@canton-network/wallet-gateway-remote 1.3.0 → 1.5.0

package/dist/ledger/wallet-allocation/wallet-allocation-service.test.js

@@ -24,8 +24,14 @@ const createAllocatedParty = (partyId, hint, namespace) => ({
     hint,
     namespace,
 });
+const authContext = {
+    userId: 'user-1',
+    accessToken: 'access-token',
+    email: 'user-1@example.com',
+};
+const FIREBLOCKS_VAULT_NAME = 'Canton Party';
 function createFireblocksDriver(options) {
-    const getKeysResult = {
+    const getKeysResult = options.getKeysResult ?? {
         keys: [{ id: 'key-1', name: 'Canton Party', publicKey: 'fb-pk' }],
     };
     const signTransactionResult = options.signTransactionResult ?? {
@@ -48,6 +54,9 @@ function createFireblocksDriver(options) {
     };
 }
 function createBlockdaemonDriver(options) {
+    const createKeyResult = options.createKeyResult ?? {
+        publicKey: 'bd-pk',
+    };
     const signTransactionResult = options.signTransactionResult ?? {
         status: 'pending',
         txId: 'tx-1',
@@ -57,9 +66,31 @@ function createBlockdaemonDriver(options) {
         controller: vi.fn().mockReturnValue({
             createKey: vi
                 .fn()
-                .mockResolvedValue({
-                publicKey: 'bd-pk',
-            }),
+                .mockResolvedValue(createKeyResult),
+            signTransaction: vi
+                .fn()
+                .mockResolvedValue(signTransactionResult),
+            getTransaction: vi
+                .fn()
+                .mockResolvedValue(getTransactionResult),
+        }),
+    };
+}
+function createDfnsDriver(options) {
+    const createKeyResult = options.createKeyResult ?? {
+        id: 'key-1',
+        publicKey: 'dfns-pk',
+    };
+    const signTransactionResult = options.signTransactionResult ?? {
+        status: 'pending',
+        txId: 'tx-1',
+    };
+    const getTransactionResult = options.getTransactionResult ?? signTransactionResult;
+    return {
+        controller: vi.fn().mockReturnValue({
+            createKey: vi
+                .fn()
+                .mockResolvedValue(createKeyResult),
             signTransaction: vi
                 .fn()
                 .mockResolvedValue(signTransactionResult),
@@ -129,8 +160,8 @@ describe('WalletAllocationService', () => {
         it('createWallet allocates new party and adds wallet', async () => {
             const expectedParty = createAllocatedParty('alice::participant1', 'alice', 'participant1');
             mockPartyAllocator.allocateParty.mockResolvedValue(expectedParty);
-            const result = await service.createWallet('user-1', undefined, 'alice', false, SigningProvider.PARTICIPANT);
-            expect(mockPartyAllocator.allocateParty).toHaveBeenCalledWith('user-1', 'alice');
+            const result = await service.createWallet(authContext, 'alice', false, SigningProvider.PARTICIPANT);
+            expect(mockPartyAllocator.allocateParty).toHaveBeenCalledWith(authContext.userId, 'alice');
             expect(mockStore.addWallet).toHaveBeenCalledWith(expect.objectContaining({
                 partyId: 'alice::participant1',
                 status: 'allocated',
@@ -147,8 +178,8 @@ describe('WalletAllocationService', () => {
                 namespace: 'namespace',
                 signingProviderId: SigningProvider.PARTICIPANT,
             });
-            await service.allocateParty('user-1', undefined, existingWallet, SigningProvider.PARTICIPANT);
-            expect(mockPartyAllocator.allocateParty).toHaveBeenCalledWith('user-1', 'alice');
+            await service.allocateParty(authContext, existingWallet, SigningProvider.PARTICIPANT);
+            expect(mockPartyAllocator.allocateParty).toHaveBeenCalledWith(authContext.userId, 'alice');
             expect(mockStore.updateWallet).toHaveBeenCalledWith({
                 partyId: 'alice::participant1',
                 networkId: 'network1',
@@ -161,7 +192,7 @@ describe('WalletAllocationService', () => {
             const expectedParty = createAllocatedParty('bob::fingerprint', 'bob', 'fingerprint');
             mockPartyAllocator.createFingerprintFromKey.mockReturnValue('fingerprint');
             mockPartyAllocator.allocateParty.mockResolvedValue(expectedParty);
-            const result = await service.createWallet('user-1', undefined, 'bob', false, SigningProvider.WALLET_KERNEL);
+            const result = await service.createWallet(authContext, 'bob', false, SigningProvider.WALLET_KERNEL);
             expect(mockStore.addWallet).toHaveBeenCalledWith(expect.objectContaining({
                 partyId: 'bob::fingerprint',
                 status: 'allocated',
@@ -169,7 +200,7 @@ describe('WalletAllocationService', () => {
             }));
             expect(result.partyId).toBe('bob::fingerprint');
             expect(result.publicKey).toBe('new-public-key');
-            expect(mockWalletKernelDriver.controller).toHaveBeenCalledWith('user-1');
+            expect(mockWalletKernelDriver.controller).toHaveBeenCalledWith(authContext.userId);
             expect(mockController.createKey).toHaveBeenCalledWith({
                 name: 'bob',
             });
@@ -187,7 +218,7 @@ describe('WalletAllocationService', () => {
                 publicKey: 'existing-public-key',
                 signingProviderId: SigningProvider.WALLET_KERNEL,
             });
-            await service.allocateParty('user-1', undefined, existingWallet, SigningProvider.WALLET_KERNEL);
+            await service.allocateParty(authContext, existingWallet, SigningProvider.WALLET_KERNEL);
             expect(mockController.signTransaction).toHaveBeenCalledWith(expect.objectContaining({
                 txHash: 'test-hash',
                 keyIdentifier: { publicKey: 'existing-public-key' },
@@ -200,13 +231,56 @@ describe('WalletAllocationService', () => {
         });
         it('throws when Wallet Gateway signing driver not available', async () => {
             const serviceWithoutDriver = createService({});
-            await expect(serviceWithoutDriver.createWallet('user-1', undefined, 'bob', false, SigningProvider.WALLET_KERNEL)).rejects.toThrow('Wallet Gateway signing driver not available');
+            await expect(serviceWithoutDriver.createWallet(authContext, 'bob', false, SigningProvider.WALLET_KERNEL)).rejects.toThrow('Wallet Gateway signing driver not available');
+        });
+        it('throws when createKey returns a signing error', async () => {
+            mockController.createKey.mockResolvedValue({
+                error: 'denied',
+                error_description: 'Key creation failed',
+            });
+            await expect(service.createWallet(authContext, 'bob', false, SigningProvider.WALLET_KERNEL)).rejects.toThrow('Error from signing driver: Key creation failed');
+        });
+        it('throws when signing the topology hash returns a driver error', async () => {
+            mockPartyAllocator.allocateParty.mockImplementation(async (_userId, _hint, _publicKey, signingCallback) => {
+                await signingCallback?.('hash');
+                return createAllocatedParty('bob::fingerprint', 'bob', 'fingerprint');
+            });
+            mockController.signTransaction.mockResolvedValue({
+                error: 'denied',
+                error_description: 'Signing failed',
+            });
+            await expect(service.createWallet(authContext, 'bob', false, SigningProvider.WALLET_KERNEL)).rejects.toThrow('Error from signing driver: Signing failed');
+        });
+        it('throws when signing the topology hash returns no signature', async () => {
+            mockPartyAllocator.allocateParty.mockImplementation(async (_userId, _hint, _publicKey, signingCallback) => {
+                await signingCallback?.('hash');
+                return createAllocatedParty('bob::fingerprint', 'bob', 'fingerprint');
+            });
+            mockController.signTransaction.mockResolvedValue({
+                signature: undefined,
+            });
+            await expect(service.createWallet(authContext, 'bob', false, SigningProvider.WALLET_KERNEL)).rejects.toThrow('No signature returned from signing driver');
+        });
+        it('throws when allocateParty signing callback returns no signature', async () => {
+            mockPartyAllocator.allocateParty.mockImplementation(async (_userId, _hint, _publicKey, signingCallback) => {
+                await signingCallback?.('hash');
+                return createAllocatedParty('bob::fingerprint', 'bob', 'fingerprint');
+            });
+            mockController.signTransaction.mockResolvedValue({
+                signature: undefined,
+            });
+            const existingWallet = createWallet('bob::namespace', {
+                hint: 'bob',
+                publicKey: 'existing-public-key',
+                signingProviderId: SigningProvider.WALLET_KERNEL,
+            });
+            await expect(service.allocateParty(authContext, existingWallet, SigningProvider.WALLET_KERNEL)).rejects.toThrow('No signature returned from signing driver');
         });
     });
     describe('Fireblocks', () => {
         it('throws when Fireblocks signing driver not available', async () => {
             const serviceWithoutFireblocks = createService({});
-            await expect(serviceWithoutFireblocks.createWallet('user-1', undefined, 'alice', false, SigningProvider.FIREBLOCKS)).rejects.toThrow('Fireblocks signing driver not available');
+            await expect(serviceWithoutFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS)).rejects.toThrow('Fireblocks signing driver not available');
         });
         it('createWallet returns allocated when signTransaction returns signed', async () => {
