accounts 0.4.4 → 0.4.6

package/src/core/Provider.test.ts

@@ -998,15 +998,29 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
   })
 
   describe('wallet_authorizeAccessKey', () => {
+    test('behavior: without publicKey or address requires a connected account', async () => {
+      const provider = Provider.create({ adapter: adapter(), chains: [chain] })
+
+      await expect(
+        provider.request({
+          method: 'wallet_authorizeAccessKey',
+          params: [{ expiry: Expiry.days(1) }],
+        }),
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `[Provider.DisconnectedError: No active account.]`,
+      )
+    })
+
     test('default: grants an access key and returns its address', async () => {
       const provider = Provider.create({ adapter: adapter(), chains: [chain] })
-      await connect(provider)
+      const rootAddress = await connect(provider)
 
       const result = await provider.request({
         method: 'wallet_authorizeAccessKey',
         params: [{ expiry: Expiry.days(1) }],
       })
-      expect(result.keyId).toMatch(/^0x[0-9a-fA-F]{40}$/)
+      expect(result.keyAuthorization.keyId).toMatch(/^0x[0-9a-fA-F]{40}$/)
+      expect(result.rootAddress).toBe(rootAddress)
     })
 
     test('behavior: granted access key is used for sendTransactionSync', async () => {
@@ -1035,8 +1049,8 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
         method: 'wallet_authorizeAccessKey',
         params: [{ expiry }],
       })
-      expect(result.keyId).toMatch(/^0x[0-9a-fA-F]{40}$/)
-      expect(result.expiry).toBe(Hex.fromNumber(expiry))
+      expect(result.keyAuthorization.keyId).toMatch(/^0x[0-9a-fA-F]{40}$/)
+      expect(result.keyAuthorization.expiry).toBe(Hex.fromNumber(expiry))
     })
 
     test('behavior: expired access key falls back to root account', async () => {
@@ -1086,7 +1100,7 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
           },
         ],
       })
-      expect(result.limits).toMatchInlineSnapshot(`
+      expect(result.keyAuthorization.limits).toMatchInlineSnapshot(`
         [
           {
             "limit": "0x4c4b40",
@@ -1162,14 +1176,14 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
       await connect(provider)
 
       const connected = (await provider.request({ method: 'eth_accounts' }))[0]!
-      const { keyId } = await provider.request({
+      const { keyAuthorization } = await provider.request({
         method: 'wallet_authorizeAccessKey',
         params: [{ expiry: Expiry.days(1) }],
       })
 
       await provider.request({
         method: 'wallet_revokeAccessKey',
-        params: [{ address: connected, accessKeyAddress: keyId }],
+        params: [{ address: connected, accessKeyAddress: keyAuthorization.address }],
       })
 
       // After revoking, sendTransactionSync should use root key (still works)
@@ -1344,8 +1358,8 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
         method: 'wallet_authorizeAccessKey',
         params: [{ ...accessKeyAccount, expiry: Expiry.days(1) }],
       })
-      expect(result.keyId).toBe(accessKeyAccount.address)
-      expect(result.keyType).toBe('p256')
+      expect(result.keyAuthorization.keyId).toBe(accessKeyAccount.address)
+      expect(result.keyAuthorization.keyType).toBe('p256')
     })
 
     test('behavior: external key authorization can be used to send a transaction', async () => {
@@ -1365,7 +1379,7 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
       const receipt = await sendTransactionSync(client, {
         account: TempoAccount.fromWebCryptoP256(keyPair, { access: rootAddress }),
         calls: [transferCall],
-        keyAuthorization: KeyAuthorization.fromRpc(result),
+        keyAuthorization: KeyAuthorization.fromRpc(result.keyAuthorization),
       })
       expect(receipt.status).toBe('success')
     })

package/src/core/Provider.ts

@@ -112,11 +112,14 @@ export function create(options: create.Options = {}): create.ReturnType {
     return merged
   }
 
-  /** Resolves the `feePayer` field from a transaction request into a URL string or `undefined`. */
+  /** Resolves the `feePayer` field from a transaction request into an absolute URL string or `undefined`. */
   function resolveFeePayer(feePayer: string | boolean | undefined): string | undefined {
-    if (typeof feePayer === 'string') return feePayer
-    if (feePayer === true) return feePayerUrl
-    return undefined
+    const url =
+      typeof feePayer === 'string' ? feePayer : feePayer === true ? feePayerUrl : undefined
+    if (!url) return undefined
+    if (url.startsWith('http://') || url.startsWith('https://')) return url
+    if (typeof window !== 'undefined') return new URL(url, window.location.origin).href
+    return url
   }
 
   const provider = Object.assign(
@@ -437,7 +440,6 @@ export function create(options: create.Options = {}): create.ReturnType {
                     return
 
                   case 'wallet_authorizeAccessKey': {
-                    assertConnected()
                     if (!actions.authorizeAccessKey)
                       throw new ox_Provider.UnsupportedMethodError({
                         message: '`authorizeAccessKey` not supported by adapter.',
@@ -445,8 +447,11 @@ export function create(options: create.Options = {}): create.ReturnType {
                     const decoded = request._decoded.params[0]
                     const result = await actions.authorizeAccessKey(decoded, request)
                     return {
-                      ...result,
-                      address: result.keyId,
+                      keyAuthorization: {
+                        ...result.keyAuthorization,
+                        address: result.keyAuthorization.keyId,
+                      },
+                      rootAddress: result.rootAddress,
                     } satisfies Rpc.wallet_authorizeAccessKey.Encoded['returns']
                   }
 

package/src/core/Schema.test-d.ts

@@ -106,18 +106,11 @@ describe('Encoded', () => {
   })
 
   test('wallet_authorizeAccessKey', () => {
-    expectTypeOf<Rpc.wallet_authorizeAccessKey.Encoded>().toMatchTypeOf<{
-      method: 'wallet_authorizeAccessKey'
-      params: readonly [
-        {
-          address?: Hex | undefined
-          expiry: number
-          keyType?: 'secp256k1' | 'p256' | 'webAuthn' | undefined
-          limits?: readonly { token: Hex; limit: Hex }[] | undefined
-          publicKey?: Hex | undefined
-        },
-      ]
-    }>()
+    expectTypeOf<Rpc.wallet_authorizeAccessKey.Encoded>().toHaveProperty('method')
+    expectTypeOf<Rpc.wallet_authorizeAccessKey.Encoded['returns']>().toHaveProperty('rootAddress')
+    expectTypeOf<Rpc.wallet_authorizeAccessKey.Encoded['returns']>().toHaveProperty(
+      'keyAuthorization',
+    )
   })
 
   test('wallet_disconnect', () => {

package/src/core/adapters/dialog.ts

@@ -33,6 +33,13 @@ export function dialog(options: dialog.Options = {}): Adapter.Adapter {
     rdns = 'xyz.tempo',
   } = options
 
+  if (typeof window !== 'undefined' && !window.isSecureContext)
+    console.warn(
+      '[accounts] Detected insecure context (HTTP).',
+      `\n\nThe Tempo Wallet iframe dialog is not supported on HTTP origins (${window.location.origin})`,
+      'due to lack of WebAuthn passkey support in non-secure contexts.',
+    )
+
   return Adapter.define({ icon, name, rdns }, ({ getAccount, getClient, store }) => {
     const listeners = new Set<(requestQueue: readonly Store.QueuedRequest[]) => void>()
     const requestStore = ox_RpcRequest.createStore()
@@ -282,7 +289,10 @@ export function dialog(options: dialog.Options = {}): Adapter.Adapter {
             return await account.signTransaction(prepared as never)
           })
           if (result !== undefined) return result
-          return await provider.request(request)
+          return await provider.request({
+            ...request,
+            params: [z.encode(Rpc.transactionRequest, parameters)] as const,
+          })
         },
 
         async signTypedData(_params, request) {
@@ -309,7 +319,10 @@ export function dialog(options: dialog.Options = {}): Adapter.Adapter {
             })
           })
           if (result !== undefined) return result
-          return await provider.request(request)
+          return await provider.request({
+            ...request,
+            params: [z.encode(Rpc.transactionRequest, parameters)] as const,
+          })
         },
 
