@seams/wallet-server 0.5.0

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -0,0 +1,309 @@
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbEcdsaDerivationActiveStateId } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
+import { getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport } from "../../framework/routeExtensions.js";
+import { coerceRouterLogger } from "../../framework/logger.js";
+import { json, withCors } from "../../framework/http.js";
+import { handleHealth, handleReady } from "./routes/health.js";
+import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
+import { handleWalletRegistration } from "./routes/walletRegistration.js";
+import { handlePasskeyCustody, handleWalletCustodyCredentialLabel, handleWalletCustodyCredentialsList, handleWalletCustodyEmailOtpChallenge, handleWalletCustodyEnvelopeOwnershipUpgrade, handleWalletRecoveryBackupAcknowledge, handleWalletRecoveryEmailOtpRelease, handleWalletRecoveryEmailOtpVerify, handleWalletRecoveryFinalize, handleWalletRecoveryGoogleEmailOtpFinalize, handleWalletRecoveryGoogleVerify, handleWalletRecoveryPrepare, handleWalletRecoveryRead, handleWalletRecoveryRotate, handleWalletRecoveryStatus } from "./routes/passkeyCustody.js";
+import { handleThresholdEcdsa } from "./routes/thresholdEcdsa.js";
+import { handleExactWalletSessionStatus, handleHostedWalletSessionExchangeIssue, handleHostedWalletSessionExchangeRedeem, handleWalletEmailOtpChallenge, handleWalletEmailOtpDevCleanupGoogleRegistration, handleWalletEmailOtpDevOutbox, handleWalletEmailOtpFactorRelease, handleWalletEmailOtpRegistrationSeal, handleWalletUnlockChallenge, handleWalletUnlockVerify } from "./routes/sessions.js";
+import { handleSyncAccount } from "./routes/syncAccount.js";
+import { handleThresholdEd25519 } from "./routes/thresholdEd25519.js";
+import { handleOwnerWalletExecutionLanePreflight } from "./routes/walletExecutionLanePreflight.js";
+import { handleWebAuthnAuthenticators } from "./routes/webauthnAuthenticators.js";
+import { handleAuth } from "./routes/auth.js";
+import { handleNearPublicKeys } from "./routes/nearPublicKeys.js";
+import { validateRouterApiRorOptions } from "../../framework/ror/provider.js";
+import { handleWellKnown } from "./routes/wellKnown.js";
+import { handleDeviceLinking } from "./routes/deviceLinking.js";
+import { handleDeviceManagement } from "./routes/deviceManagement.js";
+import { handleDeviceLinkingOwnerAuthorization } from "./routes/deviceLinkingOwnerAuthorization.js";
+import { handleSigningSessionSealRoutes } from "../../../threshold/session/signingSessionSeal/transport/fetch.js";
+import "../../framework/routerApi.js";
+import { resolveRouterApiModuleRouteExtensions } from "../../framework/modules.js";
+import { attachRouterApiRouteSurface, resolveRouterApiRouteSurface } from "../../framework/routerApiRouteSurface.js";
+//#region src/router/transport/fetch/createFetchRouter.ts
+const SIGNING_SESSION_SEAL_OPERATIONS = [{
+	keyFamily: "ed25519",
+	operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
+}, {
+	keyFamily: "ecdsa_secp256k1",
+	operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
+}];
+async function signingSessionSealRecordFromExactAdmission(input) {
+	const admission = input.admission;
+	const walletId = String(admission.context.authorization.session.walletId);
+	const expiresAtMs = admission.context.authorization.session.expiresAtMs;
+	const materialActivation = routerAbMpcMaterialActivationRefToWire(admission.admission.materialActivation);
+	switch (admission.curve) {
+		case "ecdsa": {
+			const active = await input.walletRegistration.resolveEcdsaMaterialActivation({
+				walletId,
+				materialActivation
+			});
+			if (!active.ok) return { kind: active.code === "internal" ? "unavailable" : "inactive" };
+			const normalSigning = active.routerAbEcdsaDerivationNormalSigning;
+			if (normalSigning.scope.wallet_id !== walletId || normalSigning.scope.public_identity.threshold_public_key33_b64u !== admission.admission.signer.thresholdPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(active.materialActivation, materialActivation) || !sameRouterAbMpcMaterialActivationRef(normalSigning.scope.material_activation, materialActivation)) return { kind: "inactive" };
