@ic-reactor/react 3.13.0 → 4.0.0-beta.1

package/src/auth/identity-attributes.ts

@@ -1,345 +0,0 @@
-import { IDL } from "@icp-sdk/core/candid"
-
-import type {
-  IdentityAttributeOpenIdProvider,
-  IdentityAttributeValues,
-  SignedIdentityAttributes,
-} from "./types.js"
-import { IC_INTERNET_IDENTITY_PROVIDER } from "./constants.js"
-
-export const IDENTITY_ATTRIBUTES_PROVIDER = IC_INTERNET_IDENTITY_PROVIDER
-
-/**
- * @deprecated Use the default ClientManager identity provider or
- * `IDENTITY_ATTRIBUTES_PROVIDER` instead.
- */
-export const IDENTITY_ATTRIBUTES_BETA_PROVIDER = IDENTITY_ATTRIBUTES_PROVIDER
-
-const OPEN_ID_PROVIDER_URLS = {
-  apple: "https://appleid.apple.com",
-  google: "https://accounts.google.com",
-  microsoft: "https://login.microsoftonline.com/{tid}/v2.0",
-} as const
-
-export function identityAttributeKeys({
-  openIdProvider,
-  keys,
-}: {
-  openIdProvider: IdentityAttributeOpenIdProvider
-  keys: string[]
-}): string[] {
-  const provider = normalizeOpenIdProvider(openIdProvider)
-  return keys.map((key) => `openid:${provider}:${key}`)
-}
-
-export function normalizeOpenIdProvider(
-  openIdProvider: IdentityAttributeOpenIdProvider
-): string {
-  return (
-    OPEN_ID_PROVIDER_URLS[
-      openIdProvider as keyof typeof OPEN_ID_PROVIDER_URLS
-    ] ?? openIdProvider
-  )
-}
-
-export async function resolveIdentityAttributeKeys({
-  openIdProvider,
-  keys,
-}: {
-  openIdProvider: IdentityAttributeOpenIdProvider
-  keys: string[]
-}): Promise<string[]> {
-  return identityAttributeKeys({ openIdProvider, keys })
-}
-
-export function decodeIdentityAttributeValues(
-  data: Uint8Array,
-  requestedKeys: string[]
-): IdentityAttributeValues {
-  const requestedKeyMap = requestedKeys.reduce<Record<string, string>>(
-    (acc, key) => {
-      acc[key] = identityAttributeDisplayKey(key)
-      acc[identityAttributeDisplayKey(key)] = identityAttributeDisplayKey(key)
-      return acc
-    },
-    {}
-  )
-
-  // Internet Identity's own format, read by its type. Once a message is known
-  // to be one, a key it does not hold is absent: the text fallback below
-  // cannot add anything true, only a neighbouring value under the wrong name.
-  const icrc3Entries = decodeIcrc3AttributeMap(data)
-  if (icrc3Entries) {
-    return collectIcrc3TextValues(icrc3Entries, requestedKeyMap)
-  }
-
-  const decodedValues = decodeCandidAttributeValues(data, requestedKeyMap)
-  if (Object.keys(decodedValues).length > 0) {
-    return decodedValues
-  }
-
-  return extractPrintableAttributeValues(data, requestedKeys)
-}
-
-/** The ICRC-3 `Value` an Internet Identity attribute message is encoded as. */
-type Icrc3Value =
-  | { Nat: bigint }
-  | { Int: bigint }
-  | { Blob: Uint8Array | number[] }
-  | { Text: string }
-  | { Array: Icrc3Value[] }
-  | { Map: Array<[string, Icrc3Value]> }
-
-/**
- * The entries of an Internet Identity attribute message, or `undefined` when
- * `data` is not one.
- *
- * The canister certifies `Encode!(&Icrc3Value::Map(..))`: the requested
- * attributes under the keys they were requested by (bare, such as `email`, for
- * an unscoped request), plus `implicit:nonce`, `implicit:origin` and
- * `implicit:issued_at_timestamp_ns`. None of the shapes
- * {@link decodeCandidAttributeValues} tries match it, so without this every
- * real response was read by scraping printable text, which returned the
- * neighbouring length byte as part of a value, cut names at the first
- * non-ASCII character, and matched keys inside other values.
