@idos-network/kwil-infra 1.1.0

package/src/near/signature-verification.ts

@@ -0,0 +1,85 @@
+import {
+  borshDeserialize,
+  borshSerialize,
+  bs58Decode,
+  hexDecode,
+  sha256Hash,
+} from "@idos-network/utils/codecs";
+import nacl from "tweetnacl";
+
+interface NEP413Payload {
+  tag: number;
+  message: string;
+  nonce: number[];
+  recipient: string;
+  callbackUrl?: string;
+}
+
+export const verifyNearSignature = async (
+  message: string,
+  signature: string,
+  publicKey: string,
+): Promise<boolean> => {
+  try {
+    // Parse the NEAR public key format: "ed25519:base58_encoded_key"
+    const pieces = publicKey.split(":");
+    if (pieces.length !== 2 || pieces[0] !== "ed25519") {
+      console.warn("Invalid NEAR public key format:", publicKey);
+      return false;
+    }
+
+    // Extract raw public key bytes (am trying to match the logic I did in Backend)
+    const publicKeyBytes = bs58Decode(pieces[1]);
+    if (publicKeyBytes.length !== 32) {
+      console.warn("Invalid NEAR public key length:", publicKeyBytes.length);
+      return false;
+    }
+
+    // Decode the signature from hex
+    const signatureBytes = hexDecode(signature);
+
+    // Deserialize the signature (matching Go's deserializeSignature)
+    const payloadLength = new DataView(signatureBytes.buffer).getUint16(0, false);
+    const payloadBytes = signatureBytes.slice(2, 2 + payloadLength);
+    const actualSignature = signatureBytes.slice(2 + payloadLength);
+
+    if (actualSignature.length !== 64) {
+      console.warn("Invalid signature length:", actualSignature.length);
+      return false;
+    }
+
+    // Deserialize the payload to extract nonce, recipient, callbackUrl
+    const payloadSchema = {
+      struct: {
+        tag: "u32",
+        message: "string",
+        nonce: { array: { type: "u8", len: 32 } },
+        recipient: "string",
+        callbackUrl: { option: "string" },
+      },
+    };
+
+    const deserializedPayload = borshDeserialize(payloadSchema, payloadBytes) as NEP413Payload;
+
+    // Reconstruct the payload with tag and message (matching Go implementation)
+    const reconstructedPayload: NEP413Payload = {
+      tag: 2147484061, // 2**31 + 413
+      message: message, // Use the provided message
+      nonce: deserializedPayload.nonce,
+      recipient: deserializedPayload.recipient,
+      callbackUrl: deserializedPayload.callbackUrl,
+    };
+
+    // Serialize the entire payload (matching Go's borsch.Serialize(*payload))
+    const fullPayloadBytes = borshSerialize(payloadSchema, reconstructedPayload);
+    // Hash the payload (matching Go's sha256.Sum256(payloadBytes))
+    const hash = sha256Hash(fullPayloadBytes);
+    // Raw ed25519 verification using nacl (matching Go's ed25519.Verify)
+    const isValid = nacl.sign.detached.verify(hash, actualSignature, publicKeyBytes);
+
+    return isValid;
+  } catch (error) {
+    console.warn("NEAR signature verification failed:", error);
+    return false;
+  }
+};

package/src/signature-verification/evm.ts

@@ -0,0 +1,33 @@
+export const verifyEvmSignature = async (
+  message: string,
+  signature: `0x${string}`,
+  address: `0x${string}`,
+): Promise<boolean> => {
+  let wagmi: typeof import("@wagmi/core");
+
+  try {
+    wagmi = await import("@wagmi/core");
+  } catch (_e) {
+    throw new Error("Can't load @wagmi/core");
+  }
+
+  let chains: typeof import("@wagmi/core/chains");
+  try {
+    chains = await import("@wagmi/core/chains");
+  } catch (_e) {
+    throw new Error("Can't load @wagmi/core/chains");
+  }
+
+  const wagmiConfig = wagmi.createConfig({
+    chains: [chains.mainnet],
+    transports: {
+      [chains.mainnet.id]: wagmi.http(),
+    },
+  });
+
+  return wagmi.verifyMessage(wagmiConfig, {
+    address,
+    message,
+    signature,
+  });
+};

package/src/signature-verification/facesign.ts

@@ -0,0 +1,19 @@
+import { hexDecode, utf8Encode } from "@idos-network/utils/codecs";
+import nacl from "tweetnacl";
+
+export const verifyFaceSignSignature = (
+  message: string,
+  signature: string,
+  publicKey: string,
+): boolean => {
+  try {
+    return nacl.sign.detached.verify(
+      utf8Encode(message),
+      hexDecode(signature),
+      hexDecode(publicKey),
+    );
+  } catch (error) {
+    console.warn("FaceSign signature verification failed:", error);
+    return false;
+  }
+};

package/src/signature-verification/index.test.ts

@@ -0,0 +1,110 @@
+import { hexEncode, utf8Encode } from "@idos-network/utils/codecs";
+import nacl from "tweetnacl";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("./evm", () => ({ verifyEvmSignature: vi.fn() }));
+vi.mock("./stellar", () => ({ verifyStellarSignature: vi.fn() }));
+vi.mock("../near/signature-verification", () => ({ verifyNearSignature: vi.fn() }));
+vi.mock("../xrp/signature-verification", () => ({ verifyRippleSignature: vi.fn() }));
+
+import { verifyNearSignature } from "../near/signature-verification.js";
+import { verifyRippleSignature } from "../xrp/signature-verification.js";
+import { verifyEvmSignature } from "./evm.js";
+import { verifySignature } from "./index.js";
+import { verifyStellarSignature } from "./stellar.js";
+
+describe("verifySignature", () => {
+  it("routes EVM verification", async () => {
+    const evmMock = vi.mocked(verifyEvmSignature);
+    evmMock.mockResolvedValueOnce(true);
+
+    const result = await verifySignature({
+      address: "0xabc",
+      signature: "0xsig",
+      message: "hello",
+      wallet_type: "EVM",
+      public_key: [],
+    });
+
+    expect(result).toBe(true);
+    expect(evmMock).toHaveBeenCalledWith("hello", "0xsig", "0xabc");
+  });
+
+  it("requires public_key for non-EVM wallets", async () => {
+    await expect(
+      verifySignature({
+        address: "alice.near",
+        signature: "sig",
+        message: "hello",
+        wallet_type: "NEAR",
+        public_key: [],
+      }),
+    ).rejects.toThrow("Wallet public_key is required for non-EVM wallets");
+  });
+
+  it("routes NEAR verification", async () => {
+    const nearMock = vi.mocked(verifyNearSignature);
+    nearMock.mockResolvedValueOnce(true);
+
+    const result = await verifySignature({
+      address: "alice.near",
+      signature: "sig",
+      message: "hello",
+      wallet_type: "NEAR",
+      public_key: ["ed25519:abc"],
+    });
+
+    expect(result).toBe(true);
+    expect(nearMock).toHaveBeenCalledWith("hello", "sig", "ed25519:abc");
+  });
+
+  it("routes Stellar verification", async () => {
+    const stellarMock = vi.mocked(verifyStellarSignature);
+    stellarMock.mockResolvedValueOnce(true);
+
+    const result = await verifySignature({
+      address: "GABC",
+      signature: "sig",
+      message: "hello",
+      wallet_type: "Stellar",
+      public_key: ["GABC"],
+    });
+
+    expect(result).toBe(true);
+    expect(stellarMock).toHaveBeenCalledWith("hello", "sig", "GABC");
+  });
+
+  it("returns false when verifier throws", async () => {
+    const xrpMock = vi.mocked(verifyRippleSignature);
+    xrpMock.mockImplementationOnce(() => {
+      throw new Error("boom");
+    });
+
+    const result = await verifySignature({
+      address: "rAddress",
+      signature: "sig",
+      message: "hello",
+      wallet_type: "XRPL",
+      public_key: ["pk"],
+    });
+
+    expect(result).toBe(false);
+  });
+
+  it("routes FaceSign verification", async () => {
+    const keyPair = nacl.sign.keyPair();
+    const publicKey = hexEncode(keyPair.publicKey);
+    const message = utf8Encode("hello");
+    const signature = nacl.sign.detached(message, keyPair.secretKey);
+
+    const result = await verifySignature({
+      address: "faceSignAddress",
+      signature: hexEncode(signature),
+      message: "hello",
+      wallet_type: "FaceSign",
+      public_key: [publicKey],
+    });
+
+    expect(result).toBe(true);
+  });
+});

package/src/signature-verification/index.ts

@@ -0,0 +1,72 @@
+import invariant from "tiny-invariant";
+
+import type { WalletType } from "../actions";
+
+import { verifyNearSignature } from "../near/signature-verification";
+import { verifyRippleSignature } from "../xrp/signature-verification";
+import { verifyEvmSignature } from "./evm";
+import { verifyFaceSignSignature } from "./facesign";
+import { verifyStellarSignature } from "./stellar";
+
+export interface WalletSignature {
+  address: string;
+  signature: string;
+  message: string;
+  wallet_type: WalletType;
+  public_key?: string[];
+}
+
+export const verifySignature = async (walletPayload: WalletSignature): Promise<boolean> => {
+  invariant(walletPayload.address, "Wallet address is required");
+  invariant(walletPayload.message, "Wallet message is required");
+  invariant(walletPayload.signature, "Wallet signature is required");
+  invariant(walletPayload.wallet_type, "Wallet type is required");
+
+  if (walletPayload.wallet_type !== "EVM") {
+    invariant(walletPayload.public_key?.[0], "Wallet public_key is required for non-EVM wallets");
+  }
+
+  try {
+    switch (walletPayload.wallet_type) {
+      case "EVM":
+        return verifyEvmSignature(
+          walletPayload.message,
+          walletPayload.signature as `0x${string}`,
+          walletPayload.address as `0x${string}`,
+        );
+      case "NEAR":
+        return verifyNearSignature(
+          walletPayload.message,
+          walletPayload.signature,
+          // @ts-expect-error - this has been checked above
+          walletPayload.public_key[0],
+        );
+      case "XRPL":
+        return verifyRippleSignature(
+          walletPayload.message,
+          walletPayload.signature,
+          // @ts-expect-error - this has been checked above
+          walletPayload.public_key[0],
+        );
+      case "Stellar":
+        return await verifyStellarSignature(
+          walletPayload.message,
+          walletPayload.signature,
+          // @ts-expect-error - this has been checked above
+          walletPayload.public_key[0],
+        );
+      case "FaceSign":
+        return verifyFaceSignSignature(
+          walletPayload.message,
+          walletPayload.signature,
+          // @ts-expect-error - this has been checked above
+          walletPayload.public_key[0],
+        );
+      default:
+        throw new Error(`Unsupported wallet type: ${walletPayload.wallet_type}`);
+    }
+  } catch (error) {
+    console.warn("Error verifying signature", error);
+    return false;
+  }
+};

package/src/signature-verification/stellar.ts

@@ -0,0 +1,31 @@
+export const verifyStellarSignature = async (
+  message: string,
+  signature: string,
+  publicKey: string,
+): Promise<boolean> => {
+  let stellar: typeof import("@stellar/stellar-sdk");
+
+  try {
+    stellar = await import("@stellar/stellar-sdk");
+  } catch (e) {
+    throw new Error("Can't load `@stellar/stellar-sdk`", { cause: e });
+  }
+
+  try {
+    // Convert hex signature to buffer
+    const signatureBuffer = Buffer.from(signature, "hex");
+
+    // `Keypair.fromPublicKey()` expects StrKey format, but we're passing as hex (derivePublicKey result).
+    const publicKeyBuffer = Buffer.from(publicKey, "hex");
+    const strKeyAddress = stellar.StrKey.encodeEd25519PublicKey(publicKeyBuffer);
+
+    const keypair = stellar.Keypair.fromPublicKey(strKeyAddress);
+
+    const result = keypair.verify(Buffer.from(message), signatureBuffer);
+
+    return result;
+  } catch (error) {
+    console.warn("Stellar signature verification failed:", error);
+    return false;
+  }
+};

package/src/xrp/signature-verification.ts

@@ -0,0 +1,18 @@
+import { hexEncode, utf8Encode } from "@idos-network/utils/codecs";
+
+export const verifyRippleSignature = async (
+  message: string,
+  signature: string,
+  publicKey: string,
+): Promise<boolean> => {
+  let xrpKeypair: typeof import("ripple-keypairs");
+
+  try {
+    xrpKeypair = await import("ripple-keypairs");
+  } catch (e) {
+    throw new Error("Can't load `ripple-keypairs`", { cause: e });
+  }
+
+  const messageHex = hexEncode(utf8Encode(message));
+  return xrpKeypair.verify(messageHex, signature, publicKey);
+};

package/src/xrp/signer.ts

@@ -0,0 +1,43 @@
+import type * as GemWallet from "@gemwallet/api";
+import type { Store } from "@idos-network/utils/store";
+import type { Xumm } from "xumm";
+
+import { KwilSigner } from "@idos-network/kwil-js";
+
+import type { KwilActionClient } from "../create-kwil-client";
+
+import { getXrpTxHash } from "./utils";
+
+export async function createXrpKwilSigner(
+  wallet: Xumm | typeof GemWallet,
+  currentAddress: string,
+  store: Store,
+  kwilClient: KwilActionClient,
+  walletPublicKey: string,
+): Promise<KwilSigner> {
+  const storedAddress = await store.get<string>("signer-address");
+  const storePublicKey = await store.get<string>("signer-public-key");
+
+  if (storedAddress !== currentAddress || (storePublicKey && storePublicKey !== walletPublicKey)) {
+    try {
+      // HEADS UP: for some reason logoutKGW fails on xrp
+      // storePublicKey && await kwilClient.client.auth.logoutKGW();
+      console.log("logoutKGW", kwilClient);
+    } catch (error) {
+      console.error("Failed to logout KGW:", error);
+    }
+  }
+
+  await store.set("signer-address", currentAddress);
+  await store.set("signer-public-key", walletPublicKey);
+
+  const signer = async (message: string | Uint8Array): Promise<Uint8Array> => {
+    const signature = await getXrpTxHash(message, wallet);
+    if (!signature) {
+      throw new Error("Failed to sign transaction with XRP");
+    }
+    return Buffer.from(signature, "hex");
+  };
+
+  return new KwilSigner(signer, walletPublicKey, "xrpl");
+}

package/src/xrp/utils.ts

@@ -0,0 +1,178 @@
+import type * as GemWallet from "@gemwallet/api";
+import type { Xumm } from "xumm";
+export type WalletName = "XAMAN" | "GEM";
+
+export interface WalletConfig {
+  name: WalletName;
+  instance: Xumm | typeof GemWallet;
+}
+
+export type XamanConfig = {
+  name: "XAMAN";
+  instance: Xumm;
+};
+
+export type GemConfig = {
+  name: "GEM";
+  instance: typeof GemWallet;
+};
+
+export type WalletInitConfig = XamanConfig | GemConfig;
+
+type XrpWallet = "Xumm" | "GemWallet";
+
+export function createXummPayload(message: string): Record<string, unknown> {
+  const memoData = Buffer.from(message).toString("hex"); // Encode message as hex for Memos
+  return {
+    custom_meta: {
+      instruction: message,
+    },
+    txjson: {
+      TransactionType: "SignIn",
+      Memos: [
+        {
+          Memo: {
+            MemoData: memoData,
+            MemoType: Buffer.from("idOS").toString("hex"), // Optional type identifier
+          },
+        },
+      ],
+    },
+  };
+}
+
+export function signXummTx(xummInstance: Xumm, payload: Record<string, unknown>): Promise<string> {
+  return new Promise((resolve) => {
+    // oxlint-disable-next-line typescript/no-explicit-any -- xumm payload type is not easy to import
+    xummInstance.payload?.createAndSubscribe(payload as unknown as any, async (event) => {
+      if (!event.payload.response.hex) return;
+      const hex = event.payload.response.hex;
+      resolve(hex);
+    });
+  });
+}
+
+export async function getXummPublicKey(wallet: Xumm): Promise<string | undefined> {
+  const payload = createXummPayload("Sign request from idOS");
+  const txHash = await signXummTx(wallet, payload);
+
+  let decode: typeof import("xrpl").decode;
+  try {
+    ({ decode } = await import("xrpl"));
+  } catch {
+    throw new Error(
+      'Missing optional peer dependency "xrpl". Install it to use Xumm public-key extraction.',
+    );
+  }
+
+  let decodedTx: { SigningPubKey?: string };
+  try {
+    decodedTx = decode(txHash);
+  } catch {
+    throw new Error("Failed to decode Xumm transaction payload.");
+  }
+
+  if (!decodedTx.SigningPubKey) {
+    throw new Error("SigningPubKey not found in decoded Xumm transaction.");
+  }
+
+  return decodedTx.SigningPubKey;
+}
+
+export function signGemWalletTx(
+  gemWalletInstance: typeof GemWallet,
+  message: string,
+): Promise<string | undefined> {
+  return gemWalletInstance.signMessage(message).then((response) => response.result?.signedMessage);
+}
+
+export async function getGemWalletPublicKey(
+  wallet: typeof GemWallet,
+): Promise<{ address: string; publicKey: string } | undefined> {
+  if ("isInstalled" in wallet) {
+    await wallet.isInstalled();
+    const { publicKey, address } = await wallet
+      .getPublicKey()
+      .then((res) => res.result as { publicKey: string; address: string });
+    return { address, publicKey };
+  }
+}
+
+export async function getXrpAddress(wallet: Xumm | typeof GemWallet): Promise<string | undefined> {
+  if ("isInstalled" in wallet) {
+    await wallet.isInstalled();
+    return wallet.getAddress().then((response) => response.result?.address);
+  }
+  return wallet.user.account;
+}
+
+// Type guard to check if the wallet is an Xumm wallet
+export function looksLikeXrpWallet(wallet: unknown): wallet is Xumm | typeof GemWallet {
+  return (
+    wallet !== null &&
+    typeof wallet === "object" &&
+    ("authorize" in wallet || "isInstalled" in wallet)
+  );
+}
+
+export async function getXrpWalletType(object: Record<string, unknown>): Promise<XrpWallet> {
+  if ("authorize" in object) {
+    return "Xumm";
+  }
+  if ("isInstalled" in object) {
+    return "GemWallet";
+  }
+  throw new Error("Unknown wallet type");
+}
+
+export async function getXrpTxHash(
+  message: string | Uint8Array,
+  wallet: Xumm | typeof GemWallet,
+): Promise<string | undefined> {
+  let messageString: string;
+
+  const xrpWalletType = await getXrpWalletType(wallet as Record<string, unknown>);
+
+  messageString = typeof message === "string" ? message : Buffer.from(message).toString("utf8"); // Decode Uint8Array to string
+  if (xrpWalletType === "Xumm") {
+    const memoData = Buffer.from(messageString).toString("hex"); // Encode message as hex for Memos
+
+    const payload = {
+      custom_meta: {
+        instruction: messageString,
+      },
+      txjson: {
+        TransactionType: "SignIn",
+        Memos: [
+          {
+            Memo: {
+              MemoData: memoData,
+              MemoType: Buffer.from("idOS").toString("hex"), // Optional type identifier
+            },
+          },
+        ],
+      },
+    };
+    const xummTx = await signXummTx(wallet as Xumm, payload);
+    console.log("xummTx", xummTx);
+  } else if (xrpWalletType === "GemWallet") {
+    const signature = await signGemWalletTx(wallet as typeof GemWallet, messageString);
+    if (!signature) {
+      throw new Error("Failed to sign transaction with GemWallet");
+    }
+    return signature;
+  }
+}
+
+export async function getXrpPublicKey(
+  wallet: Xumm | typeof GemWallet,
+): Promise<{ address: string; publicKey: string } | undefined> {
+  const xrpWalletType = await getXrpWalletType(wallet as Record<string, unknown>);
+  if (xrpWalletType === "Xumm") {
+    // @todo: should we remove xaman wallet support?
+    const publicKey = await getXummPublicKey(wallet as Xumm);
+    const address = await getXrpAddress(wallet);
+    return { address: address as string, publicKey: publicKey as string };
+  }
+  return getGemWalletPublicKey(wallet as typeof GemWallet);
+}