@tern-secure/backend 1.2.0-canary.v20251108045933 → 1.2.0-canary.v20251127221555

package/dist/index.mjs

@@ -1,20 +1,20 @@
 import {
   createTernSecureRequest
-} from "./chunk-ASGV4MFO.mjs";
+} from "./chunk-GFH5CXQR.mjs";
 import {
   getAuth,
   verifyToken
-} from "./chunk-MS6L7M3C.mjs";
+} from "./chunk-DJLDUW7J.mjs";
 import {
   constants
-} from "./chunk-DFAJCSBJ.mjs";
+} from "./chunk-WIVOBOZR.mjs";
 import {
   RefreshTokenErrorReason,
   TokenVerificationError,
   TokenVerificationErrorReason,
   mapJwtPayloadToDecodedIdToken,
   ternDecodeJwt
-} from "./chunk-DDUNOEIM.mjs";
+} from "./chunk-NXYWC6YO.mjs";
 
 // src/createRedirect.ts
 var buildUrl = (_baseUrl, _targetUrl, _returnBackUrl) => {
@@ -201,6 +201,84 @@ var AbstractAPI = class {
   }
 };
 
+// src/fireRestApi/endpoints/AppCheckApi.ts
+function getSdkVersion() {
+  return "12.7.0";
+}
+var FIREBASE_APP_CHECK_CONFIG_HEADERS = {
+  "X-Firebase-Client": `fire-admin-node/${getSdkVersion()}`
+};
+var AppCheckApi = class extends AbstractAPI {
+  async exchangeCustomToken(params) {
+    const { projectId, appId, customToken, accessToken, limitedUse = false } = params;
+    if (!projectId || !appId) {
+      throw new Error("Project ID and App ID are required for App Check token exchange");
+    }
+    const endpoint = `https://firebaseappcheck.googleapis.com/v1beta/projects/${projectId}/apps/${appId}:exchangeCustomToken`;
+    const headers = {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${accessToken}`
+    };
+    const body = {
+      customToken,
+      limitedUse
+    };
+    try {
+      const response = await fetch(endpoint, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`App Check token exchange failed: ${response.status} ${errorText}`);
+      }
+      const data = await response.json();
+      return {
+        token: data.token,
+        ttl: data.ttl
+      };
+    } catch (error) {
+      console.warn("[ternsecure - appcheck api]unexpected error:", error);
+      throw error;
+    }
+  }
+  async exchangeDebugToken(params) {
+    const { projectId, appId, customToken, accessToken, limitedUse = false } = params;
+    if (!projectId || !appId) {
+      throw new Error("Project ID and App ID are required for App Check token exchange");
+    }
+    const endpoint = `https://firebaseappcheck.googleapis.com/v1beta/projects/${projectId}/apps/${appId}:exchangeDebugToken`;
+    const headers = {
+      ...FIREBASE_APP_CHECK_CONFIG_HEADERS,
+      "Authorization": `Bearer ${accessToken}`
+    };
+    const body = {
+      customToken,
+      limitedUse
+    };
+    try {
+      const response = await fetch(endpoint, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`App Check token exchange failed: ${response.status} ${errorText}`);
+      }
+      const data = await response.json();
+      return {
+        token: data.token,
+        ttl: data.ttl
+      };
+    } catch (error) {
+      console.warn("[ternsecure - appcheck api]unexpected error:", error);
+      throw error;
+    }
+  }
+};
+
 // src/fireRestApi/endpoints/EmailApi.ts
 var EmailApi = class extends AbstractAPI {
   async verifyEmailVerification(apiKey, params) {
@@ -254,6 +332,30 @@ var PasswordApi = class extends AbstractAPI {
   }
 };
 
+// src/fireRestApi/endpoints/SignInApi.ts
+var SignInApi = class extends AbstractAPI {
+  async resetPasswordEmail(apiKey, params) {
+    try {
+      this.requireApiKey(apiKey);
+      const { ...restParams } = params;
+      const response = await this.request({
+        endpoint: "sendOobCode",
+        method: "POST",
+        apiKey,
+        bodyParams: restParams
+      });
+      if (response.errors) {
+        const errorMessage = response.errors[0]?.message || "Failed to send reset password email";
+        throw new Error(errorMessage);
+      }
+      return response.data;
+    } catch (error) {
+      const contextualMessage = `Failed to send reset password email: ${error instanceof Error ? error.message : "Unknown error"}`;
+      throw new Error(contextualMessage);
+    }
+  }
+};
+
 // src/fireRestApi/endpoints/SignInTokenApi.ts
 var SignInTokenApi = class extends AbstractAPI {
   async createCustomToken(apiKey, params) {
@@ -294,11 +396,14 @@ var SignUpApi = class extends AbstractAPI {
 var TokenApi = class extends AbstractAPI {
   async refreshToken(apiKey, params) {
     this.requireApiKey(apiKey);
-    const { refresh_token, request_origin, ...restParams } = params;
+    const { refresh_token, request_origin, app_check_token, ...restParams } = params;
     const headers = {};
     if (request_origin) {
       headers["Referer"] = request_origin;
     }
+    if (app_check_token) {
+      headers["X-Firebase-AppCheck"] = app_check_token;
+    }
     const bodyParams = {
       grant_type: "refresh_token",
       refresh_token,
@@ -318,13 +423,23 @@ var TokenApi = class extends AbstractAPI {
     if (options?.referer) {
       headers["Referer"] = options.referer;
     }
-    return this.request({
+    if (options?.appCheckToken) {
+      headers["X-Firebase-AppCheck"] = options.appCheckToken;
+    }
+    const response = await this.request({
       endpoint: "signInWithCustomToken",
       method: "POST",
       apiKey,
       bodyParams: params,
       headerParams: headers
     });
+    if (response.errors) {
+      throw new Error(response.errors[0].message);
+    }
+    if (!response.data) {
+      throw new Error("No data received from Firebase token exchange");
+    }
+    return response.data;
   }
 };
 
@@ -386,6 +501,9 @@ var signInWithPassword = (apiKey) => {
 var signUpEndpoint = (apiKey) => {
   return `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${apiKey}`;
 };
+var sendOobCode = (apiKey) => {
+  return `https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=${apiKey}`;
+};
 var getCustomTokenEndpoint = (apiKey) => {
   if (useEmulator() && FIREBASE_AUTH_EMULATOR_HOST) {
     let protocol = "http://";
@@ -396,9 +514,6 @@ var getCustomTokenEndpoint = (apiKey) => {
   }
   return `https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${apiKey}`;
 };
-var passwordResetEndpoint = (apiKey) => {
-  return `https://identitytoolkit.googleapis.com/v1/accounts:resetPassword?key=${apiKey}`;
-};
 
 // src/fireRestApi/request.ts
 var FIREBASE_ENDPOINT_MAP = {
@@ -406,8 +521,8 @@ var FIREBASE_ENDPOINT_MAP = {
   signInWithPassword,
   signUp: signUpEndpoint,
   signInWithCustomToken: getCustomTokenEndpoint,
-  passwordReset: passwordResetEndpoint,
-  sendOobCode: signInWithPassword,
+  passwordReset: sendOobCode,
+  sendOobCode,
   lookup: lookupEndpoint
 };
 function createRequest(options) {
@@ -456,8 +571,18 @@ function createRequest(options) {
           ...body
         });
       }
-      const isJSONResponse = res?.headers && res.headers?.get(constants.Headers.ContentType) === constants.ContentTypes.Json;
-      const responseBody = await (isJSONResponse ? res.json() : res.text());
+      const isJSONResponse = res?.headers && res.headers?.get(constants.Headers.ContentType)?.includes(constants.ContentTypes.Json);
+      let responseBody;
+      try {
+        const text = await res.text();
+        try {
+          responseBody = JSON.parse(text);
+        } catch {
+          responseBody = text;
+        }
+      } catch (e) {
+        responseBody = null;
+      }
       if (!res.ok) {
         return {
           data: null,
@@ -538,9 +663,11 @@ function parseError(error) {
 function createFireApi(options) {
   const request = createRequest(options);
   return {
+    appCheck: new AppCheckApi(request),
     email: new EmailApi(request),
     password: new PasswordApi(request),
-    signIn: new SignInTokenApi(request),
+    signIn: new SignInApi(request),
+    signInToken: new SignInTokenApi(request),
     signUp: new SignUpApi(request),
     tokens: new TokenApi(request),
     userData: new UserData(request)
@@ -590,6 +717,7 @@ var RequestProcessorContext = class {
     this.userAgent = this.getHeader(constants.Headers.UserAgent);
     this.secFetchDest = this.getHeader(constants.Headers.SecFetchDest);
     this.accept = this.getHeader(constants.Headers.Accept);
+    this.appCheckToken = this.getHeader(constants.Headers.AppCheckToken);
   }
   initCookieValues() {
     const isProduction = process.env.NODE_ENV === "production";
@@ -653,14 +781,13 @@ function isRequestForRefresh(error, context, request) {
 }
 async function authenticateRequest(request, options) {
   const context = createRequestProcessor(createTernSecureRequest(request), options);
-  const { refreshTokenInCookie } = context;
+  const { refreshTokenInCookie, appCheckToken } = context;
   const { refreshExpiredIdToken } = getAuth(options);
   function checkSessionTimeout(authTimeValue) {
     const defaultMaxAgeSeconds = convertToSeconds("5 days");
     const REAUTH_PERIOD_SECONDS = context.session?.maxAge ? convertToSeconds(context.session.maxAge) : defaultMaxAgeSeconds;
     const currentTime = Math.floor(Date.now() / 1e3);
     const authAge = currentTime - authTimeValue;
-    console.log("Current time:", currentTime, "Auth age:", authAge, "Reauth period (s):", REAUTH_PERIOD_SECONDS);
     if (authTimeValue > 0 && authAge > REAUTH_PERIOD_SECONDS) {
       return signedOut(context, AuthErrorReason.AuthTimeout, "Authentication expired");
     }
@@ -677,7 +804,8 @@ async function authenticateRequest(request, options) {
       };
     }
     return await refreshExpiredIdToken(refreshTokenInCookie, {
-      referer: context.ternUrl.origin
+      referer: context.ternUrl.origin,
+      appCheckToken
     });
   }
   async function handleRefresh() {
@@ -779,7 +907,24 @@ async function authenticateRequest(request, options) {
       if (errors) {
         throw errors[0];
       }
-      const signedInRequestState = signedIn(context, data, void 0, context.idTokenInCookie);
+      const { exchangeAppCheckToken } = getAuth(options);
+      let appCheckTokenValue;
+      try {
+        const idToken = context.idTokenInCookie || "";
+        const appCheckResult = await exchangeAppCheckToken(idToken);
+        console.log("[authenticateRequest] App Check exchange result:", appCheckResult);
+        if (appCheckResult.data?.token) {
+          appCheckTokenValue = appCheckResult.data.token;
+        }
+      } catch (error) {
+        console.warn("App Check token exchange failed:", error);
+      }
+      const headers = new Headers();
+      headers.set(
+        constants.Headers.AppCheckToken,
+        appCheckTokenValue || ""
+      );
+      const signedInRequestState = signedIn(context, data, headers, context.idTokenInCookie);
       return signedInRequestState;
     } catch (err) {
       return handleError(err, "cookie");
@@ -793,7 +938,23 @@ async function authenticateRequest(request, options) {
       if (errors) {
         throw errors[0];
       }
-      const signedInRequestState = signedIn(context, data, void 0, sessionTokenInHeader);
+      const { exchangeAppCheckToken } = getAuth(options);
+      let appCheckTokenValue;
+      try {
+        const token = sessionTokenInHeader || "";
+        const appCheckResult = await exchangeAppCheckToken(token);
+        if (appCheckResult.data?.token) {
+          appCheckTokenValue = appCheckResult.data.token;
+        }
+      } catch (error) {
+        console.warn("App Check token exchange failed:", error);
+      }
+      const headers = new Headers();
+      headers.set(
+        constants.Headers.AppCheckToken,
+        appCheckTokenValue || ""
+      );
+      const signedInRequestState = signedIn(context, data, headers, sessionTokenInHeader);
       return signedInRequestState;
     } catch (err) {
       return handleError(err, "header");
@@ -807,6 +968,16 @@ async function authenticateRequest(request, options) {
     if (isRequestForRefresh(err, context, request)) {
       const { data, error } = await handleRefresh();
       if (data) {
+        const { exchangeAppCheckToken } = getAuth(options);
+        let appCheckTokenValue;
+        try {
+          const appCheckResult = await exchangeAppCheckToken(data.token);
+          if (appCheckResult.data?.token) {
+            appCheckTokenValue = appCheckResult.data.token;
+          }
+        } catch (error2) {
+          console.warn("App Check token exchange failed in error handler:", error2);
+        }
         return signedIn(context, data.decoded, data.headers, data.token);
       }
       if (error?.cause?.reason) {