feat(evm): add grant management for EVM wallets

useragent/lib/features/connection/auth.dart

@@ -0,0 +1,103 @@
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:arbiter/features/connection/connection.dart';
+import 'package:arbiter/features/connection/server_info_storage.dart';
+import 'package:arbiter/features/identity/pk_manager.dart';
+import 'package:arbiter/proto/arbiter.pbgrpc.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:grpc/grpc.dart';
+import 'package:mtcore/markettakers.dart';
+
+Future<Connection> connectAndAuthorize(
+  StoredServerInfo serverInfo,
+  KeyHandle key, {
+  String? bootstrapToken,
+}) async {
+  try {
+    final connection = await _connect(serverInfo);
+    talker.info(
+      'Connected to server at ${serverInfo.address}:${serverInfo.port}',
+    );
+    final pubkey = await key.getPublicKey();
+
+    final req = AuthChallengeRequest(
+      pubkey: pubkey,
+      bootstrapToken: bootstrapToken,
+      keyType: switch (key.alg) {
+        KeyAlgorithm.rsa => KeyType.KEY_TYPE_RSA,
+        KeyAlgorithm.ecdsa => KeyType.KEY_TYPE_ECDSA_SECP256K1,
+        KeyAlgorithm.ed25519 => KeyType.KEY_TYPE_ED25519,
+      },
+    );
+    await connection.send(UserAgentRequest(authChallengeRequest: req));
+    talker.info(
+      "Sent auth challenge request with pubkey ${base64Encode(pubkey)}",
+    );
+
+    final response = await connection.receive();
+    talker.info('Received response from server, checking auth flow...');
+
+    if (response.hasAuthOk()) {
+      talker.info('Authentication successful, connection established');
+      return connection;
+    }
+
+    if (!response.hasAuthChallenge()) {
+      throw Exception(
+        'Expected AuthChallengeResponse, got ${response.whichPayload()}',
+      );
+    }
+
+    final challenge = _formatChallenge(response.authChallenge, pubkey);
+    talker.info(
+      'Received auth challenge, signing with key ${base64Encode(pubkey)}',
+    );
+
+    final signature = await key.sign(challenge);
+    await connection.send(
+      UserAgentRequest(authChallengeSolution: AuthChallengeSolution(signature: signature)),
+    );
+
+    talker.info('Sent auth challenge solution, waiting for server response...');
+
+    final solutionResponse = await connection.receive();
+    if (!solutionResponse.hasAuthOk()) {
+      throw Exception(
+        'Expected AuthChallengeSolutionResponse, got ${solutionResponse.whichPayload()}',
+      );
+    }
+
+    talker.info('Authentication successful, connection established');
+    return connection;
+  } catch (e) {
+    throw Exception('Failed to connect to server: $e');
+  }
+}
+
+Future<Connection> _connect(StoredServerInfo serverInfo) async {
+  final channel = ClientChannel(
+    serverInfo.address,
+    port: serverInfo.port,
+    options: ChannelOptions(
+      connectTimeout: const Duration(seconds: 10),
+      credentials: ChannelCredentials.secure(
+        onBadCertificate: (cert, host) {
+          return true;
+        },
+      ),
+    ),
+  );
+
+  final client = ArbiterServiceClient(channel);
+  final tx = StreamController<UserAgentRequest>();
+  final rx = client.userAgent(tx.stream);
+
+  return Connection(channel: channel, tx: tx, rx: rx);
+}
+
+List<int> _formatChallenge(AuthChallenge challenge, List<int> pubkey) {
+  final encodedPubkey = base64Encode(pubkey);
+  final payload = "${challenge.nonce}:$encodedPubkey";
+  return utf8.encode(payload);
+}

useragent/lib/features/connection/connection.dart

@@ -1,21 +1,13 @@
 import 'dart:async';
-import 'dart:convert';
 
