@kispi/chat 0.1.2 → 0.2.0

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import {
   errorFrom
-} from "../chunk-T3QOUFOM.js";
+} from "../chunk-5QQRM7BH.js";
 
 // src/server/api.ts
 var ServerRest = class {
@@ -36,12 +36,15 @@ var ServerRest = class {
   }
 };
 
+// src/server/guest.ts
+import { createHmac as createHmac2, randomBytes } from "crypto";
+
 // src/server/jwt.ts
 import { createHmac, timingSafeEqual } from "crypto";
 function signHS256(header, claims, secret) {
   const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(claims))}`;
-  const mac = createHmac("sha256", secret).update(signingInput).digest();
-  return `${signingInput}.${mac.toString("base64url")}`;
+  const mac2 = createHmac("sha256", secret).update(signingInput).digest();
+  return `${signingInput}.${mac2.toString("base64url")}`;
 }
 function macMatches(expected, given) {
   return expected.length === given.length && timingSafeEqual(expected, given);
@@ -50,6 +53,32 @@ function b64url(s) {
   return Buffer.from(s, "utf8").toString("base64url");
 }
 
+// src/server/guest.ts
+var GuestIdPrefix = "g_";
+var CredentialVersion = "g1";
+var MacLabel = "kispi-chat/guest/v1\n";
+var MinGuestSecretLength = 32;
+function newGuestId() {
+  return `${GuestIdPrefix}${randomBytes(16).toString("base64url")}`;
+}
+function signGuestCredential(secret, userId) {
+  return `${CredentialVersion}.${userId}.${mac(secret, userId).toString("base64url")}`;
+}
+function verifyGuestCredential(secrets, credential) {
+  const parts = credential.split(".");
+  if (parts.length !== 3) return void 0;
+  const [version, userId, given] = parts;
+  if (version !== CredentialVersion || !userId.startsWith(GuestIdPrefix)) return void 0;
+  const givenMac = Buffer.from(given, "base64url");
+  for (const [i, secret] of secrets.entries()) {
+    if (macMatches(mac(secret, userId), givenMac)) return { userId, secretIndex: i };
+  }
+  return void 0;
+}
+function mac(secret, userId) {
+  return createHmac2("sha256", secret).update(MacLabel + userId).digest();
+}
+
 // src/server/token.ts
 var MaxTokenTtlSeconds = 24 * 60 * 60;
 var DefaultTokenTtlSeconds = 60 * 60;
@@ -81,7 +110,7 @@ function tokenClaims(input, now) {
 }
 
 // src/server/webhooks.ts
-import { createHmac as createHmac2 } from "crypto";
+import { createHmac as createHmac3 } from "crypto";
 var SignatureToleranceMs = 5 * 60 * 1e3;
 var EventBeforePublish = "before_publish";
 function verifyWebhook(secret, headers, rawBody, options = {}) {
@@ -119,7 +148,7 @@ function verifyWebhook(secret, headers, rawBody, options = {}) {
   if (age > tolerance) {
     throw new Error(`webhook: signature is ${Math.round(age / 1e3)}s old, tolerance is ${tolerance / 1e3}s`);
   }
-  const expected = createHmac2("sha256", secret).update(`${timestamp}
+  const expected = createHmac3("sha256", secret).update(`${timestamp}
 ${event}
 ${delivery}
 ${rawBody}`).digest();
@@ -153,13 +182,29 @@ function createChatServer(options) {
     throw new TypeError("keyId is required: it becomes the token's kid, which tells the server which key signed it");
   }
   const rest = new ServerRest(options.url, options.secretKey, options.fetch ?? globalThis.fetch.bind(globalThis));
+  const guestSecrets = options.guestSecret === void 0 ? [] : typeof options.guestSecret === "string" ? [options.guestSecret] : options.guestSecret;
+  for (const secret of guestSecrets) {
+    if (secret.length < MinGuestSecretLength) {
+      throw new RangeError(`guestSecret must be at least ${MinGuestSecretLength} characters`);
+    }
+  }
+  const sign = (input) => signHS256({ alg: "HS256", typ: "JWT", kid: options.keyId }, tokenClaims(input, /* @__PURE__ */ new Date()), options.secretKey);
   return {
-    token(input) {
-      return signHS256(
-        { alg: "HS256", typ: "JWT", kid: options.keyId },
-        tokenClaims(input, /* @__PURE__ */ new Date()),
-        options.secretKey
-      );
+    token: sign,
+    guest(input) {
+      const signer = guestSecrets[0];
+      if (signer === void 0) {
+        throw new TypeError("guestSecret was not given to createChatServer, so guest credentials cannot be signed");
+      }
+      const { credential, ...claims } = input;
+      const verified = credential ? verifyGuestCredential(guestSecrets, credential) : void 0;
+      const userId = verified?.userId ?? newGuestId();
+      return {
+        userId,
+        credential: verified !== void 0 && verified.secretIndex === 0 ? credential : signGuestCredential(signer, userId),
+        token: sign({ ...claims, userId }),
+        created: verified === void 0
+      };
     },
     rooms: {
       ensure: (input) => rest.call("PUT", "/v1/rooms", input),
@@ -250,6 +295,7 @@ function createChatServer(options) {
 }
 export {
   DefaultTokenTtlSeconds,
+  GuestIdPrefix,
   MaxTokenTtlSeconds,
   SignatureToleranceMs,
   createChatServer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kispi/chat",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Client SDK for the chat server: one WebSocket, many rooms, ordered history.",
   "license": "MIT",
   "type": "module",