@aptos-labs/ts-sdk 1.12.2 → 1.13.0-zeta.1

package/src/{core/account → account}/Account.ts

@@ -1,10 +1,11 @@
-import type { AccountAuthenticator } from "../../transactions/authenticator/account";
-import { HexInput, SigningScheme, SigningSchemeInput } from "../../types";
-import type { AccountAddress, AccountAddressInput } from "../accountAddress";
-import { AuthenticationKey } from "../authenticationKey";
-import { AccountPublicKey, Ed25519PrivateKey, PrivateKey, Signature, VerifySignatureArgs } from "../crypto";
+import type { AccountAuthenticator } from "../transactions/authenticator/account";
+import { HexInput, SigningScheme, SigningSchemeInput } from "../types";
+import type { AccountAddress, AccountAddressInput } from "../core/accountAddress";
+import { AuthenticationKey } from "../core/authenticationKey";
+import { AccountPublicKey, Ed25519PrivateKey, PrivateKey, Signature, VerifySignatureArgs } from "../core/crypto";
 import { Ed25519Account } from "./Ed25519Account";
 import { SingleKeyAccount } from "./SingleKeyAccount";
+import { AnyRawTransaction } from "../transactions/types";
 
 /**
  * Arguments for creating an `Ed25519Account` from an `Ed25519PrivateKey`.
@@ -106,13 +107,6 @@ export interface PrivateKeyFromDerivationPathArgs {
  * Note: Generating an account instance does not create the account on-chain.
  */
 export abstract class Account {
-  /**
-   * Private key associated with the account.
-   * Note: this will be removed in the next major release,
-   *  as not all accounts have a private key.
-   */
-  abstract readonly privateKey: PrivateKey;
-
   /**
    * Public key associated with the account
    */
@@ -222,11 +216,11 @@ export abstract class Account {
   }
 
   /**
-   * Sign a message using the available signing capabilities.
-   * @param message the signing message, as binary input
-   * @return the AccountAuthenticator containing the signature, together with the account's public key
+   * Sign a transaction using the available signing capabilities.
+   * @param transaction the raw transaction
+   * @return the AccountAuthenticator containing the signature og the transaction, together with the account's public key
    */
-  abstract signWithAuthenticator(message: HexInput): AccountAuthenticator;
+  abstract signWithAuthenticator(transaction: AnyRawTransaction): AccountAuthenticator;
 
   /**
    * Sign the given message with the private key.
@@ -235,6 +229,8 @@ export abstract class Account {
    */
   abstract sign(message: HexInput): Signature;
 
+  abstract signTransaction(transaction: AnyRawTransaction): Signature;
+
   /**
    * @param args.message raw message data in HexInput format
    * @param args.signature signed message signature

package/src/{core/account → account}/Ed25519Account.ts

@@ -1,8 +1,10 @@
-import { AccountAuthenticatorEd25519 } from "../../transactions/authenticator/account";
-import { HexInput, SigningScheme } from "../../types";
-import { AccountAddress, AccountAddressInput } from "../accountAddress";
-import { Ed25519PrivateKey, Ed25519PublicKey, Ed25519Signature } from "../crypto";
+import { AccountAuthenticatorEd25519 } from "../transactions/authenticator/account";
+import { HexInput, SigningScheme } from "../types";
+import { AccountAddress, AccountAddressInput } from "../core/accountAddress";
+import { Ed25519PrivateKey, Ed25519PublicKey, Ed25519Signature } from "../core/crypto";
 import type { Account } from "./Account";
+import { AnyRawTransaction } from "../transactions/types";
+import { generateSigningMessageForTransaction } from "../transactions/transactionBuilder/signingMessage";
 
 export interface Ed25519SignerConstructorArgs {
   privateKey: Ed25519PrivateKey;
@@ -75,13 +77,17 @@ export class Ed25519Account implements Account {
     return this.publicKey.verifySignature(args);
   }
 
-  signWithAuthenticator(message: HexInput) {
-    const signature = this.privateKey.sign(message);
+  signWithAuthenticator(transaction: AnyRawTransaction) {
+    const signature = this.privateKey.sign(generateSigningMessageForTransaction(transaction));
     return new AccountAuthenticatorEd25519(this.publicKey, signature);
   }
 
   sign(message: HexInput) {
-    return this.signWithAuthenticator(message).signature;
+    return this.privateKey.sign(message);
+  }
+
+  signTransaction(transaction: AnyRawTransaction) {
+    return this.sign(generateSigningMessageForTransaction(transaction))
   }
 
   // endregion

package/src/account/EphemeralKeyPair.ts

@@ -0,0 +1,78 @@
+// Copyright © Aptos Foundation
+// SPDX-License-Identifier: Apache-2.0
+
+import { randomBytes } from "@noble/hashes/utils";
+
+
+import { EPK_HORIZON_SECS, Ed25519PrivateKey, EphemeralPublicKey, EphemeralSignature, PrivateKey} from "../core/crypto";
+import { Hex } from "../core/hex";
+import { bytesToBigIntLE, padAndPackBytesWithLen, poseidonHash } from "../core/crypto/poseidon";
+import { HexInput, SigningSchemeInput } from "../types";
+
+export class EphemeralKeyPair {
+  readonly blinder: Uint8Array;
+
+  readonly expiryDateSecs: bigint;
+
+  readonly nonce: string;
+
+  readonly privateKey: PrivateKey;
+
+  readonly publicKey: EphemeralPublicKey;
+
+  constructor(args: { privateKey: PrivateKey; expiryDateSecs?: bigint; blinder?: HexInput }) {
+    const { privateKey, expiryDateSecs, blinder } = args;
+    this.privateKey = privateKey;
+    this.publicKey = new EphemeralPublicKey(privateKey.publicKey());
+    this.expiryDateSecs = expiryDateSecs || BigInt(floorToWholeHour(currentTimeInSeconds() + EPK_HORIZON_SECS));
+    this.blinder = blinder !== undefined ? Hex.fromHexInput(blinder).toUint8Array() : generateBlinder();
+    this.nonce = this.generateNonce();
+  }
+
+  static generate(args?: {scheme: SigningSchemeInput}): EphemeralKeyPair {
+    let privateKey: PrivateKey;
+
+    switch (args?.scheme) {
+      case SigningSchemeInput.Ed25519:
+      default:
+        privateKey = Ed25519PrivateKey.generate();
+    }
+
+    return new EphemeralKeyPair({ privateKey });
+  }
+
+  generateNonce(): string {
+    const fields = padAndPackBytesWithLen(this.publicKey.bcsToBytes(), 93);
+    fields.push(BigInt(this.expiryDateSecs))
+    fields.push(bytesToBigIntLE(this.blinder))
+    const nonceHash = poseidonHash(fields);
+    return nonceHash.toString();
+  }
+
+  /**
+   * Sign the given message with the private key.
+   *   *
+   * @param data in HexInput format
+   * @returns EphemeralSignature
+   */
+  sign(data: HexInput): EphemeralSignature {
+    return new EphemeralSignature(this.privateKey.sign(data));
+  }
+}
+
+function generateBlinder(): Uint8Array {
+  return randomBytes(31);
+}
+
+function currentTimeInSeconds(): number {
+  return Math.floor(new Date().getTime() / 1000)
+}
+
+function floorToWholeHour(timestampInSeconds: number): number {
+  const date = new Date(timestampInSeconds * 1000);
+  // Reset minutes and seconds to zero
+  date.setMinutes(0);
+  date.setSeconds(0);
+  date.setMilliseconds(0);
+  return Math.floor(date.getTime() / 1000);
+}

