decane-connect-kit 2.1.0 → 2.2.1

package/dist/index.d.cts

@@ -81,6 +81,17 @@ interface SocialConfig {
     apiBaseUrl?: string;
     chains?: string[];
     rpcUrls?: Record<string, string>;
+    /**
+     * Require a fresh WebAuthn assertion for every signature rather than letting
+     * an unlocked session sign freely until it expires. Enforced inside the TEE.
+     *
+     * Does not change the session lifetime — the session stays warm (no
+     * re-attestation, no re-auth) and authority is re-proven per signature
+     * instead. Default false. Needs a passkey; PIN-only wallets have no
+     * authenticator to assert with. See SocialConfig's counterpart in
+     * social/types.ts for the full caveats.
+     */
+    requireAssertionPerSignature?: boolean;
     /**
      * Sign in with a token from your own auth system (Auth0, Clerk, Firebase,
      * Cognito, or your own backend) — surfaced as a button in the built-in
@@ -283,6 +294,25 @@ interface DecaneConnectConfig {
     apiBaseUrl?: string;
     sessionDurationMinutes?: number;
     promptPin?: () => Promise<string>;
+    /**
+     * Require a fresh WebAuthn assertion for every signature, instead of letting
+     * an unlocked session sign freely until it expires. The TEE session stays
+     * warm — this costs one authenticator prompt per signature, not a re-auth or
+     * re-attestation — and the check is enforced inside the enclave, not here.
+     *
+     * Default false, which preserves the session-signing model: unlock once, sign
+     * for the session's lifetime with no further prompts.
+     *
+     * Two things worth knowing before turning this on:
+     *  - Multi-step flows prompt per leg. An ERC-20 approve + swap is two
+     *    prompts, not one.
+     *  - The policy is declared by the client at session open, so it hardens a
+     *    leaked session handle (useless without the authenticator) but a fully
+     *    compromised page could open a session without it. Making it
+     *    unbypassable requires the policy to come from the server per user or
+     *    per project; that is not implemented yet.
+     */
+    requireAssertionPerSignature?: boolean;
     rpId?: string;
     rpName?: string;
     rpcUrls?: Record<string, string>;

package/dist/index.d.ts

@@ -81,6 +81,17 @@ interface SocialConfig {
     apiBaseUrl?: string;
     chains?: string[];
     rpcUrls?: Record<string, string>;
+    /**
+     * Require a fresh WebAuthn assertion for every signature rather than letting
+     * an unlocked session sign freely until it expires. Enforced inside the TEE.
+     *
+     * Does not change the session lifetime — the session stays warm (no
+     * re-attestation, no re-auth) and authority is re-proven per signature
+     * instead. Default false. Needs a passkey; PIN-only wallets have no
+     * authenticator to assert with. See SocialConfig's counterpart in
+     * social/types.ts for the full caveats.
+     */
+    requireAssertionPerSignature?: boolean;
     /**
      * Sign in with a token from your own auth system (Auth0, Clerk, Firebase,
      * Cognito, or your own backend) — surfaced as a button in the built-in
@@ -283,6 +294,25 @@ interface DecaneConnectConfig {
     apiBaseUrl?: string;
     sessionDurationMinutes?: number;
     promptPin?: () => Promise<string>;
+    /**
+     * Require a fresh WebAuthn assertion for every signature, instead of letting
+     * an unlocked session sign freely until it expires. The TEE session stays
+     * warm — this costs one authenticator prompt per signature, not a re-auth or
+     * re-attestation — and the check is enforced inside the enclave, not here.
+     *
+     * Default false, which preserves the session-signing model: unlock once, sign
+     * for the session's lifetime with no further prompts.
+     *
+     * Two things worth knowing before turning this on:
+     *  - Multi-step flows prompt per leg. An ERC-20 approve + swap is two
+     *    prompts, not one.
+     *  - The policy is declared by the client at session open, so it hardens a
+     *    leaked session handle (useless without the authenticator) but a fully
+     *    compromised page could open a session without it. Making it
+     *    unbypassable requires the policy to come from the server per user or
+     *    per project; that is not implemented yet.
+     */
+    requireAssertionPerSignature?: boolean;
     rpId?: string;
     rpName?: string;
     rpcUrls?: Record<string, string>;

package/dist/index.js

@@ -2200,6 +2200,12 @@ var TeeClient = class {
     this.teeUrl = teeUrl;
     this.handle = null;
     this.attested = false;
+    /** Mirrors what the signer confirmed for this session, not what we asked for. */
+    this.assertionPerSignature = false;
+  }
+  /** Whether this session actually got per-signature assertions. */
+  requiresAssertionPerSignature() {
+    return this.assertionPerSignature;
   }
   async ensureAttested() {
     if (this.attested) return;
@@ -2215,16 +2221,20 @@ var TeeClient = class {
    * couldn't derive them (older signer build, or a transient share-fetch
    * failure); callers fall back to the backend's addresses in that case.
    */
-  async openSession(deviceShare, jwt) {
+  async openSession(deviceShare, jwt, requireAssertionPerSignature = false) {
     await this.ensureAttested();
     const res = await fetch(`${this.teeUrl}/signer/session`, {
       method: "POST",
       headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ deviceShare: bytesToBase64(deviceShare) })
+      body: JSON.stringify({
+        deviceShare: bytesToBase64(deviceShare),
+        requireAssertionPerSignature
+      })
     });
     if (!res.ok) throw new Error("session open failed");
     const body = await res.json();
     this.handle = body.handle;
+    this.assertionPerSignature = body.requireAssertionPerSignature === true;
     return body.addresses ?? null;
   }
   /**
@@ -2315,14 +2325,33 @@ var TeeClient = class {
   hasSession() {
     return this.handle !== null;
   }
-  async sign(req) {
+  /**
+   * `jwt` is only needed when this session requires per-signature assertions —
+   * it authenticates the challenge request. Passed per call rather than cached
+   * on the instance deliberately: the backend's JWTs are shorter-lived than the
+   * TEE session TTL, so a stored copy would go stale mid-session.
+   */
+  async sign(req, jwt) {
     if (!this.handle) throw new Error("no session");
+    let gate = null;
+    if (this.assertionPerSignature) {
+      if (!jwt) throw new Error("sign requires a jwt when per-signature assertion is enabled");
+      gate = await this.completeAssertion(jwt);
+    }
     const res = await fetch(`${this.teeUrl}/signer/sign`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ handle: this.handle, ...req })
+      body: JSON.stringify({
+        handle: this.handle,
+        ...req,
+        ...gate ? { ...gate, origin: window.location.origin } : {}
+      })
     });
     if (res.status === 401) {
+      const body = await res.clone().json().catch(() => ({}));
+      if (body?.error === "assertion_required") {
+        throw new ExportNotAuthorizedError();
+      }
       this.handle = null;
       throw new SessionExpiredError();
     }
@@ -2345,10 +2374,11 @@ var TeeClient = class {
 // src/social/session.ts
 init_errors();
 var SessionManager = class {
-  constructor(events, durationMs, teeUrl) {
+  constructor(events, durationMs, teeUrl, requireAssertionPerSignature = false) {
     this.events = events;
     this.durationMs = durationMs;
     this.teeUrl = teeUrl;
+    this.requireAssertionPerSignature = requireAssertionPerSignature;
     this.tee = null;
     this.evmAddress = null;
     this.solanaAddress = null;
@@ -2368,7 +2398,18 @@ var SessionManager = class {
    */
   async start(deviceShare, jwt, fallback) {
     this.tee = new TeeClient(this.teeUrl);
-    const verified = await this.tee.openSession(deviceShare, jwt);
+    const verified = await this.tee.openSession(
+      deviceShare,
+      jwt,
+      this.requireAssertionPerSignature
+    );
+    if (this.requireAssertionPerSignature && !this.tee.requiresAssertionPerSignature()) {
+      void this.tee.closeSession();
+      this.tee = null;
+      throw new Error(
+        "requireAssertionPerSignature was requested but this signer does not support it \u2014 refusing to open a session with weaker authority than configured."
+      );
+    }
     const addresses = verified ?? fallback;
     if (!addresses) {
       this.tee = null;
@@ -2597,15 +2638,15 @@ async function verifyEmailCode(api, email, code) {
 
 // src/social/signers/evm.ts
 import { keccak256, Transaction, resolveProperties } from "ethers";
-async function signEvmTransaction(tee, chain, tx) {
+async function signEvmTransaction(tee, chain, tx, jwt) {
   const resolved = await resolveProperties(tx);
   const unsigned = Transaction.from(resolved).unsignedSerialized;
   const payload = unsigned.startsWith("0x") ? unsigned.slice(2) : unsigned;
   const txHash = keccak256("0x" + payload);
-  return tee.sign({ chain, kind: "transaction", payload, txHash });
+  return tee.sign({ chain, kind: "transaction", payload, txHash }, jwt);
 }
-async function signEvmMessage(tee, chain, message) {
-  return tee.sign({ chain, kind: "message", payload: message });
+async function signEvmMessage(tee, chain, message, jwt) {
+  return tee.sign({ chain, kind: "message", payload: message }, jwt);
 }
 
 // src/social/signers/solana.ts
@@ -2618,13 +2659,13 @@ function b64(bytes) {
 function unb64(s) {
   return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 }
-async function signSolanaTransaction(tee, chain, tx) {
+async function signSolanaTransaction(tee, chain, tx, jwt) {
   const bytes = tx instanceof VTx ? tx.serialize() : tx.serialize({ requireAllSignatures: false });
-  const signed = await tee.sign({ chain, kind: "transaction", payload: b64(bytes) });
+  const signed = await tee.sign({ chain, kind: "transaction", payload: b64(bytes) }, jwt);
   return unb64(signed);
 }
-async function signSolanaMessage(tee, chain, message) {
-  const sig = await tee.sign({ chain, kind: "message", payload: b64(message) });
+async function signSolanaMessage(tee, chain, message, jwt) {
+  const sig = await tee.sign({ chain, kind: "message", payload: b64(message) }, jwt);
   return unb64(sig);
 }
 
@@ -2897,7 +2938,12 @@ async function createDecaneConnect(config) {
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
   const storage = new Storage();
-  const session = new SessionManager(events, durationMs, teeUrl);
+  const session = new SessionManager(
+    events,
+    durationMs,
+    teeUrl,
+    config.requireAssertionPerSignature === true
+  );
   let auth = null;
   let persisted = loadPersisted(PERSIST_KEY);
   async function pinSetup() {
@@ -3296,11 +3342,11 @@ async function createDecaneConnect(config) {
     async signMessage(req) {
       const tee = session.requireActive();
       if (req.chain.startsWith("evm:")) {
-        return signEvmMessage(tee, req.chain, req.message);
+        return signEvmMessage(tee, req.chain, req.message, auth?.jwt);
       }
       if (req.chain.startsWith("solana:")) {
         const msg = typeof req.message === "string" ? new TextEncoder().encode(req.message) : req.message;
-        const sig = await signSolanaMessage(tee, req.chain, msg);
+        const sig = await signSolanaMessage(tee, req.chain, msg, auth?.jwt);
         return bufferToB64u(sig);
       }
       throw new CallSequenceError(`Unsupported chain: ${req.chain}`);
@@ -3348,7 +3394,7 @@ async function createDecaneConnect(config) {
           maxPriorityFeePerGas: feeData.maxPriorityFeePerGas ?? 0n
         } : { gasPrice: req.gasPrice ?? feeData.gasPrice ?? void 0 }
       };
-      const signedTx = await signEvmTransaction(tee, req.chain, tx);
+      const signedTx = await signEvmTransaction(tee, req.chain, tx, auth?.jwt);
       const txResponse = await provider.broadcastTransaction(signedTx);
       return txResponse.hash;
     },
@@ -3361,7 +3407,7 @@ async function createDecaneConnect(config) {
         tx = Transaction2.from(serializedTx);
       }
       const solChain = config.chains.find((c) => c.startsWith("solana:")) ?? "solana:mainnet";
-      return signSolanaTransaction(tee, solChain, tx);
+      return signSolanaTransaction(tee, solChain, tx, auth?.jwt);
     },
     async disconnect() {
       session.end();
@@ -5205,7 +5251,15 @@ function DecaneKit({ config, children }) {
   useEffect3(() => {
     if (!hasSocial(mode) || !config?.social || socialInitialized.current) return;
     socialInitialized.current = true;
-    const { apiKey, authMethods, promptPin, apiBaseUrl, chains, rpcUrls } = config.social;
+    const {
+      apiKey,
+      authMethods,
+      promptPin,
+      apiBaseUrl,
+      chains,
+      rpcUrls,
+      requireAssertionPerSignature
+    } = config.social;
     createDecaneConnect({
       appId: config.appId,
       apiKey,
@@ -5213,7 +5267,8 @@ function DecaneKit({ config, children }) {
       authMethods: authMethods ?? ["google", "email"],
       chains: chains ?? ["evm:1", "solana:mainnet"],
       rpcUrls,
-      promptPin
+      promptPin,
+      requireAssertionPerSignature
     }).then((sdk) => {
       socialRef.current = sdk;
       sdk.on(