stellar-sdk 0.7.0 → 0.8.0

data/spec/lib/stellar/client_spec.rb

@@ -4,6 +4,23 @@ describe Stellar::Client do
 
   subject(:client) { Stellar::Client.default_testnet }
 
+  describe "headers" do
+    let(:headers) { client.horizon.headers }
+
+    it "has 'Accept'" do
+      expect(headers["Accept"]).
+        to eq "application/hal+json,application/problem+json,application/json"
+    end
+
+    it "has 'X-Client-Name'" do
+      expect(headers["X-Client-Name"]).to eq "ruby-stellar-sdk"
+    end
+
+    it "has 'X-Client-Version'" do
+      expect(headers["X-Client-Version"]).to eq Stellar::VERSION
+    end
+  end
+
   describe "#default_testnet" do
     it 'instantiates a client pointing to horizon testnet' do
       client = described_class.default_testnet
@@ -410,4 +427,4 @@ describe Stellar::Client do
     end
   end
 
-end
+end

data/spec/lib/stellar/sep10_spec.rb

@@ -0,0 +1,1148 @@
+require "spec_helper"
+
+describe Stellar::SEP10 do
+
+  subject(:sep10) { Stellar::SEP10 }
+
+  let(:server) { Stellar::KeyPair.random }
+  let(:user) { Stellar::KeyPair.random }
+  let(:anchor) { "SDF" }
+  let(:timeout) { 600 }
+  let(:envelope) { Stellar::TransactionEnvelope.from_xdr(subject, "base64") }
+  let(:transaction) { envelope.tx }  
+
+  subject do
+    sep10.build_challenge_tx(server: server, client: user, anchor_name: anchor, timeout: timeout) 
+  end
+  
+  describe "#build_challenge_tx" do      
+    it "generates a valid SEP10 challenge" do
+      expect(transaction.seq_num).to eql(0)
+      expect(transaction.operations.size).to eql(1);
+      expect(transaction.source_account).to eql(server.public_key);
+
+      time_bounds = transaction.time_bounds
+      expect(time_bounds.max_time - time_bounds.min_time).to eql(600)
+      operation = transaction.operations.first
+
+      expect(operation.body.arm).to eql(:manage_data_op)
+      expect(operation.body.value.data_name).to eql("SDF auth")
+      expect(operation.source_account).to eql(user.public_key)
+      data_value = operation.body.value.data_value
+      expect(data_value.bytes.size).to eql(64)
+      expect(data_value.unpack("m")[0].size).to eql(48)
+    end
+
+    describe "defaults" do
+      subject do
+        sep10.build_challenge_tx(server: server, client: user, anchor_name: anchor) 
+      end
+      
+      it "has a default timeout of 300 seconds (5 minutes)" do
+        time_bounds = transaction.time_bounds
+        expect(time_bounds.max_time - time_bounds.min_time).to eql(300)
+      end
+    end
+  end
+
+  describe "#read_challenge_tx" do
+    subject do
+      challenge = super()
+      envelope = Stellar::TransactionEnvelope.from_xdr(challenge, 'base64')
+      envelope.tx.to_envelope(server, user).to_xdr(:base64)
+    end
+    
+    it "returns the envelope and client public key if the transaction is valid" do
+      expect(sep10.read_challenge_tx(challenge_xdr: subject, server: server)).to eql([envelope, user.address])
+    end
+
+    it "returns the envelope even if transaction signed by server but not client" do
+      envelope = Stellar::TransactionEnvelope.from_xdr(subject, 'base64')
+      expected_envelope = envelope.tx.to_envelope(server)
+      expect(
+        sep10.read_challenge_tx(challenge_xdr: expected_envelope.to_xdr(:base64), server: server)
+      ).to eql(
+        [expected_envelope, user.address]
+      )
+    end
+
+    it "throws an error if there are too many operations on the transaction" do
+      envelope = Stellar::TransactionEnvelope.from_xdr(subject, 'base64')
+      envelope.tx.operations += [Stellar::Operation.bump_sequence({bump_to: 1})]
+      bad_challege = envelope.tx.to_envelope(server, user).to_xdr(:base64)
+      expect {
+        sep10.read_challenge_tx(challenge_xdr: bad_challege, server:server)
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction should contain only one operation/
+      )
+    end
+
+    it "throws an error if transaction sequence number is different to zero"  do
+      envelope.tx.seq_num = 1
+
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: envelope.to_xdr(:base64), server: server)
+      }.to raise_error(Stellar::InvalidSep10ChallengeError, /The transaction sequence number should be zero/)
+    end      
+
+    it "throws an error if transaction source account is different to server account id"  do
+      expect {
