@solana-mobile/dapp-store-cli 0.1.1-0

package/src/commands/create/app.ts

@@ -0,0 +1,88 @@
+import type { App } from "@solana-mobile/dapp-store-publishing-tools";
+import { createApp } from "@solana-mobile/dapp-store-publishing-tools";
+import {
+  Connection,
+  Keypair,
+  PublicKey,
+  sendAndConfirmTransaction,
+} from "@solana/web3.js";
+
+import {
+  getConfigFile,
+  getMetaplexInstance,
+  saveToConfig,
+} from "../../utils.js";
+
+const createAppNft = async (
+  {
+    appDetails,
+    connection,
+    publisherMintAddress,
+    publisher,
+  }: {
+    appDetails: App;
+    connection: Connection;
+    publisherMintAddress: string;
+    publisher: Keypair;
+  },
+  { dryRun }: { dryRun?: boolean }
+) => {
+  const mintAddress = Keypair.generate();
+  const metaplex = getMetaplexInstance(connection, publisher);
+  const txBuilder = await createApp(
+    {
+      publisherMintAddress: new PublicKey(publisherMintAddress),
+      mintAddress,
+      appDetails,
+    },
+    { metaplex, publisher }
+  );
+
+  const blockhash = await connection.getLatestBlockhash();
+  const tx = txBuilder.toTransaction(blockhash);
+  tx.sign(mintAddress, publisher);
+
+  if (!dryRun) {
+    const txSig = await sendAndConfirmTransaction(connection, tx, [
+      publisher,
+      mintAddress,
+    ]);
+    console.info({ txSig, mintAddress: mintAddress.publicKey.toBase58() });
+  }
+
+  return { appAddress: mintAddress.publicKey.toBase58() };
+};
+
+type CreateAppCommandInput = {
+  publisherMintAddress: string;
+  signer: Keypair;
+  url: string;
+  dryRun?: boolean;
+};
+
+export const createAppCommand = async ({
+  signer,
+  url,
+  dryRun,
+  publisherMintAddress,
+}: CreateAppCommandInput) => {
+  const connection = new Connection(url);
+
+  const { app: appDetails, publisher: publisherDetails } =
+    await getConfigFile();
+
+  const { appAddress } = await createAppNft(
+    {
+      connection,
+      publisher: signer,
+      publisherMintAddress: publisherDetails.address ?? publisherMintAddress,
+      appDetails,
+    },
+    { dryRun }
+  );
+
+  // TODO(sdlaver): dry-run should not modify config
+  saveToConfig({ app: { address: appAddress } });
+
+  return { appAddress };
+};

package/src/commands/create/index.ts

@@ -0,0 +1,48 @@
+export * from "./publisher.js";
+export * from "./app.js";
+export * from "./release.js";
+
+/*
+ * Module responsible for creating publishers, apps, and releases (in that order)
+ * Anything that is out-of-order will be prompted back into order
+ * And steps that happen more than once will do their best to remember as much information as possible.
+ * We will ask questions and do our best to answer anything that's already been configured, and prompt for anything that's not
+ */
+
+// We'll never ask for private keys or seed phrases
+// You can use a burner signer to publish; all NFTs require verification from the publisher signer
+// You can use a multisig or Ledger for that purpose
+
+// Publisher
+// Public key attached to a publisher must also verify applications and releases
+// Most information here can be be edited after the fact
+// Only required fields are name, address, publisher website, and contact
+// Optional fields are: description, image_url (need dimensions!)
+
+// App
+// Publisher creator key required
+// Most information can be edited after the fact
+// Required: name, description, `android_package`
+// Optional: Any additional creator keys
+// TODO(jon): Probably okay to capture more information here like:
+// - `license_url`
+// - `copyright_url`
+// - `privacy_policy_url`
+// Release
+// Publisher creator key required
+// Immutable; information cannot be edited after publishing.
+// Change based on the review process must result in a new release
+// Required:
+// - version (automatically prompt with semver + 1)
+// - release notes (description)
+// - publisher creator key
+// - path to the APK
+// Optional:
+// - Media related to the release
+// - New permissions (prompted)
+// - New languages (prompted)
+// Handles uploads of all files, sha'ing them
+// Handles i18n (later)
+
+// We'll attempt to read as much as possible from a provided `.yml` file
+// If there are provided folders that are well-structured, we'll opt to use that too.

