@bitpay-labs/bitcore-wallet-service 11.11.1 → 11.11.3

package/ts_build/test/integration/tss.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tss.test.d.ts","sourceRoot":"","sources":["../../../test/integration/tss.test.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAC"}
+{"version":3,"file":"tss.test.d.ts","sourceRoot":"","sources":["../../../test/integration/tss.test.ts"],"names":[],"mappings":"AAEA,OAAO,sBAAsB,CAAC"}

package/ts_build/test/integration/tss.test.js

@@ -36,13 +36,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const util_1 = __importDefault(require("util"));
 const sinon_1 = __importDefault(require("sinon"));
 require("chai/register-should");
+const bitcore_tss_1 = require("@bitpay-labs/bitcore-tss");
 const crypto_wallet_core_1 = require("@bitpay-labs/crypto-wallet-core");
 const supertest_1 = __importDefault(require("supertest"));
 const twoOfThree = __importStar(require("./data/tss/2of3"));
 const index_1 = __importDefault(require("../../src/index"));
 const helpers_1 = __importDefault(require("./helpers"));
+const TestData = __importStar(require("../testdata"));
 const tss_1 = require("../../src/lib/tss");
 const tsssign_1 = require("../../src/lib/model/tsssign");
 const tsskeygen_1 = require("../../src/lib/model/tsskeygen");
@@ -454,6 +457,12 @@ describe('TSS', function () {
                     const res = await post(path, { message }, partyAuth(0));
                     expectError(res, 400, 'TSS_INVALID_MESSAGE');
                 });
+                it('should error if messages are empty arrays for an existing session', async function () {
+                    await createKeyGenSession({ joined: [1, 2] });
+                    const message = { ...round1Message(0), broadcastMessages: [], p2pMessages: [] };
+                    const res = await post(path, { message }, partyAuth(0));
+                    expectError(res, 400, 'TSS_INVALID_MESSAGE');
+                });
             });
             describe('joining a v1.2 session', function () {
                 it('should let a registered party join', async function () {
@@ -751,6 +760,266 @@ describe('TSS', function () {
                 });
             });
         });
+        describe('BWS join secrets', function () {
+            const path = `/v1/tss/keygen/${SESSION_ID}/secret`;
+            const ethSecrets = { 1: 'ethSecretForParty1', 2: 'ethSecretForParty2' };
+            const storeSecrets = (body, auth = partyAuth(0)) => post(path, body, auth);
+            const getSecret = (auth, query = { chain: 'eth', network: 'livenet' }) => {
+                const qs = new URLSearchParams(query).toString();
+                return get(path + (qs ? '?' + qs : ''), auth);
+            };
+            const fetchSession = () => storage.fetchTssKeyGenSession({ id: SESSION_ID });
+            describe('POST /v1/tss/keygen/:id/secret', function () {
+                it('should store the secrets per chain and network', async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                    (await storeSecrets({ chain: 'eth', network: 'livenet', secrets: ethSecrets })).status.should.equal(200);
+                    (await storeSecrets({ chain: 'arb', network: 'livenet', secrets: { 1: 'arb1', 2: 'arb2' } })).status.should.equal(200);
+                    const session = await fetchSession();
+                    session.bwsJoinSecrets.should.deep.equal({
+                        'eth:livenet': ethSecrets,
+                        'arb:livenet': { 1: 'arb1', 2: 'arb2' }
+                    });
+                });
+                it('should key the secrets by partyId when given keygen session copayer IDs', async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                    const res = await storeSecrets({ chain: 'eth', network: 'livenet', secrets: { [copayerIds[2]]: 'two', [copayerIds[1]]: 'one' } });
+                    res.status.should.equal(200);
+                    const session = await fetchSession();
+                    session.bwsJoinSecrets['eth:livenet'].should.deep.equal({ 1: 'one', 2: 'two' });
+                });
+                it('should normalize the chain and network', async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                    (await storeSecrets({ chain: 'ETH', network: 'testnet', secrets: ethSecrets })).status.should.equal(200);
+                    (await storeSecrets({ chain: 'btc', network: 'mainnet', secrets: ethSecrets })).status.should.equal(200);
+                    const session = await fetchSession();
+                    Object.keys(session.bwsJoinSecrets).should.deep.equal(['eth:sepolia', 'btc:livenet']);
+                });
+                it('should overwrite the secrets for the same chain and network', async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                    (await storeSecrets({ chain: 'eth', network: 'livenet', secrets: { 1: 'old1', 2: 'old2' } })).status.should.equal(200);
+                    (await storeSecrets({ chain: 'eth', network: 'livenet', secrets: ethSecrets })).status.should.equal(200);
+                    const session = await fetchSession();
+                    session.bwsJoinSecrets.should.deep.equal({ 'eth:livenet': ethSecrets });
+                });
+                it('should store the secrets after the session has expired', async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2], timeLimit: 1 });
+                    expireSession();
+                    const res = await storeSecrets({ chain: 'eth', network: 'livenet', secrets: ethSecrets });
+                    res.status.should.equal(200);
+                    (await fetchSession()).bwsJoinSecrets['eth:livenet'].should.deep.equal(ethSecrets);
+                });
+                it('should store the secret sent by a legacy (< v1.3) client', async function () {
+                    await createKeyGenSession({ version: 1.2, joined: [1, 2] });
+                    const res = await storeSecrets({ secret: 'legacySecret' });
+                    res.status.should.equal(200);
+                    const session = await fetchSession();
+                    session.bwsJoinSecret.should.equal('legacySecret');
+                    session.bwsJoinSecrets.should.deep.equal({});
+                });
+                it('should error if the requester is not the session leader', async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                    const res = await storeSecrets({ chain: 'eth', network: 'livenet', secrets: ethSecrets }, partyAuth(1));
+                    expectError(res, 400, 'TSS_GENERIC_ERROR', 'Only the session creator can store the BWS join secret');
+                });
+                it('should error if the copayer is not in the session', async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                    const res = await storeSecrets({ chain: 'eth', network: 'livenet', secrets: ethSecrets }, { copayerId: 'notInSession', privKey: randomKey() });
+                    expectError(res, 401, 'NOT_AUTHORIZED');
+                });
+                for (const [description, body] of [
+                    ['a party is missing a secret', { chain: 'eth', network: 'livenet', secrets: { 1: 'one' } }],
+                    ['a secret is for the leader', { chain: 'eth', network: 'livenet', secrets: { ...ethSecrets, 0: 'zero' } }],
+                    ['a secret is for a partyId >= n', { chain: 'eth', network: 'livenet', secrets: { ...ethSecrets, 3: 'three' } }],
+                    ['a secret is for a copayer that is not in the session', { chain: 'eth', network: 'livenet', secrets: { 1: 'one', notInSession: 'two' } }],
+                    ['a secret is not a string', { chain: 'eth', network: 'livenet', secrets: { 1: 'one', 2: { $ne: null } } }],
+                    ['a secret is empty', { chain: 'eth', network: 'livenet', secrets: { 1: 'one', 2: '' } }],
+                    ['secrets is not an object', { chain: 'eth', network: 'livenet', secrets: 'abc' }],
+                    ['secrets is an array', { chain: 'eth', network: 'livenet', secrets: ['zero', 'one', 'two'] }],
+                    ['secrets is missing', { chain: 'eth', network: 'livenet' }],
+                    ['chain is missing', { network: 'livenet', secrets: ethSecrets }],
+                    ['chain is not supported', { chain: 'foo', network: 'livenet', secrets: ethSecrets }],
+                    ['chain is a Mongo path', { chain: 'eth.livenet', network: 'livenet', secrets: ethSecrets }],
+                    ['network is missing', { chain: 'eth', secrets: ethSecrets }],
+                    ['network is not supported', { chain: 'eth', network: 'foo', secrets: ethSecrets }],
+                ]) {
+                    it(`should error if ${description}`, async function () {
+                        await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                        const res = await storeSecrets(body);
+                        expectError(res, 400, 'TSS_GENERIC_ERROR');
+                        (await fetchSession()).bwsJoinSecrets.should.deep.equal({});
+                    });
+                }
+            });
+            describe('GET /v1/tss/keygen/:id/secret', function () {
+                beforeEach(async function () {
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                    await storage.storeTssKeyBwsJoinSecrets({ id: SESSION_ID, chain: 'eth', network: 'livenet', secrets: ethSecrets });
+                });
+                it('should return each party its own secret for the chain and network', async function () {
+                    for (const partyId of [1, 2]) {
+                        const res = await getSecret(partyAuth(partyId));
+                        res.status.should.equal(200);
+                        res.body.secret.should.equal(ethSecrets[partyId]);
+                    }
+                });
+                it('should normalize the chain and network', async function () {
+                    const res = await getSecret(partyAuth(1), { chain: 'ETH', network: 'mainnet' });
+                    res.status.should.equal(200);
+                    res.body.secret.should.equal(ethSecrets[1]);
+                });
+                it('should return the secret after the session has expired', async function () {
+                    await storage.db.collection(index_1.default.Storage.collections.TSS_KEYGEN).deleteMany({});
+                    await createKeyGenSession({ version: 1.3, joined: [1, 2], timeLimit: 1 });
+                    await storage.storeTssKeyBwsJoinSecrets({ id: SESSION_ID, chain: 'eth', network: 'livenet', secrets: ethSecrets });
+                    const roundPath = `/v1/tss/keygen/${SESSION_ID}/0`;
+                    (await fetchSession()).isExpired().should.equal(false);
+                    const live = await get(roundPath, partyAuth(1));
+                    live.status.should.equal(200);
+                    (await getSecret(partyAuth(1))).body.secret.should.equal(ethSecrets[1]);
+                    expireSession();
+                    (await fetchSession()).isExpired().should.equal(true);
+                    expectError(await get(roundPath, partyAuth(1)), 400, 'TSS_SESSION_EXPIRED');
+                    const res = await getSecret(partyAuth(1));
+                    res.status.should.equal(200);
+                    res.body.secret.should.equal(ethSecrets[1]);
+                });
+                it('should error if there is no secret for the chain', async function () {
+                    const res = await getSecret(partyAuth(1), { chain: 'arb', network: 'livenet' });
+                    expectError(res, 400, 'TSS_BWS_JOIN_SECRET_NOT_FOUND');
+                });
+                it('should error if there is no secret for the network', async function () {
+                    const res = await getSecret(partyAuth(1), { chain: 'eth', network: 'testnet' });
+                    expectError(res, 400, 'TSS_BWS_JOIN_SECRET_NOT_FOUND');
+                });
+                it('should error if the chain is not supported', async function () {
+                    const res = await getSecret(partyAuth(1), { chain: 'foo', network: 'livenet' });
+                    expectError(res, 400, 'TSS_GENERIC_ERROR', 'Invalid chain provided');
+                });
+                it('should error if only one of chain and network is given', async function () {
+                    const res = await getSecret(partyAuth(1), { chain: 'eth' });
+                    expectError(res, 400, 'TSS_GENERIC_ERROR', 'Invalid network provided');
+                });
+                it('should error if the copayer is not in the session', async function () {
+                    const res = await getSecret({ copayerId: 'notInSession', privKey: randomKey() });
+                    expectError(res, 401, 'NOT_AUTHORIZED');
+                });
+                it('should reject another party identity', async function () {
+                    const res = await getSecret({ copayerId: copayerIds[2], privKey: parties[1].authKey });
+                    expectError(res, 401, 'NOT_AUTHORIZED', 'Invalid signature');
