@canton-network/wallet-gateway-remote 0.17.3 → 0.19.0

package/dist/init.js

@@ -21,6 +21,7 @@ import path from 'path';
 import { GATEWAY_VERSION } from './version.js';
 import { sessionHandler } from './middleware/sessionHandler.js';
 import { NotificationService } from './notification/NotificationService.js';
+import { sql } from 'kysely';
 let isReady = false;
 async function initializeDatabase(config, logger) {
     logger.info('Checking for database migrations...');
@@ -28,6 +29,25 @@ async function initializeDatabase(config, logger) {
     if (config.store.connection.type === 'sqlite') {
         exists = existsSync(config.store.connection.database);
     }
+    if (config.store.connection.type === 'postgres') {
+        const db = connection({
+            ...config.store,
+            connection: { ...config.store.connection, database: 'postgres' },
+        });
+        const result = await sql
+            .raw(`select 1 from pg_database where datname='${config.store.connection.database}';`)
+            .execute(db);
+        const databaseExist = result.rows.length > 0;
+        if (!databaseExist) {
+            // Ignore error because postgres does not support `create database if nor exists` clause
+            await sql
+                .raw(`create database ${config.store.connection.database};`)
+                .execute(db)
+                .catch(() => { });
+            exists = false;
+        }
+        await db.destroy();
+    }
     const db = connection(config.store);
     const umzug = migrator(db);
     const pending = await umzug.pending();
@@ -42,7 +62,7 @@ async function initializeDatabase(config, logger) {
     // bootstrap database from config file if it did not exist before
     if (!exists) {
         logger.info('Bootstrapping database from config...');
-        await bootstrap(db, config.store, logger);
+        await bootstrap(db, config.bootstrap, logger);
     }
     return new StoreSql(db, logger);
 }
@@ -52,6 +72,28 @@ async function initializeSigningDatabase(config, logger) {
     if (config.signingStore.connection.type === 'sqlite') {
         exists = existsSync(config.signingStore.connection.database);
     }
+    if (config.signingStore.connection.type === 'postgres') {
+        const db = signingConnection({
+            ...config.signingStore,
+            connection: {
+                ...config.signingStore.connection,
+                database: 'postgres',
+            },
+        });
+        const result = await sql
+            .raw(`select 1 from pg_database where datname='${config.signingStore.connection.database}';`)
+            .execute(db);
+        const databaseExist = result.rows.length > 0;
+        if (!databaseExist) {
+            // Ignore error because postgres does not support `create database if nor exists` clause
+            await sql
+                .raw(`create database ${config.signingStore.connection.database};`)
+                .execute(db)
+                .catch(() => { });
+            exists = false;
+        }
+        await db.destroy();
+    }
     const db = signingConnection(config.signingStore);
     const umzug = signingMigrator(db);
     const pending = await umzug.pending();
@@ -65,8 +107,8 @@ async function initializeSigningDatabase(config, logger) {
     }
     // bootstrap database from config file if it did not exist before
     if (!exists) {
-        logger.info('Bootstrapping database from config...');
-        await signingBootstrap(db, config.store, logger);
+        logger.info('Bootstrapping signing database from config...');
+        await signingBootstrap(db, config.signingStore, logger);
     }
     return new SigningStoreSql(db, logger);
 }
@@ -128,7 +170,12 @@ export async function initialize(opts, logger) {
     };
     const allowedPaths = {
         [config.server.dappPath]: ['*'],
-        [config.server.userPath]: ['addSession', 'listNetworks', 'listIdps'],
+        [config.server.userPath]: [
+            'addSession',
+            'listNetworks',
+            'listIdps',
+            'getUser',
+        ],
     };
     app.use('/api/*splat', express.json());
     app.use('/api/*splat', rpcRateLimit);
@@ -138,7 +185,7 @@ export async function initialize(opts, logger) {
     // register dapp API handlers
     dapp(config.server.dappPath, app, logger, server, kernelInfo, dappApiUrl, publicUrl, config.server, notificationService, authService, store);
     // register user API handlers
-    user(config.server.userPath, app, logger, kernelInfo, publicUrl, notificationService, drivers, store);
+    user(config.server.userPath, app, logger, kernelInfo, publicUrl, notificationService, drivers, store, config.server.admin);
     // register web handler
     web(app, server, userApiUrl);
     isReady = true;

