feat: add signature request queue processing

Without this patch we're missing a way for the API to execute the
signature requests and commit the data to record if the signature
threshold is met.

This patch adds the request POST /signature-requests/process which reads
all **pending** signature requests from the data DB, checks if the
confirmations meet the signature threshold and if so writes the attached
username and avatar changes to the users table.

To stay within the rate limit of 5 requests per second required by the
Safe API I implemented a rate limited queue and worker that process them
concurrently.

The request doesn't require authentication, so it could be invoked by a
CRON job, as well as the user when they log in or specifically request
an update.

Author: pheuberger

package.json

@@ -32,6 +32,7 @@
     "@ipld/car": "^5.2.5",
     "@openzeppelin/merkle-tree": "^1.0.5",
     "@safe-global/api-kit": "^2.5.4",
+    "@safe-global/protocol-kit": "^5.0.4",
     "@sentry/integrations": "^7.114.0",
     "@sentry/node": "^8.2.1",
     "@sentry/profiling-node": "^8.2.1",

pnpm-lock.yaml

@@ -0,0 +1,30 @@
+import { Database } from "../types/supabaseData.js";
+import { ISafeApiCommand } from "../types/safe-signatures.js";
+
+import { UserUpsertCommand } from "./UserUpsertCommand.js";
+import { SafeApiCommand } from "./SafeApiCommand.js";
+
+type SignatureRequest =
+  Database["public"]["Tables"]["signature_requests"]["Row"];
+
+export function getCommand(request: SignatureRequest): ISafeApiCommand {
+  switch (request.purpose) {
+    case "update_user_data":
+      return new UserUpsertCommand(
+        request.safe_address,
+        request.message_hash,
+        request.chain_id,
+      );
+    default:
+      console.warn("Unrecognized purpose:", request.purpose);
+      return new NoopCommand();
+  }
+}
+
+class NoopCommand extends SafeApiCommand implements ISafeApiCommand {
+  constructor() {
+    super("", "", 0);
+  }
+
+  async execute(): Promise<void> {}
+}

src/__generated__/routes/routes.ts

@@ -0,0 +1,26 @@
+import SafeApiKit from "@safe-global/api-kit";
+
+import { SupabaseDataService } from "../services/SupabaseDataService.js";
+import { ISafeApiCommand } from "../types/safe-signatures.js";
+
+export abstract class SafeApiCommand implements ISafeApiCommand {
+  protected readonly safeAddress: string;
+  protected readonly messageHash: string;
+  protected readonly chainId: number;
+  protected readonly dataService: SupabaseDataService;
+  protected readonly safeApiKit: SafeApiKit.default;
+
+  constructor(safeAddress: string, messageHash: string, chainId: number) {
+    this.safeAddress = safeAddress;
+    this.messageHash = messageHash;
+    this.chainId = chainId;
+    this.dataService = new SupabaseDataService();
+    this.safeApiKit = new SafeApiKit.default({ chainId: BigInt(chainId) });
+  }
+
+  abstract execute(): Promise<void>;
+
+  getId(): string {
+    return `${this.chainId}-${this.safeAddress}-${this.messageHash}`;
+  }
+}

src/__generated__/swagger.json

@@ -0,0 +1,77 @@
+import { getAddress } from "viem";
+
+import {
+  MultisigUserUpdateMessage,
+  USER_UPDATE_MESSAGE_SCHEMA,
+} from "../lib/users/schemas.js";
+import { isTypedMessage } from "../utils/signatures.js";
+import UserUpsertSignatureVerifier from "../lib/safe-signature-verification/UserUpsertSignatureVerifier.js";
+import { Database } from "../types/supabaseData.js";
+
+import { SafeApiCommand } from "./SafeApiCommand.js";
+
+type SignatureRequest =
+  Database["public"]["Tables"]["signature_requests"]["Row"];
+
+export class UserUpsertCommand extends SafeApiCommand {
+  async execute(): Promise<void> {
+    const signatureRequest = await this.dataService.getSignatureRequest(
+      this.safeAddress,
+      this.messageHash,
+    );
+
+    if (!signatureRequest || signatureRequest.status !== "pending") {
+      return;
+    }
+
+    const safeMessage = await this.safeApiKit.getMessage(this.messageHash);
+
+    if (!isTypedMessage(safeMessage.message)) {
+      throw new Error("Unexpected message type: not EIP712TypedData");
+    }
+
+    const message = USER_UPDATE_MESSAGE_SCHEMA.safeParse(
+      safeMessage.message.message,
+    );
+    if (!message.success) {
+      console.error("Unexpected message format", message.error);
+      throw new Error("Unexpected message format");
+    }
+
+    const verifier = new UserUpsertSignatureVerifier(
+      Number(signatureRequest.chain_id),
+      getAddress(this.safeAddress),
+      message.data,
+    );
+
+    if (!(await verifier.verify(safeMessage.preparedSignature))) {
+      console.error(`Signature verification failed: ${this.getId()}`);
+      return;
+    }
+
+    await this.updateDatabase(signatureRequest, message.data);
+    console.log(`Signature request executed: ${this.getId()}`);
+  }
+
+  async updateDatabase(
+    signatureRequest: Exclude<SignatureRequest, undefined>,
+    message: MultisigUserUpdateMessage,
+  ): Promise<void> {
+    const users = await this.dataService.upsertUsers([
+      {
+        address: this.safeAddress,
+        chain_id: signatureRequest.chain_id,
+        display_name: message.user.displayName,
+        avatar: message.user.avatar,
+      },
+    ]);
+    if (!users.length) {
+      throw new Error("Error adding or updating user");
+    }
+    await this.dataService.updateSignatureRequestStatus(
+      this.safeAddress,
+      this.messageHash,
+      "executed",
+    );
+  }
+}