package/src/account/KeylessAccount.ts

@@ -0,0 +1,230 @@
+// Copyright © Aptos Foundation
+// SPDX-License-Identifier: Apache-2.0
+
+import { JwtPayload, jwtDecode } from "jwt-decode";
+import { decode } from "base-64";
+import { HexInput, SigningScheme } from "../types";
+import { AccountAddress } from "../core/accountAddress";
+import {
+  AnyPublicKey,
+  AnySignature,
+  KeylessPublicKey,
+  KeylessSignature,
+  OpenIdSignature,
+  OpenIdSignatureOrZkProof,
+  Signature,
+  SignedGroth16Signature,
+  computeAddressSeed,
+  fromDerivationPath as fromDerivationPathInner,
+} from "../core/crypto";
+
+import { Account } from "./Account";
+import { EphemeralKeyPair } from "./EphemeralKeyPair";
+import { Hex } from "../core/hex";
+import { AccountAuthenticatorSingleKey } from "../transactions/authenticator/account";
+import { Serializer } from "../bcs";
+import { deriveTransactionType, generateSigningMessage } from "../transactions/transactionBuilder/signingMessage";
+import { AnyRawTransaction } from "../transactions/types";
+
+function base64UrlDecode(base64Url: string): string {
+  // Replace base64url-specific characters
+  const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
+
+  // Pad the string with '=' characters if needed
+  const paddedBase64 = base64 + "==".substring(0, (3 - (base64.length % 3)) % 3);
+
+  // Decode the base64 string using the base-64 library
+  const decodedString = decode(paddedBase64);
+
+  return decodedString;
+}
+
+export class KeylessAccount implements Account {
+  static readonly PEPPER_LENGTH: number = 31;
+
+  static readonly SLIP_0010_SEED: string = "32 bytes";
+
+  static readonly APTOS_CONNECT_CLIENT_ID: string =
+    "734998116548-ib6ircv72o1b6l0no9ol4spnnkr8gm69.apps.googleusercontent.com";
+
+  publicKey: KeylessPublicKey;
+
+  ephemeralKeyPair: EphemeralKeyPair;
+
+  uidKey: string;
+
+  uidVal: string;
+
+  aud: string;
+
+  pepper: Uint8Array;
+
+  accountAddress: AccountAddress;
+
+  proof: SignedGroth16Signature | Promise<SignedGroth16Signature>;
+
+  signingScheme: SigningScheme;
+
+  jwt: string;
+
+  constructor(args: {
+    address?: AccountAddress;
+    ephemeralKeyPair: EphemeralKeyPair;
+    iss: string;
+    uidKey: string;
+    uidVal: string;
+    aud: string;
+    pepper: HexInput;
+    proofFetcherOrData: Promise<SignedGroth16Signature> | SignedGroth16Signature;
+    jwt: string;
+  }) {
+    const { address, ephemeralKeyPair, iss, uidKey, uidVal, aud, pepper, proofFetcherOrData, jwt } = args;
+    this.ephemeralKeyPair = ephemeralKeyPair;
+    const addressSeed = computeAddressSeed(args);
+    this.publicKey = new KeylessPublicKey(iss, addressSeed);
+    this.accountAddress = address ? AccountAddress.from(address) : this.publicKey.authKey().derivedAddress();
+    this.uidKey = uidKey;
+    this.uidVal = uidVal;
+    this.aud = aud;
+    this.jwt = jwt;
+    if (proofFetcherOrData instanceof Promise) {
+      this.proof = proofFetcherOrData;
+      this.initialize(proofFetcherOrData);
+    } else {
+      this.proof = proofFetcherOrData;
+    }
+
+    this.signingScheme = SigningScheme.SingleKey;
+    const pepperBytes = Hex.fromHexInput(pepper).toUint8Array();
+    if (pepperBytes.length !== KeylessAccount.PEPPER_LENGTH) {
+      throw new Error(`Pepper length in bytes should be ${KeylessAccount.PEPPER_LENGTH}`);
+    }
+    this.pepper = pepperBytes;
+  }
+
+  private async initialize(promise: Promise<SignedGroth16Signature>) {
+    try {
+      this.proof = await promise;
+    } catch (error) {
+      throw new Error("Failed to fetch proof");
+    }
+  }
+
+  signWithAuthenticator(transaction: AnyRawTransaction): AccountAuthenticatorSingleKey {
+    const raw = deriveTransactionType(transaction);
+    const signature = new AnySignature(this.sign(raw.bcsToBytes()));
