edge-core-js 2.47.1 → 2.48.1

package/lib/core/actions.js

@@ -463,6 +463,11 @@
 
 
 
+
+
+
+
+
 
 
 

package/lib/core/context/context-api.js

@@ -512,6 +512,10 @@ export function makeContextApi(ai) {
     async changeLogSettings(settings) {
       const newSettings = { ...ai.props.state.logSettings, ...settings }
       ai.props.dispatch({ type: 'CHANGE_LOG_SETTINGS', payload: newSettings })
+    },
+
+    async setAttestationToken(token) {
+      ai.props.dispatch({ type: 'SET_ATTESTATION_TOKEN', payload: token })
     }
   }
   bridgifyObject(out)

package/lib/core/fake/fake-world.js

@@ -22,7 +22,6 @@ import { asLoginPayload } from '../../types/server-cleaners'
 
 
 import { base58 } from '../../util/encoding'
-import { validateServer } from '../../util/validateServer'
 
 import { applyLoginPayload } from '../login/login'
 import { wasLoginStash } from '../login/login-stash'
@@ -32,6 +31,20 @@ import { makeRepoPaths, saveChanges } from '../storage/repo'
 import { FakeDb } from './fake-db'
 import { makeFakeServer } from './fake-server'
 
+/**
+ * Account infrastructure hosts that stay on the in-memory fake server when
+ * `allowNetworkAccess` is enabled. Change servers and everything else use
+ * real `io.fetch`.
+ */
+function isFakeAccountInfrastructure(uri) {
+  try {
+    const { hostname } = new URL(uri)
+    return /^(login|info|sync)[a-z0-9-]*\.edge(test)?\.app$/i.test(hostname)
+  } catch (e) {
+    return false
+  }
+}
+
 async function saveLogin(io, user) {
   const { lastLogin, server } = user
   const loginId = base64.parse(user.loginId)
@@ -114,12 +127,10 @@ export function makeFakeWorld(
       const fetch = !allowNetworkAccess
         ? fakeFetch
         : (uri, opts) => {
-            try {
-              validateServer(uri) // Throws for non-Edge servers.
-            } catch (error) {
-              return io.fetch(uri, opts)
+            if (isFakeAccountInfrastructure(uri)) {
+              return fakeFetch(uri, opts)
             }
-            return fakeFetch(uri, opts)
+            return io.fetch(uri, opts)
           }
 
       const fakeIo = {

package/lib/core/login/login-fetch.js

@@ -117,7 +117,7 @@ export function loginFetchInner(
   body
 ) {
   const { state, io, log } = ai.props
-  const { apiKey, apiSecret } = state.login
+  const { apiKey, apiSecret, attestationToken } = state.login
 
   const bodyText =
     method === 'GET' || body == null
@@ -138,7 +138,10 @@ export function loginFetchInner(
     headers: {
       'content-type': 'application/json',
       accept: 'application/json',
-      authorization
+      authorization,
+      ...(attestationToken != null
+        ? { 'x-attestation-token': attestationToken }
+        : {})
     },
     corsBypass: 'never'
   }

package/lib/core/login/login-reducer.js

@@ -28,6 +28,7 @@ import { findPin2Stash } from './pin2'
 
 
 
+
 export const login = buildReducer({
   apiKey(state = '', action) {
     return action.type === 'INIT' ? action.payload.apiKey : state
@@ -37,6 +38,13 @@ export const login = buildReducer({
     return action.type === 'INIT' ? _nullishCoalesce(action.payload.apiSecret, () => ( null)) : state
   },
 
+  attestationToken(state = null, action) {
+    if (action.type !== 'SET_ATTESTATION_TOKEN') return state
+    const token = action.payload
+    // Treat empty string like clear so we never send x-attestation-token: ''.
+    return token == null || token === '' ? null : token
+  },
+
   contextAppId(state = '', action) {
     return action.type === 'INIT' ? action.payload.appId : state
   },

package/lib/node/index.js

@@ -597,21 +597,6 @@ const utf8 = {
   }
 };
 
