@aztec/pxe 0.0.1-commit.9ef841308 → 0.0.1-commit.a4600f49

package/src/events/private_event_filter_validator.ts

@@ -1,11 +1,14 @@
 import type { PrivateEventFilter } from '@aztec/aztec.js/wallet';
 import { INITIAL_L2_BLOCK_NUM } from '@aztec/constants';
 import { BlockNumber } from '@aztec/foundation/branded-types';
+import { createLogger } from '@aztec/foundation/log';
 
 import type { PrivateEventStoreFilter } from '../storage/private_event_store/private_event_store.js';
 
 export class PrivateEventFilterValidator {
-  constructor(private lastBlock: BlockNumber) {}
+  private readonly log = createLogger('pxe:private_event_filter_validator');
+
+  constructor(private readonly lastBlock: BlockNumber) {}
 
   validate(filter: PrivateEventFilter): PrivateEventStoreFilter {
     let { fromBlock, toBlock } = filter;
@@ -35,6 +38,23 @@ export class PrivateEventFilterValidator {
       throw new Error('toBlock must be strictly greater than fromBlock');
     }
 
+    // Cap the requested range to the synced block range. Without this, callers that pass a large
+    // toBlock (e.g. Number.MAX_SAFE_INTEGER as a "give me everything" idiom) would silently receive
+    // only the events that happen to be synced and believe they have complete coverage.
+    // We warn + cap rather than throw so callers don't need to query the last synced block before
+    // every request (which would also be unreliable, as the block can advance between the two calls).
+    const syncedUpperBound = BlockNumber(this.lastBlock + 1);
+    if (fromBlock >= syncedUpperBound) {
+      this.log.warn(
+        `Requested fromBlock ${fromBlock} is past last synced block ${this.lastBlock}; no events will be returned until PXE syncs further.`,
+      );
+    } else if (toBlock > syncedUpperBound) {
+      this.log.warn(
+        `Requested toBlock ${toBlock} exceeds last synced block ${this.lastBlock}; capping to ${syncedUpperBound}. Retry once PXE is further synced for complete coverage.`,
+      );
+      toBlock = syncedUpperBound;
+    }
+
     return {
       contractAddress: filter.contractAddress,
       scopes: filter.scopes,

package/src/hooks/authorize_utility_call.ts

@@ -0,0 +1,44 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { FunctionSelector } from '@aztec/stdlib/abi';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+
+/** Information about a cross-contract utility call that requires authorization. */
+export type UtilityCallAuthorizationRequest = {
+  /** The contract requesting the cross-contract call. */
+  caller: AztecAddress;
+  /** The contract class ID of the calling contract. */
+  callerClassId: Fr;
+  /** The target contract being called. */
+  target: AztecAddress;
+  /** The contract class ID of the target contract. */
+  targetClassId: Fr;
+  /** The function selector being invoked on the target. */
+  functionSelector: FunctionSelector;
+  /** The name of the function being called, from the contract artifact. */
+  functionName: string;
+  /** The serialized arguments passed to the function. */
+  args: Fr[];
+  /** The execution context from which the call originates. */
+  callerContext: 'private' | 'private view' | 'utility';
+};
+
+/** Authorization was granted. */
+type Authorized = { authorized: true };
+
+/** Authorization was denied. */
+type Denied = {
+  authorized: false;
+  /** Reason for denial, included in the error message. */
+  reason?: string;
+};
+
+/** Result of an authorization hook evaluation. */
+export type UtilityCallAuthorizationResponse = Authorized | Denied;
+
+/**
+ * Hook called when a utility function attempts a cross-contract call.
+ * Returns a response indicating whether the call is authorized and an optional denial reason.
+ */
+export type AuthorizeUtilityCall = (
+  request: UtilityCallAuthorizationRequest,
+) => Promise<UtilityCallAuthorizationResponse>;

