@prosopo/client-example-server 2.7.170 → 2.7.172

package/env.development

@@ -1,10 +0,0 @@
-PROSOPO_VERIFY_ENDPOINT=https://localhost:9235/development/siteverify
-PROSOPO_VERIFICATION_TYPE=api
-PROSOPO_SITE_KEY=5GCP69mhanZqJqnTvaaGvJCJZWSahz6xE2c7bTGETqSB5KDK
-PROSOPO_WEB2=true
-PROSOPO_SERVER_URL=https://localhost
-PROSOPO_SITE_PRIVATE_KEY=bottom drive obey lake curtain smoke basket hold race lonely fit walk
-PROSOPO_SERVER_PORT=9228
-PROSOPO_DEFAULT_ENVIRONMENT=development
-PROSOPO_MONGO_EVENTS_URI=mongodb+srv://<MONGO_URI_HERE>/frictionless_events
-_DEV_ONLY_WATCH_EVENTS=false

package/env.production

@@ -1,2 +0,0 @@
-PROSOPO_SITE_KEY=<YOUR SITE KEY HERE>
-PROSOPO_SITE_PRIVATE_KEY=<YOUR SECRET KEY HERE>

package/env.test

@@ -1,10 +0,0 @@
-PROSOPO_VERIFY_ENDPOINT=https://localhost:9235/test/siteverify
-PROSOPO_VERIFICATION_TYPE=api
-PROSOPO_SITE_KEY=5GCP69mhanZqJqnTvaaGvJCJZWSahz6xE2c7bTGETqSB5KDK
-PROSOPO_WEB2=true
-PROSOPO_SERVER_URL=https://localhost
-PROSOPO_SITE_PRIVATE_KEY=bottom drive obey lake curtain smoke basket hold race lonely fit walk
-PROSOPO_SERVER_PORT=9228
-PROSOPO_DEFAULT_ENVIRONMENT=test
-PROSOPO_MONGO_EVENTS_URI=mongodb+srv://<MONGO_URI_HERE>/frictionless_events
-_DEV_ONLY_WATCH_EVENTS=false

