@cubist-labs/cubesigner-sdk 0.4.228 → 0.4.229

package/package.json

@@ -5,7 +5,7 @@
     "url": "git+https://github.com/cubist-labs/CubeSigner-TypeScript-SDK.git",
     "directory": "packages/sdk"
   },
-  "version": "0.4.228",
+  "version": "0.4.229",
   "description": "CubeSigner TypeScript SDK",
   "license": "MIT OR Apache-2.0",
   "author": "Cubist, Inc.",

package/src/client/api_client.ts

@@ -66,6 +66,7 @@ import type {
   RoleInfoJwt,
   KeyAttestationQuery,
   RoleAttestationQuery,
+  ErrorResponse,
 } from "../schema_types";
 import { encodeToBase64 } from "../util";
 import {
@@ -82,74 +83,75 @@ import { Page, Paginator } from "../paginator";
 import type { KeyPolicy } from "../role";
 import { loadSubtleCrypto } from "../user_export";
 import type * as policy from "../policy";
-import type {
-  AddIdentityRequest,
-  AvaChain,
-  EnvInterface,
-  EotsCreateNonceRequest,
-  EotsCreateNonceResponse,
-  EotsSignRequest,
-  EotsSignResponse,
-  JrpcResponse,
-  JsonArray,
-  ListIdentityResponse,
-  ListKeyRolesResponse,
-  ListKeysResponse,
-  ListRoleKeysResponse,
-  ListRoleUsersResponse,
-  ListRolesResponse,
-  MmiJrpcMethod,
-  PendingMessageInfo,
-  PendingMessageSignResponse,
-  RatchetConfig,
-  Scope,
-  SessionData,
-  SessionLifetime,
-  SessionsResponse,
-  TaprootSignRequest,
-  TaprootSignResponse,
-  BabylonRegistrationRequest,
-  BabylonRegistrationResponse,
-  BabylonStakingRequest,
-  BabylonStakingResponse,
-  UpdateUserMembershipRequest,
-  HistoricalTx,
-  ListHistoricalTxResponse,
-  PublicOrgInfo,
-  ImportDeriveKeyProperties,
-  PasswordResetRequest,
-  EmailOtpResponse,
-  AuthenticationRequest,
-  AuthenticationResponse,
-  CreateKeyProperties,
-  InvitationAcceptRequest,
-  MfaReceipts,
-  SuiSignRequest,
-  SuiSignResponse,
-  QueryMetricsRequest,
-  QueryMetricsResponse,
-  CreateOrgRequest,
-  KeyTypeAndDerivationPath,
-  DeriveMultipleKeyTypesProperties,
-  ContactInfo,
-  ListContactsResponse,
-  JsonValue,
-  EditPolicy,
-  UpdateContactRequest,
-  AddressMap,
-  RolePolicy,
-  InvokePolicyResponse,
-  InvokePolicyRequest,
-  UploadWasmPolicyRequest,
-  UploadWasmPolicyResponse,
-  LoginRequest,
-  PasskeyAssertAnswer,
-  schemas,
-  KeyWithPoliciesInfo,
-  GetRoleKeyOptions,
-  GetUserByEmailResponse,
-  GetUserByOidcResponse,
-  EmailTemplatePurpose,
+import {
+  type AddIdentityRequest,
+  type AvaChain,
+  type EnvInterface,
+  type EotsCreateNonceRequest,
+  type EotsCreateNonceResponse,
+  type EotsSignRequest,
+  type EotsSignResponse,
+  type JrpcResponse,
+  type JsonArray,
+  type ListIdentityResponse,
+  type ListKeyRolesResponse,
+  type ListKeysResponse,
+  type ListRoleKeysResponse,
+  type ListRoleUsersResponse,
+  type ListRolesResponse,
+  type MmiJrpcMethod,
+  type PendingMessageInfo,
+  type PendingMessageSignResponse,
+  type RatchetConfig,
+  type Scope,
+  type SessionData,
+  type SessionLifetime,
+  type SessionsResponse,
+  type TaprootSignRequest,
+  type TaprootSignResponse,
+  type BabylonRegistrationRequest,
+  type BabylonRegistrationResponse,
+  type BabylonStakingRequest,
+  type BabylonStakingResponse,
+  type UpdateUserMembershipRequest,
