@pafi-dev/issuer 0.29.0 → 0.31.0

package/dist/index.cjs

@@ -2332,6 +2332,7 @@ var PTRedeemHandler = class {
   chainId;
   domainResolver;
   burnerSignerWallet;
+  supportedTokens;
   redeemLockDurationMs;
   signatureDeadlineSeconds;
   now;
@@ -2371,6 +2372,13 @@ var PTRedeemHandler = class {
     this.chainId = config.chainId;
     this.domainResolver = config.domainResolver;
     this.burnerSignerWallet = config.burnerSignerWallet;
+    if (!config.supportedTokens) {
+      throw new PTRedeemError(
+        "UNSUPPORTED_POINT_TOKEN",
+        "PTRedeemHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+      );
+    }
+    this.supportedTokens = config.supportedTokens;
     if (this.burnerSignerWallet?.account?.type === "local") {
       console.warn("[PAFI] PTRedeemHandler: burnerSignerWallet uses a local (private key) account. Use a KMS-backed signer in production.");
     }
@@ -2399,6 +2407,12 @@ var PTRedeemHandler = class {
       throw new PTRedeemError("INVALID_AMOUNT", "redeem amount must be positive");
     }
     const pointTokenAddress = (0, import_viem8.getAddress)(request.pointTokenAddress);
+    if (!this.supportedTokens.has(pointTokenAddress)) {
+      throw new PTRedeemError(
+        "UNSUPPORTED_POINT_TOKEN",
+        `redeem: pointTokenAddress ${pointTokenAddress} is not in the issuer's supported-token allowlist. Check IssuerApiHandlers.supportedTokens and PTRedeemHandler.config.supportedTokens point at the same set.`
+      );
+    }
     if (this.redemptionService) {
       const decision = await this.redemptionService.evaluate(
         request.userAddress,
@@ -2889,7 +2903,10 @@ async function prepareMobileUserOp(params) {
       callGasLimit: fallback.userOp.callGasLimit.toString(),
       verificationGasLimit: fallback.userOp.verificationGasLimit.toString(),
       preVerificationGas: fallback.userOp.preVerificationGas.toString(),
-      userOpHash: fallback.userOpHash
+      userOpHash: fallback.userOpHash,
+      // Audit PACI5-21 — carry the fallback-specific lockId so submit
+      // can bind the fallback userOpHash to the correct ledger row.
+      lockId: params.lockIdFallback
     };
   }
   const entry = {
@@ -3082,6 +3099,7 @@ async function handleMobilePrepare(params) {
     lockId: params.lockId,
     partialUserOp: sponsoredOp,
     partialUserOpFallback: params.partialUserOpFallback,
+    lockIdFallback: params.lockIdFallback,
     paymasterFields,
     chainId: params.chainId,
     store: params.store,
@@ -3110,7 +3128,8 @@ async function handleMobileSubmit(params) {
     entryPoint: params.entryPoint ?? import_core10.ENTRY_POINT_V08,
     eip7702Auth: entry.eip7702Auth
   });
-  await params.bindUserOpHash(params.lockId, result.userOpHash);
+  const targetLockId = variant === "fallback" && entry.fallback?.lockId ? entry.fallback.lockId : params.lockId;
+  await params.bindUserOpHash(targetLockId, result.userOpHash);
   await params.store.delete(params.lockId);
   return { userOpHash: result.userOpHash };
 }
@@ -3156,6 +3175,12 @@ var PTClaimHandler = class {
   cfg;
   inFlightNonces = /* @__PURE__ */ new Map();
   constructor(config) {
+    if (!config.supportedTokens) {
+      throw new PTClaimError(
+        "UNSUPPORTED_POINT_TOKEN",
+        "PTClaimHandler requires `supportedTokens` (issuer's allow-listed PointToken contracts). See audit PACI5-18."
+      );
+    }
     const lockDurationMs = config.lockDurationMs ?? DEFAULT_LOCK_MS;
     const signatureDeadlineSeconds = config.signatureDeadlineSeconds ?? DEFAULT_SIG_DEADLINE_SEC2;
     const maxAllowedSignatureMs = lockDurationMs - M11_SAFETY_MARGIN_MS2;
@@ -3187,6 +3212,14 @@ var PTClaimHandler = class {
     if (request.amount <= 0n) {
       throw new PTClaimError("INVALID_AMOUNT", "claim amount must be positive");
     }
+    const pointTokenAddress = (0, import_viem10.getAddress)(request.pointTokenAddress);
+    if (!this.cfg.supportedTokens.has(pointTokenAddress)) {
+      throw new PTClaimError(
+        "UNSUPPORTED_POINT_TOKEN",
+        `claim: pointTokenAddress ${pointTokenAddress} is not in the issuer's supported-token allowlist. Check IssuerApiHandlers.supportedTokens and PTClaimHandler.config.supportedTokens point at the same set.`,
+        { requested: pointTokenAddress }
+      );
+    }
     if (this.cfg.issuerStateValidator) {
       try {
         await this.cfg.issuerStateValidator.preValidateMint(
@@ -3838,10 +3871,16 @@ var IssuerApiAdapter = class {
       "burn",
       pointTokenAddress,
       redeemResponse.expiresInSeconds,
-      input.eip7702Auth
+      input.eip7702Auth,
+      // Audit PACI5-21 — fallback path reserves a separate
+      // PendingCredit row for the full `amount`. Surface its lockId so
+      // mobile FE can poll the correct row + `handleMobileSubmit`
+      // routes the userOpHash bind to it on fallback submit.
+      redeemResponse.fallback?.lockId
     );
     return {
       lockId: redeemResponse.lockId,
+      lockIdFallback: redeemResponse.fallback?.lockId,
       userOpHash: prepared.sponsored.userOpHash,
       typedData: prepared.sponsored.typedData,
       userOpHashFallback: prepared.fallback?.userOpHash,
@@ -3972,13 +4011,14 @@ var IssuerApiAdapter = class {
       issuerSignerWallet: this.cfg.issuerSignerWallet
     });
   }
-  async runMobilePrepare(authenticatedAddress, chainId, lockId, partialUserOp, partialUserOpFallback, scenario, pointTokenAddress, ttlSeconds, eip7702Auth) {
+  async runMobilePrepare(authenticatedAddress, chainId, lockId, partialUserOp, partialUserOpFallback, scenario, pointTokenAddress, ttlSeconds, eip7702Auth, lockIdFallback) {
     return await handleMobilePrepare({
       userAddress: authenticatedAddress,
       chainId,
       lockId,
       partialUserOp,
       partialUserOpFallback,
+      lockIdFallback,
       scenario,
       pointTokenAddress,
       ttlSeconds,
@@ -5243,7 +5283,7 @@ var MemoryRedemptionHistoryStore = class {
 };
 
 // src/index.ts
-var PAFI_ISSUER_SDK_VERSION = true ? "0.28.1" : "dev";
+var PAFI_ISSUER_SDK_VERSION = true ? "0.31.0" : "dev";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AdapterMisconfiguredError,