@witnium-tech/witniumchain 0.12.1 → 0.13.0

package/dist/index.js

@@ -94,11 +94,6 @@ var WitniumchainClient = class {
   // refresh might work even when the in-memory refresh token is undefined.
   hasRefreshCookie = false;
   oauthClientId;
-  // The redirect URI the most recent `beginOAuthLogin` issued, alongside the
-  // PKCE verifier. `completeOAuthLogin` reads it back so the token-exchange
-  // request matches the original /auth request (RFC 6749 §4.1.3 requires
-  // redirect_uri at /token to equal the one at /auth). Keyed by state.
-  pendingLogins = /* @__PURE__ */ new Map();
   verifierStorage;
   // Cache of the parsed OIDC discovery document keyed by issuer URL. Saves a
   // round trip on every OAuth call after the first. oidc-provider's discovery
@@ -566,7 +561,9 @@ var WitniumchainClient = class {
   // Routing: every method here passes `service: 'chain'` to `req()`. Calls
   // throw at call time if `chainBaseUrl` wasn't configured.
   //
-  // Auth: BearerJWT. The accounts-issued OAuth access token already carries
+  // Auth: the contract, witness, transaction and wallet reads are public on
+  // chain-api (anyone can check a witness), so they send no credential. The
+  // dashboard reads are BearerJWT: the accounts-issued token already carries
   // `aud=https://api.witniumchain.com`, so the same `accessToken` works
   // unchanged against both services.
   //
@@ -580,49 +577,49 @@ var WitniumchainClient = class {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/info`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getContractVerification(contractAddress) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/verify`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   listWitnessesV5(contractAddress, params) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/witnesses`,
-      { auth: "BearerJWT", service: "chain", query: params }
+      { auth: "Public", service: "chain", query: params }
     );
   }
   getWitnessV5(contractAddress, witnessId) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/witnesses/${encodeURIComponent(witnessId)}`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getContractTransaction(contractAddress, txHash) {
     return this.req(
       "GET",
       `/v5/contracts/${encodeURIComponent(contractAddress)}/transactions/${encodeURIComponent(txHash)}`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getTransaction(txHash) {
     return this.req(
       "GET",
       `/v5/transactions/${encodeURIComponent(txHash)}`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getWalletBalance(address) {
     return this.req(
       "GET",
       `/v5/wallets/${encodeURIComponent(address)}/balance`,
-      { auth: "BearerJWT", service: "chain" }
+      { auth: "Public", service: "chain" }
     );
   }
   getDashboardContract() {
@@ -702,8 +699,9 @@ var WitniumchainClient = class {
     url.searchParams.set("code_challenge", challenge);
     url.searchParams.set("code_challenge_method", "S256");
     if (args.prompt) url.searchParams.set("prompt", args.prompt);
-    this.verifierStorageOrDefault().set(state, verifier);
-    this.pendingLogins.set(state, { redirectUri: args.redirectUri });
+    const storage = this.verifierStorageOrDefault();
+    storage.set(state, verifier);
+    storage.set(redirectUriKey(state), args.redirectUri);
     return { authorizationUrl: url.toString(), state };
   }
   /**
@@ -756,24 +754,24 @@ var WitniumchainClient = class {
         message: "WitniumchainClient: no PKCE verifier stored for this `state`. The login flow either was not started in this tab, was already completed, or the sessionStorage entry was cleared."
       });
     }
-    const pending = this.pendingLogins.get(state);
-    if (!pending) {
+    const redirectUri = storage.get(redirectUriKey(state));
+    if (!redirectUri) {
       storage.remove(state);
       throw new WitniumchainApiError({
         status: 0,
-        message: "WitniumchainClient: PKCE verifier exists but the redirectUri for this `state` was not found in client memory (the client instance was replaced between beginOAuthLogin and completeOAuthLogin)."
+        message: "WitniumchainClient: PKCE verifier exists but the redirectUri stored with it for this `state` is missing."
       });
     }
     const discovery = await this.fetchDiscovery();
     const form = new URLSearchParams();
     form.set("grant_type", "authorization_code");
     form.set("code", code);
-    form.set("redirect_uri", pending.redirectUri);
+    form.set("redirect_uri", redirectUri);
     form.set("client_id", this.oauthClientId);
     form.set("code_verifier", verifier);
     const tokens = await this.postTokenEndpoint(discovery.token_endpoint, form);
     storage.remove(state);
-    this.pendingLogins.delete(state);
+    storage.remove(redirectUriKey(state));
     return this.persistTokenResponse(tokens);
   }
   /**
@@ -923,7 +921,6 @@ var WitniumchainClient = class {
    */
   signOut() {
     this.invalidateCredentials();
-    this.pendingLogins.clear();
   }
   // ────────────────────────────────────────────────────────────────────────
   // Internal: OAuth flow helpers
@@ -1504,6 +1501,9 @@ var MfaRecoveryCodes = class {
     return this.client.regenerateRecoveryCodes(proof);
   }
 };
+function redirectUriKey(state) {
+  return `${state}.redirect_uri`;
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }