@prosopo/provider 4.15.14 → 4.15.15

package/dist/cjs/api/captcha.cjs

@@ -1,63 +1,84 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const apiExpressRouter = require("@prosopo/api-express-router");
-const types = require("@prosopo/types");
-const express = require("express");
-const checkSpamEmail = require("./captcha/checkSpamEmail.cjs");
-require("./captcha/getFrictionlessCaptchaChallenge.cjs");
-const getImageCaptchaChallenge = require("./captcha/getImageCaptchaChallenge.cjs");
-const getPoWCaptchaChallenge = require("./captcha/getPoWCaptchaChallenge.cjs");
-const getPuzzleCaptchaChallenge = require("./captcha/getPuzzleCaptchaChallenge.cjs");
-const submitImageCaptchaSolution = require("./captcha/submitImageCaptchaSolution.cjs");
-const submitPoWCaptchaSolution = require("./captcha/submitPoWCaptchaSolution.cjs");
-const submitPuzzleCaptchaSolution = require("./captcha/submitPuzzleCaptchaSolution.cjs");
-const handler = require("./captcha/getFrictionlessCaptchaChallenge/handler.cjs");
-const asyncHandler = (handler2) => (req, res, next) => {
-  Promise.resolve().then(() => handler2(req, res, next)).catch(next);
+const require_runtime = require("../_virtual/_rolldown/runtime.cjs");
+const require_checkSpamEmail = require("./captcha/checkSpamEmail.cjs");
+const require_handler = require("./captcha/getFrictionlessCaptchaChallenge/handler.cjs");
+const require_getImageCaptchaChallenge = require("./captcha/getImageCaptchaChallenge.cjs");
+const require_getPoWCaptchaChallenge = require("./captcha/getPoWCaptchaChallenge.cjs");
+const require_getPuzzleCaptchaChallenge = require("./captcha/getPuzzleCaptchaChallenge.cjs");
+const require_submitImageCaptchaSolution = require("./captcha/submitImageCaptchaSolution.cjs");
+const require_submitPoWCaptchaSolution = require("./captcha/submitPoWCaptchaSolution.cjs");
+const require_submitPuzzleCaptchaSolution = require("./captcha/submitPuzzleCaptchaSolution.cjs");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
+let express = require("express");
+express = require_runtime.__toESM(express, 1);
+//#region src/api/captcha.ts
+/**
+* Wraps an async route handler so that any rejection - including synchronous
+* throws (e.g. from validateSiteKey/validateAddr) that become rejected
+* promises inside the async handler - is forwarded to Express's error handler.
+* Without this, Express 4 does not observe the rejection and the request hangs
+* instead of returning the intended 4xx response.
+*
+* The handler is invoked inside `Promise.resolve().then(...)` so that even a
+* truly synchronous throw (from a non-async handler) is captured as a rejected
+* promise and forwarded to `next`, rather than propagating synchronously.
+*/
+var asyncHandler = (handler) => (req, res, next) => {
+	Promise.resolve().then(() => handler(req, res, next)).catch(next);
 };
+/**
+* Returns a router connected to the database which can interact with the Proposo protocol
+*
+* @return {Router} - A middleware router that can interact with the Prosopo protocol
+* @param {ProviderEnvironment} env - The Prosopo environment
+*/
 function prosopoRouter(env) {
-  const router = express.Router();
-  let userAccessRulesStorage;
-  try {
-    userAccessRulesStorage = env.getDb().getUserAccessRulesStorage();
-  } catch (err) {
-    env.logger.warn(() => ({
-      msg: "User access rules storage unavailable; captcha endpoints will skip access-policy checks",
-      err
-    }));
-    userAccessRulesStorage = void 0;
-  }
-  router.post(
-    types.ClientApiPaths.GetImageCaptchaChallenge,
-    asyncHandler(getImageCaptchaChallenge(env, userAccessRulesStorage))
-  );
-  router.post(
-    types.ClientApiPaths.SubmitImageCaptchaSolution,
-    asyncHandler(submitImageCaptchaSolution(env))
-  );
-  router.post(
-    types.ClientApiPaths.GetPowCaptchaChallenge,
-    asyncHandler(getPoWCaptchaChallenge(env, userAccessRulesStorage))
-  );
-  router.post(
-    types.ClientApiPaths.SubmitPowCaptchaSolution,
-    asyncHandler(submitPoWCaptchaSolution.default(env))
-  );
-  router.post(
-    types.ClientApiPaths.GetFrictionlessCaptchaChallenge,
-    asyncHandler(handler(env, userAccessRulesStorage))
-  );
-  router.post(
-    types.ClientApiPaths.GetPuzzleCaptchaChallenge,
-    asyncHandler(getPuzzleCaptchaChallenge(env, userAccessRulesStorage))
-  );
-  router.post(
-    types.ClientApiPaths.SubmitPuzzleCaptchaSolution,
-    asyncHandler(submitPuzzleCaptchaSolution(env))
-  );
-  router.post(types.ClientApiPaths.CheckSpamEmail, asyncHandler(checkSpamEmail(env)));
-  router.use(apiExpressRouter.handleErrors);
-  return router;
+	const router = express.default.Router();
+	let userAccessRulesStorage;
+	try {
+		userAccessRulesStorage = env.getDb().getUserAccessRulesStorage();
+	} catch (err) {
+		env.logger.warn(() => ({
+			msg: "User access rules storage unavailable; captcha endpoints will skip access-policy checks",
+			err
+		}));
+		userAccessRulesStorage = void 0;
+	}
+	/**
+	* Provides a Captcha puzzle to a Dapp User
+	*/
+	router.post(_prosopo_types.ClientApiPaths.GetImageCaptchaChallenge, asyncHandler(require_getImageCaptchaChallenge.default(env, userAccessRulesStorage)));
+	/**
+	* Receives solved CAPTCHA challenges from the user, stores to database, and checks against solution commitment
+	*/
+	router.post(_prosopo_types.ClientApiPaths.SubmitImageCaptchaSolution, asyncHandler(require_submitImageCaptchaSolution.default(env)));
+	/**
+	* Supplies a PoW challenge to a Dapp User
+	*/
+	router.post(_prosopo_types.ClientApiPaths.GetPowCaptchaChallenge, asyncHandler(require_getPoWCaptchaChallenge.default(env, userAccessRulesStorage)));
+	/**
+	* Verifies a user's PoW solution as being approved or not
+	*/
+	router.post(_prosopo_types.ClientApiPaths.SubmitPowCaptchaSolution, asyncHandler(require_submitPoWCaptchaSolution.default(env)));
+	/**
+	* Gets a frictionless captcha challenge
+	*/
+	router.post(_prosopo_types.ClientApiPaths.GetFrictionlessCaptchaChallenge, asyncHandler(require_handler.default(env, userAccessRulesStorage)));
+	/**
+	* Supplies a Puzzle challenge to a Dapp User
+	*/
+	router.post(_prosopo_types.ClientApiPaths.GetPuzzleCaptchaChallenge, asyncHandler(require_getPuzzleCaptchaChallenge.default(env, userAccessRulesStorage)));
+	/**
+	* Verifies a user's Puzzle solution as being approved or not
+	*/
+	router.post(_prosopo_types.ClientApiPaths.SubmitPuzzleCaptchaSolution, asyncHandler(require_submitPuzzleCaptchaSolution.default(env)));
+	/**
+	* Checks if an email domain is spam
+	*/
+	router.post(_prosopo_types.ClientApiPaths.CheckSpamEmail, asyncHandler(require_checkSpamEmail.default(env)));
+	router.use(_prosopo_api_express_router.handleErrors);
+	return router;
 }
+//#endregion
 exports.asyncHandler = asyncHandler;
 exports.prosopoRouter = prosopoRouter;

package/dist/cjs/api/dnsEventUrl.cjs

@@ -1,25 +1,24 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const node_crypto = require("node:crypto");
-const EXTENSIONS = ["gif", "png", "webp"];
-const buildDnsEventUrl = (sessionId) => {
-  const subzone = process.env.DNS_EVENT_SUBZONE;
-  const secret = process.env.DNS_EVENT_HMAC_SECRET;
-  if (!subzone || !secret) {
-    return void 0;
-  }
-  const path = derivePath(sessionId, secret);
-  const port = process.env.DNS_EVENT_PORT;
-  const host = port ? `${sessionId}.${subzone}:${port}` : `${sessionId}.${subzone}`;
-  return `https://${host}${path}?sid=${sessionId}`;
+let node_crypto = require("node:crypto");
+//#region src/api/dnsEventUrl.ts
+var EXTENSIONS = [
+	"gif",
+	"png",
+	"webp"
+];
+var buildDnsEventUrl = (sessionId) => {
+	const subzone = process.env.DNS_EVENT_SUBZONE;
+	const secret = process.env.DNS_EVENT_HMAC_SECRET;
+	if (!subzone || !secret) return;
+	const path = derivePath(sessionId, secret);
+	const port = process.env.DNS_EVENT_PORT;
+	return `https://${port ? `${sessionId}.${subzone}:${port}` : `${sessionId}.${subzone}`}${path}?sid=${sessionId}`;
 };
-const derivePath = (sessionId, secret) => {
-  const mac = node_crypto.createHmac("sha256", secret);
-  mac.update(sessionId);
-  const digest = mac.digest();
-  const name = digest.subarray(0, 8).toString("hex");
-  const ext = EXTENSIONS[(digest.at(8) ?? 0) % EXTENSIONS.length];
-  return `/${name}.${ext}`;
+var derivePath = (sessionId, secret) => {
+	const mac = (0, node_crypto.createHmac)("sha256", secret);
+	mac.update(sessionId);
+	const digest = mac.digest();
+	return `/${digest.subarray(0, 8).toString("hex")}.${EXTENSIONS[(digest.at(8) ?? 0) % EXTENSIONS.length]}`;
 };
+//#endregion
 exports.buildDnsEventUrl = buildDnsEventUrl;
 exports.derivePath = derivePath;

package/dist/cjs/api/domainMiddleware.cjs

@@ -1,124 +1,113 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const apiExpressRouter = require("@prosopo/api-express-router");
-const common = require("@prosopo/common");
-const util = require("@prosopo/util");
-const utilCrypto = require("@prosopo/util-crypto");
-const zod = require("zod");
-require("../tasks/index.cjs");
-const apiToggleMaintenanceModeEndpoint = require("./admin/apiToggleMaintenanceModeEndpoint.cjs");
-const metrics = require("./metrics.cjs");
-const testSiteKey = require("./testSiteKey.cjs");
-const tasks = require("../tasks/tasks.cjs");
-const domainMiddleware = (env) => {
-  let cachedTasks;
-  return async (req, res, next) => {
-    try {
-      if (apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-        req.logger.info(() => ({
-          msg: "Maintenance mode active - skipping domain validation"
-        }));
-        next();
-        return;
-      }
-      if (!cachedTasks) {
-        cachedTasks = new tasks.Tasks(env);
-      }
-      const tasks$1 = cachedTasks;
-      const siteKey = req.headers["prosopo-site-key"];
-      if (!siteKey)
-        throw siteKeyNotRegisteredError(
-          req.i18n,
-          "No sitekey provided",
-          req.logger
-        );
-      try {
-        utilCrypto.validateAddress(siteKey, false, 42);
-      } catch (err) {
-        throw invalidSiteKeyError(req.i18n, siteKey, req.logger);
-      }
-      if (testSiteKey.isReservedTestSiteKey(siteKey)) {
-        metrics.recordDomainValidation("test_key");
