@thirdweb-dev/service-utils 0.0.0-dev-b4ddcd1-20230714194904 → 0.0.0-dev-11d3fa6-20230714225821

package/cf-worker/dist/thirdweb-dev-service-utils-cf-worker.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var index = require('../../dist/index-ded83ecc.cjs.dev.js');
+var index = require('../../dist/index-03e2bf97.cjs.dev.js');
 var services = require('../../dist/services-a3f36057.cjs.dev.js');
 
 const DEFAULT_CACHE_TTL_SECONDS = 60;
@@ -93,7 +93,9 @@ async function extractAuthorizationData(authInput) {
     clientId,
     origin,
     bundleId,
-    secretKeyHash
+    secretKeyHash,
+    targetAddress: authInput.targetAddress,
+    enforceAuth: authInput.enforcedAuth
   };
 }
 async function hashSecretKey(secretKey) {

package/cf-worker/dist/thirdweb-dev-service-utils-cf-worker.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var index = require('../../dist/index-bc2b86a5.cjs.prod.js');
+var index = require('../../dist/index-2facafef.cjs.prod.js');
 var services = require('../../dist/services-9e185105.cjs.prod.js');
 
 const DEFAULT_CACHE_TTL_SECONDS = 60;
@@ -93,7 +93,9 @@ async function extractAuthorizationData(authInput) {
     clientId,
     origin,
     bundleId,
-    secretKeyHash
+    secretKeyHash,
+    targetAddress: authInput.targetAddress,
+    enforceAuth: authInput.enforcedAuth
   };
 }
 async function hashSecretKey(secretKey) {

package/cf-worker/dist/thirdweb-dev-service-utils-cf-worker.esm.js

@@ -1,4 +1,4 @@
-import { a as authorize } from '../../dist/index-1125bae0.esm.js';
+import { a as authorize } from '../../dist/index-e7c3b3be.esm.js';
 export { b as SERVICES, S as SERVICE_DEFINITIONS, a as SERVICE_NAMES, g as getServiceByName } from '../../dist/services-86283509.esm.js';
 
 const DEFAULT_CACHE_TTL_SECONDS = 60;
@@ -89,7 +89,9 @@ async function extractAuthorizationData(authInput) {
     clientId,
     origin,
     bundleId,
-    secretKeyHash
+    secretKeyHash,
+    targetAddress: authInput.targetAddress,
+    enforceAuth: authInput.enforcedAuth
   };
 }
 async function hashSecretKey(secretKey) {

package/dist/declarations/src/cf-worker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"../../../../src/cf-worker","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAkB,iBAAiB,EAAE,uBAAoB;AAGrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,mCAAgC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAsB;AAEnD,oCAAiC;AAEjC,KAAK,mBAAmB,GAAG,iBAAiB,GAAG;IAC7C,OAAO,EAAE,WAAW,CAAC;IACrB,GAAG,EAAE,gBAAgB,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIF,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAEF,wBAAsB,eAAe,CACnC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,mBAAmB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA0C9B;AAmED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,mBAIpD;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,MAAM,UAEpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"../../../../src/cf-worker","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAkB,iBAAiB,EAAE,uBAAoB;AAGrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,mCAAgC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAsB;AAEnD,oCAAiC;AAEjC,KAAK,mBAAmB,GAAG,iBAAiB,GAAG;IAC7C,OAAO,EAAE,WAAW,CAAC;IACrB,GAAG,EAAE,gBAAgB,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIF,KAAK,SAAS,GAAG,aAAa,GAAG;IAC/B,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAEF,wBAAsB,eAAe,CACnC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,mBAAmB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA0C9B;AAqED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,mBAIpD;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,MAAM,UAEpE"}

package/dist/declarations/src/core/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"../../../../src/core","sources":["api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,sBAAmB;AAE9C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,EAAE,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,WAAW,CAAC,CAkBtB"}
+{"version":3,"file":"api.d.ts","sourceRoot":"../../../../src/core","sources":["api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,sBAAmB;AAE9C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,EAAE,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,WAAW,CAAC,CAgBtB"}

package/dist/declarations/src/core/authorize/index.d.ts

@@ -6,7 +6,8 @@ export type AuthorizationInput = {
     origin: string | null;
     bundleId: string | null;
     secretKeyHash: string | null;
-    targetAddress?: string;
+    targetAddress?: string | string[];
+    enforceAuth: boolean;
 };
 type CacheOptions = {
     get: (clientId: string) => Promise<string | null>;

package/dist/declarations/src/core/authorize/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"../../../../../src/core/authorize","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,iBAAiB,EAElB,kBAAe;AAGhB,OAAO,EAAE,mBAAmB,EAAE,mBAAgB;AAE9C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AASF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,kBAAkB,EAC5B,aAAa,EAAE,iBAAiB,EAChC,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CAoH9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"../../../../../src/core/authorize","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,iBAAiB,EAElB,kBAAe;AAGhB,OAAO,EAAE,mBAAmB,EAAE,mBAAgB;AAE9C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,KAAK,YAAY,GAAG;IAClB,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AASF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,kBAAkB,EAC5B,aAAa,EAAE,iBAAiB,EAChC,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CA+H9B"}

package/dist/declarations/src/core/authorize/types.d.ts

@@ -1,7 +1,7 @@
 import { ApiKeyMetadata } from "../api.js";
 export type AuthorizationResult = {
     authorized: true;
-    apiKeyMeta: ApiKeyMetadata;
+    apiKeyMeta: ApiKeyMetadata | null;
 } | {
     authorized: false;
     status: number;

package/dist/declarations/src/core/authorize/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"../../../../../src/core/authorize","sources":["types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAe;AAExC,MAAM,MAAM,mBAAmB,GAC3B;IACE,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B,GACD;IACE,UAAU,EAAE,KAAK,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"../../../../../src/core/authorize","sources":["types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAe;AAExC,MAAM,MAAM,mBAAmB,GAC3B;IACE,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;CACnC,GACD;IACE,UAAU,EAAE,KAAK,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/declarations/src/core/types.d.ts

@@ -1,5 +1,6 @@
 export type CoreAuthInput = {
     clientId?: string;
-    targetAddress?: string;
+    targetAddress?: string | string[];
+    enforcedAuth: boolean;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/declarations/src/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"../../../../src/core","sources":["types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAE1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"../../../../src/core","sources":["types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAE1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAElC,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC"}

package/dist/declarations/src/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"../../../../src/node","sources":["index.ts"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAuB,eAAe,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAA0B;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAoB;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,mCAAgC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAsB;AAEnD,oCAAiC;AAEjC,KAAK,iBAAiB,GAAG,iBAAiB,CAAC;AAE3C,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG;IACtC,GAAG,EAAE,eAAe,CAAC;CACtB,CAAC;AAEF,wBAAsB,aAAa,CACjC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;AAaD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,GACnB,kBAAkB,CA+DpB;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,UAE9C;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,MAAM,UAEpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"../../../../src/node","sources":["index.ts"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAuB,eAAe,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAA0B;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAoB;AAErD,OAAO,KAAK,EAAE,mBAAmB,EAAE,mCAAgC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,yBAAsB;AAEnD,oCAAiC;AAEjC,KAAK,iBAAiB,GAAG,iBAAiB,CAAC;AAE3C,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG;IACtC,GAAG,EAAE,eAAe,CAAC;CACtB,CAAC;AAEF,wBAAsB,aAAa,CACjC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;AAaD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,GACnB,kBAAkB,CAyEpB;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,UAE9C;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,MAAM,UAEpE"}

