@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthConfig.js

@@ -0,0 +1,321 @@
+import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
+import "../../../../core/authService/emailOtpConfig.js";
+import { parseSigningSessionSealRootConfig } from "../../../../threshold/session/signingSessionSeal/options.js";
+//#region src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.ts
+function normalizeLinkedDevicePasskeyTargetConfigurationV1(input) {
+	const expectedOrigin = normalizeCorsOrigin(input.expectedOrigin);
+	if (!expectedOrigin || expectedOrigin !== input.expectedOrigin.trim()) throw new Error("linked-device target Passkey origin must be an exact origin");
+	const parsedRpId = parseWebAuthnRpId(input.targetPasskeyRpId);
+	if (!parsedRpId.ok) throw new Error(`linked-device target Passkey RP ID: ${parsedRpId.error.message}`);
+	const originHostname = new URL(expectedOrigin).hostname.toLowerCase();
+	const rpId = String(parsedRpId.value).toLowerCase();
+	if (originHostname !== rpId && !originHostname.endsWith(`.${rpId}`)) throw new Error("linked-device target Passkey origin is outside the configured RP ID");
+	return {
+		rpId: parsedRpId.value,
+		expectedOrigin
+	};
+}
+function requireD1RouterApiAuthScopeString(input, field) {
+	const value = normalizeOptionalTrimmedString(input);
+	if (!value) throw new Error(`${field} is required for Cloudflare D1 Router API auth service`);
+	return value;
+}
+function parseBooleanFlag(input, fallback, field) {
+	if (input == null || input === "") return fallback;
+	if (typeof input === "boolean") return input;
+	switch (normalizeOptionalTrimmedString(input)?.toLowerCase()) {
+		case "1":
+		case "true":
+		case "yes":
+		case "on": return true;
+		case "0":
+		case "false":
+		case "no":
+		case "off": return false;
+		default: throw new Error(`${field} must be a boolean flag`);
+	}
+}
+function normalizeD1RouterApiAuthOptions(input) {
+	const githubClientId = normalizeOptionalTrimmedString(input.githubOAuth?.clientId);
+	const githubClientSecret = normalizeOptionalTrimmedString(input.githubOAuth?.clientSecret);
+	const githubCallbackUrl = normalizeOptionalTrimmedString(input.githubOAuth?.callbackUrl);
+	const githubOAuth = githubClientId && githubClientSecret && githubCallbackUrl ? {
+		clientId: githubClientId,
+		clientSecret: githubClientSecret,
+		callbackUrl: githubCallbackUrl
+	} : void 0;
+	if (input.githubOAuth && !githubOAuth) throw new Error("githubOAuth requires clientId, clientSecret, and callbackUrl");
+	return {
+		database: input.database,
+		namespace: requireD1RouterApiAuthScopeString(input.namespace, "namespace"),
+		orgId: requireD1RouterApiAuthScopeString(input.orgId, "orgId"),
+		projectId: requireD1RouterApiAuthScopeString(input.projectId, "projectId"),
+		envId: requireD1RouterApiAuthScopeString(input.envId, "envId"),
+		relayerAccount: normalizeOptionalTrimmedString(input.relayerAccount),
+		relayerPublicKey: normalizeOptionalTrimmedString(input.relayerPublicKey),
+		relayerPrivateKey: normalizeOptionalTrimmedString(input.relayerPrivateKey),
+		nearRpcUrl: normalizeOptionalTrimmedString(input.nearRpcUrl),
+		signerWasmModuleOrPath: typeof input.signerWasmModuleOrPath === "string" ? normalizeOptionalTrimmedString(input.signerWasmModuleOrPath) : input.signerWasmModuleOrPath,