package/src/hooks/execution_hooks.ts

@@ -0,0 +1,68 @@
+import type { AuthorizeUtilityCall } from './authorize_utility_call.js';
+import type { ResolveCustomRequest } from './resolve_custom_request.js';
+import type { ResolveTaggingSecretStrategy } from './resolve_tagging_secret_strategy.js';
+
+/**
+ * Hooks that PXE invokes during client-side simulation to gate or steer operations that the protocol
+ * does not restrict on its own. They give the wallet a chance to apply custom policies (e.g.
+ * prompting the user, consulting a dynamic allowlist, or inspecting call arguments) before the
+ * execution proceeds. All hooks are optional, and when a hook is absent PXE applies a safe default.
+ *
+ * For example, {@link authorizeUtilityCall} is called whenever a utility function makes a cross-contract call. A call
+ * made by a malicious contract could leak private information, so the hook lets the wallet decide, per-call, whether
+ * to allow it. A static allowlist would not work here because neither the app nor the wallet can predict ahead of
+ * time which contracts will be invoked during execution. Calls to standard contracts (such as the HandshakeRegistry)
+ * bypass this hook and are always authorized. When the hook is absent, cross-contract utility calls are denied.
+ *
+ * Note: hooks are unrelated to authentication witnesses (authwits). Authwits are an on-chain
+ * mechanism where a contract verifies that a caller was authorized by a specific account; hooks
+ * are a client-side PXE concern that gates execution before it proceeds.
+ *
+ * @example
+ * ```ts
+ * const pxe = await PXE.create({
+ *   // ...
+ *   hooks: {
+ *     authorizeUtilityCall: async (req) => {
+ *       // Allow calls to a known helper contract, deny everything else.
+ *       return req.target.equals(trustedHelper)
+ *         ? { authorized: true }
+ *         : { authorized: false, reason: 'Unknown target' };
+ *     },
+ *     // Apply per-recipient policy: reach a known contact via their address keys (no onchain trace) and use a
+ *     // non-interactive handshake for everyone else.
+ *     resolveTaggingSecretStrategy: async ({ recipient }) =>
+ *       knownContacts.has(recipient.toString())
+ *         ? { type: 'address-derived' }
+ *         : { type: 'non-interactive-handshake' },
+ *   },
+ * });
+ * ```
+ */
+export interface ExecutionHooks {
+  /** Called when a contract attempts a cross-contract utility call. Calls are denied when absent. */
+  authorizeUtilityCall?: AuthorizeUtilityCall;
+  /**
+   * Resolves a message's tagging secret when none is already established for the sender/recipient pair, letting the
+   * wallet apply per-recipient policy. PXE applies a default when absent.
+   * See {@link ResolveTaggingSecretStrategy} for the request shape and defaults.
+   */
+  resolveTaggingSecretStrategy?: ResolveTaggingSecretStrategy;
+  /**
+   * Resolves a custom, caller-defined request a circuit cannot serve from local state. Any contract can issue one, so
+   * an implementor should verify both the request `kind` and the issuing contract (its address and class ID) before
+   * fulfilling it. Rejected when absent; see {@link ResolveCustomRequest}.
+   */
+  resolveCustomRequest?: ResolveCustomRequest;
+}
+
+/**
+ * Builds an {@link ExecutionHooks} from individually-constructed hook callbacks. Returns `undefined`
+ * when every field is absent, so callers can unconditionally pass the result as `hooks`.
+ */
+export function composeHooks(hooks: ExecutionHooks): ExecutionHooks | undefined {
+  if (Object.values(hooks).every(v => v === undefined)) {
+    return undefined;
+  }
+  return hooks;
+}

