@aptos-labs/ts-sdk 1.35.0-zeta.2 → 1.36.0-zeta.0

package/src/account/AbstractKeylessAccount.ts

@@ -13,9 +13,10 @@ import {
   EphemeralCertificate,
   ZeroKnowledgeSig,
   ZkProof,
-  getKeylessJWKs,
   MoveJWK,
   getKeylessConfig,
+  fetchJWK,
+  KeylessConfiguration,
 } from "../core/crypto";
 
 import { EphemeralKeyPair } from "./EphemeralKeyPair";
@@ -428,28 +429,47 @@ export abstract class AbstractKeylessAccount extends Serializable implements Key
     return this.sign(signMess);
   }
 
+  getSigningMessage(transaction: AnyRawTransaction): Uint8Array {
+    if (this.proof === undefined) {
+      throw KeylessError.fromErrorType({
+        type: KeylessErrorType.PROOF_NOT_FOUND,
+        details: "Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing.",
+      });
+    }
+    const raw = deriveTransactionType(transaction);
+    const txnAndProof = new TransactionAndProof(raw, this.proof.proof);
+    return txnAndProof.hash();
+  }
+
   /**
    * Note - This function is currently incomplete and should only be used to verify ownership of the KeylessAccount
    *
    * Verifies a signature given the message.
    *
-   * TODO: Groth16 proof verification
-   *
    * @param args.message the message that was signed.
    * @param args.signature the KeylessSignature to verify
    * @returns boolean
    * @group Implementation
    * @category Account (On-Chain Model)
    */
-  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {
-    const { message, signature } = args;
-    if (this.isExpired()) {
-      return false;
-    }
-    if (!this.ephemeralKeyPair.getPublicKey().verifySignature({ message, signature: signature.ephemeralSignature })) {
-      return false;
-    }
-    return true;
+  verifySignature(args: {
+    message: HexInput;
+    signature: KeylessSignature;
+    jwk: MoveJWK;
+    keylessConfig: KeylessConfiguration;
+  }): boolean {
+    return this.publicKey.verifySignature(args);
+  }
+
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: KeylessSignature;
+    options?: { throwErrorWithReason?: boolean };
+  }): Promise<boolean> {
+    return this.publicKey.verifySignatureAsync({
+      ...args,
+    });
   }
 
   /**
@@ -465,43 +485,7 @@ export abstract class AbstractKeylessAccount extends Serializable implements Key
     publicKey: KeylessPublicKey | FederatedKeylessPublicKey;
     kid: string;
   }): Promise<MoveJWK> {
-    const { aptosConfig, publicKey, kid } = args;
-    const keylessPubKey = publicKey instanceof KeylessPublicKey ? publicKey : publicKey.keylessPublicKey;
-    const { iss } = keylessPubKey;
-
-    let allJWKs: Map<string, MoveJWK[]>;
-    const jwkAddr = publicKey instanceof FederatedKeylessPublicKey ? publicKey.jwkAddress : undefined;
-    try {
-      allJWKs = await getKeylessJWKs({ aptosConfig, jwkAddr });
-    } catch (error) {
-      throw KeylessError.fromErrorType({
-        type: KeylessErrorType.FULL_NODE_JWKS_LOOKUP_ERROR,
-        error,
-        details: `Failed to fetch ${jwkAddr ? "Federated" : "Patched"}JWKs ${jwkAddr ? `for address ${jwkAddr}` : "0x1"}`,
-      });
-    }
-
-    // Find the corresponding JWK set by `iss`
-    const jwksForIssuer = allJWKs.get(iss);
-
-    if (jwksForIssuer === undefined) {
-      throw KeylessError.fromErrorType({
-        type: KeylessErrorType.INVALID_JWT_ISS_NOT_RECOGNIZED,
-        details: `JWKs for issuer ${iss} not found.`,
-      });
-    }
-
-    // Find the corresponding JWK by `kid`
-    const jwk = jwksForIssuer.find((key) => key.kid === kid);
-
-    if (jwk === undefined) {
-      throw KeylessError.fromErrorType({
-        type: KeylessErrorType.INVALID_JWT_JWK_NOT_FOUND,
-        details: `JWK with kid '${kid}' for issuer '${iss}' not found.`,
-      });
-    }
-
-    return jwk;
+    return fetchJWK(args);
   }
 }
 

