@dfns/sdk 0.6.12 → 0.7.1-alpha.1

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@dfns/sdk",
-  "version": "0.6.12",
+  "version": "0.7.1-alpha.1",
   "dependencies": {
     "buffer": "6.0.3",
-    "cross-fetch": "3.1.6",
-    "uuid": "9.0.0"
+    "cross-fetch": "3.1.6"
   },
   "main": "./index.js",
   "type": "commonjs"

package/types/generic.d.ts

@@ -1,11 +1,11 @@
 import { CredentialSigner } from '../signer';
 export type DfnsBaseApiOptions = {
-    appId: string;
-    /** Needs to be specified to use any endpoint that requires authentication */
-    authToken?: string;
     /** Only needs to be specified when using another API environment */
     baseUrl?: string;
-    appSecret?: string;
+    /** Auth token needs to be specified to use any endpoint that requires authentication */
+    authToken?: string;
+    /** If orgId is specified, and an auth token is used, then before API requests are sent, a check will be performed that the auth token is indeed scoped to the expected org. That can be useful in the context of multi-org */
+    orgId?: string;
 };
 export type DfnsApiClientOptions = DfnsBaseApiOptions & {
     /** Needs to be specified to use any endpoint that required User Action Signing flow */

package/utils/authToken.d.ts

@@ -0,0 +1,5 @@
+export declare const JWT_CUSTOM_DATA_CLAIM = "https://custom/app_metadata";
+export declare const assertAuthTokenIsSameOrg: ({ authToken, orgId }: {
+    authToken: string;
+    orgId: string;
+}) => void;

package/utils/authToken.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertAuthTokenIsSameOrg = exports.JWT_CUSTOM_DATA_CLAIM = void 0;
+const base64_1 = require("./base64");
+exports.JWT_CUSTOM_DATA_CLAIM = 'https://custom/app_metadata';
+const assertAuthTokenIsSameOrg = ({ authToken, orgId }) => {
+    const tokenBody = authToken.split('.')?.[1] || '';
+    let decoded;
+    try {
+        decoded = JSON.parse((0, base64_1.fromBase64)(tokenBody).toString('utf-8'));
+    }
+    catch (error) {
+        throw new Error('Provided auth token could not be properly parsed');
+    }
+    const tokenOrgId = decoded?.[exports.JWT_CUSTOM_DATA_CLAIM]?.['orgId'];
+    if (tokenOrgId !== orgId) {
+        throw new Error(`Provided auth token is not scoped to org ID ${orgId}`);
+    }
+};
+exports.assertAuthTokenIsSameOrg = assertAuthTokenIsSameOrg;

package/utils/fetch.js

@@ -2,10 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.simpleFetch = exports.dfnsAuth = exports.catchPolicyPending = exports.errorHandler = exports.jsonSerializer = exports.fullUrl = void 0;
 const cross_fetch_1 = require("cross-fetch");
-const nonce_1 = require("./nonce");
 const dfnsError_1 = require("../dfnsError");
 const DEFAULT_DFNS_BASE_URL = 'https://api.dfns.io';
 const package_json_1 = require("../package.json");
+const authToken_1 = require("./authToken");
 const fullUrl = (fetch) => {
     return async (resource, options) => {
         const baseUrl = options.apiOptions.baseUrl || DEFAULT_DFNS_BASE_URL;
@@ -60,22 +60,17 @@ const catchPolicyPending = (fetch) => {
 exports.catchPolicyPending = catchPolicyPending;
 const dfnsAuth = (fetch) => {
     return async (resource, options) => {
-        const { appId, appSecret, authToken } = options.apiOptions;
+        const { orgId, authToken } = options.apiOptions;
+        if (authToken && orgId) {
+            (0, authToken_1.assertAuthTokenIsSameOrg)({ orgId, authToken });
+        }
         const authorization = authToken
             ? {
                 authorization: `Bearer ${authToken}`,
             }
             : {};
-        const dfnsAppSecret = appSecret
-            ? {
-                'x-dfns-appsecret': appSecret,
-            }
-            : {};
         options.headers = {
-            'x-dfns-appid': appId,
-            'x-dfns-nonce': (0, nonce_1.generateNonce)(),
             'x-dfns-sdk-version': package_json_1.version,
-            ...dfnsAppSecret,
             ...authorization,
             ...(options.headers ?? {}),
         };

package/utils/index.d.ts

@@ -2,7 +2,6 @@ export * from './base64';
 export * from './bigint';
 export * from './crypto';
 export * from './fetch';
-export * from './nonce';
 export * from './string';
 export * from './url';
 export declare const generateRandom: (size: number) => Uint8Array;

package/utils/index.js

@@ -19,7 +19,6 @@ __exportStar(require("./base64"), exports);
 __exportStar(require("./bigint"), exports);
 __exportStar(require("./crypto"), exports);
 __exportStar(require("./fetch"), exports);
-__exportStar(require("./nonce"), exports);
 __exportStar(require("./string"), exports);
 __exportStar(require("./url"), exports);
 const generateRandom = (size) => {

package/utils/nonce.d.ts

@@ -1 +0,0 @@
-export declare const generateNonce: () => string;

package/utils/nonce.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateNonce = void 0;
-const uuid_1 = require("uuid");
-const base64_1 = require("./base64");
-const generateNonce = () => {
-    return (0, base64_1.toBase64Url)(JSON.stringify({
-        uuid: (0, uuid_1.v4)(),
-        date: new Date().toISOString(),
-    }));
-};
-exports.generateNonce = generateNonce;