@canton-network/wallet-gateway-remote 1.4.0 → 1.5.0

package/dist/middleware/jwtAuth.test.js

@@ -0,0 +1,93 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { jwtAuth } from './jwtAuth.js';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+describe('jwtAuth', () => {
+    const verifyToken = vi.fn();
+    const authService = { verifyToken };
+    const logger = pino({ level: 'silent' }, sink());
+    let next;
+    let status;
+    let json;
+    beforeEach(() => {
+        verifyToken.mockReset();
+        next = vi.fn();
+        status = vi.fn().mockReturnThis();
+        json = vi.fn();
+    });
+    function makeReq(partial) {
+        return {
+            headers: {},
+            query: {},
+            ...partial,
+        };
+    }
+    function makeRes() {
+        return { status, json };
+    }
+    it('sets authContext and calls next when verification succeeds', async () => {
+        const ctx = { userId: 'alice', accessToken: 'tok' };
+        verifyToken.mockResolvedValue(ctx);
+        const req = makeReq({
+            headers: { authorization: 'Bearer abc' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(verifyToken).toHaveBeenCalledWith('Bearer abc');
+        expect(req.authContext).toEqual(ctx);
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('uses Bearer token from query when Authorization header is absent', async () => {
+        const ctx = { userId: 'bob', accessToken: 'tok' };
+        verifyToken.mockResolvedValue(ctx);
+        const req = makeReq({
+            query: { token: 'query-jwt' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(verifyToken).toHaveBeenCalledWith('Bearer query-jwt');
+        expect(req.authContext).toEqual(ctx);
+        expect(next).toHaveBeenCalledOnce();
+    });
+    it('passes undefined to verifyToken when no credentials are present', async () => {
+        verifyToken.mockResolvedValue(undefined);
+        const req = makeReq({});
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(verifyToken).toHaveBeenCalledWith(undefined);
+        expect(req.authContext).toBeUndefined();
+        expect(next).toHaveBeenCalledOnce();
+    });
+    it('returns 401 JSON when verification throws', async () => {
+        verifyToken.mockRejectedValue(new Error('bad sig'));
+        const req = makeReq({
+            headers: { authorization: 'Bearer x' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(next).not.toHaveBeenCalled();
+        expect(status).toHaveBeenCalledWith(401);
+        expect(json).toHaveBeenCalledWith({
+            error: 'Invalid or expired token: bad sig',
+        });
+    });
+    it('stringifies non-Error rejection values in the response', async () => {
+        verifyToken.mockRejectedValue('rejected');
+        const req = makeReq({
+            headers: { authorization: 'Bearer x' },
+        });
+        const res = makeRes();
+        const middleware = jwtAuth(authService, logger);
+        await middleware(req, res, next);
+        expect(json).toHaveBeenCalledWith({
+            error: 'Invalid or expired token: rejected',
+        });
+    });
+});

package/dist/middleware/rateLimit.test.js

@@ -24,6 +24,18 @@ describe('ipRateLimitKeyGenerator', () => {
         };
         expect(ipRateLimitKeyGenerator(req)).toBe('ip:2001:db8:abcd::/56');
     });
+    test('falls back to socket.remoteAddress when ip is unset', () => {
+        const req = {
+            socket: { remoteAddress: '10.0.0.2' },
+        };
+        expect(ipRateLimitKeyGenerator(req)).toBe('ip:10.0.0.2');
+    });
+    test('uses unknown when neither ip nor remoteAddress is set', () => {
+        const req = {
+            socket: {},
+        };
+        expect(ipRateLimitKeyGenerator(req)).toBe('ip:unknown');
+    });
 });
 describe('rateLimitKeyGenerator', () => {
     test('uses authenticated user id when available', () => {

package/dist/middleware/sessionHandler.js

@@ -12,7 +12,7 @@ export function sessionHandler(store, allowedPaths, logger) {
         const context = req.authContext;
         const allowedMethods = allowedPaths[req.baseUrl];
         if (req.method !== 'POST') {
-            logger.debug('Skipping authentication for OPTIONS request to ' + req.baseUrl);
+            logger.debug(`Skipping authentication for ${req.method} request to ${req.baseUrl}`);
             next();
         }
         else if (allowedMethods &&

package/dist/middleware/sessionHandler.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sessionHandler.test.d.ts.map

package/dist/middleware/sessionHandler.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionHandler.test.d.ts","sourceRoot":"","sources":["../../src/middleware/sessionHandler.test.ts"],"names":[],"mappings":""}

package/dist/middleware/sessionHandler.test.js

@@ -0,0 +1,121 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { sessionHandler } from './sessionHandler.js';
+describe('sessionHandler', () => {
+    const getSession = vi.fn();
+    const withAuthContext = vi.fn(() => ({ getSession }));
+    const store = { withAuthContext };
+    const logger = pino({ level: 'silent' }, sink());
+    const allowedPaths = {
+        '/api/v0/user': ['addSession', 'listNetworks', 'getUser'],
+        '/api/v0/dapp': ['*'],
+    };
+    let next;
+    let status;
+    let json;
+    const authContext = {
+        userId: 'user-1',
+        accessToken: 'access-token',
+    };
+    beforeEach(() => {
+        getSession.mockReset();
+        withAuthContext.mockClear();
+        withAuthContext.mockReturnValue({ getSession });
+        next = vi.fn();
+        status = vi.fn().mockReturnThis();
+        json = vi.fn();
+    });
+    function makeReq(partial) {
+        return {
+            method: 'POST',
+            baseUrl: '/api/v0/user',
+            body: { method: 'listWallets' },
+            authContext,
+            ...partial,
+        };
+    }
+    function makeRes() {
+        return { status, json };
+    }
+    it('skips session check for non-POST requests', async () => {
+        const req = makeReq({ method: 'GET' });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).not.toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('allows unauthenticated POST when the RPC method is on the allow list', async () => {
+        const req = makeReq({ body: { method: 'addSession' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).not.toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('allows unauthenticated POST when the path uses a wildcard allow list', async () => {
+        const req = makeReq({
+            baseUrl: '/api/v0/dapp',
+            body: { method: 'connect' },
+        });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).not.toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+    });
+    it('calls next when an active session exists for a protected method', async () => {
+        getSession.mockResolvedValue({
+            id: 'session-1',
+            network: 'network1',
+            accessToken: 'session-token',
+        });
+        const req = makeReq({ body: { method: 'listWallets' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(getSession).toHaveBeenCalled();
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('returns 401 when no session exists for a protected method', async () => {
+        getSession.mockResolvedValue(undefined);
+        const req = makeReq({ body: { method: 'listWallets' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(next).not.toHaveBeenCalled();
+        expect(status).toHaveBeenCalledWith(401);
+        expect(json).toHaveBeenCalledWith({
+            error: 'No active session found',
+        });
+    });
+    it('requires a session when the path is not in the allow list config', async () => {
+        getSession.mockResolvedValue(undefined);
+        const req = makeReq({
+            baseUrl: '/api/v0/other',
+            body: { method: 'addSession' },
+        });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(status).toHaveBeenCalledWith(401);
+    });
+    it('requires a session when the RPC method is not on the path allow list', async () => {
+        getSession.mockResolvedValue(undefined);
+        const req = makeReq({ body: { method: 'removeSession' } });
+        const res = makeRes();
+        const middleware = sessionHandler(store, allowedPaths, logger);
+        await middleware(req, res, next);
+        expect(withAuthContext).toHaveBeenCalledWith(authContext);
+        expect(status).toHaveBeenCalledWith(401);
+    });
+});

package/dist/notification/NotificationService.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=NotificationService.test.d.ts.map

package/dist/notification/NotificationService.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NotificationService.test.d.ts","sourceRoot":"","sources":["../../src/notification/NotificationService.test.ts"],"names":[],"mappings":""}

package/dist/notification/NotificationService.test.js

@@ -0,0 +1,110 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import pino from 'pino';
+import { consecutive, once, sink } from 'pino-test';
+import { NotificationService } from './NotificationService.js';
+describe('NotificationService', () => {
+    let mockLogger;
+    let logStream;
+    beforeEach(() => {
+        logStream = sink();
+        mockLogger = pino({ level: 'debug' }, logStream);
+    });
+    it('creates a notifier for a new notifierId', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        expect(notifier).toBeDefined();
+        expect(typeof notifier.on).toBe('function');
+        expect(typeof notifier.emit).toBe('function');
+        expect(typeof notifier.removeListener).toBe('function');
+    });
+    it('returns the same notifier instance for the same notifierId', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-1');
+        expect(notifier1).toBe(notifier2);
+    });
+    it('returns different notifier instances for different notifierIds', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-2');
+        expect(notifier1).not.toBe(notifier2);
+    });
+    it('calls listeners when an event is emitted', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        const listener = vi.fn();
+        notifier.on('txChanged', listener);
+        const result = notifier.emit('txChanged', { id: 123 });
+        expect(result).toBe(true);
+        expect(listener).toHaveBeenCalledTimes(1);
+        expect(listener).toHaveBeenCalledWith({ id: 123 });
+    });
+    it('returns false when emitting an event with no listeners', async () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        const result = notifier.emit('unknown-event');
+        expect(result).toBe(false);
+        await once(logStream, {
+            level: 20,
+            event: 'unknown-event',
+            args: [],
+            msg: 'Notifier emitted event: unknown-event for user-1',
+        });
+    });
+    it('logs every emitted event', async () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        notifier.emit('txChanged', { id: 123 });
+        await once(logStream, {
+            level: 20,
+            event: 'txChanged',
+            args: [{ id: 123 }],
+            msg: 'Notifier emitted event: txChanged for user-1',
+        });
+    });
+    it('removes listeners with removeListener', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier = service.getNotifier('user-1');
+        const listener = vi.fn();
+        notifier.on('txChanged', listener);
+        notifier.removeListener('txChanged', listener);
+        const result = notifier.emit('txChanged', { id: 123 });
+        expect(result).toBe(false);
+        expect(listener).not.toHaveBeenCalled();
+    });
+    it('keeps listeners isolated between notifiers', () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-2');
+        const listener1 = vi.fn();
+        const listener2 = vi.fn();
+        notifier1.on('txChanged', listener1);
+        notifier2.on('txChanged', listener2);
+        notifier1.emit('txChanged', { id: 1 });
+        expect(listener1).toHaveBeenCalledWith({ id: 1 });
+        expect(listener2).not.toHaveBeenCalled();
+    });
+    it('logs with the correct notifierId for each notifier', async () => {
+        const service = new NotificationService(mockLogger);
+        const notifier1 = service.getNotifier('user-1');
+        const notifier2 = service.getNotifier('user-2');
+        notifier1.emit('txChanged');
+        notifier2.emit('statusChanged');
+        await consecutive(logStream, [
+            {
+                level: 20,
+                event: 'txChanged',
+                args: [],
+                msg: 'Notifier emitted event: txChanged for user-1',
+            },
+            {
+                level: 20,
+                event: 'statusChanged',
+                args: [],
+                msg: 'Notifier emitted event: statusChanged for user-2',
+            },
+        ]);
+    });
+});

package/dist/signing/signing-drivers.d.ts

@@ -0,0 +1,7 @@
+import { SigningDriverInterface, SigningProvider } from '@canton-network/core-signing-lib';
+/**
+ * Signing drivers registered at Wallet Gateway startup.
+ * Partial because only configured providers are present (e.g. Dfns when env vars are set).
+ */
+export type SigningDrivers = Partial<Record<SigningProvider, SigningDriverInterface>>;
+//# sourceMappingURL=signing-drivers.d.ts.map

package/dist/signing/signing-drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-drivers.d.ts","sourceRoot":"","sources":["../../src/signing/signing-drivers.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AAEzC;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAChC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA"}

package/dist/signing/signing-drivers.js

@@ -0,0 +1,3 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+export {};

package/dist/user-api/controller.d.ts

@@ -3,9 +3,8 @@ import { Logger } from 'pino';
 import { NotificationService } from '../notification/NotificationService.js';
 import { AuthContext } from '@canton-network/core-wallet-auth';
 import { KernelInfo } from '../config/Config.js';
-import { SigningDriverInterface, SigningProvider } from '@canton-network/core-signing-lib';
-type AvailableSigningDrivers = Partial<Record<SigningProvider, SigningDriverInterface>>;
-export declare const userController: (kernelInfo: KernelInfo, userUrl: string, store: Store, notificationService: NotificationService, authContext: AuthContext | undefined, drivers: AvailableSigningDrivers, _logger: Logger, adminUserId?: string) => {
+import type { SigningDrivers } from '../signing/signing-drivers.js';
+export declare const userController: (kernelInfo: KernelInfo, userUrl: string, store: Store, notificationService: NotificationService, authContext: AuthContext | undefined, drivers: SigningDrivers, _logger: Logger, adminUserId?: string) => {
     addNetwork: import("./rpc-gen/typings.js").AddNetwork;
     removeNetwork: import("./rpc-gen/typings.js").RemoveNetwork;
     listNetworks: import("./rpc-gen/typings.js").ListNetworks;
@@ -34,6 +33,9 @@ export declare const userController: (kernelInfo: KernelInfo, userUrl: string, s
     listTransactions: import("./rpc-gen/typings.js").ListTransactions;
     deleteTransaction: import("./rpc-gen/typings.js").DeleteTransaction;
     getUser: import("./rpc-gen/typings.js").GetUser;
+    generateApiKey: import("./rpc-gen/typings.js").GenerateApiKey;
+    listApiKeys: import("./rpc-gen/typings.js").ListApiKeys;
+    removeApiKey: import("./rpc-gen/typings.js").RemoveApiKey;
+    listSigningProviderVaults: import("./rpc-gen/typings.js").ListSigningProviderVaults;
 };
-export {};
 //# sourceMappingURL=controller.d.ts.map

package/dist/user-api/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAMd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAEH,sBAAsB,EACtB,eAAe,EAClB,MAAM,kCAAkC,CAAA;AAUzC,KAAK,uBAAuB,GAAG,OAAO,CAClC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAClD,CAAA;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,uBAAuB,EAChC,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwhCvB,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/user-api/controller.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,KAAK,EAAW,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAEH,WAAW,EAKd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAYnE,eAAO,MAAM,cAAc,GACvB,YAAY,UAAU,EACtB,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,aAAa,WAAW,GAAG,SAAS,EACpC,SAAS,cAAc,EACvB,SAAS,MAAM,EACf,cAAc,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4hCvB,CAAA"}