@partylayer/adapter-bron 0.6.0 → 0.7.0

package/README.md

@@ -42,12 +42,55 @@ npm install @partylayer/adapter-bron
 ## Usage with SDK
 
 ```typescript
-import { createPartyLayer } from '@partylayer/sdk';
+import { createPartyLayer, type BronAdapterConfig } from '@partylayer/sdk';
+
+// Supply the OAuth endpoints, public client ID, registered redirect URI and
+// signer API URL issued for your application by Bron.
+export function createBronClient(bron: BronAdapterConfig) {
+  return createPartyLayer({
+    network: 'devnet',
+    app: { name: 'My Canton dApp' },
+    bron,
+  });
+}
+```
+
+Bron requires application-owned OAuth and signer API configuration. Without
+`bron` configuration, Bron is omitted from the wallet picker. After constructing
+the client with your approved configuration, find Bron in `await client.listWallets()`
+and pass that entry's `walletId` to `client.connect()` from a user action in the browser.
+
+Use PKCE for browser flows and never expose a client secret in frontend code.
+Register the callback URL with Bron and follow their onboarding instructions;
+this package does not provision a Bron account or credentials.
+
+### Registered callback page
 
-const client = createPartyLayer({ network: 'devnet' });
-await client.connect({ walletId: 'bron' });
+For the explicitly configured legacy OAuth contract, the application's registered
+same-origin redirect page relays the authorization response to the popup opener:
+
+```ts
+import { completeBronAuthorization } from '@partylayer/sdk';
+
+await completeBronAuthorization('https://your-app.example/oauth/bron/callback');
 ```
 
+Use the exact registered URL. Load this helper only on that dedicated callback
+page; avoid analytics and other third-party scripts there. The opener verifies
+the popup source, origin, redirect path, single-use state and S256 PKCE, then
+exchanges the code. Browser client secrets and non-PKCE browser configuration are
+rejected. Authorization is bounded, tokens remain in memory, and disconnect
+invalidates pending authorization. No new PartyLayer wallet package is required.
+
+This compatibility configuration requires a vendor-approved OAuth/signer API
+contract. Bron's current [public API authentication documentation](https://developer.bron.org/api-reference/authentication)
+describes signed API-key JWTs; it does not establish a universal per-dApp OAuth
+client or a delegated submission right on an application's participant. Do not
+put those API private keys in browser configuration or infer a submission route
+from a message-signing capability. The callback helper fixes the local OAuth
+completion path; vendor credentials, endpoint compatibility and live acceptance
+remain independently validated integration requirements.
+
 ---
 
 ## Links

package/dist/index.d.mts

@@ -27,7 +27,7 @@ interface BronAuthConfig {
     redirectUri: string;
     /** Scopes */
     scopes?: string[];
-    /** Use PKCE (recommended for browser) */
+    /** PKCE defaults to true and is required in browsers. */
     usePKCE?: boolean;
 }
 
@@ -77,10 +77,12 @@ declare class BronAdapter implements WalletAdapter {
     readonly name = "Bron";
     private authClient;
     private apiClient;
+    private redirectUri;
+    private connecting;
     constructor(config: BronAdapterConfig);
     getCapabilities(): CapabilityKey[];
     detectInstalled(): Promise<AdapterDetectResult>;
-    connect(ctx: AdapterContext, _opts?: {
+    connect(ctx: AdapterContext, opts?: {
         timeoutMs?: number;
         requiredCapabilities?: CapabilityKey[];
     }): Promise<AdapterConnectResult>;
@@ -97,4 +99,11 @@ declare class BronAdapter implements WalletAdapter {
     ledgerApi(ctx: AdapterContext, session: _partylayer_core.Session, params: LedgerApiParams): Promise<LedgerApiResult>;
 }
 
