prividium 0.17.1 → 0.18.0

package/dist/cli/src/memory-storage.js

@@ -0,0 +1,12 @@
+export class MemoryStorage {
+    store = new Map();
+    getItem(key) {
+        return this.store.get(key) ?? null;
+    }
+    setItem(key, value) {
+        this.store.set(key, value);
+    }
+    removeItem(key) {
+        this.store.delete(key);
+    }
+}

package/dist/cli/src/rpc-error-codes.js

@@ -0,0 +1,24 @@
+/**
+ * RPC error codes used in Prividium SDK.
+ * Standard codes follow JSON-RPC 2.0 spec, custom codes handle auth/authz.
+ */
+/**
+ * Internal error (-32603). Standard JSON-RPC 2.0 code for server errors.
+ */
+export const INTERNAL_RPC_ERROR = -32603;
+/**
+ * Invalid Request (-32600). Standard JSON-RPC 2.0 code for malformed requests.
+ */
+export const INVALID_REQUEST_ERROR_CODE = -32600;
+/**
+ * Invalid params (-32602). Standard JSON-RPC 2.0 code for bad parameters.
+ */
+export const BAD_RPC_PARAMS_ERROR_CODE = -32602;
+/**
+ * Unauthorized (-32090). Custom code for authentication failures (no/invalid token).
+ */
+export const UNAUTHORIZED_ERROR_CODE = -32090;
+/**
+ * Forbidden (-32001). Custom code for authorization failures (valid token, insufficient permissions).
+ */
+export const FORBIDDEN_ERROR_CODE = -32001;

package/dist/cli/src/siwe-auth.js

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+import { extractResponseError } from './error-utils.js';
+const siweMessageResponseSchema = z.object({
+    msg: z.string(),
+    nonceToken: z.string()
+});
+const siweLoginResponseSchema = z.object({
+    token: z.string(),
+    expiresAt: z.string()
+});
+const mfaResponseSchema = z.object({
+    requiresMfa: z.literal(true)
+});
+export class SiweAuth {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    get address() {
+        return this.config.account.address;
+    }
+    async authorize() {
+        // Step 1: Request SIWE message
+        const siweResponse = await fetch(new URL('/api/siwe-messages', this.config.prividiumApiBaseUrl), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                address: this.config.account.address,
+                ...(this.config.domain && { domain: this.config.domain })
+            })
+        });
+        if (!siweResponse.ok) {
+            const detail = await extractResponseError(siweResponse);
+            throw new Error(`Failed to get SIWE message: ${detail}`);
+        }
+        const siweData = siweMessageResponseSchema.parse(await siweResponse.json());
+        // Step 2: Sign the message
+        const signature = await this.config.account.signMessage({ message: siweData.msg });
+        // Step 3: Login
+        const loginResponse = await fetch(new URL('/api/auth/login/crypto-native', this.config.prividiumApiBaseUrl), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ message: siweData.msg, signature, nonceToken: siweData.nonceToken })
+        });
+        if (!loginResponse.ok) {
+            const detail = await extractResponseError(loginResponse);
+            throw new Error(`SIWE login failed: ${detail}`);
+        }
+        const loginJson = await loginResponse.json();
+        // Check for MFA requirement (admin users with passkeys)
+        const mfaParsed = mfaResponseSchema.safeParse(loginJson);
+        if (mfaParsed.success) {
+            throw new Error('SIWE login requires MFA which is not supported in programmatic auth');
+        }
+        const loginData = siweLoginResponseSchema.parse(loginJson);
+        // Step 4: Store token directly (login response includes expiresAt)
+        const tokenData = {
+            rawToken: loginData.token,
+            expiresAt: new Date(loginData.expiresAt)
+        };
+        this.config.tokenManager.setTokenDirect(tokenData);
+        return tokenData;
+    }
+    unauthorize() {
+        this.config.tokenManager.clearToken();
+    }
+    isAuthorized() {
+        return this.config.tokenManager.isAuthorized();
+    }
+}

