@metamask-previews/profile-sync-controller 32.1.1-preview-c6cdff1dd → 32.1.1-preview-9d2a9bdf5

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js

@@ -1,265 +0,0 @@
-import { array, assert, boolean, enums, integer, literal, min, nullable, object, optional, pattern, refine, sensitive, size, string, StructError, type, union, } from '@metamask/superstruct';
-import { ElevatedTokenInvalidError, MfaError } from '../../errors.js';
-import { asRecord } from '../../utils/as-record.js';
-export const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'];
-export const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);
-const CredentialDescriptorStruct = type({
-    type: literal('public-key'),
-    id: string(),
-    transports: optional(array(string())),
-});
-const ExtensionsStruct = type({});
-export const PublicKeyCredentialCreationOptionsJSONStruct = type({
-    rp: type({
-        id: string(),
-        name: string(),
-    }),
-    user: type({
-        id: sensitive(string()),
-        name: sensitive(string()),
-        displayName: sensitive(string()),
-    }),
-    challenge: sensitive(string()),
-    pubKeyCredParams: array(type({
-        type: literal('public-key'),
-        alg: integer(),
-    })),
-    excludeCredentials: optional(array(CredentialDescriptorStruct)),
-    authenticatorSelection: optional(type({
-        authenticatorAttachment: optional(string()),
-        residentKey: optional(string()),
-        requireResidentKey: optional(boolean()),
-        userVerification: optional(string()),
-    })),
-    attestation: optional(string()),
-    timeout: optional(integer()),
-    extensions: optional(ExtensionsStruct),
-});
-export const PublicKeyCredentialRequestOptionsJSONStruct = type({
-    challenge: sensitive(string()),
-    rpId: optional(string()),
-    allowCredentials: optional(array(CredentialDescriptorStruct)),
-    userVerification: optional(string()),
-    timeout: optional(integer()),
-    extensions: optional(ExtensionsStruct),
-});
-export const PasskeyCreateDataStruct = type({
-    publicKey: PublicKeyCredentialCreationOptionsJSONStruct,
-});
-export const PasskeyRequestDataStruct = type({
-    publicKey: PublicKeyCredentialRequestOptionsJSONStruct,
-});
-export const RegistrationResponseJSONStruct = sensitive(type({
-    id: string(),
-    rawId: string(),
-    type: literal('public-key'),
-    response: type({
-        attestationObject: string(),
-        clientDataJSON: string(),
-        transports: optional(array(string())),
-        publicKeyAlgorithm: optional(integer()),
-        publicKey: optional(string()),
-        authenticatorData: optional(string()),
-    }),
-    authenticatorAttachment: optional(nullable(string())),
-    clientExtensionResults: optional(ExtensionsStruct),
-}));
-export const AuthenticationResponseJSONStruct = sensitive(type({
-    id: string(),
-    rawId: string(),
-    type: literal('public-key'),
-    response: type({
-        authenticatorData: string(),
-        clientDataJSON: string(),
-        signature: string(),
-        userHandle: optional(nullable(string())),
-    }),
-    authenticatorAttachment: optional(nullable(string())),
-    clientExtensionResults: optional(ExtensionsStruct),
-}));
-/**
- * Only the assertion JWT is consumed from the verification response; the
- * profile fields on the wire duplicate what the login flow already resolved.
- */
-export const MfaVerifyCompleteResponseStruct = type({
-    token: sensitive(string()),
-    expires_in: integer(),
-});
-export const MfaEnrollResponseStruct = type({
-    flow_id: string(),
-    expires_at: string(),
-    passkey_create_data: optional(sensitive(string())),
-});
-export const MfaEnrollCompleteResponseStruct = type({
-    status: literal('enrolled'),
-});
-export const MfaVerifyResponseStruct = type({
-    flow_id: string(),
-    expires_at: string(),
-    passkey_request_data: optional(sensitive(string())),
-});
-export const MfaPasskeyDetailStruct = type({
-    display_name: optional(sensitive(string())),
-    added_at: optional(string()),
-});
-export const MfaEmailDetailStruct = type({
-    address: optional(sensitive(string())),
-    verified: optional(boolean()),
-});
-export const MfaCredentialStruct = type({
-    // Intentionally accepts strings so future server credential types and
-    // statuses can be ignored without making the complete response invalid.
-    credential_type: string(),
-    status: string(),
-    enrolled_at: optional(string()),
-    passkey: optional(MfaPasskeyDetailStruct),
-    email: optional(MfaEmailDetailStruct),
-});
-export const MfaCredentialsResponseStruct = type({
-    credentials: array(MfaCredentialStruct),
-});
-export const MfaErrorResponseStruct = type({
-    code: optional(string()),
-    message: string(),
-});
-export const TokenReasonStruct = object({
-    operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),
-});
-export const BeginEnrollmentRequestStruct = refine(object({
-    type: MfaCredentialTypeStruct,
-    email: optional(sensitive(size(string(), 3, 254))),
-    reason: TokenReasonStruct,
-}), 'BeginEnrollmentRequest', (value) => {
-    if (value.type === 'email_otp' && value.email === undefined) {
-        return 'email is required for email_otp enrollment';
-    }
-    if (value.type === 'passkey' && value.email !== undefined) {
-        return 'email is not accepted for passkey enrollment';
-    }
-    return true;
-});
-const EmailOtpCodeStruct = sensitive(pattern(string(), /^\d{6}$/u));
-const EnrollmentProofStruct = union([
-    object({
-        type: literal('passkey'),
-        attestation: RegistrationResponseJSONStruct,
-    }),
-    object({
-        type: literal('email_otp'),
-        code: EmailOtpCodeStruct,
-    }),
-]);
-export const CompleteEnrollmentRequestStruct = object({
-    flowId: string(),
-    proof: EnrollmentProofStruct,
-    reason: TokenReasonStruct,
-});
-export const BeginStepUpRequestStruct = object({
-    type: MfaCredentialTypeStruct,
-    reason: TokenReasonStruct,
-});
-const StepUpProofStruct = union([
-    object({
-        type: literal('passkey'),
-        assertion: AuthenticationResponseJSONStruct,
-    }),
-    object({
-        type: literal('email_otp'),
-        code: EmailOtpCodeStruct,
-    }),
-]);
-export const CompleteStepUpRequestStruct = object({
-    flowId: string(),
-    proof: StepUpProofStruct,
-    reason: TokenReasonStruct,
-});
-export const GetElevatedTokenRequestStruct = object({
-    maxSessionAgeMs: optional(min(integer(), 0)),
-});
-export const ElevatedTokenClaimsStruct = type({
-    sub: sensitive(string()),
-    aal: literal(2),
-    exp: integer(),
-    amr: union([MfaCredentialTypeStruct, array(MfaCredentialTypeStruct)]),
-});
-function formatStructError(error) {
-    return error
-        .failures()
-        .map(({ path, message }) => `[${path.join('.')}] ${message}`)
-        .join(', ');
-}
-/**
- * Validates data received from the authentication service.
- *
- * @param value - Untrusted response data.
- * @param struct - Expected response structure.
- * @throws MfaError if the response does not match the structure.
- */
-export function assertValidMfaResponse(value, struct) {
-    try {
-        assert(value, struct);
-    }
-    catch (error) {
-        if (error instanceof StructError) {
-            throw new MfaError('invalid_response', formatStructError(error));
-        }
-        /* istanbul ignore next */
-        throw error;
-    }
-}
-/**
- * Validates data received from an untyped controller boundary.
- *
- * @param value - Untrusted request data.
- * @param struct - Expected request structure.
- * @throws MfaError if the request does not match the structure.
- */
-export function assertValidMfaRequest(value, struct) {
-    try {
-        assert(value, struct);
-    }
-    catch (error) {
-        if (error instanceof StructError) {
-            throw new MfaError('invalid_request', formatStructError(error));
-        }
-        /* istanbul ignore next */
-        throw error;
-    }
-}
-/**
- * Validates and normalizes claims from an elevated access token.
- *
- * Hydra places hook-supplied claims under `ext` unless they are promoted to
- * the top level, so `aal` and `amr` are read from either location.
- *
- * @param payload - Decoded JWT payload.
- * @returns Validated claims with `amr` represented as an array.
- * @throws ElevatedTokenInvalidError if claims are missing or invalid.
- */
-export function parseElevatedTokenClaims(payload) {
-    const record = asRecord(payload);
-    const ext = asRecord(record?.ext);
-    const value = {
-        sub: record?.sub,
-        exp: record?.exp,
-        aal: record?.aal ?? ext?.aal,
-        amr: record?.amr ?? ext?.amr,
-    };
-    try {
-        assert(value, ElevatedTokenClaimsStruct);
-    }
-    catch (error) {
-        if (error instanceof StructError) {
-            throw new ElevatedTokenInvalidError(formatStructError(error));
-        }
-        /* istanbul ignore next */
-        throw error;
-    }
-    return {
-        sub: value.sub,
-        aal: value.aal,
-        exp: value.exp,
-        amr: Array.isArray(value.amr) ? value.amr : [value.amr],
-    };
-}
-//# sourceMappingURL=schemas.js.map

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,GAAG,EACH,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,MAAM,EACN,SAAS,EACT,IAAI,EACJ,MAAM,EACN,WAAW,EACX,IAAI,EACJ,KAAK,GACN,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAU,CAAC;AAEtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnE,MAAM,0BAA0B,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,EAAE,EAAE,MAAM,EAAE;IACZ,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,EAAE,EAAE,IAAI,CAAC;QACP,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM,EAAE;KACf,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;QACT,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CACrB,IAAI,CAAC;QACH,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;QAC3B,GAAG,EAAE,OAAO,EAAE;KACf,CAAC,CACH;IACD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/D,sBAAsB,EAAE,QAAQ,CAC9B,IAAI,CAAC;QACH,uBAAuB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACrC,CAAC,CACH;IACD,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,4CAA4C;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3C,SAAS,EAAE,2CAA2C;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CACrD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CACvD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,SAAS,EAAE,MAAM,EAAE;QACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACzC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAE1B,UAAU,EAAE,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,mBAAmB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACtC,sEAAsE;IACtE,wEAAwE;IAExE,eAAe,EAAE,MAAM,EAAE;IACzB,MAAM,EAAE,MAAM,EAAE;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACzC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAChD,MAAM,CAAC;IACL,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,iBAAiB;CAC1B,CAAC,EACF,wBAAwB,EACxB,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpE,MAAM,qBAAqB,GAAG,KAAK,CAAC;IAClC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;IAC7C,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,SAAS,EAAE,gCAAgC;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;IAClD,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;IAC5C,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,OAAO,EAAE;IACd,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;CACtE,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,KAAK;SACT,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IAMvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAY;QACrB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;QAC5B,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;KAC7B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["import {\n  array,\n  assert,\n  boolean,\n  enums,\n  integer,\n  literal,\n  min,\n  nullable,\n  object,\n  optional,\n  pattern,\n  refine,\n  sensitive,\n  size,\n  string,\n  StructError,\n  type,\n  union,\n} from '@metamask/superstruct';\nimport type { Struct } from '@metamask/superstruct';\n\nimport { ElevatedTokenInvalidError, MfaError } from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\n\nexport const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'] as const;\n\nexport const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);\n\nconst CredentialDescriptorStruct = type({\n  type: literal('public-key'),\n  id: string(),\n  transports: optional(array(string())),\n});\n\nconst ExtensionsStruct = type({});\n\nexport const PublicKeyCredentialCreationOptionsJSONStruct = type({\n  rp: type({\n    id: string(),\n    name: string(),\n  }),\n  user: type({\n    id: sensitive(string()),\n    name: sensitive(string()),\n    displayName: sensitive(string()),\n  }),\n  challenge: sensitive(string()),\n  pubKeyCredParams: array(\n    type({\n      type: literal('public-key'),\n      alg: integer(),\n    }),\n  ),\n  excludeCredentials: optional(array(CredentialDescriptorStruct)),\n  authenticatorSelection: optional(\n    type({\n      authenticatorAttachment: optional(string()),\n      residentKey: optional(string()),\n      requireResidentKey: optional(boolean()),\n      userVerification: optional(string()),\n    }),\n  ),\n  attestation: optional(string()),\n  timeout: optional(integer()),\n  extensions: optional(ExtensionsStruct),\n});\n\nexport const PublicKeyCredentialRequestOptionsJSONStruct = type({\n  challenge: sensitive(string()),\n  rpId: optional(string()),\n  allowCredentials: optional(array(CredentialDescriptorStruct)),\n  userVerification: optional(string()),\n  timeout: optional(integer()),\n  extensions: optional(ExtensionsStruct),\n});\n\nexport const PasskeyCreateDataStruct = type({\n  publicKey: PublicKeyCredentialCreationOptionsJSONStruct,\n});\n\nexport const PasskeyRequestDataStruct = type({\n  publicKey: PublicKeyCredentialRequestOptionsJSONStruct,\n});\n\nexport const RegistrationResponseJSONStruct = sensitive(\n  type({\n    id: string(),\n    rawId: string(),\n    type: literal('public-key'),\n    response: type({\n      attestationObject: string(),\n      clientDataJSON: string(),\n      transports: optional(array(string())),\n      publicKeyAlgorithm: optional(integer()),\n      publicKey: optional(string()),\n      authenticatorData: optional(string()),\n    }),\n    authenticatorAttachment: optional(nullable(string())),\n    clientExtensionResults: optional(ExtensionsStruct),\n  }),\n);\n\nexport const AuthenticationResponseJSONStruct = sensitive(\n  type({\n    id: string(),\n    rawId: string(),\n    type: literal('public-key'),\n    response: type({\n      authenticatorData: string(),\n      clientDataJSON: string(),\n      signature: string(),\n      userHandle: optional(nullable(string())),\n    }),\n    authenticatorAttachment: optional(nullable(string())),\n    clientExtensionResults: optional(ExtensionsStruct),\n  }),\n);\n\n/**\n * Only the assertion JWT is consumed from the verification response; the\n * profile fields on the wire duplicate what the login flow already resolved.\n */\nexport const MfaVerifyCompleteResponseStruct = type({\n  token: sensitive(string()),\n\n  expires_in: integer(),\n});\n\nexport const MfaEnrollResponseStruct = type({\n  flow_id: string(),\n\n  expires_at: string(),\n\n  passkey_create_data: optional(sensitive(string())),\n});\n\nexport const MfaEnrollCompleteResponseStruct = type({\n  status: literal('enrolled'),\n});\n\nexport const MfaVerifyResponseStruct = type({\n  flow_id: string(),\n\n  expires_at: string(),\n\n  passkey_request_data: optional(sensitive(string())),\n});\n\nexport const MfaPasskeyDetailStruct = type({\n  display_name: optional(sensitive(string())),\n\n  added_at: optional(string()),\n});\n\nexport const MfaEmailDetailStruct = type({\n  address: optional(sensitive(string())),\n  verified: optional(boolean()),\n});\n\nexport const MfaCredentialStruct = type({\n  // Intentionally accepts strings so future server credential types and\n  // statuses can be ignored without making the complete response invalid.\n\n  credential_type: string(),\n  status: string(),\n\n  enrolled_at: optional(string()),\n  passkey: optional(MfaPasskeyDetailStruct),\n  email: optional(MfaEmailDetailStruct),\n});\n\nexport const MfaCredentialsResponseStruct = type({\n  credentials: array(MfaCredentialStruct),\n});\n\nexport const MfaErrorResponseStruct = type({\n  code: optional(string()),\n  message: string(),\n});\n\nexport const TokenReasonStruct = object({\n  operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),\n});\n\nexport const BeginEnrollmentRequestStruct = refine(\n  object({\n    type: MfaCredentialTypeStruct,\n    email: optional(sensitive(size(string(), 3, 254))),\n    reason: TokenReasonStruct,\n  }),\n  'BeginEnrollmentRequest',\n  (value) => {\n    if (value.type === 'email_otp' && value.email === undefined) {\n      return 'email is required for email_otp enrollment';\n    }\n    if (value.type === 'passkey' && value.email !== undefined) {\n      return 'email is not accepted for passkey enrollment';\n    }\n    return true;\n  },\n);\n\nconst EmailOtpCodeStruct = sensitive(pattern(string(), /^\\d{6}$/u));\n\nconst EnrollmentProofStruct = union([\n  object({\n    type: literal('passkey'),\n    attestation: RegistrationResponseJSONStruct,\n  }),\n  object({\n    type: literal('email_otp'),\n    code: EmailOtpCodeStruct,\n  }),\n]);\n\nexport const CompleteEnrollmentRequestStruct = object({\n  flowId: string(),\n  proof: EnrollmentProofStruct,\n  reason: TokenReasonStruct,\n});\n\nexport const BeginStepUpRequestStruct = object({\n  type: MfaCredentialTypeStruct,\n  reason: TokenReasonStruct,\n});\n\nconst StepUpProofStruct = union([\n  object({\n    type: literal('passkey'),\n    assertion: AuthenticationResponseJSONStruct,\n  }),\n  object({\n    type: literal('email_otp'),\n    code: EmailOtpCodeStruct,\n  }),\n]);\n\nexport const CompleteStepUpRequestStruct = object({\n  flowId: string(),\n  proof: StepUpProofStruct,\n  reason: TokenReasonStruct,\n});\n\nexport const GetElevatedTokenRequestStruct = object({\n  maxSessionAgeMs: optional(min(integer(), 0)),\n});\n\nexport const ElevatedTokenClaimsStruct = type({\n  sub: sensitive(string()),\n  aal: literal(2),\n  exp: integer(),\n  amr: union([MfaCredentialTypeStruct, array(MfaCredentialTypeStruct)]),\n});\n\nfunction formatStructError(error: StructError): string {\n  return error\n    .failures()\n    .map(({ path, message }) => `[${path.join('.')}] ${message}`)\n    .join(', ');\n}\n\n/**\n * Validates data received from the authentication service.\n *\n * @param value - Untrusted response data.\n * @param struct - Expected response structure.\n * @throws MfaError if the response does not match the structure.\n */\nexport function assertValidMfaResponse<Value>(\n  value: unknown,\n  struct: Struct<Value>,\n): asserts value is Value {\n  try {\n    assert(value, struct);\n  } catch (error) {\n    if (error instanceof StructError) {\n      throw new MfaError('invalid_response', formatStructError(error));\n    }\n    /* istanbul ignore next */\n    throw error;\n  }\n}\n\n/**\n * Validates data received from an untyped controller boundary.\n *\n * @param value - Untrusted request data.\n * @param struct - Expected request structure.\n * @throws MfaError if the request does not match the structure.\n */\nexport function assertValidMfaRequest<Value>(\n  value: unknown,\n  struct: Struct<Value>,\n): asserts value is Value {\n  try {\n    assert(value, struct);\n  } catch (error) {\n    if (error instanceof StructError) {\n      throw new MfaError('invalid_request', formatStructError(error));\n    }\n    /* istanbul ignore next */\n    throw error;\n  }\n}\n\n/**\n * Validates and normalizes claims from an elevated access token.\n *\n * Hydra places hook-supplied claims under `ext` unless they are promoted to\n * the top level, so `aal` and `amr` are read from either location.\n *\n * @param payload - Decoded JWT payload.\n * @returns Validated claims with `amr` represented as an array.\n * @throws ElevatedTokenInvalidError if claims are missing or invalid.\n */\nexport function parseElevatedTokenClaims(payload: unknown): {\n  sub: string;\n  aal: 2;\n  exp: number;\n  amr: ('passkey' | 'email_otp')[];\n} {\n  const record = asRecord(payload);\n  const ext = asRecord(record?.ext);\n  const value: unknown = {\n    sub: record?.sub,\n    exp: record?.exp,\n    aal: record?.aal ?? ext?.aal,\n    amr: record?.amr ?? ext?.amr,\n  };\n\n  try {\n    assert(value, ElevatedTokenClaimsStruct);\n  } catch (error) {\n    if (error instanceof StructError) {\n      throw new ElevatedTokenInvalidError(formatStructError(error));\n    }\n    /* istanbul ignore next */\n    throw error;\n  }\n\n  return {\n    sub: value.sub,\n    aal: value.aal,\n    exp: value.exp,\n    amr: Array.isArray(value.amr) ? value.amr : [value.amr],\n  };\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/services.d.ts

@@ -1,104 +0,0 @@
-import type { Env } from '../../../shared/env.js';
-import type { AuthenticationResponseJSON, EnrolledCredential, MfaCredential, MfaCredentialType, MfaEnrollRequest, MfaVerifyRequest, PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions, PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions, RegistrationResponseJSON } from './types.js';
-export declare const MFA_ENROLL_URL: (env: Env) => string;
-export declare const MFA_ENROLL_COMPLETE_URL: (env: Env) => string;
-export declare const MFA_VERIFY_URL: (env: Env) => string;
-export declare const MFA_VERIFY_COMPLETE_URL: (env: Env) => string;
-export declare const MFA_CREDENTIALS_URL: (env: Env) => string;
-type EnrollmentServiceResult = {
-    flowId: string;
-    expiresAt: number;
-    publicKey?: PasskeyCreationOptions;
-};
-type VerificationServiceResult = {
-    flowId: string;
-    expiresAt: number;
-    publicKey?: PasskeyRequestOptions;
-};
-export type MfaStepUpAssertion = {
-    /** AAL2 assertion JWT to exchange at Hydra for an elevated access token. */
-    token: string;
-    /** Assertion lifetime in seconds. */
-    expiresIn: number;
-};
-type EnrollmentCompletionParams = {
-    credential_type: MfaCredentialType;
-    flow_id: string;
-    otp_code?: string;
-    passkey_attestation?: RegistrationResponseJSON;
-};
-type VerificationCompletionParams = {
-    credential_type: MfaCredentialType;
-    flow_id: string;
-    otp_code?: string;
-    passkey_assertion?: AuthenticationResponseJSON;
-};
-/**
- * Parses passkey creation data embedded in an enrollment response.
- *
- * @param value - JSON-encoded creation options.
- * @returns Validated public-key creation options.
- */
-export declare function parsePasskeyCreateData(value: string): PasskeyCreationOptions;
-/**
- * Parses passkey request data embedded in a verification response.
- *
- * @param value - JSON-encoded request options.
- * @returns Validated public-key request options.
- */
-export declare function parsePasskeyRequestData(value: string): PasskeyRequestOptions;
-/**
- * Begins enrollment of an MFA credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param body - Enrollment request.
- * @returns Validated enrollment flow data.
- */
-export declare function mfaEnroll(env: Env, accessToken: string, body: MfaEnrollRequest): Promise<EnrollmentServiceResult>;
-/**
- * Completes enrollment of an MFA credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param params - Flow identifier and enrollment proof.
- */
-export declare function mfaEnrollComplete(env: Env, accessToken: string, params: EnrollmentCompletionParams): Promise<void>;
-/**
- * Begins step-up verification with an enrolled credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param body - Verification request.
- * @returns Validated verification flow data.
- */
-export declare function mfaVerify(env: Env, accessToken: string, body: MfaVerifyRequest): Promise<VerificationServiceResult>;
-/**
- * Completes step-up verification with an enrolled credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param params - Flow identifier and verification proof.
- * @returns The AAL2 assertion JWT and its lifetime in seconds.
- */
-export declare function mfaVerifyComplete(env: Env, accessToken: string, params: VerificationCompletionParams): Promise<MfaStepUpAssertion>;
-/**
- * Maps a server credential to its public controller representation.
- *
- * Unknown credential types or statuses are dropped so the server can extend
- * either without invalidating the whole list.
- *
- * @param credential - Validated server credential.
- * @returns A supported credential, or null when it cannot be represented.
- */
-export declare function toEnrolledCredential(credential: MfaCredential): EnrolledCredential | null;
-/**
- * Gets the credentials enrolled on the canonical profile.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @returns Supported enrolled credentials.
- */
-export declare function getMfaCredentials(env: Env, accessToken: string): Promise<EnrolledCredential[]>;
-export {};
-//# sourceMappingURL=services.d.ts.map

package/dist/sdk/authentication-jwt-bearer/mfa/services.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAiClD,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAEjB,gBAAgB,EAEhB,gBAAgB,EAChB,sCAAsC,IAAI,sBAAsB,EAChE,qCAAqC,IAAI,qBAAqB,EAC9D,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,KAAK,uBAAuB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,qBAAqB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAEhC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;CAChD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAElC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAY5E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAY5E;AAyJD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAclC;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GACxB,kBAAkB,GAAG,IAAI,CAmC3B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B"}