greymass / anchor-link

Persistent, fast and secure signature provider for EOSIO chains built on top of EOSIO Signing Requests (EEP-7)
Other
53 stars 22 forks source link

Implement OBFA for Fuel (and others) within the anchor-link signature collection process #7

Closed aaroncox closed 4 years ago

aaroncox commented 4 years ago

Currently we have a conflict between:

Which prevents signers from appending OBFA (only bill first authorizer) action onto signing requests from providers.

Link, being used across all of these components, uses sessions which set the broadcast: false flag on every request passed between the provider and signer. Wallets detect this value being set to false, and refused to append OBFA actions like Fuel to the transaction being signed.

What we need is likely to modify the link itself (being the core of the UAL and Transit plugins) to have the ability to collect a signature from an OBFA signature before pushing the transaction to the blockchain itself.

The proposed new flow of a transaction in link would be something similar to:

1) Application passed transaction to Provider. 2) [New] Provider prepends OBFA action/authorization to transaction. 3) Provider uses open channel to pass a signing request to the Wallet. 4) Wallet signs transaction and issues callback, returning the transaction to Provider. 5) [New] Provider submits transaction to designated non-push API for the OBFA action to generate the signature of the OBFA provider. 6) [New] Provider combines signature into transaction 7) Provider submits transaction to the blockchain.

aaroncox commented 4 years ago

We have a very early version we're beginning to test that helps address this issue.

PR https://github.com/greymass/anchor-link/pull/8 Branch: https://github.com/greymass/anchor-link/tree/cosigner

The changes to the applications using UAL/Transit/Anchor Link to take advantage of this should be minimal. We integrated it into one of our demos here:

https://github.com/greymass/anchor-link-demo-multipass/commit/2450299a74d2feb34a61c2708223c88d1bcbbb8a#diff-14b1e33d5bf5649597cdc0e4f684dadd

Live Demo: https://greymass.github.io/anchor-link-demo-multipass/

It's designed in such a way that any cosigning service can be configured for use, so long as the service provides an API endpoint to validate the transaction and retrieve signatures.

All of this is still subject to change since it's still very early in development, but we are making progress.