@rhinestone/deposit-modal 0.8.1 → 0.9.0

package/dist/server.cjs

@@ -0,0 +1,96 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// src/server.ts
+var DEFAULT_PROCESSOR_URL = "https://v1.orchestrator.rhinestone.dev/deposit-processor";
+function jsonError(message, status) {
+  return new Response(JSON.stringify({ error: message }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function parseBody(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const record = value;
+  const fields = ["chain", "txHash", "account", "token", "destination"];
+  for (const field of fields) {
+    if (typeof record[field] !== "string" || record[field] === "") return null;
+  }
+  return Object.fromEntries(
+    fields.map((field) => [field, record[field]])
+  );
+}
+function sameIdentifier(a, b) {
+  if (a === b) return true;
+  const isHex = (value) => /^0x[0-9a-fA-F]+$/.test(value);
+  return isHex(a) && isHex(b) && a.toLowerCase() === b.toLowerCase();
+}
+function createRefundHandler(options) {
+  const processorUrl = (_nullishCoalesce(options.processorUrl, () => ( DEFAULT_PROCESSOR_URL))).replace(
+    /\/$/,
+    ""
+  );
+  const headers = {
+    "Content-Type": "application/json",
+    "x-api-key": options.apiKey
+  };
+  return async function handleRefund(request) {
+    const body = parseBody(await request.json().catch(() => null));
+    if (!body) {
+      return jsonError("Malformed refund request", 400);
+    }
+    const authorization = await options.authorize(request, body);
+    if (!authorization) {
+      return jsonError("Unauthorized", 401);
+    }
+    const query = new URLSearchParams({
+      recipient: authorization.depositRecipient,
+      chain: body.chain,
+      txHash: body.txHash,
+      includeSpam: "true"
+    });
+    const lookup = await fetch(`${processorUrl}/deposits?${query}`, { headers });
+    if (!lookup.ok) {
+      return jsonError("Could not verify the deposit", 502);
+    }
+    const { deposits = [] } = await lookup.json();
+    const owned = deposits.some(
+      (deposit) => deposit.depositAddress !== void 0 && deposit.token !== void 0 && sameIdentifier(deposit.depositAddress, body.account) && sameIdentifier(deposit.token, body.token)
+    );
+    if (!owned) {
+      return jsonError("Forbidden", 403);
+    }
+    const destination = _nullishCoalesce(authorization.refundDestination, () => ( body.destination));
+    const upstream = await fetch(`${processorUrl}/deposits/refund`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        chain: body.chain,
+        txHash: body.txHash,
+        account: body.account,
+        token: body.token,
+        recipient: destination
+      })
+    });
+    const text = await upstream.text();
+    if (!upstream.ok) {
+      return new Response(text, {
+        status: upstream.status,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    let body_;
+    try {
+      body_ = JSON.parse(text);
+    } catch (e) {
+      return new Response(text, {
+        status: upstream.status,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    return new Response(
+      JSON.stringify({ ...body_, destination }),
+      { status: upstream.status, headers: { "Content-Type": "application/json" } }
+    );
+  };
+}
+
+
+exports.createRefundHandler = createRefundHandler;

package/dist/server.d.cts

@@ -0,0 +1,65 @@
+/**
+ * Server-side helper for the claim flow. Import from
+ * `@rhinestone/deposit-modal/server` — this module talks to the processor with
+ * your API key and must never reach the browser.
+ *
+ * Deposit accounts are service-managed, so no user wallet can sign for a
+ * refund, and an exchange-funded deposit has no signable sender either.
+ * Whether a deposit belongs to a given user is something only your app knows,
+ * so that one decision is yours (`authorize`) and everything else is here.
+ */
+/** Body the ClaimModal POSTs to your endpoint. Never trusted on its own. */
+interface RefundRequestBody {
+    chain: string;
+    txHash: string;
+    account: string;
+    token: string;
+    destination: string;
+}
+interface RefundAuthorization {
+    /**
+     * The deposit `recipient` this user owns — the same value your app passes
+     * `<DepositModal>`. Used *only* to prove the deposit belongs to them: the
+     * handler lists deposits settling to it and rejects a txHash that isn't
+     * among them.
+     *
+     * Not where the money goes. One recipient covers every deposit account the
+     * user has, since the account salt includes the target chain and token.
+     */
+    depositRecipient: string;
+    /**
+     * Where the refund is paid. Set this to override whatever the browser asked
+     * for, taking the choice away from the page. Omit it to honour the address
+     * the user typed.
+     */
+    refundDestination?: string;
+}
+interface CreateRefundHandlerOptions {
+    /** Write-scoped Rhinestone API key. Server-side only. */
+    apiKey: string;
+    /**
+     * Authenticate the caller and return the recipient they own, or `null` to
+     * reject with 401. This is the only part we can't write for you.
+     */
+    authorize: (request: Request, refund: RefundRequestBody) => Promise<RefundAuthorization | null> | RefundAuthorization | null;
+    /** Defaults to the production processor. */
+    processorUrl?: string;
+}
+/**
+ * Builds a `(Request) => Promise<Response>` you can mount in any fetch-based
+ * runtime (Next.js route handlers, Hono, Bun.serve, Cloudflare Workers).
+ *
+ * ```ts
+ * // app/api/refund/route.ts
+ * export const POST = createRefundHandler({
+ *   apiKey: process.env.RHINESTONE_API_KEY!,
+ *   async authorize(request) {
+ *     const session = await getSession(request);
+ *     return session ? { depositRecipient: session.depositRecipient } : null;
+ *   },
+ * });
+ * ```
+ */
+declare function createRefundHandler(options: CreateRefundHandlerOptions): (request: Request) => Promise<Response>;
+
+export { type CreateRefundHandlerOptions, type RefundAuthorization, createRefundHandler };

package/dist/server.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Server-side helper for the claim flow. Import from
+ * `@rhinestone/deposit-modal/server` — this module talks to the processor with
+ * your API key and must never reach the browser.
+ *
+ * Deposit accounts are service-managed, so no user wallet can sign for a
+ * refund, and an exchange-funded deposit has no signable sender either.
+ * Whether a deposit belongs to a given user is something only your app knows,
+ * so that one decision is yours (`authorize`) and everything else is here.
+ */
+/** Body the ClaimModal POSTs to your endpoint. Never trusted on its own. */
+interface RefundRequestBody {
+    chain: string;
+    txHash: string;
+    account: string;
+    token: string;
+    destination: string;
+}
+interface RefundAuthorization {
+    /**
+     * The deposit `recipient` this user owns — the same value your app passes
+     * `<DepositModal>`. Used *only* to prove the deposit belongs to them: the
+     * handler lists deposits settling to it and rejects a txHash that isn't
+     * among them.
+     *
+     * Not where the money goes. One recipient covers every deposit account the
+     * user has, since the account salt includes the target chain and token.
+     */
+    depositRecipient: string;
+    /**
+     * Where the refund is paid. Set this to override whatever the browser asked
+     * for, taking the choice away from the page. Omit it to honour the address
+     * the user typed.
+     */
+    refundDestination?: string;
+}
+interface CreateRefundHandlerOptions {
+    /** Write-scoped Rhinestone API key. Server-side only. */
+    apiKey: string;
+    /**
+     * Authenticate the caller and return the recipient they own, or `null` to
+     * reject with 401. This is the only part we can't write for you.
+     */
+    authorize: (request: Request, refund: RefundRequestBody) => Promise<RefundAuthorization | null> | RefundAuthorization | null;
+    /** Defaults to the production processor. */
+    processorUrl?: string;
+}
+/**
+ * Builds a `(Request) => Promise<Response>` you can mount in any fetch-based
+ * runtime (Next.js route handlers, Hono, Bun.serve, Cloudflare Workers).
+ *
+ * ```ts
+ * // app/api/refund/route.ts
+ * export const POST = createRefundHandler({
+ *   apiKey: process.env.RHINESTONE_API_KEY!,
+ *   async authorize(request) {
+ *     const session = await getSession(request);
+ *     return session ? { depositRecipient: session.depositRecipient } : null;
+ *   },
+ * });
+ * ```
+ */
+declare function createRefundHandler(options: CreateRefundHandlerOptions): (request: Request) => Promise<Response>;
+
+export { type CreateRefundHandlerOptions, type RefundAuthorization, createRefundHandler };

package/dist/server.mjs

@@ -0,0 +1,96 @@
+// src/server.ts
+var DEFAULT_PROCESSOR_URL = "https://v1.orchestrator.rhinestone.dev/deposit-processor";
+function jsonError(message, status) {
+  return new Response(JSON.stringify({ error: message }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function parseBody(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const record = value;
+  const fields = ["chain", "txHash", "account", "token", "destination"];
+  for (const field of fields) {
+    if (typeof record[field] !== "string" || record[field] === "") return null;
+  }
+  return Object.fromEntries(
+    fields.map((field) => [field, record[field]])
+  );
+}
+function sameIdentifier(a, b) {
+  if (a === b) return true;
+  const isHex = (value) => /^0x[0-9a-fA-F]+$/.test(value);
+  return isHex(a) && isHex(b) && a.toLowerCase() === b.toLowerCase();
+}
+function createRefundHandler(options) {
+  const processorUrl = (options.processorUrl ?? DEFAULT_PROCESSOR_URL).replace(
+    /\/$/,
+    ""
+  );
+  const headers = {
+    "Content-Type": "application/json",
+    "x-api-key": options.apiKey
+  };
+  return async function handleRefund(request) {
+    const body = parseBody(await request.json().catch(() => null));
+    if (!body) {
+      return jsonError("Malformed refund request", 400);
+    }
+    const authorization = await options.authorize(request, body);
+    if (!authorization) {
+      return jsonError("Unauthorized", 401);
+    }
+    const query = new URLSearchParams({
+      recipient: authorization.depositRecipient,
+      chain: body.chain,
+      txHash: body.txHash,
+      includeSpam: "true"
+    });
+    const lookup = await fetch(`${processorUrl}/deposits?${query}`, { headers });
+    if (!lookup.ok) {
+      return jsonError("Could not verify the deposit", 502);
+    }
+    const { deposits = [] } = await lookup.json();
+    const owned = deposits.some(
+      (deposit) => deposit.depositAddress !== void 0 && deposit.token !== void 0 && sameIdentifier(deposit.depositAddress, body.account) && sameIdentifier(deposit.token, body.token)
+    );
+    if (!owned) {
+      return jsonError("Forbidden", 403);
+    }
+    const destination = authorization.refundDestination ?? body.destination;
+    const upstream = await fetch(`${processorUrl}/deposits/refund`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        chain: body.chain,
+        txHash: body.txHash,
+        account: body.account,
+        token: body.token,
+        recipient: destination
+      })
+    });
+    const text = await upstream.text();
+    if (!upstream.ok) {
+      return new Response(text, {
+        status: upstream.status,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    let body_;
+    try {
+      body_ = JSON.parse(text);
+    } catch {
+      return new Response(text, {
+        status: upstream.status,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    return new Response(
+      JSON.stringify({ ...body_, destination }),
+      { status: upstream.status, headers: { "Content-Type": "application/json" } }
+    );
+  };
+}
+export {
+  createRefundHandler
+};