package/dist/{index-bc2b86a5.cjs.prod.js → index-03e2bf97.cjs.dev.js}

@@ -6,10 +6,8 @@ async function fetchKeyMetadataFromApi(clientId, config) {
     serviceScope,
     serviceApiKey
   } = config;
-  const url = new URL(`${apiUrl}/v1/keys/use`);
-  url.searchParams.set("clientId", clientId);
-  url.searchParams.set("scope", serviceScope);
-  const response = await fetch(url.href, {
+  const url = `${apiUrl}/v1/keys/use?clientId=${clientId}&scope=${serviceScope}`;
+  const response = await fetch(url, {
     method: "GET",
     headers: {
       "x-service-api-key": serviceApiKey,
@@ -114,8 +112,6 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
   const {
     services
   } = apiKeyMetadata;
-  // const { serviceTargetAddresses, serviceAction } = validations;
-
   // validate services
   const service = services.find(srv => srv.name === serviceConfig.serviceScope);
   if (!service) {
@@ -143,11 +139,12 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
   // validate service target addresses
   // the service has to pass in the target address for this to be validated
   if (authorizationPayload?.targetAddress) {
-    const isTargetAddressAllowed = service.targetAddresses.includes(authorizationPayload.targetAddress);
-    if (!isTargetAddressAllowed) {
+    const checkedAddresses = Array.isArray(authorizationPayload.targetAddress) ? authorizationPayload.targetAddress : [authorizationPayload.targetAddress];
+    const allAllowed = service.targetAddresses.includes("*");
+    if (!allAllowed && checkedAddresses.some(ta => !service.targetAddresses.includes(ta))) {
       return {
         authorized: false,
-        errorMessage: `The service "${serviceConfig.serviceScope}" target address "${authorizationPayload.targetAddress}" is not authorized for this key.`,
+        errorMessage: `The service "${serviceConfig.serviceScope}" target address is not authorized for this key.`,
         errorCode: "SERVICE_TARGET_ADDRESS_UNAUTHORIZED",
         status: 403
       };
@@ -160,8 +157,24 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
 }
 
 async function authorize(authData, serviceConfig, cacheOptions) {
+  const {
+    clientId,
+    targetAddress,
+    enforceAuth,
+    secretKeyHash
+  } = authData;
+
+  // BACKWARDS COMPAT: if auth not enforced and
+  //                   we don't have auth credentials bypass
+  if (!enforceAuth && !clientId && !secretKeyHash) {
+    return {
+      authorized: true,
+      apiKeyMeta: null
+    };
+  }
+
   // if we don't have a client id at this point we can't authorize
-  if (!authData.clientId) {
+  if (!clientId) {
     return {
       authorized: false,
       status: 401,
@@ -173,7 +186,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
   // if we have cache options we want to check the cache first
   if (cacheOptions) {
     try {
-      const cachedKey = await cacheOptions.get(authData.clientId);
+      const cachedKey = await cacheOptions.get(clientId);
       if (cachedKey) {
         const parsed = JSON.parse(cachedKey);
         if ("updatedAt" in parsed) {
@@ -201,7 +214,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
       const {
         data,
         error
-      } = await fetchKeyMetadataFromApi(authData.clientId, serviceConfig);
+      } = await fetchKeyMetadataFromApi(clientId, serviceConfig);
       if (error) {
         return {
           authorized: false,
@@ -223,7 +236,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
       // cache the retrieved key if we have cache options
       if (cacheOptions) {
         // we await this always because it can be a promise or not
-        await cacheOptions.put(authData.clientId, data);
+        await cacheOptions.put(clientId, data);
       }
     } catch (err) {
       console.warn("failed to fetch key metadata from api", err);
@@ -256,7 +269,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
 
   // if we've made it this far we need to check service specific authorization
   const serviceAuth = authorizeService(apiKeyMeta, serviceConfig, {
-    targetAddress: authData.targetAddress
+    targetAddress
   });
   if (!serviceAuth.authorized) {
     return {

