f27345e0ba
**Motivations:** - Documenter le reste à faire (userwallet, service-login-verify, api-relay, website-skeleton) - Renforcer la validation côté api-relay et service-login-verify - Ajouter écrans diagnostic et sync service, service notifications relais, contrat par défaut **Root causes:** - N/A (évolutions + correctifs ciblés) **Correctifs:** - api-relay: GET /:hash (keys, messages, signatures) rejette hash vide → 400 - service-login-verify: validation structure preuve (challenge.hash, nonce, timestamp, signatures), reason invalid_proof_structure **Evolutions:** - RESTE_A_FAIRE.md: vue d’ensemble et tâches par projet - UserWallet: DiagnosticScreen, ServiceSyncScreen, relayNotificationService (hash events, fetch, decrypt, graph), defaultContract, loginStateMachine, useChannel, loginPublish, LoginScreen, LoginCollectShare - website-skeleton: README étendu **Pages affectées:** - RESTE_A_FAIRE.md - api-relay: keys, messages, signatures - service-login-verify: types, verifyLoginProof - userwallet: App, DiagnosticScreen, LoginCollectShare, LoginScreen, ServiceSyncScreen, useChannel, loginStateMachine, relayNotificationService, defaultContract, loginPublish - website-skeleton: README
service-login-verify
Verify login proof and anti-replay policy for services that embed UserWallet in an iframe.
Purpose
The service is the parent application that embeds UserWallet. It receives login-proof via postMessage and must verify the proof before accepting a session, without a central server. This package provides:
verifyLoginProof(proof, context)– full verification (crypto, allowed pubkeys, timestamp window, nonce anti-replay)NonceCache– in-memory anti-replay cache (TTL configurable)buildAllowedPubkeysFromValidateurs(validateurs)– build allowed pubkeys from action login validators (cle_publiqueonly)
Usage
See features/service-login-verify.md for explanation and usage example.
Install
From the repo root:
cd service-login-verify && npm install && npm run build
Consuming apps can add a workspace dependency or link to ../service-login-verify.
References
features/service-login-verify.mdfeatures/userwallet-contrat-login-reste-a-faire.md(§ 3.7)