@yeying-community/web3-bs 1.0.14 → 1.0.16

package/dist/auth/encrypt.d.ts

@@ -4,7 +4,8 @@
  * 调用钱包插件的 `yeying_encrypt` / `yeying_decrypt` / `yeying_getCipherSuites`
  * EIP-1193 自定义方法。命名安全套件 + 静默执行 + 站点授权模型同 UCAN。
  *
- * 数据密码（password 参数）由 DApp 自行管理与钱包密码独立；
+ * 默认数据密码（password 参数）由 DApp 自行管理与钱包密码独立；
+ * 也可通过 passwordSource 请求钱包插件在钱包内部派生加密密码。
  * plaintext 走 base64 字符串跨 message 边界传输。
  */
 import { isUserRejectedWalletAction } from './provider';
@@ -14,15 +15,20 @@ export interface CipherSuiteInfo {
     description: string;
     mode: 'hash' | 'symmetric';
 }
+export type CipherPasswordSource = 'manual' | 'wallet' | 'wallet+password';
 export interface EncryptOptions {
     data: string | Uint8Array;
-    password: string;
+    password?: string;
+    passwordSource?: CipherPasswordSource;
+    passwordContext?: string;
     suite?: string;
     provider?: Eip1193Provider;
 }
 export interface DecryptOptions {
     ciphertext: string;
-    password: string;
+    password?: string;
+    passwordSource?: CipherPasswordSource;
+    passwordContext?: string;
     provider?: Eip1193Provider;
 }
 export interface GetCipherSuitesOptions {

package/dist/auth/ucan.d.ts

@@ -120,6 +120,32 @@ export type UcanAuthErrorInfo = {
     status?: number;
     code?: string | number;
 };
+export type ResolveUcanAuthorizationReason = 'missing_root' | 'expired' | 'not_before' | 'missing_account' | 'invalid_issuer' | 'issuer_mismatch' | 'capability_mismatch' | 'audience_mismatch' | 'service_host_mismatch';
+export type ResolveUcanAuthorizationOptions = {
+    sessionId?: string;
+    root?: UcanRootProof | null;
+    currentAccount?: string | null;
+    expectedCapabilities?: UcanCapability[];
+    expectedAudience?: string | null;
+    expectedServiceHosts?: Record<string, string | null | undefined>;
+    recoverAccountFromRoot?: boolean;
+    nowMs?: number;
+};
+export type ResolveUcanAuthorizationResult = {
+    status: 'authorized';
+    account: string;
+    root: UcanRootProof;
+    restoredAccount: boolean;
+    expiresAt: number;
+} | {
+    status: 'unauthorized';
+    reason: ResolveUcanAuthorizationReason;
+    root?: UcanRootProof | null;
+    account?: string | null;
+    expiresAt?: number;
+    expected?: string;
+    actual?: string;
+};
 export declare const DEFAULT_UCAN_SESSION_TTL_MS: number;
 export declare const DEFAULT_UCAN_TOKEN_TTL_MS: number;
 export declare const DEFAULT_UCAN_TOKEN_SKEW_MS: number;
@@ -132,6 +158,7 @@ export declare function normalizeUcanCapabilities(caps: UcanCapability[] | undef
     includeLegacyAliases?: boolean;
 }): UcanCapability[];
 export declare function normalizeUcanExpiry(exp: number | undefined, fallbackMs: number): number;
+export declare function parseUcanAccountFromIssuer(issuer?: string | null): string | null;
 export declare function decodeUcanPayload(token: string): UcanTokenPayload | null;
 export declare function getUcanTokenTiming(token: string, options?: {
     nowMs?: number;
@@ -145,6 +172,7 @@ export declare function createUcanSession(options?: CreateUcanSessionOptions): P
 export declare function clearUcanSession(id?: string): Promise<void>;
 export declare function storeUcanRoot(root: UcanRootProof, id?: string): Promise<void>;
 export declare function getStoredUcanRoot(id?: string): Promise<UcanRootProof | null>;
+export declare function resolveUcanAuthorization(options?: ResolveUcanAuthorizationOptions): Promise<ResolveUcanAuthorizationResult>;
 export declare function getOrCreateUcanRoot(options: CreateRootUcanOptions): Promise<UcanRootProof>;
 export declare function createRootUcan(options: CreateRootUcanOptions): Promise<UcanRootProof>;
 export declare function createDelegationUcan(options: CreateUcanTokenOptions): Promise<string>;

