@travelclw/proof-protocol 0.1.2 → 0.2.0

package/core.js

@@ -1,219 +1,221 @@
-'use strict'
-
-const REQUEST_PROOF_HEADER = 'x-ctx-proof'
-const AUTH_CENTER_PROOF_AUDIENCE = 'auth-center'
-const ODM_REQUEST_PROOF_AUDIENCE = 'uweb-odm'
-const DEFAULT_REQUEST_PROOF_TIME_TOLERANCE_SECONDS = 2 * 60 * 60
-
-const REQUEST_PROOF_ERROR_CODES = Object.freeze({
-  timeMismatch: 'E4601',
-  requestExpired: 'E4602',
-  requestUnverifiable: 'E4603',
-  sessionMismatch: 'E4604',
-  requestInvalid: 'E4605',
-  serviceUnavailable: 'E503',
-})
-
-class RequestProofValidationError extends Error {
-  constructor(code) {
-    super(code)
-    this.name = 'RequestProofValidationError'
-    this.code = code
-  }
-}
-
-const compareText = (left, right) => (left < right ? -1 : left > right ? 1 : 0)
-
-const normalizePath = value => {
-  const rawValue = String(value || '').trim()
-  if (!rawValue) return ''
-
-  let path = rawValue
-  if (/^[a-z][a-z\d+.-]*:\/\//i.test(rawValue)) {
-    try {
-      path = new URL(rawValue).pathname
-    } catch {
-      return ''
-    }
-  }
-
-  const withoutQuery = path.split(/[?#]/)[0]
-  const withLeadingSlash = withoutQuery.startsWith('/') ? withoutQuery : `/${withoutQuery}`
-  return withLeadingSlash.replace(/\/{2,}/g, '/') || '/'
-}
-
-const canonicalizeQuery = value => {
-  const rawValue = String(value || '').trim()
-  if (!rawValue) return ''
-
-  let query = ''
-  if (/^[a-z][a-z\d+.-]*:\/\//i.test(rawValue)) {
-    try {
-      query = new URL(rawValue).search.slice(1)
-    } catch {
-      return ''
-    }
-  } else {
-    const withoutFragment = rawValue.split('#')[0]
-    const queryIndex = withoutFragment.indexOf('?')
-    query = queryIndex >= 0 ? withoutFragment.slice(queryIndex + 1) : ''
-  }
-
-  return Array.from(new URLSearchParams(query).entries())
-    .sort(([leftKey, leftValue], [rightKey, rightValue]) => {
-      const keyResult = compareText(leftKey, rightKey)
-      return keyResult || compareText(leftValue, rightValue)
-    })
-    .map(([key, entryValue]) => `${encodeURIComponent(key)}=${encodeURIComponent(entryValue)}`)
-    .join('&')
-}
-
-const normalizeJsonValue = value => {
-  if (value === null) return null
-  if (Array.isArray(value)) {
-    return value.map(item =>
-      item === undefined || typeof item === 'function' || typeof item === 'symbol'
-        ? null
-        : normalizeJsonValue(item),
-    )
-  }
-  if (typeof value === 'number') return Number.isFinite(value) ? value : null
-  if (typeof value !== 'object') return value
-  if (typeof value.toJSON === 'function') return normalizeJsonValue(value.toJSON())
-
-  return Object.keys(value)
-    .sort(compareText)
-    .reduce((result, key) => {
-      const item = value[key]
-      if (item !== undefined && typeof item !== 'function' && typeof item !== 'symbol') {
-        result[key] = normalizeJsonValue(item)
-      }
-      return result
-    }, {})
-}
-
-const stableJson = value => JSON.stringify(normalizeJsonValue(value)) || ''
-
-const formEntriesToObject = entries => {
-  const result = {}
-  for (const [key, value] of entries) {
-    const current = result[key]
-    result[key] =
-      current === undefined
-        ? value
-        : Array.isArray(current)
-          ? [...current, value]
-          : [current, value]
-  }
-  return result
-}
-
-const isBinaryBody = body => {
-  if (typeof Buffer !== 'undefined' && typeof Buffer.isBuffer === 'function' && Buffer.isBuffer(body)) {
-    return true
-  }
-  if (typeof Blob !== 'undefined' && body instanceof Blob) return true
-  if (typeof ArrayBuffer !== 'undefined') {
-    return body instanceof ArrayBuffer || ArrayBuffer.isView(body)
-  }
-  return false
-}
-
-const canonicalizeBody = (body, contentType, hasBody) => {
-  const normalizedContentType = String(contentType || '').toLowerCase()
