@seams/wallet-server 0.5.0

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -0,0 +1,264 @@
+import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
+import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
+import { json, readJson } from "../../../framework/http.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+//#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
+const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
+/**
+* Request-scoped owner bearer verifier used by claim, approval, and the owner
+* authorization metadata route. The returned binding is valid only until the
+* verified Wallet Session expires and is bound to the exact request bytes.
+*/
+function createDeviceLinkingOwnerRequestAuthenticatorV1(input) {
+	const nowV1 = input.nowV1 ?? Date.now;
+	return async (requestInput) => {
+		const authenticated = await authenticateDeviceLinkingOwnerWalletSessionRequestV1({
+			...requestInput,
+			authorizationSessions: input.authorizationSessions,
+			nowV1
+		});
+		if (authenticated.kind === "denied") return authenticated;
+		return {
+			kind: "authorized",
+			body: authenticated.body,
+			binding: authenticated.binding,
+			owner: authenticated.owner
+		};
+	};
+}
+async function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input) {
+	if (input.method !== "GET" && input.method !== "POST") return {
+		kind: "denied",
+		code: "invalid",
+		message: "Owner request method is invalid"
+	};
+	const nowV1 = input.nowV1 ?? Date.now;
+	const body = await readClonedJson(input.request);
+	const validated = await validateOwnerWalletSessionV1({
+		headers: Object.fromEntries(input.request.headers.entries()),
+		authorizationSessions: input.authorizationSessions,
+		nowV1
+	});
+	if (validated.kind === "denied") return validated;
+	return {
+		kind: "authorized",
+		body,
+		binding: {
+			kind: "linked_device_owner_request_binding_v1",
+			method: input.method,
+			pathname: input.pathname,
+			bodyDigestB64u: input.bodyDigestB64u,
+			expiresAtMs: validated.owner.expiresAtMs
+		},
+		owner: validated.owner
+	};
+}
+async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
+	if (ctx.pathname !== "/wallet/device-linking/v1/owner-authorization") return null;
+	if (ctx.method !== "POST") return methodNotAllowedResponse();
+	if (!service) return json({
+		ok: false,
+		code: "not_supported",
+		message: "Linked-device owner authorization is not configured"
+	}, { status: 501 });
+	const nowV1 = Date.now;
+	let body;
+	let rawBody;
+	let bodyDigestB64u;
+	try {
+		bodyDigestB64u = await requestBodyDigest(ctx.request);
+		rawBody = await readJson(ctx.request.clone());
+		body = parseLinkedDeviceOwnerAuthorizationRequestV1(rawBody);
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "Owner authorization body is invalid"
+		}, { status: 400 });
+	}
+	const validated = await authenticateDeviceLinkingOwnerWalletSessionRequestV1({
+		request: ctx.request,
+		method: ctx.method,
+		pathname: ctx.pathname,
+		bodyDigestB64u,
+		requestedAtMs: body.requestedAtMs,
+		authorizationSessions: ctx.service.authorizationSessions,
+		nowV1
+	});
+	if (validated.kind === "denied") return authDeniedResponse(validated);
+	try {
+		return json(await service.authorizeOwnerForLinkingV1({
+			payload: body.payload,
+			requestedAtMs: body.requestedAtMs,
+			bodyDigestB64u,
+			owner: validated.owner
+		}), { status: 200 });
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "internal",
+			message: error instanceof Error ? error.message : String(error)
+		}, { status: 500 });
+	}
+}
+async function validateOwnerWalletSessionV1(input) {
+	const bearerToken = extractBearerCredential(input.headers);
+	const authorizationSessions = input.authorizationSessions;
+	if (!bearerToken || !authorizationSessions) return denied("unauthorized", "An active owner Wallet Session is required");
+	const nowMs = input.nowV1();
+	let context;
+	try {
+		context = await authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
+			token: bearerToken,
+			nowMs
+		});
+	} catch {
+		return denied("unauthorized", "An active owner Wallet Session is required");
+	}
+	if (!context) return denied("unauthorized", "An exact owner Wallet Session is required");
+	const owner = await ownerContextFromExactV2AuthorizationV1({
+		context,
+		nowMs
+	});
+	if (!owner) return denied("invalid", "Wallet Session identity or capability scope is invalid");
+	return {
+		kind: "authorized",
+		owner
+	};
+}
+async function ownerContextFromExactV2AuthorizationV1(input) {
+	const { authorization, authority, authMethod } = input.context;
+	const session = authorization.session;
+	const quota = authorization.quota;
+	if (input.context.retiredAtMs !== null || authority.state !== "active" || authMethod.status !== "active" || session.expiresAtMs <= input.nowMs || session.expiresAtMs !== quota.expiresAtMs || session.tenantId !== quota.tenantId || session.principalId !== quota.principalId || session.walletSessionId !== quota.walletSessionId || session.quotaId !== quota.quotaId || session.walletId !== authority.walletId || session.authorityId !== authority.authorityId || session.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletId !== session.walletId || authMethod.walletAuthorityId !== session.authorityId || session.authorityDigestB64u !== authority.authorityDigestB64u || session.authorityRevocationEpoch !== authority.revocationEpoch) return null;
+	let expectedSubjects;
+	try {
+		expectedSubjects = buildWalletSessionCapabilitySubjectsV1(authority);
+	} catch {
+		return null;
+	}
+	if (!walletSessionCapabilitySubjectsV1Equal(session.capabilitySubjects, expectedSubjects)) return null;
+	const authData = walletAuthAuthorityFromExactV2MethodV1({
+		walletId: session.walletId,
+		principalId: session.principalId,
+		authMethod
+	});
+	if (!authData) return null;
+	const permission = buildDelegatedWalletAuthorityV1({ permissions: authority.permissions });
+	if (authority.signerActivations.keyFamilies[0] === "ed25519") return {
+		walletId: session.walletId,
+		walletSessionId: session.walletSessionId,
+		authorizationId: session.authorizationId,
+		expiresAtMs: session.expiresAtMs,
+		permission,
+		keyManifestDigestB64u: authority.signerActivationSetDigestB64u,
+		curve: "ed25519",
+		authority: authData.authority,
+		authorityScope: thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authData.authority)
+	};
+	return {
+		walletId: session.walletId,
+		walletSessionId: session.walletSessionId,
+		authorizationId: session.authorizationId,
+		expiresAtMs: session.expiresAtMs,
+		permission,
+		keyManifestDigestB64u: authority.signerActivationSetDigestB64u,
+		curve: "ecdsa",
+		walletAuthAuthorityRef: await walletAuthAuthorityRef({ authority: authData.authority }),
+		authSource: authData.authSource
+	};
+}
+function walletAuthAuthorityFromExactV2MethodV1(input) {
+	if (input.authMethod.kind === "passkey") try {
+		const derived = buildPasskeyWalletAuthAuthority({
+			walletId: input.walletId,
+			rpId: input.authMethod.rpId,
+			credentialIdB64u: input.authMethod.credentialIdB64u
+		});
+		const authority = {
+			walletId: derived.walletId,
+			factor: derived.factor,
+			verifier: derived.verifier,
+			bindingId: input.authMethod.walletAuthMethodId
+		};
+		return {
+			authority,
+			authSource: {
+				kind: "passkey",
+				credentialIdB64u: authority.factor.credentialIdB64u
+			}
+		};
+	} catch {
+		return null;
+	}
+	const providerSubject = parseProviderSubject(input.principalId);
+	if (!providerSubject.ok) return null;
+	try {
+		const derived = buildEmailOtpWalletAuthAuthority({
+			walletId: input.walletId,
+			provider: input.principalId.startsWith("google:") ? "google" : "email",
+			providerUserId: providerSubject.value,
+			emailHashHex: input.authMethod.emailHashHex
+		});
+		const authority = {
+			walletId: derived.walletId,
+			factor: derived.factor,
+			verifier: derived.verifier,
+			bindingId: input.authMethod.walletAuthMethodId
+		};
+		return {
+			authority,
+			authSource: {
+				kind: "oidc_provider",
+				providerId: authority.factor.provider === "google" ? "google_oidc" : "oidc",
