@safepassage/sdk 3.4.8 → 3.4.10

package/dist/safepassage.min.js

@@ -1,3 +0,0 @@
-/* SafePassage SDK v3.4.8 */
-"use strict";var SafePassageSDK=(()=>{var S=Object.defineProperty,oe=Object.defineProperties,ae=Object.getOwnPropertyDescriptor,ce=Object.getOwnPropertyDescriptors,le=Object.getOwnPropertyNames,v=Object.getOwnPropertySymbols;var P=Object.prototype.hasOwnProperty,C=Object.prototype.propertyIsEnumerable;var R=(t,e,n)=>e in t?S(t,e,{enumerable:!0,configurable:!0,writable:!0,value:n}):t[e]=n,h=(t,e)=>{for(var n in e||(e={}))P.call(e,n)&&R(t,n,e[n]);if(v)for(var n of v(e))C.call(e,n)&&R(t,n,e[n]);return t},y=(t,e)=>oe(t,ce(e));var D=(t,e)=>{var n={};for(var i in t)P.call(t,i)&&e.indexOf(i)<0&&(n[i]=t[i]);if(t!=null&&v)for(var i of v(t))e.indexOf(i)<0&&C.call(t,i)&&(n[i]=t[i]);return n};var w=(t,e)=>()=>(t&&(e=t(t=0)),e);var U=(t,e)=>{for(var n in e)S(t,n,{get:e[n],enumerable:!0})},pe=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of le(e))!P.call(t,s)&&s!==n&&S(t,s,{get:()=>e[s],enumerable:!(i=ae(e,s))||i.enumerable});return t};var $=t=>pe(S({},"__esModule",{value:!0}),t);function de(t,e){return K[e].includes(t)}function W(t,e,n=[]){var s;let{origin:i}=t;return de(i,e)||n.length>0&&n.some(o=>{if(o.startsWith("*.")){let a=o.slice(2);return i.endsWith(`.${a}`)||i===`https://${a}`||i===`http://${a}`}return i===o})?!0:(console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${i}`,{environment:e,trustedOrigins:K[e],allowedCustomOrigins:n,eventType:(s=t.data)==null?void 0:s.type}),!1)}function H(t,e){let{data:n}=t;return!n||typeof n!="object"?{isValid:!1,error:"Invalid message format"}:n.type!=="safepassage:verification:complete"?{isValid:!1,error:"Invalid message type"}:!n.sessionId||n.sessionId!==e?{isValid:!1,error:"Session ID mismatch"}:!n.status||!["verified","failed"].includes(n.status)?{isValid:!1,error:"Invalid status value"}:{isValid:!0}}function j(t){t==="production"&&window.location.protocol!=="https:"&&console.warn("SafePassage Warning: HTTPS recommended for production environment",{current:window.location.href})}function T(t,e){try{let n=new URL(t);if(n.protocol!=="https:"&&!(n.hostname==="localhost"||n.hostname==="127.0.0.1"))return{isValid:!1,error:`HTTPS required for return URLs in ${e}`};let i=[/data:/i,/javascript:/i,/vbscript:/i,/file:/i,/ftp:/i];for(let s of i)if(s.test(t))return{isValid:!1,error:"Blocked suspicious URL scheme"};return{isValid:!0}}catch(n){return{isValid:!1,error:"Invalid URL format"}}}function p(t,e){console.warn(`SafePassage Security Event: ${t}`,h({timestamp:new Date().toISOString(),userAgent:navigator.userAgent,url:window.location.href},e))}var K,A,q,b=w(()=>{"use strict";K={production:["https://av.safepassageapp.com","https://portal.safepassageapp.com","https://api.safepassageapp.com"],staging:["https://av.staging.safepassageapp.com","https://portal.staging.safepassageapp.com","https://api.staging.safepassageapp.com"]};A=class{constructor(){this.attempts=new Map;this.maxAttempts=5;this.timeWindow=6e4}isAllowed(e){let n=Date.now(),s=(this.attempts.get(e)||[]).filter(r=>n-r<this.timeWindow);return s.length>=this.maxAttempts?(console.warn(`SafePassage Security: Rate limit exceeded for ${e}`),!1):(s.push(n),this.attempts.set(e,s),!0)}reset(e){this.attempts.delete(e)}},q=new A});var G={};U(G,{createSignedState:()=>ge,generateHMAC:()=>x,generateSecureToken:()=>B,getSigningSecret:()=>V,parseSignedState:()=>fe,verifyHMAC:()=>F});async function x(t,e){let n=new TextEncoder,i=n.encode(e),s=n.encode(t),r=await crypto.subtle.importKey("raw",i,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await crypto.subtle.sign("HMAC",r,s);return Array.from(new Uint8Array(o)).map(a=>a.toString(16).padStart(2,"0")).join("")}async function F(t,e,n){try{let i=await x(t,n);return ue(e,i)}catch(i){return!1}}function ue(t,e){if(t.length!==e.length)return!1;let n=0;for(let i=0;i<t.length;i++)n|=t.charCodeAt(i)^e.charCodeAt(i);return n===0}function B(t=32){let e=new Uint8Array(t);return crypto.getRandomValues(e),Array.from(e,n=>n.toString(16).padStart(2,"0")).join("")}function V(t){return{production:"safepassage-prod-hmac-2025",staging:"safepassage-stage-hmac-2025"}[t]}async function ge(t,e){let n=y(h({},t),{timestamp:Date.now(),nonce:B(16)}),i=JSON.stringify(n),s=V(e),r=await x(i,s);return btoa(JSON.stringify({data:n,signature:r}))}async function fe(t,e,n=X){try{let s=atob(t),r=JSON.parse(s);if(!r.data||!r.signature)return console.warn("SafePassage: Invalid signed state format"),null;let{data:o,signature:a}=r,c=JSON.stringify(o),l=V(e);if(!await