9451032329

Committed 10 Jun 2024 03:18PM UTC coverage: 92.69% (+0.03%) from 92.662%

Build # 9451032329

Build Type

Pull #1627

github

Committed by

iamacook

Commit Message

Fix lint

Pull Request Pull Request #1627: Support authentication with ERC-6492

Run Details

2001 of 2463 branches covered (81.24%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 4 files covered. (100.0%)

3 existing lines in 2 files now uncovered.

7179 of 7441 relevant lines covered (96.48%)

326.71 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

89.8

/src/domain/siwe/siwe.repository.ts

import { ISiweApi } from '@/domain/interfaces/siwe-api.interface';
import { IConfigurationService } from '@/config/configuration.service.interface';
import { ISiweRepository } from '@/domain/siwe/siwe.repository.interface';
import { LoggingService, ILoggingService } from '@/logging/logging.interface';
import { Inject, Injectable } from '@nestjs/common';
import { verifyMessage } from 'viem';
import {
  generateSiweNonce,
  parseSiweMessage,
  validateSiweMessage,
  verifySiweMessage,
} from 'viem/siwe';
import { IBlockchainApiManager } from '@/domain/interfaces/blockchain-api.manager.interface';

@Injectable()
export class SiweRepository implements ISiweRepository {
  private readonly maxValidityPeriodInSeconds: number;

  constructor(
    @Inject(ISiweApi)
    private readonly siweApi: ISiweApi,
    @Inject(IConfigurationService)
    private readonly configurationService: IConfigurationService,
    @Inject(LoggingService)
    private readonly loggingService: ILoggingService,
    @Inject(IBlockchainApiManager)
    private readonly blockchainApiManager: IBlockchainApiManager,
  ) {
    this.maxValidityPeriodInSeconds = this.configurationService.getOrThrow(
      'auth.maxValidityPeriodSeconds',
    );
  }

  /**
   * Generates a unique nonce and stores it in cache for later verification.
   *
   * @returns nonce - unique string to be signed
   */
  async generateNonce(): Promise<{ nonce: string }> {
    const nonce = generateSiweNonce();

    await this.siweApi.storeNonce(nonce);

    return {
      nonce,
    };
  }

  /**
   * Verifies the validity of a signed message:
   *
   * 1. Ensure the message itself is not before or after validity period.
   * 2. Ensure the desired expiration time is within the max validity period.
   * 3. Verify the signature.
   * 4. Ensure the nonce was generated by us/is not a replay attack.
   *
   * @param args.message - SiWe message
   * @param args.signature - signature from signing {@link args.message}
   *
   * @returns boolean - whether the signed message is valid
   */
  async isValidMessage(args: {
    message: string;
    signature: `0x${string}`;
  }): Promise<boolean> {
    const message = parseSiweMessage(args.message);

    // Without nonce we can't verify whether a replay attack
    if (!message.nonce) {
      return false;
    }

    try {
      // Verifying message after notBefore and before expirationTime
      const isValidMessage = validateSiweMessage({
        message,
      });

      if (!isValidMessage || !message.chainId || !message.address) {
        return false;
      }

      // Expiration expectation does not exceed max validity period
      const isExpirationValid =
        !message.expirationTime ||
        message.expirationTime <=
          new Date(Date.now() + this.maxValidityPeriodInSeconds * 1_000);

      if (!isExpirationValid) {
        return false;
      }

      // Verify signature and nonce is cached (not a replay attack)
      const [isValidSignature, isNonceCached] = await Promise.all([
        this.isValidSignature({
          chainId: message.chainId.toString(),
          address: message.address,
          message: args.message,
          signature: args.signature,
        }),
        this.siweApi.getNonce(message.nonce).then(Boolean),
      ]);

      return isValidSignature && isNonceCached;
    } catch (e) {
      this.loggingService.debug(
        `Failed to verify SiWe message. message=${args.message}, error=${e}`,
      );
      return false;
    } finally {
      await this.siweApi.clearNonce(message.nonce);
    }
  }

  /**
   * Verifies signature of signed SiWe message, either by EOA or smart contract
   *
   * @param args.message - SiWe message
   * @param args.chainId - chainId of the blockchain
   * @param args.address - address of the signer
   * @param args.signature - signature from signing {@link args.message}
   *
   * @returns boolean - whether the signature is valid
   */
  private async isValidSignature(args: {
    message: string;
    chainId: string;
    address: `0x${string}`;
    signature: `0x${string}`;
  }): Promise<boolean> {
    // First check if valid signature of EOA as it can be done off chain
    const isValidEoaSignature = await verifyMessage(args).catch(() => false);
    if (isValidEoaSignature) {
      return true;
    }

    // Else, verify hash on-chain using ERC-6492 for smart contract accounts
    const blockchainApi = await this.blockchainApiManager.getBlockchainApi(
      args.chainId,
    );
    const client = blockchainApi.getClient();
    return verifySiweMessage(client, {
      message: args.message,
      signature: args.signature,
    });
  }
}

