@imtbl/sdk 0.4.0-alpha.3 → 0.4.1-alpha

package/dist/passport.js

@@ -2,13 +2,14 @@ import { ImmutableX, Config, generateLegacyStarkPrivateKey, createStarkSigner }
 import { UserManager } from 'oidc-client-ts';
 import axios$2 from 'axios';
 import jwt_decode from 'jwt-decode';
+import * as crypto from 'crypto';
 import { Magic } from 'magic-sdk';
 import { OpenIdExtension } from '@magic-ext/oidc';
+import { BigNumber, ethers } from 'ethers';
 import BN from 'bn.js';
 import * as encUtils from 'enc-utils';
 import { Web3Provider, JsonRpcProvider } from '@ethersproject/providers';
 import { EventEmitter } from 'events';
-import { ethers, BigNumber } from 'ethers';
 import { walletContracts } from '@0xsequence/abi';
 import { encodeSignature } from '@0xsequence/config';
 
@@ -4607,7 +4608,7 @@ class MultiRollupApiClients {
 }
 
 // eslint-disable-next-line @typescript-eslint/naming-convention
-const defaultHeaders = { 'x-sdk-version': 'ts-immutable-sdk-0.4.0-alpha.3' };
+const defaultHeaders = { 'x-sdk-version': 'ts-immutable-sdk-0.4.1-alpha' };
 const createConfig = ({ basePath, headers, }) => {
     if (!basePath.trim()) {
         throw Error('basePath can not be empty');
@@ -4663,7 +4664,7 @@ const createImmutableXConfiguration = ({ basePath, chainID, coreContractAddress,
     chainID,
     coreContractAddress,
     registrationContractAddress,
-    sdkVersion: 'ts-immutable-sdk-0.4.0-alpha.3',
+    sdkVersion: 'ts-immutable-sdk-0.4.1-alpha',
 });
 /**
  * Sets `sdkVersion` at the time of build
@@ -8387,8 +8388,6 @@ var globalAxios = axios;
  * https://openapi-generator.tech
  * Do not edit the class manually.
  */
-// Some imports not used depending on template conditions
-// @ts-ignore
 const BASE_PATH = "https://guardian.sandbox.imtbl.com".replace(/\/+$/, "");
 /**
  *
@@ -8416,10 +8415,10 @@ class BaseAPI {
  */
 class RequiredError extends Error {
     field;
-    name = "RequiredError";
     constructor(field, msg) {
         super(msg);
         this.field = field;
+        this.name = "RequiredError";
     }
 }
 
@@ -8464,6 +8463,8 @@ const setBearerAuthToObject = async function (object, configuration) {
     }
 };
 function setFlattenedQueryParams(urlSearchParams, parameter, key = "") {
+    if (parameter == null)
+        return;
     if (typeof parameter === "object") {
         if (Array.isArray(parameter)) {
             parameter.forEach(item => setFlattenedQueryParams(urlSearchParams, item, key));
@@ -8834,6 +8835,24 @@ class Configuration {
     }
 }
 
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Guardian
+ * Guardian API
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@immutable.com
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+const TransactionApprovalRequestChainTypeEnum = {
+    Starkex: 'starkex',
+    Evm: 'evm'
+};
+
 // used to sign message with L1 keys. Used for registration
 function serializeEthSignature(sig) {
     // This is because golang appends a recovery param
@@ -8932,10 +8951,17 @@ const withPassportError = async (fn, customErrorType) => {
 };
 
 const keyCrendentials = 'passport_credentials';
+const KEY_PKCE_STATE = 'pkce_state';
+const KEY_PKCE_VERIFIER = 'pkce_verifier';
 const validCredentialsMinTtlSec = 3600; // 1 hour
 class DeviceCredentialsManager {
     saveCredentials(tokenResponse) {
-        localStorage.setItem(keyCrendentials, JSON.stringify(tokenResponse));
+        if (this.areValid(tokenResponse)) {
+            localStorage.setItem(keyCrendentials, JSON.stringify(tokenResponse));
+        }
+        else {
+            throw Error('Invalid credentials.');
+        }
     }
     getCredentials() {
         const credentialsJson = localStorage.getItem(keyCrendentials);
@@ -8953,14 +8979,31 @@ class DeviceCredentialsManager {
         return false;
     }
     isTokenValid(jwt) {
-        const tokenPayload = jwt_decode(jwt);
-        const expiresAt = tokenPayload.exp ?? 0;
-        const now = (Date.now() / 1000) + validCredentialsMinTtlSec;
-        return expiresAt > now;
+        try {
+            const tokenPayload = jwt_decode(jwt);
+            const expiresAt = tokenPayload.exp ?? 0;
+            const now = (Date.now() / 1000) + validCredentialsMinTtlSec;
+            return expiresAt > now;
+        }
+        catch (error) {
+            return false;
+        }
     }
     clearCredentials() {
         localStorage.removeItem(keyCrendentials);
     }
+    savePKCEData(data) {
+        localStorage.setItem(KEY_PKCE_STATE, data.state);
+        localStorage.setItem(KEY_PKCE_VERIFIER, data.verifier);
+    }
+    getPKCEData() {
+        const state = localStorage.getItem(KEY_PKCE_STATE);
+        const verifier = localStorage.getItem(KEY_PKCE_VERIFIER);
+        if (state && verifier) {
+            return { state, verifier };
+        }
+        return null;
+    }
 }
 
 const formUrlEncodedHeader = {
@@ -9137,6 +9180,59 @@ class AuthManager {
         }, formUrlEncodedHeader);
         return response.data;
     }
+    static base64URLEncode(str) {
+        return str.toString('base64')
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+    }
+    static sha256(buffer) {
+        return crypto.createHash('sha256').update(buffer).digest();
+    }
+    getPKCEAuthorizationUrl() {
+        const verifier = AuthManager.base64URLEncode(crypto.randomBytes(32));
+        const challenge = AuthManager.base64URLEncode(AuthManager.sha256(verifier));
+        // https://auth0.com/docs/secure/attack-protection/state-parameters
+        const state = AuthManager.base64URLEncode(crypto.randomBytes(32));
+        this.deviceCredentialsManager.savePKCEData({ state, verifier });
+        return `${this.config.authenticationDomain}/authorize?`
+            + 'response_type=code'
+            + `&code_challenge=${challenge}`
+            + '&code_challenge_method=S256'
+            + `&client_id=${this.config.oidcConfiguration.clientId}`
+            + `&redirect_uri=${this.config.oidcConfiguration.redirectUri}`
+            + `&scope=${this.config.oidcConfiguration.scope}`
+            + `&state=${state}`
+            + `&audience=${this.config.oidcConfiguration.audience}`;
+    }
+    async connectImxPKCEFlow(authorizationCode, state) {
+        return withPassportError(async () => {
+            const pkceData = this.deviceCredentialsManager.getPKCEData();
+            if (!pkceData) {
+                throw new Error('No code verifier or state for PKCE');
+            }
+            if (state !== pkceData.state) {
+                throw new Error('Provided state does not match stored state');
+            }
+            const tokenResponse = await this.getPKCEToken(authorizationCode, pkceData.verifier);
+            const user = AuthManager.mapDeviceTokenResponseToDomainUserModel(tokenResponse);
+            // Only persist credentials that contain the necessary data
+            if (user.imx?.ethAddress && user.imx?.starkAddress && user.imx?.userAdminAddress) {
+                this.deviceCredentialsManager.saveCredentials(tokenResponse);
+            }
+            return user;
+        }, PassportErrorType.AUTHENTICATION_ERROR);
+    }
+    async getPKCEToken(authorizationCode, codeVerifier) {
+        const response = await axios$2.post(`${this.config.authenticationDomain}/oauth/token`, {
+            client_id: this.config.oidcConfiguration.clientId,
+            grant_type: 'authorization_code',
+            code_verifier: codeVerifier,
+            code: authorizationCode,
+            redirect_uri: this.config.oidcConfiguration.redirectUri,
+        }, formUrlEncodedHeader);
+        return response.data;
+    }
     async connectImxWithCredentials(tokenResponse) {
         return withPassportError(async () => {
             if (this.deviceCredentialsManager.areValid(tokenResponse)) {
@@ -9265,6 +9361,53 @@ const retryWithDelay = async (fn, options) => {
     }
 };
 
+/**
+ * ProviderErrors should take priority over RpcErrorCodes
+ */
+var ProviderErrorCode;
+(function (ProviderErrorCode) {
+    ProviderErrorCode[ProviderErrorCode["USER_REJECTED_REQUEST"] = 4001] = "USER_REJECTED_REQUEST";
+    ProviderErrorCode[ProviderErrorCode["UNAUTHORIZED"] = 4100] = "UNAUTHORIZED";
+    ProviderErrorCode[ProviderErrorCode["UNSUPPORTED_METHOD"] = 4200] = "UNSUPPORTED_METHOD";
+    ProviderErrorCode[ProviderErrorCode["DISCONNECTED"] = 4900] = "DISCONNECTED";
+})(ProviderErrorCode || (ProviderErrorCode = {}));
+var RpcErrorCode;
+(function (RpcErrorCode) {
+    RpcErrorCode[RpcErrorCode["RPC_SERVER_ERROR"] = -32000] = "RPC_SERVER_ERROR";
+    RpcErrorCode[RpcErrorCode["INVALID_REQUEST"] = -32600] = "INVALID_REQUEST";
+    RpcErrorCode[RpcErrorCode["METHOD_NOT_FOUND"] = -32601] = "METHOD_NOT_FOUND";
+    RpcErrorCode[RpcErrorCode["INVALID_PARAMS"] = -32602] = "INVALID_PARAMS";
+    RpcErrorCode[RpcErrorCode["INTERNAL_ERROR"] = -32603] = "INTERNAL_ERROR";
+    RpcErrorCode[RpcErrorCode["PARSE_ERROR"] = -32700] = "PARSE_ERROR";
+    RpcErrorCode[RpcErrorCode["USER_REJECTED_REQUEST"] = -32003] = "USER_REJECTED_REQUEST";
+})(RpcErrorCode || (RpcErrorCode = {}));
+class JsonRpcError extends Error {
+    message;
+    code;
+    constructor(code, message) {
+        super(message);
+        this.message = message;
+        this.code = code;
+    }
+}
+
+const convertBigNumberishToString = (value) => BigNumber.from(value).toString();
+const transformGuardianTransactions = (txs) => {
+    try {
+        return txs.map((t) => ({
+            delegateCall: t.delegateCall === true,
+            revertOnError: t.revertOnError === true,
+            gasLimit: t.gasLimit ? convertBigNumberishToString(t.gasLimit) : '0',
+            target: t.to ?? ethers.constants.AddressZero,
+            value: t.value ? convertBigNumberishToString(t.value) : '0',
+            data: t.data ? t.data.toString() : '0x00',
+        }));
+    }
+    catch (error) {
+        const errorMessage = (error instanceof Error) ? error.message : String(error);
+        throw new JsonRpcError(RpcErrorCode.INVALID_PARAMS, `Transaction failed to parsing: ${errorMessage}`);
+    }
+};
 class GuardianClient {
     transactionAPI;
     confirmationScreen;
@@ -9299,7 +9442,7 @@ class GuardianClient {
         });
         const { confirmationRequired } = evaluateStarkexRes.data;
         if (confirmationRequired) {
-            const confirmationResult = await this.confirmationScreen.startGuardianTransaction(payloadHash, this.imxEtherAddress);
+            const confirmationResult = await this.confirmationScreen.startGuardianTransaction(payloadHash, this.imxEtherAddress, TransactionApprovalRequestChainTypeEnum.Starkex);
             if (!confirmationResult.confirmed) {
                 throw new Error('Transaction rejected by user');
             }
@@ -9308,6 +9451,47 @@ class GuardianClient {
             this.confirmationScreen.closeWindow();
         }
     }
+    async evaluateEVMTransaction({ chainId, nonce, user, metaTransactions, }) {
+        const headers = { Authorization: `Bearer ${user.accessToken}` };
+        const guardianTransactions = transformGuardianTransactions(metaTransactions);
+        try {
+            const transactionEvaluationResponseAxiosResponse = await this.transactionAPI.evaluateTransaction({
+                id: 'evm',
+                transactionEvaluationRequest: {
+                    chainType: 'evm',
+                    chainId,
+                    transactionData: {
+                        nonce,
+                        userAddress: user.zkEvm.ethAddress,
+                        metaTransactions: guardianTransactions,
+                    },
+                },
+            }, { headers });
+            return transactionEvaluationResponseAxiosResponse.data;
+        }
+        catch (error) {
+            const errorMessage = (error instanceof Error) ? error.message : String(error);
+            throw new JsonRpcError(RpcErrorCode.INTERNAL_ERROR, `Transaction failed to validate with error: ${errorMessage}`);
+        }
+    }
+    async validateEVMTransaction({ chainId, nonce, user, metaTransactions, }) {
+        const transactionEvaluationResponse = await this.evaluateEVMTransaction({
+            chainId,
+            nonce,
+            user,
+            metaTransactions,
+        });
+        const { confirmationRequired, transactionId } = transactionEvaluationResponse;
+        if (confirmationRequired && !!transactionId) {
+            const confirmationResult = await this.confirmationScreen.startGuardianTransaction(transactionId, this.imxEtherAddress, TransactionApprovalRequestChainTypeEnum.Evm, chainId);
+            if (!confirmationResult.confirmed) {
+                throw new JsonRpcError(RpcErrorCode.USER_REJECTED_REQUEST, 'Transaction rejected by user ');
+            }
+        }
+        else {
+            this.confirmationScreen.closeWindow();
+        }
+    }
 }
 
 async function exchangeTransfer({ user, starkSigner, request, exchangesApi, }) {
@@ -9746,6 +9930,10 @@ class PassportImxProviderFactory {
         const user = await this.authManager.connectImxDeviceFlow(deviceCode, interval, timeoutMs);
         return this.createProviderInstance(user);
     }
+    async getProviderWithPKCEFlow(authorizationCode, state) {
+        const user = await this.authManager.connectImxPKCEFlow(authorizationCode, state);
+        return this.createProviderInstance(user);
+    }
     async getProviderWithCredentials(tokenResponse) {
         const user = await this.authManager.connectImxWithCredentials(tokenResponse);
         if (!user) {
@@ -10009,7 +10197,7 @@ class ConfirmationScreen {
             }, CONFIRMATION_WINDOW_CLOSED_POLLING_DURATION);
         });
     }
-    startGuardianTransaction(transactionId, imxEtherAddress) {
+    startGuardianTransaction(transactionId, imxEtherAddress, chainType, chainId) {
         return new Promise((resolve, reject) => {
             const messageHandler = ({ data, origin }) => {
                 if (origin !== this.config.passportDomain
@@ -10038,7 +10226,16 @@ class ConfirmationScreen {
                 return;
             }
             // eslint-disable-next-line max-len
-            this.confirmationWindow.location.href = `${this.config.passportDomain}/transaction-confirmation/transaction.html?transactionId=${transactionId}&imxEtherAddress=${imxEtherAddress}&chainType=starkex`;
+            let href = '';
+            if (chainType === TransactionApprovalRequestChainTypeEnum.Starkex) {
+                // eslint-disable-next-line max-len
+                href = `${this.config.passportDomain}/transaction-confirmation/transaction.html?transactionId=${transactionId}&imxEtherAddress=${imxEtherAddress}&chainType=starkex`;
+            }
+            else {
+                // eslint-disable-next-line max-len
+                href = `${this.config.passportDomain}/transaction-confirmation/zkevm?transactionId=${transactionId}&imxEtherAddress=${imxEtherAddress}&chainType=evm&chainId=${chainId}`;
+            }
+            this.confirmationWindow.location.href = href;
             // https://stackoverflow.com/questions/9388380/capture-the-close-event-of-popup-window-in-javascript/48240128#48240128
             const timer = setInterval(() => {
                 if (this.confirmationWindow?.closed) {
@@ -10146,35 +10343,6 @@ class RelayerClient {
     }
 }
 
-/**
- * ProviderErrors should take priority over RpcErrorCodes
- */
-var ProviderErrorCode;
-(function (ProviderErrorCode) {
-    ProviderErrorCode[ProviderErrorCode["USER_REJECTED_REQUEST"] = 4001] = "USER_REJECTED_REQUEST";
-    ProviderErrorCode[ProviderErrorCode["UNAUTHORIZED"] = 4100] = "UNAUTHORIZED";
-    ProviderErrorCode[ProviderErrorCode["UNSUPPORTED_METHOD"] = 4200] = "UNSUPPORTED_METHOD";
-    ProviderErrorCode[ProviderErrorCode["DISCONNECTED"] = 4900] = "DISCONNECTED";
-})(ProviderErrorCode || (ProviderErrorCode = {}));
-var RpcErrorCode;
-(function (RpcErrorCode) {
-    RpcErrorCode[RpcErrorCode["RPC_SERVER_ERROR"] = -32000] = "RPC_SERVER_ERROR";
-    RpcErrorCode[RpcErrorCode["INVALID_REQUEST"] = -32600] = "INVALID_REQUEST";
-    RpcErrorCode[RpcErrorCode["METHOD_NOT_FOUND"] = -32601] = "METHOD_NOT_FOUND";
-    RpcErrorCode[RpcErrorCode["INVALID_PARAMS"] = -32602] = "INVALID_PARAMS";
-    RpcErrorCode[RpcErrorCode["INTERNAL_ERROR"] = -32603] = "INTERNAL_ERROR";
-    RpcErrorCode[RpcErrorCode["PARSE_ERROR"] = -32700] = "PARSE_ERROR";
-})(RpcErrorCode || (RpcErrorCode = {}));
-class JsonRpcError extends Error {
-    message;
-    code;
-    constructor(code, message) {
-        super(message);
-        this.message = message;
-        this.code = code;
-    }
-}
-
 const MESSAGE_TO_SIGN = 'Only sign this message from Immutable Passport';
 async function registerZkEvmUser({ authManager, magicProvider, multiRollupApiClients, accessToken, }) {
     const web3Provider = new Web3Provider(magicProvider);
@@ -10302,46 +10470,9 @@ const chainIdNumber = (chainId) => {
 
 const MAX_TRANSACTION_HASH_RETRIEVAL_RETRIES = 30;
 const TRANSACTION_HASH_RETRIEVAL_WAIT = 1000;
-const converBigNumberishToNumber = (value) => BigNumber.from(value).toNumber();
-const transformGardianTransactions = (txs) => {
-    try {
-        return txs.map((t) => ({
-            delegateCall: t.delegateCall === true,
-            revertOnError: t.revertOnError === true,
-            gasLimit: t.gasLimit ? converBigNumberishToNumber(t.gasLimit).toString() : '0',
-            target: t.to ?? ethers.constants.AddressZero,
-            value: t.value ? converBigNumberishToNumber(t.value).toString() : '0',
-            data: t.data ? t.data.toString() : '0x00',
-        }));
-    }
-    catch (error) {
-        const errorMessage = (error instanceof Error) ? error.message : String(error);
-        throw new JsonRpcError(RpcErrorCode.INVALID_PARAMS, `Transaction failed to parsing: ${errorMessage}`);
-    }
-};
-const guardianValidation = async ({ transactionAPI, chainId, nonce, user, metaTransactions, }) => {
-    const headers = { Authorization: `Bearer ${user.accessToken}` };
-    const guardianTransactions = transformGardianTransactions(metaTransactions);
-    try {
-        await transactionAPI.evaluateTransaction({
-            id: 'evm',
-            transactionEvaluationRequest: {
-                chainType: 'evm',
-                chainId,
-                transactionData: {
-                    nonce,
-                    userAddress: user.zkEvm.ethAddress,
-                    metaTransactions: guardianTransactions,
-                },
-            },
-        }, { headers });
-    }
-    catch (error) {
-        const errorMessage = (error instanceof Error) ? error.message : String(error);
-        throw new JsonRpcError(RpcErrorCode.INTERNAL_ERROR, `Transaction failed to validate with error: ${errorMessage}`);
-    }
-};
-const sendTransaction = async ({ params, magicProvider, jsonRpcProvider, relayerClient, transactionAPI, config, user, }) => {
+const sendTransaction = async ({ params, magicProvider, jsonRpcProvider, relayerClient, guardianClient, config, user, }) => {
+    const popupWindowSize = { width: 480, height: 580 };
+    guardianClient.loading(popupWindowSize);
     const transactionRequest = params[0];
     if (!transactionRequest.to) {
         throw new JsonRpcError(RpcErrorCode.INVALID_PARAMS, 'eth_sendTransaction requires a "to" field');
@@ -10379,10 +10510,9 @@ const sendTransaction = async ({ params, magicProvider, jsonRpcProvider, relayer
         value: imxFeeOption.tokenPrice,
         revertOnError: true,
     };
-    await guardianValidation({
-        transactionAPI,
+    await guardianClient.validateEVMTransaction({
         chainId: config.zkEvmChainId,
-        nonce: converBigNumberishToNumber(nonce),
+        nonce: convertBigNumberishToString(nonce),
         user,
         metaTransactions: [metaTransaction, feeMetaTransaction],
     });
@@ -10462,10 +10592,16 @@ class ZkEvmProvider {
                 if (!this.isLoggedIn()) {
                     throw new JsonRpcError(ProviderErrorCode.UNAUTHORIZED, 'Unauthorised - call eth_requestAccounts first');
                 }
+                const guardianClient = new GuardianClient({
+                    imxPublicApiDomain: this.config.imxPublicApiDomain,
+                    accessToken: this.user.accessToken,
+                    confirmationScreen: this.confirmationScreen,
+                    imxEtherAddress: this.user?.imx?.ethAddress || '',
+                });
                 return sendTransaction({
                     params: request.params || [],
                     magicProvider: this.magicProvider,
-                    transactionAPI: this.transactionAPI,
+                    guardianClient,
                     jsonRpcProvider: this.jsonRpcProvider,
                     config: this.config,
                     relayerClient: this.relayerClient,
@@ -10631,6 +10767,12 @@ class Passport {
     async connectImxDeviceFlow(deviceCode, interval, timeoutMs) {
         return this.passportImxProviderFactory.getProviderWithDeviceFlow(deviceCode, interval, timeoutMs);
     }
+    getPKCEAuthorizationUrl() {
+        return this.authManager.getPKCEAuthorizationUrl();
+    }
+    async connectImxPKCEFlow(authorizationCode, state) {
+        return this.passportImxProviderFactory.getProviderWithPKCEFlow(authorizationCode, state);
+    }
     /**
      * @returns {boolean} the stored device flow credentials if they exist
      */

package/dist/provider.d.ts

@@ -686,7 +686,7 @@ interface GetSignableCancelOrderRequest {
  */
 interface GetSignableTradeRequest {
     /**
-     * ExpirationTimestamp in Unix time. Note: will be rounded down to the nearest hour
+     * ExpirationTimestamp in Unix time in hours. Note: will be rounded down to the nearest hour
      * @type {number}
      * @memberof GetSignableTradeRequest
      */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@imtbl/sdk",
   "description": "Immutable Unified SDK",
-  "version": "0.4.0-alpha.3",
+  "version": "0.4.1-alpha",
   "author": "Immutable",
   "browser": "./dist/index.browser.js",
   "bugs": "https://github.com/immutable/ts-immutable-sdk/issues",
@@ -11,7 +11,7 @@
     "@ethersproject/abstract-signer": "^5.7.0",
     "@ethersproject/providers": "^5.7.2",
     "@ethersproject/wallet": "^5.7.0",
-    "@imtbl/core-sdk": "^2.0.1",
+    "@imtbl/core-sdk": "^2.0.2",
     "@jest/globals": "^29.5.0",
     "@magic-ext/oidc": "^1.0.1",
     "@metamask/detect-provider": "^2.0.0",