@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -6,6 +6,7 @@ import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../.
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId, projectActiveWalletSession } from "../../../authorization/domain.js";
 import { buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../authorization/factorEvidence.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../threshold/statusCodes.js";
@@ -58,11 +59,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP authority refresh resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP authority refresh resolution failed")
 			}
 		};
 	}
@@ -70,11 +67,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 		ok: false,
 		response: {
 			status: authorityResolution.code === "internal" ? 500 : 403,
-			body: {
-				ok: false,
-				code: authorityResolution.code,
-				message: authorityResolution.message
-			}
+			body: failure(authorityResolution.code, authorityResolution.message)
 		}
 	};
 	try {
@@ -91,11 +84,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed")
 			}
 		};
 	}
@@ -106,11 +95,7 @@ function walletUnlockCustodyUnavailableResponse(lookup, factor) {
 		ok: false,
 		response: {
 			status: lookup.kind === "manifest_unavailable" ? 503 : lookup.kind === "conflict" ? 409 : lookup.kind === "missing" ? 404 : 409,
-			body: {
-				ok: false,
-				code: lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable",
-				message: `${factor} wallet custody is unavailable`
-			}
+			body: failure(lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable", `${factor} wallet custody is unavailable`)
 		}
 	};
 }
@@ -125,11 +110,7 @@ function projectEmailOtpCustody(verifiedUnlock, lookup) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Email OTP wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Email OTP wallet custody binding is invalid")
 		}
 	};
 	return {
@@ -159,11 +140,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Passkey wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Passkey wallet custody binding is invalid")
 		}
 	};
 	let ed25519 = { kind: "absent" };
@@ -175,11 +152,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "custody_binding_mismatch",
-					message: "Passkey Ed25519 custody binding is invalid"
-				}
+				body: failure("custody_binding_mismatch", "Passkey Ed25519 custody binding is invalid")
 			}
 		};
 		ed25519 = {
@@ -210,11 +183,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: 403,
-					body: {
-						ok: false,
-						code: "scope_mismatch",
-						message: "Wallet unlock proof does not match the requested ECDSA wallet"
-					}
+					body: failure("scope_mismatch", "Wallet unlock proof does not match the requested ECDSA wallet")
 				}
 			};
 			const provisioned = await input.context.provisionWalletSession(input.authorization);
@@ -222,11 +191,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: provisioned.status,
-					body: {
-						ok: false,
-						code: provisioned.code,
-						message: provisioned.message
-					}
+					body: failure(provisioned.code, provisioned.message)
 				}
 			};
 			return {
@@ -254,11 +219,7 @@ function walletUnlockScopeMismatchResponse() {
 		ok: false,
 		response: {
 			status: 403,
-			body: {
-				ok: false,
-				code: "scope_mismatch",
-				message: "Email OTP unlock proof does not match the requested Ed25519 wallet"
-			}
+			body: failure("scope_mismatch", "Email OTP unlock proof does not match the requested Ed25519 wallet")
 		}
 	};
 }
@@ -322,11 +283,7 @@ function planWalletUnlockAuthorityEcdsaSession(input) {
 function walletUnlockDeviceLinkEcdsaSessionRejection() {
 	return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "ecdsaSessionPolicy is not supported for device-linked wallet unlock"
-		}
+		body: failure("invalid_body", "ecdsaSessionPolicy is not supported for device-linked wallet unlock")
 	};
 }
 function planWalletUnlockPasskeySession(input) {
@@ -369,11 +326,7 @@ async function provisionPasskeyEd25519YaoSession(input) {
 		ok: false,
 		response: {
 			status: 409,
-			body: {
-				ok: false,
-				code: "capability_unavailable",
-				message: "Requested Ed25519 Wallet Session is unavailable"
-			}
+			body: failure("capability_unavailable", "Requested Ed25519 Wallet Session is unavailable")
 		}
 	};
 	const provisioned = await input.context.provisionWalletSession({
@@ -427,11 +380,7 @@ function walletUnlockEcdsaOperationCredential(input) {
 function walletUnlockEcdsaCredentialUnavailableResponse() {
 	return {
 		status: 409,
-		body: {
-			ok: false,
-			code: "capability_unavailable",
-			message: "ECDSA activation requires the exact Wallet Session operation credential"
-		}
+		body: failure("capability_unavailable", "ECDSA activation requires the exact Wallet Session operation credential")
 	};
 }
 /** The unlock response's Wallet Session, when the unlock holds one. */
@@ -467,11 +416,7 @@ function parseWalletUnlockRouteBody(body) {
