@interop/wallet-core 0.107.1 → 0.109.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +26 -24
- package/dist/clientAnnex/credentialAnchoredGenesis.d.ts +3 -3
- package/dist/clientAnnex/credentialAnchoredGenesis.d.ts.map +1 -1
- package/dist/clientAnnex/credentialAnchoredGenesis.js +3 -3
- package/dist/clientAnnex/credentialAnchoredGenesis.js.map +1 -1
- package/dist/clientAnnex/establish.d.ts +10 -9
- package/dist/clientAnnex/establish.d.ts.map +1 -1
- package/dist/clientAnnex/establish.js +23 -19
- package/dist/clientAnnex/establish.js.map +1 -1
- package/dist/clientAnnex/forget.d.ts +5 -5
- package/dist/clientAnnex/forget.d.ts.map +1 -1
- package/dist/clientAnnex/forget.js +1 -1
- package/dist/clientAnnex/forget.js.map +1 -1
- package/dist/clientAnnex/forgetLast.d.ts +10 -10
- package/dist/clientAnnex/forgetLast.d.ts.map +1 -1
- package/dist/clientAnnex/forgetLast.js +4 -4
- package/dist/clientAnnex/forgetLast.js.map +1 -1
- package/dist/clientAnnex/gc.d.ts +6 -6
- package/dist/clientAnnex/gc.d.ts.map +1 -1
- package/dist/clientAnnex/gc.js +13 -10
- package/dist/clientAnnex/gc.js.map +1 -1
- package/dist/clientAnnex/heal.d.ts +21 -19
- package/dist/clientAnnex/heal.d.ts.map +1 -1
- package/dist/clientAnnex/heal.js +25 -22
- package/dist/clientAnnex/heal.js.map +1 -1
- package/dist/clientAnnex/ladderAnchored.d.ts +40 -32
- package/dist/clientAnnex/ladderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/ladderAnchored.js +33 -44
- package/dist/clientAnnex/ladderAnchored.js.map +1 -1
- package/dist/clientAnnex/log.d.ts +62 -61
- package/dist/clientAnnex/log.d.ts.map +1 -1
- package/dist/clientAnnex/log.js +68 -67
- package/dist/clientAnnex/log.js.map +1 -1
- package/dist/clientAnnex/mend.d.ts.map +1 -1
- package/dist/clientAnnex/mend.js +22 -16
- package/dist/clientAnnex/mend.js.map +1 -1
- package/dist/clientAnnex/recoveryLadderAnchored.d.ts +4 -3
- package/dist/clientAnnex/recoveryLadderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/recoveryLadderAnchored.js +1 -1
- package/dist/clientAnnex/selfEnroll.d.ts +3 -3
- package/dist/clientAnnex/selfEnroll.d.ts.map +1 -1
- package/dist/clientAnnex/selfEnroll.js +6 -7
- package/dist/clientAnnex/selfEnroll.js.map +1 -1
- package/dist/clientAnnex/spaceCapability.d.ts +6 -6
- package/dist/clientAnnex/spaceCapability.d.ts.map +1 -1
- package/dist/clientAnnex/spaceCapability.js +9 -12
- package/dist/clientAnnex/spaceCapability.js.map +1 -1
- package/dist/clients/index.d.ts +1 -1
- package/dist/clients/index.d.ts.map +1 -1
- package/dist/clients/index.js.map +1 -1
- package/dist/clients/listing.d.ts +12 -18
- package/dist/clients/listing.d.ts.map +1 -1
- package/dist/clients/listing.js +17 -13
- package/dist/clients/listing.js.map +1 -1
- package/dist/clients/revocation.d.ts +2 -2
- package/dist/clients/revocation.d.ts.map +1 -1
- package/dist/clients/revocation.js.map +1 -1
- package/dist/clients/rosterPolicy.d.ts +4 -4
- package/dist/clients/rosterPolicy.d.ts.map +1 -1
- package/dist/clients/rosterPolicy.js +5 -4
- package/dist/clients/rosterPolicy.js.map +1 -1
- package/dist/connections/entry.d.ts +100 -9
- package/dist/connections/entry.d.ts.map +1 -1
- package/dist/connections/entry.js +104 -12
- package/dist/connections/entry.js.map +1 -1
- package/dist/connections/grantProof.d.ts.map +1 -1
- package/dist/connections/grantProof.js +4 -5
- package/dist/connections/grantProof.js.map +1 -1
- package/dist/connections/grants.d.ts.map +1 -1
- package/dist/connections/grants.js +3 -5
- package/dist/connections/grants.js.map +1 -1
- package/dist/connections/index.d.ts +9 -5
- package/dist/connections/index.d.ts.map +1 -1
- package/dist/connections/index.js +7 -4
- package/dist/connections/index.js.map +1 -1
- package/dist/connections/replicas.d.ts +227 -0
- package/dist/connections/replicas.d.ts.map +1 -0
- package/dist/connections/replicas.js +539 -0
- package/dist/connections/replicas.js.map +1 -0
- package/dist/connections/upsert.d.ts +75 -1
- package/dist/connections/upsert.d.ts.map +1 -1
- package/dist/connections/upsert.js +62 -34
- package/dist/connections/upsert.js.map +1 -1
- package/dist/enrollment/enrollment.d.ts.map +1 -1
- package/dist/enrollment/enrollment.js +4 -5
- package/dist/enrollment/enrollment.js.map +1 -1
- package/dist/genesis/accountGenesis.d.ts +4 -4
- package/dist/genesis/accountGenesis.d.ts.map +1 -1
- package/dist/genesis/accountGenesis.js +4 -4
- package/dist/genesis/accountGenesis.js.map +1 -1
- package/dist/keyring/fetch.d.ts +3 -3
- package/dist/keyring/fetch.d.ts.map +1 -1
- package/dist/keyring/fetch.js +3 -3
- package/dist/keyring/fetch.js.map +1 -1
- package/dist/keyring/record.d.ts.map +1 -1
- package/dist/keyring/record.js +1 -2
- package/dist/keyring/record.js.map +1 -1
- package/dist/keyring/recordEnvelope.d.ts +8 -6
- package/dist/keyring/recordEnvelope.d.ts.map +1 -1
- package/dist/keyring/recordEnvelope.js +12 -6
- package/dist/keyring/recordEnvelope.js.map +1 -1
- package/dist/keyring/unlockSpace.d.ts +15 -15
- package/dist/keyring/unlockSpace.d.ts.map +1 -1
- package/dist/keyring/unlockSpace.js +18 -19
- package/dist/keyring/unlockSpace.js.map +1 -1
- package/dist/keys/collectionLogStore.d.ts +3 -3
- package/dist/keys/collectionLogStore.d.ts.map +1 -1
- package/dist/keys/collectionLogStore.js +5 -7
- package/dist/keys/collectionLogStore.js.map +1 -1
- package/dist/keys/rosterStore.d.ts +3 -3
- package/dist/keys/rosterStore.d.ts.map +1 -1
- package/dist/keys/rosterStore.js +3 -4
- package/dist/keys/rosterStore.js.map +1 -1
- package/dist/recovery/continuation.d.ts +3 -9
- package/dist/recovery/continuation.d.ts.map +1 -1
- package/dist/recovery/continuation.js +1 -3
- package/dist/recovery/continuation.js.map +1 -1
- package/dist/recovery/index.d.ts +2 -1
- package/dist/recovery/index.d.ts.map +1 -1
- package/dist/recovery/recoveryDelegation.d.ts.map +1 -1
- package/dist/recovery/recoveryDelegation.js +2 -21
- package/dist/recovery/recoveryDelegation.js.map +1 -1
- package/dist/recovery/recoveryWebvh.d.ts +21 -15
- package/dist/recovery/recoveryWebvh.d.ts.map +1 -1
- package/dist/recovery/recoveryWebvh.js +12 -7
- package/dist/recovery/recoveryWebvh.js.map +1 -1
- package/dist/space/collections.d.ts +2 -2
- package/dist/space/collections.js +2 -2
- package/dist/space/deleteSpace.d.ts +3 -3
- package/dist/space/deleteSpace.d.ts.map +1 -1
- package/dist/space/deleteSpace.js +3 -4
- package/dist/space/deleteSpace.js.map +1 -1
- package/dist/space/errors.d.ts +1 -1
- package/dist/space/errors.js +1 -1
- package/dist/space/index.d.ts +4 -4
- package/dist/space/index.js +3 -3
- package/dist/space/provisioning.d.ts.map +1 -1
- package/dist/space/provisioning.js +6 -5
- package/dist/space/provisioning.js.map +1 -1
- package/dist/space/publicLink.d.ts +4 -4
- package/dist/space/publicLink.d.ts.map +1 -1
- package/dist/space/publicLink.js +9 -8
- package/dist/space/publicLink.js.map +1 -1
- package/dist/space/pwsLink.d.ts +58 -0
- package/dist/space/pwsLink.d.ts.map +1 -0
- package/dist/space/{wasLink.js → pwsLink.js} +42 -37
- package/dist/space/pwsLink.js.map +1 -0
- package/dist/testing/accountBuilder.d.ts +19 -19
- package/dist/testing/accountBuilder.d.ts.map +1 -1
- package/dist/testing/accountBuilder.js +45 -43
- package/dist/testing/accountBuilder.js.map +1 -1
- package/dist/unlock/index.d.ts +2 -1
- package/dist/unlock/index.d.ts.map +1 -1
- package/dist/unlock/retire.d.ts +7 -5
- package/dist/unlock/retire.d.ts.map +1 -1
- package/dist/unlock/retire.js +5 -4
- package/dist/unlock/retire.js.map +1 -1
- package/dist/unlock/standingWebvh.d.ts +24 -15
- package/dist/unlock/standingWebvh.d.ts.map +1 -1
- package/dist/unlock/standingWebvh.js +32 -19
- package/dist/unlock/standingWebvh.js.map +1 -1
- package/dist/unlock/unlockRecord.d.ts.map +1 -1
- package/dist/unlock/unlockRecord.js +7 -7
- package/dist/unlock/unlockRecord.js.map +1 -1
- package/dist/webvh/accountEntry.d.ts +39 -50
- package/dist/webvh/accountEntry.d.ts.map +1 -1
- package/dist/webvh/accountEntry.js +133 -55
- package/dist/webvh/accountEntry.js.map +1 -1
- package/dist/webvh/clientAnnexDid.d.ts +21 -14
- package/dist/webvh/clientAnnexDid.d.ts.map +1 -1
- package/dist/webvh/clientAnnexDid.js +19 -14
- package/dist/webvh/clientAnnexDid.js.map +1 -1
- package/dist/webvh/delegatedLogStore.d.ts +7 -14
- package/dist/webvh/delegatedLogStore.d.ts.map +1 -1
- package/dist/webvh/delegatedLogStore.js +10 -9
- package/dist/webvh/delegatedLogStore.js.map +1 -1
- package/dist/webvh/didWebProjection.d.ts +30 -49
- package/dist/webvh/didWebProjection.d.ts.map +1 -1
- package/dist/webvh/didWebProjection.js +9 -56
- package/dist/webvh/didWebProjection.js.map +1 -1
- package/dist/webvh/didWebvh.d.ts +19 -33
- package/dist/webvh/didWebvh.d.ts.map +1 -1
- package/dist/webvh/didWebvh.js +30 -41
- package/dist/webvh/didWebvh.js.map +1 -1
- package/dist/webvh/enrollClient.d.ts +5 -3
- package/dist/webvh/enrollClient.d.ts.map +1 -1
- package/dist/webvh/enrollClient.js +12 -10
- package/dist/webvh/enrollClient.js.map +1 -1
- package/dist/webvh/index.d.ts +2 -2
- package/dist/webvh/index.d.ts.map +1 -1
- package/dist/webvh/index.js +1 -1
- package/dist/webvh/index.js.map +1 -1
- package/dist/webvh/logLocation.d.ts +75 -0
- package/dist/webvh/logLocation.d.ts.map +1 -0
- package/dist/webvh/logLocation.js +102 -0
- package/dist/webvh/logLocation.js.map +1 -0
- package/dist/webvh/revokeClient.d.ts +10 -4
- package/dist/webvh/revokeClient.d.ts.map +1 -1
- package/dist/webvh/revokeClient.js +22 -22
- package/dist/webvh/revokeClient.js.map +1 -1
- package/dist/webvh/verifyLog.d.ts +9 -18
- package/dist/webvh/verifyLog.d.ts.map +1 -1
- package/dist/webvh/verifyLog.js +43 -50
- package/dist/webvh/verifyLog.js.map +1 -1
- package/package.json +7 -7
- package/dist/space/wasLink.d.ts +0 -57
- package/dist/space/wasLink.d.ts.map +0 -1
- package/dist/space/wasLink.js.map +0 -1
package/dist/space/publicLink.js
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
* into the profile's `public-credentials` collection, keyed by the credential's
|
|
7
7
|
* content cid; once replication mirrors it to the profile's WAS Space it
|
|
8
8
|
* resolves at the URL below. Both wallet replicas build the identical URL for a
|
|
9
|
-
* given `(
|
|
9
|
+
* given `(baseServerUrl, spaceId, cid)`, so a link handed out by one resolves the
|
|
10
10
|
* copy replicated by the other.
|
|
11
11
|
*
|
|
12
12
|
* The URL is assembled by was-client's path builders, the one owner of the WAS
|
|
@@ -15,25 +15,26 @@
|
|
|
15
15
|
* sub-path deployment keeps its prefix and the link addresses the same URL the
|
|
16
16
|
* client wrote to.
|
|
17
17
|
*/
|
|
18
|
-
import {
|
|
18
|
+
import { resourceUrl, spaceUrlById } from '@interop/was-client/paths';
|
|
19
19
|
import { PUBLIC_CREDENTIALS_COLLECTION } from './collections.js';
|
|
20
20
|
/**
|
|
21
21
|
* The absolute, world-readable URL of a credential's shared copy:
|
|
22
|
-
* `{
|
|
22
|
+
* `{baseServerUrl}/space/{spaceId}/public-credentials/{cid}`. Takes the server URL,
|
|
23
23
|
* Space id, and credential cid as arguments, with no dependency on app config.
|
|
24
24
|
* The path is joined onto the server URL's base path (a sub-path deployment
|
|
25
25
|
* keeps its prefix), and each segment is percent-encoded by the builder.
