@calimero-network/mero-react 3.0.0 → 3.0.2

package/dist/index.d.cts

@@ -2,7 +2,7 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as React from 'react';
 import React__default, { CSSProperties, ReactNode } from 'react';
 import * as _calimero_network_mero_js from '@calimero-network/mero-js';
-import { MeroJs, SetMetadataRequest, AddGroupMembersRequest, CreateContextRequest, CreateGroupInNamespaceRequest, CreateNamespaceRequest, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, DeleteGroupRequest, DeleteNamespaceRequest, DetachContextFromGroupRequest, GroupContextEntry, GroupInfo, CreateGroupInvitationRequest, GroupMember, MetadataRecord, GroupUpgradeStatusResponseData, JoinGroupRequest, JoinNamespaceRequest, MigrationStatus, MigrationStatusRollup, MemberMigrationStatusEntry, MigrateMyEntriesSummary, Namespace, SubgroupEntry, NamespaceIdentity, NestGroupRequest, RegisterGroupSigningKeyRequest, RemoveGroupMembersRequest, ResyncContextRequest, RetryGroupUpgradeRequest, SetDefaultCapabilitiesRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, SseEventData, SyncGroupRequest, UnnestGroupRequest, UpdateGroupSettingsRequest, UpdateMemberRoleRequest, UpgradeGroupRequest, TokenData } from '@calimero-network/mero-js';
+import { MeroJs, TokenStore, SetMetadataRequest, AddGroupMembersRequest, CreateContextRequest, CreateGroupInNamespaceRequest, CreateNamespaceRequest, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, DeleteGroupRequest, DeleteNamespaceRequest, DetachContextFromGroupRequest, GroupContextEntry, GroupInfo, CreateGroupInvitationRequest, GroupMember, MetadataRecord, GroupUpgradeStatusResponseData, JoinGroupRequest, JoinNamespaceRequest, MigrationStatus, MigrationStatusRollup, MemberMigrationStatusEntry, MigrateMyEntriesSummary, Namespace, SubgroupEntry, NamespaceIdentity, NestGroupRequest, RegisterGroupSigningKeyRequest, RemoveGroupMembersRequest, ResyncContextRequest, RetryGroupUpgradeRequest, SetDefaultCapabilitiesRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, SseEventData, SyncGroupRequest, UnnestGroupRequest, UpdateGroupSettingsRequest, UpdateMemberRoleRequest, UpgradeGroupRequest, TokenData } from '@calimero-network/mero-js';
 export * from '@calimero-network/mero-js';
 export { CAPABILITIES, MetadataRecord, hasCap, withCap, withoutCap } from '@calimero-network/mero-js';
 
@@ -129,13 +129,32 @@ interface MeroProviderConfig {
     registryUrl?: string;
     /** Request timeout in milliseconds */
     timeoutMs?: number;
+    /**
+     * Origins the OAuth callback is allowed to authenticate against. Defends
+     * against a malicious `node_url` in the callback URL (token exfiltration):
+     * the node login was initiated with is always trusted, and this allowlist
+     * additionally permits direct-callback entry to known nodes. When neither is
+     * available (no initiated node and no allowlist) a callback node_url is
+     * rejected and a security error is logged.
+     */
+    allowedNodeUrls?: string[];
+    /**
+     * Token store for access/refresh tokens. Defaults to a localStorage-backed
+     * store that persists across reloads.
+     *
+     * SECURITY: localStorage tokens — including the refresh token — are readable
+     * by any script on the page, so an XSS bug can exfiltrate them. For sensitive
+     * deployments pass a `MemoryTokenStore` (session-only) or a store backed by an
+     * HttpOnly cookie set by your auth service.
+     */
+    tokenStore?: TokenStore;
 }
 
 declare const MeroContext: React__default.Context<MeroContextValue | null>;
 interface MeroProviderProps extends MeroProviderConfig {
     children: React__default.ReactNode;
 }
-declare function MeroProvider({ children, mode, packageName, packageVersion, registryUrl, timeoutMs, }: MeroProviderProps): react_jsx_runtime.JSX.Element;
+declare function MeroProvider({ children, mode, packageName, packageVersion, registryUrl, timeoutMs, allowedNodeUrls, tokenStore: tokenStoreProp, }: MeroProviderProps): react_jsx_runtime.JSX.Element;
 declare function useMero(): MeroContextValue;
 
 /**

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as React from 'react';
 import React__default, { CSSProperties, ReactNode } from 'react';
 import * as _calimero_network_mero_js from '@calimero-network/mero-js';
-import { MeroJs, SetMetadataRequest, AddGroupMembersRequest, CreateContextRequest, CreateGroupInNamespaceRequest, CreateNamespaceRequest, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, DeleteGroupRequest, DeleteNamespaceRequest, DetachContextFromGroupRequest, GroupContextEntry, GroupInfo, CreateGroupInvitationRequest, GroupMember, MetadataRecord, GroupUpgradeStatusResponseData, JoinGroupRequest, JoinNamespaceRequest, MigrationStatus, MigrationStatusRollup, MemberMigrationStatusEntry, MigrateMyEntriesSummary, Namespace, SubgroupEntry, NamespaceIdentity, NestGroupRequest, RegisterGroupSigningKeyRequest, RemoveGroupMembersRequest, ResyncContextRequest, RetryGroupUpgradeRequest, SetDefaultCapabilitiesRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, SseEventData, SyncGroupRequest, UnnestGroupRequest, UpdateGroupSettingsRequest, UpdateMemberRoleRequest, UpgradeGroupRequest, TokenData } from '@calimero-network/mero-js';
+import { MeroJs, TokenStore, SetMetadataRequest, AddGroupMembersRequest, CreateContextRequest, CreateGroupInNamespaceRequest, CreateNamespaceRequest, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, DeleteGroupRequest, DeleteNamespaceRequest, DetachContextFromGroupRequest, GroupContextEntry, GroupInfo, CreateGroupInvitationRequest, GroupMember, MetadataRecord, GroupUpgradeStatusResponseData, JoinGroupRequest, JoinNamespaceRequest, MigrationStatus, MigrationStatusRollup, MemberMigrationStatusEntry, MigrateMyEntriesSummary, Namespace, SubgroupEntry, NamespaceIdentity, NestGroupRequest, RegisterGroupSigningKeyRequest, RemoveGroupMembersRequest, ResyncContextRequest, RetryGroupUpgradeRequest, SetDefaultCapabilitiesRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, SseEventData, SyncGroupRequest, UnnestGroupRequest, UpdateGroupSettingsRequest, UpdateMemberRoleRequest, UpgradeGroupRequest, TokenData } from '@calimero-network/mero-js';
 export * from '@calimero-network/mero-js';
 export { CAPABILITIES, MetadataRecord, hasCap, withCap, withoutCap } from '@calimero-network/mero-js';
 
@@ -129,13 +129,32 @@ interface MeroProviderConfig {
     registryUrl?: string;
     /** Request timeout in milliseconds */
     timeoutMs?: number;
+    /**
+     * Origins the OAuth callback is allowed to authenticate against. Defends
+     * against a malicious `node_url` in the callback URL (token exfiltration):
+     * the node login was initiated with is always trusted, and this allowlist
+     * additionally permits direct-callback entry to known nodes. When neither is
+     * available (no initiated node and no allowlist) a callback node_url is
+     * rejected and a security error is logged.
+     */
+    allowedNodeUrls?: string[];
+    /**
+     * Token store for access/refresh tokens. Defaults to a localStorage-backed
+     * store that persists across reloads.
+     *
+     * SECURITY: localStorage tokens — including the refresh token — are readable
+     * by any script on the page, so an XSS bug can exfiltrate them. For sensitive
+     * deployments pass a `MemoryTokenStore` (session-only) or a store backed by an
+     * HttpOnly cookie set by your auth service.
+     */
+    tokenStore?: TokenStore;
 }
 
 declare const MeroContext: React__default.Context<MeroContextValue | null>;
 interface MeroProviderProps extends MeroProviderConfig {
     children: React__default.ReactNode;
 }
-declare function MeroProvider({ children, mode, packageName, packageVersion, registryUrl, timeoutMs, }: MeroProviderProps): react_jsx_runtime.JSX.Element;
+declare function MeroProvider({ children, mode, packageName, packageVersion, registryUrl, timeoutMs, allowedNodeUrls, tokenStore: tokenStoreProp, }: MeroProviderProps): react_jsx_runtime.JSX.Element;
 declare function useMero(): MeroContextValue;
 
 /**

package/dist/index.js

@@ -1,5 +1,5 @@
-import { createContext, useState, useRef, useCallback, useEffect, useMemo, useContext } from 'react';
-import { parseAuthCallback, MeroJs, buildAuthLoginUrl, compareSemver, LocalStorageTokenStore } from '@calimero-network/mero-js';
+import { createContext, useMemo, useState, useRef, useCallback, useEffect, useContext } from 'react';
+import { LocalStorageTokenStore, parseAuthCallback, MeroJs, buildAuthLoginUrl, compareSemver } from '@calimero-network/mero-js';
 export * from '@calimero-network/mero-js';
 export { CAPABILITIES, hasCap, withCap, withoutCap } from '@calimero-network/mero-js';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
@@ -45,6 +45,28 @@ var ConnectionType = /* @__PURE__ */ ((ConnectionType2) => {
   return ConnectionType2;
 })(ConnectionType || {});
 
+// src/auth/node-trust.ts
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
+function resolveTrustedNodeUrl(params) {
+  const { candidate, initiated, allowedNodeUrls } = params;
+  if (!candidate) {
+    return { url: initiated ?? null, rejected: false };
+  }
+  if (initiated) {
+    return sameOrigin(candidate, initiated) ? { url: candidate, rejected: false } : { url: null, rejected: true };
+  }
+  if (allowedNodeUrls && allowedNodeUrls.length > 0) {
+    return allowedNodeUrls.some((u) => sameOrigin(candidate, u)) ? { url: candidate, rejected: false } : { url: null, rejected: true };
+  }
+  return { url: null, rejected: true };
+}
+
 // src/storage/index.ts
 var STORAGE_KEYS = {
   ACCESS_TOKEN: "mero:access_token",
@@ -175,13 +197,6 @@ function clearAllStorage() {
 }
 var MeroContext = createContext(null);
 var isBrowser = typeof window !== "undefined";
-var _tokenStore = null;
-function getTokenStore() {
-  if (!_tokenStore) {
-    _tokenStore = new LocalStorageTokenStore();
-  }
-  return _tokenStore;
-}
 function getPermissionsForMode(mode) {
   switch (mode) {
     case "single-context" /* SingleContext */:
@@ -215,8 +230,14 @@ function MeroProvider({
   packageName,
   packageVersion,
   registryUrl,
-  timeoutMs = 3e4
+  timeoutMs = 3e4,
+  allowedNodeUrls,
+  tokenStore: tokenStoreProp
 }) {
+  const tokenStore = useMemo(
+    () => tokenStoreProp ?? new LocalStorageTokenStore(),
+    [tokenStoreProp]
+  );
   const [mero, setMero] = useState(null);
   const [isAuthenticated, setIsAuthenticated] = useState(false);
   const [isOnline, setIsOnline] = useState(true);
@@ -239,13 +260,13 @@ function MeroProvider({
       }
       const instance = new MeroJs({
         baseUrl: url,
-        tokenStore: getTokenStore(),
+        tokenStore,
         timeoutMs
       });
       meroRef.current = instance;
       return instance;
     },
-    [timeoutMs]
+    [timeoutMs, tokenStore]
   );
   const checkAuth = useCallback(async (instance) => {
     try {
@@ -279,6 +300,7 @@ function MeroProvider({
       meroRef.current.clearToken();
       meroRef.current.close();
     }
+    tokenStore.clear();
     clearAllStorage();
     setMero(null);
     setIsAuthenticated(false);
@@ -287,39 +309,50 @@ function MeroProvider({
     setContextIdState(null);
     setContextIdentityState(null);
     meroRef.current = null;
-  }, []);
+  }, [tokenStore]);
   useEffect(() => {
     let active = true;
     const init = async () => {
       const callback = callbackRef.current;
+      let nodeFromCallback = null;
       if (callback) {
-        getTokenStore().setTokens({
-          access_token: callback.accessToken,
-          refresh_token: callback.refreshToken,
-          expires_at: parseJwtExpiry(callback.accessToken)
+        const { url, rejected } = resolveTrustedNodeUrl({
+          candidate: callback.nodeUrl,
+          initiated: getNodeUrl(),
+          allowedNodeUrls
         });
-        if (callback.applicationId) {
-          setApplicationId(callback.applicationId);
-          if (active) setApplicationIdState(callback.applicationId);
-        }
-        if (callback.contextId) {
-          setContextId(callback.contextId);
-          if (active) setContextIdState(callback.contextId);
-        }
-        if (callback.contextIdentity) {
-          setContextIdentity(callback.contextIdentity);
-          if (active) setContextIdentityState(callback.contextIdentity);
-        }
-        if (callback.nodeUrl) {
-          setNodeUrl(callback.nodeUrl);
-          if (active) setNodeUrlState(callback.nodeUrl);
-        }
         if (isBrowser) {
           window.history.replaceState({}, "", window.location.pathname + window.location.search);
         }
         callbackRef.current = null;
+        if (rejected) {
+          console.error(
+            "[MeroProvider] OAuth callback node_url is not trusted (it does not match the node login was initiated with, nor `allowedNodeUrls`). Ignoring the callback; no tokens stored."
+          );
+        } else if (url) {
+          tokenStore.setTokens({
+            access_token: callback.accessToken,
+            refresh_token: callback.refreshToken,
+            expires_at: parseJwtExpiry(callback.accessToken)
+          });
+          if (callback.applicationId) {
+            setApplicationId(callback.applicationId);
+            if (active) setApplicationIdState(callback.applicationId);
+          }
+          if (callback.contextId) {
+            setContextId(callback.contextId);
+            if (active) setContextIdState(callback.contextId);
+          }
+          if (callback.contextIdentity) {
+            setContextIdentity(callback.contextIdentity);
+            if (active) setContextIdentityState(callback.contextIdentity);
+          }
+          setNodeUrl(url);
+          if (active) setNodeUrlState(url);
+          nodeFromCallback = url;
+        }
       }
-      const savedUrl = callback?.nodeUrl || getNodeUrl();
+      const savedUrl = nodeFromCallback || getNodeUrl();
       if (!savedUrl) {
         if (active) setIsLoading(false);
         return;
@@ -331,7 +364,7 @@ function MeroProvider({
         setMero(instance);
         setIsAuthenticated(true);
         setIsOnline(true);
-      } else if (callback) {
+      } else if (nodeFromCallback) {
         setMero(instance);
       }
       setIsLoading(false);
@@ -343,7 +376,7 @@ function MeroProvider({
     return () => {
       active = false;
     };
-  }, [createMeroInstance, checkAuth]);
+  }, [createMeroInstance, checkAuth, allowedNodeUrls, tokenStore]);
   useEffect(() => {
     if (!isAuthenticated || !meroRef.current) return;
     let active = true;
@@ -2187,7 +2220,9 @@ function useGroupUpgradeStatus(groupId) {
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState(null);
   const mountedRef = useMountedRef();
+  const reqRef = useRef(0);
   const refetch = useCallback(async () => {
+    const seq = ++reqRef.current;
     if (!mero || !groupId) {
       if (mountedRef.current) {
         setUpgradeStatus(null);
@@ -2202,20 +2237,25 @@ function useGroupUpgradeStatus(groupId) {
     }
     try {
       const result = await mero.admin.getGroupUpgradeStatus(groupId);
-      if (mountedRef.current) {
+      if (mountedRef.current && seq === reqRef.current) {
         setUpgradeStatus(result);
       }
     } catch (err) {
       const errorValue = toError(err);
-      if (mountedRef.current) {
+      if (mountedRef.current && seq === reqRef.current) {
         setError(errorValue);
       }
     } finally {
-      if (mountedRef.current) {
+      if (mountedRef.current && seq === reqRef.current) {
         setLoading(false);
       }
     }
   }, [groupId, mero, mountedRef]);
+  useEffect(() => {
+    reqRef.current += 1;
+    setUpgradeStatus(null);
+    setError(null);
+  }, [groupId]);
   useEffect(() => {
     void refetch();
   }, [refetch]);
@@ -2500,6 +2540,11 @@ function useMyAuthoredMigration(contextId) {
     } catch {
     }
   }, [mero, contextId, mountedRef]);
+  useEffect(() => {
+    reqRef.current += 1;
+    setPendingCount(0);
+    setSummary(null);
+  }, [contextId]);
   useEffect(() => {
     void refresh();
   }, [refresh]);