@muhkoo/connect 0.7.0-alpha.3 → 0.7.0-alpha.5

package/dist/connect.d.ts

@@ -2316,6 +2316,16 @@ declare class HostedAuth {
         redirectUri: string;
         redirect?: boolean;
     }): Promise<string>;
+    /**
+     * (App side) Send the user to centralized account & security management on
+     * the hosted page (auth.muhkoo.dev/security) — manage passkeys, recovery
+     * phrase, email, Google, change password, and remove login methods, all in
+     * one place. `returnUri` (default: the current URL) gives the hosted page a
+     * "Back to app" target. Redirects the browser; resolves to the URL.
+     */
+    manageAccount(opts?: {
+        returnUri?: string;
+    }): Promise<string>;
     /** Whether the current URL looks like a hosted-auth callback (has code + state). */
     isCallback(): boolean;
     /**
@@ -2685,6 +2695,8 @@ declare class HttpError extends Error {
 }
 declare class HttpClient {
     readonly baseUrl: string;
+    /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
+    private readonly baseOrigin;
     private readonly apiKey;
     private readonly getSessionToken;
     private readonly onUnauthorized;
@@ -2696,6 +2708,8 @@ declare class HttpClient {
      * up credentials without knowing about them.
      */
     readonly fetch: typeof fetch;
+    /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
+    private isSameOrigin;
     get<T = unknown>(path: string): Promise<T>;
     post<T = unknown>(path: string, body?: unknown): Promise<T>;
     patch<T = unknown>(path: string, body?: unknown): Promise<T>;

package/dist/server/index.js

@@ -1734,16 +1734,15 @@ class DoubleRatchetManager {
     }
     async registerZK(clientId, secret, salt, ecdsaPub) {
         await this._authenticator.initializeZK();
-        console.log(`Registering ZK for ${clientId}...`);
-        console.log('ECDSA Public Key:', ecdsaPub);
         const ecdsaJwk = await crypto.subtle.exportKey('jwk', ecdsaPub);
         const ecdsaHex = toHex(fromBase64Url(ecdsaJwk.x)).slice(0, 64);
         const ecdsaPubField = new Field(BigInt('0x' + ecdsaHex));
         const ecdsaPubHash = await Poseidon.hash([ecdsaPubField]);
         const commitment = await Poseidon.hash([secret, salt, ecdsaPubHash]);
-        console.log(`Commitment for ${clientId}:`, { commitment, salt });
         this.registeredUsers.set(clientId, { commitment, salt });
-        appLogger.debug(`Registered ${clientId}: commitment=${commitment.toString()}, salt=${salt.toString()}`);
+        // NB: never log `secret`, `salt`, or `commitment` — `salt` is a private
+        // witness for the ZK circuit and `commitment` is the user's stable id.
+        appLogger.debug(`Registered ZK identity for ${clientId}`);
     }
     async performHandshake(senderId, recipientId, zkProof, publicInput, clientPublicKey, // ECDH pub for session
     clientAuthPublicKey, // ECDSA pub for auth
@@ -2969,7 +2968,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.7.0-alpha.3";
+const VERSION = "0.7.0-alpha.4";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -3005,6 +3004,8 @@ class HttpError extends Error {
 }
 class HttpClient {
     baseUrl;
+    /** Origin of {@link baseUrl} — credentials are only attached same-origin. */
+    baseOrigin;
     apiKey;
     getSessionToken;
     onUnauthorized;
@@ -3013,6 +3014,12 @@ class HttpClient {
         if (!opts?.baseUrl)
             throw new Error("HttpClient: `baseUrl` is required");
         this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+        try {
+            this.baseOrigin = new URL(this.baseUrl).origin;
+        }
+        catch {
+            this.baseOrigin = "";
+        }
         this.apiKey = opts.apiKey ?? null;
         this.getSessionToken = opts.getSessionToken ?? (() => null);
         this.onUnauthorized = opts.onUnauthorized ?? null;
@@ -3029,13 +3036,34 @@ class HttpClient {
      */
     fetch = (input, init) => {
         const headers = new Headers(init?.headers);
-        if (this.apiKey)
-            headers.set("X-Muhkoo-Key", this.apiKey);
-        const token = this.getSessionToken();
-        if (token)
-            headers.set("X-Muhkoo-Session", token);
+        // Only attach credentials when the request stays on the accelerator's
+        // origin. An absolute URL pointing elsewhere (e.g. a caller-supplied or
+        // server-reflected path that escapes `baseUrl`) must NOT receive the app
+        // key or session token, or it becomes a token-exfiltration vector.
+        if (this.isSameOrigin(input)) {
+            if (this.apiKey)
+                headers.set("X-Muhkoo-Key", this.apiKey);
+            const token = this.getSessionToken();
+            if (token)
+                headers.set("X-Muhkoo-Session", token);
+        }
         return this.fetchFn(input, { ...init, headers });
     };
+    /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
+    isSameOrigin(input) {
+        try {
+            const urlStr = typeof input === "string" ? input
+                : input instanceof URL ? input.href
+                    : input.url;
+            // Relative URLs are resolved against baseUrl downstream → same origin.
+            if (!/^https?:\/\//i.test(urlStr))
+                return true;
+            return new URL(urlStr).origin === this.baseOrigin;
+        }
+        catch {
+            return true;
+        }
+    }
     // -------------------------------------------------------------------------
     // JSON convenience helpers (path is relative to baseUrl)
     // -------------------------------------------------------------------------
@@ -3529,6 +3557,19 @@ class HostedAuth {
             this.location().assign(url);
         return url;
     }
+    /**
+     * (App side) Send the user to centralized account & security management on
+     * the hosted page (auth.muhkoo.dev/security) — manage passkeys, recovery
+     * phrase, email, Google, change password, and remove login methods, all in
+     * one place. `returnUri` (default: the current URL) gives the hosted page a
+     * "Back to app" target. Redirects the browser; resolves to the URL.
+     */
+    async manageAccount(opts = {}) {
+        const ret = opts.returnUri ?? this.location().href;
+        const url = `${this.deps.authBaseUrl}/security?` + new URLSearchParams({ return: ret }).toString();
+        this.location().assign(url);
+        return url;
+    }
     /** Whether the current URL looks like a hosted-auth callback (has code + state). */
     isCallback() {
         try {