@seams/wallet-server 0.8.0 → 0.9.1

package/dist/esm/router/cloudflare/runtime/walletObjectAddresses.js

@@ -0,0 +1,105 @@
+import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+//#region src/router/cloudflare/runtime/walletObjectAddresses.ts
+const WALLET_OBJECT_IDENTITY_HEADER = "x-seams-wallet-object-identity";
+const WALLET_OBJECT_ADDRESSES_HEADER = "x-seams-wallet-object-addresses";
+/** Opaque addresses select custody objects. They confer no execution authority. */
+var WalletObjectAddresses = class WalletObjectAddresses {
+	constructor(values) {
+		this.values = values;
+	}
+	get router() {
+		return this.values.router;
+	}
+	get deriver_a() {
+		return this.values.deriver_a;
+	}
+	get deriver_b() {
+		return this.values.deriver_b;
+	}
+	get signing_worker() {
+		return this.values.signing_worker;
+	}
+	toJSON() {
+		return this.values;
+	}
+	static parse(raw) {
+		if (!isPlainObject(raw)) throw new Error("Wallet object addresses are missing");
+		return new WalletObjectAddresses({
+			router: parseObjectId(raw.router),
+			deriver_a: parseObjectId(raw.deriver_a),
+			deriver_b: parseObjectId(raw.deriver_b),
+			signing_worker: parseObjectId(raw.signing_worker)
+		});
+	}
+};
+/** A request-local read of immutable addresses for one wallet generation. */
+var WalletObjectAddressSnapshot = class WalletObjectAddressSnapshot {
+	constructor(namespace, identity, addresses) {
+		this.namespace = namespace;
+		this.identity = identity;
+		this.addresses = addresses;
+	}
+	static parse(raw, namespace, tenant) {
+		if (!isPlainObject(raw)) throw new Error("Wallet object address snapshot is missing");
+		return new WalletObjectAddressSnapshot(tenantPart(namespace), walletObjectIdentity(raw.wallet_id, raw.ownership_generation, tenant), WalletObjectAddresses.parse(raw));
+	}
+	resolve(namespace, identity) {
+		const observed = this.identity;
+		if (namespace !== this.namespace || identity.walletId !== observed.walletId || identity.ownershipGeneration !== observed.ownershipGeneration || identity.orgId !== observed.orgId || identity.projectId !== observed.projectId || identity.envId !== observed.envId) return null;
+		return this.addresses;
+	}
+};
+function walletObjectIdentity(wallet, generation, tenant) {
+	const parsed = parseWalletId(wallet);
+	if (!parsed.ok || typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 1) throw new Error("Wallet object identity requires a wallet and ownership generation");
+	return {
+		walletId: parsed.value,
+		ownershipGeneration: generation,
+		orgId: tenantPart(tenant.orgId),
+		projectId: tenantPart(tenant.projectId),
+		envId: tenantPart(tenant.envId)
+	};
+}
+function walletObjectIdentityHeaders(identity) {
+	return { [WALLET_OBJECT_IDENTITY_HEADER]: JSON.stringify(identity) };
+}
+function readWalletObjectIdentityHeader(headers) {
+	const raw = headers.get(WALLET_OBJECT_IDENTITY_HEADER);
+	if (raw === null) return null;
+	if (raw.length > 1024) throw new Error("Wallet object identity is too large");
+	const value = JSON.parse(raw);
+	if (!isPlainObject(value)) throw new Error("Wallet object identity is malformed");
+	return walletObjectIdentity(value.walletId, value.ownershipGeneration, {
+		orgId: value.orgId,
+		projectId: value.projectId,
+		envId: value.envId
+	});
+}
+function parseObjectId(raw) {
+	if (typeof raw !== "string" || !/^[a-f0-9]{64}$/u.test(raw)) throw new Error("Wallet object address must be a Durable Object ID");
+	return raw;
+}
+function tenantPart(value) {
+	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error("Wallet object tenant is invalid");
+	return value;
+}
+function walletObjectIdentityFromWireScope(scope, generation) {
+	if (!isPlainObject(scope)) throw new Error("Wallet object scope is missing");
+	return walletObjectIdentity(scope.wallet_id, generation, {
+		orgId: scope.org_id,
+		projectId: scope.project_id,
+		envId: scope.project_environment_id
+	});
+}
+function walletRelocationObjectIdentity(wallet, generation) {
+	return walletObjectIdentity(wallet.walletId, generation, {
+		orgId: wallet.organizationId,
+		projectId: wallet.projectId,
+		envId: wallet.environmentId
+	});
+}
+//#endregion
+export { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, WalletObjectAddressSnapshot, WalletObjectAddresses, readWalletObjectIdentityHeader, walletObjectIdentity, walletObjectIdentityFromWireScope, walletObjectIdentityHeaders, walletRelocationObjectIdentity };
+
+//# sourceMappingURL=walletObjectAddresses.js.map

package/dist/esm/router/cloudflare/runtime/walletPlacementRoutes.js

@@ -0,0 +1,339 @@
+import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_RELOCATION_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { readWalletRelocationOwner } from "../d1/wallet/d1WalletRelocationOwner.js";
+import { D1WalletRelocationChallenges } from "../d1/wallet/d1WalletRelocationChallenges.js";
+import { walletRelocationEmailOtpBinding } from "../d1/wallet/d1WalletRelocationEmailOtp.js";
+import { D1WalletRelocationApprovals } from "../d1/wallet/d1WalletRelocationApprovals.js";
+import { WalletRelocationOwnerRequest } from "../d1/wallet/d1WalletRelocationOwnerRequest.js";
+import { WalletRelocationReadAccess } from "../d1/wallet/d1WalletRelocationReadAccess.js";
+//#region src/router/cloudflare/runtime/walletPlacementRoutes.ts
+const BASE_PATH = "/wallet/placement/v1";
+var WalletPlacementRoutes = class {
+	constructor(options) {
+		this.options = options;
+		this.kind = "fetch_route_extension";
+		this.id = "wallet_placement";
+		this.routes = [
+			{
+				id: "wallet_relocation_challenge",
+				surface: "relay",
+				method: "POST",
+				path: `${BASE_PATH}/relocations/challenge`,
+				auth: {
+					plane: "public",
+					rationale: "The handler requires an authenticated full-owner Wallet Session."
+				},
+				metering: { kind: "none" },
+				summary: "Issue a fresh owner relocation challenge"
+			},
+			{
+				id: "wallet_relocation_post",
+				surface: "relay",
+				method: "POST",
+				path: `${BASE_PATH}/relocations`,
+				auth: {
+					plane: "public",
+					rationale: "The handler authenticates an owner or bounded move-read credential before exact replay."
+				},
+				metering: { kind: "none" },
+				summary: "Admit or replay an exact wallet relocation"
+			},
+			{
+				id: "wallet_placement_get",
+				surface: "relay",
+				method: "GET",
+				path: BASE_PATH,
+				auth: {
+					plane: "public",
+					rationale: "The handler authenticates the full-owner Wallet Session."
+				},
+				metering: { kind: "none" },
+				summary: "Read wallet placement"
+			},
+			{
+				id: "wallet_relocation_get",
+				surface: "relay",
+				method: "GET",
+				path: `${BASE_PATH}/relocations/:moveId`,
+				auth: {
+					plane: "public",
+					rationale: "The handler authenticates a full owner or bounded move-read credential."
