diff --git a/.changeset/lovely-mangos-itch.md b/.changeset/lovely-mangos-itch.md new file mode 100644 index 0000000..a7fa4c1 --- /dev/null +++ b/.changeset/lovely-mangos-itch.md @@ -0,0 +1,5 @@ +--- +"@farcaster/auth-relay": patch +--- + +drop SIWE params in constructUrl diff --git a/apps/relay/src/handlers.ts b/apps/relay/src/handlers.ts index 0647130..1426167 100644 --- a/apps/relay/src/handlers.ts +++ b/apps/relay/src/handlers.ts @@ -46,8 +46,8 @@ export type RelaySession = { metadata: SessionMetadata; }; -const constructUrl = (channelToken: string, nonce: string, extraParams: CreateChannelRequest): string => { - const params = { channelToken, nonce, ...extraParams }; +const constructUrl = (channelToken: string): string => { + const params = { channelToken }; const query = new URLSearchParams(params); return `${URL_BASE}?${query.toString()}`; }; @@ -57,7 +57,7 @@ export async function createChannel(request: FastifyRequest<{ Body: CreateChanne if (channel.isOk()) { const channelToken = channel.value; const nonce = request.body.nonce ?? generateNonce(); - const url = constructUrl(channelToken, nonce, request.body); + const url = constructUrl(channelToken); const update = await request.channels.update(channelToken, { state: "pending", diff --git a/apps/relay/src/server.test.ts b/apps/relay/src/server.test.ts index 662c275..4a29528 100644 --- a/apps/relay/src/server.test.ts +++ b/apps/relay/src/server.test.ts @@ -86,7 +86,7 @@ describe("relay server", () => { const expirationTime = "2023-12-31T00:00:00Z"; const requestId = "some-request-id"; const redirectUrl = "http://some-redirect-url"; - const response = await http.post(getFullUrl("/v1/channel"), { + let response = await http.post(getFullUrl("/v1/channel"), { ...channelParams, nonce: customNonce, notBefore, @@ -99,17 +99,25 @@ describe("relay server", () => { const { channelToken, url, connectUri, nonce, ...rest } = response.data; // parse query params from URI const params = new URLSearchParams(url.split("?")[1]); - expect(params.get("siweUri")).toBe(channelParams.siweUri); - expect(params.get("domain")).toBe(channelParams.domain); - expect(params.get("nonce")).toBe(customNonce); - expect(params.get("notBefore")).toBe(notBefore); - expect(params.get("expirationTime")).toBe(expirationTime); - expect(params.get("requestId")).toBe(requestId); - expect(params.get("redirectUrl")).toBe(redirectUrl); + expect(params.get("channelToken")).toBe(channelToken); expect(channelToken).toMatch(/[2-9A-HJ-NP-Z]{8}/); expect(nonce).toBe(customNonce); expect(url).toBe(connectUri); expect(rest).toStrictEqual({}); + + response = await http.get(getFullUrl("/v1/channel/status"), { + headers: { Authorization: `Bearer ${channelToken}` }, + }); + + const siweParams = response.data.signatureParams; + + expect(siweParams.siweUri).toBe(channelParams.siweUri); + expect(siweParams.domain).toBe(channelParams.domain); + expect(siweParams.nonce).toBe(customNonce); + expect(siweParams.notBefore).toBe(notBefore); + expect(siweParams.expirationTime).toBe(expirationTime); + expect(siweParams.requestId).toBe(requestId); + expect(siweParams.redirectUrl).toBe(redirectUrl); }); test("validates extra SIWE parameters", async () => { diff --git a/test/client/src/e2e.test.ts b/test/client/src/e2e.test.ts index c5df01e..6ab3e67 100644 --- a/test/client/src/e2e.test.ts +++ b/test/client/src/e2e.test.ts @@ -61,29 +61,36 @@ describe("clients", () => { // 3. Auth client generates a sign in message - // 3a. Parse connect URI to get channel token and SIWE message params - const { channelToken: token, params } = walletClient.parseSignInURI({ + // 3a. Parse connect URI to get channel token + const { channelToken: token } = walletClient.parseSignInURI({ uri: url, }); expect(token).toBe(channelToken); - expect(params.uri).toBe("https://example.com"); + // 3b. Get signature params from channel + const { + data: { signatureParams: params }, + } = await appClient.status({ channelToken }); + + expect(params.siweUri).toBe("https://example.com"); expect(params.domain).toBe("example.com"); expect(params.nonce).toBe("abcd1234"); - // 3b. Build sign in message + const messageParams = { ...params, uri: params.siweUri }; + + // 3c. Build sign in message const { message: messageString } = walletClient.buildSignInMessage({ - ...params, + ...messageParams, address: account.address, fid: 1, }); - // 3c. Collect user signature + // 3d. Collect user signature const sig = await account.signMessage({ message: messageString, }); - // 3d. Look up userData + // 3e. Look up userData const userData = { fid: 1, username: "alice", @@ -92,7 +99,7 @@ describe("clients", () => { pfpUrl: "https://example.com/alice.png", }; - // 3e. Send back signed message + // 3f. Send back signed message const { response: authResponse } = await walletClient.authenticate({ channelToken, authKey: "farcaster-connect-auth-key",