@phantom/embedded-provider-core 0.1.8 → 0.1.10

package/dist/index.mjs

@@ -9,6 +9,10 @@ import {
   parseTransactionResponse
 } from "@phantom/parsers";
 
+// src/constants.ts
+var AUTHENTICATOR_EXPIRATION_TIME_MS = 7 * 24 * 60 * 60 * 1e3;
+var AUTHENTICATOR_RENEWAL_WINDOW_MS = 2 * 24 * 60 * 60 * 1e3;
+
 // src/auth/jwt-auth.ts
 var JWTAuth = class {
   async authenticate(options) {
@@ -175,14 +179,17 @@ var EmbeddedProvider = class {
     }
   }
   async getAndFilterWalletAddresses(walletId) {
+    const session = await this.storage.getSession();
+    const derivationIndex = session?.accountDerivationIndex ?? 0;
     const addresses = await retryWithBackoff(
-      () => this.client.getWalletAddresses(walletId),
+      () => this.client.getWalletAddresses(walletId, void 0, derivationIndex),
       "getWalletAddresses",
       this.logger
     ).catch(async (error) => {
       this.logger.error("EMBEDDED_PROVIDER", "getWalletAddresses failed after retries, disconnecting", {
         walletId,
-        error: error.message
+        error: error.message,
+        derivationIndex
       });
       await this.storage.clearSession();
       this.client = null;
@@ -223,6 +230,14 @@ var EmbeddedProvider = class {
         return null;
       }
     }
+    if (session.status === "completed" && !this.isSessionValid(session)) {
+      this.logger.warn("EMBEDDED_PROVIDER", "Session invalid due to authenticator expiration", {
+        sessionId: session.sessionId,
+        authenticatorExpiresAt: session.authenticatorExpiresAt
+      });
+      await this.storage.clearSession();
+      return null;
+    }
     return session;
   }
   /*
@@ -257,6 +272,7 @@ var EmbeddedProvider = class {
         walletId: this.walletId,
         addressCount: this.addresses.length
       });
+      await this.ensureValidAuthenticator();
       const result = {
         walletId: this.walletId,
         addresses: this.addresses,
@@ -286,8 +302,9 @@ var EmbeddedProvider = class {
     }
   }
   /*
-   * We use this method to validate if a session is still valid and can be used for auto-connect.
-   * This checks session status, expiration, and required fields.
+   * We use this method to validate if a session is still valid.
+   * This checks session status, required fields, and authenticator expiration.
+   * Sessions never expire by age - only authenticators expire.
    */
   isSessionValid(session) {
     if (!session) {
@@ -305,20 +322,23 @@ var EmbeddedProvider = class {
       this.logger.log("EMBEDDED_PROVIDER", "Session not completed", { status: session.status });
       return false;
     }
-    const sessionAge = Date.now() - session.lastUsed;
-    const maxSessionAge = 7 * 24 * 60 * 60 * 1e3;
-    if (sessionAge > maxSessionAge) {
-      this.logger.log("EMBEDDED_PROVIDER", "Session expired", {
-        sessionAge,
-        maxSessionAge,
-        lastUsed: new Date(session.lastUsed).toISOString()
+    if (!session.authenticatorExpiresAt) {
+      this.logger.log("EMBEDDED_PROVIDER", "Session invalid - missing authenticator timing", {
+        sessionId: session.sessionId
+      });
+      return false;
+    }
+    if (Date.now() >= session.authenticatorExpiresAt) {
+      this.logger.log("EMBEDDED_PROVIDER", "Authenticator expired, session invalid", {
+        authenticatorExpiresAt: new Date(session.authenticatorExpiresAt).toISOString(),
+        now: (/* @__PURE__ */ new Date()).toISOString()
       });
       return false;
     }
     this.logger.log("EMBEDDED_PROVIDER", "Session is valid", {
       sessionId: session.sessionId,
       walletId: session.walletId,
-      lastUsed: new Date(session.lastUsed).toISOString()
+      authenticatorExpires: new Date(session.authenticatorExpiresAt).toISOString()
     });
     return true;
   }
@@ -387,9 +407,11 @@ var EmbeddedProvider = class {
       platform: platformName
     });
     const base64urlPublicKey = base64urlEncode(bs58.decode(stamperInfo.publicKey));
+    const expiresAtMs = Date.now() + AUTHENTICATOR_EXPIRATION_TIME_MS;
+    const username = `user-${shortPubKey}`;
     const { organizationId } = await tempClient.createOrganization(organizationName, [
       {
-        username: `user-${shortPubKey}`,
+        username,
         role: "ADMIN",
         authenticators: [
           {
@@ -397,12 +419,14 @@ var EmbeddedProvider = class {
             authenticatorKind: "keypair",
             publicKey: base64urlPublicKey,
             algorithm: "Ed25519"
+            // Commented for now until KMS supports fully expirable organizations
+            // expiresAtMs: expiresAtMs,
           }
         ]
       }
     ]);
     this.logger.info("EMBEDDED_PROVIDER", "Organization created", { organizationId });
-    return { organizationId, stamperInfo };
+    return { organizationId, stamperInfo, expiresAtMs, username };
   }
   async connect(authOptions) {
     try {
@@ -431,8 +455,8 @@ var EmbeddedProvider = class {
       }
       this.validateAuthOptions(authOptions);
       this.logger.info("EMBEDDED_PROVIDER", "No existing connection, creating new auth flow");
-      const { organizationId, stamperInfo } = await this.createOrganizationAndStamper();
-      const session = await this.handleAuthFlow(organizationId, stamperInfo, authOptions);
+      const { organizationId, stamperInfo, expiresAtMs, username } = await this.createOrganizationAndStamper();
+      const session = await this.handleAuthFlow(organizationId, stamperInfo, authOptions, expiresAtMs, username);
       if (!session) {
         return {
           addresses: [],
@@ -444,6 +468,7 @@ var EmbeddedProvider = class {
         await this.storage.saveSession(session);
       }
       await this.initializeClientFromSession(session);
+      await this.ensureValidAuthenticator();
       const result = {
         walletId: this.walletId,
         addresses: this.addresses,
@@ -509,15 +534,19 @@ var EmbeddedProvider = class {
     if (!this.client || !this.walletId) {
       throw new Error("Not connected");
     }
+    await this.ensureValidAuthenticator();
     this.logger.info("EMBEDDED_PROVIDER", "Signing message", {
       walletId: this.walletId,
       message: params.message
     });
     const parsedMessage = parseMessage(params.message);
+    const session = await this.storage.getSession();
+    const derivationIndex = session?.accountDerivationIndex ?? 0;
     const rawResponse = await this.client.signMessage({
       walletId: this.walletId,
       message: parsedMessage.base64url,
-      networkId: params.networkId
+      networkId: params.networkId,
+      derivationIndex
     });
     this.logger.info("EMBEDDED_PROVIDER", "Message signed successfully", {
       walletId: this.walletId,
@@ -529,19 +558,24 @@ var EmbeddedProvider = class {
     if (!this.client || !this.walletId) {
       throw new Error("Not connected");
     }
+    await this.ensureValidAuthenticator();
     this.logger.info("EMBEDDED_PROVIDER", "Signing and sending transaction", {
       walletId: this.walletId,
       networkId: params.networkId
     });
     const parsedTransaction = await parseTransaction(params.transaction, params.networkId);
+    const session = await this.storage.getSession();
+    const derivationIndex = session?.accountDerivationIndex ?? 0;
     this.logger.log("EMBEDDED_PROVIDER", "Parsed transaction for signing", {
       walletId: this.walletId,
-      transaction: parsedTransaction
+      transaction: parsedTransaction,
+      derivationIndex
     });
     const rawResponse = await this.client.signAndSendTransaction({
       walletId: this.walletId,
       transaction: parsedTransaction.base64url,
-      networkId: params.networkId
+      networkId: params.networkId,
+      derivationIndex
     });
     this.logger.info("EMBEDDED_PROVIDER", "Transaction signed and sent successfully", {
       walletId: this.walletId,
@@ -562,20 +596,20 @@ var EmbeddedProvider = class {
    * It handles app-wallet creation directly or routes to JWT/redirect authentication for user-wallets.
    * Returns null for redirect flows since they don't complete synchronously.
