@floegence/flowersec-core 0.11.1 → 0.13.0

package/dist/client-connect/connectCore.js

@@ -8,6 +8,7 @@ import { base64urlDecode } from "../utils/base64url.js";
 import { AbortError, FlowersecError, throwIfAborted } from "../utils/errors.js";
 import { WebSocketBinaryTransport, WsCloseError } from "../ws-client/binaryTransport.js";
 import { OriginMismatchError, WsFactoryRequiredError, classifyConnectError, classifyHandshakeError, createWebSocket, waitOpen, withAbortAndTimeout, } from "./common.js";
+import { prepareChannelId } from "./contract.js";
 import { isTunnelAttachCloseReason } from "./tunnelAttachCloseReason.js";
 export async function connectCore(args) {
     const observer = normalizeObserver(args.opts.observer);
@@ -65,10 +66,7 @@ export async function connectCore(args) {
     if (!Number.isSafeInteger(maxWsQueuedBytes) || maxWsQueuedBytes < 0) {
         invalidOption("maxWsQueuedBytes must be a non-negative integer");
     }
-    const channelId = typeof args.channelId === "string" ? args.channelId.trim() : "";
-    if (channelId === "") {
-        throw new FlowersecError({ path: args.path, stage: "validate", code: "missing_channel_id", message: "missing channel_id" });
-    }
+    const channelId = prepareChannelId(args.channelId, args.path);
     let psk;
     try {
         const pskB64u = typeof args.e2eePskB64u === "string" ? args.e2eePskB64u.trim() : "";

package/dist/client-connect/contract.d.ts

@@ -0,0 +1,8 @@
+import type { ChannelInitGrant, Role as ControlRole } from "../gen/flowersec/controlplane/v1.gen.js";
+import type { DirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
+import { type FlowersecPath } from "../utils/errors.js";
+export declare const CHANNEL_ID_MAX_BYTES = 256;
+export declare function prepareChannelId(raw: string, path: Exclude<FlowersecPath, "auto">): string;
+export declare function assertTunnelGrantContract(grant: ChannelInitGrant, expectedRole: ControlRole): void;
+export declare function assertDirectConnectContract(info: DirectConnectInfo): void;
+export declare function assertValidPSK(raw: string, path: Exclude<FlowersecPath, "auto">): string;

package/dist/client-connect/contract.js

@@ -0,0 +1,51 @@
+import { base64urlDecode } from "../utils/base64url.js";
+import { FlowersecError } from "../utils/errors.js";
+const textEncoder = new TextEncoder();
+export const CHANNEL_ID_MAX_BYTES = 256;
+export function prepareChannelId(raw, path) {
+    const channelId = typeof raw === "string" ? raw.trim() : "";
+    if (channelId === "") {
+        throw new FlowersecError({ path, stage: "validate", code: "missing_channel_id", message: "missing channel_id" });
+    }
+    if (textEncoder.encode(channelId).length > CHANNEL_ID_MAX_BYTES) {
+        throw new FlowersecError({ path, stage: "validate", code: "invalid_input", message: "channel_id too long" });
+    }
+    return channelId;
+}
+export function assertTunnelGrantContract(grant, expectedRole) {
+    if (grant.role !== expectedRole) {
+        throw new FlowersecError({ stage: "validate", code: "role_mismatch", path: "tunnel", message: `expected role=${expectedRole === 1 ? "client" : "server"}` });
+    }
+    const allowedSuites = Array.isArray(grant.allowed_suites) ? grant.allowed_suites : [];
+    if (allowedSuites.length === 0) {
+        throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "allowed_suites must be non-empty" });
+    }
+    for (const suite of allowedSuites) {
+        assertSupportedSuite(suite, "tunnel");
+    }
+    assertSupportedSuite(grant.default_suite, "tunnel");
+    if (!allowedSuites.includes(grant.default_suite)) {
+        throw new FlowersecError({ stage: "validate", code: "invalid_suite", path: "tunnel", message: "default_suite must be included in allowed_suites" });
+    }
+}
+export function assertDirectConnectContract(info) {
+    assertSupportedSuite(info.default_suite, "direct");
+}
+export function assertValidPSK(raw, path) {
+    const pskB64u = typeof raw === "string" ? raw.trim() : "";
+    try {
+        const psk = base64urlDecode(pskB64u);
+        if (psk.length !== 32) {
+            throw new Error("psk must be 32 bytes");
+        }
+    }
+    catch (e) {
+        throw new FlowersecError({ stage: "validate", code: "invalid_psk", path, message: "invalid e2ee_psk_b64u", cause: e });
+    }
+    return pskB64u;
+}
+function assertSupportedSuite(suite, path) {
+    if (suite !== 1 && suite !== 2) {
+        throw new FlowersecError({ stage: "validate", code: "invalid_suite", path, message: "invalid suite" });
+    }
+}

