@worldcoin/idkit-core 1.1.3 → 1.1.4

package/build/index.cjs

@@ -69,6 +69,45 @@ var VerificationLevel = /* @__PURE__ */ ((VerificationLevel2) => {
 // src/bridge.ts
 var import_zustand = require("zustand");
 
+// src/lib/validation.ts
+function validate_bridge_url(bridge_url, is_staging) {
+  try {
+    new URL(bridge_url);
+  } catch (e) {
+    return { valid: false, errors: ["Failed to parse Bridge URL."] };
+  }
+  const test_url = new URL(bridge_url);
+  const errors = [];
+  if (is_staging && ["localhost", "127.0.0.1"].includes(test_url.hostname)) {
+    console.log("Using staging app_id with localhost bridge_url. Skipping validation.");
+    return { valid: true };
+  }
+  if (test_url.protocol !== "https:") {
+    errors.push("Bridge URL must use HTTPS.");
+  }
+  if (test_url.port) {
+    errors.push("Bridge URL must use the default port (443).");
+  }
+  if (test_url.pathname !== "/") {
+    errors.push("Bridge URL must not have a path.");
+  }
+  if (test_url.search) {
+    errors.push("Bridge URL must not have query parameters.");
+  }
+  if (test_url.hash) {
+    errors.push("Bridge URL must not have a fragment.");
+  }
+  if (!test_url.hostname.endsWith(".worldcoin.org") && !test_url.hostname.endsWith(".toolsforhumanity.com")) {
+    console.warn(
+      "Bridge URL should be a subdomain of worldcoin.org or toolsforhumanity.com. The user's identity wallet may refuse to connect. This is a temporary measure and may be removed in the future."
+    );
+  }
+  if (errors.length) {
+    return { valid: false, errors };
+  }
+  return { valid: true };
+}
+
 // src/lib/hashing.ts
 var import_buffer = require("buffer/index.js");
 var import_viem = require("viem");
@@ -177,7 +216,15 @@ var useWorldBridgeStore = (0, import_zustand.create)((set, get) => ({
   verificationState: "loading_widget" /* PreparingClient */,
   createClient: async ({ bridge_url, app_id, verification_level, action_description, action, signal }) => {
     const { key, iv } = await generateKey();
-    const res = await fetch(`${bridge_url ?? DEFAULT_BRIDGE_URL}/request`, {
+    if (bridge_url) {
+      const validation = validate_bridge_url(bridge_url, app_id.includes("staging"));
+      if (!validation.valid) {
+        console.error(validation.errors.join("\n"));
+        set({ verificationState: "failed" /* Failed */ });
+        throw new Error("Invalid bridge_url. Please check the console for more details.");
+      }
+    }
+    const res = await fetch(new URL("/request", bridge_url ?? DEFAULT_BRIDGE_URL), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(
@@ -217,7 +264,7 @@ var useWorldBridgeStore = (0, import_zustand.create)((set, get) => ({
     const key = get().key;
     if (!key)
       throw new Error("No keypair found. Please call `createClient` first.");
-    const res = await fetch(`${get().bridge_url}/response/${get().requestId}`);
+    const res = await fetch(new URL(`/response/${get().requestId}`, get().bridge_url));
     if (!res.ok) {
       return set({
         errorCode: "connection_failed" /* ConnectionFailed */,

package/build/index.js

@@ -42,6 +42,45 @@ var VerificationLevel = /* @__PURE__ */ ((VerificationLevel2) => {
 // src/bridge.ts
 import { create } from "zustand";
 
+// src/lib/validation.ts
+function validate_bridge_url(bridge_url, is_staging) {
+  try {
+    new URL(bridge_url);
+  } catch (e) {
+    return { valid: false, errors: ["Failed to parse Bridge URL."] };
+  }
+  const test_url = new URL(bridge_url);
+  const errors = [];
+  if (is_staging && ["localhost", "127.0.0.1"].includes(test_url.hostname)) {
+    console.log("Using staging app_id with localhost bridge_url. Skipping validation.");
+    return { valid: true };
+  }
+  if (test_url.protocol !== "https:") {
+    errors.push("Bridge URL must use HTTPS.");
+  }
+  if (test_url.port) {
+    errors.push("Bridge URL must use the default port (443).");
+  }
+  if (test_url.pathname !== "/") {
+    errors.push("Bridge URL must not have a path.");
+  }
+  if (test_url.search) {
+    errors.push("Bridge URL must not have query parameters.");
+  }
+  if (test_url.hash) {
+    errors.push("Bridge URL must not have a fragment.");
+  }
+  if (!test_url.hostname.endsWith(".worldcoin.org") && !test_url.hostname.endsWith(".toolsforhumanity.com")) {
+    console.warn(
+      "Bridge URL should be a subdomain of worldcoin.org or toolsforhumanity.com. The user's identity wallet may refuse to connect. This is a temporary measure and may be removed in the future."
+    );
+  }
+  if (errors.length) {
+    return { valid: false, errors };
+  }
+  return { valid: true };
+}
+
 // src/lib/utils.ts
 import { Buffer } from "buffer/index.js";
 var DEFAULT_VERIFICATION_LEVEL = "orb" /* Orb */;
@@ -109,7 +148,15 @@ var useWorldBridgeStore = create((set, get) => ({
   verificationState: "loading_widget" /* PreparingClient */,
   createClient: async ({ bridge_url, app_id, verification_level, action_description, action, signal }) => {
     const { key, iv } = await generateKey();
-    const res = await fetch(`${bridge_url ?? DEFAULT_BRIDGE_URL}/request`, {
+    if (bridge_url) {
+      const validation = validate_bridge_url(bridge_url, app_id.includes("staging"));
+      if (!validation.valid) {
+        console.error(validation.errors.join("\n"));
+        set({ verificationState: "failed" /* Failed */ });
+        throw new Error("Invalid bridge_url. Please check the console for more details.");
+      }
+    }
+    const res = await fetch(new URL("/request", bridge_url ?? DEFAULT_BRIDGE_URL), {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(
@@ -149,7 +196,7 @@ var useWorldBridgeStore = create((set, get) => ({
     const key = get().key;
     if (!key)
       throw new Error("No keypair found. Please call `createClient` first.");
-    const res = await fetch(`${get().bridge_url}/response/${get().requestId}`);
+    const res = await fetch(new URL(`/response/${get().requestId}`, get().bridge_url));
     if (!res.ok) {
       return set({
         errorCode: "connection_failed" /* ConnectionFailed */,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@worldcoin/idkit-core",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "homepage": "https://docs.worldcoin.org/id/idkit",
   "license": "MIT",
   "private": false,