    */
-  async handleAuthFlow(organizationId, stamperInfo, authOptions) {
+  async handleAuthFlow(organizationId, stamperInfo, authOptions, expiresAtMs, username) {
     if (this.config.embeddedWalletType === "user-wallet") {
       this.logger.info("EMBEDDED_PROVIDER", "Creating user-wallet, routing authentication", {
         authProvider: authOptions?.provider || "phantom-connect"
       });
       if (authOptions?.provider === "jwt") {
-        return await this.handleJWTAuth(organizationId, stamperInfo, authOptions);
+        return await this.handleJWTAuth(organizationId, stamperInfo, authOptions, expiresAtMs, username);
       } else {
         this.logger.info("EMBEDDED_PROVIDER", "Starting redirect-based authentication flow", {
           organizationId,
           parentOrganizationId: this.config.organizationId,
           provider: authOptions?.provider
         });
-        return await this.handleRedirectAuth(organizationId, stamperInfo, authOptions);
+        return await this.handleRedirectAuth(organizationId, stamperInfo, authOptions, username);
       }
     } else {
       this.logger.info("EMBEDDED_PROVIDER", "Creating app-wallet", {
@@ -598,9 +632,15 @@ var EmbeddedProvider = class {
         stamperInfo,
         authProvider: "app-wallet",
         userInfo: { embeddedWalletType: this.config.embeddedWalletType },
+        accountDerivationIndex: 0,
+        // App wallets default to index 0
         status: "completed",
         createdAt: now,
-        lastUsed: now
+        lastUsed: now,
+        authenticatorCreatedAt: now,
+        authenticatorExpiresAt: expiresAtMs,
+        lastRenewalAttempt: void 0,
+        username
       };
       await this.storage.saveSession(session);
       this.logger.info("EMBEDDED_PROVIDER", "App-wallet created successfully", { walletId, organizationId });
@@ -611,7 +651,7 @@ var EmbeddedProvider = class {
    * We use this method to handle JWT-based authentication for user-wallets.
    * It authenticates using the provided JWT token and creates a completed session.
    */
-  async handleJWTAuth(organizationId, stamperInfo, authOptions) {
+  async handleJWTAuth(organizationId, stamperInfo, authOptions, expiresAtMs, username) {
     this.logger.info("EMBEDDED_PROVIDER", "Using JWT authentication flow");
     if (!authOptions.jwtToken) {
       this.logger.error("EMBEDDED_PROVIDER", "JWT token missing for JWT authentication");
@@ -634,9 +674,14 @@ var EmbeddedProvider = class {
       stamperInfo,
       authProvider: authResult.provider,
       userInfo: authResult.userInfo,
+      accountDerivationIndex: authResult.accountDerivationIndex,
       status: "completed",
       createdAt: now,
-      lastUsed: now
+      lastUsed: now,
+      authenticatorCreatedAt: now,
+      authenticatorExpiresAt: expiresAtMs,
+      lastRenewalAttempt: void 0,
+      username
     };
     this.logger.log("EMBEDDED_PROVIDER", "Saving JWT session");
     await this.storage.saveSession(session);
@@ -647,7 +692,7 @@ var EmbeddedProvider = class {
    * It saves a temporary session before redirecting to prevent losing state during the redirect flow.
    * Session timestamp is updated before redirect to prevent race conditions.
    */
-  async handleRedirectAuth(organizationId, stamperInfo, authOptions) {
+  async handleRedirectAuth(organizationId, stamperInfo, authOptions, username) {
     this.logger.info("EMBEDDED_PROVIDER", "Using Phantom Connect authentication flow (redirect-based)", {
       provider: authOptions?.provider,
       hasRedirectUrl: !!this.config.authOptions?.redirectUrl,
@@ -663,9 +708,15 @@ var EmbeddedProvider = class {
       stamperInfo,
       authProvider: "phantom-connect",
       userInfo: { provider: authOptions?.provider },
+      accountDerivationIndex: void 0,
+      // Will be set when redirect completes
       status: "pending",
       createdAt: now,
-      lastUsed: now
+      lastUsed: now,
+      authenticatorCreatedAt: now,
+      authenticatorExpiresAt: now + AUTHENTICATOR_EXPIRATION_TIME_MS,
+      lastRenewalAttempt: void 0,
+      username: username || `user-${stamperInfo.keyId.substring(0, 8)}`
     };
     this.logger.log("EMBEDDED_PROVIDER", "Saving temporary session before redirect", {
       sessionId: tempSession.sessionId,
@@ -697,6 +748,7 @@ var EmbeddedProvider = class {
       });
       tempSession.walletId = authResult.walletId;
       tempSession.authProvider = authResult.provider || tempSession.authProvider;
+      tempSession.accountDerivationIndex = authResult.accountDerivationIndex;
       tempSession.status = "completed";
       tempSession.lastUsed = Date.now();
       await this.storage.saveSession(tempSession);
@@ -712,16 +764,119 @@ var EmbeddedProvider = class {
     }
     session.walletId = authResult.walletId;
     session.authProvider = authResult.provider || session.authProvider;
+    session.accountDerivationIndex = authResult.accountDerivationIndex;
     session.status = "completed";
     session.lastUsed = Date.now();
     await this.storage.saveSession(session);
     await this.initializeClientFromSession(session);
+    await this.ensureValidAuthenticator();
     return {
       walletId: this.walletId,
       addresses: this.addresses,
       status: "completed"
     };
   }
+  /*
+   * Ensures the authenticator is valid and performs renewal if needed.
+   * The renewal of the authenticator can only happen meanwhile the previous authenticator is still valid. 
