passkey-kit 0.7.1 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passkey-kit",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "A helper library for creating and using passkey accounts on the Stellar blockchain.",
   "author": "Tyler van der Hoeven",
   "license": "MIT",

package/src/kit.ts

@@ -1,11 +1,12 @@
-import { Client as PasskeyClient, type Secp256r1Signature, type Signature } from 'passkey-kit-sdk'
+import { Client as PasskeyClient, type Signature, type SignerKey } from 'passkey-kit-sdk'
 import { Client as FactoryClient } from 'passkey-factory-sdk'
-import { Address, StrKey, hash, xdr, Transaction, SorobanRpc, Operation, TransactionBuilder } from '@stellar/stellar-sdk'
+import { Address, StrKey, hash, xdr, Transaction, SorobanRpc, Operation, TransactionBuilder, Keypair } from '@stellar/stellar-sdk'
 import base64url from 'base64url'
 import { startRegistration, startAuthentication } from "@simplewebauthn/browser"
 import type { AuthenticatorAttestationResponseJSON, AuthenticatorSelectionCriteria } from "@simplewebauthn/types"
 import { Buffer } from 'buffer'
 import { PasskeyBase } from './base'
+import { DEFAULT_TIMEOUT } from '@stellar/stellar-sdk/contract'
 
 export const DEFAULT_LTL = 12
 
@@ -51,17 +52,17 @@ export class PasskeyKit extends PasskeyBase {
             signer: {
                 tag: 'Secp256r1',
                 values: [
-                    keyId, 
-                    publicKey, 
+                    keyId,
+                    publicKey,
                     [new Map()],
-                    {tag: 'Persistent', values: undefined},
+                    { tag: 'Persistent', values: undefined },
                 ]
             },
         })
 
         if (result.isErr())
             throw new Error(result.unwrapErr().message)
-        
+
         if (!built)
             throw new Error('Failed to create wallet')
 
@@ -99,11 +100,6 @@ export class PasskeyKit extends PasskeyBase {
                 displayName
             },
             authenticatorSelection,
-            // authenticatorSelection: {
-            //     requireResidentKey: false,
-            //     residentKey: "preferred",
-            //     userVerification: "discouraged",
-            // },
             pubKeyCredParams: [{ alg: -7, type: "public-key" }],
             // attestation: "none",
             // timeout: 120_000,
@@ -188,98 +184,124 @@ export class PasskeyKit extends PasskeyBase {
     public async signAuthEntry(
         entry: xdr.SorobanAuthorizationEntry,
         options?: {
-            keyId?: 'any' | string | Uint8Array
             rpId?: string,
-            ledgersToLive?: number
+            keyId?: 'any' | string | Uint8Array
+            keypair?: Keypair,
+            validUntilLedgerSeq?: number
         }
     ) {
-        let { keyId, rpId, ledgersToLive = DEFAULT_LTL } = options || {}
+        let { rpId, keyId, keypair, validUntilLedgerSeq } = options || {}
+
+        if (keyId && keypair)
+            throw new Error('Provide either `options.keyId` or `options.keypair` but not both')
+
+        if (!validUntilLedgerSeq) {
+            const lastLedger = await this.rpc.getLatestLedger().then(({ sequence }) => sequence)
+            validUntilLedgerSeq = lastLedger + DEFAULT_TIMEOUT / 5;
+        }
 
-        const lastLedger = await this.rpc.getLatestLedger().then(({ sequence }) => sequence)
         const credentials = entry.credentials().address();
         const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
             new xdr.HashIdPreimageSorobanAuthorization({
                 networkId: hash(Buffer.from(this.networkPassphrase)),
                 nonce: credentials.nonce(),
-                // TODO maybe if folks set `ledgersToLive` that should be the TTL vs the extension from `lastLedger`. Will make it easier to coordinate multisig
-                // Call it `validUntilLedgerSeq` like the JS SDK
-                signatureExpirationLedger: lastLedger + ledgersToLive,
+                signatureExpirationLedger: validUntilLedgerSeq,
                 invocation: entry.rootInvocation()
             })
         )
         const payload = hash(preimage.toXDR())
 
-        const authenticationResponse = await this.WebAuthn.startAuthentication(
-            keyId === 'any'
-                || (!keyId && !this.keyId)
-                ? {
-                    challenge: base64url(payload),
-                    rpId,
-                    // userVerification: "discouraged",
-                    // timeout: 120_000
-                }
-                : {
-                    challenge: base64url(payload),
-                    rpId,
-                    allowCredentials: [
-                        {
-                            id: keyId instanceof Uint8Array
-                                ? base64url(Buffer.from(keyId))
-                                : keyId || this.keyId!,
-                            type: "public-key",
-                        },
-                    ],
-                    // userVerification: "discouraged",
-                    // timeout: 120_000
-                }
-        );
+        let key: SignerKey
+        let val: Signature
+
+        // Sign with the keypair as an ed25519 signer
+        if (keypair) {
+            const signature = keypair.sign(payload);
+
+            key = {
+                tag: "Ed25519",
+                values: [keypair.rawPublicKey()]
+            }
+            val = {
+                tag: "Ed25519",
+                values: [signature],
+            }
+        }
+
+        // Default, use passkey
+        else {
+            const authenticationResponse = await this.WebAuthn.startAuthentication(
+                keyId === 'any'
+                    || (!keyId && !this.keyId)
+                    ? {
+                        challenge: base64url(payload),
+                        rpId,
+                        // userVerification: "discouraged",
+                        // timeout: 120_000
+                    }
+                    : {
+                        challenge: base64url(payload),
+                        rpId,
+                        allowCredentials: [
+                            {
+                                id: keyId instanceof Uint8Array
+                                    ? base64url(Buffer.from(keyId))
+                                    : keyId || this.keyId!,
+                                type: "public-key",
+                            },
+                        ],
+                        // userVerification: "discouraged",
+                        // timeout: 120_000
+                    }
+            );
+
+            key = {
+                tag: "Secp256r1",
+                values: [base64url.toBuffer(authenticationResponse.id)]
+            }
+            val = {
+                tag: "Secp256r1",
+                values: [
+                    {
+                        authenticator_data: base64url.toBuffer(
+                            authenticationResponse.response.authenticatorData,
+                        ),
+                        client_data_json: base64url.toBuffer(
+                            authenticationResponse.response.clientDataJSON,
+                        ),
+                        signature: this.compactSignature(
+                            base64url.toBuffer(authenticationResponse.response.signature)
+                        ),
+                    },
+                ],
+            }
+        }
 
-        const signature = this.compactSignature(
-            base64url.toBuffer(authenticationResponse.response.signature)
+        const scKeyType = xdr.ScSpecTypeDef.scSpecTypeUdt(
+            new xdr.ScSpecTypeUdt({ name: "SignerKey" }),
+        );
+        const scValType = xdr.ScSpecTypeDef.scSpecTypeUdt(
+            new xdr.ScSpecTypeUdt({ name: "Signature" }),
         );
+        const scVal = this.wallet!.spec.nativeToScVal(val, scValType);
+        const scKey = this.wallet!.spec.nativeToScVal(key, scKeyType);
+        const scEntry = new xdr.ScMapEntry({
+            key: scKey,
+            val: scVal,
+        })
 
