@aztec/pxe 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/src/contract_function_simulator/oracle/private_execution.ts

@@ -21,7 +21,7 @@ import { PrivateCircuitPublicInputs } from '@aztec/stdlib/kernel';
 import type { CircuitWitnessGenerationStats } from '@aztec/stdlib/stats';
 import { PrivateCallExecutionResult } from '@aztec/stdlib/tx';
 
-import { Oracle } from './oracle.js';
+import { buildACIRCallback } from './acir_callback.js';
 import type { PrivateExecutionOracle } from './private_execution_oracle.js';
 
 /**
@@ -43,10 +43,9 @@ export async function executePrivateFunction(
   const functionName = await privateExecutionOracle.getDebugFunctionName();
   log.verbose(`Executing private function ${functionName}`, { contract: contractAddress });
   const initialWitness = privateExecutionOracle.getInitialWitness(artifact);
-  const acvmCallback = new Oracle(privateExecutionOracle);
   const timer = new Timer();
   const acirExecutionResult = await simulator
-    .executeUserCircuit(initialWitness, artifact, acvmCallback.toACIRCallback())
+    .executeUserCircuit(initialWitness, artifact, buildACIRCallback(privateExecutionOracle))
     .catch((err: Error) => {
       err.message = resolveAssertionMessageFromError(err, artifact);
       throw new ExecutionError(

package/src/contract_function_simulator/oracle/private_execution_oracle.ts

@@ -16,8 +16,8 @@ import { PrivateContextInputs } from '@aztec/stdlib/kernel';
 import {
   AppTaggingSecret,
   AppTaggingSecretKind,
-  type ContractClassLog,
-  Tag,
+  ContractClassLog,
+  ContractClassLogFields,
   type TaggingIndexRange,
 } from '@aztec/stdlib/logs';
 import { Note, type NoteStatus } from '@aztec/stdlib/note';
@@ -29,24 +29,34 @@ import {
   type TxContext,
 } from '@aztec/stdlib/tx';
 
+import type { ResolveCustomRequest } from '../../hooks/resolve_custom_request.js';
+import {
+  DEFAULT_TAGGING_SECRET_STRATEGY,
+  type ResolveTaggingSecretStrategy,
+  type TaggingSecretStrategy,
+} from '../../hooks/resolve_tagging_secret_strategy.js';
 import { NoteService } from '../../notes/note_service.js';
+import { assertAllowedScope } from '../../storage/allowed_scopes.js';
 import type { SenderTaggingStore } from '../../storage/tagging_store/sender_tagging_store.js';
-import { syncSenderTaggingIndexes } from '../../tagging/index.js';
+import { logQueryAnchorOf, syncSenderTaggingIndexes } from '../../tagging/index.js';
 import type { ExecutionNoteCache } from '../execution_note_cache.js';
 import { ExecutionTaggingIndexCache } from '../execution_tagging_index_cache.js';
 import type { HashedValuesCache } from '../hashed_values_cache.js';
 import { BoundedVec } from '../noir-structs/bounded_vec.js';
+import type { ContractClassLogData } from '../noir-structs/contract_class_log_data.js';
+import type { NoteData } from '../noir-structs/note_data.js';
 import { Option } from '../noir-structs/option.js';
+import type { ResolvedTaggingStrategy } from '../noir-structs/resolved_tagging_strategy.js';
 import { pickNotes } from '../pick_notes.js';
-import type { IPrivateExecutionOracle, NoteData } from './interfaces.js';
+import type { IPrivateExecutionOracle } from './interfaces.js';
 import { executePrivateFunction } from './private_execution.js';
 import { UtilityExecutionOracle, type UtilityExecutionOracleArgs } from './utility_execution_oracle.js';
 
 /** Args for PrivateExecutionOracle constructor. */
-export type PrivateExecutionOracleArgs = Omit<UtilityExecutionOracleArgs, 'contractAddress'> & {
+export type PrivateExecutionOracleArgs = UtilityExecutionOracleArgs & {
   argsHash: Fr;
   txContext: TxContext;
-  callContext: CallContext;
+  txRequestSalt: Fr;
   executionCache: HashedValuesCache;
   noteCache: ExecutionNoteCache;
   taggingIndexCache: ExecutionTaggingIndexCache;
@@ -77,7 +87,7 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
 
   private readonly argsHash: Fr;
   private readonly txContext: TxContext;
-  private readonly callContext: CallContext;
+  private readonly txRequestSalt: Fr;
   private readonly executionCache: HashedValuesCache;
   private readonly noteCache: ExecutionNoteCache;
   private readonly taggingIndexCache: ExecutionTaggingIndexCache;
@@ -90,12 +100,11 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
   constructor(args: PrivateExecutionOracleArgs) {
     super({
       ...args,
-      contractAddress: args.callContext.contractAddress,
       log: args.log ?? createLogger('simulator:client_execution_context'),
     });
     this.argsHash = args.argsHash;
     this.txContext = args.txContext;
-    this.callContext = args.callContext;
+    this.txRequestSalt = args.txRequestSalt;
     this.executionCache = args.executionCache;
     this.noteCache = args.noteCache;
     this.taggingIndexCache = args.taggingIndexCache;
@@ -111,6 +120,7 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
       this.anchorBlockHeader,
       this.txContext,
       this.initialSideEffectCounter,
+      this.txRequestSalt,
     );
   }
 
