ox 1.7.2 → 1.7.5

package/src/core/_test/Signature.test.ts

@@ -572,6 +572,172 @@ describe('toBytes', () => {
   })
 })
 
+describe('toCompactBytes', () => {
+  test('default', () => {
+    const bytes = Signature.toCompactBytes({
+      r: '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf',
+      s: '0x4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+      yParity: 1,
+    })
+    expect(bytes.length).toBe(64)
+    expect(Hex.fromBytes(bytes)).toBe(
+      '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+    )
+  })
+
+  test('behavior: r/s shorter than 32 bytes are left-padded, not right-padded', () => {
+    const bytes = Signature.toCompactBytes({
+      r: '0x01',
+      s: '0x02',
+      yParity: 0,
+    })
+    // `r` occupies the first 32 bytes and must be the big-endian integer `1`
+    // (left-padded), not `1` shifted into the top byte (right-padded).
+    expect(Hex.fromBytes(bytes.subarray(0, 32))).toBe(
+      '0x0000000000000000000000000000000000000000000000000000000000000001',
+    )
+    expect(Hex.fromBytes(bytes.subarray(32, 64))).toBe(
+      '0x0000000000000000000000000000000000000000000000000000000000000002',
+    )
+  })
+
+  test('behavior: round-trips through recoverPublicKey for a signature whose r has a leading zero byte', async () => {
+    const { Secp256k1 } = await import('ox')
+    const payload = `0x${'11'.repeat(32)}` as const
+    const privateKey = Hex.fromNumber(4n * 123456789013n + 7n, { size: 32 })
+    const signature = Secp256k1.sign({ payload, privateKey })
+    // sanity: this fixture's `r` genuinely has a leading zero byte
+    expect(signature.r.startsWith('0x00')).toBe(true)
+    const expectedPublicKey = Secp256k1.recoverPublicKey({ payload, signature })
+
+    // simulate an external source (RPC/subgraph/DB) that stores `r` in
+    // minimal (non-zero-padded) form, as the `Hex.Hex` type permits
+    const minimalR = `0x${signature.r.slice(4)}` as const
+    const recoveredBytes = Signature.toRecoveredBytes({
+      r: minimalR,
+      s: signature.s,
+      yParity: signature.yParity,
+    })
+    const roundTripped = Signature.fromRecoveredBytes(recoveredBytes)
+    const recoveredPublicKey = Secp256k1.recoverPublicKey({
+      payload,
+      signature: roundTripped,
+    })
+    expect(recoveredPublicKey.x).toBe(expectedPublicKey.x)
+    expect(recoveredPublicKey.y).toBe(expectedPublicKey.y)
+  })
+})
+
+describe('fromCompactBytes', () => {
+  test('default', () => {
+    const signature = Signature.fromCompactBytes(
+      Bytes.fromHex(
+        '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+      ),
+    )
+    expect(signature).toStrictEqual({
+      r: '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf',
+      s: '0x4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+    })
+  })
+
+  test('behavior: throws on a byte length other than 64', () => {
+    expect(() => Signature.fromCompactBytes(new Uint8Array(65)))
+      .toThrowErrorMatchingInlineSnapshot(`
+      [Signature.InvalidSerializedSizeError: Value \`0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0\` is an invalid signature size.
+
+      Expected: 64 bytes.
+      Received 65 bytes.]
+    `)
+  })
+})
+
+describe('toRecoveredBytes', () => {
+  test('default', () => {
+    const bytes = Signature.toRecoveredBytes({
+      r: '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf',
+      s: '0x4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+      yParity: 1,
+    })
+    expect(bytes.length).toBe(65)
+    expect(bytes[0]).toBe(1)
+    expect(Hex.fromBytes(bytes.subarray(1))).toBe(
+      '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+    )
+  })
+
+  test('behavior: r/s shorter than 32 bytes are left-padded, not right-padded', () => {
+    const bytes = Signature.toRecoveredBytes({
+      r: '0x01',
+      s: '0x02',
+      yParity: 0,
+    })
+    expect(Hex.fromBytes(bytes.subarray(1, 33))).toBe(
+      '0x0000000000000000000000000000000000000000000000000000000000000001',
+    )
+    expect(Hex.fromBytes(bytes.subarray(33, 65))).toBe(
+      '0x0000000000000000000000000000000000000000000000000000000000000002',
+    )
+  })
+
+  test('behavior: throws before coercing an out-of-range yParity', () => {
+    expect(() =>
+      Signature.toRecoveredBytes({
+        r: '0x01',
+        s: '0x02',
+        yParity: 256,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Signature.InvalidYParityError: Value \`256\` is an invalid y-parity value. Y-parity must be 0 or 1.]`,
+    )
+  })
+})
+
+describe('fromRecoveredBytes', () => {
+  test('default', () => {
+    const bytes = new Uint8Array(65)
+    bytes[0] = 1
+    bytes.set(
+      Bytes.fromHex(
+        '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf',
+      ),
+      1,
+    )
+    bytes.set(
+      Bytes.fromHex(
+        '0x4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+      ),
+      33,
+    )
+    const signature = Signature.fromRecoveredBytes(bytes)
+    expect(signature).toStrictEqual({
+      r: '0x6e100a352ec6ad1b70802290e18aeed190704973570f3b8ed42cb9808e2ea6bf',
+      s: '0x4a90a229a244495b41890987806fcbd2d5d23fc0dbe5f5256c2613c039d76db8',
+      yParity: 1,
+    })
+  })
+
+  test('behavior: throws on a byte length other than 65', () => {
+    expect(() => Signature.fromRecoveredBytes(new Uint8Array(64)))
+      .toThrowErrorMatchingInlineSnapshot(`
+      [Signature.InvalidSerializedSizeError: Value \`0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0\` is an invalid signature size.
+
+      Expected: 65 bytes.
+      Received 64 bytes.]
+    `)
+  })
+
+  test('behavior: throws on an out-of-range yParity byte', () => {
+    const bytes = new Uint8Array(65)
+    bytes[0] = 7
+    expect(() =>
+      Signature.fromRecoveredBytes(bytes),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Signature.InvalidYParityError: Value \`7\` is an invalid y-parity value. Y-parity must be 0 or 1.]`,
+    )
+  })
+})
+
 describe('toDerHex', () => {
   test('default', () => {
     const signature = Signature.from({

package/src/core/_test/Siwe.test.ts

@@ -324,6 +324,53 @@ describe('createMessage', () => {
   `)
   })
 
+  test('behavior: uri with no path (authority only)', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(Date.UTC(2023, 1, 1)))
+
+    expect(Siwe.createMessage({ ...message, uri: 'https://example.com' }))
+      .toMatchInlineSnapshot(`
+      "example.com wants you to sign in with your Ethereum account:
+      0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
+
+
+      URI: https://example.com
+      Version: 1
+      Chain ID: 1
+      Nonce: foobarbaz
+      Issued At: 2023-02-01T00:00:00.000Z"
+    `)
+
+    vi.useRealTimers()
+  })
+
+  test('behavior: resources entry with no path (authority only)', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(Date.UTC(2023, 1, 1)))
+
+    expect(
+      Siwe.createMessage({
+        ...message,
+        resources: ['https://example.com', 'https://example.com/foo'],
+      }),
+    ).toMatchInlineSnapshot(`
+      "example.com wants you to sign in with your Ethereum account:
+      0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
+
+
+      URI: https://example.com/path
+      Version: 1
+      Chain ID: 1
+      Nonce: foobarbaz
+      Issued At: 2023-02-01T00:00:00.000Z
+      Resources:
+      - https://example.com
+      - https://example.com/foo"
+    `)
+
+    vi.useRealTimers()
+  })
+
   test('behavior: invalid version', () => {
     expect(() =>
       // @ts-expect-error
@@ -373,7 +420,7 @@ describe('createMessage', () => {
     - Every resource must be a RFC 3986 URI.
     - See https://www.rfc-editor.org/rfc/rfc3986
 
-    Provided value: https://example.com]
+    Provided value: foo]
   `)
   })
 
@@ -426,6 +473,58 @@ describe('isUri', () => {
     )
   })
 
+  test('behavior: authority with empty path (bare origin)', () => {
+    expect(Siwe.isUri('https://example.com')).toMatchInlineSnapshot(
+      `"https://example.com"`,
+    )
+  })
+
+  test('behavior: authority with empty path and port', () => {
+    expect(Siwe.isUri('https://example.com:8080')).toMatchInlineSnapshot(
+      `"https://example.com:8080"`,
+    )
+  })
+
+  test('behavior: authority with empty path and query', () => {
+    expect(Siwe.isUri('https://example.com?a=1')).toMatchInlineSnapshot(
+      `"https://example.com?a=1"`,
+    )
+  })
+
+  test('behavior: authority with empty path and fragment', () => {
+    expect(Siwe.isUri('https://example.com#top')).toMatchInlineSnapshot(
+      `"https://example.com#top"`,
+    )
+  })
+
+  test('behavior: authority with empty path (non-http scheme)', () => {
+    expect(Siwe.isUri('ipfs://bafybeiabc')).toMatchInlineSnapshot(
+      `"ipfs://bafybeiabc"`,
+    )
+  })
+
+  test('behavior: authority variants with empty path', () => {
+    expect([
+      Siwe.isUri('https://[2001:db8::1]'),
+      Siwe.isUri('https://user:pass@example.com:8080'),
+      Siwe.isUri('foo://[v1.fe]'),
+    ]).toMatchInlineSnapshot(`
+      [
+        "https://[2001:db8::1]",
+        "https://user:pass@example.com:8080",
+        "foo://[v1.fe]",
+      ]
+    `)
+  })
+
+  test.each([
+    'https://example.com:bad',
+    'https://[:::]',
+    'https://user@@example.com',
+  ])('behavior: invalid authority with empty path `%s`', (uri) => {
+    expect(Siwe.isUri(uri)).toMatchInlineSnapshot(`false`)
+  })
+
   test('behavior: check for illegal characters', () => {
     expect(Siwe.isUri('^')).toBeFalsy()
   })

package/src/tempo/AuthorizationTempo.test.ts

@@ -348,6 +348,8 @@ describe('fromRpc', () => {
         type: 'p256',
       },
     })
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('p256')
     expect(result.signature).toHaveProperty('prehash', true)
     expect(result.signature).toHaveProperty('publicKey')
@@ -370,6 +372,8 @@ describe('fromRpc', () => {
           '0x49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d976305000000007b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22222c226f726967696e223a2268747470733a2f2f6578616d706c652e636f6d222c2263726f73734f726967696e223a66616c73657d',
       },
     })
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('webAuthn')
     expect(result.signature).toHaveProperty('metadata')
     expect(result.signature).toHaveProperty('publicKey')
@@ -994,6 +998,8 @@ describe('toRpc', () => {
         type: 'p256',
       },
     })
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('p256')
   })
 
@@ -1019,6 +1025,8 @@ describe('toRpc', () => {
         type: 'webAuthn',
       },
     })
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('webAuthn')
   })
 })

package/src/tempo/KeyAuthorization.test-d.ts

@@ -1,7 +1,6 @@
 import { expectTypeOf, test } from 'vp/test'
 import * as KeyAuthorization from './KeyAuthorization.js'
-import * as MultisigConfig from './MultisigConfig.js'
-import type * as SignatureEnvelope from './SignatureEnvelope.js'
+import * as SignatureEnvelope from './SignatureEnvelope.js'
 