-  if (hasBody === false) return 'none'
-  if (normalizedContentType.includes('multipart/form-data')) return 'multipart'
-  if (typeof FormData !== 'undefined' && body instanceof FormData) return 'multipart'
-  if (body === undefined || body === null || body === '') return 'none'
-  if (isBinaryBody(body)) return 'binary'
-  if (typeof URLSearchParams !== 'undefined' && body instanceof URLSearchParams) {
-    return `form:${stableJson(formEntriesToObject(body.entries()))}`
-  }
-  if (typeof body === 'string') {
-    if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
-      return `form:${stableJson(formEntriesToObject(new URLSearchParams(body).entries()))}`
-    }
-    if (normalizedContentType.includes('json')) {
-      try {
-        return `json:${stableJson(JSON.parse(body))}`
-      } catch {
-        return `text:${body}`
-      }
-    }
-    return `text:${body}`
-  }
-  if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
-    return `form:${stableJson(body)}`
-  }
-  return `json:${stableJson(body)}`
-}
-
-const isRequestProofRequired = value => String(value ?? '').trim() !== '0'
-
-const normalizeProofMode = value => {
-  const mode = String(value ?? '').trim().toLowerCase()
-  if (mode === '0' || mode === 'off') return 'off'
-  if (mode === '1' || mode === 'shadow') return 'shadow'
-  return 'enforce'
-}
-
-const isRequestProofSetupError = error => {
-  const message = error instanceof Error ? error.message : String(error || '')
-  return /^request_proof_(?:unsupported|storage_unsupported|storage_failed|read_failed|write_failed|reset_failed|sign_failed)$/.test(
-    message,
-  )
-}
-
-const getRequestProofErrorCode = reason => {
-  if (reason === 'proof_expired') return REQUEST_PROOF_ERROR_CODES.timeMismatch
-  if (reason === 'proof_replayed') return REQUEST_PROOF_ERROR_CODES.requestExpired
-  if (
-    [
-      'missing_proof',
-      'missing_proof_binding',
-      'missing_bound_proof',
-      'missing_sso_source_proof',
-      'invalid_proof_key',
-    ].includes(reason)
-  ) {
-    return REQUEST_PROOF_ERROR_CODES.requestUnverifiable
-  }
-  if (
-    [
-      'missing_user',
-      'missing_token',
-      'missing_device_cookie',
-      'missing_binding',
-      'missing_session_context',
-      'token_mismatch',
-      'session_mismatch',
-      'session_id_mismatch',
-      'missing_sso_source_binding',
-      'sso_source_device_mismatch',
-    ].includes(reason)
-  ) {
-    return REQUEST_PROOF_ERROR_CODES.sessionMismatch
-  }
-  if (reason === 'missing_device_secret' || reason === 'verification_failed') {
-    return REQUEST_PROOF_ERROR_CODES.serviceUnavailable
-  }
-  return REQUEST_PROOF_ERROR_CODES.requestInvalid
-}
-
-module.exports = {
-  AUTH_CENTER_PROOF_AUDIENCE,
-  DEFAULT_REQUEST_PROOF_TIME_TOLERANCE_SECONDS,
-  ODM_REQUEST_PROOF_AUDIENCE,
-  REQUEST_PROOF_ERROR_CODES,
-  REQUEST_PROOF_HEADER,
-  RequestProofValidationError,
-  canonicalizeBody,
-  canonicalizeQuery,
-  getRequestProofErrorCode,
-  isRequestProofRequired,
-  isRequestProofSetupError,
-  normalizeJsonValue,
-  normalizePath,
-  normalizeProofMode,
-  stableJson,
-}
+'use strict'
+
+const REQUEST_PROOF_HEADER = 'x-ctx-proof'
+const AUTH_CENTER_PROOF_AUDIENCE = 'auth-center'
+const ODM_REQUEST_PROOF_AUDIENCE = 'uweb-odm'
+const DEFAULT_REQUEST_PROOF_TIME_TOLERANCE_SECONDS = 2 * 60 * 60
+
+const REQUEST_PROOF_ERROR_CODES = Object.freeze({
+  timeMismatch: 'E4601',
+  requestExpired: 'E4602',
+  requestUnverifiable: 'E4603',
+  sessionMismatch: 'E4604',
+  requestInvalid: 'E4605',
+  serviceUnavailable: 'E503',
+})
+
+class RequestProofValidationError extends Error {
+  constructor(code) {
+    super(code)
+    this.name = 'RequestProofValidationError'
+    this.code = code
+  }
+}
+