package/dist/{index-ded83ecc.cjs.dev.js → index-2facafef.cjs.prod.js}

@@ -6,10 +6,8 @@ async function fetchKeyMetadataFromApi(clientId, config) {
     serviceScope,
     serviceApiKey
   } = config;
-  const url = new URL(`${apiUrl}/v1/keys/use`);
-  url.searchParams.set("clientId", clientId);
-  url.searchParams.set("scope", serviceScope);
-  const response = await fetch(url.href, {
+  const url = `${apiUrl}/v1/keys/use?clientId=${clientId}&scope=${serviceScope}`;
+  const response = await fetch(url, {
     method: "GET",
     headers: {
       "x-service-api-key": serviceApiKey,
@@ -114,8 +112,6 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
   const {
     services
   } = apiKeyMetadata;
-  // const { serviceTargetAddresses, serviceAction } = validations;
-
   // validate services
   const service = services.find(srv => srv.name === serviceConfig.serviceScope);
   if (!service) {
@@ -143,11 +139,12 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
   // validate service target addresses
   // the service has to pass in the target address for this to be validated
   if (authorizationPayload?.targetAddress) {
-    const isTargetAddressAllowed = service.targetAddresses.includes(authorizationPayload.targetAddress);
-    if (!isTargetAddressAllowed) {
+    const checkedAddresses = Array.isArray(authorizationPayload.targetAddress) ? authorizationPayload.targetAddress : [authorizationPayload.targetAddress];
+    const allAllowed = service.targetAddresses.includes("*");
+    if (!allAllowed && checkedAddresses.some(ta => !service.targetAddresses.includes(ta))) {
       return {
         authorized: false,
-        errorMessage: `The service "${serviceConfig.serviceScope}" target address "${authorizationPayload.targetAddress}" is not authorized for this key.`,
+        errorMessage: `The service "${serviceConfig.serviceScope}" target address is not authorized for this key.`,
         errorCode: "SERVICE_TARGET_ADDRESS_UNAUTHORIZED",
         status: 403
       };
@@ -160,8 +157,24 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
 }
 
 async function authorize(authData, serviceConfig, cacheOptions) {
+  const {
+    clientId,
+    targetAddress,
+    enforceAuth,
+    secretKeyHash
+  } = authData;
+
+  // BACKWARDS COMPAT: if auth not enforced and
+  //                   we don't have auth credentials bypass
+  if (!enforceAuth && !clientId && !secretKeyHash) {
+    return {
+      authorized: true,
+      apiKeyMeta: null
+    };
+  }
+
   // if we don't have a client id at this point we can't authorize
-  if (!authData.clientId) {
+  if (!clientId) {
     return {
       authorized: false,
       status: 401,
@@ -173,7 +186,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
   // if we have cache options we want to check the cache first
   if (cacheOptions) {
     try {
-      const cachedKey = await cacheOptions.get(authData.clientId);
+      const cachedKey = await cacheOptions.get(clientId);
       if (cachedKey) {
         const parsed = JSON.parse(cachedKey);
         if ("updatedAt" in parsed) {
@@ -201,7 +214,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
       const {
         data,
         error
-      } = await fetchKeyMetadataFromApi(authData.clientId, serviceConfig);
+      } = await fetchKeyMetadataFromApi(clientId, serviceConfig);
       if (error) {
         return {
           authorized: false,
@@ -223,7 +236,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
       // cache the retrieved key if we have cache options
       if (cacheOptions) {
         // we await this always because it can be a promise or not
-        await cacheOptions.put(authData.clientId, data);
+        await cacheOptions.put(clientId, data);
       }
     } catch (err) {
       console.warn("failed to fetch key metadata from api", err);
@@ -256,7 +269,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
 
   // if we've made it this far we need to check service specific authorization
   const serviceAuth = authorizeService(apiKeyMeta, serviceConfig, {
-    targetAddress: authData.targetAddress
+    targetAddress
   });
   if (!serviceAuth.authorized) {
     return {