 const authorization = {
   address: '0x1111111111111111111111111111111111111111',
@@ -20,26 +19,18 @@ const signature = {
 
 const multisig = {
   account: '0x2222222222222222222222222222222222222222',
-  config: MultisigConfig.from({
+  config: {
+    salt: `0x${'00'.repeat(32)}`,
+    version: 0n,
+    threshold: 1,
     owners: [
-      {
-        owner: '0x1111111111111111111111111111111111111111',
-        weight: 1,
-      },
+      { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
     ],
-    threshold: 1,
-    version: 1n,
-  }),
+  },
   signatures: [signature],
   type: 'multisig',
 } as const satisfies SignatureEnvelope.Multisig
 
-const keychain = {
-  inner: signature,
-  type: 'keychain',
-  userAddress: authorization.address,
-} as const satisfies SignatureEnvelope.Keychain
-
 test('accepts primitive signatures', () => {
   const signed = KeyAuthorization.from(authorization, { signature })
 
@@ -48,62 +39,13 @@ test('accepts primitive signatures', () => {
   >()
 })
 
-test('accepts multisig signatures', () => {
-  const signed = KeyAuthorization.from(authorization, { signature: multisig })
-
-  expectTypeOf(signed.signature).toMatchTypeOf<
-    KeyAuthorization.Signed['signature']
-  >()
-
-  const multisigRpc = {
-    account: multisig.account,
-    config: MultisigConfig.toRpc(multisig.config),
-    signatures: [
-      {
-        r: '0x01',
-        s: '0x02',
-        type: 'secp256k1',
-        yParity: '0x0',
-      },
-    ],
-  } as const satisfies SignatureEnvelope.MultisigRpc
-
-  const rpc: KeyAuthorization.Rpc = {
-    chainId: '0x1',
-    expiry: null,
-    keyId: authorization.address,
-    keyType: authorization.type,
-    signature: multisigRpc,
-  }
-
-  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
-})
-
-test('rejects keychain signatures', () => {
-  KeyAuthorization.from(authorization, {
-    // @ts-expect-error Key authorizations do not accept keychain signatures.
-    signature: keychain,
-  })
-
-  const keychainRpc = {
-    signature: {
-      r: '0x01',
-      s: '0x02',
-      type: 'secp256k1',
-      yParity: '0x0',
-    },
-    type: 'keychain',
-    userAddress: authorization.address,
-  } as const satisfies SignatureEnvelope.KeychainRpc
-
-  const rpc: KeyAuthorization.Rpc = {
-    chainId: '0x1',
-    expiry: null,
-    keyId: authorization.address,
-    keyType: authorization.type,
-    // @ts-expect-error Key authorizations do not accept keychain RPC signatures.
-    signature: keychainRpc,
-  }
-
-  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
+test('accepts multisig signatures and account-bound grants', () => {
+  const signed = KeyAuthorization.from(
+    { ...authorization, account: multisig.account, type: 'multisig' },
+    { signature: multisig },
+  )
+  expectTypeOf(signed).toMatchTypeOf<KeyAuthorization.Signed>()
+  expectTypeOf(
+    KeyAuthorization.toRpc(signed),
+  ).toMatchTypeOf<KeyAuthorization.Rpc>()
 })

package/src/tempo/KeyAuthorization.test.ts

@@ -69,6 +69,8 @@ const signature_multisig = {
   signatures: [SignatureEnvelope.from(signature_secp256k1)],
   type: 'multisig',
 } as const satisfies SignatureEnvelope.Multisig
+const signature_multisig_rpc =
+  '0xf89794be95c3f554e9fc85ec51be69a3d807a0d55bcf2cf83ba000000000000000000000000000000000000000000000000000000000000000000101d7d694f39fd6e51aad88f6f4ce6ab8827279cfffb9226601f843b841fa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d01c' as const
 
 const signature_keychain = {
   inner: SignatureEnvelope.from(signature_secp256k1),
@@ -76,7 +78,66 @@ const signature_keychain = {
   userAddress: address,
 } as const satisfies SignatureEnvelope.Keychain
 
+describe('multisig account binding', () => {
+  test('rejects unbound grants before signing or encoding', () => {
+    const authorization = { address, chainId: 1n, type: 'multisig' } as const
+    const signed = {
+      ...authorization,
+      signature: SignatureEnvelope.from(signature_secp256k1),
+    }
+    for (const encode of [
+      () => KeyAuthorization.from(authorization),
+      () => KeyAuthorization.toTuple(authorization),
+      () => KeyAuthorization.getSignPayload(authorization),
+      () => KeyAuthorization.serialize(authorization),
+      () => KeyAuthorization.toRpc(signed),
+    ])
+      expect(encode).toThrowErrorMatchingInlineSnapshot(
+        `[KeyAuthorization.MissingAccountError: Multisig key grants require a parent account binding.]`,
+      )
+  })
+
+  test('rejects unbound RPC and RLP grants', () => {
+    const signed = KeyAuthorization.from(
+      { account: address, address, chainId: 1n, type: 'multisig' },
+      { signature: signature_secp256k1 },
+    )
+    const rpc = KeyAuthorization.toRpc(signed)
+    for (const account of [undefined, null])
+      expect(() => KeyAuthorization.fromRpc({ ...rpc, account })).toThrowError(
+        KeyAuthorization.MissingAccountError,
+      )
+    expect(() =>
+      KeyAuthorization.fromTuple([['0x01', '0x03', address]]),
+    ).toThrowError(KeyAuthorization.MissingAccountError)
+    expect(KeyAuthorization.fromRpc(rpc).account).toBe(address)
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)).account,
+    ).toBe(address)
+  })
+})
+
 describe('from', () => {
+  test('accepts multisig grants and delegates', () => {
+    const signed = KeyAuthorization.from(
+      {
+        address,
+        chainId: 1n,
+        type: 'multisig',
+        account: signature_multisig.account,
+      },
+      { signature: signature_multisig },
+    )
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
+    ).toEqual(signed)
+    expect(KeyAuthorization.fromRpc(KeyAuthorization.toRpc(signed))).toEqual(
+      signed,
+    )
+  })
+})
+
+describe('fromRpc', () => {
   test('default', () => {
     const authorization = KeyAuthorization.from({
       address,
@@ -502,16 +563,42 @@ describe('from', () => {
 })
 
 describe('fromRpc', () => {
-  test('multisig', () => {
+  test('behavior: multisig', () => {
     const authorization = KeyAuthorization.fromRpc({
       chainId: '0x1',
       expiry: null,
       keyId: address,
       keyType: 'secp256k1',
-      signature: SignatureEnvelope.toRpc(signature_multisig),
+      signature: signature_multisig_rpc,
     })
 
-    expect(authorization.signature).toEqual(signature_multisig)
+    expect(authorization.signature).toMatchInlineSnapshot(`
+      {
+        "account": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+        "config": {
+          "owners": [
+            {
+              "owner": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
+              "weight": 1,
+            },
+          ],
+          "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "threshold": 1,
+          "version": 1n,
+        },
+        "signatures": [
+          {
+            "signature": {
+              "r": "0xfa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7",
+              "s": "0x780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d0",
+              "yParity": 1,
+            },
+            "type": "secp256k1",
+          },
+        ],
+        "type": "multisig",
+      }
+    `)
   })
 
   test('rejects a keychain signature', () => {
@@ -1084,17 +1171,16 @@ describe('getSignPayload', () => {
 describe('deserialize', () => {
   test('example: matches the frozen multisig witness vector', () => {
     const serialized =
-      '0xf8f1f85382107980941eff47bc3a10a45d4b230b5d10e37751fe6aa718808080a0535353535353535353535353535353535353535353535353535353535353535380949dba7f426b711d4893c11611eacf7cc334e7146bb89a05f897949dba7f426b711d4893c11611eacf7cc334e7146bf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d6947e5f4552091a69125d5dfcb7b8c2659029395bdf01f843b8412cfed9350faf80e4115e3c4c967356b80a8e6ee42e4a49ab953c8c8a3537d8d8359bf035a9bea18f32b0da7129cdce3ce701abc09ad8919b93da21a0d57e21451b' as const
+      '0xf8f1f85382107980941eff47bc3a10a45d4b230b5d10e37751fe6aa718808080a053535353535353535353535353535353535353535353535353535353535353538094c4a590afa7337e5cd5eb3aa60cacf91c5400044bb89a05f89794c4a590afa7337e5cd5eb3aa60cacf91c5400044bf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d6947e5f4552091a69125d5dfcb7b8c2659029395bdf01f843b8412cfed9350faf80e4115e3c4c967356b80a8e6ee42e4a49ab953c8c8a3537d8d8359bf035a9bea18f32b0da7129cdce3ce701abc09ad8919b93da21a0d57e21451b' as const
     const authorization = KeyAuthorization.deserialize(serialized)
 
     expect(authorization).toMatchInlineSnapshot(`
       {
-        "account": "0x9dba7f426b711d4893c11611eacf7cc334e7146b",
+        "account": "0xc4a590afa7337e5cd5eb3aa60cacf91c5400044b",
         "address": "0x1eff47bc3a10a45d4b230b5d10e37751fe6aa718",
         "chainId": 4217n,
-        "isAdmin": false,
         "signature": {
-          "account": "0x9dba7f426b711d4893c11611eacf7cc334e7146b",
+          "account": "0xc4a590afa7337e5cd5eb3aa60cacf91c5400044b",
           "config": {
             "owners": [
               {
@@ -1306,6 +1392,19 @@ describe('serialize', () => {
 })
 
 describe('toRpc', () => {
+  test('behavior: multisig', () => {
+    const authorization = KeyAuthorization.toRpc({
+      address,
+      chainId: 1n,
+      signature: signature_multisig,
+      type: 'secp256k1',
+    })
+
+    expect(authorization.signature).toMatchInlineSnapshot(
+      `"${signature_multisig_rpc}"`,
+    )
+  })
+
   test('secp256k1', () => {
     const authorization = KeyAuthorization.from({
       address,
@@ -2503,11 +2602,11 @@ describe('admin keys (TIP-1049)', () => {
     expect((authTuple as unknown as unknown[]).length).toBe(3)
   })
 
-  test('fromTuple: drops orphan isAdmin without account', () => {
+  test('fromTuple: preserves isAdmin without account', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x01'],
     ])
-    expect(restored.isAdmin).toBeUndefined()
+    expect(restored.isAdmin).toBe(true)
     expect(restored.account).toBeUndefined()
   })
 
@@ -2515,7 +2614,7 @@ describe('admin keys (TIP-1049)', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x', account],
     ])
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })
 
@@ -2561,7 +2660,7 @@ describe('admin keys (TIP-1049)', () => {
     })
     const serialized = KeyAuthorization.serialize(authorization)
     const restored = KeyAuthorization.deserialize(serialized)
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })
 
@@ -2584,14 +2683,14 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBe(account)
   })
 
-  test('fromRpc: drops orphan isAdmin without account', () => {
+  test('fromRpc: preserves isAdmin without account', () => {
     const authorization = KeyAuthorization.from(
       { address, chainId: 1n, type: 'secp256k1' },
       { signature: SignatureEnvelope.from(signature_secp256k1) },
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, isAdmin: true })
-    expect(restored.isAdmin).toBeUndefined()
+    expect(restored.isAdmin).toBe(true)
     expect(restored.account).toBeUndefined()
   })
 
@@ -2602,7 +2701,7 @@ describe('admin keys (TIP-1049)', () => {
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, account })
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })