ox 1.7.4 → 1.7.5

package/src/core/_test/Siwe.test.ts

@@ -324,6 +324,53 @@ describe('createMessage', () => {
   `)
   })
 
+  test('behavior: uri with no path (authority only)', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(Date.UTC(2023, 1, 1)))
+
+    expect(Siwe.createMessage({ ...message, uri: 'https://example.com' }))
+      .toMatchInlineSnapshot(`
+      "example.com wants you to sign in with your Ethereum account:
+      0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
+
+
+      URI: https://example.com
+      Version: 1
+      Chain ID: 1
+      Nonce: foobarbaz
+      Issued At: 2023-02-01T00:00:00.000Z"
+    `)
+
+    vi.useRealTimers()
+  })
+
+  test('behavior: resources entry with no path (authority only)', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(Date.UTC(2023, 1, 1)))
+
+    expect(
+      Siwe.createMessage({
+        ...message,
+        resources: ['https://example.com', 'https://example.com/foo'],
+      }),
+    ).toMatchInlineSnapshot(`
+      "example.com wants you to sign in with your Ethereum account:
+      0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
+
+
+      URI: https://example.com/path
+      Version: 1
+      Chain ID: 1
+      Nonce: foobarbaz
+      Issued At: 2023-02-01T00:00:00.000Z
+      Resources:
+      - https://example.com
+      - https://example.com/foo"
+    `)
+
+    vi.useRealTimers()
+  })
+
   test('behavior: invalid version', () => {
     expect(() =>
       // @ts-expect-error
@@ -373,7 +420,7 @@ describe('createMessage', () => {
     - Every resource must be a RFC 3986 URI.
     - See https://www.rfc-editor.org/rfc/rfc3986
 
-    Provided value: https://example.com]
+    Provided value: foo]
   `)
   })
 
@@ -426,6 +473,58 @@ describe('isUri', () => {
     )
   })
 
+  test('behavior: authority with empty path (bare origin)', () => {
+    expect(Siwe.isUri('https://example.com')).toMatchInlineSnapshot(
+      `"https://example.com"`,
+    )
+  })
+
+  test('behavior: authority with empty path and port', () => {
+    expect(Siwe.isUri('https://example.com:8080')).toMatchInlineSnapshot(
+      `"https://example.com:8080"`,
+    )
+  })
+
+  test('behavior: authority with empty path and query', () => {
+    expect(Siwe.isUri('https://example.com?a=1')).toMatchInlineSnapshot(
+      `"https://example.com?a=1"`,
+    )
+  })
+
+  test('behavior: authority with empty path and fragment', () => {
+    expect(Siwe.isUri('https://example.com#top')).toMatchInlineSnapshot(
+      `"https://example.com#top"`,
+    )
+  })
+
+  test('behavior: authority with empty path (non-http scheme)', () => {
+    expect(Siwe.isUri('ipfs://bafybeiabc')).toMatchInlineSnapshot(
+      `"ipfs://bafybeiabc"`,
+    )
+  })
+
+  test('behavior: authority variants with empty path', () => {
+    expect([
+      Siwe.isUri('https://[2001:db8::1]'),
+      Siwe.isUri('https://user:pass@example.com:8080'),
+      Siwe.isUri('foo://[v1.fe]'),
+    ]).toMatchInlineSnapshot(`
+      [
+        "https://[2001:db8::1]",
+        "https://user:pass@example.com:8080",
+        "foo://[v1.fe]",
+      ]
+    `)
+  })
+
+  test.each([
+    'https://example.com:bad',
+    'https://[:::]',
+    'https://user@@example.com',
+  ])('behavior: invalid authority with empty path `%s`', (uri) => {
+    expect(Siwe.isUri(uri)).toMatchInlineSnapshot(`false`)
+  })
+
   test('behavior: check for illegal characters', () => {
     expect(Siwe.isUri('^')).toBeFalsy()
   })

package/src/tempo/AuthorizationTempo.test.ts

@@ -348,7 +348,8 @@ describe('fromRpc', () => {
         type: 'p256',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('p256')
     expect(result.signature).toHaveProperty('prehash', true)
     expect(result.signature).toHaveProperty('publicKey')
@@ -371,7 +372,8 @@ describe('fromRpc', () => {
           '0x49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d976305000000007b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22222c226f726967696e223a2268747470733a2f2f6578616d706c652e636f6d222c2263726f73734f726967696e223a66616c73657d',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('webAuthn')
     expect(result.signature).toHaveProperty('metadata')
     expect(result.signature).toHaveProperty('publicKey')
@@ -996,7 +998,8 @@ describe('toRpc', () => {
         type: 'p256',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('p256')
   })
 
