@aztec/pxe 0.0.1-commit.42ee6df9b → 0.0.1-commit.431c48d

package/dest/contract_function_simulator/oracle/private_execution_oracle.js

@@ -1,17 +1,21 @@
 import { MAX_FR_CALLDATA_TO_ALL_ENQUEUED_CALLS, PRIVATE_CONTEXT_INPUTS_LENGTH } from '@aztec/constants';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { createLogger } from '@aztec/foundation/log';
+import { allToCompletion } from '@aztec/foundation/promise';
 import { Timer } from '@aztec/foundation/timer';
 import { toACVMWitness } from '@aztec/simulator/client';
 import { FunctionSelector, countArgumentsSize } from '@aztec/stdlib/abi';
 import { siloNullifier } from '@aztec/stdlib/hash';
 import { PrivateContextInputs } from '@aztec/stdlib/kernel';
-import { ExtendedDirectionalAppTaggingSecret } from '@aztec/stdlib/logs';
-import { Tag } from '@aztec/stdlib/logs';
+import { AppTaggingSecret, AppTaggingSecretKind, ContractClassLog, ContractClassLogFields } from '@aztec/stdlib/logs';
 import { Note } from '@aztec/stdlib/note';
 import { CallContext, CountedContractClassLog, NoteAndSlot } from '@aztec/stdlib/tx';
+import { DEFAULT_TAGGING_SECRET_STRATEGY } from '../../hooks/resolve_tagging_secret_strategy.js';
 import { NoteService } from '../../notes/note_service.js';
-import { syncSenderTaggingIndexes } from '../../tagging/index.js';
+import { assertAllowedScope } from '../../storage/allowed_scopes.js';
+import { logQueryAnchorOf, syncSenderTaggingIndexes } from '../../tagging/index.js';
+import { BoundedVec } from '../noir-structs/bounded_vec.js';
+import { Option } from '../noir-structs/option.js';
 import { pickNotes } from '../pick_notes.js';
 import { executePrivateFunction } from './private_execution.js';
 import { UtilityExecutionOracle } from './utility_execution_oracle.js';
@@ -32,37 +36,32 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
     nestedExecutionResults = [];
     argsHash;
     txContext;
-    callContext;
-    utilityExecutor;
+    txRequestSalt;
     executionCache;
     noteCache;
     taggingIndexCache;
     senderTaggingStore;
     totalPublicCalldataCount;
-    sideEffectCounter;
-    senderForTags;
-    simulator;
+    initialSideEffectCounter;
+    /** Sender for tags passed in at oracle construction time. Returned by `getSenderForTags`. */ defaultSenderForTags;
     constructor(args){
         super({
             ...args,
-            contractAddress: args.callContext.contractAddress,
             log: args.log ?? createLogger('simulator:client_execution_context')
         });
         this.argsHash = args.argsHash;
         this.txContext = args.txContext;
-        this.callContext = args.callContext;
-        this.utilityExecutor = args.utilityExecutor;
+        this.txRequestSalt = args.txRequestSalt;
         this.executionCache = args.executionCache;
         this.noteCache = args.noteCache;
         this.taggingIndexCache = args.taggingIndexCache;
         this.senderTaggingStore = args.senderTaggingStore;
         this.totalPublicCalldataCount = args.totalPublicCalldataCount ?? 0;
-        this.sideEffectCounter = args.sideEffectCounter ?? 0;
-        this.senderForTags = args.senderForTags;
-        this.simulator = args.simulator;
+        this.initialSideEffectCounter = args.sideEffectCounter ?? 0;
+        this.defaultSenderForTags = args.senderForTags;
     }
     getPrivateContextInputs() {
-        return new PrivateContextInputs(this.callContext, this.anchorBlockHeader, this.txContext, this.sideEffectCounter);
+        return new PrivateContextInputs(this.callContext, this.anchorBlockHeader, this.txContext, this.initialSideEffectCounter, this.txRequestSalt);
     }
     // We still need this function until we can get user-defined ordering of structs for fn arguments
     // TODO When that is sorted out on noir side, we can use instead the utilities in serialize.ts
@@ -116,53 +115,149 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
    * for a tag in order to emit a log. Constrained tagging should not use this as there is no
    * guarantee that the recipient knows about the sender, and hence about the shared secret.
    *
-   * The value persists through nested calls, meaning all calls down the stack will use the same
-   * 'senderForTags' value (unless it is replaced).
+   * Returns the wallet-supplied default sender for tags, or `None` if no default was provided.
    */ getSenderForTags() {
-        return Promise.resolve(this.senderForTags);
+        return Promise.resolve(this.defaultSenderForTags ? Option.some(this.defaultSenderForTags) : Option.none());
     }
     /**
-   * Set the sender for tags.
-   *
-   * This unconstrained value is used as the sender when computing an unconstrained shared secret
-   * for a tag in order to emit a log. Constrained tagging should not use this as there is no
-   * guarantee that the recipient knows about the sender, and hence about the shared secret.
-   *
-   * Account contracts typically set this value before calling other contracts. The value persists
-   * through nested calls, meaning all calls down the stack will use the same 'senderForTags'
-   * value (unless it is replaced by another call to this setter).
-   */ setSenderForTags(senderForTags) {
-        this.senderForTags = senderForTags;
-        return Promise.resolve();
+   * Resolves a custom, caller-defined request via the {@link ResolveCustomRequest} hook, which produces the response
+   * however it needs to. Throws when no hook is configured, since the request cannot be served.
+   */ async resolveCustomRequest(kind, payload) {
+        const hook = this.hooks?.resolveCustomRequest;
+        if (!hook) {
+            throw new Error('Cannot serve a request: no resolveCustomRequest hook is configured');
+        }
+        const contractClassId = await this.#getCurrentContractClassId(this.contractAddress);
+        return hook({
+            contractAddress: this.contractAddress,
+            contractClassId,
+            kind,
+            payload
+        });
+    }
+    /**
+   * Resolves the tagging strategy for a message via the wallet's {@link ResolveTaggingSecretStrategy} hook. The contract receives a ready-to-use {@link ResolvedTaggingStrategy}.
+   * When no hook is configured, applies a default: a non-interactive handshake, except for an unconstrained self-send,
+   * which uses an address-derived secret.
+   */ async resolveTaggingStrategy(sender, recipient, deliveryMode) {
+        const [isUnconstrainedSelfSend, chosenStrategy] = await allToCompletion([
+            this.#isUnconstrainedSelfSend(recipient, deliveryMode),
+            this.#chooseTaggingSecretStrategy(sender, recipient, deliveryMode)
+        ]);
+        // For unconstrained delivery, a self-send uses a local address-derived secret instead of a non-interactive
+        // handshake. A self-send is one where the wallet controls the recipient's keys, so both sides' keys are local: no
+        // handshake is needed and nothing is revealed onchain. It also avoids a recursion: a handshake self-delivers its
+        // note via unconstrained delivery, which would establish yet another handshake. This guard runs regardless of the
+        // resolved strategy (hook or default), to protect wallets from invalid configuration.
+        const strategy = isUnconstrainedSelfSend ? {
+            type: 'address-derived'
+        } : chosenStrategy;
+        return this.#resolveTaggingSecretStrategy(strategy, sender, recipient);
+    }
+    async #chooseTaggingSecretStrategy(sender, recipient, deliveryMode) {
+        const hook = this.hooks?.resolveTaggingSecretStrategy;
+        if (!hook) {
+            return DEFAULT_TAGGING_SECRET_STRATEGY;
+        }
+        const contractClassId = await this.#getCurrentContractClassId(this.contractAddress);
+        return hook({
+            contractAddress: this.contractAddress,
+            contractClassId,
+            sender,
+            recipient,
+            deliveryMode
+        });
+    }
+    /**
+   * Resolves the class id the given contract runs at this simulation's anchor block. The instance no longer carries
+   * its class id (it is chain-derived), so it is resolved via the anchored contract data instead.
+   */ async #getCurrentContractClassId(address) {
+        const classId = await this.anchoredContractData.getCurrentClassId(address);
+        if (classId === undefined) {
+            throw new Error(`Cannot resolve the current contract class for ${address}`);
+        }
+        return classId;
+    }
+    /** Whether this is an unconstrained delivery to one of the wallet's own accounts (a self-send). */ #isUnconstrainedSelfSend(recipient, deliveryMode) {
+        return deliveryMode === AppTaggingSecretKind.UNCONSTRAINED ? this.keyStore.hasAccount(recipient) : Promise.resolve(false);
+    }
+    /** Resolves a wallet-provided {@link TaggingSecretStrategy} into the app-siloed secret handed to the contract. */ async #resolveTaggingSecretStrategy(strategy, sender, recipient) {
+        // PXE only performs the derivation; it does not reject a strategy that is unsound for the delivery mode (e.g. an
+        // address-derived or arbitrary-secret strategy for constrained delivery). That soundness check belongs in the
+        // Noir circuit, which constrains the resolved strategy against the delivery mode.
+        switch(strategy.type){
+            case 'non-interactive-handshake':
+                return {
+                    type: 'non-interactive-handshake'
+                };
+            case 'interactive-handshake':
+                return {
+                    type: 'interactive-handshake'
+                };
+            case 'address-derived':
+                return this.#addressDerivedSecret(sender, recipient);
+            case 'arbitrary-secret':
+                {
+                    // App-silo the raw arbitrary secret point here so wallets never replicate the derivation.
+                    const appTaggingSecret = await AppTaggingSecret.computeDirectional(strategy.secret, this.contractAddress, recipient);
+                    return {
+                        type: 'unconstrained-secret',
+                        secret: appTaggingSecret.secret
+                    };
+                }
+        }
+    }
+    /**
+   * The app-siloed, recipient-directional secret derived from the sender's and recipient's address keys via ECDH,
+   * ready to hand to the contract. Callers must validate the recipient in-circuit before reaching here, so an invalid one is unexpected.
+   */ async #addressDerivedSecret(sender, recipient) {
+        const secret = await this.getAppTaggingSecret(sender, recipient);
+        if (!secret.isSome()) {
+            throw new Error(`Cannot derive an address-derived tagging secret for invalid recipient ${recipient}`);
+        }
+        return {
+            type: 'unconstrained-secret',
+            secret: secret.value
+        };
     }
     /**
-   * Returns the next app tag for a given sender and recipient pair.
+   * Returns the sender-side app tagging secret for a `(sender, recipient)` pair.
+   *
+   * The caller obtains an index via {@link getNextTaggingIndex} and computes the final tag itself.
+   * The only expected `None` case is an invalid recipient address; missing sender data fails while deriving.
+   *
    * @param sender - The address sending the log
    * @param recipient - The address receiving the log
-   * @returns An app tag to be used in a log.
-   */ async getNextAppTagAsSender(sender, recipient) {
-        const extendedSecret = await this.#calculateExtendedDirectionalAppTaggingSecret(this.contractAddress, sender, recipient);
+   * @returns The app tagging secret, or `None` if the recipient is invalid.
+   */ async getAppTaggingSecret(sender, recipient) {
+        assertAllowedScope(sender, this.scopes);
+        const senderCompleteAddress = await this.getCompleteAddressOrFail(sender);
+        const senderIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(sender);
+        const extendedSecret = await AppTaggingSecret.computeViaEcdh(senderCompleteAddress, senderIvsk, recipient, this.contractAddress, recipient);
         if (!extendedSecret) {
-            // We'd only fail to compute an extended secret if the recipient is an invalid address. To prevent
-            // king-of-the-hill attacks, instead of failing we use a random tag. By including a correct-looking tag in the
-            // log, the transaction shape is preserved and no privacy is leaked, even if the tag is bogus.
-            this.logger.warn(`Computing a tag for invalid recipient ${recipient} - returning a random tag instead`, {
+            this.logger.warn(`Computing a tagging secret for invalid recipient ${recipient} - returning no secret`, {
                 contractAddress: this.contractAddress
             });
-            return new Tag(Fr.random());
+            return Option.none();
         }
-        const index = await this.#getIndexToUseForSecret(extendedSecret);
-        this.logger.debug(`Incrementing tagging index for sender: ${sender}, recipient: ${recipient}, contract: ${this.contractAddress} to ${index}`);
-        this.taggingIndexCache.setLastUsedIndex(extendedSecret, index);
-        return Tag.compute({
-            extendedSecret,
-            index
-        });
+        return Option.some(extendedSecret.secret);
     }
-    async #calculateExtendedDirectionalAppTaggingSecret(contractAddress, sender, recipient) {
-        const senderCompleteAddress = await this.getCompleteAddressOrFail(sender);
-        const senderIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(sender);
-        return ExtendedDirectionalAppTaggingSecret.compute(senderCompleteAddress, senderIvsk, recipient, contractAddress, recipient);
+    /**
+   * Returns the next sender-side tagging index for a given secret and delivery mode.
+   *
+   * @param secret - The tagging secret to allocate an index for.
+   * @param kind - The sender-side index namespace.
+   * @returns The next index to use for this secret.
+   */ async getNextTaggingIndex(secret, kind) {
+        const appTaggingSecret = new AppTaggingSecret(secret, this.contractAddress, kind);
+        const index = await this.#reserveNextIndexForSecret(appTaggingSecret);
+        this.logger.debug(`Incrementing ${kind} tagging index for secret in contract ${this.contractAddress} to ${index}`);
+        return index;
+    }
+    /** Resolves the next index for a given tagging secret, syncing from chain if it is missing from the in-tx cache. */ async #reserveNextIndexForSecret(secret) {
+        const index = await this.#getIndexToUseForSecret(secret);
+        this.taggingIndexCache.setLastUsedIndex(secret, index);
+        return index;
     }
     async #getIndexToUseForSecret(secret) {
         // If we have the tagging index in the cache, we use it. If not we obtain it from the execution data provider.
@@ -173,7 +268,11 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
             // This is a tagging secret we've not yet used in this tx, so first sync our store to make sure its indices
             // are up to date. We do this here because this store is not synced as part of the global sync because
             // that'd be wasteful as most tagging secrets are not used in each tx.
-            await syncSenderTaggingIndexes(secret, this.aztecNode, this.senderTaggingStore, await this.anchorBlockHeader.hash(), this.jobId);
+            const [{ finalized }, anchor] = await allToCompletion([
+                this.l2TipsStore.getL2Tips(),
+                logQueryAnchorOf(this.anchorBlockHeader)
+            ]);
+            await syncSenderTaggingIndexes(secret, this.aztecNode, this.senderTaggingStore, finalized.block.number, anchor, this.jobId);
             const lastUsedIndex = await this.senderTaggingStore.getLastUsedIndex(secret, this.jobId);
             // If lastUsedIndex is undefined, we've never used this secret, so start from 0
             // Otherwise, the next index to use is one past the last used index
@@ -228,12 +327,12 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
    * @param offset - The starting index for pagination.
    * @param status - The status of notes to fetch.
    * @returns Array of note data.
-   */ async getNotes(owner, storageSlot, numSelects, selectByIndexes, selectByOffsets, selectByLengths, selectValues, selectComparators, sortByIndexes, sortByOffsets, sortByLengths, sortOrder, limit, offset, status) {
+   */ async getNotes(owner, storageSlot, numSelects, selectByIndexes, selectByOffsets, selectByLengths, selectValues, selectComparators, sortByIndexes, sortByOffsets, sortByLengths, sortOrder, limit, offset, status, maxNotes, packedHintedNoteLength) {
         // Nullified pending notes are already removed from the list.
-        const pendingNotes = this.noteCache.getNotes(this.callContext.contractAddress, owner, storageSlot);
+        const pendingNotes = this.noteCache.getNotes(this.callContext.contractAddress, owner.value, storageSlot);
         const pendingNullifiers = this.noteCache.getNullifiers(this.callContext.contractAddress);
         const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockHeader, this.jobId);
-        const dbNotes = await noteService.getNotes(this.callContext.contractAddress, owner, storageSlot, status, this.scopes);
+        const dbNotes = await noteService.getNotes(this.callContext.contractAddress, owner.value, storageSlot, status, this.scopes);
         const dbNotesFiltered = dbNotes.filter((n)=>!pendingNullifiers.has(n.siloedNullifier.value));
         const notes = pickNotes([
             ...dbNotesFiltered,
@@ -260,7 +359,11 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
             offset
         });
         this.logger.debug(`Returning ${notes.length} notes for ${this.callContext.contractAddress} at ${storageSlot}: ${notes.map((n)=>`${n.noteNonce.toString()}:[${n.note.items.map((i)=>i.toString()).join(',')}]`).join(', ')}`);
-        return notes;
+        return BoundedVec.from({
+            data: notes,
+            maxLength: maxNotes,
+            elementSize: packedHintedNoteLength
+        });
     }
     /**
    * Keep track of the new note created during execution.
@@ -336,9 +439,14 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
    * Emit a contract class log.
    * This fn exists because we only carry a poseidon hash through the kernels, and need to
    * keep the preimage in ts for later.
-   * @param log - The contract class log to be emitted.
+   * @param logData - The contract class log to be emitted.
    * @param counter - The contract class log's counter.