+                });
+                it('should not return the legacy secret to clients that send the chain and network', async function () {
+                    await storage.storeTssKeyBwsJoinSecret({ id: SESSION_ID, secret: 'legacySecret' });
+                    const res = await getSecret(partyAuth(1), { chain: 'arb', network: 'livenet' });
+                    expectError(res, 400, 'TSS_BWS_JOIN_SECRET_NOT_FOUND');
+                });
+                describe('legacy (v1.2) session', function () {
+                    beforeEach(async function () {
+                        await storage.db.collection(index_1.default.Storage.collections.TSS_KEYGEN).deleteMany({});
+                        await createKeyGenSession({ version: 1.2, joined: [1, 2] });
+                        await storage.storeTssKeyBwsJoinSecret({ id: SESSION_ID, secret: 'legacySecret' });
+                    });
+                    it('should return the legacy secret to legacy clients', async function () {
+                        const res = await getSecret(partyAuth(1), {});
+                        res.status.should.equal(200);
+                        res.body.secret.should.equal('legacySecret');
+                    });
+                    it('should return the chain secret for a wallet created with the existing key', async function () {
+                        await storage.storeTssKeyBwsJoinSecrets({ id: SESSION_ID, chain: 'arb', network: 'livenet', secrets: { 1: 'arb1', 2: 'arb2' } });
+                        const res = await getSecret(partyAuth(1), { chain: 'arb', network: 'livenet' });
+                        res.status.should.equal(200);
+                        res.body.secret.should.equal('arb1');
+                    });
+                    it('should error if there is no secret for the chain', async function () {
+                        const res = await getSecret(partyAuth(1), { chain: 'arb', network: 'livenet' });
+                        expectError(res, 400, 'TSS_BWS_JOIN_SECRET_NOT_FOUND');
+                    });
+                });
+            });
+        });
+        describe('TSS wallets', function () {
+            const createWallet = (body) => app.post(urlPrefix + '/v2/wallets/').send({
+                name: 'tss wallet',
+                m: vector.m,
+                n: vector.n,
+                pubKey: TestData.keyPair.pub,
+                chain: 'arb',
+                network: 'testnet',
+                tssKeyId: SESSION_ID,
+                ...body
+            });
+            const joinWallet = (walletId, partyId, body = {}) => app.post(`${urlPrefix}/v2/wallets/${walletId}/copayers/`).send(helpers_1.default.getSignedCopayerOpts({
+                walletId,
+                name: 'party' + partyId,
+                xPubKey: getXPubKey(parties[partyId].seed),
+                requestPubKey: authPubKey(partyId),
+                chain: 'arb',
+                ...body
+            }));
+            beforeEach(async function () {
+                await storage.db.collection(index_1.default.Storage.collections.WALLETS).deleteMany({});
+                await storage.db.collection(index_1.default.Storage.collections.COPAYERS_LOOKUP).deleteMany({});
+                await createKeyGenSession({ version: 1.3, joined: [1, 2] });
+                await storage.storeTssKeySharedPubKey({ id: SESSION_ID, publicKey: 'sharedPublicKey' });
+            });
+            describe('POST /v2/wallets/', function () {
+                it('should create a wallet on another chain than the key generation session', async function () {
+                    const res = await createWallet({ tssKeygenCopayerId: copayerIds[0] });
+                    res.status.should.equal(200);
+                    const wallet = await util_1.default.promisify(storage.fetchWallet).call(storage, res.body.walletId);
+                    wallet.chain.should.equal('arb');
+                    wallet.tssKeyId.should.equal(SESSION_ID);
+                    wallet.tssVersion.should.equal(1.3);
+                    wallet.m.should.equal(1);
+                    wallet.n.should.equal(1);
+                });
+                it('should error if the keygen session copayer ID is missing', async function () {
+                    const res = await createWallet({});
+                    expectError(res, 400, 'BADREQUEST', 'Copayer ID is required for TSS version >= 1.3');
