@vue-solana/core 0.4.0 → 0.4.2

package/dist/ios-wallet.cjs

@@ -2,15 +2,34 @@
 
 const web3Compat = require('@solana/web3-compat');
 const bs58 = require('bs58');
-const nacl = require('tweetnacl');
+const naclModule = require('tweetnacl');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e.default : e; }
 
+function _interopNamespaceCompat(e) {
+  if (e && typeof e === 'object' && 'default' in e) return e;
+  const n = Object.create(null);
+  if (e) {
+    for (const k in e) {
+      n[k] = e[k];
+    }
+  }
+  n.default = e;
+  return n;
+}
+
 const bs58__default = /*#__PURE__*/_interopDefaultCompat(bs58);
-const nacl__default = /*#__PURE__*/_interopDefaultCompat(nacl);
+const naclModule__namespace = /*#__PURE__*/_interopNamespaceCompat(naclModule);
 
+const nacl = resolveTweetNaCl();
+function resolveTweetNaCl() {
+  const moduleDefault = naclModule__namespace.default;
+  const globalNacl = globalThis.nacl;
+  return "box" in naclModule__namespace ? naclModule__namespace : moduleDefault ?? globalNacl;
+}
 const DEFAULT_IOS_WALLET_CHAINS = ["solana:mainnet", "solana:devnet"];
 const PENDING_REQUEST_KEY = "vue-solana:ios-wallet:pending";
+const PENDING_REQUEST_TTL_MS = 10 * 60 * 1e3;
 const SESSION_PREFIX = "vue-solana:ios-wallet:session:";
 const CALLBACK_PARAMS = /* @__PURE__ */ new Set([
   "data",
@@ -142,6 +161,11 @@ function adaptSolanaIosWallet(walletInfo, options = {}) {
         transactions,
         options
       );
+      if (signedTransactions.length !== transactions.length) {
+        throw new Error(
+          `iOS wallet returned ${signedTransactions.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
       return signedTransactions.map(
         (transaction, index) => deserializeTransaction(transactions[index], transaction)
       );
@@ -169,36 +193,50 @@ function handleSolanaIosWalletCallback(options = {}) {
     cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an iOS wallet callback without a pending request");
   }
+  if (isPendingRequestExpired(pending)) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw new Error("Received an expired iOS wallet callback");
+  }
   const definition = getIosWalletDefinitionById(pending.walletId);
   const walletEncryptionPublicKey = url.searchParams.get(definition.encryptionPublicKeyParam);
   const nonce = url.searchParams.get("nonce");
   const data = url.searchParams.get("data");
   if (!nonce || !data) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an incomplete iOS wallet callback");
   }
-  const sharedSecret = getSharedSecret(
-    walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
-    pending.dappEncryptionSecretKey
-  );
-  const payload = decryptPayload(data, nonce, sharedSecret);
-  const result = createCallbackResult(pending, payload);
-  if (pending.method === "connect") {
-    if (!walletEncryptionPublicKey) {
-      throw new Error("iOS wallet connect callback did not include an encryption public key");
+  try {
+    const sharedSecret = getSharedSecret(
+      walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
+      pending.dappEncryptionSecretKey
+    );
+    const payload = decryptPayload(data, nonce, sharedSecret);
+    const result = createCallbackResult(pending, payload);
+    if (pending.method === "connect") {
+      if (!walletEncryptionPublicKey) {
+        throw new Error("iOS wallet connect callback did not include an encryption public key");
+      }
+      const publicKey = getPublicKeyField(payload, "public_key");
+      storeSession({
+        walletId: pending.walletId,
+        publicKey,
+        session: getStringField(payload, "session"),
+        dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
+        dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
+        walletEncryptionPublicKey,
+        sharedSecret: bs58__default.encode(sharedSecret)
+      });
     }
-    storeSession({
-      walletId: pending.walletId,
-      publicKey: getStringField(payload, "public_key"),
-      session: getStringField(payload, "session"),
-      dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
-      dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
-      walletEncryptionPublicKey,
-      sharedSecret: bs58__default.encode(sharedSecret)
-    });
-  }
-  clearPendingRequest();
-  cleanCallbackUrl(url, options.clearUrl);
-  return result;
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    return result;
+  } catch (cause) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw cause;
+  }
 }
 function isSolanaIosWalletInfo(walletInfo) {
   return walletInfo.source === "deep-link" && isIosWalletDefinition(walletInfo.wallet);
@@ -239,7 +277,7 @@ function getDefaultIosWalletRedirectUrl() {
   return url.toString();
 }
 function launchConnect(definition, options) {
-  const keyPair = nacl__default.box.keyPair();
+  const keyPair = nacl.box.keyPair();
   const pending = createPendingRequest(definition.id, "connect", keyPair, options.redirectUrl);
   const appIdentity = options.appIdentity ?? getDefaultIosWalletAppIdentity();
   const url = new URL(definition.connectUrl);
@@ -298,9 +336,10 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
       publicKey: bs58__default.decode(session.dappEncryptionPublicKey),
       secretKey: bs58__default.decode(session.dappEncryptionSecretKey)
     },
-    options.redirectUrl
+    options.redirectUrl,
+    method === "signAllTransactions" && Array.isArray(payload.transactions) ? payload.transactions.length : void 0
   );
-  const nonce = nacl__default.randomBytes(nacl__default.box.nonceLength);
+  const nonce = nacl.randomBytes(nacl.box.nonceLength);
   const encryptedPayload = encryptPayload(
     { ...payload, session: session.session },
     nonce,
@@ -315,7 +354,7 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
   openIosWalletUrl(url.toString());
   return waitForRedirect();
 }
-function createPendingRequest(walletId, method, keyPair, redirectUrl) {
+function createPendingRequest(walletId, method, keyPair, redirectUrl, requestedTransactionCount) {
   return {
     id: createRequestId(),
     walletId,
@@ -323,7 +362,8 @@ function createPendingRequest(walletId, method, keyPair, redirectUrl) {
     dappEncryptionPublicKey: bs58__default.encode(keyPair.publicKey),
     dappEncryptionSecretKey: bs58__default.encode(keyPair.secretKey),
     redirectUrl: redirectUrl ?? getDefaultIosWalletRedirectUrl(),
-    createdAt: Date.now()
+    createdAt: Date.now(),
+    requestedTransactionCount
   };
 }
 function createCallbackResult(pending, payload) {
@@ -331,7 +371,7 @@ function createCallbackResult(pending, payload) {
     return {
       walletId: pending.walletId,
       method: pending.method,
-      publicKey: getStringField(payload, "public_key")
+      publicKey: getPublicKeyField(payload, "public_key")
     };
   }
   if (pending.method === "signTransaction") {
@@ -346,6 +386,11 @@ function createCallbackResult(pending, payload) {
     if (!Array.isArray(transactions) || transactions.some((transaction) => typeof transaction !== "string")) {
       throw new Error("iOS wallet returned invalid signed transactions");
     }
+    if (typeof pending.requestedTransactionCount === "number" && transactions.length !== pending.requestedTransactionCount) {
+      throw new Error(
+        `iOS wallet returned ${transactions.length} signed transactions for ${pending.requestedTransactionCount} requested transactions`
+      );
+    }
     return {
       walletId: pending.walletId,
       method: pending.method,
@@ -369,13 +414,13 @@ function getSharedSecret(walletEncryptionPublicKey, dappSecretKey) {
   if (!walletEncryptionPublicKey) {
     throw new Error("Missing iOS wallet encryption public key");
   }
-  return nacl__default.box.before(bs58__default.decode(walletEncryptionPublicKey), bs58__default.decode(dappSecretKey));
+  return nacl.box.before(bs58__default.decode(walletEncryptionPublicKey), bs58__default.decode(dappSecretKey));
 }
 function encryptPayload(payload, nonce, sharedSecret) {
-  return bs58__default.encode(nacl__default.box.after(encodeJson(payload), nonce, sharedSecret));
+  return bs58__default.encode(nacl.box.after(encodeJson(payload), nonce, sharedSecret));
 }
 function decryptPayload(data, nonce, sharedSecret) {
-  const decrypted = nacl__default.box.open.after(bs58__default.decode(data), bs58__default.decode(nonce), sharedSecret);
+  const decrypted = nacl.box.open.after(bs58__default.decode(data), bs58__default.decode(nonce), sharedSecret);
   if (!decrypted) {
     throw new Error("Unable to decrypt iOS wallet callback");
   }
@@ -415,7 +460,9 @@ function getStoredSession(walletId) {
     return null;
   }
   try {
-    return JSON.parse(value);
+    const session = JSON.parse(value);
+    new web3Compat.PublicKey(session.publicKey);
+    return session;
   } catch {
     removeStoredSession(walletId);
     return null;
@@ -483,7 +530,7 @@ function cleanCallbackUrl(url, clearUrl) {
   window.history.replaceState(window.history.state, document.title, url.toString());
 }
 function createRequestId() {
-  return bs58__default.encode(nacl__default.randomBytes(16));
+  return bs58__default.encode(nacl.randomBytes(16));
 }
 function getStringField(payload, field) {
   const value = payload[field];
@@ -492,6 +539,18 @@ function getStringField(payload, field) {
   }
   return value;
 }
+function getPublicKeyField(payload, field) {
+  const value = getStringField(payload, field);
+  try {
+    new web3Compat.PublicKey(value);
+  } catch {
+    throw new Error(`iOS wallet callback returned an invalid ${field}`);
+  }
+  return value;
+}
+function isPendingRequestExpired(request) {
+  return Date.now() - request.createdAt > PENDING_REQUEST_TTL_MS;
+}
 function getIosWalletDefinition(walletInfo) {
   if (!isIosWalletDefinition(walletInfo.wallet)) {
     throw new Error("Solana wallet info is not an iOS wallet");

