@shopfront/bridge 1.14.0 → 1.16.0

package/.idea/misc.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="TaskProjectConfiguration">
+    <server type="JIRA" url="https://onshopfront.atlassian.net" />
+  </component>
+</project>

package/lib/Application.d.ts

@@ -7,6 +7,18 @@ import { ShopfrontSaleState } from "./APIs/CurrentSale/ShopfrontSaleState";
 import { Database } from "./APIs/Database/Database";
 import { MaybePromise } from "./Utilities/MiscTypes";
 import { BaseEvent } from "./Events/BaseEvent";
+export interface ShopfrontEmbeddedVerificationToken {
+    auth: string;
+    id: string;
+    app: string;
+    user: string;
+    url: {
+        raw: string;
+        loaded: string;
+    };
+}
+export declare class ShopfrontTokenDecodingError extends Error {
+}
 export declare class Application {
     protected bridge: Bridge;
     protected isReady: boolean;
@@ -14,6 +26,7 @@ export declare class Application {
     protected register: string | null;
     protected outlet: string | null;
     protected user: string | null;
+    protected signingKey: CryptoKeyPair | undefined;
     protected listeners: {
         [key in keyof Omit<FromShopfront, "CALLBACK">]: Map<(...args: Array<unknown>) => void, FromShopfront[key] & BaseEvent>;
     };
@@ -103,4 +116,13 @@ export declare class Application {
         value: TValueType | undefined;
     };
     getOption<TValueType>(option: string, defaultValue: TValueType): Promise<TValueType>;
+    protected dataIsEmbeddedToken(data: Record<string, unknown>): data is {
+        requestId: string;
+        data: BufferSource;
+        signature: BufferSource;
+    };
+    protected generateSigningKey(): Promise<void>;
+    protected decodeToken(signature: BufferSource, data: BufferSource, returnTokenObject?: boolean): Promise<ShopfrontEmbeddedVerificationToken | string>;
+    getToken(returnTokenObject: true): Promise<ShopfrontEmbeddedVerificationToken>;
+    getToken(returnTokenObject?: false): Promise<string>;
 }

package/lib/Application.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Application = void 0;
+exports.Application = exports.ShopfrontTokenDecodingError = void 0;
 const ApplicationEvents_1 = require("./ApplicationEvents");
 const Ready_1 = require("./Events/Ready");
 const Button_1 = require("./Actions/Button");
@@ -24,6 +24,9 @@ const SaleComplete_1 = require("./Events/SaleComplete");
 const UIPipeline_1 = require("./Events/UIPipeline");
 const PaymentMethodsEnabled_1 = require("./Events/PaymentMethodsEnabled");
 const AudioPermissionChange_1 = require("./Events/AudioPermissionChange");
+class ShopfrontTokenDecodingError extends Error {
+}
+exports.ShopfrontTokenDecodingError = ShopfrontTokenDecodingError;
 // noinspection JSUnusedGlobalSymbols
 class Application {
     constructor(bridge) {
@@ -73,7 +76,8 @@ class Application {
                 event === "RESPONSE_DATABASE_REQUEST" ||
                 event === "RESPONSE_LOCATION" ||
                 event === "RESPONSE_OPTION" ||
-                event === "RESPONSE_AUDIO_REQUEST") {
+                event === "RESPONSE_AUDIO_REQUEST" ||
+                event === "RESPONSE_SECURE_KEY") {
                 // Handled elsewhere
                 return;
             }
@@ -469,5 +473,67 @@ class Application {
         }
         return optionValue;
     }
+    dataIsEmbeddedToken(data) {
+        return typeof data.requestId === "string" && typeof data.data === "object" && data.data !== null;
+    }
+    async generateSigningKey() {
+        if (typeof this.signingKey !== "undefined") {
+            return;
+        }
+        this.signingKey = await crypto.subtle.generateKey({
+            name: "ECDSA",
+            namedCurve: "P-384",
+        }, true, ["sign", "verify"]);
+        this.bridge.sendMessage(ApplicationEvents_1.ToShopfront.ROTATE_SIGNING_KEY, await crypto.subtle.exportKey("jwk", this.signingKey.privateKey));
+    }
+    async decodeToken(signature, data, returnTokenObject) {
+        if (typeof this.signingKey === "undefined") {
+            // Not possible to decode
+            throw new Error("Unable to decode token due to a missing signing key");
+        }
+        if (!(await crypto.subtle.verify({
+            name: "ECDSA",
+            hash: {
+                name: "SHA-384",
+            },
+        }, this.signingKey.publicKey, signature, data))) {
+            throw new ShopfrontTokenDecodingError();
+        }
+        const decoded = JSON.parse(new TextDecoder().decode(data));
+        if (decoded.app !== this.bridge.key) {
+            throw new ShopfrontTokenDecodingError();
+        }
+        if (decoded.url.loaded !== location.href) {
+            throw new ShopfrontTokenDecodingError();
+        }
+        if (returnTokenObject) {
+            return decoded;
+        }
+        return decoded.auth;
+    }
+    async getToken(returnTokenObject) {
+        await this.generateSigningKey();
+        const request = `TokenRequest-${Date.now().toString()}`;
+        const promise = new Promise(res => {
+            const listener = (event, data) => {
+                if (event !== "RESPONSE_SECURE_KEY") {
+                    return;
+                }
+                if (!this.dataIsEmbeddedToken(data)) {
+                    return;
+                }
+                if (data.requestId !== request) {
+                    return;
+                }
+                this.bridge.removeEventListener(listener);
+                res([data.signature, data.data]);
+            };
+            this.bridge.addEventListener(listener);
+        });
+        this.bridge.sendMessage(ApplicationEvents_1.ToShopfront.REQUEST_SECURE_KEY, {
+            requestId: request,
+        });
+        return this.decodeToken(...(await promise), returnTokenObject);
+    }
 }
 exports.Application = Application;

package/lib/ApplicationEvents.d.ts

@@ -39,6 +39,8 @@ export declare enum ToShopfront {
     REDIRECT = "REDIRECT",
     GET_OPTION = "GET_OPTION",
     RESPONSE_UI_PIPELINE = "RESPONSE_UI_PIPELINE",
+    REQUEST_SECURE_KEY = "REQUEST_SECURE_KEY",
+    ROTATE_SIGNING_KEY = "ROTATE_SIGNING_KEY",
     AUDIO_REQUEST_PERMISSION = "AUDIO_REQUEST_PERMISSION",
     AUDIO_PRELOAD = "AUDIO_PRELOAD",
     AUDIO_PLAY = "AUDIO_PLAY",
@@ -185,4 +187,5 @@ export interface FromShopfrontInternal {
     RESPONSE_LOCATION: "RESPONSE_LOCATION";
     RESPONSE_OPTION: "RESPONSE_OPTION";
     RESPONSE_AUDIO_REQUEST: "RESPONSE_AUDIO_REQUEST";
+    RESPONSE_SECURE_KEY: "RESPONSE_SECURE_KEY";
 }

package/lib/ApplicationEvents.js

@@ -23,6 +23,8 @@ var ToShopfront;
     ToShopfront["REDIRECT"] = "REDIRECT";
     ToShopfront["GET_OPTION"] = "GET_OPTION";
     ToShopfront["RESPONSE_UI_PIPELINE"] = "RESPONSE_UI_PIPELINE";
+    ToShopfront["REQUEST_SECURE_KEY"] = "REQUEST_SECURE_KEY";
+    ToShopfront["ROTATE_SIGNING_KEY"] = "ROTATE_SIGNING_KEY";
     // Audio Events
     ToShopfront["AUDIO_REQUEST_PERMISSION"] = "AUDIO_REQUEST_PERMISSION";
     ToShopfront["AUDIO_PRELOAD"] = "AUDIO_PRELOAD";

package/lib/Bridge.d.ts

@@ -4,13 +4,13 @@ interface ApplicationOptions {
     id: string;
     vendor: string;
 }
-interface ApplicationEventListener {
+export interface ApplicationEventListener {
     (event: keyof ApplicationEvents.FromShopfront | keyof ApplicationEvents.FromShopfrontInternal, data: Record<string, unknown>, id: string): void;
 }
 export declare class Bridge {
     static createApplication(options: ApplicationOptions): Application;
-    protected key: string;
-    protected url: URL;
+    key: string;
+    url: URL;
     protected listeners: Array<ApplicationEventListener>;
     protected hasListener: boolean;
     protected target: Window | null;

package/lib/index.d.ts

@@ -8,5 +8,5 @@ export { SellScreenOption } from "./EmitableEvents/SellScreenOption";
 export { TableUpdate } from "./EmitableEvents/TableUpdate";
 export { SellScreenPromotionApplicable } from "./EmitableEvents/SellScreenPromotionApplicable";
 export { CompletedSale } from "./Events/SaleComplete";
-export { Application } from "./Application";
+export { Application, ShopfrontEmbeddedVerificationToken, ShopfrontTokenDecodingError } from "./Application";
 export * as Sales from "./APIs/CurrentSale/index";

package/lib/index.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Sales = exports.Application = exports.SellScreenPromotionApplicable = exports.TableUpdate = exports.SellScreenOption = exports.SaleKey = exports.Dialog = exports.Toast = exports.Redirect = exports.Button = exports.Bridge = void 0;
+exports.Sales = exports.ShopfrontTokenDecodingError = exports.Application = exports.SellScreenPromotionApplicable = exports.TableUpdate = exports.SellScreenOption = exports.SaleKey = exports.Dialog = exports.Toast = exports.Redirect = exports.Button = exports.Bridge = void 0;
 var Bridge_1 = require("./Bridge");
 Object.defineProperty(exports, "Bridge", { enumerable: true, get: function () { return Bridge_1.Bridge; } });
 var Button_1 = require("./Actions/Button");
@@ -44,4 +44,5 @@ var SellScreenPromotionApplicable_1 = require("./EmitableEvents/SellScreenPromot
 Object.defineProperty(exports, "SellScreenPromotionApplicable", { enumerable: true, get: function () { return SellScreenPromotionApplicable_1.SellScreenPromotionApplicable; } });
 var Application_1 = require("./Application");
 Object.defineProperty(exports, "Application", { enumerable: true, get: function () { return Application_1.Application; } });
+Object.defineProperty(exports, "ShopfrontTokenDecodingError", { enumerable: true, get: function () { return Application_1.ShopfrontTokenDecodingError; } });
 exports.Sales = __importStar(require("./APIs/CurrentSale/index"));

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@shopfront/bridge",
-    "version": "1.14.0",
+    "version": "1.16.0",
     "main": "./lib/index.js",
     "license": "ISC",
     "description": "The bridge used to embed your application within Shopfront",