@learncard/lca-api-service 1.3.1 → 1.3.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @welibraryos/lca-api-service
 
+## 1.3.2
+
+### Patch Changes
+
+- [#1588](https://github.com/learningeconomy/LearnCard/pull/1588) [`02ed52ec7d86b51cc45de29b4f741e596e8d7c0a`](https://github.com/learningeconomy/LearnCard/commit/02ed52ec7d86b51cc45de29b4f741e596e8d7c0a) Thanks [@goblincore](https://github.com/goblincore)! - Fix automatic email verification in local dev stacks
+
+- Updated dependencies [[`2991bd32b03e26736239dd8e586e2f720d9bcd45`](https://github.com/learningeconomy/LearnCard/commit/2991bd32b03e26736239dd8e586e2f720d9bcd45), [`0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e`](https://github.com/learningeconomy/LearnCard/commit/0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e), [`0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e`](https://github.com/learningeconomy/LearnCard/commit/0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e), [`3174c09b97fde6f7b5251390245038cf6b7ea9ba`](https://github.com/learningeconomy/LearnCard/commit/3174c09b97fde6f7b5251390245038cf6b7ea9ba), [`928e587378b3674766cf58a8bbe1cbd4d66d3a9f`](https://github.com/learningeconomy/LearnCard/commit/928e587378b3674766cf58a8bbe1cbd4d66d3a9f), [`928e587378b3674766cf58a8bbe1cbd4d66d3a9f`](https://github.com/learningeconomy/LearnCard/commit/928e587378b3674766cf58a8bbe1cbd4d66d3a9f)]:
+    - @learncard/types@5.21.0
+    - @learncard/init@2.5.0
+    - @learncard/helpers@1.6.0
+    - @learncard/email-templates@1.1.0
+    - @learncard/core@9.4.36
+    - @learncard/did-web-plugin@1.1.36
+    - @learncard/didkit-plugin@1.10.1
+    - @learncard/didkit-plugin-node@0.3.1
+
 ## 1.3.1
 
 ### Patch Changes

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 119986604 bytes
-sha256: c5d3d194d7bde48502ddfc43d0513c741a79d171dce75b507c5479e20ca22585
+size: 120281915 bytes
+sha256: 5ced11b8e911cdb7296d5c41f76d7e67fee6096c20a98f24ba308818feadfd6e

package/dist/routes/firebase.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/lca-api-service",
-    "version": "1.3.1",
+    "version": "1.3.2",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
@@ -50,14 +50,14 @@
     "dependencies": {
         "@fastify/cors": "^11.2.0",
         "@fastify/static": "^10.1.1",
-        "@learncard/core": "9.4.35",
-        "@learncard/email-templates": "1.0.6",
-        "@learncard/did-web-plugin": "1.1.35",
-        "@learncard/didkit-plugin": "1.10.0",
-        "@learncard/didkit-plugin-node": "0.3.0",
-        "@learncard/init": "2.4.16",
-        "@learncard/helpers": "1.5.1",
-        "@learncard/types": "5.20.0",
+        "@learncard/core": "9.4.36",
+        "@learncard/email-templates": "1.1.0",
+        "@learncard/did-web-plugin": "1.1.36",
+        "@learncard/didkit-plugin": "1.10.1",
+        "@learncard/didkit-plugin-node": "0.3.1",
+        "@learncard/init": "2.5.0",
+        "@learncard/helpers": "1.6.0",
+        "@learncard/types": "5.21.0",
         "@sentry/serverless": "^7.61.0",
         "@trpc/server": "11.8.0",
         "@types/jsonwebtoken": "^9.0.8",

package/src/routes/firebase.test.ts

@@ -0,0 +1,94 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+    environment: { IS_OFFLINE: true, IS_E2E_TEST: false },
+    verifyIdToken: vi.fn(),
+    getDidAuthVp: vi.fn(),
+}));
+
+vi.mock('@environment', () => ({ environment: mocks.environment }));
+vi.mock('@firebase', () => ({ default: undefined }));
+vi.mock('firebase-admin', () => ({
+    default: { auth: () => ({ verifyIdToken: mocks.verifyIdToken }) },
+}));
+vi.mock('@routes', async () => {
+    const { initTRPC } = await import('@trpc/server');
+    const t = initTRPC.create();
+    return { t, openRoute: t.procedure, authorizedDidRoute: t.procedure };
+});
+vi.mock('@helpers/learnCard.helpers', () => ({
+    getDidWebLearnCard: async () => ({ invoke: { getDidAuthVp: mocks.getDidAuthVp } }),
+    getEmptyLearnCard: vi.fn(),
+}));
+vi.mock('@cache', () => ({ default: {} }));
+vi.mock('../services/delivery', () => ({ getDeliveryService: vi.fn(), getFrom: vi.fn() }));
+vi.mock('../helpers/locale.helpers', () => ({ resolveLocaleByEmail: vi.fn() }));
+vi.mock('@helpers/dids.helpers', () => ({ isAuthorizedDID: vi.fn() }));
+
+import { firebaseRouter } from './firebase';
+
+const tokenFor = (claims: Record<string, string>): string =>
+    `e30.${Buffer.from(JSON.stringify({ sub: 'local-user', ...claims })).toString('base64url')}.test`;
+const caller = firebaseRouter.createCaller({} as never);
+
+describe('getProofOfLoginVp', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        vi.clearAllMocks();
+        mocks.environment.IS_OFFLINE = true;
+        mocks.environment.IS_E2E_TEST = false;
+        mocks.getDidAuthVp.mockResolvedValue('signed-proof');
+        vi.spyOn(console, 'error').mockImplementation(() => {});
+    });
+
+    it('includes the login email without Firebase Admin credentials in local dev', async () => {
+        await expect(
+            caller.getProofOfLoginVp({ token: tokenFor({ email: 'billy@example.com' }) })
+        ).resolves.toEqual({ success: true, vp: 'signed-proof' });
+        expect(mocks.getDidAuthVp).toHaveBeenCalledWith({
+            proofFormat: 'jwt',
+            challenge: 'proof-of-login:email:billy@example.com',
+        });
+        expect(mocks.verifyIdToken).not.toHaveBeenCalled();
+    });
+
+    it('supports the e2e token path and Firebase phone_number claim', async () => {
+        mocks.environment.IS_OFFLINE = false;
+        mocks.environment.IS_E2E_TEST = true;
+        await caller.getProofOfLoginVp({ token: tokenFor({ phone_number: '+15555550123' }) });
+        expect(mocks.getDidAuthVp).toHaveBeenCalledWith({
+            proofFormat: 'jwt',
+            challenge: 'proof-of-login:phone:+15555550123',
+        });
+    });
+
+    it('does not sign a proof when the token has no contact method', async () => {
+        expect(await caller.getProofOfLoginVp({ token: tokenFor({}) })).toMatchObject({
+            success: false,
+        });
+        expect(mocks.getDidAuthVp).not.toHaveBeenCalled();
+    });
+
+    it('requires Firebase verification outside local and e2e environments', async () => {
+        mocks.environment.IS_OFFLINE = false;
+        mocks.verifyIdToken.mockRejectedValueOnce(new Error('Invalid signature'));
+        expect(
+            await caller.getProofOfLoginVp({ token: tokenFor({ email: 'forged@example.com' }) })
+        ).toMatchObject({ success: false });
+        expect(mocks.verifyIdToken).toHaveBeenCalledOnce();
+        expect(mocks.getDidAuthVp).not.toHaveBeenCalled();
+    });
+
+    it('uses verified claims in production', async () => {
+        mocks.environment.IS_OFFLINE = false;
+        mocks.verifyIdToken.mockResolvedValueOnce({
+            uid: 'real-user',
+            email: 'verified@example.com',
+        });
+        await caller.getProofOfLoginVp({ token: 'firebase-token' });
+        expect(mocks.getDidAuthVp).toHaveBeenCalledWith({
+            proofFormat: 'jwt',
+            challenge: 'proof-of-login:email:verified@example.com',
+        });
+    });
+});

package/src/routes/firebase.ts

@@ -20,6 +20,7 @@ import { resolveLocaleByEmail } from '../helpers/locale.helpers';
 import jwtDecode from 'jwt-decode';
 import { getDidWebLearnCard, getEmptyLearnCard } from '@helpers/learnCard.helpers';
 import { isAuthorizedDID } from '@helpers/dids.helpers';
+import { verifyFirebaseToken, getContactMethodFromUser } from '@helpers/auth.helpers';
 
 const LOGIN_VERIFICATION_CODE_TEMPLATE_ALIAS =
     environment.POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS || 'login-verification-code';
@@ -501,16 +502,16 @@ export const firebaseRouter = t.router({
             const { token } = input;
 
             try {
-                const decodedToken = await app?.auth().verifyIdToken(token);
+                // Match sign-in's local/e2e token handling while retaining Firebase
+                // verification outside those environments.
+                const user = await verifyFirebaseToken(token);
+                const contactMethod = getContactMethodFromUser(user);
+                if (!contactMethod) {
+                    throw new Error('Login token does not contain an email or phone number');
+                }
 
                 const learnCard = await getDidWebLearnCard();
-
-                let proofOfLoginChallenge = 'proof-of-login:';
-                if (decodedToken?.email) {
-                    proofOfLoginChallenge += 'email:' + decodedToken?.email;
-                } else if (decodedToken?.phoneNumber) {
-                    proofOfLoginChallenge += 'phone:' + decodedToken?.phoneNumber;
-                }
+                const proofOfLoginChallenge = `proof-of-login:${contactMethod.type}:${contactMethod.value}`;
 
                 const result = await learnCard.invoke.getDidAuthVp({
                     proofFormat: 'jwt',