         async sendTransactionSync(parameters, request) {
@@ -332,7 +345,10 @@ export function dialog(options: dialog.Options = {}): Adapter.Adapter {
             })
           })
           if (result !== undefined) return result
-          return await provider.request(request)
+          return await provider.request({
+            ...request,
+            params: [z.encode(Rpc.transactionRequest, parameters)] as const,
+          })
         },
 
         async authorizeAccessKey(parameters, request) {
@@ -345,7 +361,7 @@ export function dialog(options: dialog.Options = {}): Adapter.Adapter {
 
           if (accessKey) {
             const account = getAccount({ accessKey: false, signable: false })
-            saveAccessKey(account.address, result, accessKey.keyPair)
+            saveAccessKey(account.address, result.keyAuthorization, accessKey.keyPair)
           }
 
           return result

package/src/core/adapters/local.ts

@@ -73,7 +73,7 @@ export function local(options: local.Options): Adapter.Adapter {
       options: {
         signature?: Hex.Hex | undefined
       } = {},
-    ): Promise<Adapter.authorizeAccessKey.ReturnType> {
+    ) {
       const { keyPair } = prepared
 
       const keyAuthorization = await (async () => {
@@ -140,7 +140,10 @@ export function local(options: local.Options): Adapter.Adapter {
         async authorizeAccessKey(parameters) {
           const prepared = await prepareKeyAuthorization(parameters)
           const account = getAccount({ accessKey: false, signable: true })
-          return await signKeyAuthorization(account, prepared, { signature: parameters.signature })
+          const keyAuthorization = await signKeyAuthorization(account, prepared, {
+            signature: parameters.signature,
+          })
+          return { keyAuthorization, rootAddress: account.address }
         },
         async loadAccounts(parameters) {
           const { authorizeAccessKey, ...rest } =

package/src/core/zod/rpc.ts

@@ -67,7 +67,7 @@ export const transactionRequest = z.object({
   ),
   calls: z.optional(z.readonly(z.array(call))),
   chainId: z.optional(u.number()),
-  feePayer: z.optional(z.union([z.boolean(), z.url()])),
+  feePayer: z.optional(z.union([z.boolean(), z.string()])),
   feeToken: z.optional(u.address()),
   from: z.optional(u.address()),
   gas: z.optional(u.bigint()),
@@ -259,10 +259,15 @@ export namespace wallet_authorizeAccessKey {
     publicKey: z.optional(u.hex()),
   })
 
+  const returns = z.object({
+    keyAuthorization,
+    rootAddress: u.address(),
+  })
+
   export const schema = Schema.defineItem({
     method: z.literal('wallet_authorizeAccessKey'),
     params: z.readonly(z.tuple([parameters])),
-    returns: keyAuthorization,
+    returns,
   })
   export type Encoded = Schema.Encoded<typeof schema>
   export type Decoded = Schema.Decoded<typeof schema>

package/src/server/CliAuth.ts

@@ -27,6 +27,7 @@ export const keyAuthorization = z.object({
 /** Request body for `POST /auth/pkce/code`. */
 export const createRequest = z.object({
   account: z.optional(u.address()),
+  chainId: z.optional(u.bigint()),
   codeChallenge: z.string(),
   expiry: z.optional(z.number()),
   keyType: z.optional(keyType),
@@ -345,7 +346,6 @@ export async function createDeviceCode(
   options: createDeviceCode.Options,
 ): Promise<createDeviceCode.ReturnType> {
   const {
-    chainId = BigInt(tempo.id),
     now = Date.now,
     policy = Policy.allow(),
     random = randomBytes,
@@ -353,6 +353,7 @@ export async function createDeviceCode(
     store = Store.memory(),
     ttlMs = 10 * 60 * 1_000,
   } = options
+  const chainId = request.chainId ?? options.chainId ?? BigInt(tempo.id)
   const { account, codeChallenge, pubKey } = request
   const keyType = request.keyType ?? 'secp256k1'
   const approved = await policy.validate({