mppx 0.8.14 → 0.8.15

package/src/tempo/session/server/Session.test.ts

@@ -2421,12 +2421,15 @@ describe('precompile server session unit guardrails', () => {
   })
 
   describe('WebSocket parity', () => {
-    async function createManagedWsHarness(options: { maxDeposit?: bigint } = {}) {
+    async function createManagedWsHarness(
+      options: { challengeTtlMs?: number; maxDeposit?: bigint } = {},
+    ) {
       const rawStore = Store.memory()
+      let challengeRequests = 0
       let currentPayload: SessionCredentialPayload | undefined
       let voucherPosts = 0
       const maxDeposit = options.maxDeposit ?? 3n
-      const routeHandler = Mppx_server.create({
+      const payment = Mppx_server.create({
         methods: [
           tempo_server.session({
             amount: '1',
@@ -2463,7 +2466,7 @@ describe('precompile server session unit guardrails', () => {
         ],
         realm: 'api.example.com',
         secretKey: 'test-secret-key-test-secret-key-32',
-      }).session({ amount: '1', decimals: 0, suggestedDeposit: maxDeposit.toString() })
+      })
 
       const route = async (request: Request) => {
         currentPayload = undefined
@@ -2472,7 +2475,15 @@ describe('precompile server session unit guardrails', () => {
             currentPayload = Credential.fromRequest<SessionCredentialPayload>(request).payload
             if (currentPayload.action === 'voucher') voucherPosts++
           } catch {}
-        }
+        } else challengeRequests++
+        const routeHandler = payment.session({
+          amount: '1',
+          decimals: 0,
+          suggestedDeposit: maxDeposit.toString(),
+          ...(options.challengeTtlMs === undefined
+            ? {}
+            : { expires: new Date(Date.now() + options.challengeTtlMs) }),
+        })
         return routeHandler(request)
       }
 
@@ -2510,6 +2521,9 @@ describe('precompile server session unit guardrails', () => {
         get port() {
           return port
         },
+        get challengeRequests() {
+          return challengeRequests
+        },
         get voucherPosts() {
           return voucherPosts
         },
@@ -2520,6 +2534,54 @@ describe('precompile server session unit guardrails', () => {
       }
     }
 
+    test('refreshes an expired challenge before sending a later websocket voucher', async () => {
+      const harness = await createManagedWsHarness({ challengeTtlMs: 2_000, maxDeposit: 2n })
+      harness.wsServer.on('connection', (socket: import('ws').WebSocket) => {
+        void TempoWs.serve({
+          socket,
+          store: harness.rawStore,
+          url: `${harness.server.url}/ws`,
+          route: harness.route,
+          generate: async function* (stream: TempoWs.SessionController) {
+            await stream.charge()
+            yield 'chunk-1'
+            await new Promise((resolve) => setTimeout(resolve, 2_200))
+            await stream.charge()
+            yield 'chunk-2'
+          },
+        })
+      })
+
+      try {
+        const manager = precompileSessionManager({
+          account: payer,
+          client: createSigningClient(),
+          decimals: 0,
+          fetch: globalThis.fetch,
+          maxDeposit: '2',
+          webSocket: WebSocket as never,
+        })
+        const ws = await manager.ws(`ws://localhost:${harness.port}/ws`)
+        const chunks: string[] = []
+
+        await new Promise<void>((resolve, reject) => {
+          ws.addEventListener('message', (event) => {
+            if (typeof event.data === 'string') chunks.push(event.data)
+          })
+          ws.addEventListener('close', () => resolve(), { once: true })
+          ws.addEventListener('error', () => reject(new Error('websocket stream failed')), {
+            once: true,
+          })
+        })
+
+        expect(chunks).toEqual(['chunk-1', 'chunk-2'])
+        expect(harness.challengeRequests).toBeGreaterThan(1)
+        expect(harness.voucherPosts).toBe(1)
+      } finally {
+        harness.close()
+      }
+    })
+
     test('open -> stream -> need-voucher -> resume -> close', async () => {
       const harness = await createManagedWsHarness({ maxDeposit: 3n })
       harness.wsServer.on('connection', (socket: import('ws').WebSocket) => {

package/src/tempo/session/server/Ws.ts

@@ -220,6 +220,9 @@ export async function serve(options: serve.Options): Promise<void> {
     }
 
     const { receipt } = authorizationResult
+    if (payload.action === 'voucher' && runtime.streamContext) {
+      runtime.streamContext.challengeId = credential.challenge.id
+    }
     await send(socket, formatReceiptMessage(receipt))
 
     if (payload.action === 'close') {

package/src/tempo/subscription/KeyAuthorization.test.ts

@@ -1,4 +1,5 @@
-import { KeyAuthorization } from 'ox/tempo'
+import { Rlp } from 'ox'
+import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo'
 import { privateKeyToAccount } from 'viem/accounts'
 import { describe, expect, test } from 'vp/test'
 
@@ -69,6 +70,25 @@ async function createPayload(request = parseRequest()) {
   } as const
 }
 
+function serializeCompositeSignature(
+  type: 'keychain' | 'multisig',
+  inner: SignatureEnvelope.Primitive,
+) {
+  return SignatureEnvelope.serialize(
+    type === 'keychain'
+      ? {
+          inner,
+          type,
+          userAddress: rootAccount.address,
+        }
+      : {
+          account: rootAccount.address,
+          signatures: [inner],
+          type,
+        },
+  )
+}
+
 describe('tempo subscription key authorization', () => {
   test('signs and verifies a scoped key authorization', async () => {
     const request = parseRequest()
@@ -87,6 +107,55 @@ describe('tempo subscription key authorization', () => {
     )
   })
 
