@yeying-community/web3-bs 1.0.14 → 1.0.15

package/dist/auth/ucan.d.ts

@@ -120,6 +120,32 @@ export type UcanAuthErrorInfo = {
     status?: number;
     code?: string | number;
 };
+export type ResolveUcanAuthorizationReason = 'missing_root' | 'expired' | 'not_before' | 'missing_account' | 'invalid_issuer' | 'issuer_mismatch' | 'capability_mismatch' | 'audience_mismatch' | 'service_host_mismatch';
+export type ResolveUcanAuthorizationOptions = {
+    sessionId?: string;
+    root?: UcanRootProof | null;
+    currentAccount?: string | null;
+    expectedCapabilities?: UcanCapability[];
+    expectedAudience?: string | null;
+    expectedServiceHosts?: Record<string, string | null | undefined>;
+    recoverAccountFromRoot?: boolean;
+    nowMs?: number;
+};
+export type ResolveUcanAuthorizationResult = {
+    status: 'authorized';
+    account: string;
+    root: UcanRootProof;
+    restoredAccount: boolean;
+    expiresAt: number;
+} | {
+    status: 'unauthorized';
+    reason: ResolveUcanAuthorizationReason;
+    root?: UcanRootProof | null;
+    account?: string | null;
+    expiresAt?: number;
+    expected?: string;
+    actual?: string;
+};
 export declare const DEFAULT_UCAN_SESSION_TTL_MS: number;
 export declare const DEFAULT_UCAN_TOKEN_TTL_MS: number;
 export declare const DEFAULT_UCAN_TOKEN_SKEW_MS: number;
@@ -132,6 +158,7 @@ export declare function normalizeUcanCapabilities(caps: UcanCapability[] | undef
     includeLegacyAliases?: boolean;
 }): UcanCapability[];
 export declare function normalizeUcanExpiry(exp: number | undefined, fallbackMs: number): number;
+export declare function parseUcanAccountFromIssuer(issuer?: string | null): string | null;
 export declare function decodeUcanPayload(token: string): UcanTokenPayload | null;
 export declare function getUcanTokenTiming(token: string, options?: {
     nowMs?: number;
@@ -145,6 +172,7 @@ export declare function createUcanSession(options?: CreateUcanSessionOptions): P
 export declare function clearUcanSession(id?: string): Promise<void>;
 export declare function storeUcanRoot(root: UcanRootProof, id?: string): Promise<void>;
 export declare function getStoredUcanRoot(id?: string): Promise<UcanRootProof | null>;
+export declare function resolveUcanAuthorization(options?: ResolveUcanAuthorizationOptions): Promise<ResolveUcanAuthorizationResult>;
 export declare function getOrCreateUcanRoot(options: CreateRootUcanOptions): Promise<UcanRootProof>;
 export declare function createRootUcan(options: CreateRootUcanOptions): Promise<UcanRootProof>;
 export declare function createDelegationUcan(options: CreateUcanTokenOptions): Promise<string>;

package/dist/web3-bs.esm.js

@@ -864,6 +864,73 @@ function normalizeExpiry(exp, fallbackMs) {
 function normalizeUcanExpiry(exp, fallbackMs) {
     return normalizeExpiry(exp, fallbackMs);
 }
+function normalizeEthAccount(account) {
+    return String(account || '').trim().toLowerCase();
+}
+function parseUcanAccountFromIssuer(issuer) {
+    const normalized = String(issuer || '').trim().toLowerCase();
+    const prefix = 'did:pkh:eth:';
+    if (!normalized.startsWith(prefix))
+        return null;
+    const account = normalized.slice(prefix.length);
+    return account || null;
+}
+function getUcanIssuerForAccount(account) {
+    return `did:pkh:eth:${normalizeEthAccount(account)}`;
+}
+function extractUcanStatementPayload(message) {
+    if (!message || typeof message !== 'string')
+        return null;
+    const marker = 'UCAN-AUTH';
+    const index = message.indexOf(marker);
+    if (index < 0)
+        return null;
+    const jsonStart = message.indexOf('{', index + marker.length);
+    const jsonEnd = message.lastIndexOf('}');
+    if (jsonStart < 0 || jsonEnd < jsonStart)
+        return null;
+    try {
+        const parsed = JSON.parse(message.slice(jsonStart, jsonEnd + 1));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function getUcanRootServiceHosts(root) {
+    const payload = extractUcanStatementPayload(root.siwe?.message);
+    const hosts = payload?.service_hosts;
+    if (!hosts || typeof hosts !== 'object' || Array.isArray(hosts)) {
+        return null;
+    }
+    return hosts;
+}
+function getServiceHostMismatch(root, expectedServiceHosts) {
+    if (!expectedServiceHosts)
+        return null;
+    const entries = Object.entries(expectedServiceHosts)
+        .map(([key, value]) => [key, String(value || '').trim()])
+        .filter(([, value]) => Boolean(value));
+    if (!entries.length)
+        return null;
+    const hosts = getUcanRootServiceHosts(root);
+    if (!hosts) {
+        return {
+            expected: entries.map(([key, value]) => `${key}:${value}`).join('|'),
+            actual: '',
+        };
+    }
+    for (const [key, expected] of entries) {
+        const actual = typeof hosts[key] === 'string' ? hosts[key].trim() : '';
+        if (actual !== expected) {
+            return { expected, actual };
+        }
+    }
+    return null;
+}
 function decodeUcanPayload(token) {
     const parts = String(token || '').split('.');
     if (parts.length < 2)
@@ -1291,6 +1358,105 @@ function capsEqual(a, b) {
 function isRootExpired(root, nowMs) {
     return Boolean(root.exp && nowMs > root.exp);
 }
+async function resolveUcanAuthorization(options = {}) {
+    const root = options.root === undefined
+        ? await getStoredUcanRoot(options.sessionId || DEFAULT_SESSION_ID)
+        : options.root;
+    const nowMs = options.nowMs ?? Date.now();
+    if (!root) {
+        return { status: 'unauthorized', reason: 'missing_root', root };
+    }
+    if (typeof root.exp !== 'number' || root.exp <= nowMs) {
+        return {
+            status: 'unauthorized',
+            reason: 'expired',
+            root,
+            expiresAt: root.exp,
+        };
+    }
+    if (typeof root.nbf === 'number' && root.nbf > nowMs) {
+        return {
+            status: 'unauthorized',
+            reason: 'not_before',
+            root,
+            expiresAt: root.exp,
+        };
+    }
+    const accountFromIssuer = parseUcanAccountFromIssuer(root.iss);
+    if (!accountFromIssuer) {
+        return {
+            status: 'unauthorized',
+            reason: 'invalid_issuer',
+            root,
+            expiresAt: root.exp,
+            actual: root.iss,
+        };
+    }
+    const currentAccount = normalizeEthAccount(options.currentAccount);
+    if (!currentAccount && !options.recoverAccountFromRoot) {
+        return {
+            status: 'unauthorized',
+            reason: 'missing_account',
+            root,
+            account: null,
+            expiresAt: root.exp,
+        };
+    }
+    const account = currentAccount || accountFromIssuer;
+    const expectedIssuer = getUcanIssuerForAccount(account);
+    if (root.iss !== expectedIssuer) {
+        return {
+            status: 'unauthorized',
+            reason: 'issuer_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: expectedIssuer,
+            actual: root.iss,
+        };
+    }
+    if (options.expectedCapabilities &&
+        !capsEqual(root.cap, options.expectedCapabilities)) {
+        return {
+            status: 'unauthorized',
+            reason: 'capability_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+        };
+    }
+    const expectedAudience = String(options.expectedAudience || '').trim();
+    if (expectedAudience && root.aud !== expectedAudience) {
+        return {
+            status: 'unauthorized',
+            reason: 'audience_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: expectedAudience,
+            actual: root.aud,
+        };
+    }
+    const serviceHostMismatch = getServiceHostMismatch(root, options.expectedServiceHosts);
+    if (serviceHostMismatch) {
+        return {
+            status: 'unauthorized',
+            reason: 'service_host_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: serviceHostMismatch.expected,
+            actual: serviceHostMismatch.actual,
+        };
+    }
+    return {
+        status: 'authorized',
+        account,
+        root,
+        restoredAccount: !currentAccount && account === accountFromIssuer,
+        expiresAt: root.exp,
+    };
+}
 async function getOrCreateUcanRoot(options) {
     const provider = options.provider || (await requireProvider());
     const session = options.session || (await createUcanSession({ id: options.sessionId, provider }));
@@ -2525,5 +2691,5 @@ async function initDappSession(options) {
     return result;
 }
 
-export { CipherError, DEFAULT_UCAN_SESSION_TTL_MS, DEFAULT_UCAN_TOKEN_SKEW_MS, DEFAULT_UCAN_TOKEN_TTL_MS, WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, base64ToBytes, bytesToBase64, classifyUcanAuthError, classifyWalletError, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, decodeUcanPayload, decrypt, deriveAppIdFromHost, deriveAppIdFromLocation, encrypt, focusPendingApproval, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateInvocationUcan, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getSupportedCipherSuites, getUcanSession, getUcanTokenTiming, getWalletErrorCode, getWalletErrorMessage, initDappSession, initWebDavStorage, isUcanTokenFresh, isUserRejectedWalletAction, isWalletReconnectError, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeAppHostnameForAppId, normalizeUcanCapabilities, normalizeUcanCapability, normalizeUcanExpiry, onAccountsChanged, onChainChanged, refreshAccessToken, requestAccounts, requireProvider, resolveWalletAccount, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts, watchProvider };
+export { CipherError, DEFAULT_UCAN_SESSION_TTL_MS, DEFAULT_UCAN_TOKEN_SKEW_MS, DEFAULT_UCAN_TOKEN_TTL_MS, WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, base64ToBytes, bytesToBase64, classifyUcanAuthError, classifyWalletError, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, decodeUcanPayload, decrypt, deriveAppIdFromHost, deriveAppIdFromLocation, encrypt, focusPendingApproval, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateInvocationUcan, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getSupportedCipherSuites, getUcanSession, getUcanTokenTiming, getWalletErrorCode, getWalletErrorMessage, initDappSession, initWebDavStorage, isUcanTokenFresh, isUserRejectedWalletAction, isWalletReconnectError, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeAppHostnameForAppId, normalizeUcanCapabilities, normalizeUcanCapability, normalizeUcanExpiry, onAccountsChanged, onChainChanged, parseUcanAccountFromIssuer, refreshAccessToken, requestAccounts, requireProvider, resolveUcanAuthorization, resolveWalletAccount, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts, watchProvider };
 //# sourceMappingURL=web3-bs.esm.js.map