@calimero-network/mero-js 27.2.0 → 27.4.0

package/dist/index.mjs

@@ -1000,6 +1000,7 @@ var NODE_RELEASE_SIGNER = Object.freeze({
 });
 var MEASUREMENTS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];
 var DEFAULT_RELEASE_MIRROR = "https://cloud.calimero.network";
+var DEFAULT_COLLATERAL_MIRROR = `${DEFAULT_RELEASE_MIRROR}/api/tee/pcs`;
 async function verifySignedNodeRelease(publishedMrtds, bundle, options = {}) {
   const body = typeof publishedMrtds === "string" ? new TextEncoder().encode(publishedMrtds) : publishedMrtds;
   await verifyCosignBundle(
@@ -1164,6 +1165,34 @@ async function releaseFor(version, policy, fetchImpl) {
   if (source === "github") return fetchGithubNodeRelease(version, { fetch: fetchImpl });
   return fetchNodeRelease(cloudNodeReleaseUrl(source ?? DEFAULT_RELEASE_MIRROR, version), { fetch: fetchImpl });
 }
+function defaultCollateral(policy) {
+  const source = policy.collateralSource ?? DEFAULT_COLLATERAL_MIRROR;
+  if (source === "intel") {
+    return async (quote) => (await dcap("getCollateralFromPcs"))(quote);
+  }
+  return async (quote) => (await dcap("getCollateral"))(source, quote);
+}
+function freshCollateral(fetch2, policy) {
+  const maxDays = policy.maxCollateralAgeDays;
+  if (maxDays === void 0) return fetch2;
+  return async (quote) => {
+    const collateral = await fetch2(quote);
+    let issued;
+    try {
+      issued = Date.parse(JSON.parse(collateral.tcb_info).issueDate ?? "");
+    } catch {
+      issued = Number.NaN;
+    }
+    if (!Number.isFinite(issued)) throw new Error("The quote's collateral names no TCB info issue date");
+    const ageDays = ((policy.now ?? Date.now)() - issued) / 864e5;
+    if (ageDays > maxDays) {
+      throw new Error(
+        `The quote's collateral was issued ${Math.floor(ageDays)} days ago, more than the ${maxDays} this client accepts`
+      );
+    }
+    return collateral;
+  };
+}
 async function verifyRelease(doc, args, policy, fetchImpl) {
   const version = claimedRelease(doc, policy.minReleaseVersion);
   const trusted = await trustSignedRelease({
@@ -1174,7 +1203,7 @@ async function verifyRelease(doc, args, policy, fetchImpl) {
     identity: policy.identity,
     issuer: policy.issuer
   });
-  const fetchCollateral = policy.fetchCollateral ?? (async (quote) => (await dcap("getCollateralFromPcs"))(quote));
+  const fetchCollateral = freshCollateral(policy.fetchCollateral ?? defaultCollateral(policy), policy);
   const verifier = createQuoteVerifier({
     dcapVerify: policy.dcapVerify ?? await dcap("verify"),
     fetchCollateral,
@@ -1463,6 +1492,17 @@ ${generation}`;
 function publisherBindingBytes(cluster, org, signerId, generation) {
   return new TextEncoder().encode(publisherBindingMessage(cluster, org, signerId, generation));
 }
+var CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+async function confirmationCode(requestId) {
+  const h = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(requestId)));
+  const word = (h[0] << 24 | h[1] << 16 | h[2] << 8 | h[3]) >>> 0;
+  let code = "";
+  for (let i = 0; i < 6; i++) {
+    if (i === 3) code += "-";
+    code += CROCKFORD[word >>> 27 - 5 * i & 31];
+  }
+  return code;
+}
 function consentReturn(href) {
   const url2 = typeof href === "string" ? new URL(href) : href;
   const requestId = url2.searchParams.get("request_id");
@@ -2236,16 +2276,34 @@ var CalimeroClient = class {
   }
   /**
    * {@link requestConsent}, then send the browser to the consent page
-   * (`navigate`, by default `window.location.assign`). Answers the request
-   * once `navigate` returns: with a popup (`url => window.open(url)`), poll it
-   * with {@link waitForConsent}.
+   * (`navigate`, by default `window.location.assign`). Pass `navigate` itself
+   * or {@link OpenConsentOptions}, whose `confirm` runs first with the node's
+   * answer so the app can show the person its `code`; when it answers `false`
+   * the page is not opened. When the node sends a `code` that is not
+   * {@link confirmationCode} of `requestId`, it throws `CalimeroError`
+   * (`CONSENT_CODE_MISMATCH`) and does not navigate. Answers the request
+   * once `navigate` returns (or `confirm` declines): with a popup
+   * (`url => window.open(url)`), poll it with {@link waitForConsent}.
    */
-  async openConsentPage(request, navigate = (url2) => {
-    const w = globalThis.window;
-    if (!w) throw new Error("no window to open the consent page in; pass `navigate`");
-    w.location.assign(url2);
-  }) {
+  async openConsentPage(request, navigateOrOptions = {}) {
+    const options = typeof navigateOrOptions === "function" ? { navigate: navigateOrOptions } : navigateOrOptions;
+    const navigate = options.navigate ?? ((url2) => {
+      const w = globalThis.window;
+      if (!w) throw new Error("no window to open the consent page in; pass `navigate`");
+      w.location.assign(url2);
+    });
     const started = await this.requestConsent(request);
+    if (started.code !== void 0) {
+      const expected = await confirmationCode(started.requestId);
+      if (started.code !== expected) {
+        throw new CalimeroError(200, "CONSENT_CODE_MISMATCH", "the consent page code does not match the request", {
+          requestId: started.requestId,
+          code: started.code,
+          expected
+        });
+      }
+    }
+    if (options.confirm && !await options.confirm(started)) return started;
     navigate(started.url);
     return started;
   }
@@ -2840,6 +2898,7 @@ export {
   ConfirmCancelled,
   ConfirmRequired,
   ConsentStale,
+  DEFAULT_COLLATERAL_MIRROR,
   DEFAULT_ORG_CAPABILITIES,
   DEFAULT_RELEASE_MIRROR,
   GITHUB_RELEASES,
@@ -2871,6 +2930,7 @@ export {
   claimedRelease,
   cloudNodeReleaseUrl,
   compareVersions,
+  confirmationCode,
   consentReturn,
   createQuoteVerifier,
   createSealedFetch,
@@ -2879,6 +2939,7 @@ export {
   fetchAttestedKey,
   fetchGithubNodeRelease,
   fetchNodeRelease,
+  freshCollateral,
   fromB64url,
   generateOwnerKey,
   orgCapabilities,