+const compareText = (left, right) => (left < right ? -1 : left > right ? 1 : 0)
+
+const normalizePath = value => {
+  const rawValue = String(value || '').trim()
+  if (!rawValue) return ''
+
+  let path = rawValue
+  if (/^[a-z][a-z\d+.-]*:\/\//i.test(rawValue)) {
+    try {
+      path = new URL(rawValue).pathname
+    } catch {
+      return ''
+    }
+  }
+
+  const withoutQuery = path.split(/[?#]/)[0]
+  const withLeadingSlash = withoutQuery.startsWith('/') ? withoutQuery : `/${withoutQuery}`
+  return withLeadingSlash.replace(/\/{2,}/g, '/') || '/'
+}
+
+const canonicalizeQuery = value => {
+  const rawValue = String(value || '').trim()
+  if (!rawValue) return ''
+
+  let query = ''
+  if (/^[a-z][a-z\d+.-]*:\/\//i.test(rawValue)) {
+    try {
+      query = new URL(rawValue).search.slice(1)
+    } catch {
+      return ''
+    }
+  } else {
+    const withoutFragment = rawValue.split('#')[0]
+    const queryIndex = withoutFragment.indexOf('?')
+    query = queryIndex >= 0 ? withoutFragment.slice(queryIndex + 1) : ''
+  }
+
+  return Array.from(new URLSearchParams(query).entries())
+    .sort(([leftKey, leftValue], [rightKey, rightValue]) => {
+      const keyResult = compareText(leftKey, rightKey)
+      return keyResult || compareText(leftValue, rightValue)
+    })
+    .map(([key, entryValue]) => `${encodeURIComponent(key)}=${encodeURIComponent(entryValue)}`)
+    .join('&')
+}
+
+const normalizeJsonValue = value => {
+  if (value === null) return null
+  if (Array.isArray(value)) {
+    return value.map(item =>
+      item === undefined || typeof item === 'function' || typeof item === 'symbol'
+        ? null
+        : normalizeJsonValue(item),
+    )
+  }
+  if (typeof value === 'number') return Number.isFinite(value) ? value : null
+  if (typeof value !== 'object') return value
+  if (typeof value.toJSON === 'function') return normalizeJsonValue(value.toJSON())
+
+  return Object.keys(value)
+    .sort(compareText)
+    .reduce((result, key) => {
+      const item = value[key]
+      if (item !== undefined && typeof item !== 'function' && typeof item !== 'symbol') {
+        result[key] = normalizeJsonValue(item)
+      }
+      return result
+    }, {})
+}
+
+const stableJson = value => JSON.stringify(normalizeJsonValue(value)) || ''
+
+const formEntriesToObject = entries => {
+  const result = {}
+  for (const [key, value] of entries) {
+    const current = result[key]
+    result[key] =
+      current === undefined
+        ? value
+        : Array.isArray(current)
+          ? [...current, value]
+          : [current, value]
+  }
+  return result
+}
+
+const isBinaryBody = body => {
+  if (typeof Buffer !== 'undefined' && typeof Buffer.isBuffer === 'function' && Buffer.isBuffer(body)) {
+    return true
+  }
+  if (typeof Blob !== 'undefined' && body instanceof Blob) return true
+  if (typeof ArrayBuffer !== 'undefined') {
+    return body instanceof ArrayBuffer || ArrayBuffer.isView(body)
+  }
+  return false
+}
+
+const canonicalizeBody = (body, contentType, hasBody) => {
+  const normalizedContentType = String(contentType || '').toLowerCase()
+  if (hasBody === false) return 'none'
+  if (normalizedContentType.includes('multipart/form-data')) return 'multipart'
+  if (typeof FormData !== 'undefined' && body instanceof FormData) return 'multipart'
+  if (body === undefined || body === null || body === '') return 'none'
+  if (isBinaryBody(body)) return 'binary'
+  if (typeof URLSearchParams !== 'undefined' && body instanceof URLSearchParams) {
+    return `form:${stableJson(formEntriesToObject(body.entries()))}`
+  }
+  if (typeof body === 'string') {
+    if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
+      return `form:${stableJson(formEntriesToObject(new URLSearchParams(body).entries()))}`
+    }
+    if (normalizedContentType.includes('json')) {
+      try {
+        return `json:${stableJson(JSON.parse(body))}`
+      } catch {
+        return `text:${body}`
+      }
+    }
+    return `text:${body}`
+  }
+  if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
+    return `form:${stableJson(body)}`
+  }
+  return `json:${stableJson(body)}`
+}
+
+const isRequestProofRequired = value => String(value ?? '').trim() !== '0'
+
+const normalizeProofMode = value => {
+  const mode = String(value ?? '').trim().toLowerCase()
+  if (mode === '0' || mode === 'off') return 'off'
+  if (mode === '1' || mode === 'shadow') return 'shadow'
+  return 'enforce'
+}
+
+const isRequestProofSetupError = error => {
+  const message = error instanceof Error ? error.message : String(error || '')
+  return /^request_proof_(?:unsupported|storage_unsupported|storage_failed|read_failed|write_failed|reset_failed|sign_failed|key_missing|key_changed|session_missing|context_invalid)$/.test(
+    message,
+  )
+}
+
+const getRequestProofErrorCode = reason => {
+  if (reason === 'proof_expired') return REQUEST_PROOF_ERROR_CODES.timeMismatch
+  if (reason === 'proof_replayed') return REQUEST_PROOF_ERROR_CODES.requestExpired
+  if (
+    [
+      'missing_proof',
+      'missing_proof_binding',
+      'missing_bound_proof',
+      'missing_sso_source_proof',
+      'invalid_proof_key',
+    ].includes(reason)
+  ) {
+    return REQUEST_PROOF_ERROR_CODES.requestUnverifiable
+  }
+  if (
+    [
+      'missing_user',
+      'missing_token',
+      'missing_device_cookie',
+      'missing_binding',
+      'missing_session_context',
+      'proof_session_mismatch',
+      'proof_target_mismatch',
+      'token_mismatch',
+      'session_mismatch',
+      'session_id_mismatch',
+      'missing_sso_source_binding',
+      'sso_source_device_mismatch',
+    ].includes(reason)
+  ) {
+    return REQUEST_PROOF_ERROR_CODES.sessionMismatch
+  }
+  if (reason === 'missing_device_secret' || reason === 'verification_failed') {
+    return REQUEST_PROOF_ERROR_CODES.serviceUnavailable
+  }
+  return REQUEST_PROOF_ERROR_CODES.requestInvalid
+}
+
+module.exports = {
+  AUTH_CENTER_PROOF_AUDIENCE,
+  DEFAULT_REQUEST_PROOF_TIME_TOLERANCE_SECONDS,
+  ODM_REQUEST_PROOF_AUDIENCE,
+  REQUEST_PROOF_ERROR_CODES,
+  REQUEST_PROOF_HEADER,
+  RequestProofValidationError,
+  canonicalizeBody,
+  canonicalizeQuery,
+  getRequestProofErrorCode,
+  isRequestProofRequired,
+  isRequestProofSetupError,
+  normalizeJsonValue,
+  normalizePath,
+  normalizeProofMode,
+  stableJson,
+}

package/node.d.ts

@@ -1,76 +1,80 @@
-export type RequestProofPublicKey = {
-  kty: 'EC'
-  crv: 'P-256'
-  x: string
-  y: string
-}
-
-export type NormalizedRequestProofKey = {
-  keyId: string
-  publicKey: RequestProofPublicKey
-}
-
-export type RequestProofTimeWarning = {
-  reason: 'proof_expired'
-  issuedAt: number | null
-  serverNow: number
-  diffSeconds: number | null
-  toleranceSeconds: number
-}
-
-export type VerifyRequestProofOptions = {
-  proof: string
-  publicKey: RequestProofPublicKey
-  keyId: string
-  token: string
-  method: string
-  path: string
-  audience: string
-  timeToleranceSeconds?: number
-  body?: unknown
-  contentType?: unknown
-  hasBody?: boolean
-  requestId?: unknown
-  requireRequestBindings?: boolean
-}
-
-export type ProofServerMode = 'off' | 'shadow' | 'enforce'
-
-export type ProofServerConfig = {
-  mode: ProofServerMode
-  deviceSessionSecret: string
-  deviceSessionTtlSeconds: number
-  timeToleranceSeconds: number
-}
-
-export const REQUEST_PROOF_REASON_TEXT: Readonly<Record<string, string>>
-export function getRequestProofReasonText(reason: string): string
-
-export function hasTransferredRequestBody(options: {
-  body?: unknown
-  contentLength?: unknown
-  transferEncoding?: unknown