 		ok: false,
 		response: {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "Request body is required"
-			}
+			body: failure("invalid_body", "Request body is required")
 		}
 	};
 	const record = body;
@@ -480,11 +425,7 @@ function parseWalletUnlockRouteBody(body) {
 		ok: false,
 		response: {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "unlockBackend is required"
-			}
+			body: failure("invalid_body", "unlockBackend is required")
 		}
 	};
 	return {
@@ -501,11 +442,7 @@ async function handleWalletUnlockChallengeRoute(input) {
 		const walletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 		if (!walletAuthMethodId.ok) return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: walletAuthMethodId.message
-			}
+			body: failure("invalid_body", walletAuthMethodId.message)
 		};
 	}
 	const result = unlockBackend === "passkey" ? await input.service.createWebAuthnLoginOptions({
@@ -517,6 +454,20 @@ async function handleWalletUnlockChallengeRoute(input) {
 		orgId: body.orgId,
 		ttlMs: body.ttlMs
 	});
+	if (!result.ok && result.code === "wallet_home_unavailable") return {
+		status: 503,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
+	if (!result.ok && result.code === "wallet_home_conflict") return {
+		status: 409,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
 	return {
 		status: result.ok ? 200 : result.code === "internal" ? 500 : 400,
 		body: {
@@ -688,20 +639,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	const challengeId = String(body.challengeId || "").trim();
 	if (!challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeId is required"
-		}
+		body: failure("invalid_body", "challengeId is required")
 	};
 	if (unlockBackend === "passkey") {
 		if (input.capabilityContext.kind !== "passkey_unlock") return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "Passkey unlock context is invalid"
-			}
+			body: failure("invalid_body", "Passkey unlock context is invalid")
 		};
 		let ed25519SessionRequest;
 		try {
@@ -709,11 +652,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 400,
-				body: {
-					ok: false,
-					code: "invalid_body",
-					message: error instanceof Error ? error.message : "Ed25519 session request is invalid"
-				}
+				body: failure("invalid_body", error instanceof Error ? error.message : "Ed25519 session request is invalid")
 			};
 		}
 		const result = await verifyPasskeyWalletUnlock({
@@ -732,11 +671,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const userId = String(result.userId || "").trim();
 		if (!userId) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey user is missing"
-			}
+			body: failure("internal", "Verified passkey user is missing")
 		};
 		const walletId = parseWalletId(userId);
 		const walletAuthMethodId = parseWalletAuthMethodId(result.walletAuthMethodId);
@@ -745,11 +680,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const credentialIdB64u = parseWebAuthnCredentialIdB64u(result.credentialIdB64u);
 		if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !rpId.ok || !credentialIdB64u.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey identity is invalid"
-			}
+			body: failure("internal", "Verified passkey identity is invalid")
 		};
 		let authorization;
 		try {
@@ -767,11 +698,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 403,
-				body: {
-					ok: false,
-					code: "owner_proof_rejected",
-					message: error instanceof Error ? error.message : "Passkey owner proof is invalid"
-				}
+				body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Passkey owner proof is invalid")
 			};
 		}
 		const resolvePasskeyAuthority = () => input.service.resolveActivePasskeyAuthorityForUnlock({
@@ -789,11 +716,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Passkey authority resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Passkey authority resolution failed")
 			};
 		}
 		if (authorityResolution.kind === "active_authority") {
@@ -810,11 +733,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		switch (sessionPlan.kind) {
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionPlan.authorityResolution),
-				body: {
-					ok: false,
-					code: sessionPlan.authorityResolution.code,
-					message: sessionPlan.authorityResolution.message
-				}
+				body: failure(sessionPlan.authorityResolution.code, sessionPlan.authorityResolution.message)
 			};
 			case "wallet_registration":
 				passkeyCustodyRequired = true;
@@ -836,11 +755,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 				} catch (error) {
 					return {
 						status: 500,
-						body: {
-							ok: false,
-							code: "internal",
-							message: error instanceof Error ? error.message : "Passkey Wallet Session issuance failed"
-						}
+						body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session issuance failed")
 					};
 				}
 				switch (sessionResolution.kind) {
@@ -861,11 +776,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 						break;
 					case "rejected": return {
 						status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-						body: {
-							ok: false,
-							code: sessionResolution.code,
-							message: sessionResolution.message
-						}
+						body: failure(sessionResolution.code, sessionResolution.message)
 					};
 				}
 				break;
@@ -884,11 +795,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 503,
-				body: {
-					ok: false,
-					code: "custody_unavailable",
-					message: error instanceof Error ? error.message : "Passkey wallet custody is unavailable"
-				}
+				body: failure("custody_unavailable", error instanceof Error ? error.message : "Passkey wallet custody is unavailable")
 			};
 		}
 		const ed25519Session = await provisionPasskeyEd25519YaoSession({
@@ -930,20 +837,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey authority refresh resolution failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey authority refresh resolution failed")
 				};
 			}
 			if (refreshedAuthority.kind === "rejected") return {
 				status: walletUnlockIssuanceRejectionStatus(refreshedAuthority),
-				body: {
-					ok: false,
-					code: refreshedAuthority.code,
-					message: refreshedAuthority.message
-				}
+				body: failure(refreshedAuthority.code, refreshedAuthority.message)
 			};
 			try {
 				walletSessionState = await refreshWalletUnlockSessionState({
@@ -954,11 +853,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed")
 				};
 			}
 		}
@@ -987,20 +882,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	}
 	if (input.capabilityContext.kind === "passkey_unlock") return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP unlock context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP unlock context is invalid")
 	};
 	const requestedWalletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 	if (!requestedWalletAuthMethodId.ok) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: requestedWalletAuthMethodId.message
-		}
+		body: failure("invalid_body", requestedWalletAuthMethodId.message)
 	};
 	const result = await input.service.verifyEmailOtpUnlockProof({
 		walletId: body.walletId,
@@ -1027,11 +914,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	const walletId = parseWalletId(result.walletId);
 	if (!walletId.ok) return {
 		status: 500,
-		body: {
-			ok: false,
-			code: "internal",
-			message: "Verified Email OTP wallet identity is invalid"
-		}
+		body: failure("internal", "Verified Email OTP wallet identity is invalid")
 	};
 	let authorityResolution;
 	try {
@@ -1044,20 +927,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: error instanceof Error ? error.message : "Email OTP authority resolution failed"
-			}
+			body: failure("internal", error instanceof Error ? error.message : "Email OTP authority resolution failed")
 		};
 	}
 	if (authorityResolution.kind === "rejected") return {
 		status: authorityResolution.code === "internal" ? 500 : 403,
-		body: {
-			ok: false,
-			code: authorityResolution.code,
-			message: authorityResolution.message
-		}
+		body: failure(authorityResolution.code, authorityResolution.message)
 	};
 	const exactEmailOtpAuthority = authorityResolution;
 	if (planWalletUnlockAuthorityEcdsaSession({
@@ -1091,11 +966,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 403,
-			body: {
-				ok: false,
-				code: "owner_proof_rejected",
-				message: error instanceof Error ? error.message : "Email OTP owner proof is invalid"
-			}
+			body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Email OTP owner proof is invalid")
 		};
 	}
 	let walletSessionState = { kind: "absent" };
@@ -1103,11 +974,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const walletId = parseWalletId(result.walletId);
 		if (!walletId.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified Email OTP wallet identity is invalid"
-			}
+			body: failure("internal", "Verified Email OTP wallet identity is invalid")
 		};
 		let sessionResolution;
 		try {
@@ -1122,11 +989,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed")
 			};
 		}
 		switch (sessionResolution.kind) {
@@ -1144,11 +1007,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 			case "wallet_registration": break;
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-				body: {
-					ok: false,
-					code: sessionResolution.code,
-					message: sessionResolution.message
-				}
+				body: failure(sessionResolution.code, sessionResolution.message)
 			};
 		}
 	}
@@ -1198,11 +1057,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	});
 	if (!isWalletUnlockEd25519YaoRequestedContext(input.capabilityContext)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP capability context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP capability context is invalid")
 	};
 	const capabilityResult = await provisionEmailOtpEd25519YaoCapability({
 		context: input.capabilityContext,