Consolidating frames code

.github/workflows/ci.yml

@@ -20,6 +20,7 @@ jobs:
             'export-and-sign',
             'oauth-origin',
             'oauth-redirect',
+            'shared',
           ]
 
     steps:
@@ -31,6 +32,13 @@ jobs:
         with:
           node-version: 20
 
+      # Some frames (like import/export-and-sign) depend on code in ./shared.
+      # Ensure shared's dependencies (including bech32) are installed before running their tests.
+      - name: Install Dependencies for shared (for dependent frames)
+        if: ${{ matrix.directory == 'import' || matrix.directory == 'export-and-sign' }}
+        working-directory: ./shared
+        run: npm install
+
       - name: Install Dependencies for ${{ matrix.directory }}
         working-directory: ./${{ matrix.directory }}
         run: npm install
@@ -56,6 +64,7 @@ jobs:
             'export-and-sign',
             'oauth-origin',
             'oauth-redirect',
+            'shared',
           ]
 
     steps:
@@ -88,6 +97,7 @@ jobs:
             'export-and-sign',
             'oauth-origin',
             'oauth-redirect',
+            'shared',
           ]
 
     steps:
@@ -127,6 +137,10 @@ jobs:
         with:
           node-version: 20
 
+      - name: Install Dependencies for shared
+        working-directory: ./shared
+        run: npm install
+
       - name: Install Dependencies for ${{ matrix.directory }}
         working-directory: ./${{ matrix.directory }}
         run: npm install

Dockerfile

@@ -3,6 +3,10 @@ FROM node:18-bullseye-slim AS builder
 
 WORKDIR /app
 
+# Copy shared directory first (needed by export-and-sign and import)
+COPY shared ./shared/
+RUN cd shared && npm ci
+
 # Copy export-and-sign module and build
 COPY export-and-sign ./export-and-sign/
 RUN cd export-and-sign && npm ci && npm run build

README.md

@@ -37,6 +37,18 @@ This self-contained HTML page processes OAuth callbacks from identity providers
 
 This page is hosted at https://oauth-redirect.turnkey.com/
 
+# Subfolders and build status
+
+| Subfolder        | Build in Docker | Notes |
+|------------------|-----------------|--------|
+| `shared`         | No              | Dependencies only (`npm ci`). Consumed by `export-and-sign` and `import`. |
+| `auth`           | No              | Static files, copied as-is. Also served at `/recovery` for compatibility. |
+| `export`         | No              | Static files, copied as-is. |
+| `export-and-sign`| Yes             | Webpack build; output in `dist/`. |
+| `import`         | Yes             | Webpack build; output in `dist/`. |
+| `oauth-origin`   | No              | Static files, copied as-is. |
+| `oauth-redirect` | No              | Static files, copied as-is. |
+
 # Getting Started
 
 Clone the repo:

export-and-sign/dist/bundle.a4914ea66ee78b95f2e4.js.LICENSE.txt → export-and-sign/dist/bundle.921b01a774677f8e2da8.js.LICENSE.txt

@@ -79,21 +79,6 @@ See the Apache Version 2.0 License for specific language governing permissions
 and limitations under the License.
 ***************************************************************************** */
 
-/*! *****************************************************************************
-Copyright (c) Microsoft Corporation.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THIS SOFTWARE.
-***************************************************************************** */
-
 /*! ieee754. BSD-3-Clause License. Feross Aboukhadijeh <https://feross.org/opensource> */
 
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */

export-and-sign/dist/index.html

@@ -1 +1 @@
-<!doctype html><html class="no-js"><head><link rel="icon" type="image/svg+xml" href="./favicon.svg"/><meta charset="utf-8"/><title>Turnkey Export</title><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="turnkey-signer-environment" content="__TURNKEY_SIGNER_ENVIRONMENT__"/><meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; object-src 'none'; form-action 'none'"><link href="/styles.e084a69a94c0575bc6ba.css" rel="stylesheet" integrity="sha384-uIrxQTbBoDAwjgotQ+GUHgbxFM2iajB5QKNa4WuL9wn/Ou+2383e3dM2FCWOAq9m" crossorigin="anonymous"></head><body><h2>Export Key Material</h2><p><em>This public key will be sent along with a private key ID or wallet ID inside of a new <code>EXPORT_PRIVATE_KEY</code> or <code>EXPORT_WALLET</code> activity</em></p><form><label>Embedded key</label> <input name="embedded-key" id="embedded-key" disabled="disabled"/> <button id="reset">Reset Key</button></form><br/><br/><br/><h2>Inject Key Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="key-export-bundle" id="key-export-bundle"/> <button id="inject-key">Inject Bundle</button><br/><label>Key Format</label> <select id="key-export-format" name="key-export-format"><option value="HEXADECIMAL">Hexadecimal (Default)</option><option value="SOLANA">Solana</option></select><br/><label>Organization Id</label> <input name="key-organization-id" id="key-organization-id"/></form><br/><br/><h2>Inject Wallet Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="wallet-export-bundle" id="wallet-export-bundle"/> <button id="inject-wallet">Inject Bundle</button><br/><label>Organization Id</label> <input name="wallet-organization-id" id="wallet-organization-id"/></form><br/><br/><h2>Sign Transaction</h2><p><em>Input a serialized transaction to sign.</em></p><form><label>Transaction</label> <input name="transaction-to-sign" id="transaction-to-sign"/> <button id="sign-transaction">Sign</button></form><br/><br/><h2>Sign Message</h2><p><em>Input a serialized message to sign.</em></p><form><label>Message</label> <input name="message-to-sign" id="message-to-sign"/> <button id="sign-message">Sign</button></form><br/><br/><h2>Message log</h2><p><em>Below we display a log of the messages sent / received. The forms above send messages, and the code communicates results by sending events via the <code>postMessage</code> API.</em></p><div id="message-log"></div><div id="key-div"></div><script defer="defer" src="/bundle.a4914ea66ee78b95f2e4.js" integrity="sha384-m+x1rhXXvkLoGv9xomRsrJbUk7MLDp/73HeX5mp9nUtuVwRJr/fqj2i0+cgwS8tY" crossorigin="anonymous"></script><script defer="defer" src="/bundle.38a42ea04bc431371fe4.js" integrity="sha384-JqjL1e4hr89AdN1ACVdHOtizN0IiYS+A08WFjfL3vdQdIZWSfZJnqaIo7otR1vQd" crossorigin="anonymous"></script></body></html>
+<!doctype html><html class="no-js"><head><link rel="icon" type="image/svg+xml" href="./favicon.svg"/><meta charset="utf-8"/><title>Turnkey Export</title><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="turnkey-signer-environment" content="__TURNKEY_SIGNER_ENVIRONMENT__"/><meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; object-src 'none'; form-action 'none'"><link href="/styles.e084a69a94c0575bc6ba.css" rel="stylesheet" integrity="sha384-uIrxQTbBoDAwjgotQ+GUHgbxFM2iajB5QKNa4WuL9wn/Ou+2383e3dM2FCWOAq9m" crossorigin="anonymous"></head><body><h2>Export Key Material</h2><p><em>This public key will be sent along with a private key ID or wallet ID inside of a new <code>EXPORT_PRIVATE_KEY</code> or <code>EXPORT_WALLET</code> activity</em></p><form><label>Embedded key</label> <input name="embedded-key" id="embedded-key" disabled="disabled"/> <button id="reset">Reset Key</button></form><br/><br/><br/><h2>Inject Key Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="key-export-bundle" id="key-export-bundle"/> <button id="inject-key">Inject Bundle</button><br/><label>Key Format</label> <select id="key-export-format" name="key-export-format"><option value="HEXADECIMAL">Hexadecimal (Default)</option><option value="SOLANA">Solana</option></select><br/><label>Organization Id</label> <input name="key-organization-id" id="key-organization-id"/></form><br/><br/><h2>Inject Wallet Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="wallet-export-bundle" id="wallet-export-bundle"/> <button id="inject-wallet">Inject Bundle</button><br/><label>Organization Id</label> <input name="wallet-organization-id" id="wallet-organization-id"/></form><br/><br/><h2>Sign Transaction</h2><p><em>Input a serialized transaction to sign.</em></p><form><label>Transaction</label> <input name="transaction-to-sign" id="transaction-to-sign"/> <button id="sign-transaction">Sign</button></form><br/><br/><h2>Sign Message</h2><p><em>Input a serialized message to sign.</em></p><form><label>Message</label> <input name="message-to-sign" id="message-to-sign"/> <button id="sign-message">Sign</button></form><br/><br/><h2>Message log</h2><p><em>Below we display a log of the messages sent / received. The forms above send messages, and the code communicates results by sending events via the <code>postMessage</code> API.</em></p><div id="message-log"></div><div id="key-div"></div><script defer="defer" src="/bundle.921b01a774677f8e2da8.js" integrity="sha384-P/yUGeA+YjATjB94JS/FcpAKrqBRW/oFjpTPQJAEZMy2zDCV+2mfOqsTbuxZkCcy" crossorigin="anonymous"></script><script defer="defer" src="/bundle.2ddbc9eacea08f1f698a.js" integrity="sha384-4W+bjItMNn3ZCQ3Z3NCMibWcCV0Nh645/TwMaRfW+huAfSjdL8KEipAgMQqxpIeZ" crossorigin="anonymous"></script></body></html>

export-and-sign/jest.config.js

@@ -1,6 +1,11 @@
+const path = require("path");
+
 module.exports = {
   clearMocks: true,
   setupFilesAfterEnv: ["regenerator-runtime/runtime"],
   testPathIgnorePatterns: ["/node_modules/"],
   transformIgnorePatterns: ["node_modules/(?!(@noble|@hpke)/)"],
+  moduleNameMapper: {
+    "^@shared/(.*)$": path.resolve(__dirname, "../shared/$1"),
+  },
 };

export-and-sign/package.json

@@ -18,8 +18,9 @@
   "license": "MIT",
   "dependencies": {
     "@hpke/core": "1.7.5",
+    "bech32": "2.0.0",
     "@noble/ed25519": "2.0.0",
-    "@noble/hashes": "1.3.2",
+    "@noble/hashes": "1.8.0",
     "@solana/web3.js": "1.98.4",
     "@turnkey/crypto": "2.8.6"
   },
@@ -50,6 +51,7 @@
     "@hpke/common": "1.8.1",
     "@noble/ciphers": "1.3.0",
     "@noble/curves": "1.9.7",
+    "@noble/hashes": "1.8.0",
     "@peculiar/x509": "1.12.3",
     "@solana/buffer-layout": "4.0.1",
     "@solana/codecs-numbers": "2.3.0",

export-and-sign/src/index.js

@@ -3,7 +3,7 @@
 // Import relevant modules
 import { TKHQ } from "./turnkey-core.js";
 import { initEventHandlers } from "./event-handlers.js";
-import { HpkeDecrypt } from "./crypto-utils.js";
+import { HpkeDecrypt } from "@shared/crypto-utils.js";
 import "./styles.css";
 
 // Surface TKHQ for external access