Skip to content

Commit 6c9f0f6

Browse files
AnsonhkgAnsonhkg
committed
feat(auth): enhance delegation signature handling and validation in auth context
1 parent 82d33f1 commit 6c9f0f6

File tree

9 files changed

+161
-246
lines changed

9 files changed

+161
-246
lines changed

‎packages/auth/src/lib/AuthManager/auth-manager.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ export const createAuthManager = (authManagerParams: AuthManagerParams) => {
7979
cache?: {
8080
delegationAuthSig?: boolean;
8181
};
82+
sessionKeyPair?: SessionKeyPair;
83+
delegationAuthSig?: AuthSig;
8284
}) => {
8385
return getPkpAuthContextAdapter(authManagerParams, params);
8486
},

‎packages/auth/src/lib/AuthManager/authAdapters/generateEoaDelegationAuthSig.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,11 @@ export async function generateEoaDelegationAuthSig(
4040
}
4141
): Promise<AuthSig> {
4242
_logger.info(
43-
'generateEoaDelegationAuthSig: Starting EOA delegation signature generation',
4443
{
4544
hasAccount: !!params.account,
4645
hasSessionKeyPair: !!params.sessionKeyPair,
47-
}
46+
},
47+
'generateEoaDelegationAuthSig: Starting EOA delegation signature generation'
4848
);
4949

5050
const _resources = processResources(params.authConfig.resources);
@@ -99,10 +99,10 @@ export async function generateEoaDelegationAuthSig(
9999
const delegationAuthSig = await authContext.authNeededCallback();
100100

101101
_logger.info(
102-
'generateEoaDelegationAuthSig: EOA delegation signature generated successfully',
103102
{
104103
hasSignature: !!delegationAuthSig,
105-
}
104+
},
105+
'generateEoaDelegationAuthSig: EOA delegation signature generated successfully'
106106
);
107107

108108
return delegationAuthSig as AuthSig;

‎packages/auth/src/lib/AuthManager/authAdapters/generatePkpDelegationAuthSig.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,11 @@ export async function generatePkpDelegationAuthSig(
4141
}
4242
): Promise<AuthSig> {
4343
_logger.info(
44-
'generatePkpDelegationAuthSig: Starting PKP delegation signature generation',
4544
{
4645
pkpPublicKey: params.pkpPublicKey,
4746
hasSessionKeyPair: !!params.sessionKeyPair,
48-
}
47+
},
48+
'generatePkpDelegationAuthSig: Starting PKP delegation signature generation'
4949
);
5050

5151
const _resources = processResources(params.authConfig.resources);
@@ -112,11 +112,11 @@ export async function generatePkpDelegationAuthSig(
112112
const delegationAuthSig = await authContext.authNeededCallback();
113113

114114
_logger.info(
115-
'generatePkpDelegationAuthSig: PKP delegation signature generated successfully',
116115
{
117116
pkpAddress,
118117
hasSignature: !!delegationAuthSig,
119-
}
118+
},
119+
'generatePkpDelegationAuthSig: PKP delegation signature generated successfully'
120120
);
121121

122122
return delegationAuthSig;

‎packages/auth/src/lib/AuthManager/authAdapters/getPkpAuthContextAdapter.ts‎

Lines changed: 9 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,14 @@ import {
66
NodeUrlsSchema,
77
SessionKeyUriSchema,
88
} from '@lit-protocol/schemas';
9-
import {
10-
AuthSig,
11-
LitResourceAbilityRequest,
12-
SessionKeyPair,
13-
} from '@lit-protocol/types';
9+
import { AuthSig, SessionKeyPair } from '@lit-protocol/types';
1410
import { ethers } from 'ethers';
1511
import { z } from 'zod';
1612
import { AuthConfigV2 } from '../../authenticators/types';
1713
import { AuthManagerParams } from '../auth-manager';
1814
import { getPkpAuthContext } from '../authContexts/getPkpAuthContext';
1915
import { processResources } from '../utils/processResources';
16+
import { validateDelegationAuthSig } from '../utils/validateDelegationAuthSig';
2017
import { tryGetCachedAuthData } from '../try-getters/tryGetCachedAuthData';
2118

2219
const _logger = getChildLogger({
@@ -30,54 +27,6 @@ export const PkpAuthDepsSchema = z.object({
3027
nodeUrls: NodeUrlsSchema,
3128
});
3229

33-
/**
34-
* Validates that the provided delegation auth sig hasn't expired and contains required resources
35-
*/
36-
function validateDelegationAuthSig(
37-
delegationAuthSig: AuthSig,
38-
requiredResources: LitResourceAbilityRequest[],
39-
sessionKeyUri: string
40-
): void {
41-
try {
42-
// Parse the signed message to extract expiration and validate session key match
43-
const siweMessage = delegationAuthSig.signedMessage;
44-
45-
// Check expiration
46-
const expirationMatch = siweMessage.match(/^Expiration Time: (.*)$/m);
47-
if (expirationMatch && expirationMatch[1]) {
48-
const expiration = new Date(expirationMatch[1].trim());
49-
if (expiration.getTime() <= Date.now()) {
50-
throw new Error(
51-
`Delegation signature has expired at ${expiration.toISOString()}`
52-
);
53-
}
54-
}
55-
56-
// Validate session key URI matches
57-
if (!siweMessage.includes(sessionKeyUri)) {
58-
throw new Error(
59-
'Session key URI in delegation signature does not match provided session key pair'
60-
);
61-
}
62-
63-
// TODO: Add resource validation - check if delegationAuthSig has required resources
64-
// This would involve parsing the RECAP URN and checking against requiredResources
65-
_logger.debug(
66-
'validateDelegationAuthSig: Delegation signature validated successfully',
67-
{
68-
sessionKeyUri,
69-
hasResources: requiredResources.length > 0,
70-
}
71-
);
72-
} catch (error) {
73-
throw new Error(
74-
`Invalid delegation signature: ${
75-
error instanceof Error ? error.message : 'Unknown error'
76-
}`
77-
);
78-
}
79-
}
80-
8130
export async function getPkpAuthContextAdapter(
8231
upstreamParams: AuthManagerParams,
8332
params: {
@@ -110,11 +59,11 @@ export async function getPkpAuthContextAdapter(
11059
// If pre-generated auth materials are provided, validate and use them
11160
if (params.sessionKeyPair && params.delegationAuthSig) {
11261
_logger.info(
113-
'getPkpAuthContextAdapter: Using pre-generated session materials',
11462
{
11563
hasSessionKeyPair: true,
11664
hasDelegationAuthSig: true,
117-
}
65+
},
66+
'getPkpAuthContextAdapter: Using pre-generated session materials'
11867
);
11968