-import 'package:arbiter/features/connection/server_info_storage.dart';
-import 'package:arbiter/features/identity/pk_manager.dart';
-import 'package:arbiter/proto/arbiter.pbgrpc.dart';
-import 'package:arbiter/proto/evm.pb.dart';
 import 'package:arbiter/proto/user_agent.pb.dart';
-import 'package:cryptography/cryptography.dart';
 import 'package:grpc/grpc.dart';
 import 'package:mtcore/markettakers.dart';
-import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
 
 class Connection {
   final ClientChannel channel;
   final StreamController<UserAgentRequest> _tx;
   final StreamIterator<UserAgentResponse> _rx;
-  Future<void> _requestQueue = Future<void>.value();
 
   Connection({
     required this.channel,
@@ -25,6 +17,7 @@ class Connection {
        _rx = StreamIterator(rx);
 
   Future<void> send(UserAgentRequest request) async {
+    talker.debug('Sending request: ${request.toDebugString()}');
     _tx.add(request);
   }
 
@@ -33,6 +26,7 @@ class Connection {
     if (!hasValue) {
       throw Exception('Connection closed while waiting for server response.');
     }
+    talker.debug('Received response: ${_rx.current.toDebugString()}');
     return _rx.current;
   }
 
@@ -41,258 +35,3 @@ class Connection {
     await channel.shutdown();
   }
 }
-
-Future<Connection> _connect(StoredServerInfo serverInfo) async {
-  final channel = ClientChannel(
-    serverInfo.address,
-    port: serverInfo.port,
-    options: ChannelOptions(
-      connectTimeout: const Duration(seconds: 10),
-      credentials: ChannelCredentials.secure(
-        onBadCertificate: (cert, host) {
-          return true;
-        },
-      ),
-    ),
-  );
-
-  final client = ArbiterServiceClient(channel);
-  final tx = StreamController<UserAgentRequest>();
-
-  final rx = client.userAgent(tx.stream);
-
-  return Connection(channel: channel, tx: tx, rx: rx);
-}
-
-List<int> formatChallenge(AuthChallenge challenge, List<int> pubkey) {
-  final encodedPubkey = base64Encode(pubkey);
-  final payload = "${challenge.nonce}:$encodedPubkey";
-  return utf8.encode(payload);
-}
-
-const _vaultKeyAssociatedData = 'arbiter.vault.password';
-
-Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletList: Empty()));
-
-  final response = await connection.receive();
-  if (!response.hasEvmWalletList()) {
-    throw Exception(
-      'Expected EVM wallet list response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmWalletList;
-  switch (result.whichResult()) {
-    case WalletListResponse_Result.wallets:
-      return result.wallets.wallets.toList(growable: false);
-    case WalletListResponse_Result.error:
-      throw Exception(_describeEvmError(result.error));
-    case WalletListResponse_Result.notSet:
-      throw Exception('EVM wallet list response was empty.');
-  }
-}
-
-Future<void> createEvmWallet(Connection connection) async {
-  await connection.send(UserAgentRequest(evmWalletCreate: Empty()));
-
-  final response = await connection.receive();
-  if (!response.hasEvmWalletCreate()) {
-    throw Exception(
-      'Expected EVM wallet create response, got ${response.whichPayload()}',
-    );
-  }
-
-  final result = response.evmWalletCreate;
-  switch (result.whichResult()) {
-    case WalletCreateResponse_Result.wallet:
-      return;
-    case WalletCreateResponse_Result.error:
-      throw Exception(_describeEvmError(result.error));
-    case WalletCreateResponse_Result.notSet:
-      throw Exception('Wallet creation returned no result.');
-  }
-}
-
-Future<BootstrapResult> bootstrapVault(
-  Connection connection,
-  String password,
-) async {
-  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
-
-  await connection.send(
-    UserAgentRequest(
-      bootstrapEncryptedKey: BootstrapEncryptedKey(
-        nonce: encryptedKey.nonce,
-        ciphertext: encryptedKey.ciphertext,
-        associatedData: encryptedKey.associatedData,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasBootstrapResult()) {
-    throw Exception(
-      'Expected bootstrap result, got ${response.whichPayload()}',
-    );
-  }
-
-  return response.bootstrapResult;
-}
-
-Future<UnsealResult> unsealVault(Connection connection, String password) async {
-  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
-
-  await connection.send(
-    UserAgentRequest(
-      unsealEncryptedKey: UnsealEncryptedKey(
-        nonce: encryptedKey.nonce,
-        ciphertext: encryptedKey.ciphertext,
-        associatedData: encryptedKey.associatedData,
-      ),
-    ),
-  );
-
-  final response = await connection.receive();
-  if (!response.hasUnsealResult()) {
-    throw Exception('Expected unseal result, got ${response.whichPayload()}');
-  }
-
-  return response.unsealResult;
-}
-
-Future<_EncryptedVaultKey> _encryptVaultKeyMaterial(
-  Connection connection,
-  String password,
-) async {
-  final keyExchange = X25519();
-  final cipher = Xchacha20.poly1305Aead();
-  final clientKeyPair = await keyExchange.newKeyPair();
-  final clientPublicKey = await clientKeyPair.extractPublicKey();
-
-  await connection.send(
-    UserAgentRequest(
-      unsealStart: UnsealStart(clientPubkey: clientPublicKey.bytes),
-    ),
-  );
-
-  final handshakeResponse = await connection.receive();
-  if (!handshakeResponse.hasUnsealStartResponse()) {
-    throw Exception(
-      'Expected unseal handshake response, got ${handshakeResponse.whichPayload()}',
-    );
-  }
-
-  final serverPublicKey = SimplePublicKey(
-    handshakeResponse.unsealStartResponse.serverPubkey,
-    type: KeyPairType.x25519,
-  );
-  final sharedSecret = await keyExchange.sharedSecretKey(
-    keyPair: clientKeyPair,
-    remotePublicKey: serverPublicKey,
-  );
-
-  final secretBox = await cipher.encrypt(
-    utf8.encode(password),
-    secretKey: sharedSecret,
-    nonce: cipher.newNonce(),
-    aad: utf8.encode(_vaultKeyAssociatedData),
-  );
-
-  return _EncryptedVaultKey(
-    nonce: secretBox.nonce,
-    ciphertext: [...secretBox.cipherText, ...secretBox.mac.bytes],
-    associatedData: utf8.encode(_vaultKeyAssociatedData),
-  );
-}
-
-class _EncryptedVaultKey {
-  const _EncryptedVaultKey({
-    required this.nonce,
-    required this.ciphertext,
-    required this.associatedData,
-  });
-
-  final List<int> nonce;
-  final List<int> ciphertext;
-  final List<int> associatedData;
-}
-
-Future<Connection> connectAndAuthorize(
-  StoredServerInfo serverInfo,
-  KeyHandle key, {
-  String? bootstrapToken,
-}) async {
-  try {
-    final connection = await _connect(serverInfo);
-    talker.info(
-      'Connected to server at ${serverInfo.address}:${serverInfo.port}',
-    );
-    final pubkey = await key.getPublicKey();
-
-    final req = AuthChallengeRequest(
-      pubkey: pubkey,
-      bootstrapToken: bootstrapToken,
-      keyType: switch (key.alg) {
-        KeyAlgorithm.rsa => KeyType.KEY_TYPE_RSA,
-        KeyAlgorithm.ecdsa => KeyType.KEY_TYPE_ECDSA_SECP256K1,
-        KeyAlgorithm.ed25519 => KeyType.KEY_TYPE_ED25519,
-      },
-    );
-    await connection.send(UserAgentRequest(authChallengeRequest: req));
-    talker.info(
-      "Sent auth challenge request with pubkey ${base64Encode(pubkey)}",
-    );
-
-    final response = await connection.receive();
-
-    talker.info('Received response from server, checking auth flow...');
-
-    if (response.hasAuthOk()) {
-      talker.info('Authentication successful, connection established');
-      return connection;
-    }
-
-    if (!response.hasAuthChallenge()) {
-      throw Exception(
-        'Expected AuthChallengeResponse, got ${response.whichPayload()}',
-      );
-    }
-
-    final challenge = formatChallenge(response.authChallenge, pubkey);
-    talker.info(
-      'Received auth challenge, signing with key ${base64Encode(pubkey)}',
-    );
-
-    final signature = await key.sign(challenge);
-
-    final solutionReq = AuthChallengeSolution(signature: signature);
-    await connection.send(UserAgentRequest(authChallengeSolution: solutionReq));
-
-    talker.info('Sent auth challenge solution, waiting for server response...');
-
-    final solutionResponse = await connection.receive();
-
-    if (!solutionResponse.hasAuthOk()) {
-      throw Exception(
-        'Expected AuthChallengeSolutionResponse, got ${solutionResponse.whichPayload()}',
-      );
-    }
-
-    talker.info('Authentication successful, connection established');
-
-    return connection;
-  } catch (e) {
-    throw Exception('Failed to connect to server: $e');
-  }
-}
-
-String _describeEvmError(EvmError error) {
-  return switch (error) {
-    EvmError.EVM_ERROR_VAULT_SEALED =>
-      'The vault is sealed. Unseal it before using EVM wallets.',
-    EvmError.EVM_ERROR_INTERNAL || EvmError.EVM_ERROR_UNSPECIFIED =>
-      'The server failed to process the EVM request.',
-    _ => 'The server failed to process the EVM request.',
-  };
-}

