feat: lockPrivateKeys and unlockPrivateKeys

features/keychain/api/index.js

@@ -2,6 +2,7 @@ const createKeychainApi = ({ keychain }) => {
   return {
     keychain: {
       exportKey: (...args) => keychain.exportKey(...args),
+      arePrivateKeysLocked: () => keychain.arePrivateKeysLocked(),
       sodium: {
         signDetached: keychain.sodium.signDetached,
         getKeysFromSeed: (...args) =>

features/keychain/module/__tests__/lock-private-keys.test.js

@@ -0,0 +1,162 @@
+import { mnemonicToSeed } from 'bip39'
+import { createKeyIdentifierForExodus } from '@exodus/key-ids'
+import createKeychain from './create-keychain'
+import { getSeedId } from '../crypto/seed-id'
+
+const seed = mnemonicToSeed(
+  'menu memory fury language physical wonder dog valid smart edge decrease worth'
+)
+
+const seed1 = mnemonicToSeed(
+  'menu memory fury language physical wonder dog valid smart edge decrease test'
+)
+
+const seedId = getSeedId(seed)
+
+describe('lockPrivateKeys', () => {
+  it('should allow private key usage when unlocked', async () => {
+    const keychain = createKeychain({ seed })
+    const keyId = createKeyIdentifierForExodus({ exoType: 'FUSION' })
+    const exportedKeys = await keychain.exportKey({
+      seedId,
+      keyId,
+      exportPrivate: true,
+    })
+
+    // Public keys should be the same
+    const sodiumEncryptor = keychain.createSodiumEncryptor(keyId)
+    const {
+      sign: { publicKey },
+    } = await sodiumEncryptor.getSodiumKeysFromSeed({ seedId })
+    expect(Buffer.compare(publicKey, exportedKeys.publicKey)).toBe(0)
+  })
+
+  it('should allow addSeed when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    keychain.addSeed(seed)
+  })
+
+  it('should allow removeAllSeeds when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    keychain.removeAllSeeds()
+  })
+
+  it('should allow exportKey for public keys when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    const keyId = createKeyIdentifierForExodus({ exoType: 'FUSION' })
+    const exportedKeys = await keychain.exportKey({
+      seedId,
+      keyId,
+    })
+
+    expect(exportedKeys.publicKey).toBeDefined()
+  })
+
+  it('should allow clone when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    keychain.clone()
+  })
+
+  it('should allow exportKeys after lock/unlock', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    keychain.unlockPrivateKeys([seed])
+
+    const keyId = createKeyIdentifierForExodus({ exoType: 'FUSION' })
+    const exportedKeys = await keychain.exportKey({
+      seedId,
+      keyId,
+      exportPrivate: true,
+    })
+
+    // Public keys should be the same
+    const sodiumEncryptor = keychain.createSodiumEncryptor(keyId)
+    const {
+      sign: { publicKey },
+    } = await sodiumEncryptor.getSodiumKeysFromSeed({ seedId })
+    expect(Buffer.compare(publicKey, exportedKeys.publicKey)).toBe(0)
+  })
+
+  it('should block unlock for wrong seeds length', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    await expect(async () => keychain.unlockPrivateKeys([])).rejects.toThrow(
+      /must pass in same number of seeds/
+    )
+    await expect(async () => keychain.unlockPrivateKeys([seed, seed])).rejects.toThrow(
+      /must pass in same number of seeds/
+    )
+  })
+
+  it('should block unlock when already unlocked', async () => {
+    const keychain = createKeychain({ seed })
+    await expect(async () => keychain.unlockPrivateKeys([seed])).rejects.toThrow(/already unlocked/)
+  })
+
+  it('should block unlock for wrong seed ids', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    await expect(async () => keychain.unlockPrivateKeys([seed1])).rejects.toThrow(
+      /must pass in existing seed/
+    )
+
+    const keychain1 = createKeychain({ seed })
+    keychain1.addSeed(seed1)
+    keychain1.lockPrivateKeys()
+    await expect(async () => keychain1.unlockPrivateKeys([seed, seed])).rejects.toThrow(
+      /must pass in existing seed/
+    )
+  })
+
+  it('should block exportKey for private keys when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    const keyId = createKeyIdentifierForExodus({ exoType: 'FUSION' })
+    await expect(
+      keychain.exportKey({
+        seedId,
+        keyId,
+        exportPrivate: true,
+      })
+    ).rejects.toThrow(/private keys are locked/)
+  })
+
+  it('should block signTx when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    await expect(keychain.signTx({})).rejects.toThrow(/private keys are locked/)
+  })
+
+  it('should block sodium when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    await expect(keychain.sodium.getSodiumKeysFromSeed({})).rejects.toThrow(
+      /private keys are locked/
+    )
+    await expect(keychain.createSodiumEncryptor({}).getSodiumKeysFromSeed({})).rejects.toThrow(
+      /private keys are locked/
+    )
+  })
+
+  it('should block ed25519 when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    await expect(keychain.ed25519.signBuffer({})).rejects.toThrow(/private keys are locked/)
+    await expect(keychain.createEd25519Signer({}).signBuffer({})).rejects.toThrow(
+      /private keys are locked/
+    )
+  })
+
+  it('should block secp256k1 when locked', async () => {
+    const keychain = createKeychain({ seed })
+    keychain.lockPrivateKeys()
+    await expect(keychain.secp256k1.signBuffer({})).rejects.toThrow(/private keys are locked/)
+    await expect(keychain.createSecp256k1Signer({}).signBuffer({})).rejects.toThrow(
+      /private keys are locked/
+    )
+  })
+})

features/keychain/module/keychain.js

@@ -25,6 +25,8 @@ export const MODULE_ID = 'keychain'
 export class Keychain {
   #masters = Object.create(null)
   #legacyPrivToPub = null
+  #privateKeysAreLocked = false
+  #getPrivateHDKeySymbol = Symbol('getPrivateHDKey')
 
   // TODO: remove default param. Use it temporarily for backward compatibility.
   constructor({ legacyPrivToPub = Object.create(null) }) {
@@ -42,6 +44,32 @@ export class Keychain {
     this.secp256k1 = secp256k1.create({ getPrivateHDKey: this.#getPrivateHDKey })
   }
 
+  #assertPrivateKeysUnlocked() {
+    assert(!this.#privateKeysAreLocked, 'private keys are locked')
+  }
+
+  arePrivateKeysLocked() {
+    return this.#privateKeysAreLocked
+  }
+
+  lockPrivateKeys() {
+    this.#privateKeysAreLocked = true
+  }
+
+  unlockPrivateKeys(seeds) {
+    assert(this.#privateKeysAreLocked, 'already unlocked')
+    assert(
+      seeds?.length === Object.values(this.#masters).length,
+      'must pass in same number of seeds'
+    )
+    const seedIds = new Set(seeds.map((seed) => getSeedId(seed)))
+    for (const seedId of Object.keys(this.#masters)) {
+      assert(seedIds.has(seedId), 'must pass in existing seed')
+    }
+
+    this.#privateKeysAreLocked = false
+  }
+
   addSeed(seed) {
     assert(Buffer.isBuffer(seed) && seed.length === 64, 'seed must be buffer of 64 bytes')
     const masters = Object.assign(
@@ -59,7 +87,8 @@ export class Keychain {
     this.#masters = Object.create(null)
   }
 
-  #getPrivateHDKey = ({ seedId, keyId }) => {
+  #getPrivateHDKey = ({ seedId, keyId, getPrivateHDKeySymbol }) => {
+    if (getPrivateHDKeySymbol !== this.#getPrivateHDKeySymbol) this.#assertPrivateKeysUnlocked()
     throwIfInvalidKeyIdentifier(keyId)
 
     assert(typeof seedId === 'string', 'seedId must be a BIP32 key identifier in hex encoding')
@@ -72,9 +101,14 @@ export class Keychain {
   }
 
   async exportKey({ seedId, keyId, exportPrivate }) {
+    if (exportPrivate) this.#assertPrivateKeysUnlocked()
     keyId = new KeyIdentifier(keyId)
 
-    const hdkey = this.#getPrivateHDKey({ seedId, keyId })
+    const hdkey = this.#getPrivateHDKey({
+      seedId,
+      keyId,
+      getPrivateHDKeySymbol: this.#getPrivateHDKeySymbol,
+    })
     const privateKey = hdkey.privateKey
     let publicKey = hdkey.publicKey
 
@@ -101,6 +135,7 @@ export class Keychain {
   }
 
   async signTx({ seedId, keyIds, signTxCallback, unsignedTx }) {
+    this.#assertPrivateKeysUnlocked()
     assert(typeof signTxCallback === 'function', 'signTxCallback must be a function')
     const hdkeys = Object.fromEntries(
       keyIds.map((keyId) => {