@truly-you/trulyyou-web-sdk 0.1.24 → 0.1.26

package/index.js

@@ -0,0 +1,691 @@
+/**
+ * TrulyYou SDK - Strong Customer Authentication
+ * Embed via: <script src="https://your-domain.com/truly-you-sdk.js"></script>
+ */
+
+(function(window) {
+  'use strict';
+
+  class TrulyYouSDK {
+    constructor(config = {}) {
+      this.appId = config.appId;
+      this.mode = config.mode || 'visible'; // 'visible' or 'hidden'
+      this.authUrl = config.authUrl || window.location.origin + '/auth.html';
+      this.apiUrl = config.apiUrl || window.location.origin; // Base URL for TrulyYou API
+      this.targetElement = config.targetElement || null; // Element to render iframe in for visible mode
+      this.mockMobile = config.mockMobile || false; // Force mobile UI (for testing desktop-to-mobile handoff)
+      this.pendingRequests = new Map();
+
+      if (!this.appId) {
+        throw new Error('TrulyYou SDK: appId is required');
+      }
+
+      // Listen for auth responses
+      window.addEventListener('message', this._handleAuthResponse.bind(this));
+    }
+
+/**
+     * Fetch with TrulyYou signature
+     * @param {string} url - URL to fetch
+     * @param {Object} options - Fetch options
+     * @returns {Promise<Response>} - Fetch response with signature
+     */
+    async fetchWithSignature(url, options = {}) {
+      const requestId = this._generateRequestId();
+      const method = options.method || 'GET';
+      const body = options.body || null;
+
+      // Parse URL to get path
+      let path;
+      try {
+        const urlObj = new URL(url, window.location.origin);
+        path = urlObj.pathname;
+      } catch (e) {
+        path = url;
+      }
+
+      // Create session - this evaluates rules and returns everything we need
+      // Also discovers/creates the path (origin → endpoint → backend)
+      let sessionData = null;
+      try {
+        // Determine the actual backend URL
+        // - If URL is absolute (starts with http), extract the host from it
+        // - If URL is relative, the backend is this.apiUrl (where the request will actually go)
+        let backendUrl;
+        if (url.startsWith('http://') || url.startsWith('https://')) {
+          // Absolute URL - extract the backend from the URL itself
+          try {
+            const targetUrl = new URL(url);
+            backendUrl = `${targetUrl.protocol}//${targetUrl.host}`;
+          } catch (e) {
+            backendUrl = this.apiUrl || window.location.origin;
+          }
+        } else {
+          // Relative URL - the backend is apiUrl (where we'll prepend the path)
+          backendUrl = this.apiUrl || window.location.origin;
+        }
+        
+        const sessionRes = await fetch(`${this.apiUrl || window.location.origin}/api/sessions`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            appId: this.appId,
+            requestId,
+            url: path,
+            method,
+            requestBody: body,
+            // Origin info for path discovery
+            originType: 'web',
+            webOrigin: window.location.origin,
+            backendUrl
+          })
+        });
+        if (sessionRes.ok) {
+          sessionData = await sessionRes.json();
+          
+          // Check path status - if not active, show error to developer
+          if (sessionData.path) {
+            if (sessionData.path.status !== 'active') {
+              const pathDesc = `${sessionData.path.origin?.value} → ${sessionData.path.endpoint?.method} ${sessionData.path.endpoint?.path} → ${sessionData.path.backend?.baseUrl}`;
+              console.warn(`TrulyYou SDK: Path is not active (status: ${sessionData.path.status})`);
+              console.warn(`TrulyYou SDK: Path: ${pathDesc}`);
+              console.warn('TrulyYou SDK: To activate this path, go to your TrulyYou dashboard and set it to "active".');
+              
+              throw new Error(`Path not active: ${pathDesc}. Status: ${sessionData.path.status}. Activate in TrulyYou dashboard.`);
+            }
+          }
+        }
+      } catch (e) {
+        if (e.message && e.message.includes('Path not active')) {
+          throw e; // Re-throw path errors
+        }
+        console.warn('TrulyYou SDK: Could not create session, proceeding without requirements');
+      }
+
+      // Create auth request with session data
+      const authRequest = {
+        url,
+        method,
+        body,
+        appId: this.appId,
