@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/authService/oidcVerification.js

@@ -1,261 +0,0 @@
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { parseCacheControlMaxAgeSec, parseJwtAud, parseJwtSegmentJson } from "./webauthnOidcHelpers.js";
-import { toArrayBufferCopy } from "./portableCrypto.js";
-//#region src/core/authService/oidcVerification.ts
-function createGoogleJwksState() {
-	return {
-		cache: null,
-		fetchPromise: null
-	};
-}
-function jwtError(code, message) {
-	return {
-		ok: false,
-		verified: false,
-		code,
-		message
-	};
-}
-function requireWebCrypto() {
-	return typeof crypto !== "undefined" && Boolean(crypto.subtle);
-}
-function parseJwtParts(input) {
-	const parts = input.token.split(".");
-	if (parts.length !== 3) return jwtError("invalid_body", `${input.tokenName} must be a JWT (3 segments)`);
-	const [headerB64u, payloadB64u, signatureB64u] = parts;
-	const header = parseJwtSegmentJson(headerB64u);
-	if (!header) return jwtError("invalid_body", `Invalid ${input.tokenName} header encoding`);
-	const payload = parseJwtSegmentJson(payloadB64u);
-	if (!payload) return jwtError("invalid_body", `Invalid ${input.tokenName} payload encoding`);
-	return {
-		ok: true,
-		value: {
-			headerB64u,
-			payloadB64u,
-			signatureB64u,
-			header,
-			payload
-		}
-	};
-}
-function jwkFromRaw(rawKey) {
-	if (!isPlainObject(rawKey)) return null;
-	const kid = normalizeOptionalTrimmedString(rawKey.kid);
-	const kty = normalizeOptionalTrimmedString(rawKey.kty);
-	const use = normalizeOptionalTrimmedString(rawKey.use);
-	const alg = normalizeOptionalTrimmedString(rawKey.alg);
-	const n = normalizeOptionalTrimmedString(rawKey.n);
-	const e = normalizeOptionalTrimmedString(rawKey.e);
-	if (!kid || kty !== "RSA" || !n || !e) return null;
-	if (use !== "sig" || alg !== "RS256") return null;
-	return {
-		kid,
-		jwk: rawKey
-	};
-}
-async function fetchJwks(input) {
-	const now = Date.now();
-	const resp = await fetch(input.url);
-	const text = await resp.text();
-	if (!resp.ok) throw new Error(`${input.failureLabel} (HTTP ${resp.status}): ${text.slice(0, 200)}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(input.invalidJsonLabel);
-	}
-	if (!isPlainObject(json)) throw new Error(input.invalidShapeLabel);
-	const keysRaw = json.keys;
-	if (!Array.isArray(keysRaw)) throw new Error(input.missingKeysLabel);
-	const keysByKid = /* @__PURE__ */ new Map();
-	for (const rawKey of keysRaw) {
-		const key = jwkFromRaw(rawKey);
-		if (key) keysByKid.set(key.kid, key.jwk);
-	}
-	if (!keysByKid.size) throw new Error(input.noUsableKeysLabel);
-	return {
-		keysByKid,
-		expiresAtMs: now + (parseCacheControlMaxAgeSec(resp.headers.get("cache-control")) || 3600) * 1e3
-	};
-}
-async function getGoogleJwks(state) {
-	const now = Date.now();
-	if (state.cache && now < state.cache.expiresAtMs) return state.cache;
-	if (state.fetchPromise) return state.fetchPromise;
-	state.fetchPromise = fetchJwks({
-		url: "https://www.googleapis.com/oauth2/v3/certs",
-		failureLabel: "Google OIDC certs fetch failed",
-		missingKeysLabel: "Google OIDC certs missing \"keys\" array",
-		invalidJsonLabel: "Google OIDC certs returned non-JSON response",
-		invalidShapeLabel: "Google OIDC certs returned invalid JSON shape",
-		noUsableKeysLabel: "Google OIDC certs returned no usable RSA keys"
-	});
-	try {
-		state.cache = await state.fetchPromise;
-		return state.cache;
-	} finally {
-		state.fetchPromise = null;
-	}
-}
-async function verifyJwtSignature(input) {
-	let signatureBytes;
-	try {
-		signatureBytes = base64UrlDecode(input.parts.signatureB64u);
-	} catch {
-		return jwtError("invalid_body", `Invalid ${input.tokenName} signature encoding`);
-	}
-	const dataBytes = new TextEncoder().encode(`${input.parts.headerB64u}.${input.parts.payloadB64u}`);
-	const key = await crypto.subtle.importKey("jwk", input.jwk, {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	}, false, ["verify"]);
-	if (!await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return jwtError("invalid_signature", `Invalid ${input.tokenName} signature`);
-	return { ok: true };
-}
-function verifyGoogleTimeClaims(payload) {
-	const nowSec = Math.floor(Date.now() / 1e3);
-	const exp = Number(payload.exp);
-	if (!Number.isFinite(exp) || exp <= 0) return jwtError("invalid_claims", "Invalid Google id_token exp");
-	if (nowSec >= exp) return jwtError("expired", "Google id_token is expired");
-	const nbfRaw = payload.nbf;
-	if (nbfRaw !== void 0) {
-		const nbf = Number(nbfRaw);
-		if (!Number.isFinite(nbf)) return jwtError("invalid_claims", "Invalid Google id_token nbf");
-		if (nowSec < nbf) return jwtError("not_yet_valid", "Google id_token is not yet valid");
-	}
-	return { ok: true };
-}
-function parseGoogleEmailVerified(value) {
-	if (typeof value === "boolean") return value;
-	if (typeof value === "string") return value.trim().toLowerCase() === "true";
-	return null;
-}
-function buildGoogleLoginVerificationSuccess(input) {
-	const result = {
-		ok: true,
-		verified: true,
-		providerSubject: input.providerSubject,
-		sub: input.sub