F(c,a,l))return console.warn("SafePassage: State signature verification failed"),null;if(o.timestamp){let m=Date.now()-o.timestamp;if(m>n)return console.warn("SafePassage: State parameter expired",{age:m,maxAge:n}),null}let i=o,{timestamp:g,nonce:f}=i;return D(i,["timestamp","nonce"])}catch(s){return console.warn("SafePassage: Failed to parse signed state",s),null}}var J=w(()=>{"use strict";k()});function Q(t){if(!t.apiKey)throw new Error("apiKey is required");if(t.apiKey.length>Z)throw new Error(`apiKey exceeds maximum length of ${Z} characters`);if(!he.test(t.apiKey))throw new Error("Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)");if(typeof window!="undefined"&&t.apiKey.startsWith("sk_"))throw new Error("Secret keys (sk_) should never be used in browser code for security reasons. Secret keys expose your account to unauthorized access if used client-side. Please use your public key (pk_) instead. If you need to use features that require a secret key (like custom challenge age), create the session server-side and pass the sessionId to startVerificationWithSession(). See: https://docs.safepassageapp.com/server-side-sessions");if(!t.returnUrl)throw new Error("returnUrl is required");if(t.returnUrl.length>E)throw new Error(`returnUrl exceeds maximum length of ${E} characters`);let e=me(),n=T(t.returnUrl,e);if(!n.isValid)throw new Error(`returnUrl validation failed: ${n.error}`);if(t.cancelUrl){if(t.cancelUrl.length>E)throw new Error(`cancelUrl exceeds maximum length of ${E} characters`);let i=T(t.cancelUrl,e);if(!i.isValid)throw new Error(`cancelUrl validation failed: ${i.error}`)}if(t.defaultChallengeAge!==void 0){if(t.defaultChallengeAge<Y)throw new Error(`defaultChallengeAge must be at least ${Y}`);if(t.defaultChallengeAge>z)throw new Error(`defaultChallengeAge cannot exceed ${z}`)}if(t.defaultVerificationMode&&!["L1","L2"].includes(t.defaultVerificationMode))throw new Error("defaultVerificationMode must be L1 or L2");if(t.mode&&!["redirect","new-tab"].includes(t.mode))throw new Error("mode must be redirect or new-tab")}function me(){if(typeof window=="undefined")return"production";let t=window.location.hostname;return t.includes("staging")||t.includes("stage")?"staging":"production"}async function ee(t,e){let{createSignedState:n}=await Promise.resolve().then(()=>(J(),G));return n(t,e)}var Y,z,E,Z,X,he,k=w(()=>{"use strict";b();Y=25,z=150,E=2048,Z=128,X=6e5,he=/^(pk_|sk_)[a-zA-Z0-9_]+$/});function M(t){let e=te[t]||te.production;if(!e||!e.startsWith("https://"))throw new Error(`HTTPS required for ${t} environment`);return e}function we(t){let e={production:"https://api.safepassageapp.com",staging:"https://api.staging.safepassageapp.com"},n=e[t]||e.production;if(!n||!n.startsWith("https://"))throw new Error(`HTTPS required for API URLs in ${t} environment`);return n}function ne(t){let e=window.location.protocol==="https:";switch(t){case"production":e||console.warn("SafePassage Warning: HTTPS recommended for production environment");break;case"staging":e||console.warn("SafePassage Warning: HTTPS strongly recommended in staging environment");break}try{M(t),we(t)}catch(n){let i=n instanceof Error?n.message:String(n);throw new Error(`Environment configuration validation failed: ${i}`)}}var te,ie=w(()=>{"use strict";te={production:"https://av.safepassageapp.com",staging:"https://av.staging.safepassageapp.com"}});var re={};U(re,{SafePassage:()=>u,default:()=>ve});var u,ve,L=w(()=>{"use strict";k();ie();b();u=class{constructor(e){this.popupWindow=null;this.messageListener=null;this.popupMonitorInterval=null;this.unloadListener=null;this.isVerificationInProgress=!1;this.currentSessionId=null;this.lastVerifyUrl=null;this.lastSessionToken=null;this.temporaryHandoffToken=null;Q(e);let n=e.environment||this.detectEnvironment();n!=="staging"&&n!=="production"&&(console.warn(`SafePassage SDK: Unknown environment '${n}', defaulting to 'production'`),n="production"),this.config=y(h({},e),{environment:n,mode:e.mode||"redirect"}),ne(this.config.environment),j(this.config.environment),p("SDK_INITIALIZED",{environment:this.config.environment,mode:this.config.mode,origin:window.location.origin,protocol:window.location.protocol,hostname:window.location.hostname}),this.setupAutoCleanup()}async verify(e={}){var s,r,o,a,c,l;let n=this.isPublicKey(),i;if(n)i=await this.createInternalSession(e);else throw new Error("Private API keys (sk_) should use the direct API, not the SDK. The SDK is designed for browser-based public key usage only.");if(!i)throw new Error("Failed to obtain sessionId from server");if(this.isVerificationInProgress){let d=new Error(`Verification already in progress for session ${(s=this.currentSessionId)==null?void 0:s.substring(0,8)}...`);throw p("RACE_CONDITION_PREVENTED",{currentSession:((r=this.currentSessionId)==null?void 0:r.substring(0,8))+"...",attemptedSession:"new-session-attempt",origin:window.location.origin}),(a=(o=this.config).onError)==null||a.call(o,d),d}this.isVerificationInProgress=!0,this.currentSessionId=i;try{let d=`${this.config.apiKey}:${window.location.origin}`;if(!q.isAllowed(d)){let f=new Error("Too many verification attempts. Please wait before trying again.");throw p("RATE_LIMIT_EXCEEDED",{apiKey:this.config.apiKey.substring(0,8)+"...",origin:window.location.origin,sessionId:i?i.substring(0,8)+"...":"undefined"}),(l=(c=this.config).onError)==null||l.call(c,f),f}let g=await this.buildVerificationUrl(e,i);p("VERIFICATION_INITIATED",{environment:this.config.environment,mode:this.config.mode,sessionId:i?i.substring(0,8)+"...":"undefined",origin:window.location.origin}),this.config.mode==="new-tab"?this.openNewTab(g,i):(this.unlockVerification(),this.redirect(g))}catch(d){throw this.unlockVerification(),d}}async buildVerificationUrl(e,n){let i=M(this.config.environment),s=e.challengeAge!==void 0,r=e.verificationMode!==void 0,o=s||r,a=await ee({merchantId:this.config.apiKey,sessionId:n,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge||this.config.defaultChallengeAge,verificationMode:e.verificationMode||this.config.defaultVerificationMode,hasOverrides:o,externalUserId:e.externalUserId,timestamp:Date.now(),apiUrl:this.getPortalApiUrl(),engineUrl:this.getEngineUrl(),wsUrl:this.getWebSocketUrl(),environment:this.config.environment,features:{testMode:!1,warmupPeriodMs:500,qualityThreshold:.6},handoffToken:this.temporaryHandoffToken||void 0,sessionToken:this.lastSessionToken||void 0,verifyUrl:this.lastVerifyUrl||void 0},this.config.environment);if(this.lastVerifyUrl)try{let l=new URL(this.lastVerifyUrl);return l.searchParams.set("state",a),l.searchParams.set("mode",this.config.mode),e.skipIntro&&l.searchParams.set("skip_intro","true"),e.autoReturn&&l.searchParams.set("auto_return","true"),l.toString()}catch(l){}let c=new URLSearchParams({state:a,sessionId:n,mode:this.config.mode});return e.skipIntro&&c.set("skip_intro","true"),e.autoReturn&&c.set("auto_return","true"),`${i}/?${c.toString()}`}redirect(e){window.location.href=e}openNewTab(e,n){var i,s;if(this.cleanup(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),this.popupWindow=window.open(e,"safepassage-verify","width=600,height=700"),!this.popupWindow){(s=(i=this.config).onError)==null||s.call(i,new Error("Failed to open verification window. Please check popup blocker settings."));return}this.messageListener=r=>{var l,d,g,f,I,m,_;let o=(l=r.data)==null?void 0:l.type;if(!o||typeof o!="string"||!o.startsWith("safepassage:"))return;if(!W(r,this.config.environment)){p("POSTMESSAGE_ORIGIN_BLOCKED",{origin:r.origin,environment:this.config.environment,expectedOrigins:`SafePassage trusted origins for ${this.config.environment}`,messageType:(d=r.data)==null?void 0:d.type});return}let a=H(r,n);if(!a.isValid){p("POSTMESSAGE_VALIDATION_FAILED",{error:a.error,origin:r.origin,sessionId:n.substring(0,8)+"...",messageType:(g=r.data)==null?void 0:g.type});return}let c={sessionId:r.data.sessionId,status:r.data.status,timestamp:r.data.timestamp,externalUserId:r.data.externalUserId};p("VERIFICATION_COMPLETED",{status:c.status,sessionId:n.substring(0,8)+"...",origin:r.origin}),this.cleanup({closePopup:!1}),this.unlockVerification(),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null),c.status==="verified"?(I=(f=this.config).onComplete)==null||I.call(f,c):(_=(m=this.config).onError)==null||_.call(m,new Error(`Verification failed: ${c.status}`))},window.addEventListener("message",this.messageListener),this.popupMonitorInterval=setInterval(()=>{var r,o;this.popupWindow&&this.popupWindow.closed&&(p("POPUP_CLOSED_BY_USER",{sessionId:n.substring(0,8)+"...",environment:this.config.environment}),this.cleanup(),this.unlockVerification(),(o=(r=this.config).onCancel)==null||o.call(r))},500)}setupAutoCleanup(){if(this.unloadListener=()=>{p("SDK_AUTO_CLEANUP",{environment:this.config.environment,trigger:"page_unload"}),this.cleanup(),this.unlockVerification()},window.addEventListener("beforeunload",this.unloadListener),window.addEventListener("pagehide",this.unloadListener),window.history&&window.history.pushState){let e=window.history.pushState;window.history.pushState=(...n)=>(this.cleanup(),this.unlockVerification(),e.apply(window.history,n))}}detectEnvironment(){let e=window.location.hostname;return e.includes("staging")||e.includes("stage")?"staging":"production"}getEnvironment(){return this.config.environment}unlockVerification(){this.isVerificationInProgress=!1,this.currentSessionId=null,p("VERIFICATION_UNLOCKED",{environment:this.config.environment,origin:window.location.origin})}cleanup(e={}){let n=e.closePopup!==!1;this.popupWindow&&(n&&!this.popupWindow.closed&&this.popupWindow.close(),(n||this.popupWindow.closed)&&(this.popupWindow=null)),this.messageListener&&(window.removeEventListener("message",this.messageListener),this.messageListener=null),this.popupMonitorInterval&&(clearInterval(this.popupMonitorInterval),this.popupMonitorInterval=null)}removeAutoCleanupListeners(){this.unloadListener&&(window.removeEventListener("beforeunload",this.unloadListener),window.removeEventListener("pagehide",this.unloadListener),this.unloadListener=null)}destroy(){p("SDK_DESTROYED",{environment:this.config.environment,origin:window.location.origin}),this.cleanup(),this.unlockVerification(),this.removeAutoCleanupListeners()}getPortalApiUrl(){switch(this.config.environment){case"staging":return"https://api.staging.safepassageapp.com";case"production":return"https://api.safepassageapp.com";default:return"https://api.safepassageapp.com"}}getEngineUrl(){switch(this.config.environment){case"staging":return"https://engine.staging.safepassageapp.com";case"production":return"https://engine.safepassageapp.com";default:return"https://engine.safepassageapp.com"}}getWebSocketUrl(){switch(this.config.environment){case"staging":return"wss://engine.staging.safepassageapp.com/api/websocket/stream";case"production":return"wss://engine.safepassageapp.com/api/websocket/stream";default:return"wss://engine.safepassageapp.com/api/websocket/stream"}}isPublicKey(){return this.config.apiKey.startsWith("pk_")}async createInternalSession(e){var n,i;try{let s=this.getPortalApiUrl(),r=await fetch(`${s}/api/v1/sessions/create`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`},body:JSON.stringify({merchantId:this.config.apiKey,returnUrl:this.config.returnUrl,cancelUrl:this.config.cancelUrl,challengeAge:e.challengeAge,verificationMode:e.verificationMode,merchantName:document.title||window.location.hostname,externalUserId:e.externalUserId})});if(!r.ok){let c=await r.json().catch(()=>({}));throw new Error(`Failed to create session: ${r.status} ${r.statusText}. ${c.message||""}`)}let o=await r.json(),a=o.sessionId;if(!a)throw new Error("Server did not return a sessionId");return o.verifyUrl&&(this.lastVerifyUrl=o.verifyUrl),o.sessionToken&&(this.lastSessionToken=o.sessionToken),o.handoffToken&&(this.temporaryHandoffToken=o.handoffToken),p("INTERNAL_SESSION_CREATED",{sessionId:a.substring(0,8)+"...",environment:this.config.environment,apiKeyType:"public"}),a}catch(s){let r=s instanceof Error?s.message:String(s);throw p("INTERNAL_SESSION_FAILED",{error:r,environment:this.config.environment,apiKeyType:"public"}),(i=(n=this.config).onError)==null||i.call(n,s),new Error(`Failed to create verification session: ${r}`)}}},ve=u});var Se={};U(Se,{SafePassage:()=>u,VERSION:()=>se,default:()=>u});function O(){crypto.randomUUID||(crypto.randomUUID=function(){let t=new Uint8Array(16);crypto.getRandomValues(t),t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=Array.from(t).map(n=>n.toString(16).padStart(2,"0")).join("");return[e.slice(0,8),e.slice(8,12),e.slice(12,16),e.slice(16,20),e.slice(20,32)].join("-")})}function N(){let t=[];if(!window.crypto||!window.crypto.getRandomValues)throw new Error("SafePassage SDK requires Web Crypto API support");if(!window.crypto.subtle)throw new Error("SafePassage SDK requires Web Crypto subtle API for HMAC operations");crypto.randomUUID||t.push("crypto.randomUUID not supported, using polyfill"),window.URLSearchParams||t.push("URLSearchParams not supported, consider adding a polyfill for IE 11 support"),t.length>0&&console.warn("SafePassage SDK Browser Compatibility:",t.join("; "))}L();typeof window!="undefined"&&(O(),N());var se="3.4.8";if(typeof window!="undefined"&&window){let{SafePassage:t}=(L(),$(re)),e=window;e.SafePassage=t,e.SafePassage&&(e.SafePassage.VERSION=se)}return $(Se);})();
-if(typeof SafePassageSDK !== "undefined" && SafePassageSDK.SafePassage) { window.SafePassage = SafePassageSDK.SafePassage; window.SafePassage.VERSION = SafePassageSDK.VERSION; }

package/dist/types/index.js

@@ -1,4 +0,0 @@
-/**
- * SafePassage SDK Type Definitions
- */
-export {};

package/dist/utils/__mocks__/polyfills.d.ts

@@ -1,3 +0,0 @@
-export declare function setupPolyfills(): void;
-export declare function checkBrowserCompatibility(): void;
-export declare function polyfillCryptoRandomUUID(): void;

package/dist/utils/__mocks__/polyfills.js

@@ -1,10 +0,0 @@
-// Mock polyfills to avoid browser API checks in tests
-export function setupPolyfills() {
-    // Do nothing in tests
-}
-export function checkBrowserCompatibility() {
-    // Do nothing in tests
-}
-export function polyfillCryptoRandomUUID() {
-    // Already mocked in test setup
-}

package/dist/utils/crypto.d.ts

@@ -1,105 +0,0 @@
-/**
- * Crypto utilities for SafePassage SDK - Browser compatible
- *
- * Provides cryptographic functions for the SafePassage SDK using Web Crypto API.
- * These utilities handle HMAC signing, state parameter protection, and secure
- * token generation for client-side security measures.
- *
- * IMPORTANT SECURITY NOTE:
- * Client-side cryptography provides defense-in-depth but cannot be considered
- * secure against determined attackers. True security comes from server-side
- * validation. These functions are primarily for tamper resistance and
- * integrity checking.
- *
- * Features:
- * - HMAC-SHA256 signing and verification using Web Crypto API
- * - Constant-time string comparison to prevent timing attacks
- * - Secure random token generation
- * - Signed state parameter creation and parsing
- * - Environment-specific secret derivation
- * - Timestamp and nonce-based replay protection
- *
- * @author SafePassage Engineering
- * @version 1.0.0
- */
-/**
- * Generate HMAC-SHA256 signature using Web Crypto API
- *
- * Creates an HMAC-SHA256 signature for the given data using the provided secret.
- * Uses the browser's Web Crypto API for cryptographic operations.
- *
- * SECURITY NOTE: This is client-side HMAC where the secret is known to the client.
- * It provides tamper resistance but not true security. Server-side verification
- * is required for actual security.
- *
- * @param {string} data - Data to sign
- * @param {string} secret - HMAC secret key
- * @returns {Promise<string>} Promise resolving to hex-encoded HMAC signature
- * @export
- */
-export declare function generateHMAC(data: string, secret: string): Promise<string>;
-/**
- * Verify HMAC-SHA256 signature using Web Crypto API
- *
- * Verifies an HMAC-SHA256 signature against the provided data and secret.
- * Uses constant-time comparison to prevent timing attacks.
- *
- * @param {string} data - Original data that was signed
- * @param {string} signature - HMAC signature to verify
- * @param {string} secret - HMAC secret key
- * @returns {Promise<boolean>} Promise resolving to true if signature is valid
- * @export
- */
-export declare function verifyHMAC(data: string, signature: string, secret: string): Promise<boolean>;
-/**
- * Generate a secure random token for client-side use
- *
- * Creates a cryptographically secure random token using the browser's
- * crypto.getRandomValues() function.
- *
- * @param {number} [length=32] - Token length in bytes
- * @returns {string} Hex-encoded random token
- * @export
- */
-export declare function generateSecureToken(length?: number): string;
-/**
- * Environment-specific secret derivation
- *
- * Returns environment-specific secrets for HMAC signing. In a real implementation,
- * this would derive from environment variables. For client-side use, this provides
- * basic tamper resistance only.
- *
- * WARNING: Client-side secrets are NOT secure against determined attackers.
- * This is defense-in-depth only. Real security comes from server-side validation.
- *
- * @param {'production' | 'staging'} environment - Target environment
- * @returns {string} Environment-specific secret
- * @export
- */
-export declare function getSigningSecret(environment: 'production' | 'staging'): string;
-/**
- * Create signed state parameter with timestamp and integrity protection
- *
- * Creates a signed state parameter containing the payload with added timestamp
- * and nonce for freshness and replay protection. The entire payload is signed
- * using HMAC-SHA256 and base64 encoded for URL safety.
- *
- * @param {unknown} payload - Data to include in state parameter
- * @param {'production' | 'staging'} environment - Target environment
- * @returns {Promise<string>} Promise resolving to base64-encoded signed state
- * @export
- */
-export declare function createSignedState(payload: unknown, environment: 'production' | 'staging'): Promise<string>;
-/**
- * Verify and parse signed state parameter
- *
- * Parses and verifies a signed state parameter, checking the HMAC signature
- * and timestamp freshness. Returns the original payload if validation succeeds.
- *
- * @param {string} signedState - Base64-encoded signed state parameter
- * @param {'production' | 'staging'} environment - Source environment
- * @param {number} [maxAge] - Maximum age in milliseconds
- * @returns {Promise<unknown | null>} Promise resolving to payload or null if invalid
- * @export
- */
-export declare function parseSignedState(signedState: string, environment: 'production' | 'staging', maxAge?: number): Promise<unknown | null>;

