webnative/lib/index.js

import localforage from 'localforage';
import * as common from "./common/index.js";
import * as identifiers from "./common/identifiers.js";
import * as ipfs from "./ipfs/index.js";
import * as pathing from "./path.js";
import * as crypto from "./crypto/index.js";
import * as storage from "./storage/index.js";
import * as ucan from "./ucan/internal.js";
import * as ucanPermissions from "./ucan/permissions.js";
import { setup } from "./setup/internal.js";
import * as did from "./did/index.js";
import { USERNAME_STORAGE_KEY } from "./common/index.js";
import { loadFileSystem } from "./filesystem.js";
import FileSystem from "./fs/index.js";
// SCENARIO
export var Scenario;
(function (Scenario) {
    Scenario["NotAuthorised"] = "NOT_AUTHORISED";
    Scenario["AuthSucceeded"] = "AUTH_SUCCEEDED";
    Scenario["AuthCancelled"] = "AUTH_CANCELLED";
    Scenario["Continuation"] = "CONTINUATION";
})(Scenario || (Scenario = {}));
// ERRORS
/**
 * Initialisation error
 */
export var InitialisationError;
(function (InitialisationError) {
    InitialisationError["InsecureContext"] = "INSECURE_CONTEXT";
    InitialisationError["UnsupportedBrowser"] = "UNSUPPORTED_BROWSER";
})(InitialisationError || (InitialisationError = {}));
// INTIALISE
/**
 * Check if we're authenticated, process any lobby query-parameters present in the URL,
 * and initiate the user's file system if authenticated (can be disabled).
 *
 * See `loadFileSystem` if you want to load the user's file system yourself.
 * NOTE: Only works on the main/ui thread, as it uses `window.location`.
 */
export async function initialise(options) {
    options = options || {};
    const permissions = options.permissions || null;
    const { autoRemoveUrlParams = true, rootKey } = options;
    const maybeLoadFs = async (username) => {
        return options.loadFileSystem === false
            ? undefined
            : await loadFileSystem(permissions, username, rootKey);
    };
    // Check if browser is supported
    if (globalThis.isSecureContext === false)
        throw InitialisationError.InsecureContext;
    if (await isSupported() === false)
        throw InitialisationError.UnsupportedBrowser;
    // URL things
    const url = new URL(window.location.href);
    const authorised = url.searchParams.get("authorised");
    const cancellation = url.searchParams.get("cancelled");
    // Determine scenario
    if (authorised) {
        const newUser = url.searchParams.get("newUser") === "t";
        const username = url.searchParams.get("username") || "";
        await importClassifiedInfo(authorised === "via-postmessage"
            ? await getClassifiedViaPostMessage()
            : await ipfs.cat(authorised) // in any other case we expect it to be a CID
        );
        await storage.setItem(USERNAME_STORAGE_KEY, username);
        if (autoRemoveUrlParams) {
            url.searchParams.delete("authorised");
            url.searchParams.delete("newUser");
            url.searchParams.delete("username");
            history.replaceState(null, document.title, url.toString());
        }
        if (permissions && await validateSecrets(permissions) === false) {
            console.warn("Unable to validate filesystem secrets");
            return scenarioNotAuthorised(permissions);
        }
        if (permissions && ucan.validatePermissions(permissions, username) === false) {
            console.warn("Unable to validate UCAN permissions");
            return scenarioNotAuthorised(permissions);
        }
        return scenarioAuthSucceeded(permissions, newUser, username, await maybeLoadFs(username));
    }
    else if (cancellation) {
        const c = (() => {
            switch (cancellation) {
                case "DENIED": return "User denied authorisation";
                default: return "Unknown reason";
            }
        })();
        return scenarioAuthCancelled(permissions, c);
    }
    else {
        // trigger build for internal ucan dictionary
        await ucan.store([]);
    }
    const authedUsername = await common.authenticatedUsername();
    if (authedUsername && permissions) {
        const validSecrets = await validateSecrets(permissions);
        const validUcans = ucan.validatePermissions(permissions, authedUsername);
        if (validSecrets && validUcans) {
            return scenarioContinuation(permissions, authedUsername, await maybeLoadFs(authedUsername));
        }
        else {
            return scenarioNotAuthorised(permissions);
        }
    }
    else if (authedUsername) {
        return scenarioContinuation(permissions, authedUsername, await maybeLoadFs(authedUsername));
    }
    else {
        return scenarioNotAuthorised(permissions);
    }
}
/**
 * Alias for `initialise`.
 */
export { initialise as initialize };
// SUPPORTED
export async function isSupported() {
    return localforage.supports(localforage.INDEXEDDB)
        // Firefox in private mode can't use indexedDB properly,
        // so we test if we can actually make a database.
        && await (() => new Promise(resolve => {
            const db = indexedDB.open("testDatabase");
            db.onsuccess = () => resolve(true);
            db.onerror = () => resolve(false);
        }))();
}
// EXPORT
export * from "./auth.js";
export * from "./filesystem.js";
export * from "./common/version.js";
export const fs = FileSystem;
export * as apps from "./apps/index.js";
export * as dataRoot from "./data-root.js";
export * as did from "./did/index.js";
export * as errors from "./errors.js";
export * as lobby from "./lobby/index.js";
export * as path from "./path.js";
export * as setup from "./setup.js";
export * as ucan from "./ucan/index.js";
export * as dns from "./dns/index.js";
export * as ipfs from "./ipfs/index.js";
export * as keystore from "./keystore.js";
export * as machinery from "./common/index.js";
export * as crypto from "./crypto/index.js";
export * as cbor from 'cborg';
// ㊙️  ⚛  SCENARIOS
function scenarioAuthSucceeded(permissions, newUser, username, fs) {
    return {
        scenario: Scenario.AuthSucceeded,
        permissions,
        authenticated: true,
        throughLobby: true,
        fs,
        newUser,
        username
    };
}
function scenarioAuthCancelled(permissions, cancellationReason) {
    return {
        scenario: Scenario.AuthCancelled,
        permissions,
        authenticated: false,
        throughLobby: true,
        cancellationReason
    };
}
function scenarioContinuation(permissions, username, fs) {
    return {
        scenario: Scenario.Continuation,
        permissions,
        authenticated: true,
        newUser: false,
        throughLobby: false,
        fs,
        username
    };
}
function scenarioNotAuthorised(permissions) {
    return {
        scenario: Scenario.NotAuthorised,
        permissions,
        authenticated: false
    };
}
async function importClassifiedInfo(classified) {
    const info = JSON.parse(classified);
    // Extract session key and its iv
    const rawSessionKey = await crypto.keystore.decrypt(info.sessionKey);
    // Decrypt secrets
    const secretsStr = await crypto.aes.decryptGCM(info.secrets, rawSessionKey, info.iv);
    const secrets = JSON.parse(secretsStr);
    const fsSecrets = secrets.fs;
    const ucans = secrets.ucans;
    // Import read keys and bare name filters
    await Promise.all(Object.entries(fsSecrets).map(async ([posixPath, { bareNameFilter, key }]) => {
        const path = pathing.fromPosix(posixPath);
        const readKeyId = await identifiers.readKey({ path });
        const bareNameFilterId = await identifiers.bareNameFilter({ path });
        await crypto.keystore.importSymmKey(key, readKeyId);
        await storage.setItem(bareNameFilterId, bareNameFilter);
    }));
    // Add UCANs to the storage
    await ucan.store(ucans);
}
async function getClassifiedViaPostMessage() {
    const iframe = await new Promise(resolve => {
        const iframe = document.createElement("iframe");
        iframe.id = "webnative-secret-exchange";
        iframe.style.width = "0";
        iframe.style.height = "0";
        iframe.style.border = "none";
        iframe.style.display = "none";
        document.body.appendChild(iframe);
        iframe.onload = () => {
            resolve(iframe);
        };
        iframe.src = `${setup.endpoints.lobby}/exchange.html`;
    });
    try {
        const answer = new Promise((resolve, reject) => {
            window.addEventListener("message", listen);
            function listen(event) {
                window.removeEventListener("message", listen);
                if (event.data) {
                    resolve(event.data);
                }
                else {
                    reject(new Error("Can't import UCANs & readKey(s): Missing data"));
                }
            }
        });
        if (iframe.contentWindow == null)
            throw new Error("Can't import UCANs & readKey(s): No access to its contentWindow");
        const message = {
            webnative: "exchange-secrets",
            didExchange: await did.exchange()
        };
        iframe.contentWindow.postMessage(message, iframe.src);
        return await answer;
    }
    finally {
        document.body.removeChild(iframe);
    }
}
async function validateSecrets(permissions) {
    return ucanPermissions.paths(permissions).reduce((acc, path) => acc.then(async (bool) => {
        if (bool === false)
            return bool;
        if (pathing.isBranch(pathing.Branch.Public, path))
            return bool;
        const keyName = await identifiers.readKey({ path });
        return await crypto.keystore.keyExists(keyName);
    }), Promise.resolve(true));
}
//# sourceMappingURL=index.js.map