@canton-network/wallet-gateway-remote 0.1.0

package/README.md

@@ -0,0 +1,25 @@
+# Wallet Gateway
+
+The RPC-based (server-side) Wallet Gateway.
+
+# Usage
+
+Start the service directly through npx (tested with NodeJS v24):
+
+`npx @canton-network/wallet-gateway-remote -c ./config.json`
+
+This exposes:
+
+- A dApp JSON-RPC API running on (by default) `localhost:3008`
+- A User JSON-RPC API running on (by default) `localhost:3001`
+- A User web interface running on (by default) `localhost:3002`
+
+## Configuration
+
+A configuration file is required to start up the gateway. See [config.json](https://github.com/hyperledger-labs/splice-wallet-kernel/blob/main/wallet-gateway/test/config.json) for an example.
+
+# Developing
+
+## Codegen
+
+The JSON-RPC API specs from `api-specs/` are generated into strongly-typed method builders for the remote RPC server. To update the codegen, run `yarn generate:dapp`.

package/dist/auth/jwt-auth-service.d.ts

@@ -0,0 +1,11 @@
+import { Logger } from 'pino';
+import { AuthService } from '@canton-network/core-wallet-auth';
+import { Store } from '@canton-network/core-wallet-store';
+/**
+ * Creates an AuthService that verifies JWT tokens using a remote JWK set.
+ * @param store - The Store instance to access network configurations.
+ * @param logger - Logger instance for logging debug and warning messages.
+ * @returns An AuthService implementation that verifies JWT tokens.
+ */
+export declare const jwtAuthService: (store: Store, logger: Logger) => AuthService;
+//# sourceMappingURL=jwt-auth-service.d.ts.map

package/dist/auth/jwt-auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAQ,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,KAAG,WAkD5D,CAAA"}

package/dist/auth/jwt-auth-service.js

@@ -0,0 +1,50 @@
+// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
+/**
+ * Creates an AuthService that verifies JWT tokens using a remote JWK set.
+ * @param store - The Store instance to access network configurations.
+ * @param logger - Logger instance for logging debug and warning messages.
+ * @returns An AuthService implementation that verifies JWT tokens.
+ */
+export const jwtAuthService = (store, logger) => ({
+    verifyToken: async (accessToken) => {
+        if (!accessToken || !accessToken.startsWith('Bearer ')) {
+            return undefined;
+        }
+        const jwt = accessToken.split(' ')[1];
+        logger.debug({ jwt }, 'Verifying JWT token');
+        try {
+            const iss = decodeJwt(jwt).iss;
+            if (!iss) {
+                logger.warn('JWT does not contain an issuer');
+                return undefined;
+            }
+            // TODO: change once IDP is decoupled from networks
+            const networks = await store.listNetworks();
+            const idp = networks.find((n) => n.auth.issuer === iss)?.auth;
+            if (!idp) {
+                logger.warn(`No identity provider found for issuer: ${iss}`);
+                return undefined;
+            }
+            logger.debug(idp, 'Using IDP');
+            const response = await fetch(idp.configUrl);
+            const config = await response.json();
+            const jwks = createRemoteJWKSet(new URL(config.jwks_uri));
+            const { payload } = await jwtVerify(jwt, jwks, {
+                algorithms: ['RS256'],
+            });
+            if (!payload.sub) {
+                return undefined;
+            }
+            logger.debug({ userId: payload.sub, accessToken: jwt }, 'JWT verified');
+            return { userId: payload.sub, accessToken: jwt };
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                logger.warn(error, `Failed to verify token: ${error.message}`);
+            }
+            return undefined;
+        }
+    },
+});

package/dist/config/Config.d.ts

@@ -0,0 +1,590 @@
+import { z } from 'zod';
+export declare const kernelInfoSchema: z.ZodObject<{
+    id: z.ZodString;
+    clientType: z.ZodUnion<[z.ZodLiteral<"browser">, z.ZodLiteral<"desktop">, z.ZodLiteral<"mobile">, z.ZodLiteral<"remote">]>;
+    url: z.ZodString;
+    userUrl: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    clientType: "browser" | "desktop" | "mobile" | "remote";
+    url: string;
+    userUrl: string;
+}, {
+    id: string;
+    clientType: "browser" | "desktop" | "mobile" | "remote";
+    url: string;
+    userUrl: string;
+}>;
+export declare const configSchema: z.ZodObject<{
+    kernel: z.ZodObject<{
+        id: z.ZodString;
+        clientType: z.ZodUnion<[z.ZodLiteral<"browser">, z.ZodLiteral<"desktop">, z.ZodLiteral<"mobile">, z.ZodLiteral<"remote">]>;
+        url: z.ZodString;
+        userUrl: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        clientType: "browser" | "desktop" | "mobile" | "remote";
+        url: string;
+        userUrl: string;
+    }, {
+        id: string;
+        clientType: "browser" | "desktop" | "mobile" | "remote";
+        url: string;
+        userUrl: string;
+    }>;
+    store: z.ZodObject<{
+        connection: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+            type: z.ZodLiteral<"memory">;
+        }, "strip", z.ZodTypeAny, {
+            type: "memory";
+        }, {
+            type: "memory";
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"sqlite">;
+            database: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            type: "sqlite";
+            database: string;
+        }, {
+            type: "sqlite";
+            database: string;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"postgres">;
+            host: z.ZodString;
+            port: z.ZodNumber;
+            user: z.ZodString;
+            password: z.ZodString;
+            database: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            type: "postgres";
+            password: string;
+            database: string;
+            host: string;
+            port: number;
+            user: string;
+        }, {
+            type: "postgres";
+            password: string;
+            database: string;
+            host: string;
+            port: number;
+            user: string;
+        }>]>;
+        networks: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            chainId: z.ZodString;
+            synchronizerId: z.ZodString;
+            description: z.ZodString;
+            ledgerApi: z.ZodObject<{
+                baseUrl: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                baseUrl: string;
+            }, {
+                baseUrl: string;
+            }>;
+            auth: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+                identityProviderId: z.ZodString;
+                type: z.ZodLiteral<"password">;
+                issuer: z.ZodString;
+                configUrl: z.ZodString;
+                audience: z.ZodString;
+                tokenUrl: z.ZodString;
+                grantType: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                admin: z.ZodOptional<z.ZodObject<{
+                    clientId: z.ZodString;
+                    clientSecret: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    clientId: string;
+                    clientSecret: string;
+                }, {
+                    clientId: string;
+                    clientSecret: string;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            }, {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            }>, z.ZodObject<{
+                identityProviderId: z.ZodString;
+                type: z.ZodLiteral<"implicit">;
+                issuer: z.ZodString;
+                configUrl: z.ZodString;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                admin: z.ZodOptional<z.ZodObject<{
+                    clientId: z.ZodString;
+                    clientSecret: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    clientId: string;
+                    clientSecret: string;
+                }, {
+                    clientId: string;
+                    clientSecret: string;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            }, {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            }>, z.ZodObject<{
+                identityProviderId: z.ZodString;
+                type: z.ZodLiteral<"client_credentials">;
+                issuer: z.ZodString;
+                configUrl: z.ZodString;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                clientSecret: z.ZodString;
+                admin: z.ZodOptional<z.ZodObject<{
+                    clientId: z.ZodString;
+                    clientSecret: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    clientId: string;
+                    clientSecret: string;
+                }, {
+                    clientId: string;
+                    clientSecret: string;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            }, {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            }>]>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            chainId: string;
+            synchronizerId: string;
+            description: string;
+            ledgerApi: {
+                baseUrl: string;
+            };
+            auth: {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            };
+        }, {
+            name: string;
+            chainId: string;
+            synchronizerId: string;
+            description: string;
+            ledgerApi: {
+                baseUrl: string;
+            };
+            auth: {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            };
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        connection: {
+            type: "memory";
+        } | {
+            type: "sqlite";
+            database: string;
+        } | {
+            type: "postgres";
+            password: string;
+            database: string;
+            host: string;
+            port: number;
+            user: string;
+        };
+        networks: {
+            name: string;
+            chainId: string;
+            synchronizerId: string;
+            description: string;
+            ledgerApi: {
+                baseUrl: string;
+            };
+            auth: {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            };
+        }[];
+    }, {
+        connection: {
+            type: "memory";
+        } | {
+            type: "sqlite";
+            database: string;
+        } | {
+            type: "postgres";
+            password: string;
+            database: string;
+            host: string;
+            port: number;
+            user: string;
+        };
+        networks: {
+            name: string;
+            chainId: string;
+            synchronizerId: string;
+            description: string;
+            ledgerApi: {
+                baseUrl: string;
+            };
+            auth: {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            };
+        }[];
+    }>;
+}, "strip", z.ZodTypeAny, {
+    kernel: {
+        id: string;
+        clientType: "browser" | "desktop" | "mobile" | "remote";
+        url: string;
+        userUrl: string;
+    };
+    store: {
+        connection: {
+            type: "memory";
+        } | {
+            type: "sqlite";
+            database: string;
+        } | {
+            type: "postgres";
+            password: string;
+            database: string;
+            host: string;
+            port: number;
+            user: string;
+        };
+        networks: {
+            name: string;
+            chainId: string;
+            synchronizerId: string;
+            description: string;
+            ledgerApi: {
+                baseUrl: string;
+            };
+            auth: {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            };
+        }[];
+    };
+}, {
+    kernel: {
+        id: string;
+        clientType: "browser" | "desktop" | "mobile" | "remote";
+        url: string;
+        userUrl: string;
+    };
+    store: {
+        connection: {
+            type: "memory";
+        } | {
+            type: "sqlite";
+            database: string;
+        } | {
+            type: "postgres";
+            password: string;
+            database: string;
+            host: string;
+            port: number;
+            user: string;
+        };
+        networks: {
+            name: string;
+            chainId: string;
+            synchronizerId: string;
+            description: string;
+            ledgerApi: {
+                baseUrl: string;
+            };
+            auth: {
+                type: "password";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                tokenUrl: string;
+                grantType: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "implicit";
+                clientId: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            } | {
+                type: "client_credentials";
+                clientId: string;
+                clientSecret: string;
+                identityProviderId: string;
+                issuer: string;
+                configUrl: string;
+                audience: string;
+                scope: string;
+                admin?: {
+                    clientId: string;
+                    clientSecret: string;
+                } | undefined;
+            };
+        }[];
+    };
+}>;
+export type KernelInfo = z.infer<typeof kernelInfoSchema>;
+export type Config = z.infer<typeof configSchema>;
+//# sourceMappingURL=Config.d.ts.map

