@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/authService/emailOtpUnlock.js

@@ -1,174 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failedVerification, failure } from "../../shared-ts/src/utils/failure.js";
-import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../ThresholdService/evmCryptoWasm.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { parseBoundaryWalletId } from "./webauthnWalletBinding.js";
-//#region src/core/authService/emailOtpUnlock.ts
-function parsedUnlockWalletId(raw) {
-	const walletIdRaw = normalizeOptionalTrimmedString(raw);
-	if (!walletIdRaw) return null;
-	return parseBoundaryWalletId(walletIdRaw);
-}
-function requestedUnlockTtlMs(raw) {
-	const numeric = typeof raw === "number" ? raw : Number(raw);
-	if (!Number.isFinite(numeric) || numeric <= 0) return 5 * 6e4;
-	return Math.floor(numeric);
-}
-function clampedUnlockTtlMs(raw) {
-	return Math.min(Math.max(requestedUnlockTtlMs(raw), 1e4), 10 * 6e4);
-}
-function parseUnlockProof(raw) {
-	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
-	const record = raw;
-	const publicKey = normalizeOptionalTrimmedString(record.publicKey);
-	const signatureB64u = normalizeOptionalTrimmedString(record.signature);
-	if (!publicKey || !signatureB64u) return null;
-	return {
-		publicKey,
-		signatureB64u
-	};
-}
-function decodeBase64UrlField(input) {
-	if (!input.value) return {
-		ok: false,
-		message: input.missingMessage
-	};
-	try {
-		const bytes = base64UrlDecode(input.value);
-		if (bytes.length !== input.expectedLength) return {
-			ok: false,
-			message: input.expectedLengthMessage
-		};
-		return {
-			ok: true,
-			bytes
-		};
-	} catch {
-		return {
-			ok: false,
-			message: input.invalidMessage
-		};
-	}
-}
-function byteArraysEqual(a, b) {
-	if (a.length !== b.length) return false;
-	return a.every((value, index) => value === b[index]);
-}
-async function createEmailOtpUnlockChallenge(input) {
-	try {
-		const walletId = parsedUnlockWalletId(input.request.walletId);
-		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || void 0;
-		if (!normalizeOptionalTrimmedString(input.request.walletId)) return failure("invalid_body", "Missing walletId");
-		if (!walletId) return failure("invalid_body", "Invalid walletId");
-		const activeEnrollment = await input.readActiveEnrollment({
-			walletId,
-			orgId
-		});
-		if (!activeEnrollment.ok) return activeEnrollment;
-		const enrollment = activeEnrollment.enrollment;
-		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
-		const createdAtMs = Date.now();
-		const expiresAtMs = createdAtMs + clampedUnlockTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
-		const challengeId = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
-		const challengeB64u = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
-		await input.unlockChallengeStore.put({
-			version: "email_otp_unlock_challenge_v1",
-			challengeId,
-			walletId: enrollment.walletId,
-			userId: enrollment.providerUserId,
-			orgId: enrollment.orgId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		});
-		return {
-			ok: true,
-			walletId: enrollment.walletId,
-			challengeId,
-			challengeB64u,
-			expiresAtMs,
-			unlockKeyVersion: enrollment.unlockKeyVersion
-		};
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to create Email OTP unlock challenge");
-	}
-}
-async function verifyEmailOtpUnlockProof(input) {
-	try {
-		const walletId = parsedUnlockWalletId(input.request.walletId);
-		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || void 0;
-		const challengeId = normalizeOptionalTrimmedString(input.request.challengeId);
-		if (!normalizeOptionalTrimmedString(input.request.walletId)) return failedVerification("invalid_body", "Missing walletId");
-		if (!walletId) return failedVerification("invalid_body", "Invalid walletId");
-		if (!challengeId) return failedVerification("invalid_body", "Missing challengeId");
-		const unlockProof = parseUnlockProof(input.request.unlockProof);
-		if (!unlockProof) return failedVerification("invalid_body", "unlockProof is required");
-		const challengeRecord = await input.unlockChallengeStore.consume(challengeId);
-		if (!challengeRecord || Date.now() > challengeRecord.expiresAtMs) return failedVerification("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
-		if (challengeRecord.walletId !== walletId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
-		const activeEnrollment = await input.readActiveEnrollment({
-			walletId,
-			orgId
-		});
-		if (!activeEnrollment.ok) return failedVerification(activeEnrollment.code, activeEnrollment.message);
-		const enrollment = activeEnrollment.enrollment;
-		if (challengeRecord.userId !== enrollment.providerUserId || challengeRecord.orgId !== enrollment.orgId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
-		const publicKeyDecode = decodeBase64UrlField({
