@idos-network/enclave 1.1.0

package/src/mpc/client.ts

@@ -0,0 +1,411 @@
+import { WALLET_TYPES, type WalletType } from "@idos-network/kwil-infra/actions";
+import {
+  ChainControllerApi,
+  Configuration,
+} from "@partisiablockchain/blockchain-api-transaction-client";
+import { ethers, type TypedDataDomain } from "ethers";
+import { EngineClient } from "./engine-client";
+import { deserializeState } from "./generated/IdosContract";
+import { getRandomBytes, ShamirFactory } from "./secretsharing/shamir-secret-shares";
+import {
+  ADD_ADDRESS_TYPES,
+  type AddAddressMessageToSign,
+  type AddAddressSignatureMessage,
+  type Bytes,
+  DOWNLOAD_TYPES,
+  type DownloadMessageToSign,
+  type DownloadSignatureMessage,
+  type PbcAddress,
+  REMOVE_ADDRESS_TYPES,
+  type RemoveAddressMessageToSign,
+  type RemoveAddressSignatureMessage,
+  type Sharing,
+  UPLOAD_TYPES,
+  type UploadMessageToSign,
+  type UploadSignatureMessage,
+} from "./types";
+import invariant from "tiny-invariant";
+
+export class Client {
+  private readonly baseUrl: string;
+  private readonly contractAddress: PbcAddress;
+  private engines: EngineClient[] | undefined;
+  private walletType!: WalletType;
+  private signerAddress!: string;
+  private signerPublicKey: string | undefined;
+  private factory: ShamirFactory;
+  private numNodes: number;
+
+  constructor(
+    baseUrl: string,
+    contractAddress: PbcAddress,
+    numMalicious: number,
+    numNodes: number,
+    numToReconstruct: number,
+    walletType: WalletType,
+    signerAddress: string,
+    signerPublicKey?: string,
+  ) {
+    this.baseUrl = baseUrl;
+    this.contractAddress = contractAddress;
+
+    this.reconfigure(walletType, signerAddress, signerPublicKey);
+    
+    this.numNodes = numNodes;
+    // TODO: Make these configurable from env variables
+    this.factory = new ShamirFactory({ numMalicious, numNodes, numToReconstruct });
+  }
+
+  public reconfigure(
+    walletType: WalletType,
+    signerAddress: string,
+    signerPublicKey?: string,
+  ): void {
+    // @deprecated
+    // Remove this method after a while
+    if (["evm", "xrpl", "near", "facesign", "stellar"].includes(walletType as string)) {
+      console.warn("Deprecated wallet type", walletType, ", please upgrade to latest SDK version");
+      switch (walletType as string) {
+        case "evm":
+          walletType = "EVM";
+          break;
+        case "xrpl":
+          walletType = "XRPL";
+          break;
+        case "near":
+          walletType = "NEAR";
+          break;
+        case "stellar":
+          walletType = "Stellar";
+          break;
+        case "facesign":
+          walletType = "FaceSign";
+          break;
+      }
+    }
+    
+    invariant(WALLET_TYPES.includes(walletType), `Invalid signer type: ${walletType}`);
+    invariant(
+      // XRPL, NEAR and FaceSign require a public key, EVM does not
+      (["XRPL", "NEAR", "FaceSign"].includes(walletType) && signerPublicKey) || walletType === "EVM",
+      "Signer public key is required for XRPL, NEAR and FaceSign",
+    );
+
+    this.walletType = walletType;
+    // Reset engines to force re-creation of them since they are using old signer information
+    this.engines = undefined;
+    this.signerAddress = signerAddress;
+    if (signerPublicKey) this.signerPublicKey = signerPublicKey;
+  }
+
+  public async uploadSecret(
+    id: string,
+    uploadSignature: UploadSignatureMessage,
+    signature: Bytes,
+    blindedShares: Buffer[],
+  ): Promise<{ status: string }> {
+    const engineClients = await this.getEngines();
+    const promises = [];
+    for (let i = 0; i < engineClients.length; i++) {
+      const engineClient = engineClients[i];
+      const uploadRequest: Sharing = {
+        ...uploadSignature,
+        share_data: ethers.hexlify(blindedShares[i]),
+      };
+      promises.push(engineClient.sendUpload(id, uploadRequest, signature));
+    }
+    const statuses = await Promise.all(promises);
+
+    if (statuses.every((item) => item === "201")) {
+      return { status: "success" };
+    }
+
+    if (statuses.filter((item) => item === "201").length > 0) {
+      return { status: "partial-success" };
+    }
+
+    return { status: "failure" };
+  }
+
+  public getBlindedShares(secret: Buffer): Buffer[] {
+    // TODO: Make the number of nodes configurable from env variables
+    const secretShares = this.factory.fromPlainText(this.numNodes, secret);
