@aptos-labs/ts-sdk 1.31.0 → 1.32.1

package/src/internal/keyless.ts

@@ -16,6 +16,7 @@ import {
   Groth16Zkp,
   Hex,
   KeylessPublicKey,
+  MoveJWK,
   ZeroKnowledgeSig,
   ZkProof,
   getKeylessConfig,
@@ -29,6 +30,8 @@ import { FederatedKeylessAccount } from "../account/FederatedKeylessAccount";
 import { MoveVector } from "../bcs";
 import { generateTransaction } from "./transactionSubmission";
 import { InputGenerateTransactionOptions, SimpleTransaction } from "../transactions";
+import { KeylessError, KeylessErrorType } from "../errors";
+import { FIREBASE_AUTH_ISS_PATTERN } from "../utils/const";
 
 /**
  * Retrieves a pepper value based on the provided configuration and authentication details.
@@ -86,12 +89,19 @@ export async function getProof(args: {
   ephemeralKeyPair: EphemeralKeyPair;
   pepper?: HexInput;
   uidKey?: string;
+  maxExpHorizonSecs?: number;
 }): Promise<ZeroKnowledgeSig> {
-  const { aptosConfig, jwt, ephemeralKeyPair, pepper = await getPepper(args), uidKey = "sub" } = args;
+  const {
+    aptosConfig,
+    jwt,
+    ephemeralKeyPair,
+    pepper = await getPepper(args),
+    uidKey = "sub",
+    maxExpHorizonSecs = (await getKeylessConfig({ aptosConfig })).maxExpHorizonSecs,
+  } = args;
   if (Hex.fromHexInput(pepper).toUint8Array().length !== KeylessAccount.PEPPER_LENGTH) {
     throw new Error(`Pepper needs to be ${KeylessAccount.PEPPER_LENGTH} bytes`);
   }
-  const { maxExpHorizonSecs } = await getKeylessConfig({ aptosConfig });
   const decodedJwt = jwtDecode<JwtPayload>(jwt);
   if (typeof decodedJwt.iat !== "number") {
     throw new Error("iat was not found");
@@ -174,7 +184,9 @@ export async function deriveKeylessAccount(args: {
   proofFetchCallback?: ProofFetchCallback;
 }): Promise<KeylessAccount | FederatedKeylessAccount> {
   const { aptosConfig, jwt, jwkAddress, uidKey, proofFetchCallback, pepper = await getPepper(args) } = args;
-  const proofPromise = getProof({ ...args, pepper });
+  const { verificationKey, maxExpHorizonSecs } = await getKeylessConfig({ aptosConfig });
+
+  const proofPromise = getProof({ ...args, pepper, maxExpHorizonSecs });
   // If a callback is provided, pass in the proof as a promise to KeylessAccount.create.  This will make the proof be fetched in the
   // background and the callback will handle the outcome of the fetch.  This allows the developer to not have to block on the proof fetch
   // allowing for faster rendering of UX.
@@ -190,7 +202,15 @@ export async function deriveKeylessAccount(args: {
       authenticationKey: publicKey.authKey().derivedAddress(),
     });
 
-    return FederatedKeylessAccount.create({ ...args, address, proof, pepper, proofFetchCallback, jwkAddress });
+    return FederatedKeylessAccount.create({
+      ...args,
+      address,
+      proof,
+      pepper,
+      proofFetchCallback,
+      jwkAddress,
+      verificationKey,
+    });
   }
 
   const publicKey = KeylessPublicKey.fromJwtAndPepper({ jwt, pepper, uidKey });
@@ -198,19 +218,11 @@ export async function deriveKeylessAccount(args: {
     aptosConfig,
     authenticationKey: publicKey.authKey().derivedAddress(),
   });
-  return KeylessAccount.create({ ...args, address, proof, pepper, proofFetchCallback });
+  return KeylessAccount.create({ ...args, address, proof, pepper, proofFetchCallback, verificationKey });
 }
 