package/dist/ios-wallet.mjs

@@ -1,9 +1,16 @@
 import { PublicKey, Transaction, VersionedTransaction } from '@solana/web3-compat';
 import bs58 from 'bs58';
-import nacl from 'tweetnacl';
+import * as naclModule from 'tweetnacl';
 
+const nacl = resolveTweetNaCl();
+function resolveTweetNaCl() {
+  const moduleDefault = naclModule.default;
+  const globalNacl = globalThis.nacl;
+  return "box" in naclModule ? naclModule : moduleDefault ?? globalNacl;
+}
 const DEFAULT_IOS_WALLET_CHAINS = ["solana:mainnet", "solana:devnet"];
 const PENDING_REQUEST_KEY = "vue-solana:ios-wallet:pending";
+const PENDING_REQUEST_TTL_MS = 10 * 60 * 1e3;
 const SESSION_PREFIX = "vue-solana:ios-wallet:session:";
 const CALLBACK_PARAMS = /* @__PURE__ */ new Set([
   "data",
@@ -135,6 +142,11 @@ function adaptSolanaIosWallet(walletInfo, options = {}) {
         transactions,
         options
       );
+      if (signedTransactions.length !== transactions.length) {
+        throw new Error(
+          `iOS wallet returned ${signedTransactions.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
       return signedTransactions.map(
         (transaction, index) => deserializeTransaction(transactions[index], transaction)
       );
@@ -162,36 +174,50 @@ function handleSolanaIosWalletCallback(options = {}) {
     cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an iOS wallet callback without a pending request");
   }
+  if (isPendingRequestExpired(pending)) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw new Error("Received an expired iOS wallet callback");
+  }
   const definition = getIosWalletDefinitionById(pending.walletId);
   const walletEncryptionPublicKey = url.searchParams.get(definition.encryptionPublicKeyParam);
   const nonce = url.searchParams.get("nonce");
   const data = url.searchParams.get("data");
   if (!nonce || !data) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an incomplete iOS wallet callback");
   }
-  const sharedSecret = getSharedSecret(
-    walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
-    pending.dappEncryptionSecretKey
-  );
-  const payload = decryptPayload(data, nonce, sharedSecret);
-  const result = createCallbackResult(pending, payload);
-  if (pending.method === "connect") {
-    if (!walletEncryptionPublicKey) {
-      throw new Error("iOS wallet connect callback did not include an encryption public key");
+  try {
+    const sharedSecret = getSharedSecret(
+      walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
+      pending.dappEncryptionSecretKey
+    );
+    const payload = decryptPayload(data, nonce, sharedSecret);
+    const result = createCallbackResult(pending, payload);
+    if (pending.method === "connect") {
+      if (!walletEncryptionPublicKey) {
+        throw new Error("iOS wallet connect callback did not include an encryption public key");
+      }
+      const publicKey = getPublicKeyField(payload, "public_key");
+      storeSession({
+        walletId: pending.walletId,
+        publicKey,
+        session: getStringField(payload, "session"),
+        dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
+        dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
+        walletEncryptionPublicKey,
+        sharedSecret: bs58.encode(sharedSecret)
+      });
     }
-    storeSession({
-      walletId: pending.walletId,
-      publicKey: getStringField(payload, "public_key"),
-      session: getStringField(payload, "session"),
-      dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
-      dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
-      walletEncryptionPublicKey,
-      sharedSecret: bs58.encode(sharedSecret)
-    });
-  }
-  clearPendingRequest();
-  cleanCallbackUrl(url, options.clearUrl);
-  return result;
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    return result;
+  } catch (cause) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw cause;
+  }
 }
 function isSolanaIosWalletInfo(walletInfo) {
   return walletInfo.source === "deep-link" && isIosWalletDefinition(walletInfo.wallet);
@@ -291,7 +317,8 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
       publicKey: bs58.decode(session.dappEncryptionPublicKey),
       secretKey: bs58.decode(session.dappEncryptionSecretKey)
     },
-    options.redirectUrl
+    options.redirectUrl,
+    method === "signAllTransactions" && Array.isArray(payload.transactions) ? payload.transactions.length : void 0
   );
   const nonce = nacl.randomBytes(nacl.box.nonceLength);
   const encryptedPayload = encryptPayload(
@@ -308,7 +335,7 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
   openIosWalletUrl(url.toString());
   return waitForRedirect();
 }
-function createPendingRequest(walletId, method, keyPair, redirectUrl) {
+function createPendingRequest(walletId, method, keyPair, redirectUrl, requestedTransactionCount) {
   return {
     id: createRequestId(),
     walletId,
@@ -316,7 +343,8 @@ function createPendingRequest(walletId, method, keyPair, redirectUrl) {
     dappEncryptionPublicKey: bs58.encode(keyPair.publicKey),
     dappEncryptionSecretKey: bs58.encode(keyPair.secretKey),
     redirectUrl: redirectUrl ?? getDefaultIosWalletRedirectUrl(),
-    createdAt: Date.now()
+    createdAt: Date.now(),
+    requestedTransactionCount
   };
 }
 function createCallbackResult(pending, payload) {
@@ -324,7 +352,7 @@ function createCallbackResult(pending, payload) {
     return {
       walletId: pending.walletId,
       method: pending.method,
-      publicKey: getStringField(payload, "public_key")
+      publicKey: getPublicKeyField(payload, "public_key")
     };
   }
   if (pending.method === "signTransaction") {
@@ -339,6 +367,11 @@ function createCallbackResult(pending, payload) {
     if (!Array.isArray(transactions) || transactions.some((transaction) => typeof transaction !== "string")) {
       throw new Error("iOS wallet returned invalid signed transactions");
     }
+    if (typeof pending.requestedTransactionCount === "number" && transactions.length !== pending.requestedTransactionCount) {
+      throw new Error(
+        `iOS wallet returned ${transactions.length} signed transactions for ${pending.requestedTransactionCount} requested transactions`
+      );
+    }
     return {
       walletId: pending.walletId,
       method: pending.method,
@@ -408,7 +441,9 @@ function getStoredSession(walletId) {
     return null;
   }
   try {
-    return JSON.parse(value);
+    const session = JSON.parse(value);
+    new PublicKey(session.publicKey);
+    return session;
   } catch {
     removeStoredSession(walletId);
     return null;
@@ -485,6 +520,18 @@ function getStringField(payload, field) {
   }
   return value;
 }
+function getPublicKeyField(payload, field) {
+  const value = getStringField(payload, field);
+  try {
+    new PublicKey(value);
+  } catch {
+    throw new Error(`iOS wallet callback returned an invalid ${field}`);
+  }
+  return value;
+}
+function isPendingRequestExpired(request) {
+  return Date.now() - request.createdAt > PENDING_REQUEST_TTL_MS;
+}
 function getIosWalletDefinition(walletInfo) {
   if (!isIosWalletDefinition(walletInfo.wallet)) {
     throw new Error("Solana wallet info is not an iOS wallet");

