@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -0,0 +1,538 @@
+import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
+import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
+//#region src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.ts
+function parseWebAuthnAuthenticatorRowDeviceInfo(raw) {
+	return parseWebAuthnAuthenticatorDeviceInfoJson(raw);
+}
+function parseWebAuthnLoginChallengeRecord(input) {
+	const candidate = parseWebAuthnJsonInput(input);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const record = candidate;
+	if (!hasExactFields(record, [
+		"version",
+		"challengeId",
+		"userId",
+		"rpId",
+		"challengeB64u",
+		"createdAtMs",
+		"expiresAtMs"
+	])) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
+	const userId = normalizeOptionalTrimmedString(record.userId);
+	const rpId = normalizeOptionalTrimmedString(record.rpId);
+	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
+	const createdAtMs = positiveInteger(record.createdAtMs);
+	const expiresAtMs = positiveInteger(record.expiresAtMs);
+	if (version !== "webauthn_login_challenge_v1") return null;
+	if (!challengeId || !userId || !rpId || !challengeB64u) return null;
+	if (createdAtMs === null || expiresAtMs === null) return null;
+	return {
+		version: "webauthn_login_challenge_v1",
+		challengeId,
+		userId,
+		rpId,
+		challengeB64u,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseWebAuthnSyncChallengeRecord(input) {
+	const candidate = parseWebAuthnJsonInput(input);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const record = candidate;
+	if (!hasExactFields(record, Object.hasOwn(record, "expectedUserId") ? [
+		"version",
+		"challengeId",
+		"rpId",
+		"expectedUserId",
+		"challengeB64u",
+		"createdAtMs",
+		"expiresAtMs"
+	] : [
+		"version",
+		"challengeId",
+		"rpId",
+		"challengeB64u",
+		"createdAtMs",
+		"expiresAtMs"
+	])) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
+	const rpId = normalizeOptionalTrimmedString(record.rpId);
+	const expectedUserId = normalizeOptionalTrimmedString(record.expectedUserId);
+	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
+	const createdAtMs = positiveInteger(record.createdAtMs);
+	const expiresAtMs = positiveInteger(record.expiresAtMs);
+	if (version !== "webauthn_sync_challenge_v1") return null;
+	if (Object.hasOwn(record, "expectedUserId") && !expectedUserId) return null;
+	if (!challengeId || !rpId || !challengeB64u) return null;
+	if (createdAtMs === null || expiresAtMs === null) return null;
+	return {
+		version: "webauthn_sync_challenge_v1",
+		challengeId,
+		rpId,
+		...expectedUserId ? { expectedUserId } : {},
+		challengeB64u,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseWebAuthnRecoveryRegistrationChallengeRecord(input) {
+	const candidate = parseWebAuthnJsonInput(input);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const record = candidate;
+	const fields = Object.keys(record);
+	const expectedFields = [
+		"version",
+		"challengeId",
+		"walletId",
+		"reservationId",
+		"recoveryOperationId",
+		"targetDeviceId",
+		"targetAuthorityId",
+		"targetWalletAuthMethodId",
+		"origin",
+		"rpId",
+		"replacementId",
+		"challengeB64u",
+		"continuityAnchor",
+		"createdAtMs",
+		"expiresAtMs"
+	];
+	if (fields.length !== expectedFields.length || expectedFields.some((field) => !fields.includes(field))) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
+	const walletId = parseWalletId(record.walletId);
+	let reservationId = null;
+	try {
+		reservationId = parseRecoveryCodeReservationId(record.reservationId);
+	} catch {
+		reservationId = null;
+	}
+	const recoveryOperationId = parseWalletRecoveryOperationId(record.recoveryOperationId);
+	const targetDeviceId = parseDeviceId(record.targetDeviceId);
+	const targetAuthorityId = parseWalletAuthorityId(record.targetAuthorityId);
+	const targetWalletAuthMethodId = parseWalletAuthMethodId(record.targetWalletAuthMethodId);
+	const origin = normalizeOptionalTrimmedString(record.origin);
+	const rpId = parseWebAuthnRpId(record.rpId);
+	const replacementId = normalizeOptionalTrimmedString(record.replacementId);
+	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
+	const continuityAnchor = parseWebAuthnRecoveryContinuityAnchor(record.continuityAnchor);
+	const createdAtMs = positiveInteger(record.createdAtMs);
+	const expiresAtMs = positiveInteger(record.expiresAtMs);
+	if (version !== "webauthn_recovery_registration_challenge_v2") return null;
+	if (!challengeId || !walletId.ok || !reservationId || !recoveryOperationId.ok || !targetDeviceId.ok || !targetAuthorityId.ok || !targetWalletAuthMethodId.ok || !origin || !rpId.ok || !replacementId || !challengeB64u || !continuityAnchor || continuityAnchor.method.walletId !== walletId.value || continuityAnchor.envelope.walletId !== walletId.value) return null;
+	if (createdAtMs === null || expiresAtMs === null || expiresAtMs <= createdAtMs) return null;
+	return {
+		version: "webauthn_recovery_registration_challenge_v2",
+		challengeId,
+		walletId: walletId.value,
+		reservationId,
+		recoveryOperationId: recoveryOperationId.value,
+		targetDeviceId: targetDeviceId.value,
+		targetAuthorityId: targetAuthorityId.value,
+		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+		origin,
+		rpId: rpId.value,
+		replacementId,
+		challengeB64u,
+		continuityAnchor,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseWebAuthnRecoveryContinuityAnchor(input) {
+	const candidate = parseWebAuthnJsonInput(input);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const record = candidate;
+	const expectedFields = [
+		"kind",
+		"authority",
+		"method",
+		"envelope"
+	];
+	const fields = Object.keys(record);
+	if (fields.length !== expectedFields.length || expectedFields.some((field) => !fields.includes(field))) return null;
+	if (record.kind !== "wallet_recovery_continuity_anchor_v1") return null;
+	const authority = parseWalletAuthorityV1(record.authority);
+	const method = parseWalletAuthMethodRecordV2(record.method);
+	const envelope = parseWebAuthnRecoveryContinuityEnvelopeAnchor(record.envelope);
+	if (!authority.ok || authority.value.state !== "active" || !method || method.status !== "active" || !envelope || method.walletId !== authority.value.walletId || method.walletAuthorityId !== authority.value.authorityId) return null;
+	if (method.kind === "passkey") {
+		if (envelope.kind !== "passkey" || envelope.rpId !== method.rpId || envelope.credentialIdB64u !== method.credentialIdB64u) return null;
+	} else if (envelope.kind !== "email_otp") return null;
+	return {
+		kind: "wallet_recovery_continuity_anchor_v1",
+		authority: authority.value,
+		method,
+		envelope
+	};
+}
+function buildWebAuthnRecoveryContinuityAnchorRecord(input) {
+	if (input.authority.state !== "active" || input.authority.walletId !== input.method.walletId || input.method.walletAuthorityId !== input.authority.authorityId || input.envelope.walletId !== input.method.walletId || input.envelope.lifecycle.state !== "active" || input.envelope.binding.kind !== "wallet_custody_seed_v1" || input.envelope.ownership.kind !== "method_bound" || input.envelope.ownership.walletAuthMethodId !== input.method.walletAuthMethodId) throw new Error("continuity anchor method and envelope identities do not match");
+	const envelope = buildWebAuthnRecoveryContinuityEnvelopeAnchor(input.envelope);
+	if (input.method.kind === "passkey") {
+		if (envelope.kind !== "passkey" || envelope.rpId !== input.method.rpId || envelope.credentialIdB64u !== input.method.credentialIdB64u) throw new Error("passkey continuity anchor factor does not match its method");
+	} else if (envelope.kind !== "email_otp") throw new Error("email continuity anchor factor does not match its method");
+	return {
+		kind: "wallet_recovery_continuity_anchor_v1",
+		authority: input.authority,
+		method: input.method,
+		envelope
+	};
+}
+function buildWebAuthnRecoveryContinuityEnvelopeAnchor(envelope) {
+	if (envelope.lifecycle.state !== "active") throw new Error("continuity anchor envelope must be active");
+	switch (envelope.factor.kind) {
+		case "passkey": return {
+			kind: "passkey",
+			envelopeId: envelope.envelopeId,
+			walletId: envelope.walletId,
+			rpId: envelope.factor.rpId,
+			credentialIdB64u: envelope.factor.credentialIdB64u,
+			envelopeRevision: envelope.envelopeRevision,
+			updatedAtMs: envelope.updatedAtMs,
+			bindingKind: "wallet_custody_seed_v1"
+		};
+		case "email_otp": return {
+			kind: "email_otp",
+			envelopeId: envelope.envelopeId,
+			walletId: envelope.walletId,
+			enrollmentId: envelope.factor.enrollmentId,
+			enrollmentSealKeyVersion: envelope.factor.enrollmentSealKeyVersion,
+			envelopeRevision: envelope.envelopeRevision,
+			updatedAtMs: envelope.updatedAtMs,
+			bindingKind: "wallet_custody_seed_v1"
+		};
+	}
+}
+function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {
+	const candidate = parseWebAuthnJsonInput(input);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const record = candidate;
+	const kind = normalizeOptionalTrimmedString(record.kind);
+	const envelopeId = parsePasskeyEnvelopeId(record.envelopeId);
+	const walletId = parseWalletId(record.walletId);
+	const envelopeRevision = parseRecoveryEnvelopeRevision(record.envelopeRevision);
+	const updatedAtMs = positiveInteger(record.updatedAtMs);
+	if (!kind || !envelopeId.ok || !walletId.ok || !envelopeRevision || updatedAtMs === null || record.bindingKind !== "wallet_custody_seed_v1") return null;
+	if (kind === "passkey") {
+		if (!hasExactFields(record, [
+			"kind",
+			"envelopeId",
+			"walletId",
+			"rpId",
+			"credentialIdB64u",
+			"envelopeRevision",
+			"updatedAtMs",
+			"bindingKind"
+		])) return null;
+		const rpId = parseWebAuthnRpId(record.rpId);
+		const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
+		if (!rpId.ok || !credentialIdB64u.ok) return null;
+		return {
+			kind: "passkey",
+			envelopeId: envelopeId.value,
+			walletId: walletId.value,
+			rpId: rpId.value,
+			credentialIdB64u: credentialIdB64u.value,
+			envelopeRevision,
+			updatedAtMs,
+			bindingKind: "wallet_custody_seed_v1"
+		};
+	}
+	if (kind === "email_otp") {
+		if (!hasExactFields(record, [
+			"kind",
+			"envelopeId",
+			"walletId",
+			"enrollmentId",
+			"enrollmentSealKeyVersion",
+			"envelopeRevision",
+			"updatedAtMs",
+			"bindingKind"
+		])) return null;
+		const enrollmentId = normalizeOptionalTrimmedString(record.enrollmentId);
+		const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(record.enrollmentSealKeyVersion);
+		if (!enrollmentId || !enrollmentSealKeyVersion) return null;
+		return {
+			kind: "email_otp",
+			envelopeId: envelopeId.value,
+			walletId: walletId.value,
+			enrollmentId,
+			enrollmentSealKeyVersion,
+			envelopeRevision,
+			updatedAtMs,
+			bindingKind: "wallet_custody_seed_v1"
+		};
+	}
+	return null;
+}
+function parseRecoveryEnvelopeRevision(input) {
+	try {
+		return parseEnvelopeRevision(input);
+	} catch {
+		return null;
+	}
+}
+function hasExactFields(record, expectedFields) {
+	const fields = Object.keys(record);
+	return fields.length === expectedFields.length && expectedFields.every((field) => fields.includes(field));
+}
+function parseWebAuthnAuthenticator(row) {
+	const credentialIdB64u = normalizeOptionalTrimmedString(row?.credential_id_b64u);
+	const credentialPublicKeyB64u = normalizeOptionalTrimmedString(row?.credential_public_key_b64u);
+	const counter = nonNegativeSafeInteger(row?.counter);
+	const createdAtMs = positiveInteger(row?.created_at_ms);
+	const updatedAtMs = positiveInteger(row?.updated_at_ms);
+	if (!credentialIdB64u || !credentialPublicKeyB64u) return null;
+	if (counter === null || createdAtMs === null || updatedAtMs === null) return null;
+	return {
+		credentialIdB64u,
+		credentialPublicKeyB64u,
+		counter,
+		createdAtMs,
+		updatedAtMs,
+		deviceInfo: parseWebAuthnAuthenticatorRowDeviceInfo(row?.device_info_json)
+	};
+}
+function parseWebAuthnBinding(row) {
+	const candidate = parseWebAuthnJsonInput(row.record_json);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const record = candidate;
+	if (Object.keys(record).some((field) => ![
+		"version",
+		"rpId",
+		"credentialIdB64u",
+		"userId",
+		"nearAccountId",
+		"nearEd25519SigningKeyId",
+		"signerSlot",
+		"publicKey",
+		"relayerKeyId",
+		"keyVersion",
+		"recoveryExportCapable",
+		"clientParticipantId",
+		"relayerParticipantId",
+		"participantIds",
+		"runtimePolicyScope",
+		"createdAtMs",
+		"updatedAtMs"
+	].includes(field))) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const rpId = normalizeOptionalTrimmedString(record.rpId);
+	const credentialIdB64u = normalizeOptionalTrimmedString(record.credentialIdB64u);
+	const userId = normalizeOptionalTrimmedString(record.userId);
+	const signerSlot = positiveInteger(record.signerSlot);
+	if (version !== "webauthn_credential_binding_v1" || !rpId || !credentialIdB64u || !userId) return null;
+	const nearAccountId = normalizeOptionalTrimmedString(record.nearAccountId);
+	const nearEd25519SigningKeyId = normalizeOptionalTrimmedString(record.nearEd25519SigningKeyId);
+	const publicKey = normalizeOptionalTrimmedString(record.publicKey);
+	const relayerKeyId = normalizeOptionalTrimmedString(record.relayerKeyId);
+	const keyVersion = normalizeOptionalTrimmedString(record.keyVersion);
+	const clientParticipantId = optionalNonNegativeInteger(record.clientParticipantId);
+	const relayerParticipantId = optionalNonNegativeInteger(record.relayerParticipantId);
+	const participantIds = optionalNumberArray(record.participantIds);
+	const runtimePolicyScope = parseWebAuthnRuntimePolicyScope(record.runtimePolicyScope);
+	const createdAtMs = positiveInteger(record.createdAtMs);
+	const updatedAtMs = positiveInteger(record.updatedAtMs);
+	if (createdAtMs === null || updatedAtMs === null) return null;
+	const base = {
+		version: "webauthn_credential_binding_v1",
+		rpId,
+		credentialIdB64u,
+		userId,
+		...relayerKeyId ? { relayerKeyId } : {},
+		...keyVersion ? { keyVersion } : {},
+		...typeof record.recoveryExportCapable === "boolean" ? { recoveryExportCapable: record.recoveryExportCapable } : {},
+		...clientParticipantId !== void 0 ? { clientParticipantId } : {},
+		...relayerParticipantId !== void 0 ? { relayerParticipantId } : {},
+		...participantIds ? { participantIds } : {},
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		createdAtMs,
+		updatedAtMs
+	};
+	if (!(Boolean(nearAccountId || nearEd25519SigningKeyId || publicKey) || signerSlot !== null)) return base;
+	if (!nearAccountId || !nearEd25519SigningKeyId || !publicKey || signerSlot === null) return null;
+	return {
+		...base,
+		nearAccountId,
+		nearEd25519SigningKeyId,
+		publicKey,
+		signerSlot
+	};
+}
+function webAuthnSyncWalletBindingFromCredentialBinding(binding) {
+	const { nearAccountId, nearEd25519SigningKeyId, signerSlot } = binding;
+	if (!nearAccountId || !nearEd25519SigningKeyId || signerSlot === void 0) return null;
+	return {
+		walletId: binding.userId,
+		nearAccountId,
+		nearEd25519SigningKeyId,
+		rpId: binding.rpId,
+		credentialIdB64u: binding.credentialIdB64u,
+		signerSlot
+	};
+}
+function parseNearPublicKey(row) {
+	const candidate = parseWebAuthnJsonInput(row.record_json);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const record = candidate;
+	if (Object.keys(record).some((field) => ![
+		"publicKey",
+		"kind",
+		"authBinding",
+		"signerSlot",
+		"createdAtMs",
+		"updatedAtMs"
+	].includes(field))) return null;
+	const publicKey = normalizeOptionalTrimmedString(record.publicKey);
+	const kind = parseNearPublicKeyKind(normalizeOptionalTrimmedString(record.kind));
+	const authBinding = parseNearPublicKeyAuthBinding(record);
+	if (authBinding === null) return null;
+	if (!publicKey || !kind) return null;
+	return {
+		publicKey,
+		kind,
+		signerSlot: optionalNonNegativeInteger(record.signerSlot),
+		...authBinding ? { authBinding } : {},
+		createdAtMs: optionalNonNegativeInteger(record.createdAtMs),
+		updatedAtMs: optionalNonNegativeInteger(record.updatedAtMs)
+	};
+}
+function parseWebAuthnJsonInput(input) {
+	if (typeof input === "string") try {
+		return JSON.parse(input);
+	} catch {
+		return null;
+	}
+	return input;
+}
+function parseWebAuthnRuntimePolicyScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(raw);
+	} catch {
+		return;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return void 0;
+	const record = raw;
+	if (!hasExactFields(record, [
+		"orgId",
+		"projectId",
+		"envId",
+		"signingRootVersion"
+	])) return;
+	try {
+		return normalizeRuntimePolicyScope(record);
+	} catch {
+		return;
+	}
+}
+function optionalNumberArray(input) {
+	if (!Array.isArray(input)) return void 0;
+	const values = [];
+	for (const item of input) {
+		const value = nonNegativeSafeInteger(item);
+		if (value === null) return void 0;
+		values.push(value);
+	}
+	return values;
+}
+function parseNearPublicKeyKind(input) {
+	switch (input) {
+		case "threshold":
+		case "local":
+		case "backup":
+		case "ephemeral": return input;
+		default: return null;
+	}
+}
+function parseNearPublicKeyAuthBinding(record) {
+	if (Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u")) return null;
+	if (record.authBinding === void 0) return void 0;
+	const candidate = record.authBinding;
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
+	let prototype;
+	try {
+		prototype = Object.getPrototypeOf(candidate);
+	} catch {
+		return null;
+	}
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	const authBinding = candidate;
+	const kind = normalizeOptionalTrimmedString(authBinding.kind);
+	const rpId = parseWebAuthnRpId(authBinding.rpId);
+	const credentialIdB64u = normalizeOptionalTrimmedString(authBinding.credentialIdB64u);
+	if (kind !== "passkey" || !rpId.ok || !credentialIdB64u) return null;
+	return {
+		kind: "passkey",
+		rpId: rpId.value,
+		credentialIdB64u
+	};
+}
+//#endregion
+export { buildWebAuthnRecoveryContinuityAnchorRecord, parseNearPublicKey, parseWebAuthnAuthenticator, parseWebAuthnAuthenticatorRowDeviceInfo, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord, webAuthnSyncWalletBindingFromCredentialBinding };
+
+//# sourceMappingURL=d1WebAuthnRecords.js.map