+    var blindedShares: Buffer[] = [];
+    for (let i = 0; i < secretShares.numShares(); i++) {
+      blindedShares.push(Client.blindShare(secretShares.getShareBytes(i)));
+    }
+    return blindedShares;
+  }
+
+  public uploadMessageToSign(uploadRequest: UploadSignatureMessage): UploadMessageToSign {
+    return {
+      domain: this.getTypedDomain(),
+      types: UPLOAD_TYPES,
+      value: uploadRequest,
+    };
+  }
+
+  public uploadRequest(blindedShares: Buffer[]): UploadSignatureMessage {
+    console.log({ mpc: "uploading to MPC", walletType: this.walletType, address: this.signerAddress, publicKey: this.signerPublicKey });
+
+    var address = "";
+    switch (this.walletType) {
+      case "EVM":
+        address = `eip712:${this.signerAddress}`;
+        break;
+      case "XRPL":
+        address = `XRPL:${this.signerPublicKey}`;
+        break;
+      case "NEAR":
+        address = `NEAR:${this.signerPublicKey?.replace("ed25519:", "")}`;
+        break;
+      case "FaceSign":
+        address = `FACESIGN:${this.signerPublicKey}`;
+        break;
+      default:
+        throw new Error("Invalid signer type");
+    }
+    return {
+      share_commitments: blindedShares.map((b) => ethers.keccak256(b)),
+      recovering_addresses: [address],
+    };
+  }
+
+  public downloadMessageToSign(downloadRequest: DownloadSignatureMessage): DownloadMessageToSign {
+    return {
+      domain: this.getTypedDomain(),
+      types: DOWNLOAD_TYPES,
+      value: downloadRequest,
+    };
+  }
+
+  public downloadRequest(publicKey: Uint8Array): DownloadSignatureMessage {
+    var address = "";
+    switch (this.walletType) {
+      case "EVM":
+        address = `eip712:${this.signerAddress}`;
+        break;
+      case "XRPL":
+        address = `XRPL:${this.signerPublicKey}`;
+        break;
+      case "NEAR":
+        address = `NEAR:${this.signerPublicKey?.replace("ed25519:", "")}`;
+        break;
+      case "FaceSign":
+        address = `FACESIGN:${this.signerPublicKey}`;
+        break;
+      default:
+        throw new Error("Invalid signer type");
+    }
+    return {
+      recovering_address: address,
+      timestamp: Date.now(),
+      public_key: ethers.hexlify(publicKey),
+    };
+  }
+
+  public async downloadSecret(
+    id: string,
+    downloadRequest: DownloadSignatureMessage,
+    signature: Bytes,
+    secretKey: Uint8Array,
+  ): Promise<{ status: string; secret: Buffer | undefined }> {
+    const shares = [];
+    const engineClients = await this.getEngines();
+    for (let i = 0; i < engineClients.length; i++) {
+      const engineClient = engineClients[i];
+      shares.push(engineClient.downloadAndDecrypt(id, downloadRequest, signature, secretKey));
+    }
+    const secretShares = await Promise.all(shares);
+
+    console.log({ secretSharesDownloadStatuses: secretShares.map((item) => item.status) });
+
+    if (secretShares.every((item) => item.status === "404")) {
+      return { status: "not-stored", secret: undefined };
+    }
+
+    var secret: Buffer;
+    try {
+      secret = this.factory
+        .fromSharesBytes(secretShares.map((item) => item.share))
+        .reconstructPlainText();
+      return { status: "ok", secret };
+    } catch (_e) {
+      return { status: "error", secret: undefined };
+    }
+  }
+
+  public addAddressMessageToSign(
+    addressToAdd: string,
+    publicKey: string | undefined,
+    addressToAddType: string,
+  ): AddAddressMessageToSign {
+    var address = "";
+    switch (this.walletType) {
+      case "EVM":
+        address = `eip712:${this.signerAddress}`;
+        break;
+      case "XRPL":
+        address = `XRPL:${this.signerPublicKey}`;
+        break;
+      case "NEAR":
+        address = `NEAR:${this.signerPublicKey?.replace("ed25519:", "")}`;
+        break;
+      case "FaceSign":
+        address = `FACESIGN:${this.signerPublicKey}`;
+        break;
+      default:
+        throw new Error("Invalid signer type");
+    }
+
+    var addressToAddFormatted = "";
+    // @deprecated toLowerCase remove when we have updated the SDK
+    switch (addressToAddType.toLowerCase()) {
+      case "evm":
+        addressToAddFormatted = `eip712:${addressToAdd}`;
+        break;
+      case "xrpl":
+        addressToAddFormatted = `XRPL:${publicKey}`;
+        break;
+      case "near":
+        addressToAddFormatted = `NEAR:${publicKey?.replace("ed25519:", "")}`;
+        break;
+      case "facesign":
+        addressToAddFormatted = `FACESIGN:${publicKey}`;
+        break;
+      default:
+        throw new Error("Invalid address to add type");
+    }
+
+    const value = {
+      recovering_address: address,
+      address_to_add: addressToAddFormatted,
+      timestamp: Date.now(),
+    };
+
+    return {
+      domain: this.getTypedDomain(),
+      types: ADD_ADDRESS_TYPES,
+      value,
+    };
+  }
+
+  public removeAddressMessageToSign(
+    addressToRemove: string,
+    publicKey: string | undefined,
+    addressToRemoveType: string,
+  ): RemoveAddressMessageToSign {
+    var address = "";
+    switch (this.walletType) {
+      case "EVM":
+        address = `eip712:${this.signerAddress}`;
+        break;
+      case "XRPL":
+        address = `XRPL:${this.signerPublicKey}`;
+        break;
+      case "NEAR":
+        address = `NEAR:${this.signerPublicKey?.replace("ed25519:", "")}`;
+        break;
+      case "FaceSign":
+        address = `FACESIGN:${this.signerPublicKey}`;
+        break;
+      default:
+        throw new Error("Invalid signer type");
+    }
+
+    var addressToRemoveFormatted = "";
+    // @deprecated toLowerCase remove when we have updated the SDK
+    switch (addressToRemoveType.toLowerCase()) {
+      case "evm":
+        addressToRemoveFormatted = `eip712:${addressToRemove}`;
+        break;
+      case "xrpl":
+        addressToRemoveFormatted = `XRPL:${publicKey}`;
+        break;
+      case "near":
+        addressToRemoveFormatted = `NEAR:${publicKey?.replace("ed25519:", "")}`;
+        break;
+      case "facesign":
+        addressToRemoveFormatted = `FACESIGN:${publicKey}`;
+        break;
+      default:
+        throw new Error("Invalid address to remove type");
+    }
+
+    const value = {
+      recovering_address: address,
+      address_to_remove: addressToRemoveFormatted,
+      timestamp: Date.now(),
+    };
+    return {
+      domain: this.getTypedDomain(),
+      types: REMOVE_ADDRESS_TYPES,
+      value,
+    };
+  }
+
+  public async addAddress(
+    userId: string,
+    message: AddAddressSignatureMessage,
+    signature: string,
+  ): Promise<string> {
+    const engineClients = await this.getEngines();
+    const promises = [];
+    for (let i = 0; i < engineClients.length; i++) {
+      const engineClient = engineClients[i];
+      promises.push(engineClient.sendAddAddress(userId, message, signature));
+    }
+    const statuses = await Promise.all(promises);
+
+    if (statuses.every((item) => item === "200")) {
+      return "success";
+    }
+
+    return "failure";
+  }
+
+  public async removeAddress(
+    userId: string,
+    message: RemoveAddressSignatureMessage,
+    signature: string,
+  ): Promise<string> {
+    const engineClients = await this.getEngines();
+    const promises = [];
+    for (let i = 0; i < engineClients.length; i++) {
+      const engineClient = engineClients[i];
+      promises.push(engineClient.sendRemoveAddress(userId, message, signature));
+    }
+    const statuses = await Promise.all(promises);
+
+    if (statuses.every((item) => item === "200")) {
+      return "success";
+    }
+
+    return "failure";
+  }
+
+  private getTypedDomain(): TypedDataDomain {
+    return {
+      name: "idOS secret store contract",
+      version: "1",
+      verifyingContract: `0x${this.contractAddress.substring(2)}`,
+    };
+  }
+
+  private async getEngines(): Promise<EngineClient[]> {
+    if (this.engines === undefined) {
+      const chainController = new ChainControllerApi(new Configuration({ basePath: this.baseUrl }));
+      const rawState = await chainController.getContract({ address: this.contractAddress });
+      // oxlint-disable-next-line typescript/no-non-null-assertion -- we know serializedContract is present here
+      const state = deserializeState(Buffer.from(rawState.serializedContract!, "base64"));
+      this.engines = state.nodes.map(
+        (value) => new EngineClient(value.endpoint, this.contractAddress, this.walletType),
+      );
+    }
+    return this.engines;
+  }
+
+  private static blindShare(share: Buffer): Buffer {
+    return Buffer.concat([getRandomBytes(32), share]);
+  }
+}

package/src/mpc/engine-client.ts

@@ -0,0 +1,144 @@
+import type { WalletType } from "@idos-network/kwil-infra/actions";
+import { ethers } from "ethers";
+import nacl from "tweetnacl";
+import { patchRequest, postRequest, putRequest } from "./api";
+import type {
+  AddAddressRequest,
+  Bytes,
