@safepassage/sdk 3.4.8 → 3.4.10

package/dist/utils/security.js

@@ -1,190 +0,0 @@
-/**
- * Security utilities for SafePassage SDK
- * Enhanced origin validation and security enforcement
- */
-/**
- * Trusted SafePassage origins for different environments
- * These are the only origins allowed to send PostMessage events
- */
-const TRUSTED_ORIGINS = {
-    production: [
-        'https://av.safepassageapp.com',
-        'https://portal.safepassageapp.com',
-        'https://api.safepassageapp.com',
-    ],
-    staging: [
-        'https://av.staging.safepassageapp.com',
-        'https://portal.staging.safepassageapp.com',
-        'https://api.staging.safepassageapp.com',
-    ],
-};
-/**
- * Validate if an origin is trusted for the given environment
- */
-export function isOriginTrusted(origin, environment) {
-    const trustedOrigins = TRUSTED_ORIGINS[environment];
-    return trustedOrigins.includes(origin);
-}
-/**
- * Enhanced origin validation with logging and strict allowlist
- */
-export function validatePostMessageOrigin(event, environment, allowedCustomOrigins = []) {
-    var _a;
-    const { origin } = event;
-    // Check against trusted SafePassage origins
-    if (isOriginTrusted(origin, environment)) {
-        return true;
-    }
-    // Check against custom allowed origins (for merchant websites)
-    if (allowedCustomOrigins.length > 0) {
-        const isCustomOriginAllowed = allowedCustomOrigins.some((allowedOrigin) => {
-            // Support wildcard subdomains (e.g., "*.example.com")
-            if (allowedOrigin.startsWith('*.')) {
-                const domain = allowedOrigin.slice(2);
-                return (origin.endsWith(`.${domain}`) ||
-                    origin === `https://${domain}` ||
-                    origin === `http://${domain}`);
-            }
-            return origin === allowedOrigin;
-        });
-        if (isCustomOriginAllowed) {
-            return true;
-        }
-    }
-    // Log security violation for debugging
-    console.warn(`SafePassage Security: Blocked PostMessage from untrusted origin: ${origin}`, {
-        environment,
-        trustedOrigins: TRUSTED_ORIGINS[environment],
-        allowedCustomOrigins,
-        eventType: (_a = event.data) === null || _a === void 0 ? void 0 : _a.type,
-    });
-    return false;
-}
-/**
- * Validate SafePassage message format and content
- */
-export function validateSafePassageMessage(event, expectedSessionId) {
-    const { data } = event;
-    // Check message format
-    if (!data || typeof data !== 'object') {
-        return { isValid: false, error: 'Invalid message format' };
-    }
-    // Check message type
-    if (data.type !== 'safepassage:verification:complete') {
-        return { isValid: false, error: 'Invalid message type' };
-    }
-    // Check session ID
-    if (!data.sessionId || data.sessionId !== expectedSessionId) {
-        return { isValid: false, error: 'Session ID mismatch' };
-    }
-    // Check status field
-    if (!data.status || !['verified', 'failed'].includes(data.status)) {
-        return { isValid: false, error: 'Invalid status value' };
-    }
-    return { isValid: true };
-}
-/**
- * Enforce HTTPS in production environment
- */
-export function enforceHTTPS(environment) {
-    if (environment === 'production' && window.location.protocol !== 'https:') {
-        console.warn('SafePassage Warning: HTTPS recommended for production environment', {
-            current: window.location.href,
-        });
-    }
-}
-/**
- * Validate URL security for return/cancel URLs
- */
-export function validateReturnUrl(url, environment) {
-    try {
-        const parsed = new URL(url);
-        // Production and staging should use HTTPS, except for localhost (for development)
-        if (parsed.protocol !== 'https:') {
-            // Allow localhost for development use cases
-            const isLocalhost = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
-            if (!isLocalhost) {
-                return {
-                    isValid: false,
-                    error: `HTTPS required for return URLs in ${environment}`,
-                };
-            }
-        }
-        // Block suspicious URLs
-        const suspiciousPatterns = [
-            /data:/i,
-            /javascript:/i,
-            /vbscript:/i,
-            /file:/i,
-            /ftp:/i,
-        ];
-        for (const pattern of suspiciousPatterns) {
-            if (pattern.test(url)) {
-                return { isValid: false, error: 'Blocked suspicious URL scheme' };
-            }
-        }
-        return { isValid: true };
-    }
-    catch (_a) {
-        return { isValid: false, error: 'Invalid URL format' };
-    }
-}
-/**
- * Generate secure session ID with entropy validation
- */
-export function generateSecureSessionId() {
-    // Use crypto.randomUUID if available (modern browsers)
-    if (crypto.randomUUID) {
-        return crypto.randomUUID();
-    }
-    // Fallback to secure random generation
-    const array = new Uint8Array(16);
-    crypto.getRandomValues(array);
-    // Convert to UUID v4 format
-    const hex = Array.from(array)
-        .map((b) => b.toString(16).padStart(2, '0'))
-        .join('');
-    return [
-        hex.slice(0, 8),
-        hex.slice(8, 12),
-        '4' + hex.slice(13, 16), // Version 4
-        ((parseInt(hex.slice(16, 17), 16) & 0x3) | 0x8).toString(16) +
-            hex.slice(17, 20), // Variant
-        hex.slice(20, 32),
-    ].join('-');
-}
-/**
- * Rate limiting for verification attempts
- */
-class VerificationRateLimit {
-    constructor() {
-        this.attempts = new Map();
-        this.maxAttempts = 5;
-        this.timeWindow = 60000; // 1 minute
-    }
-    isAllowed(identifier) {
-        const now = Date.now();
-        const attempts = this.attempts.get(identifier) || [];
-        // Filter out old attempts
-        const recentAttempts = attempts.filter((time) => now - time < this.timeWindow);
-        if (recentAttempts.length >= this.maxAttempts) {
-            console.warn(`SafePassage Security: Rate limit exceeded for ${identifier}`);
-            return false;
-        }
-        // Add current attempt
-        recentAttempts.push(now);
-        this.attempts.set(identifier, recentAttempts);
-        return true;
-    }
-    reset(identifier) {
-        this.attempts.delete(identifier);
-    }
-}
-export const verificationRateLimit = new VerificationRateLimit();
-/**
- * Security event logging for monitoring
- */
-export function logSecurityEvent(event, details) {
-    console.warn(`SafePassage Security Event: ${event}`, Object.assign({ timestamp: new Date().toISOString(), userAgent: navigator.userAgent, url: window.location.href }, details));
-    // In production, this could send events to a security monitoring service
-}

package/dist/utils/validation.js

@@ -1,158 +0,0 @@
-/**
- * Validation utilities for SafePassage SDK
- */
-import { validateReturnUrl } from './security';
-export const MINIMUM_AGE = 25;
-export const MAXIMUM_AGE = 150;
-export const MAX_URL_LENGTH = 2048;
-export const MAX_API_KEY_LENGTH = 128;
-export const STATE_EXPIRY_MS = 600000; // 10 minutes
-// SafePassage supports both public (pk_) and private (sk_) API keys
-const API_KEY_PATTERN = /^(pk_|sk_)[a-zA-Z0-9_]+$/;
-const UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-export function validateConfig(config) {
-    if (!config.apiKey) {
-        throw new Error('apiKey is required');
-    }
-    if (config.apiKey.length > MAX_API_KEY_LENGTH) {
-        throw new Error(`apiKey exceeds maximum length of ${MAX_API_KEY_LENGTH} characters`);
-    }
-    if (!API_KEY_PATTERN.test(config.apiKey)) {
-        throw new Error('Invalid apiKey format. Expected pk_xxx (public) or sk_xxx (private)');
-    }
-    // Prevent Secret Keys from being used in browser code
-    if (typeof window !== 'undefined' && config.apiKey.startsWith('sk_')) {
-        throw new Error('Secret keys (sk_) should never be used in browser code for security reasons. ' +
-            'Secret keys expose your account to unauthorized access if used client-side. ' +
-            'Please use your public key (pk_) instead. ' +
-            'If you need to use features that require a secret key (like custom challenge age), ' +
-            'create the session server-side and pass the sessionId to startVerificationWithSession(). ' +
-            'See: https://docs.safepassageapp.com/server-side-sessions');
-    }
-    if (!config.returnUrl) {
-        throw new Error('returnUrl is required');
-    }
-    if (config.returnUrl.length > MAX_URL_LENGTH) {
-        throw new Error(`returnUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`);
-    }
-    // Enhanced URL validation with security checks
-    const environment = detectEnvironment();
-    const returnUrlValidation = validateReturnUrl(config.returnUrl, environment);
-    if (!returnUrlValidation.isValid) {
-        throw new Error(`returnUrl validation failed: ${returnUrlValidation.error}`);
-    }
-    // cancelUrl is deprecated but still validate if provided for backwards compatibility
-    if (config.cancelUrl) {
-        if (config.cancelUrl.length > MAX_URL_LENGTH) {
-            throw new Error(`cancelUrl exceeds maximum length of ${MAX_URL_LENGTH} characters`);
-        }
-        const cancelUrlValidation = validateReturnUrl(config.cancelUrl, environment);
-        if (!cancelUrlValidation.isValid) {
-            throw new Error(`cancelUrl validation failed: ${cancelUrlValidation.error}`);
-        }
-    }
-    if (config.defaultChallengeAge !== undefined) {
-        if (config.defaultChallengeAge < MINIMUM_AGE) {
-            throw new Error(`defaultChallengeAge must be at least ${MINIMUM_AGE}`);
-        }
-        if (config.defaultChallengeAge > MAXIMUM_AGE) {
-            throw new Error(`defaultChallengeAge cannot exceed ${MAXIMUM_AGE}`);
-        }
-    }
-    if (config.defaultVerificationMode &&
-        !['L1', 'L2'].includes(config.defaultVerificationMode)) {
-        throw new Error('defaultVerificationMode must be L1 or L2');
-    }
-    if (config.mode && !['redirect', 'new-tab'].includes(config.mode)) {
-        throw new Error('mode must be redirect or new-tab');
-    }
-}
-/**
- * Detect environment based on current URL - defaults to production unless staging detected
- */
-function detectEnvironment() {
-    // If no window (server environment), default to production for safety
-    if (typeof window === 'undefined') {
-        return 'production';
-    }
-    const hostname = window.location.hostname;
-    if (hostname.includes('staging') || hostname.includes('stage')) {
-        return 'staging';
-    }
-    return 'production';
-}
-export function validateSessionId(sessionId) {
-    if (!sessionId) {
-        throw new Error('sessionId is required');
-    }
-    if (!UUID_V4_PATTERN.test(sessionId)) {
-        throw new Error('sessionId must be a valid UUID v4');
-    }
-}
-export function validateChallengeAge(age) {
-    if (age !== undefined) {
-        if (age < MINIMUM_AGE) {
-            throw new Error(`challengeAge must be at least ${MINIMUM_AGE}`);
-        }
-        if (age > MAXIMUM_AGE) {
-            throw new Error(`challengeAge cannot exceed ${MAXIMUM_AGE}`);
-        }
-    }
-}
-// URL validation now handled by security.ts validateReturnUrl function
-/**
- * Generate signed state parameter with HMAC protection
- * Uses client-side HMAC for tamper resistance and server-side verification
- */
-export async function generateState(payload, environment) {
-    // Import crypto utilities
-    const { createSignedState } = await import('./crypto');
-    return createSignedState(payload, environment);
-}
-/**
- * Parse and validate signed state parameter
- */
-export async function parseState(state, environment) {
-    try {
-        // Import crypto utilities
-        const { parseSignedState } = await import('./crypto');
-        // Try parsing as signed state first (new format)
-        const signedPayload = await parseSignedState(state, environment);
-        if (signedPayload) {
-            // Type guard to ensure signedPayload has required properties
-            const payload = signedPayload;
-            // Validate payload structure (cancelUrl is deprecated and no longer required)
-            if (!payload.merchantId ||
-                !payload.sessionId ||
-                !payload.returnUrl) {
-                return null;
-            }
-            // Cast to unknown first to satisfy TypeScript's type checking
-            return payload;
-        }
-        // Fallback to legacy base64 format for backwards compatibility
-        console.warn('SafePassage: Falling back to legacy state format - update your SDK');
-        const json = atob(state);
-        const payload = JSON.parse(json);
-        // Validate payload structure (cancelUrl is deprecated and no longer required)
-        if (!payload.merchantId ||
-            !payload.sessionId ||
-            !payload.returnUrl) {
-            return null;
-        }
-        // Check timestamp expiration
-        const age = Date.now() - payload.timestamp;
-        if (age > STATE_EXPIRY_MS) {
-            console.warn('SafePassage: State parameter expired', {
-                age,
-                maxAge: STATE_EXPIRY_MS,
-            });
-            return null;
-        }
-        return payload;
-    }
-    catch (error) {
-        console.warn('SafePassage: Failed to parse state parameter', error);
-        return null;
-    }
-}