-        // TODO No idea how to make this work
-        // https://discord.com/channels/@me/1025113063583666246/1281789018979438672
-        // const t: Signature = {
-        //     tag: 'Secp256r1',
-        //     values: [{
-        //         authenticator_data: base64url.toBuffer(authenticationResponse.response.authenticatorData),
-        //         client_data_json: base64url.toBuffer(authenticationResponse.response.clientDataJSON),
-        //         id: [base64url.toBuffer(authenticationResponse.id)],
-        //         signature
-        //     }]
-        // }
-
-        // const test = this.wallet!.spec.nativeToScVal(t, )
-
-        const sig = xdr.ScVal.scvMap([
-            new xdr.ScMapEntry({
-                key: xdr.ScVal.scvVec([
-                    xdr.ScVal.scvSymbol('Secp256r1'),
-                    xdr.ScVal.scvBytes(base64url.toBuffer(authenticationResponse.id))
-                ]),
-                val: xdr.ScVal.scvVec([
-                    xdr.ScVal.scvSymbol('Secp256r1'),
-                    xdr.ScVal.scvMap([
-                        new xdr.ScMapEntry({
-                            key: xdr.ScVal.scvSymbol('authenticator_data'),
-                            val: xdr.ScVal.scvBytes(base64url.toBuffer(authenticationResponse.response.authenticatorData)),
-                        }),
-                        new xdr.ScMapEntry({
-                            key: xdr.ScVal.scvSymbol('client_data_json'),
-                            val: xdr.ScVal.scvBytes(base64url.toBuffer(authenticationResponse.response.clientDataJSON)),
-                        }),
-                        new xdr.ScMapEntry({
-                            key: xdr.ScVal.scvSymbol('signature'),
-                            val: xdr.ScVal.scvBytes(signature),
-                        }),
-                    ])  
-                ])
-            })
-        ])
+        switch (credentials.signature().switch().name) {
+            case 'scvVoid':
+                credentials.signature(xdr.ScVal.scvMap([scEntry]))
+                break;
+            case 'scvMap':
+                credentials.signature().map()?.push(scEntry)
+                break;
+            default:
+                throw new Error('Unsupported signature')
+        }
 
-        credentials.signatureExpirationLedger(lastLedger + ledgersToLive)
-        credentials.signature(sig)
+        credentials.signatureExpirationLedger(validUntilLedgerSeq)
 
         return entry
     }
@@ -287,8 +309,10 @@ export class PasskeyKit extends PasskeyBase {
     public async signAuthEntries(
         entries: xdr.SorobanAuthorizationEntry[],
         options?: {
+            rpId?: string,
             keyId?: 'any' | string | Uint8Array
-            ledgersToLive?: number
+            keypair?: Keypair,
+            validUntilLedgerSeq?: number
         }
     ) {
         for (const auth of entries) {
@@ -308,15 +332,133 @@ export class PasskeyKit extends PasskeyBase {
     public async sign(
         txn: Transaction | string,
         options?: {
+            rpId?: string,
             keyId?: 'any' | string | Uint8Array
-            ledgersToLive?: number
+            keypair?: Keypair,
+            validUntilLedgerSeq?: number
         }
     ) {
-        /*
-            - Hack to ensure we don't stack fees when simulating and assembling multiple times
-                AssembleTransaction always adds the resource fee onto the transaction fee. 
-                This is bad in cases where you need to simulate multiple times
-        */
+        txn = this.getTxn(txn)
+
+        // Only need to sign auth for `invokeHostFunction` operations
+        if (txn.operations[0].type === 'invokeHostFunction') {
+            const entries = txn.operations[0].auth
+
+            if (entries)
+                await this.signAuthEntries(entries, options)
+        }
+
+        return txn.toXDR()
+    }
+
+    public async attachPolicy(
+        txn: Transaction | string,
+        index: number,
+        policy: string
+    ) {
+        txn = this.getTxn(txn)
+
+        // Only need to sign auth for `invokeHostFunction` operations
+        if (txn.operations[0].type !== 'invokeHostFunction')
+            return txn.toXDR()
+
+        if (!this.wallet)
+            throw new Error('Wallet not connected')
+
+        let context_arg: xdr.ScVal
+
+        const auth = txn.operations[0].auth?.[index]
+        const context = auth?.rootInvocation().function()
+
+        if (!auth || !context)
+            throw new Error('No context found')
+
+        switch (context.switch().name) {
+            case 'sorobanAuthorizedFunctionTypeContractFn':
+                switch (context.contractFn().contractAddress().switch().name) {
+                    case 'scAddressTypeContract':
+                        context_arg = xdr.ScVal.scvVec([
+                            xdr.ScVal.scvSymbol("Contract"),
+                            xdr.ScVal.scvMap([
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("args"),
+                                    val: xdr.ScVal.scvVec(context.contractFn().args()),
+                                }),
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("contract"),
+                                    val: Address.contract(context.contractFn().contractAddress().contractId()).toScVal(),
+                                }),
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("fn_name"),
+                                    val: xdr.ScVal.scvSymbol(context.contractFn().functionName()),
+                                }),
+                            ]),
+                        ])
+                        break;
+                    default:
+                        throw new Error('Unsupported contractAddress')
+                }
+                break;
+            case 'sorobanAuthorizedFunctionTypeCreateContractHostFn':
+                switch (context.createContractHostFn().contractIdPreimage().switch().name) {
+                    case 'contractIdPreimageFromAddress':
+                        context_arg = xdr.ScVal.scvVec([
+                            xdr.ScVal.scvSymbol("CreateContractHostFn"),
+                            xdr.ScVal.scvMap([
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("executable"),
+                                    val: xdr.ScVal.scvVec([
+                                        xdr.ScVal.scvSymbol("Wasm"),
+                                        xdr.ScVal.scvBytes(context.createContractHostFn().executable().wasmHash())
+                                    ]),
+                                }),
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("salt"),
+                                    val: xdr.ScVal.scvBytes(context.createContractHostFn().contractIdPreimage().fromAddress().salt()),
+                                }),
+                            ]),
+                        ])
+                        break;
+                    default:
+                        throw new Error('Unsupported contractIdPreimage')
+                }
+                break;
+            default:
+                throw new Error('Unsupported context')
+        }
+
+        const __check_auth_args = new xdr.InvokeContractArgs({
+            contractAddress: Address.fromString(this.wallet.options.contractId).toScAddress(),
+            functionName: "__check_auth",
+            args: [context_arg],
+        });
+
+        const __check_auth_invocation = new xdr.SorobanAuthorizedInvocation({
+            function:
+                xdr.SorobanAuthorizedFunction.sorobanAuthorizedFunctionTypeContractFn(
+                    __check_auth_args,
+                ),
+            subInvocations: [],
+        });
+
+        const __check_auth = new xdr.SorobanAuthorizationEntry({
+            credentials: xdr.SorobanCredentials.sorobanCredentialsAddress(
+                new xdr.SorobanAddressCredentials({
+                    address: Address.fromString(policy).toScAddress(),
+                    nonce: auth.credentials().address().nonce(),
+                    signatureExpirationLedger: auth.credentials().address().signatureExpirationLedger(),
+                    signature: xdr.ScVal.scvVec([]),
+                }),
+            ),
+            rootInvocation: __check_auth_invocation,
+        });
+
+        txn.operations[0].auth?.push(__check_auth)
+
+        return txn.toXDR()
+    }
+
+    private getTxn(txn: Transaction | string): Transaction {
         txn = TransactionBuilder.cloneFrom(new Transaction(
             typeof txn === 'string'
                 ? txn
@@ -335,28 +477,12 @@ export class PasskeyKit extends PasskeyBase {
             ) throw new Error('Must include only one operation of type `invokeHostFunction` or `extendFootprintTtl` or `restoreFootprint`')
         }
 
-        // Only need to sign auth for `invokeHostFunction` operations
-        if (txn.operations[0].type === 'invokeHostFunction') {
-            const entries = (txn.operations[0] as Operation.InvokeHostFunction).auth
-
-            if (entries)
-                await this.signAuthEntries(entries, options)
-        }
-
-        const sim = await this.rpc.simulateTransaction(txn)
-
-        if (
-            SorobanRpc.Api.isSimulationError(sim)
-            || SorobanRpc.Api.isSimulationRestore(sim) // TODO handle state archival
-        ) throw sim
-
-        return SorobanRpc.assembleTransaction(txn, sim).build().toXDR()
+        return txn
     }
 
-    /* TODO 
+    /* LATER 
         - Add a getKeyInfo action to get info about a specific passkey
             Specifically looking for name, type, etc. data so a user could grok what signer mapped to what passkey
-            @Later
     */
 
     private async getPublicKey(response: AuthenticatorAttestationResponseJSON) {
@@ -399,10 +525,10 @@ export class PasskeyKit extends PasskeyBase {
             ])
         }
 
-        /* TODO 
+        /* TODO
             - We're doing some pretty "smart" public key decoding stuff so we should verify the signature against this final public key before assuming it's safe to use and save on-chain
                 Hmm...Given that `startRegistration` doesn't produce a signature, verifying we've got the correct public key isn't really possible
-                @Later
+            - This probably needs to be an onchain check, even if just a simulation, just to ensure everything looks good before we get too far adding value etc.
         */
 
         return publicKey

package/src/server.ts

@@ -119,20 +119,20 @@ export class PasskeyServer extends PasskeyBase {
         return res || undefined as string | undefined
     }
 
-    /* TODO 
+    /* LATER
         - Add a method for getting a paginated or filtered list of all a wallet's events
-            @Later
     */
 
-    // TODO maybe fee should default to something more dynamic since we have endpoints for getting fee information now
-    public async send(xdr: string, fee: number = 10_000) {
+    public async send(xdr: string, fee?: number) {
         if (!this.launchtubeUrl || !this.launchtubeJwt)
             throw new Error('Launchtube service not configured')
 
         const data = new FormData();
 
         data.set('xdr', xdr);
-        data.set('fee', fee.toString());
+
+        if (fee)
+            data.set('fee', fee.toString());
 
         return fetch(this.launchtubeUrl, {
             method: 'POST',

package/types/kit.d.ts

@@ -1,6 +1,6 @@
 import { Client as PasskeyClient } from 'passkey-kit-sdk';
 import { Client as FactoryClient } from 'passkey-factory-sdk';
-import { xdr, Transaction, SorobanRpc } from '@stellar/stellar-sdk';
+import { xdr, Transaction, SorobanRpc, Keypair } from '@stellar/stellar-sdk';
 import { startRegistration, startAuthentication } from "@simplewebauthn/browser";
 import type { AuthenticatorSelectionCriteria } from "@simplewebauthn/types";
 import { Buffer } from 'buffer';
@@ -47,18 +47,25 @@ export declare class PasskeyKit extends PasskeyBase {
         contractId: string;
     }>;
     signAuthEntry(entry: xdr.SorobanAuthorizationEntry, options?: {
-        keyId?: 'any' | string | Uint8Array;
         rpId?: string;
-        ledgersToLive?: number;
+        keyId?: 'any' | string | Uint8Array;
+        keypair?: Keypair;
+        validUntilLedgerSeq?: number;
     }): Promise<xdr.SorobanAuthorizationEntry>;
     signAuthEntries(entries: xdr.SorobanAuthorizationEntry[], options?: {
+        rpId?: string;
         keyId?: 'any' | string | Uint8Array;
-        ledgersToLive?: number;
+        keypair?: Keypair;
+        validUntilLedgerSeq?: number;
     }): Promise<xdr.SorobanAuthorizationEntry[]>;
     sign(txn: Transaction | string, options?: {
+        rpId?: string;
         keyId?: 'any' | string | Uint8Array;
-        ledgersToLive?: number;
+        keypair?: Keypair;
+        validUntilLedgerSeq?: number;
     }): Promise<string>;
+    attachPolicy(txn: Transaction | string, index: number, policy: string): Promise<string>;
+    private getTxn;
     private getPublicKey;
     private compactSignature;
 }