-/**
- * We only accept *.edge.app or localhost as valid domain names.
- */
-function validateServer(server) {
-  const url = new URL(server);
-  if (url.protocol === 'http:' || url.protocol === 'ws:') {
-    if (url.hostname === 'localhost') return;
-  }
-  if (url.protocol === 'https:' || url.protocol === 'wss:') {
-    if (url.hostname === 'localhost') return;
-    if (/^([A-Za-z0-9_-]+\.)*edge(test)?\.app$/.test(url.hostname)) return;
-  }
-  throw new Error(`Only *.edge.app or localhost are valid login domain names, not ${url.hostname}`);
-}
-
 /*
  * These are errors the core knows about.
  *
@@ -1485,7 +1470,8 @@ function loginFetchInner(ai, serverUri, method, path, body) {
   } = ai.props;
   const {
     apiKey,
-    apiSecret
+    apiSecret,
+    attestationToken
   } = state.login;
   const bodyText = method === 'GET' || body == null ? undefined : JSON.stringify(wasLoginRequestBody(body));
 
@@ -1502,7 +1488,10 @@ function loginFetchInner(ai, serverUri, method, path, body) {
     headers: {
       'content-type': 'application/json',
       accept: 'application/json',
-      authorization
+      authorization,
+      ...(attestationToken != null ? {
+        'x-attestation-token': attestationToken
+      } : {})
     },
     corsBypass: 'never'
   };
@@ -2447,6 +2436,49 @@ function makeAuthJson(stashTree, sessionKey) {
   throw new Error('No server authentication methods available');
 }
 
+/**
+ * We only accept *.edge.app, localhost, or (for http/ws only) private LAN IPv4.
+ * https/wss still require localhost or *.edge(test)?.app; private IPs are not
+ * accepted on secure schemes.
+ */
+function validateServer(server) {
+  const url = new URL(server);
+  if (url.protocol === 'http:' || url.protocol === 'ws:') {
+    if (isPrivateHost(url.hostname)) return;
+  }
+  if (url.protocol === 'https:' || url.protocol === 'wss:') {
+    if (url.hostname === 'localhost') return;
+    if (/^([A-Za-z0-9_-]+\.)*edge(test)?\.app$/.test(url.hostname)) return;
+  }
+  throw new Error(`Only *.edge.app, localhost, or private LAN addresses (http/ws) are valid login domain names, not ${url.hostname}`);
+}
+function isPrivateHost(hostname) {
+  if (hostname === 'localhost') return true;
+  const octets = parseIpv4(hostname);
+  if (octets == null) return false;
+  const [a, b] = octets;
+  if (a === 127) return true;
+  if (a === 10) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  return false;
+}
+function parseIpv4(hostname) {
+  const parts = hostname.split('.');
+  if (parts.length !== 4) return null;
+  const octets = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const n = Number(part);
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
+    // Reject leading zeros like 010.0.0.1 which are not canonical dotted-quad
+    // when they reach this helper (URL parsing may already rewrite some forms).
+    if (part.length > 1 && part.startsWith('0')) return null;
+    octets.push(n);
+  }
+  return octets;
+}
+
 /**
  * A wrapper that knows how to load and save JSON files,
  * with parsing, stringifying, and cleaning.
@@ -11843,6 +11875,12 @@ function makeContextApi(ai) {
         type: 'CHANGE_LOG_SETTINGS',
         payload: newSettings
       });
+    },
+    async setAttestationToken(token) {
+      ai.props.dispatch({
+        type: 'SET_ATTESTATION_TOKEN',
+        payload: token
+      });
     }
   };
   yaob.bridgifyObject(out);
@@ -12815,6 +12853,12 @@ const login = reduxKeto.buildReducer({
   apiSecret(state = null, action) {
     return action.type === 'INIT' ? action.payload.apiSecret ?? null : state;
   },
+  attestationToken(state = null, action) {
+    if (action.type !== 'SET_ATTESTATION_TOKEN') return state;
+    const token = action.payload;
+    // Treat empty string like clear so we never send x-attestation-token: ''.
+    return token == null || token === '' ? null : token;
+  },
   contextAppId(state = '', action) {
     return action.type === 'INIT' ? action.payload.appId : state;
   },
@@ -14385,6 +14429,21 @@ function makeFakeServer(db) {
   return out;
 }
 