12069
// Generate sessionKeyUri from the public key
@@ -123,11 +72,11 @@ export async function getPkpAuthContextAdapter(
12372
);
12473

12574
// Validate the delegation signature
126-
validateDelegationAuthSig(
127-
params.delegationAuthSig,
128-
_resources,
129-
sessionKeyUri
130-
);
75+
validateDelegationAuthSig({
76+
delegationAuthSig: params.delegationAuthSig,
77+
requiredResources: _resources,
78+
sessionKeyUri,
79+
});
13180

13281
// Return auth context using provided materials
13382
return {

‎packages/auth/src/lib/AuthManager/authAdapters/getPkpAuthContextFromPreGeneratedAdapter.ts‎

Lines changed: 8 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import { z } from 'zod';
99
import { AuthData } from '@lit-protocol/schemas';
1010
import { AuthManagerParams } from '../auth-manager';
1111
import { processResources } from '../utils/processResources';
12+
import { validateDelegationAuthSig } from '../utils/validateDelegationAuthSig';
1213

1314
const _logger = getChildLogger({
1415
module: 'getPkpAuthContextFromPreGeneratedAdapter',
@@ -46,54 +47,6 @@ function extractAuthConfigFromDelegationAuthSig(delegationAuthSig: AuthSig): {
4647
return { domain, statement, expiration, resources };
4748
}
4849

49-
/**
50-
* Validates that the provided delegation auth sig hasn't expired and contains required resources
51-
*/
52-
function validateDelegationAuthSig(
53-
delegationAuthSig: AuthSig,
54-
requiredResources: LitResourceAbilityRequest[],
55-
sessionKeyUri: string
56-
): void {
57-
try {
58-
// Parse the signed message to extract expiration and validate session key match
59-
const siweMessage = delegationAuthSig.signedMessage;
60-
61-
// Check expiration
62-
const expirationMatch = siweMessage.match(/^Expiration Time: (.*)$/m);
63-
if (expirationMatch && expirationMatch[1]) {
64-
const expiration = new Date(expirationMatch[1].trim());
65-
if (expiration.getTime() <= Date.now()) {
66-
throw new Error(
67-
`Delegation signature has expired at ${expiration.toISOString()}`
68-
);
69-
}
70-
}
71-
72-
// Validate session key URI matches
73-
if (!siweMessage.includes(sessionKeyUri)) {
74-
throw new Error(
75-
'Session key URI in delegation signature does not match provided session key pair'
76-
);
77-
}
78-
79-
// TODO: Add resource validation - check if delegationAuthSig has required resources
80-
// This would involve parsing the RECAP URN and checking against requiredResources
81-
_logger.debug(
82-
'validateDelegationAuthSig: Delegation signature validated successfully',
83-
{
84-
sessionKeyUri,
85-
hasResources: requiredResources.length > 0,
86-
}
87-
);
88-
} catch (error) {
89-
throw new Error(
90-
`Invalid delegation signature: ${
91-
error instanceof Error ? error.message : 'Unknown error'
92-
}`
93-
);
94-
}
95-
}
96-
9750
/**
9851
* Creates a PKP auth context from pre-generated session materials.
9952
* This is a streamlined API for server-side scenarios where session materials
@@ -109,13 +62,13 @@ export async function getPkpAuthContextFromPreGeneratedAdapter(
10962
}
11063
) {
11164
_logger.info(
112-
'getPkpAuthContextFromPreGeneratedAdapter: Creating PKP auth context from pre-generated materials',
11365
{
11466
pkpPublicKey: params.pkpPublicKey,
11567
hasSessionKeyPair: !!params.sessionKeyPair,
11668
hasDelegationAuthSig: !!params.delegationAuthSig,
11769
hasAuthData: !!params.authData,
118-
}
70+
},
71+
'getPkpAuthContextFromPreGeneratedAdapter: Creating PKP auth context from pre-generated materials'
11972
);
12073

12174
// Extract auth config from delegation signature
@@ -141,11 +94,11 @@ export async function getPkpAuthContextFromPreGeneratedAdapter(
14194
);
14295

14396
// Validate the delegation signature
144-
validateDelegationAuthSig(
145-
params.delegationAuthSig,
146-
authConfig.resources,
147-
sessionKeyUri
148-
);
97+
validateDelegationAuthSig({
98+
delegationAuthSig: params.delegationAuthSig,
99+
requiredResources: authConfig.resources,
100+
sessionKeyUri,
101+
});
149102

150103
// Return auth context using pre-generated materials
151104
return {

0 commit comments

Comments
 (0)