@calimero-network/mero-react 3.0.1 → 3.0.2

package/dist/index.cjs

@@ -45,6 +45,28 @@ var ConnectionType = /* @__PURE__ */ ((ConnectionType2) => {
   return ConnectionType2;
 })(ConnectionType || {});
 
+// src/auth/node-trust.ts
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
+function resolveTrustedNodeUrl(params) {
+  const { candidate, initiated, allowedNodeUrls } = params;
+  if (!candidate) {
+    return { url: initiated ?? null, rejected: false };
+  }
+  if (initiated) {
+    return sameOrigin(candidate, initiated) ? { url: candidate, rejected: false } : { url: null, rejected: true };
+  }
+  if (allowedNodeUrls && allowedNodeUrls.length > 0) {
+    return allowedNodeUrls.some((u) => sameOrigin(candidate, u)) ? { url: candidate, rejected: false } : { url: null, rejected: true };
+  }
+  return { url: null, rejected: true };
+}
+
 // src/storage/index.ts
 var STORAGE_KEYS = {
   ACCESS_TOKEN: "mero:access_token",
@@ -175,13 +197,6 @@ function clearAllStorage() {
 }
 var MeroContext = react.createContext(null);
 var isBrowser = typeof window !== "undefined";
-var _tokenStore = null;
-function getTokenStore() {
-  if (!_tokenStore) {
-    _tokenStore = new meroJs.LocalStorageTokenStore();
-  }
-  return _tokenStore;
-}
 function getPermissionsForMode(mode) {
   switch (mode) {
     case "single-context" /* SingleContext */:
@@ -215,8 +230,14 @@ function MeroProvider({
   packageName,
   packageVersion,
   registryUrl,
-  timeoutMs = 3e4
+  timeoutMs = 3e4,
+  allowedNodeUrls,
+  tokenStore: tokenStoreProp
 }) {
+  const tokenStore = react.useMemo(
+    () => tokenStoreProp ?? new meroJs.LocalStorageTokenStore(),
+    [tokenStoreProp]
+  );
   const [mero, setMero] = react.useState(null);
   const [isAuthenticated, setIsAuthenticated] = react.useState(false);
   const [isOnline, setIsOnline] = react.useState(true);
@@ -239,13 +260,13 @@ function MeroProvider({
       }
       const instance = new meroJs.MeroJs({
         baseUrl: url,
-        tokenStore: getTokenStore(),
+        tokenStore,
         timeoutMs
       });
       meroRef.current = instance;
       return instance;
     },
-    [timeoutMs]
+    [timeoutMs, tokenStore]
   );
   const checkAuth = react.useCallback(async (instance) => {
     try {
@@ -279,6 +300,7 @@ function MeroProvider({
       meroRef.current.clearToken();
       meroRef.current.close();
     }
+    tokenStore.clear();
     clearAllStorage();
     setMero(null);
     setIsAuthenticated(false);
@@ -287,39 +309,50 @@ function MeroProvider({
     setContextIdState(null);
     setContextIdentityState(null);
     meroRef.current = null;
-  }, []);
+  }, [tokenStore]);
   react.useEffect(() => {
     let active = true;
     const init = async () => {
       const callback = callbackRef.current;
+      let nodeFromCallback = null;
       if (callback) {
-        getTokenStore().setTokens({
-          access_token: callback.accessToken,
-          refresh_token: callback.refreshToken,
-          expires_at: parseJwtExpiry(callback.accessToken)
+        const { url, rejected } = resolveTrustedNodeUrl({
+          candidate: callback.nodeUrl,
+          initiated: getNodeUrl(),
+          allowedNodeUrls
         });
-        if (callback.applicationId) {
-          setApplicationId(callback.applicationId);
-          if (active) setApplicationIdState(callback.applicationId);
-        }
-        if (callback.contextId) {
-          setContextId(callback.contextId);
-          if (active) setContextIdState(callback.contextId);
-        }
-        if (callback.contextIdentity) {
-          setContextIdentity(callback.contextIdentity);
-          if (active) setContextIdentityState(callback.contextIdentity);
-        }
-        if (callback.nodeUrl) {
-          setNodeUrl(callback.nodeUrl);
-          if (active) setNodeUrlState(callback.nodeUrl);
-        }
         if (isBrowser) {
           window.history.replaceState({}, "", window.location.pathname + window.location.search);
         }
         callbackRef.current = null;
+        if (rejected) {
+          console.error(
+            "[MeroProvider] OAuth callback node_url is not trusted (it does not match the node login was initiated with, nor `allowedNodeUrls`). Ignoring the callback; no tokens stored."
+          );
+        } else if (url) {
+          tokenStore.setTokens({
+            access_token: callback.accessToken,
+            refresh_token: callback.refreshToken,
+            expires_at: parseJwtExpiry(callback.accessToken)
+          });
+          if (callback.applicationId) {
+            setApplicationId(callback.applicationId);
+            if (active) setApplicationIdState(callback.applicationId);
+          }
+          if (callback.contextId) {
+            setContextId(callback.contextId);
+            if (active) setContextIdState(callback.contextId);
+          }
+          if (callback.contextIdentity) {
+            setContextIdentity(callback.contextIdentity);
+            if (active) setContextIdentityState(callback.contextIdentity);
+          }
+          setNodeUrl(url);
+          if (active) setNodeUrlState(url);
+          nodeFromCallback = url;
+        }
       }
-      const savedUrl = callback?.nodeUrl || getNodeUrl();
+      const savedUrl = nodeFromCallback || getNodeUrl();
       if (!savedUrl) {
         if (active) setIsLoading(false);
         return;
@@ -331,7 +364,7 @@ function MeroProvider({
         setMero(instance);
         setIsAuthenticated(true);
         setIsOnline(true);
-      } else if (callback) {
+      } else if (nodeFromCallback) {
         setMero(instance);
       }
       setIsLoading(false);
@@ -343,7 +376,7 @@ function MeroProvider({
     return () => {
       active = false;
     };
-  }, [createMeroInstance, checkAuth]);
+  }, [createMeroInstance, checkAuth, allowedNodeUrls, tokenStore]);
   react.useEffect(() => {
     if (!isAuthenticated || !meroRef.current) return;
     let active = true;