@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/router/transport/fetch/routes/externalAuth.js

@@ -0,0 +1,351 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { EXTERNAL_AUTH_PATH, externalAuthFailure, parseExternalAuthConfiguration } from "../../../../shared-ts/src/auth/externalAuth.js";
+import { externalOwnerChallenge, readExternalOwnerOperation } from "../../../../auth/externalOwnerOperations.js";
+import { authorizeWalletOwnerOperation, completeWalletOwnerOperation, walletOwnerOperationAuthorizationId } from "../walletOwnerOperationAuthorization.js";
+import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { json, readJson } from "../../../framework/http.js";
+//#region src/router/transport/fetch/routes/externalAuth.ts
+const ACTIONS = [
+	"associate",
+	"unlink",
+	"prepare",
+	"prepare-association",
+	"prepare-unlink",
+	"owner-challenge",
+	"exchange",
+	"backend-exchange",
+	"redeem",
+	"settings",
+	"logout"
+];
+function parseIdentityProof(value) {
+	const proof = requireRecord(value, "external identity proof");
+	switch (proof.kind) {
+		case "google": return {
+			kind: "google",
+			idToken: requireCanonicalString(proof.idToken, "idToken")
+		};
+		case "application": return {
+			kind: "application",
+			assertion: requireCanonicalString(proof.assertion, "assertion")
+		};
+		default: throw new Error("Unsupported external identity proof");
+	}
+}
+function parseCommand(action, body) {
+	const wallet = parseWalletId(body.walletId);
+	if (!wallet.ok) throw new Error("Wallet ID is invalid");
+	const walletId = wallet.value;
+	if (action === "backend-exchange") return {
+		action,
+		walletId,
+		attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+		proof: parseIdentityProof(body.proof)
+	};
+	const appOrigin = requireCanonicalString(body.appOrigin, "appOrigin");
+	if (new URL(appOrigin).origin !== appOrigin) throw new Error("Application origin is invalid");
+	switch (action) {
+		case "associate":
+		case "unlink": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code"),
+			factorProof: body.factorProof
+		};
+		case "owner-challenge": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code")
+		};
+		case "prepare-unlink": return {
+			action,
+			walletId,
+			appOrigin,
+			associationId: requireCanonicalString(body.associationId, "associationId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken")
+		};
+		case "prepare":
+		case "prepare-association": return {
+			action,
+			walletId,
+			appOrigin,
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken")
+		};
+		case "exchange": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			idToken: requireCanonicalString(body.idToken, "idToken")
+		};
+		case "redeem": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code")
+		};
+		case "settings":
+		case "logout": return {
+			action,
+			walletId,
+			appOrigin,
+			sessionToken: secret(body.sessionToken, "sessionToken")
+		};
+		default: return assertNever(action);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unsupported external authentication action: ${String(value)}`);
+}
+function externalAuthRoutes() {
+	return ACTIONS.map(externalAuthRoute);
+}
+function externalAuthRoute(action) {
+	return {
+		id: `external_auth_${action}`,
+		surface: "relay",
+		method: "POST",
+		path: `${EXTERNAL_AUTH_PATH}/${action}`,
+		auth: {
+			plane: "public",
+			proof: "challenge_exchange",
+			rationale: "Application credentials and scoped external identity evidence are verified by the handler."
