-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #331 from pendulum-chain/326-fix-wrong-use-of-evm-…
…account-address-for-assethub-offramp-b Add SIWE signing support for Substrate wallets.
- Loading branch information
Showing
18 changed files
with
350 additions
and
207 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| const { keccak256 } = require('viem/utils'); | ||
| const { Keyring } = require('@polkadot/api'); | ||
|
|
||
| // Returns the hash value for the address. If it's a polkadot address, it will return raw data of the address. | ||
| function getHashValueForAddress(address) { | ||
| if (address.startsWith('0x')) { | ||
| return address; | ||
| } else { | ||
| const keyring = new Keyring({ type: 'sr25519' }); | ||
| return keyring.decodeAddress(address); | ||
| } | ||
| } | ||
|
|
||
| //A memo derivation. | ||
| async function deriveMemoFromAddress(address) { | ||
| const hashValue = getHashValueForAddress(address); | ||
| const hash = keccak256(hashValue); | ||
| return BigInt(hash).toString().slice(0, 15); | ||
| } | ||
|
|
||
| module.exports = { deriveMemoFromAddress }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| class SignInMessage { | ||
| // fixed statement string | ||
| static LOGIN_MESSAGE = ' wants you to sign in with your account: '; | ||
|
|
||
| constructor(fields) { | ||
| this.scheme = fields.scheme; | ||
| this.domain = fields.domain; | ||
| this.address = fields.address; | ||
| this.nonce = fields.nonce; | ||
| this.expirationTime = new Date(fields.expirationTime).toISOString(); | ||
| this.issuedAt = fields.issuedAt ? new Date(fields.issuedAt).toISOString() : new Date().toISOString(); | ||
| } | ||
|
|
||
| toMessage() { | ||
| const header = `${this.domain}${SignInMessage.LOGIN_MESSAGE}${this.address}`; | ||
|
|
||
| const body = `\nNonce: ${this.nonce}\nIssued At: ${this.issuedAt}\nExpiration Time: ${this.expirationTime}`; | ||
|
|
||
| return `${header}\n\n${body}`; | ||
| } | ||
|
|
||
| static fromMessage(message) { | ||
| const lines = message | ||
| .split('\n') | ||
| .map((l) => l.trim()) | ||
| .filter((l) => l.length > 0); | ||
|
|
||
| const headerLine = lines.find((line) => line.includes(SignInMessage.LOGIN_MESSAGE)) || ''; | ||
| const [domain, address] = headerLine.split(SignInMessage.LOGIN_MESSAGE).map((part) => part.trim()); | ||
|
|
||
| const nonceLine = lines.find((line) => line.startsWith('Nonce:')) || ''; | ||
| const nonce = nonceLine.split('Nonce:')[1]?.trim() || ''; | ||
|
|
||
| const issuedAtLine = lines.find((line) => line.startsWith('Issued At:')) || ''; | ||
| const issuedAt = issuedAtLine.split('Issued At:')[1]?.trim(); // Can't really be empty. Constructor will default to current date if not defined. | ||
| const issuedAtMilis = new Date(issuedAt).getTime(); | ||
|
|
||
| const expirationTimeLine = lines.find((line) => line.startsWith('Expiration Time:')) || ''; | ||
| const expirationTime = expirationTimeLine.split('Expiration Time:')[1]?.trim(); | ||
| const expirationTimeMilis = new Date(expirationTime).getTime(); | ||
|
|
||
| return new SignInMessage({ | ||
| scheme: 'https', | ||
| domain, | ||
| address, | ||
| nonce, | ||
| expirationTime: expirationTimeMilis, | ||
| issuedAt: issuedAtMilis, | ||
| }); | ||
| } | ||
| } | ||
|
|
||
| module.exports = { SignInMessage }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| const { validateSignatureAndGetMemo } = require('../services/siwe.service'); | ||
|
|
||
| const getMemoFromCookiesMiddleware = async (req, res, next) => { | ||
| // If the client didn't specify, we don't want to pass a derived memo even if a cookie was sent. | ||
|
|
||
| req.derivedMemo = null; // Explicit overwrite to avoid tampering, defensive. | ||
| if (!Boolean(req.body.usesMemo)) { | ||
| return next(); | ||
| } | ||
| try { | ||
| const cookies = req.cookies; | ||
| const address = req.body.address; | ||
| // Default memo (represents no memo usage at all) | ||
| let resultMemo = null; | ||
|
|
||
| for (const authToken in cookies) { | ||
| if (!authToken.startsWith('authToken_')) { | ||
| continue; | ||
| } | ||
|
|
||
| //check if matches the address requested by client, otherwise ignore cookie. | ||
| if (!authToken.includes(address)) { | ||
| continue; | ||
| } | ||
|
|
||
| try { | ||
| const token = cookies[authToken]; | ||
| const signature = token.signature; | ||
| const nonce = token.nonce; | ||
|
|
||
| if (!signature || !nonce) { | ||
| continue; | ||
| } | ||
|
|
||
| const memo = await validateSignatureAndGetMemo(nonce, signature); | ||
| console.log(memo); | ||
|
|
||
| // First found first used | ||
| if (memo) { | ||
| resultMemo = memo; | ||
| break; | ||
| } | ||
| } catch (e) { | ||
| continue; | ||
| } | ||
| } | ||
|
|
||
| // Client declared usage of memo, but it could not be derived from provided signatures. | ||
| if (Boolean(req.body.usesMemo) && !resultMemo) { | ||
| return res.status(401).json({ | ||
| error: 'Missing or invalid authentication token', | ||
| }); | ||
| } | ||
|
|
||
| req.derivedMemo = resultMemo; | ||
|
|
||
| next(); | ||
| } catch (err) { | ||
| if (err.message.includes('Could not verify signature')) { | ||
| // Distinguish between failed signature check and other errors. | ||
| return res.status(401).json({ | ||
| error: 'Signature validation failed.', | ||
| details: err.message, | ||
| }); | ||
| } | ||
| console.error(`Error in getMemoFromCookiesMiddleware: ${err.message}`); | ||
|
|
||
| return res.status(500).json({ | ||
| error: 'Error while verifying signature', | ||
| details: err.message, | ||
| }); | ||
| } | ||
| }; | ||
|
|
||
| module.exports = { | ||
| getMemoFromCookiesMiddleware, | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.