-export { BronAdapter, type BronAdapterApiConfig, type BronAdapterConfig, type BronApiConfig, type BronAuthConfig };
+/**
+ * Call from the application's registered redirect page. The popup relays only
+ * to its own origin; the opener verifies the source, path, state and PKCE.
+ * This helper does not register a Bron OAuth client or define vendor endpoints.
+ */
+declare function completeBronAuthorization(redirectUri: string): void;
+
+export { BronAdapter, type BronAdapterApiConfig, type BronAdapterConfig, type BronApiConfig, type BronAuthConfig, completeBronAuthorization };

package/dist/index.d.ts

@@ -27,7 +27,7 @@ interface BronAuthConfig {
     redirectUri: string;
     /** Scopes */
     scopes?: string[];
-    /** Use PKCE (recommended for browser) */
+    /** PKCE defaults to true and is required in browsers. */
     usePKCE?: boolean;
 }
 
@@ -77,10 +77,12 @@ declare class BronAdapter implements WalletAdapter {
     readonly name = "Bron";
     private authClient;
     private apiClient;
+    private redirectUri;
+    private connecting;
     constructor(config: BronAdapterConfig);
     getCapabilities(): CapabilityKey[];
     detectInstalled(): Promise<AdapterDetectResult>;
-    connect(ctx: AdapterContext, _opts?: {
+    connect(ctx: AdapterContext, opts?: {
         timeoutMs?: number;
         requiredCapabilities?: CapabilityKey[];
     }): Promise<AdapterConnectResult>;
@@ -97,4 +99,11 @@ declare class BronAdapter implements WalletAdapter {
     ledgerApi(ctx: AdapterContext, session: _partylayer_core.Session, params: LedgerApiParams): Promise<LedgerApiResult>;
 }
 
-export { BronAdapter, type BronAdapterApiConfig, type BronAdapterConfig, type BronApiConfig, type BronAuthConfig };
+/**
+ * Call from the application's registered redirect page. The popup relays only
+ * to its own origin; the opener verifies the source, path, state and PKCE.
+ * This helper does not register a Bron OAuth client or define vendor endpoints.
+ */
+declare function completeBronAuthorization(redirectUri: string): void;
+
+export { BronAdapter, type BronAdapterApiConfig, type BronAdapterConfig, type BronApiConfig, type BronAuthConfig, completeBronAuthorization };

package/dist/index.js

@@ -10,15 +10,32 @@ var BronAuthClient = class {
   storage;
   tokens = null;
   // In-memory by default
+  pending = null;
+  exchange = null;
+  authorization = new AbortController();
+  epoch = 0;
+  storageWrites = Promise.resolve();
+  persist(action) {
+    const write = this.storageWrites.catch(() => {
+    }).then(action);
+    this.storageWrites = write;
+    return write;
+  }
   constructor(config, storage) {
-    this.config = config;
+    for (const input of [config.authorizationUrl, config.tokenUrl, config.redirectUri]) {
+      const url = new URL(input);
+      if (url.username || url.password || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) throw new Error("OAuth requires trusted HTTPS URLs");
+    }
+    if (!config.clientId?.trim()) throw new Error("OAuth clientId is required");
+    if (typeof window !== "undefined" && (config.clientSecret || config.usePKCE === false)) throw new Error("Browser OAuth requires PKCE and must not contain a client secret");
+    this.config = { ...config, usePKCE: config.usePKCE ?? true };
     this.storage = storage;
   }
   /**
    * Generate PKCE code verifier and challenge
    */
   async generatePKCE() {
-    const verifier = this.generateRandomString(128);
+    const verifier = this.generateRandomString(32);
     const encoder = new TextEncoder();
     const data = encoder.encode(verifier);
     const digest = await crypto.subtle.digest("SHA-256", data);
@@ -37,6 +54,9 @@ var BronAuthClient = class {
    * Start authorization flow
    */
   async startAuth() {
+    this.cancelAuthorization();
+    this.authorization = new AbortController();
+    const epoch = this.epoch;
     const state = this.generateRandomString(32);
     const params = new URLSearchParams({
       response_type: "code",
@@ -49,94 +69,108 @@ var BronAuthClient = class {
       const pkce = await this.generatePKCE();
       params.set("code_challenge", pkce.challenge);
       params.set("code_challenge_method", "S256");
-      if (typeof window !== "undefined") {
-        sessionStorage.setItem("bron_pkce_verifier", pkce.verifier);
-        sessionStorage.setItem("bron_auth_state", state);
-      }
+      if (epoch !== this.epoch) throw new Error("OAuth authorization cancelled");
+      this.pending = { state, verifier: pkce.verifier, expiresAt: Date.now() + 3e5 };
     } else {
-      if (typeof window !== "undefined") {
-        sessionStorage.setItem("bron_auth_state", state);
-      }
+      this.pending = { state, expiresAt: Date.now() + 3e5 };
     }
-    const authUrl = `${this.config.authorizationUrl}?${params.toString()}`;
-    return authUrl;
+    const url = new URL(this.config.authorizationUrl);
+    for (const [key, value] of params) url.searchParams.set(key, value);
+    return url.href;
   }
   /**
    * Finish authorization flow with callback URL
    */
   async finishAuth(callbackUrl) {
     const url = new URL(callbackUrl);
+    const redirect = new URL(this.config.redirectUri);
+    const pending = this.pending;
+    if (url.origin !== redirect.origin || url.pathname !== redirect.pathname || url.hash || url.username || url.password || [...redirect.searchParams].some(([key, value]) => url.searchParams.getAll(key).length !== 1 || url.searchParams.get(key) !== value) || !pending || pending.expiresAt <= Date.now() || url.searchParams.getAll("state").length !== 1 || url.searchParams.get("state") !== pending.state) throw new Error("Invalid or expired OAuth callback state");
+    this.pending = null;
+    if (url.searchParams.has("error")) throw new Error("OAuth authorization was declined or failed");
     const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    const error = url.searchParams.get("error");
-    if (error) {
-      throw new Error(`OAuth error: ${error}`);
-    }
-    if (!code) {
-      throw new Error("No authorization code in callback");
-    }
-    if (typeof window !== "undefined") {
-      const storedState = sessionStorage.getItem("bron_auth_state");
-      if (state !== storedState) {
-        throw new Error("State mismatch");
-      }
-    }
+    if (!code || url.searchParams.getAll("code").length !== 1) throw new Error("No unique authorization code in callback");
     const tokenParams = new URLSearchParams({
       grant_type: "authorization_code",
       code,
       redirect_uri: this.config.redirectUri,
       client_id: this.config.clientId
     });
-    if (this.config.usePKCE && typeof window !== "undefined") {
-      const verifier = sessionStorage.getItem("bron_pkce_verifier");
-      if (verifier) {
-        tokenParams.set("code_verifier", verifier);
-        sessionStorage.removeItem("bron_pkce_verifier");
-      }
-    }
-    if (this.config.clientSecret) {
-      tokenParams.set("client_secret", this.config.clientSecret);
-    }
-    const response = await fetch(this.config.tokenUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: tokenParams.toString()
-    });
-    if (!response.ok) {
-      const error2 = await response.text();
-      throw new Error(`Token exchange failed: ${error2}`);
-    }
-    const tokenData = await response.json();
-    const tokens = {
-      accessToken: tokenData.access_token,
-      refreshToken: tokenData.refresh_token,
-      expiresAt: Date.now() + tokenData.expires_in * 1e3,
-      tokenType: tokenData.token_type || "Bearer"
-    };
-    this.tokens = tokens;
-    if (this.storage) {
-      await this.storage.set("bron_tokens", JSON.stringify(tokens));
+    if (this.config.usePKCE) {
+      if (!pending.verifier) throw new Error("Missing PKCE verifier");
+      tokenParams.set("code_verifier", pending.verifier);
     }
-    if (typeof window !== "undefined") {
-      sessionStorage.removeItem("bron_auth_state");
+    if (this.config.clientSecret) tokenParams.set("client_secret", this.config.clientSecret);
+    const epoch = this.epoch;
+    const controller = new AbortController();
+    this.exchange = controller;
+    const timer = setTimeout(() => controller.abort(), 15e3);
+    try {
+      const response = await fetch(this.config.tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+        body: tokenParams.toString(),
+        credentials: "omit",
+        cache: "no-store",
+        redirect: "error",
+        referrerPolicy: "no-referrer",
+        signal: controller.signal
+      });
+      if (!response.ok) throw new Error("OAuth token exchange failed");
+      const raw = await response.text();
+      if (raw.length > 256e3) throw new Error("OAuth token response is too large");
+      const data = JSON.parse(raw);
+      if (!data || typeof data.access_token !== "string" || !data.access_token || data.access_token.length > 64e3 || /[\s\p{Cc}]/u.test(data.access_token) || typeof data.token_type !== "string" || data.token_type.toLowerCase() !== "bearer" || typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0 || data.expires_in > 31536e3 || data.refresh_token !== void 0 && (typeof data.refresh_token !== "string" || !data.refresh_token || /\p{Cc}/u.test(data.refresh_token))) {
+        throw new Error("Invalid OAuth token response");
+      }
+      if (controller.signal.aborted || epoch !== this.epoch) throw new Error("OAuth authorization cancelled");
+      const tokens = {
+        accessToken: data.access_token,
+        expiresAt: Date.now() + data.expires_in * 1e3,
+        tokenType: "Bearer",
+        ...data.refresh_token ? { refreshToken: data.refresh_token } : {}
+      };
+      this.tokens = tokens;
+      if (this.storage) await this.persist(async () => {
+        if (epoch === this.epoch) await this.storage.set("bron_tokens", JSON.stringify(tokens));
+      });
+      if (epoch !== this.epoch) throw new Error("OAuth authorization cancelled");
+      return tokens;
+    } finally {
+      clearTimeout(timer);
+      if (this.exchange === controller) this.exchange = null;
     }
-    return tokens;
+  }
+  /** Clear authorization state and abort only the in-flight token exchange. */
+  cancelAuthorization() {
+    this.authorization.abort();
+    this.epoch++;
+    this.pending = null;
+    this.exchange?.abort();
+    this.exchange = null;
+  }
+  getAuthorizationSignal() {
+    return this.authorization.signal;
   }
   /**
    * Get current access token
    */
   async getAccessToken() {
+    const epoch = this.epoch;
     if (this.tokens && Date.now() < this.tokens.expiresAt) {
       return this.tokens.accessToken;
     }
     if (this.storage) {
       const stored = await this.storage.get("bron_tokens");
+      if (epoch !== this.epoch) return null;
       if (stored) {
-        this.tokens = JSON.parse(stored);
-        if (Date.now() < this.tokens.expiresAt) {
-          return this.tokens.accessToken;
+        try {
+          const tokens = JSON.parse(stored);
+          if (typeof tokens.accessToken === "string" && tokens.accessToken && !/[\s\p{Cc}]/u.test(tokens.accessToken) && tokens.tokenType === "Bearer" && Number.isFinite(tokens.expiresAt) && Date.now() < tokens.expiresAt) {
+            this.tokens = tokens;
+            return tokens.accessToken;
+          }
+        } catch {
         }
       }
     }
@@ -146,9 +180,10 @@ var BronAuthClient = class {
    * Logout
    */
   async logout() {
+    this.cancelAuthorization();
     this.tokens = null;
     if (this.storage) {
-      await this.storage.remove("bron_tokens");
+      await this.persist(() => this.storage.remove("bron_tokens"));
     }
   }
 };
@@ -270,6 +305,61 @@ var BronApiClient = class {
     throw new Error("Polling timeout");
   }
 };
+var CALLBACK = "partylayer:bron:authorization-callback";
+function completeBronAuthorization(redirectUri) {
+  if (typeof window === "undefined" || !window.opener) throw new Error("Open this OAuth callback from the connecting application");
+  const expected = new URL(redirectUri);
+  if (window.location.origin !== expected.origin || window.location.pathname !== expected.pathname) throw new Error("Unexpected OAuth redirect page");
+  const callbackUrl = window.location.href;
+  window.opener.postMessage({ type: CALLBACK, callbackUrl }, expected.origin);
+  window.history.replaceState(null, "", expected.pathname);
+  window.close();
+}
+async function authorizeBronPopup(auth, redirectUri, timeoutMs) {
+  if (typeof window === "undefined") throw new Error("OAuth flow requires a browser environment");
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 3e5) throw new Error("Invalid OAuth timeout");
+  const expected = new URL(redirectUri);
+  if (expected.origin !== window.location.origin) throw new Error("Register a same-origin OAuth callback page");
+  const url = await auth.startAuth();
+  const popup = window.open(url, "partylayer-bron-authorization", "width=500,height=650");
+  if (!popup) {
+    auth.cancelAuthorization();
+    throw new Error("Allow the wallet authorization popup and try again");
+  }
+  return new Promise((resolve, reject) => {
+    const signal = auth.getAuthorizationSignal();
+    let callbackReceived = false;
+    let finished = false;
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      clearInterval(closed);
+      window.removeEventListener("message", receive);
+      signal.removeEventListener("abort", cancel);
+      if (error) auth.cancelAuthorization();
+      try {
+        popup.close();
+      } catch {
+      }
+      if (error) reject(error);
+      else resolve();
+    };
+    const receive = (event) => {
+      if (finished || callbackReceived || event.source !== popup || event.origin !== expected.origin || !event.data || event.data.type !== CALLBACK || typeof event.data.callbackUrl !== "string") return;
+      callbackReceived = true;
+      void auth.finishAuth(event.data.callbackUrl).then(() => finish(), (error) => finish(error));
+    };
+    const cancel = () => finish(new Error("Wallet authorization cancelled"));
+    const timer = setTimeout(() => finish(new Error("Wallet authorization timed out")), timeoutMs);
+    const closed = setInterval(() => {
+      if (!callbackReceived && popup.closed) finish(new core.UserRejectedError("Wallet authorization was closed"));
+    }, 250);
+    window.addEventListener("message", receive);
+    signal.addEventListener("abort", cancel, { once: true });
+    if (signal.aborted) cancel();
+  });
+}
 
 // src/bron-adapter.ts
 var BronAdapter = class {
@@ -277,8 +367,11 @@ var BronAdapter = class {
   name = "Bron";
   authClient;
   apiClient;
+  redirectUri;
+  connecting = false;
   constructor(config) {
     this.authClient = new BronAuthClient(config.auth);
+    this.redirectUri = config.auth.redirectUri;
     this.apiClient = new BronApiClient({
       baseUrl: config.api.baseUrl,
       getAccessToken: async () => {
@@ -308,23 +401,13 @@ var BronAdapter = class {
       reason: "Bron is a remote signer service"
     });
   }
-  async connect(ctx, _opts) {
+  async connect(ctx, opts) {
+    if (this.connecting) throw new Error("A Bron connection is already pending");
+    this.connecting = true;
     try {
       const accessToken = await this.authClient.getAccessToken();
       if (!accessToken) {
-        if (typeof window === "undefined") {
-          throw new Error("OAuth flow requires browser environment");
-        }
-        const authUrl = await this.authClient.startAuth();
-        const popup = window.open(
-          authUrl,
-          "Bron Auth",
-          "width=500,height=600"
-        );
-        if (!popup) {
-          throw new Error("Failed to open auth popup");
-        }
-        throw new Error("OAuth callback not implemented in adapter - handle in app");
+        await authorizeBronPopup(this.authClient, this.redirectUri, opts?.timeoutMs ?? 12e4);
       }
       const session = await this.apiClient.createSession();
       return {
@@ -350,6 +433,8 @@ var BronAdapter = class {
         phase: "connect",
         transport: "remote"
       });
+    } finally {
+      this.connecting = false;
     }
   }
   async disconnect(_ctx, _session) {
@@ -497,5 +582,6 @@ var BronAdapter = class {
 };
 
 exports.BronAdapter = BronAdapter;
+exports.completeBronAuthorization = completeBronAuthorization;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map