ox 1.0.2 → 1.0.3

package/src/tempo/SignatureEnvelope.test-d.ts

@@ -0,0 +1,97 @@
+import { expectTypeOf, test } from 'vp/test'
+import * as SignatureEnvelope from './SignatureEnvelope.js'
+
+const signature = {
+  r: '0x01',
+  s: '0x02',
+  type: 'secp256k1',
+  yParity: '0x0',
+} as const satisfies SignatureEnvelope.SignatureEnvelopeRpc
+
+const signatureDomain = {
+  signature: {
+    r: '0x01',
+    s: '0x02',
+    yParity: 0,
+  },
+  type: 'secp256k1',
+} as const satisfies SignatureEnvelope.Secp256k1
+
+test('toRpc preserves the signature type', () => {
+  expectTypeOf(
+    SignatureEnvelope.toRpc(signatureDomain),
+  ).toEqualTypeOf<SignatureEnvelope.Secp256k1Rpc>()
+})
+
+test('MultisigRpc uses static initialized and bootstrap shapes', () => {
+  const initialized = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: [signature],
+  } as const satisfies SignatureEnvelope.MultisigRpc
+  const bootstrap = {
+    init: {
+      owners: [
+        {
+          owner: '0x1111111111111111111111111111111111111111',
+          weight: 1,
+        },
+      ],
+      threshold: 1,
+    },
+    signatures: [signature],
+  } as const satisfies SignatureEnvelope.MultisigRpc
+  const bootstrapWithAccountUndefined: SignatureEnvelope.MultisigRpc = {
+    ...bootstrap,
+    account: undefined,
+  }
+
+  expectTypeOf(initialized.signatures).toMatchTypeOf<
+    readonly SignatureEnvelope.SignatureEnvelopeRpc[]
+  >()
+  expectTypeOf(bootstrap.signatures).toMatchTypeOf<
+    readonly SignatureEnvelope.SignatureEnvelopeRpc[]
+  >()
+  expectTypeOf(
+    bootstrapWithAccountUndefined,
+  ).toMatchTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf<
+    SignatureEnvelope.GetType<typeof bootstrap>
+  >().toEqualTypeOf<'multisig'>()
+})
+
+test('MultisigRpc rejects legacy shapes', () => {
+  const combined = {
+    account: '0x1111111111111111111111111111111111111111',
+    init: {
+      owners: [
+        {
+          owner: '0x1111111111111111111111111111111111111111',
+          weight: 1,
+        },
+      ],
+      threshold: 1,
+    },
+    signatures: [signature],
+  } as const
+  // @ts-expect-error Bootstrap RPC signatures omit `account`.
+  const combinedRpc: SignatureEnvelope.MultisigRpc = combined
+
+  const serialized = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: ['0x1234'],
+  } as const
+  // @ts-expect-error Owner approvals use structured RPC envelopes.
+  const serializedRpc: SignatureEnvelope.MultisigRpc = serialized
+
+  const tagged = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: [signature],
+    type: 'multisig',
+  } as const
+  // @ts-expect-error Multisig RPC signatures are untagged.
+  const taggedRpc: SignatureEnvelope.MultisigRpc = tagged
+
+  expectTypeOf(combinedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf(serializedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf(taggedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+})

package/src/tempo/SignatureEnvelope.test.ts

@@ -2914,18 +2914,45 @@ describe('multisig', () => {
     expect(SignatureEnvelope.deserialize(serialized)).toEqual(envelope)
   })
 
-  test('deserialize: rejects the empty `init` placeholder (`0x80`)', () => {
-    const withPlaceholder = Hex.concat(
+  test('deserialize: rejects the legacy three-field wire shape', () => {
+    const init = MultisigConfig.toTuple({
+      threshold: 1,
+      owners: [
+        { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
+      ],
+    })
+    const legacy = Hex.concat(
       '0x05',
-      Rlp.fromHex([account, [SignatureEnvelope.serialize(innerP256)], '0x']),
+      Rlp.fromHex([account, [SignatureEnvelope.serialize(innerP256)], init]),
     )
-    expect(() => SignatureEnvelope.deserialize(withPlaceholder)).toThrowError(
+    expect(() => SignatureEnvelope.deserialize(legacy)).toThrowError(
+      SignatureEnvelope.InvalidSerializedError,
+    )
+  })
+
+  test('deserialize: rejects an invalid initialized account', () => {
+    const malformed = Hex.concat(
+      '0x05',
+      Rlp.fromHex(['0x11', [SignatureEnvelope.serialize(innerP256)]]),
+    )
+    expect(() => SignatureEnvelope.deserialize(malformed)).toThrowError(
       SignatureEnvelope.InvalidSerializedError,
     )
   })
 
   test('getType', () => {
     expect(SignatureEnvelope.getType(envelope)).toBe('multisig')
+    expect(
+      SignatureEnvelope.getType({
+        init: {
+          threshold: 1,
+          owners: [
+            { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
+          ],
+        },
+        signatures: [innerP256],
+      } as never),
+    ).toBe('multisig')
   })
 
   test('extractAddress returns the multisig account', () => {
@@ -2938,9 +2965,19 @@ describe('multisig', () => {
   })
 
   test('toRpc/fromRpc round-trip', () => {
-    const rpc = SignatureEnvelope.toRpc(envelope)
-    expect(rpc.type).toBe('multisig')
+    const rpc = SignatureEnvelope.toRpc(
+      envelope,
+    ) as SignatureEnvelope.MultisigRpc
+    expect(rpc).toMatchObject({
+      account,
+      signatures: [{ type: 'secp256k1' }, { type: 'p256' }],
+    })
+    expect(rpc.init).toBeUndefined()
+    expect('type' in rpc).toBe(false)
     expect(SignatureEnvelope.fromRpc(rpc)).toEqual(envelope)
+    expect(
+      SignatureEnvelope.fromRpc({ ...rpc, type: 'multisig' } as never),
+    ).toEqual(envelope)
   })
 
   test('assert: missing properties', () => {
@@ -2949,6 +2986,63 @@ describe('multisig', () => {
     ).toThrowError()
   })
 
+  test('assert: rejects empty owner approvals', () => {
+    expect(() =>
+      SignatureEnvelope.assert({
+        type: 'multisig',
+        account,
+        signatures: [],
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig signatures cannot be empty.]`,
+    )
+  })
+
+  test('assert: accepts at most eight owner approvals', () => {
+    expect(() =>
+      SignatureEnvelope.assert({
+        type: 'multisig',
+        account,
+        signatures: Array.from(
+          { length: MultisigConfig.maxSignatures },
+          () => innerP256,
+        ),
+      }),
+    ).not.toThrow()
+
+    expect(() =>
+      SignatureEnvelope.assert({
+        type: 'multisig',
+        account,
+        signatures: Array.from(
+          { length: MultisigConfig.maxSignatures + 1 },
+          () => innerP256,
+        ),
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig signatures exceed 8.]`,
+    )
+  })
+
+  test('assert: rejects oversized owner approvals', () => {
+    const oversized = {
+      ...signature_webauthn,
+      metadata: {
+        ...signature_webauthn.metadata,
+        clientDataJSON: JSON.stringify({ value: 'x'.repeat(2048) }),
+      },
+    }
+    expect(() =>
+      SignatureEnvelope.assert({
+        type: 'multisig',
+        account,
+        signatures: [oversized],
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig owner signature exceeds 2049 bytes.]`,
+    )
+  })
+
   test('assert: rejects keychain owner approvals', () => {
     expect(() =>
       SignatureEnvelope.assert({
@@ -2980,42 +3074,44 @@ describe('multisig', () => {
     })
 
     test('assert: accepts the maximum nesting depth', () => {
-      const depth3 = SignatureEnvelope.from({
+      const depth2 = SignatureEnvelope.from({
         type: 'multisig',
         account,
-        signatures: [
-          SignatureEnvelope.from({
-            type: 'multisig',
-            account: nestedAccount,
-            signatures: [nested],
-          }),
-        ],
+        signatures: [nested],
       })
-      expect(() => SignatureEnvelope.assert(depth3)).not.toThrowError()
+      expect(() => SignatureEnvelope.assert(depth2)).not.toThrowError()
     })
 
     test('assert: rejects nesting deeper than the maximum', () => {
-      const depth4 = SignatureEnvelope.from({
+      const depth3 = SignatureEnvelope.from({
         type: 'multisig',
         account,
         signatures: [
           SignatureEnvelope.from({
             type: 'multisig',
             account: nestedAccount,
-            signatures: [
-              SignatureEnvelope.from({
-                type: 'multisig',
-                account: nestedAccount,
-                signatures: [nested],
-              }),
-            ],
+            signatures: [nested],
           }),
         ],
       })
       expect(() =>
-        SignatureEnvelope.assert(depth4),
+        SignatureEnvelope.assert(depth3),
       ).toThrowErrorMatchingInlineSnapshot(
-        `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig nesting depth exceeds 3.]`,
+        `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig nesting depth exceeds 2.]`,
+      )
+    })
+
+    test('deserialize: rejects nesting deeper than the maximum during decode', () => {
+      const primitive = SignatureEnvelope.serialize(innerP256)
+      const depth1 = Hex.concat(
+        '0x05',
+        Rlp.fromHex([nestedAccount, [primitive]]),
+      )
+      const depth2 = Hex.concat('0x05', Rlp.fromHex([nestedAccount, [depth1]]))
+      const depth3 = Hex.concat('0x05', Rlp.fromHex([account, [depth2]]))
+
+      expect(() => SignatureEnvelope.deserialize(depth3)).toThrowError(
+        SignatureEnvelope.InvalidSerializedError,
       )
     })
 
@@ -3051,10 +3147,11 @@ describe('multisig', () => {
         },
       ],
     }
+    const bootstrapAccount = MultisigConfig.getAddress(init)
 
     const bootstrapEnvelope = SignatureEnvelope.from({
       type: 'multisig',
-      account,
+      account: bootstrapAccount,
       signatures: [SignatureEnvelope.from(signature_secp256k1), innerP256],
       init,
     })
@@ -3066,12 +3163,68 @@ describe('multisig', () => {
       )
     })
 
+    test('deserialize: validates bootstrap init semantics', () => {
+      const invalid = Hex.concat(
+        '0x05',
+        Rlp.fromHex([
+          [MultisigConfig.zeroSalt, '0x01', []],
+          [SignatureEnvelope.serialize(innerP256)],
+        ]),
+      )
+      expect(() => SignatureEnvelope.deserialize(invalid)).toThrowError(
+        MultisigConfig.InvalidConfigError,
+      )
+    })
+
+    test('deserialize: rejects noncanonical bootstrap field widths', () => {
+      const signatures = [SignatureEnvelope.serialize(innerP256)]
+      const shortSalt = Hex.concat(
+        '0x05',
+        Rlp.fromHex([
+          [`0x${'00'.repeat(31)}`, '0x01', [[init.owners[0]!.owner, '0x01']]],
+          signatures,
+        ]),
+      )
+      const wideThreshold = Hex.concat(
+        '0x05',
+        Rlp.fromHex([
+          [init.salt, '0x0001', [[init.owners[0]!.owner, '0x01']]],
+          signatures,
+        ]),
+      )
+      const wideWeight = Hex.concat(
+        '0x05',
+        Rlp.fromHex([
+          [init.salt, '0x01', [[init.owners[0]!.owner, '0x0001']]],
+          signatures,
+        ]),
+      )
+
+      for (const serialized of [shortSalt, wideThreshold, wideWeight])
+        expect(() => SignatureEnvelope.deserialize(serialized)).toThrowError(
+          SignatureEnvelope.InvalidSerializedError,
+        )
+    })
+
+    test('serialize: wire shape is `0x05 || rlp([init, signatures])`', () => {
+      const serialized = SignatureEnvelope.serialize(bootstrapEnvelope)
+      const [address] = Rlp.toHex(Hex.slice(serialized, 1)) as readonly [
+        MultisigConfig.Tuple,
+        readonly Hex.Hex[],
+      ]
+      expect(MultisigConfig.fromTuple(address)).toEqual(init)
+    })
+
     test('serialize/deserialize round-trip preserves non-zero salt', () => {
+      const saltedInit = {
+        ...init,
+        salt: `0x${'42'.repeat(32)}` as const,
+      }
       const salted = SignatureEnvelope.from({
         type: 'multisig',
-        account,
+        account: MultisigConfig.getAddress(saltedInit),
         signatures: [SignatureEnvelope.from(signature_secp256k1), innerP256],
-        init: { ...init, salt: `0x${'42'.repeat(32)}` },
+        init: saltedInit,
       })
       const serialized = SignatureEnvelope.serialize(salted)
       const deserialized = SignatureEnvelope.deserialize(
@@ -3094,27 +3247,72 @@ describe('multisig', () => {
     })
 
     test('toRpc/fromRpc round-trip with init', () => {
-      const rpc = SignatureEnvelope.toRpc(bootstrapEnvelope)
+      const rpc = SignatureEnvelope.toRpc(
+        bootstrapEnvelope,
+      ) as SignatureEnvelope.MultisigRpc
       expect(rpc.init).toEqual(init)
+      expect(rpc.account).toBeUndefined()
+      expect('type' in rpc).toBe(false)
       expect(SignatureEnvelope.fromRpc(rpc)).toEqual(bootstrapEnvelope)
     })
 
-    test('toRpc encodes owner approvals as serialized hex (node `Vec<Bytes>`)', () => {
+    test('toRpc normalizes numberish init fields and the default salt', () => {
+      const rpc = SignatureEnvelope.toRpc({
+        ...bootstrapEnvelope,
+        init: {
+          threshold: '0x1',
+          owners: init.owners.map((owner) => ({
+            ...owner,
+            weight: '0x1' as const,
+          })),
+        },
+      } as SignatureEnvelope.Multisig<
+        number | Hex.Hex
+      >) as SignatureEnvelope.MultisigRpc
+      expect(rpc.init).toEqual({
+        salt: MultisigConfig.zeroSalt,
+        threshold: 1,
+        owners: init.owners,
+      })
+    })
+
+    test('toRpc encodes owner approvals as structured RPC envelopes', () => {
       const multisig = bootstrapEnvelope as SignatureEnvelope.Multisig
       const rpc = SignatureEnvelope.toRpc(
         multisig,
       ) as SignatureEnvelope.MultisigRpc
       expect(rpc.signatures).toEqual(
-        multisig.signatures.map((s) => SignatureEnvelope.serialize(s)),
+        multisig.signatures.map((signature) =>
+          SignatureEnvelope.toRpc(signature),
+        ),
       )
     })
 
     test('fromRpc detects multisig by shape (no `type` field)', () => {
       const rpc = SignatureEnvelope.toRpc(bootstrapEnvelope)
-      // The node omits the `type` discriminant; detection is shape-based.
-      const { type: _type, ...untyped } = rpc
-      expect(SignatureEnvelope.fromRpc(untyped as never)).toEqual(
+      expect(SignatureEnvelope.fromRpc(rpc)).toEqual(bootstrapEnvelope)
+    })
+
+    test('fromRpc accepts the opposite static property as undefined', () => {
+      const rpc = SignatureEnvelope.toRpc(
+        bootstrapEnvelope,
+      ) as SignatureEnvelope.MultisigRpc
+      expect(
+        SignatureEnvelope.fromRpc({ ...rpc, account: undefined } as never),
+      ).toEqual(bootstrapEnvelope)
+    })
+
+    test('fromRpc rejects the legacy combined account and init shape', () => {
+      const rpc = SignatureEnvelope.toRpc(
         bootstrapEnvelope,
+      ) as SignatureEnvelope.MultisigRpc
+      expect(() =>
+        SignatureEnvelope.fromRpc({
+          ...rpc,
+          account: bootstrapAccount,
+        } as never),
+      ).toThrowErrorMatchingInlineSnapshot(
+        `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: RPC multisig must contain exactly one of \`account\` or \`init\`.]`,
       )
     })
 
@@ -3122,11 +3320,24 @@ describe('multisig', () => {
       expect(() =>
         SignatureEnvelope.assert({
           type: 'multisig',
-          account,
-          signatures: [],
+          account: bootstrapAccount,
+          signatures: [innerP256],
           init: { threshold: 1, owners: [] },
         } as never),
       ).toThrowError()
     })
+
+    test('assert: init must derive the supplied account', () => {
+      expect(() =>
+        SignatureEnvelope.assert({
+          type: 'multisig',
+          account,
+          signatures: [innerP256],
+          init,
+        }),
+      ).toThrowErrorMatchingInlineSnapshot(
+        `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig init does not derive account.]`,
+      )
+    })
   })
 })