feat: validate bridge_url

packages/core/src/bridge.ts

@@ -3,6 +3,7 @@ import { type IDKitConfig } from '@/types/config'
 import { VerificationState } from '@/types/bridge'
 import type { ISuccessResult } from '@/types/result'
 import type { CredentialType } from '@/types/config'
+import { validate_bridge_url } from './lib/validation'
 import { encodeAction, generateSignal } from '@/lib/hashing'
 import { AppErrorCodes, ResponseStatus } from '@/types/bridge'
 import { decryptResponse, encryptRequest, exportKey, generateKey } from '@/lib/crypto'
@@ -58,7 +59,16 @@ export const useWorldBridgeStore = create<WorldBridgeStore>((set, get) => ({
 	createClient: async ({ bridge_url, app_id, verification_level, action_description, action, signal }) => {
 		const { key, iv } = await generateKey()
 
-		const res = await fetch(`${bridge_url ?? DEFAULT_BRIDGE_URL}/request`, {
+		if (bridge_url) {
+			const validation = validate_bridge_url(bridge_url)
+			if (!validation.valid) {
+				console.error(validation.errors.join('\n'))
+				set({ verificationState: VerificationState.Failed })
+				throw new Error('Invalid bridge_url. Please check the console for more details.')
+			}
+		}
+
+		const res = await fetch(new URL('/request', bridge_url ?? DEFAULT_BRIDGE_URL), {
 			method: 'POST',
 			headers: { 'Content-Type': 'application/json' },
 			body: JSON.stringify(
@@ -102,7 +112,7 @@ export const useWorldBridgeStore = create<WorldBridgeStore>((set, get) => ({
 		const key = get().key
 		if (!key) throw new Error('No keypair found. Please call `createClient` first.')
 
-		const res = await fetch(`${get().bridge_url}/response/${get().requestId}`)
+		const res = await fetch(new URL(`/response/${get().requestId}`, get().bridge_url))
 
 		if (!res.ok) {
 			return set({

packages/core/src/lib/validation.ts

@@ -0,0 +1,41 @@
+export type ValidationResponse = { valid: true } | { valid: false; errors: string[] }
+
+export function validate_bridge_url(bridge_url: string): ValidationResponse {
+	try {
+		new URL(bridge_url)
+	} catch (e) {
+		return { valid: false, errors: ['Failed to parse Bridge URL.'] }
+	}
+
+	const test_url = new URL(bridge_url)
+	const errors: string[] = []
+
+	if (test_url.protocol !== 'https:') {
+		errors.push('Bridge URL must use HTTPS.')
+	}
+	if (test_url.port) {
+		errors.push('Bridge URL must use the default port (443).')
+	}
+	if (test_url.pathname !== '/') {
+		errors.push('Bridge URL must not have a path.')
+	}
+	if (test_url.search) {
+		errors.push('Bridge URL must not have query parameters.')
+	}
+	if (test_url.hash) {
+		errors.push('Bridge URL must not have a fragment.')
+	}
+
+	// remove once restriction lifted in world app
+	if (!test_url.hostname.endsWith('worldcoin.org') && !test_url.hostname.endsWith('toolsforhumanity.com')) {
+		console.warn(
+			"Bridge URL should be a subdomain of worldcoin.org or toolsforhumanity.com. The user's identity wallet may refuse to connect. This is a temporary restriction and will be removed in the future."
+		)
+	}
+
+	if (errors.length) {
+		return { valid: false, errors }
+	}
+
+	return { valid: true }
+}