-			value: unlockProof.publicKey,
-			missingMessage: "unlockProof.publicKey is required",
-			invalidMessage: "unlockProof.publicKey must be valid base64url",
-			expectedLength: 33,
-			expectedLengthMessage: "unlockProof.publicKey must decode to 33 bytes"
-		});
-		if (!publicKeyDecode.ok) return failedVerification("invalid_body", publicKeyDecode.message);
-		try {
-			await validateSecp256k1PublicKey33(publicKeyDecode.bytes);
-		} catch {
-			return failedVerification("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
-		}
-		const signatureDecode = decodeBase64UrlField({
-			value: unlockProof.signatureB64u,
-			missingMessage: "unlockProof.signature is required",
-			invalidMessage: "unlockProof.signature must be valid base64url",
-			expectedLength: 65,
-			expectedLengthMessage: "unlockProof.signature must decode to 65 bytes"
-		});
-		if (!signatureDecode.ok) return failedVerification("invalid_body", signatureDecode.message);
-		if (!byteArraysEqual(base64UrlDecode(enrollment.clientUnlockPublicKeyB64u), publicKeyDecode.bytes)) return failedVerification("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
-		const challengeDigestDecode = decodeBase64UrlField({
-			value: challengeRecord.challengeB64u,
-			missingMessage: "Stored unlock challenge digest was invalid",
-			invalidMessage: "Stored unlock challenge digest was invalid",
-			expectedLength: 32,
-			expectedLengthMessage: "Stored unlock challenge digest must decode to 32 bytes"
-		});
-		if (!challengeDigestDecode.ok) return failedVerification("internal", challengeDigestDecode.message);
-		try {
-			await verifySecp256k1RecoverableSignatureAgainstPublicKey33(challengeDigestDecode.bytes, signatureDecode.bytes, publicKeyDecode.bytes);
-		} catch {
-			return failedVerification("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
-		}
-		const nowMs = Date.now();
-		await input.putAuthStateForEnrollment(enrollment, { lastEmailOtpLoginAtMs: nowMs });
-		return {
-			ok: true,
-			verified: true,
-			userId: enrollment.walletId,
-			walletId: enrollment.walletId,
-			providerUserId: enrollment.providerUserId,
-			orgId: enrollment.orgId,
-			enrollmentId: enrollment.enrollmentId,
-			enrollmentSealKeyVersion: enrollment.enrollmentSealKeyVersion,
-			unlockKeyVersion: enrollment.unlockKeyVersion
-		};
-	} catch (e) {
-		return failedVerification("internal", errorMessage(e) || "Failed to verify Email OTP unlock proof");
-	}
-}
-//#endregion
-export { createEmailOtpUnlockChallenge, verifyEmailOtpUnlockProof };
-
-//# sourceMappingURL=emailOtpUnlock.js.map

package/dist/esm/core/authService/googleEmailOtpOperations.js

@@ -1,141 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { deriveHostedNearAccountId, isHostedHmacReadableRelayerWalletId } from "../hostedAccountIds.js";
-import { parseBoundaryWalletId } from "./webauthnWalletBinding.js";
-import { cleanupGoogleEmailOtpDevRegistrationStateWithStores, completeGoogleEmailOtpRegistrationAttemptWithStore, consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps, failGoogleEmailOtpRegistrationAttemptWithStore, recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore, resolveGoogleEmailOtpSessionWithDeps, validateGoogleEmailOtpRegistrationCandidateWalletWithStore } from "./googleEmailOtpRegistration.js";
-//#region src/core/authService/googleEmailOtpOperations.ts
-function hostedAccountScope(input) {
-	const orgId = normalizeOptionalTrimmedString(input?.orgId);
-	const projectId = normalizeOptionalTrimmedString(input?.projectId);
-	const envId = normalizeOptionalTrimmedString(input?.envId);
-	if (orgId && projectId && envId) return {
-		projectId,
-		envId
-	};
-	throw new Error("runtimePolicyScope.orgId, runtimePolicyScope.projectId, and runtimePolicyScope.envId are required for hosted wallet id derivation");
-}
-function isHostedHmacReadableWalletId(input) {
-	return isHostedHmacReadableRelayerWalletId({
-		walletId: input.walletId,
-		relayerAccount: input.config.relayerAccount
-	});
-}
-async function deriveHostedOidcWalletId(input) {
-	const subject = normalizeOptionalTrimmedString(input.providerSubject ?? input.sub);
-	const email = normalizeOptionalTrimmedString(input.email);
-	const walletIdDerivationNonce = normalizeOptionalTrimmedString(input.walletIdDerivationNonce);
-	if (!subject && !email) throw new Error("Cannot derive hosted wallet id without provider subject or verified email");
-	const scope = hostedAccountScope(input.runtimePolicyScope);
-	return deriveHostedNearAccountId({
-		accountIdDerivationSecret: input.env.readConfigValue("ACCOUNT_ID_DERIVATION_SECRET"),
-		relayerAccount: input.env.config.relayerAccount,
-		projectId: scope.projectId,
-		envId: scope.envId,
-		authProvider: input.authProvider,
-		...subject ? { providerSubject: subject } : {},
-		...email ? { verifiedEmail: email } : {},
-		...walletIdDerivationNonce ? { walletIdDerivationNonce } : {},
-		...input.collisionCounter ? { collisionCounter: input.collisionCounter } : {}
-	});
-}
-async function resolveOidcWalletIdWithGoogleEmailOtp(input) {
-	const providerSubject = normalizeOptionalTrimmedString(input.request.providerSubject ?? input.request.sub);
-	if (!providerSubject) throw new Error("Cannot resolve OIDC wallet id without provider subject");
-	if (providerSubject.startsWith("google:")) {
-		const resolution = await resolveGoogleEmailOtpSessionForAuthService(input);
-		if (resolution.ok) return resolution.walletId;
-		const error = new Error(resolution.message);
-		error.code = resolution.code;
-		throw error;
-	}
-	const wallet = `wallet:${providerSubject}`;
-	const linkedWalletId = parseBoundaryWalletId(await input.deps.identityStore.getUserIdBySubject(wallet));
-	if (linkedWalletId) return linkedWalletId;
-	return await deriveHostedOidcWalletId({
-		env: input.deps,
-		providerSubject,
-		sub: input.request.sub,
-		email: input.request.email,
-		authProvider: "oidc",
-		...input.request.runtimePolicyScope ? { runtimePolicyScope: input.request.runtimePolicyScope } : {}
-	});
-}
-async function consumeGoogleEmailOtpRegistrationAttemptRateLimitForAuthService(input) {
-	return await consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps({
-		request: input.request,
-		consumeRateLimit: input.deps.consumeRateLimit
-	});
-}
-async function resolveGoogleEmailOtpSessionForAuthService(input) {
-	return await resolveGoogleEmailOtpSessionWithDeps({
-		request: input.request,
-		identityStore: input.deps.identityStore,
-		registrationAttemptStore: input.deps.registrationAttemptStore,
-		walletEnrollmentStore: input.deps.walletEnrollmentStore,
-		deriveHostedWalletId: async (request) => await deriveHostedOidcWalletId({
-			env: input.deps,
-			...request
-		}),
-		isHostedHmacReadableWalletId: (walletId) => isHostedHmacReadableWalletId({
-			config: input.deps.config,
-			walletId
-		})
-	});
-}
-async function completeGoogleEmailOtpRegistrationAttemptForAuthService(input) {
-	return await completeGoogleEmailOtpRegistrationAttemptWithStore({
-		registrationAttemptStore: input.deps.registrationAttemptStore,
-		identityStore: input.deps.identityStore,
-		registrationAttemptId: input.request.registrationAttemptId,
-		walletId: input.request.walletId,
-		nowMs: Date.now()
-	});
-}
-async function validateGoogleEmailOtpRegistrationCandidateWalletForAuthService(input) {
-	return await validateGoogleEmailOtpRegistrationCandidateWalletWithStore({
-		registrationAttemptStore: input.deps.registrationAttemptStore,
-		registrationAttemptId: input.request.registrationAttemptId,
-		walletId: input.request.walletId,
-		ownerProofBindingDigest: input.request.ownerProofBindingDigest,
-		providerSubject: input.request.providerSubject,
-		nowMs: Date.now()
-	});
-}
-async function recordGoogleEmailOtpRegistrationAttemptPublicKeyForAuthService(input) {
-	return await recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore({
-		registrationAttemptStore: input.deps.registrationAttemptStore,
-		registrationAttemptId: input.request.registrationAttemptId,
-		walletId: input.request.walletId,
-		finalizedPublicKey: input.request.finalizedPublicKey,
-		nowMs: Date.now()
-	});
-}
-async function failGoogleEmailOtpRegistrationAttemptForAuthService(input) {
-	await failGoogleEmailOtpRegistrationAttemptWithStore({
-		registrationAttemptStore: input.deps.registrationAttemptStore,
-		registrationAttemptId: input.request.registrationAttemptId,
-		walletId: input.request.walletId,
-		failureCode: input.request.failureCode,
-		nowMs: Date.now()
-	});
-}
-async function cleanupGoogleEmailOtpDevRegistrationStateForAuthService(input) {
-	return await cleanupGoogleEmailOtpDevRegistrationStateWithStores({
-		registrationAttemptStore: input.deps.registrationAttemptStore,
-		identityStore: input.deps.identityStore,
-		walletEnrollmentStore: input.deps.walletEnrollmentStore,
-		isProductionEnvironment: input.deps.isProductionEnvironment,
-		isHostedHmacReadableWalletId: (walletId) => isHostedHmacReadableWalletId({
-			config: input.deps.config,
-			walletId
-		}),
-		providerSubject: input.request.providerSubject,
-		walletId: input.request.walletId,
-		orgId: input.request.orgId,
-		nowMs: input.request.nowMs
-	});
-}
-//#endregion
-export { cleanupGoogleEmailOtpDevRegistrationStateForAuthService, completeGoogleEmailOtpRegistrationAttemptForAuthService, consumeGoogleEmailOtpRegistrationAttemptRateLimitForAuthService, failGoogleEmailOtpRegistrationAttemptForAuthService, recordGoogleEmailOtpRegistrationAttemptPublicKeyForAuthService, resolveGoogleEmailOtpSessionForAuthService, resolveOidcWalletIdWithGoogleEmailOtp, validateGoogleEmailOtpRegistrationCandidateWalletForAuthService };
-
-//# sourceMappingURL=googleEmailOtpOperations.js.map