@canton-network/wallet-gateway-remote 1.4.0 → 1.6.0

package/dist/auth/jwt-auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,KAAG,WA8H5D,CAAA"}
+{"version":3,"file":"jwt-auth-service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAoB,MAAM,kCAAkC,CAAA;AAChF,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,EAAE,QAAQ,MAAM,KAAG,WAiI5D,CAAA"}

package/dist/auth/jwt-auth-service.js

@@ -1,5 +1,6 @@
 // Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
+import { resolveUserEmail } from '@canton-network/core-wallet-auth';
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
 /**
  * Creates an AuthService that verifies JWT tokens using a remote JWK set.
@@ -38,7 +39,6 @@ export const jwtAuthService = (store, logger) => ({
                 return undefined;
             }
             if (idp.type == 'self_signed') {
-                logger.debug(idp, 'Using self-signed IDP');
                 const sub = decoded.sub;
                 if (!sub) {
                     logger.warn('JWT does not contain a subject');
@@ -51,7 +51,7 @@ export const jwtAuthService = (store, logger) => ({
                     ...(email ? { email } : {}),
                 };
             }
-            logger.debug(idp, 'Using IDP');
+            logger.debug({ idp }, 'Using IDP');
             const response = await fetch(idp.configUrl);
             const config = await response.json();
             const jwks = createRemoteJWKSet(new URL(config.jwks_uri));
@@ -91,12 +91,13 @@ export const jwtAuthService = (store, logger) => ({
                 accessToken: jwt,
                 email: getEmail(decoded.email),
             }, 'JWT verified');
-            const email = getEmail(decoded.email);
-            return {
+            const authContext = {
                 userId: payload.sub,
                 accessToken: jwt,
-                ...(email ? { email } : {}),
             };
+            const email = getEmail(decoded.email) ??
+                (await resolveUserEmail(authContext, idp, logger));
+            return email ? { ...authContext, email } : authContext;
         }
         catch (error) {
             if (error instanceof Error) {

package/dist/auth/jwt-auth-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt-auth-service.test.d.ts.map

package/dist/auth/jwt-auth-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth-service.test.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth-service.test.ts"],"names":[],"mappings":""}

package/dist/auth/jwt-auth-service.test.js

@@ -0,0 +1,259 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { SignJWT } from 'jose';
+import { StoreInternal } from '@canton-network/core-wallet-store-inmemory';
+import { jwtAuthService } from './jwt-auth-service.js';
+const mockJwtVerify = vi.hoisted(() => vi.fn());
+const mockCreateRemoteJWKSet = vi.hoisted(() => vi.fn(() => 'jwks'));
+const mockFetch = vi.hoisted(() => vi.fn());
+vi.mock('jose', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        jwtVerify: mockJwtVerify,
+        createRemoteJWKSet: mockCreateRemoteJWKSet,
+    };
+});
+const authContext = {
+    userId: 'test-user-id',
+    accessToken: 'test-access-token',
+};
+const SELF_SIGNED_ISSUER = 'unsafe-auth';
+const OAUTH_ISSUER = 'https://oauth.example.com';
+async function bearerToken(claims) {
+    const jwt = await new SignJWT(claims)
+        .setProtectedHeader({ alg: 'HS256' })
+        .sign(new TextEncoder().encode('test-secret'));
+    return `Bearer ${jwt}`;
+}
+const createNetwork = (id, identityProviderId, audience = 'test-audience') => ({
+    id,
+    name: `Network ${id}`,
+    synchronizerId: `${id}-sync`,
+    identityProviderId,
+    description: `Test Network ${id}`,
+    ledgerApi: { baseUrl: `http://${id}` },
+    auth: {
+        method: 'authorization_code',
+        clientId: 'cid',
+        scope: 'openid',
+        audience,
+    },
+});
+describe('jwtAuthService', () => {
+    let mockLogger;
+    let store;
+    beforeEach(async () => {
+        mockLogger = pino(sink());
+        store = new StoreInternal({ idps: [], networks: [] }, mockLogger, authContext);
+        vi.stubGlobal('fetch', mockFetch);
+        mockFetch.mockReset();
+        mockJwtVerify.mockReset();
+        mockCreateRemoteJWKSet.mockClear();
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+    });
+    it('returns undefined when access token is missing', async () => {
+        const service = jwtAuthService(store, mockLogger);
+        await expect(service.verifyToken(undefined)).resolves.toBeUndefined();
+    });
+    it('returns undefined when authorization header is not Bearer', async () => {
+        const service = jwtAuthService(store, mockLogger);
+        await expect(service.verifyToken('Basic abc')).resolves.toBeUndefined();
+    });
+    it('returns undefined when JWT has no issuer', async () => {
+        const service = jwtAuthService(store, mockLogger);
+        const token = await bearerToken({ sub: 'user-1', scope: 'openid' });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    it('returns undefined when no identity provider matches issuer', async () => {
+        await store.addIdp({
+            id: 'idp-self',
+            type: 'self_signed',
+            issuer: SELF_SIGNED_ISSUER,
+        });
+        const service = jwtAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: 'unknown-issuer',
+            sub: 'user-1',
+            scope: 'openid',
+        });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    it('returns undefined when JWT has no scope or scp claim', async () => {
+        await store.addIdp({
+            id: 'idp-self',
+            type: 'self_signed',
+            issuer: SELF_SIGNED_ISSUER,
+        });
+        const service = jwtAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: SELF_SIGNED_ISSUER,
+            sub: 'user-1',
+        });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    describe('self_signed identity provider', () => {
+        beforeEach(async () => {
+            await store.addIdp({
+                id: 'idp-self',
+                type: 'self_signed',
+                issuer: SELF_SIGNED_ISSUER,
+            });
+        });
+        it('returns auth context for a valid self-signed token', async () => {
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: SELF_SIGNED_ISSUER,
+                sub: 'user-1',
+                scope: 'openid',
+            });
+            const result = await service.verifyToken(token);
+            expect(result).toEqual({
+                userId: 'user-1',
+                accessToken: token.split(' ')[1],
+            });
+        });
+        it('accepts scp claim instead of scope', async () => {
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: SELF_SIGNED_ISSUER,
+                sub: 'user-1',
+                scp: 'openid',
+            });
+            const result = await service.verifyToken(token);
+            expect(result?.userId).toBe('user-1');
+        });
+        it('includes email when present in token', async () => {
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: SELF_SIGNED_ISSUER,
+                sub: 'user-1',
+                scope: 'openid',
+                email: 'user@example.com',
+            });
+            const result = await service.verifyToken(token);
+            expect(result).toEqual({
+                userId: 'user-1',
+                accessToken: token.split(' ')[1],
+                email: 'user@example.com',
+            });
+        });
+        it('returns undefined when JWT has no subject', async () => {
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: SELF_SIGNED_ISSUER,
+                scope: 'openid',
+            });
+            await expect(service.verifyToken(token)).resolves.toBeUndefined();
+        });
+    });
+    describe('oauth identity provider', () => {
+        const configUrl = 'https://oauth.example.com/.well-known/openid-configuration';
+        beforeEach(async () => {
+            await store.addIdp({
+                id: 'idp-oauth',
+                type: 'oauth',
+                issuer: OAUTH_ISSUER,
+                configUrl,
+            });
+            mockFetch.mockResolvedValue({
+                json: async () => ({
+                    jwks_uri: 'https://oauth.example.com/jwks',
+                }),
+            });
+        });
+        it('returns auth context when JWT verifies and audience matches', async () => {
+            await store.addNetwork(createNetwork('network-1', 'idp-oauth', 'ledger-audience'));
+            mockJwtVerify.mockResolvedValue({
+                payload: { sub: 'oauth-user', aud: 'ledger-audience' },
+            });
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: OAUTH_ISSUER,
+                sub: 'oauth-user',
+                scope: 'openid',
+                email: 'oauth@example.com',
+            });
+            const rawJwt = token.split(' ')[1];
+            const result = await service.verifyToken(token);
+            expect(mockFetch).toHaveBeenCalledWith(configUrl);
+            expect(mockCreateRemoteJWKSet).toHaveBeenCalledWith(new URL('https://oauth.example.com/jwks'));
+            expect(mockJwtVerify).toHaveBeenCalledWith(rawJwt, 'jwks', {
+                algorithms: ['RS256'],
+            });
+            expect(result).toEqual({
+                userId: 'oauth-user',
+                accessToken: rawJwt,
+                email: 'oauth@example.com',
+            });
+        });
+        it('returns undefined when no networks are configured for the IDP', async () => {
+            mockJwtVerify.mockResolvedValue({
+                payload: { sub: 'oauth-user', aud: 'ledger-audience' },
+            });
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: OAUTH_ISSUER,
+                sub: 'oauth-user',
+                scope: 'openid',
+            });
+            await expect(service.verifyToken(token)).resolves.toBeUndefined();
+        });
+        it('returns undefined when audience does not match configured networks', async () => {
+            await store.addNetwork(createNetwork('network-1', 'idp-oauth', 'expected-audience'));
+            mockJwtVerify.mockResolvedValue({
+                payload: { sub: 'oauth-user', aud: 'other-audience' },
+            });
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: OAUTH_ISSUER,
+                sub: 'oauth-user',
+                scope: 'openid',
+            });
+            await expect(service.verifyToken(token)).resolves.toBeUndefined();
+        });
+        it('returns undefined when verified JWT has no audience', async () => {
+            await store.addNetwork(createNetwork('network-1', 'idp-oauth', 'expected-audience'));
+            mockJwtVerify.mockResolvedValue({
+                payload: { sub: 'oauth-user' },
+            });
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: OAUTH_ISSUER,
+                sub: 'oauth-user',
+                scope: 'openid',
+            });
+            await expect(service.verifyToken(token)).resolves.toBeUndefined();
+        });
+        it('returns undefined when verified JWT has no subject', async () => {
+            await store.addNetwork(createNetwork('network-1', 'idp-oauth', 'expected-audience'));
+            mockJwtVerify.mockResolvedValue({
+                payload: { aud: 'expected-audience' },
+            });
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: OAUTH_ISSUER,
+                sub: 'oauth-user',
+                scope: 'openid',
+            });
+            await expect(service.verifyToken(token)).resolves.toBeUndefined();
+        });
+        it('returns undefined when JWT verification fails', async () => {
+            await store.addNetwork(createNetwork('network-1', 'idp-oauth', 'expected-audience'));
+            mockJwtVerify.mockRejectedValue(new Error('invalid signature'));
+            const service = jwtAuthService(store, mockLogger);
+            const token = await bearerToken({
+                iss: OAUTH_ISSUER,
+                sub: 'oauth-user',
+                scope: 'openid',
+            });
+            await expect(service.verifyToken(token)).resolves.toBeUndefined();
+        });
+    });
+});

package/dist/auth/jwt-unsafe-auth-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt-unsafe-auth-service.test.d.ts.map

package/dist/auth/jwt-unsafe-auth-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-unsafe-auth-service.test.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-unsafe-auth-service.test.ts"],"names":[],"mappings":""}

package/dist/auth/jwt-unsafe-auth-service.test.js

@@ -0,0 +1,120 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { describe, it, expect, beforeEach } from 'vitest';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { SignJWT } from 'jose';
+import { StoreInternal } from '@canton-network/core-wallet-store-inmemory';
+import { jwtAuthService as jwtUnsafeAuthService } from './jwt-unsafe-auth-service.js';
+const authContext = {
+    userId: 'test-user-id',
+    accessToken: 'test-access-token',
+};
+const SELF_SIGNED_ISSUER = 'unsafe-auth';
+async function bearerToken(claims) {
+    const jwt = await new SignJWT(claims)
+        .setProtectedHeader({ alg: 'HS256' })
+        .sign(new TextEncoder().encode('test-secret'));
+    return `Bearer ${jwt}`;
+}
+describe('jwtAuthService (unsafe)', () => {
+    let mockLogger;
+    let store;
+    beforeEach(async () => {
+        mockLogger = pino(sink());
+        store = new StoreInternal({ idps: [], networks: [] }, mockLogger, authContext);
+        await store.addIdp({
+            id: 'idp-self',
+            type: 'self_signed',
+            issuer: SELF_SIGNED_ISSUER,
+        });
+    });
+    it('returns undefined when access token is missing', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        await expect(service.verifyToken(undefined)).resolves.toBeUndefined();
+    });
+    it('returns undefined when authorization header is not Bearer', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        await expect(service.verifyToken('NotBearer abc')).resolves.toBeUndefined();
+    });
+    it('returns undefined when JWT has no issuer', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        const token = await bearerToken({
+            sub: 'user-1',
+            scope: 'openid',
+        });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    it('returns undefined when JWT has no subject', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: SELF_SIGNED_ISSUER,
+            scope: 'openid',
+        });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    it('returns undefined when JWT has no scope claim', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: SELF_SIGNED_ISSUER,
+            sub: 'user-1',
+        });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    it('returns undefined when no identity provider matches issuer', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: 'unknown-issuer',
+            sub: 'user-1',
+            scope: 'openid',
+        });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    it('returns undefined for oauth identity providers', async () => {
+        await store.addIdp({
+            id: 'idp-oauth',
+            type: 'oauth',
+            issuer: 'https://oauth.example.com',
+            configUrl: 'https://oauth.example.com/.well-known/openid-configuration',
+        });
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: 'https://oauth.example.com',
+            sub: 'user-1',
+            scope: 'openid',
+        });
+        await expect(service.verifyToken(token)).resolves.toBeUndefined();
+    });
+    it('returns auth context for a valid self-signed token', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: SELF_SIGNED_ISSUER,
+            sub: 'user-1',
+            scope: 'openid',
+        });
+        const result = await service.verifyToken(token);
+        expect(result).toEqual({
+            userId: 'user-1',
+            accessToken: token.split(' ')[1],
+        });
+    });
+    it('includes email when present in token', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        const token = await bearerToken({
+            iss: SELF_SIGNED_ISSUER,
+            sub: 'user-1',
+            scope: 'openid',
+            email: 'user@example.com',
+        });
+        const result = await service.verifyToken(token);
+        expect(result).toEqual({
+            userId: 'user-1',
+            accessToken: token.split(' ')[1],
+            email: 'user@example.com',
+        });
+    });
+    it('returns undefined for malformed JWT', async () => {
+        const service = jwtUnsafeAuthService(store, mockLogger);
+        await expect(service.verifyToken('Bearer not-a-jwt')).resolves.toBeUndefined();
+    });
+});

package/dist/config/Config.d.ts

@@ -15,6 +15,9 @@ export declare const serverConfigSchema: z.ZodObject<{
     requestRateLimit: z.ZodDefault<z.ZodNumber>;
     trustProxy: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber, z.ZodString]>>;
     admin: z.ZodOptional<z.ZodString>;
+    signingWorker: z.ZodPreprocess<z.ZodObject<{
+        pollInterval: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const rawConfigSchema: z.ZodObject<{
     kernel: z.ZodObject<{
@@ -22,7 +25,7 @@ export declare const rawConfigSchema: z.ZodObject<{
         publicUrl: z.ZodOptional<z.ZodString>;
         clientType: z.ZodUnion<readonly [z.ZodLiteral<"browser">, z.ZodLiteral<"desktop">, z.ZodLiteral<"mobile">, z.ZodLiteral<"remote">]>;
     }, z.core.$strip>;
-    server: z.ZodPipe<z.ZodTransform<{}, unknown>, z.ZodObject<{
+    server: z.ZodPreprocess<z.ZodObject<{
         port: z.ZodDefault<z.ZodNumber>;
         dappPath: z.ZodDefault<z.ZodString>;
         userPath: z.ZodDefault<z.ZodString>;
@@ -33,8 +36,11 @@ export declare const rawConfigSchema: z.ZodObject<{
         requestRateLimit: z.ZodDefault<z.ZodNumber>;
         trustProxy: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber, z.ZodString]>>;
         admin: z.ZodOptional<z.ZodString>;
+        signingWorker: z.ZodPreprocess<z.ZodObject<{
+            pollInterval: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
-    logging: z.ZodOptional<z.ZodPipe<z.ZodTransform<{}, unknown>, z.ZodObject<{
+    logging: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
         level: z.ZodOptional<z.ZodEnum<{
             error: "error";
             trace: "trace";
@@ -172,6 +178,43 @@ export declare const rawConfigSchema: z.ZodObject<{
                 clientId: z.ZodString;
                 clientSecretEnv: z.ZodString;
             }, z.core.$strip>], "method">]>>;
+            serviceAccountAuth: z.ZodOptional<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                method: z.ZodLiteral<"authorization_code">;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                method: z.ZodLiteral<"client_credentials">;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                clientSecret: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                method: z.ZodLiteral<"self_signed">;
+                issuer: z.ZodString;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                clientSecret: z.ZodString;
+            }, z.core.$strip>], "method">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                method: z.ZodLiteral<"authorization_code">;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                method: z.ZodLiteral<"client_credentials">;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                clientSecretEnv: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                method: z.ZodLiteral<"self_signed">;
+                issuer: z.ZodString;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                clientSecretEnv: z.ZodString;
+            }, z.core.$strip>], "method">]>>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
@@ -181,7 +224,7 @@ export declare const configSchema: z.ZodObject<{
         publicUrl: z.ZodOptional<z.ZodString>;
         clientType: z.ZodUnion<readonly [z.ZodLiteral<"browser">, z.ZodLiteral<"desktop">, z.ZodLiteral<"mobile">, z.ZodLiteral<"remote">]>;
     }, z.core.$strip>;
-    server: z.ZodPipe<z.ZodTransform<{}, unknown>, z.ZodObject<{
+    server: z.ZodPreprocess<z.ZodObject<{
         port: z.ZodDefault<z.ZodNumber>;
         dappPath: z.ZodDefault<z.ZodString>;
         userPath: z.ZodDefault<z.ZodString>;
@@ -192,8 +235,11 @@ export declare const configSchema: z.ZodObject<{
         requestRateLimit: z.ZodDefault<z.ZodNumber>;
         trustProxy: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber, z.ZodString]>>;
         admin: z.ZodOptional<z.ZodString>;
+        signingWorker: z.ZodPreprocess<z.ZodObject<{
+            pollInterval: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
-    logging: z.ZodOptional<z.ZodPipe<z.ZodTransform<{}, unknown>, z.ZodObject<{
+    logging: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
         level: z.ZodOptional<z.ZodEnum<{
             error: "error";
             trace: "trace";
@@ -295,6 +341,25 @@ export declare const configSchema: z.ZodObject<{
                 clientId: z.ZodString;
                 clientSecret: z.ZodString;
             }, z.core.$strip>], "method">>;
+            serviceAccountAuth: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                method: z.ZodLiteral<"authorization_code">;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                method: z.ZodLiteral<"client_credentials">;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                clientSecret: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                method: z.ZodLiteral<"self_signed">;
+                issuer: z.ZodString;
+                audience: z.ZodString;
+                scope: z.ZodString;
+                clientId: z.ZodString;
+                clientSecret: z.ZodString;
+            }, z.core.$strip>], "method">>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
 }, z.core.$strip>;

package/dist/config/Config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,eAAO,MAAM,gBAAgB;;;;iBAY3B,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAiD7B,CAAA;AAiCF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO1B,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOvB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AACvD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,eAAO,MAAM,gBAAgB;;;;iBAY3B,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;iBA0D7B,CAAA;AAkCF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO1B,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOvB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AACvD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}

package/dist/config/Config.js

@@ -57,6 +57,11 @@ export const serverConfigSchema = z.object({
     admin: z.string().optional().meta({
         description: 'The JWT claim (e.g. "sub") identifying the admin user. If set, requests with a matching claim will be granted admin privileges.',
     }),
+    signingWorker: z.preprocess((val) => val ?? {}, z.object({
+        pollInterval: z.number().int().positive().default(5000).meta({
+            description: 'Interval in milliseconds for the signing worker to poll external signing providers on pending transactions. Defaults to 5000.',
+        }),
+    })),
 });
 const loggingConfigSchema = z
     .object({
@@ -78,6 +83,7 @@ const bootstrapFromEnv = bootstrapConfigSchema.extend({
     networks: z.array(networkSchema.extend({
         auth: authFromEnvOrConfig,
         adminAuth: authFromEnvOrConfig.optional(),
+        serviceAccountAuth: authFromEnvOrConfig.optional(),
     })),
 });
 // Includes secrets for networks as env vars, rather than defined explicitly

package/dist/config/ConfigUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigUtils.d.ts","sourceRoot":"","sources":["../../src/config/ConfigUtils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAA8B,MAAM,aAAa,CAAA;AAGhE,qBAAa,WAAW;IACpB,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAsDlD;AA+FD,UAAU,IAAI;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACrB;AAOD,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,IAa1D,CAAA"}
+{"version":3,"file":"ConfigUtils.d.ts","sourceRoot":"","sources":["../../src/config/ConfigUtils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAA8B,MAAM,aAAa,CAAA;AAGhE,qBAAa,WAAW;IACpB,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAsDlD;AAkGD,UAAU,IAAI;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACrB;AAOD,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,IAa1D,CAAA"}

package/dist/config/ConfigUtils.js

@@ -67,6 +67,9 @@ function resolveRawConfig(rawConfig) {
             adminAuth: n.adminAuth
                 ? resolveRawNetworkAuth(n.adminAuth)
                 : undefined,
+            serviceAccountAuth: n.serviceAccountAuth
+                ? resolveRawNetworkAuth(n.serviceAccountAuth)
+                : undefined,
         };
     });
     return {

package/dist/dapp-api/controller.d.ts

@@ -3,7 +3,11 @@ import { Store } from '@canton-network/core-wallet-store';
 import { NotificationService } from '../notification/NotificationService.js';
 import { KernelInfo as KernelInfoConfig } from '../config/Config.js';
 import { Logger } from 'pino';
-export declare const dappController: (kernelInfo: KernelInfoConfig, dappUrl: string, userUrl: string, store: Store, notificationService: NotificationService, _logger: Logger, origin: string | null, context?: AuthContext) => {
+import { SigningDrivers } from '../signing/signing-drivers.js';
+export interface DappControllerDeps {
+    signingDrivers: SigningDrivers;
+}
+export declare const dappController: (kernelInfo: KernelInfoConfig, dappUrl: string, userUrl: string, store: Store, notificationService: NotificationService, _logger: Logger, origin: string | null, deps: DappControllerDeps, context?: AuthContext) => {
     status: import("./rpc-gen/typings.js").Status;
     connect: import("./rpc-gen/typings.js").Connect;
     disconnect: import("./rpc-gen/typings.js").Disconnect;

package/dist/dapp-api/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/dapp-api/controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAEH,WAAW,EAEd,MAAM,kCAAkC,CAAA;AAczC,OAAO,EAAE,KAAK,EAAe,MAAM,mCAAmC,CAAA;AAQtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAI7B,eAAO,MAAM,cAAc,GACvB,YAAY,gBAAgB,EAC5B,SAAS,MAAM,EACf,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,SAAS,MAAM,EACf,QAAQ,MAAM,GAAG,IAAI,EACrB,UAAU,WAAW;;;;;;;;;;;;;;;;CAyVxB,CAAA"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/dapp-api/controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAEH,WAAW,EAEd,MAAM,kCAAkC,CAAA;AAczC,OAAO,EAAE,KAAK,EAAe,MAAM,mCAAmC,CAAA;AAQtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AAC5E,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAK7B,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAG9D,MAAM,WAAW,kBAAkB;IAC/B,cAAc,EAAE,cAAc,CAAA;CACjC;AAED,eAAO,MAAM,cAAc,GACvB,YAAY,gBAAgB,EAC5B,SAAS,MAAM,EACf,SAAS,MAAM,EACf,OAAO,KAAK,EACZ,qBAAqB,mBAAmB,EACxC,SAAS,MAAM,EACf,QAAQ,MAAM,GAAG,IAAI,EACrB,MAAM,kBAAkB,EACxB,UAAU,WAAW;;;;;;;;;;;;;;;;CA2cxB,CAAA"}