@gerege-systems/eid-mongolia-sdk 0.6.0 → 0.6.1

package/README.md

@@ -160,6 +160,9 @@ OK ирж болзошгүй. Иймд `ResponseValidator`:
 4. Гарын үсгийг иргэний public key-ээр шалгана:
    - **auth** → ACSP_V2 payload (`smart-id|ACSP_V2|serverRandom|rpChallenge|userChallenge|B64(rpName)|B64(brokeredRpName)|B64(SHA-256(interactions))|interactionTypeUsed|initialCallbackUrl|flowType`, hash = хүсэлтийн `hashAlgorithm`) дээр — `flowType`, `userChallenge`, `serverRandom` ба алгоритмын downgrade-ийг мөн шалгана;
      `expectedFlowType` өгвөл `flowType` эхлүүлсэн урсгалтай ЯГ таарах, Web2App/App2App-д `userChallengeVerifier` заавал
+     `initialCallbackUrl`-ийг хариуны `signature.initialCallbackUrl`-аас авна (CA урсгалаар шийднэ: QR/Notification →
+     `""`, Web2App/App2App → таны callback; шилжилтийн үед legacy `/dl` ба push-д таны callback) — зөвхөн `""` эсвэл
+     таны илгээсэн callback байхад, Web2App/App2App-д заавал таны callback; өөр утга → татгалзана
    - **sign** → RP-ийн өгсөн digest дээр
 
 Аль нэг алхам бүтэлгүйтвэл `ValidationError` шиднэ — хариунд **итгэхгүй**.

package/dist/{browser-PhjcbuAN.d.cts → browser-BU9ShPWO.d.cts}

@@ -116,6 +116,12 @@ interface SessionResult {
     serverRandom: string | null;
     userChallenge: string | null;
     flowType: string | null;
+    /**
+     * ACSP_V2 payload-д гарын үсэг зурагдсан `initialCallbackUrl` (хариуны `signature.initialCallbackUrl`,
+     * eID нэмэлт). Smart-ID: QR/Notification → `""`, Web2App/App2App → RP-ийн илгээсэн URL. null = хариунд
+     * талбар алга (хуучин CA). Validator үүнийг зөвхөн `""` эсвэл RP-ийн өөрийн callback байхад л хүлээн авна.
+     */
+    initialCallbackUrl?: string | null;
     signatureAlgorithmParameters: SignatureAlgorithmParameters | null;
     interactionTypeUsed: string | null;
     /**

package/dist/{browser-PhjcbuAN.d.ts → browser-BU9ShPWO.d.ts}

@@ -116,6 +116,12 @@ interface SessionResult {
     serverRandom: string | null;
     userChallenge: string | null;
     flowType: string | null;
+    /**
+     * ACSP_V2 payload-д гарын үсэг зурагдсан `initialCallbackUrl` (хариуны `signature.initialCallbackUrl`,
+     * eID нэмэлт). Smart-ID: QR/Notification → `""`, Web2App/App2App → RP-ийн илгээсэн URL. null = хариунд
+     * талбар алга (хуучин CA). Validator үүнийг зөвхөн `""` эсвэл RP-ийн өөрийн callback байхад л хүлээн авна.
+     */
+    initialCallbackUrl?: string | null;
     signatureAlgorithmParameters: SignatureAlgorithmParameters | null;
     interactionTypeUsed: string | null;
     /**

package/dist/browser.d.cts

@@ -1 +1 @@
-export { d as DeviceLinkError, e as DeviceLinkInput, D as DeviceLinkSession, E as EidError, h as NavigatorLike, O as OpenOrShowQROptions, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.cjs';
+export { d as DeviceLinkError, e as DeviceLinkInput, D as DeviceLinkSession, E as EidError, h as NavigatorLike, O as OpenOrShowQROptions, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-BU9ShPWO.cjs';

package/dist/browser.d.ts

@@ -1 +1 @@
-export { d as DeviceLinkError, e as DeviceLinkInput, D as DeviceLinkSession, E as EidError, h as NavigatorLike, O as OpenOrShowQROptions, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.js';
+export { d as DeviceLinkError, e as DeviceLinkInput, D as DeviceLinkSession, E as EidError, h as NavigatorLike, O as OpenOrShowQROptions, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-BU9ShPWO.js';

package/dist/index.cjs

@@ -336,6 +336,9 @@ function parseSessionResult(raw) {
     serverRandom: str(sig.serverRandom),
     userChallenge: str(sig.userChallenge),
     flowType: str(sig.flowType),
+    // CA-ийн eID нэмэлт (f59d14ee-оос): гарын үсэг зурагдсан ACSP_V2 initialCallbackUrl. "" нь утга —
+    // null/undefined-аас ялгана (талбар алга = хуучин CA).
+    initialCallbackUrl: typeof sig.initialCallbackUrl === "string" ? sig.initialCallbackUrl : null,
     signatureAlgorithmParameters: parseSigParams(sig.signatureAlgorithmParameters),
     interactionTypeUsed: str(r.interactionTypeUsed),
     onBehalfOf: parseOrg(r.onBehalfOf)
@@ -447,7 +450,7 @@ var ResponseValidator = class {
       brokeredRpName: acsp.brokeredRpName,
       interactions: acsp.interactions,
       interactionTypeUsed,
-      initialCallbackUrl: acsp.initialCallbackUrl,
+      initialCallbackUrl: signedCallbackUrl(result.initialCallbackUrl, acsp.initialCallbackUrl, flowType),
       flowType
     });
     if (!verifyPayloadSignature(payload, result.signatureValueB64, leaf.publicKey, alg, hash)) {
@@ -584,6 +587,17 @@ var ResponseValidator = class {
     }
   }
 };
+function signedCallbackUrl(fromResponse, rpCallback, flowType) {
+  const rp = rpCallback ?? "";
+  if (fromResponse == null) return rp;
+  if (fromResponse !== "" && fromResponse !== rp) {
+    throw new ValidationError("signature.initialCallbackUrl \u043D\u044C \u0445\u043E\u043E\u0441\u043E\u043D \u0447 \u0431\u0438\u0448, \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0447 \u0431\u0438\u0448 (\u0445\u0443\u0443\u0440\u0430\u043C\u0447 \u0445\u0430\u0440\u0438\u0443 \u0431\u0430\u0439\u0436 \u0431\u043E\u043B\u0437\u043E\u0448\u0433\u04AF\u0439)");
+  }
+  if ((flowType === "Web2App" || flowType === "App2App") && fromResponse !== rp) {
+    throw new ValidationError(`${flowType} \u0443\u0440\u0441\u0433\u0430\u043B\u0434 signature.initialCallbackUrl \u043D\u044C \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0431\u0430\u0439\u0445 \u0451\u0441\u0442\u043E\u0439`);
+  }
+  return fromResponse;
+}
 function userChallengeOf(verifier) {
   return (0, import_node_crypto2.createHash)("sha256").update(verifier, "utf8").digest("base64url");
 }

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-PhjcbuAN.cjs';
-export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.cjs';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-BU9ShPWO.cjs';
+export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-BU9ShPWO.cjs';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-PhjcbuAN.js';
-export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.js';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-BU9ShPWO.js';
+export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-BU9ShPWO.js';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {

package/dist/index.js

@@ -261,6 +261,9 @@ function parseSessionResult(raw) {
     serverRandom: str(sig.serverRandom),
     userChallenge: str(sig.userChallenge),
     flowType: str(sig.flowType),
+    // CA-ийн eID нэмэлт (f59d14ee-оос): гарын үсэг зурагдсан ACSP_V2 initialCallbackUrl. "" нь утга —
+    // null/undefined-аас ялгана (талбар алга = хуучин CA).
+    initialCallbackUrl: typeof sig.initialCallbackUrl === "string" ? sig.initialCallbackUrl : null,
     signatureAlgorithmParameters: parseSigParams(sig.signatureAlgorithmParameters),
     interactionTypeUsed: str(r.interactionTypeUsed),
     onBehalfOf: parseOrg(r.onBehalfOf)
@@ -372,7 +375,7 @@ var ResponseValidator = class {
       brokeredRpName: acsp.brokeredRpName,
       interactions: acsp.interactions,
       interactionTypeUsed,
-      initialCallbackUrl: acsp.initialCallbackUrl,
+      initialCallbackUrl: signedCallbackUrl(result.initialCallbackUrl, acsp.initialCallbackUrl, flowType),
       flowType
     });
     if (!verifyPayloadSignature(payload, result.signatureValueB64, leaf.publicKey, alg, hash)) {
@@ -509,6 +512,17 @@ var ResponseValidator = class {
     }
   }
 };
+function signedCallbackUrl(fromResponse, rpCallback, flowType) {
+  const rp = rpCallback ?? "";
+  if (fromResponse == null) return rp;
+  if (fromResponse !== "" && fromResponse !== rp) {
+    throw new ValidationError("signature.initialCallbackUrl \u043D\u044C \u0445\u043E\u043E\u0441\u043E\u043D \u0447 \u0431\u0438\u0448, \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0447 \u0431\u0438\u0448 (\u0445\u0443\u0443\u0440\u0430\u043C\u0447 \u0445\u0430\u0440\u0438\u0443 \u0431\u0430\u0439\u0436 \u0431\u043E\u043B\u0437\u043E\u0448\u0433\u04AF\u0439)");
+  }
+  if ((flowType === "Web2App" || flowType === "App2App") && fromResponse !== rp) {
+    throw new ValidationError(`${flowType} \u0443\u0440\u0441\u0433\u0430\u043B\u0434 signature.initialCallbackUrl \u043D\u044C \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0431\u0430\u0439\u0445 \u0451\u0441\u0442\u043E\u0439`);
+  }
+  return fromResponse;
+}
 function userChallengeOf(verifier) {
   return createHash2("sha256").update(verifier, "utf8").digest("base64url");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gerege-systems/eid-mongolia-sdk",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "e-ID Mongolia Relying Party SDK — иргэнээр утсаар нь нэвтрэлт ба хууль ёсны цахим гарын үсэг (RP-API v3, Smart-ID нийцтэй).",
   "license": "MIT",
   "type": "module",