@gerege-systems/eid-mongolia-sdk 0.14.0 → 0.14.2

package/dist/index.js

@@ -1,12 +1,15 @@
 import {
   ApiError,
   AuthenticationError,
+  CertChoiceInvalidError,
   DeviceLinkError,
   EidError,
   ForbiddenError,
   NetworkError,
+  NoSigningCertificateError,
   ON_BEHALF_ERROR_CODES,
   RETRYABLE_ERROR_CODES,
+  RequestInvalidError,
   ResponseTooLargeError,
   SessionFailedError,
   ValidationError,
@@ -15,7 +18,7 @@ import {
   maskPath,
   openOrShowQR,
   parseRetryAfter
-} from "./chunk-QPJDZLHR.js";
+} from "./chunk-DXVHOZO7.js";
 
 // src/http.ts
 var DEFAULT_TIMEOUT_MS = 15e3;
@@ -85,7 +88,8 @@ var Http = class {
         { headers, retryAfterMs }
       );
     }
-    throw new ApiError(res.status, text, code, { headers, retryAfterMs });
+    const Typed = code === "NO_SIGNING_CERTIFICATE" ? NoSigningCertificateError : code === "CERT_CHOICE_INVALID" ? CertChoiceInvalidError : code === "REQUEST_INVALID" ? RequestInvalidError : ApiError;
+    throw new Typed(res.status, text, code, { headers, retryAfterMs });
   }
 };
 async function readLimited(res, limit, op) {
@@ -138,6 +142,11 @@ var RP_ROUTES = {
   authDeviceLinkEtsi: { method: "POST", path: "/authentication/device-link/etsi/{semanticsIdentifier}" },
   signNotificationEtsi: { method: "POST", path: "/signature/notification/etsi/{semanticsIdentifier}" },
   signNotificationDocument: { method: "POST", path: "/signature/notification/document/{documentNumber}" },
+  signNotificationLinked: { method: "POST", path: "/signature/notification/linked/{documentNumber}" },
+  signDeviceLinkEtsi: { method: "POST", path: "/signature/device-link/etsi/{semanticsIdentifier}" },
+  signDeviceLinkDocument: { method: "POST", path: "/signature/device-link/document/{documentNumber}" },
+  certChoiceDeviceLink: { method: "POST", path: "/signature/certificate-choice/device-link/anonymous" },
+  certChoiceEtsi: { method: "POST", path: "/signature/certificate-choice/notification/etsi/{semanticsIdentifier}" },
   pdfPrepare: { method: "POST", path: "/pdf/sign/prepare" },
   pdfDocument: { method: "GET", path: "/pdf/sign/{sessionID}/document" },
   orgRepresentations: { method: "GET", path: "/organization/representations/etsi/{personEtsi}" },
@@ -206,6 +215,21 @@ function acspV2Digest(p, hashAlgorithm) {
   return createHash(nodeHash(hashAlgorithm)).update(buildAcspV2Payload(p)).digest();
 }
 
+// src/types.ts
+var DEFAULT_SIGN_SESSION_TTL_MS = 6e5;
+function sessionExpiry(sentAtMs, ttlMs) {
+  return sentAtMs + (ttlMs && ttlMs > 0 ? ttlMs : DEFAULT_SIGN_SESSION_TTL_MS);
+}
+function parseExpiresAt(v) {
+  if (typeof v !== "string" || !/^\d{4}-\d{2}-\d{2}T/.test(v)) return void 0;
+  const t = Date.parse(v);
+  return Number.isFinite(t) ? t : void 0;
+}
+function startExpiry(raw, sentAtMs, ttlMs) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  return parseExpiresAt(r.expiresAt) ?? sessionExpiry(sentAtMs, ttlMs);
+}
+
 // src/auth.ts
 function rec(v) {
   return v && typeof v === "object" ? v : {};
@@ -251,11 +275,19 @@ var AuthApi = class {
   parseNotification(raw, acsp) {
     const r = rec(raw);
     const vc = rec(r.vc).value;
-    return { sessionId: String(r.sessionID), vc: vc != null ? String(vc) : null, rpChallenge: acsp.rpChallenge, acsp };
+    const expiresAt = parseExpiresAt(r.expiresAt);
+    return {
+      sessionId: String(r.sessionID),
+      vc: vc != null ? String(vc) : null,
+      rpChallenge: acsp.rpChallenge,
+      acsp,
+      ...expiresAt !== void 0 ? { expiresAt } : {}
+    };
   }
   parseDeviceLink(raw, acsp) {
     const r = rec(raw);
     const vc = typeof r.vc === "object" && r.vc !== null ? rec(r.vc).value : r.vc;
+    const expiresAt = parseExpiresAt(r.expiresAt);
     return {
       sessionId: String(r.sessionID),
       sessionToken: r.sessionToken != null ? String(r.sessionToken) : null,
@@ -264,7 +296,9 @@ var AuthApi = class {
       vc: vc != null ? String(vc) : null,
       rpChallenge: acsp.rpChallenge,
       acsp,
-      receivedAt: Date.now()
+      receivedAt: Date.now(),
+      sessionType: "auth",
+      ...expiresAt !== void 0 ? { expiresAt } : {}
     };
   }
   /** Push — РД/иргэний дугаар/ETSI-ээр (сервер төрлийг таьна). Иргэний утас руу мэдэгдэл очно. */
@@ -297,6 +331,10 @@ var AuthApi = class {
 function rec2(v) {
   return v && typeof v === "object" ? v : {};
 }
+var vcOf = (r) => {
+  const vc = typeof r.vc === "object" && r.vc !== null ? rec2(r.vc).value : r.vc;
+  return vc != null ? String(vc) : null;
+};
 var SignApi = class {
   constructor(http, creds, defaults) {
     this.http = http;
@@ -306,46 +344,155 @@ var SignApi = class {
   http;
   creds;
   defaults;
-  body(digestB64, interactions, opts) {
+  body(digestB64, interactions, opts, defAlg) {
+    const sign = {
+      digest: digestB64,
+      hashAlgorithm: opts?.hashAlgorithm ?? "SHA-256",
+      signatureAlgorithm: opts?.signatureAlgorithm ?? defAlg,
+      relyingPartyName: this.creds.rpName,
+      interactions: interactionsToBase64(interactions),
+      initialCallbackUrl: opts?.callbackUrl?.trim() ?? ""
+    };
     const body = {
       relyingPartyUUID: this.creds.rpUUID,
-      relyingPartyName: this.creds.rpName,
+      relyingPartyName: sign.relyingPartyName,
       certificateLevel: opts?.certificateLevel ?? this.defaults.certificateLevel,
       signatureProtocol: "RAW_DIGEST_SIGNATURE",
       signatureProtocolParameters: {
         digest: digestB64,
-        signatureAlgorithm: opts?.signatureAlgorithm ?? "rsassa-pss",
-        signatureAlgorithmParameters: { hashAlgorithm: opts?.hashAlgorithm ?? "SHA-256" }
+        signatureAlgorithm: sign.signatureAlgorithm,
+        signatureAlgorithmParameters: { hashAlgorithm: sign.hashAlgorithm }
       },
-      interactions: interactionsToBase64(interactions)
+      interactions: sign.interactions
     };
-    if (opts?.callbackUrl?.trim()) body.initialCallbackUrl = opts.callbackUrl.trim();
+    if (sign.initialCallbackUrl) body.initialCallbackUrl = sign.initialCallbackUrl;
     if (opts?.onBehalfOf?.trim()) body.onBehalfOf = opts.onBehalfOf.trim();
     if (opts?.fileName?.trim()) body.fileName = opts.fileName.trim();
-    return body;
+    return { body, sign };
   }
-  parse(raw) {
-    const r = rec2(raw);
-    const vc = rec2(r.vc).value;
-    return { sessionId: String(r.sessionID), vc: vc != null ? String(vc) : null, rpChallenge: "" };
+  async notification(path, body, sign) {
+    const sent = Date.now();
+    const r = rec2(await this.http.post(path, body));
+    return {
+      sessionId: String(r.sessionID),
+      vc: vcOf(r),
+      rpChallenge: "",
+      ...sign ? { sign } : {},
+      expiresAt: startExpiry(r, sent, this.defaults.sessionTtlMs)
+    };
+  }
+  async deviceLink(path, body, extra) {
+    const sent = Date.now();
+    const r = rec2(await this.http.post(path, body));
+    return {
+      sessionId: String(r.sessionID),
+      sessionToken: r.sessionToken != null ? String(r.sessionToken) : null,
+      sessionSecret: r.sessionSecret != null ? String(r.sessionSecret) : null,
+      deviceLinkBase: r.deviceLinkBase != null ? String(r.deviceLinkBase) : null,
+      vc: vcOf(r),
+      rpChallenge: "",
+      receivedAt: Date.now(),
+      ...extra,
+      expiresAt: startExpiry(r, sent, this.defaults.sessionTtlMs)
+    };
   }
   /**
    * Бэлэн digest-ээр push sign (РД/civil_id/ETSI). Баримт (PDF/файл)-ын байтын SHA-256
    * digest-ийг гаднаас бэлдэж өгнө — текст бус бинар баримтад тохиромжтой.
+   *
+   * ⚠️ Олон утастай иргэнд CA etsi-г ЭХНИЙ идэвхтэй төхөөрөмж рүү шийднэ. Гэрчилгээг урьдчилж мэдэх шаардлагатай бол
+   * (PAdES/CMS) {@link certificateChoiceByEtsi} → {@link digestForSigner}.
    */
   async digestByEtsi(id, digestB64, interactions, opts) {
-    const raw = await this.http.post(routePath(RP_ROUTES.signNotificationEtsi, id), this.body(digestB64, interactions, opts));
-    return this.parse(raw);
+    const { body, sign } = this.body(digestB64, interactions, opts, "rsassa-pss");
+    return this.notification(routePath(RP_ROUTES.signNotificationEtsi, id), body, sign);
   }
-  /** Бэлэн digest-ээр push sign — баримтын дугаараар (auth-аас гарсан documentNumber дээр). */
+  /** Бэлэн digest-ээр push sign — баримтын дугаараар (auth / certificate-choice-оос гарсан documentNumber дээр). */
   async digestByDocument(documentNumber, digestB64, interactions, opts) {
-    const raw = await this.http.post(routePath(RP_ROUTES.signNotificationDocument, documentNumber), this.body(digestB64, interactions, opts));
-    return this.parse(raw);
+    const { body, sign } = this.body(digestB64, interactions, opts, "rsassa-pss");
+    return this.notification(routePath(RP_ROUTES.signNotificationDocument, documentNumber), body, sign);
   }
   /** Текстийн SHA-256 digest-ийг дотроо тооцоод push sign (богино текст баримтад тохиромжтой). */
   async textByEtsi(id, text, interactions, opts) {
     return this.digestByEtsi(id, sha256Base64(text), interactions, opts);
   }
+  /**
+   * QR / Web2App / App2App sign — тодорхой иргэн (РД/civil_id/ETSI). Холбоосыг backend-д
+   * `buildDeviceLink(deviceLinkInput(s, type, lang))`-ээр; Web2App/App2App-д `callbackUrl` заавал.
+   * `validateSign`-д `expectedFlowType` = харуулсан холбоосын төрөл.
+   */
+  async deviceLinkByEtsi(id, digestB64, interactions, opts) {
+    const { body, sign } = this.body(digestB64, interactions, opts, "rsassa-pss");
+    return this.deviceLink(routePath(RP_ROUTES.signDeviceLinkEtsi, id), body, { sessionType: "sign", sign });
+  }
+  /** QR / Web2App / App2App sign — баримтын дугаараар (тодорхой төхөөрөмж). */
+  async deviceLinkByDocument(documentNumber, digestB64, interactions, opts) {
+    const { body, sign } = this.body(digestB64, interactions, opts, "rsassa-pss");
+    return this.deviceLink(routePath(RP_ROUTES.signDeviceLinkDocument, documentNumber), body, { sessionType: "sign", sign });
+  }
+  // ── Certificate-choice ──
+  certChoiceBody(opts) {
+    return {
+      relyingPartyUUID: this.creds.rpUUID,
+      relyingPartyName: this.creds.rpName,
+      certificateLevel: opts?.certificateLevel ?? this.defaults.certificateLevel
+    };
+  }
+  /**
+   * Push: иргэний (РД/civil_id/ETSI) утас руу гарын үсгийн гэрчилгээ сонгуулах хүсэлт (PIN-гүй). Үр дүнг
+   * `session.waitForResult` → `validator.validateCertificateChoice`. CERT эрх шаардана.
+   */
+  async certificateChoiceByEtsi(id, opts) {
+    return this.notification(routePath(RP_ROUTES.certChoiceEtsi, id), this.certChoiceBody(opts));
+  }
+  /**
+   * QR: иргэн хэн болохыг урьдчилж мэдэхгүй үед гэрчилгээ сонгуулах. CA-ийн certificate-choice хүсэлт
+   * initialCallbackUrl авдаггүй тул ЗӨВХӨН QR холбоос (`deviceLinkInput(s, "QR", lang)`). CERT эрх.
+   */
+  async certificateChoiceDeviceLink(opts) {
+    return this.deviceLink(routePath(RP_ROUTES.certChoiceDeviceLink), this.certChoiceBody(opts), {
+      sessionType: "cert",
+      relyingPartyName: this.creds.rpName
+    });
+  }
+  // ── Гэрчилгээ урьдчилж мэдэгдэх гарын үсэг (client-side PAdES / CMS) ──
+  signerBody(signer, digestB64, interactions, opts) {
+    if (!signer?.documentNumber?.trim()) {
+      throw new Error("eid: signer.documentNumber \u0445\u043E\u043E\u0441\u043E\u043D \u2014 validateCertificateChoice-\u0438\u0439\u043D \u04AF\u0440 \u0434\u04AF\u043D\u0433 \u04E9\u0433");
+    }
+    const out = this.body(digestB64, interactions, opts, "sha256WithRSAEncryption");
+    const want = hashLen(out.sign.hashAlgorithm);
+    const d = /^[A-Za-z0-9+/]*={0,2}$/.test(digestB64) ? Buffer.from(digestB64, "base64") : null;
+    if (!d || d.length !== want || d.toString("base64") !== digestB64) {
+      throw new Error(`eid: digest \u043D\u044C \u0441\u0442\u0430\u043D\u0434\u0430\u0440\u0442 base64, ${out.sign.hashAlgorithm}-\u0438\u0439\u043D \u0443\u0440\u0442 (${want} \u0431\u0430\u0439\u0442) \u0431\u0430\u0439\u0445 \u0451\u0441\u0442\u043E\u0439`);
+    }
+    return out;
+  }
+  /**
+   * Certificate-choice-оор сонгосон ЯГ ТЭР төхөөрөмж (`signer.documentNumber`) рүү push sign. Олон утастай иргэнд
+   * etsi-ээр эхлүүлбэл өөр утас (өөр гэрчилгээ) зурж, гэрчилгээг урьдчилж оруулсан CMS (PAdES signingCertificateV2)
+   * хүчингүй болдог — тиймээс digest-ийг ҮРГЭЛЖ documentNumber-аар зуруулна.
+   *
+   * `signer.certChoiceSessionId` байвал `/signature/notification/linked/{documentNumber}` (`linkedSessionID`), эс
+   * бөгөөс `/signature/notification/document/{documentNumber}`. Default `sha256WithRSAEncryption` + SHA-256 (digest =
+   * 32 байт DTBS); digest-ийн урт буруу бол хүсэлт явахгүй. Хариуг:
+   * `validator.validateSign(r, s.sign.digest, { hashAlgorithm: s.sign.hashAlgorithm, expectedAlgorithm:
+   * s.sign.signatureAlgorithm, expectedCertificate: signer.certificate, expectedFlowType: "Notification" })`.
+   */
+  async digestForSigner(signer, digestB64, interactions, opts) {
+    const { body, sign } = this.signerBody(signer, digestB64, interactions, opts);
+    const linked = signer.certChoiceSessionId?.trim();
+    if (linked) {
+      body.linkedSessionID = linked;
+      return this.notification(routePath(RP_ROUTES.signNotificationLinked, signer.documentNumber), body, sign);
+    }
+    return this.notification(routePath(RP_ROUTES.signNotificationDocument, signer.documentNumber), body, sign);
+  }
+  /** {@link digestForSigner}-ийн QR / Web2App / App2App хувилбар: `/signature/device-link/document/{documentNumber}`. */
+  async deviceLinkForSigner(signer, digestB64, interactions, opts) {
+    const { body, sign } = this.signerBody(signer, digestB64, interactions, opts);
+    return this.deviceLink(routePath(RP_ROUTES.signDeviceLinkDocument, signer.documentNumber), body, { sessionType: "sign", sign });
+  }
 };
 
 // src/session.ts
@@ -1106,13 +1253,19 @@ var ResponseValidator = class {
    * @param opts — `hashAlgorithm` мөр (хуучин хэлбэр; default SHA-256) эсвэл {@link ValidateSignOptions}.
    */
   validateSign(result, digestB64, opts = {}) {
-    const { hashAlgorithm = "SHA-256", expectedFlowType } = typeof opts === "string" ? { hashAlgorithm: opts } : opts;
+    const o = typeof opts === "string" ? { hashAlgorithm: opts } : opts;
+    const { hashAlgorithm = "SHA-256", expectedFlowType } = o;
     const leaf = this.precheck(result, "RAW_DIGEST_SIGNATURE");
     if (expectedFlowType && result.flowType !== expectedFlowType) {
       throw new ValidationError(`flowType ${result.flowType} \u2260 \u044D\u0445\u043B\u04AF\u04AF\u043B\u0441\u044D\u043D \u0443\u0440\u0441\u0433\u0430\u043B ${expectedFlowType} (relay \u0431\u0430\u0439\u0436 \u0431\u043E\u043B\u0437\u043E\u0448\u0433\u04AF\u0439)`);
     }
+    if (o.expectedCertificate && !leaf.raw.equals(o.expectedCertificate.raw)) {
+      throw new ValidationError(
+        `\u0413\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D certificate-choice-\u043E\u043E\u0440 \u0441\u043E\u043D\u0433\u043E\u0441\u043E\u043D\u0442\u043E\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439 (serial ${leaf.serialNumber} \u2260 ${o.expectedCertificate.serialNumber})`
+      );
+    }
     const digest = Buffer.from(digestB64, "base64");
-    const { alg, hash } = this.algorithmOf(result, leaf, null, hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, o.expectedAlgorithm ?? null, hashAlgorithm);
     if (digest.length !== hashLen(hash)) throw new ValidationError("digest \u0443\u0440\u0442 hashAlgorithm-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
     if (!verifyPrehashedSignature(digest, result.signatureValueB64, leaf.publicKey, alg, hash)) {
       throw new ValidationError("\u0413\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u04E9\u0433\u0441\u04E9\u043D digest-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
@@ -1126,6 +1279,24 @@ var ResponseValidator = class {
       parsedSubject: parseSubject(leaf)
     };
   }
+  /**
+   * Certificate-choice session-ий хариуг шалгана: COMPLETE/OK (эс бөгөөс `SessionFailedError`), гэрчилгээ ба
+   * documentNumber байгаа, хугацаа, certLevel, зориулалт (гарын үсгийн — contentCommitment, `checkKeyUsage` үед), гинж,
+   * issuer. Энэ хариунд гарын үсэг БАЙХГҮЙ — иргэнийг таниагүй (нэвтрэлт биш); зөвхөн дараагийн sign session-ий
+   * гэрчилгээг урьдчилж мэдэхэд. `sessionId` — certificate-choice session.