+		},
+		metering: { kind: "none" },
+		summary: "External authentication for wallet settings"
+	};
+}
+function parseAction(pathname) {
+	for (const action of ACTIONS) if (pathname === `/wallet/external-auth/${action}`) return action;
+	return null;
+}
+function secret(value, label) {
+	const text = requireCanonicalString(value, label);
+	if (!/^[A-Za-z0-9_-]{43}$/.test(text)) throw new Error(`${label} must contain 32 random bytes`);
+	return text;
+}
+function failure(status, code) {
+	return json(externalAuthFailure(code), {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+async function resolveApplicationTrust(ctx, service, command) {
+	const credential = extractBearerCredential(ctx.request.headers);
+	if (!credential) return null;
+	const scope = service.store.scope;
+	if (ctx.request.headers.get("x-seams-environment-id") !== scope.envId) return null;
+	const result = command.action === "backend-exchange" ? await ctx.opts.apiKeyAuth?.authenticate({
+		secret: credential,
+		endpoint: ctx.pathname,
+		requiredScopes: ["wallets.read"],
+		environmentId: scope.envId
+	}) : await ctx.opts.publishableKeyAuth?.authenticate({
+		secret: credential,
+		origin: ctx.request.headers.get("origin") || "",
+		environmentId: scope.envId
+	});
+	if (!result?.ok || result.principal.orgId !== scope.orgId || result.principal.projectId !== scope.projectId || result.principal.environmentId !== scope.envId) return null;
+	if (command.action !== "backend-exchange") {
+		const parent = await ctx.opts.publishableKeyAuth?.authenticate({
+			secret: credential,
+			origin: command.appOrigin,
+			environmentId: scope.envId
+		});
+		if (!parent?.ok || parent.principal.apiKeyId !== result.principal.apiKeyId) return null;
+	}
+	const environment = (await ctx.opts.orgProjectEnv?.listEnvironments({
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environmentId: scope.envId,
+		actorUserId: result.principal.apiKeyId,
+		roles: []
+	}, { status: "ACTIVE" }))?.find(matchesEnvironment.bind(null, scope.envId));
+	return parseExternalAuthConfiguration(environment?.externalAuth ?? {
+		kind: "disabled",
+		revision: 0
+	});
+}
+function matchesEnvironment(environmentId, environment) {
+	return environment.id === environmentId;
+}
+async function handleExternalAuth(ctx) {
+	const action = parseAction(ctx.pathname);
+	if (!action) return null;
+	if (ctx.method !== "POST") return failure(405, "invalid_request");
+	const service = ctx.service.externalAuth;
+	if (!service) return failure(503, "unavailable");
+	let command;
+	try {
+		command = parseCommand(action, requireRecord(await readJson(ctx.request), "external authentication request"));
+	} catch {
+		return failure(400, "invalid_request");
+	}
+	try {
+		const trust = await resolveApplicationTrust(ctx, service, command);
+		if (!trust) return failure(403, "access_denied");
+		return await dispatch(ctx, service, trust, command);
+	} catch {
+		return failure(503, "unavailable");
+	}
+}
+async function dispatch(ctx, service, trust, command) {
+	const walletId = command.walletId;
+	if (command.action === "prepare" || command.action === "prepare-association" || command.action === "prepare-unlink" || command.action === "exchange" || command.action === "backend-exchange" || command.action === "associate") {
+		const rateKey = await sha256HexUtf8(resolveSourceIpFromFetchHeaders(ctx.request.headers) || "unknown");
+		if (!await service.store.consumeAuthenticationAllowance(rateKey, Date.now())) return failure(429, "rate_limited");
+	}
+	if (command.action === "backend-exchange") {
+		if (trust.kind === "disabled") return failure(403, "access_denied");
+		return json(await service.exchange({
+			walletId,
+			attemptId: command.attemptId,
+			proof: command.proof,
+			trust
+		}));
+	}
+	const originBinding = JSON.stringify([ctx.request.headers.get("origin") || "", command.appOrigin]);
+	if (command.action === "prepare-unlink") return json(await service.prepareUnlink({
+		walletId,
+		associationId: command.associationId,
+		originBinding,
+		binding: command.binding,
+		sessionToken: command.sessionToken,
+		trustRevision: trust.revision
+	}));
+	if (command.action === "owner-challenge" || command.action === "associate" || command.action === "unlink") {
+		const binding = {
+			walletId,
+			attemptId: command.attemptId,
+			originBinding,
+			bindingHash: await sha256HexUtf8(command.binding),
+			sessionTokenHash: await sha256HexUtf8(command.sessionToken),
+			codeHash: await sha256HexUtf8(command.code),
+			trustRevision: trust.revision,
+			nowMs: Date.now()
+		};
+		const result = await readExternalOwnerOperation({
+			store: service.store,
+			binding,
+			requestOrigin: ctx.request.headers.get("origin") || "",
+			phase: command.action === "owner-challenge" ? "prepare" : "complete"
+		});
+		if (!result.ok) return json(result, { status: 403 });
+		const ownerOperation = result.value;
+		if (command.action === "owner-challenge") return json({
+			ok: true,
+			value: externalOwnerChallenge(ownerOperation)
+		});
+		if (command.action !== ownerOperation.attempt.purpose) return failure(403, "access_denied");
+		if (ownerOperation.attempt.status === "consumed") {
+			const stored = await ctx.service.authorizedOperations.readAuthorizedOperationById({
+				tenantId: ctx.service.authorizedOperations.tenantId,
+				authorizedOperationId: walletOwnerOperationAuthorizationId(ownerOperation.operation, ownerOperation.challengeB64u)
+			});
+			if (!stored || stored.authorization.kind !== "verified_step_up" || stored.quota.kind !== "quota_neutral" || stored.lifecycle !== "completed") return failure(503, "unavailable");
+			return new Response(stored.response.bodyText, {
+				status: stored.response.status,
+				headers: {
+					"Content-Type": stored.response.contentType,
+					"Cache-Control": "no-store"
+				}
+			});
+		}
+		const authorized = await authorizeWalletOwnerOperation({
+			ctx,
+			walletId,
+			operation: ownerOperation.operation,
+			payload: ownerOperation.payload,
+			factorProof: command.factorProof
+		});
+		if (!authorized.ok) return authorized.response;
+		if (!await service.store.consumeOwnerAttempt({
+			walletId,
+			attemptId: binding.attemptId,
+			originBinding,
+			bindingHash: binding.bindingHash,
+			sessionTokenHash: binding.sessionTokenHash,
+			codeHash: binding.codeHash,
+			trustRevision: binding.trustRevision,
+			nowMs: Date.now()
+		}, authorized.ownerAuthority)) return completeWalletOwnerOperation(ctx, authorized.operation, 403, externalAuthFailure("access_denied"), "failed_before_side_effect");
+		const attempt = ownerOperation.attempt;
+		if (attempt.purpose === "associate") {
+			if (!await service.store.associate({
+				walletId,
+				identity: attempt.identity,
+				authorityId: authorized.ownerAuthority.authorityId,
+				authorityEpoch: authorized.ownerAuthority.revocationEpoch
+			})) return completeWalletOwnerOperation(ctx, authorized.operation, 403, externalAuthFailure("access_denied"), "failed_before_side_effect");
+		} else await service.store.revokeAssociation({
+			walletId,
+			associationId: attempt.associationId,
+			owner: authorized.ownerAuthority
+		});
+		return completeWalletOwnerOperation(ctx, authorized.operation, 200, {
+			ok: true,
+			value: null
+		});
+	}
+	if (trust.kind === "disabled") return failure(403, "access_denied");
+	if (command.action === "prepare" || command.action === "prepare-association") return json(await service.prepare({
+		purpose: command.action === "prepare" ? "authenticate" : "associate",
+		walletId,
+		originBinding,
+		binding: command.binding,
+		sessionToken: command.sessionToken
+	}));
+	if (command.action === "exchange") return json(await service.exchange({
+		trust,
+		walletId,
+		attemptId: command.attemptId,
+		proof: {
+			kind: "google",
+			idToken: command.idToken
+		}
+	}));
+	const tokenHash = await sha256HexUtf8(command.sessionToken);
+	if (command.action === "logout") {
+		await service.store.revokeSession(tokenHash, originBinding);
+		return json({ ok: true });
+	}
+	const authentication = command.action === "redeem" ? await service.store.redeem({
+		walletId,
+		originBinding,
+		attemptId: command.attemptId,
+		bindingHash: await sha256HexUtf8(command.binding),
+		codeHash: await sha256HexUtf8(command.code),
+		sessionTokenHash: tokenHash,
+		nowMs: Date.now(),
+		trustRevision: trust.revision
+	}) : await service.store.readSession({
+		tokenHash,
+		originBinding,
+		nowMs: Date.now(),
+		trustRevision: trust.revision
+	});
+	if (!authentication || authentication.walletId !== walletId) return failure(403, "access_denied");
+	return json({
+		ok: true,
+		value: await service.settings(authentication)
+	}, { headers: { "Cache-Control": "no-store" } });
+}
+//#endregion
+export { externalAuthRoutes, handleExternalAuth };
+
+//# sourceMappingURL=externalAuth.js.map

package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js

@@ -1,9 +1,9 @@
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { json } from "../../../framework/http.js";
 import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret } from "../../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 import { prepareOwnerWalletExecution } from "../../../domains/signingOperations/walletExecutionAdmission.js";
-import { json } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/normalSigningRouterProxy.ts
 async function proxyNormalSigningRequestToMpcRouter(input) {
 	const proxy = input.proxy;