@aztec/pxe 0.0.1-commit.2448fdb → 0.0.1-commit.2606882

package/src/hooks/authorize_utility_call.ts

@@ -0,0 +1,44 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { FunctionSelector } from '@aztec/stdlib/abi';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+
+/** Information about a cross-contract utility call that requires authorization. */
+export type UtilityCallAuthorizationRequest = {
+  /** The contract requesting the cross-contract call. */
+  caller: AztecAddress;
+  /** The contract class ID of the calling contract. */
+  callerClassId: Fr;
+  /** The target contract being called. */
+  target: AztecAddress;
+  /** The contract class ID of the target contract. */
+  targetClassId: Fr;
+  /** The function selector being invoked on the target. */
+  functionSelector: FunctionSelector;
+  /** The name of the function being called, from the contract artifact. */
+  functionName: string;
+  /** The serialized arguments passed to the function. */
+  args: Fr[];
+  /** The execution context from which the call originates. */
+  callerContext: 'private' | 'private view' | 'utility';
+};
+
+/** Authorization was granted. */
+type Authorized = { authorized: true };
+
+/** Authorization was denied. */
+type Denied = {
+  authorized: false;
+  /** Reason for denial, included in the error message. */
+  reason?: string;
+};
+
+/** Result of an authorization hook evaluation. */
+export type UtilityCallAuthorizationResponse = Authorized | Denied;
+
+/**
+ * Hook called when a utility function attempts a cross-contract call.
+ * Returns a response indicating whether the call is authorized and an optional denial reason.
+ */
+export type AuthorizeUtilityCall = (
+  request: UtilityCallAuthorizationRequest,
+) => Promise<UtilityCallAuthorizationResponse>;

package/src/hooks/execution_hooks.ts

@@ -0,0 +1,48 @@
+import type { AuthorizeUtilityCall } from './authorize_utility_call.js';
+
+/**
+ * Hooks that PXE invokes during client-side simulation to gate operations that the protocol
+ * does not restrict on its own. They give the wallet a chance to apply custom policies (e.g.
+ * prompting the user, consulting a dynamic allowlist, or inspecting call arguments) before the
+ * execution proceeds.
+ *
+ * For example, {@link authorizeUtilityCall} is called whenever a utility function makes a
+ * cross-contract call. A call made by a malicious contract could leak private information, so the
+ * hook lets the wallet decide, per-call, whether to allow it. A static allowlist would not work
+ * here because neither the app nor the wallet can predict ahead of time which contracts will be
+ * invoked during execution.
+ *
+ * Note: hooks are unrelated to authentication witnesses (authwits). Authwits are an on-chain
+ * mechanism where a contract verifies that a caller was authorized by a specific account; hooks
+ * are a client-side PXE concern that gates execution before it proceeds.
+ *
+ * @example
+ * ```ts
+ * const pxe = await PXE.create({
+ *   // ...
+ *   hooks: {
+ *     authorizeUtilityCall: async (req) => {
+ *       // Allow calls to a known helper contract, deny everything else.
+ *       return req.target.equals(trustedHelper)
+ *         ? { authorized: true }
+ *         : { authorized: false, reason: 'Unknown target' };
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export interface ExecutionHooks {
+  /** Called when a contract attempts a cross-contract utility call. */
+  authorizeUtilityCall: AuthorizeUtilityCall;
+}
+
+/**
+ * Builds an {@link ExecutionHooks} from individually-constructed hook callbacks. Returns `undefined`
+ * when every field is absent, so callers can unconditionally pass the result as `hooks`.
+ */
+export function composeHooks(partial: Partial<ExecutionHooks>): ExecutionHooks | undefined {
+  if (Object.values(partial).every(v => v === undefined)) {
+    return undefined;
+  }
+  return partial as ExecutionHooks;
+}

package/src/hooks/index.ts

@@ -0,0 +1,7 @@
+export type {
+  AuthorizeUtilityCall,
+  UtilityCallAuthorizationRequest,
+  UtilityCallAuthorizationResponse,
+} from './authorize_utility_call.js';
+export type { ExecutionHooks } from './execution_hooks.js';
+export { composeHooks } from './execution_hooks.js';

package/src/logs/log_service.ts

@@ -1,12 +1,16 @@
+import type { BlockNumber } from '@aztec/foundation/branded-types';
 import { type Logger, type LoggerBindings, createLogger } from '@aztec/foundation/log';
 import type { KeyStore } from '@aztec/key-store';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
-import type { L2TipsProvider } from '@aztec/stdlib/block';
+import type { BlockHash, L2TipsProvider } from '@aztec/stdlib/block';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
-import { ExtendedDirectionalAppTaggingSecret, PendingTaggedLog, SiloedTag, Tag } from '@aztec/stdlib/logs';
+import { AppTaggingSecret, type LogResult, PendingTaggedLog, SiloedTag } from '@aztec/stdlib/logs';
 import type { BlockHeader } from '@aztec/stdlib/tx';
 
-import type { LogRetrievalRequest } from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
+import {
+  type LogRetrievalRequest,
+  LogSource,
+} from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
 import { LogRetrievalResponse } from '../contract_function_simulator/noir-structs/log_retrieval_response.js';
 import { AddressStore } from '../storage/address_store/address_store.js';
 import type { RecipientTaggingStore } from '../storage/tagging_store/recipient_tagging_store.js';
@@ -14,9 +18,13 @@ import type { SenderAddressBookStore } from '../storage/tagging_store/sender_add
 import {
   getAllPrivateLogsByTags,
   getAllPublicLogsByTagsFromContract,
-  loadPrivateLogsForSenderRecipientPair,
+  syncTaggedPrivateLogs,
 } from '../tagging/index.js';
 
+/** Key used to group requests by their (fromBlock, toBlock) range so each group becomes a single node call. */
+type RangeKey = string;
+const rangeKey = (fromBlock?: BlockNumber, toBlock?: BlockNumber): RangeKey => `${fromBlock ?? ''}-${toBlock ?? ''}`;
+
 export class LogService {
   private log: Logger;
 
@@ -34,133 +42,170 @@ export class LogService {
     this.log = createLogger('pxe:log_service', bindings);
   }
 
+  /** Fetches all logs matching each request's tag, returning an array of log arrays (one per request). */
   public async fetchLogsByTag(
     contractAddress: AztecAddress,
     logRetrievalRequests: LogRetrievalRequest[],
-  ): Promise<(LogRetrievalResponse | null)[]> {
+  ): Promise<LogRetrievalResponse[][]> {
     for (const request of logRetrievalRequests) {
       if (!contractAddress.equals(request.contractAddress)) {
         throw new Error(`Got a log retrieval request from ${request.contractAddress}, expected ${contractAddress}`);
       }
     }
 
-    return await Promise.all(
-      logRetrievalRequests.map(async request => {
-        const [publicLog, privateLog] = await Promise.all([
-          this.#getPublicLogByTag(request.tag, request.contractAddress),
-          this.#getPrivateLogByTag(await SiloedTag.computeFromTagAndApp(request.tag, request.contractAddress)),
-        ]);
+    if (logRetrievalRequests.length === 0) {
+      return [];
+    }
 
-        if (publicLog !== null && privateLog !== null) {
-          this.log.warn(
-            `Found both a public and private log for tag ${request.tag} from contract ${request.contractAddress}. This may indicate a contract bug. Returning the public log.`,
-          );
-        }
+    const anchorBlockHash = await this.anchorBlockHeader.hash();
+
+    const [publicLogsPerRequest, privateLogsPerRequest] = await Promise.all([
+      this.#fetchPublicLogs(contractAddress, logRetrievalRequests, anchorBlockHash),
+      this.#fetchPrivateLogs(logRetrievalRequests, anchorBlockHash),
+    ]);
 
-        return publicLog ?? privateLog;
+    return logRetrievalRequests.map((_request, i) => [
+      ...publicLogsPerRequest[i].map(LogService.#toLogRetrievalResponse),
+      ...privateLogsPerRequest[i].map(LogService.#toLogRetrievalResponse),
+    ]);
+  }
+
+  async #fetchPublicLogs(
+    contractAddress: AztecAddress,
+    requests: LogRetrievalRequest[],
+    anchorBlockHash: BlockHash,
+  ): Promise<LogResult[][]> {
+    const indices = requests.flatMap((r, i) => (r.source !== LogSource.PRIVATE ? [i] : []));
+    if (indices.length === 0) {
+      return requests.map(() => []);
+    }
+
+    const resultsPerRequest: LogResult[][] = requests.map(() => []);
+    const groups = LogService.#groupByRange(indices.map(i => ({ index: i, request: requests[i] })));
+
+    await Promise.all(
+      Array.from(groups.values()).map(async group => {
+        const tags = group.entries.map(e => e.request.tag);
+        const results = await getAllPublicLogsByTagsFromContract(
+          this.aztecNode,
+          contractAddress,
+          tags,
+          anchorBlockHash,
+          { fromBlock: group.fromBlock, toBlock: group.toBlock, includeEffects: true },
+        );
+        group.entries.forEach((entry, i) => {
+          resultsPerRequest[entry.index] = results[i];
+        });
       }),
     );
+
+    return resultsPerRequest;
   }
 