-}): boolean
-export function calculateRequestProofBindings(options: {
-  path: unknown
-  body?: unknown
-  contentType?: unknown
-  hasBody?: boolean
-  requestId?: unknown
-}): { qsh: string; bth: string; rid: string }
-export function normalizeRequestProofKey(value: unknown): Promise<NormalizedRequestProofKey | null>
-export function getRequestProofKeyId(proofValue: string): string
-export function verifyRequestProof(options: VerifyRequestProofOptions): Promise<{
-  jti: string
-  timeWarning: RequestProofTimeWarning | null
-}>
-export function normalizeProofMode(value: unknown): ProofServerMode
-export function resolveProofServerConfig(options?: {
-  env?: Record<string, string | undefined>
-  mode?: string | number
-  deviceSessionSecret?: string
-  deviceSessionTtlSeconds?: number
-  timeToleranceSeconds?: number
-}): ProofServerConfig
-
-export { RequestProofValidationError } from './core'
+export type RequestProofPublicKey = {
+  kty: 'EC'
+  crv: 'P-256'
+  x: string
+  y: string
+}
+
+export type NormalizedRequestProofKey = {
+  keyId: string
+  publicKey: RequestProofPublicKey
+}
+
+export type RequestProofTimeWarning = {
+  reason: 'proof_expired'
+  issuedAt: number | null
+  serverNow: number
+  diffSeconds: number | null
+  toleranceSeconds: number
+}
+
+export function deriveProofSessionId(sessionId: string): string
+
+export type VerifyRequestProofOptions = {
+  purpose?: 'session' | 'ticket'
+  sessionId?: string
+  proof: string
+  publicKey: RequestProofPublicKey
+  keyId: string
+  token: string
+  method: string
+  path: string
+  audience: string
+  timeToleranceSeconds?: number
+  body?: unknown
+  contentType?: unknown
+  hasBody?: boolean
+  requestId?: unknown
+  requireRequestBindings?: boolean
+}
+
+export type ProofServerMode = 'off' | 'shadow' | 'enforce'
+
+export type ProofServerConfig = {
+  mode: ProofServerMode
+  deviceSessionSecret: string
+  deviceSessionTtlSeconds: number
+  timeToleranceSeconds: number
+}
+
+export const REQUEST_PROOF_REASON_TEXT: Readonly<Record<string, string>>
+export function getRequestProofReasonText(reason: string): string
+
+export function hasTransferredRequestBody(options: {
+  body?: unknown
+  contentLength?: unknown
+  transferEncoding?: unknown
+}): boolean
+export function calculateRequestProofBindings(options: {
+  path: unknown
+  body?: unknown
+  contentType?: unknown
+  hasBody?: boolean
+  requestId?: unknown
+}): { qsh: string; bth: string; rid: string }
+export function normalizeRequestProofKey(value: unknown): Promise<NormalizedRequestProofKey | null>
+export function getRequestProofKeyId(proofValue: string): string
+export function verifyRequestProof(options: VerifyRequestProofOptions): Promise<{
+  jti: string
+  timeWarning: RequestProofTimeWarning | null
+}>
+export function normalizeProofMode(value: unknown): ProofServerMode
+export function resolveProofServerConfig(options?: {
+  env?: Record<string, string | undefined>
+  mode?: string | number
+  deviceSessionSecret?: string
+  deviceSessionTtlSeconds?: number
+  timeToleranceSeconds?: number
+}): ProofServerConfig
+
+export { RequestProofValidationError } from './core'

package/package.json

@@ -1,18 +1,9 @@
 {
   "name": "@travelclw/proof-protocol",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Framework-independent browser and Node.js request Proof protocol",
   "license": "MIT",
   "author": "travelclw",
-  "repository": {
-    "type": "git",
-    "url": "git+https://gitee.com/bubbles_4/travelclw.git",
-    "directory": "packages/proof-protocol"
-  },
-  "homepage": "https://gitee.com/bubbles_4/travelclw/tree/main/packages/proof-protocol#readme",
-  "bugs": {
-    "url": "https://gitee.com/bubbles_4/travelclw/issues"
-  },
   "keywords": [
     "proof-of-possession",
     "request-signing",