accounts 0.18.4 → 0.18.5

package/src/core/Client.test.ts

@@ -1,6 +1,10 @@
+import { Secp256k1 } from 'ox'
+import { TxEnvelopeTempo } from 'ox/tempo'
 import { custom, http } from 'viem'
+import { privateKeyToAccount } from 'viem/accounts'
+import { Transaction } from 'viem/tempo'
 import { tempo, tempoModerato } from 'viem/tempo/chains'
-import { describe, expect, test } from 'vp/test'
+import { afterEach, describe, expect, test, vi } from 'vp/test'
 
 import { secp256k1 } from '../../test/adapters.js'
 import * as Client from './Client.js'
@@ -252,6 +256,37 @@ describe('providerTransport', () => {
 })
 
 describe('feePayerTransport', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  const sender = privateKeyToAccount(
+    '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+  )
+  const feePayerPrivateKey = '0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
+
+  async function sponsoredTransaction(data: `0x${string}`) {
+    const requested = await sender.signTransaction(
+      {
+        calls: [{ data, to: '0x20c0000000000000000000000000000000000000' }],
+        chainId: tempo.id,
+        feePayer: true,
+        gas: 100_000n,
+        maxFeePerGas: 2n,
+        maxPriorityFeePerGas: 1n,
+        nonce: 1,
+      } as never,
+      { serializer: Transaction.serialize },
+    )
+    const envelope = TxEnvelopeTempo.deserialize(requested as TxEnvelopeTempo.Serialized)
+    const feePayerSignature = Secp256k1.sign({
+      payload: TxEnvelopeTempo.getFeePayerSignPayload(envelope, { sender: envelope.from! }),
+      privateKey: feePayerPrivateKey,
+    })
+    return {
+      requested,
+      signed: TxEnvelopeTempo.serialize(envelope, { feePayerSignature }),
+    }
+  }
+
   test('behavior: passes through unrelated methods to the base transport', async () => {
     const store = setup()
     const baseRequests: { method: string; params?: unknown }[] = []
@@ -337,4 +372,121 @@ describe('feePayerTransport', () => {
       ]
     `)
   })
+
+  test('behavior: accepts a fee payer signature for the requested transaction', async () => {
+    const store = setup()
+    const { requested, signed } = await sponsoredTransaction('0x1234')
+    vi.stubGlobal('fetch', async (_input: string | URL, init?: RequestInit) => {
+      const body = JSON.parse(String(init?.body)) as { id: number }
+      return Response.json({ id: body.id, jsonrpc: '2.0', result: signed })
+    })
+    const baseRequests: { method: string; params?: unknown }[] = []
+    const hash = `0x${'11'.repeat(32)}` as `0x${string}`
+    const client = Client.fromChainId(tempo.id, {
+      chains: [tempo],
+      feePayer: 'https://relay.example.com',
+      store,
+      transports: {
+        [tempo.id]: custom({
+          async request({ method, params }) {
+            baseRequests.push({ method, params })
+            return hash
+          },
+        }),
+      },
+    })
+
+    const result = await client.request({
+      method: 'eth_sendRawTransaction',
+      params: [requested],
+    })
+
+    expect(result).toMatchInlineSnapshot(
+      `"0x1111111111111111111111111111111111111111111111111111111111111111"`,
+    )
+    expect(baseRequests.map((request) => request.method)).toMatchInlineSnapshot(`
+      [
+        "eth_sendRawTransaction",
+      ]
+    `)
+    const sent = baseRequests[0]?.params as readonly unknown[] | undefined
+    expect(sent?.[0]).toBe(signed)
+  })
+
+  test('error: rejects a fee payer signature for a different transaction', async () => {
+    const store = setup()
+    const { requested } = await sponsoredTransaction('0x1234')
+    const { signed } = await sponsoredTransaction('0x5678')
+    vi.stubGlobal('fetch', async (_input: string | URL, init?: RequestInit) => {
+      const body = JSON.parse(String(init?.body)) as { id: number }
+      return Response.json({ id: body.id, jsonrpc: '2.0', result: signed })
+    })
+    const baseRequests: unknown[] = []
+    const client = Client.fromChainId(tempo.id, {
+      chains: [tempo],
+      feePayer: 'https://relay.example.com',
+      store,
+      transports: {
+        [tempo.id]: custom({
+          async request(request) {
+            baseRequests.push(request)
+            return null
+          },
+        }),
+      },
+    })
+
+    await expect(
+      client.request({ method: 'eth_sendRawTransaction', params: [requested] }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Error: Fee payer changed the requested transaction intent.]`,
+    )
+    expect(baseRequests).toMatchInlineSnapshot(`[]`)
+  })
+
+  test('error: rejects a filled transaction that changes the requested call', async () => {
+    const store = setup()
+    const request = {
+      calls: [{ data: '0x1234', to: '0x20c0000000000000000000000000000000000000', value: '0x' }],
+      chainId: '0x1079',
+      feePayer: true,
+      from: sender.address,
+      type: '0x76',
+    } as const
+    vi.stubGlobal('fetch', async (_input: string | URL, init?: RequestInit) => {
+      const body = JSON.parse(String(init?.body)) as { id: number }
+      return Response.json({
+        id: body.id,
+        jsonrpc: '2.0',
+        result: {
+          raw: '0x',
+          tx: {
+            ...request,
+            calls: [{ ...request.calls[0], data: '0x5678' }],
+          },
+        },
+      })
+    })
+    const baseRequests: unknown[] = []
+    const client = Client.fromChainId(tempo.id, {
+      chains: [tempo],
+      feePayer: 'https://relay.example.com',
+      store,
+      transports: {
+        [tempo.id]: custom({
+          async request(request) {
+            baseRequests.push(request)
+            return null
+          },
+        }),
+      },
+    })
+
+    await expect(
+      client.request({ method: 'eth_fillTransaction' as never, params: [request] as never }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Error: Fee payer changed the requested transaction intent.]`,
+    )
+    expect(baseRequests).toMatchInlineSnapshot(`[]`)
+  })
 })