package/src/commands/create/publisher.ts

@@ -0,0 +1,78 @@
+import type { Publisher } from "@solana-mobile/dapp-store-publishing-tools";
+import { createPublisher } from "@solana-mobile/dapp-store-publishing-tools";
+import {
+  Connection,
+  Keypair,
+  sendAndConfirmTransaction,
+} from "@solana/web3.js";
+
+import {
+  getConfigFile,
+  getMetaplexInstance,
+  saveToConfig,
+} from "../../utils.js";
+
+const createPublisherNft = async (
+  {
+    connection,
+    publisher,
+    publisherDetails,
+  }: {
+    connection: Connection;
+    publisher: Keypair;
+    publisherDetails: Publisher;
+  },
+  { dryRun }: { dryRun: boolean }
+) => {
+  const mintAddress = Keypair.generate();
+  const metaplex = getMetaplexInstance(connection, publisher);
+  console.info(
+    `Creating publisher at address: ${mintAddress.publicKey.toBase58()}`
+  );
+  const txBuilder = await createPublisher(
+    { mintAddress, publisherDetails },
+    { metaplex, publisher }
+  );
+
+  const blockhash = await connection.getLatestBlockhash();
+  const tx = txBuilder.toTransaction(blockhash);
+  tx.sign(mintAddress, publisher);
+
+  if (!dryRun) {
+    const txSig = await sendAndConfirmTransaction(connection, tx, [
+      publisher,
+      mintAddress,
+    ]);
+    console.info({ txSig, mintAddress: mintAddress.publicKey.toBase58() });
+  }
+
+  return { publisherAddress: mintAddress.publicKey.toBase58() };
+};
+
+export const createPublisherCommand = async ({
+  signer,
+  url,
+  dryRun,
+}: {
+  signer: Keypair;
+  url: string;
+  dryRun: boolean;
+}) => {
+  const connection = new Connection(url);
+
+  const { publisher: publisherDetails } = await getConfigFile();
+
+  const { publisherAddress } = await createPublisherNft(
+    {
+      connection,
+      publisher: signer,
+      publisherDetails,
+    },
+    { dryRun }
+  );
+
+  // TODO(sdlaver): dry-run should not modify config
+  saveToConfig({ publisher: { address: publisherAddress } });
+
+  return { publisherAddress };
+};

package/src/commands/create/release.ts

@@ -0,0 +1,107 @@
+import type {
+  App,
+  Publisher,
+  Release,
+} from "@solana-mobile/dapp-store-publishing-tools";
+import { createRelease } from "@solana-mobile/dapp-store-publishing-tools";
+import {
+  Connection,
+  Keypair,
+  PublicKey,
+  sendAndConfirmTransaction,
+} from "@solana/web3.js";
+import { CachedStorageDriver } from "../../upload/CachedStorageDriver.js";
+
+import {
+  getConfigFile,
+  getMetaplexInstance,
+  saveToConfig,
+} from "../../utils.js";
+
+type CreateReleaseCommandInput = {
+  appMintAddress: string;
+  version: string;
+  buildToolsPath: string;
+  signer: Keypair;
+  url: string;
+  dryRun?: boolean;
+};
+
+const createReleaseNft = async ({
+  appMintAddress,
+  releaseDetails,
+  appDetails,
+  publisherDetails,
+  connection,
+  publisher,
+}: {
+  appMintAddress: string;
+  releaseDetails: Release;
+  appDetails: App;
+  publisherDetails: Publisher;
+  connection: Connection;
+  publisher: Keypair;
+}) => {
+  const releaseMintAddress = Keypair.generate();
+
+  const metaplex = getMetaplexInstance(connection, publisher);
+
+  const { txBuilder } = await createRelease(
+    {
+      appMintAddress: new PublicKey(appMintAddress),
+      releaseMintAddress,
+      releaseDetails,
+      appDetails,
+      publisherDetails,
+    },
+    { metaplex, publisher }
+  );
+
+  const blockhash = await connection.getLatestBlockhash();
+  const tx = txBuilder.toTransaction(blockhash);
+  tx.sign(releaseMintAddress, publisher);
+
+  const txSig = await sendAndConfirmTransaction(connection, tx, [
+    publisher,
+    releaseMintAddress,
+  ]);
+  console.info({
+    txSig,
+    releaseMintAddress: releaseMintAddress.publicKey.toBase58(),
+  });
+
+  return { releaseAddress: releaseMintAddress.publicKey.toBase58() };
+};
+
+export const createReleaseCommand = async ({
+  appMintAddress,
+  version,
+  buildToolsPath,
+  signer,
+  url,
+  dryRun = false,
+}: CreateReleaseCommandInput) => {
+  const connection = new Connection(url);
+
+  const { release, app, publisher } = await getConfigFile(buildToolsPath);
+
+  if (!dryRun) {
+    const { releaseAddress } = await createReleaseNft({
+      appMintAddress: app.address ?? appMintAddress,
+      connection,
+      publisher: signer,
+      releaseDetails: {
+        ...release,
+        version,
+      },
+      appDetails: app,
+      publisherDetails: publisher,
+    });
+
+    saveToConfig({
+      release: { address: releaseAddress, version },
+    });
+
+    return { releaseAddress };
+  }
+};

