@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -4,6 +4,7 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import "../../../../shared-ts/src/utils/validation.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {
 	const trimmed = email.trim().toLowerCase();
@@ -142,65 +143,26 @@ function parseEmailOtpAuthStateRow(row) {
 	if (!record || !updatedAtMs || record.updatedAtMs !== updatedAtMs) return null;
 	return record;
 }
-function parseEmailOtpChallengeOperation(input) {
-	const operation = normalizeOptionalTrimmedString(input);
-	if (!operation) return null;
-	if (isWalletEmailOtpLoginOperation(operation)) return operation;
-	if (operation === "registration") return operation;
-	if (operation === "device_link") return operation;
-	return null;
-}
 function parseEmailOtpLoginOperation(input) {
 	const operation = normalizeOptionalTrimmedString(input);
 	if (operation && isWalletEmailOtpLoginOperation(operation)) return operation;
 	return WALLET_EMAIL_OTP_UNLOCK_OPERATION;
 }
-function parseEmailOtpChallengeRecord(input) {
-	const record = parseJsonObject(input);
-	if (!record) return null;
-	const version = normalizeOptionalTrimmedString(record.version);
-	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const challengeSubjectId = normalizeOptionalTrimmedString(record.challengeSubjectId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const otpChannel = normalizeOptionalTrimmedString(record.otpChannel);
-	const email = normalizeOptionalTrimmedString(record.email)?.toLowerCase() || "";
-	const otpCode = normalizeOptionalTrimmedString(record.otpCode);
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
-	const action = parseEmailOtpChallengeAction(record.action);
-	const operation = parseEmailOtpChallengeOperation(record.operation);
-	const createdAtMs = positiveSafeInteger(record.createdAtMs);
-	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	const attemptCount = nonNegativeSafeInteger(record.attemptCount);
-	const maxAttempts = positiveSafeInteger(record.maxAttempts);
-	if (version !== "email_otp_challenge_v1" || !challengeId || !challengeSubjectId || !walletId || !email || !otpCode || !ownerProofBindingDigest || !action || !operation || !emailOtpChallengePurposeIsValid({
-		action,
-		operation
-	}) || otpChannel !== "email_otp" || !createdAtMs || !expiresAtMs || attemptCount === null || !maxAttempts || expiresAtMs <= createdAtMs) return null;
+/**
+* Reads a challenge row with the core parser and holds it to more: the operation must fit the
+* action and the challenge must expire after it was created. The email is lowercased.
+*/
+function parseEmailOtpChallengeRow(row) {
+	const record = parseCurrentEmailOtpChallengeRow({
+		recordJson: row?.record_json,
+		expiresAtMs: row?.expires_at_ms
+	});
+	if (!record || record.expiresAtMs <= record.createdAtMs || !emailOtpChallengePurposeIsValid(record)) return null;
 	return {
-		version: "email_otp_challenge_v1",
-		challengeId,
-		challengeSubjectId,
-		walletId,
-		...orgId ? { orgId } : {},
-		otpChannel: EMAIL_OTP_CHANNEL,
-		email,
-		otpCode,
-		ownerProofBindingDigest,
-		action,
-		operation,
-		createdAtMs,
-		expiresAtMs,
-		attemptCount,
-		maxAttempts
+		...record,
+		email: record.email.toLowerCase()
 	};
 }
-function parseEmailOtpChallengeRow(row) {
-	const record = parseEmailOtpChallengeRecord(row?.record_json);
-	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
-	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
-	return record;
-}
 function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 	const record = parseJsonObject(input);
 	if (!record || !hasExactRecordFields(record, [
@@ -243,34 +205,13 @@ function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 		expiresAtMs
 	};
 }
-function parseEmailOtpUnlockChallengeRecord(input) {
-	const record = parseJsonObject(input);
-	if (!record) return null;
-	const version = normalizeOptionalTrimmedString(record.version);
-	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const userId = normalizeOptionalTrimmedString(record.userId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
-	const createdAtMs = positiveSafeInteger(record.createdAtMs);
-	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	if (version !== "email_otp_unlock_challenge_v1" || !challengeId || !walletId || !userId || !challengeB64u || !createdAtMs || !expiresAtMs || expiresAtMs <= createdAtMs) return null;
-	return {
-		version: "email_otp_unlock_challenge_v1",
-		challengeId,
-		walletId,
-		userId,
-		...orgId ? { orgId } : {},
-		challengeB64u,
-		createdAtMs,
-		expiresAtMs
-	};
-}
+/** An unlock challenge row as the core parser reads it, which must also expire after creation. */
 function parseEmailOtpUnlockChallengeRow(row) {
-	const record = parseEmailOtpUnlockChallengeRecord(row?.record_json);
-	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
-	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
-	return record;
+	const record = parseCurrentEmailOtpUnlockChallengeRow({
+		recordJson: row?.record_json,
+		expiresAtMs: row?.expires_at_ms
+	});
+	return record && record.expiresAtMs > record.createdAtMs ? record : null;
 }
 function emailOtpChallengeContextValues(input) {
 	return [
@@ -376,41 +317,13 @@ function emailOtpUnlockChallengeRecord(input) {
 		expiresAtMs: input.expiresAtMs
 	};
 }
-function parseEmailOtpGrantRecord(input) {
-	const record = parseJsonObject(input);
-	if (!record) return null;
-	const version = normalizeOptionalTrimmedString(record.version);
-	const grantToken = normalizeOptionalTrimmedString(record.grantToken);
-	const userId = normalizeOptionalTrimmedString(record.userId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const otpChannel = normalizeOptionalTrimmedString(record.otpChannel);
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
-	const action = normalizeOptionalTrimmedString(record.action);
-	const issuedAtMs = positiveSafeInteger(record.issuedAtMs);
-	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	if (version !== "email_otp_grant_v1" || !grantToken || !userId || !walletId || !challengeId || otpChannel !== "email_otp" || !ownerProofBindingDigest || !action || !issuedAtMs || !expiresAtMs || expiresAtMs <= issuedAtMs) return null;
-	if (action !== WALLET_EMAIL_OTP_ACTIONS.unseal && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap) return null;
-	return {
-		version: "email_otp_grant_v1",
-		grantToken,
-		userId,
-		walletId,
-		...orgId ? { orgId } : {},
-		challengeId,
-		otpChannel: EMAIL_OTP_CHANNEL,
-		ownerProofBindingDigest,
-		action,
-		issuedAtMs,
-		expiresAtMs
-	};
-}
+/** A grant row as the core parser reads it, which must also expire after it was issued. */
 function parseEmailOtpGrantRow(row) {
-	const record = parseEmailOtpGrantRecord(row?.record_json);
-	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
-	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
-	return record;
+	const record = parseCurrentEmailOtpGrantRow({
+		recordJson: row?.record_json,
+		expiresAtMs: row?.expires_at_ms
+	});
+	return record && record.expiresAtMs > record.issuedAtMs ? record : null;
 }
 async function validateEmailOtpEnrollmentMaterial(input) {
 	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(input.material.enrollmentSealKeyVersion);
@@ -489,16 +402,6 @@ function emailOtpAuthStateRecord(input) {
 		...lastStrongAuthAtMs != null ? { lastStrongAuthAtMs } : {}
 	};
 }
-function parseEmailOtpChallengeAction(input) {
-	const action = normalizeOptionalTrimmedString(input);
-	switch (action) {
-		case WALLET_EMAIL_OTP_ACTIONS.login:
-		case WALLET_EMAIL_OTP_ACTIONS.registration:
-		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap:
-		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return action;
-		default: return null;
-	}
-}
 function emailOtpChallengePurposeIsValid(input) {
 	switch (input.action) {
 		case WALLET_EMAIL_OTP_ACTIONS.login: return isWalletEmailOtpLoginOperation(input.operation);
@@ -534,6 +437,6 @@ function patchedNonNegativeAuthStateValue(current, patch) {
 	return patch >= 0 ? Math.floor(patch) : void 0;
 }
 //#endregion
-export { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpAuthStateRecord, emailOtpChallengeBindingMismatchCode, emailOtpChallengeContextValues, emailOtpChallengeInvalidOrExpired, emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, emailOtpChallengeWithAttemptCount, emailOtpGrantRecord, emailOtpRateLimitExceeded, emailOtpRateLimitKeys, emailOtpRegistrationChallengeBindingMismatchCode, emailOtpUnlockChallengeRecord, generateNumericOtp, maskEmail, parseEmailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpChallengeOperation, parseEmailOtpChallengeRecord, parseEmailOtpChallengeRow, parseEmailOtpGrantRecord, parseEmailOtpGrantRow, parseEmailOtpLoginOperation, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRecord, parseEmailOtpUnlockChallengeRow, parseEmailOtpWalletEnrollmentRecord, parseEmailOtpWalletEnrollmentRow, validateEmailOtpEnrollmentMaterial };
+export { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpAuthStateRecord, emailOtpChallengeBindingMismatchCode, emailOtpChallengeContextValues, emailOtpChallengeInvalidOrExpired, emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, emailOtpChallengeWithAttemptCount, emailOtpGrantRecord, emailOtpRateLimitExceeded, emailOtpRateLimitKeys, emailOtpRegistrationChallengeBindingMismatchCode, emailOtpUnlockChallengeRecord, generateNumericOtp, maskEmail, parseEmailOtpAuthStateRow, parseEmailOtpChallengeRow, parseEmailOtpGrantRow, parseEmailOtpLoginOperation, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow, parseEmailOtpWalletEnrollmentRow, validateEmailOtpEnrollmentMaterial };
 
 //# sourceMappingURL=d1EmailOtpRecords.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -90,12 +90,10 @@ function emailOtpEnrollmentTenantMismatch() {
 }
 var CloudflareD1EmailOtpRecoveryService = class {
 	constructor(input) {
-		this.challengeVerifier = input.challengeVerifier;
 		this.emailOtpChallenges = input.emailOtpChallenges;
 		this.emailOtpEnrollments = input.emailOtpEnrollments;
 		this.emailOtpGrants = input.emailOtpGrants;
 		this.emailOtpRateLimits = input.emailOtpRateLimits;
-		this.grantTtlMs = input.grantTtlMs;
 	}
 	async readEmailOtpEnrollment(input) {
 		const parsed = normalizeEmailOtpEnrollmentReadInput(input);

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -107,8 +107,8 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		};
 	}
 	/**
-	* Refactor 109C: the enrollment statements for a wallet's first Email OTP
-	* method, to commit in the batch that inserts that method.
+	* The enrollment statements for a wallet's first Email OTP method, to commit
+	* in the batch that inserts that method.
 	*
 	* Same construction as registration's, deliberately — the shared enrollment
 	* is one record whichever operation creates it, and a second builder would

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -2,7 +2,9 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferWalletIdsJson, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope, runtimePolicyScopeKey } from "./d1GoogleEmailOtpRegistrationRecords.js";
+import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
+import { emailOtpRegistrationAttemptRows } from "../../../../core/emailOtpD1Statements.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt } from "./d1GoogleEmailOtpRegistrationRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.ts
 var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	constructor(input) {
@@ -10,12 +12,7 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		this.orgId = input.orgId;
 	}
 	async cleanupExpired(nowMs) {
-		return d1MutationChanges(await this.prepare(`DELETE FROM email_otp_registration_attempts
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]).run());
+		return d1MutationChanges(await emailOtpRegistrationAttemptRows.deleteExpired(this.prepare, nowMs).run());
 	}
 	async create(input) {
 		const nowMs = Date.now();
@@ -46,61 +43,24 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	async findStarted(input) {
 		const nowMs = Date.now();
 		await this.cleanupExpired(nowMs);
-		const row = await this.prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND provider_subject = ?
-          AND email = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
-          AND owner_proof_binding_digest = ?
-          AND runtime_org_id = ?
-          AND runtime_policy_key = ?
-        ORDER BY updated_at_ms DESC
-        LIMIT 1`, [
-			input.providerSubject,
-			input.email,
-			nowMs,
-			input.ownerProofBindingDigest,
-			input.orgId,
-			runtimePolicyScopeKey(input.runtimePolicyScope)
-		]).first();
+		const scope = {
+			...input,
+			nowMs
+		};
+		const row = await emailOtpRegistrationAttemptRows.selectStarted(this.prepare, scope).first();
 		const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 		if (!parsed) {
 			const malformedAttemptId = normalizeOptionalTrimmedString(row?.attempt_id);
 			if (malformedAttemptId) await this.delete(malformedAttemptId);
 			return null;
 		}
-		if (!registrationAttemptMatchesStartedScope(parsed, {
-			providerSubject: input.providerSubject,
-			email: input.email,
-			orgId: input.orgId,
-			ownerProofBindingDigest: input.ownerProofBindingDigest,
-			runtimePolicyScope: input.runtimePolicyScope,
-			nowMs
-		})) return null;
+		if (!registrationAttemptMatchesStartedScope(parsed, scope)) return null;
 		const refreshed = pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(parsed, nowMs);
 		await this.put(refreshed);
 		return refreshed;
 	}
 	async abandonStartedExceptBinding(input) {
-		const result = await this.prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND provider_subject = ?
-          AND email = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?`, [
-			input.providerSubject,
-			input.email,
-			input.nowMs
-		]).all();
+		const result = await emailOtpRegistrationAttemptRows.selectPending(this.prepare, input).all();
 		for (const row of result.results || []) {
 			const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 			if (!parsed) {
@@ -117,98 +77,19 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		}
 	}
 	async hasLiveStartedWalletAttempt(input) {
-		const row = await this.prepare(`SELECT 1 AS found
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
-          AND (
-            wallet_id = ?
-            OR EXISTS (
-              SELECT 1
-                FROM json_each(offer_wallet_ids_json)
-               WHERE value = ?
-            )
-          )
-        LIMIT 1`, [
-			input.nowMs,
-			input.walletId,
-			input.walletId
-		]).first();
+		const row = await emailOtpRegistrationAttemptRows.selectLiveForWallet(this.prepare, input.walletId, input.nowMs).first();
 		return Boolean(row);
 	}
 	async read(attemptId) {
-		const record = parseGoogleEmailOtpRegistrationAttemptRow(await this.prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND attempt_id = ?
-        LIMIT 1`, [attemptId]).first());
+		const record = parseGoogleEmailOtpRegistrationAttemptRow(await emailOtpRegistrationAttemptRows.select(this.prepare, attemptId).first());
 		return record?.runtimePolicyScope?.orgId === this.orgId ? record : null;
 	}
 	async put(record) {
 		if (record.runtimePolicyScope?.orgId !== this.orgId) throw new Error("Google Email OTP registration attempt org scope mismatch");
-		await this.prepare(`INSERT INTO email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        attempt_id,
-        provider_subject,
-        email,
-        wallet_id,
-        state,
-        owner_proof_binding_digest,
-        runtime_org_id,
-        runtime_policy_key,
-        offer_wallet_ids_json,
-        record_json,
-        created_at_ms,
-        updated_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
-      DO UPDATE SET
-        provider_subject = EXCLUDED.provider_subject,
-        email = EXCLUDED.email,
-        wallet_id = EXCLUDED.wallet_id,
-        state = EXCLUDED.state,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        runtime_org_id = EXCLUDED.runtime_org_id,
-        runtime_policy_key = EXCLUDED.runtime_policy_key,
-        offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			record.attemptId,
-			record.providerSubject,
-			record.email,
-			record.walletId,
-			record.state,
-			record.ownerProofBindingDigest,
-			record.runtimePolicyScope?.orgId || "",
-			runtimePolicyScopeKey(record.runtimePolicyScope),
-			googleEmailOtpRegistrationOfferWalletIdsJson(record.offerCandidates),
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpRegistrationAttemptRows.upsert(this.prepare, record).run();
 	}
 	async delete(attemptId) {
-		await this.prepare(`DELETE FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND attempt_id = ?`, [attemptId]).run();
+		await emailOtpRegistrationAttemptRows.delete(this.prepare, attemptId).run();
 	}
 };
 //#endregion