@calimero-network/mero-js 25.2.0 → 25.3.1

package/dist/request/proof-signer.d.ts

@@ -11,7 +11,7 @@
 export interface ProofRequest {
     /** `GET`, `POST`, … exactly as it will be sent. */
     method: string;
-    /** The URL path the node will see, **without** the query string. */
+    /** The path and query the node will see, as `signedPath` reads them. */
     path: string;
     /** The exact bytes that will be sent, if any. */
     body?: unknown;

package/dist/request/request-sig.d.ts

@@ -18,14 +18,13 @@
  * three. The node's verifier handles both, so which you produce here is a
  * question about where your key lives, not about what the node accepts.
  *
- * **What it binds.** Method, path and a hash of the body. A signature for
- * `GET /a` is not a signature for `POST /a`, for `GET /b`, or for the same call
- * with different arguments.
+ * **What it binds.** Method, path and query, and a hash of the body. A
+ * signature for `GET /a?x=1` is not a signature for `POST /a?x=1`, for
+ * `GET /a?x=2`, for `GET /b?x=1`, or for the same call with a different body.
  *
- * **The path excludes the query string**, deliberately: a proxy may legitimately
- * rewrite it — a token parameter most of all — and signing over bytes something
- * else is entitled to change means failing for reasons the caller cannot see.
- * Anything that must be bound belongs in the body.
+ * **The path includes the query string**, exactly as it goes on the request
+ * line: no re-encoding, no reordering. A proxy between you and the node must
+ * forward both unchanged, or the node refuses the proof.
  *
  * **The method is not normalized.** `HEAD` and `GET` are the same *permission*
  * and the node's permission layer folds them, but they are different requests.
@@ -43,6 +42,7 @@
  * notice this file depends on both. This module's test asserts the same vectors.
  */
 import { fromHex } from "../crypto/internal.js";
+export declare const SIGN_DOMAIN: Uint8Array;
 /**
  * Commit to a request body.
  *
@@ -59,8 +59,8 @@ export interface RequestSigInput {
      */
     method: string;
     /**
-     * The path, **without** the query string. `/admin-api/namespaces`, not
-     * `/admin-api/namespaces?token=…`.
+     * The path and query, exactly as on the request line:
+     * `/admin-api/blobs?context_id=…`. Use `signedPath` to take it from a URL.
      */
     path: string;
     /**

package/dist/request/request-sig.js

@@ -18,14 +18,13 @@
  * three. The node's verifier handles both, so which you produce here is a
  * question about where your key lives, not about what the node accepts.
  *
- * **What it binds.** Method, path and a hash of the body. A signature for
- * `GET /a` is not a signature for `POST /a`, for `GET /b`, or for the same call
- * with different arguments.
+ * **What it binds.** Method, path and query, and a hash of the body. A
+ * signature for `GET /a?x=1` is not a signature for `POST /a?x=1`, for
+ * `GET /a?x=2`, for `GET /b?x=1`, or for the same call with a different body.
  *
- * **The path excludes the query string**, deliberately: a proxy may legitimately
- * rewrite it — a token parameter most of all — and signing over bytes something
- * else is entitled to change means failing for reasons the caller cannot see.
- * Anything that must be bound belongs in the body.
+ * **The path includes the query string**, exactly as it goes on the request
+ * line: no re-encoding, no reordering. A proxy between you and the node must
+ * forward both unchanged, or the node refuses the proof.
  *
  * **The method is not normalized.** `HEAD` and `GET` are the same *permission*
  * and the node's permission layer folds them, but they are different requests.
@@ -43,7 +42,7 @@
  * notice this file depends on both. This module's test asserts the same vectors.
  */
 import { concat, domainHash, fromHex, hex, importSigningKey, u32le, u64le, } from "../crypto/internal.js";
-const SIGN_DOMAIN = new TextEncoder().encode("calimero.auth.request.v1");
+export const SIGN_DOMAIN = new TextEncoder().encode("calimero.auth.request.v2");
 /**
  * Its own domain, distinct from the signing one.
  *

package/dist/request-proof/authorizer.d.ts

@@ -13,7 +13,7 @@ export interface ProofCredential {
 /** One request, as the proof has to see it. */
 export interface RequestToAuthorize {
     method: string;
-    /** Path only — a query string is excluded from the signature by design. */
+    /** Path and query, as `signedPath` reads them from the URL being fetched. */
     path: string;
     /** The body exactly as it will be sent, if there is one. */
     body?: string | Uint8Array;
@@ -36,13 +36,6 @@ export type RequestAuthorizer = (request: RequestToAuthorize) => Promise<Record<
  * in the wrong place.
  */
 export declare function createProofAuthorizer(credential: ProofCredential): RequestAuthorizer;
-/**
- * The path a proof must be signed over, taken from a URL.
- *
- * Callers hold a base URL and a relative path; the proof commits to the path the
- * node will see, which is their join with the query dropped. Deriving it from
- * the assembled URL rather than concatenating strings is what keeps a base URL
- * carrying its own prefix (`…/admin-api`) from signing a path the node never
- * receives.
- */
+/** The path and query a proof signs, read from the parsed URL: the serialization
+ * `fetch` puts on the request line, base-URL prefix and escapes included. */
 export declare function signedPath(url: string): string;

