@stellar/typescript-wallet-sdk 4.0.0 → 5.0.0-beta.1788566740000

package/test/server.test.ts

@@ -1,6 +1,21 @@
 import axios from "axios";
-import { TransactionBuilder } from "@stellar/stellar-sdk";
+import sinon from "sinon";
+import {
+  Account,
+  Asset,
+  Keypair,
+  MuxedAccount,
+  Operation,
+  StellarToml,
+  Transaction,
+  TransactionBuilder,
+  WebAuth,
+} from "@stellar/stellar-sdk";
 import { Wallet, Server } from "../src";
+import {
+  ChallengeTxnClientAccountMismatchError,
+  ChallengeValidationFailedError,
+} from "../src/walletSdk/Exceptions";
 
 let wallet;
 let account;
@@ -78,3 +93,206 @@ describe("Server helpers", () => {
     expect(parsed.kind).toBe("withdrawal");
   });
 });
+
+describe("signChallengeTransaction validation", () => {
+  const anchorA = "anchor-a.example.com";
+  const anchorB = "anchor-b.example.com";
+
+  let anchorAKp;
+  let anchorBKp;
+  let accountKp;
+
+  beforeEach(() => {
+    anchorAKp = Keypair.random();
+    anchorBKp = Keypair.random();
+    accountKp = Wallet.TestNet().stellar().account().createKeypair();
+
+    // anchorDomain always resolves to anchor A's stellar.toml
+    sinon.stub(StellarToml.Resolver, "resolve").resolves({
+      SIGNING_KEY: anchorAKp.publicKey(),
+      WEB_AUTH_ENDPOINT: `https://${anchorA}/auth`,
+      DOCUMENTATION: {},
+    } as StellarToml.Api.StellarToml);
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  // webAuthDomain defaults to anchor A, which is what the stubbed
+  // WEB_AUTH_ENDPOINT resolves to for anchorDomain.
+  const buildChallenge = (
+    serverKp,
+    homeDomain,
+    clientAccountID,
+    webAuthDomain = anchorA,
+  ) =>
+    WebAuth.buildChallengeTx(
+      serverKp,
+      clientAccountID,
+      homeDomain,
+      300,
+      networkPassphrase,
+      webAuthDomain,
+    );
+
+  it("should sign a challenge issued by the expected anchor", async () => {
+    const challengeTx = buildChallenge(anchorAKp, anchorA, accountKp.publicKey);
+
+    const signedResp = await Server.signChallengeTransaction({
+      accountKp,
+      challengeTx,
+      networkPassphrase,
+      anchorDomain: anchorA,
+    });
+
+    const signedTxn = TransactionBuilder.fromXDR(
+      signedResp.transaction,
+      networkPassphrase,
+    );
+    expect(signedTxn.signatures.length).toBe(2);
+  });
+
+  it("should reject a challenge issued by a different anchor", async () => {
+    // A relays a challenge that anchor B issued for the same account, ordering
+    // its own signature first so that signatures[0] matches the SIGNING_KEY
+    // published at anchorDomain. Only the home domain, web auth domain and
+    // transaction source bind the challenge to the anchor that issued it.
+    const relayed = TransactionBuilder.fromXDR(
+      buildChallenge(anchorBKp, anchorB, accountKp.publicKey, anchorB),
+      networkPassphrase,
+    ) as Transaction;
+
+    const anchorBSignature = relayed.signatures[0];
+    relayed.signatures.length = 0;
+    relayed.sign(anchorAKp);
+    relayed.signatures.push(anchorBSignature);
+
+    await expect(
+      Server.signChallengeTransaction({
+        accountKp,
+        challengeTx: relayed.toXDR(),
+        networkPassphrase,
+        anchorDomain: anchorA,
+      }),
+    ).rejects.toThrow(ChallengeValidationFailedError);
+  });
+
+  it("should sign a challenge issued for a muxed account of the signing key", async () => {
+    // readChallengeTx returns the M... source verbatim; the underlying G... key
