accounts 0.5.5 → 0.5.7

package/src/core/Dialog.ts

@@ -155,7 +155,12 @@ export function iframe(): Dialog {
     root.appendChild(style)
     root.appendChild(frame)
 
+    let readyResult: Messenger.ReadyOptions | undefined
+    let switchedToPopup = false
+
     function createMessenger() {
+      readyResult = undefined
+
       const m = Messenger.bridge({
         from: Messenger.fromWindow(window, { targetOrigin: hostUrl.origin }),
         to: Messenger.fromWindow(frame.contentWindow!, {
@@ -164,6 +169,23 @@ export function iframe(): Dialog {
         waitForReady: true,
       })
       m.on('rpc-response', (response) => handleResponse(store!, response))
+      m.waitForReady().then((result) => {
+        readyResult = result
+        if (result.colorScheme) frame.style.colorScheme = result.colorScheme
+      })
+      m.on('switch-mode', () => {
+        hideDialog()
+        activatePage()
+        open = false
+        switchedToPopup = true
+
+        const pending = store
+          ?.getState()
+          .requestQueue.filter(
+            (x): x is Store.QueuedRequest & { status: 'pending' } => x.status === 'pending',
+          )
+        if (pending && pending.length > 0) fallback?.syncRequests(pending)
+      })
       return m
     }
 
@@ -254,23 +276,6 @@ export function iframe(): Dialog {
       }
     }
 
-    messenger.waitForReady().then(({ colorScheme }) => {
-      if (colorScheme) frame.style.colorScheme = colorScheme
-    })
-
-    messenger.on('switch-mode', () => {
-      hideDialog()
-      activatePage()
-      open = false
-
-      const pending = store!
-        .getState()
-        .requestQueue.filter(
-          (x): x is Store.QueuedRequest & { status: 'pending' } => x.status === 'pending',
-        )
-      if (pending.length > 0) fallback!.syncRequests(pending)
-    })
-
     const instance: Instance = {
       close() {
         fallback!.close()
@@ -304,7 +309,12 @@ export function iframe(): Dialog {
         activateDialog()
       },
       async syncRequests(requests) {
-        const { trustedHosts } = await messenger.waitForReady()
+        if (switchedToPopup) {
+          fallback!.syncRequests(requests)
+          return
+        }
+
+        const { trustedHosts } = readyResult ?? (await messenger.waitForReady())
 
         // Safari does not support WebAuthn credential creation in iframes.
         if (
@@ -358,10 +368,6 @@ export function popup(options: popup.Options = {}): Dialog {
 
     let win: Window | null = null
 
-    function onBlur() {
-      if (win) handleBlur(store)
-    }
-
     const offDetectClosed = (() => {
       const timer = setInterval(() => {
         if (win?.closed) handleBlur(store)
@@ -371,19 +377,57 @@ export function popup(options: popup.Options = {}): Dialog {
 
     let messenger: Messenger.Bridge | undefined
 
+    const overlay = document.createElement('div')
+    Object.assign(overlay.style, {
+      alignItems: 'center',
+      background: 'rgba(0, 0, 0, 0.5)',
+      color: 'white',
+      display: 'none',
+      flexDirection: 'column',
+      fontFamily: 'system-ui, sans-serif',
+      fontSize: '16px',
+      gap: '12px',
+      inset: '0',
+      justifyContent: 'center',
+      position: 'fixed',
+      zIndex: '2147483647',
+    })
+    const overlayMessage = document.createElement('p')
+    Object.assign(overlayMessage.style, { margin: '0' })
+    overlayMessage.textContent = 'Continue in the popup window'
+    const overlayClose = document.createElement('button')
+    Object.assign(overlayClose.style, {
+      background: 'none',
+      border: 'none',
+      color: 'white',
+      cursor: 'pointer',
+      font: 'inherit',
+      padding: '0',
+      textDecoration: 'underline',
+    })
+    overlayClose.textContent = 'Close'
+    overlayClose.addEventListener('click', () => handleBlur(store))
+    overlay.appendChild(overlayMessage)
+    overlay.appendChild(overlayClose)
+    document.body.appendChild(overlay)
+
     return {
       close() {
+        overlay.style.display = 'none'
         if (!win) return
         win.close()
         win = null
       },
       destroy() {
         this.close()
-        window.removeEventListener('focus', onBlur)
         messenger?.destroy()
         offDetectClosed()
+        overlay.remove()
       },
       open() {
+        messenger?.destroy()
+        win?.close()
+
         const referrer = getReferrer()
 
         const hostUrl = new URL(host)
@@ -415,14 +459,13 @@ export function popup(options: popup.Options = {}): Dialog {
 
         messenger.on('rpc-response', (response) => handleResponse(store, response))
 
-        window.removeEventListener('focus', onBlur)
-        window.addEventListener('focus', onBlur)
+        overlay.style.display = 'flex'
       },
       async syncRequests(requests) {
         const requiresConfirm = requests.some((x) => x.status === 'pending')
         if (requiresConfirm) {
           if (!win || win.closed) this.open()
-          win?.focus()
+          else win.focus()
         }
         messenger?.send('rpc-requests', {
           account: getAccount(store),

package/src/core/Provider.test.ts

@@ -1642,6 +1642,20 @@ describe.each(adapters)('$name', ({ adapter }: (typeof adapters)[number]) => {
       expect(signed).toMatch(/^0x/)
     })
 
+    test('behavior: feePayer URL on eth_fillTransaction', async () => {
+      const provider = Provider.create({ adapter: adapter(), chains: [chain] })
+
+      const connected = await connect(provider)
+      await fund(connected)
+
+      const result = await provider.request({
+        method: 'eth_fillTransaction',
+        params: [{ calls: [transferCall], feePayer: server.url, from: connected }],
+      })
+
+      expect((result.tx as { feePayerSignature?: unknown }).feePayerSignature).toBeDefined()
+    })
+
     test('behavior: feePayer: true uses default from Provider.create', async () => {
       const provider = Provider.create({
         adapter: adapter(),

package/src/core/Provider.ts

@@ -208,6 +208,7 @@ export function create(options: create.Options = {}): create.ReturnType {
                     return (await actions.sendTransaction(
                       {
                         ...rest,
+                        chainId: decoded.chainId ?? store.getState().chainId,
                         ...(calls ? { calls } : {}),
                         feePayer: resolveFeePayer(decoded.feePayer),
                       },
@@ -216,16 +217,31 @@ export function create(options: create.Options = {}): create.ReturnType {
                   }
 
                   case 'eth_fillTransaction': {
-                    const [parameters] = request.params
+                    const [decoded] = request._decoded.params
+                    const parameters = { ...decoded }
                     const chainId = parameters.chainId
-                      ? Hex.toNumber(parameters.chainId)
-                      : undefined
+                    const feePayer = resolveFeePayer(parameters.feePayer)
 
-                    const fill = (params: typeof parameters) =>
-                      getClient({ chainId }).request({
+                    type FillParams = z.output<typeof Rpc.transactionRequest> & {
+                      keyAuthorization?: unknown
+                    }
+                    const fill = (params: FillParams) => {
+                      const client = getClient({ chainId, feePayer })
+                      const fillRequest = {
+                        ...params,
+                        chainId: params.chainId ?? client.chain?.id,
+                        ...(feePayer ? { feePayer: true } : {}),
+                      }
+                      const formatter = client.chain?.formatters?.transactionRequest
+                      const formatted =
+                        formatter && !fillRequest.keyAuthorization
+                          ? formatter.format({ ...fillRequest } as never, 'fillTransaction')
+                          : fillRequest
+                      return client.request({
                         method: 'eth_fillTransaction',
-                        params: [params],
+                        params: [formatted as never],
                       })
+                    }
 
                     // Inject pending keyAuthorization so the node accounts for
                     // key authorization gas during estimation.
@@ -243,8 +259,10 @@ export function create(options: create.Options = {}): create.ReturnType {
                           try {
                             const result = await fill({
                               ...parameters,
-                              // @ts-expect-error - TODO: fix
-                              keyAuthorization: KeyAuthorization.toRpc(keyAuth),
+                              keyAuthorization: {
+                                address: keyAuth.address,
+                                ...KeyAuthorization.toRpc(keyAuth),
+                              } as never,
                             })
                             AccessKey.removePending(account, { store })
                             return result
@@ -268,6 +286,7 @@ export function create(options: create.Options = {}): create.ReturnType {
                     return (await actions.signTransaction(
                       {
                         ...rest,
+                        chainId: decoded.chainId ?? store.getState().chainId,
                         ...(calls ? { calls } : {}),
                         feePayer: resolveFeePayer(decoded.feePayer),
                       },
@@ -284,6 +303,7 @@ export function create(options: create.Options = {}): create.ReturnType {
                     return (await actions.sendTransactionSync(
                       {
                         ...rest,
+                        chainId: decoded.chainId ?? store.getState().chainId,
                         ...(calls ? { calls } : {}),
                         feePayer: resolveFeePayer(decoded.feePayer),
                       },

package/src/core/adapters/dangerous_secp256k1.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from 'vp/test'
+
+import { accounts, privateKeys } from '../../../test/config.js'
+import * as Provider from '../Provider.js'
+import * as Storage from '../Storage.js'
+import { dangerous_secp256k1 } from './dangerous_secp256k1.js'
+
+describe('dangerous_secp256k1', () => {
+  test('behavior: privateKey option pins the connected account', async () => {
+    const account = accounts[1]!
+    const provider = Provider.create({
+      adapter: dangerous_secp256k1({ privateKey: privateKeys[1]! }),
+      storage: Storage.memory({ key: 'dangerous-secp256k1-private-key' }),
+    })
+
+    const result = await provider.request({ method: 'wallet_connect' })
+    expect(result.accounts).toHaveLength(1)
+    expect(result.accounts[0]!.address).toBe(account.address)
+
+    const connected = await provider.request({ method: 'eth_accounts' })
+    expect(connected).toHaveLength(1)
+    expect(connected[0]).toBe(account.address)
+  })
+})

package/src/core/adapters/dangerous_secp256k1.ts

@@ -1,4 +1,5 @@
-import { Account, Secp256k1 } from 'viem/tempo'
+import type { Hex } from 'viem'
+import { Account as TempoAccount, Secp256k1 } from 'viem/tempo'
 
 import * as Adapter from '../Adapter.js'
 import { local } from './local.js'
@@ -21,20 +22,30 @@ import { local } from './local.js'
  * ```
  */
 export function dangerous_secp256k1(options: dangerous_secp256k1.Options = {}): Adapter.Adapter {
-  const { icon, name, rdns } = options
+  const { icon, name, privateKey, rdns } = options
+  const fixed = privateKey
+    ? {
+        address: TempoAccount.fromSecp256k1(privateKey).address,
+        keyType: 'secp256k1' as const,
+        privateKey,
+      }
+    : undefined
 
   return Adapter.define({ icon, name, rdns }, (config) => {
     const { store } = config
 
     return local({
       async createAccount() {
+        if (fixed) return { accounts: [fixed] }
+
         const privateKey = Secp256k1.randomPrivateKey()
-        const account = Account.fromSecp256k1(privateKey)
+        const generated = TempoAccount.fromSecp256k1(privateKey)
         return {
-          accounts: [{ address: account.address, keyType: 'secp256k1' as const, privateKey }],
+          accounts: [{ address: generated.address, keyType: 'secp256k1' as const, privateKey }],
         }
       },
       async loadAccounts() {
+        if (fixed) return { accounts: [fixed] }
         return { accounts: [...store.getState().accounts] }
       },
     })(config)
@@ -47,6 +58,8 @@ export declare namespace dangerous_secp256k1 {
     icon?: `data:image/${string}` | undefined
     /** Display name of the provider (e.g. `"My Wallet"`). @default "Injected Wallet" */
     name?: string | undefined
+    /** Fixed private key to expose instead of generating/loading one from storage. */
+    privateKey?: Hex | undefined
     /** Reverse DNS identifier. @default `com.{lowercase name}` */
     rdns?: string | undefined
   }

package/src/server/Handler.test.ts

@@ -1,9 +1,10 @@
 import { Elysia } from 'elysia'
 import express from 'express'
 import { Hono } from 'hono'
-import type { RpcRequest } from 'ox'
+import { Json, type RpcRequest } from 'ox'
+import { SignatureEnvelope, Transaction as core_Transaction, TxEnvelopeTempo } from 'ox/tempo'
 import { sendTransactionSync } from 'viem/actions'
-import { withFeePayer } from 'viem/tempo'
+import { Transaction, withFeePayer } from 'viem/tempo'
 import { afterAll, afterEach, beforeAll, describe, expect, test } from 'vp/test'
 
 import { accounts, chain, getClient, http } from '../../test/config.js'
@@ -732,7 +733,98 @@ describe('feePayer', () => {
     requests = []
   })
 
+  async function rpc(request: Record<string, unknown>) {
+    return await fetch(server.url, {
+      body: Json.stringify(request),
+      headers: { 'content-type': 'application/json' },
+      method: 'POST',
+    }).then((response) => response.json())
+  }
+
+  /** Signs a sponsor-bound Tempo transaction, preserving the feePayerSignature. */
+  async function signSponsoredTx(account: (typeof accounts)[number], transaction: object) {
+    const serialized = (await Transaction.serialize(transaction as never)) as `0x76${string}`
+    const envelope = TxEnvelopeTempo.deserialize(serialized)
+    const signature = await account.sign({
+      hash: TxEnvelopeTempo.getSignPayload(envelope),
+    })
+    return TxEnvelopeTempo.serialize(envelope, {
+      signature: SignatureEnvelope.from(signature),
+    })
+  }
+
   describe('POST /', () => {
+    test('default: eth_fillTransaction returns a sponsor-bound transaction the sender can broadcast', async () => {
+      const response = (await rpc({
+        id: 1,
+        jsonrpc: '2.0',
+        method: 'eth_fillTransaction',
+        params: [
+          {
+            chainId: chain.id,
+            feePayer: true,
+            from: userAccount.address,
+            to: '0x0000000000000000000000000000000000000000',
+          },
+        ],
+      })) as {
+        result: {
+          sponsor: { address: string }
+          tx: Record<string, unknown>
+        }
+      }
+      const prepared = core_Transaction.fromRpc(response.result.tx as never) as {
+        feePayerSignature?: unknown
+      }
+      const signed = await signSponsoredTx(userAccount, prepared)
+      const receipt = (await getClient().request({
+        method: 'eth_sendRawTransactionSync',
+        params: [signed],
+      })) as { feePayer?: string | undefined }
+
+      expect(response.result.sponsor.address).toBe(feePayerAccount.address)
+      expect(prepared?.feePayerSignature).toBeDefined()
+      expect(receipt.feePayer).toBe(feePayerAccount.address.toLowerCase())
+      expect(requests.map(({ method }) => method)).toMatchInlineSnapshot(`
+        [
+          "eth_fillTransaction",
+        ]
+      `)
+    })
+
+    test('behavior: mutating a sponsor-bound transaction invalidates the fee payer binding', async () => {
+      const response = (await rpc({
+        id: 1,
+        jsonrpc: '2.0',
+        method: 'eth_fillTransaction',
+        params: [
+          {
+            chainId: chain.id,
+            feePayer: true,
+            from: userAccount.address,
+            to: '0x0000000000000000000000000000000000000000',
+          },
+        ],
+      })) as {
+        result: { tx: Record<string, unknown> }
+      }
+      const prepared = core_Transaction.fromRpc(response.result.tx as never) as {
+        gas?: bigint | undefined
+        feePayerSignature?: unknown
+      }
+      const signed = await signSponsoredTx(userAccount, {
+        ...prepared,
+        gas: (prepared?.gas ?? 0n) + 1n,
+      })
+
+      await expect(
+        getClient().request({
+          method: 'eth_sendRawTransactionSync',
+          params: [signed],
+        }),
+      ).rejects.toThrowError()
+    })
+
     test('behavior: eth_signRawTransaction', async () => {
       const client = getClient({
         account: userAccount,
@@ -835,8 +927,8 @@ describe('feePayer', () => {
       expect(data).toMatchInlineSnapshot(`
         {
           "error": {
-            "code": -32603,
-            "name": "RpcResponse.InternalError",
+            "code": -32602,
+            "name": "RpcResponse.InvalidParamsError",
             "stack": "",
           },
           "id": 1,