accounts
Version:
Tempo Accounts SDK
346 lines • 13 kB
JavaScript
import { AbiFunction, Address, Hex, PublicKey, RpcResponse, WebCryptoP256 } from 'ox';
import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo';
import { BaseError } from 'viem';
import { Account as TempoAccount, Actions, KeyAuthorizationManager as TempoKeyAuthorizationManager, } from 'viem/tempo';
import * as ExecutionError from './ExecutionError.js';
const status = {
/** No matching usable access key was found. */
missing: 'missing',
/** A matching key has a stored authorization that has not been observed on-chain yet. */
pending: 'pending',
/** A matching key exists on-chain and can be used. */
published: 'published',
/** A matching key exists but is past its expiry. */
expired: 'expired',
};
const unavailableErrorNames = new Set(['KeyAlreadyRevoked', 'KeyNotFound']);
/** Generates a P256 key pair and access key account. */
export async function generate(options = {}) {
const { account } = options;
const keyPair = await WebCryptoP256.createKeyPair();
const accessKey = TempoAccount.fromWebCryptoP256(keyPair, account ? { access: account } : undefined);
return { accessKey, keyPair };
}
/** Prepares an unsigned key authorization and local key material when needed. */
export async function prepareAuthorization(options) {
const { address, chainId, expiry, keyType, limits, publicKey, scopes } = options;
if (address || publicKey) {
const keyAuthorization = KeyAuthorization.from({
address: address ?? Address.fromPublicKey(PublicKey.from(publicKey)),
chainId: BigInt(chainId),
expiry,
limits,
scopes,
type: keyType ?? 'secp256k1',
});
return { keyAuthorization };
}
if (keyType && keyType !== 'p256')
throw new RpcResponse.InvalidParamsError({
message: `\`keyType: "${keyType}"\` requires externally generated key material; provide \`publicKey\` or \`address\`.`,
});
const keyPair = await WebCryptoP256.createKeyPair();
const keyAuthorization = KeyAuthorization.from({
address: Address.fromPublicKey(PublicKey.from(keyPair.publicKey)),
chainId: BigInt(chainId),
expiry,
limits,
scopes,
type: 'p256',
});
return { keyAuthorization, keyPair };
}
/** Prepares, signs, and saves an access key authorization. */
export async function authorize(options) {
const { account, chainId, parameters, store } = options;
const prepared = await prepareAuthorization({
...parameters,
chainId: parameters.chainId ?? chainId,
});
const digest = KeyAuthorization.getSignPayload(prepared.keyAuthorization);
const signature = await account.sign({ hash: digest });
const keyAuthorization = KeyAuthorization.from(prepared.keyAuthorization, {
signature: SignatureEnvelope.from(signature),
});
add({
account: account.address,
authorization: keyAuthorization,
...(prepared.keyPair ? { keyPair: prepared.keyPair } : {}),
store,
});
return KeyAuthorization.toRpc(keyAuthorization);
}
/** Returns publication status for a stored or on-chain access key. */
export async function getStatus(options) {
const { accessKey, account, calls, chainId, client, store } = options;
const now = options.now ?? Date.now() / 1000;
const local = list({ account, accessKey, chainId, store }).find((key) => scopesMatch(key, { calls }));
if (local) {
if (isExpired(local.expiry, now))
return status.expired;
if (local.keyAuthorization) {
const publicationStatus = await getPublishedStatus(client, {
accessKey: local.address,
account,
now,
}).catch(() => status.pending);
if (publicationStatus === status.published)
clearAuthorization({
accessKey: local.address,
account,
chainId,
store,
});
return publicationStatus === status.published ? status.published : status.pending;
}
return await getPublishedStatus(client, { accessKey: local.address, account, now });
}
if (accessKey)
return await getPublishedStatus(client, { accessKey, account, now });
return status.missing;
}
/** Selects a locally-signable access key account for an intent. */
export async function select(options) {
const { account, calls, chainId, store } = options;
const now = options.now ?? Date.now() / 1000;
const records = list({ account, chainId, store });
for (const record of records) {
if (!scopesMatch(record, { calls }))
continue;
if (isExpired(record.expiry, now)) {
remove({ accessKey: record.address, account: record.access, chainId: record.chainId, store });
continue;
}
const account_accessKey = hydrate(record, store);
if (!account_accessKey)
continue;
return account_accessKey;
}
}
function createKeyAuthorizationManager(store) {
return TempoKeyAuthorizationManager.from({
source: {
get(key) {
return list({
account: key.address,
accessKey: key.accessKey,
chainId: key.chainId,
store,
})[0]?.keyAuthorization;
},
remove(key) {
clearAuthorization({
account: key.address,
accessKey: key.accessKey,
chainId: key.chainId,
store,
});
},
set(key, keyAuthorization) {
patch({
account: key.address,
accessKey: key.accessKey,
chainId: key.chainId,
patch: { keyAuthorization },
store,
});
},
},
});
}
/** Adds a signed access key authorization. */
export function add(options) {
const { account, authorization, keyPair, privateKey, store } = options;
const base = {
address: authorization.address,
access: account,
chainId: Number(authorization.chainId),
expiry: authorization.expiry ?? undefined,
keyAuthorization: authorization,
keyType: authorization.type,
limits: authorization.limits,
scopes: authorization.scopes,
};
const record = (privateKey ? { ...base, privateKey } : keyPair ? { ...base, keyPair } : base);
store.setState((state) => ({
accessKeys: [
record,
...state.accessKeys.filter((entry) => !matches(entry, {
account: record.access,
accessKey: record.address,
chainId: record.chainId,
})),
],
}));
return record;
}
function clearAuthorization(options) {
const { store, ...key } = options;
patch({
...key,
patch: { keyAuthorization: undefined },
store,
});
}
/** Removes an access key record. */
export function remove(options) {
const { store, ...key } = options;
store.setState((state) => ({
accessKeys: state.accessKeys.filter((record) => !matches(record, key)),
}));
}
/** Returns whether an error means an access key is already unavailable on-chain. */
export function isUnavailableError(error) {
if (error instanceof BaseError) {
const found = error.walk((e) => {
const errorName = e.data?.errorName;
return !!errorName && unavailableErrorNames.has(errorName);
});
if (found)
return true;
}
if (!(error instanceof Error))
return false;
return unavailableErrorNames.has(ExecutionError.parse(error).errorName);
}
function scopesMatch(key, options) {
const scopes = key.scopes;
if (typeof scopes === 'undefined')
return true;
if (!Array.isArray(scopes))
return false;
if (!options.calls)
return false;
return options.calls.every((call) => {
if (!call.to)
return false;
const callTo = call.to.toLowerCase();
const callSelector = call.data?.slice(0, 10).toLowerCase();
return scopes.some((scope) => {
if (!isScope(scope))
return false;
if (scope.address.toLowerCase() !== callTo)
return false;
const selector = scope.selector;
if (!selector)
return scope.recipients ? scope.recipients.length === 0 : true;
const scopeSelector = (() => {
try {
return (selector.startsWith('0x') && selector.length === 10
? selector
: AbiFunction.getSelector(selector)).toLowerCase();
}
catch {
return undefined;
}
})();
if (!scopeSelector || callSelector !== scopeSelector)
return false;
if (!scope.recipients || scope.recipients.length === 0)
return true;
if (!call.data || call.data.length < 74)
return false;
const recipient = `0x${call.data.slice(34, 74)}`;
if (!Address.validate(recipient))
return false;
return scope.recipients.some((address) => address.toLowerCase() === recipient.toLowerCase());
});
});
}
function isScope(scope) {
if (!scope || typeof scope !== 'object')
return false;
const value = scope;
if (typeof value.address !== 'string' || !Address.validate(value.address))
return false;
if (typeof value.selector !== 'undefined' && typeof value.selector !== 'string')
return false;
if (typeof value.recipients !== 'undefined') {
if (!Array.isArray(value.recipients))
return false;
if (value.recipients.some((recipient) => typeof recipient !== 'string'))
return false;
if (value.recipients.some((recipient) => !Address.validate(recipient)))
return false;
}
return true;
}
function hydrate(accessKey, store) {
const keyAuthorizationManager = createKeyAuthorizationManager(store);
if ('keyPair' in accessKey && accessKey.keyPair)
return TempoAccount.fromWebCryptoP256(accessKey.keyPair, {
access: accessKey.access,
keyAuthorizationManager,
});
if ('privateKey' in accessKey && accessKey.privateKey) {
switch (accessKey.keyType) {
case 'secp256k1':
return TempoAccount.fromSecp256k1(accessKey.privateKey, {
access: accessKey.access,
keyAuthorizationManager,
});
case 'p256':
return TempoAccount.fromP256(accessKey.privateKey, {
access: accessKey.access,
keyAuthorizationManager,
});
}
}
return undefined;
}
function isExpired(expiry, now) {
return typeof expiry === 'number' && expiry < now;
}
async function getPublishedStatus(client, options) {
const { accessKey, account, now } = options;
try {
const metadata = await Actions.accessKey.getMetadata(client, {
account,
accessKey,
});
if (metadata.address.toLowerCase() !== accessKey.toLowerCase())
return status.missing;
if (metadata.isRevoked)
return status.missing;
if (metadata.expiry > 0n && metadata.expiry < BigInt(Math.floor(now)))
return status.expired;
return status.published;
}
catch (error) {
if (isUnavailableError(error))
return status.missing;
throw error;
}
}
function list(options) {
const { store, ...query } = options;
return store.getState().accessKeys.filter((key) => matches(key, query));
}
function patch(options) {
const { patch, store, ...key } = options;
store.setState((state) => ({
accessKeys: state.accessKeys.map((record) => {
if (!matches(record, key))
return record;
const next = { ...record };
for (const [name, value] of Object.entries(patch)) {
if (typeof value === 'undefined')
delete next[name];
else
next[name] = value;
}
return next;
}),
}));
}
function matches(record, options) {
const { accessKey, account, chainId } = options;
if (record.access.toLowerCase() !== account.toLowerCase())
return false;
if (record.chainId !== chainId)
return false;
if (accessKey && record.address.toLowerCase() !== accessKey.toLowerCase())
return false;
return true;
}
//# sourceMappingURL=AccessKey.js.map