-        next();
-        return;
-      }
-      const clientSettings = await tasks$1.db.getClientRecord(siteKey);
-      if (!clientSettings)
-        throw siteKeyNotRegisteredError(req.i18n, siteKey, req.logger);
-      const allowedDomains = clientSettings.settings?.domains;
-      if (!allowedDomains)
-        throw siteKeyInvalidDomainError(
-          req.i18n,
-          siteKey,
-          req.hostname,
-          req.logger
-        );
-      const origin = req.headers.origin;
-      if (!origin)
-        throw unauthorizedOriginError(req.i18n, void 0, req.logger);
-      const candidateOrigins = [origin, ...googleTranslateOrigins(origin)];
-      for (const candidate of candidateOrigins) {
-        for (const domain of allowedDomains) {
-          if (tasks$1.clientTaskManager.domainPatternMatcher(candidate, domain)) {
-            metrics.recordDomainValidation("allowed");
-            next();
-            return;
-          }
-        }
-      }
-      throw unauthorizedOriginError(req.i18n, origin, req.logger);
-    } catch (err) {
-      metrics.recordDomainValidation("rejected");
-      if (err instanceof common.ProsopoApiError || err instanceof zod.ZodError || err instanceof SyntaxError) {
-        apiExpressRouter.handleErrors(err, req, res, next);
-      } else {
-        res.status(401).json({ error: "Unauthorized", message: err });
-        return;
-      }
-    }
-  };
+const require_metrics = require("./metrics.cjs");
+const require_tasks = require("../tasks/tasks.cjs");
+const require_apiToggleMaintenanceModeEndpoint = require("./admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("./testSiteKey.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_util = require("@prosopo/util");
+let _prosopo_util_crypto = require("@prosopo/util-crypto");
+let zod = require("zod");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
+//#region src/api/domainMiddleware.ts
+var domainMiddleware = (env) => {
+	let cachedTasks;
+	return async (req, res, next) => {
+		try {
+			if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+				req.logger.info(() => ({ msg: "Maintenance mode active - skipping domain validation" }));
+				next();
+				return;
+			}
+			if (!cachedTasks) cachedTasks = new require_tasks.Tasks(env);
+			const tasks = cachedTasks;
+			const siteKey = req.headers["prosopo-site-key"];
+			if (!siteKey) throw siteKeyNotRegisteredError(req.i18n, "No sitekey provided", req.logger);
+			try {
+				(0, _prosopo_util_crypto.validateAddress)(siteKey, false, 42);
+			} catch (err) {
+				throw invalidSiteKeyError(req.i18n, siteKey, req.logger);
+			}
+			if (require_testSiteKey.isReservedTestSiteKey(siteKey)) {
+				require_metrics.recordDomainValidation("test_key");
+				next();
+				return;
+			}
+			const clientSettings = await tasks.db.getClientRecord(siteKey);
+			if (!clientSettings) throw siteKeyNotRegisteredError(req.i18n, siteKey, req.logger);
+			const allowedDomains = clientSettings.settings?.domains;
+			if (!allowedDomains) throw siteKeyInvalidDomainError(req.i18n, siteKey, req.hostname, req.logger);
+			const origin = req.headers.origin;
+			if (!origin) throw unauthorizedOriginError(req.i18n, void 0, req.logger);
+			const candidateOrigins = [origin, ...googleTranslateOrigins(origin)];
+			for (const candidate of candidateOrigins) for (const domain of allowedDomains) if (tasks.clientTaskManager.domainPatternMatcher(candidate, domain)) {
+				require_metrics.recordDomainValidation("allowed");
+				next();
+				return;
+			}
+			throw unauthorizedOriginError(req.i18n, origin, req.logger);
+		} catch (err) {
+			require_metrics.recordDomainValidation("rejected");