src/commands/CommandFactory.ts

@@ -11,6 +11,7 @@ import {
 
 import { SupabaseDataService } from "../services/SupabaseDataService.js";
 import { verifyAuthSignedData } from "../utils/verifyAuthSignedData.js";
+import { SignatureRequestProcessor } from "../services/SignatureRequestProcessor.js";
 
 interface CancelSignatureRequest {
   signature: string;
@@ -75,6 +76,25 @@ export class SignatureRequestController extends Controller {
     }
   }
 
+  @Post("process")
+  @SuccessResponse(200, "Signature requests processing started")
+  public async processSignatureRequests(): Promise<{
+    success: boolean;
+    message: string;
+  }> {
+    try {
+      const processor = SignatureRequestProcessor.getInstance();
+      console.log("Processing pending requests");
+      await processor.processPendingRequests();
+      return this.successResponse("Signature requests processing started");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      return this.errorResponse(
+        `Failed to process signature requests: ${message}`,
+      );
+    }
+  }
+
   async isValidSignature(
     safeAddress: string,
     messageHash: string,

src/commands/SafeApiCommand.ts

@@ -0,0 +1,47 @@
+import { getAddress, hashTypedData, type HashTypedDataParameters } from "viem";
+import Safe from "@safe-global/protocol-kit";
+
+import { getRpcUrl } from "../../utils/getRpcUrl.js";
+
+export default abstract class SafeSignatureVerifier {
+  protected chainId: number;
+  protected safeAddress: `0x${string}`;
+  protected rpcUrl: string;
+
+  constructor(chainId: number, safeAddress: `0x${string}`) {
+    const rpcUrl = getRpcUrl(chainId);
+
+    if (!rpcUrl) {
+      throw new Error(`Unsupported chain ID: ${chainId}`);
+    }
+    this.chainId = chainId;
+    this.safeAddress = getAddress(safeAddress);
+    this.rpcUrl = rpcUrl;
+  }
+
+  hashTypedData() {
+    const parameters = this.buildTypedData();
+
+    return hashTypedData({
+      domain: {
+        name: "Hypercerts",
+        version: "1",
+        chainId: this.chainId,
+        verifyingContract: this.safeAddress,
+      },
+      ...parameters,
+    });
+  }
+
+  abstract buildTypedData(): Omit<HashTypedDataParameters, "domain">;
+
+  async verify(signature: string): Promise<boolean> {
+    const safe = await Safe.default.init({
+      provider: this.rpcUrl,
+      safeAddress: this.safeAddress,
+    });
+
+    const protocolKit = await safe.connect({});
+    return protocolKit.isValidSignature(this.hashTypedData(), signature);
+  }
+}

src/commands/UserUpsertCommand.ts

@@ -0,0 +1,34 @@
+import { MultisigUserUpdateMessage } from "../users/schemas.js";
+
+import SafeSignatureVerifier from "./SafeSignatureVerifier.js";
+
+export default class UserUpsertSignatureVerifier extends SafeSignatureVerifier {
+  private message: MultisigUserUpdateMessage;
+
+  constructor(
+    chainId: number,
+    safeAddress: `0x${string}`,
+    message: MultisigUserUpdateMessage,
+  ) {
+    super(chainId, safeAddress);
+    this.message = message;
+  }
+
+  buildTypedData() {
+    return {
+      types: {
+        Metadata: [{ name: "timestamp", type: "uint256" }],
+        User: [
+          { name: "displayName", type: "string" },
+          { name: "avatar", type: "string" },
+        ],
+        UserUpdateRequest: [
+          { name: "metadata", type: "Metadata" },
+          { name: "user", type: "User" },
+        ],
+      },
+      primaryType: "UserUpdateRequest",
+      message: this.message,
+    };
+  }
+}