accounts 0.16.0 → 0.16.2

package/src/core/WebAuthnCeremony.ts

@@ -54,12 +54,10 @@ export declare namespace verifyRegistration {
 
 export declare namespace getAuthenticationOptions {
   type Parameters = {
-    /** Credential IDs to allow (restricts which credentials can be used). */
-    allowCredentialIds?: readonly string[] | undefined
     /** Challenge to use. */
     challenge?: `0x${string}` | undefined
-    /** Credential ID to restrict authentication to a specific credential. */
-    credentialId?: string | undefined
+    /** Credential ID or IDs to restrict authentication to. */
+    credentialId?: string | readonly string[] | undefined
     /** Mediation hint for passkey autofill / conditional UI. */
     mediation?: 'conditional' | 'optional' | 'required' | 'silent' | undefined
   }
@@ -124,10 +122,15 @@ export function local(options: local.Options = {}): WebAuthnCeremony {
     },
 
     async getAuthenticationOptions(parameters = {}) {
-      const { allowCredentialIds, challenge, credentialId } = parameters
+      const { challenge, credentialId } = parameters
       const { options } = Authentication.getOptions({
         challenge,
-        credentialId: (allowCredentialIds as string[] | undefined) ?? credentialId,
+        credentialId:
+          typeof credentialId === 'string'
+            ? credentialId
+            : credentialId
+              ? [...credentialId]
+              : undefined,
         rpId,
       })
       return { options }
@@ -189,8 +192,8 @@ export function server(options: server.Options): WebAuthnCeremony {
     },
 
     async getAuthenticationOptions(parameters = {}) {
-      const { allowCredentialIds, challenge, credentialId, mediation } = parameters
-      return request('/login/options', { allowCredentialIds, challenge, credentialId, mediation })
+      const { challenge, credentialId, mediation } = parameters
+      return request('/login/options', { challenge, credentialId, mediation })
     },
 
     async verifyAuthentication(response) {

package/src/core/adapters/webAuthn.ts

@@ -77,7 +77,7 @@ export function webAuthn(options: webAuthn.Options = {}): Adapter.Adapter {
         }
       },
       async loadAccounts(parameters = {}) {
-        const { selectAccount, digest } = parameters
+        const { digest, selectAccount } = parameters
 
         const credentialId = selectAccount
           ? undefined

package/src/core/mppx.localnet.test.ts

@@ -25,6 +25,19 @@ const payment = ServerMppx.create({
   secretKey: 'test-secret-key-test-secret-key-32',
 })
 
+const sponsoredPayment = ServerMppx.create({
+  methods: [
+    tempo({
+      account: accounts[1]!,
+      currency: Addresses.pathUsd,
+      feePayer: accounts[0]!,
+      getClient: () => client,
+    }),
+  ],
+  realm: 'mppx-sponsored-test',
+  secretKey: 'sponsored-test-secret-key-32-bytes',
+})
+
 let server: Server
 
 beforeAll(async () => {
@@ -90,6 +103,44 @@ describe('mppx integration', () => {
     expect(res.status).toMatchInlineSnapshot(`200`)
   })
 
+  test('pull mode preserves server-sponsored transactions', async () => {
+    const sponsoredServer = await createServer(async (req, res) => {
+      const result = await ServerMppx.toNodeListener(sponsoredPayment.charge({ amount: '1' }))(
+        req,
+        res,
+      )
+      if (result.status === 402) return
+      res.writeHead(200)
+      res.end()
+    })
+
+    try {
+      const provider = Provider.create({
+        adapter: headlessWebAuthn(),
+        chains: [chain],
+        mpp: false,
+      })
+      const address = await connect(provider)
+      await fund(address, '1')
+
+      const mppx = ClientMppx.create({
+        methods: [
+          clientTempo({
+            account: provider.getAccount(),
+            ...provider.getMppxParameters(),
+            mode: 'pull',
+          }),
+        ],
+        polyfill: false,
+      })
+
+      const res = await mppx.fetch(`${sponsoredServer.url}/fortune`)
+      expect(res.status).toMatchInlineSnapshot(`200`)
+    } finally {
+      await sponsoredServer.closeAsync()
+    }
+  })
+
   test('mppx global front door uses provider access keys', async () => {
     const provider = Provider.create({
       adapter: headlessWebAuthn(),
@@ -267,12 +318,12 @@ async function connect(provider: ReturnType<typeof Provider.create>) {
   return register.accounts[0]!.address
 }
 
-async function fund(address: `0x${string}`) {
+async function fund(address: `0x${string}`, amount = '10') {
   await Actions.token.transferSync(client, {
     account: accounts[0]!,
     feeToken: Addresses.pathUsd,
     to: address,
     token: Addresses.pathUsd,
-    amount: parseUnits('10', 6),
+    amount: parseUnits(amount, 6),
   })
 }

package/src/core/zod/rpc.test.ts

@@ -132,6 +132,25 @@ describe('transactionRequest.keyAuthorization', () => {
   })
 })
 