package/dist/web3-bs.esm.js

@@ -864,6 +864,73 @@ function normalizeExpiry(exp, fallbackMs) {
 function normalizeUcanExpiry(exp, fallbackMs) {
     return normalizeExpiry(exp, fallbackMs);
 }
+function normalizeEthAccount(account) {
+    return String(account || '').trim().toLowerCase();
+}
+function parseUcanAccountFromIssuer(issuer) {
+    const normalized = String(issuer || '').trim().toLowerCase();
+    const prefix = 'did:pkh:eth:';
+    if (!normalized.startsWith(prefix))
+        return null;
+    const account = normalized.slice(prefix.length);
+    return account || null;
+}
+function getUcanIssuerForAccount(account) {
+    return `did:pkh:eth:${normalizeEthAccount(account)}`;
+}
+function extractUcanStatementPayload(message) {
+    if (!message || typeof message !== 'string')
+        return null;
+    const marker = 'UCAN-AUTH';
+    const index = message.indexOf(marker);
+    if (index < 0)
+        return null;
+    const jsonStart = message.indexOf('{', index + marker.length);
+    const jsonEnd = message.lastIndexOf('}');
+    if (jsonStart < 0 || jsonEnd < jsonStart)
+        return null;
+    try {
+        const parsed = JSON.parse(message.slice(jsonStart, jsonEnd + 1));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function getUcanRootServiceHosts(root) {
+    const payload = extractUcanStatementPayload(root.siwe?.message);
+    const hosts = payload?.service_hosts;
+    if (!hosts || typeof hosts !== 'object' || Array.isArray(hosts)) {
+        return null;
+    }
+    return hosts;
+}
+function getServiceHostMismatch(root, expectedServiceHosts) {
+    if (!expectedServiceHosts)
+        return null;
+    const entries = Object.entries(expectedServiceHosts)
+        .map(([key, value]) => [key, String(value || '').trim()])
+        .filter(([, value]) => Boolean(value));
+    if (!entries.length)
+        return null;
+    const hosts = getUcanRootServiceHosts(root);
+    if (!hosts) {
+        return {
+            expected: entries.map(([key, value]) => `${key}:${value}`).join('|'),
+            actual: '',
+        };
+    }
+    for (const [key, expected] of entries) {
+        const actual = typeof hosts[key] === 'string' ? hosts[key].trim() : '';
+        if (actual !== expected) {
+            return { expected, actual };
+        }
+    }
+    return null;
+}
 function decodeUcanPayload(token) {
     const parts = String(token || '').split('.');
     if (parts.length < 2)
@@ -1291,6 +1358,105 @@ function capsEqual(a, b) {
 function isRootExpired(root, nowMs) {
     return Boolean(root.exp && nowMs > root.exp);
 }
+async function resolveUcanAuthorization(options = {}) {
+    const root = options.root === undefined
+        ? await getStoredUcanRoot(options.sessionId || DEFAULT_SESSION_ID)
+        : options.root;
+    const nowMs = options.nowMs ?? Date.now();
+    if (!root) {
+        return { status: 'unauthorized', reason: 'missing_root', root };
+    }
+    if (typeof root.exp !== 'number' || root.exp <= nowMs) {
+        return {
+            status: 'unauthorized',
+            reason: 'expired',
+            root,
+            expiresAt: root.exp,
+        };
+    }
+    if (typeof root.nbf === 'number' && root.nbf > nowMs) {
+        return {
+            status: 'unauthorized',
+            reason: 'not_before',
+            root,
+            expiresAt: root.exp,
+        };
+    }
+    const accountFromIssuer = parseUcanAccountFromIssuer(root.iss);
+    if (!accountFromIssuer) {
+        return {
+            status: 'unauthorized',
+            reason: 'invalid_issuer',
+            root,
+            expiresAt: root.exp,
+            actual: root.iss,
+        };
+    }
+    const currentAccount = normalizeEthAccount(options.currentAccount);
+    if (!currentAccount && !options.recoverAccountFromRoot) {
+        return {
+            status: 'unauthorized',
+            reason: 'missing_account',
+            root,
+            account: null,
+            expiresAt: root.exp,
+        };
+    }
+    const account = currentAccount || accountFromIssuer;
+    const expectedIssuer = getUcanIssuerForAccount(account);
+    if (root.iss !== expectedIssuer) {
+        return {
+            status: 'unauthorized',
+            reason: 'issuer_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: expectedIssuer,
+            actual: root.iss,
+        };
+    }
+    if (options.expectedCapabilities &&
+        !capsEqual(root.cap, options.expectedCapabilities)) {
+        return {
+            status: 'unauthorized',
+            reason: 'capability_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+        };
+    }
+    const expectedAudience = String(options.expectedAudience || '').trim();
+    if (expectedAudience && root.aud !== expectedAudience) {
+        return {
+            status: 'unauthorized',
+            reason: 'audience_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: expectedAudience,
+            actual: root.aud,
+        };
+    }
+    const serviceHostMismatch = getServiceHostMismatch(root, options.expectedServiceHosts);
+    if (serviceHostMismatch) {
+        return {
+            status: 'unauthorized',
+            reason: 'service_host_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: serviceHostMismatch.expected,
+            actual: serviceHostMismatch.actual,
+        };
+    }
+    return {
+        status: 'authorized',
+        account,
+        root,
+        restoredAccount: !currentAccount && account === accountFromIssuer,
+        expiresAt: root.exp,
+    };
+}
 async function getOrCreateUcanRoot(options) {
     const provider = options.provider || (await requireProvider());
     const session = options.session || (await createUcanSession({ id: options.sessionId, provider }));
@@ -1870,7 +2036,8 @@ async function authCentralUcanFetch(input, init = {}, options = {}) {
  * 调用钱包插件的 `yeying_encrypt` / `yeying_decrypt` / `yeying_getCipherSuites`
  * EIP-1193 自定义方法。命名安全套件 + 静默执行 + 站点授权模型同 UCAN。
  *
- * 数据密码（password 参数）由 DApp 自行管理与钱包密码独立；
+ * 默认数据密码（password 参数）由 DApp 自行管理与钱包密码独立；
+ * 也可通过 passwordSource 请求钱包插件在钱包内部派生加密密码。
  * plaintext 走 base64 字符串跨 message 边界传输。
  */
 class CipherError extends Error {
@@ -1921,6 +2088,8 @@ async function encrypt(options) {
             params: [{
                     data: options.data,
                     password: options.password,
+                    passwordSource: options.passwordSource,
+                    passwordContext: options.passwordContext,
                     suite: options.suite
                 }]
         });
@@ -1944,7 +2113,9 @@ async function decrypt(options) {
             method: 'yeying_decrypt',
             params: [{
                     ciphertext: options.ciphertext,
-                    password: options.password
+                    password: options.password,
+                    passwordSource: options.passwordSource,
+                    passwordContext: options.passwordContext
                 }]
         });
         if (!result || typeof result !== 'object' || typeof result.plaintext !== 'string') {
@@ -2525,5 +2696,5 @@ async function initDappSession(options) {
     return result;
 }
 