+			if (err instanceof _prosopo_common.ProsopoApiError || err instanceof zod.ZodError || err instanceof SyntaxError) (0, _prosopo_api_express_router.handleErrors)(err, req, res, next);
+			else {
+				res.status(401).json({
+					error: "Unauthorized",
+					message: err
+				});
+				return;
+			}
+		}
+	};
 };
-const googleTranslateOrigins = (origin) => {
-  try {
-    const url = util.parseUrl(origin);
-    const decodedHost = util.decodeGoogleTranslateHost(url.hostname);
-    if (!decodedHost) return [];
-    return [`${url.protocol}//${decodedHost}`];
-  } catch {
-    return [];
-  }
+var googleTranslateOrigins = (origin) => {
+	try {
+		const url = (0, _prosopo_util.parseUrl)(origin);
+		const decodedHost = (0, _prosopo_util.decodeGoogleTranslateHost)(url.hostname);
+		if (!decodedHost) return [];
+		return [`${url.protocol}//${decodedHost}`];
+	} catch {
+		return [];
+	}
 };
-const siteKeyNotRegisteredError = (i18n, dapp, logger) => {
-  return new common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-    context: { code: 400, siteKey: dapp },
-    i18n,
-    logger
-  });
+var siteKeyNotRegisteredError = (i18n, dapp, logger) => {
+	return new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+		context: {
+			code: 400,
+			siteKey: dapp
+		},
+		i18n,
+		logger
+	});
 };
-const invalidSiteKeyError = (i18n, siteKey, logger) => {
-  return new common.ProsopoApiError("API.INVALID_SITE_KEY", {
-    context: { code: 400, siteKey },
-    i18n,
-    logger
-  });
+var invalidSiteKeyError = (i18n, siteKey, logger) => {
+	return new _prosopo_common.ProsopoApiError("API.INVALID_SITE_KEY", {
+		context: {
+			code: 400,
+			siteKey
+		},
+		i18n,
+		logger
+	});
 };
-const unauthorizedOriginError = (i18n, origin, logger) => {
-  return new common.ProsopoApiError("API.UNAUTHORIZED_ORIGIN_URL", {
-    context: { code: 400, origin },
-    i18n,
-    logger
-  });
+var unauthorizedOriginError = (i18n, origin, logger) => {
+	return new _prosopo_common.ProsopoApiError("API.UNAUTHORIZED_ORIGIN_URL", {
+		context: {
+			code: 400,
+			origin
+		},
+		i18n,
+		logger
+	});
 };
-const siteKeyInvalidDomainError = (i18n, dapp, domain, logger) => {
-  return new common.ProsopoApiError("API.UNAUTHORIZED_ORIGIN_URL", {
-    context: {
-      code: 400,
-      message: "No domains are allowed for this site key. Please fix in the Procaptcha Portal",
-      siteKey: dapp,
-      domain
-    },
-    i18n,
-    logger
-  });
+var siteKeyInvalidDomainError = (i18n, dapp, domain, logger) => {
+	return new _prosopo_common.ProsopoApiError("API.UNAUTHORIZED_ORIGIN_URL", {
+		context: {
+			code: 400,
+			message: "No domains are allowed for this site key. Please fix in the Procaptcha Portal",
+			siteKey: dapp,
+			domain
+		},
+		i18n,
+		logger
+	});
 };
+//#endregion
 exports.domainMiddleware = domainMiddleware;

package/dist/cjs/api/forwardVerify.cjs

@@ -1,54 +1,68 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const api = require("@prosopo/api");
-const loadBalancer = require("@prosopo/load-balancer");
+let _prosopo_api = require("@prosopo/api");
+let _prosopo_load_balancer = require("@prosopo/load-balancer");
+//#region src/api/forwardVerify.ts
+/**
+* A client can send a verify request to *any* pronode, not necessarily the
+* provider that issued the token. This determines the issuing provider from the
+* `providerUrl` embedded in the token and, when it is a *different* provider to
+* this one, forwards the verification request to it and returns its response —
+* mirroring the AWS Lambda verify endpoint, but running on a provider.
+*
+* Returns `null` when this provider is the issuer (or the issuer cannot be
+* determined), signalling the caller to verify locally as before.