+    // is the correct signer, so this must be accepted.
+    const muxed = new MuxedAccount(
+      new Account(accountKp.publicKey, "0"),
+      "1234",
+    ).accountId();
+    expect(muxed.startsWith("M")).toBe(true);
+
+    const challengeTx = buildChallenge(anchorAKp, anchorA, muxed);
+
+    const signedResp = await Server.signChallengeTransaction({
+      accountKp,
+      challengeTx,
+      networkPassphrase,
+      anchorDomain: anchorA,
+    });
+
+    const signedTxn = TransactionBuilder.fromXDR(
+      signedResp.transaction,
+      networkPassphrase,
+    );
+    expect(signedTxn.signatures.length).toBe(2);
+  });
+
+  it("should reject a muxed challenge whose underlying key is not the signer", async () => {
+    const otherMuxed = new MuxedAccount(
+      new Account(Keypair.random().publicKey(), "0"),
+      "1234",
+    ).accountId();
+
+    await expect(
+      Server.signChallengeTransaction({
+        accountKp,
+        challengeTx: buildChallenge(anchorAKp, anchorA, otherMuxed),
+        networkPassphrase,
+        anchorDomain: anchorA,
+      }),
+    ).rejects.toThrow(ChallengeTxnClientAccountMismatchError);
+  });
+
+  it("should reject a challenge issued for a different account", async () => {
+    const otherAccount = Keypair.random().publicKey();
+    const challengeTx = buildChallenge(anchorAKp, anchorA, otherAccount);
+
+    await expect(
+      Server.signChallengeTransaction({
+        accountKp,
+        challengeTx,
+        networkPassphrase,
+        anchorDomain: anchorA,
+      }),
+    ).rejects.toThrow(ChallengeTxnClientAccountMismatchError);
+  });
+
+  it("should reject a transaction that is not a SEP-10 challenge", async () => {
+    const notAChallenge = new TransactionBuilder(
+      new Account(anchorAKp.publicKey(), "-1"),
+      { fee: "100", networkPassphrase },
+    )
+      .addOperation(
+        Operation.payment({
+          destination: anchorAKp.publicKey(),
+          asset: Asset.native(),
+          amount: "1000",
+        }),
+      )
+      .setTimeout(300)
+      .build();
+    notAChallenge.sign(anchorAKp);
+
+    await expect(
+      Server.signChallengeTransaction({
+        accountKp,
+        challengeTx: notAChallenge.toXDR(),
+        networkPassphrase,
+        anchorDomain: anchorA,
+      }),
+    ).rejects.toThrow(ChallengeValidationFailedError);
+  });
+
+  it("should wrap a malformed WEB_AUTH_ENDPOINT as a validation failure", async () => {
+    sinon.restore();
+    sinon.stub(StellarToml.Resolver, "resolve").resolves({
+      SIGNING_KEY: anchorAKp.publicKey(),
+      WEB_AUTH_ENDPOINT: "not a url",
+      DOCUMENTATION: {},
+    } as StellarToml.Api.StellarToml);
+
+    await expect(
+      Server.signChallengeTransaction({
+        accountKp,
+        challengeTx: buildChallenge(anchorAKp, anchorA, accountKp.publicKey),
+        networkPassphrase,
+        anchorDomain: anchorA,
+      }),
+    ).rejects.toThrow(ChallengeValidationFailedError);
+  });
+
+  it("should accept an explicit homeDomain that differs from anchorDomain", async () => {
+    const homeDomain = "wallet-home.example.com";
+    const challengeTx = buildChallenge(
+      anchorAKp,
+      homeDomain,
+      accountKp.publicKey,
+    );
+
+    const signedResp = await Server.signChallengeTransaction({
+      accountKp,
+      challengeTx,
+      networkPassphrase,
+      anchorDomain: anchorA,
+      homeDomain,
+    });
+
+    expect(signedResp.networkPassphrase).toBe(networkPassphrase);
+  });
+});