useragent/lib/features/connection/evm.dart

@@ -0,0 +1,56 @@
+import 'package:arbiter/features/connection/connection.dart';
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:protobuf/well_known_types/google/protobuf/empty.pb.dart';
+
+Future<List<WalletEntry>> listEvmWallets(Connection connection) async {
+  await connection.send(UserAgentRequest(evmWalletList: Empty()));
+
+  final response = await connection.receive();
+  if (!response.hasEvmWalletList()) {
+    throw Exception(
+      'Expected EVM wallet list response, got ${response.whichPayload()}',
+    );
+  }
+
+  final result = response.evmWalletList;
+  switch (result.whichResult()) {
+    case WalletListResponse_Result.wallets:
+      return result.wallets.wallets.toList(growable: false);
+    case WalletListResponse_Result.error:
+      throw Exception(_describeEvmError(result.error));
+    case WalletListResponse_Result.notSet:
+      throw Exception('EVM wallet list response was empty.');
+  }
+}
+
+Future<void> createEvmWallet(Connection connection) async {
+  await connection.send(UserAgentRequest(evmWalletCreate: Empty()));
+
+  final response = await connection.receive();
+  if (!response.hasEvmWalletCreate()) {
+    throw Exception(
+      'Expected EVM wallet create response, got ${response.whichPayload()}',
+    );
+  }
+
+  final result = response.evmWalletCreate;
+  switch (result.whichResult()) {
+    case WalletCreateResponse_Result.wallet:
+      return;
+    case WalletCreateResponse_Result.error:
+      throw Exception(_describeEvmError(result.error));
+    case WalletCreateResponse_Result.notSet:
+      throw Exception('Wallet creation returned no result.');
+  }
+}
+
+String _describeEvmError(EvmError error) {
+  return switch (error) {
+    EvmError.EVM_ERROR_VAULT_SEALED =>
+      'The vault is sealed. Unseal it before using EVM wallets.',
+    EvmError.EVM_ERROR_INTERNAL || EvmError.EVM_ERROR_UNSPECIFIED =>
+      'The server failed to process the EVM request.',
+    _ => 'The server failed to process the EVM request.',
+  };
+}