+  DownloadRequest,
+  EncryptedShare,
+  PbcAddress,
+  RemoveAddressRequest,
+  Sharing,
+  UpdateWalletsRequest,
+} from "./types";
+
+export class EngineClient {
+  private readonly baseUrl: string;
+  private readonly contractAddress: PbcAddress;
+  private readonly walletType: WalletType;
+
+  constructor(baseUrl: string, contractAddress: PbcAddress, walletType: WalletType) {
+    this.contractAddress = contractAddress;
+    this.baseUrl = baseUrl;
+    this.walletType = walletType;
+  }
+
+  private getAuthHeader(signature: string): Record<string, string> {
+    let prefix: string;
+    switch (this.walletType) {
+      case "EVM":
+        prefix = "eip712";
+        break;
+      case "NEAR":
+        prefix = "NEAR";
+        break;
+      case "XRPL":
+        prefix = "XRPL";
+        break;
+      case "FaceSign":
+        prefix = "FACESIGN";
+        break;
+      default:
+        prefix = "eip712"; // fallback to eip712 for unknown types
+    }
+
+    return {
+      Authorization: `${prefix} ${signature}`,
+    };
+  }
+
+  public async sendUpload(id: string, uploadRequest: Sharing, signature: Bytes): Promise<string> {
+    const authHeader = this.getAuthHeader(signature);
+    const url = `${this.baseUrl}/offchain/${this.contractAddress}/shares/${id}`;
+    const status = await putRequest(url, uploadRequest, authHeader);
+    if (status !== "201") {
+      throw new Error(`Error uploading share to ${this.contractAddress} at ${url}`);
+    }
+    return status;
+  }
+
+  public async sendDownload(
+    id: string,
+    downloadRequest: DownloadRequest,
+    signature: Bytes,
+  ): Promise<{ status: string; body: EncryptedShare | undefined }> {
+    const authHeader = this.getAuthHeader(signature);
+    const url = `${this.baseUrl}/offchain/${this.contractAddress}/shares/${id}`;
+    return await postRequest(url, downloadRequest, authHeader);
+  }
+
+  public async downloadAndDecrypt(
+    id: string,
+    downloadRequest: DownloadRequest,
+    signature: Bytes,
+    secretKey: Uint8Array,
+  ): Promise<{ share: Buffer | undefined; status: string }> {
+    const { status, body: encryptedShare } = await this.sendDownload(
+      id,
+      downloadRequest,
+      signature,
+    );
+    if (encryptedShare === undefined) {
+      return { share: undefined, status };
+    }
+    const encryptedBuffer = ethers.getBytes(encryptedShare.encrypted_share);
+    const publicKeyBuffer = ethers.getBytes(encryptedShare.public_key);
+    const nonceBuffer = ethers.getBytes(encryptedShare.nonce);
+    const open = nacl.box.open(encryptedBuffer, nonceBuffer, publicKeyBuffer, secretKey);
+    if (open == null) {
+      return { share: undefined, status: "box-open-error" };
+    }
+    // Remove blinding
+    return { share: Buffer.from(open.subarray(32)), status };
+  }
+
+  public async sendUpdate(
+    id: string,
+    updateRequest: UpdateWalletsRequest,
+    signature: string,
+  ): Promise<string> {
+    const authHeader: RequestInit["headers"] = {
+      Authorization: `eip712 ${signature}`,
+    };
+
+    const url = `${this.baseUrl}/offchain/${this.contractAddress}/shares/${id}`;
+    const ok = await patchRequest(url, updateRequest, authHeader);
+
+    if (!ok) {
+      throw new Error(`Error updating wallets to ${this.contractAddress} at ${url}`);
+    }
+
+    return ok;
+  }
+
+  public async sendAddAddress(
+    id: string,
+    addRequest: AddAddressRequest,
+    signature: string,
+  ): Promise<string> {
+    const authHeader = this.getAuthHeader(signature);
+    const url = `${this.baseUrl}/offchain/${this.contractAddress}/shares/${id}/add_address`;
+    const status = await patchRequest(url, addRequest, authHeader);
+    if (status !== "200") {
+      throw new Error(`Error adding a wallet to ${id} at ${url}`);
+    }
+
+    return status;
+  }
+
+  public async sendRemoveAddress(
+    id: string,
+    removeRequest: RemoveAddressRequest,
+    signature: string,
+  ): Promise<string> {
+    const authHeader = this.getAuthHeader(signature);
+    const url = `${this.baseUrl}/offchain/${this.contractAddress}/shares/${id}/remove_address`;
+    const status = await patchRequest(url, removeRequest, authHeader);
+    if (status !== "200") {
+      throw new Error(`Error removing address from ${id} at ${url}`);
+    }
+
+    return status;
+  }
+}

package/src/mpc/generated/IdosContract.ts

@@ -0,0 +1,92 @@
+// This file is auto-generated from an abi-file using AbiCodegen.
