@openzeppelin/miden-multisig-client 0.16.1 → 0.17.0-rc.1

package/src/account/storage.ts

@@ -2,21 +2,7 @@ import type { MultisigConfig } from '../types.js';
 import { StorageSlot, StorageMap, Word } from '@miden-sdk/miden-sdk';
 import { ensureHexPrefix } from '../utils/encoding.js';
 import { getProcedureRoot } from '../procedures.js';
-
-// Storage slot names matching the MASM definitions
-const MULTISIG_SLOT_NAMES = {
-  THRESHOLD_CONFIG: 'openzeppelin::multisig::threshold_config',
-  SIGNER_PUBLIC_KEYS: 'openzeppelin::multisig::signer_public_keys',
-  SIGNER_SCHEME_IDS: 'openzeppelin::multisig::signer_scheme_ids',
-  EXECUTED_TRANSACTIONS: 'openzeppelin::multisig::executed_transactions',
-  PROCEDURE_THRESHOLDS: 'openzeppelin::multisig::procedure_thresholds',
-} as const;
-
-const GUARDIAN_SLOT_NAMES = {
-  SELECTOR: 'openzeppelin::guardian::selector',
-  PUBLIC_KEY: 'openzeppelin::guardian::public_key',
-  SCHEME_ID: 'openzeppelin::guardian::scheme_id',
-} as const;
+import { MULTISIG_SLOT_NAMES, GUARDIAN_SLOT_NAMES } from './layout.js';
 
 function signerMapKey(index: bigint): Word {
   return new Word(new BigUint64Array([index, 0n, 0n, 0n]));
@@ -70,24 +56,25 @@ export class StorageLayoutBuilder {
     return [slot0, slot1, slot2, slot3, slot4];
   }
 
+  /**
+   * The guarded-multisig has no enable/disable selector; the guardian is always present, so this
+   * returns just two slots: the guardian public-key map and its scheme map.
+   */
   buildGuardianSlots(config: MultisigConfig): StorageSlot[] {
-    const selector = config.guardianEnabled !== false ? 1n : 0n;
     const schemeId = config.signatureScheme === 'ecdsa' ? 1n : 2n;
-    const selectorWord = new Word(new BigUint64Array([selector, 0n, 0n, 0n]));
-    const slot0 = StorageSlot.fromValue(GUARDIAN_SLOT_NAMES.SELECTOR, selectorWord);
+    const zeroKey = signerMapKey(0n);
 
     const guardianKeyMap = new StorageMap();
-    const zeroKey = signerMapKey(0n);
     const guardianKey = Word.fromHex(ensureHexPrefix(config.guardianCommitment));
     guardianKeyMap.insert(zeroKey, guardianKey);
-    const slot1 = StorageSlot.map(GUARDIAN_SLOT_NAMES.PUBLIC_KEY, guardianKeyMap);
+    const slot0 = StorageSlot.map(GUARDIAN_SLOT_NAMES.PUBLIC_KEY, guardianKeyMap);
 
     const guardianSchemeMap = new StorageMap();
     const guardianScheme = new Word(new BigUint64Array([schemeId, 0n, 0n, 0n]));
     guardianSchemeMap.insert(zeroKey, guardianScheme);
-    const slot2 = StorageSlot.map(GUARDIAN_SLOT_NAMES.SCHEME_ID, guardianSchemeMap);
+    const slot1 = StorageSlot.map(GUARDIAN_SLOT_NAMES.SCHEME_ID, guardianSchemeMap);
 
-    return [slot0, slot1, slot2];
+    return [slot0, slot1];
   }
 }
 

package/src/client.test.ts

@@ -19,22 +19,27 @@ vi.mock('@miden-sdk/miden-sdk', () => ({
       vault: vi.fn(),
     })),
   },
+  Word: vi.fn(),
 }));
 
-// Mock the AccountInspector
-vi.mock('./inspector.js', () => ({
-  AccountInspector: {
-    fromAccount: vi.fn(() => ({
-      threshold: 2,
-      numSigners: 2,
-      signerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
-      guardianEnabled: true,
-      guardianCommitment: '0x' + 'c'.repeat(64),
-      vaultBalances: [],
-      procedureThresholds: new Map(),
-    })),
-  },
-}));
+// Mock the AccountInspector, keeping the real assertCompleteDetectedConfig
+// so load()'s fail-closed validation is exercised.
+vi.mock('./inspector.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('./inspector.js')>();
+  return {
+    ...actual,
+    AccountInspector: {
+      fromAccount: vi.fn(() => ({
+        threshold: 2,
+        numSigners: 2,
+        signerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
+        guardianCommitment: '0x' + 'c'.repeat(64),
+        vaultBalances: [],
+        procedureThresholds: new Map(),
+      })),
+    },
+  };
+});
 
 // Mock the account creation module
 vi.mock('./account/index.js', () => ({
@@ -232,6 +237,66 @@ describe('MultisigClient', () => {
       expect(webClient.accounts.insert).toHaveBeenCalledTimes(1);
     });
 
+    it('fails closed when the detected signer set is incomplete (issue #306 review)', async () => {
+      const client = new MultisigClient(webClient, CLIENT_CONFIG);
+
+      const { AccountInspector } = await import('./inspector.js');
+      // Storage reports 3 signers but only 2 entries were readable — adopting
+      // this config would let membership proposals drop the missing key.
+      vi.mocked(AccountInspector.fromAccount).mockReturnValueOnce({
+        threshold: 2,
+        numSigners: 3,
+        signerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
+        guardianCommitment: '0x' + 'c'.repeat(64),
+        vaultBalances: [],
+        procedureThresholds: new Map(),
+      });
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          account_id: '0x' + 'd'.repeat(30),
+          commitment: '0x' + 'e'.repeat(64),
+          state_json: { data: 'base64state' },
+          created_at: '2024-01-01T00:00:00Z',
+          updated_at: '2024-01-02T00:00:00Z',
+        }),
+      });
+
+      await expect(client.load('0x' + 'd'.repeat(30), mockSigner)).rejects.toThrow(
+        /incomplete signer set: storage reports 3 signers, read 2/,
+      );
+    });
+
+    it('fails closed when the guardian commitment is missing', async () => {
+      const client = new MultisigClient(webClient, CLIENT_CONFIG);
+
+      const { AccountInspector } = await import('./inspector.js');
+      vi.mocked(AccountInspector.fromAccount).mockReturnValueOnce({
+        threshold: 1,
+        numSigners: 1,
+        signerCommitments: ['0x' + 'a'.repeat(64)],
+        guardianCommitment: null,
+        vaultBalances: [],
+        procedureThresholds: new Map(),
+      });
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          account_id: '0x' + 'd'.repeat(30),
+          commitment: '0x' + 'e'.repeat(64),
+          state_json: { data: 'base64state' },
+          created_at: '2024-01-01T00:00:00Z',
+          updated_at: '2024-01-02T00:00:00Z',
+        }),
+      });
+
+      await expect(client.load('0x' + 'd'.repeat(30), mockSigner)).rejects.toThrow(
+        /missing guardian commitment/,
+      );
+    });
+
     it('should throw if account not found on GUARDIAN', async () => {
       const client = new MultisigClient(webClient, CLIENT_CONFIG);
 
@@ -239,12 +304,18 @@ describe('MultisigClient', () => {
         ok: false,
         status: 404,
         statusText: 'Not Found',
-        text: async () => 'Account not found',
+        headers: new Headers(),
+        text: async () =>
+          JSON.stringify({
+            code: 'account_not_found',
+            message: 'Account not found',
+            meta: { retryable: false },
+          }),
       });
 
       await expect(
         client.load('0xnonexistent', mockSigner)
-      ).rejects.toThrow();
+      ).rejects.toThrow('Account not found');
     });
 
     it('should allow registerOnGuardian after load without explicit initial state', async () => {

package/src/client.ts

@@ -10,7 +10,7 @@ import { GuardianHttpClient } from '@openzeppelin/guardian-client';
 import type { StateObject } from '@openzeppelin/guardian-client';
 import { Multisig } from './multisig.js';
 import { createMultisigAccount } from './account/index.js';
-import { AccountInspector } from './inspector.js';
+import { AccountInspector, assertCompleteDetectedConfig } from './inspector.js';
 import { getRawMidenClient, requireConfigValue, requireMidenRpcEndpoint } from './raw-client.js';
 import type { MultisigConfig, Signer } from './types.js';
 import {
@@ -18,6 +18,11 @@ import {
   type ProverConfig,
   type ResolvedProverConfig,
 } from './prover/config.js';
+import {
+  resolveRpcConfig,
+  type RpcConfig,
+  type ResolvedRpcConfig,
+} from './rpc/config.js';
 
 interface AccountKeyBindingSigner {
   bindAccountKey?(midenClient: MidenClient, accountId: string): Promise<void>;
@@ -48,6 +53,8 @@ export interface MultisigClientConfig {
   midenRpcEndpoint: string;
   /** Multisig-owned remote prover override and proof retry policy. */
   prover?: ProverConfig;
+  /** Retry policy for idempotent Miden node reads; submission is never retried. */
+  rpc?: RpcConfig;
 }
 
 /**
@@ -95,12 +102,14 @@ export class MultisigClient {
   private readonly midenClient: MidenClient;
   private readonly midenRpcEndpoint: string;
   private readonly proverConfig: ResolvedProverConfig;
+  private readonly rpcConfig: ResolvedRpcConfig;
   private _guardianClient: GuardianHttpClient;
 
   constructor(midenClient: MidenClient, config: MultisigClientConfig) {
     this.midenClient = midenClient;
     this.midenRpcEndpoint = requireMidenRpcEndpoint(config?.midenRpcEndpoint);
     this.proverConfig = resolveProverConfig(config?.prover, midenClient.defaultProver);
+    this.rpcConfig = resolveRpcConfig(config?.rpc);
     this._guardianClient = new GuardianHttpClient(
       requireConfigValue('guardianEndpoint', config?.guardianEndpoint),
     );
@@ -176,6 +185,7 @@ export class MultisigClient {
       undefined,
       this.midenRpcEndpoint,
       this.proverConfig,
+      this.rpcConfig,
     );
   }
 
@@ -204,11 +214,13 @@ export class MultisigClient {
     const account = Account.deserialize(accountBytes);
 
     const detected = AccountInspector.fromAccount(account);
+    // Fail closed on a partial read: the detected signer set becomes the
+    // authoritative config that membership proposals rewrite on-chain.
+    assertCompleteDetectedConfig(detected);
     const config: MultisigConfig = {
       threshold: detected.threshold,
       signerCommitments: detected.signerCommitments,
-      guardianCommitment: detected.guardianCommitment ?? '',
-      guardianEnabled: detected.guardianEnabled,
+      guardianCommitment: detected.guardianCommitment,
       procedureThresholds: Array.from(detected.procedureThresholds.entries()).map(
         ([procedure, threshold]) => ({ procedure, threshold })
       ),
@@ -229,6 +241,7 @@ export class MultisigClient {
       accountId,
       this.midenRpcEndpoint,
       this.proverConfig,
+      this.rpcConfig,
     );
   }
 }

package/src/index.ts

@@ -50,11 +50,22 @@ export {
   type RecoveredAccount,
 } from './client.js';
 export type { ProverConfig, ProverRetryPolicy } from './prover/config.js';
+export type { RpcConfig, RpcRetryPolicy } from './rpc/config.js';
 export { lookupAuthDigest } from './lookupAuth.js';
-export { Multisig, type AccountState } from './multisig.js';
+export {
+  Multisig,
+  type AccountState,
+  type CreateProposalOptions,
+  type CreateSignerProposalOptions,
+  type CreateP2idProposalOptions,
+} from './multisig.js';
 export { AccountInspector, type DetectedMultisigConfig, type VaultBalance } from './inspector.js';
 export {
+  chainAnchorFromBase64,
+  chainAnchorToBase64,
   executeForSummary,
+  executeForSummaryAt,
+  summarySalt,
   buildUpdateSignersTransactionRequest,
   buildUpdateProcedureThresholdTransactionRequest,
   buildUpdateGuardianTransactionRequest,
@@ -63,6 +74,7 @@ export {
   parseP2idNoteType,
   p2idNoteTypeToMetadata,
   type P2idTransactionOptions,
+  type P2ideHeightOptions,
 } from './transaction.js';
 
 export { GuardianHttpClient, GuardianHttpError } from '@openzeppelin/guardian-client';
@@ -75,6 +87,18 @@ export {
   normalizeGuardianErrorCode,
 } from '@openzeppelin/guardian-client';
 export type { GuardianErrorCode } from '@openzeppelin/guardian-client';
+export type {
+  HistoryDecodeSection,
+  HistoryDecodeWarning,
+  HistoryEntry,
+  HistoryEntryStatus,
+  HistoryNote,
+  HistoryNoteAsset,
+  HistoryNoteTag,
+  HistoryNoteVisibility,
+  HistoryOptions,
+  HistoryPage,
+} from '@openzeppelin/guardian-client';
 
 // Codeless transport-failure classification (feature 009, User Story 3).
 export { isLikelyNetworkError, toUserFacingError } from './connectivity.js';
@@ -108,6 +132,8 @@ export {
   isConsumeNotesV2,
   isP2idNoteVisibility,
   type P2idNoteVisibility,
+  MAX_P2IDE_BLOCK_HEIGHT,
+  parseP2ideHeight,
 } from './types/proposal.js';
 
 export {