@zkproofport-app/sdk 0.2.9 → 0.2.11

package/dist/index.js

@@ -618,8 +618,16 @@ function validateMdlInputs(circuit, inputs) {
 const MAX_RETURN_SCHEME_LENGTH = 128;
 /** RFC 3986 scheme (`ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`) followed by exactly `://`. */
 const BARE_SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\/$/;
-/** `https://host[:port]` with no userinfo, path, query or fragment. */
-const HTTPS_ORIGIN_RE = /^https:\/\/[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+(:[0-9]{1,5})?$/;
+/**
+ * Schemes we refuse even in the bare `scheme://` shape.
+ *
+ * `http` and `https` are the back door the shape rule alone leaves open: with
+ * no host, `https://` is shaped exactly like a bare custom scheme and would
+ * otherwise pass. A browser pointed at nowhere is not a return target, and
+ * accepting it would re-open the URL-shaped door this field just closed.
+ * `googlechrome://` and `firefox://` are deliberately NOT denied — bare, they
+ * foreground that browser without navigating, which is the whole point.
+ */
 const DENIED_RETURN_SCHEMES = new Set([
     'about',
     'blob',
@@ -630,6 +638,7 @@ const DENIED_RETURN_SCHEMES = new Set([
     'file',
     'ftp',
     'http',
+    'https',
     'intent',
     'javascript',
     'jar',
@@ -643,6 +652,11 @@ const DENIED_RETURN_SCHEMES = new Set([
  * value fails fast in the integrator's own code instead of coming back as a
  * relay 400. The relay re-validates and is the authority.
  *
+ * One shape is accepted: a bare custom scheme such as `mydapp://`. It names an
+ * app to switch back to, never a page to visit — so hosts, paths and query
+ * strings are rejected, and an https URL is not a valid value. A web page has
+ * no app to return to and simply omits the field.
+ *
  * @param value - Candidate return target
  * @returns `null` when acceptable, otherwise a human-readable error message
  *
@@ -663,11 +677,8 @@ function validateReturnScheme(value) {
         return 'returnScheme must not contain whitespace';
     }
     const normalized = value.toLowerCase();
-    if (HTTPS_ORIGIN_RE.test(normalized)) {
-        return null;
-    }
     if (!BARE_SCHEME_RE.test(normalized)) {
-        return 'returnScheme must be a bare custom scheme such as "mydapp://" or an https origin such as "https://myapp.com" — paths, query strings and fragments are not accepted';
+        return 'returnScheme must be a bare custom scheme such as "mydapp://" — hosts, paths, query strings and fragments are not accepted, and an https URL is not a return target';
     }
     const schemeName = normalized.slice(0, normalized.indexOf(':'));
     if (DENIED_RETURN_SCHEMES.has(schemeName)) {
@@ -675,6 +686,90 @@ function validateReturnScheme(value) {
     }
     return null;
 }
+/**
+ * The return target to use when the integrator named none.
+ *
+ * Only the requesting PAGE can answer "which browser is this?" — iOS gives the
+ * ZKProofport app nothing to work with (`sourceApplication` is nil across team
+ * identifiers, and there is no public API to foreground an app by bundle id).
+ * So the detection has to happen here, in the SDK, and travel with the request.
+ *
+ * Two cases are detected, each from a POSITIVE token, and each verified in the
+ * browser's own source to foreground WITHOUT navigating anywhere:
+ *
+ *   Chrome for iOS  (`CriOS/`) -> `googlechrome://`
+ *   Firefox for iOS (`FxiOS/`) -> `firefox://`
+ *
+ * The BARE scheme is the point in both cases: it carries no URL, so the browser
+ * comes forward with nothing to open and the user lands on the tab they were
+ * already reading — no new tab, no navigation, no reload, JS state intact.
+ *
+ * Chrome: `ios/chrome/app/startup/chrome_app_startup_parameters.mm` replaces
+ * the scheme with `http`, producing `http://`, which fails GURL validation
+ * (`if (!externalURL.is_valid()) return nil;`), so the startup parameters are
+ * nil and there is nothing to open.
+ *
+ * Firefox: `firefox://` has an empty host, and
+ * `Coordinators/Router/RouteBuilder.swift` resolves the host through
+ * `DeeplinkInput.Host(rawValue: "")`, which is nil because no case has an empty
+ * raw value (`Coordinators/Router/DeeplinkInput.swift`). The scheme is not http
+ * either, so `makeRoute(url:)` falls to its final `else { return nil }`, and
+ * `SceneDelegate.handleOpenURL` then hits `guard let route = ... else
+ * { return }` and does nothing at all. Verified on the warm path — the browser
+ * is already running, which is always true here, because the user came from a
+ * page in it.
+ *
+ * Everything else deliberately returns undefined, and that is not a gap:
+ *
+ *   - Safari has no equivalent. No scheme means "just come forward";
+ *     `https://<url>` navigates and opens a new tab, `x-web-search://` opens a
+ *     search page. Both lose the user's page.
+ *   - Brave and Arc for iOS are UNDETECTABLE. Brave ships no UA token and
+ *     identifies itself only via Client Hints, which WebKit does not implement,
+ *     so it looks exactly like Safari. Inferring "Safari" by elimination and
+ *     firing a Safari-ish scheme would throw Brave and Arc users into a browser
+ *     they were not using — strictly worse than doing nothing.
+ *   - In-app webviews (KakaoTalk, Naver, Line, Instagram) are not tabs at all.
+ *     Any scheme destroys the page; the system "< Back to X" breadcrumb is the
+ *     only thing that preserves it.
+ *   - Edge (`EdgiOS`) and Opera (`OPiOS` / `OPT`) for iOS are NOT included.
+ *     Both are closed source, so `microsoft-edge://` and `opera-http://` cannot
+ *     be checked the way Chrome's and Firefox's were. Their bare schemes are
+ *     plausible analogues, and that is exactly why they stay out: an unverified
+ *     guess that opens a new tab is the bug this field exists to avoid. Add one
+ *     only with evidence that it foregrounds WITHOUT navigating.
+ *   - Android needs nothing: the ZKProofport app brings itself to the back
+ *     (`moveTaskToBack`), which resumes the browser exactly as it was.
+ *
+ * When this returns undefined the field is omitted and the ZKProofport app
+ * tells the user the proof was delivered and to switch back themselves.
+ *
+ * @param userAgent - override, for tests. Defaults to `navigator.userAgent`.
+ *   Returns undefined when there is no navigator at all (Node, SSR).
+ * @returns a scheme that is safe to open, or undefined to send nothing
+ *
+ * @internal
+ */
+function detectReturnScheme(userAgent) {
+    const ua = (typeof navigator === 'undefined' ? undefined : navigator.userAgent);
+    if (typeof ua !== 'string' || ua.length === 0) {
+        return undefined;
+    }
+    // A device token is required alongside the browser token. `CriOS` and `FxiOS`
+    // are already iOS-only and unambiguous on their own, but pairing them with the
+    // device token costs nothing and stops a synthetic or spoofed desktop user
+    // agent from producing a mobile-only scheme.
+    if (!/(iPhone|iPad|iPod)/.test(ua)) {
+        return undefined;
+    }
+    if (/CriOS\//.test(ua)) {
+        return 'googlechrome://';
+    }
+    if (/FxiOS\//.test(ua)) {
+        return 'firefox://';
+    }
+    return undefined;
+}
 function validateProofRequest(request) {
     if (!request.requestId) {
         return { valid: false, error: 'Missing requestId' };
@@ -2229,8 +2324,13 @@ class ProofportSDK {
             body.dappIcon = options.dappIcon;
         if (options.nonce)
             body.nonce = options.nonce;
-        if (options.returnScheme)
-            body.returnScheme = options.returnScheme;
+        // An explicit value always wins. Otherwise ask the SDK to work one out from
+        // the page's own user agent — the requesting page is the only side that can
+        // (iOS tells the app nothing about who launched it). Both paths can end in
+        // "send nothing", which is a legitimate outcome, not a failure.
+        const returnScheme = options.returnScheme ?? detectReturnScheme();
+        if (returnScheme)
+            body.returnScheme = returnScheme;
         const response = await fetch(`${this.relayUrl}/api/v1/proof/request`, {
             method: 'POST',
             headers: {
@@ -2534,8 +2634,10 @@ class ProofportSDK {
  * @param options - Request options (message, dappName, dappIcon, nonce, returnScheme)
  * @param options.returnScheme - Which app the ZKProofport app should switch back
  *   to once it has finished. Put **your own** deep link scheme here — the bare
- *   scheme your app registers, e.g. `'mydapp://'`. A web app can instead pass its
- *   own https origin, e.g. `'https://myapp.com'`.
+ *   scheme your app registers, e.g. `'mydapp://'`. Only a native app has an
+ *   answer to this question; a web app omits the option entirely, because
+ *   opening its https origin would launch a new browser tab on a fresh page
+ *   rather than return the user to the tab they started from.
  *
  *   This is intentionally **not** a URL and not a return address: no path, query
  *   string or fragment is accepted, and the ZKProofport app never sends the proof
@@ -2544,14 +2646,26 @@ class ProofportSDK {
  *   "which app should come back to the foreground", exactly like the
  *   `redirect.native` value a wallet uses to hand control back after signing.
  *
- *   **Omit it and nothing changes** — the user simply stays in the ZKProofport app
- *   after the proof and switches back manually. There is no auto-switch on proof
- *   failure either; only on success and on the user declining the request.
+ *   **Omit it and the SDK decides for you.** When the request is created from a
+ *   page running in Chrome for iOS (`CriOS`) or Firefox for iOS (`FxiOS`), the
+ *   SDK fills in `'googlechrome://'` or `'firefox://'` by itself: opening either
+ *   scheme bare brings that browser forward without navigating, so the user lands
+ *   back on the tab they were already reading. Every other browser sends nothing,
+ *   because nothing safe exists to send — Safari has no such scheme, and Brave
+ *   and Arc are indistinguishable from Safari on iOS, so guessing would eject the
+ *   user into the wrong browser.
+ *   On Android nothing is needed at all: the ZKProofport app brings itself to the
+ *   back and the browser resumes exactly as it was. When no target is sent and
+ *   none can be inferred, the ZKProofport app tells the user the proof was
+ *   delivered and lets them switch back themselves.
+ *
+ *   There is no auto-switch on proof failure; only on success and on the user
+ *   declining the request.
  *
  *   Rejected with an error before the request is sent: empty or whitespace values,
- *   anything longer than 128 characters, values containing a path/query/fragment,
- *   and the `http:`, `file:`, `data:`, `javascript:`, `intent:`, `tel:`, `sms:`,
- *   `mailto:` families.
+ *   anything longer than 128 characters, values carrying a host/path/query/fragment
+ *   (including https origins such as `'https://myapp.com'`), and the `http:`,
+ *   `file:`, `data:`, `javascript:`, `intent:`, `tel:`, `sms:`, `mailto:` families.
  * @returns Promise resolving to RelayProofRequest with requestId, deepLink, pollUrl
  * @throws Error if signer not set, returnScheme is malformed, or the relay request fails
  *