@canton-network/core-signing-fireblocks 0.9.0 → 0.11.0

package/dist/index.js

@@ -1,164 +1,452 @@
-// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-// Disabled unused vars rule to allow for future implementations
-/* eslint-disable @typescript-eslint/no-unused-vars */
-import { buildController, PartyMode, SigningProvider, } from '@canton-network/core-signing-lib';
-import { FireblocksHandler } from './fireblocks.js';
-import _ from 'lodash';
+import { PartyMode, SigningProvider, CC_COIN_TYPE, buildController } from '@canton-network/core-signing-lib';
+import { Fireblocks, PublicKeyInformationAlgorithmEnum } from '@fireblocks/ts-sdk';
+import { pino } from 'pino';
 import { z } from 'zod';
-const FireblocksApiKeyInfoSchema = z.object({
-    apiKey: z.string(),
-    apiSecret: z.string(),
+import _ from 'lodash';
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var RawMessageSchema = z.object({
+  content: z.string(),
+  derivationPath: z.array(z.number())
+});
+var RawMessageDataSchema = z.object({
+  messages: z.array(RawMessageSchema),
+  algorithm: z.string()
 });
-const FireblocksConfigSchema = z.object({
-    defaultApiKey: FireblocksApiKeyInfoSchema.optional(),
-    userApiKeys: z.map(z.string(), FireblocksApiKeyInfoSchema),
-    apiPath: z.string().optional(),
+var RawMessageExtraParametersSchema = z.object({
+  rawMessageData: RawMessageDataSchema
 });
-const createFireblocksHandler = (config) => {
-    return new FireblocksHandler(config.defaultKeyInfo
-        ? {
-            apiKey: config.defaultKeyInfo.apiKey,
-            apiSecret: config.defaultKeyInfo.apiSecret,
+var logger = pino({ name: "main", level: "debug" });
+var FireblocksHandler = class {
+  constructor(defaultKey, userKeys, apiPath = "https://api.fireblocks.io/v1") {
+    __publicField(this, "defaultClient");
+    __publicField(this, "clients", /* @__PURE__ */ new Map());
+    __publicField(this, "keyInfoByPublicKey", /* @__PURE__ */ new Map());
+    __publicField(this, "publicKeyByDerivationPath", /* @__PURE__ */ new Map());
+    __publicField(this, "getClient", (userId) => {
+      if (userId !== void 0 && this.clients.has(userId)) {
+        return this.clients.get(userId);
+      } else if (this.defaultClient) {
+        return this.defaultClient;
+      } else {
+        throw new Error("No Fireblocks client available for this user.");
+      }
+    });
+    if (defaultKey) {
+      this.defaultClient = new Fireblocks({
+        apiKey: defaultKey.apiKey,
+        basePath: apiPath,
+        secretKey: defaultKey.apiSecret
+      });
+    }
+    userKeys.forEach((keyInfo, userId) => {
+      const client = new Fireblocks({
+        apiKey: keyInfo.apiKey,
+        basePath: apiPath,
+        secretKey: keyInfo.apiSecret
+      });
+      this.clients.set(userId, client);
+    });
+  }
+  /**
+   * Get all public keys which correspond to Fireblocks vault accounts. This will
+   * also refresh the key cache.
+   * @returns List of Fireblocks public key information
+   */
+  async getPublicKeys(userId) {
+    const keys = [];
+    try {
+      const client = this.getClient(userId);
+      const vaultAccounts = [];
+      let after = void 0;
+      do {
+        const resp = await client.vaults.getPagedVaultAccounts(
+          after ? { after } : {}
+        );
+        after = resp.data.paging?.after;
+        vaultAccounts.push(...resp.data.accounts || []);
+      } while (after !== void 0);
+      for (const vault of vaultAccounts) {
+        if (vault.id) {
+          const derivationPath = [
+            44,
+            CC_COIN_TYPE,
+            Number(vault.id) || 0,
+            0,
+            0
+          ];
+          const publicKey = await this.lookupPublicKey(
+            userId,
+            derivationPath
+          );
+          const storedKey = {
+            derivationPath,
+            publicKey,
+            name: vault.name || vault.id,
+            algorithm: PublicKeyInformationAlgorithmEnum.EddsaEd25519
+          };
+          keys.push(storedKey);
+          this.keyInfoByPublicKey.set(storedKey.publicKey, storedKey);
         }
-        : undefined, config.userApiKeys, config.apiPath || 'https://api.fireblocks.io/v1');
-};
-export default class FireblocksSigningDriver {
-    fireblocks;
-    config;
-    constructor(config) {
-        this.config = config;
-        this.fireblocks = createFireblocksHandler(config);
+      }
+    } catch (error) {
+      logger.error(error, "Error fetching vault accounts:");
+      throw error;
     }
-    partyMode = PartyMode.EXTERNAL;
-    signingProvider = SigningProvider.FIREBLOCKS;
-    controller = (userId) => buildController({
-        signTransaction: async (params) => {
-            // TODO: validate transaction here
-            try {
-                const tx = await this.fireblocks.signTransaction(userId, params.txHash, params.publicKey, params.internalTxId);
-                return {
-                    txId: tx.txId,
-                    status: tx.status,
-                    signature: tx.signature,
-                    publicKey: tx.publicKey,
-                };
-            }
-            catch (error) {
-                return {
-                    error: 'signing_error',
-                    error_description: error.message,
-                };
-            }
-        },
-        getTransaction: async (params) => {
-            const tx = await this.fireblocks.getTransaction(userId, params.txId);
-            if (tx) {
-                return {
-                    txId: tx.txId,
-                    status: tx.status,
-                    signature: tx.signature,
-                    publicKey: tx.publicKey,
-                };
-            }
-            else {
-                return {
-                    error: 'transaction_not_found',
-                    error_description: 'The requested transaction does not exist.',
-                };
-            }
-        },
-        getTransactions: async (params) => {
-            const transactions = [];
-            if (params.publicKeys || params.txIds) {
-                const txIds = new Set(params.txIds);
-                const publicKeys = new Set(params.publicKeys);
-                for await (const tx of this.fireblocks.getTransactions(userId)) {
-                    if (txIds.has(tx.txId) ||
-                        publicKeys.has(tx.publicKey || '')) {
-                        transactions.push({
-                            txId: tx.txId,
-                            status: tx.status,
-                            signature: tx.signature,
-                            publicKey: tx.publicKey,
-                        });
-                    }
-                    if (params.txIds &&
-                        !params.publicKeys &&
-                        transactions.length == txIds.size) {
-                        // stop if we are filtering by only txIds and have found all requested transactions
-                        break;
-                    }
+    return keys;
+  }
+  /**
+   * Takes a Fireblocks response from a transactions call and extracts the transaction information
+   * relevant to the Wallet Gateway. This will potentially fetch the public key since unsigned transactions
+   * do  not include it
+   * @returns FireblocksTransaction
+   */
+  async formatTransaction(userId, tx) {
+    if (tx.signedMessages && tx.signedMessages.length > 0) {
+      const signedMessage = tx.signedMessages[0];
+      if (!signedMessage.publicKey || !signedMessage.content || !signedMessage.signature) {
+        return void 0;
+      }
+      return {
+        txId: tx.id,
+        status: "signed",
+        createdAt: tx.createdAt,
+        publicKey: signedMessage.publicKey,
+        signature: signedMessage.signature.fullSig,
+        derivationPath: signedMessage.derivationPath
+      };
+    } else {
+      const rawMessageData = RawMessageExtraParametersSchema.safeParse(
+        tx.extraParameters
+      );
+      if (!rawMessageData.success) {
+        return void 0;
+      }
+      const message = rawMessageData.data.rawMessageData.messages[0];
+      const publicKey = await this.lookupPublicKey(
+        userId,
+        message.derivationPath
+      );
+      const status = tx.status === "REJECTED" || tx.status === "BLOCKED" || tx.status === "CANCELLED" ? "rejected" : tx.status === "FAILED" ? "failed" : "pending";
+      return {
+        txId: tx.id,
+        status,
+        createdAt: tx.createdAt,
+        publicKey,
+        derivationPath: message.derivationPath
+      };
+    }
+  }
+  /**
+   * Looks up or fetches the public key (only) for a given derivation path
+   * @returns The public key as a string
+   */
+  async lookupPublicKey(userId, derivationPath) {
+    const derivationPathString = JSON.stringify(derivationPath);
+    if (this.publicKeyByDerivationPath.has(derivationPathString)) {
+      return this.publicKeyByDerivationPath.get(derivationPathString);
+    } else {
+      try {
+        const client = this.getClient(userId);
+        const key = await client.vaults.getPublicKeyInfo({
+          algorithm: PublicKeyInformationAlgorithmEnum.EddsaEd25519,
+          derivationPath: derivationPathString
+        });
+        if (key.data.publicKey) {
+          this.publicKeyByDerivationPath.set(
+            derivationPathString,
+            key.data.publicKey
+          );
+          return key.data.publicKey;
+        } else {
+          throw new Error(
+            "Malformed public key response from Fireblocks"
+          );
+        }
+      } catch (error) {
+        throw new Error(`Error looking up public key: ${error}`);
+      }
+    }
+  }
+  /**
+   * Fetch a single RAW transaction from Fireblocks by its transaction ID
+   * @returns FireblocksTransaction or undefined if not found
+   */
+  async getTransaction(userId, txId) {
+    try {
+      const client = this.getClient(userId);
+      const transaction = await client.transactions.getTransaction({
+        txId
+      });
+      return await this.formatTransaction(userId, transaction.data);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Get all RAW transactions from Fireblocks. Returns an async generator as
+   * this may return a large number of transactions and will occasionally need to
+   * refresh the key cache.
+   * @returns AsyncGenerator of FireblocksTransactions
+   */
+  async *getTransactions(userId, {
+    limit = 200,
+    before
+  } = {}) {
+    let fetchedLength = 0;
+    let beforeQuery = before;
+    try {
+      const client = this.getClient(userId);
+      do {
+        const transactions = await client.transactions.getTransactions({
+          sourceType: "VAULT_ACCOUNT",
+          limit,
+          ...beforeQuery ? { before: beforeQuery.toString() } : {}
+        });
+        fetchedLength = transactions.data.length;
+        for (const tx of transactions.data) {
+          beforeQuery = tx.createdAt - 1;
+          const formatTransaction = await this.formatTransaction(
+            userId,
+            tx
+          );
+          if (formatTransaction) {
+            yield formatTransaction;
+          } else {
+            continue;
+          }
+        }
+      } while (fetchedLength > 0);
+    } catch (error) {
+      logger.error(error, "Error fetching signatures");
+      throw error;
+    }
+  }
+  /**
+   * Sign a transaction using a public key
+   * @param tx - The transaction to sign, as a string
+   * @param publicKey - The public key to use for signing
+   * @param externalTxId - The transaction ID assigned by the Wallet Gateway
+   * @return The transaction object from Fireblocks
+   */
+  async signTransaction(userId, tx, publicKey, externalTxId) {
+    try {
+      const client = this.getClient(userId);
+      if (!this.keyInfoByPublicKey.has(publicKey)) {
+        await this.getPublicKeys(userId);
+      }
+      const key = this.keyInfoByPublicKey.get(publicKey);
+      if (!key) {
+        throw new Error(`Public key ${publicKey} not found in vaults`);
+      }
+      const transaction = await client.transactions.createTransaction({
+        transactionRequest: {
+          operation: "RAW",
+          note: `Signing transaction with public key ${publicKey}`,
+          externalTxId,
+          extraParameters: {
+            rawMessageData: {
+              messages: [
+                {
+                  content: tx,
+                  derivationPath: key.derivationPath
                 }
-                return {
-                    transactions: transactions,
-                };
+              ],
+              algorithm: key.algorithm
             }
-            else {
-                return {
-                    error: 'bad_arguments',
-                    error_description: 'either public key or txIds must be supplied',
-                };
-            }
-        },
-        getKeys: async () => {
-            try {
-                const keys = await this.fireblocks.getPublicKeys(userId);
-                return {
-                    keys: keys.map((k) => ({
-                        id: k.derivationPath.join('-'),
-                        name: k.name,
-                        publicKey: k.publicKey,
-                    })),
-                };
-            }
-            catch (error) {
-                return {
-                    error: 'fetch_error',
-                    error_description: error.message,
-                };
-            }
-        },
-        createKey: async (_params) => {
-            return {
-                error: 'not_allowed',
-                error_description: 'Creating a Fireblocks key through the Wallet Gateway is not allowed, please create new keys directly in Fireblocks.',
-            };
-        },
-        getConfiguration: async () => {
-            const hideFireblocksKeySecret = (keyInfo) => {
-                return keyInfo
-                    ? {
-                        apiKey: keyInfo.apiKey,
-                        apiSecret: '***HIDDEN***',
-                    }
-                    : undefined;
-            };
-            return {
-                ...this.config,
-                defaultKeyInfo: hideFireblocksKeySecret(this.config.defaultKeyInfo),
-                userApiKeys: new Map([...this.config.userApiKeys].map(([k, v]) => [
-                    k,
-                    hideFireblocksKeySecret(v),
-                ])),
-            };
-        },
-        setConfiguration: async (params) => {
-            const validated = FireblocksConfigSchema.safeParse(params);
-            if (!validated.success) {
-                return {
-                    error: 'bad_arguments',
-                    error_description: validated.error.message,
-                };
+          }
+        }
+      });
+      let status = "pending";
+      switch (transaction.data.status) {
+        case "REJECTED":
+          status = "rejected";
+          break;
+        case "COMPLETED":
+          status = "signed";
+          break;
+        case "CANCELLED":
+        case "FAILED":
+        case "BLOCKED":
+          status = "failed";
+          break;
+      }
+      return {
+        txId: transaction.data.id,
+        status,
+        publicKey: key.publicKey,
+        derivationPath: key.derivationPath
+      };
+    } catch (error) {
+      logger.error(error, "Error signing transaction:");
+      throw error;
+    }
+  }
+};
+var FireblocksApiKeyInfoSchema = z.object({
+  apiKey: z.string(),
+  apiSecret: z.string()
+});
+var FireblocksConfigSchema = z.object({
+  defaultApiKey: FireblocksApiKeyInfoSchema.optional(),
+  userApiKeys: z.map(z.string(), FireblocksApiKeyInfoSchema),
+  apiPath: z.string().optional()
+});
+var createFireblocksHandler = (config) => {
+  return new FireblocksHandler(
+    config.defaultKeyInfo ? {
+      apiKey: config.defaultKeyInfo.apiKey,
+      apiSecret: config.defaultKeyInfo.apiSecret
+    } : void 0,
+    config.userApiKeys,
+    config.apiPath || "https://api.fireblocks.io/v1"
+  );
+};
+var FireblocksSigningDriver = class {
+  constructor(config) {
+    __publicField(this, "fireblocks");
+    __publicField(this, "config");
+    __publicField(this, "partyMode", PartyMode.EXTERNAL);
+    __publicField(this, "signingProvider", SigningProvider.FIREBLOCKS);
+    __publicField(this, "controller", (userId) => buildController({
+      signTransaction: async (params) => {
+        try {
+          const tx = await this.fireblocks.signTransaction(
+            userId,
+            params.txHash,
+            params.publicKey,
+            params.internalTxId
+          );
+          return {
+            txId: tx.txId,
+            status: tx.status,
+            signature: tx.signature,
+            publicKey: tx.publicKey
+          };
+        } catch (error) {
+          return {
+            error: "signing_error",
+            error_description: error.message
+          };
+        }
+      },
+      getTransaction: async (params) => {
+        const tx = await this.fireblocks.getTransaction(
+          userId,
+          params.txId
+        );
+        if (tx) {
+          return {
+            txId: tx.txId,
+            status: tx.status,
+            signature: tx.signature,
+            publicKey: tx.publicKey
+          };
+        } else {
+          return {
+            error: "transaction_not_found",
+            error_description: "The requested transaction does not exist."
+          };
+        }
+      },
+      getTransactions: async (params) => {
+        const transactions = [];
+        if (params.publicKeys || params.txIds) {
+          const txIds = new Set(params.txIds);
+          const publicKeys = new Set(params.publicKeys);
+          for await (const tx of this.fireblocks.getTransactions(
+            userId
+          )) {
+            if (txIds.has(tx.txId) || publicKeys.has(tx.publicKey || "")) {
+              transactions.push({
+                txId: tx.txId,
+                status: tx.status,
+                signature: tx.signature,
+                publicKey: tx.publicKey
+              });
             }
-            if (!_.isEqual(validated.data, this.config)) {
-                this.config = validated.data;
-                this.fireblocks = createFireblocksHandler(this.config);
+            if (params.txIds && !params.publicKeys && transactions.length == txIds.size) {
+              break;
             }
-            return params;
-        },
-        // TODO: implement subscribeTransactions - we will need to figure out how to handle subscriptions
-        // when the controller is not running in a server context
-        subscribeTransactions: async (params) => Promise.resolve({}),
-    });
-}
+          }
+          return {
+            transactions
+          };
+        } else {
+          return {
+            error: "bad_arguments",
+            error_description: "either public key or txIds must be supplied"
+          };
+        }
+      },
+      getKeys: async () => {
+        try {
+          const keys = await this.fireblocks.getPublicKeys(userId);
+          return {
+            keys: keys.map((k) => ({
+              id: k.derivationPath.join("-"),
+              name: k.name,
+              publicKey: k.publicKey
+            }))
+          };
+        } catch (error) {
+          return {
+            error: "fetch_error",
+            error_description: error.message
+          };
+        }
+      },
+      createKey: async (_params) => {
+        return {
+          error: "not_allowed",
+          error_description: "Creating a Fireblocks key through the Wallet Gateway is not allowed, please create new keys directly in Fireblocks."
+        };
+      },
+      getConfiguration: async () => {
+        const hideFireblocksKeySecret = (keyInfo) => {
+          return keyInfo ? {
+            apiKey: keyInfo.apiKey,
+            apiSecret: "***HIDDEN***"
+          } : void 0;
+        };
+        return {
+          ...this.config,
+          defaultKeyInfo: hideFireblocksKeySecret(
+            this.config.defaultKeyInfo
+          ),
+          userApiKeys: new Map(
+            [...this.config.userApiKeys].map(([k, v]) => [
+              k,
+              hideFireblocksKeySecret(v)
+            ])
+          )
+        };
+      },
+      setConfiguration: async (params) => {
+        const validated = FireblocksConfigSchema.safeParse(params);
+        if (!validated.success) {
+          return {
+            error: "bad_arguments",
+            error_description: validated.error.message
+          };
+        }
+        if (!_.isEqual(validated.data, this.config)) {
+          this.config = validated.data;
+          this.fireblocks = createFireblocksHandler(this.config);
+        }
+        return params;
+      },
+      // TODO: implement subscribeTransactions - we will need to figure out how to handle subscriptions
+      // when the controller is not running in a server context
+      subscribeTransactions: async (params) => Promise.resolve({})
+    }));
+    this.config = config;
+    this.fireblocks = createFireblocksHandler(config);
+  }
+};
+
+export { FireblocksSigningDriver as default };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map