In order to perform an action that can be verified by Canvas we need a Message<Session> and its signature and a Message<Action and its signature. This means that any API endpoints that currently take a canvas_action, canvas_session and canvas_hash will now change to take the new fields. These could be given as separate parameters (in which case there would be four of them) or passed in as one object.
The Canvas data can now possibly contain Uint8Array. For these fields, we should switch from using JSON.stringify/parse/stable-stringify to using @ipld/dag-json which produces a JSON object with extra metadata for encoding things that normally would not be supported by JSON. The @ipld/dag-X libraries are already used in a number of places, such as various parts of the IPFS universe and our own codebase. This won't affect any of the other fields that are handled by Commonwealth.
The way we sign and verify data has changed, this will involve changing some code in the wallet controllers, removing most/all of the sessions controller and updating the verifyAddress endpoint. We will no longer use the CW_SESSIONS_ localstorage variables to store the temporary keys. We will still use localStorage to store keys but this will be handled by the Canvas libraries. This will mostly mean replacing the complicated crypto code with calls to the @canvas-js/chain-X libraries. Files that will be removed/consolidated:
[ ] shared/canvas/verify.ts (*)
[ ] shared/canvas/serverVerify.ts (*)
[ ] shared/canvas/index.ts
[ ] shared/canvas/chainMappings.ts (maybe can get rid of this)
[ ] shared/canvas/constructMessage.ts (maybe can get rid of this)
[ ] shared/adapters/chain/cosmos/keys.ts (maybe can get rid of this)
[ ] shared/adapters/chain/ethereum/keys.ts (maybe can get rid of this)
[ ] client/scripts/helpers/canvas.ts
Update crypto related package versions that clash with the Canvas libraries.
raykyri
commented
3 months ago
(edited by @rjwebb)
Things that need to change:
In order to perform an action that can be verified by Canvas we need a
Message<Session>and its signature and aMessage<Actionand its signature. This means that any API endpoints that currently take acanvas_action,canvas_sessionandcanvas_hashwill now change to take the new fields. These could be given as separate parameters (in which case there would be four of them) or passed in as one object.The Canvas data can now possibly contain
Uint8Array. For these fields, we should switch from usingJSON.stringify/parse/stable-stringifyto using@ipld/dag-jsonwhich produces a JSON object with extra metadata for encoding things that normally would not be supported by JSON. The@ipld/dag-Xlibraries are already used in a number of places, such as various parts of the IPFS universe and our own codebase. This won't affect any of the other fields that are handled by Commonwealth.The way we sign and verify data has changed, this will involve changing some code in the wallet controllers, removing most/all of the sessions controller and updating the
verifyAddressendpoint. We will no longer use theCW_SESSIONS_localstorage variables to store the temporary keys. We will still use localStorage to store keys but this will be handled by the Canvas libraries. This will mostly mean replacing the complicated crypto code with calls to the@canvas-js/chain-Xlibraries. Files that will be removed/consolidated:Update crypto related package versions that clash with the Canvas libraries.
Update related interfaces around the codebase:
Update the canvas-node package
Test via automated API tests.
Test all wallets in the browser, including WalletConnect, Terra/Ronin, NEAR, and Leap / 1inch / new wallets.