@cedros/login-react 0.0.11 → 0.0.13

package/dist/utils/sanitization.d.ts

@@ -1,66 +0,0 @@
-/**
- * Input sanitization utilities for security
- */
-/**
- * Sanitizes an image URL to prevent XSS and other attacks.
- *
- * ## Security Properties
- *
- * - Only allows HTTPS URLs (prevents protocol-based attacks)
- * - Blocks javascript:, data:, vbscript:, file: protocols
- * - Returns undefined for invalid URLs
- *
- * ## Limitations (S-20/SEC-08)
- *
- * This function validates the URL protocol but does NOT validate the domain.
- * Any HTTPS URL will pass validation, including URLs from untrusted domains.
- * This is intentional - domain allowlisting is application-specific and should
- * be implemented at the consumer level (see example below).
- *
- * If your application requires domain validation (e.g., only allowing images
- * from trusted CDNs), implement additional validation:
- *
- * @example Domain allowlisting (application-level)
- * ```ts
- * const ALLOWED_DOMAINS = ['cdn.example.com', 'images.trusted.org'];
- *
- * function isAllowedImageUrl(url: string): boolean {
- *   const sanitized = sanitizeImageUrl(url);
- *   if (!sanitized) return false;
- *
- *   try {
- *     const hostname = new URL(sanitized).hostname;
- *     return ALLOWED_DOMAINS.some(d => hostname === d || hostname.endsWith('.' + d));
- *   } catch {
- *     return false;
- *   }
- * }
- * ```
- *
- * @param url - The URL to sanitize
- * @returns The sanitized URL or undefined if invalid
- *
- * @example Basic usage
- * ```ts
- * sanitizeImageUrl('https://example.com/avatar.png') // 'https://example.com/avatar.png'
- * sanitizeImageUrl('javascript:alert(1)') // undefined
- * sanitizeImageUrl('data:image/svg+xml,...') // undefined
- * ```
- */
-export declare function sanitizeImageUrl(url: string | undefined | null): string | undefined;
-/**
- * Sanitizes an external link URL for use in href attributes.
- *
- * Security goals:
- * - Block dangerous protocols (javascript:, data:, vbscript:, file:)
- * - Only allow http/https absolute URLs
- */
-export declare function sanitizeExternalUrl(url: string | undefined | null): string | undefined;
-/**
- * Sanitizes user-provided text to prevent XSS in text content.
- * Escapes HTML special characters.
- *
- * @param text - The text to sanitize
- * @returns The sanitized text
- */
-export declare function sanitizeText(text: string | undefined | null): string;

package/dist/utils/sessionApi.d.ts

@@ -1,16 +0,0 @@
-import { Session, RevokeAllSessionsResponse } from '../types';
-/**
- * API client for session management operations
- */
-export declare class SessionApiClient {
-    private client;
-    constructor(baseUrl: string, timeoutMs?: number, retryAttempts?: number, getAccessToken?: () => string | null);
-    /**
-     * List all active sessions for the current user
-     */
-    listSessions(): Promise<Session[]>;
-    /**
-     * Revoke all sessions (logout from all devices)
-     */
-    revokeAllSessions(): Promise<RevokeAllSessionsResponse>;
-}

package/dist/utils/setupApi.d.ts

@@ -1,21 +0,0 @@
-import { SetupStatusResponse, CreateFirstAdminRequest, CreateFirstAdminResponse } from '../types/setup';
-/**
- * API client for setup operations (unauthenticated)
- *
- * These endpoints are used during first-run configuration before
- * any admin user exists.
- */
-export declare class SetupApiClient {
-    private client;
-    constructor(baseUrl: string, timeoutMs?: number, retryAttempts?: number);
-    /**
-     * Check if initial setup is required
-     * Returns whether the system needs initial setup (no admin exists)
-     */
-    getStatus(): Promise<SetupStatusResponse>;
-    /**
-     * Create the first admin user
-     * Only works when no admin users exist
-     */
-    createFirstAdmin(request: CreateFirstAdminRequest): Promise<CreateFirstAdminResponse>;
-}

package/dist/utils/silentWalletEnroll.d.ts

@@ -1,41 +0,0 @@
-/**
- * Silent wallet enrollment utility
- *
- * Performs wallet enrollment in the background without UI interaction.
- * Used for auto-enrolling wallets during registration.
- *
- * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.
- * The recovery phrase is not shown - user can retrieve it later if needed.
- */
-export interface SilentEnrollOptions {
-    /** User's password for Share A encryption */
-    password: string;
-    /** Server base URL */
-    serverUrl: string;
-    /** Access token for authentication (optional if using cookies) */
-    accessToken?: string;
-    /** Request timeout in ms */
-    timeoutMs?: number;
-}
-export interface SilentEnrollResult {
-    success: boolean;
-    solanaPubkey?: string;
-    error?: string;
-}
-/**
- * Silently enroll a wallet for a user
- *
- * This function performs the complete wallet enrollment process:
- * 1. Generate 32-byte seed
- * 2. Split into 3 Shamir shares (threshold 2)
- * 3. Encrypt Share A with password-derived key (Argon2id)
- * 4. Derive Solana public key from seed
- * 5. Upload encrypted Share A + plaintext Share B to server
- *
- * The recovery phrase (Share C) is not returned - user can recover it
- * later through the wallet recovery flow if needed.
- *
- * @param options - Enrollment options
- * @returns Result with success status and Solana public key
- */
-export declare function silentWalletEnroll(options: SilentEnrollOptions): Promise<SilentEnrollResult>;

package/dist/utils/systemSettingsApi.d.ts

@@ -1,18 +0,0 @@
-import { ListSystemSettingsResponse, UpdateSettingRequest, UpdateSystemSettingsResponse } from '../types';
-/**
- * API client for system settings operations (admin only)
- */
-export declare class SystemSettingsApiClient {
-    private client;
-    constructor(baseUrl: string, timeoutMs?: number, retryAttempts?: number, getAccessToken?: () => string | null);
-    /**
-     * Get all system settings grouped by category
-     * Requires system admin privileges
-     */
-    getSettings(): Promise<ListSystemSettingsResponse>;
-    /**
-     * Update one or more system settings
-     * Requires system admin privileges
-     */
-    updateSettings(settings: UpdateSettingRequest[]): Promise<UpdateSystemSettingsResponse>;
-}

package/dist/utils/tabSync.d.ts

@@ -1,46 +0,0 @@
-import { AuthUser } from '../types';
-type AuthSyncEvent = {
-    type: 'login';
-    user: AuthUser;
-} | {
-    type: 'logout';
-} | {
-    type: 'refresh';
-};
-type AuthSyncCallback = (event: AuthSyncEvent) => void;
-/**
- * Cross-tab synchronization for auth state using BroadcastChannel
- * UI-6 FIX: Use addEventListener/removeEventListener for proper cleanup.
- */
-export declare class TabSync {
-    private channel;
-    private callback;
-    private boundHandler;
-    constructor();
-    /**
-     * Handle incoming sync messages
-     */
-    private handleMessage;
-    /**
-     * Set the callback for sync events from other tabs
-     */
-    setCallback(callback: AuthSyncCallback): void;
-    /**
-     * Broadcast login event to other tabs
-     */
-    broadcastLogin(user: AuthUser): void;
-    /**
-     * Broadcast logout event to other tabs
-     */
-    broadcastLogout(): void;
-    /**
-     * Broadcast token refresh event to other tabs
-     */
-    broadcastRefresh(): void;
-    /**
-     * Close the channel and clean up references
-     * UI-6: Use removeEventListener for proper cleanup
-     */
-    close(): void;
-}
-export {};

package/dist/utils/tokenManager.d.ts

@@ -1,107 +0,0 @@
-import { TokenPair, SessionStorage } from '../types';
-/**
- * Token manager for storing and auto-refreshing tokens
- *
- * ## Security Warning: localStorage Storage
- *
- * When using `localStorage` or `sessionStorage`, tokens are stored in the browser
- * and are **vulnerable to XSS attacks**. Any JavaScript running
- * on your page (including third-party scripts, browser extensions, or malicious
- * code injected via XSS) can read these tokens.
- *
- * **Recommendations:**
- * - Use `cookie` storage with httpOnly cookies (tokens stored server-side)
- * - If localStorage is required, implement strong Content Security Policy (CSP)
- * - Sanitize all user input and output
- * - Regularly audit third-party dependencies
- *
- * @example
- * // Recommended: cookie storage (tokens in httpOnly cookies)
- * const manager = new TokenManager('cookie');
- *
- * // Use with caution: localStorage (XSS vulnerable)
- * const manager = new TokenManager('localStorage');
- */
-export interface TokenManagerOptions {
-    /**
-     * Allow `localStorage`/`sessionStorage` token persistence.
-     *
-     * @security This is intentionally opt-in because these storage modes are vulnerable
-     * to XSS token theft.
-     */
-    allowWebStorage?: boolean;
-}
-export declare class TokenManager {
-    private storage;
-    private requestedStorage;
-    private storageKey;
-    private tokens;
-    private expiresAt;
-    private refreshTimer;
-    private onRefreshNeeded;
-    private onSessionExpired;
-    private onRefreshError;
-    private isDestroyed;
-    private allowWebStorage;
-    constructor(storage?: SessionStorage, persistKey?: string, options?: TokenManagerOptions);
-    /**
-     * S-18/UI-XSS: Warn about localStorage XSS vulnerability in all environments.
-     * Security warnings should not be suppressed in production - operators need
-     * to be aware of the security implications of their storage choices.
-     */
-    private warnIfLocalStorage;
-    /**
-     * Set the callback for when tokens need to be refreshed
-     */
-    setRefreshCallback(callback: () => Promise<void>): void;
-    /**
-     * Set the callback for when session expires
-     */
-    setSessionExpiredCallback(callback: () => void): void;
-    /**
-     * Set the callback for when token refresh fails
-     * This allows the UI to show an error message to the user
-     */
-    setRefreshErrorCallback(callback: (error: Error) => void): void;
-    /**
-     * Store tokens and schedule auto-refresh
-     */
-    setTokens(tokens: TokenPair): void;
-    /**
-     * Get the current access token
-     * UI-4 FIX: Store token in local variable before expiry check to eliminate TOCTOU race.
-     * UI-TOK-01 FIX: Check isDestroyed to prevent access after manager is cleaned up.
-     */
-    getAccessToken(): string | null;
-    /**
-     * Get the current refresh token
-     */
-    getRefreshToken(): string | null;
-    /**
-     * Clear stored tokens
-     */
-    clear(): void;
-    /**
-     * Check if tokens are stored
-     */
-    hasTokens(): boolean;
-    /**
-     * Destroy the token manager and clean up resources.
-     * Call this when unmounting components or cleaning up to prevent memory leaks.
-     * P-02: Also sets isDestroyed flag to prevent timer callbacks from executing.
-     */
-    destroy(): void;
-    /**
-     * Get time until token expiry in ms
-     */
-    getTimeUntilExpiry(): number;
-    private scheduleRefresh;
-    private cancelRefresh;
-    private loadFromStorage;
-    /**
-     * Validate that parsed data matches expected StoredTokenData structure
-     */
-    private isValidStoredTokenData;
-    private saveToStorage;
-    private clearStorage;
-}

package/dist/utils/unlockCredential.d.ts

@@ -1,5 +0,0 @@
-import { UnlockCredential, UnlockCredentialRequest } from '../types/wallet';
-/**
- * Convert UnlockCredential to API request format.
- */
-export declare function toCredentialRequest(credential: UnlockCredential): UnlockCredentialRequest;

package/dist/utils/validation.d.ts

@@ -1,48 +0,0 @@
-import { PasswordValidation } from '../types';
-/**
- * Password validation rules:
- * - Minimum 10 characters
- * - At least 1 uppercase letter (A-Z)
- * - At least 1 lowercase letter (a-z)
- * - At least 1 number (0-9)
- * - At least 1 special character (@$!%*?&#^())
- *
- * Note: All checks are performed regardless of early failures to prevent
- * timing attacks that could reveal which requirements are met.
- */
-export declare function validatePassword(password: string): PasswordValidation;
-/**
- * Validate email format with robust validation.
- *
- * Validates:
- * - Proper format with @ symbol
- * - Valid characters in local and domain parts
- * - Domain must have at least one dot (TLD required)
- * - Maximum length per RFC 5321
- *
- * UI-13: Note on case normalization - This function validates format only,
- * it does NOT normalize case. Per RFC 5321, local-part is technically
- * case-sensitive (though most providers ignore case). Callers should
- * normalize emails (e.g., toLowerCase) before API calls and storage.
- *
- * @param email - The email address to validate
- * @returns true if the email format is valid
- */
-export declare function validateEmail(email: string): boolean;
-/**
- * Validate Solana public key format.
- *
- * A valid Solana public key:
- * - Is 43-44 characters long (base58 encoding of 32 bytes)
- * - Contains only valid base58 characters
- *
- * @param publicKey - The public key string to validate
- * @returns true if the public key format is valid
- *
- * @example
- * ```ts
- * validateSolanaPublicKey('DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263') // true
- * validateSolanaPublicKey('invalid') // false
- * ```
- */
-export declare function validateSolanaPublicKey(publicKey: string): boolean;

package/dist/utils/walletDetection.d.ts

@@ -1,23 +0,0 @@
-/**
- * Wallet detection utilities for Solana browser wallets
- */
-/**
- * Detects if any Solana wallet extensions are installed in the browser.
- * Checks for common wallet adapters like Phantom, Solflare, Backpack, etc.
- *
- * @returns true if at least one Solana wallet is detected
- *
- * @example
- * ```tsx
- * if (detectSolanaWallets()) {
- *   // Show Solana login button
- * }
- * ```
- */
-export declare function detectSolanaWallets(): boolean;
-/**
- * Returns list of detected Solana wallet names (for debugging/display)
- *
- * @returns Array of detected wallet provider names
- */
-export declare function getDetectedWalletNames(): string[];

package/dist/utils/webauthnJson.d.ts

@@ -1,21 +0,0 @@
-type Base64UrlString = string;
-export declare function base64UrlToArrayBuffer(b64url: Base64UrlString): ArrayBuffer;
-export declare function arrayBufferToBase64Url(buffer: ArrayBuffer): Base64UrlString;
-export type ServerCreationOptions = {
-    publicKey: Record<string, unknown>;
-};
-export declare function parseCreationOptionsFromServer(options: ServerCreationOptions): PublicKeyCredentialCreationOptions;
-export type ServerRequestOptions = {
-    publicKey: Record<string, unknown>;
-};
-export declare function parseRequestOptionsFromServer(options: ServerRequestOptions): PublicKeyCredentialRequestOptions;
-export type PublicKeyCredentialJSON = {
-    id: string;
-    rawId: string;
-    type: string;
-    authenticatorAttachment?: string;
-    clientExtensionResults?: AuthenticationExtensionsClientOutputs;
-    response: Record<string, unknown>;
-};
-export declare function credentialToServerJson(cred: PublicKeyCredential): PublicKeyCredentialJSON;
-export {};