@nerdsystem/sdk 0.0.7 → 0.0.8

package/dist/auth/client.d.ts

@@ -28,6 +28,9 @@ export declare class AuthServiceClient {
     /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
     clientIp?: string | undefined);
     get jwksUrl(): string;
+    private signature?;
+    /** HMAC of the visitor address keyed by SHA-256(tenant secret), which is what the platform stores; an unsigned address is ignored there. */
+    private signVisitor;
     private call;
     signup(input: {
         email: string;

package/dist/auth/client.js

@@ -28,13 +28,26 @@ export class AuthServiceClient {
     get jwksUrl() {
         return `${this.env.NERD_AUTH_URL.replace(/\/$/, "")}/.well-known/jwks.json`;
     }
+    signature;
+    /** HMAC of the visitor address keyed by SHA-256(tenant secret), which is what the platform stores; an unsigned address is ignored there. */
+    signVisitor(ip) {
+        this.signature ??= (async () => {
+            const enc = new TextEncoder();
+            const digest = await crypto.subtle.digest("SHA-256", enc.encode(this.env.NERD_AUTH_SECRET));
+            const keyHex = Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+            const key = await crypto.subtle.importKey("raw", enc.encode(keyHex), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+            return Array.from(new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(ip))), (b) => b.toString(16).padStart(2, "0")).join("");
+        })();
+        return this.signature;
+    }
     async call(method, path, body, auth) {
+        const visitor = this.clientIp && this.env.NERD_AUTH_SECRET ? { "x-nerd-client-ip": this.clientIp, "x-nerd-client-sig": await this.signVisitor(this.clientIp) } : {};
         const res = await this.fetchImpl(`${this.base}${path}`, {
             method,
             headers: {
                 ...(body !== undefined ? { "content-type": "application/json" } : {}),
                 ...(auth ? { authorization: `Bearer ${auth}` } : {}),
-                ...(this.clientIp ? { "x-nerd-client-ip": this.clientIp } : {}),
+                ...visitor,
             },
             body: body !== undefined ? JSON.stringify(body) : null,
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nerdsystem/sdk",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "description": "Runtime for apps deployed on nerdsystem: auth, authorization, and platform bindings.",
   "type": "module",
   "main": "./dist/index.js",