@helyx/bot 0.4.9 → 0.4.13

package/dist/verification-service.js

@@ -0,0 +1,166 @@
+import { actionReceiptSchema, challengeCreateRequestSchema, challengeCreateResponseSchema, dashboardAttemptPageSchema, dashboardAttemptQuerySchema, dashboardSafeAttemptDetailSchema, signedAssessmentEnvelopeSchema, } from "@helyx/verification-contracts";
+import { createPublicKey, verify } from "node:crypto";
+import { z } from "zod";
+const healthSchema = z
+    .object({
+    status: z.enum(["healthy", "degraded", "unavailable"]),
+    provider: z.enum(["available", "degraded", "unavailable"]),
+    allowanceRemaining: z.number().int().min(0).optional(),
+})
+    .strict();
+export class HttpVerificationService {
+    #baseUrl;
+    #internalSecret;
+    #publicSigningKeys;
+    #fetch;
+    #installationId;
+    #handler;
+    constructor(options) {
+        this.#baseUrl = options.baseUrl.replace(/\/$/u, "");
+        this.#internalSecret = options.internalSecret;
+        this.#publicSigningKeys = { ...options.publicSigningKeys };
+        this.#installationId = options.installationId;
+        this.#fetch = options.fetchImplementation ?? fetch;
+    }
+    getInstallationContext() {
+        return Promise.resolve({
+            installation: {
+                installationId: this.#installationId,
+                sourceClassification: "helyx_hosted",
+                capabilities: [
+                    "challenge.create.v1",
+                    "assessment.receive.v1",
+                    "action.receipt.write.v1",
+                    "member.current.read.v1",
+                    "ban.current.read.v1",
+                    "service.health.read.v1",
+                ],
+                authenticatedAt: new Date().toISOString(),
+            },
+        });
+    }
+    async createChallenge(input) {
+        return challengeCreateResponseSchema.parse(await this.#request("/internal/v1/challenges", {
+            method: "POST",
+            body: challengeCreateRequestSchema.parse(input),
+        }));
+    }
+    async cancelChallenges(input) {
+        return z
+            .object({ cancelled: z.number().int().min(0) })
+            .strict()
+            .parse(await this.#request("/internal/v1/challenges/cancel", {
+            method: "POST",
+            body: input,
+        }));
+    }
+    async listAttempts(input) {
+        const { installationId, guildId, ...query } = input;
+        return dashboardAttemptPageSchema.parse(await this.#request("/internal/v1/attempts/query", {
+            method: "POST",
+            body: {
+                installationId,
+                guildId,
+                query: dashboardAttemptQuerySchema.parse(query),
+            },
+        }));
+    }
+    async getAttempt(input) {
+        const result = await this.#request(`/internal/v1/attempts/${encodeURIComponent(input.attemptId)}`, { method: "POST", body: input }, true);
+        return result === null
+            ? null
+            : dashboardSafeAttemptDetailSchema.parse(result);
+    }
+    async decideAttempt(input) {
+        return dashboardSafeAttemptDetailSchema.parse(await this.#request(`/internal/v1/attempts/${encodeURIComponent(input.attemptId)}/decision`, { method: "POST", body: input }));
+    }
+    registerResultHandler(handler) {
+        if (this.#handler !== undefined)
+            throw new Error("Verification result handler is already registered");
+        this.#handler = handler;
+        return () => {
+            if (this.#handler === handler)
+                this.#handler = undefined;
+        };
+    }
+    async acceptResult(envelopeInput) {
+        const envelope = signedAssessmentEnvelopeSchema.parse(envelopeInput);
+        if (envelope.payload.deploymentSourceClassification !== "helyx_hosted" ||
+            envelope.payload.evidenceSources.discord !== "helyx_hosted" ||
+            envelope.payload.installationId !== this.#installationId)
+            throw new Error("Verification assessment is not bound to hosted Helyx");
+        const publicKey = this.#publicSigningKeys[envelope.keyId];
+        if (publicKey === undefined || !verifyEnvelope(envelope, publicKey))
+            throw new Error("Verification assessment signature is invalid");
+        const expiresAt = Date.parse(envelope.payload.expiresAt);
+        const issuedAt = Date.parse(envelope.payload.issuedAt);
+        const now = Date.now();
+        if (issuedAt > now + 30_000 || expiresAt <= now)
+            throw new Error("Verification assessment is outside its valid lifetime");
+        if (!this.#handler)
+            throw new Error("Verification result handler is unavailable");
+        return actionReceiptSchema.parse(await this.#handler({
+            envelope,
+            correlationId: envelope.payload.attemptId,
+        }));
+    }
+    async health() {
+        const health = healthSchema.parse(await this.#request("/internal/v1/health", { method: "GET" }));
+        return {
+            status: health.status,
+            provider: health.provider,
+            ...(health.allowanceRemaining === undefined
+                ? {}
+                : { allowanceRemaining: health.allowanceRemaining }),
+        };
+    }
+    async #request(path, input, allowNotFound = false) {
+        let response;
+        try {
+            response = await this.#fetch(`${this.#baseUrl}${path}`, {
+                method: input.method,
+                headers: {
+                    authorization: `Bearer ${this.#internalSecret}`,
+                    accept: "application/json",
+                    ...(input.body === undefined
+                        ? {}
+                        : { "content-type": "application/json" }),
+                },
+                ...(input.body === undefined
+                    ? {}
+                    : { body: JSON.stringify(input.body) }),
+                signal: AbortSignal.timeout(10_000),
+            });
+        }
+        catch {
+            throw new Error("Verification service is unavailable");
+        }
+        if (allowNotFound && response.status === 404)
+            return null;
+        if (!response.ok)
+            throw new Error(response.status >= 500
+                ? "Verification service is unavailable"
+                : "Verification request was rejected");
+        try {
+            return await response.json();
+        }
+        catch {
+            throw new Error("Verification service returned an invalid response");
+        }
+    }
+}
+function verifyEnvelope(envelope, publicKeySpkiBase64) {
+    let key;
+    try {
+        key = createPublicKey({
+            key: Buffer.from(publicKeySpkiBase64, "base64"),
+            format: "der",
+            type: "spki",
+        });
+    }
+    catch {
+        return false;
+    }
+    return verify(null, Buffer.from(JSON.stringify(envelope.payload), "utf8"), key, Buffer.from(envelope.signature, "base64url"));
+}
+//# sourceMappingURL=verification-service.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helyx/bot",
-  "version": "0.4.9",
+  "version": "0.4.13",
   "description": "Production Discord runtime for the modular Helyx platform.",
   "keywords": [
     "helyx",
@@ -48,14 +48,15 @@
     "start": "node --env-file-if-exists=../../.env dist/index.js"
   },
   "dependencies": {
-    "@helyx/config": "0.4.2",
-    "@helyx/control-protocol": "0.1.5",
-    "@helyx/core": "0.1.9",
-    "@helyx/database": "0.4.3",
-    "@helyx/framework": "0.1.9",
-    "@helyx/module-manifest": "0.4.2",
-    "@helyx/platform": "0.2.7",
-    "@helyx/sdk": "0.3.4",
+    "@helyx/config": "0.5.0",
+    "@helyx/control-protocol": "0.3.0",
+    "@helyx/core": "0.1.12",
+    "@helyx/database": "0.6.0",
+    "@helyx/framework": "0.1.12",
+    "@helyx/module-manifest": "0.6.0",
+    "@helyx/platform": "0.4.0",
+    "@helyx/sdk": "0.5.0",
+    "@helyx/verification-contracts": "0.1.0",
     "discord.js": "14.27.0",
     "fastify": "5.10.0",
     "pino": "10.3.1",