package/src/commands/index.ts

@@ -0,0 +1,3 @@
+export * from "./create/index.js";
+export * from "./publish/index.js";
+export * from "./validate.js";

package/src/commands/publish/index.ts

@@ -0,0 +1,29 @@
+export * from "./remove.js";
+export * from "./submit.js";
+export * from "./support.js";
+export * from "./update.js";
+
+/*
+ * Module responsible for submitting requests to the Solana dApp Store publisher portal
+ * Anything that is out-of-order will be prompted back into order
+ * And steps that happen more than once will do their best to remember as much information as possible.
+ * We will ask questions and do our best to answer anything that's already been configured, and prompt for anything that's not
+ */
+
+// We'll never ask for private keys or seed phrases
+// You must use the same signer(s) when submitting requests to the publisher portal as was used to publish
+// your app on-chain.
+
+// The Solana Mobile dApp publisher portal supports 4 different requests: `submit`, `update`, `remove`, and `support`.
+// Each request includes:
+// - a 32-digit randomly generated unique identifier
+// - an attestation payload, signed with the private key of the dApp collection update authority
+// - the dApp release NFT address
+// - contact and company information for the requestor
+// - a self-attestation that the requestor is authorized to make this request
+// - additional fields, specific to the request type in question
+
+// We'll attempt to read as much as possible from a provided `.yml` file
+// If there are provided folders that are well-structured, we'll opt to use that too.
+
+// Requests and responses are logged to the console, to facilitate use in an automated CI/CD environment.

package/src/commands/publish/remove.ts

@@ -0,0 +1,46 @@
+import { Connection, Keypair } from "@solana/web3.js";
+import type { SignWithPublisherKeypair } from "@solana-mobile/dapp-store-publishing-tools";
+import { publishRemove } from "@solana-mobile/dapp-store-publishing-tools";
+import { getConfigFile } from "../../utils.js";
+import nacl from "tweetnacl";
+
+type PublishRemoveCommandInput = {
+  releaseMintAddress: string;
+  signer: Keypair;
+  url: string;
+  dryRun: boolean;
+  requestorIsAuthorized: boolean;
+  critical: boolean;
+};
+
+export const publishRemoveCommand = async ({
+  releaseMintAddress,
+  signer,
+  url,
+  dryRun = false,
+  requestorIsAuthorized = false,
+  critical = false,
+}: PublishRemoveCommandInput) => {
+  if (!requestorIsAuthorized) {
+    console.error(
+      "ERROR: Cannot submit a request for which the requestor does not attest they are authorized to do so"
+    );
+    return;
+  }
+
+  const connection = new Connection(url);
+  const { publisher: publisherDetails } = await getConfigFile();
+  const sign = ((buf: Buffer) =>
+    nacl.sign(buf, signer.secretKey)) as SignWithPublisherKeypair;
+
+  await publishRemove(
+    { connection, sign },
+    {
+      releaseMintAddress,
+      publisherDetails,
+      requestorIsAuthorized,
+      criticalUpdate: critical,
+    },
+    dryRun
+  );
+};

