9478670067

Committed 12 Jun 2024 07:42AM UTC coverage: 92.734% (+0.04%) from 92.691%

Build # 9478670067

Build Type

push

github

Committed by

web-flow

Commit Message

Support authentication with ERC-6492 (#1627)

Integrate `IBlockchainApiManager` with our SiWe implementation to support smart contract wallets:

- Import `BlockchainApiManagerModule` in `SiweRepositoryModule`
- Modify signature validation in `SiweRepository` to verifies signatures of EOAs then on-chain
- Create `FakeBlockchainApiManager`/`TestBlockchainApiManager` for mocking `eth_call` responses
- Add appropriate test coverage

Run Details

2024 of 2483 branches covered (81.51%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 4 files covered. (100.0%)

2 existing lines in 1 file now uncovered.

7216 of 7481 relevant lines covered (96.46%)

327.83 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

89.58

/src/domain/siwe/siwe.repository.ts

import { ISiweApi } from '@/domain/interfaces/siwe-api.interface';
import { IConfigurationService } from '@/config/configuration.service.interface';
import { ISiweRepository } from '@/domain/siwe/siwe.repository.interface';
import { LoggingService, ILoggingService } from '@/logging/logging.interface';
import { Inject, Injectable } from '@nestjs/common';
import { verifyMessage } from 'viem';
import {
  generateSiweNonce,
  parseSiweMessage,
  validateSiweMessage,
} from 'viem/siwe';
import { IBlockchainApiManager } from '@/domain/interfaces/blockchain-api.manager.interface';

@Injectable()
export class SiweRepository implements ISiweRepository {
  private readonly maxValidityPeriodInSeconds: number;

  constructor(
    @Inject(ISiweApi)
    private readonly siweApi: ISiweApi,
    @Inject(IConfigurationService)
    private readonly configurationService: IConfigurationService,
    @Inject(LoggingService)
    private readonly loggingService: ILoggingService,
    @Inject(IBlockchainApiManager)
    private readonly blockchainApiManager: IBlockchainApiManager,
  ) {
    this.maxValidityPeriodInSeconds = this.configurationService.getOrThrow(
      'auth.maxValidityPeriodSeconds',
    );
  }

  /**
   * Generates a unique nonce and stores it in cache for later verification.
   *
   * @returns nonce - unique string to be signed
   */
  async generateNonce(): Promise<{ nonce: string }> {
    const nonce = generateSiweNonce();

    await this.siweApi.storeNonce(nonce);

    return {
      nonce,
    };
  }

  /**
   * Verifies the validity of a signed message:
   *
   * 1. Ensure the message itself is not before or after validity period.
   * 2. Ensure the desired expiration time is within the max validity period.
   * 3. Verify the signature.
   * 4. Ensure the nonce was generated by us/is not a replay attack.
   *
   * @param args.message - SiWe message
   * @param args.signature - signature from signing {@link args.message}
   *
   * @returns boolean - whether the signed message is valid
   */
  async isValidMessage(args: {
    message: string;
    signature: `0x${string}`;
  }): Promise<boolean> {
    const message = parseSiweMessage(args.message);

    // Without nonce we can't verify whether a replay attack
    if (!message.nonce) {
      return false;
    }

    try {
      // Verifying message after notBefore and before expirationTime
      const isValidMessage = validateSiweMessage({
        message,
      });

      if (!isValidMessage || !message.chainId || !message.address) {
        return false;
      }

      // Expiration expectation does not exceed max validity period
      const isExpirationValid =
        !message.expirationTime ||
        message.expirationTime <=
          new Date(Date.now() + this.maxValidityPeriodInSeconds * 1_000);

      if (!isExpirationValid) {
        return false;
      }

      // Verify signature and nonce is cached (not a replay attack)
      const [isValidSignature, isNonceCached] = await Promise.all([
        this.isValidSignature({
          chainId: message.chainId.toString(),
          address: message.address,
          message: args.message,
          signature: args.signature,
        }),
        this.siweApi.getNonce(message.nonce).then(Boolean),
      ]);

      return isValidSignature && isNonceCached;
    } catch (e) {
      this.loggingService.debug(
        `Failed to verify SiWe message. message=${args.message}, error=${e}`,
      );
      return false;
    } finally {
      await this.siweApi.clearNonce(message.nonce);
    }
  }

  /**
   * Verifies signature of signed SiWe message, either by EOA or smart contract
   *
   * @param args.message - SiWe message
   * @param args.chainId - chainId of the blockchain
   * @param args.address - address of the signer
   * @param args.signature - signature from signing {@link args.message}
   *
   * @returns boolean - whether the signature is valid
   */
  private async isValidSignature(args: {
    message: string;
    chainId: string;
    address: `0x${string}`;
    signature: `0x${string}`;
  }): Promise<boolean> {
    // First check if valid signature of EOA as it can be done off chain
    const isValidEoaSignature = await verifyMessage(args).catch(() => false);
    if (isValidEoaSignature) {
      return true;
    }

    // Else, verify hash on-chain using ERC-6492 for smart contract accounts
    const blockchainApi = await this.blockchainApiManager.getBlockchainApi(
      args.chainId,
    );
    return blockchainApi.verifySiweMessage({
      message: args.message,
      signature: args.signature,
    });
  }
}

1	import { ISiweApi } from '@/domain/interfaces/siwe-api.interface';	102✔
2	import { IConfigurationService } from '@/config/configuration.service.interface';	102✔
3	import { ISiweRepository } from '@/domain/siwe/siwe.repository.interface';
4	import { LoggingService, ILoggingService } from '@/logging/logging.interface';	102✔
5	import { Inject, Injectable } from '@nestjs/common';	102✔
6	import { verifyMessage } from 'viem';	102✔
7	import {	102✔
8	generateSiweNonce,
9	parseSiweMessage,
10	validateSiweMessage,
11	} from 'viem/siwe';
12	import { IBlockchainApiManager } from '@/domain/interfaces/blockchain-api.manager.interface';	102✔
13
14	@Injectable()
15	export class SiweRepository implements ISiweRepository {	102✔
16	private readonly maxValidityPeriodInSeconds: number;
17
18	constructor(
19	@Inject(ISiweApi)
20	private readonly siweApi: ISiweApi,	16✔
21	@Inject(IConfigurationService)
22	private readonly configurationService: IConfigurationService,	16✔
23	@Inject(LoggingService)
24	private readonly loggingService: ILoggingService,	16✔
25	@Inject(IBlockchainApiManager)
26	private readonly blockchainApiManager: IBlockchainApiManager,	16✔
27	) {
28	this.maxValidityPeriodInSeconds = this.configurationService.getOrThrow(	16✔
29	'auth.maxValidityPeriodSeconds',
30	);
31	}
32
33	/**
34	* Generates a unique nonce and stores it in cache for later verification.
35	*
36	* @returns nonce - unique string to be signed
37	*/
38	async generateNonce(): Promise<{ nonce: string }> {
39	const nonce = generateSiweNonce();	14✔
40
41	await this.siweApi.storeNonce(nonce);	14✔
42
43	return {	14✔
44	nonce,
45	};
46	}
47
48	/**
49	* Verifies the validity of a signed message:
50	*
51	* 1. Ensure the message itself is not before or after validity period.
52	* 2. Ensure the desired expiration time is within the max validity period.
53	* 3. Verify the signature.
54	* 4. Ensure the nonce was generated by us/is not a replay attack.
55	*
56	* @param args.message - SiWe message
57	* @param args.signature - signature from signing {@link args.message}
58	*
59	* @returns boolean - whether the signed message is valid
60	*/
61	async isValidMessage(args: {
62	message: string;
63	signature: `0x${string}`;
64	}): Promise<boolean> {
65	const message = parseSiweMessage(args.message);	14✔
66
67	// Without nonce we can't verify whether a replay attack
68	if (!message.nonce) {	14!
69	return false;	×
70	}
71
72	try {	14✔
73	// Verifying message after notBefore and before expirationTime
74	const isValidMessage = validateSiweMessage({	14✔
75	message,
76	});
77
78	if (!isValidMessage \|\| !message.chainId \|\| !message.address) {	14✔
79	return false;	2✔
80	}
81
82	// Expiration expectation does not exceed max validity period
83	const isExpirationValid =
84	!message.expirationTime \|\|	12✔
85	message.expirationTime <=
86	new Date(Date.now() + this.maxValidityPeriodInSeconds * 1_000);
87
88	if (!isExpirationValid) {	12✔
89	return false;	2✔
90	}
91
92	// Verify signature and nonce is cached (not a replay attack)
93	const [isValidSignature, isNonceCached] = await Promise.all([	10✔
94	this.isValidSignature({
95	chainId: message.chainId.toString(),
96	address: message.address,
97	message: args.message,
98	signature: args.signature,
99	}),
100	this.siweApi.getNonce(message.nonce).then(Boolean),
101	]);
102
103	return isValidSignature && isNonceCached;	10✔
104	} catch (e) {
UNCOV 105	this.loggingService.debug(	×
106	`Failed to verify SiWe message. message=${args.message}, error=${e}`,
107	);
UNCOV 108	return false;	×
109	} finally {
110	await this.siweApi.clearNonce(message.nonce);	14✔
111	}
112	}
113
114	/**
115	* Verifies signature of signed SiWe message, either by EOA or smart contract
116	*
117	* @param args.message - SiWe message
118	* @param args.chainId - chainId of the blockchain
119	* @param args.address - address of the signer
120	* @param args.signature - signature from signing {@link args.message}
121	*
122	* @returns boolean - whether the signature is valid
123	*/
124	private async isValidSignature(args: {
125	message: string;
126	chainId: string;
127	address: `0x${string}`;
128	signature: `0x${string}`;
129	}): Promise<boolean> {
130	// First check if valid signature of EOA as it can be done off chain
131	const isValidEoaSignature = await verifyMessage(args).catch(() => false);	10✔
132	if (isValidEoaSignature) {	10✔
133	return true;	6✔
134	}
135
136	// Else, verify hash on-chain using ERC-6492 for smart contract accounts
137	const blockchainApi = await this.blockchainApiManager.getBlockchainApi(	4✔
138	args.chainId,
139	);
140	return blockchainApi.verifySiweMessage({	4✔
141	message: args.message,
142	signature: args.signature,
143	});
144	}
145	}

safe-global / safe-client-gateway / 9478670067

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous