@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/core/WebAuthnLoginChallengeStore.js

@@ -1,55 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject as isObject$1 } from "../shared-ts/src/utils/validation.js";
-import { formatD1ExecStatement, parseD1JsonColumn, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import "./defaultConfigsServer.js";
-import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetdelJson, redisSetJson } from "./ThresholdService/kv.js";
+import { isObject } from "../shared-ts/src/utils/validation.js";
+import { D1WebAuthnChallengeStore, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema } from "./webAuthnStoreBackends.js";
 //#region src/core/WebAuthnLoginChallengeStore.ts
-const WEBAUTHN_LOGIN_CHALLENGE_KIND = "login";
-const WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL = Object.freeze([`
-    CREATE TABLE IF NOT EXISTS webauthn_challenges (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      challenge_id TEXT NOT NULL,
-      challenge_kind TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      expires_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
-      CHECK (length(challenge_id) > 0),
-      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (expires_at_ms > created_at_ms)
-    )
-  `, `
-    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx
-      ON webauthn_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_kind,
-        expires_at_ms
-      )
-  `]);
-async function ensureWebAuthnLoginChallengeStoreD1Schema(options) {
-	for (const statement of WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
-}
-function isObject(v) {
-	return isObject$1(v);
-}
-function toPrefixWithColon(prefix, defaultPrefix) {
-	const p = normalizeOptionalTrimmedString(prefix);
-	if (!p) return defaultPrefix;
-	return p.endsWith(":") ? p : `${p}:`;
-}
-function toWebAuthnLoginChallengePrefix(config) {
-	const explicit = normalizeOptionalTrimmedString(config.WEBAUTHN_LOGIN_CHALLENGE_PREFIX);
-	if (explicit) return toPrefixWithColon(explicit, "");
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}webauthn:login_challenge:`;
-}
+const WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL = WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL;
+const ensureWebAuthnLoginChallengeStoreD1Schema = ensureWebAuthnChallengeStoreD1Schema;
 function parseWebAuthnLoginChallengeRecord(raw) {
 	if (!isObject(raw)) return null;
 	const version = normalizeOptionalTrimmedString(raw.version);
@@ -73,358 +27,24 @@ function parseWebAuthnLoginChallengeRecord(raw) {
 		expiresAtMs: Math.floor(expiresAtMs)
 	};
 }
-function defaultNow() {
-	return /* @__PURE__ */ new Date();
-}
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 WebAuthn login challenge store`);
-	return normalized;
-}
-function normalizeD1WebAuthnLoginChallengeStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false,
-		now: input.now || defaultNow
-	};
-}
-function d1ScopeFromConfig(input) {
-	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
-	};
-}
-var InMemoryWebAuthnLoginChallengeStore = class {
-	constructor(prefix) {
-		this.map = /* @__PURE__ */ new Map();
-		this.prefix = prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnLoginChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid login challenge record");
-		this.map.set(this.key(parsed.challengeId), parsed);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const key = this.key(id);
-		const rec = this.map.get(key) || null;
-		this.map.delete(key);
-		if (!rec) return null;
-		if (Date.now() > rec.expiresAtMs) return null;
-		return rec;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		this.map.delete(this.key(id));
-	}
-};
-var D1WebAuthnLoginChallengeStore = class {
-	constructor(input) {
-		this.adapterKind = "d1";
-		this.schemaReady = false;
-		const normalized = normalizeD1WebAuthnLoginChallengeStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
-		this.now = normalized.now;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureWebAuthnLoginChallengeStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
-	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseWebAuthnLoginChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid login challenge record");
-		await this.database.prepare(`INSERT INTO webauthn_challenges (
-          namespace,
-          org_id,
-          project_id,
-          env_id,
-          challenge_id,
-          challenge_kind,
-          record_json,
-          created_at_ms,
-          expires_at_ms
-        )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-        ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-        DO UPDATE SET
-          challenge_kind = EXCLUDED.challenge_kind,
-          record_json = EXCLUDED.record_json,
-          created_at_ms = EXCLUDED.created_at_ms,
-          expires_at_ms = EXCLUDED.expires_at_ms`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.challengeId, WEBAUTHN_LOGIN_CHALLENGE_KIND, JSON.stringify(parsed), parsed.createdAtMs, parsed.expiresAtMs).run();
-	}
-	async consume(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		return parseWebAuthnLoginChallengeRecord(parseD1JsonColumn((await this.database.prepare(`DELETE FROM webauthn_challenges
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND challenge_id = ?