-   */ notifyCreatedContractClassLog(log, counter) {
+   */ notifyCreatedContractClassLog(logData, counter) {
+        const log = ContractClassLog.from({
+            contractAddress: logData.contractAddress,
+            fields: new ContractClassLogFields(logData.fields),
+            emittedLength: logData.emittedLength
+        });
         this.contractClassLogs.push(new CountedContractClassLog(log, counter));
         const text = log.toBuffer().toString('hex');
         this.logger.verbose(`Emitted log from ContractClassRegistry: "${text.length > 100 ? text.slice(0, 100) + '...' : text}"`);
@@ -365,13 +473,28 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
         const simulatorSetupTimer = new Timer();
         this.logger.debug(`Calling private function ${targetContractAddress}:${functionSelector} from ${this.callContext.contractAddress}`);
         isStaticCall = isStaticCall || this.callContext.isStaticCall;
-        await this.contractSyncService.ensureContractSynced(targetContractAddress, functionSelector, this.utilityExecutor, this.anchorBlockHeader, this.jobId, this.scopes);
-        const targetArtifact = await this.contractStore.getFunctionArtifactWithDebugMetadata(targetContractAddress, functionSelector);
+        await this.contractSyncService.ensureContractSynced({
+            contract: targetContractAddress,
+            functionToInvokeAfterSync: functionSelector,
+            utilityExecutor: this.utilityExecutor,
+            anchorBlockHeader: this.anchorBlockHeader,
+            jobId: this.jobId,
+            scopes: this.scopes,
+            triggeredBy: {
+                address: this.callContext.contractAddress,
+                selector: this.callContext.functionSelector
+            }
+        });
+        const targetArtifact = await this.anchoredContractData.getFunctionArtifactWithDebugMetadata(targetContractAddress, functionSelector);
+        if (!targetArtifact) {
+            throw new Error(`Cannot call ${targetContractAddress}:${functionSelector}: the contract is not registered. ` + `Register it via wallet.registerContract(...).`);
+        }
         const derivedTxContext = this.txContext.clone();
         const derivedCallContext = await this.deriveCallContext(targetContractAddress, targetArtifact, isStaticCall);
         const privateExecutionOracle = new PrivateExecutionOracle({
             argsHash,
             txContext: derivedTxContext,
+            txRequestSalt: this.txRequestSalt,
             callContext: derivedCallContext,
             anchorBlockHeader: this.anchorBlockHeader,
             utilityExecutor: this.utilityExecutor,
@@ -380,28 +503,34 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
             executionCache: this.executionCache,
             noteCache: this.noteCache,
             taggingIndexCache: this.taggingIndexCache,
-            contractStore: this.contractStore,
+            anchoredContractData: this.anchoredContractData,
             noteStore: this.noteStore,
             keyStore: this.keyStore,
             addressStore: this.addressStore,
             aztecNode: this.aztecNode,
             senderTaggingStore: this.senderTaggingStore,
             recipientTaggingStore: this.recipientTaggingStore,
-            senderAddressBookStore: this.senderAddressBookStore,
+            taggingSecretSourcesStore: this.taggingSecretSourcesStore,
             capsuleService: this.capsuleService,
+            factService: this.factService,
             privateEventStore: this.privateEventStore,
-            messageContextService: this.messageContextService,
+            txResolver: this.txResolver,
             contractSyncService: this.contractSyncService,
             jobId: this.jobId,
             totalPublicCalldataCount: this.totalPublicCalldataCount,
             sideEffectCounter,
             log: this.logger,
             scopes: this.scopes,
-            senderForTags: this.senderForTags,
-            simulator: this.simulator
+            senderForTags: this.defaultSenderForTags,
+            simulator: this.simulator,
+            hooks: this.hooks,
+            l2TipsStore: this.l2TipsStore,
+            transientArrayService: this.transientArrayService
         });
         const setupTime = simulatorSetupTimer.ms();
         const childExecutionResult = await executePrivateFunction(this.simulator, privateExecutionOracle, targetArtifact, targetContractAddress, functionSelector);
+        // Propagate the nested call's calldata count so the parent sees its increments on subsequent enqueues.
+        this.totalPublicCalldataCount = privateExecutionOracle.getTotalPublicCalldataCount();
         if (isStaticCall) {
             this.#checkValidStaticCall(childExecutionResult);
         }
@@ -427,6 +556,9 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
         }
         return Promise.resolve();
     }
+    getTotalPublicCalldataCount() {
+        return this.totalPublicCalldataCount;
+    }
     notifyRevertiblePhaseStart(minRevertibleSideEffectCounter) {
         return this.noteCache.setMinRevertibleSideEffectCounter(minRevertibleSideEffectCounter);
     }
@@ -443,6 +575,9 @@ import { UtilityExecutionOracle } from './utility_execution_oracle.js';
         return new CallContext(this.contractAddress, targetContractAddress, await FunctionSelector.fromNameAndParameters(targetArtifact.name, targetArtifact.parameters), isStaticCall);
     }
     getDebugFunctionName() {
-        return this.contractStore.getDebugFunctionName(this.contractAddress, this.callContext.functionSelector);
+        return this.anchoredContractData.getDebugFunctionName(this.contractAddress, this.callContext.functionSelector);
+    }
+    get callerContext() {
+        return this.callContext.isStaticCall ? 'private view' : 'private';
     }
 }