@terminal3/t3n-sdk 0.12.1 → 0.13.1

package/README.md

@@ -129,7 +129,7 @@ new T3nClient(config: T3nClientConfig)
 
 - `startHandshake(): Promise<void>` - Establish secure session with the node
 - `authenticate(authInput: AuthInput): Promise<Did>` - Authenticate using provided credentials
-- `getSessionId(): SessionId` - Get current session ID
+- `getSessionId(): SessionId | null` - Get the server-minted session ID (`null` until handshake completes; pentest M-1 / MAT-983 moved session-id minting from the client to the server)
 - `getStatus(): SessionStatus` - Get current session status
 - `getDid(): Did | null` - Get authenticated DID (null if not authenticated)
 - `isAuthenticated(): boolean` - Check if client is authenticated

package/dist/demo.d.ts

@@ -12,7 +12,7 @@ declare global {
 interface DemoResult {
     sessionId: {
         value: string;
-    };
+    } | null;
     status: SessionStatus;
     wasmLoaded: boolean;
     authenticated: boolean;

package/dist/index.d.ts

@@ -444,15 +444,25 @@ declare class HttpTransport implements Transport {
  */
 declare class MockTransport implements Transport {
     private responses;
+    private responseHeaders;
+    private lastResponseHeaders;
     private requests;
     /**
      * Mock a response for a specific method
      */
     mockResponse(method: string, response: Partial<JsonRpcResponse>): void;
+    /**
+     * Mock response headers for a specific method. Used by tests to
+     * simulate the server-minted `Session-Id` header the SDK picks up
+     * from the `auth.handshake` response (MAT-983). Unset methods
+     * default to no headers.
+     */
+    mockResponseHeaders(method: string, headers: Record<string, string>): void;
     /**
      * Mock an error response for a specific method
      */
     mockError(method: string, code: number, message: string, data?: unknown): void;
+    getLastResponseHeaders(): Record<string, string>;
     /**
      * Get all requests that were sent
      */
@@ -488,8 +498,6 @@ interface T3nClientConfig {
     wasmComponent: WasmComponent;
     /** Optional transport layer - if not provided, uses HttpTransport with baseUrl */
     transport?: Transport;
-    /** Optional session ID - will be generated if not provided */
-    sessionId?: SessionId;
     /** Optional request timeout in milliseconds (default: 30000) - used for HttpTransport */
     timeout?: number;
     /** Optional custom headers to include in requests */
@@ -520,7 +528,22 @@ interface T3nClientConfig {
 declare class T3nClient {
     private readonly config;
     private readonly transport;
-    private readonly sessionId;
+    /**
+     * Server-minted session ID, set by {@link handshake} from the
+     * `Session-Id` response header (pentest M-1 / MAT-983). `null`
+     * until the handshake completes. Client code cannot set it — the
+     * former `config.sessionId` hook was the session-fixation vector
+     * this fix closes.
+     */
+    private sessionId;
+    /**
+     * Set by {@link sendRpcRequest} when an `auth.handshake` RPC is
+     * actually issued. Decouples the "flow completed without talking
+     * to a server" case (unit-test mocks that only exercise handler
+     * delegation) from the real "server must mint the id" invariant:
+     * we only enforce the mint requirement when a round-trip happened.
+     */
+    private handshakeSentRpc;
     private readonly logger;
     private readonly encryption;
     private status;
@@ -579,7 +602,11 @@ declare class T3nClient {
      * Execute an action on the T3n node
      */
     execute(payload: unknown): Promise<string>;
-    getSessionId(): SessionId;
+    /**
+     * The server-minted session ID once handshake has completed, or
+     * `null` beforehand (pentest M-1 / MAT-983).
+     */
+    getSessionId(): SessionId | null;
     getStatus(): SessionStatus;
     getDid(): Did | null;
     getLastSetCookie(): string | null;
@@ -637,6 +664,16 @@ declare class T3nClient {
      * Send an RPC request with automatic encryption/decryption
      */
     private sendRpcRequest;
+    /**
+     * Capture the server-minted `Session-Id` from the last handshake
+     * response headers (pentest M-1 / MAT-983). Validates shape so a
+     * broken or MITM'd response fails loudly instead of leaving a
+     * garbage value in the client. Idempotent: only the first valid
+     * mint per session is honoured — subsequent handshake RPC legs
+     * (none exist today, but the state-machine loop can iterate) do
+     * not overwrite an already-set value.
+     */
+    private captureMintedSessionId;
     /**
      * Get the finalized session blob (for `session.encrypt` calls).
      * Populated by `tryFinalize` once the handshake state machine