@phantom/embedded-provider-core 1.0.0-beta.10 → 1.0.0-beta.11

package/dist/index.d.mts

@@ -29,7 +29,7 @@ interface Session {
     authenticatorCreatedAt: number;
     authenticatorExpiresAt: number;
     lastRenewalAttempt?: number;
-    username: string;
+    username?: string;
     accountDerivationIndex?: number;
 }
 interface EmbeddedStorage {
@@ -60,12 +60,14 @@ interface URLParamsAccessor {
 
 interface AuthResult {
     walletId: string;
+    organizationId: string;
     provider?: string;
     userInfo?: Record<string, any>;
-    accountDerivationIndex?: number;
+    accountDerivationIndex: number;
+    expiresInMs: number;
 }
 interface PhantomConnectOptions {
-    organizationId: string;
+    publicKey: string;
     appId: string;
     provider?: "google" | "apple";
     redirectUrl?: string;
@@ -75,7 +77,7 @@ interface PhantomConnectOptions {
 }
 interface JWTAuthOptions {
     appId: string;
-    organizationId: string;
+    publicKey: string;
     jwtToken: string;
     customAuthData?: Record<string, any>;
 }
@@ -171,7 +173,8 @@ declare class EmbeddedProvider {
     private validateAuthOptions;
     private isSessionValid;
     autoConnect(): Promise<void>;
-    private createOrganizationAndStamper;
+    private initializeStamper;
+    private createOrganizationForAppWallet;
     connect(authOptions?: AuthOptions): Promise<ConnectResult>;
     disconnect(): Promise<void>;
     signMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;

package/dist/index.d.ts

@@ -29,7 +29,7 @@ interface Session {
     authenticatorCreatedAt: number;
     authenticatorExpiresAt: number;
     lastRenewalAttempt?: number;
-    username: string;
+    username?: string;
     accountDerivationIndex?: number;
 }
 interface EmbeddedStorage {
@@ -60,12 +60,14 @@ interface URLParamsAccessor {
 
 interface AuthResult {
     walletId: string;
+    organizationId: string;
     provider?: string;
     userInfo?: Record<string, any>;
-    accountDerivationIndex?: number;
+    accountDerivationIndex: number;
+    expiresInMs: number;
 }
 interface PhantomConnectOptions {
-    organizationId: string;
+    publicKey: string;
     appId: string;
     provider?: "google" | "apple";
     redirectUrl?: string;
@@ -75,7 +77,7 @@ interface PhantomConnectOptions {
 }
 interface JWTAuthOptions {
     appId: string;
-    organizationId: string;
+    publicKey: string;
     jwtToken: string;
     customAuthData?: Record<string, any>;
 }
@@ -171,7 +173,8 @@ declare class EmbeddedProvider {
     private validateAuthOptions;
     private isSessionValid;
     autoConnect(): Promise<void>;
-    private createOrganizationAndStamper;
+    private initializeStamper;
+    private createOrganizationForAppWallet;
     connect(authOptions?: AuthOptions): Promise<ConnectResult>;
     disconnect(): Promise<void>;
     signMessage(params: SignMessageParams): Promise<ParsedSignatureResult>;

package/dist/index.js

@@ -72,6 +72,7 @@ var JWTAuth = class {
         },
         body: JSON.stringify({
           appId: options.appId,
+          publicKey: options.publicKey,
           customAuthData: options.customAuthData
         })
       });
@@ -112,10 +113,19 @@ var JWTAuth = class {
       if (!result.walletId) {
         throw new Error("Invalid JWT authentication response: missing walletId");
       }
+      if (!result.organizationId) {
+        throw new Error("Invalid JWT authentication response: missing organizationId");
+      }
+      if (!result.expiresInMs) {
+        throw new Error("Invalid JWT authentication response: missing expiresInMs");
+      }
       return {
         walletId: result.walletId,
+        organizationId: result.organizationId,
         provider: "jwt",
-        userInfo: result.userInfo || {}
+        userInfo: result.userInfo || {},
+        expiresInMs: result.expiresInMs,
+        accountDerivationIndex: result.accountDerivationIndex || 0
       };
     } catch (error) {
       if (error instanceof TypeError && error.message.includes("fetch")) {
@@ -794,34 +804,39 @@ var EmbeddedProvider = class {
    * We use this method to initialize the stamper and create an organization for new sessions.