package/src/core/Client.ts

@@ -1,4 +1,5 @@
 import { type Provider as ox_Provider } from 'ox'
+import { TxEnvelopeTempo } from 'ox/tempo'
 import {
   type Chain,
   createClient,
@@ -163,11 +164,14 @@ function feePayerTransport(
             typeof request === 'object' &&
             'feePayer' in request &&
             (request.feePayer === true || typeof request.feePayer === 'string')
-          )
-            return sponsor.request({
+          ) {
+            const response = await sponsor.request({
               method,
               params: [{ ...request, feePayer: true }],
             })
+            assertFilledTransactionIntent(request, response)
+            return response
+          }
         }
 
         if (method === 'eth_sendRawTransaction' || method === 'eth_sendRawTransactionSync') {
@@ -182,6 +186,7 @@ function feePayerTransport(
                 method: 'eth_signRawTransaction',
                 params: [serialized],
               })
+              assertSignedTransactionIntent(serialized, signed)
               return await baseTransport.request({ method, params: [signed] })
             }
           }
@@ -192,3 +197,69 @@ function feePayerTransport(
     } as ReturnType<Transport>
   }
 }
+
+function assertFilledTransactionIntent(request: Record<string, unknown>, response: unknown) {
+  if (!isObject(response) || !isObject(response.tx))
+    throw new Error('Fee payer returned an invalid filled transaction.')
+
+  const transaction = response.tx
+  if (
+    (request.from !== undefined && !sameAddress(request.from, transaction.from)) ||
+    (request.chainId !== undefined && !sameQuantity(request.chainId, transaction.chainId)) ||
+    (request.calls !== undefined && !sameCalls(request.calls, transaction.calls))
+  )
+    throw new Error('Fee payer changed the requested transaction intent.')
+}
+
+function assertSignedTransactionIntent(serialized: string, signed: unknown) {
+  if (typeof signed !== 'string' || (!signed.startsWith('0x76') && !signed.startsWith('0x78')))
+    throw new Error('Fee payer returned an invalid signed transaction.')
+
+  const requested = TxEnvelopeTempo.deserialize(serialized as TxEnvelopeTempo.Serialized)
+  const transaction = TxEnvelopeTempo.deserialize(signed as TxEnvelopeTempo.Serialized)
+  if (
+    !transaction.feePayerSignature ||
+    !sameAddress(requested.from, transaction.from) ||
+    TxEnvelopeTempo.getSignPayload(requested) !== TxEnvelopeTempo.getSignPayload(transaction)
+  )
+    throw new Error('Fee payer changed the requested transaction intent.')
+}
+
+function sameCalls(a: unknown, b: unknown) {
+  if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false
+  return a.every((call, index) => {
+    const other = b[index]
+    return (
+      isObject(call) &&
+      isObject(other) &&
+      sameAddress(call.to, other.to) &&
+      sameQuantity(call.value, other.value) &&
+      sameHex(call.data, other.data)
+    )
+  })
+}
+
+function sameAddress(a: unknown, b: unknown) {
+  if (a === undefined && b === undefined) return true
+  return typeof a === 'string' && typeof b === 'string' && a.toLowerCase() === b.toLowerCase()
+}
+
+function sameHex(a: unknown, b: unknown) {
+  const normalize = (value: unknown) =>
+    typeof value === 'string' ? value.toLowerCase() : value === undefined ? '0x' : undefined
+  return normalize(a) === normalize(b)
+}
+
+function sameQuantity(a: unknown, b: unknown) {
+  const normalize = (value: unknown) => {
+    if (value === undefined || value === null || value === '0x') return 0n
+    if (typeof value === 'bigint') return value
+    if (typeof value === 'number' || typeof value === 'string') return BigInt(value)
+    return undefined
+  }
+  return normalize(a) === normalize(b)
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}

package/src/core/Provider.localnet.test.ts

@@ -11,6 +11,9 @@ import {
 } from 'viem'
 import {
   getBalance,
+  getBlockNumber,
+  getLogs,
+  getTransactionReceipt,
   sendCalls,
   sendTransactionSync,
   signMessage,
@@ -2192,6 +2195,66 @@ describe.each(adapters)('$name', ({ adapter, name }: (typeof adapters)[number])
   })
 
   describe('wallet_revokeAccessKey', () => {
+    test('error: rejects an authorization for a different access key', async () => {
+      const provider = Provider.create({ adapter: adapter(), chains: [chain] })
+      await connect(provider)
+
+      const connected = (await provider.request({ method: 'eth_accounts' }))[0]!
+      const first = await provider.request({
+        method: 'wallet_authorizeAccessKey',
+        params: [{ expiry: Expiry.days(1) }],
+      })
+      const second = await provider.request({
+        method: 'wallet_authorizeAccessKey',
+        params: [{ expiry: Expiry.days(1) }],
+      })
+
+      await expect(
+        provider.request({
+          method: 'wallet_revokeAccessKey',
+          params: [
+            {
+              address: connected,
+              accessKeyAddress: first.keyAuthorization.address!,
+              keyAuthorization: second.keyAuthorization,
+            },
+          ],
+        }),
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `[RpcResponse.InvalidParamsError: \`keyAuthorization\` must authorize \`accessKeyAddress\`.]`,
+      )
+    })
+
+    test('behavior: atomically authorizes and revokes an unpublished access key', async () => {
+      const provider = Provider.create({ adapter: adapter(), chains: [chain] })
+      await connect(provider)
+
+      const connected = (await provider.request({ method: 'eth_accounts' }))[0]!
+      await fund(connected)
+
+      const { keyAuthorization } = await provider.request({
+        method: 'wallet_authorizeAccessKey',
+        params: [{ expiry: Expiry.days(1) }],
+      })
+
+      await provider.request({
+        method: 'wallet_revokeAccessKey',
+        params: [
+          {
+            address: connected,
+            accessKeyAddress: keyAuthorization.address!,
+            keyAuthorization,
+          },
+        ],
+      })
+
+      const metadata = await Actions.accessKey.getMetadata(getClient(), {
+        account: connected,
+        accessKey: keyAuthorization.address!,
+      })
+      expect(metadata.isRevoked).toMatchInlineSnapshot(`true`)
+    })
+
     test('default: revokes a granted access key on-chain', async () => {
       const provider = Provider.create({ adapter: adapter(), chains: [chain] })
       await connect(provider)
@@ -3232,6 +3295,57 @@ describe.each(adapters)('$name', ({ adapter, name }: (typeof adapters)[number])
       expect((result.tx as { feePayerSignature?: unknown }).feePayerSignature).toBeDefined()
     })
 
+    test('behavior: feePayer URL sponsors wallet_revokeAccessKey', async () => {
+      const provider = Provider.create({ adapter: adapter(), chains: [chain] })
+      const connected = await connect(provider)
+      await fund(connected)
+      const { keyAuthorization } = await provider.request({
+        method: 'wallet_authorizeAccessKey',
+        params: [{ expiry: Expiry.days(1) }],
+      })
+      await provider.request({
+        method: 'eth_sendTransactionSync',
+        params: [{ calls: [transferCall] }],
+      })
+
+      const rpc = getClient()
+      const blockNumber = await getBlockNumber(rpc)
+
+      await provider.request({
+        method: 'wallet_revokeAccessKey',
+        params: [
+          {
+            accessKeyAddress: keyAuthorization.address!,
+            address: connected,
+            feePayer: server.url,
+          },
+        ],
+      })
+
+      const logs = await getLogs(rpc, {
+        address: Addresses.accountKeychain,
+        fromBlock: blockNumber,
+        toBlock: 'latest',
+      })
+      const event = Actions.accessKey.revoke.extractEvent(logs)
+      const receipt = await getTransactionReceipt(rpc, { hash: event.transactionHash })
+      const metadata = await Actions.accessKey.getMetadata(rpc, {
+        account: connected,
+        accessKey: keyAuthorization.address!,
+      })
+      expect({
+        feePayer: receipt.feePayer,
+        isRevoked: metadata.isRevoked,
+        status: receipt.status,
+      }).toMatchInlineSnapshot(`
+        {
+          "feePayer": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
+          "isRevoked": true,
+          "status": "success",
+        }
+      `)
+    })
+
     test('behavior: feePayer: true uses default from Provider.create', async () => {
       const provider = Provider.create({
         adapter: adapter({ feePayer: server.url }),

package/src/core/Provider.ts

@@ -558,28 +558,29 @@ export function create(options: create.Options = {}): create.ReturnType {
     })
   }
 