@@ -181,58 +191,170 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
    * Returns the wallet-supplied default sender for tags, or `None` if no default was provided.
    */
   public getSenderForTags(): Promise<Option<AztecAddress>> {
-    return Promise.resolve(
-      this.defaultSenderForTags ? Option.some(this.defaultSenderForTags) : Option.none(AztecAddress.ZERO),
-    );
+    return Promise.resolve(this.defaultSenderForTags ? Option.some(this.defaultSenderForTags) : Option.none());
+  }
+
+  /**
+   * Resolves a custom, caller-defined request via the {@link ResolveCustomRequest} hook, which produces the response
+   * however it needs to. Throws when no hook is configured, since the request cannot be served.
+   */
+  public async resolveCustomRequest(kind: Fr, payload: Fr[]): Promise<Fr[]> {
+    const hook: ResolveCustomRequest | undefined = this.hooks?.resolveCustomRequest;
+    if (!hook) {
+      throw new Error('Cannot serve a request: no resolveCustomRequest hook is configured');
+    }
+    const contractClassId = await this.#getCurrentContractClassId(this.contractAddress);
+    return hook({ contractAddress: this.contractAddress, contractClassId, kind, payload });
+  }
+
+  /**
+   * Resolves the tagging strategy for a message via the wallet's {@link ResolveTaggingSecretStrategy} hook. The contract receives a ready-to-use {@link ResolvedTaggingStrategy}.
+   * When no hook is configured, applies a default: a non-interactive handshake, except for an unconstrained self-send,
+   * which uses an address-derived secret.
+   */
+  public async resolveTaggingStrategy(
+    sender: AztecAddress,
+    recipient: AztecAddress,
+    deliveryMode: AppTaggingSecretKind,
+  ): Promise<ResolvedTaggingStrategy> {
+    const [isUnconstrainedSelfSend, chosenStrategy] = await Promise.all([
+      this.#isUnconstrainedSelfSend(recipient, deliveryMode),
+      this.#chooseTaggingSecretStrategy(sender, recipient, deliveryMode),
+    ]);
+
+    // For unconstrained delivery, a self-send uses a local address-derived secret instead of a non-interactive
+    // handshake. A self-send is one where the wallet controls the recipient's keys, so both sides' keys are local: no
+    // handshake is needed and nothing is revealed onchain. It also avoids a recursion: a handshake self-delivers its
+    // note via unconstrained delivery, which would establish yet another handshake. This guard runs regardless of the
+    // resolved strategy (hook or default), to protect wallets from invalid configuration.
+    const strategy: TaggingSecretStrategy = isUnconstrainedSelfSend ? { type: 'address-derived' } : chosenStrategy;
+
+    return this.#resolveTaggingSecretStrategy(strategy, sender, recipient);
+  }
+
+  async #chooseTaggingSecretStrategy(
+    sender: AztecAddress,
+    recipient: AztecAddress,
+    deliveryMode: AppTaggingSecretKind,
+  ): Promise<TaggingSecretStrategy> {
+    const hook: ResolveTaggingSecretStrategy | undefined = this.hooks?.resolveTaggingSecretStrategy;
+    if (!hook) {
+      return DEFAULT_TAGGING_SECRET_STRATEGY;
+    }
+
+    const contractClassId = await this.#getCurrentContractClassId(this.contractAddress);
+    return hook({
+      contractAddress: this.contractAddress,
+      contractClassId,
+      sender,
+      recipient,
+      deliveryMode,
+    });
+  }
+
+  /**
+   * Resolves the class id the given contract runs at this simulation's anchor block. The instance no longer carries
+   * its class id (it is chain-derived), so it is resolved via the anchored contract data instead.
+   */
+  async #getCurrentContractClassId(address: AztecAddress): Promise<Fr> {
+    const classId = await this.anchoredContractData.getCurrentClassId(address);
+    if (classId === undefined) {
+      throw new Error(`Cannot resolve the current contract class for ${address}`);
+    }
+    return classId;
+  }
+
+  /** Whether this is an unconstrained delivery to one of the wallet's own accounts (a self-send). */
+  #isUnconstrainedSelfSend(recipient: AztecAddress, deliveryMode: AppTaggingSecretKind) {
+    return deliveryMode === AppTaggingSecretKind.UNCONSTRAINED
+      ? this.keyStore.hasAccount(recipient)
+      : Promise.resolve(false);
+  }
+
+  /** Resolves a wallet-provided {@link TaggingSecretStrategy} into the app-siloed secret handed to the contract. */
+  async #resolveTaggingSecretStrategy(
+    strategy: TaggingSecretStrategy,
+    sender: AztecAddress,
+    recipient: AztecAddress,
+  ): Promise<ResolvedTaggingStrategy> {
+    // PXE only performs the derivation; it does not reject a strategy that is unsound for the delivery mode (e.g. an
+    // address-derived or arbitrary-secret strategy for constrained delivery). That soundness check belongs in the
+    // Noir circuit, which constrains the resolved strategy against the delivery mode.
+    switch (strategy.type) {
+      case 'non-interactive-handshake':
+        return { type: 'non-interactive-handshake' };
+      case 'interactive-handshake':
+        return { type: 'interactive-handshake' };
+      case 'address-derived':
+        return this.#addressDerivedSecret(sender, recipient);
+      case 'arbitrary-secret': {
+        // App-silo the raw arbitrary secret point here so wallets never replicate the derivation.
+        const appTaggingSecret = await AppTaggingSecret.computeDirectional(
+          strategy.secret,
+          this.contractAddress,
+          recipient,
+        );
+        return { type: 'unconstrained-secret', secret: appTaggingSecret.secret };
+      }
+    }
+  }
+
+  /**
+   * The app-siloed, recipient-directional secret derived from the sender's and recipient's address keys via ECDH,
+   * ready to hand to the contract. Callers must validate the recipient in-circuit before reaching here, so an invalid one is unexpected.
+   */
+  async #addressDerivedSecret(sender: AztecAddress, recipient: AztecAddress): Promise<ResolvedTaggingStrategy> {
+    const secret = await this.getAppTaggingSecret(sender, recipient);
+    if (!secret.isSome()) {
+      throw new Error(`Cannot derive an address-derived tagging secret for invalid recipient ${recipient}`);
+    }
+    return { type: 'unconstrained-secret', secret: secret.value };
   }
 