@@ -1022,7 +1025,8 @@ describe('toRpc', () => {
         type: 'webAuthn',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('webAuthn')
   })
 })

package/src/tempo/KeyAuthorization.test-d.ts

@@ -1,7 +1,6 @@
 import { expectTypeOf, test } from 'vp/test'
 import * as KeyAuthorization from './KeyAuthorization.js'
-import * as MultisigConfig from './MultisigConfig.js'
-import type * as SignatureEnvelope from './SignatureEnvelope.js'
+import * as SignatureEnvelope from './SignatureEnvelope.js'
 
 const authorization = {
   address: '0x1111111111111111111111111111111111111111',
@@ -20,26 +19,18 @@ const signature = {
 
 const multisig = {
   account: '0x2222222222222222222222222222222222222222',
-  config: MultisigConfig.from({
+  config: {
+    salt: `0x${'00'.repeat(32)}`,
+    version: 0n,
+    threshold: 1,
     owners: [
-      {
-        owner: '0x1111111111111111111111111111111111111111',
-        weight: 1,
-      },
+      { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
     ],
-    threshold: 1,
-    version: 1n,
-  }),
+  },
   signatures: [signature],
   type: 'multisig',
 } as const satisfies SignatureEnvelope.Multisig
 
-const keychain = {
-  inner: signature,
-  type: 'keychain',
-  userAddress: authorization.address,
-} as const satisfies SignatureEnvelope.Keychain
-
 test('accepts primitive signatures', () => {
   const signed = KeyAuthorization.from(authorization, { signature })
 
@@ -48,51 +39,13 @@ test('accepts primitive signatures', () => {
   >()
 })
 
-test('accepts multisig signatures', () => {
-  const signed = KeyAuthorization.from(authorization, { signature: multisig })
-
-  expectTypeOf(signed.signature).toMatchTypeOf<
-    KeyAuthorization.Signed['signature']
-  >()
-
-  const multisigRpc = '0xf8' as const satisfies SignatureEnvelope.MultisigRpc
-
-  const rpc: KeyAuthorization.Rpc = {
-    chainId: '0x1',
-    expiry: null,
-    keyId: authorization.address,
-    keyType: authorization.type,
-    signature: multisigRpc,
-  }
-
-  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
-})
-
-test('rejects keychain signatures', () => {
-  KeyAuthorization.from(authorization, {
-    // @ts-expect-error Key authorizations do not accept keychain signatures.
-    signature: keychain,
-  })
-
-  const keychainRpc = {
-    signature: {
-      r: '0x01',
-      s: '0x02',
-      type: 'secp256k1',
-      yParity: '0x0',
-    },
-    type: 'keychain',
-    userAddress: authorization.address,
-  } as const satisfies SignatureEnvelope.KeychainRpc
-
-  const rpc: KeyAuthorization.Rpc = {
-    chainId: '0x1',
-    expiry: null,
-    keyId: authorization.address,
-    keyType: authorization.type,
-    // @ts-expect-error Key authorizations do not accept keychain RPC signatures.
-    signature: keychainRpc,
-  }
-
-  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
+test('accepts multisig signatures and account-bound grants', () => {
+  const signed = KeyAuthorization.from(
+    { ...authorization, account: multisig.account, type: 'multisig' },
+    { signature: multisig },
+  )
+  expectTypeOf(signed).toMatchTypeOf<KeyAuthorization.Signed>()
+  expectTypeOf(
+    KeyAuthorization.toRpc(signed),
+  ).toMatchTypeOf<KeyAuthorization.Rpc>()
 })

package/src/tempo/KeyAuthorization.test.ts

@@ -78,7 +78,66 @@ const signature_keychain = {
   userAddress: address,
 } as const satisfies SignatureEnvelope.Keychain
 
+describe('multisig account binding', () => {
+  test('rejects unbound grants before signing or encoding', () => {
+    const authorization = { address, chainId: 1n, type: 'multisig' } as const
+    const signed = {
+      ...authorization,
+      signature: SignatureEnvelope.from(signature_secp256k1),
+    }
+    for (const encode of [
+      () => KeyAuthorization.from(authorization),
+      () => KeyAuthorization.toTuple(authorization),
+      () => KeyAuthorization.getSignPayload(authorization),
+      () => KeyAuthorization.serialize(authorization),
+      () => KeyAuthorization.toRpc(signed),
+    ])
+      expect(encode).toThrowErrorMatchingInlineSnapshot(
+        `[KeyAuthorization.MissingAccountError: Multisig key grants require a parent account binding.]`,
+      )
+  })
+
+  test('rejects unbound RPC and RLP grants', () => {
+    const signed = KeyAuthorization.from(
+      { account: address, address, chainId: 1n, type: 'multisig' },
+      { signature: signature_secp256k1 },
+    )
+    const rpc = KeyAuthorization.toRpc(signed)
+    for (const account of [undefined, null])
+      expect(() => KeyAuthorization.fromRpc({ ...rpc, account })).toThrowError(
+        KeyAuthorization.MissingAccountError,
+      )
+    expect(() =>
+      KeyAuthorization.fromTuple([['0x01', '0x03', address]]),
+    ).toThrowError(KeyAuthorization.MissingAccountError)
+    expect(KeyAuthorization.fromRpc(rpc).account).toBe(address)
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)).account,
+    ).toBe(address)
+  })
+})
+
 describe('from', () => {
+  test('accepts multisig grants and delegates', () => {
+    const signed = KeyAuthorization.from(
+      {
+        address,
+        chainId: 1n,
+        type: 'multisig',
+        account: signature_multisig.account,
+      },
+      { signature: signature_multisig },
+    )
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
+    ).toEqual(signed)
+    expect(KeyAuthorization.fromRpc(KeyAuthorization.toRpc(signed))).toEqual(
+      signed,
+    )
+  })
+})
+
+describe('fromRpc', () => {
   test('default', () => {
     const authorization = KeyAuthorization.from({
       address,
@@ -1112,17 +1171,16 @@ describe('getSignPayload', () => {
 describe('deserialize', () => {
   test('example: matches the frozen multisig witness vector', () => {
     const serialized =
-      '0xf8f1f85382107980941eff47bc3a10a45d4b230b5d10e37751fe6aa718808080a0535353535353535353535353535353535353535353535353535353535353535380949dba7f426b711d4893c11611eacf7cc334e7146bb89a05f897949dba7f426b711d4893c11611eacf7cc334e7146bf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d6947e5f4552091a69125d5dfcb7b8c2659029395bdf01f843b8412cfed9350faf80e4115e3c4c967356b80a8e6ee42e4a49ab953c8c8a3537d8d8359bf035a9bea18f32b0da7129cdce3ce701abc09ad8919b93da21a0d57e21451b' as const
+      '0xf8f1f85382107980941eff47bc3a10a45d4b230b5d10e37751fe6aa718808080a053535353535353535353535353535353535353535353535353535353535353538094c4a590afa7337e5cd5eb3aa60cacf91c5400044bb89a05f89794c4a590afa7337e5cd5eb3aa60cacf91c5400044bf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d6947e5f4552091a69125d5dfcb7b8c2659029395bdf01f843b8412cfed9350faf80e4115e3c4c967356b80a8e6ee42e4a49ab953c8c8a3537d8d8359bf035a9bea18f32b0da7129cdce3ce701abc09ad8919b93da21a0d57e21451b' as const
     const authorization = KeyAuthorization.deserialize(serialized)
 
     expect(authorization).toMatchInlineSnapshot(`
       {
-        "account": "0x9dba7f426b711d4893c11611eacf7cc334e7146b",
+        "account": "0xc4a590afa7337e5cd5eb3aa60cacf91c5400044b",
         "address": "0x1eff47bc3a10a45d4b230b5d10e37751fe6aa718",
         "chainId": 4217n,
-        "isAdmin": false,
         "signature": {
-          "account": "0x9dba7f426b711d4893c11611eacf7cc334e7146b",
+          "account": "0xc4a590afa7337e5cd5eb3aa60cacf91c5400044b",
           "config": {
             "owners": [
               {
@@ -2544,11 +2602,11 @@ describe('admin keys (TIP-1049)', () => {
     expect((authTuple as unknown as unknown[]).length).toBe(3)
   })
 
-  test('fromTuple: drops orphan isAdmin without account', () => {
+  test('fromTuple: preserves isAdmin without account', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x01'],
     ])
-    expect(restored.isAdmin).toBeUndefined()
+    expect(restored.isAdmin).toBe(true)
     expect(restored.account).toBeUndefined()
   })
 
@@ -2556,7 +2614,7 @@ describe('admin keys (TIP-1049)', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x', account],
     ])
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })
 
@@ -2602,7 +2660,7 @@ describe('admin keys (TIP-1049)', () => {
     })
     const serialized = KeyAuthorization.serialize(authorization)
     const restored = KeyAuthorization.deserialize(serialized)
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })
 
@@ -2625,14 +2683,14 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBe(account)
   })
 
-  test('fromRpc: drops orphan isAdmin without account', () => {
+  test('fromRpc: preserves isAdmin without account', () => {
     const authorization = KeyAuthorization.from(
       { address, chainId: 1n, type: 'secp256k1' },
       { signature: SignatureEnvelope.from(signature_secp256k1) },
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, isAdmin: true })
-    expect(restored.isAdmin).toBeUndefined()
+    expect(restored.isAdmin).toBe(true)
     expect(restored.account).toBeUndefined()
   })
 
@@ -2643,7 +2701,7 @@ describe('admin keys (TIP-1049)', () => {
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, account })
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })