@idos-network/kwil-infra 1.1.0

package/src/facesign/facesign-signer.ts

@@ -0,0 +1,327 @@
+// Buffer after showing the iframe before posting a message, giving the enclave time to be ready.
+const POST_MESSAGE_DELAY_MS = 300;
+// Safety net: reject proposals if the enclave doesn't respond within this window.
+const PROPOSAL_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
+
+export interface FaceSignMetadata {
+  name: string;
+  description: string;
+}
+
+export interface FaceSignSignerProviderOptions {
+  metadata: FaceSignMetadata;
+  enclaveUrl: string;
+}
+
+interface SessionResponse {
+  address: string;
+}
+
+export class FaceSignSignerProvider {
+  #iframe: HTMLIFrameElement | null = null;
+  #container: HTMLDialogElement | null = null;
+
+  #resolveOpenEnclave: (() => void) | null = null;
+  #resolveSignMessage: ((signature: Uint8Array) => void) | null = null;
+  #rejectSignMessage: ((error: Error) => void) | null = null;
+  #resolveSessionProposal: ((response: SessionResponse) => void) | null = null;
+  #rejectSessionProposal: ((error: Error) => void) | null = null;
+  #resolveAddressRequest: ((address: string | null) => void) | null = null;
+
+  #messageListener: ((event: MessageEvent) => void) | null = null;
+  #messageListenerInitialized = false;
+  #proposalId = 0;
+  #hasKey: boolean | null = null;
+  #metadata: FaceSignMetadata;
+  #enclaveUrl: string;
+  #enclaveOrigin: string;
+
+  signatureType = "ed25519";
+  walletType = "FaceSign";
+  publicAddress = "";
+  publicKey = "";
+
+  constructor(options: FaceSignSignerProviderOptions) {
+    this.#metadata = options.metadata;
+    this.#enclaveUrl = options.enclaveUrl;
+    this.#enclaveOrigin = new URL(options.enclaveUrl).origin;
+  }
+
+  #setupMessageListener(): void {
+    if (this.#messageListenerInitialized) {
+      return;
+    }
+
+    this.#messageListener = (event: MessageEvent) => {
+      if (event.origin !== this.#enclaveOrigin) return;
+
+      if (event.data?.type === "facesign_ready") {
+        this.#hasKey = !!event.data.hasKey;
+        this.#resolveOpenEnclave?.();
+      }
+
+      if (event.data?.type === "sign_proposal_response") {
+        const payload = event.data.data;
+        if (!payload) return;
+
+        if (payload.signature) {
+          this.#resolveSignMessage?.(new Uint8Array(payload.signature));
+        } else {
+          this.#rejectSignMessage?.(new Error("Sign request rejected by user"));
+        }
+      }
+
+      if (event.data?.type === "session_proposal_response") {
+        const payload = event.data.data;
+        if (!payload) return;
+
+        if (payload.approved && payload.address) {
+          this.#resolveSessionProposal?.({ address: payload.address });
+        } else {
+          this.#rejectSessionProposal?.(new Error("Session request rejected by user"));
+        }
+      }
+
+      if (event.data?.type === "address_response") {
+        const payload = event.data.data;
+        this.#resolveAddressRequest?.(payload?.address ?? null);
+      }
+    };
+
+    window.addEventListener("message", this.#messageListener);
+    this.#messageListenerInitialized = true;
+  }
+
+  async preload(): Promise<{ hasKey: boolean }> {
+    this.#setupMessageListener();
+    await this.#ensureEnclave();
+    return { hasKey: this.#hasKey ?? false };
+  }
+
+  async init(): Promise<string> {
+    this.#setupMessageListener();
+
+    const sessionProposal = await this.#sessionProposal();
+
+    this.publicKey = sessionProposal.address;
+    this.publicAddress = sessionProposal.address;
+
+    return sessionProposal.address;
+  }
+
+  async getAddress(): Promise<string | null> {
+    this.#setupMessageListener();
+    await this.#ensureEnclave();
+
+    if (!this.#hasKey) return null;
+
+    return new Promise<string | null>((resolve) => {
+      const timer = setTimeout(() => resolve(null), PROPOSAL_TIMEOUT_MS);
+
+      this.#resolveAddressRequest = (address) => {
+        clearTimeout(timer);
+        this.#resolveAddressRequest = null;
+        if (address) {
+          this.publicKey = address;
+          this.publicAddress = address;
+        }
+        resolve(address);
+      };
+
+      this.#iframe?.contentWindow?.postMessage(
+        { type: "address_request", data: { id: ++this.#proposalId } },
+        this.#enclaveUrl,
+      );
+    });
+  }
+
+  get signer(): this {
+    return this;
+  }
+
+  async signMessage(message: Uint8Array | string): Promise<Uint8Array> {
+    await this.#ensureEnclave();
+    this.#showEnclave();
+
+    const messageToSign = typeof message === "string" ? new TextEncoder().encode(message) : message;
+
+    try {
+      return await new Promise<Uint8Array>((resolve, reject) => {
+        const timer = setTimeout(() => {
+          reject(new Error("FaceSign sign request timed out"));
+        }, PROPOSAL_TIMEOUT_MS);
+
+        this.#resolveSignMessage = (sig) => {
+          clearTimeout(timer);
+          resolve(sig);
+        };
+        this.#rejectSignMessage = (err) => {
+          clearTimeout(timer);
+          reject(err);
+        };
+
+        setTimeout(() => {
+          this.#iframe?.contentWindow?.postMessage(
+            {
+              type: "sign_proposal",
+              data: {
+                id: ++this.#proposalId,
+                data: messageToSign,
+                metadata: this.#metadata,
+              },
+            },
+            this.#enclaveUrl,
+          );
+        }, POST_MESSAGE_DELAY_MS);
+      });
+    } finally {
+      this.#resolveSignMessage = null;
+      this.#rejectSignMessage = null;
+      this.#hideEnclave();
+    }
+  }
+
+  async #sessionProposal(): Promise<SessionResponse> {
+    await this.#ensureEnclave();
+    this.#showEnclave();
+
+    try {
+      return await new Promise<SessionResponse>((resolve, reject) => {
+        const timer = setTimeout(() => {
+          reject(new Error("FaceSign session proposal timed out"));
+        }, PROPOSAL_TIMEOUT_MS);
+
+        this.#resolveSessionProposal = (res) => {
+          clearTimeout(timer);
+          resolve(res);
+        };
+        this.#rejectSessionProposal = (err) => {
+          clearTimeout(timer);
+          reject(err);
+        };
+
+        setTimeout(() => {
+          this.#iframe?.contentWindow?.postMessage(
+            {
+              type: "session_proposal",
+              data: {
+                id: ++this.#proposalId,
+                metadata: this.#metadata,
+              },
+            },
+            this.#enclaveUrl,
+          );
+        }, POST_MESSAGE_DELAY_MS);
+      });
+    } finally {
+      this.#resolveSessionProposal = null;
+      this.#rejectSessionProposal = null;
+      this.#hideEnclave();
+    }
+  }
+
+  hide(): void {
+    this.#cancelPendingProposals();
+    this.#hideEnclave();
+  }
+
+  #cancelPendingProposals(): void {
+    const cancelError = new Error("FaceSign operation cancelled");
+
+    if (this.#rejectSignMessage) {
+      this.#rejectSignMessage(cancelError);
+      this.#resolveSignMessage = null;
+      this.#rejectSignMessage = null;
+    }
+
+    if (this.#rejectSessionProposal) {
+      this.#rejectSessionProposal(cancelError);
+      this.#resolveSessionProposal = null;
+      this.#rejectSessionProposal = null;
+    }
+  }
+
+  destroy(): void {
+    this.#cancelPendingProposals();
+    if (this.#messageListener) {
+      window.removeEventListener("message", this.#messageListener);
+      this.#messageListener = null;
+    }
+    this.#destroyEnclave();
+  }
+
+  #createContainer(): HTMLDialogElement {
+    const container = document.createElement("dialog");
+    Object.assign(container.style, {
+      position: "fixed",
+      inset: "0",
+      width: "100%",
+      height: "100%",
+      maxWidth: "100%",
+      maxHeight: "100%",
+      margin: "0",
+      padding: "0",
+      border: "none",
+      zIndex: "99999",
+      background: "#0a0a0a",
+    });
+    document.body.appendChild(container);
+    return container;
+  }
+
+  #ensureEnclave(): Promise<void> {
+    if (this.#iframe?.contentWindow) {
+      return Promise.resolve();
+    }
+
+    return new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        reject(new Error("FaceSign enclave failed to load"));
+      }, PROPOSAL_TIMEOUT_MS);
+
+      if (!this.#container) {
+        this.#container = this.#createContainer();
+      }
+
+      this.#iframe = document.createElement("iframe");
+      this.#iframe.src = this.#enclaveUrl;
+      this.#iframe.title = "FaceSign Enclave";
+      this.#iframe.allow = "camera; fullscreen";
+      this.#iframe.style.cssText = "width:100%;height:100%;border:none;";
+
+      this.#container.appendChild(this.#iframe);
+
+      this.#resolveOpenEnclave = () => {
+        console.log("resolveOpenEnclave");
+        clearTimeout(timer);
+        resolve();
+      };
+    });
+  }
+
+  #showEnclave(): void {
+    const el = this.#container;
+
+    if (el && !el.open) {
+      el.showModal();
+    }
+  }
+
+  #hideEnclave(): void {
+    const el = this.#container;
+    if (el?.open) {
+      el.close();
+    }
+  }
+
+  #destroyEnclave(): void {
+    if (this.#iframe) {
+      this.#iframe.remove();
+      this.#iframe = null;
+    }
+    if (this.#container) {
+      this.#container.remove();
+      this.#container = null;
+    }
+  }
+}

