zorin-authority-sdk-ts

Browser/local-broker client plus a ZAUTH/1 verifier.

The browser asks the loopback Zorin Authority broker for an exact project + origin + server challenge + action + resource approval. The phone shows the transaction in Requests and returns an explicit ZOWNER/1 proof. The resulting assertion embeds that proof.

import { authorize, verifyAssertion } from '@zorin/authority';

const result = await authorize({
  projectId: 'admin.example',
  origin: 'https://admin.example.com',
  challenge: challengeFromYourBackend,
  action: 'server.restart',
  resource: 'vps:prod-01',
  message: 'Restart production web server'
});

if (result.status !== 'approved') throw new Error(result.error ?? 'Denied');

For production trust decisions, verification belongs on the backend. verifyAssertion() checks the local broker signature and the nested phone ZOWNER/1 signature, transaction scope, timings and expected fields. Supply the phone public key already enrolled for that account; never accept a self-selected key from the assertion as a new identity.

This v0.1 SDK targets the local broker MVP. Account enrollment, remote/push transport, RP-specific phone credentials and recovery are not automated yet.

Source · MIT