-  async #getPublicLogByTag(tag: Tag, contractAddress: AztecAddress): Promise<LogRetrievalResponse | null> {
-    const anchorBlockHash = await this.anchorBlockHeader.hash();
-    const allLogsPerTag = await getAllPublicLogsByTagsFromContract(
-      this.aztecNode,
-      contractAddress,
-      [tag],
-      anchorBlockHash,
-    );
-    const logsForTag = allLogsPerTag[0];
-
-    if (logsForTag.length === 0) {
-      return null;
-    } else if (logsForTag.length > 1) {
-      this.log.warn(
-        `Expected at most 1 public log for tag ${tag} and contract ${contractAddress.toString()}, got ${logsForTag.length}. This may indicate a contract bug. Returning the first log.`,
-      );
+  async #fetchPrivateLogs(requests: LogRetrievalRequest[], anchorBlockHash: BlockHash): Promise<LogResult[][]> {
+    const indices = requests.flatMap((r, i) => (r.source !== LogSource.PUBLIC ? [i] : []));
+    if (indices.length === 0) {
+      return requests.map(() => []);
     }
 
-    const scopedLog = logsForTag[0];
+    const resultsPerRequest: LogResult[][] = requests.map(() => []);
+    const groups = LogService.#groupByRange(indices.map(i => ({ index: i, request: requests[i] })));
 
-    return new LogRetrievalResponse(
-      scopedLog.logData.slice(1), // Skip the tag
-      scopedLog.txHash,
-      scopedLog.noteHashes,
-      scopedLog.firstNullifier,
+    await Promise.all(
+      Array.from(groups.values()).map(async group => {
+        const siloedTags = await Promise.all(
+          group.entries.map(e => SiloedTag.computeFromTagAndApp(e.request.tag, e.request.contractAddress)),
+        );
+        const results = await getAllPrivateLogsByTags(this.aztecNode, siloedTags, anchorBlockHash, {
+          fromBlock: group.fromBlock,
+          toBlock: group.toBlock,
+          includeEffects: true,
+        });
+        group.entries.forEach((entry, i) => {
+          resultsPerRequest[entry.index] = results[i];
+        });
+      }),
     );
+
+    return resultsPerRequest;
   }
 
-  async #getPrivateLogByTag(siloedTag: SiloedTag): Promise<LogRetrievalResponse | null> {
-    const anchorBlockHash = await this.anchorBlockHeader.hash();
-    const allLogsPerTag = await getAllPrivateLogsByTags(this.aztecNode, [siloedTag], anchorBlockHash);
-    const logsForTag = allLogsPerTag[0];
-
-    if (logsForTag.length === 0) {
-      return null;
-    } else if (logsForTag.length > 1) {
-      this.log.warn(
-        `Expected at most 1 private log for tag ${siloedTag}, got ${logsForTag.length}. This may indicate a contract bug. Returning the first log.`,
-      );
+  /**
+   * Groups requests by their (fromBlock, toBlock) range so each distinct range becomes a single node call with
+   * the range pushed down into the query (no in-memory filter).
+   */
+  static #groupByRange(
+    entries: Array<{ index: number; request: LogRetrievalRequest }>,
+  ): Map<RangeKey, { fromBlock?: BlockNumber; toBlock?: BlockNumber; entries: typeof entries }> {
+    const groups = new Map<RangeKey, { fromBlock?: BlockNumber; toBlock?: BlockNumber; entries: typeof entries }>();
+    for (const entry of entries) {
+      const key = rangeKey(entry.request.fromBlock, entry.request.toBlock);
+      const existing = groups.get(key);
+      if (existing) {
+        existing.entries.push(entry);
+      } else {
+        groups.set(key, { fromBlock: entry.request.fromBlock, toBlock: entry.request.toBlock, entries: [entry] });
+      }
     }
+    return groups;
+  }
 
