@zerodev/permissions 5.2.1-alpha.0

package/policies/toRateLimitPolicy.ts

@@ -0,0 +1,43 @@
+import { concatHex } from "viem"
+import { PolicyFlags } from "../constants.js"
+import { RATE_LIMIT_POLICY_CONTRACT } from "../constants.js"
+import type { Policy, PolicyParams } from "../types.js"
+
+export type RateLimitPolicyParams = PolicyParams & {
+    interval?: number
+    count: number
+    startAt?: number
+    type?: "rate-limit"
+}
+
+export async function toRateLimitPolicy({
+    policyAddress = RATE_LIMIT_POLICY_CONTRACT,
+    policyFlag = PolicyFlags.FOR_ALL_VALIDATION,
+    interval = 0,
+    count,
+    startAt = 0,
+    type = "rate-limit"
+}: RateLimitPolicyParams): Promise<Policy> {
+    return {
+        getPolicyData: () => {
+            const intervalHex = interval.toString(16).padStart(12, "0")
+            const countHex = count.toString(16).padStart(12, "0")
+            const startAtHex = startAt.toString(16).padStart(12, "0")
+
+            const data = intervalHex + countHex + startAtHex
+
+            return `0x${data}`
+        },
+        getPolicyInfoInBytes: () => {
+            return concatHex([policyFlag, policyAddress])
+        },
+        policyParams: {
+            type,
+            policyAddress,
+            policyFlag,
+            interval,
+            count,
+            startAt
+        }
+    }
+}

package/policies/toSignatureCallerPolicy.ts

@@ -0,0 +1,34 @@
+import { type Address, concatHex, encodeAbiParameters } from "viem"
+import { PolicyFlags } from "../constants.js"
+import { SIGNATURE_POLICY_CONTRACT } from "../constants.js"
+import type { Policy, PolicyParams } from "../types.js"
+
+export type SignatureCallerPolicyParams = PolicyParams & {
+    allowedCallers: Address[]
+    type?: "signature-caller"
+}
+
+export async function toSignatureCallerPolicy({
+    policyAddress = SIGNATURE_POLICY_CONTRACT,
+    policyFlag = PolicyFlags.FOR_ALL_VALIDATION,
+    allowedCallers,
+    type = "signature-caller"
+}: SignatureCallerPolicyParams): Promise<Policy> {
+    return {
+        getPolicyData: () => {
+            return encodeAbiParameters(
+                [{ name: "allowedCallers", type: "address[]" }],
+                [allowedCallers]
+            )
+        },
+        getPolicyInfoInBytes: () => {
+            return concatHex([policyFlag, policyAddress])
+        },
+        policyParams: {
+            type,
+            policyAddress,
+            policyFlag,
+            allowedCallers
+        }
+    }
+}

package/policies/toSudoPolicy.ts

@@ -0,0 +1,27 @@
+import { concatHex } from "viem"
+import { PolicyFlags, SUDO_POLICY_CONTRACT } from "../constants.js"
+import type { Policy, PolicyParams } from "../types.js"
+
+export type SudoPolicyParams = PolicyParams & {
+    type?: "sudo"
+}
+
+export async function toSudoPolicy({
+    policyAddress = SUDO_POLICY_CONTRACT,
+    policyFlag = PolicyFlags.FOR_ALL_VALIDATION,
+    type = "sudo"
+}: SudoPolicyParams): Promise<Policy> {
+    return {
+        getPolicyData: () => {
+            return "0x"
+        },
+        getPolicyInfoInBytes: () => {
+            return concatHex([policyFlag, policyAddress])
+        },
+        policyParams: {
+            type,
+            policyAddress,
+            policyFlag
+        }
+    }
+}

package/policies/types.ts

@@ -0,0 +1,118 @@
+import { type ExtractAbiFunction, type ExtractAbiFunctionNames } from "abitype"
+import type {
+    Abi,
+    AbiFunction,
+    AbiParameter,
+    AbiParameterKind,
+    AbiParameterToPrimitiveType,
+    AbiStateMutability,
+    Address,
+    Hex,
+    Narrow
+} from "viem"
+
+export enum CallType {
+    CALL = "0x00",
+    BATCH_CALL = "0x01",
+    DELEGATE_CALL = "0xff"
+}
+
+export enum ParamCondition {
+    EQUAL = 0,
+    GREATER_THAN = 1,
+    LESS_THAN = 2,
+    GREATER_THAN_OR_EQUAL = 3,
+    LESS_THAN_OR_EQUAL = 4,
+    NOT_EQUAL = 5
+}
+
+export interface ParamRule {
+    condition: ParamCondition
+    offset: number
+    param: Hex
+}
+
+export type PermissionCore = {
+    callType?: CallType
+    target: Address
+    selector?: Hex
+    valueLimit?: bigint
+    rules?: ParamRule[]
+}
+
+export type InferFunctionName<
+    TAbi extends Abi | readonly unknown[] = Abi,
+    TFunctionName extends string | undefined = string,
+    TAbiStateMutability extends AbiStateMutability = AbiStateMutability
+> = TAbi extends Abi
+    ? ExtractAbiFunctionNames<
+          TAbi,
+          TAbiStateMutability
+      > extends infer AbiFunctionNames
+        ?
+              | AbiFunctionNames
+              | (TFunctionName extends AbiFunctionNames ? TFunctionName : never)
+              | (Abi extends TAbi ? string : never)
+        : never
+    : TFunctionName
+
+export type GetFunctionArgs<
+    TAbi extends Abi | readonly unknown[],
+    TFunctionName extends string,
+    TAbiFunction extends AbiFunction = TAbi extends Abi
+        ? ExtractAbiFunction<TAbi, TFunctionName>
+        : AbiFunction,
+    TArgs = CombinedArgs<TAbiFunction["inputs"]>,
+    FailedToParseArgs =
+        | ([TArgs] extends [never] ? true : false)
+        | (readonly unknown[] extends TArgs ? true : false)
+> = true extends FailedToParseArgs
+    ? {
+          args?: readonly unknown[]
+      }
+    : TArgs extends readonly []
+      ? { args?: never }
+      : {
+              args?: TArgs
+          }
+
+export type Permission<
+    TAbi extends Abi | readonly unknown[],
+    TFunctionName extends string | undefined = string,
+    _FunctionName = TAbi extends Abi
+        ? InferFunctionName<TAbi, TFunctionName>
+        : never
+> = PermissionCore & {
+    functionName?: _FunctionName
+} & (TFunctionName extends string
+        ? { abi?: Narrow<TAbi> } & GetFunctionArgs<TAbi, TFunctionName>
+        : _FunctionName extends string
+          ? { abi?: [Narrow<TAbi[number]>] } & GetFunctionArgs<
+                  TAbi,
+                  _FunctionName
+              >
+          : never)
+
+export type CombinedArgs<
+    TAbiParameters extends readonly AbiParameter[],
+    TAbiParameterKind extends AbiParameterKind = AbiParameterKind
+> = {
+    [K in keyof TAbiParameters]: {
+        condition: ParamCondition
+        value: AbiParameterToPrimitiveType<TAbiParameters[K], TAbiParameterKind>
+    } | null
+}
+
+export type GeneratePermissionFromArgsParameters<
+    TAbi extends Abi | readonly unknown[],
+    TFunctionName extends string | undefined = string,
+    _FunctionName = TAbi extends Abi
+        ? InferFunctionName<TAbi, TFunctionName>
+        : never
+> = {
+    functionName?: _FunctionName
+} & (TFunctionName extends string
+    ? { abi: Narrow<TAbi> } & GetFunctionArgs<TAbi, TFunctionName>
+    : _FunctionName extends string
+      ? { abi: [Narrow<TAbi[number]>] } & GetFunctionArgs<TAbi, _FunctionName>
+      : never)

package/policies/utils/toPolicyId.ts

@@ -0,0 +1,13 @@
+import { type Hex, concat, encodeAbiParameters } from "viem"
+import type { Policy } from "../../types.js"
+
+export const toPolicyId = (policies: Policy[]): Hex => {
+    return encodeAbiParameters(
+        [{ name: "policiesData", type: "bytes[]" }],
+        [
+            policies.map((policy) =>
+                concat([policy.getPolicyInfoInBytes(), policy.getPolicyData()])
+            )
+        ]
+    )
+}

package/serializePermissionAccount.ts

@@ -0,0 +1,38 @@
+import type { KernelSmartAccount } from "@zerodev/sdk"
+import type { EntryPoint } from "permissionless/types"
+import type { Hex } from "viem"
+import {
+    isPermissionValidatorPlugin,
+    serializePermissionAccountParams
+} from "./utils.js"
+
+export const serializePermissionAccount = async <entryPoint extends EntryPoint>(
+    account: KernelSmartAccount<entryPoint>,
+    privateKey?: Hex
+): Promise<string> => {
+    if (!isPermissionValidatorPlugin(account.kernelPluginManager))
+        throw new Error("Account plugin is not a permission validator")
+    const permissionParams =
+        account.kernelPluginManager.getPluginSerializationParams()
+    const action = account.kernelPluginManager.getAction()
+    const validityData = account.kernelPluginManager.getValidityData()
+    const enableSignature =
+        await account.kernelPluginManager.getPluginEnableSignature(
+            account.address
+        )
+    const accountParams = {
+        initCode: await account.generateInitCode(),
+        accountAddress: account.address
+    }
+
+    const paramsToBeSerialized = {
+        permissionParams,
+        action,
+        validityData,
+        accountParams,
+        enableSignature,
+        privateKey
+    }
+
+    return serializePermissionAccountParams(paramsToBeSerialized)
+}

package/signers/index.ts

@@ -0,0 +1,10 @@
+export {
+    toECDSASigner,
+    type ECDSAModularSignerParams
+} from "./toECDSASigner.js"
+export {
+    toWebAuthnSigner,
+    type WebAuthnModularSignerParams
+} from "./toWebAuthnSigner.js"
+export { WebAuthnMode } from "./toWebAuthnPubKey.js"
+export { toSignerId } from "./utils/toSignerId.js"

package/signers/toECDSASigner.ts

@@ -0,0 +1,61 @@
+import { constants, fixSignedData } from "@zerodev/sdk"
+import type { TypedData } from "abitype"
+import {
+    SignTransactionNotSupportedBySmartAccount,
+    type SmartAccountSigner
+} from "permissionless/accounts"
+import { type Address, type LocalAccount, type TypedDataDefinition } from "viem"
+import { toAccount } from "viem/accounts"
+import { ECDSA_SIGNER_CONTRACT } from "../constants.js"
+import type { ModularSigner, ModularSignerParams } from "../types.js"
+
+export type ECDSAModularSignerParams<
+    TSource extends string = "custom",
+    TAddress extends Address = Address
+> = ModularSignerParams & {
+    signer: SmartAccountSigner<TSource, TAddress>
+}
+
+export function toECDSASigner<
+    TSource extends string = "custom",
+    TAddress extends Address = Address
+>({
+    signer,
+    signerContractAddress = ECDSA_SIGNER_CONTRACT
+}: ECDSAModularSignerParams<TSource, TAddress>): ModularSigner {
+    const viemSigner: LocalAccount = {
+        ...signer,
+        signTransaction: (_, __) => {
+            throw new SignTransactionNotSupportedBySmartAccount()
+        }
+    } as LocalAccount
+    const account = toAccount({
+        address: viemSigner.address,
+        async signMessage({ message }) {
+            return fixSignedData(await viemSigner.signMessage({ message }))
+        },
+        async signTransaction(_, __) {
+            throw new SignTransactionNotSupportedBySmartAccount()
+        },
+        async signTypedData<
+            const TTypedData extends TypedData | Record<string, unknown>,
+            TPrimaryType extends
+                | keyof TTypedData
+                | "EIP712Domain" = keyof TTypedData
+        >(typedData: TypedDataDefinition<TTypedData, TPrimaryType>) {
+            return fixSignedData(
+                await viemSigner.signTypedData<TTypedData, TPrimaryType>({
+                    ...typedData
+                })
+            )
+        }
+    })
+    return {
+        account,
+        signerContractAddress,
+        getSignerData: () => {
+            return viemSigner.address
+        },
+        getDummySignature: () => constants.DUMMY_ECDSA_SIG
+    }
+}

package/signers/toWebAuthnPubKey.ts

@@ -0,0 +1,152 @@
+import { Buffer } from "buffer"
+import { startAuthentication, startRegistration } from "@simplewebauthn/browser"
+import { type Hex, keccak256 } from "viem"
+import { type WebAuthnKey } from "./toWebAuthnSigner.js"
+import { b64ToBytes, uint8ArrayToHexString } from "./webAuthnUtils.js"
+
+export enum WebAuthnMode {
+    Register = "register",
+    Login = "login"
+}
+
+export const toWebAuthnPubKey = async ({
+    passkeyName,
+    passkeyServerUrl,
+    mode = WebAuthnMode.Login
+}: {
+    passkeyName: string
+    passkeyServerUrl: string
+    mode: WebAuthnMode
+}): Promise<WebAuthnKey> => {
+    let pubKey: string | undefined
+    let authenticatorIdHash: Hex
+    if (mode === WebAuthnMode.Login) {
+        // Get login options
+        const loginOptionsResponse = await fetch(
+            `${passkeyServerUrl}/login/options`,
+            {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                credentials: "include"
+            }
+        )
+        const loginOptions = await loginOptionsResponse.json()
+
+        // Start authentication (login)
+        const loginCred = await startAuthentication(loginOptions)
+
+        // get authenticatorIdHash
+        authenticatorIdHash = keccak256(
+            uint8ArrayToHexString(b64ToBytes(loginCred.id))
+        )
+
+        // Verify authentication
+        const loginVerifyResponse = await fetch(
+            `${passkeyServerUrl}/login/verify`,
+            {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ cred: loginCred }),
+                credentials: "include"
+            }
+        )
+
+        const loginVerifyResult = await loginVerifyResponse.json()
+
+        if (window.sessionStorage === undefined) {
+            throw new Error("sessionStorage is not available")
+        }
+        sessionStorage.setItem("userId", loginVerifyResult.userId)
+
+        if (!loginVerifyResult.verification.verified) {
+            throw new Error("Login not verified")
+        }
+        // Import the key
+        pubKey = loginVerifyResult.pubkey // Uint8Array pubkey
+    } else {
+        if (!passkeyName) {
+            throw new Error("No passkey name provided")
+        }
+        // Get registration options
+        const registerOptionsResponse = await fetch(
+            `${passkeyServerUrl}/register/options`,
+            {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({ username: passkeyName }),
+                credentials: "include"
+            }
+        )
+        const registerOptions = await registerOptionsResponse.json()
+
+        // save userId to sessionStorage
+        if (window.sessionStorage === undefined) {
+            throw new Error("sessionStorage is not available")
+        }
+        sessionStorage.setItem("userId", registerOptions.userId)
+
+        // Start registration
+        const registerCred = await startRegistration(registerOptions.options)
+
+        // get authenticatorIdHash
+        authenticatorIdHash = keccak256(
+            uint8ArrayToHexString(b64ToBytes(registerCred.id))
+        )
+
+        // Verify registration
+        const registerVerifyResponse = await fetch(
+            `${passkeyServerUrl}/register/verify`,
+            {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json"
+                },
+                body: JSON.stringify({
+                    userId: registerOptions.userId,
+                    username: passkeyName,
+                    cred: registerCred
+                }),
+                credentials: "include"
+            }
+        )
+
+        const registerVerifyResult = await registerVerifyResponse.json()
+        if (!registerVerifyResult.verified) {
+            throw new Error("Registration not verified")
+        }
+
+        // Import the key
+        pubKey = registerCred.response.publicKey
+    }
+    if (!pubKey) {
+        throw new Error("No public key returned from registration credential")
+    }
+
+    const spkiDer = Buffer.from(pubKey, "base64")
+    const key = await crypto.subtle.importKey(
+        "spki",
+        spkiDer,
+        {
+            name: "ECDSA",
+            namedCurve: "P-256"
+        },
+        true,
+        ["verify"]
+    )
+
+    // Export the key to the raw format
+    const rawKey = await crypto.subtle.exportKey("raw", key)
+    const rawKeyBuffer = Buffer.from(rawKey)
+
+    // The first byte is 0x04 (uncompressed), followed by x and y coordinates (32 bytes each for P-256)
+    const pubKeyX = rawKeyBuffer.subarray(1, 33).toString("hex")
+    const pubKeyY = rawKeyBuffer.subarray(33).toString("hex")
+
+    return {
+        pubX: BigInt(`0x${pubKeyX}`),
+        pubY: BigInt(`0x${pubKeyY}`),
+        authenticatorIdHash
+    }
+}