@qlever-llc/trellis 0.7.0-rc.5 → 0.7.0

package/script/js/packages/trellis/auth/browser.js

@@ -0,0 +1,52 @@
+"use strict";
+/**
+ * @module
+ * Browser-based authentication utilities for session-key based authentication.
+ * Uses WebCrypto API and IndexedDB for secure key storage.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.base64urlEncode = exports.base64urlDecode = exports.SentinelCredsSchema = exports.NatsAuthTokenV1Schema = exports.ContractApprovalSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.ApprovalDecisionSchema = exports.AuthStartResponseSchema = exports.AuthStartRequestSchema = exports.AuthStartFlowResponseSchema = exports.hasKeyPair = exports.deleteKeyPair = exports.signBytes = exports.natsConnectSigForBindingToken = exports.loadSessionKey = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.createRpcProof = exports.clearSessionKey = exports.bindFlowSig = exports.submitPortalApproval = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.fetchPortalFlowState = exports.isBindSuccessResponse = exports.buildLoginUrl = exports.bindSession = exports.bindFlow = exports.startAuthRequest = void 0;
+var login_ts_1 = require("./browser/login.js");
+Object.defineProperty(exports, "startAuthRequest", { enumerable: true, get: function () { return login_ts_1.startAuthRequest; } });
+Object.defineProperty(exports, "bindFlow", { enumerable: true, get: function () { return login_ts_1.bindFlow; } });
+Object.defineProperty(exports, "bindSession", { enumerable: true, get: function () { return login_ts_1.bindSession; } });
+Object.defineProperty(exports, "buildLoginUrl", { enumerable: true, get: function () { return login_ts_1.buildLoginUrl; } });
+Object.defineProperty(exports, "isBindSuccessResponse", { enumerable: true, get: function () { return login_ts_1.isBindSuccessResponse; } });
+var portal_ts_1 = require("./browser/portal.js");
+Object.defineProperty(exports, "fetchPortalFlowState", { enumerable: true, get: function () { return portal_ts_1.fetchPortalFlowState; } });
+Object.defineProperty(exports, "portalFlowIdFromUrl", { enumerable: true, get: function () { return portal_ts_1.portalFlowIdFromUrl; } });
+Object.defineProperty(exports, "portalProviderLoginUrl", { enumerable: true, get: function () { return portal_ts_1.portalProviderLoginUrl; } });
+Object.defineProperty(exports, "portalRedirectLocation", { enumerable: true, get: function () { return portal_ts_1.portalRedirectLocation; } });
+Object.defineProperty(exports, "submitPortalApproval", { enumerable: true, get: function () { return portal_ts_1.submitPortalApproval; } });
+var session_ts_1 = require("./browser/session.js");
+Object.defineProperty(exports, "bindFlowSig", { enumerable: true, get: function () { return session_ts_1.bindFlowSig; } });
+Object.defineProperty(exports, "clearSessionKey", { enumerable: true, get: function () { return session_ts_1.clearSessionKey; } });
+Object.defineProperty(exports, "createRpcProof", { enumerable: true, get: function () { return session_ts_1.createRpcProof; } });
+Object.defineProperty(exports, "generateSessionKey", { enumerable: true, get: function () { return session_ts_1.generateSessionKey; } });
+Object.defineProperty(exports, "getOrCreateSessionKey", { enumerable: true, get: function () { return session_ts_1.getOrCreateSessionKey; } });
+Object.defineProperty(exports, "getPublicSessionKey", { enumerable: true, get: function () { return session_ts_1.getPublicSessionKey; } });
+Object.defineProperty(exports, "hasSessionKey", { enumerable: true, get: function () { return session_ts_1.hasSessionKey; } });
+Object.defineProperty(exports, "loadSessionKey", { enumerable: true, get: function () { return session_ts_1.loadSessionKey; } });
+Object.defineProperty(exports, "natsConnectSigForBindingToken", { enumerable: true, get: function () { return session_ts_1.natsConnectSigForBindingToken; } });
+Object.defineProperty(exports, "signBytes", { enumerable: true, get: function () { return session_ts_1.signBytes; } });
+var storage_ts_1 = require("./browser/storage.js");
+Object.defineProperty(exports, "deleteKeyPair", { enumerable: true, get: function () { return storage_ts_1.deleteKeyPair; } });
+Object.defineProperty(exports, "hasKeyPair", { enumerable: true, get: function () { return storage_ts_1.hasKeyPair; } });
+var schemas_ts_1 = require("./schemas.js");
+Object.defineProperty(exports, "AuthStartFlowResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.AuthStartFlowResponseSchema; } });
+Object.defineProperty(exports, "AuthStartRequestSchema", { enumerable: true, get: function () { return schemas_ts_1.AuthStartRequestSchema; } });
+Object.defineProperty(exports, "AuthStartResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.AuthStartResponseSchema; } });
+Object.defineProperty(exports, "ApprovalDecisionSchema", { enumerable: true, get: function () { return schemas_ts_1.ApprovalDecisionSchema; } });
+Object.defineProperty(exports, "BindResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindResponseSchema; } });
+Object.defineProperty(exports, "BindSuccessResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindSuccessResponseSchema; } });
+Object.defineProperty(exports, "ClientTransportEndpointsSchema", { enumerable: true, get: function () { return schemas_ts_1.ClientTransportEndpointsSchema; } });
+Object.defineProperty(exports, "ClientTransportsSchema", { enumerable: true, get: function () { return schemas_ts_1.ClientTransportsSchema; } });
+Object.defineProperty(exports, "ContractApprovalSchema", { enumerable: true, get: function () { return schemas_ts_1.ContractApprovalSchema; } });
+Object.defineProperty(exports, "NatsAuthTokenV1Schema", { enumerable: true, get: function () { return schemas_ts_1.NatsAuthTokenV1Schema; } });
+Object.defineProperty(exports, "SentinelCredsSchema", { enumerable: true, get: function () { return schemas_ts_1.SentinelCredsSchema; } });
+var utils_ts_1 = require("./utils.js");
+Object.defineProperty(exports, "base64urlDecode", { enumerable: true, get: function () { return utils_ts_1.base64urlDecode; } });
+Object.defineProperty(exports, "base64urlEncode", { enumerable: true, get: function () { return utils_ts_1.base64urlEncode; } });
+Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return utils_ts_1.sha256; } });
+Object.defineProperty(exports, "toArrayBuffer", { enumerable: true, get: function () { return utils_ts_1.toArrayBuffer; } });
+Object.defineProperty(exports, "utf8", { enumerable: true, get: function () { return utils_ts_1.utf8; } });

package/script/js/packages/trellis/auth/device_activation.d.ts

@@ -0,0 +1,206 @@
+import type { StaticDecode } from "typebox";
+import { Type } from "typebox";
+import type { NatsAuthTokenV1 } from "./schemas.ts";
+import { AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, WaitForDeviceActivationResponseSchema } from "./protocol.ts";
+export declare const DeviceActivationPayloadSchema: Type.TObject<{
+    v: Type.TLiteral<1>;
+    publicIdentityKey: Type.TString;
+    nonce: Type.TString;
+    qrMac: Type.TString;
+}>;
+export declare const DeviceActivationWaitRequestSchema: Type.TObject<{
+    publicIdentityKey: Type.TString;
+    nonce: Type.TString;
+    contractDigest: Type.TOptional<Type.TString>;
+    iat: Type.TNumber;
+    sig: Type.TString;
+}>;
+export type DeviceActivationPayload = StaticDecode<typeof DeviceActivationPayloadSchema>;
+export type DeviceActivationWaitRequest = StaticDecode<typeof DeviceActivationWaitRequestSchema>;
+export type WaitForDeviceActivationResponse = StaticDecode<typeof WaitForDeviceActivationResponseSchema>;
+export type AuthActivateDeviceInput = StaticDecode<typeof AuthActivateDeviceSchema>;
+export type AuthActivateDeviceOutput = StaticDecode<typeof AuthActivateDeviceResponseSchema>;
+export type AuthGetDeviceActivationStatusInput = StaticDecode<typeof AuthGetDeviceActivationStatusSchema>;
+export type AuthGetDeviceActivationStatusOutput = StaticDecode<typeof AuthGetDeviceActivationStatusResponseSchema>;
+export type AuthListDeviceActivationsInput = StaticDecode<typeof AuthListDeviceActivationsSchema>;
+export type AuthListDeviceActivationsOutput = StaticDecode<typeof AuthListDeviceActivationsResponseSchema>;
+export type AuthRevokeDeviceActivationInput = StaticDecode<typeof AuthRevokeDeviceActivationSchema>;
+export type AuthRevokeDeviceActivationResponse = StaticDecode<typeof AuthRevokeDeviceActivationResponseSchema>;
+export type GetDeviceConnectInfoInput = StaticDecode<typeof AuthGetDeviceConnectInfoSchema>;
+export type GetDeviceConnectInfoOutput = StaticDecode<typeof AuthGetDeviceConnectInfoResponseSchema>;
+export type DeviceIdentity = {
+    identitySeed: Uint8Array;
+    identitySeedBase64url: string;
+    publicIdentityKey: string;
+    activationKey: Uint8Array;
+    activationKeyBase64url: string;
+};
+type DeviceActivationRpcMethod = "Auth.ActivateDevice" | "Auth.GetDeviceActivationStatus" | "Auth.ListDeviceActivations" | "Auth.RevokeDeviceActivation" | "Auth.GetDeviceConnectInfo";
+type DeviceActivationRpcInputMap = {
+    "Auth.ActivateDevice": AuthActivateDeviceInput;
+    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusInput;
+    "Auth.ListDeviceActivations": AuthListDeviceActivationsInput;
+    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationInput;
+    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoInput;
+};
+type DeviceActivationRpcOutputMap = {
+    "Auth.ActivateDevice": AuthActivateDeviceOutput;
+    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusOutput;
+    "Auth.ListDeviceActivations": AuthListDeviceActivationsOutput;
+    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationResponse;
+    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoOutput;
+};
+type RequestClient = {
+    requestOrThrow<M extends DeviceActivationRpcMethod>(method: M, input: DeviceActivationRpcInputMap[M], opts?: unknown): Promise<DeviceActivationRpcOutputMap[M]>;
+};
+export type DeviceActivationTransport = RequestClient;
+export declare function deriveDeviceIdentity(deviceRootSecret: Uint8Array): Promise<DeviceIdentity>;
+export declare function deriveDeviceQrMac(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<string>;
+export declare function buildDeviceActivationPayload(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<DeviceActivationPayload>;
+export declare function encodeDeviceActivationPayload(payload: DeviceActivationPayload): string;
+export declare function parseDeviceActivationPayload(value: string): DeviceActivationPayload;
+export declare function startDeviceActivationRequest(args: {
+    trellisUrl: string;
+    payload: DeviceActivationPayload;
+}): Promise<{
+    flowId: string;
+    instanceId: string;
+    profileId: string;
+    activationUrl: string;
+}>;
+export declare function deriveDeviceConfirmationCode(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<string>;
+export declare function verifyDeviceConfirmationCode(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+    confirmationCode: string;
+}): Promise<boolean>;
+export declare function buildDeviceWaitProofInput(publicIdentityKey: string, nonce: string, iat: number): Uint8Array;
+export declare function signDeviceWaitRequest(args: {
+    publicIdentityKey: string;
+    nonce: string;
+    identitySeed: Uint8Array | string;
+    contractDigest?: string;
+    iat?: number;
+}): Promise<DeviceActivationWaitRequest>;
+export declare function createDeviceNatsAuthToken(args: {
+    publicIdentityKey: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    iat?: number;
+}): Promise<NatsAuthTokenV1 & {
+    contractDigest: string;
+}>;
+export declare function waitForDeviceActivation(args: {
+    trellisUrl: string;
+    publicIdentityKey: string;
+    nonce: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    signal?: AbortSignal;
+    pollIntervalMs?: number;
+}): Promise<Extract<WaitForDeviceActivationResponse, {
+    status: "activated";
+}>>;
+export declare function getDeviceConnectInfo(args: {
+    trellisUrl: string;
+    publicIdentityKey: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    iat?: number;
+}): Promise<GetDeviceConnectInfoOutput>;
+export declare function createDeviceActivationClient(client: DeviceActivationTransport): {
+    activateDevice(input: AuthActivateDeviceInput): Promise<{
+        confirmationCode?: string | undefined;
+        status: "activated";
+        profileId: string;
+        instanceId: string;
+        activatedAt: string;
+    } | {
+        status: "pending_review";
+        profileId: string;
+        instanceId: string;
+        reviewId: string;
+        linkRequestId: string;
+        requestedAt: string;
+    } | {
+        reason?: string | undefined;
+        status: "rejected";
+    }>;
+    getDeviceActivationStatus(input: AuthGetDeviceActivationStatusInput): Promise<{
+        confirmationCode?: string | undefined;
+        status: "activated";
+        profileId: string;
+        instanceId: string;
+        activatedAt: string;
+    } | {
+        status: "pending_review";
+        profileId: string;
+        instanceId: string;
+        reviewId: string;
+        linkRequestId: string;
+        requestedAt: string;
+    } | {
+        reason?: string | undefined;
+        status: "rejected";
+    }>;
+    listDeviceActivations(input?: AuthListDeviceActivationsInput): Promise<{
+        activations: {
+            activatedBy?: {
+                origin: string;
+                id: string;
+            } | undefined;
+            profileId: string;
+            instanceId: string;
+            publicIdentityKey: string;
+            state: "activated" | "revoked";
+            activatedAt: string;
+            revokedAt: string | null;
+        }[];
+    }>;
+    revokeDeviceActivation(input: AuthRevokeDeviceActivationInput): Promise<{
+        success: boolean;
+    }>;
+    getDeviceConnectInfo(input: GetDeviceConnectInfoInput): Promise<{
+        status: "ready";
+        connectInfo: {
+            contractDigest: string;
+            contractId: string;
+            transports: {
+                native?: {
+                    natsServers: string[];
+                } | undefined;
+                websocket?: {
+                    natsServers: string[];
+                } | undefined;
+            };
+            profileId: string;
+            instanceId: string;
+            transport: {
+                sentinel: {
+                    jwt: string;
+                    seed: string;
+                };
+            };
+            auth: {
+                mode: "device_identity";
+                iatSkewSeconds: number;
+            };
+        };
+    }>;
+};
+export declare function verifyDeviceWaitSignature(input: DeviceActivationWaitRequest): Promise<boolean>;
+export {};
+//# sourceMappingURL=device_activation.d.ts.map

package/script/js/packages/trellis/auth/device_activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device_activation.d.ts","sourceRoot":"","sources":["../../../../../../auth/device_activation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAQ/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,2CAA2C,EAC3C,mCAAmC,EACnC,sCAAsC,EACtC,8BAA8B,EAC9B,uCAAuC,EACvC,+BAA+B,EAC/B,wCAAwC,EACxC,gCAAgC,EAChC,qCAAqC,EACtC,MAAM,eAAe,CAAC;AAgBvB,eAAO,MAAM,6BAA6B;;;;;EAKP,CAAC;AAEpC,eAAO,MAAM,iCAAiC;;;;;;EAMX,CAAC;AAEpC,MAAM,MAAM,uBAAuB,GAAG,YAAY,CAChD,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,YAAY,CACpD,OAAO,iCAAiC,CACzC,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,qCAAqC,CAC7C,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,YAAY,CAChD,OAAO,wBAAwB,CAChC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,YAAY,CAC3D,OAAO,mCAAmC,CAC3C,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,YAAY,CAC5D,OAAO,2CAA2C,CACnD,CAAC;AACF,MAAM,MAAM,8BAA8B,GAAG,YAAY,CACvD,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,YAAY,CAC3D,OAAO,wCAAwC,CAChD,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,YAAY,CAClD,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,YAAY,CACnD,OAAO,sCAAsC,CAC9C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,UAAU,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,UAAU,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,yBAAyB,GAC1B,qBAAqB,GACrB,gCAAgC,GAChC,4BAA4B,GAC5B,6BAA6B,GAC7B,2BAA2B,CAAC;AAEhC,KAAK,2BAA2B,GAAG;IACjC,qBAAqB,EAAE,uBAAuB,CAAC;IAC/C,gCAAgC,EAAE,kCAAkC,CAAC;IACrE,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,6BAA6B,EAAE,+BAA+B,CAAC;IAC/D,2BAA2B,EAAE,yBAAyB,CAAC;CACxD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,qBAAqB,EAAE,wBAAwB,CAAC;IAChD,gCAAgC,EAAE,mCAAmC,CAAC;IACtE,4BAA4B,EAAE,+BAA+B,CAAC;IAC9D,6BAA6B,EAAE,kCAAkC,CAAC;IAClE,2BAA2B,EAAE,0BAA0B,CAAC;CACzD,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,cAAc,CAAC,CAAC,SAAS,yBAAyB,EAChD,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,2BAA2B,CAAC,CAAC,CAAC,EACrC,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,aAAa,CAAC;AA6HtD,wBAAsB,oBAAoB,CACxC,gBAAgB,EAAE,UAAU,GAC3B,OAAO,CAAC,cAAc,CAAC,CA8BzB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAQnC;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAER;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GACZ,uBAAuB,CAOzB;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,uBAAuB,CAAC;CAClC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B5F;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB;AAED,wBAAgB,yBAAyB,CACvC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,UAAU,CAwBZ;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA0BvC;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,eAAe,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBxD;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CACT,OAAO,CAAC,+BAA+B,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAClE,CA6CA;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA8BtC;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,yBAAyB;0BAGT,uBAAuB;;;;;;;;;;;;;;;;;qCAGZ,kCAAkC;;;;;;;;;;;;;;;;;kCAGtC,8BAA8B;;;;;;;;;;;;;;kCAG7B,+BAA+B;;;gCAGjC,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIxD;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAiBlB"}

package/script/js/packages/trellis/auth/device_activation.js

@@ -0,0 +1,357 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceActivationWaitRequestSchema = exports.DeviceActivationPayloadSchema = void 0;
+exports.deriveDeviceIdentity = deriveDeviceIdentity;
+exports.deriveDeviceQrMac = deriveDeviceQrMac;
+exports.buildDeviceActivationPayload = buildDeviceActivationPayload;
+exports.encodeDeviceActivationPayload = encodeDeviceActivationPayload;
+exports.parseDeviceActivationPayload = parseDeviceActivationPayload;
+exports.startDeviceActivationRequest = startDeviceActivationRequest;
+exports.deriveDeviceConfirmationCode = deriveDeviceConfirmationCode;
+exports.verifyDeviceConfirmationCode = verifyDeviceConfirmationCode;
+exports.buildDeviceWaitProofInput = buildDeviceWaitProofInput;
+exports.signDeviceWaitRequest = signDeviceWaitRequest;
+exports.createDeviceNatsAuthToken = createDeviceNatsAuthToken;
+exports.waitForDeviceActivation = waitForDeviceActivation;
+exports.getDeviceConnectInfo = getDeviceConnectInfo;
+exports.createDeviceActivationClient = createDeviceActivationClient;
+exports.verifyDeviceWaitSignature = verifyDeviceWaitSignature;
+const typebox_1 = require("typebox");
+const value_1 = require("typebox/value");
+const keys_ts_1 = require("./keys.js");
+const protocol_ts_1 = require("./protocol.js");
+const utils_ts_1 = require("./utils.js");
+const DEVICE_IDENTITY_HKDF_INFO = "trellis/device-identity/v1";
+const DEVICE_ACTIVATION_HKDF_INFO = "trellis/device-activate/v1";
+const DEVICE_QR_MAC_DOMAIN = "trellis-device-qr/v1";
+const DEVICE_CONFIRMATION_DOMAIN = "trellis-device-confirm/v1";
+const CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+const DEFAULT_WAIT_POLL_INTERVAL_MS = 1_000;
+exports.DeviceActivationPayloadSchema = typebox_1.Type.Object({
+    v: typebox_1.Type.Literal(1),
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    nonce: typebox_1.Type.String({ minLength: 1 }),
+    qrMac: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.DeviceActivationWaitRequestSchema = typebox_1.Type.Object({
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    nonce: typebox_1.Type.String({ minLength: 1 }),
+    contractDigest: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    iat: typebox_1.Type.Number(),
+    sig: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+function concatBytes(parts) {
+    const size = parts.reduce((total, part) => total + part.length, 0);
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const part of parts) {
+        bytes.set(part, offset);