-export { CipherError, DEFAULT_UCAN_SESSION_TTL_MS, DEFAULT_UCAN_TOKEN_SKEW_MS, DEFAULT_UCAN_TOKEN_TTL_MS, WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, base64ToBytes, bytesToBase64, classifyUcanAuthError, classifyWalletError, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, decodeUcanPayload, decrypt, deriveAppIdFromHost, deriveAppIdFromLocation, encrypt, focusPendingApproval, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateInvocationUcan, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getSupportedCipherSuites, getUcanSession, getUcanTokenTiming, getWalletErrorCode, getWalletErrorMessage, initDappSession, initWebDavStorage, isUcanTokenFresh, isUserRejectedWalletAction, isWalletReconnectError, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeAppHostnameForAppId, normalizeUcanCapabilities, normalizeUcanCapability, normalizeUcanExpiry, onAccountsChanged, onChainChanged, refreshAccessToken, requestAccounts, requireProvider, resolveWalletAccount, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts, watchProvider };
+export { CipherError, DEFAULT_UCAN_SESSION_TTL_MS, DEFAULT_UCAN_TOKEN_SKEW_MS, DEFAULT_UCAN_TOKEN_TTL_MS, WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, base64ToBytes, bytesToBase64, classifyUcanAuthError, classifyWalletError, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, decodeUcanPayload, decrypt, deriveAppIdFromHost, deriveAppIdFromLocation, encrypt, focusPendingApproval, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateInvocationUcan, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getSupportedCipherSuites, getUcanSession, getUcanTokenTiming, getWalletErrorCode, getWalletErrorMessage, initDappSession, initWebDavStorage, isUcanTokenFresh, isUserRejectedWalletAction, isWalletReconnectError, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeAppHostnameForAppId, normalizeUcanCapabilities, normalizeUcanCapability, normalizeUcanExpiry, onAccountsChanged, onChainChanged, parseUcanAccountFromIssuer, refreshAccessToken, requestAccounts, requireProvider, resolveUcanAuthorization, resolveWalletAccount, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts, watchProvider };
 //# sourceMappingURL=web3-bs.esm.js.map