@calimero-network/mero-js 25.3.1 → 25.3.3

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export * from "./auth-api/index.js";
 export * from "./admin-api/index.js";
 export * from "./errors/index.js";
 export { parseAuthCallback, buildAuthLoginUrl } from "./auth/index.js";
-export type { AuthCallbackResult, AuthLoginOptions } from "./auth/index.js";
+export type { AuthCallbackResult, AuthLoginOptions, ParseAuthCallbackOptions, } from "./auth/index.js";
 export { MemoryTokenStore, LocalStorageTokenStore, } from "./token-store/index.js";
 export type { TokenStore } from "./token-store/index.js";
 export { RpcClient, RpcError } from "./rpc/index.js";

package/dist/index.mjs

@@ -2684,8 +2684,73 @@ function createAdminApiClientFromHttpClient(httpClient, _config) {
   return new AdminApiClient(httpClient);
 }
 
+// src/cloud/link-state.ts
+var KEY = "calimero.cloud.link.pending";
+var STATE_PARAM = "link_state";
+var LIFETIME_MS = 10 * 60 * 1e3;
+var ACCOUNT_HEX = /^[0-9a-f]{64}$/;
+var MAX_PENDING = 20;
+function readPending(key, now) {
+  try {
+    const raw = localStorage.getItem(key);
+    const pending = raw ? JSON.parse(raw) : {};
+    return Object.fromEntries(
+      Object.entries(pending).filter(
+        ([, p]) => p && typeof p.expiresAt === "number" && p.expiresAt > now
+      )
+    );
+  } catch {
+    return {};
+  }
+}
+function writePending(key, pending) {
+  try {
+    localStorage.setItem(key, JSON.stringify(pending));
+  } catch {
+  }
+}
+function beginState(key, payload) {
+  const now = Date.now();
+  const pending = readPending(key, now);
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  const state = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join(
+    ""
+  );
+  pending[state] = { ...payload, expiresAt: now + LIFETIME_MS };
+  writePending(key, Object.fromEntries(Object.entries(pending).slice(-MAX_PENDING)));
+  return state;
+}
+function takeState(key, state) {
+  const pending = readPending(key, Date.now());
+  if (!state || !Object.prototype.hasOwnProperty.call(pending, state))
+    return null;
+  const entry = pending[state];
+  delete pending[state];
+  writePending(key, pending);
+  return entry;
+}
+function beginLinkState(account, returnTo) {
+  if (!ACCOUNT_HEX.test(account)) {
+    throw new Error("accountId must be 64 lowercase hex characters");
+  }
+  const url2 = new URL(returnTo);
+  url2.searchParams.set(STATE_PARAM, beginState(KEY, { account }));
+  return url2.toString();
+}
+function takeLinkState(search) {
+  return takeState(KEY, new URLSearchParams(search).get(STATE_PARAM));
+}
+function withoutLinkState(search) {
+  const params = new URLSearchParams(search);
+  params.delete(STATE_PARAM);
+  const rest = params.toString();
+  return rest ? `?${rest}` : "";
+}
+
 // src/auth/index.ts
-function parseAuthCallback(url2) {
+var PENDING_KEY = "calimero.auth.login.pending";
+var STATE_PARAM2 = "auth_state";
+function parseAuthCallback(url2, options = {}) {
   try {
     const hashIndex = url2.indexOf("#");
     if (hashIndex === -1) return null;
@@ -2693,6 +2758,12 @@ function parseAuthCallback(url2) {
     const params = new URLSearchParams(hash);
     const accessToken = params.get("access_token");
     if (!accessToken) return null;
+    if (!options.allowUnsolicited && !takeState(PENDING_KEY, stateOf(url2, hashIndex))) {
+      console.warn(
+        "[mero-js] ignoring auth callback tokens: they answer no login begun in this browser"
+      );
+      return null;
+    }
     return {
       accessToken,
       refreshToken: params.get("refresh_token") ?? "",
@@ -2705,9 +2776,16 @@ function parseAuthCallback(url2) {
     return null;
   }
 }
+function stateOf(url2, hashIndex) {
+  const queryIndex = url2.indexOf("?");
+  if (queryIndex === -1 || queryIndex > hashIndex) return null;
+  return new URLSearchParams(url2.substring(queryIndex + 1, hashIndex)).get(STATE_PARAM2);
+}
 function buildAuthLoginUrl(nodeUrl, opts) {
+  const callback = new URL(opts.callbackUrl);
+  callback.searchParams.set(STATE_PARAM2, beginState(PENDING_KEY, {}));
   const params = new URLSearchParams();
-  params.set("callback-url", opts.callbackUrl);
+  params.set("callback-url", callback.toString());
   if (opts.permissions && opts.permissions.length > 0) {
     params.set("permissions", opts.permissions.join(","));
   }
@@ -2950,7 +3028,8 @@ var SseClient = class {
       return;
     }
     this.closed = false;
-    this.abortController = new AbortController();
+    const controller = new AbortController();
+    this.abortController = controller;
     try {
       const url2 = `${this.baseUrl}/sse`;
       const headers = {
@@ -2960,7 +3039,7 @@ var SseClient = class {
       const proofAttached = carriesProof(headers);
       const response = await this.fetchImpl(url2, {
         headers,
-        signal: this.abortController.signal,
+        signal: controller.signal,
         ...proofAttached && { redirect: "manual" }
       });
       if (proofAttached) refuseProofRedirect(response, url2);
@@ -2988,21 +3067,31 @@ var SseClient = class {
       if (!response.body) {
         throw new Error("SSE response has no body");
       }
-      this.readStream(response.body).catch((err) => {
-        if (this.closed) return;
+      this.readStream(response.body, controller).catch((err) => {
+        if (this.superseded(controller)) return;
         const error = err instanceof Error ? err : new Error(String(err));
         this.emit("error", error);
         this.scheduleReconnect();
       });
     } catch (err) {
-      if (this.closed) return;
+      if (this.superseded(controller)) return;
       const error = err instanceof Error ? err : new Error(String(err));
       this.emit("error", error);
       if (error instanceof AuthRevokedError) return;
       this.scheduleReconnect();
     }
   }
-  async readStream(body) {
+  /**
+   * Whether `controller`'s connection is no longer the one this client holds:
+   * closed, or replaced by a later connect. Its abort lands asynchronously,
+   * after a `close()` + `connect()` has already cleared `closed`, so `closed`
+   * alone cannot tell; reporting it, and reconnecting for it, would abort the
+   * live connection, whose own abort would do the same, without end.
+   */
+  superseded(controller) {
+    return this.closed || controller.signal.aborted || this.abortController !== controller;
+  }
+  async readStream(body, controller) {
     const reader = body.getReader();
     const decoder = new TextDecoder();
     let buffer = "";
@@ -3030,11 +3119,11 @@ var SseClient = class {
         }
       }
     } catch (err) {
-      if (this.closed) return;
+      if (this.superseded(controller)) return;
       const error = err instanceof Error ? err : new Error(String(err));
       this.emit("error", error);
     }
-    if (!this.closed) {
+    if (!this.superseded(controller)) {
       this.scheduleReconnect();
     }
   }
@@ -9123,12 +9212,12 @@ function createMeroClient(config) {
 }
 
 // src/account/session.ts
-var KEY = "calimero.delegated.connection";
+var KEY2 = "calimero.delegated.connection";
 var CREDENTIAL_KEY = "calimero.delegated.credential";
 function readDelegatedSession() {
   if (typeof sessionStorage === "undefined") return null;
   try {
-    const raw = sessionStorage.getItem(KEY);
+    const raw = sessionStorage.getItem(KEY2);
     return raw ? JSON.parse(raw) : null;
   } catch {
     return null;
@@ -9136,13 +9225,13 @@ function readDelegatedSession() {
 }
 function saveDelegatedSession(s) {
   try {
-    sessionStorage.setItem(KEY, JSON.stringify(s));
+    sessionStorage.setItem(KEY2, JSON.stringify(s));
   } catch {
   }
 }
 function clearDelegatedSession() {
   try {
-    sessionStorage.removeItem(KEY);
+    sessionStorage.removeItem(KEY2);
   } catch {
   }
 }
@@ -9940,64 +10029,6 @@ function base643(bytes) {
   return btoa(binary);
 }
 
-// src/cloud/link-state.ts
-var KEY2 = "calimero.cloud.link.pending";
-var STATE_PARAM = "link_state";
-var LIFETIME_MS = 10 * 60 * 1e3;
-var ACCOUNT_HEX = /^[0-9a-f]{64}$/;
-var MAX_PENDING = 20;
-function readPending(now) {
-  try {
-    const raw = localStorage.getItem(KEY2);
-    const pending = raw ? JSON.parse(raw) : {};
-    return Object.fromEntries(
-      Object.entries(pending).filter(
-        ([, p]) => p && typeof p.expiresAt === "number" && p.expiresAt > now
-      )
-    );
-  } catch {
-    return {};
-  }
-}
-function writePending(pending) {
-  try {
-    localStorage.setItem(KEY2, JSON.stringify(pending));
-  } catch {
-  }
-}
-function beginLinkState(account, returnTo) {
-  if (!ACCOUNT_HEX.test(account)) {
-    throw new Error("accountId must be 64 lowercase hex characters");
-  }
-  const url2 = new URL(returnTo);
-  const now = Date.now();
-  const pending = readPending(now);
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
-  const state = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join(
-    ""
-  );
-  pending[state] = { account, expiresAt: now + LIFETIME_MS };
-  writePending(Object.fromEntries(Object.entries(pending).slice(-MAX_PENDING)));
-  url2.searchParams.set(STATE_PARAM, state);
-  return url2.toString();
-}
-function takeLinkState(search) {
-  const state = new URLSearchParams(search).get(STATE_PARAM);
-  const pending = readPending(Date.now());
-  if (!state || !Object.prototype.hasOwnProperty.call(pending, state))
-    return null;
-  const entry = pending[state];
-  delete pending[state];
-  writePending(pending);
-  return entry;
-}
-function withoutLinkState(search) {
-  const params = new URLSearchParams(search);
-  params.delete(STATE_PARAM);
-  const rest = params.toString();
-  return rest ? `?${rest}` : "";
-}
-
 // src/cloud/link-redirect.ts
 var DEFAULT_CLOUD_WEB_URL = "https://cloud.calimero.network";
 function cloudLinkUrl(options) {
@@ -10054,7 +10085,8 @@ async function completeCloudLink(options) {
 var DEVICE_PARAM = "enrol-device";
 var KEM_PARAM = "enrol-kem";
 var CALLBACK_PARAM = "callback-url";
-var STATE_PARAM2 = "state";
+var STATE_PARAM3 = "state";
+var PENDING_KEY2 = "calimero.device.enrol.pending";
 function deviceEnrolmentUrl(options) {
   assertHex(options.devicePublicKey, "devicePublicKey");
   assertHex(options.kemPublicKey, "kemPublicKey");
@@ -10064,7 +10096,7 @@ function deviceEnrolmentUrl(options) {
   url2.searchParams.set(DEVICE_PARAM, options.devicePublicKey);
   url2.searchParams.set(KEM_PARAM, options.kemPublicKey);
   url2.searchParams.set(CALLBACK_PARAM, options.returnTo);
-  if (options.state) url2.searchParams.set(STATE_PARAM2, options.state);
+  url2.searchParams.set(STATE_PARAM3, beginState(PENDING_KEY2, {}));
   return url2.toString();
 }
 function beginDeviceEnrolment(options) {
@@ -10075,6 +10107,7 @@ function readEnrolmentCallback(location2 = window.location) {
   const params = new URLSearchParams(location2.hash.replace(/^#/, ""));
   const error = params.get("error");
   if (error) {
+    takeState(PENDING_KEY2, params.get(STATE_PARAM3));
     stripFragment2();
     throw new Error(
       error === "denied" || error === "cancelled" ? "the device was not approved at the wallet" : `the wallet refused this enrolment: ${error}`
@@ -10093,9 +10126,9 @@ function stripFragment2() {
   history.replaceState(null, "", location.pathname + location.search);
 }
 async function completeDeviceEnrolment(options) {
-  if (options.expectState !== void 0 && options.expectState !== options.state) {
+  if (!takeState(PENDING_KEY2, options.state)) {
     throw new Error(
-      "this enrolment answers a request this app did not make \u2014 the state it carries is not the one sent"
+      "this enrolment answers a request this app did not make - start the enrolment again from here"
     );
   }
   const certificate = await verifyDeviceCredential(options.credential);
@@ -12488,8 +12521,8 @@ var MeroJs = class {
   /**
    * Parse an auth callback URL hash fragment (static utility)
    */
-  static parseAuthCallback(url2) {
-    return parseAuthCallback(url2);
+  static parseAuthCallback(url2, options) {
+    return parseAuthCallback(url2, options);
   }
   /**
    * Build an auth login URL (static utility)