+				providerSubject: providerSubject.value
+			}
+		};
+	} catch {
+		return null;
+	}
+}
+async function readClonedJson(request) {
+	if (request.method === "GET") return {};
+	try {
+		return await request.clone().json();
+	} catch {
+		return {};
+	}
+}
+async function requestBodyDigest(request) {
+	return parseDigestB64u(base64UrlEncode(await sha256Bytes(new Uint8Array(await request.clone().arrayBuffer()))));
+}
+function denied(code, message) {
+	return {
+		kind: "denied",
+		code,
+		message
+	};
+}
+function methodNotAllowedResponse() {
+	return json({
+		ok: false,
+		code: "method_not_allowed"
+	}, { status: 405 });
+}
+function authDeniedResponse(value) {
+	const status = value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401;
+	return json({
+		ok: false,
+		code: value.code,
+		message: value.message
+	}, { status });
+}
+//#endregion
+export { LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, authenticateDeviceLinkingOwnerWalletSessionRequestV1, createDeviceLinkingOwnerRequestAuthenticatorV1, handleDeviceLinkingOwnerAuthorization };
+
+//# sourceMappingURL=deviceLinkingOwnerAuthorization.js.map

package/dist/esm/router/transport/fetch/routes/deviceManagement.js

@@ -0,0 +1,289 @@
+import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
+import { parseLinkedDeviceListRequestV1, parseLinkedDeviceRevokeRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { json } from "../../../framework/http.js";
+import { LinkedDeviceListCursorError } from "../../../../core/deviceLinking/linkedDeviceManagement.js";
+//#region src/router/transport/fetch/routes/deviceManagement.ts
+const LINKED_DEVICE_MANAGEMENT_BASE_V1 = "/wallet/device-linking/v1/devices";
+const LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1 = 50;
+async function handleDeviceManagement(ctx, service) {
+	const action = parseManagementPath(ctx.pathname);
+	if (!action) return null;
+	const nowMs = service.nowV1();
+	try {
+		if (action.kind === "list") return await handleList(ctx, service, nowMs);
+		return await handleRevoke(ctx, service, nowMs);
+	} catch (error) {
+		if (error instanceof DeviceManagementInputError || error instanceof LinkedDeviceListCursorError) return json({
+			ok: false,
+			kind: "invalid_input",
+			message: error.message
+		}, { status: 400 });
+		return json({
+			ok: false,
+			kind: "internal",
+			message: error instanceof Error ? error.message : String(error)
+		}, { status: 500 });
+	}
+}
+async function handleList(ctx, service, nowMs) {
+	if (ctx.method !== "GET") return methodNotAllowedResponse();
+	const request = parseBoundary(() => parseListQuery(ctx.url.searchParams));
+	const canonicalPathname = canonicalListPath(ctx.pathname, request);
+	const body = await readRequestBodyDigest(ctx.request);
+	const authentication = await authenticateOwner(service, ctx, canonicalPathname, body.digestB64u, nowMs);
+	if (authentication.kind === "denied") return authDeniedResponse(authentication);
+	validateOwnerBinding(authentication.binding, ctx.method, canonicalPathname, body.digestB64u, nowMs);
+	if (authentication.owner.walletId !== request.walletId) return unauthorizedResponse();
+	const source = {
+		walletId: authentication.owner.walletId,
+		walletSessionId: authentication.owner.walletSessionId,
+		authorizationId: authentication.owner.authorizationId,
+		expiresAtMs: authentication.owner.expiresAtMs
+	};
+	if (body.bytes.byteLength !== 0) throw new DeviceManagementInputError("linked-device list request must have an empty body");
+	const result = await service.management.listLinkedDevicesV1(request, source, nowMs);
+	if ("kind" in result) return unauthorizedResponse();
+	return json({
+		ok: true,
+		devices: result.devices,
+		ownerDevices: result.ownerDevices,
+		nextCursor: result.nextCursor
+	}, { status: 200 });
+}
+async function handleRevoke(ctx, service, nowMs) {
+	if (ctx.method !== "POST") return methodNotAllowedResponse();
+	const pathWalletAuthMethodId = parseBoundary(() => parseRevokePath(ctx.pathname));
+	const body = await readRequestBodyDigest(ctx.request);
+	const authentication = await authenticateOwner(service, ctx, ctx.pathname, body.digestB64u, nowMs);
+	if (authentication.kind === "denied") return authDeniedResponse(authentication);
+	validateOwnerBinding(authentication.binding, ctx.method, ctx.pathname, body.digestB64u, nowMs);
+	if (!hasSourceProofField(authentication.body)) return unauthorizedResponse();
+	const parsedBody = parseBoundary(() => parseRevokeBody(authentication.body));
+	const request = parsedBody.request;
+	if (pathWalletAuthMethodId !== request.walletAuthMethodId) throw new DeviceManagementInputError("revoke path and body wallet auth method ids must agree");
+	if (authentication.owner.walletId !== request.walletId) return unauthorizedResponse();
+	const freshProof = await service.verifyFreshRevokeProofV1({
+		walletId: request.walletId,
+		targetWalletAuthMethodId: request.walletAuthMethodId,
+		proof: parsedBody.proof,
+		request: ctx.request,
+		method: ctx.method,
+		pathname: ctx.pathname,
+		bodyDigestB64u: body.digestB64u,
+		requestedAtMs: request.requestedAtMs
+	});
+	if (freshProof.kind !== "authorized") return authDeniedResponse(freshProof);
+	const source = {
+		walletId: authentication.owner.walletId,
+		walletSessionId: authentication.owner.walletSessionId,
+		authorizationId: authentication.owner.authorizationId,
+		expiresAtMs: authentication.owner.expiresAtMs,
+		freshProof: {
+			walletAuthMethodId: freshProof.walletAuthMethodId,
+			verifiedAtMs: freshProof.verifiedAtMs
+		}
+	};
+	if (request.requestedAtMs > nowMs) throw new DeviceManagementInputError("revoke request is from the future");
+	const result = await service.management.revokeLinkedDeviceV1(request, source);
+	switch (result.kind) {
+		case "revoked": return json({
+			ok: true,
+			...result
+		}, { status: 200 });
+		case "not_found": return json({
+			ok: false,
+			kind: result.kind
+		}, { status: 404 });
+		case "conflict": return json({
+			ok: false,
+			kind: result.kind
+		}, { status: 409 });
+		case "unauthorized": return unauthorizedResponse();
+	}
+}
+async function authenticateOwner(service, ctx, pathname, bodyDigestB64u, nowMs) {
+	return await service.authenticateOwnerRequestV1({
+		request: ctx.request,
+		method: ctx.method,
+		pathname,
+		bodyDigestB64u,
+		requestedAtMs: nowMs
+	});
+}
+function parseListQuery(search) {
+	const keys = [...search.keys()].sort();
+	if (keys.length !== 3 || keys[0] !== "cursor" || keys[1] !== "limit" || keys[2] !== "walletId") throw new Error("linked-device list query must contain walletId, limit, and cursor");
+	const walletId = search.get("walletId");
+	const rawLimit = search.get("limit");
+	const rawCursor = search.get("cursor");
+	if (walletId === null || rawLimit === null || rawCursor === null) throw new Error("walletId, limit, and cursor are required");
+	const request = parseLinkedDeviceListRequestV1({
+		kind: "linked_device_list_request_v1",
+		walletId,
+		limit: Number(rawLimit),
+		cursor: rawCursor === "" ? null : rawCursor
+	});
+	if (request.limit > LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1) throw new Error(`linked-device list limit must be at most ${LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1}`);
+	return request;
+}
+function canonicalListPath(pathname, request) {
+	return `${pathname}?${new URLSearchParams([
+		["walletId", String(request.walletId)],
+		["limit", String(request.limit)],
+		["cursor", request.cursor ?? ""]
+	]).toString()}`;
+}
+function parseRevokePath(pathname) {
+	const prefix = `${LINKED_DEVICE_MANAGEMENT_BASE_V1}/`;
+	const parts = pathname.slice(prefix.length).split("/");
+	if (parts.length !== 2 || parts[1] !== "revoke" || !parts[0]) throw new Error("linked-device revoke path is invalid");
+	const parsed = parseWalletAuthMethodId(decodePathComponent(parts[0]));
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseRevokeBody(input) {
+	const body = requireExactPlainObject(input, [
+		"kind",
+		"requestedAtMs",
+		"sourceProof",
+		"walletAuthMethodId",
+		"walletId"
+	], "linked-device revoke body fields are invalid");