+/**
+ * Account infrastructure hosts that stay on the in-memory fake server when
+ * `allowNetworkAccess` is enabled. Change servers and everything else use
+ * real `io.fetch`.
+ */
+function isFakeAccountInfrastructure(uri) {
+  try {
+    const {
+      hostname
+    } = new URL(uri);
+    return /^(login|info|sync)[a-z0-9-]*\.edge(test)?\.app$/i.test(hostname);
+  } catch {
+    return false;
+  }
+}
 async function saveLogin(io, user) {
   const {
     lastLogin,
@@ -14452,12 +14511,10 @@ function makeFakeWorld(ios, logBackend, users) {
       } = opts;
       const fakeFetch = serverlet.makeFetchFunction(fakeServer);
       const fetch = !allowNetworkAccess ? fakeFetch : (uri, opts) => {
-        try {
-          validateServer(uri); // Throws for non-Edge servers.
-        } catch (error) {
-          return io.fetch(uri, opts);
+        if (isFakeAccountInfrastructure(uri)) {
+          return fakeFetch(uri, opts);
         }
-        return fakeFetch(uri, opts);
+        return io.fetch(uri, opts);
       };
       const fakeIo = {
         ...io,

package/lib/types/types.js

@@ -2239,6 +2239,13 @@ export * from './server-types'
 
 
 
+
+
+
+
+
+
+
 
 
 

package/lib/util/nym.js

@@ -32,54 +32,148 @@ export const mixFetchOptions = {
  */
 const SETUP_TIMEOUT_MS = 60000
 
-// MixFetch initialization state
-let mixFetchInitPromise = null
+/**
+ * How long to refuse new setups after one fails, and the ceiling that wait
+ * doubles up to.
+ *
+ * Every `createMixFetch` spawns a web worker holding megabytes of WASM before
+ * it ever contacts the gateway, and the library exposes no way to terminate
+ * that worker, so a failed setup leaves one behind. Retrying on each request
+ * therefore costs memory per attempt: with a dead gateway and a poll loop
+ * driving requests every few seconds, the workers accumulate until the host
+ * kills the whole JS context. On iOS that reads to the user as being logged
+ * out, since the core's WebView is what gets killed and reloaded.
+ *
+ * A cooldown bounds the cost to one worker per window, and the doubling keeps
+ * a long outage from spending any meaningful memory at all.
+ */
+const RETRY_BASE_MS = 30000
+const RETRY_MAX_MS = 300000
 
 /**
- * Initialize the NYM mixFetch client. Must be called before using mixFetch.
- * Safe to call multiple times - subsequent calls return the same promise.
+ * Builds the mixFetch setup routine over its own cooldown state.
+ *
+ * The returned function initializes the NYM mixFetch client, and must be
+ * called before using mixFetch. It is safe to call multiple times: subsequent
+ * calls return the same promise.
+ *
+ * A failed setup starts a cooldown: calls made before it expires fail
+ * immediately with the error that started it, instead of building another
+ * client.
+ *
+ * Tests build their own instance over a clock they control, which also gives
+ * them fresh state per case.
+ *
+ * The cooldown state is per instance, but the client, its worker and
+ * `window.__mixFetchGlobal` are process-global, so two live instances would
+ * each hold a cooldown of their own while spawning workers into the same
+ * process. The single instance exported below is the only supported
+ * arrangement.
  */
-export async function initMixFetch(log) {
-  if (mixFetchInitPromise == null) {
-    log('Initializing mixFetch...')
-    const pending = createMixFetch(mixFetchOptions)
-    // The timeout below can abandon this setup while it is still in flight.
-    // Deliberately do NOT tear it down on late completion: `createMixFetch`
-    // resolves to a healthy global singleton, and disconnecting it (a
-    // process-wide operation) would race a newer init that has taken over.
-    // A late completion just repopulates `__mixFetchGlobal`, which the next
-    // init reuses. Swallow a late rejection so it is not unhandled.
-    pending.catch(() => {})
-    let timer
-    const timeout = new Promise((resolve, reject) => {
-      timer = setTimeout(() => {
-        reject(
-          new Error(`mixFetch setup timed out after ${SETUP_TIMEOUT_MS}ms`)
+export function makeMixFetchSetup(
+  now = () => Date.now()
+) {
+  let mixFetchInitPromise = null
+
+  /** When a new setup may be attempted, and the wait that produced it. */
+  let retryAfter = 0
+  let retryDelay = RETRY_BASE_MS
+
+  /** The failure to re-throw for callers that arrive during the cooldown. */
+  let lastError
+
+  return async function initMixFetch(log) {
+    if (mixFetchInitPromise == null) {
+      if (now() < retryAfter) {
+        // Re-throwing `lastError` itself would hand the caller a stack and a
+        // message from a setup that ended minutes ago, so a cooldown
+        // rejection reads in a crash report as a fresh 60-second timeout. It
+        // is also not necessarily an `Error`: the library rejects with a raw
+        // `MessageEvent` on a worker error, so `.message` can be undefined
+        // downstream.
+        //
+        // Nothing is logged here. This runs once per refused caller, and the
+        // breadcrumb that makes the quiet window visible is emitted once per
+        // window where the cooldown is armed.
+        const remainingMs = retryAfter - now()
+        const error = new Error(
+          `mixFetch setup is cooling down for another ${Math.round(
+            remainingMs / 1000
+          )}s`
         )
-      }, SETUP_TIMEOUT_MS)
-    })
-    mixFetchInitPromise = Promise.race([pending, timeout])
-      .then(mixFetchModule => {
-        log('mixFetch initialized successfully')
-        return mixFetchModule
-      })
-      .catch(async error => {
-        // Clean up stale global state left by the failed init so the
-        // next createMixFetch call starts fresh instead of reusing a
-        // broken singleton.
-        try {
-          await disconnectMixFetch()
-        } catch (e) {}
-        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
-        delete (window ).__mixFetchGlobal
-        mixFetchInitPromise = null
-        log.error('mixFetch initialization failed:', error)
+        error.cause = lastError
         throw error
+      }
+
+      log('Initializing mixFetch...')
+      const pending = createMixFetch(mixFetchOptions)
+      // The timeout below can abandon this setup while it is still in flight.
+      // `createMixFetch` publishes `window.__mixFetchGlobal` as soon as the
+      // worker exists and only then awaits the gateway handshake
+      // (`@nymproject/mix-fetch/index.js:446-449`), so the failure path
+      // usually deletes a global whose owner is already past that assignment:
+      // the abandoned worker stays alive and unreachable, and the next setup
+      // builds a fresh one. A delete that lands before the assignment lets the
+      // late completion re-publish instead, and the line right after it
+      // configures that client, so the next setup finds a working global
+      // rather than an unconfigured one. Either way the cost is one worker per
+      // cooldown window, against a ceiling of RETRY_MAX_MS. Swallow the late
+      // rejection so it is not unhandled.
+      pending.catch(() => {})
+      let timer
+      const timeout = new Promise((resolve, reject) => {
+        timer = setTimeout(() => {
+          reject(
+            new Error(`mixFetch setup timed out after ${SETUP_TIMEOUT_MS}ms`)
+          )
+        }, SETUP_TIMEOUT_MS)
       })
-      .finally(() => {
-        clearTimeout(timer)
-      })
+      mixFetchInitPromise = Promise.race([pending, timeout])
+        .then(mixFetchModule => {
+          log('mixFetch initialized successfully')
+          return mixFetchModule
+        })
+        .catch(error => {
+          // Arm the cooldown before any cleanup. The timeout fires while the
+          // setup is still running, so the disconnect below is an RPC into a
+          // worker that is still busy and has no bounded completion; awaiting
+          // it would leave `mixFetchInitPromise` pending forever, and every
+          // later caller would await that instead of failing fast.
+          mixFetchInitPromise = null
+          lastError = error
+          retryAfter = now() + retryDelay
+          log.error(
+            `mixFetch initialization failed (no retry for ${Math.round(
+              retryDelay / 1000
+            )}s):`,
+            error
+          )
+          // One breadcrumb per cooldown window, not one per refused caller.
+          // The app caps Sentry at 25 breadcrumbs, so a poll loop retrying
+          // every few seconds would evict the whole history in about a
+          // minute, blinding the crash report this failure most needs to
+          // appear in. Emitted before the doubling below, so it names the
+          // window actually armed.
+          log.breadcrumb('mixFetch setup failed, cooling down', {
+            cooldownMs: retryDelay
+          })
+          retryDelay = Math.min(retryDelay * 2, RETRY_MAX_MS)
+
+          // Best-effort: clear the library's singleton so the next setup starts
+          // fresh instead of reusing a broken one. Not awaited, per above.
+          disconnectMixFetch().catch(() => {})
+          // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+          delete (window ).__mixFetchGlobal
+
+          throw error
+        })
+        .finally(() => {
+          clearTimeout(timer)
+        })
+    }
+    const mixFetchModule = await mixFetchInitPromise
+    return mixFetchModule.mixFetch
   }
-  const mixFetchModule = await mixFetchInitPromise
-  return mixFetchModule.mixFetch
 }
+
+export const initMixFetch = makeMixFetchSetup()

package/lib/util/validateServer.js

@@ -1,11 +1,13 @@
 /**
- * We only accept *.edge.app or localhost as valid domain names.
+ * We only accept *.edge.app, localhost, or (for http/ws only) private LAN IPv4.
+ * https/wss still require localhost or *.edge(test)?.app; private IPs are not
+ * accepted on secure schemes.
  */
 export function validateServer(server) {
   const url = new URL(server)
 
   if (url.protocol === 'http:' || url.protocol === 'ws:') {
-    if (url.hostname === 'localhost') return
+    if (isPrivateHost(url.hostname)) return
   }
   if (url.protocol === 'https:' || url.protocol === 'wss:') {
     if (url.hostname === 'localhost') return
@@ -13,6 +15,34 @@ export function validateServer(server) {
   }
 
   throw new Error(
-    `Only *.edge.app or localhost are valid login domain names, not ${url.hostname}`
+    `Only *.edge.app, localhost, or private LAN addresses (http/ws) are valid login domain names, not ${url.hostname}`
   )
 }
+
+function isPrivateHost(hostname) {
+  if (hostname === 'localhost') return true
+  const octets = parseIpv4(hostname)
+  if (octets == null) return false
+  const [a, b] = octets
+  if (a === 127) return true
+  if (a === 10) return true
+  if (a === 192 && b === 168) return true
+  if (a === 172 && b >= 16 && b <= 31) return true
+  return false
+}
+
+function parseIpv4(hostname) {
+  const parts = hostname.split('.')
+  if (parts.length !== 4) return null
+  const octets = []
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null
+    const n = Number(part)
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null
+    // Reject leading zeros like 010.0.0.1 which are not canonical dotted-quad
+    // when they reach this helper (URL parsing may already rewrite some forms).
+    if (part.length > 1 && part.startsWith('0')) return null
+    octets.push(n)
+  }
+  return octets 
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edge-core-js",
-  "version": "2.47.1",
+  "version": "2.48.1",
   "description": "Edge account & wallet management library",
   "keywords": [
     "bitcoin",

package/src/types/types.ts

@@ -2172,6 +2172,13 @@ export interface EdgeContext {
   readonly changeLogSettings: (
     settings: Partial<EdgeLogSettings>
   ) => Promise<void>
+
+  /**
+   * Supplies the latest device attestation token for login-server requests.
+   * Pass `undefined` or `''` to clear the header. Only subsequent login-server
+   * requests pick up the new value.
+   */
+  readonly setAttestationToken: (token: string | undefined) => Promise<void>
 }
 
 // ---------------------------------------------------------------------
@@ -2194,8 +2201,8 @@ export interface EdgeFakeContextOptions {
   logSettings?: Partial<EdgeLogSettings>
   plugins?: EdgeCorePluginsInit
 
-  // Allows core plugins to access the real network except for the
-  // login and sync servers, which remain emulated:
+  // Allows core plugins to access the real network except for login, info,
+  // and sync servers, which remain emulated:
   allowNetworkAccess?: boolean
 
   // Fake device options: