chore: sync from internal

Author: phantom-commit-bot[bot]

packages/auth2/src/Auth2Token.ts

@@ -1,6 +1,6 @@
 import { jwtDecode } from "jwt-decode";
 
-type Auth2TokenClaims = {
+type Claims = {
   sub: string;
   client_id: string;
   iss: string;
@@ -12,52 +12,76 @@ type Auth2TokenClaims = {
   };
 };
 
+type A2TClaims = {
+  exp: number;
+  iat: number;
+};
+
 type WalletIdentity = {
   id: string;
   derivationIndex: number;
 };
 
 export class Auth2Token {
   private WALLET_URN_PREFIX = "urn:phantom:wallet:";
+  private WALLET_TAG_URN_PREFIX = "urn:phantom:wallet-tag:";
+
+  private _claims: Claims;
+  private _a2tClaims: A2TClaims;
 
-  private _claims: Auth2TokenClaims;
   private _identity?: WalletIdentity;
+  private _walletTag?: string;
 
   private constructor(accessToken: string) {
-    const claims = jwtDecode<Auth2TokenClaims>(accessToken);
+    this._claims = jwtDecode<Claims>(accessToken);
+    this._a2tClaims = jwtDecode<A2TClaims>(this._claims.ext.a2t);
 
-    this._claims = claims;
-
-    const aud = claims.aud.find(aud => aud.startsWith(this.WALLET_URN_PREFIX));
-
-    if (!aud) {
-      return;
+    const walletAud = this._claims.aud.find(aud => aud.startsWith(this.WALLET_URN_PREFIX));
+    if (walletAud) {
+      const [id, derivationIndex] = walletAud.replace(this.WALLET_URN_PREFIX, "").split(":");
+      this._identity = {
+        id,
+        derivationIndex: Number(derivationIndex),
+      };
     }
 
-    const [id, derivationIndex] = aud.replace(this.WALLET_URN_PREFIX, "").split(":");
-    this._identity = {
-      id,
-      derivationIndex: Number(derivationIndex),
-    };
+    const walletTagAud = this._claims.aud.find(aud => aud.startsWith(this.WALLET_TAG_URN_PREFIX));
+    if (walletTagAud) {
+      this._walletTag = walletTagAud.replace(this.WALLET_TAG_URN_PREFIX, "");
+    }
   }
 
   static fromAccessToken(accessToken: string): Auth2Token {
     return new this(accessToken);
   }
 
-  get sub(): Auth2TokenClaims["sub"] {
+  get sub(): Claims["sub"] {
     return this._claims.sub;
   }
 
-  get clientId(): Auth2TokenClaims["client_id"] {
+  get clientId(): Claims["client_id"] {
     return this._claims.client_id;
   }
 
-  get a2t(): Auth2TokenClaims["ext"]["a2t"] {
+  get wallet(): WalletIdentity | undefined {
+    return this._identity;
+  }
+
+  get walletTag(): string | undefined {
+    return this._walletTag;
+  }
+
+  get a2t(): Claims["ext"]["a2t"] {
+    if (this._a2tClaims.exp < Date.now() / 1_000) {
+      throw new Auth2TokenExpiredError();
+    }
     return this._claims.ext.a2t;
   }
+}
 
-  get wallet(): WalletIdentity | undefined {
-    return this._identity;
+export class Auth2TokenExpiredError extends Error {
+  constructor() {
+    super("Auth2 token expired");
+    this.name = "Auth2TokenExpiredError";
   }
 }

packages/auth2/src/__tests__/Auth2Token.test.ts

@@ -3,7 +3,7 @@ jest.mock("jwt-decode", () => ({
   jwtDecode: mockJwtDecode,
 }));
 
-import { Auth2Token } from "../Auth2Token";
+import { Auth2Token, Auth2TokenExpiredError } from "../Auth2Token";
 
 const WALLET_URN_PREFIX = "urn:phantom:wallet:";
 
@@ -54,10 +54,22 @@ describe("Auth2Token", () => {
   });
 
   describe("a2t getter", () => {
-    it("returns the ext.a2t claim from the token", () => {
-      mockJwtDecode.mockReturnValueOnce(makeClaims({ a2t: "inner-auth2-tok" }));
+    it("returns a2t when exp is in the future", () => {
+      const validA2tClaims = { exp: Math.floor(Date.now() / 1_000) + 3600, iat: 0 };
+      mockJwtDecode.mockReturnValueOnce(makeClaims({ a2t: "valid-a2t" })).mockReturnValueOnce(validA2tClaims);
 
-      expect(Auth2Token.fromAccessToken("tok").a2t).toBe("inner-auth2-tok");
+      const token = Auth2Token.fromAccessToken("tok");
+
+      expect(token.a2t).toBe("valid-a2t");
+    });
+
+    it("throws Auth2TokenExpiredError when a2t exp is in the past", () => {
+      const expiredA2tClaims = { exp: Math.floor(Date.now() / 1_000) - 60, iat: 0 };
+      mockJwtDecode.mockReturnValueOnce(makeClaims({ a2t: "expired-a2t" })).mockReturnValueOnce(expiredA2tClaims);
+
+      const token = Auth2Token.fromAccessToken("tok");
+
+      expect(() => token.a2t).toThrow(Auth2TokenExpiredError);
     });
   });
 

packages/auth2/src/__tests__/auth2Flow.test.ts

@@ -43,7 +43,8 @@ function makeJwt(payload: Record<string, unknown>): string {
   return `${encode({ alg: "HS256" })}.${encode({ aud: [], ...payload })}.sig`;
 }
 
-const DEFAULT_ACCESS_TOKEN = makeJwt({ sub: "user-1", client_id: "test-client", ext: { a2t: "auth2-tok" } });
+const DEFAULT_A2T = makeJwt({ exp: Math.floor(Date.now() / 1_000) + 3600, iat: Math.floor(Date.now() / 1_000) });
+const DEFAULT_ACCESS_TOKEN = makeJwt({ sub: "user-1", client_id: "test-client", ext: { a2t: DEFAULT_A2T } });
 
 const MOCK_RAW_PUB = new Uint8Array([0x04, ...Array(64).fill(0x01)]);
 
@@ -582,7 +583,7 @@ describe("completeAuth2Exchange()", () => {
     mockExchangeAuthCode.mockResolvedValueOnce({
       accessToken: makeJwt({
         sub: "user-1",
-        ext: { a2t: "auth2-tok" },
+        ext: { a2t: DEFAULT_A2T },
         aud: ["urn:phantom:wallet:wallet-from-token:2"],
       }),
       idType: "Bearer",
@@ -608,7 +609,7 @@ describe("completeAuth2Exchange()", () => {
     mockExchangeAuthCode.mockResolvedValueOnce({
       accessToken: makeJwt({
         sub: "user-1",
-        ext: { a2t: "auth2-tok" },
+        ext: { a2t: DEFAULT_A2T },
         aud: ["urn:phantom:wallet:wallet-from-token:3"],
       }),
       idType: "Bearer",
@@ -837,7 +838,7 @@ describe("_getOrMigrateWallet()", () => {
   function makeToken(overrides: Partial<{ client_id: string; walletUrn: string }> = {}) {
     const aud = overrides.walletUrn ? [overrides.walletUrn] : [];
     return Auth2Token.fromAccessToken(
-      makeJwt({ sub: "user-1", client_id: overrides.client_id ?? "test-client", ext: { a2t: "t" }, aud }),
+      makeJwt({ sub: "user-1", client_id: overrides.client_id ?? "test-client", ext: { a2t: DEFAULT_A2T }, aud }),
     );
   }
 

packages/auth2/src/index.ts

@@ -1,6 +1,7 @@
 export { Auth2KmsRpcClient, type Auth2KmsClientOptions } from "./Auth2KmsRpcClient";
 export { Auth2Stamper, type Auth2StamperRefreshConfig } from "./Auth2Stamper";
 export type { Auth2StamperStorage, Auth2StamperStoredRecord } from "./Auth2StamperStorage";
+export { Auth2TokenExpiredError } from "./Auth2Token";
 export { exchangeAuthCode, refreshToken } from "./tokenExchange";
 export type { Auth2StamperWithKeyManagement, Auth2AuthProviderOptions } from "./types";
 export {

packages/browser-sdk/src/providers/embedded/adapters/Auth2Stamper.test.ts

@@ -30,6 +30,11 @@ function makeJwt(payload: Record<string, unknown>): string {
   return `${encode({ alg: "HS256" })}.${encode({ aud: [], ...payload })}.sig`;
 }
 
+function makeA2tJwt(): string {
+  const now = Math.floor(Date.now() / 1000);
+  return makeJwt({ exp: now + 3600, iat: now });
+}
+
 beforeEach(() => {
   Object.defineProperty(globalThis.crypto, "subtle", {
     value: mockSubtle,
@@ -131,7 +136,7 @@ describe("Auth2Stamper", () => {
       const stamper1 = new Auth2Stamper(new IndexedDBAuth2StamperStorage(dbName));
       await stamper1.init();
       await stamper1.setTokens({
-        accessToken: makeJwt({ sub: "u", ext: { a2t: "persisted-token" } }),
+        accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }),
         idType: "Bearer",
       });
 
@@ -149,7 +154,7 @@ describe("Auth2Stamper", () => {
       const stamper = makeStamper();
       await stamper.init();
 
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "my-token" } }), idType: "Bearer" });
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }), idType: "Bearer" });
 
       await expect(stamper.stamp({ type: "OIDC", data: Buffer.from("payload") })).resolves.toBeTruthy();
     });
@@ -158,8 +163,9 @@ describe("Auth2Stamper", () => {
       const dbName = `persist-db-${Date.now()}`;
       const stamper = new Auth2Stamper(new IndexedDBAuth2StamperStorage(dbName));
       await stamper.init();
+      const a2tJwt = makeA2tJwt();
       await stamper.setTokens({
-        accessToken: makeJwt({ sub: "u", ext: { a2t: "auto-connect-token" } }),
+        accessToken: makeJwt({ sub: "u", ext: { a2t: a2tJwt } }),
         idType: "Bearer",
       });
 
@@ -170,14 +176,14 @@ describe("Auth2Stamper", () => {
       const decoded = JSON.parse(Buffer.from(stampStr, "base64url").toString("utf-8")) as {
         idToken: string;
       };
-      expect(decoded.idToken).toBe("auto-connect-token");
+      expect(decoded.idToken).toBe(a2tJwt);
     });
 
     it("persists bearerToken and refreshToken to IndexedDB", async () => {
       const dbName = `persist-tokens-db-${Date.now()}`;
       const stamper = new Auth2Stamper(new IndexedDBAuth2StamperStorage(dbName));
       await stamper.init();
-      const accessToken = makeJwt({ sub: "u", ext: { a2t: "a2t-tok" } });
+      const accessToken = makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } });
       await stamper.setTokens({
         accessToken,
         idType: "Bearer",
@@ -203,7 +209,7 @@ describe("Auth2Stamper", () => {
     it("bearerToken returns '{idType} {accessToken}' after setTokens()", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      const accessToken = makeJwt({ sub: "test-user", ext: { a2t: "a2t-tok" } });
+      const accessToken = makeJwt({ sub: "test-user", ext: { a2t: makeA2tJwt() } });
       await stamper.setTokens({ accessToken, idType: "Bearer", refreshToken: "refresh-tok" });
 
       expect(stamper.bearerToken).toBe(`Bearer ${accessToken}`);
@@ -212,7 +218,7 @@ describe("Auth2Stamper", () => {
     it("auth2Token.sub matches the sub claim in the access token", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      const accessToken = makeJwt({ sub: "test-user", ext: { a2t: "a2t-tok" } });
+      const accessToken = makeJwt({ sub: "test-user", ext: { a2t: makeA2tJwt() } });
       await stamper.setTokens({ accessToken, idType: "Bearer" });
 
       expect(stamper.auth2Token?.sub).toBe("test-user");
@@ -221,7 +227,7 @@ describe("Auth2Stamper", () => {
     it("bearerToken returns null after clear()", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "tok" } }), idType: "Bearer" });
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }), idType: "Bearer" });
       await stamper.clear();
 
       expect(stamper.bearerToken).toBeNull();
@@ -230,7 +236,7 @@ describe("Auth2Stamper", () => {
     it("auth2Token returns null after clear()", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "tok" } }), idType: "Bearer" });
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }), idType: "Bearer" });
       await stamper.clear();
 
       expect(stamper.auth2Token).toBeNull();
@@ -247,7 +253,7 @@ describe("Auth2Stamper", () => {
     it("signs the data with ECDSA P-256 / SHA-256", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "tok" } }), idType: "Bearer" });
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }), idType: "Bearer" });
 
       const data = Buffer.from("test message");
       await stamper.stamp({ type: "OIDC", data });
@@ -270,7 +276,8 @@ describe("Auth2Stamper", () => {
       const stamper = makeStamper();
       await stamper.init();
 
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "test-id-token" } }), idType: "Bearer" });
+      const a2tJwt = makeA2tJwt();
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: a2tJwt } }), idType: "Bearer" });
 
       const stampStr = await stamper.stamp({ type: "OIDC", data: Buffer.from("payload") });
       const decoded = JSON.parse(Buffer.from(stampStr, "base64url").toString("utf-8")) as {
@@ -283,7 +290,7 @@ describe("Auth2Stamper", () => {
       };
 
       expect(decoded.kind).toBe("OIDC");
-      expect(decoded.idToken).toBe("test-id-token");
+      expect(decoded.idToken).toBe(a2tJwt);
       expect(decoded.algorithm).toBe("Secp256r1");
       expect(decoded.salt).toBe("");
       expect(typeof decoded.publicKey).toBe("string");
@@ -293,7 +300,7 @@ describe("Auth2Stamper", () => {
     it("uses the stored public key (base64url of raw P-256 bytes) in the OIDC stamp", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "tok" } }), idType: "Bearer" });
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }), idType: "Bearer" });
 
       const stampStr = await stamper.stamp({ type: "OIDC", data: Buffer.from("data") });
       const decoded = JSON.parse(Buffer.from(stampStr, "base64url").toString("utf-8")) as {
@@ -307,7 +314,7 @@ describe("Auth2Stamper", () => {
     it("works with empty data", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "tok" } }), idType: "Bearer" });
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }), idType: "Bearer" });
       await expect(stamper.stamp({ type: "OIDC", data: Buffer.from("") })).resolves.toBeTruthy();
     });
   });
@@ -335,7 +342,7 @@ describe("Auth2Stamper", () => {
     it("clears the id token", async () => {
       const stamper = makeStamper();
       await stamper.init();
-      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: "t" } }), idType: "Bearer" });
+      await stamper.setTokens({ accessToken: makeJwt({ sub: "u", ext: { a2t: makeA2tJwt() } }), idType: "Bearer" });
 
       await stamper.resetKeyPair();
 

packages/browser-sdk/src/providers/embedded/auth2.integration.test.ts

@@ -59,12 +59,17 @@ function makeJwt(payload: Record<string, unknown>): string {
   return `${encode({ alg: "HS256" })}.${encode({ aud: [], ...payload })}.sig`;
 }
 
+function makeA2tJwt(): string {
+  const now = Math.floor(Date.now() / 1000);
+  return makeJwt({ exp: now + 3600, iat: now });
+}
+
 function mockTokenResponse(overrides: Record<string, unknown> = {}) {
   return {
     ok: true,
     json: async () =>
       Promise.resolve({
-        access_token: makeJwt({ sub: "integration-user-1" }),
+        access_token: makeJwt({ sub: "integration-user-1", ext: { a2t: makeA2tJwt() } }),
         id_token: "integration-id-token",
         token_type: "Bearer",
         expires_in: 3600,
@@ -228,7 +233,7 @@ describe("Auth2 browser flow — end-to-end", () => {
     await expect(stamper.stamp({ type: "OIDC", data: Buffer.from("test-payload") })).rejects.toThrow("not initialized");
 
     await stamper.setTokens({
-      accessToken: makeJwt({ sub: "test-user", ext: { a2t: "integration-id-token" } }),
+      accessToken: makeJwt({ sub: "test-user", ext: { a2t: makeA2tJwt() } }),
       idType: "Bearer",
     });
     const stampStr = await stamper.stamp({ type: "OIDC", data: Buffer.from("test-payload") });

packages/embedded-provider-core/jest.config.js

@@ -3,4 +3,5 @@ const sharedJestConfig = require("../../sharedJestConfig");
 module.exports = {
   ...sharedJestConfig,
   displayName: "@phantom/embedded-provider-core",
+  setupFiles: ["<rootDir>/src/test/setup.ts"],
 };