accounts 0.12.2 → 0.13.0

package/src/core/adapters/turnkey.test.ts

@@ -1,5 +1,7 @@
 import { Hex, PublicKey } from 'ox'
+import { decodeFunctionData } from 'viem'
 import type { Address } from 'viem/accounts'
+import { Abis } from 'viem/tempo'
 import { describe, expect, test } from 'vp/test'
 
 import { accounts } from '../../../test/config.js'
@@ -94,10 +96,10 @@ describe('turnkey', () => {
     `)
   })
 
-  test('default: loadAccounts delegates login and caches wallet accounts for signing', async () => {
-    const { adapter, client } = setup()
+  test('default: loadAccounts returns accounts for store-backed signing', async () => {
+    const { adapter, client, store } = setup()
 
-    await adapter.actions.loadAccounts(undefined, { method: 'wallet_connect', params: undefined })
+    await connect({ adapter, store })
     const result = await adapter.actions.signPersonalMessage(
       { address, data: '0x68656c6c6f' },
       { method: 'personal_sign', params: ['0x68656c6c6f', address] },
@@ -148,9 +150,9 @@ describe('turnkey', () => {
   })
 
   test('default: signs transactions with a hydrated Tempo account', async () => {
-    const { adapter, client } = setup()
+    const { adapter, client, store } = setup()
 
-    await adapter.actions.loadAccounts(undefined, { method: 'wallet_connect', params: undefined })
+    await connect({ adapter, store })
     const result = await adapter.actions.signTransaction(
       {
         chainId: 1,
@@ -181,7 +183,7 @@ describe('turnkey', () => {
   })
 
   test('default: accepts prefixed Turnkey public keys', async () => {
-    const { adapter, client } = setup()
+    const { adapter, client, store } = setup()
     const walletAccount = toWalletAccount(account)
     client.wallets = [
       {
@@ -194,7 +196,7 @@ describe('turnkey', () => {
       },
     ]
 
-    await adapter.actions.loadAccounts(undefined, { method: 'wallet_connect', params: undefined })
+    await connect({ adapter, store })
     const result = await adapter.actions.signTransaction(
       {
         chainId: 1,
@@ -292,6 +294,53 @@ describe('turnkey', () => {
     `)
   })
 
+  test('default: revokeAccessKey revokes with the connected Turnkey account', async () => {
+    const { adapter, client, store } = setup()
+    store.setState({
+      accounts: [{ address }],
+      activeAccount: 0,
+      accessKeys: [
+        {
+          access: address,
+          address: other,
+          chainId: 1,
+          keyType: 'secp256k1',
+        } as never,
+      ],
+    })
+
+    await adapter.actions.revokeAccessKey!(
+      { accessKeyAddress: other, address },
+      { method: 'wallet_revokeAccessKey', params: [{ accessKeyAddress: other, address }] },
+    )
+
+    const transaction = client.transactions[0] as
+      | { account: { address: Address }; data: Hex.Hex; to: Address }
+      | undefined
+    const decoded = transaction
+      ? decodeFunctionData({ abi: Abis.accountKeychain, data: transaction.data })
+      : undefined
+    expect(
+      transaction &&
+        decoded && {
+          account: transaction.account.address,
+          args: decoded.args,
+          functionName: decoded.functionName,
+          to: transaction.to,
+        },
+    ).toMatchInlineSnapshot(`
+        {
+          "account": "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
+          "args": [
+            "0x8C8d35429F74ec245F8Ef2f4Fd1e551cFF97d650",
+          ],
+          "functionName": "revokeKey",
+          "to": "0xaAAAaaAA00000000000000000000000000000000",
+        }
+      `)
+    expect(store.getState().accessKeys).toMatchInlineSnapshot(`[]`)
+  })
+
   test('behavior: signing silently restores wallet accounts from an existing session', async () => {
     const { adapter, client, store } = setup()
     store.setState({ accounts: [{ address }], activeAccount: 0 })
@@ -319,7 +368,7 @@ describe('turnkey', () => {
     expect(client.signPayloads).toMatchInlineSnapshot(`[]`)
   })
 
-  test('behavior: silent restore only reconnects persisted provider accounts', async () => {
+  test('behavior: silent restore uses persisted provider accounts', async () => {
     const { adapter, client, store } = setup()
     client.wallets = [
       {
@@ -347,7 +396,7 @@ describe('turnkey', () => {
     `)
   })
 
-  test('behavior: silent restore ignores non-Ethereum wallet accounts', async () => {
+  test('behavior: silent restore rejects connected accounts missing from Turnkey metadata', async () => {
     const { adapter, client, store } = setup()
     client.wallets = [
       {
@@ -367,9 +416,43 @@ describe('turnkey', () => {
         { address, data: '0x68656c6c6f' },
         { method: 'personal_sign', params: ['0x68656c6c6f', address] },
       ),
-    ).rejects.toMatchInlineSnapshot('[Provider.DisconnectedError: No Turnkey account connected.]')
+    ).rejects.toMatchInlineSnapshot(
+      '[RpcResponse.InternalError: Connected Turnkey account "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266" was not found in fetched Turnkey wallet accounts. Reconnect with Turnkey.]',
+    )
 
+    expect(client.fetchCalls).toMatchInlineSnapshot(`1`)
     expect(client.signPayloads).toMatchInlineSnapshot(`[]`)
+    expect(store.getState().accounts).toMatchInlineSnapshot(`
+      [
+        {
+          "address": "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
+        },
+      ]
+    `)
+  })
+
+  test('behavior: reconnecting refreshes wallet account metadata', async () => {
+    const { adapter, client, store } = setup()
+
+    await connect({ adapter, store })
+    client.wallets = [
+      {
+        accounts: [toWalletAccount(account), toWalletAccount(account_2)],
+      },
+    ]
+    await connect({ adapter, store })
+
+    await adapter.actions.signPersonalMessage(
+      { address, data: '0x68656c6c6f' },
+      { method: 'personal_sign', params: ['0x68656c6c6f', address] },
+    )
+
+    expect(client.fetchCalls).toMatchInlineSnapshot(`2`)
+    expect(client.signPayloads).toMatchInlineSnapshot(`
+      [
+        "0x50b2c43fd39106bafbba0da34fc430e1f91e3c96ea2acee2bc34119f92b37750",
+      ]
+    `)
   })
 
   test('behavior: expired sessions clear provider accounts', async () => {
@@ -404,8 +487,8 @@ describe('turnkey', () => {
   })
 
   test('error: signing an unconnected account fails', async () => {
-    const { adapter } = setup()
-    await adapter.actions.loadAccounts(undefined, { method: 'wallet_connect', params: undefined })
+    const { adapter, store } = setup()
+    await connect({ adapter, store })
 
     await expect(
       adapter.actions.signPersonalMessage(
@@ -474,13 +557,29 @@ function setup(options: setup.Options = {}) {
     getAccount: (() => {
       throw new Error('not implemented')
     }) as never,
-    getClient: (() => ({ chain: { id: 1 } })) as never,
+    getClient: (() => ({
+      chain: { id: 1 },
+      sendTransaction: async (parameters: unknown) => {
+        client.transactions.push(parameters)
+        return Hex.padLeft('0x1', 32)
+      },
+    })) as never,
     storage,
     store,
   })
   return { adapter, client, store }
 }
 
+async function connect(options: Pick<ReturnType<typeof setup>, 'adapter' | 'store'>) {
+  const { adapter, store } = options
+  const loaded = await adapter.actions.loadAccounts(undefined, {
+    method: 'wallet_connect',
+    params: undefined,
+  })
+  store.setState({ accounts: loaded.accounts, activeAccount: 0 })
+  return loaded
+}
+
 declare namespace setup {
   type Options = {
     createAccount?: boolean | undefined
@@ -502,6 +601,7 @@ function createClient(options: setup.Options = {}) {
     loadCalls: 0,
     signPayloads: [] as Hex.Hex[],
     signWith: [] as string[],
+    transactions: [] as unknown[],
     wallets: [{ accounts: [toWalletAccount(account)] }] as WalletShape[],
   }
   const client = {
@@ -529,6 +629,9 @@ function createClient(options: setup.Options = {}) {
     get signWith() {
       return state.signWith
     },
+    get transactions() {
+      return state.transactions
+    },
     get wallets() {
       return state.wallets
     },
@@ -566,6 +669,7 @@ function createClient(options: setup.Options = {}) {
     loadCalls: number
     signPayloads: Hex.Hex[]
     signWith: string[]
+    transactions: unknown[]
     wallets: WalletShape[]
   }
 

package/src/core/adapters/turnkey.ts

@@ -7,14 +7,14 @@ import {
   RpcResponse,
   Secp256k1,
 } from 'ox'
-import { KeyAuthorization } from 'ox/tempo'
 import { hashMessage, hashTypedData, isAddressEqual } from 'viem'
 import type { Address } from 'viem/accounts'
 import { prepareTransactionRequest } from 'viem/actions'
-import { Account as TempoAccount } from 'viem/tempo'
+import { Account as TempoAccount, Actions } from 'viem/tempo'
 
 import * as AccessKey from '../AccessKey.js'
 import * as Adapter from '../Adapter.js'
+import * as AccessKeyTransaction from '../internal/AccessKeyTransaction.js'
 import * as Store from '../Store.js'
 
 const turnkeySessionErrorCodes = new Set([
@@ -70,11 +70,11 @@ export function turnkey<const client extends turnkey.Client>(
 ): Adapter.Adapter {
   const { icon, name = 'Turnkey', rdns = 'com.turnkey', sessionSkewMs = 10_000 } = options
 
-  return Adapter.define({ icon, name, rdns }, ({ getAccount, getClient, store }) => {
+  return Adapter.define({ icon, name, rdns }, ({ getClient, store }) => {
     let turnkeyClient_promise: Promise<client> | undefined
     let expiry_timeout: ReturnType<typeof setTimeout> | undefined
     let restore_promise: Promise<void> | undefined
-    let walletAccounts: readonly turnkey.WalletAccount[] = []
+    let walletAccounts_cache: readonly turnkey.WalletAccount[] | undefined
 
     async function getTurnkeyClient(): Promise<client> {
       turnkeyClient_promise ??= (async () => {
@@ -135,6 +135,16 @@ export function turnkey<const client extends turnkey.Client>(
       )
     }
 
+    async function refreshWalletAccounts() {
+      walletAccounts_cache = await fetchWalletAccounts()
+      return walletAccounts_cache
+    }
+
+    async function getWalletAccounts() {
+      walletAccounts_cache ??= await fetchWalletAccounts()
+      return walletAccounts_cache
+    }
+
     function selectWalletAccounts(
       accounts: readonly turnkey.WalletAccount[],
       addresses: turnkey.AccountSelection,
@@ -158,7 +168,7 @@ export function turnkey<const client extends turnkey.Client>(
       if (expiry_timeout) clearTimeout(expiry_timeout)
       expiry_timeout = undefined
       restore_promise = undefined
-      walletAccounts = []
+      walletAccounts_cache = undefined
       store.setState({ accessKeys: [], accounts: [], activeAccount: 0 })
     }
 
@@ -185,7 +195,7 @@ export function turnkey<const client extends turnkey.Client>(
 
     async function restore() {
       await Store.waitForHydration(store)
-      if (walletAccounts.length > 0) return
+      if (walletAccounts_cache) return
       if (restore_promise) return await restore_promise
 
       restore_promise = (async () => {
@@ -196,21 +206,7 @@ export function turnkey<const client extends turnkey.Client>(
         const session = await getValidSession()
         if (!session) return
 
-        const restored = await fetchWalletAccounts()
-        walletAccounts = persisted
-          .map((account) =>
-            restored.find((walletAccount) =>
-              isAddressEqual(core_Address.from(walletAccount.address), account.address),
-            ),
-          )
-          .filter((account): account is turnkey.WalletAccount => !!account)
-
-        if (walletAccounts.length === 0) return
-
-        store.setState({
-          accounts: walletAccounts.map((account) => toStoreAccount(account)),
-          activeAccount: Math.min(state.activeAccount, walletAccounts.length - 1),
-        })
+        await refreshWalletAccounts()
       })()
 
       try {
@@ -225,24 +221,32 @@ export function turnkey<const client extends turnkey.Client>(
       if (!session) throw new ox_Provider.DisconnectedError({ message: 'Turnkey session expired.' })
     }
 
-    async function accountForSigning(address: Address | undefined) {
+    async function getTurnkeyAccount(address: Address | undefined) {
       await restore()
       await requireSession()
 
-      const address_ = address ?? store.getState().accounts[store.getState().activeAccount]?.address
-      if (!address_) throw new ox_Provider.DisconnectedError({ message: 'No accounts connected.' })
-
-      const account = walletAccounts.find((account) =>
-        isAddressEqual(core_Address.from(account.address), address_),
-      )
-      if (account) return account
+      const state = store.getState()
+      const address_ = address ?? state.accounts[state.activeAccount]?.address
+      if (!address_) throw new ox_Provider.DisconnectedError({ message: 'No active account.' })
 
-      if (walletAccounts.length === 0)
+      if (state.accounts.length === 0)
         throw new ox_Provider.DisconnectedError({
           message: 'No Turnkey account connected.',
         })
 
-      throw new ox_Provider.UnauthorizedError({ message: `Account "${address_}" not found.` })
+      const connected = state.accounts.some((account) => isAddressEqual(account.address, address_))
+      if (!connected)
+        throw new ox_Provider.UnauthorizedError({ message: `Account "${address_}" not found.` })
+
+      const find = (accounts: readonly turnkey.WalletAccount[]) =>
+        accounts.find((account) => isAddressEqual(core_Address.from(account.address), address_))
+
+      const account = find(await getWalletAccounts())
+      if (account) return toTempoAccount(account)
+
+      throw new RpcResponse.InternalError({
+        message: `Connected Turnkey account "${address_}" was not found in fetched Turnkey wallet accounts. Reconnect with Turnkey.`,
+      })
     }
 
     function signatureToHex(value: turnkey.SignatureResponse): Hex.Hex {
@@ -273,38 +277,8 @@ export function turnkey<const client extends turnkey.Client>(
       return signatureToHex(result)
     }
 
-    async function withAccessKey<result>(
-      options: {
-        address?: Address | undefined
-        calls?: Adapter.signTransaction.Parameters['calls']
-        chainId?: number | undefined
-      },
-      fn: (
-        account: TempoAccount.Account,
-        keyAuthorization?: KeyAuthorization.Signed,
-      ) => Promise<result>,
-    ): Promise<{ account: TempoAccount.Account; result: result } | undefined> {
-      const account = (() => {
-        try {
-          return getAccount({ ...options, signable: true })
-        } catch {
-          return undefined
-        }
-      })()
-      if (!account || account.source !== 'accessKey') return undefined
-
-      const keyAuthorization = AccessKey.getPending(account, { store })
-      try {
-        const result = await fn(account, keyAuthorization ?? undefined)
-        return { account, result }
-      } catch (error) {
-        AccessKey.invalidate(account, error, { store })
-        return undefined
-      }
-    }
-
     async function signTransaction(parameters: Adapter.signTransaction.Parameters) {
-      const account = toTempoAccount(await accountForSigning(parameters.from))
+      const account = await getTurnkeyAccount(parameters.from)
       const { feePayer, ...rest } = parameters
       const viemClient = getClient({
         chainId: parameters.chainId,
@@ -370,11 +344,11 @@ export function turnkey<const client extends turnkey.Client>(
                 },
               })
           await requireSession()
-          walletAccounts = selectWalletAccounts(await fetchWalletAccounts(), addresses)
+          const accounts = selectWalletAccounts(await refreshWalletAccounts(), addresses)
           restore_promise = undefined
 
           const digest = personalSign ? hashMessage(personalSign.message) : parameters.digest
-          const account = walletAccounts[0]
+          const account = accounts[0]
           const keyAuthorization = authorizeAccessKey
             ? account
               ? await AccessKey.authorize({
@@ -387,7 +361,7 @@ export function turnkey<const client extends turnkey.Client>(
             : undefined
 
           return {
-            accounts: walletAccounts.map((account, index) =>
+            accounts: accounts.map((account, index) =>
               toStoreAccount(account, index === 0 ? parameters.name : undefined),
             ),
             ...(personalSign ? { personalSign: { message: personalSign.message } } : {}),
@@ -414,11 +388,11 @@ export function turnkey<const client extends turnkey.Client>(
           const turnkeyClient = await getTurnkeyClient()
           const addresses = await options.loadAccounts({ client: turnkeyClient, parameters })
           await requireSession()
-          walletAccounts = selectWalletAccounts(await fetchWalletAccounts(), addresses)
+          const accounts = selectWalletAccounts(await refreshWalletAccounts(), addresses)
           restore_promise = undefined
 
           const digest = personalSign ? hashMessage(personalSign.message) : parameters?.digest
-          const account = walletAccounts[0]
+          const account = accounts[0]
           const keyAuthorization =
             authorizeAccessKey && account
               ? await AccessKey.authorize({
@@ -430,7 +404,7 @@ export function turnkey<const client extends turnkey.Client>(
               : undefined
 
           return {
-            accounts: walletAccounts.map((account) => toStoreAccount(account)),
+            accounts: accounts.map((account) => toStoreAccount(account)),
             ...(personalSign ? { personalSign: { message: personalSign.message } } : {}),
             ...(keyAuthorization ? { keyAuthorization } : {}),
             signature:
@@ -444,130 +418,139 @@ export function turnkey<const client extends turnkey.Client>(
           }
         },
         async authorizeAccessKey(parameters) {
-          const account = await accountForSigning(undefined)
+          const account = await getTurnkeyAccount(undefined)
           const keyAuthorization = await AccessKey.authorize({
-            account: toTempoAccount(account),
+            account,
             chainId: getClient().chain.id,
             parameters,
             store,
           })
-          return { keyAuthorization, rootAddress: core_Address.from(account.address) }
+          return { keyAuthorization, rootAddress: account.address }
+        },
+        async revokeAccessKey(parameters) {
+          const account = await getTurnkeyAccount(parameters.address)
+          try {
+            await Actions.accessKey.revoke(getClient(), {
+              account,
+              accessKey: parameters.accessKeyAddress,
+            })
+          } catch (error) {
+            if (!AccessKey.isUnavailableError(error)) throw error
+          }
+          AccessKey.remove({
+            accessKey: parameters.accessKeyAddress,
+            account: account.address,
+            chainId: store.getState().chainId,
+            store,
+          })
         },
         async signPersonalMessage(parameters) {
-          const turnkeyClient = await getTurnkeyClient()
-          const account = await accountForSigning(parameters.address)
-          return await signPayload({
-            payload: hashMessage({ raw: parameters.data }),
-            turnkeyClient,
-            walletAccount: account,
+          return await (
+            await getTurnkeyAccount(parameters.address)
+          ).sign({
+            hash: hashMessage({ raw: parameters.data }),
           })
         },
         async signTransaction(parameters) {
-          const result = await withAccessKey(
-            { address: parameters.from, calls: parameters.calls, chainId: parameters.chainId },
-            async (account, keyAuthorization) => {
-              const { feePayer, ...rest } = parameters
-              const viemClient = getClient({
-                chainId: parameters.chainId,
-                feePayer: feePayer === true ? undefined : feePayer,
+          const { feePayer, ...rest } = parameters
+          const viemClient = getClient({
+            chainId: parameters.chainId,
+            feePayer: feePayer === true ? undefined : feePayer,
+          })
+          const state = store.getState()
+          const address = parameters.from ?? state.accounts[state.activeAccount]?.address
+          const transaction = address
+            ? await AccessKeyTransaction.create({
+                address,
+                calls: parameters.calls,
+                chainId: parameters.chainId ?? state.chainId,
+                client: viemClient,
+                store,
               })
-              const prepared = await prepareTransactionRequest(viemClient, {
-                account,
+            : undefined
+          if (transaction) {
+            try {
+              const prepared = await transaction.prepare({
                 ...rest,
                 ...(feePayer ? { feePayer: true } : {}),
-                keyAuthorization,
-                type: 'tempo',
-              } as never)
-              return await account.signTransaction(prepared as never)
-            },
-          )
-          if (result !== undefined) return result.result
+              })
+              return await prepared.sign()
+            } catch {}
+          }
           return await signTransaction(parameters)
         },
         async signTypedData(parameters) {
-          const turnkeyClient = await getTurnkeyClient()
-          const account = await accountForSigning(parameters.address)
           const typedData = JSON.parse(parameters.data) as {
             domain: Record<string, unknown>
             message: Record<string, unknown>
             primaryType: string
             types: Record<string, unknown>
           }
-          return await signPayload({
-            payload: hashTypedData(typedData as never),
-            turnkeyClient,
-            walletAccount: account,
+          return await (
+            await getTurnkeyAccount(parameters.address)
+          ).sign({
+            hash: hashTypedData(typedData as never),
           })
         },
         async sendTransaction(parameters) {
-          const result = await withAccessKey(
-            { address: parameters.from, calls: parameters.calls, chainId: parameters.chainId },
-            async (account, keyAuthorization) => {
-              const { feePayer, ...rest } = parameters
-              const viemClient = getClient({
-                chainId: parameters.chainId,
-                feePayer: feePayer === true ? undefined : feePayer,
+          const { feePayer, ...rest } = parameters
+          const viemClient = getClient({
+            chainId: parameters.chainId,
+            feePayer: feePayer === true ? undefined : feePayer,
+          })
+          const state = store.getState()
+          const address = parameters.from ?? state.accounts[state.activeAccount]?.address
+          const transaction = address
+            ? await AccessKeyTransaction.create({
+                address,
+                calls: parameters.calls,
+                chainId: parameters.chainId ?? state.chainId,
+                client: viemClient,
+                store,
               })
-              const prepared = await prepareTransactionRequest(viemClient, {
-                account,
+            : undefined
+          if (transaction) {
+            try {
+              const prepared = await transaction.prepare({
                 ...rest,
                 ...(feePayer ? { feePayer: true } : {}),
-                keyAuthorization,
-                type: 'tempo',
-              } as never)
-              const signed = await account.signTransaction(prepared as never)
-              return await viemClient.request({
-                method: 'eth_sendRawTransaction' as never,
-                params: [signed],
               })
-            },
-          )
-          if (result !== undefined) {
-            AccessKey.removePending(result.account, { store })
-            return result.result
+              return await prepared.send()
+            } catch {}
           }
           const signed = await signTransaction(parameters)
-          const viemClient = getClient({
-            chainId: parameters.chainId,
-            feePayer: parameters.feePayer === true ? undefined : parameters.feePayer,
-          })
           return await viemClient.request({
             method: 'eth_sendRawTransaction' as never,
             params: [signed],
           })
         },
         async sendTransactionSync(parameters) {
-          const result = await withAccessKey(
-            { address: parameters.from, calls: parameters.calls, chainId: parameters.chainId },
-            async (account, keyAuthorization) => {
-              const { feePayer, ...rest } = parameters
-              const viemClient = getClient({
-                chainId: parameters.chainId,
-                feePayer: feePayer === true ? undefined : feePayer,
+          const { feePayer, ...rest } = parameters
+          const viemClient = getClient({
+            chainId: parameters.chainId,
+            feePayer: feePayer === true ? undefined : feePayer,
+          })
+          const state = store.getState()
+          const address = parameters.from ?? state.accounts[state.activeAccount]?.address
+          const transaction = address
+            ? await AccessKeyTransaction.create({
+                address,
+                calls: parameters.calls,
+                chainId: parameters.chainId ?? state.chainId,
+                client: viemClient,
+                store,
               })
-              const prepared = await prepareTransactionRequest(viemClient, {
-                account,
+            : undefined
+          if (transaction) {
+            try {
+              const prepared = await transaction.prepare({
                 ...rest,
                 ...(feePayer ? { feePayer: true } : {}),
-                keyAuthorization,
-                type: 'tempo',
-              } as never)
-              const signed = await account.signTransaction(prepared as never)
-              return await viemClient.request({
-                method: 'eth_sendRawTransactionSync' as never,
-                params: [signed],
               })
-            },
-          )
-          if (result !== undefined) {
-            AccessKey.removePending(result.account, { store })
-            return result.result
+              return await prepared.sendSync()
+            } catch {}
           }
           const signed = await signTransaction(parameters)
-          const viemClient = getClient({
-            chainId: parameters.chainId,
-            feePayer: parameters.feePayer === true ? undefined : parameters.feePayer,
-          })
           return await viemClient.request({
             method: 'eth_sendRawTransactionSync' as never,
             params: [signed],