@sneekin/sdk 1.1.0 → 1.1.2

package/dist/verify/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,31 +120,9 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/verify/handler.ts
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createLocalJWKSet, createRemoteJWKSet, jwtVerify } from "jose";
 
 // src/verify/auth-schema.ts
 import { z } from "zod";
@@ -305,8 +310,16 @@ var SneekVerifyHandler = class {
     const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
     let payload;
     try {
-      const jwks = this.jwksByIssuer.get(partner.issuer) ?? createRemoteJWKSet(new URL("/oauth/jwks", partner.issuer));
-      this.jwksByIssuer.set(partner.issuer, jwks);
+      let jwks = this.jwksByIssuer.get(partner.issuer);
+      if (!jwks) {
+        try {
+          const localJwksData = await this.client.request("GET", "/oauth/jwks");
+          jwks = createLocalJWKSet(localJwksData);
+        } catch {
+          jwks = createRemoteJWKSet(new URL("/oauth/jwks", partner.issuer));
+        }
+        this.jwksByIssuer.set(partner.issuer, jwks);
+      }
       ({ payload } = await jwtVerify(result.idToken, jwks, {
         issuer: partner.issuer,
         audience: partner.clientId
@@ -390,11 +403,11 @@ var SneekVerifyHandler = class {
     const partner = await this.partnerConfig();
     if (!partner.origins.includes(origin)) return jsonResponse({ error: "Origin is not registered for QR verification" }, 403);
     const nonce = randomBytes(32).toString("hex");
-    const ref = createHash("sha256").update(nonce).digest("hex");
+    const ref = createHash("sha256").update(Buffer.from(nonce, "hex")).digest("hex");
     const issuedAt = Math.floor(Date.now() / 1e3);
     const expiresAt = (issuedAt + partner.qrTtlSeconds) * 1e3;
     const bindingProof = randomBytes(32).toString("base64url");
-    const signature = createHmac("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
+    const signature = createHmac("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, partner.kid, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
     await this.approvalStore.createQrSession({
       ref,
       applicationId: partner.applicationId,
@@ -402,7 +415,7 @@ var SneekVerifyHandler = class {
       bindingProofHash: this.hash(bindingProof),
       expiresAt
     });
-    return jsonResponse({ ref, nonce, issuedAt, expiresAt, signature, bindingProof }, 200);
+    return jsonResponse({ ref, nonce, issuedAt, expiresAt, kid: partner.kid, signature, bindingProof }, 200);
   }
   async qrStatus(ref, bindingProof, origin) {
     const session = await this.qrSession(ref, bindingProof, origin);
@@ -437,5 +450,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekVerifyHandler,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sneekin/sdk",
-    "version": "1.1.0",
+    "version": "1.1.2",
     "publishConfig": {
         "access": "public"
     },
@@ -66,4 +66,4 @@
     "engines": {
         "node": ">=20"
     }
-}
+}