@metamask/profile-sync-controller 0.5.0 → 0.7.0

package/dist/sdk/authentication-jwt-bearer/flow-srp.mjs

@@ -1,15 +1,121 @@
-import {
-  SRPJwtBearerAuth
-} from "../../chunk-TP7SP3AG.mjs";
-import "../../chunk-YLURF2PF.mjs";
-import "../../chunk-CAIIVJAO.mjs";
-import "../../chunk-5XSXZTED.mjs";
-import "../../chunk-UEWCUBMX.mjs";
-import "../../chunk-QDGLIUUS.mjs";
-import "../../chunk-KTCSRECK.mjs";
-import "../../chunk-TFFQFIJV.mjs";
-import "../../chunk-U5UIDVOO.mjs";
-export {
-  SRPJwtBearerAuth
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _SRPJwtBearerAuth_instances, _SRPJwtBearerAuth_config, _SRPJwtBearerAuth_options, _SRPJwtBearerAuth_getAuthSession, _SRPJwtBearerAuth_login, _SRPJwtBearerAuth_createSrpLoginRawMessage;
+import { ValidationError } from "../errors.mjs";
+import { getMetaMaskProviderEIP6963 } from "../utils/eip-6963-metamask-provider.mjs";
+import { MESSAGE_SIGNING_SNAP, connectSnap, isSnapConnected } from "../utils/messaging-signing-snap-requests.mjs";
+import { validateLoginResponse } from "../utils/validate-login-response.mjs";
+import { authenticate, authorizeOIDC, getNonce } from "./services.mjs";
+const getDefaultEIP6963Provider = async () => {
+    const provider = await getMetaMaskProviderEIP6963();
+    if (!provider) {
+        throw new ValidationError('No MetaMask wallet connected');
+    }
+    return provider;
+};
+const defaultEIP6963SigningOptions = {
+    getIdentifier: async () => {
+        const provider = await getDefaultEIP6963Provider();
+        return await MESSAGE_SIGNING_SNAP.getPublicKey(provider);
+    },
+    signMessage: async (message) => {
+        const provider = await getDefaultEIP6963Provider();
+        if (!message.startsWith('metamask:')) {
+            throw new ValidationError('message must start with "metamask:"');
+        }
+        const formattedMessage = message;
+        return await MESSAGE_SIGNING_SNAP.signMessage(provider, formattedMessage);
+    },
+};
+export class SRPJwtBearerAuth {
+    constructor(config, options) {
+        _SRPJwtBearerAuth_instances.add(this);
+        _SRPJwtBearerAuth_config.set(this, void 0);
+        _SRPJwtBearerAuth_options.set(this, void 0);
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_config, config, "f");
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_options, {
+            storage: options.storage,
+            signing: options.signing ?? defaultEIP6963SigningOptions,
+        }, "f");
+    }
+    async getAccessToken() {
+        const session = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_getAuthSession).call(this);
+        if (session) {
+            return session.token.accessToken;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_login).call(this);
+        return loginResponse.token.accessToken;
+    }
+    async getUserProfile() {
+        const session = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_getAuthSession).call(this);
+        if (session) {
+            return session.profile;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_login).call(this);
+        return loginResponse.profile;
+    }
+    async getIdentifier() {
+        return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing.getIdentifier();
+    }
+    async signMessage(message) {
+        return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing.signMessage(message);
+    }
+    async isSnapConnected() {
+        const provider = await getMetaMaskProviderEIP6963();
+        if (!provider) {
+            return false;
+        }
+        const isConnected = await isSnapConnected(provider);
+        return isConnected;
+    }
+    async connectSnap() {
+        const provider = await getDefaultEIP6963Provider();
+        const res = await connectSnap(provider);
+        return res;
+    }
+}
+_SRPJwtBearerAuth_config = new WeakMap(), _SRPJwtBearerAuth_options = new WeakMap(), _SRPJwtBearerAuth_instances = new WeakSet(), _SRPJwtBearerAuth_getAuthSession = 
+// convert expiresIn from seconds to milliseconds and use 90% of expiresIn
+async function _SRPJwtBearerAuth_getAuthSession() {
+    const auth = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.getLoginResponse();
+    if (!validateLoginResponse(auth)) {
+        return null;
+    }
+    const currentTime = Date.now();
+    const sessionAge = currentTime - auth.token.obtainedAt;
+    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;
+    if (sessionAge < refreshThreshold) {
+        return auth;
+    }
+    return null;
+}, _SRPJwtBearerAuth_login = async function _SRPJwtBearerAuth_login() {
+    // Nonce
+    const address = await this.getIdentifier();
+    const nonceRes = await getNonce(address, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+    const publicKey = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing.getIdentifier();
+    const rawMessage = __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_createSrpLoginRawMessage).call(this, nonceRes.nonce, publicKey);
+    const signature = await this.signMessage(rawMessage);
+    // Authenticate
+    const authResponse = await authenticate(rawMessage, signature, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").type, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+    // Authorize
+    const tokenResponse = await authorizeOIDC(authResponse.token, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").platform);
+    // Save
+    const result = {
+        profile: authResponse.profile,
+        token: tokenResponse,
+    };
+    await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.setLoginResponse(result);
+    return result;
+}, _SRPJwtBearerAuth_createSrpLoginRawMessage = function _SRPJwtBearerAuth_createSrpLoginRawMessage(nonce, publicKey) {
+    return `metamask:${nonce}:${publicKey}`;
 };
 //# sourceMappingURL=flow-srp.mjs.map

package/dist/sdk/authentication-jwt-bearer/flow-srp.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"flow-srp.mjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,sBAAkB;AAC5C,OAAO,EAAE,0BAA0B,EAAE,gDAA4C;AACjF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,qDAAiD;AAClD,OAAO,EAAE,qBAAqB,EAAE,6CAAyC;AACzE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,uBAAmB;AAkBnE,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;KAC3D;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAuB;IACvD,aAAa,EAAE,KAAK,IAAqB,EAAE;QACzC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC;QACnD,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,OAAe,EAAmB,EAAE;QACtD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE;YACpC,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;SAClE;QACD,MAAM,gBAAgB,GAAG,OAA+B,CAAC;QACzD,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC5E,CAAC;CACF,CAAC;AAEF,MAAM,OAAO,gBAAgB;IAK3B,YACE,MAA2C,EAC3C,OAAkC;;QANpC,2CAAoB;QAEpB,4CAA8C;QAM5C,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,4BAA4B;SACzD,MAAA,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,CAAkB,CAAC;QAC7C,IAAI,OAAO,EAAE;YACX,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;SAClC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,CAAS,CAAC;QAC1C,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,CAAkB,CAAC;QAC7C,IAAI,OAAO,EAAE;YACX,OAAO,OAAO,CAAC,OAAO,CAAC;SACxB;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,CAAS,CAAC;QAC1C,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE;YACb,OAAO,KAAK,CAAC;SACd;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CA8DF;;AA5DC,0EAA0E;AAC1E,KAAK;IACH,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC5D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAChC,OAAO,IAAI,CAAC;KACb;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE;QACjC,OAAO,IAAI,CAAC;KACb;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAErD,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CACjB,CAAC;IAEF,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAErD,OAAO,MAAM,CAAC;AAChB,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import { ValidationError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\nimport { authenticate, authorizeOIDC, getNonce } from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n} from './types';\n\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n};\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst defaultEIP6963SigningOptions: AuthSigningOptions = {\n  getIdentifier: async (): Promise<string> => {\n    const provider = await getDefaultEIP6963Provider();\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider);\n  },\n  signMessage: async (message: string): Promise<string> => {\n    const provider = await getDefaultEIP6963Provider();\n    if (!message.startsWith('metamask:')) {\n      throw new ValidationError('message must start with \"metamask:\"');\n    }\n    const formattedMessage = message as `metamask:${string}`;\n    return await MESSAGE_SIGNING_SNAP.signMessage(provider, formattedMessage);\n  },\n};\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  #config: AuthConfig;\n\n  #options: Required<JwtBearerAuth_SRP_Options>;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options,\n  ) {\n    this.#config = config;\n    this.#options = {\n      storage: options.storage,\n      signing: options.signing ?? defaultEIP6963SigningOptions,\n    };\n  }\n\n  async getAccessToken(): Promise<string> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(): Promise<string> {\n    return await this.#options.signing.getIdentifier();\n  }\n\n  async signMessage(message: string): Promise<string> {\n    return await this.#options.signing.signMessage(message);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider = await getMetaMaskProviderEIP6963();\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider = await getDefaultEIP6963Provider();\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse();\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(): Promise<LoginResponse> {\n    // Nonce\n    const address = await this.getIdentifier();\n    const nonceRes = await getNonce(address, this.#config.env);\n    const publicKey = await this.#options.signing.getIdentifier();\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result);\n\n    return result;\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/services.cjs

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticate = exports.authorizeOIDC = exports.getNonce = exports.pairIdentifiers = exports.SIWE_LOGIN_URL = exports.SRP_LOGIN_URL = exports.OIDC_TOKEN_URL = exports.PAIR_IDENTIFIERS = exports.NONCE_URL = void 0;
+const env_1 = require("../env.cjs");
+const errors_1 = require("../errors.cjs");
+const types_1 = require("./types.cjs");
+const NONCE_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/nonce`;
+exports.NONCE_URL = NONCE_URL;
+const PAIR_IDENTIFIERS = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/identifiers/pair`;
+exports.PAIR_IDENTIFIERS = PAIR_IDENTIFIERS;
+const OIDC_TOKEN_URL = (env) => `${(0, env_1.getEnvUrls)(env).oidcApiUrl}/oauth2/token`;
+exports.OIDC_TOKEN_URL = OIDC_TOKEN_URL;
+const SRP_LOGIN_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/srp/login`;
+exports.SRP_LOGIN_URL = SRP_LOGIN_URL;
+const SIWE_LOGIN_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/siwe/login`;
+exports.SIWE_LOGIN_URL = SIWE_LOGIN_URL;
+const getAuthenticationUrl = (authType, env) => {
+    switch (authType) {
+        case types_1.AuthType.SRP:
+            return (0, exports.SRP_LOGIN_URL)(env);
+        case types_1.AuthType.SiWE:
+            return (0, exports.SIWE_LOGIN_URL)(env);
+        /* istanbul ignore next */
+        default:
+            throw new errors_1.ValidationError(`Invalid AuthType: ${authType} - unable to create Auth URL`);
+    }
+};
+/**
+ * Pair multiple identifiers under a single profile
+ *
+ * @param nonce - session nonce
+ * @param logins - pairing request payload
+ * @param accessToken - JWT access token used to access protected resources
+ * @param env - server environment
+ * @returns void.
+ */
+async function pairIdentifiers(nonce, logins, accessToken, env) {
+    const pairUrl = new URL((0, exports.PAIR_IDENTIFIERS)(env));
+    try {
+        const response = await fetch(pairUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body: JSON.stringify({
+                nonce,
+                logins,
+            }),
+        });
+        if (!response.ok) {
+            const responseBody = (await response.json());
+            throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+        }
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new errors_1.PairError(`unable to pair identifiers: ${errorMessage}`);
+    }
+}
+exports.pairIdentifiers = pairIdentifiers;
+/**
+ * Service to Get Nonce for JWT Bearer Flow
+ *
+ * @param id - identifier ID
+ * @param env - server environment
+ * @returns the nonce.
+ */
+async function getNonce(id, env) {
+    const nonceUrl = new URL((0, exports.NONCE_URL)(env));
+    nonceUrl.searchParams.set('identifier', id);
+    try {
+        const nonceResponse = await fetch(nonceUrl.toString());
+        if (!nonceResponse.ok) {
+            const responseBody = (await nonceResponse.json());
+            throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+        }
+        const nonceJson = await nonceResponse.json();
+        return {
+            nonce: nonceJson.nonce,
+            identifier: nonceJson.identifier,
+            expiresIn: nonceJson.expires_in,
+        };
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new errors_1.NonceRetrievalError(`failed to generate nonce: ${errorMessage}`);
+    }
+}
+exports.getNonce = getNonce;
+/**
+ * Service to Authorize And perform OIDC Flow to get the Access Token
+ *
+ * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)
+ * @param env - server environment
+ * @param platform - SDK platform
+ * @returns Access Token from Authorization server
+ */
+async function authorizeOIDC(jwtToken, env, platform) {
+    const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+    const headers = new Headers({
+        'Content-Type': 'application/x-www-form-urlencoded',
+    });
+    const urlEncodedBody = new URLSearchParams();
+    urlEncodedBody.append('grant_type', grantType);
+    urlEncodedBody.append('client_id', (0, env_1.getOidcClientId)(env, platform));
+    urlEncodedBody.append('assertion', jwtToken);
+    try {
+        const response = await fetch((0, exports.OIDC_TOKEN_URL)(env), {
+            method: 'POST',
+            headers,
+            body: urlEncodedBody.toString(),
+        });
+        if (!response.ok) {
+            const responseBody = (await response.json());
+            throw new Error(`HTTP error: ${responseBody.error_description}, error code: ${responseBody.error}`);
+        }
+        const accessTokenResponse = await response.json();
+        return {
+            accessToken: accessTokenResponse.access_token,
+            expiresIn: accessTokenResponse.expires_in,
+            obtainedAt: Date.now(),
+        };
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new errors_1.SignInError(`unable to get access token: ${errorMessage}`);
+    }
+}
+exports.authorizeOIDC = authorizeOIDC;
+/**
+ * Service to Authenticate/Login a user via SIWE or SRP derived key.
+ *
+ * @param rawMessage - raw message for validation when authenticating
+ * @param signature - signed raw message
+ * @param authType - authentication type/flow used
+ * @param env - server environment
+ * @returns Authentication Token
+ */
+async function authenticate(rawMessage, signature, authType, env) {
+    const authenticationUrl = getAuthenticationUrl(authType, env);
+    try {
+        const response = await fetch(authenticationUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                signature,
+                // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                raw_message: rawMessage,
+            }),
+        });
+        if (!response.ok) {
+            const responseBody = (await response.json());
+            throw new Error(`${authType} login HTTP error: ${responseBody.message}, error code: ${responseBody.error}`);
+        }
+        const loginResponse = await response.json();
+        return {
+            token: loginResponse.token,
+            expiresIn: loginResponse.expires_in,
+            profile: {
+                identifierId: loginResponse.profile.identifier_id,
+                metaMetricsId: loginResponse.profile.metametrics_id,
+                profileId: loginResponse.profile.profile_id,
+            },
+        };
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new errors_1.SignInError(`unable to perform SRP login: ${errorMessage}`);
+    }
+}
+exports.authenticate = authenticate;
+//# sourceMappingURL=services.cjs.map

package/dist/sdk/authentication-jwt-bearer/services.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":";;;AACA,oCAAqD;AACrD,0CAKmB;AAEnB,uCAAmC;AAE5B,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAE,EAAE,CACpC,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,SAAS,aACyB;AAExC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAE,EAAE,CAC3C,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,0BAA0B,CAAC;AAD7C,QAAA,gBAAgB,oBAC6B;AAEnD,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CACzC,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,cAAc,kBACoB;AAExC,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAE,EAAE,CACxC,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,mBAAmB,CAAC;AADtC,QAAA,aAAa,iBACyB;AAE5C,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CACzC,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AADvC,QAAA,cAAc,kBACyB;AAEpD,MAAM,oBAAoB,GAAG,CAAC,QAAkB,EAAE,GAAQ,EAAU,EAAE;IACpE,QAAQ,QAAQ,EAAE;QAChB,KAAK,gBAAQ,CAAC,GAAG;YACf,OAAO,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,gBAAQ,CAAC,IAAI;YAChB,OAAO,IAAA,sBAAc,EAAC,GAAG,CAAC,CAAC;QAC7B,0BAA0B;QAC1B;YACE,MAAM,IAAI,wBAAe,CACvB,qBAAqB,QAAkB,8BAA8B,CACtE,CAAC;KACL;AACH,CAAC,CAAC;AAqBF;;;;;;;;GAQG;AACI,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,MAAqB,EACrB,WAAmB,EACnB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,wBAAgB,EAAC,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;SACH;KACF;IAAC,OAAO,CAAC,EAAE;QACV,0BAA0B;QAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,kBAAS,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC;KACpE;AACH,CAAC;AAjCD,0CAiCC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,GAAQ;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAA,iBAAS,EAAC,GAAG,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE5C,IAAI;QACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;YACrB,MAAM,YAAY,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAiB,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;SACH;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,SAAS,CAAC,UAAU;SAChC,CAAC;KACH;IAAC,OAAO,CAAC,EAAE;QACV,0BAA0B;QAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;KAC5E;AACH,CAAC;AAzBD,4BAyBC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,GAAQ,EACR,QAAkB;IAElB,MAAM,SAAS,GAAG,6CAA6C,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,cAAc,EAAE,mCAAmC;KACpD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,IAAA,qBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAA,sBAAc,EAAC,GAAG,CAAC,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAK1C,CAAC;YACF,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,CAAC,iBAAiB,iBAAiB,YAAY,CAAC,KAAK,EAAE,CACnF,CAAC;SACH;QAED,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,WAAW,EAAE,mBAAmB,CAAC,YAAY;YAC7C,SAAS,EAAE,mBAAmB,CAAC,UAAU;YACzC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;KACH;IAAC,OAAO,CAAC,EAAE;QACV,0BAA0B;QAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,oBAAW,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC;KACtE;AACH,CAAC;AA9CD,sCA8CC;AAOD;;;;;;;;GAQG;AACI,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,SAAiB,EACjB,QAAkB,EAClB,GAAQ;IAER,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9D,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,gFAAgF;gBAChF,gEAAgE;gBAChE,WAAW,EAAE,UAAU;aACxB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,sBAAsB,YAAY,CAAC,OAAO,iBAAiB,YAAY,CAAC,KAAK,EAAE,CAC3F,CAAC;SACH;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,SAAS,EAAE,aAAa,CAAC,UAAU;YACnC,OAAO,EAAE;gBACP,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa;gBACjD,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc;gBACnD,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;aAC5C;SACF,CAAC;KACH;IAAC,OAAO,CAAC,EAAE;QACV,0BAA0B;QAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,oBAAW,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAC;KACvE;AACH,CAAC;AA7CD,oCA6CC","sourcesContent":["import type { Env, Platform } from '../env';\nimport { getEnvUrls, getOidcClientId } from '../env';\nimport {\n  NonceRetrievalError,\n  PairError,\n  SignInError,\n  ValidationError,\n} from '../errors';\nimport type { AccessToken, ErrorMessage, UserProfile } from './types';\nimport { AuthType } from './types';\n\nexport const NONCE_URL = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/nonce`;\n\nexport const PAIR_IDENTIFIERS = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/identifiers/pair`;\n\nexport const OIDC_TOKEN_URL = (env: Env) =>\n  `${getEnvUrls(env).oidcApiUrl}/oauth2/token`;\n\nexport const SRP_LOGIN_URL = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;\n\nexport const SIWE_LOGIN_URL = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;\n\nconst getAuthenticationUrl = (authType: AuthType, env: Env): string => {\n  switch (authType) {\n    case AuthType.SRP:\n      return SRP_LOGIN_URL(env);\n    case AuthType.SiWE:\n      return SIWE_LOGIN_URL(env);\n    /* istanbul ignore next */\n    default:\n      throw new ValidationError(\n        `Invalid AuthType: ${authType as number} - unable to create Auth URL`,\n      );\n  }\n};\n\ntype NonceResponse = {\n  nonce: string;\n  identifier: string;\n  expiresIn: number;\n};\n\ntype PairRequest = {\n  signature: string;\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  raw_message: string;\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  encrypted_storage_key: string;\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  identifier_type: 'SIWE' | 'SRP';\n};\n\n/**\n * Pair multiple identifiers under a single profile\n *\n * @param nonce - session nonce\n * @param logins - pairing request payload\n * @param accessToken - JWT access token used to access protected resources\n * @param env - server environment\n * @returns void.\n */\nexport async function pairIdentifiers(\n  nonce: string,\n  logins: PairRequest[],\n  accessToken: string,\n  env: Env,\n): Promise<void> {\n  const pairUrl = new URL(PAIR_IDENTIFIERS(env));\n\n  try {\n    const response = await fetch(pairUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${accessToken}`,\n      },\n      body: JSON.stringify({\n        nonce,\n        logins,\n      }),\n    });\n\n    if (!response.ok) {\n      const responseBody = (await response.json()) as ErrorMessage;\n      throw new Error(\n        `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n      );\n    }\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new PairError(`unable to pair identifiers: ${errorMessage}`);\n  }\n}\n\n/**\n * Service to Get Nonce for JWT Bearer Flow\n *\n * @param id - identifier ID\n * @param env - server environment\n * @returns the nonce.\n */\nexport async function getNonce(id: string, env: Env): Promise<NonceResponse> {\n  const nonceUrl = new URL(NONCE_URL(env));\n  nonceUrl.searchParams.set('identifier', id);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      const responseBody = (await nonceResponse.json()) as ErrorMessage;\n      throw new Error(\n        `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n      );\n    }\n\n    const nonceJson = await nonceResponse.json();\n    return {\n      nonce: nonceJson.nonce,\n      identifier: nonceJson.identifier,\n      expiresIn: nonceJson.expires_in,\n    };\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new NonceRetrievalError(`failed to generate nonce: ${errorMessage}`);\n  }\n}\n\n/**\n * Service to Authorize And perform OIDC Flow to get the Access Token\n *\n * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)\n * @param env - server environment\n * @param platform - SDK platform\n * @returns Access Token from Authorization server\n */\nexport async function authorizeOIDC(\n  jwtToken: string,\n  env: Env,\n  platform: Platform,\n): Promise<AccessToken> {\n  const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n  const headers = new Headers({\n    'Content-Type': 'application/x-www-form-urlencoded',\n  });\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', grantType);\n  urlEncodedBody.append('client_id', getOidcClientId(env, platform));\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKEN_URL(env), {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      const responseBody = (await response.json()) as {\n        // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        error_description: string;\n        error: string;\n      };\n      throw new Error(\n        `HTTP error: ${responseBody.error_description}, error code: ${responseBody.error}`,\n      );\n    }\n\n    const accessTokenResponse = await response.json();\n    return {\n      accessToken: accessTokenResponse.access_token,\n      expiresIn: accessTokenResponse.expires_in,\n      obtainedAt: Date.now(),\n    };\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new SignInError(`unable to get access token: ${errorMessage}`);\n  }\n}\n\ntype Authentication = {\n  token: string;\n  expiresIn: number;\n  profile: UserProfile;\n};\n/**\n * Service to Authenticate/Login a user via SIWE or SRP derived key.\n *\n * @param rawMessage - raw message for validation when authenticating\n * @param signature - signed raw message\n * @param authType - authentication type/flow used\n * @param env - server environment\n * @returns Authentication Token\n */\nexport async function authenticate(\n  rawMessage: string,\n  signature: string,\n  authType: AuthType,\n  env: Env,\n): Promise<Authentication> {\n  const authenticationUrl = getAuthenticationUrl(authType, env);\n\n  try {\n    const response = await fetch(authenticationUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        signature,\n        // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        raw_message: rawMessage,\n      }),\n    });\n\n    if (!response.ok) {\n      const responseBody = (await response.json()) as ErrorMessage;\n      throw new Error(\n        `${authType} login HTTP error: ${responseBody.message}, error code: ${responseBody.error}`,\n      );\n    }\n\n    const loginResponse = await response.json();\n    return {\n      token: loginResponse.token,\n      expiresIn: loginResponse.expires_in,\n      profile: {\n        identifierId: loginResponse.profile.identifier_id,\n        metaMetricsId: loginResponse.profile.metametrics_id,\n        profileId: loginResponse.profile.profile_id,\n      },\n    };\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new SignInError(`unable to perform SRP login: ${errorMessage}`);\n  }\n}\n"]}

package/dist/{types/sdk/authentication-jwt-bearer/services.d.ts → sdk/authentication-jwt-bearer/services.d.cts}

@@ -1,6 +1,6 @@
-import type { Env, Platform } from '../env';
-import type { AccessToken, UserProfile } from './types';
-import { AuthType } from './types';
+import type { Env, Platform } from "../env.cjs";
+import type { AccessToken, UserProfile } from "./types.cjs";
+import { AuthType } from "./types.cjs";
 export declare const NONCE_URL: (env: Env) => string;
 export declare const PAIR_IDENTIFIERS: (env: Env) => string;
 export declare const OIDC_TOKEN_URL: (env: Env) => string;
@@ -60,4 +60,4 @@ type Authentication = {
  */
 export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env): Promise<Authentication>;
 export {};
-//# sourceMappingURL=services.d.ts.map
+//# sourceMappingURL=services.d.cts.map

package/dist/sdk/authentication-jwt-bearer/services.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,mBAAe;AAQ5C,OAAO,KAAK,EAAE,WAAW,EAAgB,WAAW,EAAE,oBAAgB;AACtE,OAAO,EAAE,QAAQ,EAAE,oBAAgB;AAEnC,eAAO,MAAM,SAAS,QAAS,GAAG,WACY,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,WACgB,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,WACO,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,WACY,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,WACY,CAAC;AAgBpD,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAGlB,WAAW,EAAE,MAAM,CAAC;IAGpB,qBAAqB,EAAE,MAAM,CAAC;IAG9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CA0CtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;CACtB,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,cAAc,CAAC,CAwCzB"}

package/dist/sdk/authentication-jwt-bearer/services.d.mts

@@ -0,0 +1,63 @@
+import type { Env, Platform } from "../env.mjs";
+import type { AccessToken, UserProfile } from "./types.mjs";
+import { AuthType } from "./types.mjs";
+export declare const NONCE_URL: (env: Env) => string;
+export declare const PAIR_IDENTIFIERS: (env: Env) => string;
+export declare const OIDC_TOKEN_URL: (env: Env) => string;
+export declare const SRP_LOGIN_URL: (env: Env) => string;
+export declare const SIWE_LOGIN_URL: (env: Env) => string;
+type NonceResponse = {
+    nonce: string;
+    identifier: string;
+    expiresIn: number;
+};
+type PairRequest = {
+    signature: string;
+    raw_message: string;
+    encrypted_storage_key: string;
+    identifier_type: 'SIWE' | 'SRP';
+};
+/**
+ * Pair multiple identifiers under a single profile
+ *
+ * @param nonce - session nonce
+ * @param logins - pairing request payload
+ * @param accessToken - JWT access token used to access protected resources
+ * @param env - server environment
+ * @returns void.
+ */
+export declare function pairIdentifiers(nonce: string, logins: PairRequest[], accessToken: string, env: Env): Promise<void>;
+/**
+ * Service to Get Nonce for JWT Bearer Flow
+ *
+ * @param id - identifier ID
+ * @param env - server environment
+ * @returns the nonce.
+ */
+export declare function getNonce(id: string, env: Env): Promise<NonceResponse>;
+/**
+ * Service to Authorize And perform OIDC Flow to get the Access Token
+ *
+ * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)
+ * @param env - server environment
+ * @param platform - SDK platform
+ * @returns Access Token from Authorization server
+ */
+export declare function authorizeOIDC(jwtToken: string, env: Env, platform: Platform): Promise<AccessToken>;
+type Authentication = {
+    token: string;
+    expiresIn: number;
+    profile: UserProfile;
+};
+/**
+ * Service to Authenticate/Login a user via SIWE or SRP derived key.
+ *
+ * @param rawMessage - raw message for validation when authenticating
+ * @param signature - signed raw message
+ * @param authType - authentication type/flow used
+ * @param env - server environment
+ * @returns Authentication Token
+ */
+export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env): Promise<Authentication>;
+export {};
+//# sourceMappingURL=services.d.mts.map

package/dist/sdk/authentication-jwt-bearer/services.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,mBAAe;AAQ5C,OAAO,KAAK,EAAE,WAAW,EAAgB,WAAW,EAAE,oBAAgB;AACtE,OAAO,EAAE,QAAQ,EAAE,oBAAgB;AAEnC,eAAO,MAAM,SAAS,QAAS,GAAG,WACY,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,WACgB,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,WACO,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,WACY,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,WACY,CAAC;AAgBpD,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAGlB,WAAW,EAAE,MAAM,CAAC;IAGpB,qBAAqB,EAAE,MAAM,CAAC;IAG9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CA0CtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;CACtB,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,cAAc,CAAC,CAwCzB"}

package/dist/sdk/authentication-jwt-bearer/services.mjs

@@ -1,27 +1,168 @@
-import {
-  NONCE_URL,
-  OIDC_TOKEN_URL,
-  PAIR_IDENTIFIERS,
-  SIWE_LOGIN_URL,
-  SRP_LOGIN_URL,
-  authenticate,
-  authorizeOIDC,
-  getNonce,
-  pairIdentifiers
-} from "../../chunk-YLURF2PF.mjs";
-import "../../chunk-CAIIVJAO.mjs";
-import "../../chunk-KTCSRECK.mjs";
-import "../../chunk-TFFQFIJV.mjs";
-import "../../chunk-U5UIDVOO.mjs";
-export {
-  NONCE_URL,
-  OIDC_TOKEN_URL,
-  PAIR_IDENTIFIERS,
-  SIWE_LOGIN_URL,
-  SRP_LOGIN_URL,
-  authenticate,
-  authorizeOIDC,
-  getNonce,
-  pairIdentifiers
+import { getEnvUrls, getOidcClientId } from "../env.mjs";
+import { NonceRetrievalError, PairError, SignInError, ValidationError } from "../errors.mjs";
+import { AuthType } from "./types.mjs";
+export const NONCE_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/nonce`;
+export const PAIR_IDENTIFIERS = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/identifiers/pair`;
+export const OIDC_TOKEN_URL = (env) => `${getEnvUrls(env).oidcApiUrl}/oauth2/token`;
+export const SRP_LOGIN_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;
+export const SIWE_LOGIN_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;
+const getAuthenticationUrl = (authType, env) => {
+    switch (authType) {
+        case AuthType.SRP:
+            return SRP_LOGIN_URL(env);
+        case AuthType.SiWE:
+            return SIWE_LOGIN_URL(env);
+        /* istanbul ignore next */
+        default:
+            throw new ValidationError(`Invalid AuthType: ${authType} - unable to create Auth URL`);
+    }
 };
+/**
+ * Pair multiple identifiers under a single profile
+ *
+ * @param nonce - session nonce
+ * @param logins - pairing request payload
+ * @param accessToken - JWT access token used to access protected resources
+ * @param env - server environment
+ * @returns void.