+  test.each(['keychain', 'multisig'] as const)(
+    'rejects %s authorization signatures',
+    async (type) => {
+      const request = parseRequest()
+
+      await expect(
+        signSubscriptionKeyAuthorization({
+          accessKey,
+          account: {
+            async sign({ hash }) {
+              const inner = SignatureEnvelope.from(await rootAccount.sign({ hash }))
+              if (inner.type === 'keychain' || inner.type === 'multisig') {
+                throw new Error('expected primitive signature')
+              }
+              return serializeCompositeSignature(type, inner)
+            },
+          },
+          chainId: 4217,
+          request,
+        }),
+      ).rejects.toThrow('keyAuthorization must use a primitive signature')
+    },
+  )
+
+  test.each(['keychain', 'multisig'] as const)(
+    'rejects serialized %s authorization signatures',
+    async (type) => {
+      const request = parseRequest()
+      const payload = await createPayload(request)
+      const authorization = KeyAuthorization.deserialize(payload.signature)
+      const [authorizationTuple] = KeyAuthorization.toTuple(authorization)
+
+      expect(() =>
+        verifySubscriptionKeyAuthorization({
+          accessKey,
+          chainId: 4217,
+          payload: {
+            ...payload,
+            signature: Rlp.fromHex([
+              authorizationTuple,
+              serializeCompositeSignature(type, authorization.signature!),
+            ]),
+          },
+          request,
+        }),
+      ).toThrow('keyAuthorization must use a primitive signature')
+    },
+  )
+
   test('builds wallet allowed calls from the subscription request', () => {
     const request = parseRequest()
 

package/src/tempo/subscription/KeyAuthorization.ts

@@ -168,8 +168,14 @@ export async function signSubscriptionKeyAuthorization(parameters: {
   const signature = await account.sign({
     hash: KeyAuthorization.getSignPayload(authorization),
   })
+  const signatureEnvelope = SignatureEnvelope.from(signature)
+  if (signatureEnvelope.type === 'keychain' || signatureEnvelope.type === 'multisig') {
+    throw new VerificationFailedError({
+      reason: 'keyAuthorization must use a primitive signature',
+    })
+  }
   return KeyAuthorization.from(authorization, {
-    signature: SignatureEnvelope.from(signature),
+    signature,
   })
 }
 
@@ -238,14 +244,19 @@ function createUnsignedAuthorization(parameters: {
 function deserializeAuthorization(signature: `0x${string}`) {
   try {
     return KeyAuthorization.deserialize(signature)
-  } catch {
+  } catch (error) {
+    if (error instanceof KeyAuthorization.InvalidSignatureTypeError) {
+      throw new VerificationFailedError({
+        reason: 'keyAuthorization must use a primitive signature',
+      })
+    }
     throw new VerificationFailedError({ reason: 'invalid keyAuthorization payload' })
   }
 }
 
 function getPrimitiveSignature(authorization: Authorization) {
   const signature = authorization.signature
-  if (!signature || signature.type === 'keychain') {
+  if (!signature) {
     throw new VerificationFailedError({
       reason: 'keyAuthorization must use a primitive signature',
     })

package/src/viem/Client.test.ts

@@ -2,7 +2,7 @@ import { createClient, custom, defineChain, type Hex } from 'viem'
 import { privateKeyToAccount } from 'viem/accounts'
 import { signTransaction } from 'viem/actions'
 import { Account as TempoAccount, Transaction } from 'viem/tempo'
-import { tempoLocalnet } from 'viem/tempo/chains'
+import { tempo as tempoMainnetChain, tempoLocalnet, tempoModerato } from 'viem/tempo/chains'
 import { afterEach, describe, expect, test, vi } from 'vp/test'
 
 import * as Client from './Client.js'
@@ -48,6 +48,23 @@ describe('getResolver', () => {
     expect(client.chain?.name).toBe('test')
   })
 
+  test('behavior: resolves the correct named Tempo chain even when the default chain differs', async () => {
+    const getClient = Client.getResolver({
+      // Default chain is mainnet, but the resolved chain ID below is testnet.
+      chain: tempoMainnetChain as never,
+      rpcUrl: {
+        [tempoMainnetChain.id]: 'https://rpc.example.com',
+        [tempoModerato.id]: 'https://rpc2.example.com',
+      },
+    })
+
+    const client = await getClient({ chainId: tempoModerato.id })
+
+    expect(client.chain?.id).toBe(tempoModerato.id)
+    expect(client.chain?.name).toBe(tempoModerato.name)
+    expect(client.chain?.name).not.toBe(tempoMainnetChain.name)
+  })
+
   test('error: throws when no rpcUrl provided', () => {
     const getClient = Client.getResolver({})
 

package/src/viem/Client.ts

@@ -1,8 +1,14 @@
 import { type Chain, type Client, createClient, createTransport, custom, http } from 'viem'
 import { withFeePayer } from 'viem/tempo'
+import { tempo as tempoMainnetChain, tempoModerato } from 'viem/tempo/chains'
 
 import type { MaybePromise } from '../internal/types.js'
 
+const knownTempoChains: Record<number, Chain> = {
+  [tempoMainnetChain.id]: tempoMainnetChain,
+  [tempoModerato.id]: tempoModerato,
+}
+
 export function getResolver(
   parameters: getResolver.Parameters & {
     /** Default chain to use if not provided. */
@@ -73,7 +79,7 @@ export function getResolver(
     if (!url) throw new Error(`No \`rpcUrl\` configured for \`chainId\` (${resolvedChainId}).`)
     const transport = feePayerUrl ? withFeePayer(http(url), http(feePayerUrl)) : http(url)
     return createClient({
-      chain: { ...chain, id: resolvedChainId } as never,
+      chain: (knownTempoChains[resolvedChainId] ?? { ...chain, id: resolvedChainId }) as never,
       transport,
     })
   }