swig-developer-sdk 0.6.0__py3-none-any.whl

swig_developer_sdk/one_business.py

@@ -0,0 +1,163 @@
+from __future__ import annotations
+
+import base64
+import json
+from dataclasses import dataclass
+from typing import Literal, Protocol
+from urllib.parse import parse_qs, urlencode, urljoin, urlparse
+
+from .common import JsonObject
+
+DEFAULT_ONE_BUSINESS_URL = "https://swig-one-business.vercel.app"
+
+
+@dataclass(frozen=True, slots=True)
+class OneBusinessGrantAccessResult:
+    status: str
+    swig_pubkey: str
+    wallet_address: str
+    role_id: int
+    authority_public_key: str
+    signature: str | None = None
+    state: str | None = None
+
+
+class OneBusinessGrantAccessCallbackError(Exception):
+    def __init__(
+        self,
+        *,
+        code: str,
+        description: str | None = None,
+        state: str | None = None,
+    ) -> None:
+        super().__init__(description or code)
+        self.code = code
+        self.description = description
+        self.state = state
+
+
+class OneBusinessLocation(Protocol):
+    def assign(self, url: str) -> None: ...
+
+    def replace(self, url: str) -> None: ...
+
+
+def build_one_business_grant_access_url(
+    *,
+    swig_pubkey: str,
+    authority_public_key: str,
+    actions: list[JsonObject] | None = None,
+    app_name: str | None = None,
+    one_business_url: str = DEFAULT_ONE_BUSINESS_URL,
+    redirect_uri: str | None = None,
+    state: str | None = None,
+) -> str:
+    base_url = one_business_url.strip()
+    if not base_url:
+        raise ValueError("one_business_url is required")
+    if not swig_pubkey.strip() or not authority_public_key.strip():
+        raise ValueError("swig_pubkey and authority_public_key are required")
+    query: dict[str, str] = {
+        "swig_pubkey": swig_pubkey.strip(),
+        "authority_public_key": authority_public_key.strip(),
+    }
+    if app_name is not None:
+        query["app_name"] = app_name
+    if redirect_uri is not None:
+        query["redirect_uri"] = redirect_uri
+    if state is not None:
+        query["state"] = state
+    if actions is not None:
+        encoded = base64.urlsafe_b64encode(
+            json.dumps(actions, separators=(",", ":")).encode("utf-8")
+        ).decode("ascii")
+        query["actions"] = encoded.rstrip("=")
+    normalized_base = base_url if base_url.endswith("/") else f"{base_url}/"
+    return f"{urljoin(normalized_base, 'authorize/grant-access')}?{urlencode(query)}"
+
+
+def redirect_to_one_business_grant_access(
+    *,
+    location: OneBusinessLocation,
+    swig_pubkey: str,
+    authority_public_key: str,
+    actions: list[JsonObject] | None = None,
+    app_name: str | None = None,
+    one_business_url: str = DEFAULT_ONE_BUSINESS_URL,
+    redirect_uri: str | None = None,
+    state: str | None = None,
+    mode: Literal["assign", "replace"] = "assign",
+) -> None:
+    url = build_one_business_grant_access_url(
+        swig_pubkey=swig_pubkey,
+        authority_public_key=authority_public_key,
+        actions=actions,
+        app_name=app_name,
+        one_business_url=one_business_url,
+        redirect_uri=redirect_uri,
+        state=state,
+    )
+    if mode == "replace":
+        location.replace(url)
+        return
+    location.assign(url)
+
+
+def complete_one_business_grant_access(
+    callback_url: str,
+) -> OneBusinessGrantAccessResult:
+    params = parse_qs(urlparse(callback_url).query, keep_blank_values=True)
+    error_code = _read_param(params, "error")
+    state = _read_param(params, "state")
+    if error_code:
+        raise OneBusinessGrantAccessCallbackError(
+            code=error_code,
+            description=_read_param(params, "error_description"),
+            state=state,
+        )
+    swig_pubkey = _required_param(params, "swig_pubkey")
+    wallet_address = _required_param(params, "wallet_address")
+    authority_public_key = _required_param(params, "authority_public_key")
+    role_id_value = _required_param(params, "role_id")
+    try:
+        role_id = int(role_id_value)
+    except ValueError as parse_error:
+        raise ValueError(
+            "Grant access callback has an invalid role_id"
+        ) from parse_error
+    if role_id < 0:
+        raise ValueError("Grant access callback has an invalid role_id")
+    return OneBusinessGrantAccessResult(
+        status=(
+            _read_param(params, "status")
+            or _read_param(params, "grant_status")
+            or "granted"
+        ),
+        swig_pubkey=swig_pubkey,
+        wallet_address=wallet_address,
+        role_id=role_id,
+        authority_public_key=authority_public_key,
+        signature=_read_param(params, "signature"),
+        state=state,
+    )
+
+
+def _required_param(params: dict[str, list[str]], name: str) -> str:
+    value = _read_param(params, name)
+    if not value:
+        raise ValueError(f"Grant access callback is missing {name}")
+    return value
+
+
+def _read_param(params: dict[str, list[str]], name: str) -> str | None:
+    camel = _snake_to_camel(name)
+    for key in (name, camel):
+        values = params.get(key)
+        if values and values[0].strip():
+            return values[0].strip()
+    return None
+
+
+def _snake_to_camel(value: str) -> str:
+    head, *tail = value.split("_")
+    return head + "".join(part.capitalize() for part in tail)

swig_developer_sdk/passkeys.py

@@ -0,0 +1,122 @@
+from __future__ import annotations
+
+import hashlib
+import inspect
+import struct
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from typing import TypeAlias
+
+from .signing import PasskeySigningFn, PasskeySigningResult
+
+R1_AUTHENTICATION_TYPE_WEBAUTHN_RAW_CLIENT_DATA_JSON = 2
+SECP256R1_SCALAR_SIZE = 32
+P256_ORDER = int(
+    "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
+    16,
+)
+P256_HALF_ORDER = P256_ORDER >> 1
+
+
+@dataclass(frozen=True, slots=True)
+class WebAuthnAssertion:
+    authenticator_data: bytes
+    client_data_json: bytes
+    signature: bytes
+
+
+WebAuthnAssertionFn: TypeAlias = Callable[
+    [bytes], WebAuthnAssertion | Awaitable[WebAuthnAssertion]
+]
+
+
+def create_secp256r1_passkey_signing_fn(
+    get_assertion: WebAuthnAssertionFn,
+) -> PasskeySigningFn:
+    async def sign(message: bytes) -> PasskeySigningResult:
+        assertion = get_assertion(message)
+        if inspect.isawaitable(assertion):
+            assertion = await assertion
+        client_data_hash = hashlib.sha256(assertion.client_data_json).digest()
+        return PasskeySigningResult(
+            signature=secp256r1_der_to_raw_signature(assertion.signature),
+            prefix=_raw_webauthn_prefix(
+                assertion.client_data_json,
+                assertion.authenticator_data,
+            ),
+            message=assertion.authenticator_data + client_data_hash,
+        )
+
+    return sign
+
+
+def secp256r1_der_to_raw_signature(der_signature: bytes) -> bytes:
+    r, s = _parse_der_signature(der_signature)
+    if s > P256_HALF_ORDER:
+        s = P256_ORDER - s
+    return r.to_bytes(SECP256R1_SCALAR_SIZE, "big") + s.to_bytes(
+        SECP256R1_SCALAR_SIZE, "big"
+    )
+
+
+def _raw_webauthn_prefix(client_json: bytes, auth_data: bytes) -> bytes:
+    if len(auth_data) > 0xFFFF:
+        raise ValueError("WebAuthn authenticatorData is too large")
+    if len(client_json) > 0xFFFF:
+        raise ValueError("WebAuthn clientDataJSON is too large")
+    return b"".join(
+        (
+            struct.pack(
+                "<HH",
+                R1_AUTHENTICATION_TYPE_WEBAUTHN_RAW_CLIENT_DATA_JSON,
+                len(auth_data),
+            ),
+            auth_data,
+            struct.pack("<H", len(client_json)),
+            client_json,
+        )
+    )
+
+
+def _parse_der_signature(value: bytes) -> tuple[int, int]:
+    offset = 0
+    if not value or value[offset] != 0x30:
+        raise ValueError("Invalid secp256r1 DER signature")
+    sequence_length, offset = _read_der_length(value, offset + 1)
+    if offset + sequence_length != len(value):
+        raise ValueError("Invalid secp256r1 DER signature length")
+    r_bytes, offset = _read_der_integer(value, offset)
+    s_bytes, offset = _read_der_integer(value, offset)
+    if offset != len(value):
+        raise ValueError("Invalid secp256r1 DER signature trailing data")
+    return int.from_bytes(r_bytes, "big"), int.from_bytes(s_bytes, "big")
+
+
+def _read_der_integer(value: bytes, offset: int) -> tuple[bytes, int]:
+    if offset >= len(value) or value[offset] != 0x02:
+        raise ValueError("Invalid secp256r1 DER signature integer")
+    length, start = _read_der_length(value, offset + 1)
+    end = start + length
+    if length == 0 or end > len(value):
+        raise ValueError("Invalid secp256r1 DER signature integer length")
+    integer = value[start:end]
+    if integer[0] == 0 and len(integer) > 1:
+        integer = integer[1:]
+    if len(integer) > SECP256R1_SCALAR_SIZE:
+        raise ValueError("Secp256r1 signature integer is too large")
+    return integer, end
+
+
+def _read_der_length(value: bytes, offset: int) -> tuple[int, int]:
+    if offset >= len(value):
+        raise ValueError("Invalid secp256r1 DER signature length")
+    first = value[offset]
+    if first < 0x80:
+        return first, offset + 1
+    length_bytes = first & 0x7F
+    if length_bytes == 0 or length_bytes > 2:
+        raise ValueError("Unsupported secp256r1 DER signature length")
+    end = offset + 1 + length_bytes
+    if end > len(value):
+        raise ValueError("Invalid secp256r1 DER signature length")
+    return int.from_bytes(value[offset + 1 : end], "big"), end

swig_developer_sdk/paymaster.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Literal, TypeAlias
+from urllib.parse import urlencode
+
+from .common import Network
+from .core import HttpClient
+
+PaymasterKind: TypeAlias = Literal["api", "idp", "unspecified"]
+PaymasterBalanceKind: TypeAlias = Literal["api", "idp"]
+
+
+@dataclass(frozen=True, slots=True)
+class PaymasterBalance:
+    configured: bool
+    kind: PaymasterKind
+    id: str
+    address: str
+    label: str
+    balance_lamports: str
+    balance_sol: float
+
+
+class PaymasterClient:
+    def __init__(
+        self,
+        http: HttpClient,
+        default_network: Network | None = None,
+    ) -> None:
+        self._http = http
+        self._default_network = default_network
+
+    async def get_balance(
+        self,
+        *,
+        network: Network | None = None,
+        kind: PaymasterBalanceKind | None = None,
+    ) -> PaymasterBalance:
+        query: dict[str, str] = {}
+        resolved_network = network or self._default_network
+        if resolved_network is not None:
+            query["network"] = resolved_network
+        if kind is not None:
+            query["kind"] = (
+                "PAYMASTER_KIND_API" if kind == "api" else "PAYMASTER_KIND_IDP"
+            )
+        suffix = f"?{urlencode(query)}" if query else ""
+        return normalize_paymaster_balance(
+            await self._http.get(f"/paymaster/balance{suffix}")
+        )
+
+    async def get_idp_balance(
+        self,
+        *,
+        network: Network | None = None,
+    ) -> PaymasterBalance:
+        return await self.get_balance(network=network, kind="idp")
+
+
+def normalize_paymaster_balance(value: object) -> PaymasterBalance:
+    if not isinstance(value, Mapping):
+        raise ValueError("Paymaster balance response must be an object")
+    configured = value.get("configured", False)
+    if not isinstance(configured, bool):
+        raise ValueError("Paymaster balance response has invalid configured")
+    return PaymasterBalance(
+        configured=configured,
+        kind=_normalize_kind(value.get("kind")),
+        id=_optional_string(value.get("id")) or "",
+        address=_optional_string(value.get("address")) or "",
+        label=_optional_string(value.get("label")) or "",
+        balance_lamports=str(
+            value.get("balanceLamports", value.get("balance_lamports", "0"))
+        ),
+        balance_sol=_number(
+            value.get("balanceSol", value.get("balance_sol", 0)),
+            "balanceSol",
+        ),
+    )
+
+
+def _normalize_kind(value: object) -> PaymasterKind:
+    if value in ("api", "PAYMASTER_KIND_API", 1):
+        return "api"
+    if value in ("idp", "PAYMASTER_KIND_IDP", 2):
+        return "idp"
+    if value in (None, "unspecified", "PAYMASTER_KIND_UNSPECIFIED", 0):
+        return "unspecified"
+    raise ValueError("Paymaster balance response has invalid kind")
+
+
+def _number(value: object, field: str) -> float:
+    if isinstance(value, (int, float)) and not isinstance(value, bool):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value)
+        except ValueError:
+            pass
+    raise ValueError(f"Paymaster balance response is missing {field}")
+
+
+def _optional_string(value: object) -> str | None:
+    return value if isinstance(value, str) else None