-  async function revokeAccessKey(parameters: {
-    address: Address.Address
-    accessKeyAddress: Address.Address
-  }) {
+  async function revokeAccessKey(parameters: Adapter.revokeAccessKey.Parameters) {
     const selected = await getAdapterAccount({ address: parameters.address })
+    const feePayer = parameters.feePayer
     const client = getWalletClient({
       account: selected.account,
+      feePayer: feePayer === true ? undefined : feePayer,
       transport: selected.transport,
     })
     if (selected.account.type === 'json-rpc') {
       await client.request({
         method: 'wallet_revokeAccessKey' as never,
-        params: [parameters] as never,
+        params: [z.encode(Rpc.wallet_revokeAccessKey.parameters, parameters)] as never,
       })
     } else {
       try {
-        await Actions.accessKey.revokeSync(getClient(), {
+        await Actions.accessKey.revokeSync(client, {
           account: selected.account as TempoAccount.Account,
           accessKey: parameters.accessKeyAddress,
+          ...(feePayer ? { feePayer: true as never } : {}),
+          ...(parameters.keyAuthorization ? { keyAuthorization: parameters.keyAuthorization } : {}),
         })
       } catch (error) {
-        if (!AccessKey.isUnavailableError(error)) throw error
+        if (typeof feePayer === 'string' || !AccessKey.isUnavailableError(error)) throw error
       }
     }
     store.accessKeys.remove({
@@ -677,6 +678,13 @@ export function create(options: create.Options = {}): create.ReturnType {
     parameters: Adapter.revokeAccessKey.Parameters,
     request: Pick<Rpc.wallet_revokeAccessKey.Encoded, 'method' | 'params'>,
   ) {
+    if (
+      parameters.keyAuthorization &&
+      !AddressUtil.isEqual(parameters.keyAuthorization.address, parameters.accessKeyAddress)
+    )
+      throw new RpcResponse.InvalidParamsError({
+        message: '`keyAuthorization` must authorize `accessKeyAddress`.',
+      })
     if (actions.revokeAccessKey) return await actions.revokeAccessKey(parameters, request)
     if (instance.getAccount) return await revokeAccessKey(parameters)
     unsupported('revokeAccessKey')
@@ -713,6 +721,12 @@ export function create(options: create.Options = {}): create.ReturnType {
     return url
   }
 
+  function resolveRevocationFeePayer(
+    feePayer: string | boolean | undefined,
+  ): Adapter.revokeAccessKey.Parameters['feePayer'] {
+    return resolveFeePayer(feePayer) ?? (feePayer === true ? true : undefined)
+  }
+
   function stripAuthorizeAccessKey(
     parameters: create.AuthorizeAccessKeyParameters,
   ): Adapter.authorizeAccessKey.Parameters {
@@ -1608,7 +1622,10 @@ export function create(options: create.Options = {}): create.ReturnType {
                   case 'wallet_revokeAccessKey': {
                     assertConnected()
                     const [decoded] = request._decoded.params
-                    await revokeAccessKeyAction({ ...decoded }, request)
+                    await revokeAccessKeyAction(
+                      { ...decoded, feePayer: resolveRevocationFeePayer(decoded.feePayer) },
+                      request,
+                    )
                     return
                   }
 

package/src/core/Schema.test-d.ts

@@ -1,4 +1,5 @@
 import type { RpcSchema } from 'ox'
+import type { KeyAuthorization } from 'ox/tempo'
 import type { Hex } from 'viem'
 import { describe, expectTypeOf, test } from 'vp/test'
 
@@ -309,6 +310,19 @@ describe('Request', () => {
     expectTypeOf<SwitchChain['params']>().toEqualTypeOf<readonly [{ chainId: number }]>()
   })
 
+  test('wallet_revokeAccessKey supports app-provided fee sponsorship', () => {
+    expectTypeOf<Rpc.wallet_revokeAccessKey.Decoded['params']>().toEqualTypeOf<
+      readonly [
+        {
+          accessKeyAddress: Hex
+          address: Hex
+          feePayer?: boolean | string | undefined
+          keyAuthorization?: KeyAuthorization.Signed | undefined
+        },
+      ]
+    >()
+  })
+
   test('eth_accounts has no params', () => {
     type EthAccounts = Extract<Schema.Request, { method: 'eth_accounts' }>
     expectTypeOf<EthAccounts>().not.toHaveProperty('params')