Wallet auth

[valiafetisov]

Closes #52

[valiafetisov]

Current state: API service have fully working sign in with wallet functionality (manually testable). Next steps:

• Update frontend to use "Sign in with Ethereum" button
• Update tests to cover new API logic

Testing scenario

1. Create challenge via executing createChallenge graphql mutation

   • Example request (that have to contain your public etherium address)

     mutation {
         createChallenge(
             address: "paste_your_ethereum_address"
         ) {
             nonce
             message
             hex
         }
     }

   • Example response (that contains hex-encoded message)

     {
         "data": {
             "createChallenge": {
                 "nonce": "6f4c7f7cd61a499290e68a2740957407",
                 "message": "example.com wants you to sign in with your Ethereum account...",
                 "hex": "0x302e302e302e302077616e74732029..."
             }
         }
     }

     Where hex is just hex-encoded message that actually needs to be signed

2. Sign provided message

   • Either using your metamask wallet

     // this should be executed at the browser console of the graphql playground
     await ethereum.request({
         method: 'personal_sign',
         params: [
             'paste_hex_from_the_above',
             'paste_your_ethereum_address'
         ]
     });

   • Or using foundry command line tool called cast (note: you will be asked for your private key; for other auth methods, read the cli docs)

     $ cast wallet sign -i "hex_from_the_above"

3. Provide signature back to the API to get usual JWT token back

   • Example request

     mutation {
         solveChallenge(
             nonce: "paste_nonce_from_step_1"
             signature: "paste_signature_from_step_2"
         ) {
             token
         }
     }

   • Example response

     {
         "data": {
             "solveChallenge": {
                 "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uSWQiOiI5ZGM1NjI3Mi1hMjBjLTRmM2YtYjM5MC1kZDc2NjE1NTA0YTYiLCJpYXQiOjE2ODczMzc2MDEsImV4cCI6MTY4Nzk0MjQwMX0.z1lJlKXnCbcex59JkU9j7hfRGhR2EBrnUE8phwPN7C0"
             }
         }
     }

4. Use provided JWT token to make subsequent API requests

   • Either sent as Authorization: Bearer paste_token_from_step_3
   • Or set as Authorization cookie
   • Example request

     query {
         me {
             address
         }
     }

[LukSteib]

Approved based on screenshared review. What we might still adjust:

• Make it work in the docker based setup

[LukSteib]

• Re-checked via docker and worked as expected ✔️
• Checked reference implementation (here) - no further feedback based on that, so all good ✔️

One remaining question (non approval blocking):
Tried browser session without metamask extension and received the following error:

Sign in error: could not coalesce error (error={ "message": "Cannot read properties of undefined (reading 'request')" }, code=UNKNOWN_ERROR, version=6.6.1)

Assume this is expected, right?

[valiafetisov]

Assume this is expected, right?

No, I actually haven't tested it. Updated the code with a better error message "Please install web-based wallet such as Metamask".

[LukSteib]

• Still getting the following error message: Sign in error: could not coalesce error (error={ "message": "Cannot read properties of undefined (reading 'request')" }, code=UNKNOWN_ERROR, version=6.6.1) -> not the one from latest commit

[valiafetisov]

Still getting the following error message

Can you please give me more details about your setup? How do you reach this error, what extensions do you have installed? Which browser do you use?

I previously was able to reproduce, fix and test the error myself in safari (without any installed extensions):

[LukSteib]

Just didn't recreate the docker images in the first place :(
My bad...

Updated error message works ✔️

Approved