@idos-network/kwil-infra 3.0.0 → 4.0.0

package/src/actions/actions.ts

@@ -12,6 +12,11 @@ export const WALLET_TYPES = ["EVM", "NEAR", "XRPL", "Stellar", "FaceSign", "MM"]
 export type WalletType = (typeof WALLET_TYPES)[number];
 
 export const walletTypeSchema: z.ZodType<WalletType> = z.enum(WALLET_TYPES);
+export const ADD_WALLET_TYPES = ["EVM", "NEAR", "XRPL", "Stellar", "FaceSign"] as const;
+
+export type AddWalletType = (typeof ADD_WALLET_TYPES)[number];
+
+export const addWalletTypeSchema: z.ZodType<AddWalletType> = z.enum(ADD_WALLET_TYPES);
 export const ENCRYPTION_PASSWORD_STORES = ["user", "mpc", "mm"] as const;
 
 export type EncryptionPasswordStore = (typeof ENCRYPTION_PASSWORD_STORES)[number];
@@ -165,6 +170,20 @@ export const actionSchema: Record<string, ActionSchemaElement[]> = {
       type: DataType.Uuid,
     },
   ],
+  credential_broader_message: [
+    {
+      name: "public_notes_signature",
+      type: DataType.Text,
+    },
+    {
+      name: "content_uri",
+      type: DataType.Text,
+    },
+    {
+      name: "recipient_wallet",
+      type: DataType.Text,
+    },
+  ],
   create_preliminary_credential: [
     {
       name: "request_id",
@@ -736,7 +755,7 @@ export type GetUserAsInserterOutput = z.infer<typeof GetUserAsInserterOutputSche
 export async function getUserAsInserter(
   kwilClient: KwilActionClient,
   params: GetUserAsInserterInput,
-): Promise<GetUserAsInserterOutput> {
+): Promise<GetUserAsInserterOutput | undefined> {
   const inputs = GetUserAsInserterInputSchema.parse(params);
   return await kwilClient
     .call<GetUserAsInserterOutput[]>({
@@ -792,13 +811,13 @@ export async function upsertWalletAsInserter(
 
 export const AddWalletMessageInputSchema: z.ZodObject<{
   address: z.ZodString;
-  wallet_type: z.ZodType<WalletType>;
+  wallet_type: z.ZodType<AddWalletType>;
   user_id: z.ZodUUID;
   not_before: z.ZodISODateTime;
   not_after: z.ZodISODateTime;
 }> = z.object({
   address: z.string(),
-  wallet_type: walletTypeSchema,
+  wallet_type: addWalletTypeSchema,
   user_id: z.uuid(),
   not_before: rfc3339DateTimeSchema,
   not_after: rfc3339DateTimeSchema,
@@ -834,7 +853,7 @@ export const AddWalletInputSchema: z.ZodObject<{
   id: z.ZodUUID;
   address: z.ZodString;
   public_key: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  wallet_type: z.ZodType<WalletType>;
+  wallet_type: z.ZodType<AddWalletType>;
   not_before: z.ZodISODateTime;
   not_after: z.ZodISODateTime;
   signature: z.ZodString;
@@ -842,7 +861,7 @@ export const AddWalletInputSchema: z.ZodObject<{
   id: z.uuid(),
   address: z.string(),
   public_key: z.string().nullish(),
-  wallet_type: walletTypeSchema,
+  wallet_type: addWalletTypeSchema,
   not_before: rfc3339DateTimeSchema,
   not_after: rfc3339DateTimeSchema,
   signature: z.string(),
@@ -868,7 +887,7 @@ export const GetWalletsOutputSchema: z.ZodObject<{
   address: z.ZodString;
   public_key: z.ZodNullable<z.ZodString>;
   wallet_type: z.ZodType<WalletType>;
-  message: z.ZodString;
+  message: z.ZodNullable<z.ZodString>;
   signature: z.ZodString;
   inserter: z.ZodNullable<z.ZodString>;
 }> = z.object({
@@ -877,7 +896,7 @@ export const GetWalletsOutputSchema: z.ZodObject<{
   address: z.string(),
   public_key: z.string().nullable(),
   wallet_type: walletTypeSchema,
-  message: z.string(),
+  message: z.string().nullable(),
   signature: z.string(),
   inserter: z.string().nullable(),
 });
@@ -911,6 +930,43 @@ export async function removeWallet(
   });
 }
 
+export const CredentialBroaderMessageInputSchema: z.ZodObject<{
+  public_notes_signature: z.ZodString;
+  content_uri: z.ZodString;
+  recipient_wallet: z.ZodString;
+}> = z.object({
+  public_notes_signature: z.string(),
+  content_uri: blobContentUriSchema,
+  recipient_wallet: z.string(),
+});
+
+export type CredentialBroaderMessageInput = z.infer<typeof CredentialBroaderMessageInputSchema>;
+
+export const CredentialBroaderMessageOutputSchema: z.ZodObject<{
+  message: z.ZodString;
+}> = z.object({
+  message: z.string(),
+});
+
+export type CredentialBroaderMessageOutput = z.infer<typeof CredentialBroaderMessageOutputSchema>;
+
+/**  CREDENTIAL ACTIONS */
+export async function credentialBroaderMessage(
+  kwilClient: KwilActionClient,
+  params: CredentialBroaderMessageInput,
+): Promise<CredentialBroaderMessageOutput> {
+  const inputs = CredentialBroaderMessageInputSchema.parse(params);
+  return await kwilClient
+    .call<CredentialBroaderMessageOutput[]>({
+      name: "credential_broader_message",
+      inputs,
+    })
+    .then((result) => {
+      if (!result[0]) throw new Error("credential_broader_message returned no rows");
+      return result[0];
+    });
+}
+
 export const CreatePreliminaryCredentialInputSchema: z.ZodObject<{
   request_id: z.ZodUUID;
   credential_id: z.ZodUUID;
@@ -939,7 +995,6 @@ export type CreatePreliminaryCredentialInput = z.infer<
   typeof CreatePreliminaryCredentialInputSchema
 >;
 
-/**  CREDENTIAL ACTIONS */
 export async function createPreliminaryCredential(
   kwilClient: KwilActionClient,
   params: CreatePreliminaryCredentialInput,
@@ -1260,7 +1315,7 @@ export type CredentialExistAsInserterOutput = z.infer<typeof CredentialExistAsIn
 export async function credentialExistAsInserter(
   kwilClient: KwilActionClient,
   params: CredentialExistAsInserterInput,
-): Promise<CredentialExistAsInserterOutput> {
+): Promise<CredentialExistAsInserterOutput | undefined> {
   const inputs = CredentialExistAsInserterInputSchema.parse(params);
   return await kwilClient
     .call<CredentialExistAsInserterOutput[]>({
@@ -1380,7 +1435,7 @@ export type GetSiblingCredentialIdOutput = z.infer<typeof GetSiblingCredentialId
 export async function getSiblingCredentialId(
   kwilClient: KwilActionClient,
   params: GetSiblingCredentialIdInput,
-): Promise<GetSiblingCredentialIdOutput> {
+): Promise<GetSiblingCredentialIdOutput | undefined> {
   const inputs = GetSiblingCredentialIdInputSchema.parse(params);
   return await kwilClient
     .call<GetSiblingCredentialIdOutput[]>({
@@ -1573,7 +1628,7 @@ export type DwgMessageOutput = z.infer<typeof DwgMessageOutputSchema>;
 export async function dwgMessage(
   kwilClient: KwilActionClient,
   params: DwgMessageInput,
-): Promise<DwgMessageOutput> {
+): Promise<DwgMessageOutput | undefined> {
   const inputs = DwgMessageInputSchema.parse(params);
   return await kwilClient
     .call<DwgMessageOutput[]>({
@@ -1708,7 +1763,7 @@ export type GetAccessGrantsGrantedCountOutput = z.infer<
 export async function getAccessGrantsGrantedCount(
   kwilClient: KwilActionClient,
   params: GetAccessGrantsGrantedCountInput,
-): Promise<GetAccessGrantsGrantedCountOutput> {
+): Promise<GetAccessGrantsGrantedCountOutput | undefined> {
   const inputs = GetAccessGrantsGrantedCountInputSchema.parse(params);
   return await kwilClient
     .call<GetAccessGrantsGrantedCountOutput[]>({
@@ -1737,7 +1792,7 @@ export type HasLockedAccessGrantsOutput = z.infer<typeof HasLockedAccessGrantsOu
 export async function hasLockedAccessGrants(
   kwilClient: KwilActionClient,
   params: HasLockedAccessGrantsInput,
-): Promise<HasLockedAccessGrantsOutput> {
+): Promise<HasLockedAccessGrantsOutput | undefined> {
   const inputs = HasLockedAccessGrantsInputSchema.parse(params);
   return await kwilClient
     .call<HasLockedAccessGrantsOutput[]>({
@@ -1815,7 +1870,7 @@ export type HasProfileOutput = z.infer<typeof HasProfileOutputSchema>;
 export async function hasProfile(
   kwilClient: KwilActionClient,
   params: HasProfileInput,
-): Promise<HasProfileOutput> {
+): Promise<HasProfileOutput | undefined> {
   const inputs = HasProfileInputSchema.parse(params);
   return await kwilClient
     .call<HasProfileOutput[]>(
@@ -1867,7 +1922,7 @@ export type CheckCallerPayerOutput = z.infer<typeof CheckCallerPayerOutputSchema
 export async function checkCallerPayer(
   kwilClient: KwilActionClient,
   params: CheckCallerPayerInput,
-): Promise<CheckCallerPayerOutput> {
+): Promise<CheckCallerPayerOutput | undefined> {
   const inputs = CheckCallerPayerInputSchema.parse(params);
   return await kwilClient
     .call<CheckCallerPayerOutput[]>({
@@ -1918,7 +1973,7 @@ export type CheckBalanceOutput = z.infer<typeof CheckBalanceOutputSchema>;
 export async function checkBalance(
   kwilClient: KwilActionClient,
   params: CheckBalanceInput,
-): Promise<CheckBalanceOutput> {
+): Promise<CheckBalanceOutput | undefined> {
   const inputs = CheckBalanceInputSchema.parse(params);
   return await kwilClient
     .call<CheckBalanceOutput[]>({
@@ -1949,7 +2004,7 @@ export type GetWalletWithBalanceOutput = z.infer<typeof GetWalletWithBalanceOutp
 export async function getWalletWithBalance(
   kwilClient: KwilActionClient,
   params: GetWalletWithBalanceInput,
-): Promise<GetWalletWithBalanceOutput> {
+): Promise<GetWalletWithBalanceOutput | undefined> {
   const inputs = GetWalletWithBalanceInputSchema.parse(params);
   return await kwilClient
     .call<GetWalletWithBalanceOutput[]>({
@@ -1989,7 +2044,9 @@ export const GetAllowanceOutputSchema: z.ZodObject<{
 export type GetAllowanceOutput = z.infer<typeof GetAllowanceOutputSchema>;
 
 /**  FaceSign should not be able to call this */
-export async function getAllowance(kwilClient: KwilActionClient): Promise<GetAllowanceOutput> {
+export async function getAllowance(
+  kwilClient: KwilActionClient,
+): Promise<GetAllowanceOutput | undefined> {
   return await kwilClient
     .call<GetAllowanceOutput[]>({
       name: "get_allowance",
@@ -2045,7 +2102,7 @@ export type GetIssuerFeeOutput = z.infer<typeof GetIssuerFeeOutputSchema>;
 export async function getIssuerFee(
   kwilClient: KwilActionClient,
   params: GetIssuerFeeInput,
-): Promise<GetIssuerFeeOutput> {
+): Promise<GetIssuerFeeOutput | undefined> {
   const inputs = GetIssuerFeeInputSchema.parse(params);
   return await kwilClient
     .call<GetIssuerFeeOutput[]>({

package/src/facesign/facesign-signer.test.ts

@@ -2,7 +2,7 @@
 
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { FaceSignSignerProvider } from "./facesign-signer";
+import { FaceSignSignerProvider, resetStoredFaceSignKey } from "./facesign-signer";
 
 const ENCLAVE_ORIGIN = "https://facesign.example";
 
@@ -21,6 +21,63 @@ function iframeWindow(): Window {
   return iframe.contentWindow;
 }
 
+describe("resetStoredFaceSignKey", () => {
+  afterEach(() => {
+    vi.useRealTimers();
+    document.body.replaceChildren();
+  });
+
+  async function readyProvider(hasKey: boolean) {
+    const signer = provider();
+    const posted: unknown[] = [];
+    const pending = resetStoredFaceSignKey(signer);
+
+    await vi.waitFor(() => {
+      expect(document.querySelector("iframe")).not.toBeNull();
+    });
+
+    vi.spyOn(iframeWindow(), "postMessage").mockImplementation((message) => {
+      posted.push(message);
+    });
+
+    window.dispatchEvent(
+      new MessageEvent("message", {
+        origin: ENCLAVE_ORIGIN,
+        data: { type: "facesign_ready", hasKey },
+      }),
+    );
+
+    return { signer, posted, pending };
+  }
+
+  it("deletes a stored key and tears the provider down", async () => {
+    const { posted, pending } = await readyProvider(true);
+
+    await vi.waitFor(() => {
+      expect(posted).toContainEqual({ type: "reset", data: { id: 1 } });
+    });
+
+    window.dispatchEvent(
+      new MessageEvent("message", {
+        origin: ENCLAVE_ORIGIN,
+        data: { type: "reset_complete", data: { id: 1, ok: true } },
+      }),
+    );
+
+    await expect(pending).resolves.toBe(true);
+    expect(document.querySelector("iframe")).toBeNull();
+  });
+
+  it("leaves a provider with no stored key ready to scan", async () => {
+    const { signer, posted, pending } = await readyProvider(false);
+
+    await expect(pending).resolves.toBe(false);
+    expect(posted).toEqual([]);
+    expect(document.querySelector("iframe")).not.toBeNull();
+    signer.destroy();
+  });
+});
+
 describe("FaceSignSignerProvider.reset", () => {
   afterEach(() => {
     vi.useRealTimers();

package/src/facesign/facesign-signer.ts

@@ -18,6 +18,14 @@ interface SessionResponse {
   address: string;
 }
 
+// Browser-stored key is not the active idOS profile. Delete it before add-wallet can sign. reset() destroys this provider.
+export async function resetStoredFaceSignKey(provider: FaceSignSignerProvider): Promise<boolean> {
+  const { hasKey } = await provider.preload();
+  if (!hasKey) return false;
+  await provider.reset();
+  return true;
+}
+
 export class FaceSignSignerProvider {
   #iframe: HTMLIFrameElement | null = null;
   #container: HTMLDialogElement | null = null;

package/src/facesign/index.ts

@@ -1,2 +1,2 @@
 export type { FaceSignMetadata, FaceSignSignerProviderOptions } from "./facesign-signer";
-export { FaceSignSignerProvider } from "./facesign-signer";
+export { FaceSignSignerProvider, resetStoredFaceSignKey } from "./facesign-signer";

package/src/mm-token/create-mm-token-kwil-signer.test.ts

@@ -4,7 +4,6 @@ import { describe, expect, it } from "vitest";
 import {
   createMmTokenAuth,
   isMmTokenAuth,
-  mmTokenCredentialContentUri,
   mmTokenStorageId,
   type MmTokenEnvelope,
 } from "./create-mm-token-kwil-signer.js";
@@ -116,21 +115,6 @@ describe("createMmTokenAuth", () => {
     expect(mmTokenStorageId(signer)).toBe("storage-abc");
   });
 
-  it("builds the credential ukyc:// URI from a base64url-encoded token", () => {
-    const credentialId = "0198c21d-79cb-7000-8000-000000000001";
-    const encodedToken = encodeEnvelope(createEnvelope());
-    const signer = createMmTokenAuth(encodedToken);
-    const credential = {
-      id: credentialId,
-      content_uri: mmTokenCredentialContentUri(signer, credentialId),
-    };
-
-    expect(credential).toEqual({
-      id: credentialId,
-      content_uri: `ukyc://storage-abc/blobs/${credentialId}`,
-    });
-  });
-
   it("fails when the token payload has no storage_id", () => {
     const signer = createMmTokenAuth(
       encodeEnvelope(

package/src/mm-token/create-mm-token-kwil-signer.ts

@@ -1,5 +1,4 @@
 import { KwilSigner } from "@idos-network/kwil-js";
-import { createUkycContentUri } from "@idos-network/utils/blob-gateway";
 import {
   base64UrlDecode,
   base64UrlEncode,
@@ -58,10 +57,6 @@ export function mmTokenStorageId(signer: KwilSigner): string {
   return storageId.trim();
 }
 
-export function mmTokenCredentialContentUri(signer: KwilSigner, credentialId: string): string {
-  return createUkycContentUri(mmTokenStorageId(signer), credentialId);
-}
-
 function isMmTokenEnvelope(value: unknown): value is MmTokenEnvelope {
   return (
     value !== null &&

package/src/near/create-near-wallet-kwil-signer.test.ts

@@ -0,0 +1,218 @@
+import type { Wallet as NearWallet } from "@near-wallet-selector/core";
+
+import {
+  base64Encode,
+  borshSerialize,
+  bs58Encode,
+  bytesConcat,
+  sha256Hash,
+} from "@idos-network/utils/codecs";
+import { MemoryStore } from "@idos-network/utils/store";
+import nacl from "tweetnacl";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import type { KwilActionClient } from "../create-kwil-client";
+
+import { createNearWalletKwilSigner } from "./create-near-wallet-kwil-signer";
+
+const fullAccess = vi.hoisted(() => ({
+  keys: [] as string[],
+  limitedKeys: [] as string[],
+  queries: 0,
+  lastRequest: undefined as { request_type?: string; account_id?: string } | undefined,
+}));
+
+vi.mock("near-api-js", () => ({
+  connect: async () => ({
+    connection: {
+      provider: {
+        query: async (request: { request_type?: string; account_id?: string }) => {
+          fullAccess.queries += 1;
+          fullAccess.lastRequest = request;
+          return {
+            keys: [
+              ...fullAccess.keys.map((public_key) => ({
+                public_key,
+                access_key: { permission: "FullAccess" },
+              })),
+              ...fullAccess.limitedKeys.map((public_key) => ({
+                public_key,
+                access_key: {
+                  permission: {
+                    FunctionCall: {
+                      allowance: "0",
+                      receiver_id: "example.near",
+                      method_names: [],
+                    },
+                  },
+                },
+              })),
+            ],
+          };
+        },
+      },
+    },
+  }),
+}));
+
+const ACCOUNT = "victim.testnet";
+const RECIPIENT = "idos.network";
+const CALLBACK = "https://app.example/callback";
+const MESSAGE = "idOS authentication";
+const NEP413_TAG = 2147484061;
+
+const nep413PayloadSchema = {
+  struct: {
+    message: "string",
+    nonce: { array: { type: "u8", len: 32 } },
+    recipient: "string",
+    callbackUrl: { option: "string" },
+  },
+} as const;
+
+const keyPair = nacl.sign.keyPair.fromSeed(new Uint8Array(32).fill(4));
+const fragmentKey = `ed25519:${bs58Encode(keyPair.publicKey)}`;
+const realKey = `ed25519:${bs58Encode(new Uint8Array(32).fill(1))}`;
+
+const kwilClient = {
+  client: { auth: { logoutKGW: async () => {} } },
+} as unknown as KwilActionClient;
+
+function signNep413(nonce: Uint8Array, message = MESSAGE): string {
+  const hash = sha256Hash(
+    bytesConcat(
+      borshSerialize("u32", NEP413_TAG),
+      borshSerialize(nep413PayloadSchema, {
+        message,
+        nonce,
+        recipient: RECIPIENT,
+        callbackUrl: CALLBACK,
+      }),
+    ),
+  );
+  return base64Encode(nacl.sign.detached(hash, keyPair.secretKey));
+}
+
+function signedRequest(): { nonce: Uint8Array; signature: string } {
+  for (let i = 0; i < 64; i++) {
+    const nonce = new Uint8Array(32).fill(i);
+    const signature = signNep413(nonce);
+    if (signature.includes("+")) return { nonce, signature };
+  }
+  throw new Error("expected a base64 signature containing '+'");
+}
+
+async function signerPublicKey(fragment: {
+  accountId: string;
+  signature: string;
+  publicKey: string;
+  nonce: Uint8Array;
+  message?: string;
+}): Promise<string> {
+  // Literal "+", not percent-encoded, so URLSearchParams would turn it into a space.
+  window.location.hash = `accountId=${fragment.accountId}&signature=${fragment.signature}&publicKey=${fragment.publicKey}`;
+  const store = new MemoryStore();
+  await store.set("signer-address", ACCOUNT);
+  await store.set("signer-public-key", realKey);
+  await store.set("sign-last-message", fragment.message ?? MESSAGE);
+  await store.set("sign-last-nonce", Array.from(fragment.nonce));
+  await store.set("sign-last-url", CALLBACK);
+  const wallet = { id: "my-near-wallet", signMessage: vi.fn() } as unknown as NearWallet;
+
+  const { publicKey } = await createNearWalletKwilSigner(wallet, ACCOUNT, store, kwilClient);
+  return publicKey;
+}
+
+describe("createNearWalletKwilSigner my-near-wallet redirect", () => {
+  afterEach(() => {
+    window.location.hash = "";
+    fullAccess.keys = [];
+    fullAccess.limitedKeys = [];
+    fullAccess.queries = 0;
+    fullAccess.lastRequest = undefined;
+  });
+
+  it("accepts a fragment whose signature matches the saved request and a full-access key", async () => {
+    const { nonce, signature } = signedRequest();
+    fullAccess.keys = [realKey, fragmentKey];
+
+    expect(
+      await signerPublicKey({ accountId: ACCOUNT, signature, publicKey: fragmentKey, nonce }),
+    ).toBe(fragmentKey);
+    expect(window.location.hash).toBe("");
+    expect(fullAccess.queries).toBe(1);
+    expect(fullAccess.lastRequest).toMatchObject({
+      request_type: "view_access_key_list",
+      account_id: ACCOUNT,
+    });
+  });
+
+  it("ignores a signature that does not match the saved request", async () => {
+    const { nonce, signature } = signedRequest();
+    fullAccess.keys = [realKey, fragmentKey];
+
+    expect(
+      await signerPublicKey({
+        accountId: ACCOUNT,
+        signature,
+        publicKey: fragmentKey,
+        nonce,
+        message: "different message",
+      }),
+    ).toBe(realKey);
+    expect(fullAccess.queries).toBe(0);
+  });
+
+  it("ignores a fragment for a different account", async () => {
+    const { nonce, signature } = signedRequest();
+    fullAccess.keys = [realKey, fragmentKey];
+
+    expect(
+      await signerPublicKey({
+        accountId: "attacker.testnet",
+        signature,
+        publicKey: fragmentKey,
+        nonce,
+      }),
+    ).toBe(realKey);
+    expect(fullAccess.queries).toBe(0);
+  });
+
+  it("ignores a public key that is not a full-access key of the account", async () => {
+    const { nonce, signature } = signedRequest();
+    fullAccess.keys = [realKey];
+    fullAccess.limitedKeys = [fragmentKey];
+
+    expect(
+      await signerPublicKey({ accountId: ACCOUNT, signature, publicKey: fragmentKey, nonce }),
+    ).toBe(realKey);
+    expect(fullAccess.queries).toBe(1);
+    expect(fullAccess.lastRequest).toMatchObject({
+      request_type: "view_access_key_list",
+      account_id: ACCOUNT,
+    });
+  });
+
+  it("does not replay an untrusted fragment signature", async () => {
+    const { nonce } = signedRequest();
+    window.location.hash = `accountId=${ACCOUNT}&signature=sig&publicKey=${fragmentKey}`;
+    const store = new MemoryStore();
+    await store.set("signer-address", ACCOUNT);
+    await store.set("signer-public-key", realKey);
+    await store.set("sign-last-message", MESSAGE);
+    await store.set("sign-last-nonce", Array.from(nonce));
+    await store.set("sign-last-url", CALLBACK);
+    const original = vi.fn();
+    const wallet = { id: "my-near-wallet", signMessage: original } as unknown as NearWallet;
+
+    await createNearWalletKwilSigner(wallet, ACCOUNT, store, kwilClient);
+    void wallet.signMessage?.({
+      message: MESSAGE,
+      recipient: RECIPIENT,
+      nonce: Buffer.alloc(32),
+    });
+
+    await vi.waitFor(() => expect(original).toHaveBeenCalledOnce());
+    expect(original.mock.calls[0]?.[0].message).toBe(MESSAGE);
+  });
+});