create-dubhe 0.1.13 → 1.2.0-pre.51

package/template/101/aptos-template/contracts/counter/build/counter/sources/dependencies/AptosFramework/jwks.move

@@ -1,889 +0,0 @@
-/// JWK functions and structs.
-///
-/// Note: An important design constraint for this module is that the JWK consensus Rust code is unable to
-/// spawn a VM and make a Move function call. Instead, the JWK consensus Rust code will have to directly
-/// write some of the resources in this file. As a result, the structs in this file are declared so as to
-/// have a simple layout which is easily accessible in Rust.
-module aptos_framework::jwks {
-    use std::bcs;
-    use std::error;
-    use std::option;
-    use std::option::Option;
-    use std::signer;
-    use std::string;
-    use std::string::{String, utf8};
-    use std::vector;
-    use aptos_std::comparator::{compare_u8_vector, is_greater_than, is_equal};
-    use aptos_std::copyable_any;
-    use aptos_std::copyable_any::Any;
-    use aptos_framework::chain_status;
-    use aptos_framework::config_buffer;
-    use aptos_framework::event::emit;
-    use aptos_framework::reconfiguration;
-    use aptos_framework::system_addresses;
-    #[test_only]
-    use aptos_framework::account::create_account_for_test;
-
-    friend aptos_framework::genesis;
-    friend aptos_framework::reconfiguration_with_dkg;
-
-    /// We limit the size of a `PatchedJWKs` resource installed by a dapp owner for federated keyless accounts.
-    /// Note: If too large, validators waste work reading it for invalid TXN signatures.
-    const MAX_FEDERATED_JWKS_SIZE_BYTES: u64 = 2 * 1024; // 2 KiB
-
-    const EUNEXPECTED_EPOCH: u64 = 1;
-    const EUNEXPECTED_VERSION: u64 = 2;
-    const EUNKNOWN_PATCH_VARIANT: u64 = 3;
-    const EUNKNOWN_JWK_VARIANT: u64 = 4;
-    const EISSUER_NOT_FOUND: u64 = 5;
-    const EJWK_ID_NOT_FOUND: u64 = 6;
-    const EINSTALL_FEDERATED_JWKS_AT_APTOS_FRAMEWORK: u64 = 7;
-    const EFEDERATED_JWKS_TOO_LARGE: u64 = 8;
-    const EINVALID_FEDERATED_JWK_SET: u64 = 9;
-
-    const ENATIVE_MISSING_RESOURCE_VALIDATOR_SET: u64 = 0x0101;
-    const ENATIVE_MISSING_RESOURCE_OBSERVED_JWKS: u64 = 0x0102;
-    const ENATIVE_INCORRECT_VERSION: u64 = 0x0103;
-    const ENATIVE_MULTISIG_VERIFICATION_FAILED: u64 = 0x0104;
-    const ENATIVE_NOT_ENOUGH_VOTING_POWER: u64 = 0x0105;
-
-    /// An OIDC provider.
-    struct OIDCProvider has copy, drop, store {
-        /// The utf-8 encoded issuer string. E.g., b"https://www.facebook.com".
-        name: vector<u8>,
-
-        /// The ut8-8 encoded OpenID configuration URL of the provider.
-        /// E.g., b"https://www.facebook.com/.well-known/openid-configuration/".
-        config_url: vector<u8>,
-    }
-
-    /// A list of OIDC providers whose JWKs should be watched by validators. Maintained by governance proposals.
-    struct SupportedOIDCProviders has copy, drop, key, store {
-        providers: vector<OIDCProvider>,
-    }
-
-    /// An JWK variant that represents the JWKs which were observed but not yet supported by Aptos.
-    /// Observing `UnsupportedJWK`s means the providers adopted a new key type/format, and the system should be updated.
-    struct UnsupportedJWK has copy, drop, store {
-        id: vector<u8>,
-        payload: vector<u8>,
-    }
-
-    /// A JWK variant where `kty` is `RSA`.
-    struct RSA_JWK has copy, drop, store {
-        kid: String,
-        kty: String,
-        alg: String,
-        e: String,
-        n: String,
-    }
-
-    /// A JSON web key.
-    struct JWK has copy, drop, store {
-        /// A `JWK` variant packed as an `Any`.
-        /// Currently the variant type is one of the following.
-        /// - `RSA_JWK`
-        /// - `UnsupportedJWK`
-        variant: Any,
-    }
-
-    /// A provider and its `JWK`s.
-    struct ProviderJWKs has copy, drop, store {
-        /// The utf-8 encoding of the issuer string (e.g., "https://www.facebook.com").
-        issuer: vector<u8>,
-
-        /// A version number is needed by JWK consensus to dedup the updates.
-        /// e.g, when on chain version = 5, multiple nodes can propose an update with version = 6.
-        /// Bumped every time the JWKs for the current issuer is updated.
-        /// The Rust authenticator only uses the latest version.
-        version: u64,
-
-        /// Vector of `JWK`'s sorted by their unique ID (from `get_jwk_id`) in dictionary order.
-        jwks: vector<JWK>,
-    }
-
-    /// Multiple `ProviderJWKs` objects, indexed by issuer and key ID.
-    struct AllProvidersJWKs has copy, drop, store {
-        /// Vector of `ProviderJWKs` sorted by `ProviderJWKs::issuer` in dictionary order.
-        entries: vector<ProviderJWKs>,
-    }
-
-    /// The `AllProvidersJWKs` that validators observed and agreed on.
-    struct ObservedJWKs has copy, drop, key, store {
-        jwks: AllProvidersJWKs,
-    }
-
-    #[event]
-    /// When `ObservedJWKs` is updated, this event is sent to resync the JWK consensus state in all validators.
-    struct ObservedJWKsUpdated has drop, store {
-        epoch: u64,
-        jwks: AllProvidersJWKs,
-    }
-
-    /// A small edit or patch that is applied to a `AllProvidersJWKs` to obtain `PatchedJWKs`.
-    struct Patch has copy, drop, store {
-        /// A `Patch` variant packed as an `Any`.
-        /// Currently the variant type is one of the following.
-        /// - `PatchRemoveAll`
-        /// - `PatchRemoveIssuer`
-        /// - `PatchRemoveJWK`
-        /// - `PatchUpsertJWK`
-        variant: Any,
-    }
-
-    /// A `Patch` variant to remove all JWKs.
-    struct PatchRemoveAll has copy, drop, store {}
-
-    /// A `Patch` variant to remove an issuer and all its JWKs.
-    struct PatchRemoveIssuer has copy, drop, store {
-        issuer: vector<u8>,
-    }
-
-    /// A `Patch` variant to remove a specific JWK of an issuer.
-    struct PatchRemoveJWK has copy, drop, store {
-        issuer: vector<u8>,
-        jwk_id: vector<u8>,
-    }
-
-    /// A `Patch` variant to upsert a JWK for an issuer.
-    struct PatchUpsertJWK has copy, drop, store {
-        issuer: vector<u8>,
-        jwk: JWK,
-    }
-
-    /// A sequence of `Patch` objects that are applied *one by one* to the `ObservedJWKs`.
-    ///
-    /// Maintained by governance proposals.
-    struct Patches has key {
-        patches: vector<Patch>,
-    }
-
-    /// The result of applying the `Patches` to the `ObservedJWKs`.
-    /// This is what applications should consume.
-    struct PatchedJWKs has drop, key {
-        jwks: AllProvidersJWKs,
-    }
-
-    /// JWKs for federated keyless accounts are stored in this resource.
-    struct FederatedJWKs has drop, key {
-        jwks: AllProvidersJWKs,
-    }
-
-    //
-    // Structs end.
-    // Functions begin.
-    //
-
-    /// Called by a federated keyless dapp owner to install the JWKs for the federated OIDC provider (e.g., Auth0, AWS
-    /// Cognito, etc). For type-safety, we explicitly use a `struct FederatedJWKs { jwks: AllProviderJWKs }` instead of
-    /// reusing `PatchedJWKs { jwks: AllProviderJWKs }`, which is a JWK-consensus-specific struct.
-    public fun patch_federated_jwks(jwk_owner: &signer, patches: vector<Patch>) acquires FederatedJWKs {
-        // Prevents accidental calls in 0x1::jwks that install federated JWKs at the Aptos framework address.
-        assert!(!system_addresses::is_aptos_framework_address(signer::address_of(jwk_owner)),
-            error::invalid_argument(EINSTALL_FEDERATED_JWKS_AT_APTOS_FRAMEWORK)
-        );
-
-        let jwk_addr = signer::address_of(jwk_owner);
-        if (!exists<FederatedJWKs>(jwk_addr)) {
-            move_to(jwk_owner, FederatedJWKs { jwks: AllProvidersJWKs { entries: vector[] } });
-        };
-
-        let fed_jwks = borrow_global_mut<FederatedJWKs>(jwk_addr);
-        vector::for_each_ref(&patches, |obj|{
-            let patch: &Patch = obj;
-            apply_patch(&mut fed_jwks.jwks, *patch);
-        });
-
-        // TODO: Can we check the size more efficiently instead of serializing it via BCS?
-        let num_bytes = vector::length(&bcs::to_bytes(fed_jwks));
-        assert!(num_bytes < MAX_FEDERATED_JWKS_SIZE_BYTES, error::invalid_argument(EFEDERATED_JWKS_TOO_LARGE));
-    }
-
-    /// This can be called to install or update a set of JWKs for a federated OIDC provider.  This function should
-    /// be invoked to intially install a set of JWKs or to update a set of JWKs when a keypair is rotated.
-    ///
-    /// The `iss` parameter is the value of the `iss` claim on the JWTs that are to be verified by the JWK set.
-    /// `kid_vec`, `alg_vec`, `e_vec`, `n_vec` are String vectors of the JWK attributes `kid`, `alg`, `e` and `n` respectively.
-    /// See https://datatracker.ietf.org/doc/html/rfc7517#section-4 for more details about the JWK attributes aforementioned.
-    ///
-    /// For the example JWK set snapshot below containing 2 keys for Google found at https://www.googleapis.com/oauth2/v3/certs -
-    /// ```json
-    /// {
-    ///   "keys": [
-    ///     {
-    ///       "alg": "RS256",
-    ///       "use": "sig",
-    ///       "kty": "RSA",
-    ///       "n": "wNHgGSG5B5xOEQNFPW2p_6ZxZbfPoAU5VceBUuNwQWLop0ohW0vpoZLU1tAsq_S9s5iwy27rJw4EZAOGBR9oTRq1Y6Li5pDVJfmzyRNtmWCWndR-bPqhs_dkJU7MbGwcvfLsN9FSHESFrS9sfGtUX-lZfLoGux23TKdYV9EE-H-NDASxrVFUk2GWc3rL6UEMWrMnOqV9-tghybDU3fcRdNTDuXUr9qDYmhmNegYjYu4REGjqeSyIG1tuQxYpOBH-tohtcfGY-oRTS09kgsSS9Q5BRM4qqCkGP28WhlSf4ui0-norS0gKMMI1P_ZAGEsLn9p2TlYMpewvIuhjJs1thw",
-    ///       "kid": "d7b939771a7800c413f90051012d975981916d71",
-    ///       "e": "AQAB"
-    ///     },
-    ///     {
-    ///       "kty": "RSA",
-    ///       "kid": "b2620d5e7f132b52afe8875cdf3776c064249d04",
-    ///       "alg": "RS256",
-    ///       "n": "pi22xDdK2fz5gclIbDIGghLDYiRO56eW2GUcboeVlhbAuhuT5mlEYIevkxdPOg5n6qICePZiQSxkwcYMIZyLkZhSJ2d2M6Szx2gDtnAmee6o_tWdroKu0DjqwG8pZU693oLaIjLku3IK20lTs6-2TeH-pUYMjEqiFMhn-hb7wnvH_FuPTjgz9i0rEdw_Hf3Wk6CMypaUHi31y6twrMWq1jEbdQNl50EwH-RQmQ9bs3Wm9V9t-2-_Jzg3AT0Ny4zEDU7WXgN2DevM8_FVje4IgztNy29XUkeUctHsr-431_Iu23JIy6U4Kxn36X3RlVUKEkOMpkDD3kd81JPW4Ger_w",
-    ///       "e": "AQAB",
-    ///       "use": "sig"
-    ///     }
-    ///   ]
-    /// }
-    /// ```
-    ///
-    /// We can call update_federated_jwk_set for Google's `iss` - "https://accounts.google.com" and for each vector
-    /// argument `kid_vec`, `alg_vec`, `e_vec`, `n_vec`, we set in index 0 the corresponding attribute in the first JWK and we set in index 1 the
-    /// the corresponding attribute in the second JWK as shown below.
-    ///
-    /// ```move
-    /// use std::string::utf8;
-    /// aptos_framework::jwks::update_federated_jwk_set(
-    ///     jwk_owner,
-    ///     b"https://accounts.google.com",
-    ///     vector[utf8(b"d7b939771a7800c413f90051012d975981916d71"), utf8(b"b2620d5e7f132b52afe8875cdf3776c064249d04")],
-    ///     vector[utf8(b"RS256"), utf8(b"RS256")],
-    ///     vector[utf8(b"AQAB"), utf8(b"AQAB")],
-    ///     vector[
-    ///         utf8(b"wNHgGSG5B5xOEQNFPW2p_6ZxZbfPoAU5VceBUuNwQWLop0ohW0vpoZLU1tAsq_S9s5iwy27rJw4EZAOGBR9oTRq1Y6Li5pDVJfmzyRNtmWCWndR-bPqhs_dkJU7MbGwcvfLsN9FSHESFrS9sfGtUX-lZfLoGux23TKdYV9EE-H-NDASxrVFUk2GWc3rL6UEMWrMnOqV9-tghybDU3fcRdNTDuXUr9qDYmhmNegYjYu4REGjqeSyIG1tuQxYpOBH-tohtcfGY-oRTS09kgsSS9Q5BRM4qqCkGP28WhlSf4ui0-norS0gKMMI1P_ZAGEsLn9p2TlYMpewvIuhjJs1thw"),
-    ///         utf8(b"pi22xDdK2fz5gclIbDIGghLDYiRO56eW2GUcboeVlhbAuhuT5mlEYIevkxdPOg5n6qICePZiQSxkwcYMIZyLkZhSJ2d2M6Szx2gDtnAmee6o_tWdroKu0DjqwG8pZU693oLaIjLku3IK20lTs6-2TeH-pUYMjEqiFMhn-hb7wnvH_FuPTjgz9i0rEdw_Hf3Wk6CMypaUHi31y6twrMWq1jEbdQNl50EwH-RQmQ9bs3Wm9V9t-2-_Jzg3AT0Ny4zEDU7WXgN2DevM8_FVje4IgztNy29XUkeUctHsr-431_Iu23JIy6U4Kxn36X3RlVUKEkOMpkDD3kd81JPW4Ger_w")
-    ///     ]
-    /// )
-    /// ```
-    ///
-    /// See AIP-96 for more details about federated keyless - https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-96.md
-    ///
-    /// NOTE: Currently only RSA keys are supported.
-    public entry fun update_federated_jwk_set(jwk_owner: &signer, iss: vector<u8>, kid_vec: vector<String>, alg_vec: vector<String>, e_vec: vector<String>, n_vec: vector<String>) acquires FederatedJWKs {
-        assert!(!vector::is_empty(&kid_vec), error::invalid_argument(EINVALID_FEDERATED_JWK_SET));
-        let num_jwk = vector::length<String>(&kid_vec);
-        assert!(vector::length(&alg_vec) == num_jwk , error::invalid_argument(EINVALID_FEDERATED_JWK_SET));
-        assert!(vector::length(&e_vec) == num_jwk, error::invalid_argument(EINVALID_FEDERATED_JWK_SET));
-        assert!(vector::length(&n_vec) == num_jwk, error::invalid_argument(EINVALID_FEDERATED_JWK_SET));
-
-        let remove_all_patch = new_patch_remove_all();
-        let patches = vector[remove_all_patch];
-        while (!vector::is_empty(&kid_vec)) {
-            let kid = vector::pop_back(&mut kid_vec);
-            let alg = vector::pop_back(&mut alg_vec);
-            let e = vector::pop_back(&mut e_vec);
-            let n = vector::pop_back(&mut n_vec);
-            let jwk = new_rsa_jwk(kid, alg, e, n);
-            let patch = new_patch_upsert_jwk(iss, jwk);
-            vector::push_back(&mut patches, patch)
-        };
-        patch_federated_jwks(jwk_owner, patches);
-    }
-
-    /// Get a JWK by issuer and key ID from the `PatchedJWKs`.
-    /// Abort if such a JWK does not exist.
-    /// More convenient to call from Rust, since it does not wrap the JWK in an `Option`.
-    public fun get_patched_jwk(issuer: vector<u8>, jwk_id: vector<u8>): JWK acquires PatchedJWKs {
-        option::extract(&mut try_get_patched_jwk(issuer, jwk_id))
-    }
-
-    /// Get a JWK by issuer and key ID from the `PatchedJWKs`, if it exists.
-    /// More convenient to call from Move, since it does not abort.
-    public fun try_get_patched_jwk(issuer: vector<u8>, jwk_id: vector<u8>): Option<JWK> acquires PatchedJWKs {
-        let jwks = &borrow_global<PatchedJWKs>(@aptos_framework).jwks;
-        try_get_jwk_by_issuer(jwks, issuer, jwk_id)
-    }
-
-    /// Deprecated by `upsert_oidc_provider_for_next_epoch()`.
-    ///
-    /// TODO: update all the tests that reference this function, then disable this function.
-    public fun upsert_oidc_provider(fx: &signer, name: vector<u8>, config_url: vector<u8>): Option<vector<u8>> acquires SupportedOIDCProviders {
-        system_addresses::assert_aptos_framework(fx);
-        chain_status::assert_genesis();
-
-        let provider_set = borrow_global_mut<SupportedOIDCProviders>(@aptos_framework);
-
-        let old_config_url= remove_oidc_provider_internal(provider_set, name);
-        vector::push_back(&mut provider_set.providers, OIDCProvider { name, config_url });
-        old_config_url
-    }
-
-    /// Used in on-chain governances to update the supported OIDC providers, effective starting next epoch.
-    /// Example usage:
-    /// ```
-    /// aptos_framework::jwks::upsert_oidc_provider_for_next_epoch(
-    ///     &framework_signer,
-    ///     b"https://accounts.google.com",
-    ///     b"https://accounts.google.com/.well-known/openid-configuration"
-    /// );
-    /// aptos_framework::aptos_governance::reconfigure(&framework_signer);
-    /// ```
-    public fun upsert_oidc_provider_for_next_epoch(fx: &signer, name: vector<u8>, config_url: vector<u8>): Option<vector<u8>> acquires SupportedOIDCProviders {
-        system_addresses::assert_aptos_framework(fx);
-
-        let provider_set = if (config_buffer::does_exist<SupportedOIDCProviders>()) {
-            config_buffer::extract<SupportedOIDCProviders>()
-        } else {
-            *borrow_global<SupportedOIDCProviders>(@aptos_framework)
-        };
-
-        let old_config_url = remove_oidc_provider_internal(&mut provider_set, name);
-        vector::push_back(&mut provider_set.providers, OIDCProvider { name, config_url });
-        config_buffer::upsert(provider_set);
-        old_config_url
-    }
-
-    /// Deprecated by `remove_oidc_provider_for_next_epoch()`.
-    ///
-    /// TODO: update all the tests that reference this function, then disable this function.
-    public fun remove_oidc_provider(fx: &signer, name: vector<u8>): Option<vector<u8>> acquires SupportedOIDCProviders {
-        system_addresses::assert_aptos_framework(fx);
-        chain_status::assert_genesis();
-
-        let provider_set = borrow_global_mut<SupportedOIDCProviders>(@aptos_framework);
-        remove_oidc_provider_internal(provider_set, name)
-    }
-
-    /// Used in on-chain governances to update the supported OIDC providers, effective starting next epoch.
-    /// Example usage:
-    /// ```
-    /// aptos_framework::jwks::remove_oidc_provider_for_next_epoch(
-    ///     &framework_signer,
-    ///     b"https://accounts.google.com",
-    /// );
-    /// aptos_framework::aptos_governance::reconfigure(&framework_signer);
-    /// ```
-    public fun remove_oidc_provider_for_next_epoch(fx: &signer, name: vector<u8>): Option<vector<u8>> acquires SupportedOIDCProviders {
-        system_addresses::assert_aptos_framework(fx);
-
-        let provider_set = if (config_buffer::does_exist<SupportedOIDCProviders>()) {
-            config_buffer::extract<SupportedOIDCProviders>()
-        } else {
-            *borrow_global<SupportedOIDCProviders>(@aptos_framework)
-        };
-        let ret = remove_oidc_provider_internal(&mut provider_set, name);
-        config_buffer::upsert(provider_set);
-        ret
-    }
-
-    /// Only used in reconfigurations to apply the pending `SupportedOIDCProviders`, if there is any.
-    public(friend) fun on_new_epoch(framework: &signer) acquires SupportedOIDCProviders {
-        system_addresses::assert_aptos_framework(framework);
-        if (config_buffer::does_exist<SupportedOIDCProviders>()) {
-            let new_config = config_buffer::extract<SupportedOIDCProviders>();
-            if (exists<SupportedOIDCProviders>(@aptos_framework)) {
-                *borrow_global_mut<SupportedOIDCProviders>(@aptos_framework) = new_config;
-            } else {
-                move_to(framework, new_config);
-            }
-        }
-    }
-
-    /// Set the `Patches`. Only called in governance proposals.
-    public fun set_patches(fx: &signer, patches: vector<Patch>) acquires Patches, PatchedJWKs, ObservedJWKs {
-        system_addresses::assert_aptos_framework(fx);
-        borrow_global_mut<Patches>(@aptos_framework).patches = patches;
-        regenerate_patched_jwks();
-    }
-
-    /// Create a `Patch` that removes all entries.
-    public fun new_patch_remove_all(): Patch {
-        Patch {
-            variant: copyable_any::pack(PatchRemoveAll {}),
-        }
-    }
-
-    /// Create a `Patch` that removes the entry of a given issuer, if exists.
-    public fun new_patch_remove_issuer(issuer: vector<u8>): Patch {
-        Patch {
-            variant: copyable_any::pack(PatchRemoveIssuer { issuer }),
-        }
-    }
-
-    /// Create a `Patch` that removes the entry of a given issuer, if exists.
-    public fun new_patch_remove_jwk(issuer: vector<u8>, jwk_id: vector<u8>): Patch {
-        Patch {
-            variant: copyable_any::pack(PatchRemoveJWK { issuer, jwk_id })
-        }
-    }
-
-    /// Create a `Patch` that upserts a JWK into an issuer's JWK set.
-    public fun new_patch_upsert_jwk(issuer: vector<u8>, jwk: JWK): Patch {
-        Patch {
-            variant: copyable_any::pack(PatchUpsertJWK { issuer, jwk })
-        }
-    }
-
-    /// Create a `JWK` of variant `RSA_JWK`.
-    public fun new_rsa_jwk(kid: String, alg: String, e: String, n: String): JWK {
-        JWK {
-            variant: copyable_any::pack(RSA_JWK {
-                kid,
-                kty: utf8(b"RSA"),
-                e,
-                n,
-                alg,
-            }),
-        }
-    }
-
-    /// Create a `JWK` of variant `UnsupportedJWK`.