+describe('wallet_connect.capabilities.request: credentials', () => {
+  test('accepts multiple credential IDs for login', () => {
+    expect(
+      z.parse(Rpc.wallet_connect.capabilities.request, {
+        credentialId: ['cred-1', 'cred-2'],
+        method: 'login',
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "credentialId": [
+          "cred-1",
+          "cred-2",
+        ],
+        "method": "login",
+      }
+    `)
+  })
+})
+
 describe('wallet_connect.capabilities.request: auth', () => {
   test('accepts string shorthand', () => {
     expect(

package/src/core/zod/rpc.ts

@@ -710,7 +710,7 @@ export namespace wallet_connect {
         }),
         z.object({
           digest: z.optional(u.hex()),
-          credentialId: z.optional(z.string()),
+          credentialId: z.optional(z.union([z.string(), z.array(z.string())])),
           authorizeAccessKey,
           auth,
           identity,
@@ -829,7 +829,7 @@ export namespace wallet_connect_strict {
         }),
         z.object({
           digest: z.optional(u.hex()),
-          credentialId: z.optional(z.string()),
+          credentialId: z.optional(z.union([z.string(), z.array(z.string())])),
           authorizeAccessKey,
           auth,
           identity,

package/src/server/internal/handlers/utils.test.ts

@@ -0,0 +1,53 @@
+import { RpcRequest } from 'ox'
+import { describe, expect, test } from 'vp/test'
+
+import * as Utils from './utils.js'
+
+const request = RpcRequest.from({ id: 1, method: 'eth_sendRawTransaction', params: ['0x00'] })
+
+describe('rpcErrorJson', () => {
+  test('maps upstream expired transactions to a transaction-rejected error', () => {
+    const error = {
+      cause: {
+        code: -32603,
+        message: 'Revm error: transaction expired',
+      },
+    }
+
+    expect(Utils.rpcErrorJson(request, error)).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": -32003,
+          "data": {
+            "code": "transaction_expired",
+          },
+          "message": "Transaction expired.",
+        },
+        "id": 1,
+        "jsonrpc": "2.0",
+      }
+    `)
+  })
+
+  test('preserves unrelated upstream internal errors', () => {
+    const error = {
+      code: -32603,
+      data: { reason: 'database unavailable' },
+      message: 'Revm error: database unavailable',
+    }
+
+    expect(Utils.rpcErrorJson(request, error)).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": -32603,
+          "data": {
+            "reason": "database unavailable",
+          },
+          "message": "Revm error: database unavailable",
+        },
+        "id": 1,
+        "jsonrpc": "2.0",
+      }
+    `)
+  })
+})

package/src/server/internal/handlers/utils.ts

@@ -97,6 +97,22 @@ export function rpcErrorJson(request: RpcRequest.RpcRequest, error: unknown) {
     )
 
   const inner = resolveError(error)
+  if (
+    inner.code === RpcResponse.InternalError.code &&
+    inner.message !== undefined &&
+    /^Revm error: transaction expired\.?$/.test(inner.message)
+  )
+    return RpcResponse.from(
+      {
+        error: {
+          code: -32003,
+          data: { code: 'transaction_expired' },
+          message: 'Transaction expired.',
+        },
+      },
+      { request },
+    )
+
   const message = inner.message ?? (error as Error).message
   const code = inner.code ?? -32603
   const data = inner.data

package/src/server/internal/handlers/webAuthn.test.ts

@@ -1,10 +1,14 @@
+import { vi } from 'vitest'
 import { afterAll, afterEach, beforeAll, describe, expect, test } from 'vp/test'
+import { Registration } from 'webauthx/server'
 
 import { createServer, type Server } from '../../../../test/utils.js'
 import * as WebAuthnCeremony from '../../../core/WebAuthnCeremony.js'
 import * as Kv from '../../Kv.js'
 import { type SessionPayload, webAuthn } from './webAuthn.js'
 
+vi.mock('webauthx/server', { spy: true })
+
 let server: Server
 let ceremony: WebAuthnCeremony.WebAuthnCeremony
 
@@ -52,6 +56,25 @@ describe('POST /login/options', () => {
     const { options: b } = await ceremony.getAuthenticationOptions()
     expect(a.publicKey!.challenge).not.toBe(b.publicKey!.challenge)
   })
+
+  test('behavior: restricts authentication to multiple credentials', async () => {
+    const { options } = await ceremony.getAuthenticationOptions({
+      credentialId: ['Y3JlZC0x', 'Y3JlZC0y'],
+    })
+
+    expect(options.publicKey?.allowCredentials).toMatchInlineSnapshot(`
+      [
+        {
+          "id": "Y3JlZC0x",
+          "type": "public-key",
+        },
+        {
+          "id": "Y3JlZC0y",
+          "type": "public-key",
+        },
+      ]
+    `)
+  })
 })
 
 describe('POST /register', () => {
@@ -152,6 +175,59 @@ describe('hooks', () => {
     await hookServer.closeAsync()
   })
 
+  test('behavior: onRegister rejection removes the credential', async () => {
+    const kv = Kv.memory()
+    await kv.set('challenge:0x01', { created: Date.now(), name: 'Test' })
+    const publicKey =
+      '0x04ab891400140fc4f8e941ce0ff90e419de9470acaca613bbd717a4775435031a7d884318e919fd3b3e5a631d866d8a380b44063e70f0c381ee16e0652f7f97554'
+    vi.mocked(Registration.verify).mockReturnValueOnce({
+      aaguid: 'fbfc3007-154e-4ecc-8c0b-6e020557d7bd',
+      credential: { publicKey },
+    } as never)
+    const hookServer = await createServer(
+      webAuthn({
+        kv,
+        origin: 'http://localhost',
+        rpId: 'localhost',
+        onRegister() {
+          throw new Error('Authenticator not allowed')
+        },
+      }).listener,
+    )
+
+    try {
+      const clientDataJSON = 'eyJjaGFsbGVuZ2UiOiJBUSJ9'
+      const response = await fetch(`${hookServer.url}/register`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          attestationObject: 'AA',
+          clientDataJSON,
+          id: 'credential',
+          publicKey,
+          raw: {
+            authenticatorAttachment: null,
+            id: 'credential',
+            rawId: 'Y3JlZGVudGlhbA',
+            response: { clientDataJSON },
+            type: 'public-key',
+          },
+        }),
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`400`)
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": "Authenticator not allowed",
+        }
+      `)
+      expect(await kv.get('credential:credential')).toBeUndefined()
+      expect(await kv.get('challenge:0x01')).toBeUndefined()
+    } finally {
+      await hookServer.closeAsync()
+    }
+  })
+
   test('behavior: onAuthenticate error does not call hook', async () => {
     let called = false
     const hookServer = await createServer(

package/src/server/internal/handlers/webAuthn.ts

@@ -152,6 +152,7 @@ export function webAuthn(options: webAuthn.Options): webAuthn.ReturnType {
         rpId,
       })
 
+      const { aaguid } = result
       const { publicKey } = result.credential
       const credentialId = credential.id
       // Base64url-encode the userId we registered with so it matches
@@ -160,22 +161,29 @@ export function webAuthn(options: webAuthn.Options): webAuthn.ReturnType {
       const userId = stored.userId
         ? Base64.fromBytes(Bytes.fromString(stored.userId), { pad: false, url: true })
         : undefined
-      const created = await createCredential(kv, `credential:${credentialId}`, {
+      const key = `credential:${credentialId}`
+      const created = await createCredential(kv, key, {
         publicKey,
         ...(userId ? { userId } : {}),
       })
       if (!created) throw new Error('Credential already exists')
 
-      const [hook] = await Promise.all([
-        onRegister?.({
-          credentialId,
-          name: stored.name,
-          publicKey,
-          request: c.req.raw,
-          ...(userId ? { userId } : {}),
-        }),
-        kv.delete(`challenge:${challenge}`),
-      ])
+      const hook = await (async () => {
+        try {
+          return await onRegister?.({
+            ...(aaguid ? { aaguid } : {}),
+            credentialId,
+            name: stored.name,
+            publicKey,
+            request: c.req.raw,
+            ...(userId ? { userId } : {}),
+          })
+        } catch (error) {
+          await Promise.all([kv.delete(key), kv.delete(`challenge:${challenge}`)])
+          throw error
+        }
+      })()
+      await kv.delete(`challenge:${challenge}`)
 
       // Successful registration is also a successful authentication for
       // the freshly-minted credential. Issue a session here so the
@@ -231,13 +239,13 @@ export function webAuthn(options: webAuthn.Options): webAuthn.ReturnType {
       } = body as {
         allowCredentialIds?: string[]
         challenge?: Hex.Hex
-        credentialId?: string
+        credentialId?: string | string[]
         mediation?: string
       }
 
       const { challenge, options: authOptions } = Authentication.getOptions({
         challenge: requestChallenge,
-        credentialId: allowCredentialIds ?? credentialId,
+        credentialId: credentialId ?? allowCredentialIds,
         rpId,
       })
       const options = mediation ? { ...authOptions, mediation } : authOptions
@@ -414,8 +422,14 @@ export declare namespace webAuthn {
      * best-effort `get` then `set` storage.
      */
     kv: Kv.Kv
-    /** Called after a successful registration. The returned response is merged onto the default JSON response. */
+    /**
+     * Called after a successful registration. The returned response is merged
+     * onto the default JSON response. Throwing rejects the request and removes
+     * the newly stored credential.
+     */
     onRegister?: (parameters: {
+      /** Authenticator model identifier, when the authenticator reports one. */
+      aaguid?: string | undefined
       credentialId: string
       /** The name provided during `/register/options` (e.g. user email). */
       name: string