@rhinestone/1auth 0.7.1 → 0.7.3

package/dist/index.mjs

@@ -8,7 +8,12 @@ import {
 } from "./chunk-IHBVEU33.mjs";
 import {
   createOneAuthProvider
-} from "./chunk-THKG3FAG.mjs";
+} from "./chunk-UXBBB7AV.mjs";
+import {
+  buildTransactionReview,
+  encodeWebAuthnSignature,
+  hashCalls
+} from "./chunk-N6KE5CII.mjs";
 import {
   getAllSupportedChainsAndTokens,
   getChainById,
@@ -26,11 +31,6 @@ import {
   isTokenAddressSupported,
   resolveTokenAddress
 } from "./chunk-GUAI55LL.mjs";
-import {
-  buildTransactionReview,
-  encodeWebAuthnSignature,
-  hashCalls
-} from "./chunk-N6KE5CII.mjs";
 
 // src/client.ts
 import { hashTypedData } from "viem";
@@ -163,7 +163,7 @@ var POPUP_WIDTH = LOADING_MODAL_WIDTH;
 var POPUP_HEIGHT = 600;
 var DEFAULT_EMBED_WIDTH = `${LOADING_MODAL_WIDTH}px`;
 var DEFAULT_EMBED_HEIGHT = "500px";
-var DEFAULT_PROVIDER_URL = "https://passkey.1auth.box";
+var DEFAULT_PROVIDER_URL = "https://passkey.1auth.app";
 function currentWindowOrigin() {
   if (typeof window === "undefined") return null;
   const origin = window.location?.origin;
@@ -619,7 +619,7 @@ var OneAuthClient = class {
    * Falls back to the raw dialog URL string if URL parsing fails (e.g. during
    * unit tests with non-standard URL formats).
    *
-   * @returns The scheme + host + optional port of the dialog app (e.g. `"https://passkey.1auth.box"`).
+   * @returns The scheme + host + optional port of the dialog app (e.g. `"https://passkey.1auth.app"`).
    */
   getDialogOrigin() {
     const dialogUrl = this.getDialogUrl();
@@ -1670,7 +1670,7 @@ var OneAuthClient = class {
       };
       const handleMessage = (event) => {
         if (event.origin !== dialogOrigin) return;
-        if (event.data?.type === "PASSKEY_CLOSE") {
+        if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           resolveClosed(iframeReadyObserved);
         }
       };
@@ -2369,7 +2369,7 @@ var OneAuthClient = class {
       const dialogOrigin2 = this.getDialogOrigin();
       const earlyCloseHandler = (event) => {
         if (event.origin !== dialogOrigin2) return;
-        if (event.data?.type === "PASSKEY_CLOSE") {
+        if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           userClosedEarly = true;
           cleanup();
         }
@@ -2984,7 +2984,7 @@ var OneAuthClient = class {
    * @param cleanup - Idempotent teardown function that closes and removes the dialog.
    * @returns A `SigningResult` discriminated union.
    */
-  waitForIntentSigningResponse(requestId, dialog, _iframe, cleanup) {
+  waitForIntentSigningResponse(requestId, dialog, iframe, cleanup) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       const handleMessage = (event) => {
@@ -3010,7 +3010,7 @@ var OneAuthClient = class {
               }
             });
           }
-        } else if (message?.type === "PASSKEY_CLOSE") {
+        } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           window.removeEventListener("message", handleMessage);
           cleanup();
           resolve({
@@ -3041,12 +3041,13 @@ var OneAuthClient = class {
    *     forward to the execute endpoint.
    *
    * @param dialog - The `<dialog>` element wrapping the signing iframe.
-   * @param _iframe - Unused; kept for signature consistency with other wait helpers.
+   * @param iframe - The signing iframe; used to authenticate the source of
+   *   `PASSKEY_CLOSE` so a sibling same-origin dialog can't forge a rejection.
    * @param cleanup - Idempotent teardown that closes and removes the dialog.
    * @returns A `SigningResult` extended with an optional `signedHash` field
    *   populated when the dialog performs message signing.
    */
-  waitForSigningResponse(dialog, _iframe, cleanup) {
+  waitForSigningResponse(dialog, iframe, cleanup) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       const handleMessage = (event) => {
@@ -3077,7 +3078,7 @@ var OneAuthClient = class {
               }
             });
           }
-        } else if (message?.type === "PASSKEY_CLOSE") {
+        } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           window.removeEventListener("message", handleMessage);
           cleanup();
           resolve({
@@ -3160,7 +3161,7 @@ var OneAuthClient = class {
               }
             });
           }
-        } else if (message?.type === "PASSKEY_CLOSE") {
+        } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           window.removeEventListener("message", handleMessage);
           cleanup();
           resolve({
@@ -3410,7 +3411,7 @@ var OneAuthClient = class {
               );
             }
           });
-        } else if (event.data?.type === "PASSKEY_CLOSE") {
+        } else if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           teardown();
           cleanup();
           resolve({ ready: false });
@@ -4433,7 +4434,7 @@ var OneAuthClient = class {
             blindSigning
           }, dialogOrigin);
           resolve(true);
-        } else if (event.data?.type === "PASSKEY_CLOSE") {
+        } else if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           teardown();
           cleanup();
           resolve(false);
@@ -5076,7 +5077,7 @@ var OneAuthClient = class {
               message: "Permission grant failed"
             }
           });
-        } else if (data?.type === "PASSKEY_CLOSE") {
+        } else if (data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           teardown();
           cleanup();
           resolve({