|
|
26
26
|
*
|
|
27
27
|
* @param options {object}
|
|
28
|
-
* @param options.
|
|
28
|
+
* @param options.baseServerUrl {string} the server's base server URL
|
|
29
29
|
* @param options.spaceId {string} the profile's WAS Space id
|
|
30
30
|
* @param options.cid {string} the credential's content cid
|
|
31
31
|
* @returns {string}
|
|
32
32
|
*/
|
|
33
|
-
export function publicCredentialUrl({
|
|
34
|
-
return
|
|
35
|
-
|
|
36
|
-
|
|
33
|
+
export function publicCredentialUrl({ baseServerUrl, spaceId, cid }) {
|
|
34
|
+
return resourceUrl({
|
|
35
|
+
spaceUrl: spaceUrlById({ baseServerUrl, spaceId }),
|
|
36
|
+
collectionId: PUBLIC_CREDENTIALS_COLLECTION,
|
|
37
|
+
resourceId: cid
|
|
37
38
|
});
|
|
38
39
|
}
|
|
39
40
|
//# sourceMappingURL=publicLink.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publicLink.js","sourceRoot":"","sources":["../../src/space/publicLink.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"publicLink.js","sourceRoot":"","sources":["../../src/space/publicLink.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAA;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,aAAa,EACb,OAAO,EACP,GAAG,EAKJ;IACC,OAAO,WAAW,CAAC;QACjB,QAAQ,EAAE,YAAY,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAClD,YAAY,EAAE,6BAA6B;QAC3C,UAAU,EAAE,GAAG;KAChB,CAAC,CAAA;AACJ,CAAC"}
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The decoded link: the base server URL plus the controller secret AS A
|
|
3
|
+
* STRING.
|
|
4
|
+
*/
|
|
5
|
+
export interface PwsLinkPayload {
|
|
6
|
+
baseServerUrl: string;
|
|
7
|
+
/**
|
|
8
|
+
* The controller secret (already decoded back to the passphrase string).
|
|
9
|
+
*/
|
|
10
|
+
secret: string;
|
|
11
|
+
}
|
|
12
|
+
/**
|
|
13
|
+
* The `t` discriminator member every `pws-link` payload carries.
|
|
14
|
+
*/
|
|
15
|
+
export declare const PWS_LINK_TYPE = "pws-link";
|
|
16
|
+
/**
|
|
17
|
+
* Whether some scanned or pasted text has a `pws-link` payload's JSON shape.
|
|
18
|
+
* Matched structurally on the `t` member rather than by calling the parser,
|
|
19
|
+
* so an unrelated JSON blob is not refused with a connection-code error
|
|
20
|
+
* message. This is the recognizer a wallet hands `@interop/wallet-request`'s
|
|
21
|
+
* input classifier for its `pws-link` branch; whether the payload is valid
|
|
22
|
+
* is {@link parsePwsLinkPayload}'s answer.
|
|
23
|
+
*
|
|
24
|
+
* @param text {string}
|
|
25
|
+
* @returns {boolean}
|
|
26
|
+
*/
|
|
27
|
+
export declare function isPwsLinkPayload(text: string): boolean;
|
|
28
|
+
/**
|
|
29
|
+
* Encodes a passphrase into the payload's `secret` field: `base64url(utf8(...))`,
|
|
30
|
+
* no padding.
|
|
31
|
+
*
|
|
32
|
+
* @param passphrase {string}
|
|
33
|
+
* @returns {string}
|
|
34
|
+
*/
|
|
35
|
+
export declare function encodePwsLinkSecret(passphrase: string): string;
|
|
36
|
+
/**
|
|
37
|
+
* Builds the full `pws-link` payload string a QR encodes.
|
|
38
|
+
*
|
|
39
|
+
* @param options {object}
|
|
40
|
+
* @param options.baseServerUrl {string} the server's base server URL
|
|
41
|
+
* @param options.passphrase {string}
|
|
42
|
+
* @returns {string}
|
|
43
|
+
*/
|
|
44
|
+
export declare function buildPwsLinkPayload({ baseServerUrl, passphrase }: {
|
|
45
|
+
baseServerUrl: string;
|
|
46
|
+
passphrase: string;
|
|
47
|
+
}): string;
|
|
48
|
+
/**
|
|
49
|
+
* Parses and validates a scanned payload, returning the base server URL and the
|
|
50
|
+
* decoded string secret. Throws {@link HumanReadableError} for anything that is
|
|
51
|
+
* not a valid current-version `pws-link` payload (so the scanner shows a clean
|
|
52
|
+
* message rather than mis-handling an unrelated QR).
|
|
53
|
+
*
|
|
54
|
+
* @param raw {string} the raw scanned code value
|
|
55
|
+
* @returns {PwsLinkPayload}
|
|
56
|
+
*/
|
|
57
|
+
export declare function parsePwsLinkPayload(raw: string): PwsLinkPayload;
|
|
58
|
+
//# sourceMappingURL=pwsLink.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"pwsLink.d.ts","sourceRoot":"","sources":["../../src/space/pwsLink.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,aAAa,CAAA;AAEvC;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgBtD;AA6CD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,aAAa,EACb,UAAU,EACX,EAAE;IACD,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,CAOT;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAyC/D"}
|
|
@@ -2,33 +2,37 @@
|
|
|
2
2
|
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
3
|
*/
|
|
4
4
|
/**
|
|
5
|
-
* The `
|
|
5
|
+
* The `pws-link` QR hand-off payload -- the "Connect mobile wallet" flow where
|
|
6
6
|
* the web wallet displays a QR that carries an account's controller secret and
|
|
7
7
|
* the mobile wallet scans it.
|
|
8
8
|
*
|
|
9
9
|
* The payload is a NON-URL JSON blob (deliberately not a link, so the OS camera
|
|
10
10
|
* app / deep-link handling never routes it and it cannot leak into browser
|
|
11
11
|
* history or link-preview fetchers). It is accepted only by the in-app scanner.
|
|
12
|
-
* Shape:
|
|
12
|
+
* Shape:
|
|
13
|
+
* `{ v: 1, t: 'pws-link', baseServerUrl, secret: base64url(utf8(passphrase)) }`.
|
|
14
|
+
* `baseServerUrl` is the server's base server URL, the one the receiving
|
|
15
|
+
* wallet builds its client from; the account itself is reached through the
|
|
16
|
+
* keyring record the secret unlocks, so the link carries no DID.
|
|
13
17
|
*/
|
|
14
18
|
import { base64urlnopad } from '@scure/base';
|
|
15
19
|
import { HumanReadableError } from './errors.js';
|
|
16
20
|
/**
|
|
17
|
-
* The `t` discriminator member every `
|
|
21
|
+
* The `t` discriminator member every `pws-link` payload carries.
|
|
18
22
|
*/
|
|
19
|
-
export const
|
|
23
|
+
export const PWS_LINK_TYPE = 'pws-link';
|
|
20
24
|
/**
|
|
21
|
-
* Whether some scanned or pasted text has a `
|
|
25
|
+
* Whether some scanned or pasted text has a `pws-link` payload's JSON shape.
|
|
22
26
|
* Matched structurally on the `t` member rather than by calling the parser,
|
|
23
27
|
* so an unrelated JSON blob is not refused with a connection-code error
|
|
24
28
|
* message. This is the recognizer a wallet hands `@interop/wallet-request`'s
|
|
25
|
-
* input classifier for its `
|
|
26
|
-
* is {@link
|
|
29
|
+
* input classifier for its `pws-link` branch; whether the payload is valid
|
|
30
|
+
* is {@link parsePwsLinkPayload}'s answer.
|
|
27
31
|
*
|
|
28
32
|
* @param text {string}
|
|
29
33
|
* @returns {boolean}
|
|
30
34
|
*/
|
|
31
|
-
export function
|
|
35
|
+
export function isPwsLinkPayload(text) {
|
|
32
36
|
const trimmed = text.trim();
|
|
33
37
|
if (!trimmed.startsWith('{')) {
|
|
34
38
|
return false;
|
|
@@ -42,7 +46,7 @@ export function isWasLinkPayload(text) {
|
|
|
42
46
|
}
|
|
43
47
|
return (parsed !== null &&
|
|
44
48
|
typeof parsed === 'object' &&
|
|
45
|
-
parsed.t ===
|
|
49
|
+
parsed.t === PWS_LINK_TYPE);
|
|
46
50
|
}
|
|
47
51
|
const NOT_A_LINK = 'This QR code is not a wallet connection code.';
|
|
48
52
|
const BAD_SERVER = 'Connection code points at an insecure or invalid server and was rejected.';
|
|
@@ -53,22 +57,23 @@ function stripPadding(value) {
|
|
|
53
57
|
return value.replace(/=+$/, '');
|
|
54
58
|
}
|
|
55
59
|
/**
|
|
56
|
-
* Validates the scanned `
|
|
57
|
-
* it. The code carries the controller secret in the clear, so a
|
|
58
|
-
* would let a crafted QR aim capability-signed requests (and the
|
|
59
|
-
* attacker-controlled or cleartext host. Requires a parseable
|
|
60
|
-
* plain `http:` is allowed ONLY for loopback dev hosts.
|
|
60
|
+
* Validates the scanned `baseServerUrl` before the wallet ever signs a
|
|
61
|
+
* request to it. The code carries the controller secret in the clear, so a
|
|
62
|
+
* bad base would let a crafted QR aim capability-signed requests (and the
|
|
63
|
+
* secret) at an attacker-controlled or cleartext host. Requires a parseable
|
|
64
|
+
* `https:` URL; plain `http:` is allowed ONLY for loopback dev hosts.
|
|
61
65
|
*
|
|
62
66
|
* This is a scheme/host rule, not an allowlist: the payload carries its own
|
|
63
|
-
*
|
|
64
|
-
* -- a connection code names the storage server the user is
|
|
65
|
-
* consuming app later needs to constrain the host further, that
|
|
66
|
-
* the call site, on the returned
|
|
67
|
+
* base server URL, and there is no app-configured set of permitted servers
|
|
68
|
+
* to inject -- a connection code names the storage server the user is
|
|
69
|
+
* joining. If a consuming app later needs to constrain the host further, that
|
|
70
|
+
* check belongs at the call site, on the returned
|
|
71
|
+
* {@link PwsLinkPayload.baseServerUrl}.
|
|
67
72
|
*/
|
|
68
|
-
function
|
|
73
|
+
function assertValidBaseServerUrl(baseServerUrl) {
|
|
69
74
|
let url;
|
|
70
75
|
try {
|
|
71
|
-
url = new URL(
|
|
76
|
+
url = new URL(baseServerUrl);
|
|
72
77
|
}
|
|
73
78
|
catch {
|
|
74
79
|
throw new HumanReadableError(BAD_SERVER);
|
|
@@ -89,35 +94,35 @@ function assertValidServerUrl(serverUrl) {
|
|
|
89
94
|
* @param passphrase {string}
|
|
90
95
|
* @returns {string}
|
|
91
96
|
*/
|
|
92
|
-
export function
|
|
97
|
+
export function encodePwsLinkSecret(passphrase) {
|
|
93
98
|
return base64urlnopad.encode(new TextEncoder().encode(passphrase));
|
|
94
99
|
}
|
|
95
100
|
/**
|
|
96
|
-
* Builds the full `
|
|
101
|
+
* Builds the full `pws-link` payload string a QR encodes.
|
|
97
102
|
*
|
|
98
103
|
* @param options {object}
|
|
99
|
-
* @param options.
|
|
104
|
+
* @param options.baseServerUrl {string} the server's base server URL
|
|
100
105
|
* @param options.passphrase {string}
|
|
101
106
|
* @returns {string}
|
|
102
107
|
*/
|
|
103
|
-
export function
|
|
108
|
+
export function buildPwsLinkPayload({ baseServerUrl, passphrase }) {
|
|
104
109
|
return JSON.stringify({
|
|
105
110
|
v: 1,
|
|
106
|
-
t:
|
|
107
|
-
|
|
108
|
-
secret:
|
|
111
|
+
t: PWS_LINK_TYPE,
|
|
112
|
+
baseServerUrl,
|
|
113
|
+
secret: encodePwsLinkSecret(passphrase)
|
|
109
114
|
});
|
|
110
115
|
}
|
|
111
116
|
/**
|
|
112
|
-
* Parses and validates a scanned payload, returning the server URL and the
|
|
117
|
+
* Parses and validates a scanned payload, returning the base server URL and the
|
|
113
118
|
* decoded string secret. Throws {@link HumanReadableError} for anything that is
|
|
114
|
-
* not a valid current-version `
|
|
119
|
+
* not a valid current-version `pws-link` payload (so the scanner shows a clean
|
|
115
120
|
* message rather than mis-handling an unrelated QR).
|
|
116
121
|
*
|
|
117
122
|
* @param raw {string} the raw scanned code value
|
|
118
|
-
* @returns {
|
|
123
|
+
* @returns {PwsLinkPayload}
|
|
119
124
|
*/
|
|
120
|
-
export function
|
|
125
|
+
export function parsePwsLinkPayload(raw) {
|
|
121
126
|
let parsed;
|
|
122
127
|
try {
|
|
123
128
|
parsed = JSON.parse(raw);
|
|
@@ -128,17 +133,17 @@ export function parseWasLinkPayload(raw) {
|
|
|
128
133
|
if (typeof parsed !== 'object' || parsed === null) {
|
|
129
134
|
throw new HumanReadableError(NOT_A_LINK);
|
|
130
135
|
}
|
|
131
|
-
const { v, t,
|
|
132
|
-
if (t !==
|
|
136
|
+
const { v, t, baseServerUrl, secret } = parsed;
|
|
137
|
+
if (t !== PWS_LINK_TYPE) {
|
|
133
138
|
throw new HumanReadableError(NOT_A_LINK);
|
|
134
139
|
}
|
|
135
140
|
if (v !== 1) {
|
|
136
141
|
throw new HumanReadableError('This connection code is from a newer app version. Please update.');
|
|
137
142
|
}
|
|
138
|
-
if (typeof
|
|
143
|
+
if (typeof baseServerUrl !== 'string' || baseServerUrl.length === 0) {
|
|
139
144
|
throw new HumanReadableError('Connection code is missing its server.');
|
|
140
145
|
}
|
|
141
|
-
|
|
146
|
+
assertValidBaseServerUrl(baseServerUrl);
|
|
142
147
|
if (typeof secret !== 'string' || secret.length === 0) {
|
|
143
148
|
throw new HumanReadableError('Connection code is missing its secret.');
|
|
144
149
|
}
|
|
