@tinycloud/sdk-core 3.0.0-beta.5 → 3.0.0-beta.6

package/dist/delegations/index.cjs

@@ -46,6 +46,7 @@ __export(delegations_exports, {
   MemoryShareCache: () => MemoryShareCache,
   ReceiveOptionsSchema: () => ReceiveOptionsSchema,
   SHARE_DELIVERY_AUTHORIZATION_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
+  SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN,
   SenderShareStore: () => SenderShareStore,
   ShareAccessError: () => ShareAccessError,
   ShareActionSchema: () => ShareActionSchema,
@@ -114,6 +115,7 @@ __export(delegations_exports, {
   validateOwnerSharePolicyRegistrationBytes: () => validateOwnerSharePolicyRegistrationBytes,
   validateReceiveOptions: () => validateReceiveOptions,
   validateShareDeliveryAuthorizationBytes: () => validateShareDeliveryAuthorizationBytes,
+  validateShareDeliveryAuthorizationV3Bytes: () => validateShareDeliveryAuthorizationV3Bytes,
   validateSharingServiceConfig: () => validateSharingServiceConfig,
   verifyBearerEnvelope: () => import_share_sdk2.verifyBearerEnvelope,
   verifyShareCid: () => verifyShareCid,
@@ -1493,13 +1495,13 @@ function canonicalizeRecapCaveats(caveats) {
     }
     if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
     if (typeof value === "object") {
-      const object = value;
-      const prototype = Object.getPrototypeOf(object);
+      const object2 = value;
+      const prototype = Object.getPrototypeOf(object2);
       if (prototype !== Object.prototype && prototype !== null) {
         throw new Error("ReCap caveats must contain only JSON values.");
       }
-      return `{${Object.keys(object).sort().map(
-        (key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`
+      return `{${Object.keys(object2).sort().map(
+        (key) => `${JSON.stringify(key)}:${canonicalize(object2[key])}`
       ).join(",")}}`;
     }
     throw new Error("ReCap caveats must contain only JSON values.");
@@ -2740,8 +2742,8 @@ function canonicalJson(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
   if (typeof value === "object") {
-    const object = value;
-    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
+    const object2 = value;
+    return `{${Object.keys(object2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object2[key])}`).join(",")}}`;
   }
   throw new ShareEnvelopeError("invalid-envelope", "unsupported JSON value");
 }
@@ -4336,8 +4338,8 @@ function canonicalJsonForProof(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJsonForProof).join(",")}]`;
   if (typeof value === "object") {
-    const object = value;
-    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object[key])}`).join(",")}}`;
+    const object2 = value;
+    return `{${Object.keys(object2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object2[key])}`).join(",")}}`;
   }
   throw new ShareAccessError("SHARE_SESSION_INVALID");
 }
@@ -5046,12 +5048,12 @@ var ShareRecipientClient = class {
     this.assertDetachedProof(request.proof);
   }
   parseSessionCapability(value) {
-    const object = this.requireObject(value, "session capability");
-    if (typeof object.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
-    if (!Array.isArray(object.actions) || object.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
-    const resource = this.requireObject(object.resource, "session capability resource");
+    const object2 = this.requireObject(value, "session capability");
+    if (typeof object2.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
+    if (!Array.isArray(object2.actions) || object2.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
+    const resource = this.requireObject(object2.resource, "session capability resource");
     if (resource.kind !== "exact" && resource.kind !== "prefix" || typeof resource.path !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability resource is invalid");
-    return { spaceId: object.spaceId, actions: [...new Set(object.actions)], resource: { kind: resource.kind, path: resource.path } };
+    return { spaceId: object2.spaceId, actions: [...new Set(object2.actions)], resource: { kind: resource.kind, path: resource.path } };
   }
   assertProvidedPolicySession(session, envelope) {
     const sessionExpiry = dateValue(session.expiresAt);
@@ -6805,6 +6807,97 @@ function shareDeliveryTrustedKid(publicKey) {
   return `${did}#${did.slice("did:key:".length)}`;
 }
 