package/dist/wallet-standard.cjs

@@ -136,9 +136,17 @@ function adaptSolanaStandardWallet(walletInfo, options = {}) {
           chain: options.chain
         }))
       );
-      return results.map(
-        (result, index) => deserializeTransaction(transactions[index], result.signedTransaction)
-      );
+      if (results.length !== transactions.length) {
+        throw new Error(
+          `Solana wallet returned ${results.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
+      return results.map((result, index) => {
+        if (!result) {
+          throw new Error("Solana wallet did not return a signed transaction");
+        }
+        return deserializeTransaction(transactions[index], result.signedTransaction);
+      });
     } : void 0,
     signAndSendTransaction: hasSignAndSendTransaction(wallet) ? async (transaction, sendOptions) => {
       const activeAccount = getActiveAccount(account);

package/dist/wallet-standard.mjs

@@ -130,9 +130,17 @@ function adaptSolanaStandardWallet(walletInfo, options = {}) {
           chain: options.chain
         }))
       );
-      return results.map(
-        (result, index) => deserializeTransaction(transactions[index], result.signedTransaction)
-      );
+      if (results.length !== transactions.length) {
+        throw new Error(
+          `Solana wallet returned ${results.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
+      return results.map((result, index) => {
+        if (!result) {
+          throw new Error("Solana wallet did not return a signed transaction");
+        }
+        return deserializeTransaction(transactions[index], result.signedTransaction);
+      });
     } : void 0,
     signAndSendTransaction: hasSignAndSendTransaction(wallet) ? async (transaction, sendOptions) => {
       const activeAccount = getActiveAccount(account);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vue-solana/core",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Framework-agnostic primitives for Vue Solana libraries.",
   "license": "MIT",
   "keywords": [