@tinycloud/sdk-services 2.3.0-beta.2 → 2.3.0-beta.5

package/dist/encryption/index.js

@@ -387,6 +387,7 @@ function canonicalHashHex(sha256, value) {
 // src/encryption/networkId.ts
 var URN_PREFIX = "urn:tinycloud:encryption:";
 var NETWORK_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+var PKH_EIP155_DID_RE = /^did:pkh:eip155:(\d+):(0x[a-fA-F0-9]{40})$/;
 var NetworkIdError = class extends Error {
   constructor(message) {
     super(message);
@@ -453,6 +454,22 @@ function isNetworkId(networkId) {
     return false;
   }
 }
+function parsePkhOwnerDid(ownerDid) {
+  const match = ownerDid.match(PKH_EIP155_DID_RE);
+  if (!match) return null;
+  return {
+    chainId: match[1],
+    address: match[2].toLowerCase()
+  };
+}
+function ownerDidMatches(a, b) {
+  const aPkh = parsePkhOwnerDid(a);
+  const bPkh = parsePkhOwnerDid(b);
+  if (aPkh && bPkh) {
+    return aPkh.chainId === bPkh.chainId && aPkh.address === bPkh.address;
+  }
+  return a === b;
+}
 function networkDiscoveryKey(name) {
   if (!NETWORK_NAME_RE.test(name)) {
     throw new NetworkIdError(
@@ -588,7 +605,19 @@ async function discoverNetwork(input) {
   };
 }
 function validateDescriptor(descriptor, networkId, ownerDid, name) {
-  if (descriptor.networkId !== networkId) {
+  let descriptorNetwork;
+  try {
+    descriptorNetwork = parseNetworkId(descriptor.networkId);
+  } catch (err2) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_NETWORK_ID",
+        message: `descriptor networkId is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
+      })
+    };
+  }
+  if (descriptorNetwork.name !== name || !ownerDidMatches(descriptorNetwork.ownerDid, ownerDid)) {
     return {
       ok: false,
       error: encryptionError({
@@ -597,7 +626,8 @@ function validateDescriptor(descriptor, networkId, ownerDid, name) {
       })
     };
   }
-  if (descriptor.ownerDid !== ownerDid) {
+  const descriptorOwnerDid = descriptorOwner(descriptor);
+  if (descriptorOwnerDid === void 0 || !ownerDidMatches(descriptorOwnerDid, ownerDid) || !ownerDidMatches(descriptorOwnerDid, descriptorNetwork.ownerDid)) {
     return {
       ok: false,
       error: encryptionError({
@@ -624,7 +654,20 @@ function validateDescriptor(descriptor, networkId, ownerDid, name) {
       })
     };
   }
-  return { ok: true, data: descriptor };
+  return {
+    ok: true,
+    data: {
+      ...descriptor,
+      ownerDid: descriptorOwnerDid
+    }
+  };
+}
+function descriptorOwner(descriptor) {
+  if (typeof descriptor.ownerDid === "string" && descriptor.ownerDid.length > 0) {
+    return descriptor.ownerDid;
+  }
+  const legacyDescriptor = descriptor;
+  return typeof legacyDescriptor.principal === "string" && legacyDescriptor.principal.length > 0 ? legacyDescriptor.principal : void 0;
 }
 function ensureNetworkUsableForDecrypt(descriptor) {
   if (descriptor.state === "active" || descriptor.state === "rotating") {