useragent/lib/features/connection/evm/grants.dart

@@ -0,0 +1,122 @@
+import 'package:arbiter/features/connection/connection.dart';
+import 'package:arbiter/proto/evm.pb.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:fixnum/fixnum.dart';
+import 'package:protobuf/well_known_types/google/protobuf/timestamp.pb.dart';
+
+Future<List<GrantEntry>> listEvmGrants(
+  Connection connection, {
+  int? walletId,
+}) async {
+  final request = EvmGrantListRequest();
+  if (walletId != null) {
+    request.walletId = walletId;
+  }
+
+  await connection.send(UserAgentRequest(evmGrantList: request));
+
+  final response = await connection.receive();
+  if (!response.hasEvmGrantList()) {
+    throw Exception(
+      'Expected EVM grant list response, got ${response.whichPayload()}',
+    );
+  }
+
+  final result = response.evmGrantList;
+  switch (result.whichResult()) {
+    case EvmGrantListResponse_Result.grants:
+      return result.grants.grants.toList(growable: false);
+    case EvmGrantListResponse_Result.error:
+      throw Exception(_describeGrantError(result.error));
+    case EvmGrantListResponse_Result.notSet:
+      throw Exception('EVM grant list response was empty.');
+  }
+}
+
+Future<int> createEvmGrant(
+  Connection connection, {
+  required int clientId,
+  required int walletId,
+  required Int64 chainId,
+  DateTime? validFrom,
+  DateTime? validUntil,
+  List<int>? maxGasFeePerGas,
+  List<int>? maxPriorityFeePerGas,
+  TransactionRateLimit? rateLimit,
+  required SpecificGrant specific,
+}) async {
+  await connection.send(
+    UserAgentRequest(
+      evmGrantCreate: EvmGrantCreateRequest(
+        clientId: clientId,
+        shared: SharedSettings(
+          walletId: walletId,
+          chainId: chainId,
+          validFrom: validFrom == null ? null : _toTimestamp(validFrom),
+          validUntil: validUntil == null ? null : _toTimestamp(validUntil),
+          maxGasFeePerGas: maxGasFeePerGas,
+          maxPriorityFeePerGas: maxPriorityFeePerGas,
+          rateLimit: rateLimit,
+        ),
+        specific: specific,
+      ),
+    ),
+  );
+
+  final response = await connection.receive();
+  if (!response.hasEvmGrantCreate()) {
+    throw Exception(
+      'Expected EVM grant create response, got ${response.whichPayload()}',
+    );
+  }
+
+  final result = response.evmGrantCreate;
+  switch (result.whichResult()) {
+    case EvmGrantCreateResponse_Result.grantId:
+      return result.grantId;
+    case EvmGrantCreateResponse_Result.error:
+      throw Exception(_describeGrantError(result.error));
+    case EvmGrantCreateResponse_Result.notSet:
+      throw Exception('Grant creation returned no result.');
+  }
+}
+
+Future<void> deleteEvmGrant(Connection connection, int grantId) async {
+  await connection.send(
+    UserAgentRequest(evmGrantDelete: EvmGrantDeleteRequest(grantId: grantId)),
+  );
+
+  final response = await connection.receive();
+  if (!response.hasEvmGrantDelete()) {
+    throw Exception(
+      'Expected EVM grant delete response, got ${response.whichPayload()}',
+    );
+  }
+
+  final result = response.evmGrantDelete;
+  switch (result.whichResult()) {
+    case EvmGrantDeleteResponse_Result.ok:
+      return;
+    case EvmGrantDeleteResponse_Result.error:
+      throw Exception(_describeGrantError(result.error));
+    case EvmGrantDeleteResponse_Result.notSet:
+      throw Exception('Grant revoke returned no result.');
+  }
+}
+
+Timestamp _toTimestamp(DateTime value) {
+  final utc = value.toUtc();
+  return Timestamp()
+    ..seconds = Int64(utc.millisecondsSinceEpoch ~/ 1000)
+    ..nanos = (utc.microsecondsSinceEpoch % 1000000) * 1000;
+}
+
+String _describeGrantError(EvmError error) {
+  return switch (error) {
+    EvmError.EVM_ERROR_VAULT_SEALED =>
+      'The vault is sealed. Unseal it before using EVM grants.',
+    EvmError.EVM_ERROR_INTERNAL || EvmError.EVM_ERROR_UNSPECIFIED =>
+      'The server failed to process the EVM grant request.',
+    _ => 'The server failed to process the EVM grant request.',
+  };
+}