+/* eslint-disable */
+// @ts-nocheck
+// noinspection ES6UnusedImports
+import {
+  AbiByteInput,
+  AbiByteOutput,
+  type AbiInput,
+  type AbiOutput,
+  type BlockchainAddress,
+  type BlockchainStateClient,
+  type StateWithClient,
+} from "@partisiablockchain/abi-client";
+
+type Option<K> = K | undefined;
+export class IdosContract {
+  private readonly _client: BlockchainStateClient | undefined;
+  private readonly _address: BlockchainAddress | undefined;
+
+  public constructor(
+    client: BlockchainStateClient | undefined,
+    address: BlockchainAddress | undefined,
+  ) {
+    this._address = address;
+    this._client = client;
+  }
+  public deserializeContractState(_input: AbiInput): ContractState {
+    const nodes_vecLength = _input.readI32();
+    const nodes: NodeConfig[] = [];
+    for (let nodes_i = 0; nodes_i < nodes_vecLength; nodes_i++) {
+      const nodes_elem: NodeConfig = this.deserializeNodeConfig(_input);
+      nodes.push(nodes_elem);
+    }
+    return { nodes };
+  }
+  public deserializeNodeConfig(_input: AbiInput): NodeConfig {
+    const address: BlockchainAddress = _input.readAddress();
+    const endpoint: string = _input.readString();
+    return { address, endpoint };
+  }
+  public async getState(): Promise<ContractState> {
+    const bytes = await this._client?.getContractStateBinary(this._address!);
+    if (bytes === undefined) {
+      throw new Error("Unable to get state bytes");
+    }
+    const input = AbiByteInput.createLittleEndian(bytes);
+    return this.deserializeContractState(input);
+  }
+}
+export interface ContractState {
+  nodes: NodeConfig[];
+}
+
+export interface NodeConfig {
+  address: BlockchainAddress;
+  endpoint: string;
+}
+function serializeNodeConfig(_out: AbiOutput, _value: NodeConfig): void {
+  const { address, endpoint } = _value;
+  _out.writeAddress(address);
+  _out.writeString(endpoint);
+}
+
+export function initialize(nodes: NodeConfig[]): Buffer {
+  return AbiByteOutput.serializeBigEndian((_out) => {
+    _out.writeBytes(Buffer.from("ffffffff0f", "hex"));
+    _out.writeI32(nodes.length);
+    for (const nodes_vec of nodes) {
+      serializeNodeConfig(_out, nodes_vec);
+    }
+  });
+}
+
+export function deserializeState(state: StateWithClient): ContractState;
+export function deserializeState(bytes: Buffer): ContractState;
+export function deserializeState(
+  bytes: Buffer,
+  client: BlockchainStateClient,
+  address: BlockchainAddress,
+): ContractState;
+export function deserializeState(
+  state: Buffer | StateWithClient,
+  client?: BlockchainStateClient,
+  address?: BlockchainAddress,
+): ContractState {
+  if (Buffer.isBuffer(state)) {
+    const input = AbiByteInput.createLittleEndian(state);
+    return new IdosContract(client, address).deserializeContractState(input);
+  }
+  const input = AbiByteInput.createLittleEndian(state.bytes);
+  return new IdosContract(state.client, state.address).deserializeContractState(input);
+}

package/src/mpc/index.ts

@@ -0,0 +1,2 @@
+export * from "./client";
+export * from "./types";