- *
- * @see https://github.com/dfinity/ICRC-1/blob/main/standards/ICRC-3/README.md
- */
-function decodeIcrc3AttributeMap(
-  data: Uint8Array
-): Array<[string, Icrc3Value]> | undefined {
-  const value = IDL.Rec()
-  value.fill(
-    IDL.Variant({
-      Nat: IDL.Nat,
-      Int: IDL.Int,
-      Blob: IDL.Vec(IDL.Nat8),
-      Text: IDL.Text,
-      Array: IDL.Vec(value),
-      Map: IDL.Vec(IDL.Tuple(IDL.Text, value)),
-    })
-  )
-
-  try {
-    const [decoded] = IDL.decode([value], data) as [Icrc3Value]
-    return "Map" in decoded ? decoded.Map : undefined
-  } catch {
-    return undefined
-  }
-}
-
-/**
- * The requested attributes in an ICRC-3 map, as certified.
- *
- * Only `Text` entries are attribute values; the `implicit:` entries are there
- * for the verifier and are returned only if asked for by name.
- */
-function collectIcrc3TextValues(
-  entries: Array<[string, Icrc3Value]>,
-  requestedKeyMap: Record<string, string>
-): IdentityAttributeValues {
-  const values: IdentityAttributeValues = {}
-  for (const [key, value] of entries) {
-    if (!Object.prototype.hasOwnProperty.call(requestedKeyMap, key)) continue
-    if ("Text" in value) {
-      values[requestedKeyMap[key]] = value.Text
-    }
-  }
-  return values
-}
-
-function decodeCandidAttributeValues(
-  data: Uint8Array,
-  requestedKeyMap: Record<string, string>
-): IdentityAttributeValues {
-  const textPairs = IDL.Vec(IDL.Tuple(IDL.Text, IDL.Text))
-  const recordPairs = IDL.Vec(
-    IDL.Record({
-      key: IDL.Text,
-      value: IDL.Text,
-    })
-  )
-
-  const candidates = [
-    [textPairs],
-    [recordPairs],
-    [IDL.Record({ attributes: textPairs })],
-    [IDL.Record({ values: textPairs })],
-    [IDL.Record({ attributes: recordPairs })],
-    [IDL.Record({ values: recordPairs })],
-  ]
-
-  for (const candidate of candidates) {
-    try {
-      const decoded = IDL.decode(candidate, data)
-      const values = collectDecodedAttributeValues(decoded, requestedKeyMap)
-      if (Object.keys(values).length > 0) {
-        return values
-      }
-    } catch {
-      // Try the next known beta payload shape, then fall back to text extraction.
-    }
-  }
-
-  return {}
-}
-
-function collectDecodedAttributeValues(
-  value: unknown,
-  requestedKeyMap: Record<string, string>,
-  activeKey?: string
-): IdentityAttributeValues {
-  const values: IdentityAttributeValues = {}
-
-  if (typeof value === "string") {
-    const displayKey = requestedKeyMap[value]
-    if (displayKey) {
-      return values
-    }
-    if (activeKey && isPrintableTextValue(value)) {
-      values[activeKey] = value
-    }
-    return values
-  }
-
-  if (Array.isArray(value)) {
-    if (value.length === 2 && typeof value[0] === "string") {
-      const displayKey = requestedKeyMap[value[0]]
-      if (
-        displayKey &&
-        typeof value[1] === "string" &&
-        isPrintableTextValue(value[1])
-      ) {
-        values[displayKey] = value[1]
-        return values
-      }
-    }
-
-    for (const item of value) {
-      Object.assign(
-        values,
-        collectDecodedAttributeValues(item, requestedKeyMap, activeKey)
-      )
-    }
-    return values
-  }
-
-  if (value && typeof value === "object") {
-    const record = value as Record<string, unknown>
-    if (typeof record.key === "string" && typeof record.value === "string") {
-      const displayKey = requestedKeyMap[record.key]
-      if (displayKey && isPrintableTextValue(record.value)) {
-        values[displayKey] = record.value
-        return values
-      }
-    }
-
-    for (const [key, nested] of Object.entries(record)) {
-      const displayKey = requestedKeyMap[key] ?? activeKey
-      if (
-        displayKey &&
-        typeof nested === "string" &&
-        isPrintableTextValue(nested)
-      ) {
-        values[displayKey] = nested
-        continue
-      }
-      Object.assign(
