@feelflow/ffid-sdk 12.0.0 → 12.1.0

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_API_BASE_URL } from '../chunk-JEVK2XUM.js';
 export { DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES } from '../chunk-JEVK2XUM.js';
-import { createRemoteJWKSet, jwtVerify, errors } from 'jose';
+import { SignJWT, importJWK, jwtVerify, createRemoteJWKSet, errors } from 'jose';
 
 // src/auth/token-store.ts
 var STORAGE_KEY = "ffid_tokens";
@@ -309,13 +309,13 @@ var HTTP_SERVER_ERROR_MIN = 500;
 var HTTP_SERVER_ERROR_LIMIT = 600;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
-  let jwtVerify2 = null;
+  let jwtVerify3 = null;
   let cacheReadFailureEscalated = false;
   let cacheWriteFailureEscalated = false;
   let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
-    if (!jwtVerify2) {
-      jwtVerify2 = createJwtVerifier({
+    if (!jwtVerify3) {
+      jwtVerify3 = createJwtVerifier({
         baseUrl,
         serviceCode,
         logger,
@@ -325,7 +325,7 @@ function createVerifyAccessToken(deps) {
         errorCodes
       });
     }
-    return jwtVerify2;
+    return jwtVerify3;
   }
   async function verifyAccessToken(accessToken, options) {
     if (authMode !== "service-key") {
@@ -573,7 +573,8 @@ function createBillingMethods(deps) {
           subscriptionId: params.subscriptionId,
           successUrl: params.successUrl,
           cancelUrl: params.cancelUrl,
-          ...params.planId ? { planId: params.planId } : {}
+          ...params.planId ? { planId: params.planId } : {},
+          ...params.quantity !== void 0 ? { quantity: params.quantity } : {}
         })
       }
     );
@@ -1386,7 +1387,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "12.0.0";
+var SDK_VERSION = "12.1.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -4864,4 +4865,184 @@ function clear(opts = {}) {
 }
 var sessionCookies = { serialize, read, clear };
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCatalogHashError, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SESSION_COOKIE_NAME, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };
+// src/server/db-token/constants.ts
+var FFID_DB_TOKEN_ALGORITHM = "ES256";
+var FFID_DB_TOKEN_ROLE = "authenticated";
+var FFID_DB_TOKEN_AUDIENCE = "authenticated";
+var DEFAULT_DB_TOKEN_TTL_SECONDS = 300;
+var MAX_DB_TOKEN_TTL_SECONDS = 900;
+var FFID_DB_TOKEN_ORGANIZATION_CLAIM = "organization_id";
+var FFID_DB_TOKEN_RESERVED_CLAIMS = [
+  "sub",
+  "role",
+  "aud",
+  "iss",
+  "iat",
+  "exp",
+  "nbf",
+  "jti",
+  FFID_DB_TOKEN_ORGANIZATION_CLAIM
+];
+var MILLISECONDS_PER_SECOND = 1e3;
+
+// src/server/db-token/errors.ts
+var FFID_DB_TOKEN_ERROR_CODES = {
+  /** Signing key is not a private P-256 JWK with a `kid`, or cannot be imported. */
+  INVALID_SIGNING_KEY: "INVALID_SIGNING_KEY",
+  /** `ttlSeconds` is not a positive integer within `MAX_DB_TOKEN_TTL_SECONDS`. */
+  INVALID_TTL: "INVALID_TTL",
+  /** `userId` is not a UUID. */
+  INVALID_USER_ID: "INVALID_USER_ID",
+  /** `organizationId` is not a UUID. */
+  INVALID_ORGANIZATION_ID: "INVALID_ORGANIZATION_ID",
+  /** A product claim uses a name the minter reserves (`sub`, `role`, `exp`, ...). */
+  RESERVED_CLAIM: "RESERVED_CLAIM",
+  /** `now` is not a valid `Date` (an Invalid Date would sign `iat` / `exp` as null). */
+  INVALID_CLOCK: "INVALID_CLOCK"
+};
+var FFIDDbTokenError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "FFIDDbTokenError";
+    this.code = code;
+  }
+};
+
+// src/server/db-token/mint.ts
+var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var RESERVED_CLAIM_SET = new Set(FFID_DB_TOKEN_RESERVED_CLAIMS);
+var isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
+var invalidKey = (reason, cause) => new FFIDDbTokenError(
+  FFID_DB_TOKEN_ERROR_CODES.INVALID_SIGNING_KEY,
+  `Invalid DB token signing key: ${reason}`,
+  cause === void 0 ? void 0 : { cause }
+);
+var describeCause = (cause) => cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
+function parseSigningKey(signingKey, kidOverride) {
+  let candidate = signingKey;
+  if (typeof signingKey === "string") {
+    if (signingKey.trim().length === 0) {
+      throw invalidKey("signingKey is empty (is the environment variable set?)");
+    }
+    try {
+      candidate = JSON.parse(signingKey);
+    } catch {
+      throw invalidKey("not valid JSON");
+    }
+  }
+  if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) {
+    throw invalidKey("expected a JWK object");
+  }
+  const jwk = candidate;
+  if (jwk.kty !== "EC" || jwk.crv !== "P-256") {
+    throw invalidKey(`expected kty=EC crv=P-256 for ${FFID_DB_TOKEN_ALGORITHM}`);
+  }
+  if (!isNonEmptyString(jwk.d) || !isNonEmptyString(jwk.x) || !isNonEmptyString(jwk.y)) {
+    throw invalidKey("expected a private key (d, x, y)");
+  }
+  const kid = kidOverride ?? jwk.kid;
+  if (!isNonEmptyString(kid)) {