+        offset += part.length;
+    }
+    return bytes;
+}
+function normalizeSecretBytes(value, name) {
+    if (typeof value === "string") {
+        const decoded = (0, utils_ts_1.base64urlDecode)(value);
+        if (decoded.length === 0)
+            throw new Error(`${name} must not be empty`);
+        return decoded;
+    }
+    if (value.length === 0)
+        throw new Error(`${name} must not be empty`);
+    return value;
+}
+async function hkdfSha256(inputKeyingMaterial, info, length) {
+    const key = await crypto.subtle.importKey("raw", (0, utils_ts_1.toArrayBuffer)(inputKeyingMaterial), "HKDF", false, ["deriveBits"]);
+    const derivedBits = await crypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: (0, utils_ts_1.toArrayBuffer)(new Uint8Array(0)),
+        info: (0, utils_ts_1.toArrayBuffer)((0, utils_ts_1.utf8)(info)),
+    }, key, length * 8);
+    return new Uint8Array(derivedBits);
+}
+async function hmacSha256(keyBytes, data) {
+    const key = await crypto.subtle.importKey("raw", (0, utils_ts_1.toArrayBuffer)(keyBytes), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return new Uint8Array(await crypto.subtle.sign("HMAC", key, (0, utils_ts_1.toArrayBuffer)(data)));
+}
+function crockfordEncode(bytes) {
+    let value = 0;
+    let bits = 0;
+    let output = "";
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            output += CROCKFORD_ALPHABET[(value >>> bits) & 31] ?? "0";
+        }
+    }
+    if (bits > 0) {
+        output += CROCKFORD_ALPHABET[(value << (5 - bits)) & 31] ?? "0";
+    }
+    return output;
+}
+function normalizeCrockford(value) {
+    return value.trim().toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1");
+}
+async function sleep(ms, signal) {
+    if (signal?.aborted) {
+        throw signal.reason ?? new DOMException("Aborted", "AbortError");
+    }
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+async function responseErrorDetail(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed.reason === "string" && parsed.reason.length > 0) {
+            return parsed.reason;
+        }
+        if (typeof parsed.message === "string" && parsed.message.length > 0) {
+            return parsed.message;
+        }
+    }
+    catch {
+        // Fall through to raw text below.
+    }
+    return text;
+}
+async function deriveDeviceIdentity(deviceRootSecret) {
+    if (deviceRootSecret.length !== 32) {
+        throw new Error(`Invalid device root secret length: ${deviceRootSecret.length} (expected 32)`);
+    }
+    const identitySeed = await hkdfSha256(deviceRootSecret, DEVICE_IDENTITY_HKDF_INFO, 32);
+    const activationKey = await hkdfSha256(deviceRootSecret, DEVICE_ACTIVATION_HKDF_INFO, 32);
+    const identitySeedBase64url = (0, utils_ts_1.base64urlEncode)(identitySeed);
+    const identityPrivateKey = await (0, keys_ts_1.importEd25519PrivateKeyFromSeedBase64url)(identitySeedBase64url);
+    const publicIdentityKey = await (0, keys_ts_1.publicKeyBase64urlFromPrivateKey)(identityPrivateKey);
+    return {
+        identitySeed,
+        identitySeedBase64url,
+        publicIdentityKey,
+        activationKey,
+        activationKeyBase64url: (0, utils_ts_1.base64urlEncode)(activationKey),
+    };
+}
+async function deriveDeviceQrMac(input) {
+    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
+    const mac = await hmacSha256(activationKey, concatBytes([
+        (0, utils_ts_1.utf8)(DEVICE_QR_MAC_DOMAIN),
+        (0, utils_ts_1.utf8)(input.publicIdentityKey),
+        (0, utils_ts_1.utf8)(input.nonce),
+    ]));
+    return (0, utils_ts_1.base64urlEncode)(mac.slice(0, 8));
+}
+async function buildDeviceActivationPayload(input) {
+    const qrMac = await deriveDeviceQrMac(input);
+    return {
+        v: 1,
+        publicIdentityKey: input.publicIdentityKey,
+        nonce: input.nonce,
+        qrMac,
+    };
+}
+function encodeDeviceActivationPayload(payload) {
+    return (0, utils_ts_1.base64urlEncode)((0, utils_ts_1.utf8)(JSON.stringify(payload)));
+}
+function parseDeviceActivationPayload(value) {
+    const decoded = new TextDecoder().decode((0, utils_ts_1.base64urlDecode)(value));
+    const parsed = JSON.parse(decoded);
+    if (!value_1.Value.Check(exports.DeviceActivationPayloadSchema, parsed)) {
+        throw new Error("Invalid device activation payload");
+    }
+    return parsed;
+}
+async function startDeviceActivationRequest(args) {
+    const response = await fetch(new URL("/auth/devices/activate/requests", args.trellisUrl), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ payload: args.payload }),
+    });
+    if (!response.ok) {
+        const detail = await responseErrorDetail(response);
+        throw new Error(`Device activation request failed: ${response.status}${detail ? ` ${detail}` : ""}`);
+    }
+    const parsed = await response.json();
+    if (typeof parsed.flowId !== "string" || typeof parsed.instanceId !== "string" ||
+        typeof parsed.profileId !== "string" || typeof parsed.activationUrl !== "string") {
+        throw new Error("Device activation request returned an invalid response");
+    }
+    return {
+        flowId: parsed.flowId,
+        instanceId: parsed.instanceId,
+        profileId: parsed.profileId,
+        activationUrl: parsed.activationUrl,
+    };
+}
+async function deriveDeviceConfirmationCode(input) {
+    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
+    const mac = await hmacSha256(activationKey, concatBytes([
+        (0, utils_ts_1.utf8)(DEVICE_CONFIRMATION_DOMAIN),
+        (0, utils_ts_1.utf8)(input.publicIdentityKey),
+        (0, utils_ts_1.utf8)(input.nonce),
+    ]));
+    return crockfordEncode(mac.slice(0, 5)).slice(0, 8);
+}
+async function verifyDeviceConfirmationCode(input) {
+    const expected = await deriveDeviceConfirmationCode(input);
+    return normalizeCrockford(expected) ===
+        normalizeCrockford(input.confirmationCode);
+}
+function buildDeviceWaitProofInput(publicIdentityKey, nonce, iat) {
+    const enc = new TextEncoder();
+    const publicIdentityKeyBytes = enc.encode(publicIdentityKey);
+    const nonceBytes = enc.encode(nonce);
+    const iatBytes = enc.encode(String(iat));
+    const buf = new Uint8Array(4 + publicIdentityKeyBytes.length +
+        4 + nonceBytes.length +
+        4 + iatBytes.length);
+    const view = new DataView(buf.buffer);
+    let offset = 0;
+    view.setUint32(offset, publicIdentityKeyBytes.length);
+    offset += 4;
+    buf.set(publicIdentityKeyBytes, offset);
+    offset += publicIdentityKeyBytes.length;
+    view.setUint32(offset, nonceBytes.length);
+    offset += 4;
+    buf.set(nonceBytes, offset);
+    offset += nonceBytes.length;
+    view.setUint32(offset, iatBytes.length);
+    offset += 4;
+    buf.set(iatBytes, offset);
+    return buf;
+}
+async function signDeviceWaitRequest(args) {
+    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
+    const identityPrivateKey = await (0, keys_ts_1.importEd25519PrivateKeyFromSeedBase64url)((0, utils_ts_1.base64urlEncode)(identitySeed));
+    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
+    const proofInput = buildDeviceWaitProofInput(args.publicIdentityKey, args.nonce, iat);
+    const proofHash = await (0, utils_ts_1.sha256)(proofInput);
+    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, (0, utils_ts_1.toArrayBuffer)(proofHash)));
+    return {
+        publicIdentityKey: args.publicIdentityKey,
+        nonce: args.nonce,
+        ...(args.contractDigest ? { contractDigest: args.contractDigest } : {}),
+        iat,
+        sig: (0, utils_ts_1.base64urlEncode)(signature),
+    };
+}
+async function createDeviceNatsAuthToken(args) {
+    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
+    const identityPrivateKey = await (0, keys_ts_1.importEd25519PrivateKeyFromSeedBase64url)((0, utils_ts_1.base64urlEncode)(identitySeed));
+    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
+    const digest = await crypto.subtle.digest("SHA-256", (0, utils_ts_1.toArrayBuffer)((0, utils_ts_1.utf8)(`nats-connect:${iat}`)));
+    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, digest));
+    return {
+        v: 1,
+        sessionKey: args.publicIdentityKey,
+        iat,
+        sig: (0, utils_ts_1.base64urlEncode)(signature),
