feat: Add Tempo T5/T6 key authorization fields

.changeset/bright-buckets-tap.md

@@ -0,0 +1,5 @@
+---
+"accounts": patch
+---
+
+Added support for admin access keys + witness.

package.json

@@ -79,7 +79,7 @@
     "jose": "^6.2.3",
     "mipd": "^0.0.7",
     "mppx": "catalog:",
-    "ox": "~0.14.20",
+    "ox": "~0.14.29",
     "wata": "0.4.0",
     "webauthx": "~0.1.1",
     "zod": "^4.3.6",

src/cli/adapter.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, test } from 'vp/test'
+import * as z from 'zod/mini'
+
+import { chain, getClient } from '../../test/config.js'
+import * as Account from '../core/Account.js'
+import * as Storage from '../core/Storage.js'
+import * as Store from '../core/Store.js'
+import * as Rpc from '../core/zod/rpc.js'
+import { cli } from './adapter.js'
+
+describe('cli', () => {
+  test('error: rejects unsupported T5 fields for wallet_authorizeAccessKey', async () => {
+    const { adapter } = setup()
+    const parameters: Rpc.wallet_authorizeAccessKey.Decoded['params'][number] = {
+      account: '0x0000000000000000000000000000000000000001',
+      expiry: 0,
+    }
+
+    await expect(
+      adapter.actions.authorizeAccessKey!(parameters, {
+        method: 'wallet_authorizeAccessKey',
+        params: z.encode(Rpc.wallet_authorizeAccessKey.schema.params!, [parameters]),
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[RpcResponse.InvalidParamsError: \`authorizeAccessKey.account\`, \`authorizeAccessKey.isAdmin\`, and \`authorizeAccessKey.witness\` are not supported by the CLI adapter.]`,
+    )
+  })
+
+  test('error: rejects unsupported T5 fields for wallet_connect login', async () => {
+    const { adapter } = setup()
+
+    await expect(
+      adapter.actions.loadAccounts(
+        {
+          authorizeAccessKey: {
+            expiry: 0,
+            isAdmin: false,
+          },
+        },
+        { method: 'wallet_connect', params: undefined },
+      ),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[RpcResponse.InvalidParamsError: \`authorizeAccessKey.account\`, \`authorizeAccessKey.isAdmin\`, and \`authorizeAccessKey.witness\` are not supported by the CLI adapter.]`,
+    )
+  })
+
+  test('error: rejects unsupported T5 fields for wallet_connect register', async () => {
+    const { adapter } = setup()
+
+    await expect(
+      adapter.actions.createAccount(
+        {
+          authorizeAccessKey: {
+            expiry: 0,
+            witness: `0x${'11'.repeat(32)}`,
+          },
+          name: 'test',
+        },
+        { method: 'wallet_connect', params: undefined },
+      ),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[RpcResponse.InvalidParamsError: \`authorizeAccessKey.account\`, \`authorizeAccessKey.isAdmin\`, and \`authorizeAccessKey.witness\` are not supported by the CLI adapter.]`,
+    )
+  })
+})
+
+function setup() {
+  const storage = Storage.memory()
+  const store = Store.create({ chainId: chain.id, storage })
+  const adapter = cli({
+    host: 'http://localhost/cli-auth',
+    open() {
+      throw new Error('Unexpected browser open.')
+    },
+  })({
+    getAccount: (options) => Account.find({ ...options, signable: true, store }),
+    getClient: () => getClient({ chain }) as never,
+    storage,
+    store,
+  })
+  return { adapter, store }
+}

src/cli/adapter.ts

@@ -53,6 +53,8 @@ export function cli(options: cli.Options): Adapter.Adapter {
       } = options
       const { account, authorizeAccessKey, method } = request
 
+      rejectUnsupportedAuthorizeAccessKey(authorizeAccessKey)
+
       // p256 by default; secp256k1 only when explicitly requested.
       const generatedKeyType = authorizeAccessKey?.keyType === 'secp256k1' ? 'secp256k1' : 'p256'
       const generatedAccessKey =
@@ -337,3 +339,17 @@ async function post<
 function unsupported(message: string) {
   return new core_Provider.UnsupportedMethodError({ message })
 }
+
+function rejectUnsupportedAuthorizeAccessKey(
+  authorizeAccessKey: Adapter.authorizeAccessKey.Parameters | undefined,
+) {
+  if (
+    authorizeAccessKey?.account ||
+    typeof authorizeAccessKey?.isAdmin !== 'undefined' ||
+    authorizeAccessKey?.witness
+  )
+    throw new RpcResponse.InvalidParamsError({
+      message:
+        '`authorizeAccessKey.account`, `authorizeAccessKey.isAdmin`, and `authorizeAccessKey.witness` are not supported by the CLI adapter.',
+    })
+}