             const serviceWithFireblocks = createService({
@@ -220,7 +294,7 @@ describe('WalletAllocationService', () => {
                 }),
             });
             mockPartyAllocator.allocatePartyWithExistingWallet.mockResolvedValue('alice::namespace');
-            const result = await serviceWithFireblocks.createWallet('user-1', undefined, 'alice', false, SigningProvider.FIREBLOCKS);
+            const result = await serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS, FIREBLOCKS_VAULT_NAME);
             expect(result.status).toBe('allocated');
             expect(result.partyId).toBe('alice::namespace');
             expect(mockPartyAllocator.allocatePartyWithExistingWallet).toHaveBeenCalled();
@@ -236,7 +310,7 @@ describe('WalletAllocationService', () => {
                     },
                 }),
             });
-            const result = await serviceWithFireblocks.createWallet('user-1', undefined, 'alice', false, SigningProvider.FIREBLOCKS);
+            const result = await serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS, FIREBLOCKS_VAULT_NAME);
             expect(result.status).toBe('initialized');
             expect(mockPartyAllocator.allocatePartyWithExistingWallet).not.toHaveBeenCalled();
             expect(mockStore.addWallet).toHaveBeenCalled();
@@ -254,17 +328,168 @@ describe('WalletAllocationService', () => {
                     },
                 }),
             });
-            const result = await serviceWithFireblocks.createWallet('user-1', undefined, 'alice', false, SigningProvider.FIREBLOCKS);
+            const result = await serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS, FIREBLOCKS_VAULT_NAME);
             expect(result.status).toBe('removed');
             expect(result.reason).toBe(expectedReason);
             expect(mockPartyAllocator.allocatePartyWithExistingWallet).not.toHaveBeenCalled();
             expect(mockStore.addWallet).toHaveBeenCalled();
         });
+        it('createWallet handles missing topology transactions from party allocator', async () => {
+            mockPartyAllocator.generateTopologyTransactions.mockResolvedValue({
+                topologyTransactions: undefined,
+                multiHash: 'multi-hash',
+            });
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    signTransactionResult: { status: 'pending', txId: 'tx-1' },
+                }),
+            });
+            const result = await serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS, FIREBLOCKS_VAULT_NAME);
+            expect(result.topologyTransactions).toBe('');
+        });
+        it('throws when getKeys returns a signing error', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    getKeysResult: {
+                        error: 'denied',
+                        error_description: 'Keys unavailable',
+                    },
+                }),
+            });
+            await expect(serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS, FIREBLOCKS_VAULT_NAME)).rejects.toThrow('Error from signing driver: Keys unavailable');
+        });
+        it('throws when vaultName is missing for Fireblocks', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({}),
+            });
+            await expect(serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS)).rejects.toThrow('vaultName is required for creating a wallet with Fireblocks');
+        });
+        it('throws when the selected Fireblocks vault is missing', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    getKeysResult: { keys: [] },
+                }),
+            });
+            await expect(serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS, 'missing-vault')).rejects.toThrow('Fireblocks key not found');
+        });
+        it('getVaults returns vault names for Fireblocks', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    getKeysResult: {
+                        keys: [
+                            {
+                                id: 'key-1',
+                                name: 'Vault A',
+                                publicKey: 'fb-pk-a',
+                            },
+                            {
+                                id: 'key-2',
+                                name: 'Vault B',
+                                publicKey: 'fb-pk-b',
+                            },
+                        ],
+                    },
+                }),
+            });
+            const result = await serviceWithFireblocks.getVaults(authContext, SigningProvider.FIREBLOCKS);
+            expect(result).toEqual({ vaults: ['Vault A', 'Vault B'] });
+        });
+        it('throws when listing vaults for an unsupported signing provider', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({}),
+            });
