@learncard/sss-key-manager 0.1.13 → 0.1.15

package/package.json

@@ -1,54 +1,64 @@
 {
-  "name": "@learncard/sss-key-manager",
-  "version": "0.1.13",
-  "description": "Shamir Secret Sharing key manager for LearnCard - replaces Web3Auth SFA",
-  "main": "./dist/index.js",
-  "module": "./dist/sss-key-manager.esm.js",
-  "types": "./dist/sss-key-manager.d.ts",
-  "files": [
-    "dist"
-  ],
-  "author": "Learning Economy Foundation (www.learningeconomy.io)",
-  "license": "MIT",
-  "homepage": "https://github.com/learningeconomy/LearnCard/tree/main/packages/sss-key-manager/README.md",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/learningeconomy/LearnCard"
-  },
-  "bugs": {
-    "url": "https://github.com/learningeconomy/LearnCard/issues"
-  },
-  "devDependencies": {
-    "@esbuild-plugins/node-resolve": "^0.1.4",
-    "@types/node": "^18.7.19",
-    "dts-bundle-generator": "^6.10.0",
-    "esbuild": "^0.27.1",
-    "fake-indexeddb": "^6.2.5",
-    "jsdom": "^24.0.0",
-    "shx": "^0.3.4",
-    "typescript": "^5.0.0",
-    "vitest": "^1.0.0"
-  },
-  "dependencies": {
-    "@noble/ed25519": "^2.0.0",
-    "@scure/bip39": "^1.2.1",
-    "hash-wasm": "^4.11.0",
-    "shamir-secret-sharing": "^0.0.4",
-    "@learncard/types": "5.17.3"
-  },
-  "peerDependencies": {
-    "@simplewebauthn/browser": ">=9.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@simplewebauthn/browser": {
-      "optional": true
+    "name": "@learncard/sss-key-manager",
+    "version": "0.1.15",
+    "description": "Shamir Secret Sharing key manager for LearnCard - replaces Web3Auth SFA",
+    "main": "./dist/index.js",
+    "module": "./dist/sss-key-manager.esm.js",
+    "types": "./dist/sss-key-manager.d.ts",
+    "files": [
+        "dist",
+        "src"
+    ],
+    "scripts": {
+        "build": "node ./scripts/build.mjs && shx cp ./scripts/mixedEntrypoint.js ./dist/index.js && dts-bundle-generator src/index.ts -o dist/sss-key-manager.d.ts --no-check",
+        "dev": "node ./scripts/build.mjs --watch",
+        "test": "vitest run",
+        "test:watch": "vitest",
+        "typecheck": "tsc --noEmit"
+    },
+    "author": "Learning Economy Foundation (www.learningeconomy.io)",
+    "license": "MIT",
+    "homepage": "https://github.com/learningeconomy/LearnCard/tree/main/packages/sss-key-manager/README.md",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/learningeconomy/LearnCard"
+    },
+    "bugs": {
+        "url": "https://github.com/learningeconomy/LearnCard/issues"
+    },
+    "devDependencies": {
+        "@esbuild-plugins/node-resolve": "^0.1.4",
+        "@types/node": "^18.7.19",
+        "dts-bundle-generator": "^6.10.0",
+        "esbuild": "^0.27.1",
+        "fake-indexeddb": "^6.2.5",
+        "jsdom": "^24.0.0",
+        "shx": "^0.3.4",
+        "typescript": "^5.0.0",
+        "vitest": "^1.0.0"
+    },
+    "dependencies": {
+        "@learncard/types": "workspace:*",
+        "@noble/ed25519": "^2.0.0",
+        "@scure/bip39": "^1.2.1",
+        "hash-wasm": "^4.11.0",
+        "shamir-secret-sharing": "^0.0.4"
+    },
+    "peerDependencies": {
+        "@simplewebauthn/browser": ">=9.0.0"
+    },
+    "peerDependenciesMeta": {
+        "@simplewebauthn/browser": {
+            "optional": true
+        }
+    },
+    "exports": {
+        ".": {
+            "development": "./src/index.ts",
+            "types": "./dist/sss-key-manager.d.ts",
+            "import": "./dist/sss-key-manager.esm.js",
+            "require": "./dist/index.js",
+            "default": "./dist/sss-key-manager.esm.js"
+        }
     }
-  },
-  "scripts": {
-    "build": "node ./scripts/build.mjs && shx cp ./scripts/mixedEntrypoint.js ./dist/index.js && dts-bundle-generator src/index.ts -o dist/sss-key-manager.d.ts --no-check",
-    "dev": "node ./scripts/build.mjs --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit"
-  }
-}
+}

package/src/api-client.ts

@@ -0,0 +1,257 @@
+/**
+ * API client for SSS Key Manager server routes
+ */
+
+import type {
+    AuthProvider,
+    AuthProviderType,
+    ContactMethod,
+    ServerEncryptedShare,
+    RecoveryMethodInfo,
+    EncryptedShare,
+    SecurityLevel,
+} from './types';
+
+export interface GetAuthShareResponse {
+    authShare: ServerEncryptedShare | null;
+    primaryDid: string | null;
+    securityLevel: SecurityLevel;
+    recoveryMethods: RecoveryMethodInfo[];
+    keyProvider: 'web3auth' | 'sss';
+    maskedRecoveryEmail?: string | null;
+}
+
+export interface StoreAuthShareInput {
+    authShare: ServerEncryptedShare;
+    primaryDid: string;
+    securityLevel?: SecurityLevel;
+}
+
+export interface StoreRecoveryShareInput {
+    type: 'passkey' | 'backup' | 'phrase' | 'email';
+    encryptedShare?: EncryptedShare;
+    credentialId?: string;
+    shareVersion?: number;
+}
+
+export interface ApiClientConfig {
+    serverUrl: string;
+    authProvider: AuthProvider;
+}
+
+export class SSSApiClient {
+    private serverUrl: string;
+    private authProvider: AuthProvider;
+
+    constructor(config: ApiClientConfig) {
+        this.serverUrl = config.serverUrl.replace(/\/$/, '');
+        this.authProvider = config.authProvider;
+    }
+
+    private async getAuthHeaders(): Promise<Record<string, string>> {
+        const token = await this.authProvider.getIdToken();
+        return {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${token}`,
+        };
+    }
+
+    private async getContactMethodFromUser(): Promise<ContactMethod | null> {
+        const user = await this.authProvider.getCurrentUser();
+        if (!user) return null;
+
+        if (user.email) {
+            return { type: 'email' as const, value: user.email.toLowerCase() };
+        }
+        if (user.phone) {
+            return { type: 'phone' as const, value: user.phone };
+        }
+        return null;
+    }
+
+    async getAuthShare(): Promise<GetAuthShareResponse | null> {
+        const headers = await this.getAuthHeaders();
+        const providerType = this.authProvider.getProviderType();
+
+        const response = await fetch(`${this.serverUrl}/keys/auth-share`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ providerType }),
+        });
+
+        if (!response.ok) {
+            if (response.status === 404) {
+                return null;
+            }
+            throw new Error(`Failed to get auth share: ${response.statusText}`);
+        }
+
+        return response.json();
+    }
+
+    async storeAuthShare(input: StoreAuthShareInput): Promise<void> {
+        const headers = await this.getAuthHeaders();
+        const providerType = this.authProvider.getProviderType();
+
+        const response = await fetch(`${this.serverUrl}/keys/auth-share`, {
+            method: 'PUT',
+            headers,
+            body: JSON.stringify({
+                ...input,
+                providerType,
+            }),
+        });
+
+        if (!response.ok) {
+            throw new Error(`Failed to store auth share: ${response.statusText}`);
+        }
+    }
+
+    async addRecoveryMethod(input: StoreRecoveryShareInput): Promise<void> {
+        const headers = await this.getAuthHeaders();
+        const providerType = this.authProvider.getProviderType();
+
+        const response = await fetch(`${this.serverUrl}/keys/recovery`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                ...input,
+                providerType,
+            }),
+        });
+
+        if (!response.ok) {
+            throw new Error(`Failed to add recovery method: ${response.statusText}`);
+        }
+    }
+
+    async getRecoveryShare(
+        type: 'passkey' | 'backup' | 'phrase' | 'email',
+        credentialId?: string
+    ): Promise<{ encryptedShare?: EncryptedShare; shareVersion?: number } | null> {
+        const token = await this.authProvider.getIdToken();
+        const providerType = this.authProvider.getProviderType();
+
+        const params = new URLSearchParams({
+            type,
+            providerType,
+            authToken: token,
+        });
+
+        if (credentialId) {
+            params.append('credentialId', credentialId);
+        }
+
+        const response = await fetch(`${this.serverUrl}/keys/recovery?${params}`, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+
+        if (!response.ok) {
+            if (response.status === 404) {
+                return null;
+            }
+            throw new Error(`Failed to get recovery share: ${response.statusText}`);
+        }
+
+        return response.json();
+    }
+
+    async markMigrated(): Promise<void> {
+        const headers = await this.getAuthHeaders();
+        const providerType = this.authProvider.getProviderType();
+
+        const response = await fetch(`${this.serverUrl}/keys/migrate`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ providerType }),
+        });
+
+        if (!response.ok) {
+            throw new Error(`Failed to mark as migrated: ${response.statusText}`);
+        }
+    }
+
+    async sendEmailBackupShare(emailShare: string, overrideEmail?: string): Promise<void> {
+        const headers = await this.getAuthHeaders();
+        const providerType = this.authProvider.getProviderType();
+
+        let email = overrideEmail;
+
+        if (!email) {
+            const user = await this.authProvider.getCurrentUser();
+            email = user?.email;
+        }
+
+        if (!email) {
+            console.warn('Cannot send email backup share: no email address available');
+            return;
+        }
+
+        const response = await fetch(`${this.serverUrl}/keys/email-backup`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                providerType,
+                emailShare,
+                email,
+            }),
+        });
+
+        if (!response.ok) {
+            // Non-fatal: log but don't throw — the user can still use the app
+            console.warn(`Failed to send email backup share: ${response.statusText}`);
+        }
+    }
+
+    async addRecoveryEmail(email: string): Promise<void> {
+        const token = await this.authProvider.getIdToken();
+        const providerType = this.authProvider.getProviderType();
+
+        const response = await fetch(`${this.serverUrl}/keys/recovery-email/add`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ authToken: token, providerType, email }),
+        });
+
+        if (!response.ok) {
+            const data = await response.json().catch(() => ({}));
+            throw new Error(data?.message || `Failed to add recovery email: ${response.statusText}`);
+        }
+    }
+
+    async verifyRecoveryEmail(code: string): Promise<{ maskedEmail: string }> {
+        const token = await this.authProvider.getIdToken();
+        const providerType = this.authProvider.getProviderType();
+
+        const response = await fetch(`${this.serverUrl}/keys/recovery-email/verify`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ authToken: token, providerType, code }),
+        });
+
+        if (!response.ok) {
+            const data = await response.json().catch(() => ({}));
+            throw new Error(data?.message || `Failed to verify recovery email: ${response.statusText}`);
+        }
+
+        return response.json();
+    }
+
+    async deleteUserKey(): Promise<void> {
+        const headers = await this.getAuthHeaders();
+        const providerType = this.authProvider.getProviderType();
+
+        const response = await fetch(`${this.serverUrl}/keys`, {
+            method: 'DELETE',
+            headers,
+            body: JSON.stringify({ providerType }),
+        });
+
+        if (!response.ok) {
+            throw new Error(`Failed to delete user key: ${response.statusText}`);
+        }
+    }
+}