@medialane/sdk 0.104.0 → 0.105.0

package/dist/index.cjs

@@ -3,6 +3,8 @@
 var zod = require('zod');
 var sha3_js = require('@noble/hashes/sha3.js');
 var base = require('@scure/base');
+var hmac_js = require('@noble/hashes/hmac.js');
+var sha2_js = require('@noble/hashes/sha2.js');
 
 // src/config.ts
 
@@ -1559,6 +1561,81 @@ async function getBackendSignedUrl(config, kind = "image") {
   if (!res.ok || !data.data) throw new Error(data.error ?? "Failed to create upload URL");
   return data.data.url;
 }
+var IDENTITY_PREFIX = "siws_";
+var ACCOUNT_SESSION_PREFIX = "account_session_";
+var IDENTITY_DOMAIN = "siws-identity-v1";
+var ACCOUNT_SESSION_DOMAIN = "account-session-v1";
+var IDENTITY_TTL_SECONDS = 86400;
+var ACCOUNT_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+var CLOCK_SKEW_SECONDS = 60;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function toHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function sign(secret, domain, payload) {
+  const message = domain === null ? payload : `${domain}.${payload}`;
+  return toHex(hmac_js.hmac(sha2_js.sha256, encoder.encode(secret), encoder.encode(message)));
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function signatureMatches(secret, domain, payload, provided) {
+  return constantTimeEquals(provided, sign(secret, domain, payload)) || constantTimeEquals(provided, sign(secret, null, payload));
+}
+function encodePayload(value) {
+  return base.base64urlnopad.encode(encoder.encode(JSON.stringify(value)));
+}
+function decodePayload(payload) {
+  try {
+    return JSON.parse(decoder.decode(base.base64urlnopad.decode(payload)));
+  } catch {
+    return null;
+  }
+}
+function splitToken(raw, prefix) {
+  if (!raw.startsWith(prefix)) return null;
+  const inner = raw.slice(prefix.length);
+  const dot = inner.lastIndexOf(".");
+  if (dot === -1) return null;
+  return { payload: inner.slice(0, dot), signature: inner.slice(dot + 1) };
+}
+function withinLifetime(iat, exp) {
+  if (!iat || !exp) return false;
+  const now = Math.floor(Date.now() / 1e3);
+  return exp >= now && iat <= now + CLOCK_SKEW_SECONDS;
+}
+function issueSiwsToken(secret, chain, wallet, ttlSeconds = IDENTITY_TTL_SECONDS) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const payload = encodePayload({ sub: wallet, chain, iat, exp: iat + ttlSeconds });
+  return `${IDENTITY_PREFIX}${payload}.${sign(secret, IDENTITY_DOMAIN, payload)}`;
+}
+function verifySiwsToken(secret, raw) {
+  const parts = splitToken(raw, IDENTITY_PREFIX);
+  if (!parts) return null;
+  if (!signatureMatches(secret, IDENTITY_DOMAIN, parts.payload, parts.signature)) return null;
+  const data = decodePayload(parts.payload);
+  if (!data?.sub || !withinLifetime(data.iat, data.exp)) return null;
+  return { address: data.sub, chain: data.chain ?? "STARKNET" };
+}
+function issueAccountSessionToken(secret, accountId, ttlSeconds = ACCOUNT_SESSION_TTL_SECONDS) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const payload = encodePayload({ accountId, iat, exp: iat + ttlSeconds });
+  return `${ACCOUNT_SESSION_PREFIX}${payload}.${sign(secret, ACCOUNT_SESSION_DOMAIN, payload)}`;
+}
+function verifyAccountSessionToken(secret, raw) {
+  const parts = splitToken(raw, ACCOUNT_SESSION_PREFIX);
+  if (!parts) return null;
+  if (!signatureMatches(secret, ACCOUNT_SESSION_DOMAIN, parts.payload, parts.signature)) return null;
+  const data = decodePayload(parts.payload);
+  if (!data?.accountId || !withinLifetime(data.iat, data.exp)) return null;
+  return data.accountId;
+}
 
 // src/metadata.ts
 var RESERVED_TRAITS = /* @__PURE__ */ new Set([
@@ -1653,12 +1730,14 @@ function resolveSafeImageContentType(contentType) {
 }
 var MAX_IPFS_GATEWAY_RESPONSE_BYTES = 25 * 1024 * 1024;
 
+exports.ACCOUNT_SESSION_TTL_SECONDS = ACCOUNT_SESSION_TTL_SECONDS;
 exports.ALLOWED_IMAGE_CONTENT_TYPES = ALLOWED_IMAGE_CONTENT_TYPES;
 exports.ApiClient = ApiClient;
 exports.CHAINS = CHAINS;
 exports.DEFAULT_CHAIN = DEFAULT_CHAIN;
 exports.DEFAULT_CURRENCY = DEFAULT_CURRENCY;
 exports.FeeConfigSchema = FeeConfigSchema;
+exports.IDENTITY_TTL_SECONDS = IDENTITY_TTL_SECONDS;
 exports.IPFS_SAFE_CONTENT_TYPE_PREFIXES = IPFS_SAFE_CONTENT_TYPE_PREFIXES;
 exports.MAX_IMAGE_PROXY_BYTES = MAX_IMAGE_PROXY_BYTES;
 exports.MAX_IMAGE_REDIRECTS = MAX_IMAGE_REDIRECTS;
@@ -1733,6 +1812,8 @@ exports.isSameOrigin = isSameOrigin;
 exports.isServiceId = isServiceId;
 exports.isTransientRpcError = isTransientRpcError;
 exports.isValidIpfsCidPath = isValidIpfsCidPath;
+exports.issueAccountSessionToken = issueAccountSessionToken;
+exports.issueSiwsToken = issueSiwsToken;
 exports.listServices = listServices;
 exports.normalizeAddress = normalizeAddress;
 exports.normalizeHash = normalizeHash;
@@ -1750,5 +1831,7 @@ exports.uploadDirectoryToBackend = uploadDirectoryToBackend;
 exports.uploadFileToBackend = uploadFileToBackend;
 exports.uploadJsonToBackend = uploadJsonToBackend;
 exports.validateUrl = validateUrl;
+exports.verifyAccountSessionToken = verifyAccountSessionToken;
+exports.verifySiwsToken = verifySiwsToken;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map