+        requestId,
+        mode: this.mode,
+        // Session ID for auth page to fetch full context
+        sessionId: sessionData?.sessionId || null,
+        // Also pass evaluated data from session for immediate use
+        endpointTitle: sessionData?.endpointTitle || null,
+        endpointDescription: sessionData?.endpointDescription || null,
+        authRequirements: sessionData?.authRequirements || null
+      };
+
+      // Open auth window/iframe based on mode
+      const authResponse = await this._requestAuth(authRequest);
+
+      if (!authResponse.approved) {
+        throw new Error('Authentication denied by user');
+      }
+
+      // Add signature headers from auth response
+      const headers = new Headers(options.headers || {});
+      
+      // Auth page returns headers object with signature data
+      if (authResponse.headers) {
+        Object.entries(authResponse.headers).forEach(([key, value]) => {
+          headers.set(key, value);
+        });
+      }
+      
+      // Always add appId
+      headers.set('X-TrulyYou-AppId', this.appId);
+
+      // Make the actual request
+      // For relative URLs, prepend apiUrl to call the backend directly
+      const fetchUrl = (url.startsWith('http://') || url.startsWith('https://')) 
+        ? url 
+        : `${this.apiUrl || window.location.origin}${url}`;
+      
+      const response = await fetch(fetchUrl, {
+        ...options,
+        headers
+      });
+
+      return response;
+    }
+
+    /**
+     * Request authentication from user
+     * @private
+     */
+    async _requestAuth(authRequest) {
+      return new Promise((resolve, reject) => {
+        // Store resolver for this request
+        this.pendingRequests.set(authRequest.requestId, { resolve, reject });
+
+        // Build auth URL - now simplified to just pass sessionId
+        // The auth page fetches all details from the session
+        const params = new URLSearchParams({
+          sessionId: authRequest.sessionId,
+          requestId: authRequest.requestId,
+          mode: this.mode
+        });
+
+        if (this.mockMobile) {
+          params.set('mockMobile', 'true');
+        }
+
+        const authUrl = `${this.authUrl}?${params.toString()}`;
+
+        if (this.mode === 'visible') {
+          if (this.targetElement) {
+            // Render iframe in target element
+            const targetEl = typeof this.targetElement === 'string' 
+              ? document.querySelector(this.targetElement) 
+              : this.targetElement;
+
+            if (!targetEl) {
+              reject(new Error('Target element not found'));
+              this.pendingRequests.delete(authRequest.requestId);
+              return;
+            }
+
+            // Create iframe - auto-sizes to fit content
+            const iframe = document.createElement('iframe');
+            iframe.src = authUrl;
+            iframe.id = `truly-you-auth-${authRequest.requestId}`;
+            iframe.style.width = '100%';
+            iframe.style.height = '0';
+            iframe.style.border = 'none';
+            iframe.style.display = 'block';
+            iframe.style.overflow = 'hidden';
+            // Enable WebAuthn in cross-origin iframe
+            iframe.allow = 'publickey-credentials-get *; publickey-credentials-create *';
+            
+            // Store original styles to restore later
+            this._originalContent = targetEl.innerHTML;
+            this._originalStyles = {
+              minHeight: targetEl.style.minHeight,
+              height: targetEl.style.height
+            };
+            
+            // Listen for resize messages from iframe
+            const resizeHandler = (event) => {
+              if (event.data?.type === 'TRULY_YOU_RESIZE' && event.data?.requestId === authRequest.requestId) {
+                iframe.style.height = event.data.height + 'px';
+              }
+            };
+            window.addEventListener('message', resizeHandler);
+            this._resizeHandler = resizeHandler;
+            
+            // Clear target and add iframe
+            targetEl.innerHTML = '';
+            targetEl.appendChild(iframe);
+
+            // Timeout after 5 minutes
+            setTimeout(() => {
+              if (this.pendingRequests.has(authRequest.requestId)) {
+                // Check localStorage for response
+                const storedResponse = localStorage.getItem(`truly_you_auth_${authRequest.requestId}`);