+        contractDigest: args.contractDigest,
+    };
+}
+async function waitForDeviceActivation(args) {
+    const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_WAIT_POLL_INTERVAL_MS;
+    while (true) {
+        const request = await signDeviceWaitRequest(args);
+        let response;
+        try {
+            response = await fetch(new URL("/auth/devices/activate/wait", args.trellisUrl), {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify(request),
+                signal: args.signal,
+            });
+        }
+        catch (error) {
+            if (args.signal?.aborted) {
+                throw error;
+            }
+            await sleep(pollIntervalMs, args.signal);
+            continue;
+        }
+        if (!response.ok) {
+            const detail = await responseErrorDetail(response);
+            throw new Error(detail
+                ? `device activation wait failed: ${response.status} ${detail}`
+                : `device activation wait failed: ${response.status}`);
+        }
+        const body = await response.json();
+        if (!value_1.Value.Check(protocol_ts_1.WaitForDeviceActivationResponseSchema, body)) {
+            throw new Error("Invalid device activation wait response");
+        }
+        if (body.status === "pending") {
+            await sleep(pollIntervalMs, args.signal);
+            continue;
+        }
+        if (body.status === "rejected") {
+            throw new Error(`device activation rejected: ${body.reason ?? "unknown_reason"}`);
+        }
+        return body;
+    }
+}
+async function getDeviceConnectInfo(args) {
+    const request = await signDeviceWaitRequest({
+        publicIdentityKey: args.publicIdentityKey,
+        identitySeed: args.identitySeed,
+        contractDigest: args.contractDigest,
+        nonce: "connect-info",
+        iat: args.iat,
+    });
+    const payload = {
+        publicIdentityKey: request.publicIdentityKey,
+        contractDigest: args.contractDigest,
+        iat: request.iat,
+        sig: request.sig,
+    };
+    const response = await fetch(new URL("/auth/devices/connect-info", args.trellisUrl), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+    });
+    if (!response.ok) {
+        throw new Error(`device connect info failed: ${response.status}`);
+    }
+    const body = await response.json();
+    if (!value_1.Value.Check(protocol_ts_1.AuthGetDeviceConnectInfoResponseSchema, body)) {
+        throw new Error("Invalid device connect info response");
+    }
+    return body;
+}
+function createDeviceActivationClient(client) {
+    return {
+        activateDevice(input) {
+            return client.requestOrThrow("Auth.ActivateDevice", input);
+        },
+        getDeviceActivationStatus(input) {
+            return client.requestOrThrow("Auth.GetDeviceActivationStatus", input);
+        },
+        listDeviceActivations(input = {}) {
+            return client.requestOrThrow("Auth.ListDeviceActivations", input);
+        },
+        revokeDeviceActivation(input) {
+            return client.requestOrThrow("Auth.RevokeDeviceActivation", input);
+        },
+        getDeviceConnectInfo(input) {
+            return client.requestOrThrow("Auth.GetDeviceConnectInfo", input);
+        },
+    };
+}
+async function verifyDeviceWaitSignature(input) {
+    const publicKey = await (0, keys_ts_1.importEd25519PublicKeyFromBase64url)(input.publicIdentityKey);
+    const proofHash = await (0, utils_ts_1.sha256)(buildDeviceWaitProofInput(input.publicIdentityKey, input.nonce, input.iat));
+    return await crypto.subtle.verify("Ed25519", publicKey, (0, utils_ts_1.toArrayBuffer)((0, utils_ts_1.base64urlDecode)(input.sig)), (0, utils_ts_1.toArrayBuffer)(proofHash));
+}

package/script/js/packages/trellis/auth/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../auth/keys.ts"],"names":[],"mappings":"AAqBA,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAQnE;AAED,wBAAsB,wCAAwC,CAC5D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAapB;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,mCAAmC,CACvD,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,SAAS,CAAC,CAYpB"}