@ledgerhq/revault-api 1.20.0 → 1.23.1

package/lib/fakes.mjs

@@ -1,9 +1,12 @@
 import { faker } from '@faker-js/faker';
 import z5, { z } from 'zod';
-import { ChallengeType, PsdModel, AccountType, AccountGovernanceType, ActivationStatus, WhitelistType, PolicyType, UserDeviceType, AdminPermission, RequestType, RequestReviewStatus, RequestState, GateAccountType } from '@prisma/client';
+import { ChallengeType, PsdModel, AccountType, AccountGovernanceType, ActivationStatus, WhitelistType, PolicyType, UserRole, UserRegistrationState, UserDeviceType, AdminPermission, RequestType, RequestReviewStatus, RequestState, GateAccountType } from '@prisma/client';
 import 'axios';
 import invariant from 'invariant';
 import { omit, times } from 'lodash';
+import 'crypto';
+import 'fs/promises';
+import 'path';
 
 // src/__fakes__/responses.ts
 
@@ -31,8 +34,12 @@ var ensureNonEmptyArray = (values, message) => {
 function unreachable(value) {
   throw new Error(`Un-covered: ${value}`);
 }
-var zHsmObjectId = z.string().regex(/^[\w-]+$/).min(1);
+var zBigInt = z.string().regex(/^0|[1-9]\d*$/);
+var zIntString = z.string().min(1).regex(/^-?\d+$/);
 var zHexString = z.string().regex(/^[0-9a-fA-F]+$/);
+
+// src/hsm/types.ts
+var zHsmObjectId = z.string().regex(/^[\w-]+$/).min(1);
 var zPubKey = zHexString.describe("Public key");
 var zHsmCertificate = z.object({
   codeHash: z.string().base64().describe("Hash of the executable that generated this certificate"),
@@ -85,28 +92,28 @@ var zUserRegistrationDeviceData = z.object({
   name: z.string().describe("Name of the user to register"),
   psdModel: z.nativeEnum(PsdModel).describe("Device model"),
   pubKey: zPubKey.describe("Device public key"),
-  confidentialityKey: zPubKey.describe("TODO describe"),
-  psdEphemeralKey: zPubKey.describe("TODO describe"),
-  psdEphemeralKeyAttestation: zHsmCertificate.describe("TODO describe")
-}).describe("TODO describe");
+  confidentialityKey: zPubKey,
+  psdEphemeralKey: zPubKey,
+  psdEphemeralKeyAttestation: zHsmCertificate
+}).describe("Data generated by the PSD to register on HSM");
 var zUserRegistrationChallenge = z.object({
-  challenge: z.string().describe("TODO describe"),
-  ephemeralPublicKey: zPubKey.describe("TODO describe"),
-  ephemeralPublicKeyAttestation: zHsmCertificate.describe("TODO describe"),
-  handshake: zHexString.describe("TODO describe"),
-  handshakeAttestation: zHsmCertificate.describe("TODO describe"),
-  u2fRegisterData: z.string().describe("TODO describe"),
-  ciphertext: z.string().describe("TODO describe"),
-  requestId: z.string().describe("TODO describe")
-}).describe("TODO describe");
+  challenge: z.string(),
+  ephemeralPublicKey: zPubKey,
+  ephemeralPublicKeyAttestation: zHsmCertificate,
+  handshake: zHexString,
+  handshakeAttestation: zHsmCertificate,
+  u2fRegisterData: z.string(),
+  ciphertext: z.string(),
+  requestId: z.string()
+}).describe("Challenge generated by HSM\xA0using the PSD registration data");
 z.object({
-  certificate: zHsmCertificate.describe("TODO describe"),
-  u2fRegister: zHexString.describe("TODO describe"),
-  u2fKeyHandle: zHexString.describe("TODO describe"),
-  registerData: z.string().describe("TODO describe"),
-  validationKey: zPubKey.describe("TODO describe"),
-  pairingPayload: z.string().describe("TODO describe")
-}).describe("TODO describe");
+  certificate: zHsmCertificate,
+  u2fRegister: zHexString,
+  u2fKeyHandle: zHexString,
+  registerData: z.string(),
+  validationKey: zPubKey,
+  pairingPayload: z.string()
+}).describe("Final registration response from PSD to HSM");
 z.object({
   confidentialityKeyCurve25519: z.string(),
   confidentialityKeySignature: z.string()
@@ -127,8 +134,17 @@ z.object({
   }),
   blob: zBlob
 });
-var zBigInt = z.string().regex(/^0|[1-9]\d*$/);
-var zIntString = z.string().min(1).regex(/^-?\d+$/);
+var zHsmSignature = z.object({
+  digest: z.string().nullable().describe("Signed digest"),
+  derivationPath: z.string().nullable().describe("Derivation path used to sign the digest"),
+  r: z.string().base64().describe("Base64 encoded signature r coordinate"),
+  s: z.string().base64().describe("Base64 encoded signature s coordinate"),
+  v: z.union([z.literal(0), z.literal(1)]).nullable().describe("Ecdsa only, signature recovery value"),
+  der: zHexString.describe(
+    "Hex string encoded DER signature format (for eddsa, concatenation of r & s)"
+  ),
+  pubkey: zHexString.nullable().describe("Public key for signature verification, 32 or 33 bytes")
+});
 var zBitcoinLikeTransactionType = z5.enum(["BITCOIN_LIKE_SEND", "BITCOIN_LIKE_RECEIVE"]).describe("Bitcoin-like transaction type");
 var zCardanoLikeTransactionType = z5.enum([
   "CARDANO_LIKE_SEND",
@@ -521,6 +537,25 @@ var zCreateTransactionRequestData = z5.object({
   accountId: z5.string().min(1).describe("Target account id"),
   transaction: zTransactionData
 });
+var zSignMessageRequestData = z5.object({
+  accountId: z5.string().min(1).describe("Target account id"),
+  message: z5.string().nonempty().describe("Hex data to sign, either a json string for EIP712, or a raw string for EIP191"),
+  address: z5.string().nonempty().nullable().describe("Address for which to sign the message")
+});
+z5.object({
+  signature: zHsmSignature
+});
+var zDigestData = z5.object({
+  digest: zHexString.describe("The hex string digest to sign"),
+  derivationPath: z5.string().nonempty().describe("The derivation path with which to sign the digest")
+});
+var zSignDigestsRequestData = z5.object({
+  accountId: z5.string().min(1).describe("Target account id"),
+  digests: z5.array(zDigestData).describe("The digests to sign")
+});
+z5.object({
+  signatures: z5.array(zHsmSignature)
+});
 var zAccountOperationType = z.enum([
   "SEND",
   "STAKE",
@@ -1208,6 +1243,11 @@ var serializeAccount = (account) => {
   };
   return zAccountResponse.parse(response);
 };
+var zRequestReviewStep = z.object({
+  stageName: z.string().regex(/^\w+$/).describe("The review stage name"),
+  quorum: z.number().int().min(1).describe("Quorum for the review step")
+});
+var zRequestReviewSteps = z.array(zRequestReviewStep);
 var zSciConfigData = z5.object({
   dapps: z5.array(z5.string()).nullable().describe("Allowed DApps, null allows all"),
   customContractCallEnabled: z5.boolean().describe("Allow non-DApp SCI")
@@ -1219,11 +1259,6 @@ var zCreateSciConfigRequestData = z5.object({
 var zEditSciConfigRequestData = z5.object({
   config: zSciConfigData
 });
-var zRequestReviewStep = z.object({
-  stageName: z.string().regex(/^\w+$/).describe("The review stage name"),
-  quorum: z.number().int().min(1).describe("Quorum for the review step")
-});
-var zRequestReviewSteps = z.array(zRequestReviewStep);
 var zGroupName = z5.string().min(1).max(19).describe("Group name");
 var zCreateGroupRequestData = z5.object({
   name: zGroupName,
@@ -1234,6 +1269,30 @@ var zEditGroupRequestData = z5.object({
   name: zGroupName,
   members: z5.array(z5.string()).describe("List of group members ids")
 });
+var zUserName = z.string().min(1).max(19).describe("User name");
+var zUserRegistrationCreateInput = z.object({
+  name: zUserName,
+  role: z.enum([UserRole.ADMIN, UserRole.OPERATOR]).describe("User role"),
+  psdModel: z.nativeEnum(PsdModel).describe("PSD model"),
+  deviceUserId: z.string().describe("Device user ID")
+});
+zUserRegistrationCreateInput.extend({
+  id: z.string().describe("User registration ID"),
+  workspaceName: z.string().describe("Workspace name"),
+  state: z.nativeEnum(UserRegistrationState).describe("User registration state")
+});
+
+// src/users/request-data.ts
+var zCreatePsdUserRequestData = z5.object({
+  registrationId: z5.string().describe("User registration ID")
+});
+var zCreateApiUserRequestData = z5.object({
+  name: zUserName,
+  publicKey: z5.string().describe("Public key")
+}).describe("Create API user request data");
+var zCreateApiUserAccessRequestData = z5.object({
+  name: zUserName
+}).describe("Create API user request data");
 var zRegistration = z5.discriminatedUnion("subState", [
   z5.object({
     subState: z5.literal("PENDING"),
@@ -1247,9 +1306,9 @@ var zRegistration = z5.discriminatedUnion("subState", [
     u2fPubKey: zPubKey.describe("U2F public key for authenticate via PSD")
   }).describe("Completed registration")
 ]);
-var zUserName = z5.string().min(1).max(19).describe("User name");
+var zUserName2 = z5.string().min(1).max(19).describe("User name");
 var zCreateUserWithDeviceData = z5.object({
-  name: zUserName,
+  name: zUserName2,
   deviceType: z5.enum([UserDeviceType.PSD, UserDeviceType.SOFT_PSD]).describe("Device type"),
   deviceUserId: z5.string().regex(/^[A-F0-9]{16}$/).describe("Device user ID"),
   registration: zRegistration.optional().describe("Data collected from the new user during registration")
@@ -1259,13 +1318,6 @@ var zCreateAdminRequestData = zCreateUserWithDeviceData.extend({
   // Admin must use PSD
 });
 var zCreateOperatorRequestData = zCreateUserWithDeviceData;
-var zCreateApiUserRequestData = z5.object({
-  name: zUserName,
-  publicKey: z5.string().describe("Public key")
-}).describe("Create API user request data");
-var zCreateApiUserAccessRequestData = z5.object({
-  name: zUserName
-}).describe("Create API user request data");
 var zApiKeyName = z5.string().min(1).max(19).describe("API key name");
 var zCreateApiKeyRequestData = z5.object({
   name: zApiKeyName,
@@ -1294,23 +1346,13 @@ var zUpdateQuorumRequestData = z5.object({
 });
 
 // src/requests/request-data.ts
-var zUserCreationVaultRequestMixinsByType = {
-  CREATE_ADMIN: z5.object({
-    type: z5.literal(RequestType.CREATE_ADMIN),
-    data: zCreateAdminRequestData
-  }),
-  CREATE_OPERATOR: z5.object({
-    type: z5.literal(RequestType.CREATE_OPERATOR),
-    data: zCreateOperatorRequestData
-  })
-};
 var zVaultRequestMixinsByType = {
   // Workspaces
   [RequestType.UPDATE_QUORUM]: z5.object({
     type: z5.literal(RequestType.UPDATE_QUORUM),
     data: zUpdateQuorumRequestData
   }),
-  // Transactions
+  // Operator requests
   [RequestType.CREATE_TRANSACTION]: z5.object({
     type: z5.literal(RequestType.CREATE_TRANSACTION),
     data: zCreateTransactionRequestData,
@@ -1318,6 +1360,14 @@ var zVaultRequestMixinsByType = {
       hash: z5.string().nullable()
     }).optional().nullable()
   }),
+  [RequestType.SIGN_MESSAGE]: z5.object({
+    type: z5.literal(RequestType.SIGN_MESSAGE),
+    data: zSignMessageRequestData
+  }),
+  [RequestType.SIGN_DIGESTS]: z5.object({
+    type: z5.literal(RequestType.SIGN_DIGESTS),
+    data: zSignDigestsRequestData
+  }),
   // Accounts
   [RequestType.CREATE_ACCOUNT]: z5.object({
     type: z5.literal(RequestType.CREATE_ACCOUNT),
@@ -1325,6 +1375,7 @@ var zVaultRequestMixinsByType = {
   }),
   [RequestType.EDIT_ACCOUNT]: z5.object({
     type: z5.literal(RequestType.EDIT_ACCOUNT),
+    targetId: z5.string(),
     data: zEditAccountRequestData
   }),
   [RequestType.ACTIVATE_TRADELINK_ACCOUNT]: z5.object({
@@ -1344,6 +1395,7 @@ var zVaultRequestMixinsByType = {
   }),
   [RequestType.EDIT_GROUP]: z5.object({
     type: z5.literal(RequestType.EDIT_GROUP),
+    targetId: z5.string(),
     data: zEditGroupRequestData
   }),
   [RequestType.REVOKE_GROUP]: z5.object({
@@ -1357,6 +1409,7 @@ var zVaultRequestMixinsByType = {
   }),
   [RequestType.EDIT_WHITELIST]: z5.object({
     type: z5.literal(RequestType.EDIT_WHITELIST),
+    targetId: z5.string(),
     data: zEditWhitelistRequestData
   }),
   // Entities
@@ -1373,7 +1426,10 @@ var zVaultRequestMixinsByType = {
     data: z5.object({})
   }),
   // Users
-  ...zUserCreationVaultRequestMixinsByType,
+  [RequestType.CREATE_PSD_USER]: z5.object({
+    type: z5.literal(RequestType.CREATE_PSD_USER),
+    data: zCreatePsdUserRequestData
+  }),
   [RequestType.CREATE_API_USER]: z5.object({
     type: z5.literal(RequestType.CREATE_API_USER),
     data: zCreateApiUserRequestData
@@ -1424,6 +1480,7 @@ var zVaultRequestMixinsByType = {
   }),
   [RequestType.EDIT_POLICY]: z5.object({
     type: z5.literal(RequestType.EDIT_POLICY),
+    targetId: z5.string(),
     data: zEditPolicyRequestData
   }),
   // Tradelink
@@ -1460,7 +1517,10 @@ var zVaultRequestMixinsByType = {
   }),
   [RequestType.CREATE_SETTLEMENT]: z5.object({
     type: z5.literal(RequestType.CREATE_SETTLEMENT),
-    data: zCreateSettlementRequestData
+    data: zCreateSettlementRequestData,
+    meta: z5.object({
+      hash: z5.string().nullable()
+    }).optional().nullable()
   }),
   [RequestType.FORCE_UNPLEDGE]: z5.object({
     type: z5.literal(RequestType.FORCE_UNPLEDGE),
@@ -1468,7 +1528,10 @@ var zVaultRequestMixinsByType = {
   }),
   [RequestType.TRADELINK_WITHDRAW]: z5.object({
     type: z5.literal(RequestType.TRADELINK_WITHDRAW),
-    data: zTradelinkWithdrawRequestData
+    data: zTradelinkWithdrawRequestData,
+    meta: z5.object({
+      hash: z5.string().nullable()
+    }).optional().nullable()
   }),
   // Deprecate ADMIN_GOV_RULE
   [RequestType.CREATE_ADMIN_GOV_RULE]: z5.object({
@@ -1480,6 +1543,16 @@ var zVaultRequestMixinsByType = {
     data: z5.object({}).describe("Deprecated")
   })
 };
+var zVaultRequestMixinsByLegacyType = {
+  CREATE_ADMIN: z5.object({
+    type: z5.literal(RequestType.CREATE_ADMIN),
+    data: zCreateAdminRequestData
+  }),
+  CREATE_OPERATOR: z5.object({
+    type: z5.literal(RequestType.CREATE_OPERATOR),
+    data: zCreateOperatorRequestData
+  })
+};
 
 // src/requests/app-types.ts
 var zRequestReviewResponse = z5.object({
@@ -1502,14 +1575,19 @@ var zVaultRequestCommonMixin = z5.object({
   reviews: z5.array(zRequestReviewResponse).describe("Requests reviews"),
   // `type` and `data` are correlated -- See `zVaultRequestMixinsByType`
   createdAt: z5.coerce.date().describe("Creation timestamp"),
-  updatedAt: z5.coerce.date().describe("Last modification timestamp")
+  updatedAt: z5.coerce.date().describe("Last modification timestamp"),
+  // `inflight` is fetched from ONGOING RequestSaga
+  inflight: z5.object({
+    lastError: z5.string().describe("Error message from the last failure"),
+    numFailed: z5.number().int().describe("Number of failures so far"),
+    retryAfter: z5.coerce.date().describe("Date after which next retry is scheduled")
+  }).optional().describe("Extra information if the request is currently being processed")
 });
 var allowedRequestCreationInput = {
-  [RequestType.CREATE_ADMIN]: zVaultRequestMixinsByType[RequestType.CREATE_ADMIN],
+  [RequestType.CREATE_PSD_USER]: zVaultRequestMixinsByType[RequestType.CREATE_PSD_USER],
   [RequestType.CREATE_GROUP]: zVaultRequestMixinsByType[RequestType.CREATE_GROUP],
   [RequestType.CREATE_WHITELIST]: zVaultRequestMixinsByType[RequestType.CREATE_WHITELIST],
   [RequestType.EDIT_WHITELIST]: zVaultRequestMixinsByType[RequestType.EDIT_WHITELIST],
-  [RequestType.CREATE_OPERATOR]: zVaultRequestMixinsByType[RequestType.CREATE_OPERATOR],
   [RequestType.CREATE_TRANSACTION]: zVaultRequestMixinsByType[RequestType.CREATE_TRANSACTION],
   [RequestType.CREATE_POLICY]: zVaultRequestMixinsByType[RequestType.CREATE_POLICY],
   [RequestType.EDIT_POLICY]: zVaultRequestMixinsByType[RequestType.EDIT_POLICY],
@@ -1517,6 +1595,7 @@ var allowedRequestCreationInput = {
     type: z5.literal(RequestType.CREATE_ACCOUNT),
     data: zCreateAccountUserInputData
   }),
+  [RequestType.EDIT_ACCOUNT]: zVaultRequestMixinsByType[RequestType.EDIT_ACCOUNT],
   [RequestType.ACTIVATE_TRADELINK_ACCOUNT]: zVaultRequestMixinsByType[RequestType.ACTIVATE_TRADELINK_ACCOUNT],
   [RequestType.CREATE_TRADELINK_CUSTODIAN]: zVaultRequestMixinsByType[RequestType.CREATE_TRADELINK_CUSTODIAN],
   [RequestType.EDIT_TRADELINK_CUSTODIAN]: zVaultRequestMixinsByType[RequestType.EDIT_TRADELINK_CUSTODIAN],
@@ -1543,16 +1622,7 @@ z5.object({
 var zVaultRequestResponse = z5.discriminatedUnion(
   "type",
   ensureNonEmptyArray(
-    Object.values(zVaultRequestMixinsByType).map((_) => {
-      const requestType = _.shape.type._def.value;
-      return _.merge(zVaultRequestCommonMixin).describe(`${requestType} request`);
-    })
-  )
-);
-z5.discriminatedUnion(
-  "type",
-  ensureNonEmptyArray(
-    Object.values(zUserCreationVaultRequestMixinsByType).map((_) => {
+    Object.values({ ...zVaultRequestMixinsByType, ...zVaultRequestMixinsByLegacyType }).map((_) => {
       const requestType = _.shape.type._def.value;
       return _.merge(zVaultRequestCommonMixin).describe(`${requestType} request`);
     })
@@ -1590,8 +1660,15 @@ var shouldHaveTargetHsmId = (request) => {
         return void 0;
       }
       return true;
+    case RequestType.CREATE_PSD_USER:
+    case RequestType.CREATE_API_USER:
+    case RequestType.CREATE_API_USER_ACCESS:
+    // targeting / editing an existing `User`
+    case RequestType.REVOKE_USER:
     case RequestType.UPDATE_QUORUM:
     case RequestType.CREATE_TRANSACTION:
+    case RequestType.SIGN_MESSAGE:
+    case RequestType.SIGN_DIGESTS:
     case RequestType.CREATE_ACCOUNT:
     case RequestType.EDIT_ACCOUNT:
     case RequestType.ACTIVATE_TRADELINK_ACCOUNT:
@@ -1600,10 +1677,6 @@ var shouldHaveTargetHsmId = (request) => {
     case RequestType.REVOKE_GROUP:
     case RequestType.CREATE_WHITELIST:
     case RequestType.EDIT_WHITELIST:
-    case RequestType.CREATE_API_USER:
-    case RequestType.CREATE_API_USER_ACCESS:
-    // targeting / editing an existing `User`
-    case RequestType.REVOKE_USER:
     case RequestType.CREATE_POLICY:
     case RequestType.EDIT_POLICY:
     case RequestType.CREATE_TRADELINK_CUSTODIAN:
@@ -1628,15 +1701,18 @@ var shouldHaveTargetId = (request) => {
     case RequestType.REVOKE_API_KEY:
       return false;
     case RequestType.CREATE_TRANSACTION:
+    case RequestType.SIGN_MESSAGE:
+    case RequestType.SIGN_DIGESTS:
       return false;
+    case RequestType.CREATE_PSD_USER:
+    case RequestType.CREATE_ADMIN:
+    case RequestType.CREATE_OPERATOR:
+    case RequestType.CREATE_API_USER:
     case RequestType.CREATE_WORKSPACE_RULE:
     case RequestType.CREATE_ACCOUNT:
     case RequestType.CREATE_GROUP:
     case RequestType.CREATE_WHITELIST:
     case RequestType.CREATE_ENTITY:
-    case RequestType.CREATE_ADMIN:
-    case RequestType.CREATE_OPERATOR:
-    case RequestType.CREATE_API_USER:
     case RequestType.CREATE_SCICONFIG:
     case RequestType.CREATE_POLICY:
     case RequestType.CREATE_TRADELINK_CUSTODIAN:
@@ -1679,12 +1755,16 @@ function serializeVaultRequest(request) {
     ...request,
     legacyId: request.gateId
   };
-  if (request.type === "CREATE_TRANSACTION") {
-    Object.assign(serialized, {
-      meta: {
-        hash: request.transactionMeta?.hash ?? null
-      }
-    });
+  switch (request.type) {
+    case "CREATE_TRANSACTION":
+    case "TRADELINK_WITHDRAW":
+    case "CREATE_SETTLEMENT":
+      Object.assign(serialized, {
+        meta: {
+          hash: request.transactionMeta?.hash ?? null
+        }
+      });
+      break;
   }
   return zVaultRequestResponse.parse(serialized);
 }