package/src/commands/publish/submit.ts

@@ -0,0 +1,55 @@
+import { Connection, Keypair } from "@solana/web3.js";
+import type { SignWithPublisherKeypair } from "@solana-mobile/dapp-store-publishing-tools";
+import { publishSubmit } from "@solana-mobile/dapp-store-publishing-tools";
+import nacl from "tweetnacl";
+import { getConfigFile } from "../../utils.js";
+
+type PublishSubmitCommandInput = {
+  releaseMintAddress: string;
+  signer: Keypair;
+  url: string;
+  dryRun: boolean;
+  compliesWithSolanaDappStorePolicies: boolean;
+  requestorIsAuthorized: boolean;
+};
+
+export const publishSubmitCommand = async ({
+  releaseMintAddress,
+  signer,
+  url,
+  dryRun = false,
+  compliesWithSolanaDappStorePolicies = false,
+  requestorIsAuthorized = false,
+}: PublishSubmitCommandInput) => {
+  if (!compliesWithSolanaDappStorePolicies) {
+    console.error(
+      "ERROR: Cannot submit a request for which the requestor does not attest that it complies with Solana dApp Store policies"
+    );
+    return;
+  } else if (!requestorIsAuthorized) {
+    console.error(
+      "ERROR: Cannot submit a request for which the requestor does not attest they are authorized to do so"
+    );
+    return;
+  }
+
+  const connection = new Connection(url);
+  const {
+    publisher: publisherDetails,
+    solana_mobile_dapp_publisher_portal: solanaMobileDappPublisherPortalDetails,
+  } = await getConfigFile();
+  const sign = ((buf: Buffer) =>
+    nacl.sign(buf, signer.secretKey)) as SignWithPublisherKeypair;
+
+  await publishSubmit(
+    { connection, sign },
+    {
+      releaseMintAddress,
+      publisherDetails,
+      solanaMobileDappPublisherPortalDetails,
+      compliesWithSolanaDappStorePolicies,
+      requestorIsAuthorized,
+    },
+    dryRun
+  );
+};

package/src/commands/publish/support.ts

@@ -0,0 +1,46 @@
+import { Connection, Keypair } from "@solana/web3.js";
+import type { SignWithPublisherKeypair } from "@solana-mobile/dapp-store-publishing-tools";
+import { publishSupport } from "@solana-mobile/dapp-store-publishing-tools";
+import { getConfigFile } from "../../utils.js";
+import nacl from "tweetnacl";
+
+type PublishSupportCommandInput = {
+  releaseMintAddress: string;
+  signer: Keypair;
+  url: string;
+  dryRun: boolean;
+  requestorIsAuthorized: boolean;
+  requestDetails: string;
+};
+
+export const publishSupportCommand = async ({
+  releaseMintAddress,
+  signer,
+  url,
+  dryRun = false,
+  requestorIsAuthorized = false,
+  requestDetails,
+}: PublishSupportCommandInput) => {
+  if (!requestorIsAuthorized) {
+    console.error(
+      "ERROR: Cannot submit a request for which the requestor does not attest they are authorized to do so"
+    );
+    return;
+  }
+
+  const connection = new Connection(url);
+  const { publisher: publisherDetails } = await getConfigFile();
+  const sign = ((buf: Buffer) =>
+    nacl.sign(buf, signer.secretKey)) as SignWithPublisherKeypair;
+
+  await publishSupport(
+    { connection, sign },
+    {
+      releaseMintAddress,
+      publisherDetails,
+      requestorIsAuthorized,
+      requestDetails,
+    },
+    dryRun
+  );
+};

package/src/commands/publish/update.ts

@@ -0,0 +1,58 @@
+import { Connection, Keypair } from "@solana/web3.js";
+import type { SignWithPublisherKeypair } from "@solana-mobile/dapp-store-publishing-tools";
+import { publishUpdate } from "@solana-mobile/dapp-store-publishing-tools";
+import { getConfigFile } from "../../utils.js";
+import nacl from "tweetnacl";
+
+type PublishUpdateCommandInput = {
+  releaseMintAddress: string;
+  signer: Keypair;
+  url: string;
+  dryRun: boolean;
+  compliesWithSolanaDappStorePolicies: boolean;
+  requestorIsAuthorized: boolean;
+  critical: boolean;
+};
+
+export const publishUpdateCommand = async ({
+  releaseMintAddress,
+  signer,
+  url,
+  dryRun = false,
+  compliesWithSolanaDappStorePolicies = false,
+  requestorIsAuthorized = false,
+  critical = false,
+}: PublishUpdateCommandInput) => {
+  if (!compliesWithSolanaDappStorePolicies) {
+    console.error(
+      "ERROR: Cannot submit a request for which the requestor does not attest that it complies with Solana dApp Store policies"
+    );
+    return;
+  } else if (!requestorIsAuthorized) {
+    console.error(
+      "ERROR: Cannot submit a request for which the requestor does not attest they are authorized to do so"
+    );
+    return;
+  }
+
+  const connection = new Connection(url);
+  const {
+    publisher: publisherDetails,
+    solana_mobile_dapp_publisher_portal: solanaMobileDappPublisherPortalDetails,
+  } = await getConfigFile();
+  const sign = ((buf: Buffer) =>
+    nacl.sign(buf, signer.secretKey)) as SignWithPublisherKeypair;
+
+  await publishUpdate(
+    { connection, sign },
+    {
+      releaseMintAddress,
+      publisherDetails,
+      solanaMobileDappPublisherPortalDetails,
+      compliesWithSolanaDappStorePolicies,
+      requestorIsAuthorized,
+      criticalUpdate: critical,
+    },
+    dryRun
+  );
+};

package/src/commands/validate.ts

@@ -0,0 +1,67 @@
+import {
+  createAppJson,
+  createPublisherJson,
+  createReleaseJson,
+  validateApp,
+  validatePublisher,
+  validateRelease,
+} from "@solana-mobile/dapp-store-publishing-tools";
+import { debug, getConfigFile } from "../utils.js";
+
+import type { Keypair } from "@solana/web3.js";
+import type { MetaplexFile } from "@metaplex-foundation/js";
+
+export const validateCommand = async ({
+  signer,
+  buildToolsPath,
+}: {
+  signer: Keypair;
+  buildToolsPath?: string;
+}) => {
+  const {
+    publisher: publisherDetails,
+    app: appDetails,
+    release: releaseDetails,
+  } = await getConfigFile(buildToolsPath);
+
+  debug({ publisherDetails, appDetails, releaseDetails });
+
+  const publisherJson = createPublisherJson(publisherDetails);
+  if (typeof publisherJson.image !== "string") {
+    publisherJson.image = (publisherJson.image as MetaplexFile)?.fileName;
+  }
+  debug(JSON.stringify({ publisherJson }, null, 2));
+
+  try {
+    validatePublisher(publisherJson);
+    console.info(`Publisher JSON valid!`);
+  } catch (e) {
+    console.error(e);
+  }
+
+  const appJson = createAppJson(appDetails, signer.publicKey);
+  if (typeof appJson.image !== "string") {
+    appJson.image = (appJson.image as MetaplexFile)?.fileName;
+  }
+  debug(JSON.stringify({ appJson }, null, 2));
+
+  try {
+    validateApp(appJson);
+    console.info(`App JSON valid!`);
+  } catch (e) {
+    console.error(e);
+  }
+
+  const releaseJson = await createReleaseJson(
+    { releaseDetails, appDetails, publisherDetails },
+    signer.publicKey
+  );
+  debug(JSON.stringify({ releaseJson }, null, 2));
+
+  try {
+    validateRelease(releaseJson);
+    console.info(`Release JSON valid!`);
+  } catch (e) {
+    console.error(e);
+  }
+};

package/src/config/index.ts

@@ -0,0 +1,40 @@
+import type {
+  App,
+  Publisher,
+  Release,
+  SolanaMobileDappPublisherPortal,
+} from "@solana-mobile/dapp-store-publishing-tools";
+import fs from "fs/promises";
+import { load } from "js-yaml";
+
+import Ajv from "ajv";
+
+// eslint-disable-next-line require-extensions/require-extensions
+import schemaJson from "./schema.json";
+
+// TODO: Add version number return here
+export interface CLIConfig {
+  publisher: Publisher;
+  app: App;
+  release: Release;
+  solana_mobile_dapp_publisher_portal: SolanaMobileDappPublisherPortal;
+  isValid: boolean;
+}
+
+const ajv = new Ajv({ strictTuples: false });
+const validate = ajv.compile(schemaJson);
+
+export const getConfig = async (configPath: string) => {
+  const configFile = await fs.readFile(configPath, "utf-8");
+  const configJson = load(configFile);
+
+  const valid = validate(load(configFile) as object);
+
+  if (!valid) {
+    console.error(validate.errors);
+    process.exit(1);
+  }
+
+  const config = load(configFile) as CLIConfig;
+  return config;
+};