@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/EmailOtpRecords.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, isWalletEmailOtpLoginOperation } from "../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/core/EmailOtpRecords.ts
 /** Parses JSON text; any other value, and text that is not JSON, comes back unchanged. */
@@ -21,48 +20,6 @@ function toNonNegativeSafeInt(value) {
 	if (!Number.isSafeInteger(parsed) || parsed < 0) return null;
 	return parsed;
 }
-function parseRuntimePolicyScope(raw) {
-	const parsed = parseJsonRecord(raw);
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
-	const obj = parsed;
-	const orgId = normalizeOptionalTrimmedString(obj.orgId);
-	const projectId = normalizeOptionalTrimmedString(obj.projectId);
-	const envId = normalizeOptionalTrimmedString(obj.envId);
-	const signingRootVersion = normalizeOptionalTrimmedString(obj.signingRootVersion);
-	if (!orgId || !projectId || !envId || !signingRootVersion) return void 0;
-	return {
-		orgId,
-		projectId,
-		envId,
-		signingRootVersion
-	};
-}
-function hasOwnRecordField(record, field) {
-	return Object.prototype.hasOwnProperty.call(record, field);
-}
-function isB64uString(value) {
-	return /^[A-Za-z0-9_-]+$/.test(value);
-}
-function parseGoogleEmailOtpRegistrationOfferCandidates(raw) {
-	if (!Array.isArray(raw) || raw.length < 1) return null;
-	const candidates = [];
-	for (const candidate of raw) {
-		if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) return null;
-		const candidateRecord = candidate;
-		const candidateId = normalizeOptionalTrimmedString(candidateRecord.candidateId);
-		const candidateWalletId = normalizeOptionalTrimmedString(candidateRecord.walletId);
-		const candidateCollisionCounter = toNonNegativeSafeInt(candidateRecord.collisionCounter);
-		if (!candidateId || !candidateWalletId || candidateCollisionCounter == null) return null;
-		candidates.push({
-			candidateId,
-			walletId: candidateWalletId,
-			collisionCounter: candidateCollisionCounter
-		});
-	}
-	const [firstCandidate, ...remainingCandidates] = candidates;
-	if (!firstCandidate) return null;
-	return [firstCandidate, ...remainingCandidates];
-}
 function parseCurrentEmailOtpChallengeRecord(raw) {
 	const parsed = parseJsonRecord(raw);
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
@@ -85,9 +42,8 @@ function parseCurrentEmailOtpChallengeRecord(raw) {
 	if (version !== "email_otp_challenge_v1") return null;
 	if (!challengeId || !challengeSubjectId || !walletId || !email || !otpCode || !ownerProofBindingDigest || !action || !operationRaw || !createdAtMs || !expiresAtMs || attemptCount == null || !maxAttempts) return null;
 	if (otpChannel !== "email_otp") return null;
-	if (action !== WALLET_EMAIL_OTP_ACTIONS.login && action !== WALLET_EMAIL_OTP_ACTIONS.registration && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap && action !== WALLET_EMAIL_OTP_ACTIONS.deviceLink) return null;
-	const operation = isWalletEmailOtpLoginOperation(operationRaw) || operationRaw === "registration" || operationRaw === "wallet_unlock" || operationRaw === "device_link" ? operationRaw : null;
-	if (!operation) return null;
+	const purpose = parseEmailOtpChallengePurpose(action, operationRaw);
+	if (!purpose) return null;
 	return {
 		version: "email_otp_challenge_v1",
 		challengeId,
@@ -98,14 +54,38 @@ function parseCurrentEmailOtpChallengeRecord(raw) {
 		email,
 		otpCode,
 		ownerProofBindingDigest,
-		action,
-		operation,
+		...purpose,
 		createdAtMs,
 		expiresAtMs,
 		attemptCount,
 		maxAttempts
 	};
 }
+function parseEmailOtpChallengePurpose(action, operation) {
+	switch (action) {