package/dist/config/Config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAU3B,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAOqoe,CAAC;;;;;;;;;;;;;;qBAA0Z,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAA6+B,CAAC;;;;;;;;;;;;qBAA6V,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAA0kC,CAAC;;;;;;;;;;;;;qBAAyY,CAAC;;;;;;;;;;;;;;;;;;;;;;;qBAAonB,CAAC;;;;;;;;;;;;qBAA8V,CAAC;;;;;;;;;;;;;qBAA0Y,CAAC;;;;;;;;;;;;;;;;;;;;;;;qBAA0lB,CAAC;;;;;;;;;;;;qBAA8V,CAAC;;;;;;;;;;;;;qBAA0Y,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAAq5B,CAAC;;;;;;;;;;;;qBAA8V,CAAC;;;;;;;;;;;;;qBAA0Y,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAAs3B,CAAC;;;;;;;;;;;;qBAA8V,CAAC;;;;;;;;;;;;;qBAA0Y,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAA50E,CAAC;;;;;;;;;;;;qBAA8V,CAAC;;;;;;;;;;;;;qBAA0Y,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAAs3B,CAAC;;;;;;;;;;;;qBAA8V,CAAC;;;;;;;;;;;;;qBAA0Y,CAAC;;;;;;;EAJ9twB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}