    * This is the first step when no existing session is found and we need to set up a new wallet.
    */
-  async createOrganizationAndStamper() {
+  async initializeStamper() {
     this.logger.log("EMBEDDED_PROVIDER", "Initializing stamper");
-    const stamperInfo = await this.stamper.init();
-    this.logger.log("EMBEDDED_PROVIDER", "Stamper initialized", {
+    await this.stamper.init();
+    this.logger.log("EMBEDDED_PROVIDER", "Resetting keypair to avoid conflicts with existing keypairs");
+    const stamperInfo = await this.stamper.resetKeyPair();
+    this.logger.log("EMBEDDED_PROVIDER", "Stamper initialized with fresh keypair", {
       publicKey: stamperInfo.publicKey,
       keyId: stamperInfo.keyId,
       algorithm: this.stamper.algorithm
     });
-    this.logger.log("EMBEDDED_PROVIDER", "Creating temporary PhantomClient");
-    const tempClient = new import_client.PhantomClient(
-      {
-        apiBaseUrl: this.config.apiBaseUrl,
-        headers: {
-          ...this.platform.analyticsHeaders || {}
-        }
-      },
-      this.stamper
-    );
+    const expiresInMs = AUTHENTICATOR_EXPIRATION_TIME_MS;
+    this.logger.info("EMBEDDED_PROVIDER", "Stamper ready for auth flow with fresh keypair", {
+      publicKey: stamperInfo.publicKey,
+      keyId: stamperInfo.keyId
+    });
+    return { stamperInfo, expiresInMs };
+  }
+  async createOrganizationForAppWallet(stamperInfo, expiresInMs) {
+    const tempClient = new import_client.PhantomClient({
+      apiBaseUrl: this.config.apiBaseUrl,
+      headers: {
+        ...this.platform.analyticsHeaders || {}
+      }
+    });
     const platformName = this.platform.name || "unknown";
     const shortPubKey = stamperInfo.publicKey.slice(0, 8);
     const organizationName = `${this.config.appId.substring(0, 8)}-${platformName}-${shortPubKey}`;
-    this.logger.log("EMBEDDED_PROVIDER", "Creating organization", {
+    this.logger.log("EMBEDDED_PROVIDER", "Creating organization for app-wallet", {
       organizationName,
       publicKey: stamperInfo.publicKey,
       platform: platformName
     });
     const base64urlPublicKey = (0, import_base64url2.base64urlEncode)(import_bs582.default.decode(stamperInfo.publicKey));
-    const expiresInMs = AUTHENTICATOR_EXPIRATION_TIME_MS;
     const username = `user-${(0, import_utils.randomUUID)()}`;
     const { organizationId } = await tempClient.createOrganization(organizationName, [
       {
@@ -832,15 +847,14 @@ var EmbeddedProvider = class {
             authenticatorName: `auth-${shortPubKey}`,
             authenticatorKind: "keypair",
             publicKey: base64urlPublicKey,
-            algorithm: "Ed25519"
-            // Commented for now until KMS supports fully expirable organizations
-            // expiresInMs: expiresInMs,
+            algorithm: "Ed25519",
+            expiresInMs
           }
         ]
       }
     ]);
-    this.logger.info("EMBEDDED_PROVIDER", "Organization created", { organizationId });
-    return { organizationId, stamperInfo, expiresInMs, username };
+    this.logger.info("EMBEDDED_PROVIDER", "Organization created for app-wallet", { organizationId });
+    return organizationId;
   }
   async connect(authOptions) {
     try {
@@ -869,8 +883,8 @@ var EmbeddedProvider = class {
       }
       this.validateAuthOptions(authOptions);
       this.logger.info("EMBEDDED_PROVIDER", "No existing connection, creating new auth flow");
-      const { organizationId, stamperInfo, expiresInMs, username } = await this.createOrganizationAndStamper();
-      const session = await this.handleAuthFlow(organizationId, stamperInfo, authOptions, expiresInMs, username);
+      const { stamperInfo, expiresInMs } = await this.initializeStamper();
+      const session = await this.handleAuthFlow(stamperInfo.publicKey, stamperInfo, authOptions, expiresInMs);
       if (!session) {
         return {
           addresses: [],
@@ -1042,24 +1056,25 @@ var EmbeddedProvider = class {
    * It handles app-wallet creation directly or routes to JWT/redirect authentication for user-wallets.
    * Returns null for redirect flows since they don't complete synchronously.
    */
-  async handleAuthFlow(organizationId, stamperInfo, authOptions, expiresInMs, username) {
+  async handleAuthFlow(publicKey, stamperInfo, authOptions, expiresInMs) {
     if (this.config.embeddedWalletType === "user-wallet") {
       this.logger.info("EMBEDDED_PROVIDER", "Creating user-wallet, routing authentication", {
         authProvider: authOptions?.provider || "phantom-connect"
       });
       if (authOptions?.provider === "jwt") {
-        return await this.handleJWTAuth(organizationId, stamperInfo, authOptions, expiresInMs, username);
+        return await this.handleJWTAuth(publicKey, stamperInfo, authOptions, expiresInMs);
       } else {
         this.logger.info("EMBEDDED_PROVIDER", "Starting redirect-based authentication flow", {
-          organizationId,
+          publicKey,
           provider: authOptions?.provider
         });
-        return await this.handleRedirectAuth(organizationId, stamperInfo, authOptions, username);
+        return await this.handleRedirectAuth(publicKey, stamperInfo, authOptions);
       }
     } else {
       this.logger.info("EMBEDDED_PROVIDER", "Creating app-wallet", {
-        organizationId
+        publicKey
       });
+      const organizationId = await this.createOrganizationForAppWallet(stamperInfo, expiresInMs);
       const tempClient = new import_client.PhantomClient(
         {
           apiBaseUrl: this.config.apiBaseUrl,
@@ -1088,8 +1103,7 @@ var EmbeddedProvider = class {
         lastUsed: now,
         authenticatorCreatedAt: now,
         authenticatorExpiresAt: Date.now() + expiresInMs,
-        lastRenewalAttempt: void 0,
-        username
+        lastRenewalAttempt: void 0
       };
       await this.storage.saveSession(session);
       this.logger.info("EMBEDDED_PROVIDER", "App-wallet created successfully", { walletId, organizationId });
@@ -1100,7 +1114,7 @@ var EmbeddedProvider = class {
    * We use this method to handle JWT-based authentication for user-wallets.
    * It authenticates using the provided JWT token and creates a completed session.
    */
-  async handleJWTAuth(organizationId, stamperInfo, authOptions, expiresInMs, username) {
+  async handleJWTAuth(publicKey, stamperInfo, authOptions, localExpiresInMs) {
     this.logger.info("EMBEDDED_PROVIDER", "Using JWT authentication flow");
     if (!authOptions.jwtToken) {
       this.logger.error("EMBEDDED_PROVIDER", "JWT token missing for JWT authentication");
@@ -1108,13 +1122,20 @@ var EmbeddedProvider = class {
     }
     this.logger.log("EMBEDDED_PROVIDER", "Starting JWT authentication");
     const authResult = await this.jwtAuth.authenticate({
-      organizationId,
+      publicKey,
       appId: this.config.appId,
       jwtToken: authOptions.jwtToken,
       customAuthData: authOptions.customAuthData
     });
     const walletId = authResult.walletId;
-    this.logger.info("EMBEDDED_PROVIDER", "JWT authentication completed", { walletId });
+    const organizationId = authResult.organizationId;
+    const expiresInMs = authResult.expiresInMs > 0 ? authResult.expiresInMs : localExpiresInMs;
+    this.logger.info("EMBEDDED_PROVIDER", "JWT authentication completed", {
+      walletId,
+      organizationId,
+      expiresInMs,
+      source: authResult.expiresInMs ? "server" : "local"
+    });
     const now = Date.now();
     const session = {
       sessionId: generateSessionId(),
@@ -1130,8 +1151,7 @@ var EmbeddedProvider = class {
       lastUsed: now,
       authenticatorCreatedAt: now,
       authenticatorExpiresAt: Date.now() + expiresInMs,
-      lastRenewalAttempt: void 0,
-      username
+      lastRenewalAttempt: void 0
     };
     this.logger.log("EMBEDDED_PROVIDER", "Saving JWT session");
     await this.storage.saveSession(session);
@@ -1142,7 +1162,7 @@ var EmbeddedProvider = class {
    * It saves a temporary session before redirecting to prevent losing state during the redirect flow.