+		case WALLET_EMAIL_OTP_ACTIONS.login: return typeof operation === "string" && isWalletEmailOtpLoginOperation(operation) ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.registration: return operation === "registration" ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap: return operation === "wallet_unlock" ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return operation === "device_link" ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.relocation: return operation === "wallet_relocation" ? {
+			action,
+			operation
+		} : null;
+		default: return null;
+	}
+}
 function parseCurrentEmailOtpChallengeRow(input) {
 	const record = parseCurrentEmailOtpChallengeRecord(input.recordJson);
 	const expiresAtMs = toPositiveSafeInt(input.expiresAtMs);
@@ -183,96 +163,6 @@ function parseCurrentEmailOtpUnlockChallengeRow(input) {
 	if (record.expiresAtMs !== expiresAtMs) return null;
 	return record;
 }
-function parseCurrentGoogleEmailOtpRegistrationAttemptRecord(raw) {
-	const parsed = parseJsonRecord(raw);
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const obj = parsed;
-	const version = normalizeOptionalTrimmedString(obj.version);
-	const attemptId = normalizeOptionalTrimmedString(obj.attemptId);
-	const providerSubject = normalizeOptionalTrimmedString(obj.providerSubject);
-	const email = normalizeOptionalTrimmedString(obj.email);
-	const walletId = normalizeOptionalTrimmedString(obj.walletId);
-	const offerId = normalizeOptionalTrimmedString(obj.offerId);
-	const offerCandidates = parseGoogleEmailOtpRegistrationOfferCandidates(obj.offerCandidates);
-	const selectedCandidateId = normalizeOptionalTrimmedString(obj.selectedCandidateId);
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(obj.ownerProofBindingDigest);
-	const authProvider = normalizeOptionalTrimmedString(obj.authProvider);
-	const accountIdSlugVersion = normalizeOptionalTrimmedString(obj.accountIdSlugVersion);
-	const walletIdDerivationNonce = normalizeOptionalTrimmedString(obj.walletIdDerivationNonce);
-	const collisionCounter = toNonNegativeSafeInt(obj.collisionCounter);
-	const state = normalizeOptionalTrimmedString(obj.state);
-	const createdAtMs = toPositiveSafeInt(obj.createdAtMs);
-	const updatedAtMs = toPositiveSafeInt(obj.updatedAtMs);
-	const expiresAtMs = toPositiveSafeInt(obj.expiresAtMs);
-	const runtimePolicyScope = parseRuntimePolicyScope(obj.runtimePolicyScope);
-	const finalizedPublicKey = normalizeOptionalTrimmedString(obj.finalizedPublicKey) || void 0;
-	const failureCode = normalizeOptionalTrimmedString(obj.failureCode) || void 0;
-	if (version !== "google_email_otp_registration_attempt_v1" || !attemptId || !providerSubject || !email || !walletId || !offerId || !offerCandidates || !selectedCandidateId || !offerCandidates.some((candidate) => candidate.candidateId === selectedCandidateId) || !ownerProofBindingDigest || !authProvider || accountIdSlugVersion !== "hmac_readable_v1" || !walletIdDerivationNonce || !isB64uString(walletIdDerivationNonce) || collisionCounter == null || !state || !createdAtMs || !updatedAtMs || !expiresAtMs) return null;
-	if (state !== "started" && state !== "key_finalized" && state !== "active" && state !== "abandoned" && state !== "failed" && state !== "expired") return null;
-	if (updatedAtMs < createdAtMs) return null;
-	if (state === "key_finalized" && !finalizedPublicKey) return null;
-	if ((state === "abandoned" || state === "failed") && !failureCode) return null;
-	const base = {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId,
-		providerSubject,
-		email,
-		walletId,
-		offerId,
-		offerCandidates,
-		selectedCandidateId,
-		ownerProofBindingDigest,
-		authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce,
-		collisionCounter,
-		createdAtMs,
-		updatedAtMs,
-		expiresAtMs,
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-	switch (state) {
-		case "started": return {
-			...base,
-			state
-		};
-		case "key_finalized":
-			if (!finalizedPublicKey) return null;
-			return {
-				...base,
-				state,
-				finalizedPublicKey
-			};
-		case "active": return {
-			...base,
-			state,
-			...finalizedPublicKey ? { finalizedPublicKey } : {}
-		};
-		case "abandoned":
-		case "failed":
-			if (!failureCode) return null;
-			return {
-				...base,
-				state,
-				...finalizedPublicKey ? { finalizedPublicKey } : {},
-				failureCode
-			};
-		case "expired": return {
-			...base,
-			state,
-			...finalizedPublicKey ? { finalizedPublicKey } : {},
-			...failureCode ? { failureCode } : {}
-		};
-	}
-}
-function parseCurrentGoogleEmailOtpRegistrationAttemptRow(input) {
-	const record = parseCurrentGoogleEmailOtpRegistrationAttemptRecord(input.recordJson);
-	const expiresAtMs = toPositiveSafeInt(input.expiresAtMs);
-	const updatedAtMs = toPositiveSafeInt(input.updatedAtMs);
-	if (!record || !expiresAtMs || !updatedAtMs) return null;
-	if (record.expiresAtMs !== expiresAtMs || record.updatedAtMs !== updatedAtMs) return null;
-	return record;
-}
 /** The scope as one comparable string, as D1 stores it in `runtime_policy_key`; empty when unset. */
 function runtimePolicyScopeKey(scope) {
 	if (!scope) return "";
@@ -290,90 +180,7 @@ function registrationAttemptMatchesStartedScope(record, input) {
 function registrationAttemptMatchesReplacementScope(record, input) {
 	return record.ownerProofBindingDigest !== input.ownerProofBindingDigest && isLivePendingAttemptInScope(record, input);
 }
-function parseCurrentEmailOtpWalletEnrollmentRecord(raw) {
-	const parsed = parseJsonRecord(raw);
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const obj = parsed;
-	if (hasOwnRecordField(obj, "enrollmentEscrowCiphertextB64u")) return null;
-	const version = normalizeOptionalTrimmedString(obj.version);
-	const walletId = normalizeOptionalTrimmedString(obj.walletId);
-	const providerUserId = normalizeOptionalTrimmedString(obj.providerUserId);
-	const orgId = normalizeOptionalTrimmedString(obj.orgId);
-	const verifiedEmail = normalizeOptionalTrimmedString(obj.verifiedEmail)?.toLowerCase() || "";
-	const enrollmentId = normalizeOptionalTrimmedString(obj.enrollmentId);
-	const enrollmentVersion = normalizeOptionalTrimmedString(obj.enrollmentVersion);
-	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(obj.enrollmentSealKeyVersion);
-	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(obj.serverSealedFactorCiphertextB64u);
-	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(obj.clientUnlockPublicKeyB64u);
-	const unlockKeyVersion = normalizeOptionalTrimmedString(obj.unlockKeyVersion);
-	const createdAtMs = toPositiveSafeInt(obj.createdAtMs);
-	const updatedAtMs = toPositiveSafeInt(obj.updatedAtMs);
-	if (version !== "email_otp_wallet_enrollment_v1" || !walletId || !providerUserId || !orgId || !verifiedEmail || !enrollmentId || !enrollmentVersion || !enrollmentSealKeyVersion || !serverSealedFactorCiphertextB64u || !clientUnlockPublicKeyB64u || !unlockKeyVersion || !createdAtMs || !updatedAtMs) return null;
-	if (updatedAtMs < createdAtMs) return null;
-	return {
-		version: "email_otp_wallet_enrollment_v1",
-		walletId,
-		providerUserId,
-		orgId,
-		verifiedEmail,
-		enrollmentId,
-		enrollmentVersion,
-		enrollmentSealKeyVersion,
-		serverSealedFactorCiphertextB64u,
-		clientUnlockPublicKeyB64u,
-		unlockKeyVersion,
-		createdAtMs,
-		updatedAtMs
-	};
-}
-function parseCurrentEmailOtpWalletEnrollmentRow(input) {
-	const record = parseCurrentEmailOtpWalletEnrollmentRecord(input.recordJson);
-	const updatedAtMs = toPositiveSafeInt(input.updatedAtMs);
-	if (!record || !updatedAtMs) return null;
-	if (record.updatedAtMs !== updatedAtMs) return null;
-	return record;
-}
-function parseCurrentEmailOtpAuthStateRecord(raw) {
-	const parsed = parseJsonRecord(raw);
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const obj = parsed;
-	const version = normalizeOptionalTrimmedString(obj.version);
-	const walletId = normalizeOptionalTrimmedString(obj.walletId);
-	const providerUserId = normalizeOptionalTrimmedString(obj.providerUserId);
-	const orgId = normalizeOptionalTrimmedString(obj.orgId);
-	const createdAtMs = toPositiveSafeInt(obj.createdAtMs);
-	const updatedAtMs = toPositiveSafeInt(obj.updatedAtMs);
-	const otpFailureCount = obj.otpFailureCount == null ? void 0 : toNonNegativeSafeInt(obj.otpFailureCount);
-	const lastOtpFailureAtMs = obj.lastOtpFailureAtMs == null ? void 0 : toPositiveSafeInt(obj.lastOtpFailureAtMs);
-	const otpLockedUntilMs = obj.otpLockedUntilMs == null ? void 0 : toPositiveSafeInt(obj.otpLockedUntilMs);
-	const lastEmailOtpLoginAtMs = obj.lastEmailOtpLoginAtMs == null ? void 0 : toPositiveSafeInt(obj.lastEmailOtpLoginAtMs);
-	const lastStrongAuthAtMs = obj.lastStrongAuthAtMs == null ? void 0 : toPositiveSafeInt(obj.lastStrongAuthAtMs);
-	if (!raw || version !== "email_otp_auth_state_v1") return null;
-	if (!walletId || !providerUserId || !orgId || !createdAtMs || !updatedAtMs) return null;
-	if ("otpFailureCount" in obj && obj.otpFailureCount != null && otpFailureCount === void 0 || "lastOtpFailureAtMs" in obj && obj.lastOtpFailureAtMs != null && lastOtpFailureAtMs === void 0 || "otpLockedUntilMs" in obj && obj.otpLockedUntilMs != null && otpLockedUntilMs === void 0 || "lastEmailOtpLoginAtMs" in obj && obj.lastEmailOtpLoginAtMs != null && lastEmailOtpLoginAtMs === void 0 || "lastStrongAuthAtMs" in obj && obj.lastStrongAuthAtMs != null && lastStrongAuthAtMs === void 0) return null;
-	if (updatedAtMs < createdAtMs) return null;
-	return {
-		version: "email_otp_auth_state_v1",
-		walletId,
-		providerUserId,
-		orgId,
-		createdAtMs,
-		updatedAtMs,
-		...otpFailureCount != null ? { otpFailureCount } : {},
-		...lastOtpFailureAtMs != null ? { lastOtpFailureAtMs } : {},
-		...otpLockedUntilMs != null ? { otpLockedUntilMs } : {},
-		...lastEmailOtpLoginAtMs != null ? { lastEmailOtpLoginAtMs } : {},
-		...lastStrongAuthAtMs != null ? { lastStrongAuthAtMs } : {}
-	};
-}
-function parseCurrentEmailOtpAuthStateRow(input) {
-	const record = parseCurrentEmailOtpAuthStateRecord(input.recordJson);
-	const updatedAtMs = toPositiveSafeInt(input.updatedAtMs);
-	if (!record || !updatedAtMs) return null;
-	if (record.updatedAtMs !== updatedAtMs) return null;
-	return record;
-}
 //#endregion
-export { parseCurrentEmailOtpAuthStateRecord, parseCurrentEmailOtpAuthStateRow, parseCurrentEmailOtpChallengeRecord, parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRecord, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRecord, parseCurrentEmailOtpUnlockChallengeRow, parseCurrentEmailOtpWalletEnrollmentRecord, parseCurrentEmailOtpWalletEnrollmentRow, parseCurrentGoogleEmailOtpRegistrationAttemptRecord, parseCurrentGoogleEmailOtpRegistrationAttemptRow, parseJsonRecord, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope, runtimePolicyScopeKey };
+export { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope, runtimePolicyScopeKey };
 
 //# sourceMappingURL=EmailOtpRecords.js.map