package/dist/{index-1125bae0.esm.js → index-e7c3b3be.esm.js}

@@ -4,10 +4,8 @@ async function fetchKeyMetadataFromApi(clientId, config) {
     serviceScope,
     serviceApiKey
   } = config;
-  const url = new URL(`${apiUrl}/v1/keys/use`);
-  url.searchParams.set("clientId", clientId);
-  url.searchParams.set("scope", serviceScope);
-  const response = await fetch(url.href, {
+  const url = `${apiUrl}/v1/keys/use?clientId=${clientId}&scope=${serviceScope}`;
+  const response = await fetch(url, {
     method: "GET",
     headers: {
       "x-service-api-key": serviceApiKey,
@@ -112,8 +110,6 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
   const {
     services
   } = apiKeyMetadata;
-  // const { serviceTargetAddresses, serviceAction } = validations;
-
   // validate services
   const service = services.find(srv => srv.name === serviceConfig.serviceScope);
   if (!service) {
@@ -141,11 +137,12 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
   // validate service target addresses
   // the service has to pass in the target address for this to be validated
   if (authorizationPayload?.targetAddress) {
-    const isTargetAddressAllowed = service.targetAddresses.includes(authorizationPayload.targetAddress);
-    if (!isTargetAddressAllowed) {
+    const checkedAddresses = Array.isArray(authorizationPayload.targetAddress) ? authorizationPayload.targetAddress : [authorizationPayload.targetAddress];
+    const allAllowed = service.targetAddresses.includes("*");
+    if (!allAllowed && checkedAddresses.some(ta => !service.targetAddresses.includes(ta))) {
       return {
         authorized: false,
-        errorMessage: `The service "${serviceConfig.serviceScope}" target address "${authorizationPayload.targetAddress}" is not authorized for this key.`,
+        errorMessage: `The service "${serviceConfig.serviceScope}" target address is not authorized for this key.`,
         errorCode: "SERVICE_TARGET_ADDRESS_UNAUTHORIZED",
         status: 403
       };
@@ -158,8 +155,24 @@ function authorizeService(apiKeyMetadata, serviceConfig, authorizationPayload) {
 }
 
 async function authorize(authData, serviceConfig, cacheOptions) {
+  const {
+    clientId,
+    targetAddress,
+    enforceAuth,
+    secretKeyHash
+  } = authData;
+
+  // BACKWARDS COMPAT: if auth not enforced and
+  //                   we don't have auth credentials bypass
+  if (!enforceAuth && !clientId && !secretKeyHash) {
+    return {
+      authorized: true,
+      apiKeyMeta: null
+    };
+  }
+
   // if we don't have a client id at this point we can't authorize
-  if (!authData.clientId) {
+  if (!clientId) {
     return {
       authorized: false,
       status: 401,
@@ -171,7 +184,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
   // if we have cache options we want to check the cache first
   if (cacheOptions) {
     try {
-      const cachedKey = await cacheOptions.get(authData.clientId);
+      const cachedKey = await cacheOptions.get(clientId);
       if (cachedKey) {
         const parsed = JSON.parse(cachedKey);
         if ("updatedAt" in parsed) {
@@ -199,7 +212,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
       const {
         data,
         error
-      } = await fetchKeyMetadataFromApi(authData.clientId, serviceConfig);
+      } = await fetchKeyMetadataFromApi(clientId, serviceConfig);
       if (error) {
         return {
           authorized: false,
@@ -221,7 +234,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
       // cache the retrieved key if we have cache options
       if (cacheOptions) {
         // we await this always because it can be a promise or not
-        await cacheOptions.put(authData.clientId, data);
+        await cacheOptions.put(clientId, data);
       }
     } catch (err) {
       console.warn("failed to fetch key metadata from api", err);
@@ -254,7 +267,7 @@ async function authorize(authData, serviceConfig, cacheOptions) {
 
   // if we've made it this far we need to check service specific authorization
   const serviceAuth = authorizeService(apiKeyMeta, serviceConfig, {
-    targetAddress: authData.targetAddress
+    targetAddress
   });
   if (!serviceAuth.authorized) {
     return {

package/node/dist/thirdweb-dev-service-utils-node.cjs.dev.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var node_crypto = require('node:crypto');
-var index = require('../../dist/index-ded83ecc.cjs.dev.js');
+var index = require('../../dist/index-03e2bf97.cjs.dev.js');
 var services = require('../../dist/services-a3f36057.cjs.dev.js');
 