-        values,
-        collectDecodedAttributeValues(nested, requestedKeyMap, displayKey)
-      )
-    }
-  }
-
-  return values
-}
-
-function extractPrintableAttributeValues(
-  data: Uint8Array,
-  requestedKeys: string[]
-): IdentityAttributeValues {
-  const text = new TextDecoder().decode(data)
-  const values: IdentityAttributeValues = {}
-
-  for (const requestedKey of requestedKeys) {
-    const start = text.indexOf(requestedKey)
-    if (start === -1) {
-      continue
-    }
-
-    const tail = text.slice(start + requestedKey.length)
-    const printableRuns = tail.match(/[\x20-\x7E]{2,512}/g) ?? []
-    const value = printableRuns
-      .map((candidate) =>
-        cleanPrintableAttributeValue(candidate, requestedKeys)
-      )
-      .find(
-        (candidate) =>
-          isPrintableTextValue(candidate) &&
-          candidate !== requestedKey &&
-          !candidate.startsWith("openid:")
-      )
-
-    if (value) {
-      values[identityAttributeDisplayKey(requestedKey)] = value.trim()
-    }
-  }
-
-  return values
-}
-
-function cleanPrintableAttributeValue(
-  value: string,
-  requestedKeys: string[]
-): string {
-  let cleaned = value
-
-  for (const requestedKey of requestedKeys) {
-    const nextKeyIndex = cleaned.indexOf(requestedKey)
-    if (nextKeyIndex > 0) {
-      cleaned = cleaned.slice(
-        0,
-        trimCandidTextLengthPrefix(cleaned, nextKeyIndex)
-      )
-    }
-  }
-
-  const nextOpenIdKeyIndex = cleaned.indexOf("openid:")
-  if (nextOpenIdKeyIndex > 0) {
-    cleaned = cleaned.slice(
-      0,
-      trimCandidTextLengthPrefix(cleaned, nextOpenIdKeyIndex)
-    )
-  }
-
-  return cleaned.trim()
-}
-
-function trimCandidTextLengthPrefix(value: string, index: number): number {
-  let trimmedIndex = index
-  while (trimmedIndex > 0 && isAsciiDigit(value.charCodeAt(trimmedIndex - 1))) {
-    trimmedIndex -= 1
-  }
-  return trimmedIndex
-}
-
-function isAsciiDigit(charCode: number): boolean {
-  return charCode >= 48 && charCode <= 57
-}
-
-function identityAttributeDisplayKey(key: string): string {
-  return key.split(":").pop() || key
-}
-
-function isPrintableTextValue(value: string): boolean {
-  return value.length > 0 && value.length <= 512 && /^[\x20-\x7E]+$/.test(value)
-}
-
-export function normalizeSignedIdentityAttributes(
-  attributes: SignedIdentityAttributes
-): SignedIdentityAttributes {
-  return {
-    data: new Uint8Array(attributes.data),
-    signature: new Uint8Array(attributes.signature),
-  }
-}

package/src/auth/index.ts

@@ -1,7 +0,0 @@
-export * from "./authentication-manager.js"
-export * from "./identity-attributes-manager.js"
-export * from "./identity-attributes.js"
-export * from "./constants.js"
-export * from "./types.js"
-export * from "../hooks/createAuthHooks.js"
-export * from "./createIdentityAttributeHooks.js"

package/src/auth/local-ii-probe.ts

@@ -1,173 +0,0 @@
-/**
- * Ask a locally deployed Internet Identity canister what it actually serves.
- *
- * `localInternetIdentityProvider` builds `http://<id>.localhost:<port>/authorize`,
- * the id.ai-era path. Whether that works depends on which Internet Identity
- * build is installed, and the window is narrow:
- *
- * - up to `release-2025-03-07`, the SPA lived at `/` and used a `#authorize`
- *   fragment; `/authorize` is not an asset
- * - `release-2026-01-05` through `release-2026-03-16` serve `/authorize`
- * - from `release-2026-03-23` the frontend left the canister entirely (the id.ai
- *   split), so `/authorize` 404s even on `.raw`
- *
- * Outside that window the login popup renders the gateway's
- * "Response Verification Error" page and the app simply waits until the user
- * closes it. Nothing points at the cause.
- *
- * Asking the canister over the agent avoids the gateway, so the answer is about
- * the canister's assets rather than about how the gateway felt about them.
- */
-
-import { Actor, type HttpAgent } from "@icp-sdk/core/agent"
-import { IDL } from "@icp-sdk/core/candid"
-import type { AuthClientFlavor } from "./auth-client-compat.js"
-
-/** The `http_request` query every asset-serving canister exposes. */
-const httpInterface: IDL.InterfaceFactory = ({ IDL }) => {
-  const HeaderField = IDL.Tuple(IDL.Text, IDL.Text)
-  return IDL.Service({
-    http_request: IDL.Func(
-      [
-        IDL.Record({
-          method: IDL.Text,
-          url: IDL.Text,
-          headers: IDL.Vec(HeaderField),
-          body: IDL.Vec(IDL.Nat8),
-        }),
-      ],
-      [
-        IDL.Record({
-          status_code: IDL.Nat16,
-          headers: IDL.Vec(HeaderField),
-          body: IDL.Vec(IDL.Nat8),
-        }),
-      ],
-      ["query"]
-    ),
-  })
-}
-
-interface HttpCapableActor {
-  http_request: (request: {
-    method: string
-    url: string
-    headers: [string, string][]
-    body: Uint8Array
-  }) => Promise<{ status_code: number }>
-}
-
-/** Where a given Internet Identity build expects the sign-in flow to start. */
-export type AuthorizePath = "/authorize" | "/#authorize"
-
-export interface LocalIiProbe {
-  /** The path that works, or `null` when the canister serves no sign-in UI. */
-  path: AuthorizePath | null
-  /**
-   * The probe could not reach a conclusion — the canister was unreachable, or
-   * it does not expose `http_request` at all. Callers keep their existing
-   * behaviour rather than blocking a login that might well work.
-   */
-  inconclusive: boolean
-}
-
-async function statusOf(
-  actor: HttpCapableActor,
-  url: string
-): Promise<number | undefined> {
-  try {
-    const response = await actor.http_request({
-      method: "GET",
-      url,
-      headers: [],
-      body: new Uint8Array(),
-    })
-    return response.status_code
-  } catch {
-    return undefined
-  }
-}
-
-/**
- * Determine which authorize path a locally deployed Internet Identity serves.
- *
- * Never throws. A probe that cannot answer returns `inconclusive`, because a
- * diagnostic that blocks a working setup is worse than the failure it explains.
- */
-export async function probeLocalInternetIdentity(
-  agent: HttpAgent,
-  canisterId: string
-): Promise<LocalIiProbe> {
-  let actor: HttpCapableActor
-  try {
-    actor = Actor.createActor<HttpCapableActor>(httpInterface, {
-      agent,
-      canisterId,
-    })
-  } catch {
-    return { path: "/authorize", inconclusive: true }
-  }
-
-  const authorize = await statusOf(actor, "/authorize")
-
-  // The canister does not answer http_request at all — not an asset canister,
-  // not deployed, or the replica is down. Not our call to make.
-  if (authorize === undefined) {
-    return { path: "/authorize", inconclusive: true }
-  }
-
-  if (authorize >= 200 && authorize < 300) {
-    return { path: "/authorize", inconclusive: false }
-  }
-
-  // Pre-2026 builds serve the SPA at the root and drive the flow from a
-  // `#authorize` fragment, which is a path the gateway never sees.
-  const root = await statusOf(actor, "/")
-  if (root !== undefined && root >= 200 && root < 300) {
-    return { path: "/#authorize", inconclusive: false }
-  }
-
-  return { path: null, inconclusive: false }
-}
-
-/**
- * The error a login gets when the installed build serves no sign-in UI, in
- * place of a 503 page inside a popup the app cannot see.
- *
- * The fix depends on the installed `@icp-sdk/auth` major. v8 signs in through
- * the page the canister serves, so an older build that still serves one works.
- * v10 signs in through `ii_session_delegation` and mints with
- * `app_prepare_delegation`, which Internet Identity gained only after its
- * frontend left the canister (#561). No build serves both, so a v10 app needs
- * the frontend from somewhere else, and older builds cannot help it.
- *
- * @param flavor - The installed client's contract. Defaults to `legacy` (v8),
- *   whose advice this error gave before it knew about v10.
- */
-export function localInternetIdentityUnavailableError(
-  canisterId: string,
-  flavor: AuthClientFlavor = "legacy"
-): Error {
-  const problem =
-    `[ic-reactor] The Internet Identity canister ${canisterId} does not serve a sign-in UI: ` +
-    `neither /authorize nor / returned a page. `
-
-  if (flavor === "session") {
-    return new Error(
-      problem +
-        `With @icp-sdk/auth v10, local sign-in needs an Internet Identity frontend served ` +
-        `separately, because no Internet Identity canister build both serves /authorize and ` +
-        `supports v10 sessions. Set \`identityProvider\` to that frontend's authorize URL and ` +
-        `\`internetIdentityId\` to the local Internet Identity canister that mints its delegations.`
-    )
-  }
-
-  return new Error(
-    problem +
-      `Internet Identity builds from ` +
-      `release-2026-03-23 onward moved their frontend out of the canister (the id.ai split) ` +
-      `and cannot be used locally. Install internet_identity_dev.wasm from release-2026-03-16, ` +
-      `the newest build that still self-serves /authorize, or point \`identityProvider\` at a ` +
-      `provider you host yourself.`
-  )
-}