1	import { ISiweApi } from '@/domain/interfaces/siwe-api.interface';	102✔
2	import { IConfigurationService } from '@/config/configuration.service.interface';	102✔
3	import { ISiweRepository } from '@/domain/siwe/siwe.repository.interface';
4	import { LoggingService, ILoggingService } from '@/logging/logging.interface';	102✔
5	import { Inject, Injectable } from '@nestjs/common';	102✔
6	import { verifyMessage } from 'viem';	102✔
7	import {	102✔
8	generateSiweNonce,
9	parseSiweMessage,
10	validateSiweMessage,
11	verifySiweMessage,
12	} from 'viem/siwe';
13	import { IBlockchainApiManager } from '@/domain/interfaces/blockchain-api.manager.interface';	102✔
14
15	@Injectable()
16	export class SiweRepository implements ISiweRepository {	102✔
17	private readonly maxValidityPeriodInSeconds: number;
18
19	constructor(
20	@Inject(ISiweApi)
21	private readonly siweApi: ISiweApi,	16✔
22	@Inject(IConfigurationService)
23	private readonly configurationService: IConfigurationService,	16✔
24	@Inject(LoggingService)
25	private readonly loggingService: ILoggingService,	16✔
26	@Inject(IBlockchainApiManager)
27	private readonly blockchainApiManager: IBlockchainApiManager,	16✔
28	) {
29	this.maxValidityPeriodInSeconds = this.configurationService.getOrThrow(	16✔
30	'auth.maxValidityPeriodSeconds',
31	);
32	}
33
34	/**
35	* Generates a unique nonce and stores it in cache for later verification.
36	*
37	* @returns nonce - unique string to be signed
38	*/
39	async generateNonce(): Promise<{ nonce: string }> {
40	const nonce = generateSiweNonce();	14✔
41
42	await this.siweApi.storeNonce(nonce);	14✔
43
44	return {	14✔
45	nonce,
46	};
47	}
48
49	/**
50	* Verifies the validity of a signed message:
51	*
52	* 1. Ensure the message itself is not before or after validity period.
53	* 2. Ensure the desired expiration time is within the max validity period.
54	* 3. Verify the signature.
55	* 4. Ensure the nonce was generated by us/is not a replay attack.
56	*
57	* @param args.message - SiWe message
58	* @param args.signature - signature from signing {@link args.message}
59	*
60	* @returns boolean - whether the signed message is valid
61	*/
62	async isValidMessage(args: {
63	message: string;
64	signature: `0x${string}`;
65	}): Promise<boolean> {
66	const message = parseSiweMessage(args.message);	14✔
67
68	// Without nonce we can't verify whether a replay attack
69	if (!message.nonce) {	14!
70	return false;	×
71	}
72
73	try {	14✔
74	// Verifying message after notBefore and before expirationTime
75	const isValidMessage = validateSiweMessage({	14✔
76	message,
77	});
78
79	if (!isValidMessage \|\| !message.chainId \|\| !message.address) {	14✔
80	return false;	2✔
81	}
82
83	// Expiration expectation does not exceed max validity period
84	const isExpirationValid =
85	!message.expirationTime \|\|	12✔
86	message.expirationTime <=
87	new Date(Date.now() + this.maxValidityPeriodInSeconds * 1_000);
88
89	if (!isExpirationValid) {	12✔
90	return false;	2✔
91	}
92
93	// Verify signature and nonce is cached (not a replay attack)
94	const [isValidSignature, isNonceCached] = await Promise.all([	10✔
95	this.isValidSignature({
96	chainId: message.chainId.toString(),
97	address: message.address,
98	message: args.message,
99	signature: args.signature,
100	}),
101	this.siweApi.getNonce(message.nonce).then(Boolean),
102	]);
103
104	return isValidSignature && isNonceCached;	10✔
105	} catch (e) {
UNCOV 106	this.loggingService.debug(	×
107	`Failed to verify SiWe message. message=${args.message}, error=${e}`,
108	);
UNCOV 109	return false;	×
110	} finally {
111	await this.siweApi.clearNonce(message.nonce);	14✔
112	}
113	}
114
115	/**
116	* Verifies signature of signed SiWe message, either by EOA or smart contract
117	*
118	* @param args.message - SiWe message
119	* @param args.chainId - chainId of the blockchain
120	* @param args.address - address of the signer
121	* @param args.signature - signature from signing {@link args.message}
122	*
123	* @returns boolean - whether the signature is valid
124	*/
125	private async isValidSignature(args: {
126	message: string;
127	chainId: string;
128	address: `0x${string}`;
129	signature: `0x${string}`;
130	}): Promise<boolean> {
131	// First check if valid signature of EOA as it can be done off chain
132	const isValidEoaSignature = await verifyMessage(args).catch(() => false);	10✔
133	if (isValidEoaSignature) {	10✔
134	return true;	6✔
135	}
136
137	// Else, verify hash on-chain using ERC-6492 for smart contract accounts
138	const blockchainApi = await this.blockchainApiManager.getBlockchainApi(	4✔
139	args.chainId,
140	);
141	const client = blockchainApi.getClient();	4✔
142	return verifySiweMessage(client, {	4✔
143	message: args.message,
144	signature: args.signature,
145	});
146	}
147	}

safe-global / safe-client-gateway / 9451032329

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous