@opendatalabs/personal-server-ts-server 1.10.2 → 1.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api-auth.d.ts.map +1 -1
- package/dist/api-auth.js +22 -62
- package/dist/api-auth.js.map +1 -1
- package/dist/routes/write-session.d.ts +4 -0
- package/dist/routes/write-session.d.ts.map +1 -1
- package/dist/routes/write-session.js +17 -91
- package/dist/routes/write-session.js.map +1 -1
- package/dist/ui/ps-lite-debug.js +4923 -4441
- package/package.json +3 -3
package/dist/api-auth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,
|
|
1
|
+
{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAMrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AA6CD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CAiI3B"}
|
package/dist/api-auth.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { authenticateRequest, } from "@opendatalabs/personal-server-ts-core/auth";
|
|
2
|
-
import { verifyDataReadPolicy
|
|
3
|
-
import { createInMemoryWriteProofReplayStore,
|
|
2
|
+
import { verifyDataReadPolicy } from "@opendatalabs/personal-server-ts-core/policy";
|
|
3
|
+
import { createInMemoryWriteProofReplayStore, createWriteSessionAuthorization, } from "@opendatalabs/personal-server-ts-core/write";
|
|
4
4
|
import { NotOwnerError, ProtocolError, UnregisteredBuilderError, } from "@opendatalabs/personal-server-ts-core/errors";
|
|
5
5
|
function serverNotConfigured() {
|
|
6
6
|
return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
|
|
@@ -27,14 +27,24 @@ async function assertRegisteredBuilder(gateway, signer) {
|
|
|
27
27
|
return;
|
|
28
28
|
throw new UnregisteredBuilderError();
|
|
29
29
|
}
|
|
30
|
-
function bearerToken(request) {
|
|
31
|
-
const header = request.headers.get("authorization");
|
|
32
|
-
if (!header?.startsWith("Bearer "))
|
|
33
|
-
return null;
|
|
34
|
-
return header.slice(7);
|
|
35
|
-
}
|
|
36
30
|
export function createServerApiAuth(deps) {
|
|
37
31
|
const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
|
|
32
|
+
// The write-session half of this port is protocol, not runtime: the browser
|
|
33
|
+
// build's adapters call the same factory, so a delegated write is checked
|
|
34
|
+
// identically wherever the Personal Server runs.
|
|
35
|
+
const writeSessions = createWriteSessionAuthorization({
|
|
36
|
+
serverOrigin: deps.serverOrigin,
|
|
37
|
+
serverOwner: deps.serverOwner,
|
|
38
|
+
sessionStore: deps.writeSessionStore,
|
|
39
|
+
replayStore: writeProofReplayStore,
|
|
40
|
+
policyPorts: {
|
|
41
|
+
authSessionVerifier: deps.gateway,
|
|
42
|
+
grantVerifier: deps.gateway,
|
|
43
|
+
runtimeAvailability: deps.runtimeAvailability,
|
|
44
|
+
// Fee seam intentionally not wired: builder writes are free in the
|
|
45
|
+
// demo slice (write fee mechanics undecided).
|
|
46
|
+
},
|
|
47
|
+
});
|
|
38
48
|
async function authorizeOwner(request) {
|
|
39
49
|
const result = await authenticate(request, deps);
|
|
40
50
|
if (result.isPolicyBypass)
|
|
@@ -58,42 +68,9 @@ export function createServerApiAuth(deps) {
|
|
|
58
68
|
* unknown bearer) falls through to the owner path unchanged.