+			return {
+				kind: "resolved",
+				record: {
+					kind: "exact_wallet_session_operation_credential",
+					curve: "ecdsa",
+					thresholdSessionId: routerAbEcdsaDerivationActiveStateId(normalSigning),
+					userId: walletId,
+					expiresAtMs
+				}
+			};
+		}
+		case "ed25519": {
+			const active = await input.walletRegistration.resolveEd25519MaterialActivation({
+				walletId,
+				materialActivation
+			});
+			if (!active.ok) return { kind: active.code === "internal" ? "unavailable" : "inactive" };
+			const identity = active.exportIdentity;
+			if (identity.scope.account_id !== walletId || identity.application_binding.wallet_id !== walletId || base64UrlEncode(Uint8Array.from(identity.registered_public_key)) !== admission.admission.signer.registeredPublicKeyB64u || !sameRouterAbMpcMaterialActivationRef(active.materialActivation, materialActivation) || !sameRouterAbMpcMaterialActivationRef(identity.scope.material_activation, materialActivation)) return { kind: "inactive" };
+			return {
+				kind: "resolved",
+				record: {
+					kind: "exact_wallet_session_operation_credential",
+					curve: "ed25519",
+					thresholdSessionId: identity.scope.threshold_session_id,
+					userId: walletId,
+					expiresAtMs
+				}
+			};
+		}
+	}
+}
+async function authorizeSigningSessionSealWithExactWalletSession(authorizationSessions, walletRegistration, input) {
+	if (!authorizationSessions) return {
+		ok: false,
+		code: "sessions_disabled",
+		message: "Wallet Sessions are not configured",
+		status: 501
+	};
+	const token = extractBearerCredential(input.headers);
+	if (!token) return {
+		ok: false,
+		code: "wallet_session_missing",
+		message: "Wallet Session is missing",
+		status: 401
+	};
+	const nowMs = Date.now();
+	let context;
+	try {
+		context = await authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
+			token,
+			nowMs
+		});
+	} catch {
+		return {
+			ok: false,
+			code: "wallet_session_unavailable",
+			message: "Wallet Session is unavailable",
+			status: 503
+		};
+	}
+	if (!context) return {
+		ok: false,
+		code: "wallet_session_invalid",
+		message: "Wallet Session is invalid",
+		status: 401
+	};
+	const matchingRecords = [];
+	let admitted = false;
+	try {
+		for (const operation of SIGNING_SESSION_SEAL_OPERATIONS) {
+			const resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+				context,
+				nowMs,
+				operation
+			});
+			if (resolution.kind !== "admitted") continue;
+			admitted = true;
+			const record = await signingSessionSealRecordFromExactAdmission({
+				admission: resolution.admission,
+				walletRegistration
+			});
+			if (record.kind === "unavailable") return {
+				ok: false,
+				code: "wallet_session_unavailable",
+				message: "Wallet Session is unavailable",
+				status: 503
+			};
+			if (record.kind === "resolved" && record.record.thresholdSessionId === input.thresholdSessionId) matchingRecords.push(record.record);
+		}
+	} catch {
+		return {
+			ok: false,
+			code: "wallet_session_unavailable",
+			message: "Wallet Session is unavailable",
+			status: 503
+		};
+	}
+	if (matchingRecords.length === 1) {
+		const thresholdSession = matchingRecords[0];
+		return {
+			ok: true,
+			auth: {
+				userId: thresholdSession.userId,
+				session: thresholdSession
+			}
+		};
+	}
+	if (admitted) return {
+		ok: false,
+		code: "wallet_session_scope_mismatch",
+		message: "Wallet Session does not match the requested threshold session",
+		status: 403
+	};
+	return {
+		ok: false,
+		code: "wallet_session_invalid",
+		message: "Wallet Session is invalid",
+		status: 401
+	};
+}
+async function handleExactWalletSigningSessionSeal(context) {
+	return await handleSigningSessionSealRoutes({
+		request: context.request,
+		pathname: context.pathname,
+		method: context.method,
+		logger: context.logger,
+		authorize: authorizeSigningSessionSealWithExactWalletSession.bind(void 0, context.service.authorizationSessions, context.service.walletRegistration),
+		options: context.opts.signingSessionSeal
+	});
+}
+function createFetchRouter(service, opts, runtime) {
+	const notFound = () => new Response("Not Found", { status: 404 });
+	const sessionCookieName = String(opts.sessionCookieName || "").trim() || "seams-jwt";
+	const routeExtensions = resolveRouterApiModuleRouteExtensions(opts);
+	const effectiveOpts = {
+		...opts,
+		sessionCookieName,
+		routeExtensions,
+		modules: []
+	};
+	if (effectiveOpts.ror) validateRouterApiRorOptions(effectiveOpts.ror);
+	const logger = coerceRouterLogger(effectiveOpts.logger);
+	const routeSurface = resolveRouterApiRouteSurface(effectiveOpts, { transport: "fetch" });
+	const { routeDefinitions } = routeSurface;
+	const handlers = [
+		handleWellKnown,
+		handleWalletRegistration,
+		async (context) => await handleDeviceLinkingOwnerAuthorization(context, context.service.deviceLinkingOwnerAuthorization),
+		handleDeviceLinking,
+		async (context) => {
+			if (!context.pathname.startsWith("/wallet/device-linking/v1/devices")) return null;
+			const service = context.service.deviceManagement;
+			if (!service) return json({
+				ok: false,
+				code: "not_supported",
+				message: "Linked-device management is not configured"
+			}, { status: 501 });
+			return await handleDeviceManagement(context, service);
+		},
+		handlePasskeyCustody,
+		handleWalletCustodyEmailOtpChallenge,
+		handleWalletCustodyCredentialsList,
+		handleWalletCustodyCredentialLabel,
+		handleWalletCustodyEnvelopeOwnershipUpgrade,
+		handleWalletRecoveryPrepare,
+		handleWalletRecoveryGoogleVerify,
+		handleWalletRecoveryEmailOtpVerify,
+		handleWalletRecoveryEmailOtpRelease,
+		handleWalletRecoveryGoogleEmailOtpFinalize,
+		handleWalletRecoveryFinalize,
+		handleWalletRecoveryBackupAcknowledge,
+		handleWalletRecoveryRotate,
+		handleWalletRecoveryRead,
+		handleWalletRecoveryStatus,
+		handleAuth,
+		handleSyncAccount,
+		handleOwnerWalletExecutionLanePreflight,
+		handleThresholdEd25519,
+		handleThresholdEcdsa,
+		handleExactWalletSigningSessionSeal,
+		handleWebAuthnAuthenticators,
+		handleNearPublicKeys,
+		handleExactWalletSessionStatus,
+		handleHostedWalletSessionExchangeIssue,
+		handleHostedWalletSessionExchangeRedeem,
+		handleWalletUnlockChallenge,
+		handleWalletUnlockVerify,
+		handleWalletEmailOtpChallenge,
+		handleWalletEmailOtpFactorRelease,
+		handleWalletEmailOtpDevCleanupGoogleRegistration,
+		handleWalletEmailOtpRegistrationSeal,
+		handleWalletEmailOtpDevOutbox,
+		...getRouterApiRouteExtensionsForTransport(routeExtensions, "fetch").map((extension) => {
+			const extensionRoutes = getRouterApiRouteExtensionRoutes(extension, "fetch");
+			return async (c) => {
+				const route = findRouteDefinitionForRequest(extensionRoutes, c.method, c.pathname);
+				if (!route) return null;
+				return await extension.handleFetchRoute({
+					request: c.request,
+					route,
+					pathname: c.pathname,
+					method: c.method,
+					logger: c.logger,
+					runtime: c.runtime
+				});
+			};
+		}),
+		handleHealth,
+		handleReady
+	];
+	return attachRouterApiRouteSurface(async function handler(request, requestRuntime = runtime) {
+		const url = new URL(request.url);
+		const { pathname } = url;
+		const method = request.method.toUpperCase();
+		if (method === "OPTIONS") {
+			const res = new Response(null, { status: 204 });
+			withCors(res.headers, effectiveOpts, request);
+			return res;
+		}
+		const ctx = {
+			runtime: requestRuntime,
+			service,
+			opts: effectiveOpts,
+			logger,
+			routeDefinitions,
+			request,
+			url,
+			pathname,
+			method
+		};
+		try {
+			for (const fn of handlers) {
+				const res = await fn(ctx);
+				if (res) {
+					withCors(res.headers, effectiveOpts, request);
+					return res;
+				}
+			}
+			const res = notFound();
+			withCors(res.headers, effectiveOpts, request);
+			return res;
+		} catch (e) {
+			const res = json({
+				code: "internal",
+				message: e instanceof Error ? e.message : String(e)
+			}, { status: 500 });
+			withCors(res.headers, effectiveOpts, request);
+			return res;
+		}
+	}, routeSurface);
+}
+//#endregion
+export { authorizeSigningSessionSealWithExactWalletSession, createFetchRouter };
+
+//# sourceMappingURL=createFetchRouter.js.map

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -0,0 +1,219 @@
