thirdweb 5.61.7-nightly-da9f1964e4ae74ed5d33666788e2d16e4d56614d-20241015000333 → 5.62.0

package/src/wallets/in-app/core/wallet/enclave-wallet.ts

@@ -11,10 +11,10 @@ import type {
   Account,
   SendTransactionOption,
 } from "../../../interfaces/wallet.js";
-import { getUserStatus } from "../../web/lib/actions/get-enclave-user-status.js";
-import { signMessage as signEnclaveMessage } from "../../web/lib/actions/sign-message.enclave.js";
-import { signTransaction as signEnclaveTransaction } from "../../web/lib/actions/sign-transaction.enclave.js";
-import { signTypedData as signEnclaveTypedData } from "../../web/lib/actions/sign-typed-data.enclave.js";
+import { getUserStatus } from "../actions/get-enclave-user-status.js";
+import { signMessage as signEnclaveMessage } from "../actions/sign-message.enclave.js";
+import { signTransaction as signEnclaveTransaction } from "../actions/sign-transaction.enclave.js";
+import { signTypedData as signEnclaveTypedData } from "../actions/sign-typed-data.enclave.js";
 import type { ClientScopedStorage } from "../authentication/client-scoped-storage.js";
 import type {
   AuthDetails,
@@ -33,18 +33,16 @@ export type UserStatus = {
       | { address: string; [key: string]: string }
       | { id: string; [key: string]: string };
   }[];
-  wallets:
-    | [
-        {
-          address: string;
-          createdAt: string;
-          type: "sharded" | "enclave";
-        },
-      ]
-    | [];
+  wallets: UserWallet[];
   id: string;
 };
 
+export type UserWallet = {
+  address: string;
+  createdAt: string;
+  type: "sharded" | "enclave";
+};
+
 export class EnclaveWallet implements IWebWallet {
   private client: ThirdwebClient;
   private ecosystem?: Ecosystem;
@@ -130,7 +128,6 @@ export class EnclaveWallet implements IWebWallet {
    */
   async getAccount(): Promise<Account> {
     const client = this.client;
-    const ecosystem = this.ecosystem;
     const storage = this.localStorage;
 
     const _signTransaction = async (tx: SendTransactionOption) => {
@@ -171,7 +168,6 @@ export class EnclaveWallet implements IWebWallet {
 
       return signEnclaveTransaction({
         client,
-        ecosystem,
         storage,
         payload: transaction,
       });
@@ -218,7 +214,6 @@ export class EnclaveWallet implements IWebWallet {
 
         const { signature } = await signEnclaveMessage({
           client,
-          ecosystem,
           payload: messagePayload,
           storage,
         });
@@ -228,7 +223,6 @@ export class EnclaveWallet implements IWebWallet {
         const parsedTypedData = parseTypedData(_typedData);
         const { signature } = await signEnclaveTypedData({
           client,
-          ecosystem,
           payload: parsedTypedData,
           storage,
         });

package/src/wallets/in-app/native/auth/passkeys.ts

@@ -125,7 +125,7 @@ export async function hasStoredPasskey(
   const storage = new ClientScopedStorage({
     storage: nativeLocalStorage,
     clientId: client.clientId,
-    ecosystemId: ecosystemId,
+    ecosystem: ecosystemId ? { id: ecosystemId } : undefined,
   });
   const credId = await storage.getPasskeyCredentialId();
   return !!credId;

package/src/wallets/in-app/native/helpers/api/fetchers.ts

@@ -14,6 +14,8 @@ import { createErrorMessage } from "../errors.js";
 
 const EMBEDDED_WALLET_TOKEN_HEADER = "embedded-wallet-token";
 const PAPER_CLIENT_ID_HEADER = "x-thirdweb-client-id";
+const ECOSYSTEM_ID_HEADER = "x-ecosystem-id";
+const ECOSYSTEM_PARTNER_ID_HEADER = "x-ecosystem-partner-id";
 
 let sessionNonce: Hex | undefined = undefined;
 