|
|
59
69
|
*/
|
|
60
70
|
async function authorizeWrite(input) {
|
|
61
|
-
const
|
|
62
|
-
if (
|
|
63
|
-
|
|
64
|
-
if (session) {
|
|
65
|
-
if (!deps.serverOwner)
|
|
66
|
-
throw serverNotConfigured();
|
|
67
|
-
const grant = await verifyDataWritePolicy({
|
|
68
|
-
signer: session.builderAddress,
|
|
69
|
-
grantId: session.grantId,
|
|
70
|
-
requestedScope: input.scope,
|
|
71
|
-
serverOwner: deps.serverOwner,
|
|
72
|
-
}, {
|
|
73
|
-
authSessionVerifier: deps.gateway,
|
|
74
|
-
grantVerifier: deps.gateway,
|
|
75
|
-
runtimeAvailability: deps.runtimeAvailability,
|
|
76
|
-
// Fee seam intentionally not wired: builder writes are free in
|
|
77
|
-
// the demo slice (write fee mechanics undecided).
|
|
78
|
-
});
|
|
79
|
-
// releaseProof is a rollback hook for the handler, never part of the
|
|
80
|
-
// stored attribution record.
|
|
81
|
-
const { releaseProof, ...attribution } = await verifyWriterAttribution({
|
|
82
|
-
request: input.request,
|
|
83
|
-
builderAddress: session.builderAddress,
|
|
84
|
-
grantId: grant.id,
|
|
85
|
-
serverOrigin: deps.serverOrigin,
|
|
86
|
-
replayStore: writeProofReplayStore,
|
|
87
|
-
});
|
|
88
|
-
return {
|
|
89
|
-
builder: session.builderAddress,
|
|
90
|
-
grantId: grant.id,
|
|
91
|
-
grantScopes: grant.scopes ?? [],
|
|
92
|
-
attribution,
|
|
93
|
-
releaseProof,
|
|
94
|
-
};
|
|
95
|
-
}
|
|
96
|
-
}
|
|
71
|
+
const delegated = await writeSessions.authorizeSessionWrite(input);
|
|
72
|
+
if (delegated)
|
|
73
|
+
return delegated;
|
|
97
74
|
await authorizeOwner(input.request);
|
|
98
75
|
}
|
|
99
76
|
/**
|
|
@@ -105,24 +82,7 @@ export function createServerApiAuth(deps) {
|
|
|
105
82
|
* 401 discloses nothing. Returns undefined for any other credential.
|
|
106
83
|
*/
|
|
107
84
|
async function authorizeWriteSession(request) {
|
|
108
|
-
|
|
109
|
-
if (!token || !deps.writeSessionStore)
|
|
110
|
-
return;
|
|
111
|
-
const session = await deps.writeSessionStore.getByTokenHash(await hashWriteSessionToken(token));
|
|
112
|
-
if (!session)
|
|
113
|
-
return;
|
|
114
|
-
const { releaseProof } = await verifyWriterAttribution({
|
|
115
|
-
request,
|
|
116
|
-
builderAddress: session.builderAddress,
|
|
117
|
-
grantId: session.grantId,
|
|
118
|
-
serverOrigin: deps.serverOrigin,
|
|
119
|
-
replayStore: writeProofReplayStore,
|
|
120
|
-
});
|
|
121
|
-
return {
|
|
122
|
-
builder: session.builderAddress,
|
|
123
|
-
grantId: session.grantId,
|
|
124
|
-
releaseProof,
|
|
125
|
-
};
|
|
85
|
+
return writeSessions.recognizeWriteSession(request);
|
|
126
86
|
}
|
|
127
87
|
return {
|
|
128
88
|
authorizeOwner,
|
package/dist/api-auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;
|
|
1
|
+
{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAgCtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,+BAA+B;IAC/B,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO;IACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,iBAAiB;QACpC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,mEAAmE;YACnE,8CAA8C;SAC/C;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAAC,KAAmC;QAC/D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAgB;QACnD,OAAO,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,qBAAqB;QAErB,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -7,6 +7,10 @@
|
|
|
7
7
|
* the EXISTING ingest endpoint (POST /v1/data/:scope) — see api-auth.ts
|
|
8
8
|
* authorizeWrite. The PS keeps signing AddData as the owner; the builder
|
|
9
9
|
* never holds the owner key.
|
|
10
|
+
*
|
|
11
|
+
* The handshake itself is runtime-agnostic and lives in core
|
|
12
|
+
* (write/route.ts), so the browser build mounts the identical logic. This file
|
|
13
|
+
* is only the Hono mounting and this build's dependency wiring.
|
|
10
14
|
*/
|
|
11
15
|
import { Hono } from "hono";
|
|
12
16
|
import type { Logger } from "pino";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"write-session.d.ts","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"write-session.d.ts","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAqBpE"}
|
|
@@ -7,102 +7,28 @@
|
|
|
7
7
|
* the EXISTING ingest endpoint (POST /v1/data/:scope) — see api-auth.ts
|
|
8
8
|
* authorizeWrite. The PS keeps signing AddData as the owner; the builder
|
|
9
9
|
* never holds the owner key.
|
|
10
|
+
*
|
|
11
|
+
* The handshake itself is runtime-agnostic and lives in core
|
|
12
|
+
* (write/route.ts), so the browser build mounts the identical logic. This file
|
|
13
|
+
* is only the Hono mounting and this build's dependency wiring.
|
|
10
14
|
*/
|
|
11
|
-
import { createHash, randomBytes } from "node:crypto";
|
|
12
15
|
import { Hono } from "hono";
|
|
13
|
-
import {
|
|
14
|
-
import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
|
|
15
|
-
import { createInMemoryWriteProofReplayStore, createWriteSession, } from "@opendatalabs/personal-server-ts-core/write";
|
|
16
|
-
function jsonError(status, errorCode, message) {
|
|
17
|
-
return {
|
|
18
|
-
error: { code: status, errorCode, message },
|
|
19
|
-
};
|
|
20
|
-
}
|
|
21
|
-
/**
|
|
22
|
-
* Only ProtocolErrors are client-facing. Anything else (gateway, store,
|
|
23
|
-
* runtime failures) is logged with its cause and answered generically so
|
|
24
|
-
* internal details never reach the caller. Same mapping as the core data
|
|
25
|
-
* handler.
|
|
26
|
-
*/
|
|
27
|
-
function internalError(logger, err, stage) {
|
|
28
|
-
logger.error({ err, stage }, "Write session handshake failed with an unexpected error");
|
|
29
|
-
return jsonError(500, "INTERNAL_ERROR", "Internal server error");
|
|
30
|
-
}
|
|
16
|
+
import { createInMemoryWriteProofReplayStore, handleWriteSessionRequest, } from "@opendatalabs/personal-server-ts-core/write";
|
|
31
17
|
export function writeSessionRoutes(deps) {
|
|
32
18
|
const app = new Hono();
|
|
33
19
|
const proofReplayStore = deps.proofReplayStore ?? createInMemoryWriteProofReplayStore();
|
|
34
|
-
app.post("/session",
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
accessToken: deps.accessToken,
|
|
47
|
-
sessionTokenVerifier: deps.tokenStore,
|
|
48
|
-
serverOwner: deps.serverOwner,
|
|
49
|
-
});
|
|
50
|
-
}
|
|
51
|
-
catch (err) {
|
|
52
|
-
if (!(err instanceof ProtocolError)) {
|
|
53
|
-
return c.json(internalError(deps.logger, err, "authenticate"), 500);
|
|
54
|
-
}
|
|
55
|
-
return c.json(jsonError(401, "WRITE_SESSION_AUTH_FAILED", err.message), 401);
|
|
56
|
-
}
|
|
57
|
-
if (authResult.mechanism !== "web3-signed") {
|
|
58
|
-
return c.json(jsonError(401, "WRITE_SESSION_PROOF_REQUIRED", "POST /v1/write/session requires a Web3Signed proof signed by the builder key"), 401);
|
|
59
|
-
}
|
|
60
|
-
const grantId = authResult.auth.payload.grantId;
|
|
61
|
-
if (!grantId) {
|
|
62
|
-
return c.json(jsonError(400, "GRANT_ID_REQUIRED", "The Web3Signed proof must carry a grantId (the write-grant issued to the builder)"), 400);
|
|
63
|
-
}
|
|
64
|
-
// Replay guard: bind to a digest of the exact proof header, remembered
|
|
65
|
-
// until the proof's own expiry (a replay only matters while still valid).
|
|
66
|
-
const proofHeader = c.req.raw.headers.get("authorization") ?? "";
|
|
67
|
-
const proofId = createHash("sha256").update(proofHeader).digest("hex");
|
|
68
|
-
const expSec = authResult.auth.payload.exp;
|
|
69
|
-
const expiresAtMs = (typeof expSec === "number"
|
|
70
|
-
? expSec
|
|
71
|
-
: Math.floor(Date.now() / 1000) + 300) * 1000;
|
|
72
|
-
try {
|
|
73
|
-
const session = await createWriteSession({
|
|
74
|
-
builderAddress: authResult.auth.signer,
|
|
75
|
-
grantId,
|
|
76
|
-
proof: { id: proofId, expiresAtMs },
|
|
77
|
-
}, {
|
|
78
|
-
store: deps.sessionStore,
|
|
79
|
-
authSessionVerifier: deps.gateway,
|
|
80
|
-
grantVerifier: deps.gateway,
|
|
81
|
-
serverOwner: deps.serverOwner,
|
|
82
|
-
randomToken: () => `vana_write_${randomBytes(32).toString("hex")}`,
|
|
83
|
-
replayStore: proofReplayStore,
|
|
84
|
-
});
|
|
85
|
-
deps.logger.info({
|
|
86
|
-
builder: authResult.auth.signer,
|
|
87
|
-
grantId: session.grantId,
|
|
88
|
-
writeScopes: session.writeScopes,
|
|
89
|
-
}, "Write session minted");
|
|
90
|
-
return c.json({
|
|
91
|
-
access_token: session.accessToken,
|
|
92
|
-
token_type: "Bearer",
|
|
93
|
-
expires_in: session.expiresInSeconds,
|
|
94
|
-
// Write patterns, prefix stripped — what POST /v1/data/:scope will
|
|
95
|
-
// accept under this token.
|
|
96
|
-
scope: session.writeScopes.join(" "),
|
|
97
|
-
});
|
|
98
|
-
}
|
|
99
|
-
catch (err) {
|
|
100
|
-
if (err instanceof ProtocolError) {
|
|
101
|
-
return c.json(err.toJSON(), err.code);
|
|
102
|
-
}
|
|
103
|
-
return c.json(internalError(deps.logger, err, "create-session"), 500);
|
|
104
|
-
}
|
|
105
|
-
});
|
|
20
|
+
app.post("/session", (c) => handleWriteSessionRequest(c.req.raw, {
|
|
21
|
+
serverOrigin: deps.serverOrigin,
|
|
22
|
+
serverOwner: deps.serverOwner,
|
|
23
|
+
sessionStore: deps.sessionStore,
|
|
24
|
+
replayStore: proofReplayStore,
|
|
25
|
+
authSessionVerifier: deps.gateway,
|
|
26
|
+
grantVerifier: deps.gateway,
|
|
27
|
+
devToken: deps.devToken,
|
|
28
|
+
accessToken: deps.accessToken,
|
|
29
|
+
tokenStore: deps.tokenStore,
|
|
30
|
+
logger: deps.logger,
|
|
31
|
+
}));
|
|
106
32
|
return app;
|
|
107
33
|
}
|
|
108
34
|
//# sourceMappingURL=write-session.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"write-session.js","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"write-session.js","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EACL,mCAAmC,EACnC,yBAAyB,GAG1B,MAAM,6CAA6C,CAAC;AAoBrD,MAAM,UAAU,kBAAkB,CAAC,IAA2B;IAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,gBAAgB,GACpB,IAAI,CAAC,gBAAgB,IAAI,mCAAmC,EAAE,CAAC;IAEjE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CACzB,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QACnC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,gBAAgB;QAC7B,mBAAmB,EAAE,IAAI,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,OAAO;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CACH,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}
|