+    throw invalidKey("kid is required (Supabase matches the header kid against the imported key)");
+  }
+  return { jwk, kid };
+}
+function resolveTtlSeconds(ttlSeconds) {
+  const ttl = ttlSeconds ?? DEFAULT_DB_TOKEN_TTL_SECONDS;
+  if (!Number.isInteger(ttl) || ttl < 1 || ttl > MAX_DB_TOKEN_TTL_SECONDS) {
+    throw new FFIDDbTokenError(
+      FFID_DB_TOKEN_ERROR_CODES.INVALID_TTL,
+      `ttlSeconds must be an integer between 1 and ${MAX_DB_TOKEN_TTL_SECONDS}`
+    );
+  }
+  return ttl;
+}
+function requireUuid(value, code, label) {
+  if (typeof value !== "string" || !UUID_PATTERN2.test(value)) {
+    throw new FFIDDbTokenError(FFID_DB_TOKEN_ERROR_CODES[code], `${label} must be a UUID`);
+  }
+  return value.toLowerCase();
+}
+function resolveNow(now) {
+  if (now === void 0) return /* @__PURE__ */ new Date();
+  if (!(now instanceof Date) || Number.isNaN(now.getTime())) {
+    throw new FFIDDbTokenError(FFID_DB_TOKEN_ERROR_CODES.INVALID_CLOCK, "now must be a valid Date");
+  }
+  return now;
+}
+function assertNoReservedClaims(claims) {
+  if (!claims) return;
+  for (const name of Object.keys(claims)) {
+    if (RESERVED_CLAIM_SET.has(name)) {
+      throw new FFIDDbTokenError(
+        FFID_DB_TOKEN_ERROR_CODES.RESERVED_CLAIM,
+        `Claim "${name}" is reserved by the DB token minter`
+      );
+    }
+  }
+}
+async function importSigningKey(jwk, kid) {
+  const ecParameters = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+  let privateKey;
+  let publicKey;
+  try {
+    const imported = await Promise.all([
+      importJWK({ ...ecParameters, d: jwk.d, kid, alg: FFID_DB_TOKEN_ALGORITHM }, FFID_DB_TOKEN_ALGORITHM),
+      importJWK({ ...ecParameters, kid, alg: FFID_DB_TOKEN_ALGORITHM }, FFID_DB_TOKEN_ALGORITHM)
+    ]);
+    if (imported[0] instanceof Uint8Array || imported[1] instanceof Uint8Array) {
+      throw new Error("expected an asymmetric key");
+    }
+    ;
+    [privateKey, publicKey] = imported;
+  } catch (cause) {
+    throw invalidKey(`key material could not be imported (${describeCause(cause)})`, cause);
+  }
+  try {
+    const probe = await new SignJWT({}).setProtectedHeader({ alg: FFID_DB_TOKEN_ALGORITHM, kid }).sign(privateKey);
+    await jwtVerify(probe, publicKey);
+  } catch (cause) {
+    throw invalidKey("private part (d) does not match the public part (x, y)", cause);
+  }
+  return privateKey;
+}
+function createDbTokenMinter(config) {
+  const { jwk, kid } = parseSigningKey(config.signingKey, config.kid);
+  const ttlSeconds = resolveTtlSeconds(config.ttlSeconds);
+  const issuer = config.issuer;
+  let keyPromise;
+  const loadKey = () => {
+    keyPromise ??= importSigningKey(jwk, kid).catch((error) => {
+      keyPromise = void 0;
+      throw error;
+    });
+    return keyPromise;
+  };
+  return {
+    kid,
+    ttlSeconds,
+    async mint(input) {
+      const sub = requireUuid(input.userId, "INVALID_USER_ID", "userId");
+      const organizationId = input.organizationId === void 0 || input.organizationId === null ? void 0 : requireUuid(input.organizationId, "INVALID_ORGANIZATION_ID", "organizationId");
+      assertNoReservedClaims(input.claims);
+      const now = resolveNow(input.now);
+      const iat = Math.floor(now.getTime() / MILLISECONDS_PER_SECOND);
+      const exp = iat + ttlSeconds;
+      const claims = {
+        ...input.claims,
+        sub,
+        role: FFID_DB_TOKEN_ROLE,
+        aud: FFID_DB_TOKEN_AUDIENCE,
+        iat,
+        exp,
+        ...issuer === void 0 ? {} : { iss: issuer },
+        ...organizationId === void 0 ? {} : { [FFID_DB_TOKEN_ORGANIZATION_CLAIM]: organizationId }
+      };
+      const key = await loadKey();
+      const token = await new SignJWT(claims).setProtectedHeader({ alg: FFID_DB_TOKEN_ALGORITHM, kid, typ: "JWT" }).sign(key);
+      return { token, expiresAt: new Date(exp * MILLISECONDS_PER_SECOND), claims };
+    }
+  };
+}
+
+export { ALL_DENIED_EXCEPT_NECESSARY, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, DEFAULT_DB_TOKEN_TTL_SECONDS, FFIDCatalogHashError, FFIDDbTokenError, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_DB_TOKEN_ALGORITHM, FFID_DB_TOKEN_AUDIENCE, FFID_DB_TOKEN_ERROR_CODES, FFID_DB_TOKEN_ORGANIZATION_CLAIM, FFID_DB_TOKEN_RESERVED_CLAIMS, FFID_DB_TOKEN_ROLE, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SESSION_COOKIE_NAME, MAX_DB_TOKEN_TTL_SECONDS, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createDbTokenMinter, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DW8_m1_M.cjs';
+import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-aUNBn5SW.cjs';
 import '../../types-Cjb9J0rL.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-ByfZA9sJ.js';
+import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-5dVFeHt8.js';
 import '../../types-Cjb9J0rL.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "12.0.0",
+  "version": "12.1.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",