-	};
-	if (input.email) result.email = input.email;
-	if (input.name) result.name = input.name;
-	if (input.givenName) result.given_name = input.givenName;
-	if (input.familyName) result.family_name = input.familyName;
-	if (input.emailVerified !== null) result.emailVerified = input.emailVerified;
-	if (input.hostedDomain) result.hostedDomain = input.hostedDomain;
-	return result;
-}
-async function resolveLinkedProviderUserId(input) {
-	let userId = input.providerSubject;
-	try {
-		const linked = await input.identityStore.getUserIdBySubject(input.providerSubject);
-		if (linked) userId = linked;
-		await input.identityStore.linkSubjectToUserId({
-			userId,
-			subject: input.providerSubject,
-			allowMoveIfSoleIdentity: false
-		});
-	} catch {}
-	return userId;
-}
-function buildGoogleLoginFacadeSuccess(input) {
-	const result = {
-		ok: true,
-		verified: true,
-		userId: input.userId,
-		providerSubject: input.verified.providerSubject,
-		sub: input.verified.sub
-	};
-	if (input.verified.email) result.email = input.verified.email;
-	if (input.verified.name) result.name = input.verified.name;
-	if (input.verified.given_name) result.given_name = input.verified.given_name;
-	if (input.verified.family_name) result.family_name = input.verified.family_name;
-	if (typeof input.verified.emailVerified === "boolean") result.emailVerified = input.verified.emailVerified;
-	if (input.verified.hostedDomain) result.hostedDomain = input.verified.hostedDomain;
-	return result;
-}
-async function verifyGoogleIdToken(input) {
-	if (!input.config?.clientIds?.length) return jwtError("not_configured", "Google OIDC is not configured on this server");
-	const idToken = normalizeOptionalTrimmedString(input.request.idToken ?? input.request.id_token);
-	if (!idToken) return jwtError("invalid_body", "id_token is required");
-	if (!requireWebCrypto()) return jwtError("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
-	const parts = parseJwtParts({
-		token: idToken,
-		tokenName: "id_token"
-	});
-	if (!parts.ok) return parts;
-	const kid = normalizeOptionalTrimmedString(parts.value.header.kid);
-	const alg = normalizeOptionalTrimmedString(parts.value.header.alg);
-	if (!kid) return jwtError("invalid_body", "id_token header.kid is required");
-	if (alg !== "RS256") return jwtError("invalid_body", "id_token header.alg must be RS256");
-	const jwk = (await getGoogleJwks(input.jwksState)).keysByKid.get(kid);
-	if (!jwk) return jwtError("unknown_kid", "Unknown Google key id (kid)");
-	const signature = await verifyJwtSignature({
-		jwk,
-		parts: parts.value,
-		tokenName: "Google id_token"
-	});
-	if (!signature.ok) return signature;
-	const iss = normalizeOptionalTrimmedString(parts.value.payload.iss);
-	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return jwtError("invalid_issuer", "Invalid Google id_token issuer");
-	const time = verifyGoogleTimeClaims(parts.value.payload);
-	if (!time.ok) return time;
-	const aud = parseJwtAud(parts.value.payload.aud);
-	if (!aud.length) return jwtError("invalid_claims", "Missing Google id_token aud");
-	const allowedAudSet = new Set(input.config.clientIds);
-	if (!aud.some((value) => allowedAudSet.has(value))) return jwtError("invalid_audience", "Google id_token audience mismatch");
-	const sub = normalizeOptionalTrimmedString(parts.value.payload.sub);
-	if (!sub) return jwtError("invalid_claims", "Missing Google id_token sub");
-	const hostedDomain = normalizeOptionalTrimmedString(parts.value.payload.hd);
-	if (input.config.hostedDomains?.length) {
-		const allowHd = new Set(input.config.hostedDomains.map((d) => d.toLowerCase()));
-		if (!hostedDomain || !allowHd.has(hostedDomain.toLowerCase())) return jwtError("invalid_hosted_domain", "Google hosted domain is not allowed");
-	}
-	const email = normalizeOptionalTrimmedString(parts.value.payload.email);
-	const name = normalizeOptionalTrimmedString(parts.value.payload.name);
-	const givenName = normalizeOptionalTrimmedString(parts.value.payload.given_name);
-	const familyName = normalizeOptionalTrimmedString(parts.value.payload.family_name);
-	const emailVerified = parseGoogleEmailVerified(parts.value.payload.email_verified);
-	return buildGoogleLoginVerificationSuccess({
-		providerSubject: `google:${sub}`,
-		sub,
-		email,
-		name,
-		givenName,
-		familyName,
-		emailVerified,
-		hostedDomain
-	});
-}
-async function verifyGoogleLoginWithIdentityStore(input) {
-	try {
-		const verified = await verifyGoogleIdToken({
-			request: input.request,
-			config: input.config,
-			jwksState: input.jwksState
-		});
-		if (!verified.ok) return verified;
-		return buildGoogleLoginFacadeSuccess({
-			verified,
-			userId: await resolveLinkedProviderUserId({
-				identityStore: input.identityStore,
-				providerSubject: verified.providerSubject
-			})
-		});
-	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Google OIDC verification failed"
-		};
-	}
-}
-//#endregion
-export { createGoogleJwksState, getGoogleJwks, verifyGoogleIdToken, verifyGoogleLoginWithIdentityStore };
-
-//# sourceMappingURL=oidcVerification.js.map

package/dist/esm/core/authService/registrationThresholdHelpers.js

@@ -1,30 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
-import "../../shared-ts/src/utils/validation.js";
-import { ActionType } from "../../shared-ts/src/near/actions.js";
-//#region src/core/authService/registrationThresholdHelpers.ts
-function buildFullAccessAddKeyAction(publicKey) {
-	return {
-		action_type: ActionType.AddKey,
-		public_key: publicKey,
-		access_key: JSON.stringify({
-			nonce: 0,
-			permission: { FullAccess: {} }
-		})
-	};
-}
-function normalizeBootstrapPublicKeys(args) {
-	const publicKey = ensureEd25519Prefix(normalizeOptionalTrimmedString(args.publicKey) || "");
-	if (!publicKey) throw new Error("Missing or invalid bootstrap operational public key");
-	const recoveryPublicKey = ensureEd25519Prefix(normalizeOptionalTrimmedString(args.recoveryPublicKey) || "");
-	if (recoveryPublicKey && recoveryPublicKey === publicKey) throw new Error("Bootstrap recovery public key must differ from the operational public key");
-	return {
-		publicKey,
-		...recoveryPublicKey ? { recoveryPublicKey } : {},
-		expectedPublicKeys: recoveryPublicKey ? [publicKey, recoveryPublicKey] : [publicKey]
-	};
-}
-//#endregion
-export { buildFullAccessAddKeyAction, normalizeBootstrapPublicKeys };
-
-//# sourceMappingURL=registrationThresholdHelpers.js.map

package/dist/esm/core/authService/runtime.js

@@ -1,45 +0,0 @@
-import { toPublicKeyStringFromSecretKey } from "../nearKeys.js";
-import { ensureSignerWasmRuntime } from "./wasm.js";
-//#region src/core/authService/runtime.ts
-function createInitialAuthServiceRuntimeState() {
-	return {
-		isInitialized: false,
-		relayerPublicKey: "",
-		signerWasmReady: false
-	};
-}
-async function ensureAuthServiceSignerWasmReady(input) {
-	const signerState = await ensureSignerWasmRuntime({
-		state: { signerWasmReady: input.state.signerWasmReady },
-		override: input.signerWasmOverride,
-		logger: input.logger
-	});
-	return {
-		...input.state,
-		signerWasmReady: signerState.signerWasmReady
-	};
-}
-async function ensureAuthServiceRuntimeReady(input) {
-	if (input.state.isInitialized) return input.state;
-	let relayerPublicKey = "";
-	try {
-		relayerPublicKey = toPublicKeyStringFromSecretKey(input.relayerPrivateKey);
-	} catch {
-		input.logger.warn("Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format");
-	}
-	return {
-		...await ensureAuthServiceSignerWasmReady({
-			state: {
-				...input.state,
-				relayerPublicKey
-			},
-			signerWasmOverride: input.signerWasmOverride,
-			logger: input.logger
-		}),
-		isInitialized: true
-	};
-}
-//#endregion
-export { createInitialAuthServiceRuntimeState, ensureAuthServiceRuntimeReady, ensureAuthServiceSignerWasmReady };
-
-//# sourceMappingURL=runtime.js.map

package/dist/esm/core/authService/storeRegistry.js

@@ -1,102 +0,0 @@
-import { createWalletStore } from "../WalletStore.js";
-import { createWebAuthnCredentialBindingStore } from "../WebAuthnCredentialBindingStore.js";
-import { createNearPublicKeyStore } from "../NearPublicKeyStore.js";
-import { createEmailOtpRateLimiter } from "./rateLimits.js";
-import { createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore } from "../EmailOtpStores.js";
-import { createIdentityStore } from "../IdentityStore.js";
-import { createWalletAuthMethodStore } from "../WalletAuthMethodStore.js";
-import { createWebAuthnAuthenticatorStore } from "../WebAuthnAuthenticatorStore.js";
-import { createWebAuthnLoginChallengeStore } from "../WebAuthnLoginChallengeStore.js";
-import { createWebAuthnSyncChallengeStore } from "../WebAuthnSyncChallengeStore.js";
-//#region src/core/authService/storeRegistry.ts
-function createStoreFactoryInput(input) {
-	return {
-		config: input.config.thresholdStore || null,
-		logger: input.logger,
-		isNode: input.isNode()
-	};
-}
-var AuthServiceStoreRegistry = class {
-	constructor(input) {
-		this.input = input;
-		this.webAuthnAuthenticatorStore = null;
-		this.webAuthnLoginChallengeStore = null;
-		this.webAuthnCredentialBindingStore = null;
-		this.webAuthnSyncChallengeStore = null;
-		this.emailOtpChallengeStore = null;
-		this.emailOtpGrantStore = null;
-		this.emailOtpWalletEnrollmentStore = null;
-		this.emailOtpAuthStateStore = null;
-		this.emailOtpUnlockChallengeStore = null;
-		this.emailOtpRegistrationAttemptStore = null;
-		this.emailOtpRateLimiter = null;
-		this.nearPublicKeyStore = null;
-		this.identityStore = null;
-		this.walletStore = null;
-		this.walletAuthMethodStore = null;
-	}
-	getWebAuthnAuthenticatorStore() {
-		this.webAuthnAuthenticatorStore ??= createWebAuthnAuthenticatorStore(createStoreFactoryInput(this.input));
-		return this.webAuthnAuthenticatorStore;
-	}
-	getWebAuthnLoginChallengeStore() {
-		this.webAuthnLoginChallengeStore ??= createWebAuthnLoginChallengeStore(createStoreFactoryInput(this.input));
-		return this.webAuthnLoginChallengeStore;
-	}
-	getWebAuthnCredentialBindingStore() {
-		this.webAuthnCredentialBindingStore ??= createWebAuthnCredentialBindingStore(createStoreFactoryInput(this.input));
-		return this.webAuthnCredentialBindingStore;
-	}
-	getWebAuthnSyncChallengeStore() {
-		this.webAuthnSyncChallengeStore ??= createWebAuthnSyncChallengeStore(createStoreFactoryInput(this.input));
-		return this.webAuthnSyncChallengeStore;
-	}
-	getWalletStore() {
-		this.walletStore ??= createWalletStore(createStoreFactoryInput(this.input));
-		return this.walletStore;
-	}
-	getWalletAuthMethodStore() {
-		this.walletAuthMethodStore ??= createWalletAuthMethodStore(createStoreFactoryInput(this.input));
-		return this.walletAuthMethodStore;
-	}
-	getEmailOtpChallengeStore() {
-		this.emailOtpChallengeStore ??= createEmailOtpChallengeStore(createStoreFactoryInput(this.input));
-		return this.emailOtpChallengeStore;
-	}
-	getEmailOtpGrantStore() {
-		this.emailOtpGrantStore ??= createEmailOtpGrantStore(createStoreFactoryInput(this.input));
-		return this.emailOtpGrantStore;
-	}
-	getEmailOtpWalletEnrollmentStore() {
-		this.emailOtpWalletEnrollmentStore ??= createEmailOtpWalletEnrollmentStore(createStoreFactoryInput(this.input));
-		return this.emailOtpWalletEnrollmentStore;
-	}
-	getEmailOtpAuthStateStore() {
-		this.emailOtpAuthStateStore ??= createEmailOtpAuthStateStore(createStoreFactoryInput(this.input));
-		return this.emailOtpAuthStateStore;
-	}
-	getEmailOtpUnlockChallengeStore() {
-		this.emailOtpUnlockChallengeStore ??= createEmailOtpUnlockChallengeStore(createStoreFactoryInput(this.input));
-		return this.emailOtpUnlockChallengeStore;
-	}
-	getEmailOtpRegistrationAttemptStore() {
-		this.emailOtpRegistrationAttemptStore ??= createEmailOtpRegistrationAttemptStore(createStoreFactoryInput(this.input));
-		return this.emailOtpRegistrationAttemptStore;
-	}
-	getEmailOtpRateLimiter() {
-		this.emailOtpRateLimiter ??= createEmailOtpRateLimiter({ thresholdStore: this.input.config.thresholdStore });
-		return this.emailOtpRateLimiter;
-	}
-	getIdentityStore() {
-		this.identityStore ??= createIdentityStore(createStoreFactoryInput(this.input));
-		return this.identityStore;
-	}
-	getNearPublicKeyStore() {
-		this.nearPublicKeyStore ??= createNearPublicKeyStore(createStoreFactoryInput(this.input));
-		return this.nearPublicKeyStore;
-	}
-};
-//#endregion
-export { AuthServiceStoreRegistry };
-
-//# sourceMappingURL=storeRegistry.js.map

package/dist/esm/core/authService/thresholdStoreSummary.js

@@ -1,32 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { coerceThresholdNodeRole } from "../ThresholdService/config.js";
-//#region src/core/authService/thresholdStoreSummary.ts
-function thresholdStoreKind(cfg) {
-	if ("kind" in cfg) switch (cfg.kind) {
-		case "upstash-redis-rest": return "upstash";
-		case "redis-tcp": return "redis";
-		case "cloudflare-do": return "cloudflare-do";
-		case "in-memory": return "in-memory";
-	}
-	const upstashUrl = normalizeOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_TOKEN);
-	const redisUrl = normalizeOptionalTrimmedString(cfg.REDIS_URL);
-	if (upstashUrl || upstashToken) return "upstash";
-	if (redisUrl) return "redis";
-	return "in-memory";
-}
-function summarizeThresholdStoreConfig(cfg) {
-	if (!cfg) return "thresholdStore: not configured";
-	const nodeRole = coerceThresholdNodeRole(cfg.THRESHOLD_NODE_ROLE);
-	const store = thresholdStoreKind(cfg);
-	return [
-		`thresholdStore: configured`,
-		`nodeRole=${nodeRole}`,
-		`store=${store}`
-	].join(" ");
-}
-//#endregion
-export { summarizeThresholdStoreConfig };
-
-//# sourceMappingURL=thresholdStoreSummary.js.map

package/dist/esm/core/authService/webauthnAuthority.js

@@ -1,17 +0,0 @@
-import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
-//#region src/core/authService/webauthnAuthority.ts
-function requireWebAuthnRpId(value, fieldName) {
-	const parsed = parseWebAuthnRpId(value);
-	if (!parsed.ok) throw new Error(`${fieldName}: ${parsed.error.message}`);
-	return parsed.value;
-}
-function passkeyThresholdEd25519AuthorityScope(rpId) {
-	return {
-		kind: "passkey_rp",
-		rpId
-	};
-}
-//#endregion
-export { passkeyThresholdEd25519AuthorityScope, requireWebAuthnRpId };
-
-//# sourceMappingURL=webauthnAuthority.js.map

package/dist/esm/core/defaultConfigsServer.js

@@ -1,9 +0,0 @@
-//#region src/core/defaultConfigsServer.ts
-const THRESHOLD_NODE_ROLE_COORDINATOR = "coordinator";
-const THRESHOLD_NODE_ROLE_DEFAULT = THRESHOLD_NODE_ROLE_COORDINATOR;
-const THRESHOLD_DO_OBJECT_NAME_DEFAULT = "threshold-store";
-const THRESHOLD_PREFIX_DEFAULT = "w3a";
-//#endregion
-export { THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT };
-
-//# sourceMappingURL=defaultConfigsServer.js.map