package/dist/utils/crypto.js

@@ -1,216 +0,0 @@
-/**
- * Crypto utilities for SafePassage SDK - Browser compatible
- *
- * Provides cryptographic functions for the SafePassage SDK using Web Crypto API.
- * These utilities handle HMAC signing, state parameter protection, and secure
- * token generation for client-side security measures.
- *
- * IMPORTANT SECURITY NOTE:
- * Client-side cryptography provides defense-in-depth but cannot be considered
- * secure against determined attackers. True security comes from server-side
- * validation. These functions are primarily for tamper resistance and
- * integrity checking.
- *
- * Features:
- * - HMAC-SHA256 signing and verification using Web Crypto API
- * - Constant-time string comparison to prevent timing attacks
- * - Secure random token generation
- * - Signed state parameter creation and parsing
- * - Environment-specific secret derivation
- * - Timestamp and nonce-based replay protection
- *
- * @author SafePassage Engineering
- * @version 1.0.0
- */
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-import { STATE_EXPIRY_MS } from './validation';
-/**
- * Generate HMAC-SHA256 signature using Web Crypto API
- *
- * Creates an HMAC-SHA256 signature for the given data using the provided secret.
- * Uses the browser's Web Crypto API for cryptographic operations.
- *
- * SECURITY NOTE: This is client-side HMAC where the secret is known to the client.
- * It provides tamper resistance but not true security. Server-side verification
- * is required for actual security.
- *
- * @param {string} data - Data to sign
- * @param {string} secret - HMAC secret key
- * @returns {Promise<string>} Promise resolving to hex-encoded HMAC signature
- * @export
- */
-export async function generateHMAC(data, secret) {
-    // Encode the secret and data as Uint8Array
-    const encoder = new TextEncoder();
-    const keyData = encoder.encode(secret);
-    const dataBuffer = encoder.encode(data);
-    // Import the secret as a key
-    const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    // Generate the signature
-    const signature = await crypto.subtle.sign('HMAC', key, dataBuffer);
-    // Convert to hex string
-    return Array.from(new Uint8Array(signature))
-        .map((b) => b.toString(16).padStart(2, '0'))
-        .join('');
-}
-/**
- * Verify HMAC-SHA256 signature using Web Crypto API
- *
- * Verifies an HMAC-SHA256 signature against the provided data and secret.
- * Uses constant-time comparison to prevent timing attacks.
- *
- * @param {string} data - Original data that was signed
- * @param {string} signature - HMAC signature to verify
- * @param {string} secret - HMAC secret key
- * @returns {Promise<boolean>} Promise resolving to true if signature is valid
- * @export
- */
-export async function verifyHMAC(data, signature, secret) {
-    try {
-        const expectedSignature = await generateHMAC(data, secret);
-        return constantTimeCompare(signature, expectedSignature);
-    }
-    catch (_a) {
-        return false;
-    }
-}
-/**
- * Constant-time string comparison to prevent timing attacks
- *
- * Compares two strings in constant time to prevent timing-based attacks
- * that could leak information about the expected signature.
- *
- * @param {string} a - First string to compare
- * @param {string} b - Second string to compare
- * @returns {boolean} True if strings are equal
- */
-function constantTimeCompare(a, b) {
-    if (a.length !== b.length) {
-        return false;
-    }
-    let result = 0;
-    for (let i = 0; i < a.length; i++) {
-        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
-    }
-    return result === 0;
-}
-/**
- * Generate a secure random token for client-side use
- *
- * Creates a cryptographically secure random token using the browser's
- * crypto.getRandomValues() function.
- *
- * @param {number} [length=32] - Token length in bytes
- * @returns {string} Hex-encoded random token
- * @export
- */
-export function generateSecureToken(length = 32) {
-    const array = new Uint8Array(length);
-    crypto.getRandomValues(array);
-    return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('');
-}
-/**
- * Environment-specific secret derivation
- *
- * Returns environment-specific secrets for HMAC signing. In a real implementation,
- * this would derive from environment variables. For client-side use, this provides
- * basic tamper resistance only.
- *
- * WARNING: Client-side secrets are NOT secure against determined attackers.
- * This is defense-in-depth only. Real security comes from server-side validation.
- *
- * @param {'production' | 'staging'} environment - Target environment
- * @returns {string} Environment-specific secret
- * @export
- */
-export function getSigningSecret(environment) {
-    // WARNING: Client-side secrets are NOT secure against determined attackers
-    // This is defense-in-depth only. Real security comes from server-side validation.
-    const baseSecrets = {
-        production: 'safepassage-prod-hmac-2025',
-        staging: 'safepassage-stage-hmac-2025',
-    };
-    return baseSecrets[environment];
-}
-/**
- * Create signed state parameter with timestamp and integrity protection
- *
- * Creates a signed state parameter containing the payload with added timestamp
- * and nonce for freshness and replay protection. The entire payload is signed
- * using HMAC-SHA256 and base64 encoded for URL safety.
- *
- * @param {unknown} payload - Data to include in state parameter
- * @param {'production' | 'staging'} environment - Target environment
- * @returns {Promise<string>} Promise resolving to base64-encoded signed state
- * @export
- */
-export async function createSignedState(payload, environment) {
-    // Add timestamp for freshness
-    const timestampedPayload = Object.assign(Object.assign({}, payload), { timestamp: Date.now(), nonce: generateSecureToken(16) });
-    const dataString = JSON.stringify(timestampedPayload);
-    const secret = getSigningSecret(environment);
-    const signature = await generateHMAC(dataString, secret);
-    // Combine data and signature
-    const signedPayload = {
-        data: timestampedPayload,
-        signature,
-    };
-    return btoa(JSON.stringify(signedPayload));
-}
-/**
- * Verify and parse signed state parameter
- *
- * Parses and verifies a signed state parameter, checking the HMAC signature
- * and timestamp freshness. Returns the original payload if validation succeeds.
- *
- * @param {string} signedState - Base64-encoded signed state parameter
- * @param {'production' | 'staging'} environment - Source environment
- * @param {number} [maxAge] - Maximum age in milliseconds
- * @returns {Promise<unknown | null>} Promise resolving to payload or null if invalid
- * @export
- */
-export async function parseSignedState(signedState, environment, maxAge = STATE_EXPIRY_MS) {
-    try {
-        const json = atob(signedState);
-        const signedPayload = JSON.parse(json);
-        if (!signedPayload.data || !signedPayload.signature) {
-            console.warn('SafePassage: Invalid signed state format');
-            return null;
-        }
-        const { data, signature } = signedPayload;
-        const dataString = JSON.stringify(data);
-        const secret = getSigningSecret(environment);
-        // Verify signature
-        const isValid = await verifyHMAC(dataString, signature, secret);
-        if (!isValid) {
-            console.warn('SafePassage: State signature verification failed');
-            return null;
-        }
-        // Check timestamp freshness
-        if (data.timestamp) {
-            const age = Date.now() - data.timestamp;
-            if (age > maxAge) {
-                console.warn('SafePassage: State parameter expired', { age, maxAge });
-                return null;
-            }
-        }
-        // Remove internal fields before returning
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        const { timestamp, nonce } = data, payload = __rest(data, ["timestamp", "nonce"]);
-        return payload;
-    }
-    catch (error) {
-        console.warn('SafePassage: Failed to parse signed state', error);
-        return null;
-    }
-}

package/dist/utils/environment.d.ts

@@ -1,13 +0,0 @@
-/**
- * Environment utilities for SafePassage SDK with security enforcement
- */
-export declare function getEnvironmentUrl(environment: 'production' | 'staging'): string;
-export declare function getApiUrl(environment: 'production' | 'staging'): string;
-/**
- * Detect environment - always defaults to production unless staging is detected
- */
-export declare function detectEnvironment(): 'production' | 'staging';
-/**
- * Validate environment configuration on startup
- */
-export declare function validateEnvironmentSecurity(environment: 'production' | 'staging'): void;

package/dist/utils/environment.js

@@ -1,75 +0,0 @@
-/**
- * Environment utilities for SafePassage SDK with security enforcement
- */
-const ENVIRONMENT_URLS = {
-    production: 'https://av.safepassageapp.com',
-    staging: 'https://av.staging.safepassageapp.com',
-};
-export function getEnvironmentUrl(environment) {
-    // Default to production for unknown environments (like 'development')
-    const url = ENVIRONMENT_URLS[environment] || ENVIRONMENT_URLS.production;
-    // Security check: Ensure production/staging always use HTTPS
-    if (!url || !url.startsWith('https://')) {
-        throw new Error(`HTTPS required for ${environment} environment`);
-    }
-    return url;
-}
-export function getApiUrl(environment) {
-    const apiUrls = {
-        production: 'https://api.safepassageapp.com',
-        staging: 'https://api.staging.safepassageapp.com',
-    };
-    // Default to production for unknown environments (like 'development')
-    const url = apiUrls[environment] || apiUrls.production;
-    // Security check: Ensure HTTPS is always used
-    if (!url || !url.startsWith('https://')) {
-        throw new Error(`HTTPS required for API URLs in ${environment} environment`);
-    }
-    return url;
-}
-/**
- * Detect environment - always defaults to production unless staging is detected
- */
-export function detectEnvironment() {
-    const hostname = window.location.hostname;
-    if (hostname.includes('staging') || hostname.includes('stage')) {
-        // Enforce HTTPS in staging
-        if (window.location.protocol !== 'https:') {
-            console.error('SafePassage Security Error: HTTPS required in staging environment');
-        }
-        return 'staging';
-    }
-    // Default to production environment - strict HTTPS enforcement
-    if (window.location.protocol !== 'https:') {
-        console.warn('SafePassage Warning: HTTPS recommended for production environment');
-    }
-    return 'production';
-}
-/**
- * Validate environment configuration on startup
- */
-export function validateEnvironmentSecurity(environment) {
-    // Check current page protocol
-    const isSecure = window.location.protocol === 'https:';
-    switch (environment) {
-        case 'production':
-            if (!isSecure) {
-                console.warn('SafePassage Warning: HTTPS recommended for production environment');
-            }
-            break;
-        case 'staging':
-            if (!isSecure) {
-                console.warn('SafePassage Warning: HTTPS strongly recommended in staging environment');
-            }
-            break;
-    }
-    // Validate environment URLs
-    try {
-        getEnvironmentUrl(environment);
-        getApiUrl(environment);
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        throw new Error(`Environment configuration validation failed: ${errorMessage}`);
-    }
-}

package/dist/utils/polyfills.js

@@ -1,58 +0,0 @@
-/**
- * Polyfills for browser compatibility
- */
-/**
- * Polyfill for crypto.randomUUID (not supported in older browsers)
- * Generates a UUID v4 using crypto.getRandomValues
- */
-export function setupPolyfills() {
-    // Polyfill crypto.randomUUID if not available
-    if (!crypto.randomUUID) {
-        crypto.randomUUID =
-            function () {
-                // Generate 16 random bytes
-                const array = new Uint8Array(16);
-                crypto.getRandomValues(array);
-                // Set version (4) and variant bits
-                array[6] = (array[6] & 0x0f) | 0x40; // Version 4
-                array[8] = (array[8] & 0x3f) | 0x80; // Variant 10
-                // Convert to hex string with dashes
-                const hex = Array.from(array)
-                    .map((b) => b.toString(16).padStart(2, '0'))
-                    .join('');
-                return [
-                    hex.slice(0, 8),
-                    hex.slice(8, 12),
-                    hex.slice(12, 16),
-                    hex.slice(16, 20),
-                    hex.slice(20, 32),
-                ].join('-');
-            };
-    }
-    // Note: URLSearchParams is widely supported (IE 11 doesn't support it, but we're not targeting IE 11)
-    // If needed, a polyfill can be added here
-}
-/**
- * Check browser compatibility and warn about unsupported features
- */
-export function checkBrowserCompatibility() {
-    const warnings = [];
-    // Check for required features
-    if (!window.crypto || !window.crypto.getRandomValues) {
-        throw new Error('SafePassage SDK requires Web Crypto API support');
-    }
-    if (!window.crypto.subtle) {
-        throw new Error('SafePassage SDK requires Web Crypto subtle API for HMAC operations');
-    }
-    // Check for features that we can polyfill
-    if (!crypto.randomUUID) {
-        warnings.push('crypto.randomUUID not supported, using polyfill');
-    }
-    if (!window.URLSearchParams) {
-        warnings.push('URLSearchParams not supported, consider adding a polyfill for IE 11 support');
-    }
-    // Log warnings if any
-    if (warnings.length > 0) {
-        console.warn('SafePassage SDK Browser Compatibility:', warnings.join('; '));
-    }
-}