+   */
+  validateCertificateChoice(result, sessionId = null) {
+    this.sessionDone(result);
+    const leaf = this.leafOf(result, "RAW_DIGEST_SIGNATURE");
+    return {
+      documentNumber: result.documentNumber,
+      certificate: leaf,
+      certificateDerB64: leaf.raw.toString("base64"),
+      certificateLevel: String(result.certificateLevel ?? ""),
+      parsedSubject: parseSubject(leaf),
+      certChoiceSessionId: sessionId
+    };
+  }
   /**
    * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
    * (downgrade / alg confusion хаалт).
@@ -1175,13 +1346,22 @@ var ResponseValidator = class {
   // ── дотоод ──
   /** state/endResult, cert байгаа эсэх, chain, validity, certLevel — нийтлэг шалгалт. */
   precheck(result, protocol) {
-    if (result.state !== "COMPLETE") throw new ValidationError(`Session \u0434\u0443\u0443\u0441\u0430\u0430\u0433\u04AF\u0439 (state=${result.state})`);
-    if (result.endResult !== "OK") throw new SessionFailedError(result.endResult ?? "UNKNOWN");
+    this.sessionDone(result);
     if (result.signatureProtocol && result.signatureProtocol !== protocol) {
       throw new ValidationError(`signatureProtocol ${result.signatureProtocol} \u2260 ${protocol}`);
     }
     if (!result.certificateDerB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0430\u043B\u0433\u0430");
     if (!result.signatureValueB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0430\u043B\u0433\u0430");
+    return this.leafOf(result, protocol);
+  }
+  /** COMPLETE + OK; амжилтгүй endResult → SessionFailedError. */
+  sessionDone(result) {
+    if (result.state !== "COMPLETE") throw new ValidationError(`Session \u0434\u0443\u0443\u0441\u0430\u0430\u0433\u04AF\u0439 (state=${result.state})`);
+    if (result.endResult !== "OK") throw new SessionFailedError(result.endResult ?? "UNKNOWN");
+  }
+  /** Хариуны гэрчилгээ: documentNumber, задлалт, хугацаа, certLevel, зориулалт (protocol), гинж, issuer. */
+  leafOf(result, protocol) {
+    if (!result.certificateDerB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0430\u043B\u0433\u0430");
     if (!result.documentNumber) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 documentNumber \u0430\u043B\u0433\u0430");
     const leaf = new X509Certificate3(Buffer.from(result.certificateDerB64, "base64"));
     this.checkValidity(leaf);
@@ -1598,7 +1778,7 @@ var EidClient = class {
     });
     const level = cfg.defaultCertificateLevel ?? "QUALIFIED";
     this.auth = new AuthApi(http, cfg.credentials, { certificateLevel: level });
-    this.sign = new SignApi(http, cfg.credentials, { certificateLevel: level });
+    this.sign = new SignApi(http, cfg.credentials, { certificateLevel: level, sessionTtlMs: cfg.signSessionTtlMs });
     this.pdf = new PdfApi(http, cfg.credentials, {
       certificateLevel: level,
       timeoutMs: cfg.pdfTimeoutMs ?? DEFAULT_PDF_TIMEOUT_MS,
@@ -1674,6 +1854,37 @@ function buildDeviceLink(p) {
   const authCode = createHmac("sha256", Buffer.from(p.sessionSecret, "base64")).update(payload, "utf8").digest("base64url");
   return `${unprotected}&authCode=${authCode}`;
 }
+function deviceLinkInput(s, deviceLinkType, lang) {
+  const base = {
+    deviceLinkBase: s.deviceLinkBase ?? "",
+    deviceLinkType,
+    sessionToken: s.sessionToken ?? "",
+    sessionSecret: s.sessionSecret ?? "",
+    lang,
+    receivedAt: s.receivedAt
+  };
+  if (s.sessionType === "sign" && s.sign) {
+    return {
+      ...base,
+      sessionType: "sign",
+      digest: s.sign.digest,
+      relyingPartyName: s.sign.relyingPartyName,
+      interactions: s.sign.interactions,
+      initialCallbackUrl: s.sign.initialCallbackUrl
+    };
+  }
+  if (s.sessionType === "cert") {
+    return { ...base, sessionType: "cert", relyingPartyName: s.relyingPartyName ?? "", interactions: "" };
+  }
+  return {
+    ...base,
+    sessionType: "auth",
+    rpChallenge: s.acsp?.rpChallenge ?? s.rpChallenge,
+    relyingPartyName: s.acsp?.relyingPartyName ?? "",
+    interactions: s.acsp?.interactions ?? "",
+    initialCallbackUrl: s.acsp?.initialCallbackUrl ?? ""
+  };
+}
 function qrDeviceLinkTicker(input, onLink, opts) {
   const clock = opts?.clock ?? Date.now;
   const tick = () => onLink(buildDeviceLink({ ...input, deviceLinkType: "QR", now: clock() }));
@@ -1710,6 +1921,16 @@ function memoryLoginStore() {
   };
 }
 var CALLBACK_PATH = "/auth/eid/callback";
+function forwardedClientIp(headers, trustProxy) {
+  if (trustProxy === false || trustProxy === 0) return void 0;
+  const xff = header(headers, "x-forwarded-for").split(",").map((x) => x.trim()).filter(Boolean);
+  if (xff.length) {
+    if (trustProxy === true) return xff[0];
+    const n = Math.floor(trustProxy);
+    return n >= 1 && n <= xff.length ? xff[xff.length - n] : void 0;
+  }
+  return header(headers, "x-real-ip").trim() || void 0;
+}
 var ID_RE = /^(\p{L}{2}[0-9]{8}|[0-9]{8,14}|PNOMN-[0-9]{8,14})$/u;
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var B64URL_RE = /^[A-Za-z0-9_-]{43}$/;
@@ -1761,11 +1982,12 @@ function safeEqualHex(a, b) {
   const y = Buffer.from(b, "hex");
   return x.length === y.length && x.length > 0 && timingSafeEqual2(x, y);
 }
-function toIdentity(r, v, flowType) {
+function toIdentity(sessionId, r, v, flowType) {
   const s = v.parsedSubject;
   const etsi = s.serialNumber ?? "";
   const m = /^PNOMN-([0-9]+)$/.exec(etsi);
   return {
+    sessionId,
     etsi,
     civilId: m ? m[1] : null,
     givenName: s.givenName ?? null,
@@ -1933,7 +2155,8 @@ function createEidLogin(opts) {
     const idCode = typeof body.idCode === "string" ? body.idCode.replace(/\s+/g, "").toUpperCase() : "";
     if (mode === "push" && !ID_RE.test(idCode)) return json(400, { error: "invalid_id" });
     const limited = () => json(429, { error: "rate_limited" }, { "Retry-After": "60" });
-    if (req.ip && !await rateLimit(`start:${req.ip}`)) return limited();
+    const ip = req.ip || (opts.trustProxy ? forwardedClientIp(req.headers, opts.trustProxy) : void 0);
+    if (ip && !await rateLimit(`start:${ip}`)) return limited();
     if (mode === "push" && !await rateLimit(`push:${idCode}`)) return limited();
     let r;
     try {
@@ -1955,7 +2178,7 @@ function createEidLogin(opts) {
   async function finish(req, tx, r, flow, verifier) {
     const v = client.validator.validateAuth(r, tx.acsp, { expectedFlowType: flow, userChallengeVerifier: verifier });
     if (!await store.delete(tx.sessionId)) return void 0;
-    const out = await opts.onSuccess(toIdentity(r, v, flow), { request: req, mode: tx.mode }) ?? {};
+    const out = await opts.onSuccess(toIdentity(tx.sessionId, r, v, flow), { request: req, mode: tx.mode }) ?? {};
     return out;
   }
   async function status(req) {
@@ -2038,11 +2261,20 @@ function createEidLogin(opts) {
     }
     return json(404, { error: "not_found" });
   }
+  let warnedNoIp = false;
   async function handle(req) {
     const headers = {};
     req.headers.forEach((v, k) => headers[k] = v);
     const body = req.method === "POST" ? await req.text() : void 0;
-    const r = await handleRequest({ method: req.method, url: req.url, headers, body });
+    const ip = opts.getClientIp?.(req) || void 0;
+    if (!ip && !opts.getClientIp && !opts.trustProxy && !warnedNoIp) {
+      warnedNoIp = true;
+      onError(new Error("eid-login: handle(Request)-\u0434 \u043A\u043B\u0438\u0435\u043D\u0442 IP \u0430\u043B\u0433\u0430 \u2014 `start:<ip>` \u0445\u044F\u0437\u0433\u0430\u0430\u0440 \u0430\u0436\u0438\u043B\u043B\u0430\u0445\u0433\u04AF\u0439; getClientIp \u044D\u0441\u0432\u044D\u043B trustProxy \u04E9\u0433"), {
+        request: { method: req.method, url: req.url, headers },
+        mode: "qr"
+      });
+    }
+    const r = await handleRequest({ method: req.method, url: req.url, headers, body, ip });
     const h = new Headers();
     for (const [k, v] of Object.entries(r.headers)) for (const x of [v].flat()) h.append(k, x);
     return new Response(r.status === 302 || r.status === 303 || r.body === "" ? null : r.body, { status: r.status, headers: h });
@@ -2054,20 +2286,24 @@ export {
   AuthApi,
   AuthenticationError,
   CITIZEN_ISSUING_CA_SKI,
+  CertChoiceInvalidError,
   DEFAULT_BASE_URL,
   DEFAULT_PDF_MAX_BYTES,
   DEFAULT_PDF_TIMEOUT_MS,
+  DEFAULT_SIGN_SESSION_TTL_MS,
   DeviceLinkError,
   EidClient,
   EidError,
   ForbiddenError,
   Http,
   NetworkError,
+  NoSigningCertificateError,
   ON_BEHALF_ERROR_CODES,
   OrganizationApi,
   PdfApi,
   PersonApi,
   RETRYABLE_ERROR_CODES,
+  RequestInvalidError,
   ResponseTooLargeError,
   ResponseValidator,
   SessionApi,
@@ -2080,10 +2316,13 @@ export {
   buildDeviceLink,
   createEidLogin,
   deviceLink,
+  deviceLinkInput,
+  forwardedClientIp,
   interactionsToBase64,
   isMobileUserAgent,
   memoryLoginStore,
   openOrShowQR,
+  parseExpiresAt,
   parseRetryAfter,
   parseSessionResult,
   parseSubject,
@@ -2091,7 +2330,9 @@ export {
   qrDeviceLinkTicker,
   randomChallenge,
   resolveBaseUrl,
+  sessionExpiry,
   sha256Base64,
+  startExpiry,
   tokenAuthDigest,
   tokenLimitOf,
   userChallengeOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gerege-systems/eid-mongolia-sdk",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "e-ID Mongolia Relying Party SDK — иргэнээр утсаар нь нэвтрэлт ба хууль ёсны цахим гарын үсэг (RP-API v3, Smart-ID нийцтэй).",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
   },
   "scripts": {
     "build": "tsup src/index.ts src/browser.ts --format esm,cjs --dts --clean && tsup src/button.ts --format esm,cjs --dts --tsconfig tsconfig.button.json",
-    "test": "npm run build && node --test --experimental-strip-types test/sdk.test.ts test/portal-gaps.test.ts test/chain.test.ts test/qr.test.ts test/login.test.ts test/button.test.ts",
+    "test": "npm run build && node --test --experimental-strip-types test/sdk.test.ts test/portal-gaps.test.ts test/chain.test.ts test/qr.test.ts test/login.test.ts test/button.test.ts test/sign-gaps.test.ts test/session-start.test.ts",
     "test:contract": "npm run build && node --experimental-strip-types test/contract.test.ts",
     "lint": "tsc --noEmit && tsc --noEmit -p tsconfig.button.json"
   },