+   */
+  async ensureValidAuthenticator() {
+    const session = await this.storage.getSession();
+    if (!session) {
+      throw new Error("No active session found");
+    }
+    const now = Date.now();
+    if (!session.authenticatorExpiresAt) {
+      this.logger.warn("EMBEDDED_PROVIDER", "Session missing authenticator timing - treating as invalid session");
+      await this.disconnect();
+      throw new Error("Invalid session - missing authenticator timing");
+    }
+    const timeUntilExpiry = session.authenticatorExpiresAt - now;
+    this.logger.log("EMBEDDED_PROVIDER", "Checking authenticator expiration", {
+      expiresAt: new Date(session.authenticatorExpiresAt).toISOString(),
+      timeUntilExpiry
+    });
+    if (timeUntilExpiry <= 0) {
+      this.logger.error("EMBEDDED_PROVIDER", "Authenticator has expired, disconnecting");
+      await this.disconnect();
+      throw new Error("Authenticator expired");
+    }
+    const renewalWindow = AUTHENTICATOR_RENEWAL_WINDOW_MS;
+    if (timeUntilExpiry <= renewalWindow) {
+      this.logger.info("EMBEDDED_PROVIDER", "Authenticator needs renewal", {
+        expiresAt: new Date(session.authenticatorExpiresAt).toISOString(),
+        timeUntilExpiry,
+        renewalWindow
+      });
+      try {
+        await this.renewAuthenticator(session);
+        this.logger.info("EMBEDDED_PROVIDER", "Authenticator renewed successfully");
+      } catch (error) {
+        this.logger.error("EMBEDDED_PROVIDER", "Failed to renew authenticator", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+  /*
+   * We use this method to perform silent authenticator renewal.
+   * It generates a new keypair, creates a new authenticator, and switches to it.
+   */
+  async renewAuthenticator(session) {
+    if (!this.client) {
+      throw new Error("Client not initialized");
+    }
+    this.logger.info("EMBEDDED_PROVIDER", "Starting authenticator renewal");
+    try {
+      const newKeyInfo = await this.stamper.rotateKeyPair();
+      this.logger.log("EMBEDDED_PROVIDER", "Generated new keypair for renewal", {
+        newKeyId: newKeyInfo.keyId,
+        newPublicKey: newKeyInfo.publicKey
+      });
+      const base64urlPublicKey = base64urlEncode(bs58.decode(newKeyInfo.publicKey));
+      const expiresAtMs = Date.now() + AUTHENTICATOR_EXPIRATION_TIME_MS;
+      let authenticatorResult;
+      try {
+        authenticatorResult = await this.client.createAuthenticator({
+          organizationId: session.organizationId,
+          username: session.username,
+          authenticatorName: `auth-${newKeyInfo.keyId.substring(0, 8)}`,
+          authenticator: {
+            authenticatorName: `auth-${newKeyInfo.keyId.substring(0, 8)}`,
+            authenticatorKind: "keypair",
+            publicKey: base64urlPublicKey,
+            algorithm: "Ed25519"
+            // Commented for now until KMS supports fully expiring organizations
+            // expiresAtMs: expiresAtMs,
+          },
+          replaceExpirable: true
+        });
+      } catch (error) {
+        this.logger.error("EMBEDDED_PROVIDER", "Failed to create new authenticator", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+        await this.stamper.rollbackRotation();
+        throw new Error(`Failed to create new authenticator: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      this.logger.info("EMBEDDED_PROVIDER", "Created new authenticator", {
+        authenticatorId: authenticatorResult.id
+      });
+      await this.stamper.commitRotation(authenticatorResult.id || "unknown");
+      const now = Date.now();
+      session.stamperInfo = newKeyInfo;
+      session.authenticatorCreatedAt = now;
+      session.authenticatorExpiresAt = expiresAtMs;
+      session.lastRenewalAttempt = now;
+      await this.storage.saveSession(session);
+      this.logger.info("EMBEDDED_PROVIDER", "Authenticator renewal completed successfully", {
+        newKeyId: newKeyInfo.keyId,
+        expiresAt: new Date(expiresAtMs).toISOString()
+      });
+    } catch (error) {
+      await this.stamper.rollbackRotation();
+      throw error;
+    }
+  }
   /*
    * We use this method to initialize the PhantomClient and fetch wallet addresses from a completed session.
    * This is the final step that sets up the provider's client state and retrieves available addresses.
@@ -746,6 +901,8 @@ var EmbeddedProvider = class {
   }
 };
 export {
+  AUTHENTICATOR_EXPIRATION_TIME_MS,
+  AUTHENTICATOR_RENEWAL_WINDOW_MS,
   EmbeddedProvider,
   JWTAuth,
   generateSessionId,