+        sep10.read_challenge_tx(challenge_xdr: envelope.to_xdr(:base64), server: Stellar::KeyPair.random)
+      }.to raise_error(Stellar::InvalidSep10ChallengeError, /The transaction source account is not equal to the server's account/)
+    end
+
+    it "throws an error if transaction doesn't contain any operation" do
+      envelope.tx.operations = []
+
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: envelope.to_xdr(:base64), server: server)
+      }.to raise_error(Stellar::InvalidSep10ChallengeError, /The transaction should contain only one operation/)
+    end
+
+    it "throws an error if operation does not contain the source account" do
+      op = envelope.tx.operations[0]
+      op.source_account = nil
+
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: envelope.to_xdr(:base64), server: server)
+      }.to raise_error(Stellar::InvalidSep10ChallengeError, /The transaction's operation should contain a source account/)
+    end
+      
+    it "throws an error if operation is not manage data"  do
+      envelope.tx.operations = [ 
+        Stellar::Operation.payment(
+          destination: Stellar::KeyPair.random, 
+          amount: [:native, 20],
+          source_account: Stellar::KeyPair.random
+        )
+      ]
+
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: envelope.to_xdr(:base64), server: server)
+      }.to raise_error(Stellar::InvalidSep10ChallengeError, /The transaction's operation should be manageData/)
+    end
+
+    it "throws an error if operation value is not a 64 bytes base64 string" do
+      transaction.operations[0].body.value.data_value = SecureRandom.random_bytes(64)
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: envelope.to_xdr(:base64), server: server)          
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction's operation value should be a 64 bytes base64 random string/
+      )
+    end
+
+    it "throws an error if transaction is not signed by the server" do
+      envelope.signatures = envelope.signatures.slice(1, 2)
+      
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: envelope.to_xdr(:base64), server: server)          
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction is not signed by the server/
+      )
+    end
+
+
+    it "throws an error if transaction does not contain valid timeBounds" do
+      envelope.tx.time_bounds = nil
+      challenge = envelope.tx.to_envelope(server, user).to_xdr(:base64)
+
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: challenge, server: server)          
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction has expired/
+      )
+
+      envelope.tx.time_bounds = Stellar::TimeBounds.new(min_time: 0, max_time: 5)
+      challenge = envelope.tx.to_envelope(server, user).to_xdr(:base64)
+
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: challenge, server: server)          
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction has expired/
+      )
+
+      now = Time.now.to_i
+      envelope.tx.time_bounds = Stellar::TimeBounds.new(
+        min_time: now + 100, 
+        max_time: now + 500
+      )
+      challenge = envelope.tx.to_envelope(server, user).to_xdr(:base64)
+
+      expect { 
+        sep10.read_challenge_tx(challenge_xdr: challenge, server: server)          
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction has expired/
+      )
+    end
+  end
+
+  describe "#verify_challenge_tx_threshold" do
+    it "raises transaction not signed by server" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      challenge_envelope.signatures = [client_kp_a, client_kp_b, client_kp_c].map { 
+        |kp| challenge_envelope.tx.sign_decorated(kp) 
+      }
+
+      signers = Set[
+        {'key' => client_kp_a.address, 'weight': 1},
+        {'key' => client_kp_b.address, 'weight': 1},
+        {'key' => client_kp_c.address, 'weight': 1}
+      ]
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge_envelope.to_xdr(:base64), 
+          server: server_kp, 
+          signers: signers,
+          threshold: 3
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction is not signed by the server/
+      )
+    end
+
+    it "succeeds with extra signers passed" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp_a,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [
+        challenge_envelope.tx.sign_decorated(client_kp_a),