+import { json, readJson } from "../../../framework/http.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
+import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
+//#region src/router/transport/fetch/routes/auth.ts
+function assertNeverAuthProviderAction(route) {
+	throw new Error(`Unsupported auth provider action: ${String(route)}`);
+}
+function assertNeverAuthIdentityMutation(route) {
+	throw new Error(`Unsupported auth identity mutation: ${String(route)}`);
+}
+async function requireExactWalletSession(ctx) {
+	const token = extractBearerCredential(ctx.request.headers);
+	if (!token) return {
+		ok: false,
+		response: json({
+			ok: false,
+			code: "unauthorized",
+			message: "No valid Wallet Session"
+		}, { status: 401 })
+	};
+	try {
+		const context = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: ctx.service.authorizationSessions.tenantId,
+			token,
+			nowMs: Date.now()
+		});
+		if (!context) return {
+			ok: false,
+			response: json({
+				ok: false,
+				code: "unauthorized",
+				message: "No valid Wallet Session"
+			}, { status: 401 })
+		};
+		return {
+			ok: true,
+			context
+		};
+	} catch {
+		return {
+			ok: false,
+			response: json({
+				ok: false,
+				code: "wallet_session_unavailable",
+				message: "Wallet Session is unavailable"
+			}, { status: 503 })
+		};
+	}
+}
+async function requireExactPasskeyStepUp(input) {
+	const result = await input.ctx.service.webAuthn.verifyWebAuthnLogin(input.stepUp);
+	if (!result.ok) return {
+		ok: false,
+		response: json(result, { status: result.code === "internal" ? 500 : 400 })
+	};
+	const walletId = String(input.context.authorization.session.walletId);
+	if (String(result.userId).trim() !== walletId) return {
+		ok: false,
+		response: json({
+			ok: false,
+			code: "forbidden",
+			message: "Step-up user mismatch"
+		}, { status: 403 })
+	};
+	if (result.walletAuthMethodId !== input.context.authMethod.walletAuthMethodId || result.walletAuthorityId !== input.context.authority.authorityId) return {
+		ok: false,
+		response: json({
+			ok: false,
+			code: "forbidden",
+			message: "Step-up authority mismatch"
+		}, { status: 403 })
+	};
+	return { ok: true };
+}
+async function handleAuth(ctx) {
+	if (ctx.method === "GET" && ctx.pathname === "/auth/identities") {
+		const sess = await requireExactWalletSession(ctx);
+		if (!sess.ok) return sess.response;
+		const walletId = String(sess.context.authorization.session.walletId);
+		const out = await ctx.service.identity.listIdentities({ userId: walletId });
+		return json(out, { status: out.ok ? 200 : out.code === "internal" ? 500 : 400 });
+	}
+	if (ctx.method === "POST" && (ctx.pathname === "/auth/link" || ctx.pathname === "/auth/unlink")) {
+		const body = await readJson(ctx.request);
+		const origin = String(ctx.request.headers.get("origin") || "").trim() || void 0;
+		const parsed = parseAuthIdentityMutationRequest({
+			pathname: ctx.pathname,
+			body,
+			origin
+		});
+		if (!parsed) return null;
+		if (!parsed.ok) return json(parsed.body, { status: parsed.status });
+		const command = parsed.request;
+		const sess = await requireExactWalletSession(ctx);
+		if (!sess.ok) return sess.response;
+		const walletId = String(sess.context.authorization.session.walletId);
+		const stepUpRequest = command.request.stepUp;
+		const stepUp = await requireExactPasskeyStepUp({
+			ctx,
+			context: sess.context,
+			stepUp: stepUpRequest
+		});
+		if (!stepUp.ok) return stepUp.response;
+		await ctx.service.emailOtp.markEmailOtpStrongAuthSatisfied({ walletId });
+		switch (command.kind) {
+			case "link": {
+				const verified = await ctx.service.identity.verifyGoogleLogin({ idToken: command.request.idToken });
+				if (!verified.ok || !verified.verified || !verified.providerSubject) return json(verified, { status: verified.code === "internal" ? 500 : 400 });
+				const subject = verified.providerSubject;
+				const linked = await ctx.service.identity.linkIdentity({
+					userId: walletId,
+					subject,
+					allowMoveIfSoleIdentity: true
+				});
+				if (!linked.ok) return json(linked, { status: linked.code === "internal" ? 500 : 400 });
+				const identities = await ctx.service.identity.listIdentities({ userId: walletId });