+// src/delegations/share-delivery-v3.ts
+var import_ed255198 = require("@noble/curves/ed25519");
+var SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v3\0";
+var AUTHORIZATION_KEYS2 = [
+  "type",
+  "version",
+  "jti",
+  "shareCid",
+  "shareId",
+  "policyCid",
+  "policyRootCid",
+  "enforcementRootCid",
+  "nodeAudience",
+  "enforcerDid",
+  "targetOrigin",
+  "openCredentialsAudience",
+  "holder",
+  "recipientMatcher",
+  "deliveryEmail",
+  "shareUrl",
+  "returnOrigin",
+  "documentName",
+  "senderDid",
+  "senderTrust",
+  "contentSource",
+  "contentSourceDigestHex",
+  "shareExpiresAt",
+  "issuedAt",
+  "reportAbuseToken",
+  "actions",
+  "resource",
+  "requestBodyDigest",
+  "idempotencyKey",
+  "expiresAt",
+  "dataAuthority"
+];
+function exactObject(value, keys, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
+  const record = value;
+  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
+  return record;
+}
+function decodeBase64Url2(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
+  if (typeof atob === "function") {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+  }
+  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
+  throw new Error("base64url decoding is unavailable");
+}
+function object(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
+  return value;
+}
+function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
+  } catch {
+    throw new Error("v3 share delivery response is not valid UTF-8 JSON");
+  }
+  const root = exactObject(parsed, ["authorization", "proof"], "v3 share delivery response");
+  const authorization = exactObject(root.authorization, AUTHORIZATION_KEYS2, "v3 share delivery authorization");
+  const proof = exactObject(root.proof, ["alg", "kid", "signature"], "v3 share delivery proof");
+  const envelope = object(expected.request.envelope, "v3 share envelope");
+  const policyRoot = object(envelope.policyRoot, "v3 policy root");
+  const enforcementRoot = object(envelope.enforcementRoot, "v3 enforcement root");
+  const target = object(envelope.target, "v3 target");
+  const display = object(envelope.display, "v3 display");
+  const resource = object(envelope.resource, "v3 resource");
+  const envelopeSignature = object(envelope.signature, "v3 envelope signature");
+  const shareUrl = new URL(expected.request.shareUrl);
+  const targetOrigin = String(target.origin);
+  const targetUrl = new URL(targetOrigin);
+  const targetHost = targetUrl.hostname;
+  const expectedNodeAudience = `did:web:${targetHost}`;
+  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 3 || authorization.dataAuthority !== false || authorization.jti !== expected.request.jti || authorization.shareCid !== expected.request.shareCid || authorization.shareId !== envelope.shareId || authorization.policyCid !== envelope.policyCid || authorization.policyRootCid !== policyRoot.cid || authorization.enforcementRootCid !== enforcementRoot.cid || authorization.enforcerDid !== target.nodeAudience || authorization.targetOrigin !== target.origin || authorization.nodeAudience !== expectedNodeAudience || expected.nodeProof.kid.split("#", 1)[0] !== expectedNodeAudience || authorization.recipientMatcher === void 0 || canonicalizeSignedObjectUnsigned(authorization.recipientMatcher) !== canonicalizeSignedObjectUnsigned(envelope.recipientMatcher) || canonicalizeSignedObjectUnsigned(authorization.contentSource) !== canonicalizeSignedObjectUnsigned(envelope.contentSource) || authorization.contentSourceDigestHex !== envelope.contentSourceDigestHex || authorization.deliveryEmail !== expected.request.recipientEmail || authorization.shareUrl !== expected.request.shareUrl || authorization.documentName !== expected.request.documentName || authorization.documentName !== display.filename || authorization.senderDid !== envelopeSignature.signerDid || authorization.senderTrust !== "verified" || canonicalizeSignedObjectUnsigned(authorization.actions) !== canonicalizeSignedObjectUnsigned(envelope.actions) || authorization.resource !== resource.path || authorization.shareExpiresAt !== envelope.expiry || authorization.requestBodyDigest !== expected.request.requestBodyDigest || authorization.expiresAt !== expected.request.expiresAt || authorization.idempotencyKey !== expected.request.jti || authorization.reportAbuseToken !== expected.request.jti || authorization.returnOrigin !== shareUrl.origin || shareUrl.pathname !== `/s/${authorization.shareCid}` || shareUrl.hash !== `#k=${expected.request.envelopeKey}` || targetUrl.protocol !== "https:" || shareUrl.protocol !== "https:") throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  if (typeof authorization.openCredentialsAudience !== "string" || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) throw new Error("v3 share delivery credentials audience is untrusted");
+  if (proof.alg !== "EdDSA" || proof.kid !== expected.nodeProof.kid || typeof proof.signature !== "string") throw new Error("v3 share delivery proof is invalid");
+  const issuedAt = Date.parse(String(authorization.issuedAt));
+  const expiresAt = Date.parse(String(authorization.expiresAt));
+  const shareExpiresAt = Date.parse(String(authorization.shareExpiresAt));
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || !Number.isFinite(shareExpiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 5 * 6e4 || shareExpiresAt <= issuedAt || typeof authorization.holder !== "string" || !authorization.holder.startsWith("did:")) throw new Error("v3 share delivery authorization time or holder is invalid");
+  const publicKey = expected.nodeProof.publicKey.length === 34 ? expected.nodeProof.publicKey.slice(2) : expected.nodeProof.publicKey;
+  const signature = decodeBase64Url2(proof.signature);
+  const signed = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
+  if (publicKey.length !== 32 || signature.length !== 64 || !import_ed255198.ed25519.verify(signature, signed, publicKey)) throw new Error("v3 share delivery proof signature is invalid");
+  return { authorization, proof };
+}
+
 // src/delegations/sender-share-store.ts
 var MemorySenderShareRecordStorage = class {
   constructor() {