package/src/account/MultiKeyAccount.ts

@@ -259,6 +259,7 @@ export class MultiKeyAccount implements Account, KeylessSigner {
    * Verify the given message and signature with the public keys.
    *
    * This function checks if the provided signatures are valid for the given message using the corresponding public keys.
+   * Note: If you are using KeylessAccounts, you must use `verifySignatureAsync` instead.
    *
    * @param args - The arguments for verifying the signature.
    * @param args.message - The raw message data in HexInput format.
@@ -267,21 +268,27 @@ export class MultiKeyAccount implements Account, KeylessSigner {
    * @group Implementation
    * @category Account (On-Chain Model)
    */
-  verifySignature(args: VerifyMultiKeySignatureArgs): boolean {
-    const { message, signature } = args;
-    const isSignerIndicesSorted = this.signerIndicies.every(
-      (value, i) => i === 0 || value >= this.signerIndicies[i - 1],
-    );
-    if (!isSignerIndicesSorted) {
-      return false;
-    }
-    for (let i = 0; i < signature.signatures.length; i += 1) {
-      const singleSignature = signature.signatures[i];
-      const publicKey = this.publicKey.publicKeys[this.signerIndicies[i]];
-      if (!publicKey.verifySignature({ message, signature: singleSignature })) {
-        return false;
-      }
-    }
-    return true;
+  verifySignature(args: { message: HexInput; signature: MultiKeySignature }): boolean {
+    return this.publicKey.verifySignature(args);
+  }
+
+  /**
+   * Verify the given message and signature with the public keys.
+   *
+   * This function checks if the provided signatures are valid for the given message using the corresponding public keys.
+   *
+   * @param args - The arguments for verifying the signature.
+   * @param args.message - The raw message data in HexInput format.
+   * @param args.signature - The signed message MultiKeySignature containing multiple signatures.
+   * @returns A boolean indicating whether the signatures are valid for the message.
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: MultiKeySignature;
+  }): Promise<boolean> {
+    return await this.publicKey.verifySignatureAsync(args);
   }
 }

package/src/api/account.ts

@@ -1,15 +1,8 @@
 // Copyright © Aptos Foundation
 // SPDX-License-Identifier: Apache-2.0
 
-import { Account as AccountModule, EphemeralKeyPair } from "../account";
-import {
-  AccountAddress,
-  PrivateKey,
-  AccountAddressInput,
-  createObjectAddress,
-  AccountPublicKey,
-  PublicKey,
-} from "../core";
+import { Account as AccountModule } from "../account";
+import { AccountAddress, PrivateKey, AccountAddressInput, createObjectAddress } from "../core";
 import {
   AccountData,
   AnyNumber,
@@ -37,13 +30,11 @@ import {
   getAccountOwnedObjects,
   getAccountOwnedTokens,
   getAccountOwnedTokensFromCollectionAddress,
-  getAccountsForPublicKey,
   getAccountTokensCount,
   getAccountTransactionsCount,
   getInfo,
   getModule,
   getModules,
-  getPublicKeyFromAccountAddress,
   getResource,
   getResources,
   getTransactions,
@@ -57,7 +48,6 @@ import { view } from "../internal/view";
 import { isEncodedStruct, parseEncodedStruct } from "../utils";
 import { memoizeAsync } from "../utils/memoize";
 import { AccountAbstraction } from "./account/abstraction";
-import { DeriveKeylessAccountParams } from "../internal/keyless";
 
 /**
  * A class to query all `Account` related queries on Aptos.
@@ -909,48 +899,4 @@ export class Account {
   async deriveAccountFromPrivateKey(args: { privateKey: PrivateKey }): Promise<AccountModule> {
     return deriveAccountFromPrivateKey({ aptosConfig: this.config, ...args });
   }
-
-  async getPublicKeyFromAccountAddress(args: {
-    accountAddress: AccountAddressInput;
-    minimumLedgerVersion?: AnyNumber;
-  }): Promise<PublicKey> {
-    await waitForIndexerOnVersion({
-      config: this.config,
-      minimumLedgerVersion: args.minimumLedgerVersion,
-      processorType: ProcessorType.DEFAULT,
-    });
-    return getPublicKeyFromAccountAddress({
-      aptosConfig: this.config,
-      ...args,
-    });
-  }
-
-  async getAccountsForPublicKey(args: {
-    publicKey: AccountPublicKey;
-    minimumLedgerVersion?: AnyNumber;
-    options?: { verified?: boolean };
-  }): Promise<
-    {
-      accountAddress: AccountAddress;
-      publicKey: PublicKey;
-      verified: boolean;
-      lastTransactionVersion: number;
-    }[]
-  > {
-    await waitForIndexerOnVersion({
-      config: this.config,
-      minimumLedgerVersion: args.minimumLedgerVersion,
-      processorType: ProcessorType.DEFAULT,
-    });
-    return getAccountsForPublicKey({
-      aptosConfig: this.config,
-      ...args,
-    });
-  }
-
-  // deriveAccount(args: AccountDerivationParams | AccountDerivationParams[]): Promise<Account> {
-  //   return deriveAccount({ aptosConfig: this.config, ...args });
-  // }
 }
-
-// type AccountDerivationParams = { privateKey: PrivateKey } | DeriveKeylessAccountParams;

package/src/cli/localNode.ts

@@ -89,23 +89,14 @@ export class LocalNode {
     const cliArgs = ["aptos", "node", "run-localnet", "--force-restart", "--assume-yes", "--with-indexer-api"];
 
     const currentPlatform = platform();
-    let childProcess;
-    // Check if current OS is windows
-    if (currentPlatform === "win32") {
-      childProcess = spawn(cliCommand, cliArgs, { shell: true });
-    } else {
-      childProcess = spawn(cliCommand, cliArgs);
-    }
-
-    this.process = childProcess;
+    const spawnConfig = {
+      env: { ...process.env, ENABLE_KEYLESS_DEFAULT: "1" },
+      ...(currentPlatform === "win32" && { shell: true }),
+    };
 
-    childProcess.stderr?.on("data", (data: any) => {
-      const str = data.toString();
-      // Print local node output error log
-      console.log(str);
-    });
+    this.process = spawn(cliCommand, cliArgs, spawnConfig);
 
-    childProcess.stdout?.on("data", (data: any) => {
+    this.process.stdout?.on("data", (data: any) => {
       const str = data.toString();
       // Print local node output log
       if (this.showStdout) {

package/src/core/crypto/abstraction.ts

@@ -3,7 +3,7 @@ import { HexInput } from "../../types";
 import { AccountAddress } from "../accountAddress";
 import { AuthenticationKey } from "../authenticationKey";
 import { Hex } from "../hex";
-import { AccountPublicKey, VerifySignatureArgs } from "./publicKey";
+import { AccountPublicKey, VerifySignatureArgs, VerifySignatureAsyncArgs } from "./publicKey";
 import { Signature } from "./signature";
 
 export class AbstractSignature extends Signature {
@@ -40,6 +40,11 @@ export class AbstractPublicKey extends AccountPublicKey {
     throw new Error("This function is not implemented for AbstractPublicKey.");
   }
 
+  // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars
+  async verifySignatureAsync(args: VerifySignatureAsyncArgs): Promise<boolean> {
+    throw new Error("This function is not implemented for AbstractPublicKey.");
+  }
+
   // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars
   serialize(serializer: Serializer): void {
     throw new Error("This function is not implemented for AbstractPublicKey.");

package/src/core/crypto/ed25519.ts

@@ -9,7 +9,7 @@ import { Hex } from "../hex";
 import { HexInput, SigningScheme as AuthenticationKeyScheme, PrivateKeyVariants } from "../../types";
 import { CKDPriv, deriveKey, HARDENED_OFFSET, isValidHardenedPath, mnemonicToSeed, splitPath } from "./hdKey";
 import { PrivateKey } from "./privateKey";
-import { AccountPublicKey, PublicKey, VerifySignatureArgs } from "./publicKey";
+import { AccountPublicKey, PublicKey, VerifySignatureArgs, VerifySignatureAsyncArgs } from "./publicKey";
 import { Signature } from "./signature";
 import { convertSigningMessage } from "./utils";
 
@@ -120,6 +120,24 @@ export class Ed25519PublicKey extends AccountPublicKey {
     return ed25519.verify(signatureBytes, messageBytes, publicKeyBytes);
   }
 
+  /**
+   * Note: Ed25519Signatures can be verified syncronously.
+   *
+   * Verifies the provided signature against the given message.
+   * This function helps ensure the integrity and authenticity of the message by confirming that the signature is valid.
+   *
+   * @param args - The arguments for signature verification.
+   * @param args.aptosConfig - The configuration object for connecting to the Aptos network
+   * @param args.message - The message that was signed.
+   * @param args.signature - The signature to verify, which must be an instance of Secp256k1Signature.
+   * @returns A boolean indicating whether the signature is valid for the given message.
+   * @group Implementation
+   * @category Serialization
+   */
+  async verifySignatureAsync(args: VerifySignatureAsyncArgs): Promise<boolean> {
+    return this.verifySignature(args);
+  }
+
   /**
    * Generates an authentication key from the public key using the Ed25519 scheme.
    * This function is essential for creating a secure authentication key that can be used for further cryptographic operations.