+				return json({
+					ok: true,
+					linked: true,
+					subject,
+					...linked.movedFromUserId ? { movedFromUserId: linked.movedFromUserId } : {},
+					...identities.ok ? { identities: identities.subjects } : {}
+				}, { status: 200 });
+			}
+			case "unlink": break;
+			default: assertNeverAuthIdentityMutation(command);
+		}
+		const subject = command.request.subject;
+		if (subject.startsWith("near:")) return json({
+			ok: false,
+			code: "not_supported",
+			message: "near: subjects cannot be unlinked"
+		}, { status: 400 });
+		const out = await ctx.service.identity.unlinkIdentity({
+			userId: walletId,
+			subject
+		});
+		if (!out.ok) return json(out, { status: out.code === "internal" ? 500 : 400 });
+		const identities = await ctx.service.identity.listIdentities({ userId: walletId });
+		return json({
+			ok: true,
+			unlinked: true,
+			subject,
+			...identities.ok ? { identities: identities.subjects } : {}
+		}, { status: 200 });
+	}
+	if (ctx.method !== "POST") return null;
+	const parsedRoute = parseAuthProviderActionPath(ctx.pathname);
+	if (!parsedRoute) return null;
+	const origin = String(ctx.request.headers.get("origin") || "").trim() || void 0;
+	switch (parsedRoute.kind) {
+		case "passkey_options": {
+			const parsed = parsePasskeyLoginOptionsRequest(await readJson(ctx.request));
+			if (!parsed.ok) return json(parsed.body, { status: parsed.status });
+			const result = await ctx.service.webAuthn.createWebAuthnLoginOptions(parsed.request);
+			return json(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+		}
+		case "passkey_verify": {
+			const parsed = parsePasskeyLoginVerifyRequest({
+				body: await readJson(ctx.request),
+				origin
+			});
+			if (!parsed.ok) return json(parsed.body, { status: parsed.status });
+			const result = await ctx.service.webAuthn.verifyWebAuthnLogin(parsed.request);
+			if (!result.ok || !result.verified) return json(result, { status: result.code === "internal" ? 500 : 400 });
+			return json({
+				ok: true,
+				verified: true
+			}, { status: 200 });
+		}
+		case "google_options": return json({
+			ok: true,
+			...ctx.service.identity.getGoogleOidcPublicConfig()
+		}, { status: 200 });
+		case "github_options": return json({
+			ok: true,
+			...ctx.service.identity.getGithubOAuthPublicConfig()
+		}, { status: 200 });
+		case "google_verify": {
+			const parsed = parseGoogleLoginVerifyRequest(await readJson(ctx.request));
+			if (!parsed.ok) return json(parsed.body, { status: parsed.status });
+			const runtimePolicyScope = await resolveThresholdRuntimePolicyScope({
+				explicitScopeRaw: void 0,
+				projectEnvironmentIdRaw: parsed.request.projectEnvironmentId,
+				headers: ctx.request.headers,
+				origin,
+				publishableKeyAuth: ctx.opts.publishableKeyAuth,
+				orgProjectEnv: ctx.opts.orgProjectEnv
+			});
+			if (!runtimePolicyScope.ok) return json({
+				ok: false,
+				code: runtimePolicyScope.code,
+				message: runtimePolicyScope.message
+			}, { status: runtimePolicyScope.status });
+			if (!runtimePolicyScope.scope) return json({
+				ok: false,
+				code: "runtime_policy_scope_unavailable",
+				message: "Google Email OTP requires an active managed runtime policy scope"
+			}, { status: 500 });
+			const result = await ctx.service.identity.verifyGoogleLogin(parsed.request);
+			if (!result.ok || !result.verified || !result.providerSubject) return json(result, { status: result.code === "internal" ? 500 : 400 });
+			const resolution = await ctx.service.identity.resolveGoogleEmailOtpSession({
+				providerSubject: result.providerSubject,
+				email: result.email,
+				accountMode: parsed.request.accountMode,
+				...parsed.request.loginWalletId ? { loginWalletId: parsed.request.loginWalletId } : {},
+				runtimePolicyScope: runtimePolicyScope.scope,
+				restartRegistrationOffer: parsed.request.restartRegistrationOffer
+			});
+			return json(resolution, { status: resolution.ok ? 200 : resolution.code === "wallet_id_collision" ? 409 : 400 });
+		}
+		default: return assertNeverAuthProviderAction(parsedRoute);
+	}
+}
+//#endregion
+export { handleAuth };
+
+//# sourceMappingURL=auth.js.map