decane-connect-kit 2.24.1 → 2.25.0

package/dist/index.d.cts

@@ -159,6 +159,27 @@ interface DecaneConnectConfig {
      * has happened. Default false: the share is wrapped and stored at creation.
      */
     deferDeviceProtection?: boolean;
+    /**
+     * Resume a live session in a NEW TAB, not just after a reload. Default false.
+     *
+     * The session — handle plus JWT — normally lives in sessionStorage, so it
+     * survives a reload and dies with the tab. That makes a second tab, or a
+     * return visit an hour later, a full sign-in and unlock again even though the
+     * enclave session is still valid for two hours.
+     *
+     * With this on, the session is held in localStorage under the same expiry, so
+     * a returning user is signing again in about a second.
+     *
+     * THE TRADE, stated plainly: the handle IS the signing credential — no other
+     * header is required to sign with it. Widening its storage widens the window
+     * in which anything able to run script on your origin could take it, from one
+     * tab to every tab until it expires. It is off by default for that reason.
+     *
+     * Turn it on when the return-visit cost matters more than that window, and
+     * pair it with `requireAssertionPerSignature` so a stolen handle still cannot
+     * move funds without a fresh authenticator touch.
+     */
+    resumeSessionAcrossTabs?: boolean;
     /**
      * Offer to save a recovery-share file at signup. **Default false** since
      * 2.7.4 — opt in explicitly with `true`.

package/dist/index.d.ts

@@ -159,6 +159,27 @@ interface DecaneConnectConfig {
      * has happened. Default false: the share is wrapped and stored at creation.
      */
     deferDeviceProtection?: boolean;
+    /**
+     * Resume a live session in a NEW TAB, not just after a reload. Default false.
+     *
+     * The session — handle plus JWT — normally lives in sessionStorage, so it
+     * survives a reload and dies with the tab. That makes a second tab, or a
+     * return visit an hour later, a full sign-in and unlock again even though the
+     * enclave session is still valid for two hours.
+     *
+     * With this on, the session is held in localStorage under the same expiry, so
+     * a returning user is signing again in about a second.
+     *
+     * THE TRADE, stated plainly: the handle IS the signing credential — no other
+     * header is required to sign with it. Widening its storage widens the window
+     * in which anything able to run script on your origin could take it, from one
+     * tab to every tab until it expires. It is off by default for that reason.
+     *
+     * Turn it on when the return-visit cost matters more than that window, and
+     * pair it with `requireAssertionPerSignature` so a stolen handle still cannot
+     * move funds without a fresh authenticator touch.
+     */
+    resumeSessionAcrossTabs?: boolean;
     /**
      * Offer to save a recovery-share file at signup. **Default false** since
      * 2.7.4 — opt in explicitly with `true`.

package/dist/index.js

@@ -2331,9 +2331,62 @@ import { sha256, encodeBase58 } from "ethers";
 // src/social/teeClient.ts
 import { startAuthentication } from "@simplewebauthn/browser";
 
+// src/social/attestation.ts
+import {
+  getCollateral,
+  getCollateralAndVerify,
+  verify as verifyQuoteWithCollateral,
+  PHALA_PCCS_URL
+} from "@phala/dcap-qvl";
+
+// src/social/collateralCache.ts
+var CACHE_PREFIX = "decane:collateral:v1:";
+var COLLATERAL_TTL_MS = 12 * 60 * 60 * 1e3;
+function storage() {
+  try {
+    return typeof localStorage !== "undefined" ? localStorage : null;
+  } catch {
+    return null;
+  }
+}
+function keyFor(teeUrl) {
+  return `${CACHE_PREFIX}${teeUrl}`;
+}
+function readCollateral(teeUrl) {
+  const store = storage();
+  if (!store) return null;
+  try {
+    const raw = store.getItem(keyFor(teeUrl));
+    if (!raw) return null;
+    const entry = JSON.parse(raw);
+    if (!entry?.at || Date.now() - entry.at > COLLATERAL_TTL_MS) {
+      store.removeItem(keyFor(teeUrl));
+      return null;
+    }
+    return entry.collateral ?? null;
+  } catch {
+    return null;
+  }
+}
+function writeCollateral(teeUrl, collateral) {
+  const store = storage();
+  if (!store) return;
+  try {
+    store.setItem(keyFor(teeUrl), JSON.stringify({ at: Date.now(), collateral }));
+  } catch {
+  }
+}