package/src/facesign/index.ts

@@ -0,0 +1,2 @@
+export type { FaceSignMetadata, FaceSignSignerProviderOptions } from "./facesign-signer";
+export { FaceSignSignerProvider } from "./facesign-signer";

package/src/index.ts

@@ -0,0 +1,7 @@
+export * from "./create-kwil-client";
+export * from "./create-kwil-signer";
+export {
+  getNearFullAccessPublicKeys,
+  implicitAddressFromPublicKey,
+  signNearMessage,
+} from "./near/create-near-wallet-kwil-signer";

package/src/near/create-near-wallet-kwil-signer.ts

@@ -0,0 +1,245 @@
+import type { Store } from "@idos-network/utils/store";
+import type {
+  Wallet as NearWallet,
+  SignedMessage,
+  SignMessageParams,
+} from "@near-wallet-selector/core";
+import type { connect as connectT } from "near-api-js";
+import type { AccessKeyList } from "near-api-js/lib/providers/provider";
+
+import { KwilSigner } from "@idos-network/kwil-js";
+import {
+  base64Decode,
+  binaryWriteUint16BE,
+  borshSerialize,
+  bs58Decode,
+  bytesConcat,
+  hexEncode,
+  utf8Decode,
+} from "@idos-network/utils/codecs";
+
+import type { KwilActionClient } from "../create-kwil-client";
+
+import { getNearConnectionConfig } from "./get-config";
+
+const NEAR_WALLET_TYPES: string[] = [
+  "browser",
+  "injected",
+  "instant-link",
+  "hardware",
+  "bridge",
+] satisfies NearWallet["type"][];
+
+export function looksLikeNearWallet(signer: unknown): signer is NearWallet {
+  return (
+    signer !== null &&
+    typeof signer === "object" &&
+    "id" in signer &&
+    "metadata" in signer &&
+    "type" in signer &&
+    typeof signer.type === "string" &&
+    NEAR_WALLET_TYPES.includes(signer.type)
+  );
+}
+
+class KwilNonce {
+  bytes: Uint8Array;
+
+  constructor(length = 32) {
+    // We're in the browser, so there's a window.crypto for sure.
+    /* global crypto */
+    this.bytes = crypto.getRandomValues(new Uint8Array(length));
+  }
+
+  get clampUTF8() {
+    return this.bytes.map((byte) => byte & 127);
+  }
+}
+
+/**
+ * Creates a signer function that can be used to sign messages with a NEAR wallet
+ */
+function createNearWalletSigner(
+  wallet: NearWallet,
+  recipient: string,
+): (message: string | Uint8Array) => Promise<Uint8Array> {
+  return async (message: string | Uint8Array): Promise<Uint8Array> => {
+    const messageString = typeof message === "string" ? message : utf8Decode(message);
+
+    if (!wallet.signMessage) {
+      throw new Error("Only wallets with signMessage are supported.");
+    }
+
+    const nonceSuggestion = Buffer.from(new KwilNonce(32).bytes);
+
+    const {
+      nonce = nonceSuggestion,
+      signature,
+      // @ts-expect-error Signatures don't seem to be updated for NEP413 yet.
+      callbackUrl,
+      // oxlint-disable-next-line typescript/no-non-null-assertion -- Only non-signing wallets return void.
+    } = (await (
+      wallet.signMessage as (
+        _: SignMessageParams,
+      ) => Promise<SignedMessage & { nonce?: Uint8Array }>
+    )({
+      message: messageString,
+      recipient,
+      nonce: nonceSuggestion,
+    }))!;
+
+    const nep413BorschSchema = {
+      struct: {
+        tag: "u32",
+        message: "string",
+        nonce: { array: { type: "u8", len: 32 } },
+        recipient: "string",
+        callbackUrl: { option: "string" },
+      },
+    };
+
+    const nep413BorshParams = {
+      tag: 2147484061,
+      message: messageString,
+      nonce: Array.from(nonce),
+      recipient,
+      callbackUrl,
+    };
+
+    const nep413BorshPayload = borshSerialize(nep413BorschSchema, nep413BorshParams);
+    const result = bytesConcat(
+      binaryWriteUint16BE(nep413BorshPayload.length),
+      nep413BorshPayload,
+      base64Decode(signature),
+    );
+
+    return result;
+  };
+}
+
+export function implicitAddressFromPublicKey(publicKey: string): string {
+  const key_without_prefix = publicKey.replace(/^ed25519:/, "");
+  return hexEncode(bs58Decode(key_without_prefix));
+}
+
+export async function getNearFullAccessPublicKeys(
+  namedAddress: string,
+): Promise<string[] | undefined> {
+  let connect: typeof connectT;
+  try {
+    connect = (await import("near-api-js")).connect;
+  } catch (_e) {
+    throw new Error("Can't load near-api-js");
+  }
+  const connectionConfig = getNearConnectionConfig(namedAddress);
+  const nearConnection = await connect(connectionConfig);
+
+  try {
+    const response: AccessKeyList = await nearConnection.connection.provider.query({
+      request_type: "view_access_key_list",
+      finality: "final",
+      account_id: namedAddress,
+    });
+    return response.keys
+      .filter((element) => element.access_key.permission === "FullAccess")
+      ?.map((i) => i.public_key);
+  } catch {
+    // `Near` failed if namedAddress contains uppercase symbols
+    return;
+  }
+}
+
+export async function signNearMessage(
+  wallet: NearWallet,
+  message: string,
+  recipient = "idos.network",
+): Promise<string> {
+  const signer = createNearWalletSigner(wallet, recipient);
+  const signedPayload = await signer(message);
+  return hexEncode(signedPayload);
+}
+
+export async function createNearWalletKwilSigner(
+  wallet: NearWallet,
+  currentAddress: string,
+  store: Store,
+  kwilClient: KwilActionClient,
+  recipient = "idos.network",
+): Promise<{ kwilSigner: KwilSigner; publicKey: string }> {
+  if (!wallet.signMessage) throw new Error("Only wallets with signMessage are supported.");
+
+  if (wallet.id === "my-near-wallet") {
+    const { accountId, signature, publicKey, error } = Object.fromEntries(
+      new URLSearchParams(window.location.hash.slice(1)).entries(),
+    );
+
+    if (signature) {
+      await store.set("signer-address", accountId);
+      await store.set("signer-public-key", publicKey);
+    }
+
+    const signMessageOriginal = wallet.signMessage.bind(wallet);
+
+    wallet.signMessage = async ({
+      message,
+      recipient,
+    }: SignMessageParams): Promise<SignedMessage & { nonce?: Uint8Array }> => {
+      if (error) return Promise.reject();
+
+      const lastMessage = await store.get<string>("sign-last-message");
+      const lastNonce = await store.get<Uint8Array>("sign-last-nonce");
+
+      if (signature && message === lastMessage && lastNonce) {
+        const nonce = Buffer.from(lastNonce);
+        const callbackUrl = await store.get<string>("sign-last-url");
+
+        return Promise.resolve({
+          accountId: currentAddress,
+          publicKey,
+          signature,
+          nonce,
+          message,
+          callbackUrl,
+        } as SignedMessage);
+      }
+
+      const callbackUrl = window.location.href;
+      const nonce = Buffer.from(new KwilNonce(32).clampUTF8);
+
+      await store.set("sign-last-message", message);
+      await store.set("sign-last-nonce", Array.from(nonce));
+      await store.set("sign-last-url", callbackUrl);
+
+      signMessageOriginal({ message, nonce, recipient, callbackUrl });
+
+      return new Promise(() => ({}) as SignedMessage);
+    };
+  }
+
+  const storedAddress = await store.get<string>("signer-address");
+
+  let publicKey = await store.get<string>("signer-public-key");
+
+  if (storedAddress !== currentAddress || !publicKey) {
+    store.reset();
+    // To avoid re-using the old signer's kgw cookie.
+    // When kwil-js supports multi cookies, we can remove this.
+    await kwilClient.client.auth.logoutKGW();
+
+    const message = "idOS authentication";
+    const nonce = Buffer.from(new KwilNonce(32).bytes);
+    const signResult = await wallet.signMessage({ message, recipient, nonce });
+    if (!signResult) throw new Error("signMessage returned no result");
+    ({ publicKey } = signResult);
+
+    await store.set("signer-address", currentAddress);
+    await store.set("signer-public-key", publicKey);
+  }
+
+  const signer = createNearWalletSigner(wallet, recipient);
+
+  return {
+    kwilSigner: new KwilSigner(signer, implicitAddressFromPublicKey(publicKey), "nep413"),
+    publicKey,
+  };
+}

package/src/near/get-config.ts

@@ -0,0 +1,43 @@
+// Network configuration mapping
+const NEAR_NETWORKS = {
+  mainnet: {
+    networkId: "mainnet",
+    nodeUrl: "https://rpc.mainnet.near.org",
+  },
+  testnet: {
+    networkId: "testnet",
+    nodeUrl: "https://rpc.testnet.near.org",
+  },
+  betanet: {
+    networkId: "betanet",
+    nodeUrl: "https://rpc.betanet.near.org",
+  },
+  shardnet: {
+    networkId: "shardnet",
+    nodeUrl: "https://rpc.shardnet.near.org",
+  },
+} as const;
+
+// Function to detect NEAR network from account ID
+export const detectNearNetwork = (accountId: string): keyof typeof NEAR_NETWORKS => {
+  if (accountId.endsWith(".near")) return "mainnet";
+  if (accountId.endsWith(".testnet")) return "testnet";
+  if (accountId.endsWith(".betanet")) return "betanet";
+  if (accountId.endsWith(".shardnet")) return "shardnet";
+
+  // Default to testnet for development, mainnet for production
+  return "testnet";
+};
+
+// Function to get connection config based on account ID
+export const getNearConnectionConfig = (
+  accountId: string,
+): { networkId: string; nodeUrl: string } => {
+  const network = detectNearNetwork(accountId);
+  const networkConfig = NEAR_NETWORKS[network];
+
+  return {
+    networkId: networkConfig.networkId,
+    nodeUrl: networkConfig.nodeUrl,
+  };
+};

package/src/near/nep413.ts

@@ -0,0 +1,62 @@
+import type { KeyPair } from "near-api-js";
+
+import {
+  binaryWriteUint16BE,
+  borshSerialize,
+  bytesConcat,
+  sha256Hash,
+  utf8Decode,
+} from "@idos-network/utils/codecs";
+
+export function kwilNep413Signer(
+  recipient: string,
+): (keyPair: KeyPair) => (messageBytes: Uint8Array) => Promise<Uint8Array> {
+  return (keyPair: KeyPair) =>
+    async (messageBytes: Uint8Array): Promise<Uint8Array> => {
+      const message = utf8Decode(messageBytes);
+      const nonceLength = 32;
+      const nonce = crypto.getRandomValues(new Uint8Array(nonceLength));
+
+      const nep413BorschSchema = {
+        struct: {
+          message: "string",
+          nonce: { array: { type: "u8", len: nonceLength } },
+          recipient: "string",
+          callbackUrl: { option: "string" },
+        },
+      } as const;
+
+      const tag = 2147484061; // 2**31 + 413
+
+      const { signature } = keyPair.sign(
+        sha256Hash(
+          bytesConcat(
+            borshSerialize("u32", tag),
+            borshSerialize(nep413BorschSchema, { message, nonce, recipient }),
+          ),
+        ),
+      );
+
+      const kwilNep413BorschSchema = {
+        struct: {
+          tag: "u32",
+          ...nep413BorschSchema.struct,
+        },
+      };
+
+      const kwilNep413BorshParams = {
+        tag,
+        message,
+        nonce,
+        recipient,
+      };
+
+      const kwilNep413BorshPayload = borshSerialize(kwilNep413BorschSchema, kwilNep413BorshParams);
+
+      return bytesConcat(
+        binaryWriteUint16BE(kwilNep413BorshPayload.length),
+        kwilNep413BorshPayload,
+        signature,
+      );
+    };
+}