-interface JWK {
-  kty: string; // Key type
-  kid: string; // Key ID
-  alg: string; // Algorithm used with the key
-  n: string; // Modulus (for RSA keys)
-  e: string; // Exponent (for RSA keys)
-}
-
-interface JWKS {
-  keys: JWK[];
+export interface JWKS {
+  keys: MoveJWK[];
 }
 
 export async function updateFederatedKeylessJwkSetTransaction(args: {
@@ -221,11 +233,37 @@ export async function updateFederatedKeylessJwkSetTransaction(args: {
   options?: InputGenerateTransactionOptions;
 }): Promise<SimpleTransaction> {
   const { aptosConfig, sender, iss, options } = args;
-  const jwksUrl = args.jwksUrl ?? (iss.endsWith("/") ? `${iss}.well-known/jwks.json` : `${iss}/.well-known/jwks.json`);
-  const response = await fetch(jwksUrl);
-  if (!response.ok) {
-    throw new Error(`Failed to fetch JWKS: ${response.status} ${response.statusText}`);
+
+  let { jwksUrl } = args;
+
+  if (jwksUrl === undefined) {
+    if (FIREBASE_AUTH_ISS_PATTERN.test(iss)) {
+      jwksUrl = "https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com";
+    } else {
+      jwksUrl = iss.endsWith("/") ? `${iss}.well-known/jwks.json` : `${iss}/.well-known/jwks.json`;
+    }
+  }
+
+  let response: Response;
+
+  try {
+    response = await fetch(jwksUrl);
+    if (!response.ok) {
+      throw new Error(`${response.status} ${response.statusText}`);
+    }
+  } catch (error) {
+    let errorMessage: string;
+    if (error instanceof Error) {
+      errorMessage = `${error.message}`;
+    } else {
+      errorMessage = `error unknown - ${error}`;
+    }
+    throw KeylessError.fromErrorType({
+      type: KeylessErrorType.JWK_FETCH_FAILED_FEDERATED,
+      details: `Failed to fetch JWKS at ${jwksUrl}: ${errorMessage}`,
+    });
   }
+
   const jwks: JWKS = await response.json();
   return generateTransaction({
     aptosConfig,

package/src/internal/transaction.ts

@@ -9,7 +9,8 @@
  */
 
 import { AptosConfig } from "../api/aptosConfig";
-import { AptosApiError, getAptosFullNode, paginateWithCursor } from "../client";
+import { getAptosFullNode, paginateWithCursor } from "../client";
+import { AptosApiError } from "../errors";
 import {
   TransactionResponseType,
   type AnyNumber,

package/src/internal/transactionSubmission.ts

@@ -6,11 +6,11 @@
  */
 
 import { AptosConfig } from "../api/aptosConfig";
-import { MoveVector, U8 } from "../bcs";
+import { Deserializer, MoveVector, U8 } from "../bcs";
 import { postAptosFullNode } from "../client";
-import { Account, AbstractKeylessAccount, MultiKeyAccount } from "../account";
+import { Account, AbstractKeylessAccount, isKeylessSigner } from "../account";
 import { AccountAddress, AccountAddressInput } from "../core/accountAddress";
-import { PrivateKey } from "../core/crypto";
+import { FederatedKeylessPublicKey, KeylessPublicKey, KeylessSignature, PrivateKey } from "../core/crypto";
 import { AccountAuthenticator } from "../transactions/authenticator/account";
 import { RotationProofChallenge } from "../transactions/instances/rotationProofChallenge";
 import {
@@ -33,7 +33,7 @@ import {
 } from "../transactions/types";
 import { getInfo } from "./account";
 import { UserTransactionResponse, PendingTransactionResponse, MimeType, HexInput, TransactionResponse } from "../types";
-import { TypeTagU8, TypeTagVector, generateSigningMessageForTransaction } from "../transactions";
+import { SignedTransaction, TypeTagU8, TypeTagVector, generateSigningMessageForTransaction } from "../transactions";
 import { SimpleTransaction } from "../transactions/instances/simpleTransaction";
 import { MultiAgentTransaction } from "../transactions/instances/multiAgentTransaction";
 
@@ -312,15 +312,33 @@ export async function submitTransaction(
 ): Promise<PendingTransactionResponse> {
   const { aptosConfig } = args;
   const signedTransaction = generateSignedTransaction({ ...args });
-  const { data } = await postAptosFullNode<Uint8Array, PendingTransactionResponse>({
-    aptosConfig,
-    body: signedTransaction,
-    path: "transactions",
-    originMethod: "submitTransaction",
-    contentType: MimeType.BCS_SIGNED_TRANSACTION,
-  });
-  return data;
+  try {
+    const { data } = await postAptosFullNode<Uint8Array, PendingTransactionResponse>({
+      aptosConfig,
+      body: signedTransaction,
+      path: "transactions",
+      originMethod: "submitTransaction",
+      contentType: MimeType.BCS_SIGNED_TRANSACTION,
+    });
+    return data;
+  } catch (e) {
+    const signedTxn = SignedTransaction.deserialize(new Deserializer(signedTransaction));
+    if (
+      signedTxn.authenticator.isSingleSender() &&
+      signedTxn.authenticator.sender.isSingleKey() &&
+      (signedTxn.authenticator.sender.public_key.publicKey instanceof KeylessPublicKey ||
+        signedTxn.authenticator.sender.public_key.publicKey instanceof FederatedKeylessPublicKey)
+    ) {
+      await AbstractKeylessAccount.fetchJWK({
+        aptosConfig,
+        publicKey: signedTxn.authenticator.sender.public_key.publicKey,
+        kid: (signedTxn.authenticator.sender.signature.signature as KeylessSignature).getJwkKid(),
+      });
+    }
+    throw e;
+  }
 }
+
 export type FeePayerOrFeePayerAuthenticatorOrNeither =
   | { feePayer: Account; feePayerAuthenticator?: never }
   | { feePayer?: never; feePayerAuthenticator: AccountAuthenticator }
@@ -336,11 +354,11 @@ export async function signAndSubmitTransaction(
   const { aptosConfig, signer, feePayer, transaction } = args;
   // If the signer contains a KeylessAccount, await proof fetching in case the proof
   // was fetched asynchronously.
-  if (signer instanceof AbstractKeylessAccount || signer instanceof MultiKeyAccount) {
-    await signer.waitForProofFetch();
+  if (isKeylessSigner(signer)) {
+    await signer.checkKeylessAccountValidity(aptosConfig);
   }
-  if (feePayer instanceof AbstractKeylessAccount || feePayer instanceof MultiKeyAccount) {
-    await feePayer.waitForProofFetch();
+  if (isKeylessSigner(feePayer)) {
+    await feePayer.checkKeylessAccountValidity(aptosConfig);
   }
   const feePayerAuthenticator =
     args.feePayerAuthenticator || (feePayer && signAsFeePayer({ signer: feePayer, transaction }));
@@ -362,8 +380,8 @@ export async function signAndSubmitAsFeePayer(args: {
 }): Promise<PendingTransactionResponse> {
   const { aptosConfig, senderAuthenticator, feePayer, transaction } = args;
 
-  if (feePayer instanceof AbstractKeylessAccount || feePayer instanceof MultiKeyAccount) {
-    await feePayer.waitForProofFetch();
+  if (isKeylessSigner(feePayer)) {
+    await feePayer.checkKeylessAccountValidity(aptosConfig);
   }
 
   const feePayerAuthenticator = signAsFeePayer({ signer: feePayer, transaction });

package/src/transactions/authenticator/transaction.ts

@@ -42,6 +42,26 @@ export abstract class TransactionAuthenticator extends Serializable {
         throw new Error(`Unknown variant index for TransactionAuthenticator: ${index}`);
     }
   }
+
+  isEd25519(): this is TransactionAuthenticatorEd25519 {
+    return this instanceof TransactionAuthenticatorEd25519;
+  }
+
+  isMultiEd25519(): this is TransactionAuthenticatorMultiEd25519 {
+    return this instanceof TransactionAuthenticatorMultiEd25519;
+  }
+
+  isMultiAgent(): this is TransactionAuthenticatorMultiAgent {
+    return this instanceof TransactionAuthenticatorMultiAgent;
+  }
+
+  isFeePayer(): this is TransactionAuthenticatorFeePayer {
+    return this instanceof TransactionAuthenticatorFeePayer;
+  }
+
+  isSingleSender(): this is TransactionAuthenticatorSingleSender {
+    return this instanceof TransactionAuthenticatorSingleSender;
+  }
 }
 
 /**