feat(keyring-eth-money-mpc): skip MFA for whitelisted signatures

.github/workflows/validate-pr-title.yml

@@ -44,10 +44,10 @@ jobs:
             keyring-api
             keyring-eth-hd
             keyring-eth-money
+            keyring-eth-money-mpc
             keyring-eth-ledger-bridge
             keyring-eth-simple
             keyring-eth-trezor
-            keyring-eth-mpc
             keyring-internal-api
             keyring-internal-snap-client
             keyring-sdk

README.md

@@ -22,7 +22,7 @@ This repository contains the following packages [^fn1]:
 - [`@metamask/eth-hd-keyring`](packages/keyring-eth-hd)
 - [`@metamask/eth-ledger-bridge-keyring`](packages/keyring-eth-ledger-bridge)
 - [`@metamask/eth-money-keyring`](packages/keyring-eth-money)
-- [`@metamask/eth-mpc-keyring`](packages/keyring-eth-mpc)
+- [`@metamask/eth-money-mpc-keyring`](packages/keyring-eth-money-mpc)
 - [`@metamask/eth-qr-keyring`](packages/keyring-eth-qr)
 - [`@metamask/eth-simple-keyring`](packages/keyring-eth-simple)
 - [`@metamask/eth-snap-keyring`](packages/keyring-snap-bridge)
@@ -53,7 +53,7 @@ linkStyle default opacity:0.5
   eth_hd_keyring(["@metamask/eth-hd-keyring"]);
   eth_ledger_bridge_keyring(["@metamask/eth-ledger-bridge-keyring"]);
   eth_money_keyring(["@metamask/eth-money-keyring"]);
-  eth_mpc_keyring(["@metamask/eth-mpc-keyring"]);
+  eth_money_mpc_keyring(["@metamask/eth-money-mpc-keyring"]);
   eth_qr_keyring(["@metamask/eth-qr-keyring"]);
   eth_simple_keyring(["@metamask/eth-simple-keyring"]);
   eth_trezor_keyring(["@metamask/eth-trezor-keyring"]);
@@ -81,9 +81,9 @@ linkStyle default opacity:0.5
   eth_money_keyring --> keyring_api;
   eth_money_keyring --> keyring_sdk;
   eth_money_keyring --> keyring_utils;
-  eth_mpc_keyring --> keyring_api;
-  eth_mpc_keyring --> keyring_sdk;
-  eth_mpc_keyring --> keyring_utils;
+  eth_money_mpc_keyring --> keyring_api;
+  eth_money_mpc_keyring --> keyring_sdk;
+  eth_money_mpc_keyring --> keyring_utils;
   eth_qr_keyring --> keyring_api;
   eth_qr_keyring --> keyring_sdk;
   eth_qr_keyring --> keyring_utils;

jest.config.packages.js

@@ -86,6 +86,10 @@ module.exports = {
   // Here we ensure that Jest resolves `@metamask/*` imports to the uncompiled source code for packages that live in this repo.
   // NOTE: This must be synchronized with the `paths` option in `tsconfig.packages.json`.
   moduleNameMapper: {
+    // Listed before the `@metamask/*` wildcard so the AES-GCM subpath is not
+    // rewritten to a workspace source directory.
+    '^@metamask/cryptography/aes-gcm$':
+      '<rootDir>/../../node_modules/@metamask/cryptography/dist/aes-gcm.js',
     '^@metamask/(.+)/v2$': [
       '<rootDir>/../$1/src/v2',
       // Some @metamask/* packages we are referencing aren't in this monorepo,
@@ -97,6 +101,12 @@ module.exports = {
       // Some @metamask/* packages we are referencing aren't in this monorepo,
       // so in that case use their published versions
       '<rootDir>/../../node_modules/@metamask/$1',
+      // Some published @metamask/* packages are ESM-only and have no `main`
+      // field, so resolving their package directory fails. In that case, use
+      // their ESM entrypoint directly. This is only safe for modules that are
+      // mocked with `jest.mock`, since Jest's CommonJS runtime cannot execute
+      // native ESM.
+      '<rootDir>/../../node_modules/@metamask/$1/dist/index.js',
     ],
   },
 

packages/keyring-eth-money-mpc/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- Initial release of `@metamask/eth-money-mpc-keyring` ([#627](https://github.com/MetaMask/accounts/pull/627))
+- Skip MFA for whitelisted signature requests, and retry with a 2FA token when the backend returns `mfa_required` ([#TODO](https://github.com/MetaMask/accounts/pull/TODO))
+
+[Unreleased]: https://github.com/MetaMask/accounts/