package/dist/request-proof/authorizer.js

@@ -51,15 +51,10 @@ export function createProofAuthorizer(credential) {
         return { [REQUEST_PROOF_HEADER]: proof };
     };
 }
-/**
- * The path a proof must be signed over, taken from a URL.
- *
- * Callers hold a base URL and a relative path; the proof commits to the path the
- * node will see, which is their join with the query dropped. Deriving it from
- * the assembled URL rather than concatenating strings is what keeps a base URL
- * carrying its own prefix (`…/admin-api`) from signing a path the node never
- * receives.
- */
+/** The path and query a proof signs, read from the parsed URL: the serialization
+ * `fetch` puts on the request line, base-URL prefix and escapes included. */
 export function signedPath(url) {
-    return new URL(url).pathname;
+    // A relative URL resolves as `fetch` resolves it: against the page, if any.
+    const parsed = new URL(url, globalThis.location?.href ?? 'http://localhost');
+    return parsed.pathname + parsed.search;
 }

package/dist/request-proof/request-proof.d.ts

@@ -11,11 +11,8 @@ export interface RequestProofInput {
      */
     method: string;
     /**
-     * The path, **without** the query string.
-     *
-     * Excluded because a proxy may legitimately rewrite a query, and a signature
-     * over bytes something else may change fails for reasons the caller cannot
-     * see. Anything that must be bound belongs in the body.
+     * The path and query, exactly as on the request line, with no re-encoding or
+     * reordering. Use `signedPath` to take it from a URL.
      */
     path: string;
     /**
@@ -48,7 +45,7 @@ export interface RequestProofInput {
  *
  *   CallerProof = <account_proof bytes> || 0x00 (no session) || RequestSig
  *   RequestSig  = u32le(len method) || method
- *               || u32le(len path)  || path
+ *               || u32le(len path)  || path (with its query)
  *               || body_hash[32]
  *               || u64le(issued_at) || u64le(expires_at)
  *               || signature[64]

package/dist/request-proof/request-proof.js

@@ -24,14 +24,8 @@
  * this authenticates a caller without granting operator actions.
  */
 import { concat, domainHash, fromHex, hex, importSigningKey, u32le, u64le, } from '../crypto/internal.js';
+import { requestBodyHash, SIGN_DOMAIN } from '../request/request-sig.js';
 const utf8 = (text) => new TextEncoder().encode(text);
-/** `calimero.auth.request.v1` — what the request signature is separated by. */
-const REQUEST_SIGN_DOMAIN = utf8('calimero.auth.request.v1');
-/**
- * `calimero.auth.request.body.v1` — distinct from the signing domain so a body
- * hash can never be presented as a request signature preimage.
- */
-const REQUEST_BODY_DOMAIN = utf8('calimero.auth.request.body.v1');
 /** The header a signed request carries. */
 export const REQUEST_PROOF_HEADER = 'X-Calimero-Proof';
 /** Seconds a signature stays honourable. Short, because it bounds replay. */
@@ -47,7 +41,7 @@ const DEFAULT_VALID_FOR = 300;
  *
  *   CallerProof = <account_proof bytes> || 0x00 (no session) || RequestSig
  *   RequestSig  = u32le(len method) || method
- *               || u32le(len path)  || path
+ *               || u32le(len path)  || path (with its query)
  *               || body_hash[32]
  *               || u64le(issued_at) || u64le(expires_at)
  *               || signature[64]
@@ -59,20 +53,10 @@ export async function signRequestProof(input) {
     if (!path.startsWith('/')) {
         throw new Error(`signRequestProof needs a path, got ${JSON.stringify(path)}`);
     }
-    if (path.includes('?')) {
-        throw new Error(`the path must carry no query string, got ${JSON.stringify(path)} — ` +
-            'a query is excluded from the signature on purpose, because a proxy may ' +
-            'rewrite one. Anything that must be bound belongs in the body.');
-    }
-    const bodyBytes = input.body === undefined
-        ? new Uint8Array()
-        : typeof input.body === 'string'
-            ? utf8(input.body)
-            : input.body;
-    const bodyHash = await domainHash(REQUEST_BODY_DOMAIN, [bodyBytes]);
+    const bodyHash = await requestBodyHash(input.body);
     const issuedAt = Math.floor(input.now ?? Date.now() / 1000);
     const expiresAt = issuedAt + (input.validForSeconds ?? DEFAULT_VALID_FOR);
-    const payload = await domainHash(REQUEST_SIGN_DOMAIN, [
+    const payload = await domainHash(SIGN_DOMAIN, [
         utf8(method),
         utf8(path),
         bodyHash,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "25.2.0",
+  "version": "25.3.1",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {