@seams/wallet-server 0.5.0

package/dist/esm/threshold/session/signingSessionSeal/service.js

@@ -0,0 +1,316 @@
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import "../../../shared-ts/src/utils/encoders.js";
+//#region src/threshold/session/signingSessionSeal/service.ts
+const SIGNING_SESSION_SEAL_LOG_LABEL = "[threshold-signing-session-seal]";
+const SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS_DEFAULT = 9e4;
+const SIGNING_SESSION_SEAL_REPLAYABLE_ERROR_CODES = new Set([
+	"expired",
+	"exhausted",
+	"forbidden",
+	"not_found",
+	"invalid_ciphertext",
+	"invalid_key_version"
+]);
+function toMessage(input, defaultMessage) {
+	return String(input || "").trim() || defaultMessage;
+}
+function toCode(input, defaultCode) {
+	return String(input || "").trim() || defaultCode;
+}
+function toPositiveInt(value, defaultValue) {
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed) || parsed <= 0) return defaultValue;
+	return Math.floor(parsed);
+}
+function isExpired(session, nowMs) {
+	return !Number.isFinite(session.expiresAtMs) || session.expiresAtMs <= nowMs;
+}
+async function emitAudit(input) {
+	if (!input.options.audit) return;
+	try {
+		await input.options.audit({
+			operation: input.operation,
+			thresholdSessionId: input.thresholdSessionId,
+			userId: input.userId,
+			ok: input.result.ok,
+			...input.result.ok ? {} : { code: input.result.code },
+			durationMs: Math.max(0, input.nowMs() - input.startedAtMs)
+		});
+	} catch {}
+}
+function emitOperationRequestLog(input) {
+	const logger = input.options.logger;
+	if (!logger) return;
+	const metadataKeys = input.metadata ? Object.keys(input.metadata) : [];
+	logger.info(`${SIGNING_SESSION_SEAL_LOG_LABEL} ${input.operation} request`, {
+		operation: input.operation,
+		thresholdSessionId: input.thresholdSessionId,
+		userId: input.userId,
+		...input.keyVersion ? { keyVersion: input.keyVersion } : {},
+		metadataKeys
+	});
+}
+function emitOperationResultLog(input) {
+	const logger = input.options.logger;
+	if (!logger) return;
+	const payload = {
+		operation: input.operation,
+		thresholdSessionId: input.thresholdSessionId,
+		userId: input.userId,
+		durationMs: input.durationMs,
+		...input.result.ok ? {
+			keyVersion: input.result.keyVersion,
+			expiresAtMs: input.result.expiresAtMs
+		} : {
+			code: input.result.code,
+			message: input.result.message
+		}
+	};
+	if (input.result.ok) {
+		logger.info(`${SIGNING_SESSION_SEAL_LOG_LABEL} ${input.operation} success`, payload);
+		return;
+	}
+	logger.warn(`${SIGNING_SESSION_SEAL_LOG_LABEL} ${input.operation} failure`, payload);
+}
+function signingSessionSealAuthorizationId(session) {
+	switch (session.kind) {
+		case "exact_wallet_session_operation_credential": return session.thresholdSessionId;
+	}
+}
+function fnv1aHex(input) {
+	let hash = 2166136261;
+	for (let i = 0; i < input.length; i += 1) {
+		hash ^= input.charCodeAt(i);
+		hash = Math.imul(hash, 16777619);
+	}
+	return (hash >>> 0).toString(16).padStart(8, "0");
+}
+async function hashCiphertextForIdempotency(ciphertext) {
+	const normalized = String(ciphertext || "").trim();
+	if (!normalized) return "";
+	try {
+		return `sha256:${base64UrlEncode(await sha256BytesUtf8(normalized))}`;
+	} catch {
+		return `fnv1a:${fnv1aHex(normalized)}`;
+	}
+}
+async function makeOperationRequestKey(args) {
+	const thresholdSessionId = String(args.request.thresholdSessionId || "").trim();
+	const userId = String(args.auth.userId || "").trim();
+	const ciphertext = String(args.request.ciphertext || "").trim();
+	if (!thresholdSessionId || !userId || !ciphertext) return "";
+	const keyVersion = String(args.request.keyVersion || "").trim();
+	const operation = args.operation === "apply-server-seal" ? "apply" : "remove";