-            AND challenge_kind = ?
-            AND expires_at_ms > ?
-          RETURNING record_json`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, id, WEBAUTHN_LOGIN_CHALLENGE_KIND, this.now().getTime()).first())?.record_json));
-	}
-	async del(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await this.database.prepare(`DELETE FROM webauthn_challenges
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND challenge_id = ?
-            AND challenge_kind = ?`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, id, WEBAUTHN_LOGIN_CHALLENGE_KIND).run();
-	}
-};
-var UpstashRedisRestWebAuthnLoginChallengeStore = class {
-	constructor(input) {
-		this.client = new UpstashRedisRestClient({
-			url: input.url,
-			token: input.token
-		});
-		this.prefix = input.prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnLoginChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid login challenge record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		await this.client.setJson(this.key(parsed.challengeId), parsed, ttlMs);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const parsed = parseWebAuthnLoginChallengeRecord(await this.client.getdelJson(this.key(id)));
-		if (!parsed) return null;
-		if (Date.now() > parsed.expiresAtMs) return null;
-		return parsed;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await this.client.del(this.key(id));
-	}
-};
-var RedisTcpWebAuthnLoginChallengeStore = class {
-	constructor(input) {
-		this.client = new RedisTcpClient(input.redisUrl);
-		this.prefix = input.prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnLoginChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid login challenge record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		await redisSetJson(this.client, this.key(parsed.challengeId), parsed, ttlMs);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const parsed = parseWebAuthnLoginChallengeRecord(await redisGetdelJson(this.client, this.key(id)));
-		if (!parsed) return null;
-		if (Date.now() > parsed.expiresAtMs) return null;
-		return parsed;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await redisDel(this.client, this.key(id));
-	}
+const LOGIN_CHALLENGE_STORE = {
+	label: "login challenge",
+	prefixConfigKey: "WEBAUTHN_LOGIN_CHALLENGE_PREFIX",
+	prefixName: "login_challenge",
+	challengeKind: "login",
+	parse: parseWebAuthnLoginChallengeRecord,
+	durableObjectLogSubject: "login challenge persistence",
+	connectionErrorSubject: "webauthn login challenge store",
+	unconfiguredNote: "non-persistent",
+	d1ScopeLabel: "login challenge"
 };
-function isDurableObjectNamespaceLike(v) {
-	return Boolean(v) && typeof v === "object" && !Array.isArray(v) && typeof v.idFromName === "function" && typeof v.get === "function";
-}
-function resolveDoNamespaceFromConfig(config) {
-	const direct = config.namespace;
-	if (isDurableObjectNamespaceLike(direct)) return direct;
-	const alt = config.durableObjectNamespace;
-	if (isDurableObjectNamespaceLike(alt)) return alt;
-	const envStyle = config.THRESHOLD_DO_NAMESPACE;
-	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
-	return null;
-}
-function resolveDoStub(input) {
-	const id = input.namespace.idFromName(input.objectName);
-	return input.namespace.get(id);
-}
-async function callDo(stub, req) {
-	const resp = await stub.fetch("https://threshold-store.invalid/", {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(req)
-	});
-	const text = await resp.text();
-	if (!resp.ok) throw new Error(`WebAuthn DO store HTTP ${resp.status}: ${text}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(`WebAuthn DO store returned non-JSON response: ${text.slice(0, 200)}`);
-	}
-	if (!isObject(json)) throw new Error("WebAuthn DO store returned invalid JSON shape");
-	if (json.ok === true) return json;
-	const code = normalizeOptionalTrimmedString(json.code);
-	const message = normalizeOptionalTrimmedString(json.message);
-	return {
-		ok: false,
-		code: code || "internal",
-		message: message || "WebAuthn DO store error"
-	};
-}
-var CloudflareDurableObjectWebAuthnLoginChallengeStore = class {
+var D1WebAuthnLoginChallengeStore = class extends D1WebAuthnChallengeStore {
 	constructor(input) {
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
-		this.prefix = input.prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnLoginChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid login challenge record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const resp = await callDo(this.stub, {
