@safepassage/sdk 3.0.4 → 3.0.6

package/dist/utils/security.js

@@ -8,14 +8,14 @@
  */
 const TRUSTED_ORIGINS = {
     production: [
-        'https://verify.safepassageapp.com',
+        'https://av.safepassageapp.com',
         'https://portal.safepassageapp.com',
-        'https://api.safepassageapp.com'
+        'https://api.safepassageapp.com',
     ],
     staging: [
-        'https://verify-staging.safepassageapp.com',
-        'https://portal-staging.safepassageapp.com',
-        'https://api-staging.safepassageapp.com'
+        'https://av.safepassageapp.com',
+        'https://portal.safepassageapp.com',
+        'https://api.safepassageapp.com',
     ],
     development: [
         'http://localhost:5173',
@@ -25,8 +25,8 @@ const TRUSTED_ORIGINS = {
         'http://127.0.0.1:5173',
         'http://127.0.0.1:3000',
         'http://127.0.0.1:3001',
-        'http://127.0.0.1:3002'
-    ]
+        'http://127.0.0.1:3002',
+    ],
 };
 /**
  * Validate if an origin is trusted for the given environment
@@ -46,11 +46,13 @@ export function validatePostMessageOrigin(event, environment, allowedCustomOrigi
     }
     // Check against custom allowed origins (for merchant websites)
     if (allowedCustomOrigins.length > 0) {
-        const isCustomOriginAllowed = allowedCustomOrigins.some(allowedOrigin => {
+        const isCustomOriginAllowed = allowedCustomOrigins.some((allowedOrigin) => {
             // Support wildcard subdomains (e.g., "*.example.com")
             if (allowedOrigin.startsWith('*.')) {
                 const domain = allowedOrigin.slice(2);
-                return origin.endsWith(`.${domain}`) || origin === `https://${domain}` || origin === `http://${domain}`;
+                return (origin.endsWith(`.${domain}`) ||
+                    origin === `https://${domain}` ||
+                    origin === `http://${domain}`);
             }
             return origin === allowedOrigin;
         });
@@ -63,7 +65,7 @@ export function validatePostMessageOrigin(event, environment, allowedCustomOrigi
         environment,
         trustedOrigins: TRUSTED_ORIGINS[environment],
         allowedCustomOrigins,
-        eventType: event.data?.type
+        eventType: event.data?.type,
     });
     return false;
 }
@@ -85,7 +87,8 @@ export function validateSafePassageMessage(event, expectedSessionId) {
         return { isValid: false, error: 'Session ID mismatch' };
     }
     // Check status field
-    if (!data.status || !['verified', 'failed', 'cancelled'].includes(data.status)) {
+    if (!data.status ||
+        !['verified', 'failed', 'cancelled'].includes(data.status)) {
         return { isValid: false, error: 'Invalid status value' };
     }
     return { isValid: true };
@@ -98,7 +101,7 @@ export function enforceHTTPS(environment) {
         const httpsUrl = window.location.href.replace('http:', 'https:');
         console.error('SafePassage Security: HTTPS required in production. Redirecting...', {
             current: window.location.href,
-            redirect: httpsUrl
+            redirect: httpsUrl,
         });
         window.location.replace(httpsUrl);
     }
@@ -111,7 +114,10 @@ export function validateReturnUrl(url, environment) {
         const parsed = new URL(url);
         // Production must use HTTPS
         if (environment === 'production' && parsed.protocol !== 'https:') {
-            return { isValid: false, error: 'HTTPS required for return URLs in production' };
+            return {
+                isValid: false,
+                error: 'HTTPS required for return URLs in production',
+            };
         }
         // Development allows HTTP localhost
         if (environment === 'development') {
@@ -124,7 +130,10 @@ export function validateReturnUrl(url, environment) {
         }
         // Staging should use HTTPS
         if (environment === 'staging' && parsed.protocol !== 'https:') {
-            return { isValid: false, error: 'HTTPS required for return URLs in staging' };
+            return {
+                isValid: false,
+                error: 'HTTPS required for return URLs in staging',
+            };
         }
         // Block suspicious URLs
         const suspiciousPatterns = [
@@ -132,7 +141,7 @@ export function validateReturnUrl(url, environment) {
             /javascript:/i,
             /vbscript:/i,
             /file:/i,
-            /ftp:/i
+            /ftp:/i,
         ];
         for (const pattern of suspiciousPatterns) {
             if (pattern.test(url)) {
@@ -141,7 +150,7 @@ export function validateReturnUrl(url, environment) {
         }
         return { isValid: true };
     }
-    catch (error) {
+    catch {
         return { isValid: false, error: 'Invalid URL format' };
     }
 }
@@ -157,13 +166,16 @@ export function generateSecureSessionId() {
     const array = new Uint8Array(16);
     crypto.getRandomValues(array);
     // Convert to UUID v4 format
-    const hex = Array.from(array).map(b => b.toString(16).padStart(2, '0')).join('');
+    const hex = Array.from(array)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
     return [
         hex.slice(0, 8),
         hex.slice(8, 12),
         '4' + hex.slice(13, 16), // Version 4
-        ((parseInt(hex.slice(16, 17), 16) & 0x3) | 0x8).toString(16) + hex.slice(17, 20), // Variant
-        hex.slice(20, 32)
+        ((parseInt(hex.slice(16, 17), 16) & 0x3) | 0x8).toString(16) +
+            hex.slice(17, 20), // Variant
+        hex.slice(20, 32),
     ].join('-');
 }
 /**
@@ -179,7 +191,7 @@ class VerificationRateLimit {
         const now = Date.now();
         const attempts = this.attempts.get(identifier) || [];
         // Filter out old attempts
-        const recentAttempts = attempts.filter(time => now - time < this.timeWindow);
+        const recentAttempts = attempts.filter((time) => now - time < this.timeWindow);
         if (recentAttempts.length >= this.maxAttempts) {
             console.warn(`SafePassage Security: Rate limit exceeded for ${identifier}`);
             return false;
@@ -202,7 +214,7 @@ export function logSecurityEvent(event, details) {
         timestamp: new Date().toISOString(),
         userAgent: navigator.userAgent,
         url: window.location.href,
-        ...details
+        ...details,
     });
     // In production, this could send events to a security monitoring service
 }

package/dist/utils/validation.js

@@ -59,7 +59,8 @@ export function validateConfig(config) {
             throw new Error(`defaultChallengeAge cannot exceed ${MAXIMUM_AGE}`);
         }
     }
-    if (config.defaultVerificationMode && !['L1', 'L2'].includes(config.defaultVerificationMode)) {
+    if (config.defaultVerificationMode &&
+        !['L1', 'L2'].includes(config.defaultVerificationMode)) {
         throw new Error('defaultVerificationMode must be L1 or L2');
     }
     if (config.mode && !['redirect', 'new-tab'].includes(config.mode)) {
@@ -71,7 +72,9 @@ export function validateConfig(config) {
  */
 function detectEnvironment() {
     const hostname = window.location.hostname;
-    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname.includes('.local')) {
+    if (hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname.includes('.local')) {
         return 'development';
     }
     if (hostname.includes('staging') || hostname.includes('stage')) {
@@ -117,25 +120,35 @@ export async function parseState(state, environment) {
         // Try parsing as signed state first (new format)
         const signedPayload = await parseSignedState(state, environment);
         if (signedPayload) {
+            // Type guard to ensure signedPayload has required properties
+            const payload = signedPayload;
             // Validate payload structure
-            if (!signedPayload.merchantId || !signedPayload.sessionId ||
-                !signedPayload.returnUrl || !signedPayload.cancelUrl) {
+            if (!payload.merchantId ||
+                !payload.sessionId ||
+                !payload.returnUrl ||
+                !payload.cancelUrl) {
                 return null;
             }
-            return signedPayload;
+            return payload;
         }
         // Fallback to legacy base64 format for backwards compatibility
         console.warn('SafePassage: Falling back to legacy state format - update your SDK');
         const json = atob(state);
         const payload = JSON.parse(json);
         // Validate payload structure
-        if (!payload.merchantId || !payload.sessionId || !payload.returnUrl || !payload.cancelUrl) {
+        if (!payload.merchantId ||
+            !payload.sessionId ||
+            !payload.returnUrl ||
+            !payload.cancelUrl) {
             return null;
         }
         // Check timestamp expiration
         const age = Date.now() - payload.timestamp;
         if (age > STATE_EXPIRY_MS) {
-            console.warn('SafePassage: State parameter expired', { age, maxAge: STATE_EXPIRY_MS });
+            console.warn('SafePassage: State parameter expired', {
+                age,
+                maxAge: STATE_EXPIRY_MS,
+            });
             return null;
         }
         return payload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safepassage/sdk",
-  "version": "3.0.4",
+  "version": "3.0.6",
   "description": "SafePassage SDK - Lightweight redirect-based age verification",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,16 +14,16 @@
     "dev": "tsc --watch",
     "demo": "python3 -m http.server 8080",
     "serve-demo": "npx serve . -p 8080",
-    "test": "jest --config test/jest.config.js",
-    "test:browser": "jest --config test/jest.config.js test/browser-compat",
-    "test:mobile": "jest --config test/jest.config.js test/mobile",
-    "test:performance": "jest --config test/jest.config.js test/performance",
-    "test:security": "jest --config test/jest.config.js test/security",
-    "test:accessibility": "jest --config test/jest.config.js test/accessibility",
-    "test:edge": "jest --config test/jest.config.js test/edge-cases",
-    "test:integration": "jest --config test/jest.config.js test/integration",
-    "test:all": "node test/run-tests.js",
-    "test:coverage": "jest --config test/jest.config.js --coverage",
+    "test": "jest",
+    "test:browser": "jest test/browser-compat",
+    "test:mobile": "jest test/mobile",
+    "test:performance": "jest test/performance",
+    "test:security": "jest test/security",
+    "test:accessibility": "jest test/accessibility",
+    "test:edge": "jest test/edge-cases",
+    "test:integration": "jest test/integration",
+    "test:all": "jest",
+    "test:coverage": "jest --coverage",
     "benchmark": "node test/performance/benchmark.js",
     "prepublishOnly": "npm run build",
     "version": "npm run build && git add -A dist",
@@ -42,15 +42,19 @@
   "devDependencies": {
     "@babel/core": "^7.27.4",
     "@babel/preset-env": "^7.27.2",
-    "@types/jest": "^29.5.12",
+    "@testing-library/dom": "^10.4.0",
+    "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/jest": "^29.5.14",
     "@types/node": "^24.0.1",
     "babel-jest": "^30.0.0",
     "esbuild": "^0.25.5",
     "jest": "^29.7.0",
     "jest-environment-jsdom": "^29.7.0",
+    "jsdom": "^26.1.0",
     "puppeteer": "^21.11.0",
     "terser": "^5.42.0",
-    "ts-jest": "^29.1.2",
+    "ts-jest": "^29.4.0",
     "typescript": "~5.8.3"
   },
   "repository": {