+				},
+				metering: { kind: "none" },
+				summary: "Read wallet relocation progress"
+			}
+		];
+	}
+	async handleFetchRoute(input) {
+		return this.handle(input.request);
+	}
+	async handle(request) {
+		if (request.method === "POST" && new URL(request.url).pathname === `${BASE_PATH}/relocations/challenge`) return this.challenge(request);
+		if (request.method === "POST" && new URL(request.url).pathname === `${BASE_PATH}/relocations`) return this.relocate(request);
+		if (request.method !== "GET") return failure("method_not_allowed", 405);
+		const url = new URL(request.url);
+		const wallet = parseWalletId(url.searchParams.get("walletId"));
+		if (!wallet.ok || url.searchParams.getAll("walletId").length !== 1) return failure("invalid_input", 400);
+		let moveId;
+		if (url.pathname === BASE_PATH) moveId = null;
+		else {
+			const match = /^\/wallet\/placement\/v1\/relocations\/(wmove_[A-Za-z0-9_-]{43})$/u.exec(url.pathname);
+			if (!match) return failure("not_found", 404);
+			moveId = match[1];
+		}
+		const nowMs = Date.now();
+		if (!await WalletRelocationOwnerRequest.authenticate({
+			request,
+			walletId: wallet.value,
+			tenantId: this.options.tenantId,
+			scope: this.options.scope,
+			allowedOrigins: this.options.allowedOrigins,
+			authorizationSessions: this.options.authorizationSessions,
+			nowMs
+		})) {
+			if (!moveId) return failure("unauthorized", 401);
+			const approval = await new D1WalletRelocationApprovals(this.options.database, this.options.scope).find(wallet.value, moveId);
+			if (!approval) return failure("unauthorized", 401);
+			if (!await WalletRelocationReadAccess.authenticate({
+				request,
+				binding: approval.binding,
+				database: this.options.database,
+				scope: this.options.scope,
+				allowedOrigins: this.options.allowedOrigins,
+				nowMs
+			})) return failure("unauthorized", 401);
+		}
+		const walletKey = this.walletKey(wallet.value);
+		const path = moveId === null ? "placement-status" : "relocation-status";
+		const body = moveId === null ? { wallet: walletKey } : {
+			wallet: walletKey,
+			moveId
+		};
+		return this.dispatch(path, body);
+	}
+	async challenge(request) {
+		const intent = parseRelocationIntent(await request.json().catch(invalidBody), "challenge");
+		if (!intent || intent.kind !== "challenge") return failure("invalid_input", 400);
+		const nowMs = Date.now();
+		const owner = await WalletRelocationOwnerRequest.authenticate({
+			request,
+			walletId: intent.walletId,
+			tenantId: this.options.tenantId,
+			scope: this.options.scope,
+			allowedOrigins: this.options.allowedOrigins,
+			authorizationSessions: this.options.authorizationSessions,
+			nowMs
+		});
+		if (!owner) return failure("unauthorized", 401);
+		const resolved = await this.dispatch("relocation-request", {
+			wallet: this.walletKey(intent.walletId),
+			moveId: intent.moveId,
+			destinationRegion: intent.destinationRegion,
+			expectedGeneration: intent.expectedGeneration,
+			authorityId: owner.authorityId
+		});
+		if (!resolved.ok) return resolved;
+		const body = await resolved.clone().json().catch(invalidBody);
+		if (!isPlainObject(body)) return failure("invalid_directory_response", 502);
+		if (body.kind === "unchanged") return resolved;
+		if (body.kind !== "resolved" || typeof body.requestDigest !== "string" || !/^[a-f0-9]{64}$/u.test(body.requestDigest) || body.sourceGeneration !== intent.expectedGeneration || body.destinationRegion !== intent.destinationRegion) return failure("invalid_directory_response", 502);
+		const binding = owner.bindMove({
+			moveId: intent.moveId,
+			requestDigestHex: body.requestDigest,
+			sourceGeneration: intent.expectedGeneration,
+			destinationRegion: intent.destinationRegion
+		});
+		const activeOwner = await readWalletRelocationOwner(this.options.database, this.options.scope, binding);
+		if (!activeOwner) return failure("unauthorized", 401);
+		const factorExpiresAtMs = activeOwner.method.kind === "email_otp" ? this.options.emailOtp.issuer.challengeExpiresAt(nowMs) : owner.credentialExpiresAtMs;
+		const challenge = await new D1WalletRelocationChallenges(this.options.database, this.options.scope).issue(binding, nowMs, factorExpiresAtMs);
+		if (challenge.state !== "issued" || challenge.expiresAtMs <= Date.now()) return failure("relocation_challenge_expired_or_consumed", 409);
+		let factor;
+		if (activeOwner.method.kind === "email_otp") {
+			const enrollment = await this.options.emailOtp.verifier.readEnrollmentForWallet(binding.walletId);
+			if (!enrollment || enrollment.orgId !== this.options.scope.orgId || await sha256HexUtf8(enrollment.verifiedEmail) !== activeOwner.method.emailHashHex) return failure("unauthorized", 401);
+			const issued = await this.options.emailOtp.issuer.create({
+				action: WALLET_EMAIL_OTP_ACTIONS.relocation,
+				operation: WALLET_EMAIL_OTP_RELOCATION_OPERATION,
+				userId: enrollment.providerUserId,
+				walletId: binding.walletId,
+				orgId: this.options.scope.orgId,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				requestOrigin: binding.origin,
+				ownerProofBindingDigest: await walletRelocationEmailOtpBinding(this.options.scope, binding, challenge.challengeB64u),
+				expiresAtMs: challenge.expiresAtMs
+			});
+			if (!issued.ok) return Response.json(issued, {
+				status: 503,
+				headers: { "Cache-Control": "no-store" }
+			});
+			factor = {
+				kind: "email_otp",
+				challengeId: issued.challenge.challengeId,
+				delivery: issued.delivery
+			};
+		} else factor = { kind: "passkey" };
+		return Response.json({
+			kind: "challenge",
+			factor,
+			moveId: binding.moveId,
+			walletId: binding.walletId,
+			destinationRegion: binding.destinationRegion,
+			expectedGeneration: binding.sourceGeneration,
+			requestDigest: binding.requestDigestHex,
+			challengeB64u: challenge.challengeB64u,
+			expiresAtMs: challenge.expiresAtMs
+		}, { headers: { "Cache-Control": "no-store" } });
+	}
+	async relocate(request) {
+		const intent = parseRelocationIntent(await request.json().catch(invalidBody), "admission");
+		if (!intent || intent.kind !== "admission") return failure("invalid_input", 400);
+		const nowMs = Date.now();
+		const owner = await WalletRelocationOwnerRequest.authenticate({
+			request,
+			walletId: intent.walletId,
+			tenantId: this.options.tenantId,
+			scope: this.options.scope,
+			allowedOrigins: this.options.allowedOrigins,
+			authorizationSessions: this.options.authorizationSessions,
+			nowMs
+		});
+		const approvals = new D1WalletRelocationApprovals(this.options.database, this.options.scope);
+		let approval = await approvals.find(intent.walletId, intent.moveId);
+		if (!owner) {
+			if (!approval) return failure("unauthorized", 401);
+			if (!await WalletRelocationReadAccess.authenticate({
+				request,
+				binding: approval.binding,
+				database: this.options.database,
+				scope: this.options.scope,
+				allowedOrigins: this.options.allowedOrigins,
+				nowMs
+			})) return failure("unauthorized", 401);
+		}
+		if (!approval) {
+			if (!owner) return failure("unauthorized", 401);
+			if (intent.sourceProof === null) return failure("owner_approval_required", 409);
+			const challenge = await new D1WalletRelocationChallenges(this.options.database, this.options.scope).find(intent.walletId, intent.moveId);
+			if (!challenge) return failure("relocation_challenge_required", 409);
+			if (challenge.binding.destinationRegion !== intent.destinationRegion || challenge.binding.sourceGeneration !== intent.expectedGeneration) return failure("request_conflict", 409);
+			if (owner.bindMove(challenge.binding).encoded() !== challenge.binding.encoded()) return failure("unauthorized", 401);
+			const proof = parseSourceProof(intent.sourceProof);
+			if (!proof) return failure("invalid_source_proof", 400);
+			let result;
+			switch (proof.kind) {
+				case "passkey":
+					result = await approvals.approvePasskey({
+						owner,
+						binding: challenge.binding,
+						credential: proof.credential,
+						nowMs
+					});
+					break;
+				case "email_otp":
+					result = await approvals.approveEmailOtp({
+						owner,
+						binding: challenge.binding,
+						challengeId: proof.challengeId,
+						otpCode: proof.otpCode,
+						nowMs,
+						verifier: this.options.emailOtp.verifier,
+						emailOtpChallenges: this.options.emailOtp.emailOtpChallenges
+					});
+					break;
+				default: return assertNever(proof);
+			}
+			if (result.kind === "denied") return failure("source_proof_denied", 403);
+			approval = result.approval;
+		}
+		if (intent.destinationRegion !== approval.binding.destinationRegion || intent.expectedGeneration !== approval.binding.sourceGeneration) return failure("request_conflict", 409);
+		return this.dispatch("relocation-admit", {
+			wallet: this.walletKey(intent.walletId),
+			moveId: intent.moveId,
+			requestDigest: approval.binding.requestDigestHex,
+			destinationRegion: approval.binding.destinationRegion,
+			expectedGeneration: approval.binding.sourceGeneration,
+			authorityId: approval.binding.authorityId
+		});
+	}
+	walletKey(walletId) {
+		return {
+			namespace: this.options.scope.namespace,
+			organizationId: this.options.scope.orgId,
+			projectId: this.options.scope.projectId,
+			environmentId: this.options.scope.envId,
+			walletId
+		};
+	}
+	async dispatch(path, body) {
+		const response = await this.options.directory.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${path}`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body)
+		}));
+		const headers = new Headers(response.headers);
+		headers.set("Cache-Control", "no-store");
+		return new Response(response.body, {
+			status: response.status,
+			headers
+		});
+	}
+};
+function failure(code, status) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+function invalidBody() {
+	return null;
+}
+function parseRelocationIntent(raw, purpose) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== (purpose === "challenge" ? 4 : 5)) return null;
+	if (purpose === "admission" && !Object.hasOwn(raw, "sourceProof")) return null;
+	const wallet = parseWalletId(raw.walletId);
+	if (!wallet.ok || typeof raw.moveId !== "string" || !/^wmove_[A-Za-z0-9_-]{43}$/u.test(raw.moveId) || typeof raw.expectedGeneration !== "number" || !Number.isSafeInteger(raw.expectedGeneration) || raw.expectedGeneration <= 0 || raw.destinationRegion !== "US" && raw.destinationRegion !== "WEUR" && raw.destinationRegion !== "APAC" && raw.destinationRegion !== "OC") return null;
+	const intent = {
+		walletId: wallet.value,
+		moveId: raw.moveId,
+		destinationRegion: raw.destinationRegion,
+		expectedGeneration: raw.expectedGeneration
+	};
+	return purpose === "challenge" ? {
+		...intent,
+		kind: "challenge"
+	} : {
+		...intent,
+		kind: "admission",
+		sourceProof: raw.sourceProof
+	};
+}
+function parseSourceProof(raw) {
+	if (!isPlainObject(raw)) return null;
+	if (raw.kind === "passkey" && Object.keys(raw).length === 2 && Object.hasOwn(raw, "credential")) return {
+		kind: "passkey",
+		credential: raw.credential
+	};
+	if (raw.kind !== "email_otp" || Object.keys(raw).length !== 3) return null;
+	try {
+		return {
+			kind: "email_otp",
+			challengeId: requireCanonicalString(raw.challengeId, "OTP challenge"),
+			otpCode: requireCanonicalString(raw.otpCode, "OTP code")
+		};
+	} catch {
+		return null;
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unexpected relocation proof: ${String(value)}`);
+}
+//#endregion
+export { WalletPlacementRoutes };
+
+//# sourceMappingURL=walletPlacementRoutes.js.map