@fourt/sdk 1.4.1 → 1.5.1

package/dist/index.js

@@ -5,168 +5,38 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 
-// src/session/index.ts
-import { createStore } from "zustand";
-import { persist, createJSONStorage } from "zustand/middleware";
-var SessionStore = class {
-  _store;
-  constructor() {
-    this._store = createStore()(
-      persist(this._getInitialState, {
-        name: "fourt-session",
-        storage: createJSONStorage(() => localStorage),
-        // persist only these in localStorage
-        partialize: (state) => ({
-          bundle: state.bundle,
-          type: state.type,
-          otpId: state.otpId
-        })
-      })
-    );
-  }
-  get type() {
-    return this._store.getState().type;
-  }
-  set type(type) {
-    this._store.setState({ type });
-  }
-  get token() {
-    return this._store.getState().token;
-  }
-  set token(token) {
-    this._store.setState({ token });
-  }
-  get csrfToken() {
-    return this._store.getState().csrfToken;
-  }
-  set csrfToken(csrfToken) {
-    this._store.setState({ csrfToken });
-  }
-  get bundle() {
-    return this._store.getState().bundle;
-  }
-  set bundle(bundle) {
-    this._store.setState({ bundle });
-  }
-  get user() {
-    return this._store.getState().user;
-  }
-  set user(user) {
-    this._store.setState({ ...this._store.getState(), user });
-  }
-  get otpId() {
-    return this._store.getState().otpId;
-  }
-  set otpId(otpId) {
-    this._store.setState({ otpId });
-  }
-  clearUser() {
-    this._store.setState({ ...this._store.getState(), user: void 0 });
-  }
-  clearBundle() {
-    this._store.setState({ ...this._store.getState(), bundle: void 0 });
-  }
-  clearType() {
-    this._store.setState({ ...this._store.getState(), type: void 0 });
-  }
-  clearToken() {
-    this._store.setState({ ...this._store.getState(), token: void 0 });
-  }
-  clearOtpId() {
-    this._store.setState({ ...this._store.getState(), otpId: void 0 });
-  }
-  clearAll() {
-    this.clearToken();
-    this.clearUser();
-    this.clearBundle();
-    this.clearType();
-    this.clearOtpId();
-  }
-  _getInitialState() {
-    return {
-      type: void 0,
-      user: void 0,
-      bundle: void 0,
-      token: void 0,
-      csrfToken: void 0,
-      otpId: void 0
-    };
-  }
-};
-
-// src/modules/auth/email/magicLink.ts
-var MagicLinkModule = class {
+// src/modules/auth/email.ts
+var EmailModule = class {
   constructor(_webSignerClient) {
     this._webSignerClient = _webSignerClient;
   }
   /**
-   * Completes authentication with magic link that contains a bundle.
+   * Initialize user authentication process using email.
    *
-   * @param params {CompleteAuthWithBundleParams} params received as URL params necessary to complete authentication process.
-   * @returns {Promise<void>} promise that completes the authentication process.
+   * @param params {InitEmailAuthParams} params to initialize the user authentication process.
+   * @returns {Promise<void>} promise that resolves when the initialization is complete.
    */
-  async complete(params) {
-    return this._webSignerClient.completeAuthWithBundle({
-      ...params,
-      sessionType: "email" /* Email */
-    });
-  }
-};
-
-// src/modules/auth/email/otp.ts
-var OtpModule = class {
-  constructor(_webSignerClient) {
-    this._webSignerClient = _webSignerClient;
+  async initialize(params) {
+    return this._webSignerClient.initEmailAuth(params);
   }
   /**
-   * Completes authentication with OTP code after user receives the bundle and subOrgId.
+   * Completes email authentication with OTP code.
    *
-   * @param params {CompleteAuthWithOtpParams} params to complete the authentication process.
+   * @param params {CompleteEmailAuthParams} params to complete the authentication process.
    * @returns {Promise<void>} promise that completes the authentication process.
    */
   async complete(params) {
-    const { bundle, subOrgId } = await this._webSignerClient.otpAuth(params);
-    return this._webSignerClient.completeAuthWithBundle({
-      bundle,
-      subOrgId,
-      sessionType: "email" /* Email */
-    });
-  }
-};
-
-// src/modules/auth/email.ts
-var EmailModule = class {
-  constructor(_webSignerClient) {
-    this._webSignerClient = _webSignerClient;
-    this._magicLinkModule = new MagicLinkModule(this._webSignerClient);
-    this._otpModule = new OtpModule(this._webSignerClient);
-  }
-  _magicLinkModule;
-  _otpModule;
-  /**
-   * Initialize user authentication process using email.
-   *
-   * @param params {EmailInitializeAuthParams} params to initialize the user authentication process.
-   * @returns {Promise<void>} promise that resolves to the result of the authentication process.
-   */
-  async initialize(params) {
-    return this._webSignerClient.emailAuth(params);
+    await this._webSignerClient.completeEmailAuth(params);
   }
   /**
    * Get the email authentication method of the app, that was chosen in fourt.io dashboard.
    * It can be either `magiclink` or `otp`.
    *
-   * @returns {Promise<string>} promise that resolves to the email authentication method.
+   * @returns {Promise<'otp' | 'magiclink'>} promise that resolves to the email authentication method.
    */
   async getAuthMethod() {
     return this._webSignerClient.getEmailAuthMethod();
   }
-  get magicLink() {
-    return this._magicLinkModule;
-  }
-  get otp() {
-    return this._otpModule;
-  }
 };
 
 // src/modules/auth/passkeys.ts
@@ -177,10 +47,10 @@ var PasskeysModule = class {
   /**
    * Signs in a user using Passkeys.
    *
-   * @param params {WebauthnSignInParams} params for the sign-in process.
+   * @param params {WebAuthnSignInParams} params for the sign-in process.
    */
   async signIn(params) {
-    return this._webSignerClient.webauthnSignIn(params);
+    return this._webSignerClient.webAuthnSignIn(params);
   }
 };
 
@@ -224,11 +94,8 @@ var GoogleModule = class {
   constructor(_webSignerClient) {
     this._webSignerClient = _webSignerClient;
   }
-  /**
-   *
-   * @returns
-   */
   async init() {
+    await this._webSignerClient.resetKeyPair();
     const initUrl = await this._webSignerClient.getOAuthInitUrl("google");
     const url = new URL(initUrl);
     const internalUrl = new URL(
@@ -236,7 +103,7 @@ var GoogleModule = class {
       this._webSignerClient.configuration.apiUrl
     ).href;
     url.searchParams.set("redirect_uri", internalUrl);
-    const publicKey = await this._webSignerClient.getIframePublicKey();
+    const publicKey = await this._webSignerClient.getPublicKey();
     const nonce = await LibSha256.sha256Hex(publicKey);
     url.searchParams.set("nonce", nonce);
     const state = new jose.UnsecuredJWT({
@@ -266,7 +133,8 @@ var FacebookModule = class {
     this._webSignerClient = _webSignerClient;
   }
   async init() {
-    const publicKey = await this._webSignerClient.getIframePublicKey();
+    await this._webSignerClient.resetKeyPair();
+    const publicKey = await this._webSignerClient.getPublicKey();
     const internalUrl = new URL(
       "v1/oauth/facebook",
       this._webSignerClient.configuration.apiUrl
@@ -304,11 +172,8 @@ var AppleModule = class {
   constructor(_webSignerClient) {
     this._webSignerClient = _webSignerClient;
   }
-  /**
-   *
-   * @returns
-   */
   async init() {
+    await this._webSignerClient.resetKeyPair();
     const initUrl = await this._webSignerClient.getOAuthInitUrl("apple");
     const url = new URL(initUrl);
     const internalUrl = new URL(
@@ -316,7 +181,7 @@ var AppleModule = class {
       this._webSignerClient.configuration.apiUrl
     ).href;
     url.searchParams.set("redirect_uri", internalUrl);
-    const publicKey = await this._webSignerClient.getIframePublicKey();
+    const publicKey = await this._webSignerClient.getPublicKey();
     const nonce = await LibSha256.sha256Hex(publicKey);
     url.searchParams.set("nonce", nonce);
     const state = new jose3.UnsecuredJWT({
@@ -351,12 +216,7 @@ var OAuthModule = class {
   get apple() {
     return this._appleModule;
   }
-  async complete({ bundle, subOrgId }) {
-    await this._webSignerClient.completeAuthWithBundle({
-      bundle,
-      subOrgId,
-      sessionType: "oauth" /* OAuth */
-    });
+  async complete({ subOrgId }) {
   }
 };
 