package/dist/direct-client/connect.js

@@ -1,7 +1,7 @@
 import { assertDirectConnectInfo } from "../gen/flowersec/direct/v1.gen.js";
-import { base64urlDecode } from "../utils/base64url.js";
 import { FlowersecError } from "../utils/errors.js";
 import { connectCore } from "../client-connect/connectCore.js";
+import { assertDirectConnectContract, assertValidPSK, prepareChannelId } from "../client-connect/contract.js";
 function isRecord(v) {
     return typeof v === "object" && v != null && !Array.isArray(v);
 }
@@ -68,9 +68,7 @@ export async function connectDirect(info, opts) {
     if (ready.ws_url === "") {
         throw new FlowersecError({ stage: "validate", code: "missing_ws_url", path: "direct", message: "missing ws_url" });
     }
-    if (ready.channel_id === "") {
-        throw new FlowersecError({ stage: "validate", code: "missing_channel_id", path: "direct", message: "missing channel_id" });
-    }
+    const channelId = prepareChannelId(ready.channel_id, "direct");
     if (ready.channel_init_expire_at_unix_s <= 0) {
         throw new FlowersecError({
             stage: "validate",
@@ -79,19 +77,12 @@ export async function connectDirect(info, opts) {
             message: "missing channel_init_expire_at_unix_s",
         });
     }
-    try {
-        const psk = base64urlDecode(ready.e2ee_psk_b64u);
-        if (psk.length !== 32) {
-            throw new Error("psk must be 32 bytes");
-        }
-    }
-    catch (e) {
-        throw new FlowersecError({ stage: "validate", code: "invalid_psk", path: "direct", message: "invalid e2ee_psk_b64u", cause: e });
-    }
+    assertDirectConnectContract(ready);
+    assertValidPSK(ready.e2ee_psk_b64u, "direct");
     return await connectCore({
         path: "direct",
         wsUrl: ready.ws_url,
-        channelId: ready.channel_id,
+        channelId,
         e2eePskB64u: ready.e2ee_psk_b64u,
         defaultSuite: ready.default_suite,
         opts,

package/dist/tunnel-client/connect.js

@@ -4,6 +4,7 @@ import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
 import { FlowersecError } from "../utils/errors.js";
 import { randomBytes } from "../client-connect/common.js";
 import { connectCore } from "../client-connect/connectCore.js";
+import { assertTunnelGrantContract, assertValidPSK, prepareChannelId } from "../client-connect/contract.js";
 function isRecord(v) {
     return typeof v === "object" && v != null && !Array.isArray(v);
 }
@@ -84,10 +85,7 @@ export async function connectTunnel(grant, opts) {
     if (tunnelUrl === "") {
         throw new FlowersecError({ stage: "validate", code: "missing_tunnel_url", path: "tunnel", message: "missing tunnel_url" });
     }
-    const channelId = checkedGrant.channel_id.trim();
-    if (channelId === "") {
-        throw new FlowersecError({ stage: "validate", code: "missing_channel_id", path: "tunnel", message: "missing channel_id" });
-    }
+    const channelId = prepareChannelId(checkedGrant.channel_id, "tunnel");
     const token = checkedGrant.token.trim();
     if (token === "") {
         throw new FlowersecError({ stage: "validate", code: "missing_token", path: "tunnel", message: "missing token" });
@@ -100,20 +98,9 @@ export async function connectTunnel(grant, opts) {
             message: "missing channel_init_expire_at_unix_s",
         });
     }
-    const e2eePskB64u = checkedGrant.e2ee_psk_b64u.trim();
-    try {
-        const psk = base64urlDecode(e2eePskB64u);
-        if (psk.length !== 32) {
-            throw new Error("psk must be 32 bytes");
-        }
-    }
-    catch (e) {
-        throw new FlowersecError({ stage: "validate", code: "invalid_psk", path: "tunnel", message: "invalid e2ee_psk_b64u", cause: e });
-    }
+    assertTunnelGrantContract(checkedGrant, ControlRole.Role_client);
+    const e2eePskB64u = assertValidPSK(checkedGrant.e2ee_psk_b64u, "tunnel");
     const idleTimeoutSeconds = checkedGrant.idle_timeout_seconds;
-    if (checkedGrant.role !== ControlRole.Role_client) {
-        throw new FlowersecError({ stage: "validate", code: "role_mismatch", path: "tunnel", message: "expected role=client" });
-    }
     const endpointInstanceId = opts.endpointInstanceId ?? base64urlEncode(randomBytes(24));
     let eidBytes;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floegence/flowersec-core",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "description": "Flowersec core TypeScript library (browser-friendly E2EE + multiplexing over WebSocket).",
   "license": "MIT",
   "repository": {