@bitpay-labs/bitcore-wallet-service 11.10.13 → 11.11.0

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.10.13",
+  "version": "11.11.0",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -24,7 +24,7 @@
   "scripts": {
     "start": "npm run clean && npm run build && ./start.sh",
     "stop": "./stop.sh",
-    "test": "npm run compile && mcr mocha ts_build/test",
+    "test": "npm run compile && mcr mocha ts_build/test/**/*.js",
     "build": "tsc && npm run cp:templates",
     "build:prod": "tsc -p tsconfig.prod.json && npm run cp:templates",
     "build:docker": "docker build -t bitpay/bitcore-wallet-service:latest -f ./Dockerfile ../..",
@@ -42,8 +42,8 @@
   },
   "dependencies": {
     "@bitpay-labs/bitcore-logging": "^11.10.9",
-    "@bitpay-labs/bitcore-tss": "^11.10.13",
-    "@bitpay-labs/crypto-wallet-core": "^11.10.13",
+    "@bitpay-labs/bitcore-tss": "^11.11.0",
+    "@bitpay-labs/crypto-wallet-core": "^11.11.0",
     "@sendgrid/mail": "6.5.4",
     "abi-decoder": "2.4.0",
     "async": "0.9.2",
@@ -107,5 +107,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "c51c900f0009f1237ef30dca2c35922381864491"
+  "gitHead": "df3d9a76fd7418767d2951fbbfce5a0c7c1db215"
 }

package/src/externalservices/moonpay.ts

@@ -447,7 +447,8 @@ export class MoonpayService {
           if (err) {
             return reject(err.body ? err.body : err);
           } else {
-            return resolve(data.body ? data.body : data);
+            const success = data.statusCode >= 200 && data.statusCode < 300;
+            return resolve(data.body ? data.body : { success });
           }
         }
       );
@@ -526,7 +527,10 @@ export class MoonpayService {
           if (err) {
             return reject(err.body ?? err);
           } else {
-            return resolve(data.body ?? data);
+            if (!data.body) {
+              return reject(new ClientError('Moonpay did not return a session'));
+            }
+            return resolve(data.body);
           }
         }
       );

package/src/lib/common/constants.ts

@@ -226,7 +226,7 @@ export const Constants = {
 
   // May be different from the defaults if we rollback
   // or want to beta test new versions.
-  TSS_KEYGEN_SCHEME_VERSION_MAX: 1.1,
+  TSS_KEYGEN_SCHEME_VERSION_MAX: 1.2,
   TSS_SIGGEN_SCHEME_VERSION_MAX: 1.1,
   
   TSS_KEYGEN_SCHEME_VERSION_MIN: 1,

package/src/lib/errors/errordefinitions.ts

@@ -82,6 +82,10 @@ interface Errors<T> {
   TSS_SESSION_EXPIRED: T;
   TSS_MISMATCH_VERSION: T;
   TSS_FINAL_SIGNATURE_MISMATCH: T;
+  TSS_INVALID_PARTY_DATA: T;
+  TSS_PARTY_ALREADY_REGISTERED: T;
+  TSS_ROUNDS_ALREADY_STARTED: T;
+  TSS_REGISTRATION_PENDING: T;
 };
 
 const errors: Errors<string> = {
@@ -159,6 +163,10 @@ const errors: Errors<string> = {
   TSS_SESSION_EXPIRED: 'TSS session has expired',
   TSS_MISMATCH_VERSION: 'TSS version does not match session version',
   TSS_FINAL_SIGNATURE_MISMATCH: 'Final signature does not match the one generated by the session',
+  TSS_INVALID_PARTY_DATA: 'Invalid party data',
+  TSS_PARTY_ALREADY_REGISTERED: 'Party already registered with a different party ID',
+  TSS_ROUNDS_ALREADY_STARTED: 'Rounds have already started',
+  TSS_REGISTRATION_PENDING: 'Awaiting registration by the session initiator',
 };
 
 const errorsObject = { codes: {} };

package/src/lib/model/tsskeygen.ts

@@ -44,10 +44,14 @@ export interface ITssKeyGenModel {
    */
   n: number;
   /**
-   * The list of public keys of the participants in the TSS key generation process.
-   * The pub keys are in partyId order.
+   * The list of copayer IDs of the participants in the TSS key generation process.
+   * They are in partyId order.
    */
   participants: Array<string>;
+  /**
+   * The list of authentication public keys corresponding to the participants in the TSS key generation process.
+   */
+  authPublicKeys: Array<string>;
   /**
    * An array of the rounds in round order. Each round is an array of messages
    */
@@ -89,6 +93,7 @@ export class TssKeyGenModel implements ITssKeyGenModel {
   id: string;
   n: number;
   participants: Array<string>;
+  authPublicKeys: Array<string>;
   rounds: Array<Array<{
     fromPartyId: number;
     messages: ITssKeyMessageObject;
@@ -135,9 +140,11 @@ export class TssKeyGenModel implements ITssKeyGenModel {
     x.schemeVersion = version || Defaults.TSS_KEYGEN_SCHEME_VERSION;
     x.n = n;
     x.participants = new Array(n);
-    x.participants[partyId] = copayerId;
+    x.participants[0] = copayerId; // caller's partyId is 0 (enforced above)
+    x.authPublicKeys = new Array(n);
+    x.authPublicKeys[0] = message.publicKey; // caller's partyId is 0 (enforced above)
     x.rounds = [[{
-      fromPartyId: partyId,
+      fromPartyId: 0, // caller's partyId is 0 (enforced above)
       messages: message
     }]];
     x.joinPassword = passwordHash;
@@ -154,6 +161,7 @@ export class TssKeyGenModel implements ITssKeyGenModel {
     x.schemeVersion = obj.schemeVersion;
     x.n = obj.n;
     x.participants = obj.participants;
+    x.authPublicKeys = obj.authPublicKeys;
     x.rounds = obj.rounds;
     x.sharedPublicKey = obj.sharedPublicKey;
     x.joinPassword = obj.joinPassword;

package/src/lib/routes/middleware/authRequest.ts

@@ -39,16 +39,13 @@ async function withSession(storage: Storage, opts): Promise<Copayer> {
         return reject(Errors.NOT_AUTHORIZED.withMessage('Session expired'));
       }
 
-      storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-        if (err) {
-          return reject(err);
-        }
+      storage.fetchCopayerLookup(opts.copayerId).then(copayer => {
         if (!copayer) {
           return reject(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
         }
 
         return resolve(copayer);
-      });
+      }).catch(err => reject(err));
     });
   });
 
@@ -60,17 +57,10 @@ async function withSignature(storage: Storage, opts): Promise<Copayer> {
     return;
   }
 
-  const copayer = await new Promise<Copayer>((resolve, reject) => {
-    storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-      if (err) {
-        return reject(err);
-      }
-      if (!copayer) {
-        return reject(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
-      }
-      return resolve(copayer);
-    });
-  });
+  const copayer = await storage.fetchCopayerLookup(opts.copayerId);
+  if (!copayer) {
+    throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found');
+  }
 
   const isValid = !!copayer.requestPubKeys.find(pubKey => Utils.verifyMessage(opts.message, opts.signature, pubKey.key));
   if (!isValid) {

package/src/lib/routes/middleware/authTssRequest.ts

@@ -5,15 +5,23 @@ import { Errors } from '../../errors/errordefinitions';
 import { WalletService, checkRequired } from '../../server';
 import { error } from '../helpers';
 import { getCredentials, getMessage } from './authRequest';
-import type { TssKeyGenModel } from '../../model/tsskeygen';
-import type { TssSigGenModel } from '../../model/tsssign';
+import type { ITssKeyMessageObject, TssKeyGenModel } from '../../model/tsskeygen';
+import type { ITssSigMessageObject, TssSigGenModel } from '../../model/tsssign';
+
+function verifyMessage(req: express.Request, signature: string, pubKey: string) {
+  const message = getMessage(req);
+  const isValid = !!Utils.verifyMessage(message, signature, pubKey);
+  if (!isValid) {
+    throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+  }
+}
 
 /**
- * Middleware to authenticate TSS requests and attach the TSS session to the request.
+ * Middleware to authenticate TSS key generation requests and attach the TSS session to the request.
  * It checks if the request has valid credentials, verifies the signature,
  * and retrieves the TSS session based on the request path.
  */
-export function authTssRequest(): express.RequestHandler {
+export function authTssKeyGenRequest(): express.RequestHandler {
   return async function(req, res, next) {
     try {
       const storage = WalletService.getStorage();
@@ -28,37 +36,74 @@ export function authTssRequest(): express.RequestHandler {
       } = credentials;
       
       const { id } = req.params as { [key: string]: string };
+      const body = req.body as { message: ITssKeyMessageObject | undefined };
 
-      let session: TssKeyGenModel | TssSigGenModel | null = null;
-      let partyId = null;
-      let pubKey = null;
-      if (req.path.includes('/tss/keygen/')) {
-        session = await storage.fetchTssKeyGenSession({ id });
-        partyId = session?.participants.indexOf(copayerId);
-        pubKey = partyId > -1 ? session.rounds[0].find(r => r.fromPartyId === partyId)?.messages.publicKey : null;
-      } else if (req.path.includes('/tss/sign/')) {
-        session = await storage.fetchTssSigSession({ id });
-        partyId = session?.participants.find(p => p.copayerId === copayerId)?.partyId;
-        pubKey = partyId == null ? null : session?.rounds[0]?.find(r => r.fromPartyId === partyId)?.messages.publicKey;
-      } else {
-        throw new Error('Unknown TSS request path: ' + req.path);
-      }
+      // Note: the copayer is not fetched from the db here bc it's not stored
+      //  until the key generation session is done and the wallet gets created.
 
+      const session: TssKeyGenModel = await storage.fetchTssKeyGenSession({ id });
       if (!session) {
-        throw Errors.NOT_AUTHORIZED.withMessage('Session not found');
-      }
-      if (!pubKey) {
-        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+        // This is a brand new session. Caller should be party 0 with the initial round message.
+        if (body?.message?.round === 0 && body?.message?.partyId === 0) {
+          const pubKey = body?.message?.publicKey;
+          verifyMessage(req, signature, pubKey); // Self verification, but at least ensures that the caller owns the message's private key
+          return next();
+        } else {
+          // Session should have been initialized by the client already in BWC > TssKeyGen.newKey()
+          throw Errors.NOT_AUTHORIZED.withMessage('Session not found');
+        }
       }
+
       if (session.isExpired()) {
         throw Errors.TSS_SESSION_EXPIRED;
       }
 
-      const message = getMessage(req);
-      const isValid = !!Utils.verifyMessage(message, signature, pubKey);
-      if (!isValid) {
-        throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+      const isRound0Msg = body?.message?.round === 0;
+      const awaitingJoiners = session.participants.some(p => !p); // session.participants is initiated with n slots (initally null) that get populated as participants join
+      const participantIdx = session.participants.indexOf(copayerId); // equals -1 if the copayer has not joined yet
+      if (participantIdx === -1 && session.schemeVersion >= 1.2) {
+        // Check session.authPublicKeys to ensure initiator registered this participant
+        const msgPubKey = body?.message?.publicKey;
+        if (!msgPubKey) {
+          throw Errors.NOT_AUTHORIZED;
+        }
+        const _participantIdx = session.authPublicKeys.indexOf(msgPubKey);
+        if (_participantIdx === -1) {
+          throw Errors.NOT_AUTHORIZED;
+        }
+        if (session.participants[_participantIdx]) {
+          throw Errors.NOT_AUTHORIZED;
+        }
+      }
+      const partyId = participantIdx > -1
+        ? participantIdx
+        : (awaitingJoiners && isRound0Msg)
+          ? body?.message?.partyId // if participant has not joined session yet, use the partyId from the initial round message (verified below)
+          : -1;
+      
+      if (partyId < 0 || partyId >= session.n || !Number.isInteger(partyId)) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+      }
+
+      let pubKey: string = null;
+      if (session?.schemeVersion <= 1.1) {
+        // session.authPublicKeys was not added until 1.2, so fetch public key from the first round messages instead (old way)
+        pubKey = session.rounds[0].find(r => r.fromPartyId === partyId)?.messages.publicKey;
+        if (!pubKey && participantIdx === -1) {
+          // Joining party hasn't submitted its round 0 message yet and legacy sessions have no registration,
+          //  so use the joining message's public key (verifyTssMessage verifies the message's payload against it)
+          pubKey = body?.message?.publicKey;
+        }
+      } else {
+        // authPublicKeys is set by the session leader, so this will verify that the leader and the calling participant here are on the same page
+        pubKey = session?.authPublicKeys[partyId];
+      }
+
+      if (!pubKey) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
       }
+
+      verifyMessage(req, signature, pubKey);
     
       req.session = session;
       return next();
@@ -69,4 +114,63 @@ export function authTssRequest(): express.RequestHandler {
       return error.returnError(new ClientError({ code: 'INTERNAL_ERROR' }), res, req);
     }
   };
+};
+
+export function authTssSignRequest(): express.RequestHandler {
+  return async function(req, res, next) {
+    try {
+      const storage = WalletService.getStorage();
+      const credentials = getCredentials(req);
+      if (!checkRequired(credentials, ['copayerId', 'signature'])) {
+        throw Errors.NOT_AUTHORIZED;
+      }
+    
+      const {
+        copayerId,
+        signature
+      } = credentials;
+      
+      const { id } = req.params as { [key: string]: string };
+      const body = req.body as { message: ITssSigMessageObject | undefined };
+      // Only some requests carry a body.message (e.g. POST /store only sends the final signature).
+      //  Omitting it is safe since routes that don't receive a message don't consume one.
+      const verifyMsg = !!body?.message;
+
+      const copayer = await storage.fetchCopayerLookup(copayerId);
+      if (!copayer) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found');
+      }
+      const pubKey = copayer.requestPubKeys[0].key;
+      if (verifyMsg && pubKey !== body?.message?.publicKey) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Invalid public key');
+      }
+
+      const session: TssSigGenModel = await storage.fetchTssSigSession({ id });
+      // If !session, it needs to be initiated
+      if (session) {
+        if (session.isExpired()) {
+          throw Errors.TSS_SESSION_EXPIRED;
+        }
+        const party = session.participants.find(p => p.copayerId === copayerId);
+        if (!party) {
+          throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+        }
+        if (verifyMsg && party.partyId !== body?.message?.partyId) {
+          throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+        }
+
+        req.session = session;
+      } else if (body?.message?.round !== 0) {
+        throw Errors.TSS_SESSION_NOT_FOUND;
+      }
+      
+      verifyMessage(req, signature, pubKey);
+      return next();
+    } catch (err) {
+      if (err instanceof ClientError) {
+        return error.returnError(err, res, req);
+      }
+      return error.returnError(new ClientError({ code: 'INTERNAL_ERROR' }), res, req);
+    }
+  };
 };

package/src/lib/routes/tss.ts

@@ -2,7 +2,7 @@ import express from 'express';
 import * as Types from '../../types/expressapp';
 import { TssKeyGen, TssSign } from '../tss';
 import { authRequest } from './middleware/authRequest';
-import { authTssRequest } from './middleware/authTssRequest';
+import { authTssKeyGenRequest, authTssSignRequest } from './middleware/authTssRequest';
 import { createWalletLimiter } from './middleware/createWalletLimiter';
 import { verifyTssMessage } from './middleware/verifyTssMessage';
 
@@ -23,7 +23,7 @@ export class TssRouter {
     
     /** Key generation methods */
 
-    router.post('/v1/tss/keygen/:id', createWalletLimiter(opts), verifyTssMessage, async function(req, res) {
+    router.post('/v1/tss/keygen/:id', createWalletLimiter(opts), authTssKeyGenRequest(), verifyTssMessage, async function(req, res) {
       try {
         const id = req.params.id;
         // version was not given by client until 1.1, so fallback to 1.0
@@ -36,7 +36,20 @@ export class TssRouter {
       }
     });
 
-    router.get('/v1/tss/keygen/:id/:round', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/keygen/:id/register', authTssKeyGenRequest(), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const copayerId = req.headers['x-identity'];
+        const data = req.body;
+
+        await TssKeyGen.registerParty({ id, copayerId, data });
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.get('/v1/tss/keygen/:id/:round', authTssKeyGenRequest(), async function(req, res) {
       let interval: NodeJS.Timeout;
       try {
         const abort = new AbortController();
@@ -74,7 +87,7 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/keygen/:id/store', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/keygen/:id/store', authTssKeyGenRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const copayerId = req.headers['x-identity'];
@@ -87,7 +100,7 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/keygen/:id/secret', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const { secret } = req.body;
@@ -99,7 +112,7 @@ export class TssRouter {
       }
     });
 
-    router.get('/v1/tss/keygen/:id/secret', authTssRequest(), async function(req, res) {
+    router.get('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const copayerId = req.headers['x-identity'];
@@ -126,7 +139,7 @@ export class TssRouter {
       }
     });
 
-    router.get('/v1/tss/sign/:id/:round', authTssRequest(), async function(req, res) {
+    router.get('/v1/tss/sign/:id/:round', authTssSignRequest(), async function(req, res) {
       let interval: NodeJS.Timeout;
       try {
         const abort = new AbortController();
@@ -161,7 +174,7 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/sign/:id/store', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/sign/:id/store', authTssSignRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const { signature } = req.body;

package/src/lib/routes/wallets.ts

@@ -229,15 +229,14 @@ export function registerWalletRoutes(router: express.Router, context: RouteConte
       }
 
       const storage = WalletService.getStorage();
-      const existing = await Promise.all<{ copayerId: string; verified: boolean }>(copayers.map(c => new Promise((resolve) => {
-        storage.fetchCopayerLookup(c.copayerId, (err, copayer) => {
-          if (err || !copayer) {
-            return resolve({ copayerId: c.copayerId, verified: false });
-          }
-          const verified = copayer.requestPubKeys.some(pubkey => Utils.verifyMessage(c.copayerId, c.signature, pubkey.key));
-          return resolve({ copayerId: c.copayerId, verified });
-        });
-      })));
+      const existing = await Promise.all<{ copayerId: string; verified: boolean }>(copayers.map(async c => {
+        const copayer = await storage.fetchCopayerLookup(c.copayerId).catch(() => null);
+        if (!copayer) {
+          return { copayerId: c.copayerId, verified: false };
+        }
+        const verified = copayer.requestPubKeys.some(pubkey => Utils.verifyMessage(c.copayerId, c.signature, pubkey.key));
+        return { copayerId: c.copayerId, verified };
+      }));
       return res.json(existing.filter(e => e.verified).map(e => e.copayerId));
     } catch (err) {
       return returnError(err, res, req);

package/src/lib/server.ts

@@ -394,10 +394,7 @@ export class WalletService implements IWalletService {
         return cb(ex);
       }
 
-      server.storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-        if (err) {
-          return cb(err);
-        }
+      server.storage.fetchCopayerLookup(opts.copayerId).then(copayer => {
         if (!copayer) {
           return cb(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
         }
@@ -420,7 +417,7 @@ export class WalletService implements IWalletService {
 
         server.copayerId = opts.copayerId;
         return cb(null, server);
-      });
+      }).catch(err => cb(err));
     };
 
     const withSession = cb => {
@@ -428,7 +425,7 @@ export class WalletService implements IWalletService {
         return;
       }
 
-      let server;
+      let server: WalletService;
       try {
         server = WalletService.getInstance(opts);
       } catch (ex) {
@@ -445,10 +442,7 @@ export class WalletService implements IWalletService {
           return cb(Errors.NOT_AUTHORIZED.withMessage('Session expired'));
         }
 
-        server.storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-          if (err) {
-            return cb(err);
-          }
+        server.storage.fetchCopayerLookup(opts.copayerId).then(copayer => {
           if (!copayer) {
             return cb(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
           }
@@ -456,7 +450,7 @@ export class WalletService implements IWalletService {
           server.copayerId = opts.copayerId;
           server.walletId = copayer.walletId;
           return cb(null, server);
-        });
+        }).catch(err => cb(err));
       });
     };
 
@@ -1060,8 +1054,7 @@ export class WalletService implements IWalletService {
       derivationStrategy: wallet.derivationStrategy
     });
 
-    this.storage.fetchCopayerLookup(copayer.id, (err, res) => {
-      if (err) return cb(err);
+    this.storage.fetchCopayerLookup(copayer.id).then(res => {
       if (res) return cb(Errors.COPAYER_REGISTERED);
 
       if (opts.dryRun)
@@ -1113,7 +1106,7 @@ export class WalletService implements IWalletService {
           }
         );
       });
-    });
+    }).catch(err => cb(err));
   }
 
   _addKeyToCopayer(wallet: Wallet, copayer: Copayer, opts, cb) {
@@ -1143,8 +1136,7 @@ export class WalletService implements IWalletService {
   addAccess(opts, cb) {
     if (!checkRequired(opts, ['copayerId', 'requestPubKey', 'signature'], cb)) return;
 
-    this.storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-      if (err) return cb(err);
+    this.storage.fetchCopayerLookup(opts.copayerId).then(copayer => {
       if (!copayer) return cb(Errors.NOT_AUTHORIZED);
       this.storage.fetchWallet(copayer.walletId, (err, wallet) => {
         if (err) return cb(err);
@@ -1164,7 +1156,7 @@ export class WalletService implements IWalletService {
 
         this._addKeyToCopayer(wallet, copayer, opts, cb);
       });
-    });
+    }).catch(err => cb(err));
   }
 
   _setClientVersion(version) {