package/src/hooks/index.ts

@@ -0,0 +1,12 @@
+export type {
+  AuthorizeUtilityCall,
+  UtilityCallAuthorizationRequest,
+  UtilityCallAuthorizationResponse,
+} from './authorize_utility_call.js';
+export { type ExecutionHooks, composeHooks } from './execution_hooks.js';
+export { type CustomRequest, type ResolveCustomRequest } from './resolve_custom_request.js';
+export {
+  type ResolveTaggingSecretStrategy,
+  type TaggingSecretStrategy,
+  type TaggingSecretStrategyRequest,
+} from './resolve_tagging_secret_strategy.js';

package/src/hooks/resolve_custom_request.ts

@@ -0,0 +1,24 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+
+/**
+ * A custom, caller-defined request resolved via the {@link ResolveCustomRequest} hook. It carries no fixed meaning:
+ * `kind` selects the request type so one hook can serve many such types, and `payload` holds the opaque,
+ * request-specific arguments. The resolver answers by whatever means it needs (local state, a third party,
+ * offchain data).
+ */
+export type CustomRequest = {
+  /** The address of the contract issuing the request. */
+  contractAddress: AztecAddress;
+  /** The issuing contract's class ID, so resolvers can apply class-level (not just per-address) policy. */
+  contractClassId: Fr;
+  /** Discriminates the request type, letting one hook serve many such types. */
+  kind: Fr;
+  /** Opaque, request-specific arguments. */
+  payload: Fr[];
+};
+
+/**
+ * Hook resolving a {@link CustomRequest}. The resolver produces the response however it needs to.
+ */
+export type ResolveCustomRequest = (request: CustomRequest) => Promise<Fr[]>;

package/src/hooks/resolve_tagging_secret_strategy.ts

@@ -0,0 +1,57 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { Point } from '@aztec/foundation/curves/grumpkin';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { AppTaggingSecretKind } from '@aztec/stdlib/logs';
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars -- only referenced by a {@link} doc tag
+import type { ResolveCustomRequest } from './resolve_custom_request.js';
+
+/**
+ * How a message's tagging secret is chosen: the wallet's strategy, returned by the `resolveTaggingSecretStrategy` hook
+ * when no onchain handshake has been registered for the sender/recipient pair. This is intent (plus, for an arbitrary
+ * secret, the raw material); PXE resolves it into the secret it hands the contract.
+ */
+export type TaggingSecretStrategy =
+  | {
+      /** Establish a fresh non-interactive handshake via the onchain registry; reveals the recipient onchain. */
+      type: 'non-interactive-handshake';
+    }
+  | {
+      /**
+       * Establish a fresh interactive handshake via the onchain registry. Reveals nothing about the recipient
+       * onchain, but requires the recipient to answer the registry's signed-authorization request (served through
+       * the {@link ResolveCustomRequest} hook), so the send fails when it cannot be served.
+       */
+      type: 'interactive-handshake';
+    }
+  | {
+      /** Derive the secret from the sender's and recipient's address keys via ECDH. PXE computes and silos it. */
+      type: 'address-derived';
+    }
+  | {
+      /**
+       * A raw shared secret point the two parties already share offchain (e.g. coordinated out-of-band), supplied by
+       * the wallet. PXE app-silos it before use. Only sound for unconstrained delivery, since nothing onchain proves
+       * the recipient knows it.
+       */
+      type: 'arbitrary-secret';
+      /** The raw (un-siloed) shared secret point to derive the tag from. */
+      secret: Point;
+    };
+
+/** Information about the message delivery requesting a tagging secret strategy. */
+export type TaggingSecretStrategyRequest = {
+  contractAddress: AztecAddress;
+  /**
+   * The contract class ID of the executing contract, so wallets can apply class-level (not just per-address) policy.
+   */
+  contractClassId: Fr;
+  sender: AztecAddress;
+  recipient: AztecAddress;
+  deliveryMode: AppTaggingSecretKind;
+};
+
+/**
+ * Hook returning the {@link TaggingSecretStrategy} for an outgoing message.
+ */
+export type ResolveTaggingSecretStrategy = (request: TaggingSecretStrategyRequest) => Promise<TaggingSecretStrategy>;