+	const ciphertextHash = await hashCiphertextForIdempotency(ciphertext);
+	if (!ciphertextHash) return "";
+	return [
+		"signing-session-seal",
+		operation,
+		userId,
+		thresholdSessionId,
+		keyVersion || "_",
+		ciphertextHash
+	].join(":");
+}
+function shouldPersistIdempotentResult(result) {
+	if (result.ok) return true;
+	return SIGNING_SESSION_SEAL_REPLAYABLE_ERROR_CODES.has(String(result.code || "").trim());
+}
+async function runSealOperation(input) {
+	const nowMs = input.options.nowMs || Date.now;
+	const startedAtMs = nowMs();
+	let result = {
+		ok: false,
+		code: "internal",
+		message: "Internal error"
+	};
+	try {
+		emitOperationRequestLog({
+			options: input.options,
+			operation: input.operation,
+			thresholdSessionId: input.request.thresholdSessionId,
+			userId: input.auth.userId,
+			keyVersion: input.request.keyVersion,
+			metadata: input.request.metadata
+		});
+		const session = input.auth.session;
+		if (signingSessionSealAuthorizationId(session) !== input.request.thresholdSessionId) {
+			result = {
+				ok: false,
+				code: "forbidden",
+				message: "Wallet Session does not match requested thresholdSessionId"
+			};
+			return result;
+		}
+		if (session.userId !== input.auth.userId) {
+			result = {
+				ok: false,
+				code: "forbidden",
+				message: "thresholdSessionId does not belong to authenticated user"
+			};
+			return result;
+		}
+		if (isExpired(session, nowMs())) {
+			result = {
+				ok: false,
+				code: "expired",
+				message: "threshold session expired"
+			};
+			return result;
+		}
+		if (input.options.guard) {
+			const guard = await input.options.guard({
+				operation: input.operation,
+				thresholdSessionId: input.request.thresholdSessionId,
+				auth: input.auth
+			});
+			if (!guard.ok) {
+				result = {
+					ok: false,
+					code: toCode(guard.code, "forbidden"),
+					message: toMessage(guard.message, "Request rejected")
+				};
+				return result;
+			}
+		}
+		const sealed = await input.options.cipher.run({
+			operation: input.operation,
+			thresholdSessionId: input.request.thresholdSessionId,
+			ciphertext: input.request.ciphertext,
+			keyVersion: input.request.keyVersion,
+			metadata: input.request.metadata,
+			auth: { userId: input.auth.userId }
+		});
+		if (!sealed.ok) {
+			result = {
+				ok: false,
+				code: toCode(sealed.code, "internal"),
+				message: toMessage(sealed.message, "Signing-session seal operation failed")
+			};
+			return result;
+		}
+		result = {
+			ok: true,
+			ciphertext: sealed.ciphertext,
+			keyVersion: sealed.keyVersion || input.request.keyVersion,
+			expiresAtMs: session.expiresAtMs
+		};
+		return result;
+	} catch (error) {
+		result = {
+			ok: false,
+			code: "internal",
+			message: toMessage(error instanceof Error ? error.message : error, "Internal error")
+		};
+		return result;
+	} finally {
+		const durationMs = Math.max(0, nowMs() - startedAtMs);
+		emitOperationResultLog({
+			options: input.options,
+			operation: input.operation,
+			thresholdSessionId: input.request.thresholdSessionId,
+			userId: input.auth.userId,
+			result,
+			durationMs
+		});
+		await emitAudit({
+			options: input.options,
+			operation: input.operation,
+			thresholdSessionId: input.request.thresholdSessionId,
+			userId: input.auth.userId,
+			result,
+			startedAtMs,
+			nowMs
+		});
+	}
+}
+function createSigningSessionSealService(options) {
+	const singleFlight = /* @__PURE__ */ new Map();
+	const nowMs = options.nowMs || Date.now;
+	const idempotencyStore = options.idempotency?.store;
+	const idempotencyTtlMs = toPositiveInt(options.idempotency?.ttlMs, SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS_DEFAULT);
+	const tryReplayIdempotentResult = async (operation, thresholdSessionId, userId, idempotencyKey) => {
+		if (!idempotencyStore || !idempotencyKey) return null;
+		try {
+			const replay = await idempotencyStore.get({
+				key: idempotencyKey,
+				nowMs: nowMs()
+			});
+			if (!replay) return null;
+			options.logger?.info(`${SIGNING_SESSION_SEAL_LOG_LABEL} idempotency_replay_hit`, {
+				operation,
+				thresholdSessionId,
+				userId
+			});
+			return replay;
+		} catch (error) {
+			options.logger?.warn(`${SIGNING_SESSION_SEAL_LOG_LABEL} idempotency_replay_error`, {
+				operation,
+				thresholdSessionId,
+				userId,
+				message: toMessage(error instanceof Error ? error.message : error, "Unknown error")
+			});
+			return null;
+		}
+	};
+	const tryPersistIdempotentResult = async (operation, thresholdSessionId, userId, idempotencyKey, result) => {
+		if (!idempotencyStore || !idempotencyKey) return;
+		try {
+			await idempotencyStore.set({
+				key: idempotencyKey,
+				result,
+				expiresAtMs: nowMs() + idempotencyTtlMs
+			});
+		} catch (error) {
+			options.logger?.warn(`${SIGNING_SESSION_SEAL_LOG_LABEL} idempotency_persist_error`, {
+				operation,
+				thresholdSessionId,
+				userId,
+				message: toMessage(error instanceof Error ? error.message : error, "Unknown error")
+			});
+		}
+	};
+	const runWithSingleFlight = async (operation, request, auth) => {
+		const operationKey = await makeOperationRequestKey({
+			operation,
+			request,
+			auth
+		});
+		const idempotentReplay = await tryReplayIdempotentResult(operation, request.thresholdSessionId, auth.userId, operationKey);
+		if (idempotentReplay) return idempotentReplay;
+		const runAndPersist = async () => {
+			const result = await runSealOperation({
+				options,
+				operation,
+				request,
+				auth
+			});
+			if (shouldPersistIdempotentResult(result)) await tryPersistIdempotentResult(operation, request.thresholdSessionId, auth.userId, operationKey, result);
+			return result;
+		};
+		if (!operationKey) return await runAndPersist();
+		const inFlight = singleFlight.get(operationKey);
+		if (inFlight) {
+			options.logger?.info(`${SIGNING_SESSION_SEAL_LOG_LABEL} single_flight_hit`, {
+				operation,
+				thresholdSessionId: request.thresholdSessionId,
+				userId: auth.userId
+			});
+			return await inFlight;
+		}
+		const task = runAndPersist().finally(() => {
+			singleFlight.delete(operationKey);
+		});
+		singleFlight.set(operationKey, task);
+		return await task;
+	};
+	return {
+		applyServerSeal: async (request, auth) => await runWithSingleFlight("apply-server-seal", request, auth),
+		removeServerSeal: async (request, auth) => await runWithSingleFlight("remove-server-seal", request, auth)
+	};
+}
+//#endregion
+export { createSigningSessionSealService };
+
+//# sourceMappingURL=service.js.map

package/dist/esm/threshold/session/signingSessionSeal/transport/express.js

@@ -0,0 +1,151 @@
+import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
+//#region src/threshold/session/signingSessionSeal/transport/express.ts
+function errMessage(error) {
+	return error instanceof Error ? error.message : String(error || "Internal error");
+}
+function registerSigningSessionSealRoutes(router, ctx) {
+	const options = ctx.options;
+	ctx.logger.info("[threshold-signing-session-seal] routes", { enabled: Boolean(options) });
+	if (!options) return;
+	const basePath = resolveSigningSessionSealBasePath(options.basePath);
+	const applyPath = buildSigningSessionSealApplyPath(basePath);
+	const removePath = buildSigningSessionSealRemovePath(basePath);
+	router.post(applyPath, async (req, res) => {
+		const startedAtMs = Date.now();
+		try {
+			ctx.logger.info("[threshold-signing-session-seal] request", {
+				route: applyPath,
+				operation: "apply-server-seal"
+			});
+			const parsed = parseSigningSessionSealApplyBody(req.body || {});
+			if (!parsed.ok) {