+    const publicKey = new AnyPublicKey(this.publicKey);
+    return new AccountAuthenticatorSingleKey(publicKey, signature);
+  }
+
+  async waitForProofFetch() {
+    if (this.proof instanceof Promise) {
+      await this.proof
+    }
+  }
+
+  sign(data: HexInput): Signature {
+    const { expiryDateSecs } = this.ephemeralKeyPair;
+    const currentTimeInSeconds = Math.floor(new Date().getTime() / 1000);
+    if (expiryDateSecs < currentTimeInSeconds) {
+      throw new Error("Ephemeral key pair is expired.");
+    }
+    if (this.proof instanceof Promise) {
+      throw new Error("Failed to fetch proof.");
+    }
+    const jwtHeader = this.jwt.split(".")[0];
+    const ephemeralPublicKey = this.ephemeralKeyPair.publicKey;
+
+    const serializer = new Serializer();
+    serializer.serializeFixedBytes(Hex.fromHexInput(data).toUint8Array());
+    serializer.serializeOption(this.proof.proof);
+    const signMess = generateSigningMessage(serializer.toUint8Array(), "TransactionAndProof");
+
+    const ephemeralSignature = this.ephemeralKeyPair.sign(signMess);
+
+    return new KeylessSignature({
+      jwtHeader: base64UrlDecode(jwtHeader),
+      openIdSignatureOrZkProof: new OpenIdSignatureOrZkProof(this.proof),
+      expiryDateSecs,
+      ephemeralPublicKey,
+      ephemeralSignature,
+    });
+  }
+
+  signTransaction(transaction: AnyRawTransaction): Signature {
+    const raw = deriveTransactionType(transaction);
+    return this.sign(raw.bcsToBytes());
+  }
+
+  signWithOpenIdSignature(data: HexInput): Signature {
+    const [jwtHeader, jwtPayload, jwtSignature] = this.jwt.split(".");
+    const openIdSig = new OpenIdSignature({
+      jwtSignature,
+      jwtPayloadJson: jwtPayload,
+      uidKey: this.uidKey,
+      epkBlinder: this.ephemeralKeyPair.blinder,
+      pepper: this.pepper,
+    });
+
+    const { expiryDateSecs } = this.ephemeralKeyPair;
+    const ephemeralPublicKey = this.ephemeralKeyPair.publicKey;
+    const ephemeralSignature = this.ephemeralKeyPair.sign(data);
+    return new KeylessSignature({
+      jwtHeader,
+      openIdSignatureOrZkProof: new OpenIdSignatureOrZkProof(openIdSig),
+      expiryDateSecs,
+      ephemeralPublicKey,
+      ephemeralSignature,
+    });
+  }
+
+  deriveAptosConnectPublicKey(): KeylessPublicKey {
+    const { uidKey, uidVal, pepper } = this;
+    const { iss } = this.publicKey;
+    const addressSeed = computeAddressSeed({
+      uidKey,
+      uidVal,
+      aud: KeylessAccount.APTOS_CONNECT_CLIENT_ID,
+      pepper,
+    });
+    return new KeylessPublicKey(iss, addressSeed);
+  }
+
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars, class-methods-use-this
+  verifySignature(args: { message: HexInput; signature: Signature }): boolean {
+    return true;
+  }
+
+  static fromJWTAndProof(args: {
+    proofFetcherOrData: Promise<SignedGroth16Signature> | SignedGroth16Signature;
+    jwt: string;
+    ephemeralKeyPair: EphemeralKeyPair;
+    pepper: HexInput;
+    uidKey?: string;
+  }): KeylessAccount {
+    const { proofFetcherOrData, jwt, ephemeralKeyPair, pepper } = args;
+    const uidKey = args.uidKey ?? "sub";
+
+    const jwtPayload = jwtDecode<JwtPayload & { [key: string]: string }>(jwt);
+    const iss = jwtPayload.iss!;
+    if (typeof jwtPayload.aud !== "string") {
+      throw new Error("aud was not found or an array of values");
+    }
+    const aud = jwtPayload.aud!;
+    const uidVal = jwtPayload[uidKey];
+    return new KeylessAccount({
+      proofFetcherOrData,
+      ephemeralKeyPair,
+      iss,
+      uidKey,
+      uidVal,
+      aud,
+      pepper,
+      jwt,
+    });
+  }
+
+  static fromDerivationPath(path: string, seed: Uint8Array): Uint8Array {
+    return fromDerivationPathInner(path, KeylessAccount.SLIP_0010_SEED, seed);
+  }
+}