+                });
+                it('should error if the keygen session copayer ID is not the session leader', async function () {
+                    const res = await createWallet({ tssKeygenCopayerId: copayerIds[1] });
+                    expectError(res, 400, 'BADREQUEST', 'Only the TSS session leader can create a wallet');
+                });
+                it('should not require the keygen session copayer ID for a legacy (v1.2) session', async function () {
+                    await storage.db.collection(index_1.default.Storage.collections.TSS_KEYGEN).deleteMany({});
+                    await createKeyGenSession({ version: 1.2, joined: [1, 2] });
+                    await storage.storeTssKeySharedPubKey({ id: SESSION_ID, publicKey: 'sharedPublicKey' });
+                    const res = await createWallet({});
+                    res.status.should.equal(200);
+                });
+            });
+            describe('POST /v2/wallets/:id/copayers/', function () {
+                let walletId;
+                beforeEach(async function () {
+                    const res = await createWallet({ tssKeygenCopayerId: copayerIds[0] });
+                    walletId = res.body.walletId;
+                });
+                it('should let the parties join with their keygen session copayer IDs', async function () {
+                    for (const partyId of [0, 1, 2]) {
+                        const res = await joinWallet(walletId, partyId, { tssKeygenChain: 'btc' });
+                        res.status.should.equal(200);
+                        res.body.copayerId.should.equal(xPubToCopayerId('arb', getXPubKey(parties[partyId].seed)));
+                    }
+                    const wallet = await util_1.default.promisify(storage.fetchWallet).call(storage, walletId);
+                    wallet.copayers.length.should.equal(3);
+                });
+                it('should error if the keygen chain is not given for a different wallet chain', async function () {
+                    const res = await joinWallet(walletId, 1);
+                    expectError(res, 400, 'TSS_NON_PARTICIPANT');
+                });
+                it('should error if the keygen chain is invalid', async function () {
+                    const res = await joinWallet(walletId, 1, { tssKeygenChain: 'foo' });
+                    expectError(res, 400, 'BADREQUEST', 'Invalid TSS keygen chain');
+                });
+                it('should error if the copayer was not in the key generation session', async function () {
+                    const res = await joinWallet(walletId, 1, {
+                        xPubKey: getXPubKey(Buffer.alloc(32, 1)),
+                        tssKeygenChain: 'btc'
+                    });
+                    expectError(res, 400, 'TSS_NON_PARTICIPANT');
+                });
+            });
+        });
     });
     describe('Signing', function () {
         const sigMessage = (partyId) => ({
@@ -784,6 +1053,14 @@ describe('TSS', function () {
         });
         describe('POST /v1/tss/sign/:id', function () {
             const path = `/v1/tss/sign/${SESSION_ID}`;
+            const broadcastMessage = (partyId, round = 0) => ({
+                ...sigMessage(partyId),
+                round,
+                broadcastMessages: [{
+                        from: partyId,
+                        payload: bitcore_tss_1.utils.detachSignData(Buffer.from(`round ${round} from party ${partyId}`), parties[partyId].authKey)
+                    }]
+            });
             it('should error if session is expired', async function () {
                 await createSigSession({ timeLimit: 1 });
                 expireSession();
@@ -791,6 +1068,73 @@ describe('TSS', function () {
                 const res = await post(path, { message }, partyAuth(1));
                 expectError(res, 400, 'TSS_SESSION_EXPIRED');
             });
+            it('should start a new session with party 0\'s round 0 message', async function () {
+                const res = await post(path, { message: broadcastMessage(0), m: 2, version: 1.1 }, partyAuth(0));
+                res.status.should.equal(200);
+                const session = await storage.fetchTssSigSession({ id: SESSION_ID });
+                session.m.should.equal(2);
+                session.participants.should.deep.equal([{ partyId: 0, copayerId: copayerIds[0] }]);
+            });
+            it('should let another copayer join with its round 0 message', async function () {
+                (await post(path, { message: broadcastMessage(0), m: 2, version: 1.1 }, partyAuth(0))).status.should.equal(200);
+                const res = await post(path, { message: broadcastMessage(1), version: 1.1 }, partyAuth(1));
+                res.status.should.equal(200);
+                const session = await storage.fetchTssSigSession({ id: SESSION_ID });
+                session.participants.should.deep.equal([
+                    { partyId: 0, copayerId: copayerIds[0] },
+                    { partyId: 1, copayerId: copayerIds[1] }
+                ]);
+                session.getCurrentRound().should.equal(1);
+            });
+            it('should error if a copayer joins a full session', async function () {
+                await createSigSession();
+                const res = await post(path, { message: broadcastMessage(2), version: 1.1 }, partyAuth(2));
+                expectError(res, 400, 'TSS_MAX_PARTICIPANTS_REACHED');
+            });
+            it('should error if a non-participant sends a message for a later round', async function () {
+                await createSigSession();
+                const res = await post(path, { message: broadcastMessage(2, 1), version: 1.1 }, partyAuth(2));
+                expectError(res, 401, 'NOT_AUTHORIZED', 'Copayer not found in session');
+            });
+            it('should error if messages are empty arrays in an m > 1 session', async function () {
+                await createSigSession();
+                const message = { ...sigMessage(0), round: 1 };
+                const res = await post(path, { message, version: 1.1 }, partyAuth(0));
+                expectError(res, 400, 'TSS_INVALID_MESSAGE');
+            });
+            describe('1-of-N session', function () {
+                const start = () => post(path, { message: broadcastMessage(0), m: 1, version: 1.1 }, partyAuth(0));
+                it('should accept rounds that have no messages for other parties', async function () {
+                    (await start()).status.should.equal(200);
+                    for (const round of [1, 2, 3, 4]) {
+                        const message = round === 3 ? broadcastMessage(0, round) : { ...sigMessage(0), round };
+                        const res = await post(path, { message, version: 1.1 }, partyAuth(0));
+                        res.status.should.equal(200, `round ${round}: ${res.text}`);
+                    }
+                    const session = await storage.fetchTssSigSession({ id: SESSION_ID });
+                    session.rounds.length.should.equal(5);
+                    session.getCurrentRound().should.equal(5);
+                    const res = await get(`/v1/tss/sign/${SESSION_ID}/4?maxWaitTime=0`, partyAuth(0));
+                    res.status.should.equal(200);
+                    JSON.parse(res.text).messages.should.deep.equal([]);
+                });
+                it('should error if round 0 has no broadcast message', async function () {
+                    const res = await post(path, { message: sigMessage(0), m: 1, version: 1.1 }, partyAuth(0));
+                    expectError(res, 400, 'TSS_INVALID_MESSAGE');
+                });
+                it('should still verify broadcast signatures', async function () {
+                    (await start()).status.should.equal(200);
+                    const message = broadcastMessage(0, 1);
+                    message.broadcastMessages[0].payload = bitcore_tss_1.utils.detachSignData(Buffer.from('forged'), randomKey());
+                    const res = await post(path, { message, version: 1.1 }, partyAuth(0));
+                    expectError(res, 400, 'TSS_INVALID_MESSAGE_SIG');
+                });
+                it('should error if another copayer tries to join', async function () {
+                    (await start()).status.should.equal(200);
+                    const res = await post(path, { message: broadcastMessage(1), version: 1.1 }, partyAuth(1));
+                    expectError(res, 400, 'TSS_MAX_PARTICIPANTS_REACHED');
+                });
+            });
         });
         describe('GET /v1/tss/sign/:id/:round', function () {
             const path = `/v1/tss/sign/${SESSION_ID}/0?maxWaitTime=0`;