package/test/transaction.test.ts

@@ -1,8 +1,24 @@
 import axios from "axios";
-import { Horizon, MuxedAccount } from "@stellar/stellar-sdk";
-
-import { AccountService, SigningKeypair, Stellar, Wallet } from "../src";
+import {
+  Account,
+  Horizon,
+  Keypair,
+  MuxedAccount,
+  Operation,
+} from "@stellar/stellar-sdk";
+
+import {
+  AccountService,
+  ApplicationConfiguration,
+  Config,
+  SigningKeypair,
+  Stellar,
+  StellarConfiguration,
+  TransactionBuilder,
+  Wallet,
+} from "../src";
 import { IssuedAssetId, NativeAssetId } from "../src/walletSdk/Asset";
+import { PathPayBoundRequiredError } from "../src/walletSdk/Exceptions";
 
 describe("Muxed Transactions", () => {
   let wallet: Wallet;
@@ -289,6 +305,7 @@ describe("Path Payment", () => {
         sendAsset: new NativeAssetId(),
         destAsset: usdcAsset,
         sendAmount: "5",
+        destMin: "4.9",
       })
       .build();
     expect(txn.operations[0].type).toBe("pathPaymentStrictSend");
@@ -304,6 +321,7 @@ describe("Path Payment", () => {
         sendAsset: new NativeAssetId(),
         destAsset: usdcAsset,
         destAmount: "5",
+        sendMax: "5.1",
       })
       .build();
     expect(txn.operations[0].type).toBe("pathPaymentStrictReceive");
@@ -314,10 +332,95 @@ describe("Path Payment", () => {
       sourceAddress: sourceKp,
     });
     const txn = txBuilder
-      .swap(new NativeAssetId(), new NativeAssetId(), ".1")
+      .swap(new NativeAssetId(), new NativeAssetId(), ".1", ".1")
       .build();
     sourceKp.sign(txn);
     const success = await stellar.submitTransaction(txn);
     expect(success).toBe(true);
   }, 15000);
 });
+
+describe("Path Payment bounds", () => {
+  const usdcAsset = new IssuedAssetId(
+    "USDC",
+    "GBBD47IF6LWK7P7MDEVSCWR7DPUWV3NY3DTQEVFL4NAT4AQH3ZLLFLA5",
+  );
+  const destination = Keypair.random().publicKey();
+
+  // Builds a TransactionBuilder offline so these tests never touch Horizon
+  const newBuilder = () =>
+    new TransactionBuilder(
+      new Config({
+        stellarConfiguration: StellarConfiguration.TestNet(),
+        applicationConfiguration: new ApplicationConfiguration(),
+      }),
+      new Account(Keypair.random().publicKey(), "0"),
+    );
+
+  it("throws when sendAmount is given without destMin", () => {
+    expect(() =>
+      newBuilder().pathPay({
+        destinationAddress: destination,
+        sendAsset: new NativeAssetId(),
+        destAsset: usdcAsset,
+        sendAmount: "5",
+      } as any),
+    ).toThrow(PathPayBoundRequiredError);
+  });
+
+  it("throws when destAmount is given without sendMax", () => {
+    expect(() =>
+      newBuilder().pathPay({
+        destinationAddress: destination,
+        sendAsset: new NativeAssetId(),
+        destAsset: usdcAsset,
+        destAmount: "5",
+      } as any),
+    ).toThrow(PathPayBoundRequiredError);
+  });
+
+  it("throws when swap is called without destMin", () => {
+    expect(() =>
+      (newBuilder() as any).swap(new NativeAssetId(), usdcAsset, "1"),
+    ).toThrow(PathPayBoundRequiredError);
+  });
+
+  it("uses the destMin given to pathPay", () => {
+    const txn = newBuilder()
+      .pathPay({
+        destinationAddress: destination,
+        sendAsset: new NativeAssetId(),
+        destAsset: usdcAsset,
+        sendAmount: "5",
+        destMin: "4.9",
+      })
+      .build();
+    const op = txn.operations[0] as Operation.PathPaymentStrictSend;
+    expect(op.type).toBe("pathPaymentStrictSend");
+    expect(op.destMin).toBe("4.9000000");
+  });
+
+  it("uses the sendMax given to pathPay", () => {
+    const txn = newBuilder()
+      .pathPay({
+        destinationAddress: destination,
+        sendAsset: new NativeAssetId(),
+        destAsset: usdcAsset,
+        destAmount: "5",
+        sendMax: "5.1",
+      })
+      .build();
+    const op = txn.operations[0] as Operation.PathPaymentStrictReceive;
+    expect(op.type).toBe("pathPaymentStrictReceive");
+    expect(op.sendMax).toBe("5.1000000");
+  });
+
+  it("uses the destMin given to swap", () => {
+    const txn = newBuilder()
+      .swap(new NativeAssetId(), usdcAsset, "1", "0.9")
+      .build();
+    const op = txn.operations[0] as Operation.PathPaymentStrictSend;
+    expect(op.type).toBe("pathPaymentStrictSend");
+    expect(op.destMin).toBe("0.9000000");
+  });
+});

package/test/tsconfig.json

@@ -1,6 +1,7 @@
 {
   "compilerOptions": {
     "esModuleInterop": true,
+    "skipLibCheck": true,
     "baseUrl": "./",
     "outDir": "lib",
     "declaration": true,

package/webpack.config.js

@@ -40,7 +40,6 @@ module.exports = (env = { NODE: false }) => {
             util: require.resolve("util"),
             vm: require.resolve("vm-browserify"),
             "process/browser": require.resolve("process/browser"),
-            buffer: require.resolve("buffer"),
           }
         : {},
     },
@@ -60,9 +59,6 @@ module.exports = (env = { NODE: false }) => {
           new webpack.ProvidePlugin({
             process: "process/browser",
           }),
-          new webpack.ProvidePlugin({
-            Buffer: ["buffer", "Buffer"],
-          }),
         ]
       : [],
   };