-    const scopedLog = logsForTag[0];
-
+  static #toLogRetrievalResponse(log: LogResult): LogRetrievalResponse {
+    // includeEffects: true was used, so noteHashes and nullifiers are populated. Every tx has at least one nullifier
+    // (the first nullifier derived from the tx hash); empty here would indicate a buggy node.
+    const noteHashes = log.noteHashes!;
+    const nullifiers = log.nullifiers!;
+    if (nullifiers.length === 0) {
+      throw new Error(`Log for tx ${log.txHash} returned no nullifiers from the node`);
+    }
     return new LogRetrievalResponse(
-      scopedLog.logData.slice(1), // Skip the tag
-      scopedLog.txHash,
-      scopedLog.noteHashes,
-      scopedLog.firstNullifier,
+      log.logData.slice(1), // Skip the tag
+      log.txHash,
+      noteHashes,
+      nullifiers[0],
     );
   }
 
-  public async fetchTaggedLogs(contractAddress: AztecAddress, recipient: AztecAddress): Promise<PendingTaggedLog[]> {
+  public async fetchTaggedLogs(
+    contractAddress: AztecAddress,
+    recipient: AztecAddress,
+    providedSecrets: AppTaggingSecret[],
+  ): Promise<PendingTaggedLog[]> {
     this.log.verbose(`Fetching tagged logs for ${contractAddress.toString()}`);
 
-    // We only load logs from block up to and including the anchor block number
-    const anchorBlockNumber = this.anchorBlockHeader.getBlockNumber();
-    const anchorBlockHash = await this.anchorBlockHeader.hash();
-
     const l2Tips = await this.l2TipsStore.getL2Tips();
-    const currentTimestamp = this.anchorBlockHeader.globalVariables.timestamp;
-    // Get all secrets for this recipient (one per sender)
-    const secrets = await this.#getSecretsForSenders(contractAddress, recipient);
-
-    // Load logs for all sender-recipient pairs in parallel
-    const logArrays = await Promise.all(
-      secrets.map(secret =>
-        loadPrivateLogsForSenderRecipientPair(
-          secret,
-          this.aztecNode,
-          this.recipientTaggingStore,
-          anchorBlockNumber,
-          anchorBlockHash,
-          currentTimestamp,
-          l2Tips.finalized.block.number,
-          this.jobId,
-        ),
-      ),
+    // The secrets PXE derives or stores internally, plus any the app supplies explicitly for secrets PXE cannot
+    // enumerate itself (e.g. handshake-derived ones).
+    const secrets = [...(await this.#getSecretsForSenders(contractAddress, recipient)), ...providedSecrets];
+
+    const logs = await syncTaggedPrivateLogs(
+      secrets,
+      this.aztecNode,
+      this.recipientTaggingStore,
+      this.anchorBlockHeader,
+      l2Tips.finalized.block.number,
+      this.jobId,
     );
 
-    return logArrays
-      .flat()
-      .map(
-        scopedLog =>
-          new PendingTaggedLog(scopedLog.logData, scopedLog.txHash, scopedLog.noteHashes, scopedLog.firstNullifier),
-      );
+    return logs.map(log => {
+      const noteHashes = log.noteHashes!;
+      const nullifiers = log.nullifiers!;
+      if (nullifiers.length === 0) {
+        throw new Error(`Log for tx ${log.txHash} returned no nullifiers from the node`);
+      }
+      return new PendingTaggedLog(log.logData, log.txHash, noteHashes, nullifiers[0]);
+    });
   }
 
-  async #getSecretsForSenders(
-    contractAddress: AztecAddress,
-    recipient: AztecAddress,
-  ): Promise<ExtendedDirectionalAppTaggingSecret[]> {
+  async #getSecretsForSenders(contractAddress: AztecAddress, recipient: AztecAddress): Promise<AppTaggingSecret[]> {
     const recipientCompleteAddress = await this.addressStore.getCompleteAddress(recipient);
     if (!recipientCompleteAddress) {
       return [];
     }
     const recipientIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(recipient);
 
-    // We implicitly add all PXE accounts as senders, this helps us decrypt tags on notes that we send to ourselves
-    // (recipient = us, sender = us)
+    // We implicitly add all PXE accounts as senders, this helps us find tagged logs with messages that are sent to a
+    // local account (recipient = us, sender = us)
     const allSenders = [...(await this.senderAddressBookStore.getSenders()), ...(await this.keyStore.getAccounts())];
 
