@settlemint/dalp-sdk 3.1.33 → 3.2.0-rc.1

package/dist/auth.js

@@ -0,0 +1,540 @@
+import {
+  createDalpSdkConfigurationError2
+} from "./chunk-k3ntysxx.js";
+import {
+  DALP_AUTH_SURFACE_HEADER2,
+  secret2,
+  unwrapSecret,
+  detectDalpRuntime,
+  refuseCrossOriginBrowserSession,
+  refuseBundledApiKey,
+  STEP_UP_CHALLENGE_HEADER,
+  STEP_UP_CHALLENGE_PATH,
+  carriesWalletProof,
+  stepUpChallengeRequest
+} from "./chunk-6hckdbwt.js";
+import {
+  makeCookieStore2,
+  createCookieStoreFetch2,
+  SDK_USER_AGENT2
+} from "./chunk-xnarraj7.js";
+import {
+  normalizeDalpBaseUrl
+} from "./chunk-crtb9edj.js";
+
+// src/auth/live.ts
+import { apiKeyClient } from "@better-auth/api-key/client";
+import { passkeyClient as passkeyClient2 } from "@better-auth/passkey/client";
+import {
+  createAuthClient as createBetterAuthClient
+} from "better-auth/client";
+import {
+  adminClient,
+  customSessionClient,
+  deviceAuthorizationClient,
+  inferAdditionalFields,
+  organizationClient,
+  twoFactorClient
+} from "better-auth/client/plugins";
+
+// src/auth/client.ts
+class AuthConfigError extends Error {
+  constructor(field, requirement) {
+    super(`\`${field}\` ${requirement}`);
+    this.name = "AuthConfigError";
+  }
+}
+function optionalText(value, field) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "string") {
+    return handleNonString(field);
+  }
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    throw new AuthConfigError(field, "must not be blank");
+  }
+  return trimmed;
+}
+function handleNonString(field) {
+  throw new AuthConfigError(field, "must be a string");
+}
+function requiredUrl(value) {
+  if (typeof value !== "string") {
+    return handleNonString("url");
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new AuthConfigError("url", "must be a valid URL");
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new AuthConfigError("url", "must use http or https");
+  }
+  return value;
+}
+function optionalHeaders(value) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new AuthConfigError("headers", "must be an object of strings");
+  }
+  const headers = {};
+  for (const [name, header] of Object.entries(value)) {
+    if (typeof header !== "string") {
+      throw new AuthConfigError("headers", "must be an object of strings");
+    }
+    headers[name] = header;
+  }
+  return headers;
+}
+function optionalAuthSurface(value) {
+  if (value === undefined || value === "console" || value === "portal") {
+    return value;
+  }
+  throw new AuthConfigError("authSurface", 'must be "console" or "portal"');
+}
+function optionalFetch(value) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "function") {
+    throw new AuthConfigError("fetch", "must be a function");
+  }
+  return value;
+}
+function optionalRuntime(value) {
+  if (value === undefined || value === "browser" || value === "server" || value === "react-native") {
+    return value;
+  }
+  throw new AuthConfigError("runtime", 'must be "browser", "server", or "react-native"');
+}
+function optionalPasskeyCeremony(value) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "object" || value === null || typeof Reflect.get(value, "authenticate") !== "function" || typeof Reflect.get(value, "register") !== "function") {
+    throw new AuthConfigError("passkey", "must expose authenticate and register");
+  }
+  return value;
+}
+function optionalCookieStore(value) {
+  if (value === undefined) {
+    return;
+  }
+  const store = value;
+  if (typeof value !== "object" || value === null || typeof store.header !== "function" || typeof store.storeSetCookieHeaders !== "function") {
+    throw new AuthConfigError("cookieStore", "must expose header and storeSetCookieHeaders");
+  }
+  return store;
+}
+function decodeAuthConfig(input) {
+  const raw = input;
+  const apiKey = optionalText(raw.apiKey, "apiKey");
+  const cookie = optionalText(raw.cookie, "cookie");
+  if ([apiKey, cookie].filter((credential) => credential !== undefined).length > 1) {
+    throw new AuthConfigError("apiKey/cookie", "configure only one auth credential source");
+  }
+  const url = requiredUrl(raw.url);
+  const cookieStore = optionalCookieStore(raw.cookieStore);
+  const authSurface = optionalAuthSurface(raw.authSurface);
+  const headers = optionalHeaders(raw.headers);
+  const configuredFetch = optionalFetch(raw.fetch);
+  const runtime = optionalRuntime(raw.runtime);
+  const passkey = optionalPasskeyCeremony(raw.passkey);
+  return {
+    url,
+    ...apiKey === undefined ? {} : { apiKey: secret2(apiKey) },
+    ...cookie === undefined ? {} : { cookie: secret2(cookie) },
+    ...cookieStore === undefined ? {} : { cookieStore },
+    ...authSurface === undefined ? {} : { authSurface },
+    ...headers === undefined ? {} : { headers },
+    ...configuredFetch === undefined ? {} : { fetch: configuredFetch },
+    ...runtime === undefined ? {} : { runtime },
+    ...passkey === undefined ? {} : { passkey }
+  };
+}
+async function decodeDalpAuthClientConfig(input) {
+  try {
+    return decodeAuthConfig(input);
+  } catch (error) {
+    throw createDalpSdkConfigurationError2({
+      message: "DALP SDK: auth client configuration is invalid.",
+      why: "The auth client received a malformed URL, credential, header map, runtime, fetch seam, cookie store, or passkey ceremony.",
+      fix: "Pass one credential source, an HTTP(S) URL, a known runtime, and valid fetch, cookie-store, and passkey seams.",
+      cause: error
+    });
+  }
+}
+
+// src/auth/invite-step-up.ts
+var INVITE_MEMBER_PATH = "/api/auth/organization/invite-member";
+var INVITE_MEMBER_OPERATION = `POST ${INVITE_MEMBER_PATH}`;
+function readChallengeId(payload) {
+  const data = payload !== null && typeof payload === "object" ? Reflect.get(payload, "data") : undefined;
+  const challengeId = data !== null && typeof data === "object" ? Reflect.get(data, "challengeId") : undefined;
+  return typeof challengeId === "string" ? challengeId : undefined;
+}
+function invitesWithWalletProof(input, init, baseUrl) {
+  const url = input instanceof Request ? input.url : String(input);
+  if ((init?.method ?? "GET").toUpperCase() !== "POST" || typeof init?.body !== "string" || new URL(url).pathname !== new URL(`${baseUrl}${INVITE_MEMBER_PATH}`).pathname) {
+    return;
+  }
+  const body = JSON.parse(init.body);
+  return carriesWalletProof(body) ? body : undefined;
+}
+function withInviteStepUp(fetchImpl, baseUrl) {
+  return async (input, init) => {
+    const headers = new Headers(init?.headers);
+    const body = invitesWithWalletProof(input, init, baseUrl);
+    if (body === undefined || headers.has("x-api-key") || headers.has(STEP_UP_CHALLENGE_HEADER)) {
+      return fetchImpl(input, init);
+    }
+    const challengeHeaders = new Headers(headers);
+    challengeHeaders.set("Content-Type", "application/json");
+    const issued = await fetchImpl(`${baseUrl}${STEP_UP_CHALLENGE_PATH}`, {
+      method: "POST",
+      headers: challengeHeaders,
+      body: JSON.stringify(await stepUpChallengeRequest(INVITE_MEMBER_OPERATION, null, body)),
+      signal: init?.signal ?? null,
+      ...init?.credentials === undefined ? {} : { credentials: init.credentials }
+    });
+    if (!issued.ok) {
+      return issued;
+    }
+    const challengeId = readChallengeId(await issued.json());
+    if (challengeId !== undefined) {
+      headers.set(STEP_UP_CHALLENGE_HEADER, challengeId);
+    }
+    return fetchImpl(input, { ...init, headers });
+  };
+}
+
+// src/auth/native-passkey.ts
+import {
+  passkeyClient
+} from "@better-auth/passkey/client";
+var ceremonyFailed = (code, error) => ({
+  data: null,
+  error: {
+    code,
+    message: error instanceof Error ? error.message : "The passkey ceremony did not complete.",
+    status: 400,
+    statusText: "BAD_REQUEST"
+  }
+});
+function withExtensions(options, extensions) {
+  return options.extensions === undefined && extensions === undefined ? options : { ...options, extensions: { ...options.extensions, ...extensions } };
+}
+function ceremonyPasskeyClient(ceremony) {
+  const plugin = passkeyClient();
+  return {
+    ...plugin,
+    getActions: ($fetch, $store) => {
+      const signIn = async (opts, options) => {
+        const generated = await $fetch("/passkey/generate-authenticate-options", {
+          method: "GET",
+          throw: false
+        });
+        if (generated.data === null) {
+          return generated;
+        }
+        let response;
+        try {
+          response = await ceremony.authenticate(withExtensions(generated.data, opts?.extensions));
+        } catch (error) {
+          return ceremonyFailed("AUTH_CANCELLED", error);
+        }
+        const { clientExtensionResults, ...responseBody } = response;
+        try {
+          const verified = await $fetch("/passkey/verify-authentication", {
+            body: { response: responseBody },
+            ...opts?.fetchOptions,
+            ...options,
+            method: "POST",
+            throw: false
+          });
+          $store.notify("$listPasskeys");
+          $store.notify("$sessionSignal");
+          return opts?.returnWebAuthnResponse === true ? { ...verified, webauthn: { response, clientExtensionResults } } : verified;
+        } catch (error) {
+          return ceremonyFailed("AUTH_CANCELLED", error);
+        }
+      };
+      const addPasskey = async (opts, fetchOpts) => {
+        const generated = await $fetch("/passkey/generate-register-options", {
+          method: "GET",
+          query: {
+            ...opts?.authenticatorAttachment === undefined ? {} : { authenticatorAttachment: opts.authenticatorAttachment },
+            ...opts?.name === undefined || opts.name === "" ? {} : { name: opts.name },
+            ...opts?.context === undefined || opts.context === null ? {} : { context: opts.context }
+          },
+          throw: false
+        });
+        if (generated.data === null) {
+          return generated;
+        }
+        let response;
+        try {
+          response = await ceremony.register(withExtensions(generated.data, opts?.extensions));
+        } catch (error) {
+          return ceremonyFailed("REGISTRATION_CANCELLED", error);
+        }
+        const { clientExtensionResults, ...responseBody } = response;
+        try {
+          const verified = await $fetch("/passkey/verify-registration", {
+            ...opts?.fetchOptions,
+            ...fetchOpts,
+            body: {
+              response: responseBody,
+              name: opts?.name,
+              ...opts?.createSession === true ? { createSession: true } : {}
+            },
+            method: "POST",
+            throw: false
+          });
+          if (verified.data === null) {
+            return verified;
+          }
+          $store.notify("$listPasskeys");
+          if (verified.data.session !== undefined) {
+            $store.notify("$sessionSignal");
+          }
+          return opts?.returnWebAuthnResponse === true ? { ...verified, webauthn: { response, clientExtensionResults } } : verified;
+        } catch (error) {
+          return ceremonyFailed("UNKNOWN_ERROR", error);
+        }
+      };
+      return { signIn: { passkey: signIn }, passkey: { addPasskey }, $Infer: {} };
+    }
+  };
+}
+
+// src/auth/permissions.ts
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements as adminDefaultStatements } from "better-auth/plugins/admin/access";
+import {
+  memberAc,
+  defaultStatements as organizationDefaultStatements,
+  ownerAc
+} from "better-auth/plugins/organization/access";
+var dalPermissions = {
+  organization: ["update", "delete", "list"],
+  setting: ["read", "list", "upsert", "remove", "set-global-theme"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"],
+  corporateAction: ["approve"]
+};
+var customPermissions = {
+  ...adminDefaultStatements,
+  ...organizationDefaultStatements,
+  ...dalPermissions
+};
+var narrowAccessControl = createAccessControl(customPermissions);
+var accessControl = createAccessControl({
+  ...adminDefaultStatements,
+  ...organizationDefaultStatements,
+  ...dalPermissions
+});
+var adminRole = narrowAccessControl.newRole({
+  ...adminAc.statements,
+  ...ownerAc.statements,
+  organization: ["update", "delete", "list"],
+  setting: ["read", "list", "upsert", "remove", "set-global-theme"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"],
+  corporateAction: ["approve"]
+});
+var ownerRole = narrowAccessControl.newRole({
+  ...ownerAc.statements,
+  user: ["list", "get", "update"],
+  setting: ["read", "list", "upsert", "remove"],
+  system: ["read", "list", "create"],
+  exchangeRates: ["read", "list"],
+  corporateAction: ["approve"]
+});
+var memberRole = narrowAccessControl.newRole({
+  ...memberAc.statements,
+  setting: ["read", "list"],
+  system: ["read", "list"],
+  exchangeRates: ["read", "list"]
+});
+
+// src/auth/wallet-plugins.ts
+import { defineErrorCodes } from "better-auth";
+var WALLET_VERIFICATION_ERROR_CODES = {
+  WALLET_VERIFICATION_INVALID_CODE: "Invalid wallet verification code",
+  WALLET_VERIFICATION_NOT_CONFIGURED: "The account holds no wallet verification method of that type",
+  WALLET_CREDENTIAL_LOCKED: "Wallet verification is locked after repeated failures. Retry after the wait.",
+  WALLET_VERIFICATION_UNAVAILABLE: "Wallet verification did not settle. Try again in a moment.",
+  WALLET_VERIFICATION_FACTOR_UNAVAILABLE: "The identity provider did not answer. Try again in a moment, or use another verification method."