package/dist/cli/src/storage.js

@@ -0,0 +1,142 @@
+import { addYears } from 'date-fns/addYears';
+import { z } from 'zod';
+import { STORAGE_KEYS, tokenDataSchema } from './types.js';
+export class LocalStorage {
+    getItem(key) {
+        if (typeof localStorage === 'undefined') {
+            return null;
+        }
+        return localStorage.getItem(key);
+    }
+    setItem(key, value) {
+        if (typeof localStorage !== 'undefined') {
+            localStorage.setItem(key, value);
+        }
+    }
+    removeItem(key) {
+        if (typeof localStorage !== 'undefined') {
+            localStorage.removeItem(key);
+        }
+    }
+}
+export class TokenManager {
+    storage;
+    chainId;
+    prividiumApiUrl;
+    tokenCache = null;
+    onAuthExpiry;
+    constructor(storage, chainId, prividiumApiUrl, onAuthExpiry) {
+        this.storage = storage;
+        this.chainId = chainId;
+        this.prividiumApiUrl = prividiumApiUrl;
+        this.onAuthExpiry = onAuthExpiry ?? (() => { });
+    }
+    get tokenKey() {
+        return `${STORAGE_KEYS.TOKEN_PREFIX}${this.chainId}`;
+    }
+    get stateKey() {
+        return `${STORAGE_KEYS.STATE_PREFIX}${this.chainId}`;
+    }
+    getToken() {
+        if (this.tokenCache) {
+            return this.tokenCache;
+        }
+        const tokenDataStr = this.storage.getItem(this.tokenKey);
+        if (!tokenDataStr) {
+            return null;
+        }
+        try {
+            const tokenData = tokenDataSchema.safeParse(JSON.parse(tokenDataStr));
+            if (!tokenData.success) {
+                return null;
+            }
+            if (new Date() > tokenData.data.expiresAt) {
+                this.clearToken();
+                this.onAuthExpiry();
+                return null;
+            }
+            this.tokenCache = tokenData.data;
+            return tokenData.data;
+        }
+        catch (e) {
+            if (e instanceof SyntaxError) {
+                return null;
+            }
+            throw e;
+        }
+    }
+    async getTokenExpiration(token) {
+        const currentSessionRes = await fetch(new URL('/api/auth/current-session', this.prividiumApiUrl), {
+            headers: {
+                authorization: `Bearer ${token}`
+            }
+        });
+        if (!currentSessionRes.ok) {
+            throw new Error('Error accessing prividium api');
+        }
+        if (currentSessionRes.status === 404) {
+            // NOTE: 404 indicates /api/auth/current-session is unavailable (older API),
+            // so the token expiration cannot be retrieved. The SDK must defer expiry
+            // handling until a 403 response is received; a far-future date prevents
+            // premature onExpiry callbacks before validation fails.
+            return addYears(new Date(), 100);
+        }
+        if (!currentSessionRes.ok || currentSessionRes.status !== 200) {
+            throw new Error('Error accessing prividium api');
+        }
+        const schema = z.object({
+            expiresAt: z.iso.datetime()
+        });
+        const parsed = schema.safeParse(await currentSessionRes.json());
+        if (!parsed.success) {
+            throw new Error('Invalid response from prividium api');
+        }
+        return new Date(parsed.data.expiresAt);
+    }
+    async setToken(rawToken) {
+        try {
+            const expiresAt = await this.getTokenExpiration(rawToken);
+            const tokenData = { rawToken, expiresAt };
+            this.storage.setItem(this.tokenKey, JSON.stringify(tokenData));
+            this.tokenCache = tokenData;
+            return tokenData;
+        }
+        catch (error) {
+            this.clearToken();
+            throw error;
+        }
+    }
+    /**
+     * Stores token data directly without fetching expiration from the API.
+     * Used by SIWE auth where the login response already includes expiresAt.
+     */
+    setTokenDirect(tokenData) {
+        this.storage.setItem(this.tokenKey, JSON.stringify(tokenData));
+        this.tokenCache = tokenData;
+    }
+    clearToken() {
+        this.tokenCache = null;
+        this.storage.removeItem(this.tokenKey);
+    }
+    isAuthorized() {
+        const tokenData = this.getToken();
+        if (tokenData === null) {
+            return false;
+        }
+        const isExpired = new Date() > tokenData.expiresAt;
+        if (isExpired) {
+            this.onAuthExpiry();
+            this.clearToken();
+        }
+        return !isExpired;
+    }
+    setState(state) {
+        this.storage.setItem(this.stateKey, state);
+    }
+    getState() {
+        return this.storage.getItem(this.stateKey);
+    }
+    clearState() {
+        this.storage.removeItem(this.stateKey);
+    }
+}

package/dist/cli/src/types.js

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+export const roleSchema = z.object({
+    roleName: z.string()
+});
+export const profileSchema = z.object({
+    id: z.string(),
+    createdAt: z.coerce.date(),
+    displayName: z.string(),
+    updatedAt: z.coerce.date(),
+    roles: roleSchema.array(),
+    wallets: z.unknown().array()
+});
+export const authorizeTransactionResponseSchema = z.object({
+    message: z.string(),
+    activeUntil: z.string()
+});
+const methodSelectorSchema = z.string().regex(/^0x[0-9a-fA-F]{8}$/, 'Invalid method selector format');
+const addressSchema = z.string().regex(/^0x[0-9a-fA-F]{40}$/i, 'Invalid address format');
+export const contractAbiResponseSchema = z.object({
+    contractAddress: addressSchema,
+    name: z.string().nullable(),
+    abi: z.array(z.record(z.string(), z.unknown())),
+    functions: z.array(z.object({
+        selector: methodSelectorSchema,
+        signature: z.string(),
+        name: z.string(),
+        accessType: z.enum(['read', 'write'])
+    }))
+});
+export const tokenDataSchema = z.object({
+    rawToken: z.string(),
+    expiresAt: z.coerce.date()
+});
+export const AUTH_ERRORS = {
+    INVALID_STATE: 'Invalid state parameter',
+    NO_RECEIVED_STATE: 'No state parameter',
+    NO_SAVED_STATE: 'No saved state',
+    NO_TOKEN: 'No token received',
+    EXPIRED_TOKEN: 'Expired token',
+    INVALID_JWT: 'Invalid JWT format',
+    AUTH_REQUIRED: 'Authentication required'
+};
+export const STORAGE_KEYS = {
+    STATE_PREFIX: 'prividium_auth_state_',
+    TOKEN_PREFIX: 'prividium_token_'
+};

package/dist/cli/tsconfig.cli.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["../../cli/base-cli.ts","../../cli/index.ts","../../cli/commands/config.ts","../../cli/commands/doctor.ts","../../cli/commands/proxy.ts","../../cli/commands/doctor/constants.ts","../../cli/commands/doctor/profile.ts","../../cli/commands/doctor/stages.ts","../../cli/commands/doctor/types.ts","../../cli/commands/doctor/utils.ts","../../cli/commands/doctor/clients/browser-auth.ts","../../cli/commands/doctor/clients/http.ts","../../cli/commands/doctor/clients/rpc.ts","../../cli/commands/doctor/clients/wallet-api.ts","../../cli/commands/doctor/probes/authentication.ts","../../cli/commands/doctor/probes/bridging.ts","../../cli/commands/doctor/probes/global.ts","../../cli/commands/doctor/probes/wallet-api.ts","../../cli/commands/doctor/probes/wallet.ts","../../cli/commands/doctor/probes/authentication/authentication.ts","../../cli/commands/doctor/probes/authentication/wallet-preconditions.ts","../../cli/commands/doctor/probes/bridging/bridging.ts","../../cli/commands/doctor/probes/global/input-validation.ts","../../cli/commands/doctor/probes/global/reachability.ts","../../cli/commands/doctor/probes/wallet/authenticated-rpc.ts","../../cli/commands/doctor/probes/wallet/authorization-and-wallet-rpc.ts","../../cli/commands/doctor/report/build.ts","../../cli/commands/doctor/report/render.ts","../../cli/commands/utils/show-prividium-header.ts","../../cli/commands/utils/url-config.ts","../../cli/server/config-file.ts","../../cli/server/connection-workflow.ts","../../cli/server/server.ts"],"version":"5.8.3"}

package/dist/sdk/popup-auth.d.ts

@@ -1,12 +1,6 @@
 import type { TokenManager } from './storage.js';
 import { type PopupOptions } from './types.js';
-/**
- * OAuth scopes that can be requested during authorization
- *
- * - `wallet:required`: Requires user to have at least one wallet associated
- * - `network:required`: Requires user to have wallet connected with correct chain
- */
-export type OauthScope = 'wallet:required' | 'network:required';
+export type { OauthScope } from './types.js';
 export interface PopupAuthConfig {
     authBaseUrl: string;
     clientId: string;

package/dist/sdk/siwe-auth.d.ts

@@ -4,7 +4,7 @@ import type { TokenData } from './types.js';
 export interface SiweAuthConfig {
     account: LocalAccount;
     prividiumApiBaseUrl: string;
-    domain: string;
+    domain?: string;
     tokenManager: TokenManager;
 }
 export declare class SiweAuth {

package/dist/sdk/siwe-auth.js

@@ -26,7 +26,7 @@ export class SiweAuth {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
                 address: this.config.account.address,
-                domain: this.config.domain
+                ...(this.config.domain && { domain: this.config.domain })
             })
         });
         if (!siweResponse.ok) {

package/dist/sdk/siwe-chain.d.ts

@@ -4,7 +4,7 @@ export interface PrividiumSiweConfig {
     chain: Omit<Chain, 'rpcUrls'>;
     prividiumApiBaseUrl: string;
     account: LocalAccount;
-    domain: string;
+    domain?: string;
     storage?: Storage;
     autoReauthenticate?: boolean;
     onAuthExpiry?: () => void;

package/dist/sdk/types.d.ts

@@ -1,6 +1,6 @@
 import type { Address, Chain, Hex, Transport } from 'viem';
 import { z } from 'zod';
-import type { OauthScope } from './popup-auth.js';
+export type OauthScope = 'wallet:required' | 'network:required';
 export interface Storage {
     getItem(key: string): string | null;
     setItem(key: string, value: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prividium",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "type": "module",
   "bin": {
     "prividium": "bin/cli.js"
@@ -24,7 +24,7 @@
   ],
   "scripts": {
     "build": "tsc -b && pnpm copy-static-files",
-    "copy-static-files": "cp -r cli/static dist/cli",
+    "copy-static-files": "cp -r cli/static dist/cli/cli",
     "dev": "tsc -b --watch",
     "test": "vitest run",
     "test:watch": "vitest",

package/dist/cli/commands/proxy.js

@@ -1,149 +0,0 @@
-import { log } from '@clack/prompts';
-import color from 'kleur';
-import { CreationWorkflow } from '../server/connection-workflow.js';
-import { buildServer } from '../server/server.js';
-import { gatherUrlConfig } from './utils/url-config.js';
-const DEFAULT_PORT = 24101;
-async function verifyUserPanelUrl(url) {
-    try {
-        const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
-        const html = await response.text();
-        const metaMatch = html.match(/<meta\s+name="prividium-component"\s+content="([^"]*)"\s*\/?>/i);
-        if (metaMatch?.[1]) {
-            const component = metaMatch[1].toLowerCase();
-            if (component === 'admin-panel') {
-                log.error(`The --user-panel-url appears to point to an Admin Panel, not a User Panel.\n` +
-                    `  Provided URL: ${url}\n\n` +
-                    `Please provide the User Panel URL instead (typically a different port).`);
-                process.exit(1);
-            }
-            if (component !== 'user-panel') {
-                log.warn(`Could not confirm that --user-panel-url points to a Prividium User Panel.\n` +
-                    `  Provided URL: ${url}\n` +
-                    `  Detected component: "${metaMatch[1]}"\n` +
-                    `Proceeding anyway. If authentication hangs, verify this URL is correct.`);
-            }
-            return;
-        }
-        log.warn(`Could not confirm that --user-panel-url points to a Prividium User Panel.\n` +
-            `  Provided URL: ${url}\n` +
-            `Proceeding anyway. If authentication hangs, verify this URL is correct.`);
-    }
-    catch (error) {
-        if (error instanceof TypeError ||
-            (error instanceof DOMException && (error.name === 'TimeoutError' || error.name === 'AbortError'))) {
-            log.warn(`Could not reach --user-panel-url at ${url}.\n` +
-                `Proceeding anyway. If authentication hangs, verify this URL is correct.`);
-            return;
-        }
-        throw error;
-    }
-}
-function checkHostAndPortWarnings(host, port, allowExternalAccess) {
-    if (port !== DEFAULT_PORT) {
-        log.warn(`Non standard port detected: ${port}. Redirect from prividium auth might not work.`);
-    }
-    if (host !== '127.0.0.1' && host !== 'localhost') {
-        if (!allowExternalAccess) {
-            log.error(`${color.bold('ERROR')}: In order to use a host different than local host you need to set --unsecureAllowOutsideAccess flag.`);
-            process.exit(1);
-        }
-        if (host === '0.0.0.0') {
-            log.warn(`${color.bold('WARNING')}: Your local proxy will be exposed outside your current device.`);
-        }
-        else {
-            log.warn(`${color.bold('WARNING')}: Non standard host: ${host}. Your proxy might be open for other devices. Redirect from prividium auth might not work.`);
-        }
-    }
-}
-async function startServer(opts) {
-    const workflow = new CreationWorkflow(opts.host, opts.port);
-    workflow.start();
-    const { prividiumRpcUrl, userPanelUrl } = await gatherUrlConfig({
-        configPath: opts.configPath,
-        rpcUrl: opts.rpcUrl,
-        userPanelUrl: opts.userPanelUrl,
-        rpcUrlLabel: 'prividium rpc',
-        logProvidedUrls: true
-    });
-    await verifyUserPanelUrl(userPanelUrl);
-    checkHostAndPortWarnings(opts.host, opts.port, opts.allowExternalAccess);
-    const app = buildServer({
-        prividiumRpcUrl,
-        userPanelUrl,
-        host: opts.host,
-        port: opts.port,
-        async onSubmit() {
-            await workflow.onSubmit();
-        },
-        onCall(methodName) {
-            workflow.onMessage(methodName);
-        },
-        onReAuthNeeded() {
-            workflow.onMessage(`Please login again: ${serverUrl}`);
-        },
-        onError: (err) => {
-            workflow.onError(err);
-        }
-    });
-    await app.listen({
-        port: opts.port,
-        host: opts.host
-    });
-    const serverUrl = `http://${opts.host}:${opts.port}`;
-    await workflow.waitForAuthentication(serverUrl);
-}
-export const addProxy = (cli) => {
-    return cli.command('proxy', 'Starts authenticated rpc proxy server', (yargs) => yargs
-        .option('rpcUrl', {
-        alias: ['rpc-url', 'r'],
-        description: 'Specifies target Prividium™ rpc url. These takes precedence over config file and env variable.',
-        demandOption: false,
-        type: 'string'
-    })
-        .option('userPanelUrl', {
-        alias: ['user-panel-url', 'u'],
-        description: 'Specifies url used to log in into the Prividium™ network. Takes precedence over config file and env variable',
-        type: 'string'
-    })
-        .option('configPath', {
-        alias: ['c', 'config-path', 'config'],
-        description: 'Path for config file. By default config file is stored under user personal folder',
-        type: 'string',
-        demandOption: false
-    })
-        .option('port', {
-        alias: ['p'],
-        description: 'Port used for local proxy. This has to match with the port configured in your Prividium™ network.',
-        default: DEFAULT_PORT,
-        type: 'number'
-    })
-        .option('host', {
-        alias: 'h',
-        description: 'Host used for local server. By default traffic from outside localhost is disabled.',
-        default: '127.0.0.1',
-        type: 'string'
-    })
-        .option('unsecureAllowOutsideAccess', {
-        alias: ['unsecure-allow-outside-access'],
-        description: 'Allow server to be exposed to the network (accessible by other devices)',
-        default: false,
-        type: 'boolean'
-    }), async (args) => {
-        try {
-            await startServer({
-                rpcUrl: args.rpcUrl,
-                userPanelUrl: args.userPanelUrl,
-                configPath: args.configPath,
-                port: args.port,
-                host: args.host,
-                allowExternalAccess: args.unsecureAllowOutsideAccess
-            });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            console.error(`Prividium proxy failed: ${message}`);
-            process.exit(1);
-        }
-    });
-};

package/dist/tsconfig.cli.tsbuildinfo

@@ -1 +0,0 @@
-{"root":["../cli/base-cli.ts","../cli/index.ts","../cli/commands/config.ts","../cli/commands/doctor.ts","../cli/commands/proxy.ts","../cli/commands/doctor/constants.ts","../cli/commands/doctor/profile.ts","../cli/commands/doctor/stages.ts","../cli/commands/doctor/types.ts","../cli/commands/doctor/utils.ts","../cli/commands/doctor/clients/browser-auth.ts","../cli/commands/doctor/clients/http.ts","../cli/commands/doctor/clients/rpc.ts","../cli/commands/doctor/clients/wallet-api.ts","../cli/commands/doctor/probes/authentication.ts","../cli/commands/doctor/probes/bridging.ts","../cli/commands/doctor/probes/global.ts","../cli/commands/doctor/probes/wallet-api.ts","../cli/commands/doctor/probes/wallet.ts","../cli/commands/doctor/probes/authentication/authentication.ts","../cli/commands/doctor/probes/authentication/wallet-preconditions.ts","../cli/commands/doctor/probes/bridging/bridging.ts","../cli/commands/doctor/probes/global/input-validation.ts","../cli/commands/doctor/probes/global/reachability.ts","../cli/commands/doctor/probes/wallet/authenticated-rpc.ts","../cli/commands/doctor/probes/wallet/authorization-and-wallet-rpc.ts","../cli/commands/doctor/report/build.ts","../cli/commands/doctor/report/render.ts","../cli/commands/utils/show-prividium-header.ts","../cli/commands/utils/url-config.ts","../cli/server/config-file.ts","../cli/server/connection-workflow.ts","../cli/server/server.ts"],"version":"5.8.3"}