+function dropCollateral(teeUrl) {
+  const store = storage();
+  if (!store) return;
+  try {
+    store.removeItem(keyFor(teeUrl));
+  } catch {
+  }
+}
+
 // src/social/attestation.ts
 init_errors();
-import { getCollateralAndVerify } from "@phala/dcap-qvl";
 
 // ../../infra/tee-measurement.json
 var tee_measurement_default = {
@@ -2360,6 +2413,9 @@ function hexToBytes(hex) {
 function bytesToHex(bytes) {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
 async function verifyTeeAttestation(teeUrl, nonce) {
   const res = await fetch(`${teeUrl}/attestation`, {
     method: "POST",
@@ -2369,9 +2425,22 @@ async function verifyTeeAttestation(teeUrl, nonce) {
   if (!res.ok) throw new AttestationError("quote fetch failed");
   const { quote, measurement } = await res.json();
   let verified;
+  const cached = readCollateral(teeUrl);
   try {
-    verified = await getCollateralAndVerify(hexToBytes(quote));
-  } catch {
+    if (cached) {
+      try {
+        verified = await verifyQuoteWithCollateral(hexToBytes(quote), cached, nowSeconds());
+      } catch {
+        dropCollateral(teeUrl);
+        verified = await getCollateralAndVerify(hexToBytes(quote));
+      }
+    } else {
+      const collateral = await getCollateral(PHALA_PCCS_URL, hexToBytes(quote));
+      verified = await verifyQuoteWithCollateral(hexToBytes(quote), collateral, nowSeconds());
+      writeCollateral(teeUrl, collateral);
+    }
+  } catch (e) {
+    if (e instanceof AttestationError) throw e;
     throw new AttestationError("quote signature invalid");
   }
   if (verified.status === "Revoked") {
@@ -2413,14 +2482,51 @@ async function teeFetch(url, init) {
 }
 var ATTESTATION_TTL_MS = 10 * 6e4;
 var attestationCache = /* @__PURE__ */ new Map();
+var ATTESTATION_PERSIST_PREFIX = "decane:attested:v1:";
+function persistedAt(teeUrl) {
+  try {
+    if (typeof sessionStorage === "undefined") return null;
+    const raw = sessionStorage.getItem(ATTESTATION_PERSIST_PREFIX + teeUrl);
+    const at = raw ? Number(raw) : NaN;
+    return Number.isFinite(at) ? at : null;
+  } catch {
+    return null;
+  }
+}
+function rememberAttested(teeUrl, at) {
+  try {
+    if (typeof sessionStorage !== "undefined") {
+      sessionStorage.setItem(ATTESTATION_PERSIST_PREFIX + teeUrl, String(at));
+    }
+  } catch {
+  }
+}
+function forgetAttested(teeUrl) {
+  try {
+    if (typeof sessionStorage !== "undefined") {
+      sessionStorage.removeItem(ATTESTATION_PERSIST_PREFIX + teeUrl);
+    }
+  } catch {
+  }
+}
 function attestOnce(teeUrl, verify) {
   const hit = attestationCache.get(teeUrl);
   if (hit && Date.now() - hit.at < ATTESTATION_TTL_MS) return hit.promise;
-  const promise = verify().catch((e) => {
+  const at = persistedAt(teeUrl);
+  if (at && Date.now() - at < ATTESTATION_TTL_MS) {
+    const resolved = Promise.resolve();
+    attestationCache.set(teeUrl, { at, promise: resolved });
+    return resolved;
+  }
+  const startedAt = Date.now();
+  const promise = verify().then(() => {
+    rememberAttested(teeUrl, startedAt);
+  }).catch((e) => {
     attestationCache.delete(teeUrl);
+    forgetAttested(teeUrl);
     throw e;
   });
-  attestationCache.set(teeUrl, { at: Date.now(), promise });
+  attestationCache.set(teeUrl, { at: startedAt, promise });
   return promise;
 }
 function prewarmAttestation(teeUrl) {
@@ -3692,29 +3798,44 @@ function clearLastUser(key) {
 function sessionPersistKey(apiKey) {
   return `decane:sess:${apiKey.slice(0, 20)}`;
 }
+var sessionStore = () => typeof sessionStorage !== "undefined" ? sessionStorage : null;
+function useCrossTabSessionStore(enabled) {
+  sessionStore = enabled ? () => typeof localStorage !== "undefined" ? localStorage : null : () => typeof sessionStorage !== "undefined" ? sessionStorage : null;
+}
 function loadSession(key) {
   try {
-    const raw = typeof sessionStorage !== "undefined" ? sessionStorage.getItem(key) : null;
-    return raw ? JSON.parse(raw) : null;
+    const raw = sessionStore()?.getItem(key) ?? (typeof sessionStorage !== "undefined" ? sessionStorage.getItem(key) : null) ?? (typeof localStorage !== "undefined" ? localStorage.getItem(key) : null);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    if (parsed?.expiresAt && parsed.expiresAt <= Date.now()) {
+      clearSessionPersist(key);
+      return null;
+    }
+    return parsed;
   } catch {
     return null;
   }
 }
 function saveSession(key, s) {
   try {
-    sessionStorage.setItem(key, JSON.stringify(s));
+    sessionStore()?.setItem(key, JSON.stringify(s));
   } catch {
   }
 }
 function clearSessionPersist(key) {
   try {
-    sessionStorage.removeItem(key);
+    if (typeof sessionStorage !== "undefined") sessionStorage.removeItem(key);
+  } catch {
+  }
+  try {
+    if (typeof localStorage !== "undefined") localStorage.removeItem(key);
   } catch {
   }
 }
 async function createDecaneConnect(config) {
   if (!config.appId) throw new Error("decane-connect-kit: appId is required");
   if (!config.apiKey) throw new Error("decane-connect-kit: apiKey is required");
+  useCrossTabSessionStore(config.resumeSessionAcrossTabs === true);
   if (!config.chains?.length)
     throw new Error("decane-connect-kit: at least one chain is required");
   if (config.rotateOnNewDeviceRecovery && !config.onRecoveryRotated) {
@@ -3733,7 +3854,7 @@ async function createDecaneConnect(config) {
   const teeUrl = config.teeUrl ?? DEFAULT_TEE_URL;
   const events = new EventEmitter();
   const api = new ApiClient(baseUrl, config.apiKey, config.appId);
-  const storage = new Storage();
+  const storage2 = new Storage();
   const session = new SessionManager(
     events,
     durationMs,
@@ -3876,7 +3997,7 @@ async function createDecaneConnect(config) {
   }
   async function attachUnlockToken(userId, jwt, tokenKey) {
     try {
-      const stored = await storage.getShare(userId);
+      const stored = await storage2.getShare(userId);
       if (!stored) return;
       const { token } = await api.issueUnlockToken(jwt);
       const unlockTokenIv = generateRandomBytes(12);
@@ -3885,13 +4006,13 @@ async function createDecaneConnect(config) {
         new TextEncoder().encode(token),
         unlockTokenIv
       );
-      await storage.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
+      await storage2.putShare({ ...stored, wrappedUnlockToken, unlockTokenIv });
     } catch (e) {
       console.warn("decane-connect-kit: could not store an unlock token for this device.", e);
     }
   }
   async function persistRotatedDeviceShare(userId, deviceShare) {
-    const stored = await storage.getShare(userId);
+    const stored = await storage2.getShare(userId);
     if (!stored) {
       throw new CallSequenceError(
         "Share set was rotated but this device has no stored share to update. Recover the wallet on this device before rotating."
@@ -3900,21 +4021,21 @@ async function createDecaneConnect(config) {
     const wrappingKey = await getWrappingKey(stored);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    await storage.putShare({ ...stored, wrappedDeviceShare, iv });
+    await storage2.putShare({ ...stored, wrappedDeviceShare, iv });
   }
   function hasPasswordUnlock(stored) {
     return !!stored && stored.unlockMethod === "password" && !!stored.passwordSalt && !!stored.wrappedUnlockToken && !!stored.unlockTokenIv;
   }
   async function passwordDeviceCandidate() {
     if (persisted?.userId) {
-      const stored = await storage.getShare(persisted.userId);
+      const stored = await storage2.getShare(persisted.userId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
     if (lastUserId) {
-      const stored = await storage.getShare(lastUserId);
+      const stored = await storage2.getShare(lastUserId);
       return hasPasswordUnlock(stored) ? stored : null;
     }
-    const candidates = (await storage.listShares()).filter(hasPasswordUnlock);
+    const candidates = (await storage2.listShares()).filter(hasPasswordUnlock);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function getWrappingKey(stored) {
@@ -3942,7 +4063,7 @@ async function createDecaneConnect(config) {
     let credentialId;
     let prfOutput;
     try {
-      const label = (await storage.getShare(userId))?.profile?.email;
+      const label = (await storage2.getShare(userId))?.profile?.email;
       ({ credentialId, prfOutput } = await registerWebAuthnCredential({
         api,
         jwt,
@@ -3974,8 +4095,8 @@ async function createDecaneConnect(config) {
     const wrappingKey = await importAesKey(prfOutput);
     const iv = generateRandomBytes(12);
     const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-    const existing = await storage.getShare(userId);
-    await storage.putShare({
+    const existing = await storage2.getShare(userId);
+    await storage2.putShare({
       ...existing,
       userId,
       wrappedDeviceShare,
@@ -4059,7 +4180,7 @@ async function createDecaneConnect(config) {
       const { wrappingKey, tokenKey, meta } = await passwordSetup();
       const iv = generateRandomBytes(12);
       const wrappedDeviceShare = await aesGcmEncrypt(wrappingKey, deviceShare, iv);
-      await storage.putShare({
+      await storage2.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4133,7 +4254,7 @@ async function createDecaneConnect(config) {
         shareSet.device,
         iv
       );
-      await storage.putShare({
+      await storage2.putShare({
         userId,
         wrappedDeviceShare,
         iv,
@@ -4237,7 +4358,7 @@ async function createDecaneConnect(config) {
   async function returningUserUnlock(userId, jwt) {
     const rawAddresses = await api.getAddresses(jwt);
     const recordedAddresses = rawAddresses.evm && rawAddresses.solana ? { evm: rawAddresses.evm, solana: rawAddresses.solana, tron: rawAddresses.tron ?? evmToTronAddress2(rawAddresses.evm) } : null;
-    const stored = await storage.getShare(userId);
+    const stored = await storage2.getShare(userId);
     let deviceShare;
     let joinedViaPasskeySync = false;
     if (!stored) {
@@ -4276,7 +4397,7 @@ async function createDecaneConnect(config) {
         rpId,
         teeUrl,
         api,
-        storage,
+        storage: storage2,
         onProgress: config.onRecoveryProgress,
         promptForRecoveryFile: config.promptForRecoveryFile,
         onNewRecoveryShare: async (recoveryShare, shareSetVersion) => {
@@ -4290,7 +4411,7 @@ async function createDecaneConnect(config) {
       });
       deviceShare = recovered.deviceShare;
       joinedViaPasskeySync = recovered.flow === "passkey-sync";
-      if (!deferDeviceProtection && !await storage.getShare(userId) && isPasskeySupported()) {
+      if (!deferDeviceProtection && !await storage2.getShare(userId) && isPasskeySupported()) {
         await registerPasskeyAndBackup(userId, jwt, deviceShare);
       }
     } else {
@@ -4311,7 +4432,7 @@ async function createDecaneConnect(config) {
     } catch (e) {
       if (e instanceof StaleDeviceShareError) {
         zeroize(deviceShare);
-        await storage.deleteShare(userId);
+        await storage2.deleteShare(userId);
         if (stored) return returningUserUnlock(userId, jwt);
       } else {
         zeroize(deviceShare);
@@ -4335,7 +4456,7 @@ async function createDecaneConnect(config) {
     const result = await tee.rotateShares(jwt);
     try {
       await persistRotatedDeviceShare(userId, result.deviceShare);
-      const refreshed = await storage.getShare(userId);
+      const refreshed = await storage2.getShare(userId);
       if (refreshed?.unlockMethod === "passkey" && refreshed.credentialId && refreshed.prfSalt) {
         await api.putRecoveryBackup(jwt, {
           wrappedDeviceShare: refreshed.wrappedDeviceShare,
@@ -4368,13 +4489,13 @@ async function createDecaneConnect(config) {
   }
   async function passkeyLoginCandidate() {
     if (!persisted?.userId || !isPasskeySupported()) return null;
-    return usablePasskeyShare(await storage.getShare(persisted.userId));
+    return usablePasskeyShare(await storage2.getShare(persisted.userId));
   }
   async function passkeyDeviceCandidate() {
     if (!isPasskeySupported()) return null;
     if (persisted?.userId) return passkeyLoginCandidate();
-    if (lastUserId) return usablePasskeyShare(await storage.getShare(lastUserId));
-    const candidates = (await storage.listShares()).map(usablePasskeyShare).filter(Boolean);
+    if (lastUserId) return usablePasskeyShare(await storage2.getShare(lastUserId));
+    const candidates = (await storage2.listShares()).map(usablePasskeyShare).filter(Boolean);
     return candidates.length === 1 ? candidates[0] : null;
   }
   async function canOfferPasskey() {
@@ -4382,15 +4503,15 @@ async function createDecaneConnect(config) {
     if (await passkeyDeviceCandidate()) return true;
     const known = persisted?.userId ?? lastUserId;
     if (!known) return false;
-    return await storage.getShare(known) == null;
+    return await storage2.getShare(known) == null;
   }
   async function rememberProfile(userId, profile) {
     const incoming = Object.fromEntries(Object.entries(profile).filter(([, v]) => v));
     if (!Object.keys(incoming).length) return;
     try {
-      const stored = await storage.getShare(userId);
+      const stored = await storage2.getShare(userId);
       if (!stored) return;
-      await storage.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
+      await storage2.putShare({ ...stored, profile: { ...stored.profile, ...incoming } });
     } catch {
     }
   }
@@ -4414,7 +4535,7 @@ async function createDecaneConnect(config) {
     savePersisted(PERSIST_KEY, persisted);
     events.emit("connected");
     persistLiveSession();
-    const stored = await storage.getShare(userId);
+    const stored = await storage2.getShare(userId);
     return {
       addresses,
       isNewUser: false,
@@ -4587,7 +4708,7 @@ async function createDecaneConnect(config) {
       events.emit("connected");
       persistLiveSession();
       scheduleAccessTokenExpiry(token, claims.expiresAt);
-      const stored = await storage.getShare(claims.userId);
+      const stored = await storage2.getShare(claims.userId);
       return {
         addresses,
         isNewUser: false,
@@ -4617,7 +4738,7 @@ async function createDecaneConnect(config) {
       const candidate = await passkeyDeviceCandidate();
       if (candidate) return passkeyLogin(candidate);
       const known = persisted?.userId ?? lastUserId;
-      if (isPasskeySupported() && known && await storage.getShare(known) == null) {
+      if (isPasskeySupported() && known && await storage2.getShare(known) == null) {
         return passkeyLoginWithoutShare(known);
       }
       throw new NewDeviceError();
@@ -4636,7 +4757,7 @@ async function createDecaneConnect(config) {
     async setUnlockPassword(password) {
       if (!auth) throw new ReconnectRequiredError();
       validateUnlockPassword(password);
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       if (!stored) throw new NewDeviceError();
       const deviceShare = await aesGcmDecrypt(
         await getWrappingKey(stored),
@@ -4655,7 +4776,7 @@ async function createDecaneConnect(config) {
         );
         const iv = generateRandomBytes(12);
         const wrappedDeviceShare = await aesGcmEncrypt(shareKey, deviceShare, iv);
-        await storage.putShare({
+        await storage2.putShare({
           ...stored,
           unlockMethod: "password",
           wrappedDeviceShare,
@@ -4735,9 +4856,9 @@ async function createDecaneConnect(config) {
     async removeUnlockPassword() {
       if (!auth) throw new ReconnectRequiredError();
       await api.revokeUnlockTokens(auth.jwt);
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       if (!stored || stored.unlockMethod !== "password") return;
-      await storage.putShare({
+      await storage2.putShare({
         ...stored,
         wrappedUnlockToken: void 0,
         unlockTokenIv: void 0
@@ -4745,13 +4866,13 @@ async function createDecaneConnect(config) {
     },
     async hasPasskey() {
       if (!auth) return false;
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       return stored?.unlockMethod === "passkey";
     },
     async addPasskey() {
       if (!auth) throw new ReconnectRequiredError();
       if (!isPasskeySupported()) throw new WebAuthnNotSupportedError();
-      const stored = await storage.getShare(auth.userId);
+      const stored = await storage2.getShare(auth.userId);
       if (stored?.unlockMethod === "passkey") return;
       if (!stored) {
         if (!serverAssistedRecovery) throw new NewDeviceError();
@@ -4784,11 +4905,11 @@ async function createDecaneConnect(config) {
     },
     async deviceProtected() {
       if (!auth) return false;
-      return await storage.getShare(auth.userId) !== null;
+      return await storage2.getShare(auth.userId) !== null;
     },
     async protectDevice() {
       if (!auth) throw new ReconnectRequiredError();
-      if (await storage.getShare(auth.userId)) return true;
+      if (await storage2.getShare(auth.userId)) return true;
       if (!serverAssistedRecovery) throw new NewDeviceError();
       const tee = new TeeClient(teeUrl);
       const provisioned = await tee.provisionDeviceShare(auth.jwt);
@@ -4798,7 +4919,7 @@ async function createDecaneConnect(config) {
       } finally {
         zeroize(provisioned);
       }
-      return await storage.getShare(auth.userId) !== null;
+      return await storage2.getShare(auth.userId) !== null;
     },
     async unlock() {
       if (!auth) {