+            await expect(serviceWithFireblocks.getVaults(authContext, SigningProvider.PARTICIPANT)).rejects.toThrow('Signing provider participant does not support listing vaults');
+        });
+        it('throws when a signed createWallet has no signature in getTransaction', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    signTransactionResult: { status: 'signed', txId: 'tx-1' },
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'signed',
+                    },
+                }),
+            });
+            await expect(serviceWithFireblocks.createWallet(authContext, 'alice', false, SigningProvider.FIREBLOCKS, FIREBLOCKS_VAULT_NAME)).rejects.toThrow('Transaction signed but no signature found in result');
+        });
+        it('throws when allocateParty wallet is missing topology metadata', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({}),
+            });
+            await expect(serviceWithFireblocks.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.FIREBLOCKS,
+                topologyTransactions: undefined,
+                externalTxId: 'tx-1',
+            }), SigningProvider.FIREBLOCKS)).rejects.toThrow('Existing wallet is missing field externalTxId or topologyTransactions');
+        });
+        it('allocateParty updates wallet to pending state', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    getTransactionResult: { txId: 'tx-1', status: 'pending' },
+                }),
+            });
+            await serviceWithFireblocks.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.FIREBLOCKS,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.FIREBLOCKS);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                partyId: 'alice::fingerprint',
+                networkId: 'network1',
+                status: 'initialized',
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING,
+            });
+        });
+        it('allocateParty updates wallet to allocated when transaction is signed', async () => {
+            const hexSignature = 'deadbeef';
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'signed',
+                        signature: hexSignature,
+                    },
+                }),
+            });
+            mockPartyAllocator.allocatePartyWithExistingWallet.mockResolvedValue('alice::namespace');
+            await serviceWithFireblocks.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.FIREBLOCKS,
+                namespace: 'fingerprint',
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.FIREBLOCKS);
+            expect(mockPartyAllocator.allocatePartyWithExistingWallet).toHaveBeenCalledWith('fingerprint', ['tx1'], Buffer.from(hexSignature, 'hex').toString('base64'), 'user-1');
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                networkId: 'network1',
+                partyId: 'alice::namespace',
+                status: 'allocated',
+                reason: '',
+            });
+        });
+        it('allocateParty disables wallet when transaction is rejected', async () => {
+            const serviceWithFireblocks = createService({
+                [SigningProvider.FIREBLOCKS]: createFireblocksDriver({
+                    getTransactionResult: { txId: 'tx-1', status: 'rejected' },
+                }),
+            });
+            await serviceWithFireblocks.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.FIREBLOCKS,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.FIREBLOCKS);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                partyId: 'alice::fingerprint',
+                networkId: 'network1',
+                status: 'removed',
+                disabled: true,
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED,
+            });
+        });
     });
     describe('Blockdaemon', () => {
         it('throws when Blockdaemon signing driver not available', async () => {
             const serviceWithoutBlockdaemon = createService({});
-            await expect(serviceWithoutBlockdaemon.createWallet('user-1', 'user-1@example.com', 'alice', false, SigningProvider.BLOCKDAEMON)).rejects.toThrow('Blockdaemon signing driver not available');
+            await expect(serviceWithoutBlockdaemon.createWallet(authContext, 'alice', false, SigningProvider.BLOCKDAEMON)).rejects.toThrow('Blockdaemon signing driver not available');
         });
         it('createWallet returns initialized when signTransaction returns pending', async () => {
             const serviceWithBlockdaemon = createService({
@@ -272,7 +497,7 @@ describe('WalletAllocationService', () => {
                     signTransactionResult: { status: 'pending', txId: 'tx-1' },
                 }),
             });
-            const result = await serviceWithBlockdaemon.createWallet('user-1', 'user-1@example.com', 'alice', false, SigningProvider.BLOCKDAEMON);
+            const result = await serviceWithBlockdaemon.createWallet(authContext, 'alice', false, SigningProvider.BLOCKDAEMON);
             expect(result.status).toBe('initialized');
             expect(result.reason).toBe(WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING);
             expect(result.externalTxId).toBe('tx-1');
@@ -292,11 +517,317 @@ describe('WalletAllocationService', () => {
                 }),
             });
             mockPartyAllocator.allocatePartyWithExistingWallet.mockResolvedValue('alice::namespace');
-            const result = await serviceWithBlockdaemon.createWallet('user-1', 'user-1@example.com', 'alice', false, SigningProvider.BLOCKDAEMON);
+            const result = await serviceWithBlockdaemon.createWallet(authContext, 'alice', false, SigningProvider.BLOCKDAEMON);
+            expect(result.status).toBe('allocated');
+            expect(result.partyId).toBe('alice::namespace');
+            expect(mockPartyAllocator.allocatePartyWithExistingWallet).toHaveBeenCalled();
+            expect(mockStore.addWallet).toHaveBeenCalled();
+        });
+        it('throws when createKey returns an error object', async () => {
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({
+                    createKeyResult: {
+                        error: 'denied',
+                        error_description: 'Cannot create key',
+                    },
+                }),
+            });
+            await expect(serviceWithBlockdaemon.createWallet(authContext, 'alice', false, SigningProvider.BLOCKDAEMON)).rejects.toThrow('Failed to create key: Cannot create key');
+        });
+        it('throws when a signed createWallet has no signature in getTransaction', async () => {
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({
+                    signTransactionResult: { status: 'signed', txId: 'tx-1' },
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'signed',
+                    },
+                }),
+            });
+            await expect(serviceWithBlockdaemon.createWallet(authContext, 'alice', false, SigningProvider.BLOCKDAEMON)).rejects.toThrow('Transaction signed but no signature found in result');
+        });
+        it.each([
+            ['failed', WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED],
+            ['rejected', WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED],
+        ])('createWallet marks wallet removed when signTransaction returns %s', async (status, expectedReason) => {
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({
+                    signTransactionResult: { status, txId: 'tx-1' },
+                }),
+            });
+            const result = await serviceWithBlockdaemon.createWallet(authContext, 'alice', false, SigningProvider.BLOCKDAEMON);
+            expect(result.status).toBe('removed');
+            expect(result.disabled).toBe(true);
+            expect(result.reason).toBe(expectedReason);
+        });
+        it('throws when allocateParty wallet is missing topology metadata', async () => {
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({}),
+            });
+            await expect(serviceWithBlockdaemon.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.BLOCKDAEMON,
+                topologyTransactions: 'tx1',
+                externalTxId: undefined,
+            }), SigningProvider.BLOCKDAEMON)).rejects.toThrow('Existing wallet is missing field externalTxId or topologyTransactions');
+        });
+        it('allocateParty updates wallet to allocated when transaction is signed', async () => {
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'signed',
+                        signature: 'sig-base64',
+                    },
+                }),
+            });
+            mockPartyAllocator.allocatePartyWithExistingWallet.mockResolvedValue('alice::namespace');
+            await serviceWithBlockdaemon.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.BLOCKDAEMON,
+                namespace: 'fingerprint',
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.BLOCKDAEMON);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                networkId: 'network1',
+                partyId: 'alice::namespace',
+                status: 'allocated',
+                reason: '',
+            });
+        });
+        it('allocateParty updates wallet to pending state', async () => {
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({
+                    getTransactionResult: { txId: 'tx-1', status: 'pending' },
+                }),
+            });
+            await serviceWithBlockdaemon.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.BLOCKDAEMON,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.BLOCKDAEMON);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                partyId: 'alice::fingerprint',
+                networkId: 'network1',
+                status: 'initialized',
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING,
+            });
+        });
+        it('allocateParty disables wallet when transaction is rejected', async () => {
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({
+                    getTransactionResult: { txId: 'tx-1', status: 'rejected' },
+                }),
+            });
+            await serviceWithBlockdaemon.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.BLOCKDAEMON,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.BLOCKDAEMON);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                partyId: 'alice::fingerprint',
+                networkId: 'network1',
+                status: 'removed',
+                disabled: true,
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED,
+            });
+        });
+        it('allocateParty disables wallet when transaction failed', async () => {
+            const warnSpy = vi.spyOn(mockLogger, 'warn');
+            const serviceWithBlockdaemon = createService({
+                [SigningProvider.BLOCKDAEMON]: createBlockdaemonDriver({
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'failed',
+                        metadata: { code: 'X' },
+                    },
+                }),
+            });
+            await serviceWithBlockdaemon.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.BLOCKDAEMON,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.BLOCKDAEMON);
+            expect(warnSpy).toHaveBeenCalled();
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                partyId: 'alice::fingerprint',
+                networkId: 'network1',
+                status: 'removed',
+                disabled: true,
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED,
+            });
+        });
+    });
+    describe('Dfns', () => {
+        it('throws when Dfns signing driver not available', async () => {
+            const serviceWithoutDfns = createService({});
+            await expect(serviceWithoutDfns.createWallet(authContext, 'alice', false, SigningProvider.DFNS)).rejects.toThrow('Dfns signing driver not available');
+        });
+        it('createWallet returns initialized when signTransaction returns pending', async () => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    signTransactionResult: { status: 'pending', txId: 'tx-1' },
+                    getTransactionResult: { status: 'pending', txId: 'tx-1' },
+                }),
+            });
+            const result = await serviceWithDfns.createWallet(authContext, 'alice', false, SigningProvider.DFNS);
+            expect(result.status).toBe('initialized');
+            expect(result.reason).toBe(WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING);
+            expect(result.externalTxId).toBe('tx-1');
+            expect(result.partyId).toBe('alice::fingerprint');
+            expect(mockStore.addWallet).toHaveBeenCalled();
+        });
+        it('createWallet returns allocated when signTransaction returns signed', async () => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    createKeyResult: { id: 'key-1', publicKey: 'dfns-pk' },
+                    signTransactionResult: { status: 'signed', txId: 'tx-1' },
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'signed',
+                        signature: 'sig-base64',
+                    },
+                }),
+            });
+            mockPartyAllocator.allocatePartyWithExistingWallet.mockResolvedValue('alice::namespace');
+            const result = await serviceWithDfns.createWallet(authContext, 'alice', false, SigningProvider.DFNS);
             expect(result.status).toBe('allocated');
             expect(result.partyId).toBe('alice::namespace');
             expect(mockPartyAllocator.allocatePartyWithExistingWallet).toHaveBeenCalled();
             expect(mockStore.addWallet).toHaveBeenCalled();
         });
+        it.each([
+            ['failed', WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED],
+            ['rejected', WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED],
+        ])('createWallet returns status removed with reason when signTransaction returns %s', async (status, expectedReason) => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    signTransactionResult: { status, txId: 'tx-1' },
+                    getTransactionResult: { status, txId: 'tx-1' },
+                }),
+            });
+            const result = await serviceWithDfns.createWallet(authContext, 'alice', false, SigningProvider.DFNS);
+            expect(result.status).toBe('removed');
+            expect(result.reason).toBe(expectedReason);
+            expect(result.disabled).toBe(true);
+            expect(mockStore.addWallet).toHaveBeenCalled();
+        });
+        it('throws when createKey returns a signing error', async () => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    createKeyResult: {
+                        error: 'denied',
+                        error_description: 'Dfns key error',
+                    },
+                }),
+            });
+            await expect(serviceWithDfns.createWallet(authContext, 'alice', false, SigningProvider.DFNS)).rejects.toThrow('Error from signing driver: Dfns key error');
+        });
+        it('throws when a signed createWallet has no signature in getTransaction', async () => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    signTransactionResult: { status: 'signed', txId: 'tx-1' },
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'signed',
+                    },
+                }),
+            });
+            await expect(serviceWithDfns.createWallet(authContext, 'alice', false, SigningProvider.DFNS)).rejects.toThrow('Transaction signed but no signature found in result');
+        });
+        it('throws when allocateParty wallet is missing topology metadata', async () => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({}),
+            });
+            await expect(serviceWithDfns.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.DFNS,
+                topologyTransactions: 'tx1',
+                externalTxId: undefined,
+            }), SigningProvider.DFNS)).rejects.toThrow('Existing wallet is missing field externalTxId or topologyTransactions');
+        });
+        it('allocateParty throws when signed transaction has no signature', async () => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status: 'signed',
+                    },
+                }),
+            });
+            await expect(serviceWithDfns.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.DFNS,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.DFNS)).rejects.toThrow('Transaction signed but no signature found in result');
+        });
+        it('allocateParty updates wallet to allocated when transaction is signed', async () => {
+            const driver = createDfnsDriver({
+                getTransactionResult: {
+                    txId: 'tx-1',
+                    status: 'signed',
+                    signature: 'sig-base64',
+                },
+            });
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: driver,
+            });
+            mockPartyAllocator.allocatePartyWithExistingWallet.mockResolvedValue('alice::namespace');
+            await serviceWithDfns.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.DFNS,
+                namespace: 'fingerprint',
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.DFNS);
+            expect(mockPartyAllocator.allocatePartyWithExistingWallet).toHaveBeenCalledWith('fingerprint', ['tx1'], 'sig-base64', authContext.userId);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                networkId: 'network1',
+                partyId: 'alice::namespace',
+                status: 'allocated',
+                reason: '',
+            });
+        });
+        it('allocateParty updates wallet to initialized when transaction is pending', async () => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    getTransactionResult: { txId: 'tx-1', status: 'pending' },
+                }),
+            });
+            await serviceWithDfns.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.DFNS,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.DFNS);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                partyId: 'alice::fingerprint',
+                networkId: 'network1',
+                status: 'initialized',
+                reason: WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_PENDING,
+            });
+        });
+        it.each([
+            ['failed', WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_FAILED],
+            ['rejected', WALLET_DISABLED_REASON.TOPOLOGY_TRANSACTION_REJECTED],
+        ])('allocateParty disables wallet when transaction is %s', async (status, expectedReason) => {
+            const serviceWithDfns = createService({
+                [SigningProvider.DFNS]: createDfnsDriver({
+                    getTransactionResult: {
+                        txId: 'tx-1',
+                        status,
+                        metadata: { cause: 'test' },
+                    },
+                }),
+            });
+            await serviceWithDfns.allocateParty(authContext, createWallet('alice::fingerprint', {
+                signingProviderId: SigningProvider.DFNS,
+                topologyTransactions: 'tx1',
+                externalTxId: 'tx-1',
+            }), SigningProvider.DFNS);
+            expect(mockStore.updateWallet).toHaveBeenCalledWith({
+                partyId: 'alice::fingerprint',
+                networkId: 'network1',
+                status: 'removed',
+                disabled: true,
+                reason: expectedReason,
+            });
+        });
     });
 });