+        challenge_envelope.tx.sign_decorated(client_kp_b)
+      ]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect(
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            {'key' => client_kp_a.address, 'weight' => 1},
+            {'key' => client_kp_b.address, 'weight' => 1},
+            {'key' => client_kp_c.address, 'weight' => 1}
+          ],
+          threshold: 2
+        )
+      ).to eql(
+        Set[
+          {'key' => client_kp_a.address, 'weight' => 1},
+          {'key' => client_kp_b.address, 'weight' => 1}
+        ]
+      )
+    end
+
+    it "rasies an error for unrecognizied signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp_a,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [
+        challenge_envelope.tx.sign_decorated(client_kp_a),
+        challenge_envelope.tx.sign_decorated(client_kp_b),
+        challenge_envelope.tx.sign_decorated(client_kp_c)
+      ]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            {'key' => client_kp_a.address, 'weight' => 1},
+            {'key' => client_kp_b.address, 'weight' => 1},
+          ],
+          threshold: 2
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /Transaction has unrecognized signatures./
+      )
+    end
+
+    it "verifies proper challenge and threshold" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      transaction = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      transaction.signatures += [
+        client_kp_a, client_kp_b, client_kp_c
+      ].map { |kp| transaction.tx.sign_decorated(kp) }
+      challenge_tx = transaction.to_xdr(:base64)
+
+      signers = Set[
+        {"key" => client_kp_a.address, "weight" => 1},
+        {"key" => client_kp_b.address, "weight" => 2},
+        {"key" => client_kp_c.address, "weight" => 4},
+      ]
+
+      signers_found = sep10.verify_challenge_tx_threshold(
+        challenge_xdr: challenge_tx,
+        server: server_kp,
+        threshold: 7,
+        signers: signers,
+      )
+      expect(signers_found).to eql(signers)
+    end
+
+    it "raises error when signers don't meet threshold" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      transaction = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      transaction.signatures.push(transaction.tx.sign_decorated(client_kp_a))
+      challenge_tx = transaction.to_xdr(:base64)
+
+      signers = Set[
+        {"key" => client_kp_a.address, "weight" => 1},
+        {"key" => client_kp_b.address, "weight" => 2},
+        {"key" => client_kp_c.address, "weight" => 4},
+      ]
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge_tx,
+          server: server_kp,
+          threshold: 7,
+          signers: signers,
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        "signers with weight %d do not meet threshold %d." % [1, 7]
+      )
+    end
+
+    it "ignores non-G address" do
+      preauth_tx_hash = "TAQCSRX2RIDJNHFIFHWD63X7D7D6TRT5Y2S6E3TEMXTG5W3OECHZ2OG4"
+      x_hash = "XDRPF6NZRR7EEVO7ESIWUDXHAOMM2QSKIQQBJK6I2FB7YKDZES5UCLWD"
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [challenge_envelope.tx.sign_decorated(client_kp)]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect(
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            {'key'=> client_kp.address, 'weight' => 1},
+            {'key'=> preauth_tx_hash, 'weight' => 1},
+            {'key'=> x_hash, 'weight' => 1}
+          ],
+          threshold: 1
+        )
+      ).to eql(
+        Set[
+          {'key' => client_kp.address, 'weight' => 1}
+        ]
+      )
+    end
+
+    it "raises no signers error" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      challenge_envelope.signatures += [
+        client_kp_a, client_kp_b, client_kp_c
+      ].map { |kp| challenge_envelope.tx.sign_decorated(kp) }
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge_envelope.to_xdr(:base64), 
+          server: server_kp, 
+          signers: Set.new,
+          threshold: 2
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /No signers provided./
+      )
+    end
+
+    it "raises an error for no signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures.clear
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            {'key' => client_kp.address, 'weight' => 1}
+          ],
+          threshold: 2
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction is not signed by the server/
+      )
+    end
+
+    it "does not pass back duplicate signers or double-count weights" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [challenge_envelope.tx.sign_decorated(client_kp)]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect(
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            {'key' => client_kp.address, 'weight' => 1},
+            {'key' => client_kp.address, 'weight' => 2}
+          ],
+          threshold: 1
+        )
+      ).to eql(
+        Set[{'key' => client_kp.address, 'weight' => 1}]
+      )
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            {'key' => client_kp.address, 'weight' => 1},
+            {'key' => client_kp.address, 'weight' => 2}
+          ],
+          threshold: 3
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /signers with weight 1 do not meet threshold 3./
+      )
+    end
+
+    it "raises an error for duplicate signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [
+        challenge_envelope.tx.sign_decorated(client_kp),
+        challenge_envelope.tx.sign_decorated(client_kp)
+      ]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[{'key' => client_kp.address, 'weight' => 1}],
+          threshold: 1
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /Transaction has unrecognized signatures./
+      )
+    end
+
+    it "raises an error for duplicate signatures and signers" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [
+        challenge_envelope.tx.sign_decorated(client_kp),
+        challenge_envelope.tx.sign_decorated(client_kp)
+      ]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect {
+        sep10.verify_challenge_tx_threshold(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            {'key' => client_kp.address, 'weight' => 1},
+            {'key' => client_kp.address, 'weight' => 2}
+          ],
+          threshold: 1
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /Transaction has unrecognized signatures./
+      )
+    end
+  end
+
+  describe "#verify_challenge_tx" do
+    it "verifies proper challenge transaction" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      envelope.signatures.push(envelope.tx.sign_decorated(client_kp))
+      challenge_tx = envelope.to_xdr(:base64)
+
+      sep10.verify_challenge_tx(
+        challenge_xdr: challenge_tx, 
+        server: server_kp
+      )
+    end
+
+    it "raises not signed by client" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      expect {
+        sep10.verify_challenge_tx(
+          challenge_xdr: challenge, 
+          server: server_kp
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        "Transaction not signed by client: %s" % [client_kp.address]
+      )
+    end
+  end
+
+  describe "#verify_challenge_tx_signers" do
+    it "returns expected signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      challenge_envelope.signatures += [
+        client_kp_a, client_kp_b, client_kp_c
+      ].map { |kp| challenge_envelope.tx.sign_decorated(kp) }
+
+      signers = Set[
+        client_kp_a.address,
+        client_kp_b.address,
+        client_kp_c.address,
+        Stellar::KeyPair.random.address
+      ]
+      signers_found = sep10.verify_challenge_tx_signers(
+        challenge_xdr: challenge_envelope.to_xdr(:base64), 
+        server: server_kp, 
+        signers: signers
+      )
+      expect(signers_found).to eql(Set[
+        client_kp_a.address,
+        client_kp_b.address,
+        client_kp_c.address,
+      ])
+    end
+
+    it "raises no signers error" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      challenge_envelope.signatures += [
+        client_kp_a, client_kp_b, client_kp_c
+      ].map { |kp| challenge_envelope.tx.sign_decorated(kp) }
+
+      expect {
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge_envelope.to_xdr(:base64), 
+          server: server_kp, 
+          signers: Set.new
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /No signers provided./
+      )
+    end
+
+    it "raises transaction not signed by server" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      challenge_envelope.signatures = [client_kp_a, client_kp_b, client_kp_c].map { 
+        |kp| challenge_envelope.tx.sign_decorated(kp) 
+      }
+
+      signers = Set[
+        client_kp_a.address,
+        client_kp_b.address,
+        client_kp_c.address
+      ]
+
+      expect {
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge_envelope.to_xdr(:base64), 
+          server: server_kp, 
+          signers: signers
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction is not signed by the server/
+      )
+    end
+
+    it "raises no client signers found" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      challenge_envelope.signatures += [
+        client_kp_a, client_kp_b, client_kp_c
+      ].map { |kp| challenge_envelope.tx.sign_decorated(kp) }
+
+      # Different signers than those on the transaction envelope
+      signers = Set[
+        Stellar::KeyPair.random.address,
+        Stellar::KeyPair.random.address,
+        Stellar::KeyPair.random.address
+      ]
+
+      expect {
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge_envelope.to_xdr(:base64), 
+          server: server_kp, 
+          signers: signers
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /Transaction not signed by any client signer./
+      )
+    end
+
+    it "raises unrecognized signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout,
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+      # Add random signature
+      challenge_envelope.signatures += [
+        client_kp_a, client_kp_b, client_kp_c, Stellar::KeyPair.random
+      ].map { |kp| challenge_envelope.tx.sign_decorated(kp) }
+
+      signers = Set[
+        client_kp_a.address,
+        client_kp_b.address,
+        client_kp_c.address
+      ]
+
+      expect {
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge_envelope.to_xdr(:base64), 
+          server: server_kp, 
+          signers: signers
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /Transaction has unrecognized signatures./
+      )
+    end
+
+    it "raises an error when transaction only has server signature" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp,
+        anchor_name: "SDF",
+        timeout: 600,
+      ) 
+
+      expect { 
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge, 
+          server: server_kp,
+          signers: Set[server_kp.address]
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /At least one signer with a G... address must be provied/
+      )
+    end
+
+    it "succeeds even when the server is included in the passed signers" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [challenge_envelope.tx.sign_decorated(client_kp)]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect(
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[server_kp.address, client_kp.address]
+        )
+      ).to eql(
+        Set[client_kp.address]
+      )
+    end
+
+    it "succeeds with extra signers passed" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp_a,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [
+        challenge_envelope.tx.sign_decorated(client_kp_a),
+        challenge_envelope.tx.sign_decorated(client_kp_b)
+      ]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect(
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[
+            client_kp_a.address,
+            client_kp_b.address,
+            client_kp_c.address
+          ]
+        )
+      ).to eql(
+        Set[client_kp_a.address, client_kp_b.address]
+      )
+    end
+
+    it "does not pass back duplicate signers" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [challenge_envelope.tx.sign_decorated(client_kp)]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect(
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[client_kp.address, client_kp.address]
+        )
+      ).to eql(
+        Set[client_kp.address]
+      )
+    end
+
+    it "raises an error for duplicate signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [
+        challenge_envelope.tx.sign_decorated(client_kp),
+        challenge_envelope.tx.sign_decorated(client_kp)
+      ]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect {
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[server_kp.address, client_kp.address]
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /Transaction has unrecognized signatures./
+      )
+    end
+
+    it "ignores non-G address" do
+      preauth_tx_hash = "TAQCSRX2RIDJNHFIFHWD63X7D7D6TRT5Y2S6E3TEMXTG5W3OECHZ2OG4"
+      x_hash = "XDRPF6NZRR7EEVO7ESIWUDXHAOMM2QSKIQQBJK6I2FB7YKDZES5UCLWD"