+	return {
+		request: parseLinkedDeviceRevokeRequestV1({
+			kind: body.kind,
+			walletId: body.walletId,
+			walletAuthMethodId: body.walletAuthMethodId,
+			requestedAtMs: body.requestedAtMs
+		}),
+		proof: parseFreshRevokeProof(body.sourceProof)
+	};
+}
+function parseFreshRevokeProof(input) {
+	const proof = requirePlainObject(input, "fresh revocation proof is required");
+	switch (proof.kind) {
+		case "webauthn_assertion": return parseWebAuthnFreshRevokeProof(proof);
+		case "email_otp": return parseEmailOtpFreshRevokeProof(proof);
+		default: throw new Error("fresh revocation proof kind is invalid");
+	}
+}
+function parseWebAuthnFreshRevokeProof(input) {
+	const proof = requireExactPlainObject(input, [
+		"credential",
+		"expectedChallengeDigestB64u",
+		"kind",
+		"rpId"
+	], "fresh WebAuthn revocation proof is invalid");
+	if (typeof proof.expectedChallengeDigestB64u !== "string" || !proof.expectedChallengeDigestB64u.trim()) throw new Error("fresh WebAuthn revocation proof is invalid");
+	const rpId = parseWebAuthnRpId(proof.rpId);
+	if (!rpId.ok || !isPlainRouteObject(proof.credential)) throw new Error("fresh WebAuthn revocation proof is invalid");
+	return {
+		kind: "webauthn_assertion",
+		rpId: rpId.value,
+		credential: proof.credential,
+		expectedChallengeDigestB64u: proof.expectedChallengeDigestB64u.trim()
+	};
+}
+function parseEmailOtpFreshRevokeProof(input) {
+	const proof = requireExactPlainObject(input, [
+		"challengeId",
+		"kind",
+		"otpCode",
+		"ownerProofBindingDigest"
+	], "fresh Email OTP revocation proof is invalid");
+	if (typeof proof.challengeId !== "string" || typeof proof.otpCode !== "string" || typeof proof.ownerProofBindingDigest !== "string" || !proof.challengeId.trim() || !proof.otpCode.trim() || !proof.ownerProofBindingDigest.trim()) throw new Error("fresh Email OTP revocation proof is invalid");
+	return {
+		kind: "email_otp",
+		challengeId: proof.challengeId.trim(),
+		otpCode: proof.otpCode.trim(),
+		ownerProofBindingDigest: proof.ownerProofBindingDigest.trim()
+	};
+}
+function requirePlainObject(input, message) {
+	if (!isPlainRouteObject(input)) throw new Error(message);
+	return input;
+}
+function requireExactPlainObject(input, expectedKeys, message) {
+	const object = requirePlainObject(input, message);
+	if (!hasExactKeys(object, expectedKeys)) throw new Error(message);
+	return object;
+}
+function hasSourceProofField(input) {
+	return isPlainRouteObject(input) && Object.prototype.hasOwnProperty.call(input, "sourceProof");
+}
+function hasExactKeys(input, expected) {
+	const actual = Object.keys(input).sort();
+	const keys = [...expected].sort();
+	return actual.length === keys.length && actual.every((key, index) => key === keys[index]);
+}
+function isPlainRouteObject(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return false;
+	try {
+		const prototype = Object.getPrototypeOf(input);
+		return prototype === Object.prototype || prototype === null;
+	} catch {
+		return false;
+	}
+}
+function parseManagementPath(pathname) {
+	if (pathname === "/wallet/device-linking/v1/devices") return { kind: "list" };
+	if (pathname.startsWith(`/wallet/device-linking/v1/devices/`)) return { kind: "revoke" };
+	return null;
+}
+function validateOwnerBinding(binding, method, pathname, bodyDigestB64u, nowMs) {
+	if (binding.kind !== "linked_device_owner_request_binding_v1" || binding.method !== method || binding.pathname !== pathname || binding.bodyDigestB64u !== bodyDigestB64u || binding.expiresAtMs <= nowMs) throw new DeviceManagementInputError("owner request binding is invalid or expired");
+}
+async function readRequestBodyDigest(request) {
+	const bytes = new Uint8Array(await request.clone().arrayBuffer());
+	return {
+		bytes,
+		digestB64u: parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)))
+	};
+}
+function decodePathComponent(raw) {
+	try {
+		return decodeURIComponent(raw);
+	} catch {
+		throw new Error("linked-device revoke path is invalid");
+	}
+}
+function parseBoundary(parse) {
+	try {
