@vue-solana/core 0.4.1 → 0.4.2

package/dist/ios-wallet.cjs

@@ -29,6 +29,7 @@ function resolveTweetNaCl() {
 }
 const DEFAULT_IOS_WALLET_CHAINS = ["solana:mainnet", "solana:devnet"];
 const PENDING_REQUEST_KEY = "vue-solana:ios-wallet:pending";
+const PENDING_REQUEST_TTL_MS = 10 * 60 * 1e3;
 const SESSION_PREFIX = "vue-solana:ios-wallet:session:";
 const CALLBACK_PARAMS = /* @__PURE__ */ new Set([
   "data",
@@ -160,6 +161,11 @@ function adaptSolanaIosWallet(walletInfo, options = {}) {
         transactions,
         options
       );
+      if (signedTransactions.length !== transactions.length) {
+        throw new Error(
+          `iOS wallet returned ${signedTransactions.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
       return signedTransactions.map(
         (transaction, index) => deserializeTransaction(transactions[index], transaction)
       );
@@ -187,36 +193,50 @@ function handleSolanaIosWalletCallback(options = {}) {
     cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an iOS wallet callback without a pending request");
   }
+  if (isPendingRequestExpired(pending)) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw new Error("Received an expired iOS wallet callback");
+  }
   const definition = getIosWalletDefinitionById(pending.walletId);
   const walletEncryptionPublicKey = url.searchParams.get(definition.encryptionPublicKeyParam);
   const nonce = url.searchParams.get("nonce");
   const data = url.searchParams.get("data");
   if (!nonce || !data) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an incomplete iOS wallet callback");
   }
-  const sharedSecret = getSharedSecret(
-    walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
-    pending.dappEncryptionSecretKey
-  );
-  const payload = decryptPayload(data, nonce, sharedSecret);
-  const result = createCallbackResult(pending, payload);
-  if (pending.method === "connect") {
-    if (!walletEncryptionPublicKey) {
-      throw new Error("iOS wallet connect callback did not include an encryption public key");
+  try {
+    const sharedSecret = getSharedSecret(
+      walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
+      pending.dappEncryptionSecretKey
+    );
+    const payload = decryptPayload(data, nonce, sharedSecret);
+    const result = createCallbackResult(pending, payload);
+    if (pending.method === "connect") {
+      if (!walletEncryptionPublicKey) {
+        throw new Error("iOS wallet connect callback did not include an encryption public key");
+      }
+      const publicKey = getPublicKeyField(payload, "public_key");
+      storeSession({
+        walletId: pending.walletId,
+        publicKey,
+        session: getStringField(payload, "session"),
+        dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
+        dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
+        walletEncryptionPublicKey,
+        sharedSecret: bs58__default.encode(sharedSecret)
+      });
     }
-    storeSession({
-      walletId: pending.walletId,
-      publicKey: getStringField(payload, "public_key"),
-      session: getStringField(payload, "session"),
-      dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
-      dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
-      walletEncryptionPublicKey,
-      sharedSecret: bs58__default.encode(sharedSecret)
-    });
-  }
-  clearPendingRequest();
-  cleanCallbackUrl(url, options.clearUrl);
-  return result;
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    return result;
+  } catch (cause) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw cause;
+  }
 }
 function isSolanaIosWalletInfo(walletInfo) {
   return walletInfo.source === "deep-link" && isIosWalletDefinition(walletInfo.wallet);
@@ -316,7 +336,8 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
       publicKey: bs58__default.decode(session.dappEncryptionPublicKey),
       secretKey: bs58__default.decode(session.dappEncryptionSecretKey)
     },
-    options.redirectUrl
+    options.redirectUrl,
+    method === "signAllTransactions" && Array.isArray(payload.transactions) ? payload.transactions.length : void 0
   );
   const nonce = nacl.randomBytes(nacl.box.nonceLength);
   const encryptedPayload = encryptPayload(
@@ -333,7 +354,7 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
   openIosWalletUrl(url.toString());
   return waitForRedirect();
 }
-function createPendingRequest(walletId, method, keyPair, redirectUrl) {
+function createPendingRequest(walletId, method, keyPair, redirectUrl, requestedTransactionCount) {
   return {
     id: createRequestId(),
     walletId,
@@ -341,7 +362,8 @@ function createPendingRequest(walletId, method, keyPair, redirectUrl) {
     dappEncryptionPublicKey: bs58__default.encode(keyPair.publicKey),
     dappEncryptionSecretKey: bs58__default.encode(keyPair.secretKey),
     redirectUrl: redirectUrl ?? getDefaultIosWalletRedirectUrl(),
-    createdAt: Date.now()
+    createdAt: Date.now(),
+    requestedTransactionCount
   };
 }
 function createCallbackResult(pending, payload) {
@@ -349,7 +371,7 @@ function createCallbackResult(pending, payload) {
     return {
       walletId: pending.walletId,
       method: pending.method,
-      publicKey: getStringField(payload, "public_key")
+      publicKey: getPublicKeyField(payload, "public_key")
     };
   }
   if (pending.method === "signTransaction") {
@@ -364,6 +386,11 @@ function createCallbackResult(pending, payload) {
     if (!Array.isArray(transactions) || transactions.some((transaction) => typeof transaction !== "string")) {
       throw new Error("iOS wallet returned invalid signed transactions");
     }
+    if (typeof pending.requestedTransactionCount === "number" && transactions.length !== pending.requestedTransactionCount) {
+      throw new Error(
+        `iOS wallet returned ${transactions.length} signed transactions for ${pending.requestedTransactionCount} requested transactions`
+      );
+    }
     return {
       walletId: pending.walletId,
       method: pending.method,
@@ -433,7 +460,9 @@ function getStoredSession(walletId) {
     return null;
   }
   try {
-    return JSON.parse(value);
+    const session = JSON.parse(value);
+    new web3Compat.PublicKey(session.publicKey);
+    return session;
   } catch {
     removeStoredSession(walletId);
     return null;
@@ -510,6 +539,18 @@ function getStringField(payload, field) {
   }
   return value;
 }
+function getPublicKeyField(payload, field) {
+  const value = getStringField(payload, field);
+  try {
+    new web3Compat.PublicKey(value);
+  } catch {
+    throw new Error(`iOS wallet callback returned an invalid ${field}`);
+  }
+  return value;
+}
+function isPendingRequestExpired(request) {
+  return Date.now() - request.createdAt > PENDING_REQUEST_TTL_MS;
+}
 function getIosWalletDefinition(walletInfo) {
   if (!isIosWalletDefinition(walletInfo.wallet)) {
     throw new Error("Solana wallet info is not an iOS wallet");

package/dist/ios-wallet.mjs

@@ -10,6 +10,7 @@ function resolveTweetNaCl() {
 }
 const DEFAULT_IOS_WALLET_CHAINS = ["solana:mainnet", "solana:devnet"];
 const PENDING_REQUEST_KEY = "vue-solana:ios-wallet:pending";
+const PENDING_REQUEST_TTL_MS = 10 * 60 * 1e3;
 const SESSION_PREFIX = "vue-solana:ios-wallet:session:";
 const CALLBACK_PARAMS = /* @__PURE__ */ new Set([
   "data",
@@ -141,6 +142,11 @@ function adaptSolanaIosWallet(walletInfo, options = {}) {
         transactions,
         options
       );
+      if (signedTransactions.length !== transactions.length) {
+        throw new Error(
+          `iOS wallet returned ${signedTransactions.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
       return signedTransactions.map(
         (transaction, index) => deserializeTransaction(transactions[index], transaction)
       );
@@ -168,36 +174,50 @@ function handleSolanaIosWalletCallback(options = {}) {
     cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an iOS wallet callback without a pending request");
   }
+  if (isPendingRequestExpired(pending)) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw new Error("Received an expired iOS wallet callback");
+  }
   const definition = getIosWalletDefinitionById(pending.walletId);
   const walletEncryptionPublicKey = url.searchParams.get(definition.encryptionPublicKeyParam);
   const nonce = url.searchParams.get("nonce");
   const data = url.searchParams.get("data");
   if (!nonce || !data) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
     throw new Error("Received an incomplete iOS wallet callback");
   }
-  const sharedSecret = getSharedSecret(
-    walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
-    pending.dappEncryptionSecretKey
-  );
-  const payload = decryptPayload(data, nonce, sharedSecret);
-  const result = createCallbackResult(pending, payload);
-  if (pending.method === "connect") {
-    if (!walletEncryptionPublicKey) {
-      throw new Error("iOS wallet connect callback did not include an encryption public key");
+  try {
+    const sharedSecret = getSharedSecret(
+      walletEncryptionPublicKey ?? getStoredSession(pending.walletId)?.walletEncryptionPublicKey,
+      pending.dappEncryptionSecretKey
+    );
+    const payload = decryptPayload(data, nonce, sharedSecret);
+    const result = createCallbackResult(pending, payload);
+    if (pending.method === "connect") {
+      if (!walletEncryptionPublicKey) {
+        throw new Error("iOS wallet connect callback did not include an encryption public key");
+      }
+      const publicKey = getPublicKeyField(payload, "public_key");
+      storeSession({
+        walletId: pending.walletId,
+        publicKey,
+        session: getStringField(payload, "session"),
+        dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
+        dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
+        walletEncryptionPublicKey,
+        sharedSecret: bs58.encode(sharedSecret)
+      });
     }
-    storeSession({
-      walletId: pending.walletId,
-      publicKey: getStringField(payload, "public_key"),
-      session: getStringField(payload, "session"),
-      dappEncryptionPublicKey: pending.dappEncryptionPublicKey,
-      dappEncryptionSecretKey: pending.dappEncryptionSecretKey,
-      walletEncryptionPublicKey,
-      sharedSecret: bs58.encode(sharedSecret)
-    });
-  }
-  clearPendingRequest();
-  cleanCallbackUrl(url, options.clearUrl);
-  return result;