-    public fun new_unsupported_jwk(id: vector<u8>, payload: vector<u8>): JWK {
-        JWK {
-            variant: copyable_any::pack(UnsupportedJWK { id, payload })
-        }
-    }
-
-    /// Initialize some JWK resources. Should only be invoked by genesis.
-    public fun initialize(fx: &signer) {
-        system_addresses::assert_aptos_framework(fx);
-        move_to(fx, SupportedOIDCProviders { providers: vector[] });
-        move_to(fx, ObservedJWKs { jwks: AllProvidersJWKs { entries: vector[] } });
-        move_to(fx, Patches { patches: vector[] });
-        move_to(fx, PatchedJWKs { jwks: AllProvidersJWKs { entries: vector[] } });
-    }
-
-    /// Helper function that removes an OIDC provider from the `SupportedOIDCProviders`.
-    /// Returns the old config URL of the provider, if any, as an `Option`.
-    fun remove_oidc_provider_internal(provider_set: &mut SupportedOIDCProviders, name: vector<u8>): Option<vector<u8>> {
-        let (name_exists, idx) = vector::find(&provider_set.providers, |obj| {
-            let provider: &OIDCProvider = obj;
-            provider.name == name
-        });
-
-        if (name_exists) {
-            let old_provider = vector::swap_remove(&mut provider_set.providers, idx);
-            option::some(old_provider.config_url)
-        } else {
-            option::none()
-        }
-    }
-
-    /// Only used by validators to publish their observed JWK update.
-    ///
-    /// NOTE: It is assumed verification has been done to ensure each update is quorum-certified,
-    /// and its `version` equals to the on-chain version + 1.
-    public fun upsert_into_observed_jwks(fx: &signer, provider_jwks_vec: vector<ProviderJWKs>) acquires ObservedJWKs, PatchedJWKs, Patches {
-        system_addresses::assert_aptos_framework(fx);
-        let observed_jwks = borrow_global_mut<ObservedJWKs>(@aptos_framework);
-        vector::for_each(provider_jwks_vec, |obj| {
-            let provider_jwks: ProviderJWKs = obj;
-            upsert_provider_jwks(&mut observed_jwks.jwks, provider_jwks);
-        });
-
-        let epoch = reconfiguration::current_epoch();
-        emit(ObservedJWKsUpdated { epoch, jwks: observed_jwks.jwks });
-        regenerate_patched_jwks();
-    }
-
-    /// Only used by governance to delete an issuer from `ObservedJWKs`, if it exists.
-    ///
-    /// Return the potentially existing `ProviderJWKs` of the given issuer.
-    public fun remove_issuer_from_observed_jwks(fx: &signer, issuer: vector<u8>): Option<ProviderJWKs> acquires ObservedJWKs, PatchedJWKs, Patches {
-        system_addresses::assert_aptos_framework(fx);
-        let observed_jwks = borrow_global_mut<ObservedJWKs>(@aptos_framework);
-        let old_value = remove_issuer(&mut observed_jwks.jwks, issuer);
-
-        let epoch = reconfiguration::current_epoch();
-        emit(ObservedJWKsUpdated { epoch, jwks: observed_jwks.jwks });
-        regenerate_patched_jwks();
-
-        old_value
-    }
-
-    /// Regenerate `PatchedJWKs` from `ObservedJWKs` and `Patches` and save the result.
-    fun regenerate_patched_jwks() acquires PatchedJWKs, Patches, ObservedJWKs {
-        let jwks = borrow_global<ObservedJWKs>(@aptos_framework).jwks;
-        let patches = borrow_global<Patches>(@aptos_framework);
-        vector::for_each_ref(&patches.patches, |obj|{
-            let patch: &Patch = obj;
-            apply_patch(&mut jwks, *patch);
-        });
-        *borrow_global_mut<PatchedJWKs>(@aptos_framework) = PatchedJWKs { jwks };
-    }
-
-    /// Get a JWK by issuer and key ID from an `AllProvidersJWKs`, if it exists.
-    fun try_get_jwk_by_issuer(jwks: &AllProvidersJWKs, issuer: vector<u8>, jwk_id: vector<u8>): Option<JWK> {
-        let (issuer_found, index) = vector::find(&jwks.entries, |obj| {
-            let provider_jwks: &ProviderJWKs = obj;
-            issuer == provider_jwks.issuer
-        });
-
-        if (issuer_found) {
-            try_get_jwk_by_id(vector::borrow(&jwks.entries, index), jwk_id)
-        } else {
-            option::none()
-        }
-    }
-
-    /// Get a JWK by key ID from a `ProviderJWKs`, if it exists.
-    fun try_get_jwk_by_id(provider_jwks: &ProviderJWKs, jwk_id: vector<u8>): Option<JWK> {
-        let (jwk_id_found, index) = vector::find(&provider_jwks.jwks, |obj|{
-            let jwk: &JWK = obj;
-            jwk_id == get_jwk_id(jwk)
-        });
-
-        if (jwk_id_found) {
-            option::some(*vector::borrow(&provider_jwks.jwks, index))
-        } else {
-            option::none()
-        }
-    }
-
-    /// Get the ID of a JWK.
-    fun get_jwk_id(jwk: &JWK): vector<u8> {
-        let variant_type_name = *string::bytes(copyable_any::type_name(&jwk.variant));
-        if (variant_type_name == b"0x1::jwks::RSA_JWK") {
-            let rsa = copyable_any::unpack<RSA_JWK>(jwk.variant);
-            *string::bytes(&rsa.kid)
-        } else if (variant_type_name == b"0x1::jwks::UnsupportedJWK") {
-            let unsupported = copyable_any::unpack<UnsupportedJWK>(jwk.variant);
-            unsupported.id
-        } else {
-            abort(error::invalid_argument(EUNKNOWN_JWK_VARIANT))
-        }
-    }
-
-    /// Upsert a `ProviderJWKs` into an `AllProvidersJWKs`. If this upsert replaced an existing entry, return it.
-    /// Maintains the sorted-by-issuer invariant in `AllProvidersJWKs`.
-    fun upsert_provider_jwks(jwks: &mut AllProvidersJWKs, provider_jwks: ProviderJWKs): Option<ProviderJWKs> {
-        // NOTE: Using a linear-time search here because we do not expect too many providers.
-        let found = false;
-        let index = 0;
-        let num_entries = vector::length(&jwks.entries);
-        while (index < num_entries) {
-            let cur_entry = vector::borrow(&jwks.entries, index);
-            let comparison = compare_u8_vector(provider_jwks.issuer, cur_entry.issuer);
-            if (is_greater_than(&comparison)) {
-                index = index + 1;
-            } else {
-                found = is_equal(&comparison);
-                break
-            }
-        };
-
-        // Now if `found == true`, `index` points to the JWK we want to update/remove; otherwise, `index` points to
-        // where we want to insert.
-        let ret = if (found) {
-            let entry = vector::borrow_mut(&mut jwks.entries, index);
-            let old_entry = option::some(*entry);
-            *entry = provider_jwks;
-            old_entry
-        } else {
-            vector::insert(&mut jwks.entries, index, provider_jwks);
-            option::none()
-        };
-
-        ret
-    }
-
-    /// Remove the entry of an issuer from a `AllProvidersJWKs` and return the entry, if exists.
-    /// Maintains the sorted-by-issuer invariant in `AllProvidersJWKs`.
-    fun remove_issuer(jwks: &mut AllProvidersJWKs, issuer: vector<u8>): Option<ProviderJWKs> {
-        let (found, index) = vector::find(&jwks.entries, |obj| {
-            let provider_jwk_set: &ProviderJWKs = obj;
-            provider_jwk_set.issuer == issuer
-        });
-
-        let ret = if (found) {
-            option::some(vector::remove(&mut jwks.entries, index))
-        } else {
-            option::none()
-        };
-
-        ret
-    }
-
-    /// Upsert a `JWK` into a `ProviderJWKs`. If this upsert replaced an existing entry, return it.
-    fun upsert_jwk(set: &mut ProviderJWKs, jwk: JWK): Option<JWK> {
-        let found = false;
-        let index = 0;
-        let num_entries = vector::length(&set.jwks);
-        while (index < num_entries) {
-            let cur_entry = vector::borrow(&set.jwks, index);
-            let comparison = compare_u8_vector(get_jwk_id(&jwk), get_jwk_id(cur_entry));
-            if (is_greater_than(&comparison)) {
-                index = index + 1;
-            } else {
-                found = is_equal(&comparison);
-                break
-            }
-        };
-
-        // Now if `found == true`, `index` points to the JWK we want to update/remove; otherwise, `index` points to
-        // where we want to insert.
-        let ret = if (found) {
-            let entry = vector::borrow_mut(&mut set.jwks, index);
-            let old_entry = option::some(*entry);
-            *entry = jwk;
-            old_entry
-        } else {
-            vector::insert(&mut set.jwks, index, jwk);
-            option::none()
-        };
-
-        ret
-    }
-
-    /// Remove the entry of a key ID from a `ProviderJWKs` and return the entry, if exists.
-    fun remove_jwk(jwks: &mut ProviderJWKs, jwk_id: vector<u8>): Option<JWK> {
-        let (found, index) = vector::find(&jwks.jwks, |obj| {
-            let jwk: &JWK = obj;
-            jwk_id == get_jwk_id(jwk)
-        });
-
-        let ret = if (found) {
-            option::some(vector::remove(&mut jwks.jwks, index))
-        } else {
-            option::none()
-        };
-
-        ret
-    }
-
-    /// Modify an `AllProvidersJWKs` object with a `Patch`.
-    /// Maintains the sorted-by-issuer invariant in `AllProvidersJWKs`.
-    fun apply_patch(jwks: &mut AllProvidersJWKs, patch: Patch) {
-        let variant_type_name = *string::bytes(copyable_any::type_name(&patch.variant));
-        if (variant_type_name == b"0x1::jwks::PatchRemoveAll") {
-            jwks.entries = vector[];
-        } else if (variant_type_name == b"0x1::jwks::PatchRemoveIssuer") {
-            let cmd = copyable_any::unpack<PatchRemoveIssuer>(patch.variant);
-            remove_issuer(jwks, cmd.issuer);
-        } else if (variant_type_name == b"0x1::jwks::PatchRemoveJWK") {
-            let cmd = copyable_any::unpack<PatchRemoveJWK>(patch.variant);
-            // TODO: This is inefficient: we remove the issuer, modify its JWKs & and reinsert the updated issuer. Why
-            // not just update it in place?
-            let existing_jwk_set = remove_issuer(jwks, cmd.issuer);
-            if (option::is_some(&existing_jwk_set)) {
-                let jwk_set = option::extract(&mut existing_jwk_set);
-                remove_jwk(&mut jwk_set, cmd.jwk_id);
-                upsert_provider_jwks(jwks, jwk_set);
-            };
-        } else if (variant_type_name == b"0x1::jwks::PatchUpsertJWK") {
-            let cmd = copyable_any::unpack<PatchUpsertJWK>(patch.variant);
-            // TODO: This is inefficient: we remove the issuer, modify its JWKs & and reinsert the updated issuer. Why
-            // not just update it in place?
-            let existing_jwk_set = remove_issuer(jwks, cmd.issuer);
-            let jwk_set = if (option::is_some(&existing_jwk_set)) {
-                option::extract(&mut existing_jwk_set)
-            } else {
-                ProviderJWKs {
-                    version: 0,
-                    issuer: cmd.issuer,
-                    jwks: vector[],
-                }
-            };
-            upsert_jwk(&mut jwk_set, cmd.jwk);
-            upsert_provider_jwks(jwks, jwk_set);
-        } else {
-            abort(std::error::invalid_argument(EUNKNOWN_PATCH_VARIANT))
-        }
-    }
-
-    //
-    // Functions end.
-    // Tests begin.
-    //
-
-    #[test_only]
-    fun initialize_for_test(aptos_framework: &signer) {
-        create_account_for_test(@aptos_framework);
-        reconfiguration::initialize_for_test(aptos_framework);
-        initialize(aptos_framework);
-    }
-
-    #[test(fx = @aptos_framework)]
-    fun test_observed_jwks_operations(fx: &signer) acquires ObservedJWKs, PatchedJWKs, Patches {
-        initialize_for_test(fx);
-        let jwk_0 = new_unsupported_jwk(b"key_id_0", b"key_payload_0");
-        let jwk_1 = new_unsupported_jwk(b"key_id_1", b"key_payload_1");
-        let jwk_2 = new_unsupported_jwk(b"key_id_2", b"key_payload_2");
-        let jwk_3 = new_unsupported_jwk(b"key_id_3", b"key_payload_3");
-        let jwk_4 = new_unsupported_jwk(b"key_id_4", b"key_payload_4");
-        let expected = AllProvidersJWKs { entries: vector[] };
-        assert!(expected == borrow_global<ObservedJWKs>(@aptos_framework).jwks, 1);
-
-        let alice_jwks_v1 = ProviderJWKs {
-            issuer: b"alice",
-            version: 1,
-            jwks: vector[jwk_0, jwk_1],
-        };
-        let bob_jwks_v1 = ProviderJWKs{
-            issuer: b"bob",
-            version: 1,
-            jwks: vector[jwk_2, jwk_3],
-        };
-        upsert_into_observed_jwks(fx, vector[bob_jwks_v1]);
-        upsert_into_observed_jwks(fx, vector[alice_jwks_v1]);
-        let expected = AllProvidersJWKs { entries: vector[
-            alice_jwks_v1,
-            bob_jwks_v1,
-        ] };
-        assert!(expected == borrow_global<ObservedJWKs>(@aptos_framework).jwks, 2);
-
-        let alice_jwks_v2 = ProviderJWKs {
-            issuer: b"alice",
-            version: 2,
-            jwks: vector[jwk_1, jwk_4],
-        };
-        upsert_into_observed_jwks(fx, vector[alice_jwks_v2]);
-        let expected = AllProvidersJWKs { entries: vector[
-            alice_jwks_v2,
-            bob_jwks_v1,
-        ] };
-        assert!(expected == borrow_global<ObservedJWKs>(@aptos_framework).jwks, 3);
-
-        remove_issuer_from_observed_jwks(fx, b"alice");
-        let expected = AllProvidersJWKs { entries: vector[bob_jwks_v1] };
-        assert!(expected == borrow_global<ObservedJWKs>(@aptos_framework).jwks, 4);
-    }
-
-    #[test]
-    fun test_apply_patch() {
-        let jwks = AllProvidersJWKs {
-            entries: vector[
-                ProviderJWKs {
-                    issuer: b"alice",
-                    version: 111,
-                    jwks: vector[
-                        new_rsa_jwk(
-                            utf8(b"e4adfb436b9e197e2e1106af2c842284e4986aff"), // kid
-                            utf8(b"RS256"), // alg
-                            utf8(b"AQAB"), // e
-                            utf8(b"psply8S991RswM0JQJwv51fooFFvZUtYdL8avyKObshyzj7oJuJD8vkf5DKJJF1XOGi6Wv2D-U4b3htgrVXeOjAvaKTYtrQVUG_Txwjebdm2EvBJ4R6UaOULjavcSkb8VzW4l4AmP_yWoidkHq8n6vfHt9alDAONILi7jPDzRC7NvnHQ_x0hkRVh_OAmOJCpkgb0gx9-U8zSBSmowQmvw15AZ1I0buYZSSugY7jwNS2U716oujAiqtRkC7kg4gPouW_SxMleeo8PyRsHpYCfBME66m-P8Zr9Fh1Qgmqg4cWdy_6wUuNc1cbVY_7w1BpHZtZCNeQ56AHUgUFmo2LAQQ"), // n
-                        ),
-                        new_unsupported_jwk(b"key_id_0", b"key_content_0"),
-                    ],
-                },
-                ProviderJWKs {
-                    issuer: b"bob",
-                    version: 222,
-                    jwks: vector[
-                        new_unsupported_jwk(b"key_id_1", b"key_content_1"),
-                        new_unsupported_jwk(b"key_id_2", b"key_content_2"),
-                    ],
-                },
-            ],
-        };
-
-        let patch = new_patch_remove_issuer(b"alice");
-        apply_patch(&mut jwks, patch);
-        assert!(jwks == AllProvidersJWKs {
-            entries: vector[
-                ProviderJWKs {
-                    issuer: b"bob",
-                    version: 222,
-                    jwks: vector[
-                        new_unsupported_jwk(b"key_id_1", b"key_content_1"),
-                        new_unsupported_jwk(b"key_id_2", b"key_content_2"),
-                    ],
-                },
-            ],
-        }, 1);
-
-        let patch = new_patch_remove_jwk(b"bob", b"key_id_1");
-        apply_patch(&mut jwks, patch);
-        assert!(jwks == AllProvidersJWKs {
-            entries: vector[
-                ProviderJWKs {
-                    issuer: b"bob",
-                    version: 222,
-                    jwks: vector[
-                        new_unsupported_jwk(b"key_id_2", b"key_content_2"),
-                    ],
-                },
-            ],
-        }, 1);
-
-        let patch = new_patch_upsert_jwk(b"carl", new_rsa_jwk(
-            utf8(b"0ad1fec78504f447bae65bcf5afaedb65eec9e81"), // kid
-            utf8(b"RS256"), // alg
-            utf8(b"AQAB"), // e
-            utf8(b"sm72oBH-R2Rqt4hkjp66tz5qCtq42TMnVgZg2Pdm_zs7_-EoFyNs9sD1MKsZAFaBPXBHDiWywyaHhLgwETLN9hlJIZPzGCEtV3mXJFSYG-8L6t3kyKi9X1lUTZzbmNpE0tf-eMW-3gs3VQSBJQOcQnuiANxbSXwS3PFmi173C_5fDSuC1RoYGT6X3JqLc3DWUmBGucuQjPaUF0w6LMqEIy0W_WYbW7HImwANT6dT52T72md0JWZuAKsRRnRr_bvaUX8_e3K8Pb1K_t3dD6WSLvtmEfUnGQgLynVl3aV5sRYC0Hy_IkRgoxl2fd8AaZT1X_rdPexYpx152Pl_CHJ79Q"), // n
-        ));
-        apply_patch(&mut jwks, patch);
-        let edit = new_patch_upsert_jwk(b"bob", new_unsupported_jwk(b"key_id_2", b"key_content_2b"));
-        apply_patch(&mut jwks, edit);
-        let edit = new_patch_upsert_jwk(b"alice", new_unsupported_jwk(b"key_id_3", b"key_content_3"));
-        apply_patch(&mut jwks, edit);
-        let edit = new_patch_upsert_jwk(b"alice", new_unsupported_jwk(b"key_id_0", b"key_content_0b"));
-        apply_patch(&mut jwks, edit);
-        assert!(jwks == AllProvidersJWKs {
-            entries: vector[
-                ProviderJWKs {
-                    issuer: b"alice",
-                    version: 0,
-                    jwks: vector[
-                        new_unsupported_jwk(b"key_id_0", b"key_content_0b"),
-                        new_unsupported_jwk(b"key_id_3", b"key_content_3"),
-                    ],
-                },
-                ProviderJWKs {
-                    issuer: b"bob",
-                    version: 222,
-                    jwks: vector[
-                        new_unsupported_jwk(b"key_id_2", b"key_content_2b"),
-                    ],
-                },
-                ProviderJWKs {
-                    issuer: b"carl",
-                    version: 0,
-                    jwks: vector[
-                        new_rsa_jwk(
-                            utf8(b"0ad1fec78504f447bae65bcf5afaedb65eec9e81"), // kid
-                            utf8(b"RS256"), // alg
-                            utf8(b"AQAB"), // e
-                            utf8(b"sm72oBH-R2Rqt4hkjp66tz5qCtq42TMnVgZg2Pdm_zs7_-EoFyNs9sD1MKsZAFaBPXBHDiWywyaHhLgwETLN9hlJIZPzGCEtV3mXJFSYG-8L6t3kyKi9X1lUTZzbmNpE0tf-eMW-3gs3VQSBJQOcQnuiANxbSXwS3PFmi173C_5fDSuC1RoYGT6X3JqLc3DWUmBGucuQjPaUF0w6LMqEIy0W_WYbW7HImwANT6dT52T72md0JWZuAKsRRnRr_bvaUX8_e3K8Pb1K_t3dD6WSLvtmEfUnGQgLynVl3aV5sRYC0Hy_IkRgoxl2fd8AaZT1X_rdPexYpx152Pl_CHJ79Q"), // n
-                        )
-                    ],
-                },
-            ],
-        }, 1);
-
-        let patch = new_patch_remove_all();
-        apply_patch(&mut jwks, patch);
-        assert!(jwks == AllProvidersJWKs { entries: vector[] }, 1);
-    }
-
-    #[test(aptos_framework = @aptos_framework)]
-    fun test_patched_jwks(aptos_framework: signer) acquires ObservedJWKs, PatchedJWKs, Patches {
-        initialize_for_test(&aptos_framework);
-        let jwk_0 = new_unsupported_jwk(b"key_id_0", b"key_payload_0");
-        let jwk_1 = new_unsupported_jwk(b"key_id_1", b"key_payload_1");
-        let jwk_2 = new_unsupported_jwk(b"key_id_2", b"key_payload_2");
-        let jwk_3 = new_unsupported_jwk(b"key_id_3", b"key_payload_3");
-        let jwk_3b = new_unsupported_jwk(b"key_id_3", b"key_payload_3b");
-
-        // Fake observation from validators.
-        upsert_into_observed_jwks(&aptos_framework, vector [
-            ProviderJWKs {
-                issuer: b"alice",
-                version: 111,
-                jwks: vector[jwk_0, jwk_1],
-            },
-            ProviderJWKs{
-                issuer: b"bob",
-                version: 222,
-                jwks: vector[jwk_2, jwk_3],
-            },
-        ]);
-        assert!(jwk_3 == get_patched_jwk(b"bob", b"key_id_3"), 1);
-        assert!(option::some(jwk_3) == try_get_patched_jwk(b"bob", b"key_id_3"), 1);
-
-        // Ignore all Bob's keys.
-        set_patches(&aptos_framework, vector[
-            new_patch_remove_issuer(b"bob"),
-        ]);
-        assert!(option::none() == try_get_patched_jwk(b"bob", b"key_id_3"), 1);
-
-        // Update one of Bob's key..
-        set_patches(&aptos_framework, vector[
-            new_patch_upsert_jwk(b"bob", jwk_3b),
-        ]);
-        assert!(jwk_3b == get_patched_jwk(b"bob", b"key_id_3"), 1);
-        assert!(option::some(jwk_3b) == try_get_patched_jwk(b"bob", b"key_id_3"), 1);
-
-        // Wipe everything, then add some keys back.
-        set_patches(&aptos_framework, vector[
-            new_patch_remove_all(),
-            new_patch_upsert_jwk(b"alice", jwk_1),
-            new_patch_upsert_jwk(b"bob", jwk_3),
-        ]);
-        assert!(jwk_3 == get_patched_jwk(b"bob", b"key_id_3"), 1);
-        assert!(option::some(jwk_3) == try_get_patched_jwk(b"bob", b"key_id_3"), 1);
-    }
-}