@@ -152,6 +157,6 @@ export function parseWasLinkPayload(raw) {
|
|
|
152
157
|
if (secretText.length === 0) {
|
|
153
158
|
throw new HumanReadableError('Connection code has an empty secret.');
|
|
154
159
|
}
|
|
155
|
-
return {
|
|
160
|
+
return { baseServerUrl, secret: secretText };
|
|
156
161
|
}
|
|
157
|
-
//# sourceMappingURL=
|
|
162
|
+
//# sourceMappingURL=pwsLink.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"pwsLink.js","sourceRoot":"","sources":["../../src/space/pwsLink.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAchD;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAA;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CACL,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QACzB,MAA0B,CAAC,CAAC,KAAK,aAAa,CAChD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,GAAG,+CAA+C,CAAA;AAClE,MAAM,UAAU,GACd,2EAA2E,CAAA;AAE7E;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAAC,aAAqB;IACrD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,UAAU,GACd,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,uDAAuD;QACvD,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAA;IAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC1E,OAAM;IACR,CAAC;IACD,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,aAAa,EACb,UAAU,EAIX;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,EAAE,CAAC;QACJ,CAAC,EAAE,aAAa;QAChB,aAAa;QACb,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC;KACxC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAiC,CAAA;IACzE,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,kBAAkB,CAC1B,kEAAkE,CACnE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,CAAC,CAAA;IACxE,CAAC;IACD,wBAAwB,CAAC,aAAa,CAAC,CAAA;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACnC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAC5C,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;AAC9C,CAAC"}
|
|
@@ -33,18 +33,18 @@ export type BuilderCredential = Awaited<ReturnType<typeof mintCredential>>;
|
|
|
33
33
|
* same `credential` again.
|
|
34
34
|
*
|
|
35
35
|
* @param options {object}
|
|
36
|
-
* @param options.
|
|
36
|
+
* @param options.baseServerUrl {string} the booted server's URL
|
|
37
37
|
* @param [options.credential] {BuilderCredential} from `mintCredential`; a
|
|
38
38
|
* fresh high-entropy one when omitted
|
|
39
39
|
* @returns {Promise<object>} the account's ids, the credential's ladder seed
|
|
40
40
|
* and standing client, and the bridge and sibling delegations the re-bind
|
|
41
41
|
* carried
|
|
42
42
|
*/
|
|
43
|
-
export declare function establishAccount({
|
|
44
|
-
|
|
43
|
+
export declare function establishAccount({ baseServerUrl, credential }: {
|
|
44
|
+
baseServerUrl: string;
|
|
45
45
|
credential?: BuilderCredential;
|
|
46
46
|
}): Promise<{
|
|
47
|
-
|
|
47
|
+
baseServerUrl: string;
|
|
48
48
|
spaceId: string;
|
|
49
49
|
accountDid: string;
|
|
50
50
|
annexSpaceId: string;
|
|
@@ -58,12 +58,12 @@ export type EstablishedAccount = Awaited<ReturnType<typeof establishAccount>>;
|
|
|
58
58
|
* A credential-anchored account with one passphrase.
|
|
59
59
|
*
|
|
60
60
|
* @param options {object}
|
|
61
|
-
* @param options.
|
|
61
|
+
* @param options.baseServerUrl {string}
|
|
62
62
|
* @param [options.passphrase] {string} a unique one by default
|
|
63
63
|
* @returns {Promise<object>} the established account plus `passphrase`
|
|
64
64
|
*/
|
|
65
|
-
export declare function buildPassphraseAccount({
|
|
66
|
-
|
|
65
|
+
export declare function buildPassphraseAccount({ baseServerUrl, passphrase }: {
|
|
66
|
+
baseServerUrl: string;
|
|
67
67
|
passphrase?: string;
|
|
68
68
|
}): Promise<EstablishedAccount & {
|
|
69
69
|
passphrase: string;
|
|
@@ -150,12 +150,12 @@ export declare function enrollClient({ account }: {
|
|
|
150
150
|
* The passphrase shape plus a second standing credential.
|
|
151
151
|
*
|
|
152
152
|
* @param options {object}
|
|
153
|
-
* @param options.
|
|
153
|
+
* @param options.baseServerUrl {string}
|
|
154
154
|
* @param [options.passphrase] {string} a unique one by default
|
|
155
155
|
* @returns {Promise<object>} the passphrase account plus `second`
|
|
156
156
|
*/
|
|
157
|
-
export declare function buildSecondCredentialAccount({
|
|
158
|
-
|
|
157
|
+
export declare function buildSecondCredentialAccount({ baseServerUrl, passphrase }: {
|
|
158
|
+
baseServerUrl: string;
|
|
159
159
|
passphrase?: string;
|
|
160
160
|
}): Promise<{
|
|
161
161
|
second: {
|
|
@@ -165,7 +165,7 @@ export declare function buildSecondCredentialAccount({ serverUrl, passphrase }:
|
|
|
165
165
|
bridge: IZcap;
|
|
166
166
|
sibling: IZcap;
|
|
167
167
|
};
|
|
168
|
-
|
|
168
|
+
baseServerUrl: string;
|
|
169
169
|
spaceId: string;
|
|
170
170
|
accountDid: string;
|
|
171
171
|
annexSpaceId: string;
|
|
@@ -179,12 +179,12 @@ export declare function buildSecondCredentialAccount({ serverUrl, passphrase }:
|
|
|
179
179
|
* The passphrase shape plus one issued, unspent recovery code.
|
|
180
180
|
*
|
|
181
181
|
* @param options {object}
|
|
182
|
-
* @param options.
|
|
182
|
+
* @param options.baseServerUrl {string}
|
|
183
183
|
* @param [options.passphrase] {string} a unique one by default
|
|
184
184
|
* @returns {Promise<object>} the passphrase account plus `recovery`
|
|
185
185
|
*/
|
|
186
|
-
export declare function buildRecoveryCodeAccount({
|
|
187
|
-
|
|
186
|
+
export declare function buildRecoveryCodeAccount({ baseServerUrl, passphrase }: {
|
|
187
|
+
baseServerUrl: string;
|
|
188
188
|
passphrase?: string;
|
|
189
189
|
}): Promise<{
|
|
190
190
|
recovery: {
|
|
@@ -193,7 +193,7 @@ export declare function buildRecoveryCodeAccount({ serverUrl, passphrase }: {
|
|
|
193
193
|
recoveryKid: string;
|
|
194
194
|
bridge: IZcap;
|
|
195
195
|
};
|
|
196
|
-
|
|
196
|
+
baseServerUrl: string;
|
|
197
197
|
spaceId: string;
|
|
198
198
|
accountDid: string;
|
|
199
199
|
annexSpaceId: string;
|
|
@@ -207,12 +207,12 @@ export declare function buildRecoveryCodeAccount({ serverUrl, passphrase }: {
|
|
|
207
207
|
* The passphrase shape plus one enrolled client.
|
|
208
208
|
*
|
|
209
209
|
* @param options {object}
|
|
210
|
-
* @param options.
|
|
210
|
+
* @param options.baseServerUrl {string}
|
|
211
211
|
* @param [options.passphrase] {string} a unique one by default
|
|
212
212
|
* @returns {Promise<object>} the passphrase account plus `client`
|
|
213
213
|
*/
|
|
214
|
-
export declare function buildEnrolledClientAccount({
|
|
215
|
-
|
|
214
|
+
export declare function buildEnrolledClientAccount({ baseServerUrl, passphrase }: {
|
|
215
|
+
baseServerUrl: string;
|
|
216
216
|
passphrase?: string;
|
|
217
217
|
}): Promise<{
|
|
218
218
|
client: {
|
|
@@ -224,7 +224,7 @@ export declare function buildEnrolledClientAccount({ serverUrl, passphrase }: {
|
|
|
224
224
|
userKey: import("../keys/userKey.js").UserKey;
|
|
225
225
|
zcapClient: ZcapClient;
|
|
226
226
|
};
|
|
227
|
-
|
|
227
|
+
baseServerUrl: string;
|
|
228
228
|
spaceId: string;
|
|
229
229
|
accountDid: string;
|
|
230
230
|
annexSpaceId: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"accountBuilder.d.ts","sourceRoot":"","sources":["../../src/testing/accountBuilder.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"accountBuilder.d.ts","sourceRoot":"","sources":["../../src/testing/accountBuilder.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AA4DhD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACX,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;GAc9B;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAA;AAE1E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,aAAa,EACb,UAAU,EACX,EAAE;IACD,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,iBAAiB,CAAA;CAC/B;;;;;;;;;GA6EA;AAED,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAA;AAE7E;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,aAAa,EACb,UAA+B,EAChC,EAAE;IACD,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAAC,kBAAkB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAMvD;AAqFD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,OAAO,EACP,UAA+B,EAChC,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;;;;;;GAwEA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;CAC5B;;;;;GA4CA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;CAC5B;;;;;;;;GAqCA;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,aAAa,EACb,UAAU,EACX,EAAE;IACD,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;;;;;;;;;;;;;;;;gBAvU8C,MAAM;GA6UpD;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,aAAa,EACb,UAAU,EACX,EAAE;IACD,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;;;;;;;;;;;;;;;gBA7V8C,MAAM;GAmWpD;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,aAAa,EACb,UAAU,EACX,EAAE;IACD,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;;;;;;;;;;;;;;;;;;gBAnX8C,MAAM;GAyXpD"}
|