package/src/account/MultiKeyAccount.ts

@@ -0,0 +1,121 @@
+// Copyright © Aptos Foundation
+// SPDX-License-Identifier: Apache-2.0
+
+import { Account } from "./Account";
+import { MultiKey, MultiSignature, PublicKey, Signature } from "../core/crypto";
+import { AccountAddress } from "../core/accountAddress";
+import { HexInput, SigningScheme } from "../types";
+import { AccountAuthenticatorMultiKey } from "../transactions/authenticator/account";
+import { AnyRawTransaction } from "../transactions/types";
+import { KeylessAccount } from "./KeylessAccount";
+
+export class MultiKeyAccount implements Account {
+  /**
+   * Public key associated with the account
+   */
+  readonly publicKey: MultiKey;
+
+  /**
+   * Account address associated with the account
+   */
+  readonly accountAddress: AccountAddress;
+
+  /**
+   * Signing scheme used to sign transactions
+   */
+  readonly signingScheme: SigningScheme;
+
+  signers: Account[];
+
+  signaturesBitmap: Uint8Array;
+
+  /**
+   * constructor for Account
+   *
+   * Need to update this to use the new crypto library if new schemes are added.
+   *
+   * @param args.privateKey PrivateKey - private key of the account
+   * @param args.address AccountAddress - address of the account
+   * @param args.legacy optional. If set to false, the keypair authentication keys will be derived with a unified scheme.
+   * Defaults to deriving an authentication key with the legacy scheme.
+   *
+   * This method is private because it should only be called by the factory static methods.
+   * @returns Account
+   */
+  constructor(args: { multiKey: MultiKey; signers: Account[] }) {
+    const { multiKey, signers } = args;
+
+    this.publicKey = multiKey;
+    this.signers = signers;
+    this.signingScheme = SigningScheme.MultiKey;
+
+    this.accountAddress = this.publicKey.authKey().derivedAddress();
+
+    const bits: number[] = [];
+    for (const signer of signers) {
+      bits.push(this.publicKey.getIndex(signer.publicKey));
+    }
+    this.signaturesBitmap = this.publicKey.createBitmap({ bits });
+  }
+
+  static fromPublicKeysAndSigners(args: {
+    publicKeys: PublicKey[];
+    signaturesRequired: number;
+    signers: Account[];
+  }): MultiKeyAccount {
+    const { publicKeys, signaturesRequired, signers } = args;
+    const multiKey = new MultiKey({ publicKeys, signaturesRequired });
+    return new MultiKeyAccount({ multiKey, signers });
+  }
+
+  static isMultiKeySigner(account: Account): account is MultiKeyAccount {
+    return account instanceof MultiKeyAccount;
+  }
+
+  signWithAuthenticator(transaction: AnyRawTransaction) {
+    return new AccountAuthenticatorMultiKey(this.publicKey, this.signTransaction(transaction));
+  }
+
+  async waitForProofFetch() {
+    const keylessSigners = this.signers.filter((signer) => signer instanceof KeylessAccount) as KeylessAccount[];
+    await Promise.all(
+      keylessSigners.filter((signer) => signer.proof instanceof Promise).map( (signer) => signer.proof),
+    );
+  }
+
+  /**
+   * Sign the given message with the private key.
+   *
+   * TODO: Add sign transaction or specific types
+   *
+   * @param data in HexInput format
+   * @returns Signature
+   */
+  sign(data: HexInput): MultiSignature {
+    const signatures = [];
+    for (const signer of this.signers) {
+      signatures.push(signer.sign(data));
+    }
+    return new MultiSignature({ signatures, bitmap: this.signaturesBitmap });
+  }
+
+  signTransaction(transaction: AnyRawTransaction) {
+    const signatures = [];
+    for (const signer of this.signers) {
+      signatures.push(signer.signTransaction(transaction));
+    }
+    return new MultiSignature({ signatures, bitmap: this.signaturesBitmap });
+  }
+
+  /**
+   * Verify the given message and signature with the public key.
+   *
+   * @param args.message raw message data in HexInput format
+   * @param args.signature signed message Signature
+   * @returns
+   */
+  // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars
+  verifySignature(args: { message: HexInput; signature: Signature }): boolean {
+    return true;
+  }
+}

package/src/{core/account → account}/SingleKeyAccount.ts

@@ -1,8 +1,10 @@
-import { AccountAuthenticatorSingleKey } from "../../transactions/authenticator/account";
-import { type HexInput, SigningScheme, SigningSchemeInput } from "../../types";
-import { AccountAddress, AccountAddressInput } from "../accountAddress";
-import { AnyPublicKey, AnySignature, Ed25519PrivateKey, PrivateKey, Secp256k1PrivateKey } from "../crypto";
+import { AccountAuthenticatorSingleKey } from "../transactions/authenticator/account";
+import { type HexInput, SigningScheme, SigningSchemeInput } from "../types";
+import { AccountAddress, AccountAddressInput } from "../core/accountAddress";
+import { AnyPublicKey, AnySignature, Ed25519PrivateKey, PrivateKey, Secp256k1PrivateKey } from "../core/crypto";
 import type { Account } from "./Account";
+import { generateSigningMessageForTransaction } from "../transactions/transactionBuilder/signingMessage";
+import { AnyRawTransaction } from "../transactions/types";
 
 export interface SingleKeySignerConstructorArgs {
   privateKey: PrivateKey;
@@ -106,14 +108,18 @@ export class SingleKeyAccount implements Account {
     return this.publicKey.verifySignature(args);
   }
 
-  signWithAuthenticator(message: HexInput) {
-    const innerSignature = this.privateKey.sign(message);
+  signWithAuthenticator(transaction: AnyRawTransaction) {
+    const innerSignature = this.sign(generateSigningMessageForTransaction(transaction));
     const signature = new AnySignature(innerSignature);
     return new AccountAuthenticatorSingleKey(this.publicKey, signature);
   }
 
   sign(message: HexInput) {
-    return this.signWithAuthenticator(message).signature;
+    return this.privateKey.sign(message);
+  }
+
+  signTransaction(transaction: AnyRawTransaction) {
+    return this.sign(generateSigningMessageForTransaction(transaction))
   }
 
   // endregion

package/src/account/index.ts

@@ -0,0 +1,6 @@
+export * from "./Ed25519Account";
+export * from "./Account";
+export * from "./SingleKeyAccount";
+export * from "./KeylessAccount";
+export * from "./EphemeralKeyPair";
+export * from "./MultiKeyAccount";