package/dist/ledger/wallet-sync-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-sync-service.d.ts","sourceRoot":"","sources":["../../src/ledger/wallet-sync-service.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,YAAY,EAEf,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAEtE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB;;CAElC,CAAA;AAED,qBAAa,iBAAiB;IAEtB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,cAAc;gBARd,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,YAAY,EAC/B,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,CAC3B,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,YAAK,EACE,cAAc,EAAE,sBAAsB;IAG5C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAU3B,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAC5D;QACI,iBAAiB,EAAE,eAAe,CAAC,WAAW,CAAA;QAC9C,OAAO,EAAE,OAAO,CAAA;KACnB,GACD;QACI,iBAAiB,EAAE,OAAO,CACtB,eAAe,EACf,eAAe,CAAC,WAAW,CAC9B,CAAA;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,OAAO,CAAA;KACnB,CACN;YA6Ha,mBAAmB;IAqC3B,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC;IA6BtC,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC;CA8HjD"}
+{"version":3,"file":"wallet-sync-service.d.ts","sourceRoot":"","sources":["../../src/ledger/wallet-sync-service.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,YAAY,EAEf,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAEtE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,sBAAsB;;CAElC,CAAA;AAED,qBAAa,iBAAiB;IAEtB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,cAAc;gBARd,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,YAAY,EAC/B,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,CAC3B,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,YAAK,EACE,cAAc,EAAE,sBAAsB;IAG5C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAU3B,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAC5D;QACI,iBAAiB,EAAE,eAAe,CAAC,WAAW,CAAA;QAC9C,OAAO,EAAE,OAAO,CAAA;KACnB,GACD;QACI,iBAAiB,EAAE,OAAO,CACtB,eAAe,EACf,eAAe,CAAC,WAAW,CAC9B,CAAA;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,OAAO,CAAA;KACnB,CACN;YA6Ha,mBAAmB;IAqC3B,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC;IA+BtC,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC;CAsJjD"}

package/dist/ledger/wallet-sync-service.js

@@ -144,21 +144,19 @@ export class WalletSyncService {
     }
     async isWalletSyncNeeded() {
         try {
+            const network = await this.store.getCurrentNetwork();
             const existingWallets = await this.store.getWallets();
-            // Check if there are any disabled wallets
             const hasDisabledWallets = existingWallets.some((w) => w.disabled);
             if (hasDisabledWallets) {
                 return true;
             }
-            // Check if there are parties on ledger that aren't in store
             const partiesWithRights = await this.getPartiesRightsMap();
             // Treat disabled wallets as if they don't exist, so they can be re-synced
             const enabledWallets = existingWallets.filter((w) => !w.disabled);
-            const existingPartyIds = new Set(enabledWallets.map((w) => w.partyId));
-            // Check if there are parties on ledger that aren't in store
-            return partiesWithRights
-                .keys()
-                .some((party) => !existingPartyIds.has(party));
+            // Track by (partyId, networkId) combination to handle multi-hosted parties
+            const existingPartyNetworkPairs = new Set(enabledWallets.map((w) => `${w.partyId}:${w.networkId}`));
+            // Check if there are parties on ledger that aren't in store for this network
+            return Array.from(partiesWithRights.keys()).some((party) => !existingPartyNetworkPairs.has(`${party}:${network.id}`));
         }
         catch (err) {
             this.logger.error({ err }, 'Error checking if sync is needed');
@@ -171,17 +169,25 @@ export class WalletSyncService {
         try {
             const network = await this.store.getCurrentNetwork();
             this.logger.info(network, 'Current network');
-            // Get existing parties from participant
             const partiesWithRights = await this.getPartiesRightsMap();
             // Add new Wallets given the found parties
+            // Only check wallets in the current network
             const existingWallets = await this.store.getWallets();
             this.logger.info(existingWallets, 'Existing wallets');
             // Treat disabled wallets as if they don't exist, so they can be re-synced
             const enabledWallets = existingWallets.filter((w) => !w.disabled);
-            const existingPartyIdToSigningProvider = new Map(enabledWallets.map((w) => [w.partyId, w.signingProviderId]));
-            const disabledPartyIds = new Set(existingWallets.filter((w) => w.disabled).map((w) => w.partyId));
+            // Track by (partyId, networkId) combination
+            const existingPartyNetworkToSigningProvider = new Map(enabledWallets.map((w) => [
+                `${w.partyId}:${w.networkId}`,
+                w.signingProviderId,
+            ]));
+            // Track disabled wallets by (partyId, networkId) combination
+            const disabledPartyNetworkPairs = new Set(existingWallets
+                .filter((w) => w.disabled)
+                .map((w) => `${w.partyId}:${w.networkId}`));
             // Resolve signing providers for all new parties
-            const newParties = Array.from(partiesWithRights.keys()).filter((party) => !existingPartyIdToSigningProvider.has(party)
+            // Check if (partyId, networkId) combination already exists
+            const newParties = Array.from(partiesWithRights.keys()).filter((party) => !existingPartyNetworkToSigningProvider.has(`${party}:${network.id}`)
             // todo: filter on idp id
             );
             this.logger.info({ newParties }, 'Found new parties to sync with Wallet Gateway');
@@ -217,10 +223,14 @@ export class WalletSyncService {
                 return wallet;
             }));
             // Remove disabled wallets that are being re-synced before adding them back
+            // Filter by (partyId, networkId) combination
             await Promise.all(newParticipantWallets
-                .filter((wallet) => disabledPartyIds.has(wallet.partyId))
+                .filter((wallet) => disabledPartyNetworkPairs.has(`${wallet.partyId}:${wallet.networkId}`))
                 .map((wallet) => {
-                this.logger.info({ partyId: wallet.partyId }, 'Removing disabled wallet for re-sync');
+                this.logger.info({
+                    partyId: wallet.partyId,
+                    networkId: wallet.networkId,
+                }, 'Removing disabled wallet for re-sync');
                 return this.store.removeWallet(wallet.partyId);
             }));
             await Promise.all(newParticipantWallets.map((wallet) => this.store.addWallet(wallet)));
@@ -231,14 +241,14 @@ export class WalletSyncService {
                 disabled: newParticipantWallets.filter((w) => w.disabled)
                     .length,
             }, 'Wallet sync summary');
-            // Set primary wallet if none exists
-            const wallets = await this.store.getWallets();
-            const hasPrimary = wallets.some((w) => w.primary);
-            if (!hasPrimary && wallets.length > 0) {
-                this.store.setPrimaryWallet(wallets[0].partyId);
-                this.logger.info(`Set ${wallets[0].partyId} as primary wallet`);
+            // Set primary wallet if none exists in current network
+            const networkWallets = await this.store.getWallets();
+            const hasPrimary = networkWallets.some((w) => w.primary);
+            if (!hasPrimary && networkWallets.length > 0) {
+                this.store.setPrimaryWallet(networkWallets[0].partyId);
+                this.logger.info(`Set ${networkWallets[0].partyId} as primary wallet in network ${network.id}`);
             }
-            this.logger.debug(wallets, 'Wallet sync completed.');
+            this.logger.debug({ wallets: newParticipantWallets }, 'Wallet sync completed.');
             return {
                 added: newParticipantWallets,
                 removed: [],

package/dist/ledger/wallet-sync-service.test.js

@@ -7,6 +7,7 @@ import { SigningProvider, } from '@canton-network/core-signing-lib';
 import { InternalSigningDriver } from '@canton-network/core-signing-internal';
 import { ParticipantSigningDriver } from '@canton-network/core-signing-participant';
 import { StoreSql, connection, migrator, } from '@canton-network/core-signing-store-sql';
+import { StoreInternal } from '@canton-network/core-wallet-store-inmemory';
 import { WalletSyncService } from './wallet-sync-service.js';
 import { PartyAllocationService } from './party-allocation-service.js';
 const mockLedgerGet = jest.fn();
@@ -103,6 +104,9 @@ describe('WalletSyncService - resolveSigningProvider', () => {
         const internalDriver = service['signingDrivers'][SigningProvider.WALLET_KERNEL];
         const controller = internalDriver.controller(authContext.userId);
         const key = await controller.createKey({ name: 'test-key' });
+        if ('error' in key) {
+            throw new Error(`Failed to create key in test: ${key.error_description}`);
+        }
         const namespace = partyAllocator.createFingerprintFromKey(key.publicKey);
         mockLedgerGet.mockResolvedValueOnce({
             participantId: 'participant1::different-participant-namespace',
@@ -165,3 +169,338 @@ describe('WalletSyncService - resolveSigningProvider', () => {
         });
     });
 });
+describe('WalletSyncService - multi-network features', () => {
+    const authContext = {
+        userId: 'test-user-id',
+        accessToken: 'test-access-token',
+    };
+    let mockLogger;
+    let store;
+    let mockLedgerClient;
+    let mockAdminLedgerClient;
+    let partyAllocator;
+    const createNetwork = (id) => ({
+        id,
+        name: `Network ${id}`,
+        synchronizerId: `${id}-sync`,
+        identityProviderId: 'idp1',
+        description: `Test Network ${id}`,
+        ledgerApi: { baseUrl: `http://${id}` },
+        auth: {
+            method: 'authorization_code',
+            clientId: 'cid',
+            scope: 'scope',
+            audience: 'aud',
+        },
+    });
+    const createWallet = (partyId, networkId, disabled = false) => ({
+        primary: false,
+        partyId,
+        status: 'allocated',
+        hint: partyId.split('::')[0],
+        signingProviderId: 'internal',
+        publicKey: 'publicKey',
+        namespace: 'namespace',
+        networkId,
+        disabled,
+    });
+    const setSession = async (networkId) => {
+        await store.setSession({
+            id: `sess-${networkId}`,
+            network: networkId,
+            accessToken: 'token',
+        });
+    };
+    beforeEach(async () => {
+        mockLogger = pino(sink());
+        store = new StoreInternal({
+            idps: [],
+            networks: [],
+        }, mockLogger, authContext);
+        // Add a default IdP that tests can use (use updateIdp to avoid errors if it already exists)
+        try {
+            await store.addIdp({
+                id: 'idp1',
+                type: 'oauth',
+                issuer: 'http://auth',
+                configUrl: 'http://auth/.well-known/openid-configuration',
+            });
+        }
+        catch {
+            // IdP might already exist from previous test, use updateIdp instead
+            await store.updateIdp({
+                id: 'idp1',
+                type: 'oauth',
+                issuer: 'http://auth',
+                configUrl: 'http://auth/.well-known/openid-configuration',
+            });
+        }
+        partyAllocator = new PartyAllocationService({
+            synchronizerId: 'test-sync-id',
+            accessTokenProvider: {
+                getUserAccessToken: async () => 'user.jwt',
+                getAdminAccessToken: async () => 'admin.jwt',
+            },
+            httpLedgerUrl: 'http://test',
+            logger: mockLogger,
+        });
+        const ledgerModule = await import('@canton-network/core-ledger-client');
+        mockLedgerClient = new ledgerModule.LedgerClient({
+            baseUrl: new URL('http://test'),
+            logger: mockLogger,
+            accessTokenProvider: {
+                getUserAccessToken: async () => 'token',
+                getAdminAccessToken: async () => 'token',
+            },
+        });
+        mockAdminLedgerClient = new ledgerModule.LedgerClient({
+            baseUrl: new URL('http://test'),
+            logger: mockLogger,
+            isAdmin: true,
+            accessTokenProvider: {
+                getUserAccessToken: async () => 'token',
+                getAdminAccessToken: async () => 'token',
+            },
+        });
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+        mockLedgerGet.mockClear();
+    });
+    it('isWalletSyncNeeded should filter by current network', async () => {
+        const network1 = createNetwork('network1');
+        await store.addNetwork(network1);
+        await setSession('network1');
+        await store.addWallet(createWallet('party1::namespace', 'network1'));
+        await store.addWallet(createWallet('party2::namespace', 'network2'));
+        mockLedgerGet.mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        });
+        const service = new WalletSyncService(store, mockLedgerClient, mockAdminLedgerClient, authContext, mockLogger, {}, partyAllocator);
+        const syncNeeded = await service.isWalletSyncNeeded();
+        // Should return false because party1 already exists in network1
+        expect(syncNeeded).toBe(false);
+    });
+    it('isWalletSyncNeeded should detect new parties for current network only', async () => {
+        const network1 = createNetwork('network1');
+        await store.addNetwork(network1);
+        await setSession('network1');
+        mockLedgerGet.mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        });
+        const service = new WalletSyncService(store, mockLedgerClient, mockAdminLedgerClient, authContext, mockLogger, {}, partyAllocator);
+        const syncNeeded = await service.isWalletSyncNeeded();
+        // Should return true because party1 exists on ledger but not in store for network1
+        expect(syncNeeded).toBe(true);
+    });
+    it('syncWallets should only sync wallets for current network', async () => {
+        const network1 = createNetwork('network1');
+        await store.addNetwork(network1);
+        await setSession('network1');
+        await store.addWallet(createWallet('party1::namespace', 'network1'));
+        const addWalletSpy = jest.spyOn(store, 'addWallet');
+        mockLedgerGet