@@ -433,7 +293,6 @@ var UserModule = class {
 
 // src/signer/web.ts
 import { getWebAuthnAttestation } from "@turnkey/http";
-import { IframeStamper } from "@turnkey/iframe-stamper";
 import { WebauthnStamper } from "@turnkey/webauthn-stamper";
 
 // src/lib/base64.ts
@@ -478,6 +337,98 @@ var LibBytes = class {
   };
 };
 
+// src/session/index.ts
+import { createStore } from "zustand";
+import { persist, createJSONStorage } from "zustand/middleware";
+var SessionStore = class {
+  _store;
+  constructor() {
+    this._store = createStore()(
+      persist(this._getInitialState, {
+        name: "fourt-session",
+        storage: createJSONStorage(() => localStorage),
+        // persist only these in localStorage
+        partialize: (state) => ({
+          bundle: state.bundle,
+          type: state.type,
+          otpId: state.otpId
+        })
+      })
+    );
+  }
+  get type() {
+    return this._store.getState().type;
+  }
+  set type(type) {
+    this._store.setState({ type });
+  }
+  get token() {
+    return this._store.getState().token;
+  }
+  set token(token) {
+    this._store.setState({ token });
+  }
+  get csrfToken() {
+    return this._store.getState().csrfToken;
+  }
+  set csrfToken(csrfToken) {
+    this._store.setState({ csrfToken });
+  }
+  get bundle() {
+    return this._store.getState().bundle;
+  }
+  set bundle(bundle) {
+    this._store.setState({ bundle });
+  }
+  get user() {
+    return this._store.getState().user;
+  }
+  set user(user) {
+    this._store.setState({ ...this._store.getState(), user });
+  }
+  get otpId() {
+    return this._store.getState().otpId;
+  }
+  set otpId(otpId) {
+    this._store.setState({ otpId });
+  }
+  clearUser() {
+    this._store.setState({ ...this._store.getState(), user: void 0 });
+  }
+  clearBundle() {
+    this._store.setState({ ...this._store.getState(), bundle: void 0 });
+  }
+  clearType() {
+    this._store.setState({ ...this._store.getState(), type: void 0 });
+  }
+  clearToken() {
+    this._store.setState({ ...this._store.getState(), token: void 0 });
+  }
+  clearCsrfToken() {
+    this._store.setState({ ...this._store.getState(), csrfToken: void 0 });
+  }
+  clearOtpId() {
+    this._store.setState({ ...this._store.getState(), otpId: void 0 });
+  }
+  clearAll() {
+    this.clearToken();
+    this.clearUser();
+    this.clearBundle();
+    this.clearType();
+    this.clearOtpId();
+  }
+  _getInitialState() {
+    return {
+      type: void 0,
+      user: void 0,
+      bundle: void 0,
+      token: void 0,
+      csrfToken: void 0,
+      otpId: void 0
+    };
+  }
+};
+
 // src/signer/index.ts
 import { TurnkeyClient } from "@turnkey/http";
 
@@ -637,7 +588,7 @@ var SignerClient = class {
       throw error;
     }
   }
-  async whoAmI(subOrgId) {
+  async signIn(subOrgId) {
     const orgId = subOrgId || this._sessionStore.user?.subOrgId;
     if (!orgId) throw new BadRequestError("No orgId provided");
     const stampedRequest = await this._turnkeyClient.stampGetWhoami({
@@ -666,7 +617,8 @@ var SignerClient = class {
     this._scheduleRefresh(token);
   }
   async request(route, method, body) {
-    const url = new URL(`${route}`, this._configuration.apiUrl);
+    const url = new URL(this._configuration.apiUrl);
+    url.pathname = url.pathname + route;
     const token = this._sessionStore.token;
     const csrfToken = this._sessionStore.csrfToken;
     const headers = {
@@ -756,7 +708,9 @@ var SignerClient = class {
       } catch (error) {
         if (error instanceof UnauthorizedError) {
           try {
-            this._sessionStore.clearAll();
+            this._sessionStore.clearToken();
+            this._sessionStore.clearCsrfToken();
+            this._sessionStore.clearUser();
           } catch {
           }
           throw error;
@@ -791,10 +745,10 @@ var SignerClient = class {
 };
 
