@canton-network/wallet-gateway-remote 1.3.0 → 1.5.0

package/dist/user-api/controller.js

@@ -4,14 +4,16 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
 import { LedgerClient } from '@canton-network/core-ledger-client';
 import buildController from './rpc-gen/index.js';
-import { assertConnected, authSchema, AuthTokenProvider, fetchOidcUserInfo, idpSchema, } from '@canton-network/core-wallet-auth';
-import { SigningProvider, } from '@canton-network/core-signing-lib';
+import { assertConnected, authSchema, AuthTokenProvider, idpSchema, } from '@canton-network/core-wallet-auth';
+import { isRpcError, SigningProvider } from '@canton-network/core-signing-lib';
 import { PartyAllocationService } from '../ledger/party-allocation-service.js';
 import { WalletAllocationService } from '../ledger/wallet-allocation/wallet-allocation-service.js';
 import { WalletSyncService } from '../ledger/wallet-sync-service.js';
-import { networkStatus } from '../utils.js';
+import { logDynamically, networkStatus } from '../utils.js';
 import { v4 } from 'uuid';
 import { TransactionService } from '../ledger/transaction-service.js';
+import { rpcErrors } from '@canton-network/core-rpc-errors';
+import crypto from 'crypto';
 export const userController = (kernelInfo, userUrl, store, notificationService, authContext, drivers, _logger, adminUserId) => {
     const logger = _logger.child({ component: 'user-controller' });
     const provider = {
@@ -26,27 +28,6 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             throw new Error('Unauthorized: only the admin user can perform this operation');
         }
     }
-    async function resolveUserEmail(connectedContext) {
-        if (connectedContext.email) {
-            return connectedContext.email;
-        }
-        try {
-            const network = await store.getCurrentNetwork();
-            if (!network) {
-                return undefined;
-            }
-            const idp = await store.getIdp(network.identityProviderId);
-            if (idp.type !== 'oauth') {
-                return undefined;
-            }
-            const userInfo = await fetchOidcUserInfo(idp.configUrl, connectedContext.accessToken);
-            return userInfo?.email;
-        }
-        catch (error) {
-            logger.warn(error, 'Failed to resolve user email from OIDC userinfo');
-            return undefined;
-        }
-    }
     return buildController({
         getUser: async () => {
             const userId = assertConnected(authContext).userId;
@@ -95,12 +76,42 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
         listNetworks: async () => {
             const networks = await store.listNetworks();
             return {
-                networks: networks.map((n) => ({
-                    ...n,
-                    ledgerApi: n.ledgerApi.baseUrl,
-                })),
+                networks: networks.map(toPublicNetwork),
             };
         },
+        getNetwork: async (params) => {
+            assertAdmin();
+            const network = await store.getNetwork(params.networkId);
+            return { network: toNetworkDto(network) };
+        },
+        selfSignedAccessToken: async (params) => {
+            const network = (await store.listNetworks()).find((n) => n.id === params.networkId);
+            if (!network) {
+                throw new Error(`Network "${params.networkId}" not found`);
+            }
+            const auth = network.auth;
+            if (auth.method !== 'self_signed') {
+                throw new Error('Network does not use self_signed authentication');
+            }
+            const idp = (await store.listIdps()).find((idp) => idp.id === network.identityProviderId);
+            if (!idp) {
+                throw new Error(`Identity provider "${network.identityProviderId}" not found`);
+            }
+            if (idp.type !== 'self_signed') {
+                throw new Error('Identity provider is not configured for self_signed authentication');
+            }
+            const accessToken = await new AuthTokenProvider({
+                method: 'self_signed',
+                issuer: idp.issuer,
+                credentials: {
+                    clientId: params.clientId,
+                    clientSecret: auth.clientSecret,
+                    scope: auth.scope,
+                    audience: auth.audience,
+                },
+            }, logger).getAccessToken();
+            return { accessToken };
+        },
         addIdp: async (params) => {
             assertAdmin();
             const validatedIdp = idpSchema.parse(params.idp);
@@ -122,14 +133,10 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             await store.removeIdp(params.identityProviderId);
             return null;
         },
-        listIdps: async () => Promise.resolve({ idps: await store.listIdps() }),
+        listIdps: async () => ({ idps: await store.listIdps() }),
         createWallet: async (params) => {
-            logger.info(`Creating wallet with params: ${JSON.stringify(params)}`);
             const { signingProviderId, primary, partyHint } = params;
             const connectedContext = assertConnected(authContext);
-            const userId = connectedContext.userId;
-            const email = await resolveUserEmail(connectedContext);
-            const notifier = notificationService.getNotifier(userId);
             const network = await store.getCurrentNetwork();
             if (network === undefined) {
                 throw new Error('No network session found');
@@ -138,6 +145,7 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             if (!network.adminAuth) {
                 throw new Error('No admin auth configured');
             }
+            const notifier = notificationService.getNotifier(connectedContext.userId);
             const adminTokenProvider = AuthTokenProvider.fromGatewayConfig(idp, network.adminAuth, logger);
             const partyAllocator = new PartyAllocationService({
                 synchronizerId: network.synchronizerId,
@@ -149,7 +157,7 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             if (!drivers[signingProviderId]) {
                 throw new Error(`Signing provider ${signingProviderId} not supported`);
             }
-            const wallet = await walletAllocationService.createWallet(userId, email, partyHint, primary ?? false, signingProviderId);
+            const wallet = await walletAllocationService.createWallet(connectedContext, partyHint, primary ?? false, signingProviderId, params.vaultName);
             // Sync wallets (TODO: separate rights sync from wallet sync as we only need rights sync here)
             const ledgerClient = new LedgerClient({
                 baseUrl: new URL(network.ledgerApi.baseUrl),
@@ -164,24 +172,21 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             return { wallet };
         },
         allocatePartyForWallet: async (params) => {
-            logger.info(`Allocating party for wallet: ${JSON.stringify(params)}`);
             const connectedContext = assertConnected(authContext);
             const userId = connectedContext.userId;
-            const email = await resolveUserEmail(connectedContext);
-            const notifier = notificationService.getNotifier(userId);
             const network = await store.getCurrentNetwork();
             if (!network) {
                 throw new Error('No network session found');
             }
+            if (!network.adminAuth) {
+                throw new Error('No admin auth configured');
+            }
             const allWallets = await store.getWallets();
             const existingWallet = allWallets.find((w) => w.partyId === params.partyId && w.networkId === network.id);
             if (!existingWallet) {
                 throw new Error(`Wallet not found for party ${params.partyId}`);
             }
             const idp = await store.getIdp(network.identityProviderId);
-            if (!network.adminAuth) {
-                throw new Error('No admin auth configured');
-            }
             const accessTokenProvider = AuthTokenProvider.fromGatewayConfig(idp, network.adminAuth, logger);
             const partyAllocator = new PartyAllocationService({
                 synchronizerId: network.synchronizerId,
@@ -194,7 +199,7 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             if (!drivers[signingProviderId]) {
                 throw new Error(`Signing provider ${signingProviderId} not supported`);
             }
-            await walletAllocationService.allocateParty(userId, email, existingWallet, signingProviderId);
+            await walletAllocationService.allocateParty(connectedContext, existingWallet, signingProviderId);
             // Sync wallets (TODO: separate rights sync from wallet sync as we only need rights sync here)
             const ledgerClient = new LedgerClient({
                 baseUrl: new URL(network.ledgerApi.baseUrl),
@@ -207,6 +212,7 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             const wallets = await store.getWallets();
             const wallet = wallets.find((w) => w.partyId === existingWallet.partyId &&
                 w.networkId === network.id);
+            const notifier = notificationService.getNotifier(userId);
             notifier?.emit('accountsChanged', wallets);
             return { wallet };
         },
@@ -219,7 +225,9 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             notifier?.emit('accountsChanged', wallets);
             return null;
         },
-        removeWallet: async (params) => Promise.resolve({}),
+        removeWallet: async (params) => {
+            throw rpcErrors.methodNotSupported();
+        },
         listWallets: async (params) => {
             return await store.getWallets(params.filter);
         },
@@ -235,36 +243,153 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             }
             const connectedContext = assertConnected(authContext);
             const userId = connectedContext.userId;
-            const email = await resolveUserEmail(connectedContext);
             const notifier = notificationService.getNotifier(userId);
-            const signingProvider = wallet.signingProviderId;
-            const driver = drivers[signingProvider]?.controller(userId);
-            if (!driver) {
-                throw new Error(`No driver found for ${wallet.signingProviderId}`);
-            }
             const transactionService = new TransactionService(store, logger, drivers, notifier);
-            switch (wallet.signingProviderId) {
-                case SigningProvider.PARTICIPANT: {
-                    return transactionService.signWithParticipant(wallet);
-                }
-                case SigningProvider.WALLET_KERNEL: {
-                    return transactionService.signWithWalletKernel(userId, wallet, signParams);
-                }
-                case SigningProvider.BLOCKDAEMON: {
-                    if (!email) {
-                        throw new Error('Email is required for Blockdaemon wallet allocation');
-                    }
-                    return transactionService.signWithBlockdaemon(email, wallet, signParams);
-                }
-                case SigningProvider.FIREBLOCKS: {
-                    return transactionService.signWithFireblocks(userId, wallet, signParams);
+            logDynamically(logger, 'signing transaction with params', {
+                info: { transactionId: signParams.transactionId },
+                debug: { signParams, wallet, connectedContext },
+            });
+            const response = await transactionService.sign(connectedContext, wallet, signParams);
+            logDynamically(logger, 'transaction signed with response', {
+                info: { transactionId: signParams.transactionId },
+                debug: { response },
+            });
+            return response;
+        },
+        signMessage: async (params) => {
+            const pending = await store.getMessageRaw(params.messageId);
+            if (!pending) {
+                throw new Error(`Message signing request not found with id: ${params.messageId}`);
+            }
+            if (pending.status !== 'pending') {
+                throw new Error(`Cannot sign message with status '${pending.status}'. Only pending messages can be signed.`);
+            }
+            const userId = assertConnected(authContext).userId;
+            if (pending.userId !== userId) {
+                throw new Error(`Message signing request ${pending.id} is not owned by user ${userId}`);
+            }
+            const notifier = notificationService.getNotifier(userId);
+            const emitFailedAndPersist = async (details) => {
+                // Best-effort: make sure listeners see a terminal state.
+                try {
+                    await store.setMessageRawStatus(pending.id, 'failed');
                 }
-                case SigningProvider.DFNS: {
-                    return transactionService.signWithDfns(userId, wallet, signParams);
+                catch {
+                    // ignore (e.g. record removed concurrently)
                 }
-                default:
-                    throw new Error(`Unsupported signing provider: ${wallet.signingProviderId}`);
+                notifier.emit('messageSignature', {
+                    status: 'failed',
+                    messageId: pending.id,
+                });
+                // Preserve the original error message for the caller/UI.
+                throw new Error(details);
+            };
+            const wallet = (await store.getWallets()).find((w) => w.partyId === pending.partyId);
+            if (!wallet) {
+                return await emitFailedAndPersist(`No wallet found for partyId ${pending.partyId} (from message request ${pending.id})`);
+            }
+            if (wallet.publicKey !== pending.publicKey) {
+                return await emitFailedAndPersist(`Wallet public key changed for partyId ${pending.partyId}; refusing to sign message request ${pending.id}`);
+            }
+            // TODO: support other signing providers
+            if (wallet.signingProviderId !== SigningProvider.WALLET_KERNEL) {
+                return await emitFailedAndPersist(`signMessage is only supported for ${SigningProvider.WALLET_KERNEL} wallets, got ${wallet.signingProviderId}`);
+            }
+            const driver = drivers[SigningProvider.WALLET_KERNEL]?.controller(userId);
+            if (!driver) {
+                return await emitFailedAndPersist('Wallet Kernel signing driver not available');
+            }
+            const result = await driver.signMessage({
+                message: pending.message,
+                keyIdentifier: { publicKey: wallet.publicKey },
+            });
+            if (isRpcError(result)) {
+                await store.setMessageRawStatus(pending.id, 'failed');
+                notifier.emit('messageSignature', {
+                    status: 'failed',
+                    messageId: pending.id,
+                });
+                throw new Error(result.error_description);
+            }
+            if (!result?.signature) {
+                await store.setMessageRawStatus(pending.id, 'failed');
+                notifier.emit('messageSignature', {
+                    status: 'failed',
+                    messageId: pending.id,
+                });
+                throw new Error(`signMessage failed`);
+            }
+            await store.setMessageRawStatus(pending.id, 'signed', {
+                signedAt: new Date(),
+                signature: result.signature,
+            });
+            notifier.emit('messageSignature', {
+                status: 'signed',
+                messageId: pending.id,
+                signature: result.signature,
+            });
+            return {
+                signature: result.signature,
+                publicKey: wallet.publicKey,
+            };
+        },
+        getMessageToSign: async (params) => {
+            const message = await store.getMessageRaw(params.messageId);
+            if (!message) {
+                throw new Error(`Message signing request not found with id: ${params.messageId}`);
             }
+            return {
+                message: {
+                    id: message.id,
+                    status: message.status,
+                    partyId: message.partyId,
+                    publicKey: message.publicKey,
+                    message: message.message,
+                    ...(message.origin !== null && { origin: message.origin }),
+                    ...(message.createdAt && {
+                        createdAt: message.createdAt.toISOString(),
+                    }),
+                    ...(message.signedAt && {
+                        signedAt: message.signedAt.toISOString(),
+                    }),
+                    ...(message.signature && { signature: message.signature }),
+                },
+            };
+        },
+        listMessagesToSign: async () => {
+            const messages = await store.listMessageRaws();
+            return {
+                messages: messages.map((message) => ({
+                    id: message.id,
+                    status: message.status,
+                    partyId: message.partyId,
+                    publicKey: message.publicKey,
+                    message: message.message,
+                    ...(message.origin !== null && { origin: message.origin }),
+                    ...(message.createdAt && {
+                        createdAt: message.createdAt.toISOString(),
+                    }),
+                    ...(message.signedAt && {
+                        signedAt: message.signedAt.toISOString(),
+                    }),
+                    ...(message.signature && { signature: message.signature }),
+                })),
+            };
+        },
+        deleteMessageToSign: async (params) => {
+            const message = await store.getMessageRaw(params.messageId);
+            if (!message) {
+                throw new Error(`Message signing request not found with id: ${params.messageId}`);
+            }
+            if (message.status !== 'pending') {
+                throw new Error(`Cannot delete message with status '${message.status}'. Only pending messages can be deleted.`);
+            }
+            const userId = assertConnected(authContext).userId;
+            if (message.userId !== userId) {
+                throw new Error(`Message signing request ${message.id} is not owned by user ${userId}`);
+            }
+            await store.removeMessageRaw(message.id);
+            return null;
         },
         execute: async (executeParams) => {
             const wallets = await store.getWallets();
@@ -272,45 +397,38 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             const transaction = await store.getTransaction(executeParams.transactionId);
             const wallet = wallets.find((w) => w.partyId === executeParams.partyId);
             if (wallet === undefined) {
-                throw new Error('No primary wallet found');
+                throw new Error('Requested wallet not found for user');
             }
             if (transaction === undefined) {
                 throw new Error('No transaction found');
             }
-            const userId = assertConnected(authContext).userId;
+            const connectedContext = assertConnected(authContext);
+            const accessTokenProvider = AuthTokenProvider.fromToken(connectedContext.accessToken, logger);
             if (network === undefined) {
                 throw new Error('No network session found');
             }
-            const notifier = notificationService.getNotifier(userId);
-            // Create AccessTokenProvider for user token
-            const userAccessTokenProvider = AuthTokenProvider.fromToken(authContext.accessToken, logger);
+            const notifier = notificationService.getNotifier(connectedContext.userId);
             const ledgerClient = new LedgerClient({
                 baseUrl: new URL(network.ledgerApi.baseUrl),
                 logger,
-                accessTokenProvider: userAccessTokenProvider,
+                accessTokenProvider,
             });
             const transactionService = new TransactionService(store, logger, drivers, notifier);
-            switch (wallet.signingProviderId) {
-                case SigningProvider.PARTICIPANT: {
-                    try {
-                        return await transactionService.executeWithParticipant(userId, executeParams, transaction, ledgerClient, network);
-                    }
-                    catch (error) {
-                        logger.error(error, 'Failed to submit transaction');
-                        throw error;
-                    }
-                }
-                case SigningProvider.WALLET_KERNEL:
-                case SigningProvider.BLOCKDAEMON:
-                case SigningProvider.FIREBLOCKS: {
-                    return transactionService.executeWithExternal(userId, executeParams, transaction, ledgerClient);
-                }
-                case SigningProvider.DFNS: {
-                    return transactionService.executeWithDfns(transaction);
-                }
-                default:
-                    throw new Error(`Unsupported signing provider: ${wallet.signingProviderId}`);
-            }
+            logDynamically(logger, 'executing transaction with params', {
+                info: { transactionId: executeParams.transactionId },
+                debug: {
+                    executeParams,
+                    transaction,
+                    wallet,
+                    userId: connectedContext.userId,
+                },
+            });
+            const response = await transactionService.execute(connectedContext.userId, wallet, transaction, executeParams, ledgerClient, network);
+            logDynamically(logger, 'transaction executed with response', {
+                info: { transactionId: executeParams.transactionId },
