@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/src/internal/owners/Passkey.ts

@@ -0,0 +1,72 @@
+/**
+ * Linked wallet.tempo passkeys as owner keys, which `TempoAccount.kinds` lists. Passkey sign-in and
+ * links live in `Passkey.ts`.
+ * @module
+ */
+import { and, asc, eq, inArray } from 'drizzle-orm'
+import type { Hex } from 'ox'
+import { Account } from 'viem/tempo'
+import * as Schema from '../../app/db/schema.js'
+import * as Owner from '../Owner.js'
+
+/**
+ * Linked wallet.tempo passkeys as owner keys. Each owns the account at the address that its public
+ * key derives, in each realm whose relying party the passkey belongs to. A passkey that Tempo ID
+ * stores as its own is a sign-in credential, and owns no account. A passkey signs only in the
+ * browser, and Tempo ID creates none.
+ */
+export const owner = Owner.kind({
+  errors: [],
+  load(_c, options) {
+    const { userId } = options
+    const realms = options.realms.filter((realm) => realm.passkeys)
+
+    return Promise.resolve({
+      async list(_c, options) {
+        if (realms.length === 0) return []
+
+        const keys = await options.db
+          .select()
+          .from(Schema.keys)
+          .where(
+            and(
+              eq(Schema.keys.userId, userId),
+              eq(Schema.keys.source, 'wallet'),
+              inArray(
+                Schema.keys.rpId,
+                realms.map((realm) => realm.passkeys!.rpId),
+              ),
+            ),
+          )
+          .orderBy(asc(Schema.keys.createdAt), asc(Schema.keys.id))
+
+        return keys.flatMap((key) =>
+          realms
+            .filter((realm) => realm.passkeys!.rpId === key.rpId)
+            .map((realm) =>
+              Owner.from({
+                account: Account.fromConfig({
+                  owners: [
+                    Account.fromWebAuthnP256(
+                      { id: key.id, publicKey: key.publicKey as Hex.Hex },
+                      { rpId: key.rpId },
+                    ),
+                  ],
+                }),
+                createdAt: key.createdAt,
+                credential: {
+                  id: key.id,
+                  publicKey: key.publicKey as Hex.Hex,
+                  rpId: key.rpId,
+                },
+                realm,
+                signer: undefined,
+                type: 'webAuthn',
+              }),
+            ),
+        )
+      },
+    })
+  },
+  type: 'webAuthn',
+})

package/src/internal/owners/Privy.ts

@@ -0,0 +1,81 @@
+/**
+ * Privy wallets as owner keys, which `TempoAccount.kinds` lists. The Privy client, its wallets, and
+ * its tokens live in `Privy.ts`.
+ * @module
+ */
+import * as ErrorResponse from '../ErrorResponse.js'
+import * as Owner from '../Owner.js'
+import * as Privy from '../Privy.js'
+import * as Realm from '../Realm.js'
+import * as Timing from '../Timing.js'
+
+/**
+ * Privy wallets as owner keys. A realm's Privy app holds the user's wallets in the realm, and creates
+ * the user's first wallet there. A wallet signs on the server with a token that only Privy trusts.
+ */
+export const owner = Owner.kind({
+  errors: ErrorResponse.fromUpstream.errors,
+  async load(c, options) {
+    const { db, env, realms, userId } = options
+    const apps = await Timing.measure(
+      c,
+      Realm.privyApps(db, { realms, secret: env.SECRET }),
+      'Realm.privyApps',
+    )
+
+    const toOwner = (
+      app: Privy.App,
+      realm: Realm.Realm,
+      wallet: Privy.Wallet,
+    ) =>
+      Owner.from({
+        account: Privy.toAccount({ app, wallet }),
+        createdAt: wallet.createdAt,
+        realm,
+        async signer(c, options) {
+          const jwt = await Timing.measure(
+            c,
+            Privy.token(options.auth, {
+              app,
+              privateKey: env.PRIVY_JWT_PRIVATE_KEY,
+              userId,
+            }),
+            'Privy.token',
+          )
+          return Privy.toAccount({ app, token: jwt, wallet }).owners[0]!
+        },
+        type: 'privy',
+      })
+
+    return {
+      create(realm) {
+        const app = apps.get(realm.id)
+        if (!app) return undefined
+        return async (c) => {
+          const wallet = await Timing.measure(
+            c,
+            Privy.firstWallet(c, { app, userId }),
+            'Privy.firstWallet',
+          )
+          return toOwner(app, realm, wallet)
+        }
+      },
+      async list(c) {
+        const lists = await Promise.all(
+          realms.map(async (realm) => {
+            const app = apps.get(realm.id)
+            if (!app) return []
+            const wallets = await Timing.measure(
+              c,
+              Privy.listWallets(c, { app, userId }),
+              'Privy.listWallets',
+            )
+            return wallets.map((wallet) => toOwner(app, realm, wallet))
+          }),
+        )
+        return Owner.merge(lists)
+      },
+    }
+  },
+  type: 'privy',
+})

package/src/internal/owners/Secp256k1.ts

@@ -0,0 +1,143 @@
+/**
+ * Secp256k1 owner keys that Tempo ID creates, holds, and signs with itself, in the place of a Privy
+ * wallet, for the suites and local development. Each user holds at most one in each realm that
+ * `realm_secp256k1` names, and its row holds the private key encrypted with `SECRET`. A production
+ * realm never turns them on, since the key stays in Tempo ID's database.
+ * @module
+ */
+import { symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto'
+import { and, asc, eq, inArray } from 'drizzle-orm'
+import type { Hex } from 'ox'
+import {
+  generatePrivateKey,
+  privateKeyToAccount,
+  toAccount,
+} from 'viem/accounts'
+import { Account } from 'viem/tempo'
+import * as Schema from '../../app/db/schema.js'
+import * as Owner from '../Owner.js'
+import type * as Realm from '../Realm.js'
+import * as Timing from '../Timing.js'
+
+/** The account of a listed owner signs nothing. Only the owner's `signer` signs. */
+export class SignerRequiredError extends Error {
+  override readonly name = 'Secp256k1.SignerRequiredError'
+
+  constructor() {
+    super(
+      "The account of a secp256k1 owner signs nothing. Sign with the owner's signer.",
+    )
+  }
+}
+
+/**
+ * Secp256k1 keys as owner keys. In each realm that holds them, the kind creates the user's first key
+ * and signs with it on the server.
+ */
+export const owner = Owner.kind({
+  errors: [],
+  load(_c, options) {
+    const { env, userId } = options
+    const realms = options.realms.filter((realm) => realm.secp256k1)
+
+    const toOwner = (row: Row, realm: Realm.Realm) =>
+      Owner.from({
+        account: Account.fromConfig({ owners: [unsigned(row.address)] }),
+        createdAt: row.createdAt,
+        realm,
+        async signer() {
+          const privateKey = await symmetricDecrypt({
+            data: row.privateKey,
+            key: env.SECRET,
+          })
+          return privateKeyToAccount(privateKey as Hex.Hex)
+        },
+        type: 'secp256k1',
+      })
+
+    return Promise.resolve({
+      create(realm) {
+        if (!realms.some((entry) => entry.id === realm.id)) return undefined
+        return async (c) => {
+          const privateKey = generatePrivateKey()
+          // A concurrent create for the same user and realm keeps the first key, and both return it.
+          await Timing.measure(
+            c,
+            options.db
+              .insert(Schema.secp256k1Owners)
+              .values({
+                address: privateKeyToAccount(privateKey).address,
+                privateKey: await symmetricEncrypt({
+                  data: privateKey,
+                  key: env.SECRET,
+                }),
+                realmId: realm.id,
+                userId,
+              })
+              .onConflictDoNothing(),
+            'db.secp256k1Owner.insert',
+          )
+          const [row] = await Timing.measure(
+            c,
+            options.db
+              .select()
+              .from(Schema.secp256k1Owners)
+              .where(
+                and(
+                  eq(Schema.secp256k1Owners.userId, userId),
+                  eq(Schema.secp256k1Owners.realmId, realm.id),
+                ),
+              ),
+            'db.secp256k1Owner.get',
+          )
+          return toOwner(row!, realm)
+        }
+      },
+      async list(c, options) {
+        if (realms.length === 0) return []
+
+        const rows = await Timing.measure(
+          c,
+          options.db
+            .select()
+            .from(Schema.secp256k1Owners)
+            .where(
+              and(
+                eq(Schema.secp256k1Owners.userId, userId),
+                inArray(
+                  Schema.secp256k1Owners.realmId,
+                  realms.map((realm) => realm.id),
+                ),
+              ),
+            )
+            .orderBy(
+              asc(Schema.secp256k1Owners.createdAt),
+              asc(Schema.secp256k1Owners.realmId),
+            ),
+          'db.secp256k1Owner.list',
+        )
+        return rows.map((row) =>
+          toOwner(
+            row,
+            realms.find((realm) => realm.id === row.realmId)!,
+          ),
+        )
+      },
+    })
+  },
+  type: 'secp256k1',
+})
+
+/** A row of `secp256k1_owners`. */
+type Row = typeof Schema.secp256k1Owners.$inferSelect
+
+/** Returns a Viem account for `address` that signs nothing, as a listed owner's account. */
+function unsigned(address: string) {
+  const refuse = () => Promise.reject(new SignerRequiredError())
+  return toAccount({
+    address: address as Hex.Hex,
+    signMessage: refuse,
+    signTransaction: refuse,
+    signTypedData: refuse,
+  })
+}

package/src/types/app.d.ts

@@ -0,0 +1,19 @@
+/** The Tempo ID app's build, which `#app` names and `pnpm build` writes to `dist/app/`. */
+declare module '#app' {
+  /** The built Worker's handlers. */
+  const handlers: {
+    /** Serves a request with the Worker's bindings. */
+    fetch(
+      request: Request,
+      env: Record<string, unknown>,
+      ctx: unknown,
+    ): Promise<Response>
+    /** Runs the scheduled jobs. */
+    scheduled(
+      controller: unknown,
+      env: Record<string, unknown>,
+      ctx: unknown,
+    ): Promise<void>
+  }
+  export default handlers
+}

package/src/worker.ts

@@ -0,0 +1,11 @@
+/**
+ * The Worker entry: `App.create` runs Tempo ID in a Cloudflare Worker.
+ *
+ * ```ts
+ * import { App } from '@tempoxyz/id/worker'
+ *
+ * export default App.create({ from: 'Tempo ID <noreply@id.example.com>' })
+ * ```
+ * @module
+ */
+export * as App from './App.js'