packages/keyring-eth-money-mpc/README.md

@@ -0,0 +1,23 @@
+# MPC Money Keyring
+
+A Keyring for Ethereum money accounts that uses Multi-Party Computation (MPC) for key management and signing, built on top of the [MFA Wallet SDK](https://github.com/MetaMask/mfa-wallet-sdk).
+
+The default export is the V1 `MpcMoneyKeyring` implementation. A V2 adapter that wraps it is available from `@metamask/eth-money-mpc-keyring/v2`.
+
+## MFA
+
+Pass `getMfaWhitelistConfig` to let signature requests skip MFA when they match [`@metamask/money-account-mfa-whitelist`](https://github.com/MetaMask/core/tree/main/packages/money-account-mfa-whitelist). The keyring sends the original request with the hash. The backend repeats the check with its own account, hash, and pinned configuration. When that still requires MFA, `/sign` responds with `{ "code": "mfa_required" }`. The keyring then requests a 2FA profile token and calls `/sign` once more.
+
+Key generation, import, share rotation, share sync, and transaction signing always use a 2FA token. Omitting `getMfaWhitelistConfig` does too.
+
+## Installation
+
+`yarn add @metamask/eth-money-mpc-keyring`
+
+or
+
+`npm install @metamask/eth-money-mpc-keyring`
+
+## Contributing
+
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/accounts#readme).

packages/keyring-eth-mpc/jest.config.js → packages/keyring-eth-money-mpc/jest.config.cjs

@@ -14,6 +14,22 @@ module.exports = merge(baseConfig, {
   // The display name when running multiple projects
   displayName,
 
+  // Source files use Node16-style `.js` specifiers. Map them back to the
+  // TypeScript sources so Jest can load the modules under test.
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1',
+  },
+
+  // `@metamask/cryptography` is ESM-only. Transform it so Jest's CommonJS
+  // runtime can load the AES-GCM helpers.
+  transformIgnorePatterns: ['/node_modules/(?!@metamask/cryptography/)'],
+  transform: {
+    '/@metamask/cryptography/.+\\.js$': path.join(
+      __dirname,
+      'jest.cryptography-transform.cjs',
+    ),
+  },
+
   // An array of regexp pattern strings used to skip coverage collection
   coveragePathIgnorePatterns: ['./src/tests'],
 

packages/keyring-eth-money-mpc/jest.cryptography-transform.cjs

@@ -0,0 +1,33 @@
+/**
+ * Jest runs this package as CommonJS, and `@metamask/cryptography` ships
+ * ESM only. Transpile those files when the test runtime loads them.
+ *
+ * This file is CommonJS because Jest loads transformers without the
+ * package's TypeScript build.
+ */
+const ts = require('typescript');
+
+/**
+ * @type {import('@jest/transform').Transformer}
+ */
+module.exports = {
+  /**
+   * Transpile an ESM file to CommonJS.
+   *
+   * @param {string} sourceText - ESM source from `@metamask/cryptography`.
+   * @param {string} sourcePath - Absolute path of the source file.
+   * @returns {{ code: string }} CommonJS source Jest can execute.
+   */
+  process(sourceText, sourcePath) {
+    const result = ts.transpileModule(sourceText, {
+      compilerOptions: {
+        esModuleInterop: true,
+        module: ts.ModuleKind.CommonJS,
+        target: ts.ScriptTarget.ES2020,
+      },
+      fileName: sourcePath,
+    });
+
+    return { code: result.outputText };
+  },
+};

packages/keyring-eth-mpc/package.json → packages/keyring-eth-money-mpc/package.json

@@ -1,12 +1,12 @@
 {
-  "name": "@metamask/eth-mpc-keyring",
+  "name": "@metamask/eth-money-mpc-keyring",
   "version": "0.0.0",
-  "description": "A Keyring for Ethereum accounts that uses Multi-Party Computation (MPC) for key management and signing",
+  "description": "A Keyring for Ethereum money accounts that uses Multi-Party Computation (MPC) for key management and signing",
   "keywords": [
     "ethereum",
     "keyring"
   ],
-  "homepage": "https://github.com/MetaMask/accounts/tree/main/packages/keyring-eth-mpc#readme",
+  "homepage": "https://github.com/MetaMask/accounts/tree/main/packages/keyring-eth-money-mpc#readme",
   "bugs": {
     "url": "https://github.com/MetaMask/accounts/issues"
   },
@@ -16,32 +16,18 @@
     "url": "https://github.com/MetaMask/accounts.git"
   },
   "files": [
-    "dist/",
-    "v2.js"
+    "dist/"
   ],
+  "type": "module",
   "sideEffects": false,
-  "main": "./dist/index.cjs",
-  "types": "./dist/index.d.cts",
   "exports": {
     ".": {
-      "import": {
-        "types": "./dist/index.d.mts",
-        "default": "./dist/index.mjs"
-      },
-      "require": {
-        "types": "./dist/index.d.cts",
-        "default": "./dist/index.cjs"
-      }
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
     },
     "./v2": {
-      "import": {
-        "types": "./dist/v2/index.d.mts",
-        "default": "./dist/v2/index.mjs"
-      },
-      "require": {
-        "types": "./dist/v2/index.d.cts",
-        "default": "./dist/v2/index.cjs"
-      }
+      "types": "./dist/v2/index.d.mts",
+      "default": "./dist/v2/index.mjs"
     },
     "./package.json": "./package.json"
   },
@@ -50,33 +36,40 @@
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
-    "build": "ts-bridge --project tsconfig.build.json --verbose --clean --no-references",
+    "build": "ts-bridge --project tsconfig.build.json --verbose --clean --no-references --format module",
     "build:clean": "yarn build --clean",
     "build:docs": "typedoc",
-    "changelog:update": "../../scripts/update-changelog.sh @metamask/eth-mpc-keyring",
-    "changelog:validate": "../../scripts/validate-changelog.sh @metamask/eth-mpc-keyring",
+    "changelog:update": "../../scripts/update-changelog.sh @metamask/eth-money-mpc-keyring",
+    "changelog:validate": "../../scripts/validate-changelog.sh @metamask/eth-money-mpc-keyring",
     "publish:preview": "yarn npm publish --tag preview",
     "test": "yarn test:source && yarn test:types",
-    "test:clean": "NODE_OPTIONS=--experimental-vm-modules jest --clearCache",
-    "build:all": "ts-bridge --project tsconfig.build.json --verbose --clean",
+    "test:clean": "jest --clearCache",
+    "build:all": "ts-bridge --project tsconfig.build.json --verbose --clean --format module",
     "since-latest-release": "../../scripts/since-latest-release.sh",
-    "test:source": "NODE_OPTIONS=--experimental-vm-modules jest --reporters=jest-silent-reporter",
+    "test:source": "jest --reporters=jest-silent-reporter",
     "test:types": "../../scripts/tsd-test.sh ./src",
-    "test:verbose": "NODE_OPTIONS=--experimental-vm-modules jest --verbose",
-    "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch"
+    "test:verbose": "jest --verbose",
+    "test:watch": "jest --watch"
   },
   "dependencies": {
+    "@ethereumjs/util": "^9.1.0",
+    "@metamask/cryptography": "^1.1.2",
+    "@metamask/eth-sig-util": "^9.0.0",
     "@metamask/keyring-api": "^24.2.0",
     "@metamask/keyring-sdk": "^4.0.0",
     "@metamask/keyring-utils": "^5.0.0",
+    "@metamask/mfa-wallet-cl24": "^0.1.0",
+    "@metamask/mfa-wallet-dkls23": "^0.1.0",
+    "@metamask/mfa-wallet-network": "^0.1.0",
+    "@metamask/money-account-mfa-whitelist": "npm:@metamask-previews/money-account-mfa-whitelist@0.0.0-preview-6ccf7a055",
+    "@metamask/superstruct": "^3.4.1",
     "@metamask/utils": "^11.11.0"
   },
   "devDependencies": {
-    "@ethereumjs/tx": "^5.4.0",
     "@lavamoat/allow-scripts": "^3.2.1",
     "@lavamoat/preinstall-always-fail": "^2.1.0",
     "@metamask/auto-changelog": "^6.1.0",
-    "@metamask/eth-sig-util": "^9.0.0",
+    "@metamask/mfa-wallet-interface": "^0.1.0",
     "@ts-bridge/cli": "^0.6.3",
     "@types/jest": "^29.5.12",
     "deepmerge": "^4.2.2",
@@ -88,7 +81,8 @@
   },
   "lavamoat": {
     "allowScripts": {
-      "@lavamoat/preinstall-always-fail": false
+      "@lavamoat/preinstall-always-fail": false,
+      "@metamask/mfa-wallet-network>centrifuge>protobufjs": false
     }
   }
 }