+				ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
+					route: applyPath,
+					operation: "apply-server-seal",
+					code: parsed.code,
+					message: parsed.message,
+					durationMs: Math.max(0, Date.now() - startedAtMs)
+				});
+				res.status(400).json({
+					ok: false,
+					code: parsed.code,
+					message: parsed.message
+				});
+				return;
+			}
+			const authorized = await authorizeSigningSessionSealRequest({
+				options,
+				headers: req.headers || {},
+				thresholdSessionId: parsed.value.thresholdSessionId
+			});
+			if (!authorized.ok) {
+				ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
+					route: applyPath,
+					operation: "apply-server-seal",
+					code: authorized.code || "unauthorized",
+					message: authorized.message || "Unauthorized",
+					durationMs: Math.max(0, Date.now() - startedAtMs)
+				});
+				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json({
+					ok: false,
+					code: authorized.code || "unauthorized",
+					message: authorized.message || "Unauthorized"
+				});
+				return;
+			}
+			const result = await options.service.applyServerSeal(parsed.value, authorized.auth);
+			const status = signingSessionSealStatusCode(result);
+			res.status(status).json(result);
+			ctx.logger.info("[threshold-signing-session-seal] response", {
+				route: applyPath,
+				status,
+				ok: result.ok,
+				durationMs: Math.max(0, Date.now() - startedAtMs),
+				userId: authorized.auth.userId
+			});
+		} catch (error) {
+			const message = errMessage(error);
+			ctx.logger.error("[threshold-signing-session-seal] error", {
+				route: applyPath,
+				message,
+				durationMs: Math.max(0, Date.now() - startedAtMs)
+			});
+			res.status(500).json({
+				ok: false,
+				code: "internal",
+				message
+			});
+		}
+	});
+	router.post(removePath, async (req, res) => {
+		const startedAtMs = Date.now();
+		try {
+			ctx.logger.info("[threshold-signing-session-seal] request", {
+				route: removePath,
+				operation: "remove-server-seal"
+			});
+			const parsed = parseSigningSessionSealRemoveBody(req.body || {});
+			if (!parsed.ok) {
+				ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
+					route: removePath,
+					operation: "remove-server-seal",
+					code: parsed.code,
+					message: parsed.message,
+					durationMs: Math.max(0, Date.now() - startedAtMs)
+				});
+				res.status(400).json({
+					ok: false,
+					code: parsed.code,
+					message: parsed.message
+				});
+				return;
+			}
+			const authorized = await authorizeSigningSessionSealRequest({
+				options,
+				headers: req.headers || {},
+				thresholdSessionId: parsed.value.thresholdSessionId
+			});
+			if (!authorized.ok) {
+				ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
+					route: removePath,
+					operation: "remove-server-seal",
+					code: authorized.code || "unauthorized",
+					message: authorized.message || "Unauthorized",
+					durationMs: Math.max(0, Date.now() - startedAtMs)
+				});
+				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json({
+					ok: false,
+					code: authorized.code || "unauthorized",
+					message: authorized.message || "Unauthorized"
+				});
+				return;
+			}
+			const result = await options.service.removeServerSeal(parsed.value, authorized.auth);
+			const status = signingSessionSealStatusCode(result);
+			res.status(status).json(result);
+			ctx.logger.info("[threshold-signing-session-seal] response", {
+				route: removePath,
+				status,
+				ok: result.ok,
+				durationMs: Math.max(0, Date.now() - startedAtMs),
+				userId: authorized.auth.userId
+			});
+		} catch (error) {
+			const message = errMessage(error);
+			ctx.logger.error("[threshold-signing-session-seal] error", {
+				route: removePath,
+				message,
+				durationMs: Math.max(0, Date.now() - startedAtMs)
+			});
+			res.status(500).json({
+				ok: false,
+				code: "internal",
+				message
+			});
+		}
+	});
+}
+//#endregion
+export { registerSigningSessionSealRoutes };
+
+//# sourceMappingURL=express.js.map

package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js

@@ -0,0 +1,106 @@
+import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
+//#region src/threshold/session/signingSessionSeal/transport/fetch.ts
+function json(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "Content-Type": "application/json; charset=utf-8" }
+	});
+}
+async function readJsonSafe(request) {
+	try {
+		return await request.json();
+	} catch {
+		return null;
+	}
+}
+function headersToRecord(headers) {
+	const out = {};
+	headers.forEach((value, key) => {
+		out[key] = value;
+	});
+	return out;
+}
+function errMessage(error) {
+	return error instanceof Error ? error.message : String(error || "Internal error");
+}
+async function handleSigningSessionSealRoutes(ctx) {
+	const options = ctx.options;
+	if (!options) return null;
+	const basePath = resolveSigningSessionSealBasePath(options.basePath);
+	const applyPath = buildSigningSessionSealApplyPath(basePath);
+	const removePath = buildSigningSessionSealRemovePath(basePath);
+	const isApply = ctx.method === "POST" && ctx.pathname === applyPath;
+	const isRemove = ctx.method === "POST" && ctx.pathname === removePath;
+	if (!isApply && !isRemove) return null;
+	const startedAtMs = Date.now();
+	const operation = isApply ? "apply-server-seal" : "remove-server-seal";
+	try {
+		ctx.logger.info("[threshold-signing-session-seal] request", {
+			route: isApply ? applyPath : removePath,
+			operation
+		});
+		const body = await readJsonSafe(ctx.request);
+		const parsed = isApply ? parseSigningSessionSealApplyBody(body) : parseSigningSessionSealRemoveBody(body);
+		if (!parsed.ok) {
+			ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
+				route: isApply ? applyPath : removePath,
+				operation,
+				code: parsed.code,
+				message: parsed.message,
+				durationMs: Math.max(0, Date.now() - startedAtMs)
+			});
+			return json({
+				ok: false,
+				code: parsed.code,
+				message: parsed.message
+			}, 400);
+		}
+		const authorized = await authorizeSigningSessionSealRequest({
+			options,
+			headers: headersToRecord(ctx.request.headers),
+			authorize: ctx.authorize,
+			thresholdSessionId: parsed.value.thresholdSessionId
+		});
+		if (!authorized.ok) {
+			ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
+				route: isApply ? applyPath : removePath,
+				operation,
+				code: authorized.code || "unauthorized",
+				message: authorized.message || "Unauthorized",
+				durationMs: Math.max(0, Date.now() - startedAtMs)
+			});
+			return json({
+				ok: false,
+				code: authorized.code || "unauthorized",
+				message: authorized.message || "Unauthorized"
+			}, signingSessionSealAuthorizeStatusCode(authorized));
+		}
+		const result = isApply ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
+		const status = signingSessionSealStatusCode(result);
+		ctx.logger.info("[threshold-signing-session-seal] response", {
+			route: isApply ? applyPath : removePath,
+			operation,
+			status,
+			ok: result.ok,
+			durationMs: Math.max(0, Date.now() - startedAtMs),
+			userId: authorized.auth.userId
+		});
+		return json(result, status);
+	} catch (error) {
+		const message = errMessage(error);
+		ctx.logger.error("[threshold-signing-session-seal] error", {
+			route: isApply ? applyPath : removePath,
+			message,
+			durationMs: Math.max(0, Date.now() - startedAtMs)
+		});
+		return json({
+			ok: false,
+			code: "internal",
+			message
+		}, 500);
+	}
+}
+//#endregion
+export { handleSigningSessionSealRoutes };
+
+//# sourceMappingURL=fetch.js.map