+                debug: { response },
+            });
+            return response;
         },
         addSession: async function (params) {
             try {
@@ -390,7 +508,7 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             }
         },
         removeSession: async () => {
-            logger.info(authContext, 'Removing session');
+            logger.info({ authContext }, 'Removing session');
             const userId = assertConnected(authContext).userId;
             const notifier = notificationService.getNotifier(userId);
             await store.removeSession();
@@ -561,5 +679,122 @@ export const userController = (kernelInfo, userUrl, store, notificationService,
             await store.removeTransaction(transaction.id);
             return null;
         },
+        generateApiKey: async (params) => {
+            const userId = assertConnected(authContext).userId;
+            const network = await store.getCurrentNetwork();
+            const apiKeyId = v4();
+            const generatedApiKey = crypto.randomBytes(32).toString('hex');
+            const hashedApiKey = crypto
+                .createHash('sha256')
+                .update(generatedApiKey)
+                .digest('hex');
+            const storedApiKey = {
+                id: apiKeyId,
+                name: params.name,
+                digest: hashedApiKey,
+                userId,
+                networkId: network.id,
+                email: authContext?.email || null,
+                createdAt: new Date(),
+            };
+            await store.addApiKey(storedApiKey);
+            logDynamically(logger, 'Generated new API key', {
+                info: { apiKeyId: storedApiKey.id },
+                debug: {
+                    name: storedApiKey.name,
+                    userId: storedApiKey.userId,
+                    networkId: storedApiKey.networkId,
+                    createdAt: storedApiKey.createdAt,
+                },
+            });
+            return {
+                id: storedApiKey.id,
+                apiKey: generatedApiKey,
+            };
+        },
+        listApiKeys: async () => {
+            const apiKeys = await store.listApiKeys().then((keys) => keys.map((key) => ({
+                id: key.id,
+                name: key.name,
+                createdAt: key.createdAt.toISOString(),
+            })));
+            return { apiKeys };
+        },
+        removeApiKey: async (params) => {
+            await store.removeApiKey(params.id);
+            return null;
+        },
+        listSigningProviderVaults: async (params) => {
+            const network = await store.getCurrentNetwork();
+            const idp = await store.getIdp(network.identityProviderId);
+            if (!network.adminAuth) {
+                throw new Error('No admin auth configured');
+            }
+            const adminAccessTokenProvider = AuthTokenProvider.fromGatewayConfig(idp, network.adminAuth, logger);
+            const partyAllocator = new PartyAllocationService({
+                synchronizerId: network.synchronizerId,
+                accessTokenProvider: adminAccessTokenProvider,
+                httpLedgerUrl: network.ledgerApi.baseUrl,
+                logger,
+            });
+            const walletAllocationService = new WalletAllocationService(store, logger, partyAllocator, drivers);
+            if (!drivers[params.signingProviderId]) {
+                throw new Error(`Signing provider ${params.signingProviderId} not supported`);
+            }
+            return walletAllocationService.getVaults(assertConnected(authContext), params.signingProviderId);
+        },
     });
 };
+function toAuthDto(auth) {
+    const base = {
+        method: auth.method,
+        audience: auth.audience,
+        scope: auth.scope,
+        clientId: auth.clientId,
+    };
+    if (auth.method === 'self_signed') {
+        return {
+            ...base,
+            issuer: auth.issuer,
+            clientSecret: auth.clientSecret,
+        };
+    }
+    if (auth.method === 'client_credentials') {
+        return {
+            ...base,
+            clientSecret: auth.clientSecret,
+        };
+    }
+    return base;
+}
+function toNetworkDto(network) {
+    return {
+        id: network.id,
+        name: network.name,
+        description: network.description,
+        synchronizerId: network.synchronizerId,
+        identityProviderId: network.identityProviderId,
+        ledgerApi: network.ledgerApi.baseUrl,
+        auth: toAuthDto(network.auth),
+        ...(network.adminAuth
+            ? { adminAuth: toAuthDto(network.adminAuth) }
+            : {}),
+    };
+}
+function toPublicNetwork(network) {
+    const auth = network.auth;
+    return {
+        id: network.id,
+        name: network.name,
+        description: network.description,
+        synchronizerId: network.synchronizerId,
+        identityProviderId: network.identityProviderId,
+        ledgerApi: network.ledgerApi.baseUrl,
+        authMethod: auth.method,
+        ...(auth.method !== 'client_credentials' && {
+            clientId: auth.clientId,
+            scope: auth.scope,
+            audience: auth.audience,
+        }),
+    };
+}

package/dist/user-api/controller.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=controller.test.d.ts.map

package/dist/user-api/controller.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.test.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.test.ts"],"names":[],"mappings":""}