     // We deduplicate the senders by adding them to a set and then converting the set back to an array
@@ -170,7 +215,7 @@ export class LogService {
 
     return Promise.all(
       deduplicatedSenders.map(async sender => {
-        const secret = await ExtendedDirectionalAppTaggingSecret.compute(
+        const secret = await AppTaggingSecret.computeUnconstrained(
           recipientCompleteAddress,
           recipientIvsk,
           sender,

package/src/messages/message_context_service.ts

@@ -1,7 +1,8 @@
+import { uniqueBy } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
 import { MessageContext } from '@aztec/stdlib/logs';
-import { TxHash } from '@aztec/stdlib/tx';
+import { type IndexedTxEffect, TxHash } from '@aztec/stdlib/tx';
 
 /** Resolves transaction hashes into the context needed to process messages. */
 export class MessageContextService {
@@ -14,31 +15,48 @@ export class MessageContextService {
    * process messages that originated from that transaction. Returns `null` for tx hashes that are zero, not yet
    * available, or in blocks beyond the anchor block.
    */
-  getMessageContextsByTxHash(txHashes: Fr[], anchorBlockNumber: number): Promise<(MessageContext | null)[]> {
-    // TODO: optimize, we might be hitting the node to get the same txHash repeatedly
-    return Promise.all(
-      txHashes.map(async txHashField => {
-        // A zero tx hash indicates a tx-less offchain message (e.g. one not tied to any onchain transaction).
-        // These messages don't have a transaction context to resolve, so we return null.
-        if (txHashField.isZero()) {
-          return null;
-        }
+  async getMessageContextsByTxHash(txHashes: Fr[], anchorBlockNumber: number): Promise<(MessageContext | null)[]> {
+    const nonZeroTxHashes = txHashes.filter(h => !h.isZero()).map(h => TxHash.fromField(h));
+    const uniqueTxHashes = uniqueBy(nonZeroTxHashes, h => h.toString());
+    const fetched = await Promise.all(
+      uniqueTxHashes.map(h => this.aztecNode.getTxReceipt(h, { includeTxEffect: true })),
+    );
+    const txEffects = new Map(
+      uniqueTxHashes
+        .map((h, i): [string, IndexedTxEffect | undefined] => {
+          const receipt = fetched[i];
+          if (!receipt.isMined() || !receipt.txEffect) {
+            return [h.toString(), undefined];
+          }
+          return [
+            h.toString(),
+            {
+              data: receipt.txEffect,
+              l2BlockNumber: receipt.blockNumber,
+              l2BlockHash: receipt.blockHash,
+              txIndexInBlock: receipt.txIndexInBlock,
+              slotNumber: receipt.slotNumber,
+            },
+          ];
+        })
+        .filter((entry): entry is [string, IndexedTxEffect] => entry[1] !== undefined),
+    );
 
-        const txHash = TxHash.fromField(txHashField);
-        const txEffect = await this.aztecNode.getTxEffect(txHash);
-        if (!txEffect || txEffect.l2BlockNumber > anchorBlockNumber) {
-          return null;
-        }
+    return txHashes.map(txHashField => {
+      const txHash = TxHash.fromField(txHashField);
+      const txEffect = txEffects.get(txHash.toString());
+      if (!txEffect || txEffect.l2BlockNumber > anchorBlockNumber) {
+        return null;
+      }
 
-        // Every tx has at least one nullifier (the first nullifier derived from the tx hash). Hitting this condition
-        // would mean a buggy node, but since we need to access data.nullifiers[0], the defensive check does no harm.
-        const data = txEffect.data;
-        if (data.nullifiers.length === 0) {
-          throw new Error(`Tx effect for ${txHash} has no nullifiers`);
-        }
+      // Every tx has at least one nullifier (the first nullifier derived from the tx hash). Hitting this condition
+      // would mean a buggy node, but since we need to access data.nullifiers[0], the defensive check does no harm.
+      const data = txEffect.data;
+      if (data.nullifiers.length === 0) {
+        throw new Error(`Tx effect for ${txHash} has no nullifiers`);
+      }
 
-        return new MessageContext(data.txHash, data.noteHashes, data.nullifiers[0]);
-      }),
-    );
+      return new MessageContext(data.txHash, data.noteHashes, data.nullifiers[0]);
+    });
   }
 }