useragent/lib/features/connection/server_info_storage.dart

@@ -37,6 +37,7 @@ class SecureServerInfoStorage implements ServerInfoStorage {
 
   @override
   Future<StoredServerInfo?> load() async {
+    return null;
     final rawValue = await _storage.read(key: _storageKey);
     if (rawValue == null) {
       return null;

useragent/lib/features/connection/vault.dart

@@ -0,0 +1,107 @@
+import 'package:arbiter/features/connection/connection.dart';
+import 'package:arbiter/proto/user_agent.pb.dart';
+import 'package:cryptography/cryptography.dart';
+
+const _vaultKeyAssociatedData = 'arbiter.vault.password';
+
+Future<BootstrapResult> bootstrapVault(
+  Connection connection,
+  String password,
+) async {
+  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
+
+  await connection.send(
+    UserAgentRequest(
+      bootstrapEncryptedKey: BootstrapEncryptedKey(
+        nonce: encryptedKey.nonce,
+        ciphertext: encryptedKey.ciphertext,
+        associatedData: encryptedKey.associatedData,
+      ),
+    ),
+  );
+
+  final response = await connection.receive();
+  if (!response.hasBootstrapResult()) {
+    throw Exception(
+      'Expected bootstrap result, got ${response.whichPayload()}',
+    );
+  }
+
+  return response.bootstrapResult;
+}
+
+Future<UnsealResult> unsealVault(Connection connection, String password) async {
+  final encryptedKey = await _encryptVaultKeyMaterial(connection, password);
+
+  await connection.send(
+    UserAgentRequest(
+      unsealEncryptedKey: UnsealEncryptedKey(
+        nonce: encryptedKey.nonce,
+        ciphertext: encryptedKey.ciphertext,
+        associatedData: encryptedKey.associatedData,
+      ),
+    ),
+  );
+
+  final response = await connection.receive();
+  if (!response.hasUnsealResult()) {
+    throw Exception('Expected unseal result, got ${response.whichPayload()}');
+  }
+
+  return response.unsealResult;
+}
+
+Future<_EncryptedVaultKey> _encryptVaultKeyMaterial(
+  Connection connection,
+  String password,
+) async {
+  final keyExchange = X25519();
+  final cipher = Xchacha20.poly1305Aead();
+  final clientKeyPair = await keyExchange.newKeyPair();
+  final clientPublicKey = await clientKeyPair.extractPublicKey();
+
+  await connection.send(
+    UserAgentRequest(unsealStart: UnsealStart(clientPubkey: clientPublicKey.bytes)),
+  );
+
+  final handshakeResponse = await connection.receive();
+  if (!handshakeResponse.hasUnsealStartResponse()) {
+    throw Exception(
+      'Expected unseal handshake response, got ${handshakeResponse.whichPayload()}',
+    );
+  }
+
+  final serverPublicKey = SimplePublicKey(
+    handshakeResponse.unsealStartResponse.serverPubkey,
+    type: KeyPairType.x25519,
+  );
+  final sharedSecret = await keyExchange.sharedSecretKey(
+    keyPair: clientKeyPair,
+    remotePublicKey: serverPublicKey,
+  );
+
+  final secretBox = await cipher.encrypt(
+    password.codeUnits,
+    secretKey: sharedSecret,
+    nonce: cipher.newNonce(),
+    aad: _vaultKeyAssociatedData.codeUnits,
+  );
+
+  return _EncryptedVaultKey(
+    nonce: secretBox.nonce,
+    ciphertext: [...secretBox.cipherText, ...secretBox.mac.bytes],
+    associatedData: _vaultKeyAssociatedData.codeUnits,
+  );
+}
+
+class _EncryptedVaultKey {
+  const _EncryptedVaultKey({
+    required this.nonce,
+    required this.ciphertext,
+    required this.associatedData,
+  });
+
+  final List<int> nonce;
+  final List<int> ciphertext;
+  final List<int> associatedData;
+}