@cubist-labs/cubesigner-sdk 0.4.270 → 0.4.273

package/src/client/api_client.ts

@@ -74,6 +74,8 @@ import type {
   PolicyInfo,
   JsonRpcRequest,
   JsonRpcResult,
+  Eip7702SignRequest,
+  SignResponse,
 } from "../schema_types.ts";
 import { encodeToBase64 } from "../util.ts";
 import { auditLogEntrySchema } from "../audit_log.ts";
@@ -723,7 +725,7 @@ export class ApiClient extends BaseClient {
 
   // #endregion
 
-  // #region ORG USERS: orgUserInvite, orgUserDelete, orgUsersList, orgUserGet, orgUserGetByEmail, orgUserCreateOidc, orgUserDeleteOidc
+  // #region ORG USERS: orgUserInvite, orgUserDelete, orgUsersList, orgUserGet, orgUserGetByEmail, orgUserCreateOidc, orgUserDeleteOidc, resetUserMfaInit, resetUserMfaComplete
 
   /**
    * Create a new (first-party) user in the organization and send an email invitation to that user.
@@ -923,6 +925,55 @@ export class ApiClient extends BaseClient {
     });
   }
 
+  /**
+   * Initiate an MFA reset for a user in the org (then the user must call {@link resetUserMfaComplete}).
+   *
+   * Can only be called by an org owner. The target may be any org user with an
+   * email configured; the backend emails them a short-lived reset token, which
+   * the user can use to complete the reset.
+   *
+   * @param userId The id of the user whose MFA should be reset.
+   * @returns An empty response
+   */
+  async resetUserMfaInit(userId: string): Promise<Empty> {
+    const o = op("/v0/org/{org_id}/users/reset_mfa", "post");
+
+    return this.exec(o, {
+      body: { user_id: userId },
+    });
+  }
+
+  /**
+   * Complete an MFA reset for a user in the org (after an org owner initiates
+   * with {@link resetUserMfaInit}).
+   *
+   * Clears all of the calling user's MFA factors. Authenticated via an OIDC
+   * token, since an MFA-locked user cannot complete a session login.
+   *
+   * @param env The environment to use
+   * @param orgId The org the user belongs to
+   * @param oidcToken An OIDC token identifying the user whose MFA is being reset
+   * @param resetToken The reset token emailed to the user by {@link resetUserMfaInit}
+   * @param headers Optional headers to set
+   */
+  static async resetUserMfaComplete(
+    env: EnvInterface,
+    orgId: string,
+    oidcToken: string,
+    resetToken: string,
+    headers?: HeadersInit,
+  ): Promise<void> {
+    const o = op("/v0/org/{org_id}/users/reset_mfa", "patch");
+    await retryOn5XX(() =>
+      o({
+        baseUrl: env.SignerApiRoot,
+        params: { path: { org_id: orgId } },
+        body: { token: resetToken },
+        headers: mergeHeaders(headers, authHeader(oidcToken)),
+      }),
+    ).then(assertOk);
+  }
+
   // #endregion
 
   // #region KEYS: keyGet, keyAttest, keyUpdate, keyDelete, keysCreate, keysDerive, keysList, keyHistory
@@ -2144,13 +2195,17 @@ export class ApiClient extends BaseClient {
   /**
    * List pending MFA requests accessible to the current user.
    *
-   * @returns The MFA requests.
+   * @param page Pagination options. Defaults to fetching the entire result set.
+   * @returns Paginator for iterating over the MFA requests.
    */
-  async mfaList(): Promise<MfaRequestInfo[]> {
+  mfaList(page?: PageOpts): Paginator<schemas["PaginatedListMfaResponse"], MfaRequestInfo[]> {
     const o = op("/v0/org/{org_id}/mfa", "get");
-
-    const { mfa_requests } = await this.exec(o, {});
-    return mfa_requests;
+    return Paginator.items(
+      page ?? Page.default(),
+      (query) => this.exec(o, { params: { query } }),
+      (r) => r.mfa_requests,
+      (r) => r.last_evaluated_key,
+    );
   }
 
   /**
@@ -2350,6 +2405,33 @@ export class ApiClient extends BaseClient {
     return await CubeSignerResponse.create(this.env, signFn, mfaReceipt);
   }
 
+  /**
+   * Sign EIP-7702 authorization request.
+   *
+   * This requires the key to have a '"AllowEip7702Signing"' {@link KeyPolicy}.
+   *
+   * @param key The key to sign with (either {@link Key} or its material ID).
+   * @param req What to sign
+   * @param mfaReceipt Optional MFA receipt(s)
+   * @returns Signature (or MFA approval request).
+   */
+  async signEip7702(
+    key: Key | string,
+    req: Eip7702SignRequest,
+    mfaReceipt?: MfaReceipts,
+  ): Promise<CubeSignerResponse<SignResponse>> {
+    const o = op("/v0/org/{org_id}/evm/eip7702/sign/{pubkey}", "post");
+
+    const pubkey = typeof key === "string" ? (key as string) : key.materialId;
+    const signFn = async (headers?: HeadersInit) =>
+      this.exec(o, {
+        params: { path: { pubkey } },
+        body: req,
+        headers,
+      });
+    return await CubeSignerResponse.create(this.env, signFn, mfaReceipt);
+  }
+
   /**
    * Sign an Eth2/Beacon-chain validation message.
    *

package/src/client.ts

@@ -160,6 +160,20 @@ export class CubeSignerClient {
     return await ApiClient.identityProveOidc(...args);
   }
 