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures += [challenge_envelope.tx.sign_decorated(client_kp)]
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect(
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[client_kp.address, preauth_tx_hash, x_hash]
+        )
+      ).to eql(
+        Set[client_kp.address]
+      )
+    end
+
+    it "raises an error for no signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(
+        sep10.build_challenge_tx(
+          server: server_kp,
+          client: client_kp,
+          anchor_name: "SDF",
+          timeout: 600,
+        ), 
+        "base64"
+      )
+      challenge_envelope.signatures.clear
+      challenge = challenge_envelope.to_xdr(:base64)
+
+      expect {
+        sep10.verify_challenge_tx_signers(
+          challenge_xdr: challenge,
+          server: server_kp,
+          signers: Set[client_kp.address]
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /The transaction is not signed by the server/
+      )
+    end
+  end
+
+  describe "#verify_tx_signatures" do
+    it "returns expected signatures" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      client_kp_b = Stellar::KeyPair.random
+      client_kp_c = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+
+      challenge_envelope.signatures += [
+        client_kp_a, client_kp_b, client_kp_c
+      ].map { |kp| challenge_envelope.tx.sign_decorated(kp) }
+
+      signers = Set[
+        client_kp_a.address,
+        client_kp_b.address,
+        client_kp_c.address,
+        Stellar::KeyPair.random.address
+      ]
+      signers_found = sep10.verify_tx_signatures(
+        tx_envelope: challenge_envelope, signers: signers
+      )
+      expect(signers_found).to eql(Set[
+        client_kp_a.address,
+        client_kp_b.address,
+        client_kp_c.address
+      ])
+    end
+
+    it "raises no signature error" do
+      server_kp = Stellar::KeyPair.random
+      client_kp = Stellar::KeyPair.random
+      value = SecureRandom.base64(48)
+            
+      tx = Stellar::Transaction.manage_data({
+        account: server_kp,
+        sequence:  0,
+        name: "SDF auth", 
+        value: value,
+        source_account: client_kp
+      })
+
+      now = Time.now.to_i
+      tx.time_bounds = Stellar::TimeBounds.new(
+        min_time: now, 
+        max_time: now + timeout
+      )
+
+      signers = Set[client_kp.address]
+      expect{
+        sep10.verify_tx_signatures(
+          tx_envelope: tx.to_envelope(), signers: signers
+        )
+      }.to raise_error(
+        Stellar::InvalidSep10ChallengeError,
+        /Transaction has no signatures./
+      )
+    end
+
+    it "removes duplicate signers" do
+      server_kp = Stellar::KeyPair.random
+      client_kp_a = Stellar::KeyPair.random
+      timeout = 600
+      anchor_name = "SDF"
+
+      challenge = sep10.build_challenge_tx(
+        server: server_kp,
+        client: client_kp_a,
+        anchor_name: anchor_name,
+        timeout: timeout
+      )
+
+      challenge_envelope = Stellar::TransactionEnvelope.from_xdr(challenge, "base64")
+
+      # Sign the transaction with the same keypair twice
+      challenge_envelope.signatures += [
+        client_kp_a, client_kp_a
+      ].map { |kp| challenge_envelope.tx.sign_decorated(kp) }
+
+      signers = Set[
+        client_kp_a.address,
+        client_kp_a.address,
+        Stellar::KeyPair.random.address
+      ]
+      signers_found = sep10.verify_tx_signatures(
+        tx_envelope: challenge_envelope, signers: signers
+      )
+      expect(signers_found).to eql(Set[client_kp_a.address])
+    end
+  end
+
+  describe "#verify_tx_signed_by" do
+    let(:keypair) { Stellar::KeyPair.random }
+    let(:envelope) do
+      Stellar::Transaction.bump_sequence(account: keypair, bump_to: 1000, sequence: 0).to_envelope(keypair)
+    end
+    
+    it "returns true if transaction envelope is signed by keypair" do
+      result = sep10.verify_tx_signed_by(tx_envelope: envelope, keypair: keypair)
+      expect(result).to eql(true)
+    end
+    
+    it "returns false if transaction envelope is not signed by keypair" do
+      result = sep10.verify_tx_signed_by(
+        tx_envelope: envelope, 
+        keypair: Stellar::KeyPair.random
+      )
+      expect(result).to eql(false)
+    end
+  end
+end