+  type HistoricalTx,
+  type ListHistoricalTxResponse,
+  type PublicOrgInfo,
+  type ImportDeriveKeyProperties,
+  type PasswordResetRequest,
+  type EmailOtpResponse,
+  type AuthenticationRequest,
+  type AuthenticationResponse,
+  type CreateKeyProperties,
+  type InvitationAcceptRequest,
+  type MfaReceipts,
+  type SuiSignRequest,
+  type SuiSignResponse,
+  type QueryMetricsRequest,
+  type QueryMetricsResponse,
+  type CreateOrgRequest,
+  type KeyTypeAndDerivationPath,
+  type DeriveMultipleKeyTypesProperties,
+  type ContactInfo,
+  type ListContactsResponse,
+  type JsonValue,
+  type EditPolicy,
+  type UpdateContactRequest,
+  type AddressMap,
+  type RolePolicy,
+  type InvokePolicyResponse,
+  type InvokePolicyRequest,
+  type UploadWasmPolicyRequest,
+  type UploadWasmPolicyResponse,
+  type LoginRequest,
+  type PasskeyAssertAnswer,
+  type schemas,
+  type KeyWithPoliciesInfo,
+  type GetRoleKeyOptions,
+  type GetUserByEmailResponse,
+  type GetUserByOidcResponse,
+  type EmailTemplatePurpose,
+  ErrResponse,
 } from "../index";
 import { assertOk, op, type Op, type Operation, apiFetch } from "../fetch";
 import { BaseClient, type ClientConfig, signerSessionFromSessionInfo } from "./base_client";
@@ -2713,9 +2715,35 @@ export class ApiClient extends BaseClient {
       method: method,
       params: params,
     };
-    const func = async (headers?: HeadersInit) => this.exec(o, { headers, body });
-    const resp = (await CubeSignerResponse.create(this.env, func)).data();
-    return resp;
+    const func = async (headers?: HeadersInit) => {
+      const resp = await this.exec(o, { headers, body });
+      if (resp.error) {
+        const data = resp.error.data as ErrorResponse | undefined;
+        throw new ErrResponse({
+          message: resp.error.message,
+          errorCode: data?.error_code,
+          requestId: data?.request_id,
+        });
+      }
+      return resp;
+    };
+    const resp = await CubeSignerResponse.create(this.env, func);
+    return resp.data();
+  }
+
+  /**
+   * Retrieve a proof of this session's CubeSigner identity.
+   *
+   * @returns a JWT that can be validated against the JWKS from {@link customerProofJwksUrl}.
+   */
+  async getCustomerProof(): Promise<string> {
+    const resp = await this.mmi("custodian_getCustomerProof", []);
+    const jwt = resp.result?.jwt;
+    if (!jwt || typeof jwt !== "string") {
+      console.warn("Unexpected getCustomerProof response", resp);
+      throw new Error("The type JWT included in the customer proof response is not string");
+    }
+    return jwt;
   }
 
   /**
@@ -2770,6 +2798,15 @@ export class ApiClient extends BaseClient {
     return new URL(`${this.env.SignerApiRoot.replace(/\/$/, "")}${url}`);
   }
 
+  /**
+   * @returns JSON Web Key Set (JWKS) URL with the keys used for validating JWTs returned by the {@link customerProof} method.
+   */
+  customerProofJwksUrl(): URL {
+    const url = "/v0/mmi/v3/.well-known/jwks.json";
+    op(url, "get"); // just to type check the url above
+    return new URL(`${this.env.SignerApiRoot.replace(/\/$/, "")}${url}`);
+  }
+
   // #endregion
 
   /**