viem
Version:
651 lines • 24.4 kB
JavaScript
import * as Address from 'ox/Address';
import * as Hex from 'ox/Hex';
import * as P256 from 'ox/P256';
import * as PublicKey from 'ox/PublicKey';
import * as Secp256k1 from 'ox/Secp256k1';
import * as Signature from 'ox/Signature';
import { Channel, KeyAuthorization, MultisigConfig, SignatureEnvelope, } from 'ox/tempo';
import * as WebAuthnP256 from 'ox/WebAuthnP256';
import * as WebCryptoP256 from 'ox/WebCryptoP256';
import { parseAccount } from '../accounts/utils/parseAccount.js';
import { hashAuthorization } from '../utils/authorization/hashAuthorization.js';
import { keccak256 } from '../utils/hash/keccak256.js';
import { hashMessage } from '../utils/signature/hashMessage.js';
import { hashTypedData } from '../utils/signature/hashTypedData.js';
import { nativeMultisigFactory } from './Addresses.js';
import { parseApproval } from './multisig/Signature.js';
import * as Transaction from './Transaction.js';
/** Instantiates an Account. */
export function from(parameters) {
const { access } = parameters;
if (access)
return fromAccessKey(parameters);
return fromRoot(parameters);
}
/**
* Instantiates an Account from a headless WebAuthn credential (P256 private key).
*
* @example
* ```ts
* import { Account } from 'viem/tempo'
*
* const account = Account.fromHeadlessWebAuthn('0x...')
* ```
*
* @param privateKey P256 private key.
* @returns Account.
*/
export function fromHeadlessWebAuthn(privateKey, options) {
const { access, keyAuthorizationManager, rpId, origin, internal_version } = options;
const publicKey = P256.getPublicKey({ privateKey });
return from({
...(access ? { access, keyAuthorizationManager } : {}),
internal_version,
keyType: 'webAuthn',
publicKey,
async sign({ hash }) {
const { metadata, payload } = WebAuthnP256.getSignPayload({
...options,
challenge: hash,
rpId,
origin,
});
const signature = P256.sign({
payload,
privateKey,
hash: true,
});
return SignatureEnvelope.serialize({
metadata,
signature,
publicKey,
type: 'webAuthn',
});
},
});
}
/**
* Instantiates an Account from a P256 private key.
*
* @example
* ```ts
* import { Account } from 'viem/tempo'
*
* const account = Account.fromP256('0x...')
* ```
*
* @param privateKey P256 private key.
* @returns Account.
*/
export function fromP256(privateKey, options = {}) {
const { access, keyAuthorizationManager, internal_version } = options;
const publicKey = P256.getPublicKey({ privateKey });
return from({
...(access ? { access, keyAuthorizationManager } : {}),
internal_version,
keyType: 'p256',
publicKey,
async sign({ hash }) {
const signature = P256.sign({ payload: hash, privateKey });
return SignatureEnvelope.serialize({
signature,
publicKey,
type: 'p256',
});
},
});
}
/**
* Instantiates an Account from a Secp256k1 private key.
*
* @example
* ```ts
* import { Account } from 'viem/tempo'
*
* const account = Account.fromSecp256k1('0x...')
* ```
*
* @param privateKey Secp256k1 private key.
* @returns Account.
*/
export function fromSecp256k1(privateKey, options = {}) {
const { access, keyAuthorizationManager, internal_version } = options;
const publicKey = Secp256k1.getPublicKey({ privateKey });
return from({
...(access ? { access, keyAuthorizationManager } : {}),
internal_version,
keyType: 'secp256k1',
publicKey,
async sign(parameters) {
const { hash } = parameters;
const signature = Secp256k1.sign({ payload: hash, privateKey });
return Signature.toHex(signature);
},
});
}
export function fromMultisig(value) {
const configInput = (() => {
if (typeof value === 'string')
return undefined;
const { address: _, ...config } = value;
return config;
})();
const config = (() => {
if (!configInput)
return undefined;
const ownerEntries = configInput.owners.map((value) => typeof value === 'string' || 'address' in value
? { owner: value, weight: 1 }
: value);
return MultisigConfig.from({
...configInput,
owners: ownerEntries.map(({ owner, weight }) => ({
owner: typeof owner === 'string' ? owner : owner.address,
weight,
})),
threshold: configInput.threshold ?? 1,
});
})();
if (typeof value !== 'string') {
if ((value.address === undefined || value.address === 'infer') &&
config.version !== 0n)
throw new Error('An initial multisig config must have version zero.');
if (value.address !== undefined &&
value.address !== 'infer' &&
config.version === 0n)
throw new Error('A current multisig config must have a version.');
}
const address = Address.checksum((() => {
if (typeof value === 'string')
return value;
if (value.address === undefined || value.address === 'infer')
return MultisigConfig.getAddress(config, {
factory: nativeMultisigFactory,
});
return value.address;
})());
const ownerAccounts = (() => {
if (!configInput)
return [];
return configInput.owners.flatMap((value) => {
const owner = typeof value === 'string' || 'address' in value ? value : value.owner;
return typeof owner === 'string' ? [] : [parseAccount(owner)];
});
})();
if (ownerAccounts.some((owner) => owner.source === 'multisig' || isAccessKeyAccount(owner)))
throw new Error('Multisig owners must use primitive signatures.');
const owners = config?.owners.flatMap(({ owner }) => {
const account = ownerAccounts.find((account) => Address.isEqual(account.address, owner));
return account ? [account] : [];
}) ?? [];
const account = {
address,
config,
owners,
publicKey: '0x',
source: 'multisig',
type: 'local',
async sign({ hash }) {
return SignatureEnvelope.serialize(await signMultisig(account, { payload: hash }));
},
async signMessage() {
throw new Error('`signMessage` is not supported for multisig accounts.');
},
async signTransaction(transaction, options) {
const { serializer = Transaction.serialize } = options ?? {};
const request = transaction;
if (request.owner) {
const owner = parseAccount(request.owner);
if (owner.type !== 'local')
throw new Error('A local owner account is required to approve a multisig transaction.');
if (owner.source !== 'root')
throw new Error('A Tempo owner account is required to approve a multisig transaction.');
const { owner: _, ...ownerRequest } = request;
return await owner.signTransaction(ownerRequest, options);
}
if (owners.length === 0)
return (await serializer(transaction));
const presign = {
...request,
signatures: undefined,
...(request.feePayerSignature === undefined
? {}
: { feePayerSignature: null }),
};
const payload = keccak256(await serializer(presign));
const simulation = request.multisigSimulation;
if (request.from && !Address.isEqual(request.from, address))
throw new Error('Multisig account does not match the transaction sender.');
const signature = await signMultisig(account, {
config: simulation?.config,
payload,
signatures: request.signatures?.map((signature) => parseApproval(signature)),
});
return (await serializer(transaction, signature));
},
async signTypedData() {
throw new Error('`signTypedData` is not supported for multisig accounts.');
},
};
return account;
}
function isMultisigAccount(account) {
return account.source === 'multisig';
}
async function signMultisig(account, parameters) {
const { config, payload, signatures: providedSignatures = [] } = parameters;
const currentConfig = config ?? account.config;
if (!currentConfig)
throw new Error('A current multisig config is required for local signing.');
const digest = MultisigConfig.getSignPayload({
account: account.address,
config: currentConfig,
payload,
});
const signatures = [...providedSignatures];
const signedOwners = new Set();
let weight = 0;
for (const signature of providedSignatures) {
const address = SignatureEnvelope.extractAddress({
payload: digest,
signature,
}).toLowerCase();
const owner = currentConfig.owners.find((owner) => Address.isEqual(owner.owner, address));
if (!owner || signedOwners.has(address))
continue;
signedOwners.add(address);
weight += Number(owner.weight);
}
const owners = [...currentConfig.owners].sort((a, b) => Number(b.weight) - Number(a.weight) ||
a.owner.toLowerCase().localeCompare(b.owner.toLowerCase()));
for (const owner of owners) {
if (weight >= Number(currentConfig.threshold))
break;
const address = owner.owner.toLowerCase();
if (signedOwners.has(address))
continue;
const ownerAccount = account.owners.find((account) => Address.isEqual(account.address, owner.owner));
if (!ownerAccount)
continue;
if (!ownerAccount.sign)
throw new Error('Multisig owner account cannot sign.');
signatures.push(parseApproval(await ownerAccount.sign({ hash: digest })));
signedOwners.add(address);
weight += Number(owner.weight);
if (weight >= Number(currentConfig.threshold))
break;
}
if (weight < Number(currentConfig.threshold))
throw new Error('Local multisig owners do not meet the threshold.');
return SignatureEnvelope.from({
account: account.address,
config: currentConfig,
signatures: SignatureEnvelope.sortMultisigApprovals({
account: account.address,
config: currentConfig,
payload,
signatures,
}),
});
}
/**
* Instantiates an Account from a WebAuthn credential.
*
* @example
*
* ### Create Passkey + Instantiate Account
*
* Create a credential with `WebAuthnP256.createCredential` and then instantiate
* a Viem Account with `Account.fromWebAuthnP256`.
*
* It is highly recommended to store the credential's public key in an external store
* for future use (ie. for future calls to `WebAuthnP256.getCredential`).
*
* ```ts
* import { Account, WebAuthnP256 } from 'viem/tempo'
* import { publicKeyStore } from './store'
*
* // 1. Create credential
* const credential = await WebAuthnP256.createCredential({ name: 'Example' })
*
* // 2. Instantiate account
* const account = Account.fromWebAuthnP256(credential)
*
* // 3. Store public key
* await publicKeyStore.set(credential.id, credential.publicKey)
*
* ```
*
* @example
*
* ### Get Credential + Instantiate Account
*
* Gets a credential from `WebAuthnP256.getCredential` and then instantiates
* an account with `Account.fromWebAuthnP256`.
*
* The `getPublicKey` function is required to fetch the public key paired with the credential
* from an external store. The public key is required to derive the account's address.
*
* ```ts
* import { Account, WebAuthnP256 } from 'viem/tempo'
* import { publicKeyStore } from './store'
*
* // 1. Get credential
* const credential = await WebAuthnP256.getCredential({
* async getPublicKey(credential) {
* // 2. Get public key from external store.
* return await publicKeyStore.get(credential.id)
* }
* })
*
* // 3. Instantiate account
* const account = Account.fromWebAuthnP256(credential)
* ```
*
* @param credential WebAuthnP256 credential.
* @returns Account.
*/
export function fromWebAuthnP256(credential, options = {}) {
const { id } = credential;
const publicKey = PublicKey.fromHex(credential.publicKey);
return from({
keyType: 'webAuthn',
publicKey,
async sign({ hash }) {
const { metadata, signature } = await WebAuthnP256.sign({
...options,
challenge: hash,
credentialId: id,
});
return SignatureEnvelope.serialize({
publicKey,
metadata,
signature,
type: 'webAuthn',
});
},
});
}
/**
* Instantiates an Account from a P256 private key.
*
* @example
* ```ts
* import { Account } from 'viem/tempo'
* import { WebCryptoP256 } from 'ox'
*
* const keyPair = await WebCryptoP256.createKeyPair()
*
* const account = Account.fromWebCryptoP256(keyPair)
* ```
*
* @param keyPair WebCryptoP256 key pair.
* @returns Account.
