497bcf0819
**Motivations:** - website-skeleton needs a real service contract with valid UUIDs and validators - Service wallet required for production use with configurable public key - Iframe styling needs improvement to remove scrollbars and match UserWallet theme **Root causes:** - DEFAULT_VALIDATEURS used placeholder public key that cannot verify signatures - No service wallet generation script for production deployment - Iframe had fixed height causing scrollbars and visual mismatch with dark theme **Correctifs:** - Created real service contract in src/serviceContract.ts with dedicated UUIDs (skeleton-service-uuid-4nkweb-2026) - Added service wallet generation script (generate-service-wallet.mjs) with .env and .env.private files - Improved iframe container styling: increased height (800px), dark background (#1a1a1a), better shadows, hidden scrollbars - Added .env.private to .gitignore for security **Evolutions:** - Service contract automatically loaded on startup and sent to UserWallet iframe - Public key configurable via VITE_SKELETON_SERVICE_PUBLIC_KEY environment variable - Added npm script 'generate-wallet' for easy wallet generation - Enhanced iframe visual integration with UserWallet dark theme **Pages affectées:** - website-skeleton/src/serviceContract.ts (new) - website-skeleton/src/config.ts - website-skeleton/src/main.ts - website-skeleton/generate-service-wallet.mjs (new) - website-skeleton/index.html - website-skeleton/package.json - website-skeleton/.gitignore - website-skeleton/.env (new) - website-skeleton/.env.private (new)
service-login-verify
Verify login proof and anti-replay policy for services that embed UserWallet in an iframe.
Purpose
The service is the parent application that embeds UserWallet. It receives login-proof via postMessage and must verify the proof before accepting a session, without a central server. This package provides:
verifyLoginProof(proof, context)– full verification (crypto, allowed pubkeys, timestamp window, nonce anti-replay)NonceCache– in-memory anti-replay cache (TTL configurable)buildAllowedPubkeysFromValidateurs(validateurs)– build allowed pubkeys from action login validators (cle_publiqueonly)
Usage
See features/service-login-verify.md for explanation and usage example.
Install
From the repo root:
cd service-login-verify && npm install && npm run build
Consuming apps can add a workspace dependency or link to ../service-login-verify.
References
features/service-login-verify.mdfeatures/userwallet-contrat-login-reste-a-faire.md(§ 3.7)