+            .mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party3::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        })
+            .mockResolvedValueOnce({
+            participantId: 'participant1::namespace',
+        });
+        const service = new WalletSyncService(store, mockLedgerClient, mockAdminLedgerClient, authContext, mockLogger, {}, partyAllocator);
+        await service.syncWallets();
+        // Should only add wallet for party3 (party1 already exists)
+        const wallets = await store.getAllWallets({ networkIds: ['network1'] });
+        expect(wallets.some((w) => w.partyId === 'party3::namespace')).toBe(true);
+        expect(addWalletSpy).toHaveBeenCalled();
+    });
+    it('syncWallets should handle same party ID across different networks', async () => {
+        const network1 = createNetwork('network1');
+        await store.addNetwork(network1);
+        await setSession('network1');
+        // Mock ledger client to return rights for party1
+        mockLedgerGet
+            .mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        })
+            .mockResolvedValueOnce({
+            participantId: 'participant1::namespace',
+        });
+        const service = new WalletSyncService(store, mockLedgerClient, mockAdminLedgerClient, authContext, mockLogger, {}, partyAllocator);
+        await service.syncWallets();
+        // Should add party1 for network1
+        const wallets = await store.getAllWallets({ networkIds: ['network1'] });
+        expect(wallets.some((w) => w.partyId === 'party1::namespace')).toBe(true);
+    });
+    it('isWalletSyncNeeded should detect multi-hosted party on different network', async () => {
+        const network1 = createNetwork('network1');
+        const network2 = createNetwork('network2');
+        await store.addNetwork(network1);
+        await store.addNetwork(network2);
+        await store.addWallet(createWallet('party1::namespace', 'network1'));
+        const service = new WalletSyncService(store, mockLedgerClient, mockAdminLedgerClient, authContext, mockLogger, {}, partyAllocator);
+        // Mock ledger client to return rights for party1 (multi-hosted party) for network1 check
+        mockLedgerGet.mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        });
+        await setSession('network1');
+        // Check sync needed for network1 (party already exists)
+        const syncNeeded1 = await service.isWalletSyncNeeded();
+        expect(syncNeeded1).toBe(false);
+        // Mock ledger client to return rights for party1 for network2 check
+        mockLedgerGet.mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        });
+        await setSession('network2');
+        // Check sync needed for network2 (party doesn't exist yet)
+        const syncNeeded2 = await service.isWalletSyncNeeded();
+        expect(syncNeeded2).toBe(true);
+    });
+    it('syncWallets should handle multi-hosted party across networks', async () => {
+        const network1 = createNetwork('network1');
+        const network2 = createNetwork('network2');
+        await store.addNetwork(network1);
+        await store.addNetwork(network2);
+        // Add wallet to network1 (simulating it was synced there previously)
+        await setSession('network1');
+        await store.addWallet(createWallet('party1::namespace', 'network1'));
+        const service = new WalletSyncService(store, mockLedgerClient, mockAdminLedgerClient, authContext, mockLogger, {}, partyAllocator);
+        // Sync on network1 (party already exists, should not add)
+        await setSession('network1');
+        // Only need one mock since resolveSigningProvider won't be called if party already exists
+        mockLedgerGet.mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        });
+        const syncResult1 = await service.syncWallets();
+        expect(syncResult1.added.length).toBe(0); // Should not add, already exists
+        // Sync on network2 (party doesn't exist, should add)
+        await setSession('network2');
+        // Verify no wallets exist for network2 before sync
+        const walletsBeforeSync = await store.getAllWallets({
+            networkIds: ['network2'],
+        });
+        expect(walletsBeforeSync.length).toBe(0);
+        mockLedgerGet.mockClear();
+        // First mock: getPartiesRightsMap calls ledgerClient.getWithRetry('/v2/users/{user-id}/rights')
+        mockLedgerGet.mockResolvedValueOnce({
+            rights: [
+                {
+                    kind: {
+                        CanActAs: {
+                            value: {
+                                party: 'party1::namespace',
+                            },
+                        },
+                    },
+                },
+            ],
+        });
+        // Second mock: resolveSigningProvider calls adminLedgerClient.getWithRetry('/v2/parties/participant-id')
+        mockLedgerGet.mockResolvedValueOnce({
+            participantId: 'participant1::namespace',
+        });
+        expect(mockLedgerGet).toHaveBeenCalledTimes(0);
+        const syncResult = await service.syncWallets();
+        expect(mockLedgerGet).toHaveBeenCalledTimes(2); // Once for rights, once for participantId
+        expect(syncResult.added.length).toBe(1);
+        expect(syncResult.added[0].partyId).toBe('party1::namespace');
+        expect(syncResult.added[0].networkId).toBe('network2');
+        expect(syncResult.added[0].disabled).toBe(false);
+        const network2Wallets = await store.getAllWallets({
+            networkIds: ['network2'],
+        });
+        const party1Wallet = network2Wallets.find((w) => w.partyId === 'party1::namespace');
+        expect(party1Wallet).toBeDefined();
+        expect(party1Wallet?.networkId).toBe('network2');
+        expect(party1Wallet?.disabled).toBe(false);
+    });
+    // TODO maybe now that we never block sync button don't consider disabled wallet as sync is needed?
+    it('isWalletSyncNeeded should return true when disabled wallets exist', async () => {
+        const network1 = createNetwork('network1');
+        await store.addNetwork(network1);
+        await setSession('network1');
+        await store.addWallet(createWallet('party1::namespace', 'network1', true));
+        const service = new WalletSyncService(store, mockLedgerClient, mockAdminLedgerClient, authContext, mockLogger, {}, partyAllocator);
+        const syncNeeded = await service.isWalletSyncNeeded();
+        // Should return true because there's a disabled wallet
+        expect(syncNeeded).toBe(true);
+    });
+});

package/dist/middleware/jwtAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwtAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/jwtAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B,wBAAgB,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAehE"}
+{"version":3,"file":"jwtAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/jwtAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B,wBAAgB,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkBhE"}

package/dist/middleware/jwtAuth.js

@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 export function jwtAuth(authService, logger) {
     return async (req, res, next) => {
-        const authHeader = req.headers.authorization;
+        // Support both Authorization header and token query parameter (for EventSource)
+        const authHeader = req.headers.authorization ||
+            (req.query.token ? `Bearer ${req.query.token}` : undefined);
         try {
             const context = await authService.verifyToken(authHeader);
             req.authContext = context;

package/dist/user-api/controller.d.ts

@@ -5,7 +5,7 @@ import { AuthContext } from '@canton-network/core-wallet-auth';
 import { KernelInfo } from '../config/Config.js';
 import { SigningDriverInterface, SigningProvider } from '@canton-network/core-signing-lib';
 type AvailableSigningDrivers = Partial<Record<SigningProvider, SigningDriverInterface>>;
-export declare const userController: (kernelInfo: KernelInfo, userUrl: string, store: Store, notificationService: NotificationService, authContext: AuthContext | undefined, drivers: AvailableSigningDrivers, _logger: Logger) => {
+export declare const userController: (kernelInfo: KernelInfo, userUrl: string, store: Store, notificationService: NotificationService, authContext: AuthContext | undefined, drivers: AvailableSigningDrivers, _logger: Logger, adminUserId?: string) => {
     addNetwork: import("./rpc-gen/typings.js").AddNetwork;
     removeNetwork: import("./rpc-gen/typings.js").RemoveNetwork;
     listNetworks: import("./rpc-gen/typings.js").ListNetworks;
@@ -25,6 +25,8 @@ export declare const userController: (kernelInfo: KernelInfo, userUrl: string, s
     listSessions: import("./rpc-gen/typings.js").ListSessions;
     getTransaction: import("./rpc-gen/typings.js").GetTransaction;
     listTransactions: import("./rpc-gen/typings.js").ListTransactions;
+    deleteTransaction: import("./rpc-gen/typings.js").DeleteTransaction;
+    getUser: import("./rpc-gen/typings.js").GetUser;
 };
 export {};
 //# sourceMappingURL=controller.d.ts.map

package/dist/user-api/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA0BA,OAAO,EACH,KAAK,EAIR,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAGH,WAAW,EAId,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AAczC,KAAK,uBAAuB,GAAG,OAAO,CAClC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,uBAAuB,EAChC,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;CAu8BlB,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA4BA,OAAO,EACH,KAAK,EAIR,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAGH,WAAW,EAId,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EACH,sBAAsB,EACtB,eAAe,EAElB,MAAM,kCAAkC,CAAA;AAazC,KAAK,uBAAuB,GAAG,OAAO,CAClC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,uBAAuB,EAChC,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;CA4iCvB,CAAA"}