 // src/signer/web.ts
+import { IndexedDbStamper } from "@turnkey/indexed-db-stamper";
 var WebSignerClient = class extends SignerClient {
-  iframeStamper;
+  indexedDbStamper;
   webauthnStamper;
-  iframeConfig;
   oauthConfiguration;
   /**
    * Initializes a new instance of the `WebSignerClient` class.
@@ -804,44 +758,20 @@ var WebSignerClient = class extends SignerClient {
   constructor({
     configuration,
     webauthn,
-    iframe,
     oauth
   }) {
-    const iframeConfig = {
-      iframeElementId: iframe?.iframeElementId ?? "turnkey-iframe",
-      iframeContainerId: iframe?.iframeContainerId ?? "signer-iframe-container"
-    };
-    const iframeContainer = document.createElement("div");
-    iframeContainer.id = iframeConfig.iframeContainerId;
-    iframeContainer.style.display = "none";
-    document.body.appendChild(iframeContainer);
-    const iframeStamper = new IframeStamper({
-      iframeUrl: "https://auth.turnkey.com",
-      iframeElementId: iframeConfig.iframeElementId,
-      iframeContainer: document.getElementById(iframeConfig.iframeContainerId)
-    });
+    const indexedDbStamper = new IndexedDbStamper();
     super({
-      stamper: iframeStamper,
-      // Initialized to iframeStamper; can be either webauthnStamper or iframeStamper
+      stamper: indexedDbStamper,
       configuration
     });
-    this.iframeStamper = iframeStamper;
-    this.iframeConfig = iframeConfig;
+    this.indexedDbStamper = indexedDbStamper;
     this.webauthnStamper = new WebauthnStamper({ rpId: webauthn.rpId });
     this.oauthConfiguration = oauth;
   }
   async logout() {
     super.logout();
-    this.iframeStamper.clear();
-    const stamper = new IframeStamper({
-      iframeUrl: "https://auth.turnkey.com",
-      iframeElementId: this.iframeConfig.iframeElementId,
-      iframeContainer: document.getElementById(
-        this.iframeConfig.iframeContainerId
-      )
-    });
-    this.iframeStamper = stamper;
-    await this._initIframeStamper();
+    this.indexedDbStamper.clear();
   }
   async signRawMessage(msg) {
     await this._updateStamper();
@@ -861,15 +791,15 @@ var WebSignerClient = class extends SignerClient {
   /**
    * Signs in a user with webauthn.
    *
-   * @param {WebauthnSignInParams} params params for the sign in
+   * @param {WebAuthnSignInParams} params params for the sign in
    */
-  async webauthnSignIn({ email }) {
+  async webAuthnSignIn({ email }) {
     const existingUserSubOrgId = await this.lookUpUser(email);
     if (!existingUserSubOrgId) {
-      await this._createAccount({ method: "webauthn", email });
+      await this._createWebAuthnAccount({ email });
     } else {
       this.stamper = this.webauthnStamper;
-      await this.whoAmI(existingUserSubOrgId);
+      await this.signIn(existingUserSubOrgId);
       this._sessionStore.type = "passkeys" /* Passkeys */;
       if (!this._sessionStore.user || !this._sessionStore.user.credentialId) {
         return;
@@ -886,127 +816,67 @@ var WebSignerClient = class extends SignerClient {
   /**
    * Handles auth user process with email according to the method of the used app.
    *
-   * @param {EmailInitializeAuthParams} params params needed for the initialization of the auth process
+   * @param {InitEmailAuthParams} params params needed for the initialization of the auth process
    */
-  async emailAuth(params) {
-    const method = await this.getEmailAuthMethod();
-    if (method === "magiclink") {
-      const existingUserSubOrgId = await this.lookUpUser(params.email);
-      if (!existingUserSubOrgId) {
-        await this._createAccount({ method: "email", ...params });
-      } else {
-        await this._initMagicLinkAuth(params);
-      }
-    } else if (method === "otp") {
-      const { otpId } = await this._initOtpAuth({ email: params.email });
-      if (!otpId) throw new NotFoundError("No OTP init response returned.");
-      this._sessionStore.otpId = otpId;
-    } else {
-      throw new Error("Invalid email authentication method.");
-    }
-    return { method };
+  async initEmailAuth(params) {
+    await this.indexedDbStamper.resetKeyPair();
+    const { otpId } = await this._initEmailAuth(params);
+    if (!otpId) throw new NotFoundError("No OTP init response returned.");
+    this._sessionStore.otpId = otpId;
   }
-  async getIframePublicKey() {
-    return await this._initIframeStamper();
+  async getPublicKey() {
+    await this._initIndexedDbStamper();
+    return this.indexedDbStamper.getPublicKey();
+  }
+  async resetKeyPair() {
+    await this._initIndexedDbStamper();
+    await this.indexedDbStamper.resetKeyPair();
   }
   /**
    * Verifies the provided otp code.
    *
-   * @param {CompleteAuthWithOtpParams} params params needed for otp code verification
+   * @param {CompleteEmailAuthParams} params params needed for otp code verification
    */
-  async otpAuth(params) {
-    const { credentialBundle, subOrgId } = await this.request(
-      "/v1/otp-auth",
-      "POST",
-      {
-        email: params.email,
-        otpCode: params.otpCode,
-        otpId: this._sessionStore.otpId,
-        targetPublicKey: await this.getIframePublicKey()
-      }
-    );
-    if (!credentialBundle || !subOrgId)
+  async completeEmailAuth(params) {
+    await this._initIndexedDbStamper();
+    if (!this._sessionStore.otpId)
+      throw new NotFoundError("No OTP ID found in session store.");
+    const { subOrgId } = await this.request("/v1/email/complete", "POST", {
+      otpId: this._sessionStore.otpId,
+      otpCode: params.otpCode,
+      publicKey: await this.getPublicKey()
+    });
+    if (!subOrgId)
       throw new NotFoundError("No OTP authentication response returned.");
-    return {
-      bundle: credentialBundle,
-      subOrgId
-    };
+    await this.signIn(subOrgId);
+    this._sessionStore.type = "email" /* Email */;
+    this._sessionStore.clearOtpId();
   }
   /**
    * Gets the email authentication method of the app.
    */
   async getEmailAuthMethod() {
-    const { method } = await this.request("/v1/email-auth", "GET");
+    const { method } = await this.request("/v1/email/method", "GET");
     return method;
   }
-  /**
-   * Starts email authentication process via otp.
-   */
-  async _initOtpAuth(params) {
-    return this.request("/v1/otp-auth", "POST", { email: params.email });
-  }
-  /**
-   * Completes the authentication process with a credential bundle.
-   *
-   * @param {CompleteAuthWithBundleParams} params params for the completion of the auth process
-   */
-  async completeAuthWithBundle({
-    bundle,
-    subOrgId,
-    sessionType
-  }) {
-    await this._initIframeStamper();
-    const result = await this.iframeStamper.injectCredentialBundle(bundle);
-    if (!result) {
-      throw new Error("Failed to inject credential bundle");
-    }
-    await this.whoAmI(subOrgId);
-    this._sessionStore.type = sessionType;
-    this._sessionStore.bundle = bundle;
-  }
   /**
    * Checks for an existing session and if exists, updates the stamper accordingly.
    */
   async _updateStamper() {
-    if (this._sessionStore.type === void 0 && (this._sessionStore.bundle === void 0 || this._sessionStore.token === void 0))
+    if (this._sessionStore.type === void 0 && this._sessionStore.token === void 0)
       return;
     if (this._sessionStore.type === "passkeys" /* Passkeys */) {
       this.stamper = this.webauthnStamper;
     } else {
-      this.stamper = this.iframeStamper;
-      await this.completeAuthWithBundle({
-        bundle: this._sessionStore.bundle,
-        subOrgId: this._sessionStore.user?.subOrgId,
-        sessionType: this._sessionStore.type
-      });
-    }
-  }
-  /**
-   * Init authentication with magic link email.
-   *
-   * @param {EmailInitializeAuthParams} params params for the sign in
-   */
-  async _initMagicLinkAuth({
-    email,
-    expirationSeconds,
-    redirectUrl
-  }) {
-    if (!redirectUrl) {
-      throw new Error("redirectUrl is required for magic link authentication.");
+      this.stamper = this.indexedDbStamper;
     }
-    return this.request("/v1/email-auth", "POST", {
-      email,
-      targetPublicKey: await this.getIframePublicKey(),
-      expirationSeconds,
-      redirectUrl: redirectUrl.toString()
-    });
   }
   /**
    * Creates a passkey account using the webauthn stamper.
    *
-   * @param {Extract<CreateAccountParams, { method: 'webauthn' }>} params params for the creation of the account
+   * @param {WebAuthnSignInParams} params params for the creation of the account
    */
-  async _createWebauthnAccount(params) {
+  async _createWebAuthnAccount(params) {
     const { challenge, attestation } = await this._webauthnGenerateAttestation(
       params.email
     );
@@ -1014,11 +884,9 @@ var WebSignerClient = class extends SignerClient {
       "/v1/signup",
       "POST",
       {
-        passkey: {
-          challenge: LibBase64.fromBuffer(challenge),
-          attestation
-        },
-        email: params.email
+        email: params.email,
+        challenge: LibBase64.fromBuffer(challenge),
+        attestation
       }
     );
     this._sessionStore.user = {
@@ -1031,42 +899,17 @@ var WebSignerClient = class extends SignerClient {
     this._scheduleRefresh(token);
   }
   /**
-   * Creates an email account using the iframe stamper.
+   * Init account creation with email.
    *
-   * @param {Extract<CreateAccountParams, { method: 'email' }>} params params for the creation of the account
+   * @param {InitEmailAuthParams} params params for the creation of the account
    */
-  async _createEmailAccount(params) {
-    const { email, expirationSeconds, redirectUrl } = params;
-    if (!redirectUrl) {
-      throw new Error("redirectUrl is required for magic link authentication.");
-    }
-    const response = await this.request("/v1/signup", "POST", {
-      email,
-      iframe: {
-        targetPublicKey: await this.getIframePublicKey(),
-        expirationSeconds,
-        redirectUrl: redirectUrl.toString()
-      }
+  async _initEmailAuth(params) {
+    const response = await this.request("/v1/email/init", "POST", {
+      email: params.email,
+      redirectUrl: params.redirectUrl ? params.redirectUrl.toString() : void 0
     });
     return response;
   }
-  /**
-   * Handle the account creation process.
-   *
-   * @param {CreateAccountParams} params params to create an account
-   */
-  async _createAccount(params) {
-    switch (params.method) {
-      case "webauthn": {
-        await this._createWebauthnAccount(params);
-        break;
-      }
-      case "email": {
-        await this._createEmailAccount(params);
-        break;
-      }
-    }
-  }
   async _webauthnGenerateAttestation(email) {
     const challenge = LibBytes.generateRandomBuffer();
     const authenticatorUserId = LibBytes.generateRandomBuffer();
@@ -1101,12 +944,11 @@ var WebSignerClient = class extends SignerClient {
     });
     return { challenge, attestation, authenticatorUserId };
   }
-  async _initIframeStamper() {
-    if (!this.iframeStamper.publicKey()) {
-      await this.iframeStamper.init();
+  async _initIndexedDbStamper() {
+    if (!this.indexedDbStamper.getPublicKey()) {
+      await this.indexedDbStamper.init();
     }
-    this.stamper = this.iframeStamper;
-    return this.iframeStamper.publicKey();
+    this.stamper = this.indexedDbStamper;
   }
 };
 
@@ -1221,12 +1063,11 @@ var FourtWebSigner = class {
    */
   constructor({
     configuration,
-    auth: { webauthn, iframe, oauth }
+    auth: { webauthn, oauth }
   }) {
     this._webSignerClient = new WebSignerClient({
       configuration,
       webauthn,
-      iframe,
       oauth
     });
     this._modules = {