@onekeyfe/hd-core 1.2.8-alpha.126 → 1.2.8-alpha.128

package/src/api/zcash/ZcashSignPczt.ts

@@ -0,0 +1,152 @@
+import { bytesToHex } from '@noble/hashes/utils';
+import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+
+import { BaseMethod } from '../BaseMethod';
+import { invalidParameter, validateParams } from '../helpers/paramsValidator';
+import { stripHexPrefix } from '../helpers/hexUtils';
+import { UI_REQUEST } from '../../constants/ui-request';
+
+import type { ZcashSignPczt as HardwareZcashSignPczt } from '@onekeyfe/hd-transport';
+import type { TypedCall, TypedResponseMessage } from '../../device/DeviceCommands';
+import type { ZcashSignedPczt } from '../../types/api/zcashSignPczt';
+import type { DeviceFirmwareRange } from '../../types';
+
+const CHUNK_BYTE_SIZE = 1024;
+// Host memory sanity bound on the device-announced length, not a device limit.
+const SIGNED_PCZT_SANITY_MAX_BYTES = 16 * 1024 * 1024;
+
+export default class ZcashSignPczt extends BaseMethod<HardwareZcashSignPczt> {
+  pczt: Buffer = Buffer.alloc(0);
+
+  getSupportedProtocols() {
+    return ['V2'] as const;
+  }
+
+  init() {
+    this.checkDeviceId = true;
+    this.allowDeviceMode = [...this.allowDeviceMode, UI_REQUEST.NOT_INITIALIZE];
+    this.strictCheckDeviceSupport = true;
+
+    validateParams(this.payload, [{ name: 'pczt', type: 'hexString', required: true }]);
+
+    // Reject odd-length hex instead of left-padding it, which would shift every nibble.
+    const pcztHex = stripHexPrefix(this.payload.pczt);
+    if (pcztHex.length % 2 !== 0) {
+      throw invalidParameter('pczt hex must have an even length');
+    }
+    this.pczt = Buffer.from(pcztHex, 'hex');
+    if (this.pczt.length === 0) {
+      throw invalidParameter('pczt is empty');
+    }
+
+    this.params = {
+      pczt_length: this.pczt.length,
+      pczt_initial_chunk: bytesToHex(this.pczt.subarray(0, CHUNK_BYTE_SIZE)),
+    };
+  }
+
+  getVersionRange(): DeviceFirmwareRange {
+    return {
+      model_pro2: {
+        min: '0.0.0',
+      },
+    };
+  }
+
+  // Upload: the device decides every chunk length via ZcashPcztChunkRequest and
+  // the host must answer with exactly that many bytes.
+  uploadPczt = async (
+    typedCall: TypedCall,
+    first: TypedResponseMessage<'ZcashSignedPczt'> | TypedResponseMessage<'ZcashPcztChunkRequest'>,
+    initialOffset: number
+  ): Promise<TypedResponseMessage<'ZcashSignedPczt'>> => {
+    let res = first;
+    let offset = initialOffset;
+    while (res.type === 'ZcashPcztChunkRequest') {
+      const { chunk_length: chunkLength } = res.message;
+      if (
+        !Number.isSafeInteger(chunkLength) ||
+        chunkLength <= 0 ||
+        offset + chunkLength > this.pczt.length
+      ) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.ResponseUnexpectTypeError,
+          `device requested ${chunkLength} bytes at offset ${offset} of ${this.pczt.length}`
+        );
+      }
+
+      const chunk = this.pczt.subarray(offset, offset + chunkLength);
+      res = await typedCall('ZcashPcztChunkAck', ['ZcashSignedPczt', 'ZcashPcztChunkRequest'], {
+        data_chunk: bytesToHex(chunk),
+      });
+      offset += chunkLength;
+    }
+
+    if (offset !== this.pczt.length) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.ResponseUnexpectTypeError,
+        'device completed signing before receiving the whole pczt'
+      );
+    }
+    return res;
+  };
+
+  // Download: the host decides chunk lengths via ZcashSignedPcztChunkRequest
+  // until the announced pczt_length has been received.
+  downloadSignedPczt = async (
+    typedCall: TypedCall,
+    res: TypedResponseMessage<'ZcashSignedPczt'>
+  ): Promise<Buffer> => {
+    const { pczt_length: total, pczt_initial_chunk: initial } = res.message;
+    if (!Number.isSafeInteger(total) || total <= 0 || total > SIGNED_PCZT_SANITY_MAX_BYTES) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.ResponseUnexpectTypeError,
+        `device announced invalid signed pczt length ${total}`
+      );
+    }
+
+    const parts: Buffer[] = [Buffer.from(initial ?? '', 'hex')];
+    let received = parts[0].length;
+    if (received > total) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.ResponseUnexpectTypeError,
+        'device returned more initial pczt bytes than announced'
+      );
+    }
+
+    while (received < total) {
+      const chunkLength = Math.min(CHUNK_BYTE_SIZE, total - received);
+      const ack = await typedCall('ZcashSignedPcztChunkRequest', 'ZcashPcztChunkAck', {
+        chunk_length: chunkLength,
+      });
+      const chunk = Buffer.from(ack.message.data_chunk ?? '', 'hex');
+      if (chunk.length !== chunkLength) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.ResponseUnexpectTypeError,
+          `device returned ${chunk.length} of ${chunkLength} requested bytes at offset ${received} of ${total}`
+        );
+      }
+      parts.push(chunk);
+      received += chunk.length;
+    }
+
+    return Buffer.concat(parts);
+  };
+
+  async run(): Promise<ZcashSignedPczt> {
+    const typedCall = this.device.getCommands().typedCall.bind(this.device.getCommands());
+
+    const first = await typedCall('ZcashSignPczt', ['ZcashSignedPczt', 'ZcashPcztChunkRequest'], {
+      ...this.params,
+    });
+
+    const signed = await this.uploadPczt(
+      typedCall,
+      first,
+      Math.min(CHUNK_BYTE_SIZE, this.pczt.length)
+    );
+    const pczt = await this.downloadSignedPczt(typedCall, signed);
+
+    return { pczt: bytesToHex(pczt) };
+  }
+}

package/src/core/index.ts

@@ -61,6 +61,7 @@ import {
   formatLogMethodLabel,
   getLogBlockLabel,
   getSafeLogPayload,
+  getSafeLogTask,
 } from '../events';
 import TransportManager from '../data-manager/TransportManager';
 import DeviceConnector from '../device/DeviceConnector';
@@ -1451,7 +1452,7 @@ export const cancel = (context: CoreContext, connectId?: string) => {
       };
       for (const requestId of requestIds) {
         const task = requestQueue.getTask(requestId);
-        Log.debug('Cancel Api connect task: ', task);
+        Log.debug('Cancel Api connect task: ', getSafeLogTask(task));
         if (task) {
           // During ensureConnected the method has a connectId but device is
           // assigned only after the poll succeeds. Interrupt the cached BLE
@@ -1486,7 +1487,7 @@ export const cancel = (context: CoreContext, connectId?: string) => {
       };
       for (const requestId of requestQueue.getRequestTasksId()) {
         const task = requestQueue.getTask(requestId);
-        Log.debug('Cancel Api connect task: ', task);
+        Log.debug('Cancel Api connect task: ', getSafeLogTask(task));
         if (task) {
           interruptDevice(task.method?.device);
           if (task.method.connectId) {
@@ -1949,7 +1950,7 @@ export default class Core extends EventEmitter {
         break;
       }
       case IFRAME.CALLBACK: {
-        Log.log('callback message: ', message);
+        Log.log('callback message: ', getSafeLogPayload(message));
         postMessage(message);
         break;
       }

package/src/data/messages/messages-protocol-v2.json

@@ -11034,6 +11034,61 @@
         }
       }
     },
+    "ZcashSignPczt": {
+      "fields": {
+        "pczt_length": {
+          "rule": "required",
+          "type": "uint32",
+          "id": 1
+        },
+        "pczt_initial_chunk": {
+          "rule": "required",
+          "type": "bytes",
+          "id": 2
+        }
+      }
+    },
+    "ZcashPcztChunkRequest": {
+      "fields": {
+        "chunk_length": {
+          "rule": "required",
+          "type": "uint32",
+          "id": 1
+        }
+      }
+    },
+    "ZcashPcztChunkAck": {
+      "fields": {
+        "data_chunk": {
+          "rule": "required",
+          "type": "bytes",
+          "id": 1
+        }
+      }
+    },
+    "ZcashSignedPczt": {
+      "fields": {
+        "pczt_length": {
+          "rule": "required",
+          "type": "uint32",
+          "id": 1
+        },
+        "pczt_initial_chunk": {
+          "rule": "required",
+          "type": "bytes",
+          "id": 2
+        }
+      }
+    },
+    "ZcashSignedPcztChunkRequest": {
+      "fields": {
+        "chunk_length": {
+          "rule": "required",
+          "type": "uint32",
+          "id": 1
+        }
+      }
+    },
     "wire_in": {
       "type": "bool",
       "id": 50002,
@@ -11459,6 +11514,11 @@
         "MessageType_NeoAddress": 12302,
         "MessageType_NeoSignTx": 12303,
         "MessageType_NeoSignedTx": 12304,
+        "MessageType_ZcashSignPczt": 12402,
+        "MessageType_ZcashSignedPczt": 12403,
+        "MessageType_ZcashPcztChunkRequest": 12404,
+        "MessageType_ZcashPcztChunkAck": 12405,
+        "MessageType_ZcashSignedPcztChunkRequest": 12406,
         "MessageType_DeviceFactoryInfoSet": 60000,
         "MessageType_DeviceFactoryInfoGet": 60001,
         "MessageType_DeviceFactoryInfo": 60002,
@@ -11511,7 +11571,9 @@
         "MessageType_PortfolioUpdate": 61400,
         "MessageType_NftUpdate": 61500,
         "MessageType_OnboardingStatusGet": 61600,
-        "MessageType_OnboardingStatus": 61601
+        "MessageType_OnboardingStatus": 61601,
+        "MessageType_ZcashGetAddress": 12400,
+        "MessageType_ZcashAddress": 12401
       },
       "reserved": [
         [90, 92],
@@ -13730,6 +13792,81 @@
           }
         }
       }
+    },
+    "ZcashAddressType": {
+      "values": {
+        "UNIFIED_ORCHARD_P2PKH": 0,
+        "TRANSPARENT_P2PKH": 1,
+        "UNIFIED_ORCHARD": 2
+      }
+    },
+    "ZcashAddressScope": {
+      "values": {
+        "EXTERNAL": 0,
+        "INTERNAL": 1
+      }
+    },
+    "ZcashGetAddress": {
+      "fields": {
+        "address_n": {
+          "rule": "repeated",
+          "type": "uint32",
+          "id": 1,
+          "options": {
+            "packed": false
+          }
+        },
+        "show_display": {
+          "type": "bool",
+          "id": 2
+        },
+        "include_seed_fingerprint": {
+          "type": "bool",
+          "id": 3
+        },
+        "include_ufvk": {
+          "type": "bool",
+          "id": 4
+        },
+        "diversifier_index": {
+          "type": "uint32",
+          "id": 5,
+          "options": {
+            "default": 0
+          }
+        },
+        "address_type": {
+          "type": "ZcashAddressType",
+          "id": 6,
+          "options": {
+            "default": "UNIFIED_ORCHARD_P2PKH"
+          }
+        },
+        "scope": {
+          "type": "ZcashAddressScope",
+          "id": 7,
+          "options": {
+            "default": "EXTERNAL"
+          }
+        }
+      }
+    },
+    "ZcashAddress": {
+      "fields": {
+        "address": {
+          "rule": "required",
+          "type": "string",
+          "id": 1
+        },
+        "ufvk": {
+          "type": "string",
+          "id": 2
+        },
+        "seed_fingerprint": {
+          "type": "bytes",
+          "id": 3
+        }
+      }
     }
   }
 }

package/src/events/logBlockEvent.ts

@@ -8,8 +8,8 @@ export const LogBlockEvent: Set<string> = new Set([
   UI_RESPONSE.RECEIVE_PASSPHRASE,
 ]);
 
-// These resource/file APIs did not exist in 1.1.32. Skip the payload so
-// the log layer does not copy huge Base64 or binary data.
+// Drop sensitive wallet payloads and large resource data before logger caches
+// or log events can retain them, regardless of whether debug output is enabled.
 const LogPayloadBlockMethod: Set<string> = new Set([
   'btcDeriveContextHash',
   'deviceUploadNft',
@@ -17,6 +17,12 @@ const LogPayloadBlockMethod: Set<string> = new Set([
   'uploadPortfolio',
   'fileWrite',
   'fileRead',
+  'zcashGetAddress',
+  'zcashSignPczt',
+  'moneroGetAddress',
+  'moneroGetWatchKey',
+  'moneroKeyImageSync',
+  'moneroSignTransaction',
 ]);
 
 export function getLogBlockLabel(message: unknown): string | undefined {
@@ -40,11 +46,57 @@ export function getLogBlockLabel(message: unknown): string | undefined {
   return undefined;
 }
 
+// All-network results of these networks carry what their own address methods
+// keep out of logs (viewing keys, private addresses).
+const LogPayloadBlockNetwork: Set<string> = new Set(['zcash', 'xmr']);
+
+type AllNetworkLogItem = { network?: string; success?: boolean; payload?: object | string } | null;
+
+// A call response lists the results in `payload`; a loop callback carries one
+// result, or all of them when finished, in `payload.data`.
+type AllNetworkLogMessage = {
+  payload?: AllNetworkLogItem[] | { data?: AllNetworkLogItem | AllNetworkLogItem[] };
+};
+
+function redactAllNetworkItem(item: AllNetworkLogItem): AllNetworkLogItem {
+  if (!item || item.success === false || item.payload === undefined) return item;
+  return item.network && LogPayloadBlockNetwork.has(item.network)
+    ? { ...item, payload: '[REDACTED]' }
+    : item;
+}
+
+function redactAllNetworkItems(items: AllNetworkLogItem[]) {
+  const redacted = items.map(redactAllNetworkItem);
+  return redacted.some((item, index) => item !== items[index]) ? redacted : items;
+}
+
+// Returns `message` itself when nothing needs redacting.
+function redactAllNetworkResults(message: AllNetworkLogMessage): AllNetworkLogMessage {
+  const { payload } = message;
+  if (Array.isArray(payload)) {
+    const items = redactAllNetworkItems(payload);
+    return items === payload ? message : { ...message, payload: items };
+  }
+  const data = payload?.data;
+  if (!data) return message;
+  const redacted = Array.isArray(data) ? redactAllNetworkItems(data) : redactAllNetworkItem(data);
+  return redacted === data ? message : { ...message, payload: { ...payload, data: redacted } };
+}
+
 export function getSafeLogPayload(value: unknown, blockLabel?: string): unknown {
   if (blockLabel) {
     return { method: blockLabel, payload: '[REDACTED]' };
   }
-  return value;
+  if (!value || typeof value !== 'object') return value;
+  return redactAllNetworkResults(value as AllNetworkLogMessage);
+}
+
+// A queued task holds its method's raw payload; redact it like the call.
+export function getSafeLogTask<T extends { id?: number; method?: { payload?: unknown } }>(
+  task: T | undefined
+): T | { id?: number; method: string; payload: string } | undefined {
+  const blockLabel = getLogBlockLabel(task?.method?.payload);
+  return blockLabel ? { id: task?.id, method: blockLabel, payload: '[REDACTED]' } : task;
 }
 
 export function formatLogMethodLabel(label: string, methodName?: string): string {

package/src/events/ui-request.ts

@@ -218,6 +218,7 @@ export interface PreviousAddressResult {
   type: typeof UI_REQUEST.PREVIOUS_ADDRESS_RESULT;
   payload: {
     device: Device;
+    method: string;
     data: {
       address?: string;
       path?: string;

package/src/inject.ts

@@ -504,4 +504,17 @@ export const createCoreApi = (
     call({ ...params, connectId, deviceId, method: 'neoGetAddress' }),
   neoSignTransaction: (connectId, deviceId, params) =>
     call({ ...params, connectId, deviceId, method: 'neoSignTransaction' }),
+  zcashGetAddress: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'zcashGetAddress' }),
+  zcashSignPczt: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'zcashSignPczt' }),
+
+  moneroGetAddress: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroGetAddress' }),
+  moneroGetWatchKey: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroGetWatchKey' }),
+  moneroKeyImageSync: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroKeyImageSync' }),
+  moneroSignTransaction: (connectId, deviceId, params) =>
+    call({ ...params, connectId, deviceId, method: 'moneroSignTransaction' }),
 });

package/src/types/api/allNetworkGetAddress.ts

@@ -34,7 +34,9 @@ export type INetwork =
   | 'nostr'
   | 'benfen'
   | 'neo'
-  | 'stellar';
+  | 'stellar'
+  | 'xmr'
+  | 'zcash';
 
 export type CommonResponseParams = {
   path: string;
@@ -66,6 +68,12 @@ type AllNetworkAddressPayload =
       // Nostr public key (bech32)
       npub?: string;
     }
+  | {
+      // Zcash
+      address: string;
+      ufvk?: string;
+      seedFingerprint?: string;
+    }
   | {
       // Cardano
       addressParameters: CardanoAddressParameters;

package/src/types/api/export.ts

@@ -227,3 +227,18 @@ export type { BenfenAddress, BenfenGetAddressParams } from './benfenGetAddress';
 export type { BenfenPublicKey, BenfenGetPublicKeyParams } from './benfenGetPublicKey';
 export type { BenfenSignMessageParams } from './benfenSignMessage';
 export type { BenfenSignedTx, BenfenSignTransactionParams } from './benfenSignTransaction';
+export type { ZcashAddress, ZcashGetAddressParams } from './zcashGetAddress';
+export type { ZcashSignedPczt, ZcashSignPcztParams } from './zcashSignPczt';
+
+export type { MoneroAddress, MoneroGetAddressParams } from './moneroGetAddress';
+export type { MoneroGetWatchKeyParams, MoneroWatchKey } from './moneroGetWatchKey';
+export type {
+  MoneroEncryptedKeyImage,
+  MoneroKeyImageSyncParams,
+  MoneroKeyImageSyncResult,
+  MoneroKeyImageTransfer,
+} from './moneroKeyImageSync';
+export type {
+  MoneroSignTransactionParams,
+  MoneroSignTransactionResult,
+} from './moneroSignTransaction';

package/src/types/api/index.ts

@@ -154,6 +154,12 @@ import type { benfenSignTransaction } from './benfenSignTransaction';
 import type { benfenSignMessage } from './benfenSignMessage';
 import type { neoGetAddress } from './neoGetAddress';
 import type { neoSignTransaction } from './neoSignTransaction';
+import type { zcashGetAddress } from './zcashGetAddress';
+import type { zcashSignPczt } from './zcashSignPczt';
+import type { moneroGetAddress } from './moneroGetAddress';
+import type { moneroGetWatchKey } from './moneroGetWatchKey';
+import type { moneroKeyImageSync } from './moneroKeyImageSync';
+import type { moneroSignTransaction } from './moneroSignTransaction';
 import type { ConnectSettings } from '../settings';
 import type { HardwareConnectProtocol } from '@onekeyfe/hd-shared';
 
@@ -472,4 +478,18 @@ export type CoreApi = {
    */
   neoGetAddress: typeof neoGetAddress;
   neoSignTransaction: typeof neoSignTransaction;
+
+  /**
+   * Zcash
+   */
+  zcashGetAddress: typeof zcashGetAddress;
+  zcashSignPczt: typeof zcashSignPczt;
+
+  /**
+   * Monero
+   */
+  moneroGetAddress: typeof moneroGetAddress;
+  moneroGetWatchKey: typeof moneroGetWatchKey;
+  moneroKeyImageSync: typeof moneroKeyImageSync;
+  moneroSignTransaction: typeof moneroSignTransaction;
 };

package/src/types/api/moneroGetAddress.ts

@@ -0,0 +1,27 @@
+import type { CommonParams, Response } from '../params';
+
+export type MoneroAddress = {
+  path: string;
+  // Primary address of the account, base58
+  address: string;
+};
+
+export type MoneroGetAddressParams = {
+  // Account path, m/44'/128'/account'
+  path: string | number[];
+  showOnOneKey?: boolean;
+  // 0 mainnet, 1 testnet, 2 stagenet
+  networkType?: number;
+};
+
+export declare function moneroGetAddress(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & MoneroGetAddressParams
+): Response<MoneroAddress>;
+
+export declare function moneroGetAddress(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & { bundle?: MoneroGetAddressParams[] }
+): Response<Array<MoneroAddress>>;

package/src/types/api/moneroGetWatchKey.ts

@@ -0,0 +1,28 @@
+import type { CommonParams, Response } from '../params';
+
+export type MoneroWatchKey = {
+  path: string;
+  // Private view key, hex
+  watchKey: string;
+  // Primary address of the account, base58
+  address: string;
+};
+
+export type MoneroGetWatchKeyParams = {
+  // Account path, m/44'/128'/account'
+  path: string | number[];
+  // 0 mainnet, 1 testnet, 2 stagenet
+  networkType?: number;
+};
+
+export declare function moneroGetWatchKey(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & MoneroGetWatchKeyParams
+): Response<MoneroWatchKey>;
+
+export declare function moneroGetWatchKey(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & { bundle?: MoneroGetWatchKeyParams[] }
+): Response<Array<MoneroWatchKey>>;

package/src/types/api/moneroKeyImageSync.ts

@@ -0,0 +1,45 @@
+import type { CommonParams, Response } from '../params';
+
+// One owned output, as wallet2 describes it to the device. Keys are 32-byte hex.
+export type MoneroKeyImageTransfer = {
+  // Output public key
+  outKey: string;
+  // Transaction public key R
+  txPubKey: string;
+  // Additional tx public keys: the one for this output, or the whole list
+  additionalTxPubKeys?: string[];
+  // Index of the output within its transaction
+  internalOutputIndex: number;
+  // Receiving subaddress index; omitted means 0 (primary address)
+  subAddrMajor?: number;
+  subAddrMinor?: number;
+};
+
+// ChaCha20-Poly1305 under encKey, hex.
+export type MoneroEncryptedKeyImage = {
+  // 12-byte nonce
+  iv: string;
+  // Ciphertext of key image || signature c || signature r, then the 16-byte tag
+  blob: string;
+};
+
+export type MoneroKeyImageSyncResult = {
+  // Key that decrypts every blob, hex
+  encKey: string;
+  // One entry per transfer, in request order
+  keyImages: MoneroEncryptedKeyImage[];
+};
+
+export type MoneroKeyImageSyncParams = {
+  // Account path, m/44'/128'/account'
+  path: string | number[];
+  // 0 mainnet, 1 testnet, 2 stagenet
+  networkType?: number;
+  transfers: MoneroKeyImageTransfer[];
+};
+
+export declare function moneroKeyImageSync(
+  connectId: string,
+  deviceId: string,
+  params: CommonParams & MoneroKeyImageSyncParams
+): Response<MoneroKeyImageSyncResult>;