+		accountInitialBalance: normalizeOptionalTrimmedString(input.accountInitialBalance),
+		implicitNearAccountTestFundingEnabled: parseBooleanFlag(input.implicitNearAccountTestFundingEnabled, false, "implicitNearAccountTestFundingEnabled"),
+		googleOidcClientId: normalizeOptionalTrimmedString(input.googleOidcClientId),
+		githubOAuth,
+		accountIdDerivationSecret: normalizeOptionalTrimmedString(input.accountIdDerivationSecret),
+		emailOtp: normalizeEmailOtpConfig(input),
+		emailOtpServerSeal: normalizeEmailOtpServerSealConfig(input),
+		routerAbEcdsaPresignRuntime: input.routerAbEcdsaPresignRuntime,
+		ed25519YaoProductRegistration: input.ed25519YaoProductRegistration,
+		ecdsaStrictRegistration: input.ecdsaStrictRegistration,
+		tenantRootCustodyLineage: input.tenantRootCustodyLineage,
+		linkedDevice: input.linkedDevice
+	};
+}
+function configuredInteger(input) {
+	if (input.raw == null || input.raw === "") return input.fallback;
+	const value = typeof input.raw === "number" ? input.raw : Number(input.raw);
+	if (!Number.isFinite(value)) throw new Error(`${input.field} must be a finite number`);
+	if (value < input.min || value > input.max) throw new Error(`${input.field} must be between ${input.min} and ${input.max}`);
+	return Math.floor(value);
+}
+function normalizeEmailOtpDeliveryMode(input, fallback) {
+	const value = normalizeOptionalTrimmedString(input)?.toLowerCase() || fallback;
+	switch (value) {
+		case "email_provider":
+		case "provider_and_demo_code":
+		case "log":
+		case "dev_d1_outbox":
+		case "demo_code_response": return value;
+		default: throw new Error("emailOtpDeliveryMode must be one of email_provider, provider_and_demo_code, log, dev_d1_outbox, or demo_code_response");
+	}
+}
+function normalizeEmailOtpRuntimeProfile(input, production) {
+	const configured = normalizeOptionalTrimmedString(input)?.toLowerCase();
+	if (!configured) {
+		if (production) throw new Error("emailOtpRuntimeProfile is required when emailOtpProduction is enabled");
+		return "development";
+	}
+	const value = configured;
+	switch (value) {
+		case "development":
+		case "testnet_live_demo":
+		case "testnet_service":
+		case "mainnet_service": return value;
+		default: throw new Error("emailOtpRuntimeProfile must be one of development, testnet_live_demo, testnet_service, or mainnet_service");
+	}
+}
+function normalizeEmailOtpCodeLength(input) {
+	if (configuredInteger({
+		field: "emailOtpCodeLength",
+		raw: input,
+		fallback: 6,
+		min: 6,
+		max: 8
+	}) !== 6) throw new Error(`emailOtpCodeLength must be 6`);
+	return 6;
+}
+function normalizeDemoOrigin(input) {
+	const value = normalizeOptionalTrimmedString(input);
+	if (!value) throw new Error("emailOtpDemoAllowedOrigins contains an empty origin");
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new Error(`emailOtpDemoAllowedOrigins contains an invalid origin: ${value}`);
+	}
+	if (parsed.protocol !== "https:" || parsed.origin !== value) throw new Error(`emailOtpDemoAllowedOrigins must contain exact HTTPS origins without paths: ${value}`);
+	return parsed.origin;
+}
+function emailOtpDemoAllowedOriginInputs(input) {
+	if (Array.isArray(input)) return input;
+	const value = normalizeOptionalTrimmedString(input);
+	if (!value) return [];
+	return value.split(",");
+}
+function normalizeEmailOtpDemoAllowedOrigins(input) {
+	const values = emailOtpDemoAllowedOriginInputs(input);
+	return [...new Set(values.map(normalizeDemoOrigin))];
+}
+function assertEmailOtpDeliveryProfile(input) {
+	if (input.runtimeProfile === "mainnet_service" && input.deliveryMode !== "email_provider") throw new Error("mainnet_service requires emailOtpDeliveryMode=email_provider");
+	if (input.deliveryMode !== "demo_code_response" && input.deliveryMode !== "provider_and_demo_code") return;
+	if (input.runtimeProfile !== "testnet_live_demo") throw new Error(`${input.deliveryMode} requires emailOtpRuntimeProfile=testnet_live_demo`);
+	if (input.demoAllowedOrigins.length === 0) throw new Error(`${input.deliveryMode} requires at least one emailOtpDemoAllowedOrigins entry`);
+}
+function emailOtpRateLimitPolicy(input) {
+	return {
+		limit: configuredInteger({
+			field: input.limitField,
+			raw: input.limitRaw,
+			fallback: input.limitFallback,
+			min: 1,
+			max: input.limitMax
+		}),
+		windowMs: configuredInteger({
+			field: input.windowField,
+			raw: input.windowRaw,
+			fallback: input.windowFallback,
+			min: 1e3,
+			max: 1440 * 6e4
+		})
+	};
+}
+function normalizeEmailOtpConfig(input) {
+	const production = parseBooleanFlag(input.emailOtpProduction, false, "emailOtpProduction");
+	const runtimeProfile = normalizeEmailOtpRuntimeProfile(input.emailOtpRuntimeProfile, production);
+	const deliveryMode = normalizeEmailOtpDeliveryMode(input.emailOtpDeliveryMode, runtimeProfile === "testnet_live_demo" ? "demo_code_response" : "email_provider");
+	const demoAllowedOrigins = normalizeEmailOtpDemoAllowedOrigins(input.emailOtpDemoAllowedOrigins);
+	assertEmailOtpDeliveryProfile({
+		deliveryMode,
+		runtimeProfile,
+		demoAllowedOrigins
+	});
+	if (deliveryMode === "provider_and_demo_code" && !input.emailOtpDeliveryProvider) throw new Error("provider_and_demo_code requires an Email OTP delivery provider");
+	const challengeDefault = production ? {
+		limit: 30,
+		windowMs: 6e4
+	} : {
+		limit: 100,
+		windowMs: 6e4
+	};
+	const verifyDefault = production ? {
+		limit: 30,
+		windowMs: 6e4
+	} : {
+		limit: 100,
+		windowMs: 6e4
+	};
+	const grantDefault = production ? {
+		limit: 30,
+		windowMs: 6e4
+	} : {
+		limit: 100,
+		windowMs: 6e4
+	};
+	const googleRegistrationAttemptDefault = production ? {
+		limit: 12,
+		windowMs: 10 * 6e4
+	} : {
+		limit: 200,
+		windowMs: 6e4
+	};
+	return {
+		deliveryMode,
+		runtimeProfile,
+		demoAllowedOrigins,
+		...input.emailOtpDeliveryProvider ? { deliveryProvider: input.emailOtpDeliveryProvider } : {},
+		production,
+		devOutboxEnabled: deliveryMode === "dev_d1_outbox" && !production && parseBooleanFlag(input.emailOtpDevOutboxEnabled, true, "emailOtpDevOutboxEnabled"),
+		challengeTtlMs: configuredInteger({
+			field: "emailOtpChallengeTtlMs",
+			raw: input.emailOtpChallengeTtlMs,
+			fallback: 5 * 6e4,
+			min: 3e4,
+			max: 15 * 6e4
+		}),
+		grantTtlMs: configuredInteger({
+			field: "emailOtpGrantTtlMs",
+			raw: input.emailOtpGrantTtlMs,
+			fallback: 3e4,
+			min: 1e4,
+			max: 5 * 6e4
+		}),
+		maxAttempts: configuredInteger({
+			field: "emailOtpMaxAttempts",
+			raw: input.emailOtpMaxAttempts,
+			fallback: 5,
+			min: 1,
+			max: 10
+		}),
+		lockoutTtlMs: configuredInteger({
+			field: "emailOtpLockoutTtlMs",
+			raw: input.emailOtpLockoutTtlMs,
+			fallback: 5 * 6e4,
+			min: 6e4,
+			max: 1440 * 6e4
+		}),
+		codeLength: normalizeEmailOtpCodeLength(input.emailOtpCodeLength),
+		maxActiveChallengesPerContext: configuredInteger({
+			field: "emailOtpMaxActiveChallengesPerContext",
+			raw: input.emailOtpMaxActiveChallengesPerContext,
+			fallback: 5,
+			min: 1,
+			max: 20
+		}),
+		rateLimits: {
+			challenge: emailOtpRateLimitPolicy({
+				limitField: "emailOtpChallengeRateLimitMax",
+				limitRaw: input.emailOtpChallengeRateLimitMax,
+				limitFallback: challengeDefault.limit,
+				limitMax: 500,
+				windowField: "emailOtpChallengeRateLimitWindowMs",
+				windowRaw: input.emailOtpChallengeRateLimitWindowMs,
+				windowFallback: challengeDefault.windowMs
+			}),
+			verify: emailOtpRateLimitPolicy({
+				limitField: "emailOtpVerifyRateLimitMax",
+				limitRaw: input.emailOtpVerifyRateLimitMax,
+				limitFallback: verifyDefault.limit,
+				limitMax: 1e3,
+				windowField: "emailOtpVerifyRateLimitWindowMs",
+				windowRaw: input.emailOtpVerifyRateLimitWindowMs,
+				windowFallback: verifyDefault.windowMs
+			}),
+			grant: emailOtpRateLimitPolicy({
+				limitField: "emailOtpGrantRateLimitMax",
+				limitRaw: input.emailOtpGrantRateLimitMax,
+				limitFallback: grantDefault.limit,
+				limitMax: 1e3,
+				windowField: "emailOtpGrantRateLimitWindowMs",
+				windowRaw: input.emailOtpGrantRateLimitWindowMs,
+				windowFallback: grantDefault.windowMs
+			}),
+			googleRegistrationAttempt: emailOtpRateLimitPolicy({
+				limitField: "emailOtpGoogleRegistrationAttemptRateLimitMax",
+				limitRaw: input.emailOtpGoogleRegistrationAttemptRateLimitMax,
+				limitFallback: googleRegistrationAttemptDefault.limit,
+				limitMax: 1e3,
+				windowField: "emailOtpGoogleRegistrationAttemptRateLimitWindowMs",
+				windowRaw: input.emailOtpGoogleRegistrationAttemptRateLimitWindowMs,
+				windowFallback: googleRegistrationAttemptDefault.windowMs
+			})
+		}
+	};
+}
+function missingEmailOtpServerSealConfig() {
+	return {
+		configured: false,
+		message: "Email OTP server seal requires emailOtpServerSeal.rootSecretB64u and currentKeyVersion"
+	};
+}
+function normalizeEmailOtpServerSealConfig(input) {
+	const raw = input.emailOtpServerSeal;
+	if (!raw) return missingEmailOtpServerSealConfig();
+	const rootSecretB64u = normalizeOptionalTrimmedString(raw.rootSecretB64u);
+	const currentKeyVersion = normalizeOptionalTrimmedString(raw.currentKeyVersion);
+	if (!rootSecretB64u || !currentKeyVersion) return missingEmailOtpServerSealConfig();
+	try {
+		return {
+			configured: true,
+			rootConfig: parseSigningSessionSealRootConfig({
+				rootSecretB64u,
+				currentKeyVersion,
+				acceptedWarmKeyVersions: raw.acceptedWarmKeyVersions
+			})
+		};
+	} catch (error) {
+		return {
+			configured: false,
+			message: configErrorMessage(error) || "Email OTP Shamir configuration is invalid"
+		};
+	}
+}
+function configErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "");
+}
+//#endregion
+export { normalizeD1RouterApiAuthOptions, normalizeLinkedDevicePasskeyTargetConfigurationV1, parseBooleanFlag, requireD1RouterApiAuthScopeString };
+
+//# sourceMappingURL=d1RouterApiAuthConfig.js.map