*/
export function fromWebCryptoP256(keyPair, options = {}) {
const { access, keyAuthorizationManager, internal_version } = options;
const { publicKey, privateKey } = keyPair;
return from({
...(access ? { access, keyAuthorizationManager } : {}),
internal_version,
keyType: 'p256',
publicKey,
async sign({ hash }) {
const signature = await WebCryptoP256.sign({ payload: hash, privateKey });
return SignatureEnvelope.serialize({
signature,
prehash: true,
publicKey,
type: 'p256',
});
},
});
}
export async function signVoucher(account, parameters) {
const hash = getVoucherSignPayload(parameters);
if (isAccessKeyAccount(account))
return account.sign({ hash, raw: true });
return account.sign({ hash });
}
function getVoucherSignPayload(parameters) {
const { chainId, channel, cumulativeAmount } = parameters;
const channelId = typeof channel === 'string'
? channel
: Channel.computeId(channel, {
chainId,
});
return Channel.getVoucherSignPayload({
chainId,
channelId,
cumulativeAmount,
});
}
function isAccessKeyAccount(account) {
return account.source === 'accessKey' && 'accessKeyAddress' in account;
}
/** @internal */
export function getKeyAuthorizationSignPayload(account, parameters) {
const { admin, chainId, expiry, key, limits, scopes, witness } = parameters;
const { accessKeyAddress, keyType: type } = resolveAccessKey(key);
const boundFields = isAccessKeyAccount(account) || isMultisigAccount(account)
? { account: account.address }
: {};
const restrictions = admin ? {} : { expiry, limits, scopes };
return KeyAuthorization.getSignPayload({
address: accessKeyAddress,
chainId,
type,
witness,
...(admin ? { isAdmin: true } : {}),
...boundFields,
...restrictions,
});
}
export async function signKeyAuthorization(account, parameters) {
const { admin, chainId, expiry, key, limits, multisig: multisigState, scopes, signatures, witness, } = parameters;
const { accessKeyAddress, keyType: type } = resolveAccessKey(key);
// When the signer is an admin access key, the authorization must be
// signed directly by that key and bound to the parent account it acts
// on behalf of, so the signed payload cannot be replayed against another
// account. [TIP-1049]
const isAccessKey = isAccessKeyAccount(account);
const isMultisig = isMultisigAccount(account);
const boundFields = isAccessKey || isMultisig ? { account: account.address } : {};
// Admin key authorizations are unrestricted and must not carry expiry,
// limits, or call scopes (the protocol rejects them). [TIP-1049]
const restrictions = admin ? {} : { expiry, limits, scopes };
const hash = getKeyAuthorizationSignPayload(account, parameters);
const signature = await (async () => {
if (isAccessKey)
return account.sign({ hash, raw: true });
if (isMultisig) {
if (!multisigState)
throw new Error('Multisig state is required to sign a key authorization.');
return SignatureEnvelope.serialize(await signMultisig(account, {
config: multisigState.config,
payload: hash,
signatures: signatures?.map((signature) => parseApproval(signature)),
}));
}
return account.sign({ hash });
})();
return KeyAuthorization.from({
address: accessKeyAddress,
chainId,
signature: SignatureEnvelope.from(signature),
type,
...(witness ? { witness } : {}),
...(admin ? { isAdmin: true } : {}),
...boundFields,
...restrictions,
});
}
/** @internal */
// biome-ignore lint/correctness/noUnusedVariables: _
function fromBase(parameters) {
const { keyType = 'secp256k1', parentAddress, source = 'privateKey', internal_version = 'v2', } = parameters;
const address = parentAddress ?? Address.fromPublicKey(parameters.publicKey);
const publicKey = PublicKey.toHex(parameters.publicKey, {
includePrefix: false,
});
async function sign({ hash, raw }) {
if (raw)
return await parameters.sign({ hash });
const innerHash = parentAddress && internal_version === 'v2'
? keccak256(Hex.concat('0x04', hash, parentAddress))
: hash;
const signature = await parameters.sign({ hash: innerHash });
if (parentAddress)
return SignatureEnvelope.serialize(SignatureEnvelope.from({
userAddress: parentAddress,
inner: SignatureEnvelope.from(signature),
type: 'keychain',
version: internal_version,
}));
return signature;
}
return {
address: Address.checksum(address),
keyType,
sign,
async signAuthorization(parameters) {
const { chainId, nonce } = parameters;
const address = parameters.contractAddress ?? parameters.address;
const signature = await sign({
hash: hashAuthorization({ address, chainId, nonce }),
});
const envelope = SignatureEnvelope.from(signature);
if (envelope.type !== 'secp256k1')
throw new Error('Unsupported signature type. Expected `secp256k1` but got `' +
envelope.type +
'`.');
const { r, s, yParity } = envelope.signature;
return {
address,
chainId,
nonce,
r: Hex.fromNumber(r, { size: 32 }),
s: Hex.fromNumber(s, { size: 32 }),
yParity,
};
},
async signMessage(parameters) {
const { message } = parameters;
return await sign({ hash: hashMessage(message) });
},
async signTransaction(transaction, options) {
const { serializer = Transaction.serialize } = options ?? {};
const presign = (() => {
if ('feePayerSignature' in transaction && transaction.feePayerSignature)
return { ...transaction, feePayerSignature: null };
return transaction;
})();
const payload = keccak256(await serializer(presign));
// Native multisig (TIP-1061): return this owner's approval, a serialized
// primitive signature over the multisig owner approval digest, instead of
// a full serialized transaction. Approvals are combined later in
// `sendTransaction({ signatures })`.
