@learncard/network-plugin 2.13.16 → 2.13.17

package/dist/lcn-plugin.esm.js

@@ -17528,6 +17528,56 @@ mustache.Writer = Writer;
 var mustache_default = mustache;
 
 // src/plugin.ts
+var LEARNCARD_DOMAIN_SUFFIXES = [".learncard.com", ".learncard.app", ".learncard.ai"];
+var isLearnCardDomain = /* @__PURE__ */ __name((host) => {
+  return LEARNCARD_DOMAIN_SUFFIXES.some(
+    (suffix) => host === suffix.replace(/^\./, "") || host.endsWith(suffix)
+  );
+}, "isLearnCardDomain");
+var isLocalhostHost = /* @__PURE__ */ __name((host) => {
+  const lower = host.toLowerCase();
+  return lower === "localhost" || lower === "127.0.0.1";
+}, "isLocalhostHost");
+var validateFederationUrl = /* @__PURE__ */ __name((userProvidedUrl, config2) => {
+  let parsed;
+  try {
+    parsed = new URL(userProvidedUrl);
+  } catch {
+    throw new Error(`Invalid federation endpoint URL: ${userProvidedUrl}`);
+  }
+  if (config2.serviceOrigin) {
+    const endpointOrigin = parsed.origin;
+    if (endpointOrigin === config2.serviceOrigin) {
+      return parsed.href;
+    }
+  }
+  const host = parsed.hostname.toLowerCase();
+  const isLocalhost = isLocalhostHost(host);
+  if (isLocalhost) {
+    if (!config2.allowLocalhostFederation) {
+      throw new Error(
+        `Localhost federation is disabled. Set allowLocalhostFederation: true for development.`
+      );
+    }
+    if (parsed.protocol === "https:") {
+      parsed.protocol = "http:";
+    }
+    return parsed.href;
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Federation requires HTTPS for non-localhost hosts: ${userProvidedUrl}`);
+  }
+  if (config2.trustedFederationHosts !== void 0) {
+    const trustedHosts = new Set(config2.trustedFederationHosts);
+    const allowAnyHost = trustedHosts.has("*");
+    if (!allowAnyHost && !isLearnCardDomain(host) && !trustedHosts.has(host)) {
+      throw new Error(
+        `Federation host '${host}' is not trusted. Add it to trustedFederationHosts or use '*' to allow any host.`
+      );
+    }
+  }
+  return parsed.href;
+}, "validateFederationUrl");
 var uint8ArrayToBase64Url = /* @__PURE__ */ __name((bytes) => {
   let binary = "";
   for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
@@ -17621,8 +17671,20 @@ var issueCredentialWithNetworkStatus = /* @__PURE__ */ __name(async (learnCard,
 }, "issueCredentialWithNetworkStatus");
 async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, options) {
   const apiToken = typeof apiTokenOrOptions === "string" ? apiTokenOrOptions : void 0;
-  const guardianApprovalGetter = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions?.guardianApprovalGetter : void 0) ?? options?.guardianApprovalGetter;
-  const extraHeaders = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions?.extraHeaders : void 0) ?? options?.extraHeaders;
+  const resolvedOptions = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions : options) ?? {};
+  const {
+    guardianApprovalGetter,
+    extraHeaders,
+    trustedFederationHosts,
+    allowLocalhostFederation
+  } = resolvedOptions;
+  const serviceUrl = new URL(url2);
+  const serviceIsLocalhost = isLocalhostHost(serviceUrl.hostname);
+  const federationConfig = {
+    trustedFederationHosts,
+    allowLocalhostFederation: allowLocalhostFederation ?? serviceIsLocalhost,
+    serviceOrigin: serviceUrl.origin
+  };
   let did = "";
   try {
     const idPlane = learnCard?.id;
@@ -17691,8 +17753,8 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
     }
   }, "getBoostTemplateForIssuance");
   const getInboxEndpointForDid = /* @__PURE__ */ __name(async (_learnCard, recipientDid) => {
-    const serviceUrl = new URL(url2);
-    const serviceDomain = `${serviceUrl.hostname}${serviceUrl.port ? `%3A${serviceUrl.port}` : ""}`;
+    const serviceUrl2 = new URL(url2);
+    const serviceDomain = `${serviceUrl2.hostname}${serviceUrl2.port ? `%3A${serviceUrl2.port}` : ""}`;
     const localServiceDid = `did:web:${serviceDomain}`;
     const getInferredServiceDid = /* @__PURE__ */ __name((did2) => {
       if (!did2.startsWith("did:web:")) return null;
@@ -17713,12 +17775,12 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
     }), "getInboxService");
     const inferredServiceDid = getInferredServiceDid(recipientDid);
     if (inferredServiceDid === localServiceDid) {
-      return `${serviceUrl.origin}/api/inbox/receive`;
+      return `${serviceUrl2.origin}/api/inbox/receive`;
     }
     const didDoc = await _learnCard.invoke.resolveDid(recipientDid);
     const inboxService = getInboxService(didDoc);
     if ((inboxService?.serviceDid || inferredServiceDid) === localServiceDid) {
-      return `${serviceUrl.origin}/api/inbox/receive`;
+      return `${serviceUrl2.origin}/api/inbox/receive`;
     }
     if (!inboxService?.serviceEndpoint) {
       throw new Error(
@@ -17880,7 +17942,8 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         return client.profileManager.updateProfileManager.mutate(manager);
       }, "updateProfileManagerProfile"),
       deleteProfile: /* @__PURE__ */ __name(async () => {
-        if (!userData) throw new Error("Account does not exist!");
+        await initialQuery;
+        if (!apiToken) await ensureUser();
         const result = await client.profile.deleteProfile.mutate();
         if (result) {
           userData = void 0;
@@ -18031,11 +18094,10 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
             proofFormat: "jwt",
             challenge: `inbox-federation-${crypto.randomUUID()}`
           });
-          let receiveUrl = inboxEndpoint;
-          if (receiveUrl.includes("localhost")) {
-            receiveUrl = receiveUrl.replace("https://", "http://");
-          }
+          const receiveUrl = validateFederationUrl(inboxEndpoint, federationConfig);
           const response = await fetch(receiveUrl, {
+            // A redirect must not bypass endpoint validation or forward credentials.
+            redirect: "error",
             method: "POST",
             headers: {
               "Content-Type": "application/json",
@@ -18510,8 +18572,8 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           const isDid = recipient.startsWith("did:");
           const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(recipient);
           const isPhone = /^\+?[\d\s-]{10,}$/.test(recipient.replace(/[\s-]/g, ""));
-          const serviceUrl = new URL(url2);
-          const serviceDomain = `${serviceUrl.hostname}${serviceUrl.port ? `%3A${serviceUrl.port}` : ""}`;
+          const serviceUrl2 = new URL(url2);
+          const serviceDomain = `${serviceUrl2.hostname}${serviceUrl2.port ? `%3A${serviceUrl2.port}` : ""}`;
           const recipientDomain = recipient.startsWith("did:web:") ? recipient.split(":")[2] : void 0;
           const isRemoteDidWebRecipient = recipient.startsWith("did:web:") && recipientDomain !== serviceDomain;
           if (isRemoteDidWebRecipient && input.templateUri) {