passkey-kit 0.7.1 → 0.7.3

package/cheatsheet

@@ -13,7 +13,7 @@ stellar contract deploy --wasm target/wasm32-unknown-unknown/release/sample_poli
 
 export JWT=???
 mercury-cli --jwt $JWT --local false --mainnet false deploy
-mercury-cli --jwt $JWT --local false --mainnet false catchup --project-name "smart-wallets-data-multi-signer-multi-sig" --contracts "CDONKSPO6DUH46JRRIAK4O5ZINA5C2RXHP57BMFHKVBGOQXAT3IW6QCO"
+mercury-cli --jwt $JWT --local false --mainnet false catchup --project-name "smart-wallets-data-multi-signer-multi-sig" --contracts "CBMMJ55OQSFSYASVENVHW55QNA4Q52GE42P23E4V7O37GKMETKOFFENA"
 curl -X GET https://api.mercurydata.app/catchups/4
 curl -X POST https://api.mercurydata.app/zephyr/execute -H "Authorization: Bearer $MERCURY_JWT" -H 'Content-Type: application/json' -d '{"mode":{"Function": {"fname": "get_signers_by_address", "arguments": "{\"address\": \"CA4G3X75IGGNXNLXFIVFNYIGC6YAVLA7KSIFFDBSR7RQ7KEZMZWLXQBH\"}"}}}'
 curl -X POST https://api.mercurydata.app/zephyr/execute -H "Authorization: Bearer $MERCURY_JWT" -H 'Content-Type: application/json' -d '{"mode":{"Function": {"fname": "get_address_by_signer", "arguments": "{\"id\": [78,127,30,69,248,174,95,168,47,59,161,168,51,120,117,135,112,133,232,92]}"}}}'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passkey-kit",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "A helper library for creating and using passkey accounts on the Stellar blockchain.",
   "author": "Tyler van der Hoeven",
   "license": "MIT",
@@ -14,8 +14,8 @@
     "base64url": "^3.0.1",
     "buffer": "^6.0.3",
     "passkey-factory-sdk": "0.3.1",
-    "passkey-kit-sdk": "0.3.1",
-    "sac-sdk": "0.1.0"
+    "sac-sdk": "0.1.0",
+    "passkey-kit-sdk": "0.3.1"
   },
   "devDependencies": {
     "@simplewebauthn/types": "^10.0.0",

package/src/index.ts

@@ -1,5 +1,5 @@
 import { PasskeyServer } from "./server"
-import { PasskeyKit, DEFAULT_LTL } from "./kit"
+import { PasskeyKit } from "./kit"
 import { SACClient } from "./sac"
 
-export { PasskeyServer, PasskeyKit, SACClient, DEFAULT_LTL }
+export { PasskeyServer, PasskeyKit, SACClient }

package/src/kit.ts

@@ -1,13 +1,12 @@
-import { Client as PasskeyClient, type Secp256r1Signature, type Signature } from 'passkey-kit-sdk'
+import { Client as PasskeyClient, type Signature, type SignerKey } from 'passkey-kit-sdk'
 import { Client as FactoryClient } from 'passkey-factory-sdk'
-import { Address, StrKey, hash, xdr, Transaction, SorobanRpc, Operation, TransactionBuilder } from '@stellar/stellar-sdk'
+import { Address, StrKey, hash, xdr, Transaction, SorobanRpc, TransactionBuilder, Keypair } from '@stellar/stellar-sdk'
 import base64url from 'base64url'
 import { startRegistration, startAuthentication } from "@simplewebauthn/browser"
 import type { AuthenticatorAttestationResponseJSON, AuthenticatorSelectionCriteria } from "@simplewebauthn/types"
 import { Buffer } from 'buffer'
 import { PasskeyBase } from './base'
-
-export const DEFAULT_LTL = 12
+import { DEFAULT_TIMEOUT } from '@stellar/stellar-sdk/contract'
 
 export class PasskeyKit extends PasskeyBase {
     declare public rpc: SorobanRpc.Server
@@ -51,17 +50,17 @@ export class PasskeyKit extends PasskeyBase {
             signer: {
                 tag: 'Secp256r1',
                 values: [
-                    keyId, 
-                    publicKey, 
+                    keyId,
+                    publicKey,
                     [new Map()],
-                    {tag: 'Persistent', values: undefined},
+                    { tag: 'Persistent', values: undefined },
                 ]
             },
         })
 
         if (result.isErr())
             throw new Error(result.unwrapErr().message)
-        
+
         if (!built)
             throw new Error('Failed to create wallet')
 
@@ -99,11 +98,6 @@ export class PasskeyKit extends PasskeyBase {
                 displayName
             },
             authenticatorSelection,
-            // authenticatorSelection: {
-            //     requireResidentKey: false,
-            //     residentKey: "preferred",
-            //     userVerification: "discouraged",
-            // },
             pubKeyCredParams: [{ alg: -7, type: "public-key" }],
             // attestation: "none",
             // timeout: 120_000,
@@ -188,98 +182,134 @@ export class PasskeyKit extends PasskeyBase {
     public async signAuthEntry(
         entry: xdr.SorobanAuthorizationEntry,
         options?: {
-            keyId?: 'any' | string | Uint8Array
             rpId?: string,
-            ledgersToLive?: number
+            keyId?: 'any' | string | Uint8Array
+            keypair?: Keypair,
+            validUntilLedgerSeq?: number
         }
     ) {
-        let { keyId, rpId, ledgersToLive = DEFAULT_LTL } = options || {}
+        let { rpId, keyId, keypair, validUntilLedgerSeq } = options || {}
+
+        if (keyId && keypair)
+            throw new Error('Provide either `options.keyId` or `options.keypair` but not both')
 
-        const lastLedger = await this.rpc.getLatestLedger().then(({ sequence }) => sequence)
         const credentials = entry.credentials().address();
+
+        if (!validUntilLedgerSeq) {
+            validUntilLedgerSeq = credentials.signatureExpirationLedger()
+
+            if (!validUntilLedgerSeq) {
+                const lastLedger = await this.rpc.getLatestLedger().then(({ sequence }) => sequence)
+                validUntilLedgerSeq = lastLedger + DEFAULT_TIMEOUT / 5;
+            }
+        }
+
+        credentials.signatureExpirationLedger(validUntilLedgerSeq)
+        
         const preimage = xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
             new xdr.HashIdPreimageSorobanAuthorization({
                 networkId: hash(Buffer.from(this.networkPassphrase)),
                 nonce: credentials.nonce(),
-                // TODO maybe if folks set `ledgersToLive` that should be the TTL vs the extension from `lastLedger`. Will make it easier to coordinate multisig
-                // Call it `validUntilLedgerSeq` like the JS SDK
-                signatureExpirationLedger: lastLedger + ledgersToLive,
+                signatureExpirationLedger: credentials.signatureExpirationLedger(),
                 invocation: entry.rootInvocation()
             })
         )
         const payload = hash(preimage.toXDR())
 
-        const authenticationResponse = await this.WebAuthn.startAuthentication(
-            keyId === 'any'
-                || (!keyId && !this.keyId)
-                ? {
-                    challenge: base64url(payload),
-                    rpId,
-                    // userVerification: "discouraged",
-                    // timeout: 120_000
-                }
-                : {
-                    challenge: base64url(payload),
-                    rpId,
-                    allowCredentials: [
-                        {
-                            id: keyId instanceof Uint8Array
-                                ? base64url(Buffer.from(keyId))
-                                : keyId || this.keyId!,
-                            type: "public-key",
-                        },
-                    ],
-                    // userVerification: "discouraged",
-                    // timeout: 120_000
-                }
-        );
+        let key: SignerKey
+        let val: Signature
 
-        const signature = this.compactSignature(
-            base64url.toBuffer(authenticationResponse.response.signature)
-        );
+        // Sign with the keypair as an ed25519 signer
+        if (keypair) {
+            const signature = keypair.sign(payload);
 
-        // TODO No idea how to make this work
-        // https://discord.com/channels/@me/1025113063583666246/1281789018979438672
-        // const t: Signature = {
-        //     tag: 'Secp256r1',
-        //     values: [{
-        //         authenticator_data: base64url.toBuffer(authenticationResponse.response.authenticatorData),
-        //         client_data_json: base64url.toBuffer(authenticationResponse.response.clientDataJSON),
-        //         id: [base64url.toBuffer(authenticationResponse.id)],
-        //         signature
-        //     }]
-        // }
-
-        // const test = this.wallet!.spec.nativeToScVal(t, )
-
-        const sig = xdr.ScVal.scvMap([
-            new xdr.ScMapEntry({
-                key: xdr.ScVal.scvVec([
-                    xdr.ScVal.scvSymbol('Secp256r1'),
-                    xdr.ScVal.scvBytes(base64url.toBuffer(authenticationResponse.id))
-                ]),
-                val: xdr.ScVal.scvVec([
-                    xdr.ScVal.scvSymbol('Secp256r1'),
-                    xdr.ScVal.scvMap([
-                        new xdr.ScMapEntry({
-                            key: xdr.ScVal.scvSymbol('authenticator_data'),
-                            val: xdr.ScVal.scvBytes(base64url.toBuffer(authenticationResponse.response.authenticatorData)),
-                        }),
-                        new xdr.ScMapEntry({
-                            key: xdr.ScVal.scvSymbol('client_data_json'),
-                            val: xdr.ScVal.scvBytes(base64url.toBuffer(authenticationResponse.response.clientDataJSON)),
-                        }),
-                        new xdr.ScMapEntry({
-                            key: xdr.ScVal.scvSymbol('signature'),
-                            val: xdr.ScVal.scvBytes(signature),
-                        }),
-                    ])  
-                ])
-            })
-        ])
+            key = {
+                tag: "Ed25519",
+                values: [keypair.rawPublicKey()]
+            }
+            val = {
+                tag: "Ed25519",
+                values: [signature],
+            }
+        }
+
+        // Default, use passkey
+        else {
+            const authenticationResponse = await this.WebAuthn.startAuthentication(
+                keyId === 'any'
+                    || (!keyId && !this.keyId)
+                    ? {
+                        challenge: base64url(payload),
+                        rpId,
+                        // userVerification: "discouraged",
+                        // timeout: 120_000
+                    }
+                    : {
+                        challenge: base64url(payload),
+                        rpId,
+                        allowCredentials: [
+                            {
+                                id: keyId instanceof Uint8Array
+                                    ? base64url(Buffer.from(keyId))
+                                    : keyId || this.keyId!,
+                                type: "public-key",
+                            },
+                        ],
+                        // userVerification: "discouraged",
+                        // timeout: 120_000
+                    }
+            );
+
+            key = {
+                tag: "Secp256r1",
+                values: [base64url.toBuffer(authenticationResponse.id)]
+            }
+            val = {
+                tag: "Secp256r1",
+                values: [
+                    {
+                        authenticator_data: base64url.toBuffer(
+                            authenticationResponse.response.authenticatorData,
+                        ),
+                        client_data_json: base64url.toBuffer(
+                            authenticationResponse.response.clientDataJSON,
+                        ),
+                        signature: this.compactSignature(
+                            base64url.toBuffer(authenticationResponse.response.signature)
+                        ),
+                    },
+                ],
+            }
+        }
+
+        const scKeyType = xdr.ScSpecTypeDef.scSpecTypeUdt(
+            new xdr.ScSpecTypeUdt({ name: "SignerKey" }),
+        );
+        const scValType = xdr.ScSpecTypeDef.scSpecTypeUdt(
+            new xdr.ScSpecTypeUdt({ name: "Signature" }),
+        );
+        const scVal = this.wallet!.spec.nativeToScVal(val, scValType);
+        const scKey = this.wallet!.spec.nativeToScVal(key, scKeyType);
+        const scEntry = new xdr.ScMapEntry({
+            key: scKey,
+            val: scVal,
+        })
 
-        credentials.signatureExpirationLedger(lastLedger + ledgersToLive)
-        credentials.signature(sig)
+        switch (credentials.signature().switch().name) {
+            case 'scvVoid':
+                credentials.signature(xdr.ScVal.scvMap([scEntry]))
+                break;
+            case 'scvMap':
+                // Add the new signature to the existing map
+                credentials.signature().map()?.push(scEntry)
+                // Order the map by key
+                credentials.signature().map()?.sort((a, b) => 
+                    a.key().toXDR().compare(b.key().toXDR())
+                )
+                break;
+            default:
+                throw new Error('Unsupported signature')
+        }
 
         return entry
     }
@@ -287,10 +317,14 @@ export class PasskeyKit extends PasskeyBase {
     public async signAuthEntries(
         entries: xdr.SorobanAuthorizationEntry[],
         options?: {
+            rpId?: string,
             keyId?: 'any' | string | Uint8Array
-            ledgersToLive?: number
+            keypair?: Keypair,
+            validUntilLedgerSeq?: number
         }
     ) {
+        // TODO should there be more control over which auth entries are signed? Especially given we support multiple signers now?
+        // As-is .sign() will always sign every smart wallet auth entry. This may be okay but likely we should have more control over which auth entry the signer is signing
         for (const auth of entries) {
             if (
                 auth.credentials().switch().name === 'sorobanCredentialsAddress'
@@ -308,15 +342,133 @@ export class PasskeyKit extends PasskeyBase {
     public async sign(
         txn: Transaction | string,
         options?: {
+            rpId?: string,
             keyId?: 'any' | string | Uint8Array
-            ledgersToLive?: number
+            keypair?: Keypair,
+            validUntilLedgerSeq?: number
         }
     ) {
-        /*
-            - Hack to ensure we don't stack fees when simulating and assembling multiple times
-                AssembleTransaction always adds the resource fee onto the transaction fee. 
-                This is bad in cases where you need to simulate multiple times
-        */
+        txn = this.getTxn(txn)
+
+        // Only need to sign auth for `invokeHostFunction` operations
+        if (txn.operations[0].type === 'invokeHostFunction') {
+            const entries = txn.operations[0].auth
+
+            if (entries)
+                await this.signAuthEntries(entries, options)
+        }
+
+        return txn.toXDR()
+    }
+
+    public async attachPolicy(
+        txn: Transaction | string,
+        index: number,
+        policy: string
+    ) {
+        txn = this.getTxn(txn)
+
+        // Only need to sign auth for `invokeHostFunction` operations
+        if (txn.operations[0].type !== 'invokeHostFunction')
+            return txn.toXDR()
+
+        if (!this.wallet)
+            throw new Error('Wallet not connected')
+
+        let context_arg: xdr.ScVal
+
+        const auth = txn.operations[0].auth?.[index]
+        const context = auth?.rootInvocation().function()
+
+        if (!auth || !context)
+            throw new Error('No context found')
+
+        switch (context.switch().name) {
+            case 'sorobanAuthorizedFunctionTypeContractFn':
+                switch (context.contractFn().contractAddress().switch().name) {
+                    case 'scAddressTypeContract':
+                        context_arg = xdr.ScVal.scvVec([
+                            xdr.ScVal.scvSymbol("Contract"),
+                            xdr.ScVal.scvMap([
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("args"),
+                                    val: xdr.ScVal.scvVec(context.contractFn().args()),
+                                }),
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("contract"),
+                                    val: Address.contract(context.contractFn().contractAddress().contractId()).toScVal(),
+                                }),
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("fn_name"),
+                                    val: xdr.ScVal.scvSymbol(context.contractFn().functionName()),
+                                }),
+                            ]),
+                        ])
+                        break;
+                    default:
+                        throw new Error('Unsupported contractAddress')
+                }
+                break;
+            case 'sorobanAuthorizedFunctionTypeCreateContractHostFn':
+                switch (context.createContractHostFn().contractIdPreimage().switch().name) {
+                    case 'contractIdPreimageFromAddress':
+                        context_arg = xdr.ScVal.scvVec([
+                            xdr.ScVal.scvSymbol("CreateContractHostFn"),
+                            xdr.ScVal.scvMap([
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("executable"),
+                                    val: xdr.ScVal.scvVec([
+                                        xdr.ScVal.scvSymbol("Wasm"),
+                                        xdr.ScVal.scvBytes(context.createContractHostFn().executable().wasmHash())
+                                    ]),
+                                }),
+                                new xdr.ScMapEntry({
+                                    key: xdr.ScVal.scvSymbol("salt"),
+                                    val: xdr.ScVal.scvBytes(context.createContractHostFn().contractIdPreimage().fromAddress().salt()),
+                                }),
+                            ]),
+                        ])
+                        break;
+                    default:
+                        throw new Error('Unsupported contractIdPreimage')
+                }
+                break;
+            default:
+                throw new Error('Unsupported context')
+        }
+
+        const __check_auth_args = new xdr.InvokeContractArgs({
+            contractAddress: Address.fromString(this.wallet.options.contractId).toScAddress(),
+            functionName: "__check_auth",
+            args: [context_arg],
+        });
+
+        const __check_auth_invocation = new xdr.SorobanAuthorizedInvocation({
+            function:
+                xdr.SorobanAuthorizedFunction.sorobanAuthorizedFunctionTypeContractFn(
+                    __check_auth_args,
+                ),
+            subInvocations: [],
+        });
+
+        const __check_auth = new xdr.SorobanAuthorizationEntry({
+            credentials: xdr.SorobanCredentials.sorobanCredentialsAddress(
+                new xdr.SorobanAddressCredentials({
+                    address: Address.fromString(policy).toScAddress(),
+                    nonce: auth.credentials().address().nonce(),
+                    signatureExpirationLedger: auth.credentials().address().signatureExpirationLedger(),
+                    signature: xdr.ScVal.scvVec([]),
+                }),
+            ),
+            rootInvocation: __check_auth_invocation,
+        });
+
+        txn.operations[0].auth?.push(__check_auth)
+
+        return txn.toXDR()
+    }
+
+    private getTxn(txn: Transaction | string): Transaction {
         txn = TransactionBuilder.cloneFrom(new Transaction(
             typeof txn === 'string'
                 ? txn
@@ -335,28 +487,12 @@ export class PasskeyKit extends PasskeyBase {
             ) throw new Error('Must include only one operation of type `invokeHostFunction` or `extendFootprintTtl` or `restoreFootprint`')
         }
 
-        // Only need to sign auth for `invokeHostFunction` operations
-        if (txn.operations[0].type === 'invokeHostFunction') {
-            const entries = (txn.operations[0] as Operation.InvokeHostFunction).auth
-
-            if (entries)
-                await this.signAuthEntries(entries, options)
-        }
-
-        const sim = await this.rpc.simulateTransaction(txn)
-
-        if (
-            SorobanRpc.Api.isSimulationError(sim)
-            || SorobanRpc.Api.isSimulationRestore(sim) // TODO handle state archival
-        ) throw sim
-
-        return SorobanRpc.assembleTransaction(txn, sim).build().toXDR()
+        return txn
     }
 
-    /* TODO 
+    /* LATER 
         - Add a getKeyInfo action to get info about a specific passkey
             Specifically looking for name, type, etc. data so a user could grok what signer mapped to what passkey
-            @Later
     */
 
     private async getPublicKey(response: AuthenticatorAttestationResponseJSON) {
@@ -399,10 +535,10 @@ export class PasskeyKit extends PasskeyBase {
             ])
         }
 
-        /* TODO 
+        /* TODO
             - We're doing some pretty "smart" public key decoding stuff so we should verify the signature against this final public key before assuming it's safe to use and save on-chain
                 Hmm...Given that `startRegistration` doesn't produce a signature, verifying we've got the correct public key isn't really possible
-                @Later
+            - This probably needs to be an onchain check, even if just a simulation, just to ensure everything looks good before we get too far adding value etc.
         */
 
         return publicKey

package/src/server.ts

@@ -119,20 +119,20 @@ export class PasskeyServer extends PasskeyBase {
         return res || undefined as string | undefined
     }
 
-    /* TODO 
+    /* LATER
         - Add a method for getting a paginated or filtered list of all a wallet's events
-            @Later
     */
 
-    // TODO maybe fee should default to something more dynamic since we have endpoints for getting fee information now
-    public async send(xdr: string, fee: number = 10_000) {
+    public async send(xdr: string, fee?: number) {
         if (!this.launchtubeUrl || !this.launchtubeJwt)
             throw new Error('Launchtube service not configured')
 
         const data = new FormData();
 
         data.set('xdr', xdr);
-        data.set('fee', fee.toString());
+
+        if (fee)
+            data.set('fee', fee.toString());
 
         return fetch(this.launchtubeUrl, {
             method: 'POST',

package/types/index.d.ts

@@ -1,4 +1,4 @@
 import { PasskeyServer } from "./server";
-import { PasskeyKit, DEFAULT_LTL } from "./kit";
+import { PasskeyKit } from "./kit";
 import { SACClient } from "./sac";
-export { PasskeyServer, PasskeyKit, SACClient, DEFAULT_LTL };
+export { PasskeyServer, PasskeyKit, SACClient };

package/types/kit.d.ts

@@ -1,11 +1,10 @@
 import { Client as PasskeyClient } from 'passkey-kit-sdk';
 import { Client as FactoryClient } from 'passkey-factory-sdk';
-import { xdr, Transaction, SorobanRpc } from '@stellar/stellar-sdk';
+import { xdr, Transaction, SorobanRpc, Keypair } from '@stellar/stellar-sdk';
 import { startRegistration, startAuthentication } from "@simplewebauthn/browser";
 import type { AuthenticatorSelectionCriteria } from "@simplewebauthn/types";
 import { Buffer } from 'buffer';
 import { PasskeyBase } from './base';
-export declare const DEFAULT_LTL = 12;
 export declare class PasskeyKit extends PasskeyBase {
     rpc: SorobanRpc.Server;
     rpcUrl: string;
@@ -47,18 +46,25 @@ export declare class PasskeyKit extends PasskeyBase {
         contractId: string;
     }>;
     signAuthEntry(entry: xdr.SorobanAuthorizationEntry, options?: {
-        keyId?: 'any' | string | Uint8Array;
         rpId?: string;
-        ledgersToLive?: number;
+        keyId?: 'any' | string | Uint8Array;
+        keypair?: Keypair;
+        validUntilLedgerSeq?: number;
     }): Promise<xdr.SorobanAuthorizationEntry>;
     signAuthEntries(entries: xdr.SorobanAuthorizationEntry[], options?: {
+        rpId?: string;
         keyId?: 'any' | string | Uint8Array;
-        ledgersToLive?: number;
+        keypair?: Keypair;
+        validUntilLedgerSeq?: number;
     }): Promise<xdr.SorobanAuthorizationEntry[]>;
     sign(txn: Transaction | string, options?: {
+        rpId?: string;
         keyId?: 'any' | string | Uint8Array;
-        ledgersToLive?: number;
+        keypair?: Keypair;
+        validUntilLedgerSeq?: number;
     }): Promise<string>;
+    attachPolicy(txn: Transaction | string, index: number, policy: string): Promise<string>;
+    private getTxn;
     private getPublicKey;
     private compactSignature;
 }