@seams/wallet-server 0.5.0

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js

@@ -0,0 +1,540 @@
+import { parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { json, readJson } from "../../../framework/http.js";
+import { InMemoryRouterAbEd25519YaoRecoveryService, buildWarmRecoveryBootstrapResponse, recoveryAuthorizationBinding } from "./routerAbEd25519YaoRecovery.js";
+import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "../registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
+//#region src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.ts
+var RecoveryAdmissionRequestRun = class {
+	constructor(context, request) {
+		this.context = context;
+		this.request = request;
+	}
+	async prepare(state) {
+		const authorized = await this.context.input.authorization.authorize({
+			kind: "admit",
+			request: this.context.input.request,
+			body: this.request
+		});
+		if (!authorized.ok) return {
+			kind: "rejected",
+			value: authorized
+		};
+		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization));
+		switch (prepared.kind) {
+			case "claimed": return {
+				kind: "claimed",
+				state,
+				claim: prepared.claim
+			};
+			case "completed": return {
+				kind: "completed",
+				value: {
+					ok: true,
+					status: 200,
+					value: prepared.value
+				}
+			};
+			case "failed": return {
+				kind: "rejected",
+				value: prepared.failure
+			};
+		}
+	}
+	async backend(_claim) {
+		try {
+			return {
+				kind: "response",
+				value: await this.context.input.backend.admitRecovery(this.request, this.context.trace)
+			};
+		} catch (error) {
+			return {
+				kind: "uncertain",
+				message: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async complete(state, claim, backend) {
+		return {
+			state,
+			value: this.service(state).commitAdmitRecovery({
+				request: this.request,
+				claim,
+				outcome: {
+					kind: "backend_response",
+					result: backend
+				}
+			})
+		};
+	}
+	service(state) {
+		return new InMemoryRouterAbEd25519YaoRecoveryService(this.context.input.backend, state.recovery);
+	}
+};
+var RecoveryExecutionRequestRun = class {
+	constructor(context, request) {
+		this.context = context;
+		this.request = request;
+	}
+	async prepare(state) {
+		const authorized = await this.context.input.authorization.authorize({
+			kind: "execute",
+			request: this.context.input.request,
+			body: this.request
+		});
+		if (!authorized.ok) return {
+			kind: "rejected",
+			value: authorized
+		};
+		const prepared = this.service(state).prepareExecuteRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization));
+		switch (prepared.kind) {
+			case "claimed": return {
+				kind: "claimed",
+				state,
+				claim: prepared.claim
+			};
+			case "completed": return {
+				kind: "completed",
+				value: {
+					ok: true,
+					status: 200,
+					value: prepared.value
+				}
+			};
+			case "failed": return {
+				kind: "rejected",
+				value: prepared.failure
+			};
+		}
+	}
+	async backend(_claim) {
+		try {
+			return {
+				kind: "response",
+				value: await this.context.input.backend.executeRecovery(this.request, _claim.admissionRequest, this.context.trace)
+			};
+		} catch (error) {
+			return {
+				kind: "uncertain",
+				message: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async complete(state, claim, backend) {
+		return {
+			state,
+			value: this.service(state).commitExecuteRecovery({
+				request: this.request,
+				claim,
+				outcome: {
+					kind: "backend_response",
+					result: backend
+				}
+			})
+		};
+	}
+	service(state) {
+		return new InMemoryRouterAbEd25519YaoRecoveryService(this.context.input.backend, state.recovery);
+	}
+};
+var RecoveryActivationRequestRun = class {
+	constructor(context, request) {
+		this.context = context;
+		this.request = request;
+	}
+	async prepare(state) {
+		const authorized = await this.context.input.authorization.authorize({
+			kind: "activate",
+			request: this.context.input.request,
+			body: this.request
+		});
+		if (!authorized.ok) return {
+			kind: "rejected",
+			value: authorized
+		};
+		const prepared = this.service(state).prepareActivateRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization));
+		switch (prepared.kind) {
+			case "claimed": return {
+				kind: "claimed",
+				state,
+				claim: prepared.claim
+			};
+			case "completed": return {
+				kind: "completed",
+				value: {
+					ok: true,
+					status: 200,
+					value: prepared.value
+				}
+			};
+			case "failed": return {
+				kind: "rejected",
+				value: prepared.failure
+			};
+		}
+	}
+	async backend(_claim) {
+		try {
+			return {
+				kind: "response",
+				value: await this.context.input.backend.activateRecovery(this.request, this.context.trace)
+			};
+		} catch (error) {
+			return {
+				kind: "uncertain",
+				message: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async complete(state, claim, backend) {
+		const committed = await this.service(state).commitActivateRecovery({
+			request: this.request,
+			claim,
+			outcome: {
+				kind: "backend_response",
+				result: backend
+			}
+		});
+		return {
+			state,
+			value: committed.kind === "completed" ? committed.value : committed.failure
+		};
+	}
+	service(state) {
+		return new InMemoryRouterAbEd25519YaoRecoveryService(this.context.input.backend, state.recovery, this.context.input.capabilityPersistence);
+	}
+};
+async function handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1(input) {
+	if (input.request.method !== "POST") return json({
+		ok: false,
+		code: "method_not_allowed",
+		message: "Method not allowed"
+	}, { status: 405 });
+	const trace = resolveTrace(input.request);
+	if (!trace.ok) return json({
+		ok: false,
+		code: "invalid_trace_id",
+		message: trace.message
+	}, { status: 400 });
+	const parsed = await parseRecoveryRequest(input.request);
+	if ("response" in parsed) return parsed.response;
+	const context = {
+		input,
+		trace: trace.value
+	};
+	try {
+		if (parsed.kind === "warm_bootstrap") return await runWarmRecoveryBootstrapRequest(context, parsed.value);
+		if (parsed.kind === "status") return await runRecoveryStatusRequest(context, parsed.value);
+		return recoveryResponse(await runRecoveryRequest(context, parsed));
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "router_state_unavailable",
+			message: error instanceof Error ? error.message : String(error)
+		}, { status: 503 });
+	}
+}
+async function runRecoveryStatusRequest(context, request) {
+	const authorized = await context.input.authorization.authorize({
+		kind: "admit",
+		request: context.input.request,
+		body: request.admission
+	});
+	if (!authorized.ok) return json({
+		ok: false,
+		code: authorized.code,
+		message: authorized.message
+	}, { status: authorized.status });
+	const lifecycleId = request.admission.scope.lifecycle_id;
+	return json(recoveryStatus(lifecycleId, (await context.input.store.load(lifecycleId)).state.recovery.recoveries.get(JSON.stringify(request.admission))), { status: 200 });
+}
+function recoveryStatus(lifecycleId, recovery) {
+	if (!recovery) return {
+		stage: "missing",
+		lifecycle_id: lifecycleId
+	};
+	switch (recovery.kind) {
+		case "admitting":
+		case "admission_failed": return {
+			stage: "missing",
+			lifecycle_id: lifecycleId
+		};
+		case "admitted":
+		case "executing":
+		case "execution_failed": return {
+			stage: "admitted",
+			lifecycle_id: lifecycleId,
+			admission_receipt: recovery.admissionReceipt
+		};
+		case "staged":
+		case "activating":
+		case "activation_failed": return {
+			stage: "executed",
+			lifecycle_id: lifecycleId,
+			admission_receipt: recovery.admissionReceipt,
+			execution_result: recovery.result
+		};
+		case "promoted": return {
+			stage: "promoted",
+			lifecycle_id: lifecycleId,
+			admission_receipt: recovery.admissionReceipt,
+			execution_result: recovery.result,
+			activation_receipt: recovery.activationReceipt
+		};
+	}
+}
+async function runWarmRecoveryBootstrapRequest(context, request) {
+	const authorized = await context.input.authorization.authorize({
+		kind: "bootstrap",
+		request: context.input.request,
+		body: request
+	});
+	if (!authorized.ok) return json({
+		ok: false,
+		code: authorized.code,
+		message: authorized.message
+	}, { status: authorized.status });
+	if (authorized.authorization.kind === "wallet_recovery") return json({
+		ok: false,
+		code: "wallet_session_claims_invalid",
+		message: "warm recovery requires a Wallet Session"
+	}, { status: 401 });
+	const activeCapability = await context.input.capabilities.resolveActiveCapability({
+		kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+		walletId: request.walletId,
+		nearEd25519SigningKeyId: request.nearEd25519SigningKeyId,
+		signerSlot: request.signerSlot,
+		signingWorkerId: request.signingWorkerId,
+		participantIds: request.participantIds
+	});
+	if (!activeCapability.ok) return json({
+		ok: false,
+		code: activeCapability.code,
+		message: activeCapability.message
+	}, { status: activeCapability.code === "unknown_capability" ? 404 : 409 });
+	const response = await buildWarmRecoveryBootstrapResponse({
+		request,
+		authorization: authorized.authorization,
+		capability: activeCapability.capability,
+		linkedAuthorities: context.input.linkedAuthorities ?? null
+	});
+	if (!response) return json({
+		ok: false,
+		code: "continuity_mismatch",
+		message: "active Ed25519 Yao capability does not match the Wallet Session lifecycle"
+	}, { status: 409 });
+	return json(response, { status: 200 });
+}
+async function runRecoveryRequest(context, request) {
+	switch (request.kind) {
+		case "admit": return await runAdmissionRequest(context, request.value);
+		case "execute": return await runExecutionRequest(context, request.value);
+		case "activate": return await runActivationRequest(context, request.value);
+	}
+}
+async function runAdmissionRequest(context, request) {
+	const first = await runAdmissionTwoPhase(context, request);
+	if (first.kind !== "rejected" || first.value.ok || first.value.code !== "unknown_capability") return mapAdmissionResult(first);
+	const resolved = await context.input.capabilities.resolveActiveCapability({
+		kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+		walletId: request.application_binding.wallet_id,
+		nearEd25519SigningKeyId: request.application_binding.near_ed25519_signing_key_id,
+		signerSlot: request.application_binding.key_creation_signer_slot,
+		signingWorkerId: request.scope.signing_worker_id,
+		participantIds: request.participant_ids
+	});
+	if (!resolved.ok) return activeCapabilityResolutionFailure(resolved);
+	return mapAdmissionResult(await runAdmissionTwoPhase(context, request));
+}
+async function runAdmissionTwoPhase(context, request) {
+	const run = new RecoveryAdmissionRequestRun(context, request);
+	return await runRouterAbEd25519YaoRegistrationTwoPhaseV1({
+		lifecycleId: request.scope.lifecycle_id,
+		store: context.input.store,
+		prepare: run.prepare.bind(run),
+		backend: run.backend.bind(run),
+		complete: run.complete.bind(run)
+	});
+}
+function activeCapabilityResolutionFailure(resolution) {
+	switch (resolution.code) {
+		case "invalid_lookup": return {
+			ok: false,
+			status: 400,
+			code: "invalid_request",
+			message: resolution.message
+		};
+		case "unknown_capability": return {
+			ok: false,
+			status: 404,
+			code: "unknown_capability",
+			message: resolution.message
+		};
+		case "capability_conflict": return {
+			ok: false,
+			status: 409,
+			code: "capability_conflict",
+			message: resolution.message
+		};
+	}
+}
+async function runExecutionRequest(context, request) {
+	const run = new RecoveryExecutionRequestRun(context, request);
+	return mapExecutionResult(await runRouterAbEd25519YaoRegistrationTwoPhaseV1({
+		lifecycleId: request.binding.lifecycle.lifecycle_id,
+		store: context.input.store,
+		prepare: run.prepare.bind(run),
+		backend: run.backend.bind(run),
+		complete: run.complete.bind(run)
+	}));
+}
+async function runActivationRequest(context, request) {
+	const run = new RecoveryActivationRequestRun(context, request);
+	return mapActivationResult(await runRouterAbEd25519YaoRegistrationTwoPhaseV1({
+		lifecycleId: request.binding.lifecycle.lifecycle_id,
+		store: context.input.store,
+		prepare: run.prepare.bind(run),
+		backend: run.backend.bind(run),
+		complete: run.complete.bind(run)
+	}));
+}
+function mapAdmissionResult(result) {
+	switch (result.kind) {
+		case "committed":
+		case "completed":
+		case "rejected": return result.value;
+		case "preclaim_version_mismatch": return stateConflictFailure("admission_failed", "preclaim", result.key);
+		case "backend_uncertain": return backendUncertainFailure("admission_failed", result.message);
+		case "terminal_version_mismatch": return stateConflictFailure("admission_failed", "terminal", result.key);
+	}
+}
+function mapExecutionResult(result) {
+	switch (result.kind) {
+		case "committed":
+		case "completed":
+		case "rejected": return result.value;
+		case "preclaim_version_mismatch": return stateConflictFailure("execution_failed", "preclaim", result.key);
+		case "backend_uncertain": return backendUncertainFailure("execution_failed", result.message);
+		case "terminal_version_mismatch": return stateConflictFailure("execution_failed", "terminal", result.key);
+	}
+}
+function mapActivationResult(result) {
+	switch (result.kind) {
+		case "committed":
+		case "completed":
+		case "rejected": return result.value;
+		case "preclaim_version_mismatch": return activationStateConflictFailure("preclaim", result.key);
+		case "backend_uncertain": return backendUncertainFailure("activation_failed", result.message);
+		case "terminal_version_mismatch": return activationStateConflictFailure("terminal", result.key);
+	}
+}
+function stateConflictFailure(code, phase, key) {
+	return {
+		ok: false,
+		status: phase === "preclaim" ? 409 : 503,
+		code,
+		message: phase === "preclaim" ? `Yao recovery claim conflicted on ${key}` : `Yao recovery terminal state is uncertain after a ${key} conflict`
+	};
+}
+function activationStateConflictFailure(phase, key) {
+	return {
+		ok: false,
+		status: phase === "preclaim" ? 409 : 503,
+		code: "activation_failed",
+		message: phase === "preclaim" ? `Yao recovery activation claim conflicted on ${key}` : `Yao recovery activation terminal state is uncertain after a ${key} conflict`
+	};
+}
+function backendUncertainFailure(code, message) {
+	return {
+		ok: false,
+		status: 503,
+		code,
+		message
+	};
+}
+async function parseRecoveryRequest(request) {
+	const raw = await readJson(request);
+	const pathname = new URL(request.url).pathname;
+	if (pathname === "/router-ab/ed25519/yao/recovery/bootstrap") {
+		const parsed = parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1(raw);
+		return parsed.ok ? {
+			kind: "warm_bootstrap",
+			value: parsed.value
+		} : { response: json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 }) };
+	}
+	if (pathname === "/router-ab/ed25519/yao/recovery/admit") {
+		const parsed = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(raw);
+		return parsed.ok ? {
+			kind: "admit",
+			value: parsed.value
+		} : { response: json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 }) };
+	}
+	if (pathname === "/router-ab/ed25519/yao/recovery/execute") {
+		const parsed = parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(raw);
+		return parsed.ok ? {
+			kind: "execute",
+			value: parsed.value
+		} : { response: json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 }) };
+	}
+	if (pathname === "/router-ab/ed25519/yao/recovery/activate") {
+		const parsed = parseRouterAbEd25519YaoRecoveryActivationRequestV1(raw);
+		return parsed.ok ? {
+			kind: "activate",
+			value: parsed.value
+		} : { response: json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 }) };
+	}
+	if (pathname === "/router-ab/ed25519/yao/recovery/status") {
+		const parsed = parseRouterAbEd25519YaoRecoveryStatusRequestV1(raw);
+		return parsed.ok ? {
+			kind: "status",
+			value: parsed.value
+		} : { response: json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 }) };
+	}
+	return { response: json({
+		ok: false,
+		code: "not_found",
+		message: "Not found"
+	}, { status: 404 }) };
+}
+function resolveTrace(request) {
+	const parsed = parseRouterAbTraceContextV1(request.headers.get(ROUTER_AB_TRACE_ID_HEADER_V1));
+	if (parsed.ok) return parsed;
+	if (parsed.reason === "missing") return {
+		ok: true,
+		value: createRouterAbTraceContextV1()
+	};
+	return {
+		ok: false,
+		message: parsed.message
+	};
+}
+function recoveryResponse(result) {
+	return result.ok ? json(result.value, { status: result.status }) : json({
+		ok: false,
+		code: result.code,
+		message: result.message
+	}, { status: result.status });
+}
+//#endregion
+export { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 };
+
+//# sourceMappingURL=routerAbEd25519YaoRecoveryRequestScopedCloudflare.js.map