@yeying-community/web3-bs 1.0.14 → 1.0.16

package/dist/web3-bs.umd.js

@@ -870,6 +870,73 @@
     function normalizeUcanExpiry(exp, fallbackMs) {
         return normalizeExpiry(exp, fallbackMs);
     }
+    function normalizeEthAccount(account) {
+        return String(account || '').trim().toLowerCase();
+    }
+    function parseUcanAccountFromIssuer(issuer) {
+        const normalized = String(issuer || '').trim().toLowerCase();
+        const prefix = 'did:pkh:eth:';
+        if (!normalized.startsWith(prefix))
+            return null;
+        const account = normalized.slice(prefix.length);
+        return account || null;
+    }
+    function getUcanIssuerForAccount(account) {
+        return `did:pkh:eth:${normalizeEthAccount(account)}`;
+    }
+    function extractUcanStatementPayload(message) {
+        if (!message || typeof message !== 'string')
+            return null;
+        const marker = 'UCAN-AUTH';
+        const index = message.indexOf(marker);
+        if (index < 0)
+            return null;
+        const jsonStart = message.indexOf('{', index + marker.length);
+        const jsonEnd = message.lastIndexOf('}');
+        if (jsonStart < 0 || jsonEnd < jsonStart)
+            return null;
+        try {
+            const parsed = JSON.parse(message.slice(jsonStart, jsonEnd + 1));
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                return null;
+            }
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    }
+    function getUcanRootServiceHosts(root) {
+        const payload = extractUcanStatementPayload(root.siwe?.message);
+        const hosts = payload?.service_hosts;
+        if (!hosts || typeof hosts !== 'object' || Array.isArray(hosts)) {
+            return null;
+        }
+        return hosts;
+    }
+    function getServiceHostMismatch(root, expectedServiceHosts) {
+        if (!expectedServiceHosts)
+            return null;
+        const entries = Object.entries(expectedServiceHosts)
+            .map(([key, value]) => [key, String(value || '').trim()])
+            .filter(([, value]) => Boolean(value));
+        if (!entries.length)
+            return null;
+        const hosts = getUcanRootServiceHosts(root);
+        if (!hosts) {
+            return {
+                expected: entries.map(([key, value]) => `${key}:${value}`).join('|'),
+                actual: '',
+            };
+        }
+        for (const [key, expected] of entries) {
+            const actual = typeof hosts[key] === 'string' ? hosts[key].trim() : '';
+            if (actual !== expected) {
+                return { expected, actual };
+            }
+        }
+        return null;
+    }
     function decodeUcanPayload(token) {
         const parts = String(token || '').split('.');
         if (parts.length < 2)
@@ -1297,6 +1364,105 @@
     function isRootExpired(root, nowMs) {
         return Boolean(root.exp && nowMs > root.exp);
     }
+    async function resolveUcanAuthorization(options = {}) {
+        const root = options.root === undefined
+            ? await getStoredUcanRoot(options.sessionId || DEFAULT_SESSION_ID)
+            : options.root;
+        const nowMs = options.nowMs ?? Date.now();
+        if (!root) {
+            return { status: 'unauthorized', reason: 'missing_root', root };
+        }
+        if (typeof root.exp !== 'number' || root.exp <= nowMs) {
+            return {
+                status: 'unauthorized',
+                reason: 'expired',
+                root,
+                expiresAt: root.exp,
+            };
+        }
+        if (typeof root.nbf === 'number' && root.nbf > nowMs) {
+            return {
+                status: 'unauthorized',
+                reason: 'not_before',
+                root,
+                expiresAt: root.exp,
+            };
+        }
+        const accountFromIssuer = parseUcanAccountFromIssuer(root.iss);
+        if (!accountFromIssuer) {
+            return {
+                status: 'unauthorized',
+                reason: 'invalid_issuer',
+                root,
+                expiresAt: root.exp,
+                actual: root.iss,
+            };
+        }
+        const currentAccount = normalizeEthAccount(options.currentAccount);
+        if (!currentAccount && !options.recoverAccountFromRoot) {
+            return {
+                status: 'unauthorized',
+                reason: 'missing_account',
+                root,
+                account: null,
+                expiresAt: root.exp,
+            };
+        }
+        const account = currentAccount || accountFromIssuer;
+        const expectedIssuer = getUcanIssuerForAccount(account);
+        if (root.iss !== expectedIssuer) {
+            return {
+                status: 'unauthorized',
+                reason: 'issuer_mismatch',
+                root,
+                account,
+                expiresAt: root.exp,
+                expected: expectedIssuer,
+                actual: root.iss,
+            };
+        }
+        if (options.expectedCapabilities &&
+            !capsEqual(root.cap, options.expectedCapabilities)) {
+            return {
+                status: 'unauthorized',
+                reason: 'capability_mismatch',
+                root,
+                account,
+                expiresAt: root.exp,
+            };
+        }
+        const expectedAudience = String(options.expectedAudience || '').trim();
+        if (expectedAudience && root.aud !== expectedAudience) {
+            return {
+                status: 'unauthorized',
+                reason: 'audience_mismatch',
+                root,
+                account,
+                expiresAt: root.exp,
+                expected: expectedAudience,
+                actual: root.aud,
+            };
+        }
+        const serviceHostMismatch = getServiceHostMismatch(root, options.expectedServiceHosts);
+        if (serviceHostMismatch) {
+            return {
+                status: 'unauthorized',
+                reason: 'service_host_mismatch',
+                root,
+                account,
+                expiresAt: root.exp,
+                expected: serviceHostMismatch.expected,
+                actual: serviceHostMismatch.actual,
+            };
+        }
+        return {
+            status: 'authorized',
+            account,
+            root,
+            restoredAccount: !currentAccount && account === accountFromIssuer,
+            expiresAt: root.exp,
+        };
+    }
     async function getOrCreateUcanRoot(options) {
         const provider = options.provider || (await requireProvider());
         const session = options.session || (await createUcanSession({ id: options.sessionId, provider }));
@@ -1876,7 +2042,8 @@
      * 调用钱包插件的 `yeying_encrypt` / `yeying_decrypt` / `yeying_getCipherSuites`
      * EIP-1193 自定义方法。命名安全套件 + 静默执行 + 站点授权模型同 UCAN。
      *
-     * 数据密码（password 参数）由 DApp 自行管理与钱包密码独立；
+     * 默认数据密码（password 参数）由 DApp 自行管理与钱包密码独立；
+     * 也可通过 passwordSource 请求钱包插件在钱包内部派生加密密码。
      * plaintext 走 base64 字符串跨 message 边界传输。
      */
     class CipherError extends Error {
@@ -1927,6 +2094,8 @@
                 params: [{
                         data: options.data,
                         password: options.password,
+                        passwordSource: options.passwordSource,
+                        passwordContext: options.passwordContext,
                         suite: options.suite
                     }]
             });
@@ -1950,7 +2119,9 @@
                 method: 'yeying_decrypt',
                 params: [{
                         ciphertext: options.ciphertext,
-                        password: options.password
+                        password: options.password,
+                        passwordSource: options.passwordSource,
+                        passwordContext: options.passwordContext
                     }]
             });
             if (!result || typeof result !== 'object' || typeof result.plaintext !== 'string') {
@@ -2592,9 +2763,11 @@
     exports.normalizeUcanExpiry = normalizeUcanExpiry;
     exports.onAccountsChanged = onAccountsChanged;
     exports.onChainChanged = onChainChanged;
+    exports.parseUcanAccountFromIssuer = parseUcanAccountFromIssuer;
     exports.refreshAccessToken = refreshAccessToken;
     exports.requestAccounts = requestAccounts;
     exports.requireProvider = requireProvider;
+    exports.resolveUcanAuthorization = resolveUcanAuthorization;
     exports.resolveWalletAccount = resolveWalletAccount;
     exports.setAccessToken = setAccessToken;
     exports.setCentralSessionToken = setCentralSessionToken;