@tinycloud/sdk-core 3.10.0 → 3.11.0-beta.0

package/dist/index.cjs

@@ -288,6 +288,7 @@ __export(index_exports, {
   canonicalizeSecretScope: () => import_sdk_services10.canonicalizeSecretScope,
   canonicalizeSignedObjectUnsigned: () => canonicalizeSignedObjectUnsigned,
   canonicalizeUnifiedPolicyCapability: () => canonicalizeUnifiedPolicyCapability,
+  checkChangedExpiration: () => checkChangedExpiration,
   checkDecryptInvocationInput: () => import_sdk_services10.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
   classifyRegistryLookup: () => classifyRegistryLookup,
@@ -16679,7 +16680,7 @@ function diffImmutableSiweFields(original, signed, options2) {
     "requestId",
     "nonRecapResources"
   ];
-  const keys = options2?.originalHasRecap ? baseKeys : [...baseKeys, "statement"];
+  const keys = (options2?.originalHasRecap ? baseKeys : [...baseKeys, "statement"]).filter((key) => !(options2?.allowExpirationChange === true && key === "expirationTime"));
   const diffs = [];
   for (const key of keys) {
     const a = original[key] ?? "";
@@ -16690,6 +16691,62 @@ function diffImmutableSiweFields(original, signed, options2) {
   }
   return diffs;
 }
+var CHANGED_EXPIRY_MIN_REMAINING_MS = 6e4;
+var ISO_INSTANT = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+function parseInstantMs(value) {
+  const match = value === void 0 ? null : ISO_INSTANT.exec(value);
+  if (!match || value === void 0) return void 0;
+  const [year, month, day] = [Number(match[1]), Number(match[2]), Number(match[3])];
+  if (new Date(Date.UTC(year, month - 1, day)).getUTCDate() !== day) return void 0;
+  const ms2 = Date.parse(value);
+  return Number.isFinite(ms2) ? ms2 : void 0;
+}
+var EXPIRATION_LINE = /^Expiration Time:/;
+function hasCanonicalExpirationLine(siwe) {
+  if (siwe.includes("\r")) return false;
+  const lines = siwe.split("\n");
+  const index = lines.findIndex((line) => EXPIRATION_LINE.test(line));
+  if (index < 0 || !/^Expiration Time: \S+$/.test(lines[index])) return false;
+  const resources = lines.indexOf("Resources:", 4);
+  return resources < 0 || index < resources;
+}
+function checkChangedExpiration(input) {
+  const nowMs = input.now instanceof Date ? input.now.getTime() : input.now;
+  if (!Number.isFinite(nowMs)) return "expiry check needs a finite current time";
+  const maxMs = input.maxExpiresAt === void 0 ? void 0 : input.maxExpiresAt instanceof Date ? input.maxExpiresAt.getTime() : input.maxExpiresAt;
+  if (maxMs !== void 0 && !Number.isFinite(new Date(maxMs).getTime())) return "expiry check needs a finite maximum";
+  const originalHasRecap = input.originalHasRecap ?? /(?:^|\n)-\s+urn:recap:/i.test(input.preparedSiwe);
+  const countLines = (siwe) => siwe.split(/\r?\n/).filter((line) => EXPIRATION_LINE.test(line)).length;
+  if (countLines(input.preparedSiwe) !== 1 || countLines(input.signedSiwe) !== 1) {
+    return "expiry check needs exactly one Expiration Time line in both messages";
+  }
+  if (!hasCanonicalExpirationLine(input.signedSiwe)) {
+    return "the Expiration Time line is not in canonical SIWE form";
+  }
+  const prepared = extractImmutableSiweFields(input.preparedSiwe);
+  const signed = extractImmutableSiweFields(input.signedSiwe);
+  const drift = diffImmutableSiweFields(prepared, signed, { originalHasRecap, allowExpirationChange: true });
+  if (drift.length > 0) return `altered immutable SIWE fields: ${drift.join(", ")}`;
+  if (signed.expirationTime === prepared.expirationTime) return null;
+  const expiresAt = parseInstantMs(signed.expirationTime);
+  if (expiresAt === void 0) return "expiry is not a valid timestamp";
+  if (expiresAt <= nowMs + CHANGED_EXPIRY_MIN_REMAINING_MS) {
+    return "expiry must be more than 60 seconds from now; choose a longer expiry";
+  }
+  for (const [label, value] of [["Issued At", prepared.issuedAt], ["Not Before", prepared.notBefore]]) {
+    if (value === void 0 || value === "") continue;
+    const bound = parseInstantMs(value);
+    if (bound === void 0) return `${label} is not a valid timestamp`;
+    if (expiresAt <= bound) return `expiry must be after ${label}; choose a later expiry`;
+  }
+  if (maxMs !== void 0 && expiresAt > maxMs) {
+    return `expiry is later than the maximum for this request (the latest allowed is ${new Date(maxMs).toISOString()}); choose an earlier expiry`;
+  }
+  if (expiresAt > nowMs + EXPIRY.MAX_MS) {
+    return "expiry is more than 10 years away, the longest this SDK accepts; choose a shorter expiry";
+  }
+  return null;
+}
 function extractRecapAttenuations(siwe) {
   const merged = {};
   const lines = siwe.split(/\r?\n/);