 async function authorizeNode(authInput, serviceConfig) {
@@ -36,10 +36,13 @@ function getHeader(headers, headerName) {
   return header ?? null;
 }
 function extractAuthorizationData(authInput) {
-  if (!authInput.req.url) {
-    throw new Error("no req.url in authInput.req");
+  let requestUrl;
+  try {
+    requestUrl = new URL(authInput.req.url || "", `http://${authInput.req.headers.host}`);
+  } catch (error) {
+    console.log("** Node URL Error **", error);
+    throw error;
   }
-  const requestUrl = new URL(authInput.req.url, authInput.req.headers.host);
   const headers = authInput.req.headers;
   const secretKey = getHeader(headers, "x-secret-key");
   // prefer clientId that is explicitly passed in
@@ -93,7 +96,9 @@ function extractAuthorizationData(authInput) {
     secretKey,
     clientId,
     origin,
-    bundleId
+    bundleId,
+    targetAddress: authInput.targetAddress,
+    enforceAuth: authInput.enforcedAuth
   };
 }
 function hashSecretKey(secretKey) {

package/node/dist/thirdweb-dev-service-utils-node.cjs.prod.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var node_crypto = require('node:crypto');
-var index = require('../../dist/index-bc2b86a5.cjs.prod.js');
+var index = require('../../dist/index-2facafef.cjs.prod.js');
 var services = require('../../dist/services-9e185105.cjs.prod.js');
 
 async function authorizeNode(authInput, serviceConfig) {
@@ -36,10 +36,13 @@ function getHeader(headers, headerName) {
   return header ?? null;
 }
 function extractAuthorizationData(authInput) {
-  if (!authInput.req.url) {
-    throw new Error("no req.url in authInput.req");
+  let requestUrl;
+  try {
+    requestUrl = new URL(authInput.req.url || "", `http://${authInput.req.headers.host}`);
+  } catch (error) {
+    console.log("** Node URL Error **", error);
+    throw error;
   }
-  const requestUrl = new URL(authInput.req.url, authInput.req.headers.host);
   const headers = authInput.req.headers;
   const secretKey = getHeader(headers, "x-secret-key");
   // prefer clientId that is explicitly passed in
@@ -93,7 +96,9 @@ function extractAuthorizationData(authInput) {
     secretKey,
     clientId,
     origin,
-    bundleId
+    bundleId,
+    targetAddress: authInput.targetAddress,
+    enforceAuth: authInput.enforcedAuth
   };
 }
 function hashSecretKey(secretKey) {

package/node/dist/thirdweb-dev-service-utils-node.esm.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { a as authorize } from '../../dist/index-1125bae0.esm.js';
+import { a as authorize } from '../../dist/index-e7c3b3be.esm.js';
 export { b as SERVICES, S as SERVICE_DEFINITIONS, a as SERVICE_NAMES, g as getServiceByName } from '../../dist/services-86283509.esm.js';
 
 async function authorizeNode(authInput, serviceConfig) {
@@ -32,10 +32,13 @@ function getHeader(headers, headerName) {
   return header ?? null;
 }
 function extractAuthorizationData(authInput) {
-  if (!authInput.req.url) {
-    throw new Error("no req.url in authInput.req");
+  let requestUrl;
+  try {
+    requestUrl = new URL(authInput.req.url || "", `http://${authInput.req.headers.host}`);
+  } catch (error) {
+    console.log("** Node URL Error **", error);
+    throw error;
   }
-  const requestUrl = new URL(authInput.req.url, authInput.req.headers.host);
   const headers = authInput.req.headers;
   const secretKey = getHeader(headers, "x-secret-key");
   // prefer clientId that is explicitly passed in
@@ -89,7 +92,9 @@ function extractAuthorizationData(authInput) {
     secretKey,
     clientId,
     origin,
-    bundleId
+    bundleId,
+    targetAddress: authInput.targetAddress,
+    enforceAuth: authInput.enforcedAuth
   };
 }
 function hashSecretKey(secretKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thirdweb-dev/service-utils",
-  "version": "0.0.0-dev-b4ddcd1-20230714194904",
+  "version": "0.0.0-dev-11d3fa6-20230714225821",
   "main": "dist/thirdweb-dev-service-utils.cjs.js",
   "module": "dist/thirdweb-dev-service-utils.esm.js",
   "exports": {