+*
+* @param env - The provider environment
+* @param logger - Request-scoped logger
+* @param path - The verify path to forward to (kept identical, so the issuer
+*   routes the request to the correct captcha-type verification)
+* @param providerUrl - The issuing provider url, decoded from the token
+* @param dapp - The site key (used as the `Prosopo-Site-Key` header)
+* @param user - The user account (used as the `Prosopo-User` header)
+* @param body - The original, already-parsed request body, forwarded verbatim
+*/
 function normalizeProviderUrl(url) {
-  try {
-    const parsed = new URL(url);
-    parsed.hostname = parsed.hostname.replace(/^(ipv4|ipv6)\./, "");
-    return parsed.toString().replace(/\/$/, "");
-  } catch {
-    return url.replace(/\/$/, "");
-  }
+	try {
+		const parsed = new URL(url);
+		parsed.hostname = parsed.hostname.replace(/^(ipv4|ipv6)\./, "");
+		return parsed.toString().replace(/\/$/, "");
+	} catch {
+		return url.replace(/\/$/, "");
+	}
 }
 async function forwardVerifyIfNotIssuer(args) {
-  const { env, logger, path, providerUrl, dapp, user, body, alreadyForwarded } = args;
-  if (alreadyForwarded) {
-    return null;
-  }
-  if (!providerUrl) {
-    return null;
-  }
-  let providers;
-  try {
-    providers = await loadBalancer.getProviders(env.defaultEnvironment);
-  } catch (error) {
-    logger.warn(() => ({
-      msg: "Failed to load provider list; verifying locally",
-      err: error instanceof Error ? error : new Error(String(error)),
-      data: { providerUrl }
-    }));
-    return null;
-  }
-  const normalizedProviderUrl = normalizeProviderUrl(providerUrl);
-  const issuer = providers.find(
-    (provider) => normalizeProviderUrl(provider.url) === normalizedProviderUrl
-  );
-  if (!issuer) {
-    logger.warn(() => ({
-      msg: "Token providerUrl is not a known provider; verifying locally",
-      data: { providerUrl }
-    }));
-    return null;
-  }
-  if (env.pair?.address && issuer.address === env.pair.address) {
-    return null;
-  }
-  logger.info(() => ({
-    msg: "Forwarding verify request to issuing provider",
-    data: { providerUrl, path, dapp }
-  }));
-  const providerApi = new api.ProviderApi(issuer.url, dapp);
-  return providerApi.forwardVerify(path, body, user);
+	const { env, logger, path, providerUrl, dapp, user, body, alreadyForwarded } = args;
+	if (alreadyForwarded) return null;
+	if (!providerUrl) return null;
+	let providers;
+	try {
+		providers = await (0, _prosopo_load_balancer.getProviders)(env.defaultEnvironment);
+	} catch (error) {
+		logger.warn(() => ({
+			msg: "Failed to load provider list; verifying locally",
+			err: error instanceof Error ? error : new Error(String(error)),
+			data: { providerUrl }
+		}));
+		return null;
+	}
+	const normalizedProviderUrl = normalizeProviderUrl(providerUrl);
+	const issuer = providers.find((provider) => normalizeProviderUrl(provider.url) === normalizedProviderUrl);
+	if (!issuer) {
+		logger.warn(() => ({
+			msg: "Token providerUrl is not a known provider; verifying locally",
+			data: { providerUrl }
+		}));
+		return null;
+	}
+	if (env.pair?.address && issuer.address === env.pair.address) return null;
+	logger.info(() => ({
+		msg: "Forwarding verify request to issuing provider",
+		data: {
+			providerUrl,
+			path,
+			dapp
+		}
+	}));
+	return new _prosopo_api.ProviderApi(issuer.url, dapp).forwardVerify(path, body, user);
 }
+//#endregion
 exports.forwardVerifyIfNotIssuer = forwardVerifyIfNotIssuer;