+ */
+export async function pairIdentifiers(nonce, logins, accessToken, env) {
+    const pairUrl = new URL(PAIR_IDENTIFIERS(env));
+    try {
+        const response = await fetch(pairUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body: JSON.stringify({
+                nonce,
+                logins,
+            }),
+        });
+        if (!response.ok) {
+            const responseBody = (await response.json());
+            throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+        }
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new PairError(`unable to pair identifiers: ${errorMessage}`);
+    }
+}
+/**
+ * Service to Get Nonce for JWT Bearer Flow
+ *
+ * @param id - identifier ID
+ * @param env - server environment
+ * @returns the nonce.
+ */
+export async function getNonce(id, env) {
+    const nonceUrl = new URL(NONCE_URL(env));
+    nonceUrl.searchParams.set('identifier', id);
+    try {
+        const nonceResponse = await fetch(nonceUrl.toString());
+        if (!nonceResponse.ok) {
+            const responseBody = (await nonceResponse.json());
+            throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+        }
+        const nonceJson = await nonceResponse.json();
+        return {
+            nonce: nonceJson.nonce,
+            identifier: nonceJson.identifier,
+            expiresIn: nonceJson.expires_in,
+        };
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new NonceRetrievalError(`failed to generate nonce: ${errorMessage}`);
+    }
+}
+/**
+ * Service to Authorize And perform OIDC Flow to get the Access Token
+ *
+ * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)
+ * @param env - server environment
+ * @param platform - SDK platform
+ * @returns Access Token from Authorization server
+ */
+export async function authorizeOIDC(jwtToken, env, platform) {
+    const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+    const headers = new Headers({
+        'Content-Type': 'application/x-www-form-urlencoded',
+    });
+    const urlEncodedBody = new URLSearchParams();
+    urlEncodedBody.append('grant_type', grantType);
+    urlEncodedBody.append('client_id', getOidcClientId(env, platform));
+    urlEncodedBody.append('assertion', jwtToken);
+    try {
+        const response = await fetch(OIDC_TOKEN_URL(env), {
+            method: 'POST',
+            headers,
+            body: urlEncodedBody.toString(),
+        });
+        if (!response.ok) {
+            const responseBody = (await response.json());
+            throw new Error(`HTTP error: ${responseBody.error_description}, error code: ${responseBody.error}`);
+        }
+        const accessTokenResponse = await response.json();
+        return {
+            accessToken: accessTokenResponse.access_token,
+            expiresIn: accessTokenResponse.expires_in,
+            obtainedAt: Date.now(),
+        };
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new SignInError(`unable to get access token: ${errorMessage}`);
+    }
+}
+/**
+ * Service to Authenticate/Login a user via SIWE or SRP derived key.
+ *
+ * @param rawMessage - raw message for validation when authenticating
+ * @param signature - signed raw message
+ * @param authType - authentication type/flow used
+ * @param env - server environment
+ * @returns Authentication Token
+ */
+export async function authenticate(rawMessage, signature, authType, env) {
+    const authenticationUrl = getAuthenticationUrl(authType, env);
+    try {
+        const response = await fetch(authenticationUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                signature,
+                // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                raw_message: rawMessage,
+            }),
+        });
+        if (!response.ok) {
+            const responseBody = (await response.json());
+            throw new Error(`${authType} login HTTP error: ${responseBody.message}, error code: ${responseBody.error}`);
+        }
+        const loginResponse = await response.json();
+        return {
+            token: loginResponse.token,
+            expiresIn: loginResponse.expires_in,
+            profile: {
+                identifierId: loginResponse.profile.identifier_id,
+                metaMetricsId: loginResponse.profile.metametrics_id,
+                profileId: loginResponse.profile.profile_id,
+            },
+        };
+    }
+    catch (e) {
+        /* istanbul ignore next */
+        const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+        throw new SignInError(`unable to perform SRP login: ${errorMessage}`);
+    }
+}
 //# sourceMappingURL=services.mjs.map