package/src/app.ts

@@ -1,210 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import fs from "node:fs";
-import http from "node:http";
-import type { Server } from "node:http";
-import https from "node:https";
-import type { ServerOptions } from "node:https";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { ProsopoEnvError } from "@prosopo/common";
-import { loadEnv } from "@prosopo/dotenv";
-import { getLogger } from "@prosopo/logger";
-import { getServerConfig } from "@prosopo/server";
-import type { ProsopoServerConfigOutput } from "@prosopo/types";
-import { at, isMain } from "@prosopo/util";
-import cors from "cors";
-import express from "express";
-import routesFactory from "./routes/routes.js";
-import connectionFactory from "./utils/connection.js";
-import memoryServerSetup from "./utils/database.js";
-
-export enum ProsopoVerificationType {
-	api = "api",
-	local = "local",
-}
-
-const logger = getLogger("info", "client-example-server:app");
-
-/**
- * The siteverify endpoint the deployment talks to. Non-production
- * environments get their name as a subdomain prefix. An unset NODE_ENV is
- * treated as production: prefixing it produced `undefined-api.prosopo.io`,
- * a host that does not exist.
- */
-export const resolveVerifyEndpoint = (): string => {
-	const environment = process.env.NODE_ENV;
-	const apiPrefix =
-		!environment || environment === "production" ? "" : `${environment}-`;
-	return (
-		process.env.PROSOPO_VERIFY_ENDPOINT ||
-		`https://${apiPrefix}api.prosopo.io/siteverify`
-	);
-};
-
-/** Anything the enum doesn't name falls back to the hosted API. */
-export const resolveVerifyType = (): ProsopoVerificationType =>
-	Object.keys(ProsopoVerificationType).includes(
-		process.env.PROSOPO_VERIFICATION_TYPE as string,
-	)
-		? (process.env.PROSOPO_VERIFICATION_TYPE as ProsopoVerificationType)
-		: ProsopoVerificationType.api;
-
-export const isDevelopmentOrTest = (): boolean =>
-	process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test";
-
-/** The express app, minus the routes, which need a database connection. */
-export const createApp = (): express.Express => {
-	const app = express();
-
-	// https://express-rate-limit.mintlify.app/guides/troubleshooting-proxy-issues
-	app.set("trust proxy", 1);
-
-	app.use(cors({ origin: true, credentials: true }));
-
-	app.use(express.urlencoded({ extended: true }));
-
-	app.use(express.json());
-
-	app.use((_, res, next) => {
-		res.setHeader("Access-Control-Allow-Origin", "*");
-		res.setHeader(
-			"Access-Control-Allow-Methods",
-			"GET, POST, PUT, PATCH, DELETE",
-		);
-		res.setHeader(
-			"Access-Control-Allow-Headers",
-			"Origin, Content-Type, X-Auth-Token, Authorization",
-		);
-		next();
-	});
-
-	// No explicit OPTIONS handler: cors() above already answers preflight
-	// requests with a 204 and never calls through, so the handler that used to
-	// sit here could not run.
-
-	return app;
-};
-
-export const DEFAULT_PORT = 9228;
-
-/**
- * The port is the last segment of the configured server URL. A URL without
- * one used to yield NaN, which node turns into an arbitrary free port — the
- * server came up on an address nothing was configured to talk to.
- */
-export const resolvePort = (config: ProsopoServerConfigOutput): number => {
-	if (!config.serverUrl) return DEFAULT_PORT;
-	const segments = config.serverUrl.split(":");
-	if (segments.length < 3) return DEFAULT_PORT;
-	const port = Number.parseInt(at(segments, 2));
-	return Number.isNaN(port) ? DEFAULT_PORT : port;
-};
-
-/**
- * HTTPS in development/test when the repo's certificates exist, plain HTTP
- * otherwise — in production Caddy terminates TLS.
- */
-export const startServer = (
-	app: express.Express,
-	port: number,
-	dirname: string = path.dirname(fileURLToPath(import.meta.url)),
-): Server => {
-	if (isDevelopmentOrTest()) {
-		const certsDir = path.resolve(dirname, "../../../certs");
-
-		const keyPath = path.join(certsDir, "server.key");
-		const certPath = path.join(certsDir, "server.crt");
-
-		if (fs.existsSync(keyPath) && fs.existsSync(certPath)) {
-			const httpsOptions: ServerOptions = {
-				key: fs.readFileSync(keyPath),
-				cert: fs.readFileSync(certPath),
-			};
-
-			return https.createServer(httpsOptions, app).listen(port, () => {
-				logger.info(() => ({ msg: `HTTPS server started on port ${port}` }));
-			});
-		}
-		logger.warn(() => ({
-			msg: "Certificates not found, starting HTTP server instead. Run ./setup_certs.sh to enable HTTPS in development.",
-		}));
-		return http.createServer(app).listen(port, () => {
-			logger.info(() => ({ msg: `HTTP server started on port ${port}` }));
-		});
-	}
-	return http.createServer(app).listen(port, () => {
-		logger.info(() => ({
-			msg: `HTTP server started on port ${port} (TLS handled by reverse proxy)`,
-		}));
-	});
-};
-
-export async function main(): Promise<Server> {
-	loadEnv();
-
-	const verifyEndpoint = resolveVerifyEndpoint();
-
-	logger.info(() => ({ data: { verifyEndpoint } }));
-
-	const verifyType = resolveVerifyType();
-
-	const app = createApp();
-
-	if (!process.env.MONGO_URI && !isDevelopmentOrTest()) {
-		throw new Error(
-			"Cannot run mongo memory when NODE_ENV is neither development nor test",
-		);
-	}
-	logger.info(() => ({ msg: process.env.MONGO_URI }));
-	const uri = process.env.MONGO_URI || (await memoryServerSetup());
-	logger.info(() => ({ msg: "mongo uri", data: { uri } }));
-	const mongoose = connectionFactory(uri);
-	if (!process.env.PROSOPO_SITE_PRIVATE_KEY) {
-		const mnemonicError = new ProsopoEnvError("GENERAL.MNEMONIC_UNDEFINED", {
-			context: { missingParams: ["PROSOPO_SITE_PRIVATE_KEY"] },
-			logger,
-		});
-
-		logger.error(() => ({ err: mnemonicError }));
-	}
-
-	const config = getServerConfig();
-
-	logger.info(() => ({ msg: "Config", data: { config } }));
-
-	app.use(routesFactory(mongoose, config, verifyEndpoint, verifyType));
-
-	const port = resolvePort(config);
-
-	logger.info(() => ({ msg: "Listening on port", data: { port } }));
-
-	return startServer(app, port);
-}
-
-// Only boot when run as a binary: importing this module (a test, or another
-// entrypoint reusing createApp) must not open a port or spin up mongo.
-if (isMain(import.meta.url)) {
-	main()
-		.then(() => {
-			logger.info(() => ({ msg: "Server started" }));
-		})
-		.catch((err) => {
-			logger.error(() => ({ err }));
-			// Non-zero, so a boot failure is visible to whatever supervises the
-			// process rather than reading as a clean shutdown.
-			process.exit(1);
-		});
-}

package/src/controllers/auth.ts

@@ -1,396 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import { blake2b } from "@noble/hashes/blake2.js";
-import { utf8ToBytes } from "@noble/hashes/utils.js";
-import { u8aToHex } from "@polkadot/util";
-import { randomAsHex } from "@polkadot/util-crypto";
-import { ProsopoEnvError } from "@prosopo/common";
-import { getPair } from "@prosopo/keyring";
-import { getLogger } from "@prosopo/logger";
-import { ProsopoServer } from "@prosopo/server";
-import {
-	ApiParams,
-	CaptchaType,
-	type KeyringPair,
-	ProcaptchaResponse,
-	type ProcaptchaToken,
-	type ProsopoServerConfigOutput,
-} from "@prosopo/types";
-import { at } from "@prosopo/util";
-import type { NextFunction, Request, Response } from "express";
-import jwt, { type JwtPayload } from "jsonwebtoken";
-import type { Connection } from "mongoose";
-import { z } from "zod";
-import type { UserInterface } from "../models/user.js";
-
-const logger = getLogger("info", "client-example-server:auth");
-
-const SubscribeBodySpec = ProcaptchaResponse.merge(
-	z.object({
-		email: z.string().email(),
-		password: z.string(),
-		siteKey: z.string(),
-	}),
-);
-
-function hashPassword(password: string): string {
-	return u8aToHex(blake2b(utf8ToBytes(password)));
-}
-
-const NO_IP = "NO_IP";
-
-/**
- * Derives the correct KeyringPair and secret for a given site key by trying different captcha types.
- * @param baseSecret - The base secret from config
- * @param siteKey - The site key to match against
- * @returns Object containing the matched pair and its corresponding secret
- * @throws Error if no matching pair is found
- */
-const getPairAndSecretForSiteKey = (
-	baseSecret: string,
-	siteKey: string,
-): { pair: KeyringPair; secret: string } => {
-	let pair: KeyringPair | undefined;
-	let secret = baseSecret;
-
-	pair = getPair(secret);
-
-	if (pair.address === siteKey) {
-		logger.info(() => ({
-			msg: "Site key matches the server configuration without captcha type suffix",
-			data: {
-				siteKeyDerived: pair?.address,
-				siteKey,
-			},
-		}));
-		return { pair, secret };
-	}
-
-	for (const captchaType of [
-		CaptchaType.pow,
-		CaptchaType.image,
-		CaptchaType.frictionless,
-		CaptchaType.puzzle,
-	]) {
-		const newSecret = `${baseSecret}//${captchaType}`;
-		pair = getPair(newSecret);
-		logger.info(() => ({
-			msg: "Checking pair",
-			data: {
-				captchaType,
-				siteKeyDerived: pair?.address,
-				siteKey,
-			},
-		}));
-		if (pair.address === siteKey) {
-			secret = newSecret;
-			break;
-		}
-	}
-
-	if (!pair || pair.address !== siteKey) {
-		throw new Error(
-			`Site key does not match the server configuration: Provided ${siteKey} vs Server ${pair?.address}`,
-		);
-	}
-
-	return { pair, secret };
-};
-
-const getResponse = async (
-	ip: string,
-	token: ProcaptchaToken,
-	secret: string,
-	verifyEndpoint: string,
-	email?: string,
-) => {
-	// Only include ip if environment is production
-	const body: Record<string, string> = {
-		[ApiParams.token]: token,
-		[ApiParams.secret]: secret,
-		...(email ? { [ApiParams.email]: email } : {}),
-	};
-
-	if (process.env.NODE_ENV !== "development") {
-		body[ApiParams.ip] = ip;
-	}
-
-	logger.info(() => ({
-		data: {
-			body: { ...body, [ApiParams.secret]: "[redacted]" },
-		},
-	}));
-
-	const response = await fetch(verifyEndpoint, {
-		method: "POST",
-		body: JSON.stringify(body),
-	});
-	return response.json();
-};
-
-const verify = async (
-	prosopoServer: ProsopoServer,
-	verifyType: string,
-	verifyEndpoint: string,
-	token: ProcaptchaToken,
-	secret: string,
-	ip: string,
-	email?: string,
-	// The session id the widget was rendered with. Forwarded so the provider
-	// can confirm the token was earned in this same session; omitted, no
-	// correlation is attempted.
-	clientSessionId?: string,
-) => {
-	if (verifyType === "api") {
-		// verify using the API endpoint
-		logger.info(() => ({
-			msg: "Verifying using the API endpoint",
-			data: {
-				verifyEndpoint,
-			},
-		}));
-
-		const response = await getResponse(
-			ip,
-			token,
-			secret,
-			verifyEndpoint,
-			email,
-		);
-		logger.info(() => ({
-			data: {
-				response,
-			},
-		}));
-		return response.verified;
-	}
-	// verify using the TypeScript library
-	const verified = await prosopoServer.isVerified(
-		token,
-		ip,
-		email,
-		clientSessionId,
-	);
-	logger.info(() => ({
-		data: {
-			verified,
-		},
-	}));
-	return verified[ApiParams.verified];
-};
-
-const signup = async (
-	mongoose: Connection,
-	config: ProsopoServerConfigOutput,
-	verifyEndpoint: string,
-	verifyType: string,
-	req: Request,
-	res: Response,
-	next: NextFunction,
-) => {
-	try {
-		if (!config.account.secret) {
-			throw new ProsopoEnvError("GENERAL.MNEMONIC_UNDEFINED", {
-				context: { missingParams: ["PROSOPO_SITE_PRIVATE_KEY"] },
-			});
-		}
-		const User = mongoose.model<UserInterface>("User");
-		// checks if email exists
-		const dbUser = await User.findOne({
-			email: { $eq: req.body.email },
-		});
-		const payload = SubscribeBodySpec.parse(req.body);
-		// get the procaptcha-response token
-		const token = payload[ApiParams.procaptchaResponse];
-		const siteKey = payload[ApiParams.siteKey];
-
-		const { pair, secret } = getPairAndSecretForSiteKey(
-			config.account.secret,
-			siteKey,
-		);
-
-		const prosopoServer = new ProsopoServer(config, pair);
-		if (dbUser) {
-			return res.status(409).json({ message: "email already exists" });
-		}
-
-		const email = req.body.email;
-		const verified = await verify(
-			prosopoServer,
-			verifyType,
-			verifyEndpoint,
-			token,
-			secret,
-			req.headers["x-client-ip"]?.toString() || "127.0.0.1",
-			email,
-			req.body[ApiParams.clientSessionId],
-		);
-
-		if (verified === true) {
-			// salt
-			const salt = randomAsHex(32);
-			// !!!DUMMY CODE!!! - Do not use in production. Use bcrypt or similar for password hashing.
-			const passwordHash = hashPassword(`${req.body.password}${salt}`);
-			// No `if (passwordHash)` guard: the hash is always a non-empty hex
-			// string, and the guard's absent else-branch left the request hanging
-			// with no response at all.
-			return User.create({
-				email: email,
-				name: req.body.name,
-				password: passwordHash,
-				salt: salt,
-			})
-				.then(() => {
-					res.status(200).json({ message: "user created" });
-				})
-				.catch((err) => {
-					logger.error(() => ({
-						err,
-						msg: "Error creating user in database",
-					}));
-					res.status(502).json({ message: "error while creating the user" });
-				});
-		}
-		res
-			.status(401)
-			.json({ message: "user has not completed a captcha", verified });
-	} catch (err) {
-		console.error("error", err);
-		res
-			.status(500)
-			.json({ message: (err as Error).message || "internal server error" });
-	}
-};
-
-const login = async (
-	mongoose: Connection,
-	config: ProsopoServerConfigOutput,
-	verifyEndpoint: string,
-	verifyType: string,
-	req: Request,
-	res: Response,
-) => {
-	const User = mongoose.model<UserInterface>("User");
-
-	// checks if email exists
-	await User.findOne({
-		email: { $eq: req.body.email },
-	})
-		.then(async (dbUser) => {
-			if (dbUser) {
-				const payload = SubscribeBodySpec.parse(req.body);
-
-				const token = payload[ApiParams.procaptchaResponse];
-				const siteKey = payload[ApiParams.siteKey];
-
-				if (!config.account.secret) {
-					throw new ProsopoEnvError("GENERAL.SECRET_MISSING", {
-						context: { missingParams: ["PROSOPO_SITE_PRIVATE_KEY"] },
-					});
-				}
-
-				const { pair, secret } = getPairAndSecretForSiteKey(
-					config.account.secret,
-					siteKey,
-				);
-				const prosopoServer = new ProsopoServer(config, pair);
-
-				const verified = await verify(
-					prosopoServer,
-					verifyType,
-					verifyEndpoint,
-					token,
-					secret,
-					req.headers["x-client-ip"]?.toString() || NO_IP,
-					// login carries no email; the session id still has to reach
-					// the provider or a widget rendered with data-sessionid is
-					// silently unverified against its session.
-					undefined,
-					req.body[ApiParams.clientSessionId],
-				);
-
-				logger.info(() => ({
-					data: {
-						verified,
-					},
-				}));
-
-				if (verified) {
-					// password hash
-					// !!!DUMMY CODE!!! - Do not use in production. Use bcrypt or similar for password hashing.
-					const passwordHash = hashPassword(
-						`${req.body.password}${dbUser.salt}`,
-					);
-					if (passwordHash !== dbUser.password) {
-						// password doesnt match
-						return res.status(401).json({ message: "invalid credentials" });
-					}
-					// password match
-					const token = jwt.sign({ email: req.body.email }, "secret", {
-						expiresIn: "1h",
-					});
-					return res
-						.status(200)
-						.json({ message: "user logged in", token: token });
-				}
-				return res
-					.status(401)
-					.json({ message: "user has not completed a captcha", verified });
-			}
-			return res.status(404).json({ message: "user not found" });
-		})
-		.catch((err) => {
-			console.error("error", err);
-			res.status(500).json({ message: err.message || "internal server error" });
-		});
-};
-
-const isAuth = (req: Request, res: Response) => {
-	const authHeader = req.get("Authorization") || "";
-	// Each branch returns: without the returns a missing header still fell
-	// through to `at(headerParts, 1)`, which throws on a one-element array, and
-	// a failed verify sent a 500 followed by a 401 on the same response.
-	if (!authHeader) {
-		return res.status(401).json({ message: "not authenticated" });
-	}
-
-	const headerParts = authHeader.split(" ");
-	if (headerParts.length < 2) {
-		return res.status(401).json({ message: "not authenticated" });
-	}
-
-	const token = at(headerParts, 1);
-	// "Bearer " with nothing after it is a malformed credential, not a server
-	// fault: jwt.verify("") throws and would otherwise surface as a 500.
-	if (!token) {
-		return res.status(401).json({ message: "not authenticated" });
-	}
-
-	let decodedToken: string | JwtPayload = "";
-	try {
-		decodedToken = jwt.verify(token, "secret");
-	} catch (err) {
-		return res.status(500).json({
-			message: (err as Error).message || "could not decode the token",
-		});
-	}
-
-	if (!decodedToken) {
-		return res.status(401).json({ message: "unauthorized" });
-	}
-	return res.status(200).json({ message: "here is your resource" });
-};
-
-export { signup, login, isAuth };

package/src/models/user.ts

@@ -1,45 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-import mongoose, { Schema } from "mongoose";
-
-export interface UserInterface {
-	id: number;
-	email: string;
-	name: string;
-	password: string;
-	salt: string;
-}
-
-const UserSchema = new Schema<UserInterface>({
-	email: {
-		type: mongoose.SchemaTypes.String,
-		required: true,
-	},
-	name: {
-		type: mongoose.SchemaTypes.String,
-	},
-	password: {
-		type: mongoose.SchemaTypes.String,
-		required: true,
-	},
-	id: {
-		type: mongoose.SchemaTypes.Number,
-	},
-	salt: {
-		type: mongoose.SchemaTypes.String,
-		required: true,
-	},
-});
-
-export default UserSchema;