+                if (storedResponse) {
+                  const response = JSON.parse(storedResponse);
+                  localStorage.removeItem(`truly_you_auth_${authRequest.requestId}`);
+                  
+                  if (response.approved) {
+                    resolve(response);
+                  } else {
+                    reject(new Error('Authentication denied'));
+                  }
+                } else {
+                  reject(new Error('Authentication timeout'));
+                }
+                this.pendingRequests.delete(authRequest.requestId);
+                
+                // Clean up resize handler
+                if (this._resizeHandler) {
+                  window.removeEventListener('message', this._resizeHandler);
+                  this._resizeHandler = undefined;
+                }
+                
+                // Remove iframe and restore original content
+                if (iframe.parentNode) {
+                  iframe.parentNode.removeChild(iframe);
+                  if (this._originalContent !== undefined) {
+                    targetEl.innerHTML = this._originalContent;
+                  }
+                }
+              }
+            }, 300000);
+
+          } else {
+            // Open popup window (fallback when no targetElement provided)
+            const width = 480;
+            const height = 600;
+            const left = window.screen.width / 2 - width / 2;
+            const top = window.screen.height / 2 - height / 2;
+
+            const authWindow = window.open(
+              authUrl,
+              'TrulyYou Authentication',
+              `width=${width},height=${height},left=${left},top=${top},resizable=no,scrollbars=yes`
+            );
+
+            if (!authWindow) {
+              reject(new Error('Failed to open authentication window. Please allow popups.'));
+              this.pendingRequests.delete(authRequest.requestId);
+              return;
+            }
+
+            // Poll for window closure
+            const checkClosed = setInterval(() => {
+              if (authWindow.closed) {
+                clearInterval(checkClosed);
+                
+                // Check localStorage for response
+                const storedResponse = localStorage.getItem(`truly_you_auth_${authRequest.requestId}`);
+                if (storedResponse) {
+                  const response = JSON.parse(storedResponse);
+                  localStorage.removeItem(`truly_you_auth_${authRequest.requestId}`);
+                  
+                  if (response.approved) {
+                    resolve(response);
+                  } else {
+                    reject(new Error('Authentication denied'));
+                  }
+                  this.pendingRequests.delete(authRequest.requestId);
+                } else {
+                  reject(new Error('Authentication window closed without response'));
+                  this.pendingRequests.delete(authRequest.requestId);
+                }
+              }
+            }, 500);
+
+            // Timeout after 5 minutes
+            setTimeout(() => {
+              if (this.pendingRequests.has(authRequest.requestId)) {
+                clearInterval(checkClosed);
+                if (authWindow && !authWindow.closed) {
+                  authWindow.close();
+                }
+                reject(new Error('Authentication timeout'));
+                this.pendingRequests.delete(authRequest.requestId);
+              }
+            }, 300000);
+          }
+
+        } else if (this.mode === 'hidden') {
+          // Check if we're on desktop - if so, we need to show QR code
+          const userAgent = navigator.userAgent.toLowerCase();
+          const isMac = /macintosh|mac os x/i.test(userAgent);
+          const isWindows = /windows nt/i.test(userAgent) && !/windows phone/i.test(userAgent);
+          const isLinuxDesktop = /linux/i.test(userAgent) && !/android/i.test(userAgent);
+          const isDesktop = isMac || isWindows || isLinuxDesktop;
+
+          console.log('[SDK] Hidden mode - isDesktop:', isDesktop, 'targetElement:', this.targetElement);
+
+          if (isDesktop && this.targetElement) {
+            // On desktop with targetElement, show visible iframe for QR code
+            // Find the visible element if selector matches multiple
+            let targetEl;
+            if (typeof this.targetElement === 'string') {
+              const elements = document.querySelectorAll(this.targetElement);
+              console.log('[SDK] Found elements:', elements.length);
+              targetEl = Array.from(elements).find(el => {
+                // Check if element AND all ancestors are visible
+                const isVisible = el.offsetParent !== null || el.offsetWidth > 0 || el.offsetHeight > 0;
+                console.log('[SDK] Element visible:', isVisible, 'offsetParent:', el.offsetParent, el);
+                return isVisible;
+              }) || elements[0];
+            } else {
+              targetEl = this.targetElement;
+            }
+
+            console.log('[SDK] Using targetEl:', targetEl);
+
+            if (targetEl) {
+              const iframe = document.createElement('iframe');
+              iframe.src = authUrl;
+              iframe.id = `truly-you-auth-${authRequest.requestId}`;
+              iframe.style.width = '100%';
+              iframe.style.height = '0';
+              iframe.style.border = 'none';
+              iframe.style.display = 'block';
+              iframe.style.overflow = 'hidden';
+              iframe.allow = 'publickey-credentials-get *; publickey-credentials-create *';
+              
+              // Store original styles to restore later
+              this._originalContent = targetEl.innerHTML;
+              this._originalStyles = {
+                minHeight: targetEl.style.minHeight,
+                height: targetEl.style.height
+              };
+              
+              // Listen for resize messages from iframe
+              const resizeHandler = (event) => {
+                if (event.data?.type === 'TRULY_YOU_RESIZE' && event.data?.requestId === authRequest.requestId) {
+                  iframe.style.height = event.data.height + 'px';
+                }
+              };
+              window.addEventListener('message', resizeHandler);
+              this._resizeHandler = resizeHandler;
+              
+              // Clear target and add iframe
+              targetEl.innerHTML = '';
+              targetEl.appendChild(iframe);
+
+              // Timeout after 10 minutes
+              setTimeout(() => {
+                if (this.pendingRequests.has(authRequest.requestId)) {
+                  const storedResponse = localStorage.getItem(`truly_you_auth_${authRequest.requestId}`);
+                  if (storedResponse) {
+                    const response = JSON.parse(storedResponse);
+                    localStorage.removeItem(`truly_you_auth_${authRequest.requestId}`);
+                    
+                    if (response.approved) {
+                      resolve(response);
+                    } else {
+                      reject(new Error('Authentication denied'));
+                    }
+                  } else {
+                    reject(new Error('Authentication timeout'));
+                  }
+                  this.pendingRequests.delete(authRequest.requestId);
+                  
+                  if (this._resizeHandler) {
+                    window.removeEventListener('message', this._resizeHandler);
+                    this._resizeHandler = undefined;
+                  }
+                  
+                  if (iframe.parentNode) {
+                    iframe.parentNode.removeChild(iframe);
+                    if (this._originalContent !== undefined) {
+                      targetEl.innerHTML = this._originalContent;
+                    }
+                  }
+                }
+              }, 600000);
+              return;
+            }
+          }
+
+          // Mobile or no targetElement: Create hidden iframe
+          const iframe = document.createElement('iframe');
+          iframe.style.display = 'none';
+          iframe.src = authUrl;
+          iframe.id = `truly-you-auth-${authRequest.requestId}`;
+          // Enable WebAuthn in cross-origin iframe
+          iframe.allow = 'publickey-credentials-get *; publickey-credentials-create *';
+          document.body.appendChild(iframe);
+
+          // Timeout after 10 minutes for hidden mode (enrollment can take time)
+          setTimeout(() => {
+            if (this.pendingRequests.has(authRequest.requestId)) {
+              document.body.removeChild(iframe);
+              
+              // Check localStorage for response
+              const storedResponse = localStorage.getItem(`truly_you_auth_${authRequest.requestId}`);
+              if (storedResponse) {
+                const response = JSON.parse(storedResponse);
+                localStorage.removeItem(`truly_you_auth_${authRequest.requestId}`);
+                
+                if (response.approved) {
+                  resolve(response);
+                } else {
+                  reject(new Error('Authentication denied'));
+                }
+              } else {
+                reject(new Error('Authentication timeout in hidden mode'));
+              }
+              this.pendingRequests.delete(authRequest.requestId);
+            }
+          }, 600000);
+        }
+      });
+    }
+
+    /**
+     * Handle auth response from window/iframe
+     * @private
+     */
+    _handleAuthResponse(event) {
+      if (event.data?.type === 'TRULY_YOU_AUTH_RESPONSE') {
+        const response = event.data.data;
+        const pending = this.pendingRequests.get(response.requestId);
+
+        if (pending) {
+          if (response.approved) {
+            pending.resolve(response);
+          } else {
+            pending.reject(new Error('Authentication denied'));
+          }
+          this.pendingRequests.delete(response.requestId);
+
+          // Clean up resize handler
+          if (this._resizeHandler) {
+            window.removeEventListener('message', this._resizeHandler);
+            this._resizeHandler = undefined;
+          }
+          
+          // Clean up iframe if exists and restore original content
+          const iframe = document.getElementById(`truly-you-auth-${response.requestId}`);
+          if (iframe && iframe.parentNode) {
+            const parent = iframe.parentNode;
+            parent.removeChild(iframe);
+            
+            // Restore original content if we saved it
+            if (this._originalContent !== undefined) {
+              parent.innerHTML = this._originalContent;
+              this._originalContent = undefined;
+            }
+          }
+        }
+      }
+    }
+
+    /**
+     * Generate unique request ID
+     * @private
+     */
+    _generateRequestId() {
+      return `req_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;
+    }
+
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+      return {
+        appId: this.appId,
+        mode: this.mode,
+        authUrl: this.authUrl,
+        mockMobile: this.mockMobile
+      };
+    }
+
+    /**
+     * Update mockMobile setting
+     */
+    setMockMobile(enabled) {
+      this.mockMobile = !!enabled;
+    }
+
+    /**
+     * Update mode (visible/hidden)
+     */
+    setMode(mode) {
+      if (mode !== 'visible' && mode !== 'hidden') {
+        throw new Error('Mode must be either "visible" or "hidden"');
+      }
+      this.mode = mode;
+    }
+  }
+
+  // Export to window
+  window.TrulyYouSDK = TrulyYouSDK;
+
+  // AMD/CommonJS compatibility
+  if (typeof define === 'function' && define.amd) {
+    define([], function() { return TrulyYouSDK; });
+  } else if (typeof module === 'object' && module.exports) {
+    module.exports = TrulyYouSDK;
+  }
+
+})(typeof window !== 'undefined' ? window : global);
+
+/**
+ * TrulyYou Server SDK - For server-side signature verification
+ * Usage: const TrulyYouServer = require('@trulyyou/sdk/server');
+ *        const trulyyou = new TrulyYouServer({ appId: 'your-app-id', secretKey: 'your-secret-key' });
+ */
+(function(root) {
+  'use strict';
+
+  class TrulyYouServer {
+    /**
+     * Initialize the server-side SDK
+     * @param {object} config - Configuration options
+     * @param {string} config.appId - Your TrulyYou App ID (public key)
+     * @param {string} config.secretKey - Your TrulyYou Secret Key (private key)
+     * @param {string} [config.apiUrl] - TrulyYou API URL (defaults to https://api.trulyyou.io)
+     */
+    constructor(config = {}) {
+      if (!config.appId) {
+        throw new Error('TrulyYou Server SDK: appId is required');
+      }
+      if (!config.secretKey) {
+        throw new Error('TrulyYou Server SDK: secretKey is required');
+      }
+
+      this.appId = config.appId;
+      this.secretKey = config.secretKey;
+      this.apiUrl = config.apiUrl || process.env.TRULYYOU_API_URL || 'http://localhost:3000';
+    }
+
+    /**
+     * Verify a signature from an incoming request
+     * @param {object} request - The incoming request object
+     * @param {object} request.headers - Request headers containing the signature
+     * @param {string} request.method - HTTP method (GET, POST, etc.)
+     * @param {string} request.url - Request URL/path
+     * @param {string|object} [request.body] - Request body (string or object)
+     * @returns {Promise<object>} - Verification result
+     */
+    async verifySignature(request) {
+      const signature = request.headers['x-trulyyou-signature'] || request.headers['X-TrulyYou-Signature'];
+      const keyId = request.headers['x-trulyyou-keyid'] || request.headers['X-TrulyYou-KeyId'];
+      const payload = request.headers['x-trulyyou-payload'] || request.headers['X-TrulyYou-Payload'];
+      const appId = request.headers['x-trulyyou-appid'] || request.headers['X-TrulyYou-AppId'];
+
+      if (!signature) {
+        return {
+          verified: false,
+          error: 'Missing x-trulyyou-signature header'
+        };
+      }
+
+      if (appId && appId !== this.appId) {
+        return {
+          verified: false,
+          error: 'App ID mismatch'
+        };
+      }
+
+      // Prepare body
+      let body = request.body;
+      if (body && typeof body === 'object') {
+        body = JSON.stringify(body);
+      }
+
+      // Call TrulyYou API to verify
+      try {
+        const fetch = typeof globalThis.fetch !== 'undefined' 
+          ? globalThis.fetch 
+          : require('node-fetch');
+
+        const response = await fetch(`${this.apiUrl}/api/verify-signature`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-TrulyYou-AppId': this.appId,
+            'X-TrulyYou-SecretKey': this.secretKey
+          },
+          body: JSON.stringify({
+            signature,
+            keyId: keyId || null,
+            payload: payload || null,
+            method: request.method,
+            url: request.url,
+            body: body || null
+          })
+        });
+
+        const result = await response.json();
+        
+        return {
+          verified: result.verified || false,
+          user: result.user || null,
+          verifications: result.verifications || {},
+          authRequirementsMet: result.authRequirementsMet || false,
+          missingVerifications: result.missingVerifications || [],
+          error: result.error || null
+        };
+      } catch (err) {
+        return {
+          verified: false,
+          error: err.message
+        };
+      }
+    }
+
+    /**
+     * Express/Connect middleware for signature verification
+     * @param {object} [options] - Middleware options
+     * @param {boolean} [options.optional=false] - If true, allows requests without signature
+     * @param {function} [options.onError] - Custom error handler
+     * @returns {function} Express middleware
+     */
+    middleware(options = {}) {
+      const self = this;
+      
+      return async function trulyYouMiddleware(req, res, next) {
+        const signature = req.headers['x-trulyyou-signature'];
+        
+        // If signature is optional and not present, continue
+        if (options.optional && !signature) {
+          req.trulyYou = { verified: false, optional: true };
+          return next();
+        }
+
+        const result = await self.verifySignature({
+          headers: req.headers,
+          method: req.method,
+          url: req.originalUrl || req.url,
+          body: req.body
+        });
+
+        if (!result.verified) {
+          if (options.onError) {
+            return options.onError(result.error, req, res, next);
+          }
+          return res.status(401).json({ 
+            error: 'Unauthorized', 
+            message: result.error || 'Invalid signature'
+          });
+        }
+
+        // Attach verification result to request
+        req.trulyYou = result;
+        next();
+      };
+    }
+  }
+
+  // Export for Node.js/CommonJS
+  if (typeof module === 'object' && module.exports) {
+    module.exports.TrulyYouServer = TrulyYouServer;
+  }
+
+  // Export to global for browser (if needed)
+  if (typeof root !== 'undefined') {
+    root.TrulyYouServer = TrulyYouServer;
+  }
+
+})(typeof window !== 'undefined' ? window : (typeof global !== 'undefined' ? global : this));