    * Session timestamp is updated before redirect to prevent race conditions.
    */
-  async handleRedirectAuth(organizationId, stamperInfo, authOptions, username) {
+  async handleRedirectAuth(publicKey, stamperInfo, authOptions) {
     this.logger.info("EMBEDDED_PROVIDER", "Using Phantom Connect authentication flow (redirect-based)", {
       provider: authOptions?.provider,
       hasRedirectUrl: !!this.config.authOptions.redirectUrl,
@@ -1152,9 +1172,10 @@ var EmbeddedProvider = class {
     const sessionId = generateSessionId();
     const tempSession = {
       sessionId,
-      walletId: `temp-${now}`,
+      walletId: `temp-wallet-${now}`,
+      // Temporary ID, will be updated after redirect
+      organizationId: `temp-org-${now}`,
       // Temporary ID, will be updated after redirect
-      organizationId,
       appId: this.config.appId,
       stamperInfo,
       authProvider: "phantom-connect",
@@ -1166,8 +1187,7 @@ var EmbeddedProvider = class {
       lastUsed: now,
       authenticatorCreatedAt: now,
       authenticatorExpiresAt: now + AUTHENTICATOR_EXPIRATION_TIME_MS,
-      lastRenewalAttempt: void 0,
-      username: username || `user-${(0, import_utils.randomUUID)()}`
+      lastRenewalAttempt: void 0
     };
     this.logger.log("EMBEDDED_PROVIDER", "Saving temporary session before redirect", {
       sessionId: tempSession.sessionId,
@@ -1176,13 +1196,13 @@ var EmbeddedProvider = class {
     tempSession.lastUsed = Date.now();
     await this.storage.saveSession(tempSession);
     this.logger.info("EMBEDDED_PROVIDER", "Starting Phantom Connect redirect", {
-      organizationId,
+      publicKey,
       appId: this.config.appId,
       provider: authOptions?.provider,
       authUrl: this.config.authOptions.authUrl
     });
     const authResult = await this.authProvider.authenticate({
-      organizationId,
+      publicKey,
       appId: this.config.appId,
       provider: authOptions?.provider,
       redirectUrl: this.config.authOptions.redirectUrl,
@@ -1193,13 +1213,24 @@ var EmbeddedProvider = class {
     if (authResult && "walletId" in authResult) {
       this.logger.info("EMBEDDED_PROVIDER", "Authentication completed after redirect", {
         walletId: authResult.walletId,
+        organizationId: authResult.organizationId,
         provider: authResult.provider
       });
       tempSession.walletId = authResult.walletId;
+      tempSession.organizationId = authResult.organizationId;
       tempSession.authProvider = authResult.provider || tempSession.authProvider;
       tempSession.accountDerivationIndex = authResult.accountDerivationIndex;
       tempSession.status = "completed";
       tempSession.lastUsed = Date.now();
+      if (authResult.expiresInMs > 0) {
+        const now2 = Date.now();
+        tempSession.authenticatorCreatedAt = now2;
+        tempSession.authenticatorExpiresAt = now2 + authResult.expiresInMs;
+        this.logger.log("EMBEDDED_PROVIDER", "Updated authenticator expiration from immediate auth response", {
+          expiresInMs: authResult.expiresInMs,
+          expiresAt: new Date(tempSession.authenticatorExpiresAt).toISOString()
+        });
+      }
       await this.storage.saveSession(tempSession);
       return tempSession;
     }
@@ -1213,9 +1244,19 @@ var EmbeddedProvider = class {
     }
     session.walletId = authResult.walletId;
     session.authProvider = authResult.provider || session.authProvider;
+    session.organizationId = authResult.organizationId;
     session.accountDerivationIndex = authResult.accountDerivationIndex;
     session.status = "completed";
     session.lastUsed = Date.now();
+    if (authResult.expiresInMs > 0) {
+      const now = Date.now();
+      session.authenticatorCreatedAt = now;
+      session.authenticatorExpiresAt = now + authResult.expiresInMs;
+      this.logger.log("EMBEDDED_PROVIDER", "Updated authenticator expiration from auth response", {
+        expiresInMs: authResult.expiresInMs,
+        expiresAt: new Date(session.authenticatorExpiresAt).toISOString()
+      });
+    }
     await this.storage.saveSession(session);
     await this.initializeClientFromSession(session);
     await this.ensureValidAuthenticator();
@@ -1269,13 +1310,13 @@ var EmbeddedProvider = class {
   }
   /*
    * We use this method to perform silent authenticator renewal.
-   * It generates a new keypair, creates a new authenticator, and switches to it.
+   * It generates a new keypair, adds a new user to the organization with the new keypair, and switches to it.
    */
   async renewAuthenticator(session) {
     if (!this.client) {
       throw new Error("Client not initialized");
     }
-    this.logger.info("EMBEDDED_PROVIDER", "Starting authenticator renewal");
+    this.logger.info("EMBEDDED_PROVIDER", "Starting authenticator renewal using addUserToOrganization");
     try {
       const newKeyInfo = await this.stamper.rotateKeyPair();
       this.logger.log("EMBEDDED_PROVIDER", "Generated new keypair for renewal", {
@@ -1284,44 +1325,54 @@ var EmbeddedProvider = class {
       });
       const base64urlPublicKey = (0, import_base64url2.base64urlEncode)(import_bs582.default.decode(newKeyInfo.publicKey));
       const expiresInMs = AUTHENTICATOR_EXPIRATION_TIME_MS;
-      let authenticatorResult;
+      const shortKeyId = newKeyInfo.keyId.substring(0, 8);
+      const newUsername = `user-${shortKeyId}`;
       try {
-        authenticatorResult = await this.client.createAuthenticator({
+        await this.client.addUserToOrganization({
           organizationId: session.organizationId,
-          username: session.username,
-          authenticatorName: `auth-${newKeyInfo.keyId.substring(0, 8)}`,
-          authenticator: {
-            authenticatorName: `auth-${newKeyInfo.keyId.substring(0, 8)}`,
-            authenticatorKind: "keypair",
-            publicKey: base64urlPublicKey,
-            algorithm: "Ed25519"
-            // Commented for now until KMS supports fully expiring organizations
-            // expiresInMs: expiresInMs,
+          user: {
+            username: newUsername,
+            role: "ADMIN",
+            // Use ADMIN role like original users
+            authenticators: [
+              {
+                authenticatorName: `auth-${shortKeyId}`,
+                authenticatorKind: "keypair",
+                publicKey: base64urlPublicKey,
+                algorithm: "Ed25519"
+              }
+            ],
+            traits: {
+              appId: this.config.appId
+            }
           },
+          expiresInMs,
           replaceExpirable: true
+          // Replace oldest expirable user if at limit
         });
       } catch (error) {
-        this.logger.error("EMBEDDED_PROVIDER", "Failed to create new authenticator", {
+        this.logger.error("EMBEDDED_PROVIDER", "Failed to add new user to organization", {
           error: error instanceof Error ? error.message : String(error)
         });
         await this.stamper.rollbackRotation();
         throw new Error(
-          `Failed to create new authenticator: ${error instanceof Error ? error.message : String(error)}`
+          `Failed to add new user to organization: ${error instanceof Error ? error.message : String(error)}`
         );
       }
-      this.logger.info("EMBEDDED_PROVIDER", "Created new authenticator", {
-        authenticatorId: authenticatorResult.id
+      this.logger.info("EMBEDDED_PROVIDER", "Added new user to organization successfully", {
+        username: newUsername
       });
-      await this.stamper.commitRotation(authenticatorResult.id || "unknown");
+      await this.stamper.commitRotation(newKeyInfo.keyId);
       const now = Date.now();
       session.stamperInfo = newKeyInfo;
       session.authenticatorCreatedAt = now;
-      session.authenticatorExpiresAt = Date.now() + expiresInMs;
+      session.authenticatorExpiresAt = now + expiresInMs;
       session.lastRenewalAttempt = now;
       await this.storage.saveSession(session);
       this.logger.info("EMBEDDED_PROVIDER", "Authenticator renewal completed successfully", {
         newKeyId: newKeyInfo.keyId,
-        expiresAt: new Date(Date.now() + expiresInMs).toISOString()
+        newUsername,
+        expiresAt: new Date(session.authenticatorExpiresAt).toISOString()
       });
     } catch (error) {
       await this.stamper.rollbackRotation();