   /**
-   * Returns the next app tag for a given sender and recipient pair (unconstrained delivery).
+   * Returns the sender-side app tagging secret for a `(sender, recipient)` pair.
    *
-   * The simulator computes the directional tagging secret (derived via ECDH from `(sender, recipient, contract)`),
-   * as well as the full siloed tag, and hands the opaque value back to the caller.
+   * The caller obtains an index via {@link getNextTaggingIndex} and computes the final tag itself.
+   * The only expected `None` case is an invalid recipient address; missing sender data fails while deriving.
    *
    * @param sender - The address sending the log
    * @param recipient - The address receiving the log
-   * @returns An app tag to be used in a log.
+   * @returns The app tagging secret, or `None` if the recipient is invalid.
    */
-  public async getNextAppTagAsSender(sender: AztecAddress, recipient: AztecAddress): Promise<Tag> {
-    const extendedSecret = await this.#calculateAppTaggingSecret(this.contractAddress, sender, recipient);
+  public async getAppTaggingSecret(sender: AztecAddress, recipient: AztecAddress): Promise<Option<Fr>> {
+    assertAllowedScope(sender, this.scopes);
+
+    const senderCompleteAddress = await this.getCompleteAddressOrFail(sender);
+    const senderIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(sender);
+    const extendedSecret = await AppTaggingSecret.computeViaEcdh(
+      senderCompleteAddress,
+      senderIvsk,
+      recipient,
+      this.contractAddress,
+      recipient,
+    );
 
     if (!extendedSecret) {
-      // We'd only fail to compute an extended secret if the recipient is an invalid address. To prevent
-      // king-of-the-hill attacks, instead of failing we use a random tag. By including a correct-looking tag in the
-      // log, the transaction shape is preserved and no privacy is leaked, even if the tag is bogus.
-      this.logger.warn(`Computing a tag for invalid recipient ${recipient} - returning a random tag instead`, {
+      this.logger.warn(`Computing a tagging secret for invalid recipient ${recipient} - returning no secret`, {
         contractAddress: this.contractAddress,
       });
-      return Tag.random();
+      return Option.none();
     }
 
-    const index = await this.#reserveNextIndexForSecret(extendedSecret);
-    this.logger.debug(
-      `Incrementing tagging index for sender: ${sender}, recipient: ${recipient}, contract: ${this.contractAddress} to ${index}`,
-    );
-
-    return Tag.compute({ extendedSecret, index });
+    return Option.some(extendedSecret.secret);
   }
 
   /**
-   * Returns the next sender-side index for a constrained-delivery app-siloed shared secret.
-   *
-   * Unlike the unconstrained variant, the simulator does not compute the secret: it was supplied by the calling contract
-   * (which retrieved it from an onchain handshake registry). The simulator only acts as a per-secret index counter.
-   * The caller computes the onchain tag itself.
+   * Returns the next sender-side tagging index for a given secret and delivery mode.
    *
-   * @param appSiloedSecret - The app-siloed shared secret retrieved from the handshake registry by the caller.
+   * @param secret - The tagging secret to allocate an index for.
+   * @param kind - The sender-side index namespace.
    * @returns The next index to use for this secret.
    */
-  public async getNextConstrainedTaggingIndex(appSiloedSecret: Fr): Promise<number> {
-    const secret = new AppTaggingSecret(appSiloedSecret, this.contractAddress, AppTaggingSecretKind.CONSTRAINED);
-    const index = await this.#reserveNextIndexForSecret(secret);
-    this.logger.debug(
-      `Incrementing tagging index for constrained-delivery secret in contract ${this.contractAddress} to ${index}`,
-    );
+  public async getNextTaggingIndex(secret: Fr, kind: AppTaggingSecretKind): Promise<number> {
+    const appTaggingSecret = new AppTaggingSecret(secret, this.contractAddress, kind);
+    const index = await this.#reserveNextIndexForSecret(appTaggingSecret);
+    this.logger.debug(`Incrementing ${kind} tagging index for secret in contract ${this.contractAddress} to ${index}`);
     return index;
   }
 
@@ -243,18 +365,6 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
     return index;
   }
 
-  async #calculateAppTaggingSecret(contractAddress: AztecAddress, sender: AztecAddress, recipient: AztecAddress) {
-    const senderCompleteAddress = await this.getCompleteAddressOrFail(sender);
-    const senderIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(sender);
-    return AppTaggingSecret.computeUnconstrained(
-      senderCompleteAddress,
-      senderIvsk,
-      recipient,
-      contractAddress,
-      recipient,
-    );
-  }
-
   async #getIndexToUseForSecret(secret: AppTaggingSecret): Promise<number> {
     // If we have the tagging index in the cache, we use it. If not we obtain it from the execution data provider.
     const lastUsedIndexInTx = this.taggingIndexCache.getLastUsedIndex(secret);
@@ -265,11 +375,16 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
       // This is a tagging secret we've not yet used in this tx, so first sync our store to make sure its indices
       // are up to date. We do this here because this store is not synced as part of the global sync because
       // that'd be wasteful as most tagging secrets are not used in each tx.
+      const [{ finalized }, anchor] = await Promise.all([
+        this.l2TipsStore.getL2Tips(),
+        logQueryAnchorOf(this.anchorBlockHeader),
+      ]);
       await syncSenderTaggingIndexes(
         secret,
         this.aztecNode,
         this.senderTaggingStore,
-        await this.anchorBlockHeader.hash(),
+        finalized.block.number,
+        anchor,
         this.jobId,
       );
 
@@ -488,10 +603,15 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
    * Emit a contract class log.
    * This fn exists because we only carry a poseidon hash through the kernels, and need to
    * keep the preimage in ts for later.
-   * @param log - The contract class log to be emitted.
+   * @param logData - The contract class log to be emitted.
    * @param counter - The contract class log's counter.
    */
-  public notifyCreatedContractClassLog(log: ContractClassLog, counter: number) {
+  public notifyCreatedContractClassLog(logData: ContractClassLogData, counter: number) {
+    const log = ContractClassLog.from({
+      contractAddress: logData.contractAddress,
+      fields: new ContractClassLogFields(logData.fields),
+      emittedLength: logData.emittedLength,
+    });
     this.contractClassLogs.push(new CountedContractClassLog(log, counter));
     const text = log.toBuffer().toString('hex');
     this.logger.verbose(
@@ -549,10 +669,16 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
       this.scopes,
     );
 
-    const targetArtifact = await this.contractStore.getFunctionArtifactWithDebugMetadata(
+    const targetArtifact = await this.anchoredContractData.getFunctionArtifactWithDebugMetadata(
       targetContractAddress,
       functionSelector,
     );
+    if (!targetArtifact) {
+      throw new Error(
+        `Cannot call ${targetContractAddress}:${functionSelector}: the contract is not registered. ` +
+          `Register it via wallet.registerContract(...).`,
+      );
+    }
 
     const derivedTxContext = this.txContext.clone();
 
@@ -561,6 +687,7 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
     const privateExecutionOracle = new PrivateExecutionOracle({
       argsHash,
       txContext: derivedTxContext,
+      txRequestSalt: this.txRequestSalt,
       callContext: derivedCallContext,
       anchorBlockHeader: this.anchorBlockHeader,
       utilityExecutor: this.utilityExecutor,
@@ -569,17 +696,18 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
       executionCache: this.executionCache,
       noteCache: this.noteCache,
       taggingIndexCache: this.taggingIndexCache,
-      contractStore: this.contractStore,
+      anchoredContractData: this.anchoredContractData,
       noteStore: this.noteStore,
       keyStore: this.keyStore,
       addressStore: this.addressStore,
       aztecNode: this.aztecNode,
       senderTaggingStore: this.senderTaggingStore,
       recipientTaggingStore: this.recipientTaggingStore,
-      senderAddressBookStore: this.senderAddressBookStore,
+      taggingSecretSourcesStore: this.taggingSecretSourcesStore,
       capsuleService: this.capsuleService,
+      factService: this.factService,
       privateEventStore: this.privateEventStore,
-      messageContextService: this.messageContextService,
+      txResolver: this.txResolver,
       contractSyncService: this.contractSyncService,
       jobId: this.jobId,
       totalPublicCalldataCount: this.totalPublicCalldataCount,
@@ -590,6 +718,7 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
       simulator: this.simulator,
       hooks: this.hooks,
       l2TipsStore: this.l2TipsStore,
+      transientArrayService: this.transientArrayService,
     });
 
     const setupTime = simulatorSetupTimer.ms();
@@ -671,7 +800,7 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
   }
 
   public getDebugFunctionName() {
-    return this.contractStore.getDebugFunctionName(this.contractAddress, this.callContext.functionSelector);
+    return this.anchoredContractData.getDebugFunctionName(this.contractAddress, this.callContext.functionSelector);
   }
 
   protected override get callerContext() {