+  /**
+   * Complete an MFA reset for a user in the org. The reset must first be
+   * initiated by an org owner via {@link Org.resetUserMfaInit}.
+   *
+   * Same as {@link ApiClient.resetUserMfaComplete}, see its documentation for more details.
+   *
+   * @param args Request arguments
+   */
+  static async resetUserMfaComplete(
+    ...args: Parameters<typeof ApiClient.resetUserMfaComplete>
+  ): Promise<void> {
+    await ApiClient.resetUserMfaComplete(...args);
+  }
+
   /**
    * Initialize email OTP authentication.
    *

package/src/key.ts

@@ -30,6 +30,8 @@ import type {
   KeyInfoJwt,
   KeyAttestationQuery,
   KeyPropertiesPatch,
+  Eip7702SignRequest,
+  SignResponse,
 } from "./schema_types.ts";
 import type {
   ApiClient,
@@ -553,6 +555,22 @@ export class Key {
     return await this.#apiClient.signEip712(this, req, mfaReceipt);
   }
 
+  /**
+   * Sign EIP-7702 authorization request.
+   *
+   * This requires the key to have a '"AllowEip7702Signing"' {@link KeyPolicy}.
+   *
+   * @param req What to sign
+   * @param mfaReceipt Optional MFA receipt(s)
+   * @returns Signature (or MFA approval request).
+   */
+  async signEip7702(
+    req: Eip7702SignRequest,
+    mfaReceipt?: MfaReceipts,
+  ): Promise<CubeSignerResponse<SignResponse>> {
+    return await this.#apiClient.signEip7702(this, req, mfaReceipt);
+  }
+
   /**
    * Sign an Eth2/Beacon-chain validation message.
    *

package/src/org.ts

@@ -569,6 +569,18 @@ export class Org {
     return this.#apiClient.orgUserDeleteOidc.bind(this.#apiClient);
   }
 
+  /**
+   * Initiate an MFA reset for a user in the org. The reset is completed by
+   * the user via {@link CubeSignerClient.resetUserMfaComplete}.
+   *
+   * Same as {@link ApiClient.resetUserMfaInit}, see its documentation for more information.
+   *
+   * @returns A function that initiates an MFA reset for a user
+   */
+  get resetUserMfaInit() {
+    return this.#apiClient.resetUserMfaInit.bind(this.#apiClient);
+  }
+
   /**
    * List all users in the organization.
    *
@@ -997,11 +1009,13 @@ export class Org {
   /**
    * List pending MFA requests accessible to the current user.
    *
+   * @param page Pagination options. Defaults to fetching the entire result set.
    * @returns The MFA requests.
    */
-  async mfaRequests(): Promise<MfaRequest[]> {
+  async mfaRequests(page?: PageOpts): Promise<MfaRequest[]> {
     return await this.#apiClient
-      .mfaList()
+      .mfaList(page)
+      .fetch()
       .then((mfaInfos) => mfaInfos.map((mfaInfo) => new MfaRequest(this.#apiClient, mfaInfo)));
   }
 

package/src/role.ts

@@ -462,16 +462,26 @@ export type AllowEip191Signing = typeof AllowEip191Signing;
 export const AllowEip712Signing = "AllowEip712Signing" as const;
 export type AllowEip712Signing = typeof AllowEip712Signing;
 
+/** Allow EIP-7702 signing */
+export const AllowEip7702Signing = "AllowEip7702Signing" as const;
+export type AllowEip7702Signing = typeof AllowEip7702Signing;
+
 /** Allow BTC message signing */
 export const AllowBtcMessageSigning = "AllowBtcMessageSigning" as const;
 export type AllowBtcMessageSigning = typeof AllowBtcMessageSigning;
 
+/** Allow BTC message signing */
+export const AllowAutoSign = "AllowAutoSign" as const;
+export type AllowAutoSign = typeof AllowAutoSign;
+
 export type AllowPolicy =
   | AllowRawBlobSigning
   | AllowDiffieHellmanExchange
   | AllowEip191Signing
   | AllowEip712Signing
-  | AllowBtcMessageSigning;
+  | AllowEip7702Signing
+  | AllowBtcMessageSigning
+  | AllowAutoSign;
 
 /** A reference to an org-level named policy, using its name/id and its version */
 export type PolicyReference = `${string}/v${number}` | `${string}/latest`;