@@ -63,6 +65,12 @@ export async function authFetchEmbeddedWalletUser(args: {
           authTokenClient || ""
         }`,
         [PAPER_CLIENT_ID_HEADER]: client.clientId,
+        ...(storage.ecosystem
+          ? {
+              [ECOSYSTEM_ID_HEADER]: storage.ecosystem.id,
+              [ECOSYSTEM_PARTNER_ID_HEADER]: storage.ecosystem?.partnerId,
+            }
+          : {}),
         ...getSessionHeaders(),
       }
     : {
@@ -70,6 +78,12 @@ export async function authFetchEmbeddedWalletUser(args: {
           authTokenClient || ""
         }`,
         [PAPER_CLIENT_ID_HEADER]: client.clientId,
+        ...(storage.ecosystem
+          ? {
+              [ECOSYSTEM_ID_HEADER]: storage.ecosystem.id,
+              [ECOSYSTEM_PARTNER_ID_HEADER]: storage.ecosystem?.partnerId,
+            }
+          : {}),
         ...getSessionHeaders(),
       };
 

package/src/wallets/in-app/native/helpers/auth/middleware.ts

@@ -102,10 +102,11 @@ async function getRecoveryCode(args: {
     }
     try {
       return await getCognitoRecoveryPasswordV2({ client, storage });
-    } catch {
+    } catch (err) {
+      console.error("Error recovering wallet", err);
       return await getCognitoRecoveryPasswordV1({ client, storage }).catch(
         () => {
-          throw new Error("Something went wrong getting cognito recovery code");
+          throw new Error("Something went wrong while recovering wallet");
         },
       );
     }

package/src/wallets/in-app/native/helpers/constants.ts

@@ -22,6 +22,8 @@ export const GENERATE_RECOVERY_PASSWORD_LAMBDA_FUNCTION_V1 =
   "arn:aws:lambda:us-west-2:324457261097:function:recovery-share-password-GenerateRecoverySharePassw-bbE5ZbVAToil";
 export const GENERATE_RECOVERY_PASSWORD_LAMBDA_FUNCTION_V2 =
   "arn:aws:lambda:us-west-2:324457261097:function:lambda-thirdweb-auth-enc-key-prod-ThirdwebAuthEncKeyFunction";
+export const ENCLAVE_KMS_KEY_ARN =
+  "arn:aws:kms:us-west-2:324457261097:key/8b2a8cd5-9b22-4ea0-a6bc-463824a78f20";
 
 // TODO allow overriding domain
 const DOMAIN_URL_2023 = getThirdwebBaseUrl("inAppWallet");

package/src/wallets/in-app/native/helpers/wallet/migration.ts

@@ -0,0 +1,185 @@
+import { GenerateDataKeyCommand, KMSClient } from "@aws-sdk/client-kms";
+import { fromCognitoIdentity } from "@aws-sdk/credential-providers";
+import QuickCrypto from "react-native-quick-crypto";
+import type { ThirdwebClient } from "../../../../../client/client.js";
+import { getThirdwebBaseUrl } from "../../../../../utils/domains.js";
+import { stringToBytes } from "../../../../../utils/encoding/to-bytes.js";
+import { randomBytesBuffer } from "../../../../../utils/random.js";
+import {
+  concatUint8Arrays,
+  uint8ArrayToBase64,
+} from "../../../../../utils/uint8-array.js";
+import { privateKeyToAccount } from "../../../../private-key.js";
+import type { ClientScopedStorage } from "../../../core/authentication/client-scoped-storage.js";
+import type { AuthStoredTokenWithCookieReturnType } from "../../../core/authentication/types.js";
+import type { UserWallet } from "../../../core/wallet/enclave-wallet.js";
+import { authFetchEmbeddedWalletUser } from "../api/fetchers.js";
+import { postAuth } from "../auth/middleware.js";
+import {
+  AWS_REGION,
+  ENCLAVE_KMS_KEY_ARN,
+  ROUTE_AUTH_COGNITO_ID_TOKEN_V2,
+} from "../constants.js";
+import { getShares, getWalletPrivateKeyFromShares } from "./retrieval.js";
+
+/**
+ * Migrate a sharded wallet to an enclave wallet.
+ *
+ * @param args - The arguments for the migration process.
+ * @returns The migrated user wallet.
+ */
+export async function migrateToEnclaveWallet(args: {
+  client: ThirdwebClient;
+  storage: ClientScopedStorage;
+  storedToken: AuthStoredTokenWithCookieReturnType["storedToken"];
+  encryptionKey?: string;
+}): Promise<UserWallet> {
+  // setup sharded wallet first, so we have the shares available
+  await postAuth({
+    storedToken: args.storedToken,
+    client: args.client,
+    storage: args.storage,
+    encryptionKey: args.encryptionKey,
+  });
+
+  const { authShare, deviceShare } = await getShares({
+    client: args.client,
+    authShare: { toRetrieve: true },
+    deviceShare: { toRetrieve: true },
+    recoveryShare: { toRetrieve: false },
+    storage: args.storage,
+  });
+
+  // construct the sharded wallet
+  const privateKey = await getWalletPrivateKeyFromShares([
+    authShare,
+    deviceShare,
+  ]);
+  const account = privateKeyToAccount({
+    client: args.client,
+    privateKey,
+  });
+  const address = account.address;
+
+  // get cognito identity
+  const idTokenResponse = await authFetchEmbeddedWalletUser({
+    client: args.client,
+    url: ROUTE_AUTH_COGNITO_ID_TOKEN_V2,
+    props: {
+      method: "GET",
+    },
+    storage: args.storage,
+  });
+  if (!idTokenResponse.ok) {
+    throw new Error(
+      `Failed to fetch id token from Cognito: ${JSON.stringify(
+        await idTokenResponse.json(),
+        null,
+        2,
+      )}`,
+    );
+  }
+  const idTokenResult = await idTokenResponse.json();
+  const { token, identityId } = idTokenResult;
+
+  const cognitoIdentity = fromCognitoIdentity({
+    clientConfig: {
+      region: AWS_REGION,
+    },
+    identityId,
+    logins: {
+      "cognito-identity.amazonaws.com": token,
+    },
+  });
+
+  // get kms key
+  const kmsClient = new KMSClient({
+    region: AWS_REGION,
+    credentials: cognitoIdentity,
+  });
+  const generateDataKeyCommand = new GenerateDataKeyCommand({
+    KeyId: ENCLAVE_KMS_KEY_ARN,
+    KeySpec: "AES_256",
+  });
+  const encryptedKeyResult = await kmsClient.send(generateDataKeyCommand);
+  const plaintextKeyBlob = encryptedKeyResult.Plaintext;
+  const cipherTextBlob = encryptedKeyResult.CiphertextBlob;
+  if (!plaintextKeyBlob || !cipherTextBlob) {
+    throw new Error("No migration key found. Please try again.");
+  }
+
+  // encrypt private key
+  const iv = randomBytesBuffer(16);
+  // @ts-ignore - default import buils but ts doesn't like it
+  const key = await QuickCrypto.subtle.importKey(
+    "raw",
+    plaintextKeyBlob,
+    "AES-CBC",
+    false,
+    ["encrypt", "decrypt"],
+  );
+
+  // @ts-ignore - default import buils but ts doesn't like it
+  const encryptedPrivateKey = await QuickCrypto.subtle.encrypt(
+    {
+      name: "AES-CBC",
+      iv,
+    },
+    key,
+    stringToBytes(privateKey),
+  );
+
+  const encryptedData = concatUint8Arrays([
+    iv,
+    new Uint8Array(encryptedPrivateKey),
+  ]);
+
+  const ivB64 = uint8ArrayToBase64(iv);
+  const cipherTextB64 = uint8ArrayToBase64(cipherTextBlob);
+  const encryptedPrivateKeyB64 = uint8ArrayToBase64(encryptedData);
+
+  // execute migration
+  const result = await executeMigration({
+    client: args.client,
+    storage: args.storage,
+    address,
+    kmsCiphertextB64: cipherTextB64,
+    encryptedPrivateKeyB64: encryptedPrivateKeyB64,
+    ivB64,
+  });
+
+  return result;
+}
+
+async function executeMigration(args: {
+  client: ThirdwebClient;
+  storage: ClientScopedStorage;
+  address: string;
+  kmsCiphertextB64: string;
+  encryptedPrivateKeyB64: string;
+  ivB64: string;
+}): Promise<UserWallet> {
+  const migrationResponse = await authFetchEmbeddedWalletUser({
+    client: args.client,
+    url: `${getThirdwebBaseUrl("inAppWallet")}/api/v1/enclave-wallet/migrate`,
+    props: {
+      method: "POST",
+      body: JSON.stringify({
+        address: args.address,
+        kmsCiphertextB64: args.kmsCiphertextB64,
+        encryptedPrivateKeyB64: args.encryptedPrivateKeyB64,
+        ivB64: args.ivB64,
+      }),
+    },
+    storage: args.storage,
+  });
+  if (!migrationResponse.ok) {
+    throw new Error(
+      `Failed to migrate to enclave wallet: ${JSON.stringify(
+        await migrationResponse.json(),
+      )}`,
+    );
+  }
+  const migrationResult = (await migrationResponse.json()) as UserWallet;
+  return migrationResult;
+}

package/src/wallets/in-app/native/helpers/wallet/retrieval.ts

@@ -40,7 +40,7 @@ export async function getExistingUserAccount(args: {
   });
 }
 
-async function getWalletPrivateKeyFromShares(shares: string[]) {
+export async function getWalletPrivateKeyFromShares(shares: string[]) {
   const { secrets } = await import("./sss.js");
   let privateKeyHex = secrets.combine(shares, 0);
   if (!isHex(privateKeyHex)) {
@@ -86,7 +86,7 @@ async function getAccountFromShares(args: {
  * @returns The requested shares
  * @throws if attempting to get deviceShare when it's not present
  */
-async function getShares<
+export async function getShares<
   A extends boolean,
   D extends boolean,
   R extends boolean,

package/src/wallets/in-app/native/native-connector.ts

@@ -2,6 +2,7 @@ import type { ThirdwebClient } from "../../../client/client.js";
 import { stringify } from "../../../utils/json.js";
 import { nativeLocalStorage } from "../../../utils/storage/nativeStorage.js";
 import type { Account } from "../../interfaces/wallet.js";
+import { getUserStatus } from "../core/actions/get-enclave-user-status.js";
 import { authEndpoint } from "../core/authentication/authEndpoint.js";
 import { ClientScopedStorage } from "../core/authentication/client-scoped-storage.js";
 import { guestAuthenticate } from "../core/authentication/guest.js";
@@ -29,7 +30,6 @@ import type { InAppConnector } from "../core/interfaces/connector.js";
 import { EnclaveWallet } from "../core/wallet/enclave-wallet.js";
 import type { Ecosystem } from "../core/wallet/types.js";
 import type { IWebWallet } from "../core/wallet/web-wallet.js";
-import { getUserStatus } from "../web/lib/actions/get-enclave-user-status.js";
 import { sendOtp, verifyOtp } from "../web/lib/auth/otp.js";
 import { deleteActiveAccount, socialAuth } from "./auth/native-auth.js";
 import { logoutUser } from "./helpers/auth/logout.js";
@@ -44,60 +44,95 @@ type NativeConnectorOptions = {
 export class InAppNativeConnector implements InAppConnector {
   private client: ThirdwebClient;
   private ecosystem?: Ecosystem;
+  private storage: ClientScopedStorage;
   private passkeyDomain?: string;
-  private localStorage: ClientScopedStorage;
   private wallet?: IWebWallet;
 
   constructor(options: NativeConnectorOptions) {
     this.client = options.client;
-    this.ecosystem = options.ecosystem;
     this.passkeyDomain = options.passkeyDomain;
-    this.localStorage = new ClientScopedStorage({
+    this.ecosystem = options.ecosystem;
+    this.storage = new ClientScopedStorage({
       storage: nativeLocalStorage,
       clientId: this.client.clientId,
-      ecosystemId: this.ecosystem?.id,
+      ecosystem: options.ecosystem,
     });
   }
 
-  async initializeWallet(authToken?: string) {
-    const storedAuthToken = await this.localStorage.getAuthCookie();
-    if (!authToken && storedAuthToken === null) {
+  async initializeWallet(
+    authResult?: AuthStoredTokenWithCookieReturnType,
+    encryptionKey?: string,
+  ) {
+    const storedAuthToken = await this.storage.getAuthCookie();
+    if (!authResult && storedAuthToken === null) {
       throw new Error(
         "No auth token provided and no stored auth token found to initialize the wallet",
       );
     }
     const user = await getUserStatus({
-      authToken: authToken || (storedAuthToken as string),
+      authToken:
+        authResult?.storedToken.cookieString || (storedAuthToken as string),
       client: this.client,
-      ecosystem: this.ecosystem,
+      ecosystem: this.storage.ecosystem,
     });
     if (!user) {
       throw new Error("Cannot initialize wallet, no user logged in");
     }
-    const wallet = user.wallets[0];
-    // TODO (enclaves): Migration to enclave wallet if sharded
+    let wallet = user.wallets[0];
+
+    // TODO (enclaves): Migration to enclave wallet for in-app wallets as well
+    if (
+      authResult &&
+      this.storage.ecosystem &&
+      wallet &&
+      wallet.type === "sharded"
+    ) {
+      const { migrateToEnclaveWallet } = await import(
+        "./helpers/wallet/migration.js"
+      );
+      wallet = await migrateToEnclaveWallet({
+        client: this.client,
+        storage: this.storage,
+        storedToken: authResult.storedToken,
+        encryptionKey,
+      });
+    }
+
+    if (authResult && this.ecosystem && !wallet) {
+      // new ecosystem user, generate enclave wallet
+      // TODO (enclaves): same flow for in-app wallets
+      const { generateWallet } = await import(
+        "../core/actions/generate-wallet.enclave.js"
+      );
+      wallet = await generateWallet({
+        authToken: authResult.storedToken.cookieString,
+        client: this.client,
+        ecosystem: this.ecosystem,
+      });
+    }
+
     if (wallet && wallet.type === "enclave") {
       this.wallet = new EnclaveWallet({
         client: this.client,
         ecosystem: this.ecosystem,
         address: wallet.address,
-        storage: this.localStorage,
+        storage: this.storage,
       });
     } else {
       this.wallet = new ShardedWallet({
         client: this.client,
-        storage: this.localStorage,
+        storage: this.storage,
       });
     }
   }
 
   async getUser(): Promise<GetUser> {
     if (!this.wallet) {
-      const localAuthToken = await this.localStorage.getAuthCookie();
+      const localAuthToken = await this.storage.getAuthCookie();
       if (!localAuthToken) {
         return { status: "Logged Out" };
       }
-      await this.initializeWallet(localAuthToken);
+      await this.initializeWallet();
     }
     if (!this.wallet) {
       throw new Error("Wallet not initialized");
@@ -164,13 +199,13 @@ export class InAppNativeConnector implements InAppConnector {
         return customJwt({
           jwt: params.jwt,
           client: this.client,
-          storage: this.localStorage,
+          storage: this.storage,
         });
       case "auth_endpoint":
         return authEndpoint({
           payload: params.payload,
           client: this.client,
-          storage: this.localStorage,
+          storage: this.storage,
         });
       default:
         throw new Error(`Unsupported authentication type: ${strategy}`);
@@ -185,17 +220,16 @@ export class InAppNativeConnector implements InAppConnector {
       client: this.client,
       ecosystem: this.ecosystem,
     });
-    await this.initializeWallet(authResult.storedToken.cookieString);
-    if (!this.wallet) {
-      throw new Error("Wallet not initialized");
-    }
     const encryptionKey =
       params.strategy === "jwt"
         ? params.encryptionKey
         : params.strategy === "auth_endpoint"
           ? params.encryptionKey
           : undefined;
-
+    await this.initializeWallet(authResult, encryptionKey);
+    if (!this.wallet) {
+      throw new Error("Wallet not initialized");
+    }
     await this.wallet.postWalletSetUp({
       ...authResult,
       encryptionKey,
@@ -226,7 +260,7 @@ export class InAppNativeConnector implements InAppConnector {
       storeLastUsedPasskey = true,
     } = args;
     const domain = this.passkeyDomain;
-    const storage = this.localStorage;
+    const storage = this.storage;
     if (!domain) {
       throw new Error(
         "Passkey domain is required for native platforms. Please pass it in the 'auth' options when creating the inAppWallet().",
@@ -278,14 +312,14 @@ export class InAppNativeConnector implements InAppConnector {
   async deleteActiveAccount() {
     return deleteActiveAccount({
       client: this.client,
-      storage: this.localStorage,
+      storage: this.storage,
     });
   }
 
   logout(): Promise<LogoutReturnType> {
     return logoutUser({
       client: this.client,
-      storage: this.localStorage,
+      storage: this.storage,
     });
   }
 
@@ -294,7 +328,7 @@ export class InAppNativeConnector implements InAppConnector {
     return await linkAccount({
       client: args.client,
       tokenToLink: storedToken.cookieString,
-      storage: this.localStorage,
+      storage: this.storage,
       ecosystem: args.ecosystem || this.ecosystem,
     });
   }
@@ -303,7 +337,7 @@ export class InAppNativeConnector implements InAppConnector {
     return getLinkedProfilesInternal({
       client: this.client,
       ecosystem: this.ecosystem,
-      storage: this.localStorage,
+      storage: this.storage,
     });
   }
 }

package/src/wallets/in-app/web/lib/auth/iframe-auth.ts

@@ -1,4 +1,6 @@
 import type { ThirdwebClient } from "../../../../../client/client.js";
+import { generateWallet } from "../../../core/actions/generate-wallet.enclave.js";
+import { getUserStatus } from "../../../core/actions/get-enclave-user-status.js";
 import type { ClientScopedStorage } from "../../../core/authentication/client-scoped-storage.js";
 import type {
   AuthAndWalletRpcReturnType,
@@ -10,8 +12,6 @@ import type {
 import type { Ecosystem } from "../../../core/wallet/types.js";
 import type { ClientIdWithQuerierType } from "../../types.js";
 import type { InAppWalletIframeCommunicator } from "../../utils/iFrameCommunication/InAppWalletIframeCommunicator.js";
-import { generateWallet } from "../actions/generate-wallet.enclave.js";
-import { getUserStatus } from "../actions/get-enclave-user-status.js";
 import { BaseLogin } from "./base-login.js";
 
 export type AuthQuerierTypes = {

package/src/wallets/in-app/web/lib/auth/passkeys.ts

@@ -86,7 +86,7 @@ export async function hasStoredPasskey(
   const storage = new ClientScopedStorage({
     storage: webLocalStorage, // TODO (passkey) react native variant of this fn
     clientId: client.clientId,
-    ecosystemId: ecosystemId,
+    ecosystem: ecosystemId ? { id: ecosystemId } : undefined,
   });
   const credId = await storage.getPasskeyCredentialId();
   return !!credId;