@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js

@@ -2,34 +2,43 @@ import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/dom
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
+import { routerAbEd25519YaoTenantRootWireV1 } from "../../domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js";
 import { createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
 //#region src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.ts
 /** Source-preserving ordinary material paths implemented by the Cloudflare workers. */
 const CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1 = "/router-ab/router/ed25519-yao/execute-source-preserving";
+/** Marks an execution the Router may already have run as its replay. */
+const ROUTER_AB_YAO_REPLAY_HEADER_V1 = "x-seams-yao-replay";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/reserve-inactive-source-preserving";
 const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ed25519-yao/activate-reservation";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/activate-reservation";
 const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ed25519-yao/deactivate-reservation";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/deactivate-reservation";
+function signingWorkerWalletScopeWireV1(tenant, walletId) {
+	return {
+		org_id: tenant.orgId,
+		project_id: tenant.projectId,
+		project_environment_id: tenant.envId,
+		wallet_id: walletId
+	};
+}
 function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input) {
 	return { executeEd25519SourcePreservingV1: async (request) => {
-		const tenantRoot = await input.resolveTenantRoot(request);
+		const tenantRootWire = await routerAbEd25519YaoTenantRootWireV1(await input.resolveTenantRoot(request));
 		return await postRouterJsonRequestV1(input, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, {
 			source_binding: request.sourceBinding,
 			target: {
-				tenant_root: {
-					identity_digest_b64u: tenantRoot.identityDigestB64u,
-					custody_lineage_b64u: tenantRoot.custodyLineageB64u
-				},
+				tenant_root: tenantRootWire,
 				application: request.applicationBinding,
 				participant_ids: request.participantIds,
 				target: {
+					operation: "registration",
 					binding: request.targetRequest.binding,
 					deriver_a_input: request.targetRequest.deriver_a_input,
 					deriver_b_input: request.targetRequest.deriver_b_input
 				}
 			}
-		}, "Ed25519 source-preserving Router execution");
+		}, "Ed25519 source-preserving Router execution", "replay");
 	} };
 }
 function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(input) {
@@ -38,18 +47,19 @@ function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(inp
 			return ed25519ReservationFromSourceContributionV1(request);
 		},
 		reserveInactiveEcdsaSignerMaterialV1: async (request) => {
-			return parseEcdsaReservationResponseV1(request, await postReservationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, ecdsaReservationRequestToWireV1(request), "ecdsa_secp256k1"));
+			return parseEcdsaReservationResponseV1(request, await postReservationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, ecdsaReservationRequestToWireV1(request, input.tenant), "ecdsa_secp256k1"));
 		}
 	};
 }
 function createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1(input) {
 	return {
-		activateInactiveEd25519SignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, ed25519ActivationRequestToWireV1(request), "ed25519"),
-		activateInactiveEcdsaSignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, ecdsaActivationRequestToWireV1(request), "ecdsa_secp256k1")
+		activateInactiveEd25519SignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, ed25519ActivationRequestToWireV1(request, input.tenant), "ed25519"),
+		activateInactiveEcdsaSignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, ecdsaActivationRequestToWireV1(request, input.tenant), "ecdsa_secp256k1")
 	};
 }
-function ecdsaReservationRequestToWireV1(request) {
+function ecdsaReservationRequestToWireV1(request, tenant) {
 	return {
+		scope: signingWorkerWalletScopeWireV1(tenant, String(request.plannedActivationRef.materialOwner)),
 		source_derivation: {
 			application_binding_digest_b64u: request.preparation.sourceDerivation.applicationBindingDigestB64u,
 			client_share_retry_counter: request.preparation.sourceDerivation.clientShareRetryCounter
@@ -75,15 +85,18 @@ function ed25519ReservationFromSourceContributionV1(request) {
 		serverMaterialReservationId: sourceContribution.reservationId
 	};
 }
-function ed25519ActivationRequestToWireV1(input) {
+function ed25519ActivationRequestToWireV1(input, tenant) {
 	return {
+		scope: signingWorkerWalletScopeWireV1(tenant, input.sourceContribution.targetBinding.lifecycle.account_id),
 		binding: input.sourceContribution.targetBinding,
 		reservation_id: input.reservationId
 	};
 }
-function ecdsaActivationRequestToWireV1(input) {
+function ecdsaActivationRequestToWireV1(input, tenant) {
+	const materialActivation = input.preparation.sourceContribution.binding.target.activation;
 	return {
-		material_activation: routerAbMpcMaterialActivationRefToWire(input.preparation.sourceContribution.binding.target.activation),
+		scope: signingWorkerWalletScopeWireV1(tenant, String(materialActivation.materialOwner)),
+		material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation),
 		reservation_id: input.reservationId
 	};
 }
@@ -216,16 +229,27 @@ async function postSigningWorkerJsonRequestV1(input, path, body, operation) {
 		throw new Error(`${operation} returned invalid JSON`);
 	}
 }
-async function postRouterJsonRequestV1(input, path, body, operation) {
-	const response = await input.fetch(new Request(`https://mpc-router.router-ab.internal${path}`, {
+async function postRouterJsonRequestV1(input, path, body, operation, retryAfterTransportFailure = "none") {
+	const send = async (replay) => await input.fetch(new Request(`https://mpc-router.router-ab.internal${path}`, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
-			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
+			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret,
+			...replay ? { [ROUTER_AB_YAO_REPLAY_HEADER_V1]: "1" } : {}
 		},
 		body: JSON.stringify(body)
 	}));
-	if (!response.ok) throw new Error(`${operation} failed with HTTP ${response.status}`);
+	let response;
+	try {
+		response = await send(false);
+	} catch (error) {
+		if (retryAfterTransportFailure === "none") throw error;
+		response = await send(true);
+	}
+	if (!response.ok) {
+		const reason = (await response.text().catch(() => "")).slice(0, 300);
+		throw new Error(`${operation} failed with HTTP ${response.status}: ${reason}`);
+	}
 	try {
 		return await response.json();
 	} catch {
@@ -234,18 +258,21 @@ async function postRouterJsonRequestV1(input, path, body, operation) {
 }
 function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input) {
 	return {
-		deactivateInactiveEd25519SignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ed25519"),
-		deactivateInactiveEcdsaSignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ecdsa_secp256k1")
+		deactivateInactiveEd25519SignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ed25519", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner))),
+		deactivateInactiveEcdsaSignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ecdsa_secp256k1", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner)))
 	};
 }
-async function postDeactivationRequestV1(input, path, materialActivation, keyFamily) {
+async function postDeactivationRequestV1(input, path, materialActivation, keyFamily, scope) {
 	const response = await input.fetch(new Request(`https://signing-worker.router-ab.internal${path}`, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
 			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
 		},
-		body: JSON.stringify({ material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation) })
+		body: JSON.stringify({
+			scope,
+			material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation)
+		})
 	}));
 	if (!response.ok) throw new Error(`ordinary ${keyFamily} material deactivation failed with HTTP ${response.status}`);
 	let raw;