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    return result;
+  } catch (cause) {
+    clearPendingRequest();
+    cleanCallbackUrl(url, options.clearUrl);
+    throw cause;
+  }
 }
 function isSolanaIosWalletInfo(walletInfo) {
   return walletInfo.source === "deep-link" && isIosWalletDefinition(walletInfo.wallet);
@@ -297,7 +317,8 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
       publicKey: bs58.decode(session.dappEncryptionPublicKey),
       secretKey: bs58.decode(session.dappEncryptionSecretKey)
     },
-    options.redirectUrl
+    options.redirectUrl,
+    method === "signAllTransactions" && Array.isArray(payload.transactions) ? payload.transactions.length : void 0
   );
   const nonce = nacl.randomBytes(nacl.box.nonceLength);
   const encryptedPayload = encryptPayload(
@@ -314,7 +335,7 @@ async function launchEncryptedWalletRequest(definition, method, options, payload
   openIosWalletUrl(url.toString());
   return waitForRedirect();
 }
-function createPendingRequest(walletId, method, keyPair, redirectUrl) {
+function createPendingRequest(walletId, method, keyPair, redirectUrl, requestedTransactionCount) {
   return {
     id: createRequestId(),
     walletId,
@@ -322,7 +343,8 @@ function createPendingRequest(walletId, method, keyPair, redirectUrl) {
     dappEncryptionPublicKey: bs58.encode(keyPair.publicKey),
     dappEncryptionSecretKey: bs58.encode(keyPair.secretKey),
     redirectUrl: redirectUrl ?? getDefaultIosWalletRedirectUrl(),
-    createdAt: Date.now()
+    createdAt: Date.now(),
+    requestedTransactionCount
   };
 }
 function createCallbackResult(pending, payload) {
@@ -330,7 +352,7 @@ function createCallbackResult(pending, payload) {
     return {
       walletId: pending.walletId,
       method: pending.method,
-      publicKey: getStringField(payload, "public_key")
+      publicKey: getPublicKeyField(payload, "public_key")
     };
   }
   if (pending.method === "signTransaction") {
@@ -345,6 +367,11 @@ function createCallbackResult(pending, payload) {
     if (!Array.isArray(transactions) || transactions.some((transaction) => typeof transaction !== "string")) {
       throw new Error("iOS wallet returned invalid signed transactions");
     }
+    if (typeof pending.requestedTransactionCount === "number" && transactions.length !== pending.requestedTransactionCount) {
+      throw new Error(
+        `iOS wallet returned ${transactions.length} signed transactions for ${pending.requestedTransactionCount} requested transactions`
+      );
+    }
     return {
       walletId: pending.walletId,
       method: pending.method,
@@ -414,7 +441,9 @@ function getStoredSession(walletId) {
     return null;
   }
   try {
-    return JSON.parse(value);
+    const session = JSON.parse(value);
+    new PublicKey(session.publicKey);
+    return session;
   } catch {
     removeStoredSession(walletId);
     return null;
@@ -491,6 +520,18 @@ function getStringField(payload, field) {
   }
   return value;
 }
+function getPublicKeyField(payload, field) {
+  const value = getStringField(payload, field);
+  try {
+    new PublicKey(value);
+  } catch {
+    throw new Error(`iOS wallet callback returned an invalid ${field}`);
+  }
+  return value;
+}
+function isPendingRequestExpired(request) {
+  return Date.now() - request.createdAt > PENDING_REQUEST_TTL_MS;
+}
 function getIosWalletDefinition(walletInfo) {
   if (!isIosWalletDefinition(walletInfo.wallet)) {
     throw new Error("Solana wallet info is not an iOS wallet");

package/dist/wallet-standard.cjs

@@ -136,9 +136,17 @@ function adaptSolanaStandardWallet(walletInfo, options = {}) {
           chain: options.chain
         }))
       );
-      return results.map(
-        (result, index) => deserializeTransaction(transactions[index], result.signedTransaction)
-      );
+      if (results.length !== transactions.length) {
+        throw new Error(
+          `Solana wallet returned ${results.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
+      return results.map((result, index) => {
+        if (!result) {
+          throw new Error("Solana wallet did not return a signed transaction");
+        }
+        return deserializeTransaction(transactions[index], result.signedTransaction);
+      });
     } : void 0,
     signAndSendTransaction: hasSignAndSendTransaction(wallet) ? async (transaction, sendOptions) => {
       const activeAccount = getActiveAccount(account);

package/dist/wallet-standard.mjs

@@ -130,9 +130,17 @@ function adaptSolanaStandardWallet(walletInfo, options = {}) {
           chain: options.chain
         }))
       );
-      return results.map(
-        (result, index) => deserializeTransaction(transactions[index], result.signedTransaction)
-      );
+      if (results.length !== transactions.length) {
+        throw new Error(
+          `Solana wallet returned ${results.length} signed transactions for ${transactions.length} requested transactions`
+        );
+      }
+      return results.map((result, index) => {
+        if (!result) {
+          throw new Error("Solana wallet did not return a signed transaction");
+        }
+        return deserializeTransaction(transactions[index], result.signedTransaction);
+      });
     } : void 0,
     signAndSendTransaction: hasSignAndSendTransaction(wallet) ? async (transaction, sendOptions) => {
       const activeAccount = getActiveAccount(account);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vue-solana/core",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Framework-agnostic primitives for Vue Solana libraries.",
   "license": "MIT",
   "keywords": [