+		return parse();
+	} catch (error) {
+		throw new DeviceManagementInputError(error instanceof Error ? error.message : String(error));
+	}
+}
+function authDeniedResponse(result) {
+	return json({
+		ok: false,
+		kind: "unauthorized",
+		code: result.code,
+		message: result.message
+	}, { status: result.code === "expired" ? 410 : 401 });
+}
+function unauthorizedResponse() {
+	return json({
+		ok: false,
+		kind: "unauthorized"
+	}, { status: 401 });
+}
+function methodNotAllowedResponse() {
+	return json({
+		ok: false,
+		kind: "method_not_allowed"
+	}, { status: 405 });
+}
+var DeviceManagementInputError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DeviceManagementInputError";
+	}
+};
+//#endregion
+export { LINKED_DEVICE_MANAGEMENT_BASE_V1, LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1, handleDeviceManagement };
+
+//# sourceMappingURL=deviceManagement.js.map

package/dist/esm/router/transport/fetch/routes/health.js

@@ -0,0 +1,42 @@
+import { buildCorsOrigins } from "../../../../core/SessionService.js";
+import { json } from "../../../framework/http.js";
+//#region src/router/transport/fetch/routes/health.ts
+async function handleHealth(ctx) {
+	if (!ctx.opts.healthz || ctx.method !== "GET" || ctx.pathname !== "/healthz") return null;
+	const allowed = buildCorsOrigins(...ctx.opts.corsOrigins || []);
+	const corsAllowed = allowed === "*" ? "*" : allowed;
+	const thresholdConfigured = Boolean(ctx.opts.routerAbNormalSigningRouterProxy);
+	return json({
+		ok: true,
+		relayerAccount: ctx.service.router.getConfiguredRelayerAccount(),
+		thresholdEd25519: { configured: thresholdConfigured },
+		cors: { allowedOrigins: corsAllowed }
+	}, { status: 200 });
+}
+async function handleReady(ctx) {
+	if (!ctx.opts.readyz || ctx.method !== "GET" || ctx.pathname !== "/readyz") return null;
+	const allowed = buildCorsOrigins(...ctx.opts.corsOrigins || []);
+	const corsAllowed = allowed === "*" ? "*" : allowed;
+	const thresholdConfigured = Boolean(ctx.opts.routerAbNormalSigningRouterProxy);
+	try {
+		if (ctx.opts.readyCheck) await ctx.opts.readyCheck();
+		await ctx.service.router.getRelayerAccount();
+		return json({
+			ok: true,
+			thresholdEd25519: { configured: thresholdConfigured },
+			cors: { allowedOrigins: corsAllowed }
+		}, { status: 200 });
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "relayer_unavailable",
+			message: error instanceof Error ? error.message : String(error),
+			thresholdEd25519: { configured: thresholdConfigured },
+			cors: { allowedOrigins: corsAllowed }
+		}, { status: 503 });
+	}
+}
+//#endregion
+export { handleHealth, handleReady };
+
+//# sourceMappingURL=health.js.map

package/dist/esm/router/transport/fetch/routes/nearPublicKeys.js

@@ -0,0 +1,39 @@
+import { json } from "../../../framework/http.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+//#region src/router/transport/fetch/routes/nearPublicKeys.ts
+async function handleNearPublicKeys(ctx) {
+	if (ctx.method !== "GET") return null;
+	if (ctx.pathname !== "/near/public-keys") return null;
+	try {
+		const token = extractBearerCredential(ctx.request.headers);
+		if (!token) return json({
+			ok: false,
+			code: "unauthorized",
+			message: "No valid Wallet Session"
+		}, { status: 401 });
+		const nowMs = Date.now();
+		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: ctx.service.authorizationSessions.tenantId,
+			token,
+			nowMs
+		});
+		if (!exact) return json({
+			ok: false,
+			code: "unauthorized",
+			message: "No valid Wallet Session"
+		}, { status: 401 });
+		const result = await ctx.service.nearFunding.listNearPublicKeysForUser({ userId: String(exact.authorization.session.walletId) });
+		if (!result.ok) return json(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
+		return json(result, { status: 200 });
+	} catch (e) {
+		return json({
+			ok: false,
+			code: "internal",
+			message: e?.message || "Internal error"
+		}, { status: 500 });
+	}
+}
+//#endregion
+export { handleNearPublicKeys };
+
+//# sourceMappingURL=nearPublicKeys.js.map