const { multisigSimulation, from } = transaction;
if (multisigSimulation) {
if (!from)
throw new Error('A multisig sender is required for signing.');
const config = MultisigConfig.from(multisigSimulation.config);
const digest = MultisigConfig.getSignPayload({
account: from,
config,
payload,
});
return await sign({ hash: digest, raw: true });
}
const signature = await sign({ hash: payload });
const envelope = SignatureEnvelope.from(signature);
return await serializer(transaction, envelope);
},
async signTypedData(typedData) {
return await sign({ hash: hashTypedData(typedData) });
},
async signVoucher(parameters) {
const hash = getVoucherSignPayload(parameters);
if (parentAddress)
return await sign({ hash, raw: true });
return await sign({ hash });
},
publicKey,
source,
type: 'local',
};
}
/** @internal */
// biome-ignore lint/correctness/noUnusedVariables: _
function fromRoot(parameters) {
const account = fromBase(parameters);
return {
...account,
source: 'root',
async signKeyAuthorization(key, parameters) {
const { chainId, expiry, limits, scopes, witness, admin } = parameters;
const { accessKeyAddress, keyType: type } = resolveAccessKey(key);
// Admin key authorizations are unrestricted and must not carry expiry,
// limits, or call scopes (the protocol rejects them). [TIP-1049]
const restrictions = admin ? {} : { expiry, limits, scopes };
const signature = await account.sign({
hash: KeyAuthorization.getSignPayload({
address: accessKeyAddress,
chainId,
type,
witness,
...(admin ? { isAdmin: true } : {}),
...restrictions,
}),
});
const keyAuthorization = KeyAuthorization.from({
address: accessKeyAddress,
chainId,
signature: SignatureEnvelope.from(signature),
type,
...(witness ? { witness } : {}),
...(admin ? { isAdmin: true } : {}),
...restrictions,
});
return keyAuthorization;
},
};
}
// biome-ignore lint/correctness/noUnusedVariables: _
function fromAccessKey(parameters) {
const { access, keyAuthorizationManager } = parameters;
const { address: parentAddress } = parseAccount(access);
const account = fromBase({ ...parameters, parentAddress });
return {
...account,
accessKeyAddress: Address.fromPublicKey(parameters.publicKey),
keyAuthorizationManager,
source: 'accessKey',
};
}
/** @internal */
export function resolveAccessKey(accessKey) {
if ('accessKeyAddress' in accessKey)
return {
accessKeyAddress: accessKey.accessKeyAddress,
keyType: accessKey.keyType,
};
if ('publicKey' in accessKey && accessKey.publicKey)
return {
accessKeyAddress: Address.fromPublicKey(PublicKey.fromHex(accessKey.publicKey)),
keyType: accessKey.type,
};
return {
accessKeyAddress: accessKey.address,
keyType: accessKey.type,
};
}
// Export types required for inference.
// biome-ignore lint/performance/noBarrelFile: _
export {
/** @deprecated */
KeyAuthorization as z_KeyAuthorization,
/** @deprecated */
SignatureEnvelope as z_SignatureEnvelope,
/** @deprecated */
TxEnvelopeTempo as z_TxEnvelopeTempo, } from 'ox/tempo';
//# sourceMappingURL=Account.js.map