@novasamatech/host-papp 0.9.3 → 0.9.4

package/dist/sso/auth/impl.d.ts

@@ -76,5 +76,14 @@ export declare function createAuth({ hostMetadata, deviceIdentity, deviceIdentit
     };
     authenticate(): ResultAsync<StoredUserSession | null, Error>;
     abortAuthentication(): void;
+    /**
+     * Discard the persisted device keypair and the processed-handshake marker
+     * stored with it, so the next pairing runs on a new topic with a new key —
+     * which makes any cached on-chain HandshakeSuccess undecryptable.
+     *
+     * No-op for hosts supplying their own `deviceIdentity` factory, and a
+     * pairing already in flight keeps the old identity.
+     */
+    resetDeviceIdentity(): ResultAsync<void, Error>;
 };
 export {};

package/dist/sso/auth/impl.js

@@ -146,6 +146,17 @@ export function createAuth({ hostMetadata, deviceIdentity, deviceIdentityStore,
             authResult = null;
             pairingStatus.reset();
         },
+        /**
+         * Discard the persisted device keypair and the processed-handshake marker
+         * stored with it, so the next pairing runs on a new topic with a new key —
+         * which makes any cached on-chain HandshakeSuccess undecryptable.
+         *
+         * No-op for hosts supplying their own `deviceIdentity` factory, and a
+         * pairing already in flight keeps the old identity.
+         */
+        resetDeviceIdentity() {
+            return deviceIdentityStore.reset();
+        },
     };
     function persistAndNotify(identity, success, _flowId) {
         const localAccount = createLocalSessionAccount(createAccountId(identity.statementAccountPublicKey));

package/dist/sso/deviceIdentityStore.d.ts

@@ -9,6 +9,7 @@ export type DeviceIdentityStore = {
     loadOrCreate(): ResultAsync<DeviceIdentity, Error>;
     readLastProcessedHandshakeStatement(): ResultAsync<string | null, Error>;
     writeLastProcessedHandshakeStatement(hex: string): ResultAsync<void, Error>;
+    reset(): ResultAsync<void, Error>;
 };
 export declare function createDeviceIdentityStore(salt: string, storage: StorageAdapter): DeviceIdentityStore;
 export declare const awaitDeviceIdentity: (store: DeviceIdentityStore) => Promise<DeviceIdentity>;

package/dist/sso/deviceIdentityStore.js

@@ -66,6 +66,9 @@ export function createDeviceIdentityStore(salt, storage) {
                 return write({ ...existing, lastProcessedHandshakeStatement: hex });
             });
         },
+        reset() {
+            return storage.clear(KEY);
+        },
     };
 }
 // Re-export the awaitable form for convenience, since most call sites already

package/dist/sso/sessionManager/impl.d.ts

@@ -1,5 +1,6 @@
 import type { StatementStoreAdapter } from '@novasamatech/statement-store';
 import type { StorageAdapter } from '@novasamatech/storage-adapter';
+import { ResultAsync } from 'neverthrow';
 import type { IdentityRepository } from '../../identity/types.js';
 import type { Callback } from '../../types.js';
 import type { AllowanceRepository } from '../allowance/index.js';
@@ -20,7 +21,11 @@ export declare function createSsoSessionManager({ ssoSessionRepository, userSecr
         read: () => UserSession[];
         subscribe: (callback: Callback<UserSession[]>) => () => void;
     };
-    disconnect(userSession: StoredUserSession): import("neverthrow").ResultAsync<void, Error>;
+    disconnect(userSession: StoredUserSession): ResultAsync<undefined, Error>;
+    /**
+     * Teardown by id alone, without notifying the peer.
+     * */
+    forget(sessionId: string): ResultAsync<undefined, Error>;
     dispose(): void;
 };
 export {};

package/dist/sso/sessionManager/impl.js

@@ -1,9 +1,9 @@
 import { createEncryption } from '@novasamatech/statement-store';
-import { okAsync } from 'neverthrow';
+import { ResultAsync, okAsync } from 'neverthrow';
 import { emitHostPappDebugMessage } from '../../debugBus.js';
 import { createState } from '../../helpers/state.js';
 import { createSsoStatementProver } from '../ssoSessionProver.js';
-import { createUserSession } from './userSession.js';
+import { createUserSession, processedMessagesKey } from './userSession.js';
 export function createSsoSessionManager({ ssoSessionRepository, userSecretRepository, allowanceRepository, identityRepository, statementStore, storage, }) {
     const localSessions = createState({});
     const sessionUnsubscribes = new Map();
@@ -11,9 +11,16 @@ export function createSsoSessionManager({ ssoSessionRepository, userSecretReposi
         sessionUnsubscribes.get(id)?.();
         sessionUnsubscribes.delete(id);
     };
-    const disconnect = (session) => {
-        return ssoSessionRepository.filter(s => s.id !== session.id).map(() => undefined);
-    };
+    // The session-list write goes first: it is what notifies the subscription
+    // above to unsubscribe and dispose the live session.
+    const purgeSession = (sessionId) => ssoSessionRepository
+        .filter(s => s.id !== sessionId)
+        .andThen(() => ResultAsync.combine([
+        userSecretRepository.clear(sessionId),
+        allowanceRepository.clearSession(sessionId),
+        storage.clear(processedMessagesKey(sessionId)),
+    ]))
+        .map(() => undefined);
     ssoSessionRepository.subscribe(userSessions => {
         const activeSessions = localSessions.read();
         const toRemove = new Set(Object.keys(activeSessions));
@@ -36,7 +43,7 @@ export function createSsoSessionManager({ ssoSessionRepository, userSecretReposi
                     case 'v1': {
                         switch (message.data.value.tag) {
                             case 'Disconnected':
-                                return disconnect(userSession).map(() => true);
+                                return purgeSession(userSession.id).map(() => false);
                         }
                     }
                 }
@@ -76,9 +83,18 @@ export function createSsoSessionManager({ ssoSessionRepository, userSecretReposi
             const session = createSession(userSession, statementStore, storage, userSecretRepository, allowanceRepository, identityRepository);
             return session
                 .sendDisconnectMessage()
-                .andThen(() => disconnect(userSession))
-                .andThen(() => userSecretRepository.clear(userSession.id))
-                .andThen(() => allowanceRepository.clearSession(userSession.id));
+                .orElse(error => {
+                console.warn('[host-papp] disconnect: peer notification failed, tearing down locally anyway', error);
+                return okAsync(undefined);
+            })
+                .andTee(() => session.dispose())
+                .andThen(() => purgeSession(userSession.id));
+        },
+        /**
+         * Teardown by id alone, without notifying the peer.
+         * */
+        forget(sessionId) {
+            return purgeSession(sessionId);
         },
         dispose() {
             for (const session of Object.values(localSessions.read())) {

package/dist/sso/sessionManager/userSession.d.ts

@@ -12,6 +12,7 @@ import { RemoteMessageCodec } from './scale/remoteMessage.js';
 import type { ApAllocationOutcome, ResourceAllocationRequest } from './scale/resourceAllocation.js';
 import type { SignVrfRequest } from './scale/signVrf.js';
 import type { SignRawLegacyRequest, SigningPayloadRequest, SigningPayloadResponseData, SigningRawRequest } from './scale/signing.js';
+export declare const processedMessagesKey: (sessionId: string) => string;
 export type UserSession = StoredUserSession & {
     /** Read this session's persisted allowance slot-account key for a product/resource. */
     readAllowance(productId: string, resource: AllowanceResourceKind): ResultAsync<Uint8Array | null, Error>;

package/dist/sso/sessionManager/userSession.js

@@ -16,6 +16,8 @@ import { RemoteMessageCodec } from './scale/remoteMessage.js';
 const QUEUE_TASK_TIMEOUT_MS = 240_000;
 // Mobile SSO statements allow 500 KiB total; keep headroom for statement/session overhead.
 const MAX_SSO_REQUEST_SIZE = 498 * 1024;
+// Per-session dedup log of already-handled peer message ids.
+export const processedMessagesKey = (sessionId) => `sso_processed_${sessionId}`;
 function withQueueTimeout(resultAsync, label) {
     const timeoutPromise = new Promise(resolve => setTimeout(() => resolve(err(new Error(`${label} timed out — queue freed`))), QUEUE_TASK_TIMEOUT_MS));
     return ResultAsync.fromPromise(Promise.race([resultAsync, timeoutPromise]), toError).andThen(r => r);
@@ -106,7 +108,7 @@ export function createUserSession({ userSession, statementStore, encryption, sto
     });
     const processedMessages = fieldListView({
         storage,
-        key: `sso_processed_${userSession.id}`,
+        key: processedMessagesKey(userSession.id),
         from: JSON.parse,
         to: JSON.stringify,
     });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/host-papp",
   "type": "module",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Polkadot app integration",
   "license": "Apache-2.0",
   "repository": {
@@ -38,10 +38,10 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@novasamatech/host-api": "0.9.3",
-    "@novasamatech/scale": "0.9.3",
-    "@novasamatech/statement-store": "0.9.3",
-    "@novasamatech/storage-adapter": "0.9.3",
+    "@novasamatech/host-api": "0.9.4",
+    "@novasamatech/scale": "0.9.4",
+    "@novasamatech/statement-store": "0.9.4",
+    "@novasamatech/storage-adapter": "0.9.4",
     "@polkadot-api/utils": "^0.4.0",
     "@polkadot-labs/hdkd-helpers": "^0.0.31",
     "nanoevents": "10.0.0",