-			op: "set",
-			key: this.key(parsed.challengeId),
-			value: parsed,
-			ttlMs
-		});
-		if (!resp.ok) throw new Error(resp.message);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const resp = await callDo(this.stub, {
-			op: "getdel",
-			key: this.key(id)
-		});
-		if (!resp.ok) return null;
-		const parsed = parseWebAuthnLoginChallengeRecord(resp.value);
-		if (!parsed) return null;
-		if (Date.now() > parsed.expiresAtMs) return null;
-		return parsed;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		const resp = await callDo(this.stub, {
-			op: "del",
-			key: this.key(id)
-		});
-		if (!resp.ok) throw new Error(resp.message);
+		super(input, LOGIN_CHALLENGE_STORE);
 	}
 };
 function createWebAuthnLoginChallengeStore(input) {
-	const config = isObject(input.config) ? input.config : {};
-	const prefix = toWebAuthnLoginChallengePrefix(config);
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error("[webauthn] D1 login challenge store selected but no D1 database was provided");
-		input.logger.info("[webauthn] Using D1 login challenge store");
-		return new D1WebAuthnLoginChallengeStore({
-			database,
-			...d1ScopeFromConfig({
-				config,
-				namespace: prefix
-			})
-		});
-	}
-	if (kind === "cloudflare-do") {
-		const namespace = resolveDoNamespaceFromConfig(config);
-		if (!namespace) throw new Error("cloudflare-do webauthn store selected but no Durable Object namespace was provided (expected config.namespace)");
-		const objectName = normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
-		input.logger.info("[webauthn] Using Cloudflare Durable Object store for login challenge persistence");
-		return new CloudflareDurableObjectWebAuthnLoginChallengeStore({
-			namespace,
-			objectName,
-			prefix
-		});
-	}
-	if (kind === "in-memory") {
-		input.logger.info("[webauthn] Using in-memory login challenge store (non-persistent)");
-		return new InMemoryWebAuthnLoginChallengeStore(prefix);
-	}
-	if (kind === "upstash-redis-rest") {
-		const url = normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-		const token = normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-		if (!url || !token) throw new Error("Upstash webauthn login challenge store enabled but url/token are not both set");
-		input.logger.info("[webauthn] Using Upstash REST login challenge store");
-		return new UpstashRedisRestWebAuthnLoginChallengeStore({
-			url,
-			token,
-			prefix
-		});
-	}
-	if (kind === "redis-tcp") {
-		if (!input.isNode) {
-			input.logger.warn("[webauthn] redis-tcp login challenge store is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWebAuthnLoginChallengeStore(prefix);
-		}
-		const redisUrl = normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL);
-		if (!redisUrl) throw new Error("redis-tcp webauthn login challenge store enabled but redisUrl is not set");
-		input.logger.info("[webauthn] Using redis-tcp login challenge store");
-		return new RedisTcpWebAuthnLoginChallengeStore({
-			redisUrl,
-			prefix
-		});
-	}
-	if (kind) throw new Error(`[webauthn] Unknown login challenge store kind: ${kind}`);
-	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-	if (upstashUrl || upstashToken) {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash webauthn login challenge store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
-		input.logger.info("[webauthn] Using Upstash REST login challenge store");
-		return new UpstashRedisRestWebAuthnLoginChallengeStore({
-			url: upstashUrl,
-			token: upstashToken,
-			prefix
-		});
-	}
-	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
-	if (redisUrl) {
-		if (!input.isNode) {
-			input.logger.warn("[webauthn] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWebAuthnLoginChallengeStore(prefix);
-		}
-		input.logger.info("[webauthn] Using redis-tcp login challenge store");
-		return new RedisTcpWebAuthnLoginChallengeStore({
-			redisUrl,
-			prefix
-		});
-	}
-	input.logger.info("[webauthn] Using in-memory login challenge store (non-persistent)");
-	return new InMemoryWebAuthnLoginChallengeStore(prefix);
+	return createWebAuthnChallengeStore(input, LOGIN_CHALLENGE_STORE, (options) => new D1WebAuthnLoginChallengeStore(options));
 }
 //#endregion
 export { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema };