@calimero-network/mero-js 29.0.0 → 29.2.0

package/dist/index.mjs

@@ -1394,6 +1394,36 @@ var ConsentStale = class extends CalimeroError {
     this.name = "ConsentStale";
   }
 };
+var OriginNotRegistered = class extends CalimeroError {
+  constructor(message, details = {}) {
+    const origin = typeof details.origin === "string" ? details.origin : "";
+    const pkg = typeof details.package === "string" ? details.package : "";
+    const site = origin ? `this site (${origin})` : "this site";
+    super(403, "ORIGIN_NOT_REGISTERED", `${site} is not registered for ${pkg || "any package"}${message ? ` (${message})` : ""}`, details);
+    this.name = "OriginNotRegistered";
+    this.origin = origin;
+    this.package = pkg;
+    this.nodeMessage = message;
+  }
+};
+var BadOrigin = class extends CalimeroError {
+  constructor(code, message, details = {}) {
+    super(400, code, message, details);
+    this.name = "BadOrigin";
+  }
+};
+var OriginTaken = class extends CalimeroError {
+  constructor(message, details = {}) {
+    super(409, "ORIGIN_TAKEN", message, details);
+    this.name = "OriginTaken";
+  }
+};
+var QuotaExceeded = class extends CalimeroError {
+  constructor(message, details = {}) {
+    super(429, "QUOTA_EXCEEDED", message, details);
+    this.name = "QuotaExceeded";
+  }
+};
 var AppError = class extends CalimeroError {
   constructor(message, details = {}) {
     super(422, "APP_ERROR", message, details);
@@ -1453,6 +1483,15 @@ function errorFrom(status, body, retryAfterHeader) {
       return new ReleaseDeadlineError(message, details);
     case "409 CONSENT_STALE":
       return new ConsentStale(message, details);
+    case "403 ORIGIN_NOT_REGISTERED":
+      return new OriginNotRegistered(message, details);
+    case "400 BAD_ORIGIN":
+    case "400 BAD_RP_ID":
+      return new BadOrigin(code, message, details);
+    case "409 ORIGIN_TAKEN":
+      return new OriginTaken(message, details);
+    case "429 QUOTA_EXCEEDED":
+      return new QuotaExceeded(message, details);
     case "412 CONFIRM_REQUIRED":
       return new ConfirmRequired(message, details);
     case "413 ARGS_TOO_LARGE":
@@ -1741,6 +1780,25 @@ var CalimeroClient = class _CalimeroClient {
     this.channels = /* @__PURE__ */ new Map();
     /** Rejections of the underlying `fetch` itself: the node could not be reached or dropped the connection. */
     this.networkFailures = /* @__PURE__ */ new WeakSet();
+    // ---------------------------------------------------------------- package origins
+    /**
+     * The web origins `{package}`'s managers registered so a frontend they host
+     * themselves can sign users in with passkeys ({@link PackageOrigins}).
+     * Adding and removing one is approved with a passkey.
+     */
+    this.packageOrigins = {
+      list: async (pkg) => {
+        const { origins } = await this.get(`package-origins/${seg(pkg)}`);
+        return origins ?? [];
+      },
+      add: (pkg, origin, passkey, options = {}) => this.confirmed(
+        "POST",
+        `package-origins/${seg(pkg)}`,
+        options.rpId === void 0 ? { origin } : { origin, rpId: options.rpId },
+        passkey
+      ),
+      remove: (pkg, origin, passkey) => this.confirmed("DELETE", `package-origins/${seg(pkg)}`, { origin }, passkey)
+    };
     const trim = (url2) => url2.replace(/\/+$/, "");
     this.nodeUrls = [...new Set([options.baseUrl, ...options.nodes ?? []].map(trim))];
     this.policy = options.policy;
@@ -1996,13 +2054,19 @@ var CalimeroClient = class _CalimeroClient {
   // ---------------------------------------------------------------- identity
   /**
    * Create an account with a new passkey, and sign in. The node then asks the
-   * new passkey to sign the account it creates (`412 CONFIRM_REQUIRED`, core
-   * #proofs-at-apply-rest), so a sign-up prompts twice: create, then sign.
+   * new passkey to sign the account it creates (`412 CONFIRM_REQUIRED`), so a
+   * sign-up prompts twice: create, then sign. On a page whose origin is not
+   * the cluster's ({@link SignInOptions}), the node makes the passkey for that
+   * origin's relying party (the confirmation's `rpId` is that origin's too)
+   * and binds the session to the package the origin is registered for; an
+   * unregistered origin is refused with {@link OriginNotRegistered}.
    */
-  async signUp(passkey, name) {
-    const begin = await this.post(
+  async signUp(passkey, name, options = {}) {
+    const origin = this.pageOrigin(options);
+    const begin = await this.begin(
       "auth/passkey/register/begin",
-      { name }
+      origin === void 0 ? { name } : { name, origin },
+      origin
     );
     const registration = await passkey.create(begin.options);
     const session = await this.postConfirmed(
@@ -2013,12 +2077,18 @@ var CalimeroClient = class _CalimeroClient {
     this.useSession(session);
     return session;
   }
-  /** Sign in with an existing passkey. */
-  async signIn(passkey) {
-    const begin = await this.post(
-      "auth/passkey/login/begin"
-    );
-    const assertion = await passkey.get(fromB64url(begin.options.challenge), begin.options.rpId);
+  /**
+   * Sign in with an existing passkey. On a page whose origin is not the
+   * cluster's ({@link SignInOptions}), the assertion is made for that
+   * origin's relying-party id, as the node answers it, and the session is
+   * bound to the origin's package; an unregistered origin is refused with
+   * {@link OriginNotRegistered}.
+   */
+  async signIn(passkey, options = {}) {
+    const origin = this.pageOrigin(options);
+    const begin = await this.begin("auth/passkey/login/begin", origin === void 0 ? void 0 : { origin }, origin);
+    const rpId = begin.options.rpId ?? begin.options.rp?.id ?? "";
+    const assertion = await passkey.get(fromB64url(begin.options.challenge), rpId);
     const session = await this.post("auth/passkey/login/finish", {
       challengeId: begin.challengeId,
       assertion
@@ -2026,6 +2096,36 @@ var CalimeroClient = class _CalimeroClient {
     this.useSession(session);
     return session;
   }
+  /**
+   * The origin a sign-up or sign-in sends: the one given, or the page's own
+   * when it is not a node's origin; `undefined` for none.
+   */
+  pageOrigin(options) {
+    if (options.origin !== void 0) return options.origin ?? void 0;
+    const page = globalThis.location?.origin;
+    if (!page || page === "null") return void 0;
+    const nodes = new Set(
+      this.nodeUrls.map((url2) => {
+        try {
+          return new URL(url2).origin;
+        } catch {
+          return url2;
+        }
+      })
+    );
+    return nodes.has(page) ? void 0 : page;
+  }
+  /** POST a ceremony's `begin`, naming the page's `origin` in an {@link OriginNotRegistered} the node leaves it out of. */
+  async begin(path, body, origin) {
+    try {
+      return await this.post(path, body);
+    } catch (error) {
+      if (error instanceof OriginNotRegistered && !error.origin && origin !== void 0) {
+        throw new OriginNotRegistered(error.nodeMessage, { ...error.details, origin });
+      }
+      throw error;
+    }
+  }
   /**
    * Swap the refresh token for a new session, on whichever node the client
    * uses: any node of the cluster takes it. A refresh token is used once, so
@@ -2068,6 +2168,7 @@ var CalimeroClient = class _CalimeroClient {
     this.auth = void 0;
     this.current = void 0;
   }
+  /** Who the credential is: the account, how it signed in, and the package (`app`) and `origin` a session is bound to. */
   me() {
     return this.get("auth/me");
   }
@@ -2122,6 +2223,12 @@ var CalimeroClient = class _CalimeroClient {
    * Create an API key for an agent or server, approved with the account's
    * `passkey` (`412 CONFIRM_REQUIRED`); needs a passkey session (an API key
    * is refused `403`). The key is returned once.
+   *
+   * `upgrades: { app, package? }` makes an upgrade key, for CI: it upgrades
+   * that one app to signed releases of its package (default: the one the app
+   * runs, by that package's pinned signer) with {@link upgradeApp} and no
+   * passkey, and every other request with it is refused
+   * `403 UPGRADE_KEY_ONLY`. It takes no other scope field.
    */
   createApiKey(options, passkey) {
     return this.postConfirmed("auth/apikeys", { ...options }, passkey);
@@ -2261,6 +2368,8 @@ var CalimeroClient = class _CalimeroClient {
    * `passkey` gives. Refused (`403`) to a session opened on an app's
    * frontend: an app asks its user with {@link requestConsent} instead. Past
    * a release deadline its approver has not met: {@link ReleaseDeadlineError}.
+   * With an upgrade key ({@link createApiKey} `upgrades`) pass no passkey and
+   * a `version` of the key's package: the key's own proof stands in for it.
    */
   upgradeApp(app, target, passkey) {
     const path = `apps/${seg(app)}/upgrade`;
@@ -3234,6 +3343,7 @@ export {
   AgentGateError,
   AppError,
   ArgsTooLarge,
+  BadOrigin,
   CalimeroClient,
   CalimeroError,
   ConfirmCancelled,
@@ -3254,7 +3364,10 @@ export {
   NODE_RELEASE_SIGNER,
   NotFound,
   ORG_CAPABILITIES,
+  OriginNotRegistered,
+  OriginTaken,
   PRODUCTION_PROFILE,
+  QuotaExceeded,
   RELEASE_VERIFIER,
   ReleaseDeadlineError,
   SEALED_CONTENT_TYPE,