package/src/core/crypto/ephemeral.ts

@@ -4,6 +4,7 @@ import { PublicKey } from "./publicKey";
 import { Signature } from "./signature";
 import { Ed25519PublicKey, Ed25519Signature } from "./ed25519";
 import { Hex } from "../hex";
+import { AptosConfig } from "../../api";
 
 /**
  * Represents ephemeral public keys for Aptos Keyless accounts.
@@ -64,6 +65,14 @@ export class EphemeralPublicKey extends PublicKey {
     return this.publicKey.verifySignature({ message, signature: signature.signature });
   }
 
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: EphemeralSignature;
+  }): Promise<boolean> {
+    return this.verifySignature(args);
+  }
+
   /**
    * Serializes the current instance, specifically handling the Ed25519 signature type.
    * This function ensures that the signature is properly serialized using the provided serializer.

package/src/core/crypto/federatedKeyless.ts

@@ -6,7 +6,15 @@ import { Deserializer, Serializer } from "../../bcs";
 import { HexInput, AnyPublicKeyVariant, SigningScheme } from "../../types";
 import { AuthenticationKey } from "../authenticationKey";
 import { AccountAddress, AccountAddressInput } from "../accountAddress";
-import { KeylessPublicKey, KeylessSignature } from "./keyless";
+import {
+  KeylessConfiguration,
+  KeylessPublicKey,
+  KeylessSignature,
+  MoveJWK,
+  verifyKeylessSignature,
+  verifyKeylessSignatureWithJwkAndConfig,
+} from "./keyless";
+import { AptosConfig } from "../../api";
 
 /**
  * Represents the FederatedKeylessPublicKey public key
@@ -60,13 +68,19 @@ export class FederatedKeylessPublicKey extends AccountPublicKey {
    *
    * @param args.message message
    * @param args.signature The signature
+   * @param args.jwk - The JWK to use for verification.
+   * @param args.keylessConfig - The keyless configuration to use for verification.
    * @returns true if the signature is valid
    * @group Implementation
    * @category Serialization
    */
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars, class-methods-use-this
-  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {
-    throw new Error("Not yet implemented");
+  verifySignature(args: {
+    message: HexInput;
+    signature: KeylessSignature;
+    jwk: MoveJWK;
+    keylessConfig: KeylessConfiguration;
+  }): boolean {
+    return verifyKeylessSignatureWithJwkAndConfig({ ...args, publicKey: this });
   }
 
   serialize(serializer: Serializer): void {
@@ -84,6 +98,28 @@ export class FederatedKeylessPublicKey extends AccountPublicKey {
     return publicKey instanceof FederatedKeylessPublicKey;
   }
 
+  /**
+   * Verifies a keyless signature for a given message.  It will fetch the keyless configuration and the JWK to
+   * use for verification from the appropriate network as defined by the aptosConfig.
+   *
+   * @param args.aptosConfig The aptos config to use for fetching the keyless configuration.
+   * @param args.message The message to verify the signature against.
+   * @param args.signature The signature to verify.
+   * @param args.options.throwErrorWithReason Whether to throw an error with the reason for the failure instead of returning false.
+   * @returns true if the signature is valid
+   */
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: KeylessSignature;
+    options?: { throwErrorWithReason?: boolean };
+  }): Promise<boolean> {
+    return verifyKeylessSignature({
+      ...args,
+      publicKey: this,
+    });
+  }
+
   /**
    * Creates a FederatedKeylessPublicKey from the JWT components plus pepper
    *

package/src/core/crypto/index.ts

@@ -1,13 +1,14 @@
 // Copyright © Aptos Foundation
 // SPDX-License-Identifier: Apache-2.0
 
+export * from "./abstraction";
 export * from "./ed25519";
-export * from "./hdKey";
-export * from "./multiEd25519";
-export * from "./multiKey";
 export * from "./ephemeral";
 export * from "./federatedKeyless";
+export * from "./hdKey";
 export * from "./keyless";
+export * from "./multiEd25519";
+export * from "./multiKey";
 export * from "./poseidon";
 export * from "./privateKey";
 export * from "./publicKey";