+};
+var WALLET_PINCODE_ERROR_CODES = defineErrorCodes({
+  WALLET_PINCODE_ALREADY_SET: "Wallet pincode already set",
+  WALLET_PINCODE_ALREADY_REMOVED: "Wallet pincode already removed",
+  WALLET_PINCODE_PASSWORD_REQUIRED: "A current wallet verification code is required; the account password is not accepted",
+  WALLET_PINCODE_FRESH_SSO_REQUIRED: "Sign in through SSO again before recovering your wallet PIN",
+  WALLET_PINCODE_INVALID_RECOVERY_CODE: "Invalid recovery code",
+  WALLET_PINCODE_NO_RECOVERY_CODES_REMAINING: "No recovery codes remaining",
+  WALLET_PINCODE_RECOVERY_NOT_CONFIGURED: "Recovery codes are not configured",
+  WALLET_LAST_SIGNING_FACTOR: "Set up another way to approve transactions before you remove this one.",
+  ...WALLET_VERIFICATION_ERROR_CODES
+});
+var WALLET_TWO_FACTOR_ERROR_CODES = defineErrorCodes({
+  WALLET_TWO_FACTOR_PASSWORD_REQUIRED: "A current wallet verification code is required; the account password is not accepted",
+  WALLET_TWO_FACTOR_INVALID_CODE: "Invalid two factor code",
+  WALLET_TWO_FACTOR_AUTHENTICATOR_PROOF_REQUIRED: "Changing or turning off the wallet authenticator needs a code from the authenticator or a recovery code",
+  WALLET_LAST_SIGNING_FACTOR: "Set up another way to approve transactions before you remove this one.",
+  ...WALLET_VERIFICATION_ERROR_CODES
+});
+var WALLET_SECRET_CODES_ERROR_CODES = defineErrorCodes({
+  WALLET_SECRET_CODES_AUTHENTICATOR_PROOF_REQUIRED: "Regenerating recovery codes needs a code from the wallet authenticator or a recovery code",
+  WALLET_SECRET_CODES_PIN_PROOF_REQUIRED: "Regenerating recovery codes needs the wallet PIN or a recovery code",
+  WALLET_SECRET_CODES_VERIFICATION_MISMATCH: "Secret codes verification mismatch",
+  ...WALLET_VERIFICATION_ERROR_CODES
+});
+var walletPincodeClient = () => ({
+  id: "wallet-pincode",
+  $InferServerPlugin: {
+    id: "wallet-pincode",
+    $ERROR_CODES: WALLET_PINCODE_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_PINCODE_ERROR_CODES,
+  pathMethods: {
+    "/wallet/pincode/enable": "POST",
+    "/wallet/pincode/disable": "POST",
+    "/wallet/pincode/update": "POST",
+    "/wallet/pincode/recover": "POST",
+    "/wallet/pincode/reset": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/pincode/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+var walletTwoFactorClient = () => ({
+  id: "wallet-two-factor",
+  $InferServerPlugin: {
+    id: "wallet-two-factor",
+    $ERROR_CODES: WALLET_TWO_FACTOR_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_TWO_FACTOR_ERROR_CODES,
+  pathMethods: {
+    "/wallet/two-factor/enable": "POST",
+    "/wallet/two-factor/disable": "POST",
+    "/wallet/two-factor/verify": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/two-factor/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+var walletSecretCodesClient = () => ({
+  id: "wallet-secret-codes",
+  $InferServerPlugin: {
+    id: "wallet-secret-codes",
+    $ERROR_CODES: WALLET_SECRET_CODES_ERROR_CODES,
+    endpoints: {}
+  },
+  $ERROR_CODES: WALLET_SECRET_CODES_ERROR_CODES,
+  pathMethods: {
+    "/wallet/secret-codes/generate": "POST",
+    "/wallet/secret-codes/confirm": "POST"
+  },
+  atomListeners: [
+    {
+      matcher: (path) => path.startsWith("/wallet/secret-codes/"),
+      signal: "$sessionSignal"
+    }
+  ]
+});
+
+// src/auth/live.ts
+var adminPluginOptions = {
+  ac: accessControl,
+  roles: { admin: adminRole, owner: ownerRole, member: memberRole }
+};
+var organizationPluginOptions = {
+  ac: accessControl,
+  roles: { owner: ownerRole, member: memberRole }
+};
+var reservedHeaders = new Set(["x-api-key", "authorization", "cookie"]);
+function authHeaders(config, runtime, baseUrl) {
+  const headers = { "User-Agent": SDK_USER_AGENT2 };
+  if (runtime === "react-native") {
+    headers.origin = new URL(baseUrl).origin;
+  }
+  for (const [name, value] of Object.entries(config.headers ?? {})) {
+    if (!reservedHeaders.has(name.toLowerCase())) {
+      headers[name.toLowerCase() === "origin" ? "origin" : name] = value;
+    }
+  }
+  if (config.apiKey !== undefined) {
+    headers["x-api-key"] = unwrapSecret(config.apiKey);
+  }
+  if (config.authSurface !== undefined) {
+    headers[DALP_AUTH_SURFACE_HEADER2] = config.authSurface;
+  }
+  return headers;
+}
+function createConfiguredBetterAuthClient(config, cookieStore) {
+  const plugins = [
+    customSessionClient(),
+    inferAdditionalFields(),
+    adminClient(adminPluginOptions),
+    apiKeyClient(),
+    config.passkey === undefined ? passkeyClient2() : ceremonyPasskeyClient(config.passkey),
+    walletPincodeClient(),
+    walletTwoFactorClient(),
+    walletSecretCodesClient(),
+    twoFactorClient({ onTwoFactorRedirect() {} }),
+    deviceAuthorizationClient(),
+    organizationClient(organizationPluginOptions)
+  ];
+  const baseUrl = normalizeDalpBaseUrl(config.url);
+  const runtime = config.runtime ?? detectDalpRuntime();
+  refuseCrossOriginBrowserSession(runtime, baseUrl, config.apiKey !== undefined);
+  if (config.apiKey !== undefined) {
+    refuseBundledApiKey(runtime);
+  }
+  return createBetterAuthClient({
+    baseURL: `${baseUrl}/api/auth`,
+    fetchOptions: {
+      headers: authHeaders(config, runtime, baseUrl),
+      customFetchImpl: withInviteStepUp(createCookieStoreFetch2(cookieStore, config.fetch), baseUrl),
+      credentials: runtime === "react-native" ? "omit" : "include"
+    },
+    plugins
+  });
+}
+async function createDalpAuthClient(input) {
+  const config = await decodeDalpAuthClientConfig(input);
+  const cookieStore = config.cookieStore ?? makeCookieStore2();
+  if (config.cookie !== undefined) {
+    cookieStore.setCookieHeader(unwrapSecret(config.cookie));
+  }
+  const credentialCount = [config.apiKey, cookieStore.isEmpty() ? undefined : true].filter(Boolean).length;
+  if (credentialCount > 1) {
+    throw createDalpSdkConfigurationError2({
+      message: "DALP SDK: configure only one auth credential source.",
+      why: "The auth client received multiple credential types.",
+      fix: "Use an API key or a cookie store, not both."
+    });
+  }
+  return createConfiguredBetterAuthClient(config, cookieStore);
+}
+var makeDalpAuthClient = createDalpAuthClient;
+export {
+  createDalpAuthClient,
+  decodeDalpAuthClientConfig,
+  makeDalpAuthClient
+};