feat: support resumable client authentication

Author: cesarenaldi

packages/client/src/auth.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest';
+import { fetchApiKeys } from './actions';
+import { createTestWalletClient, publicClient } from './testing';
+import { authenticateWith } from './viem';
+
+const walletClient = createTestWalletClient();
+
+describe('clients', () => {
+  describe('PublicClient.beginAuthentication', () => {
+    it('authenticates a secure client from an authentication workflow', async () => {
+      const secureClient = await publicClient
+        .beginAuthentication()
+        .then(authenticateWith(walletClient));
+
+      await expect(fetchApiKeys(secureClient)).resolves.toBeDefined();
+    });
+
+    it('authenticates with a non-zero nonce', async () => {
+      const secureClient = await publicClient
+        .beginAuthentication({ nonce: 1 })
+        .then(authenticateWith(walletClient));
+
+      await expect(fetchApiKeys(secureClient)).resolves.toBeDefined();
+    });
+
+    it('reuses stored credentials during authentication when they remain valid', async () => {
+      const initialClient = await publicClient
+        .beginAuthentication()
+        .then(authenticateWith(walletClient));
+
+      const secureClient = await publicClient
+        .beginAuthentication({ credentials: initialClient.credentials })
+        .then(authenticateWith(walletClient));
+
+      await expect(fetchApiKeys(secureClient)).resolves.toBeDefined();
+    });
+  });
+});

packages/client/src/clients.test.ts

@@ -1,11 +1,12 @@
 import type { ApiKeyCreds } from '@polymarket/bindings/clob';
 import { expectEvmAddress, expectSignature } from '@polymarket/types';
-import { createOrDeriveApiKey } from './actions/auth';
+import { createOrDeriveApiKey, fetchApiKeys } from './actions/auth';
 import {
   type AuthenticationWorkflow,
   createL2AuthTypedDataPayload,
 } from './authentication';
 import { type EnvironmentConfig, production } from './environments';
+import { RequestRejectedError } from './errors';
 import { ServiceClient } from './ServiceClient';
 
 export type PublicClientConfig = {
@@ -17,6 +18,10 @@ export type PublicClientConfig = {
   environment?: EnvironmentConfig;
 };
 
+export type BeginAuthenticationOptions =
+  | { credentials: ApiKeyCreds }
+  | { nonce: number };
+
 type Context = {
   /** @internal */
   environment: EnvironmentConfig;
@@ -29,6 +34,8 @@ type Context = {
 };
 
 type SecureContext = Context & {
+  /** @internal */
+  address: string;
   /** @internal */
   credentials: ApiKeyCreds;
 };
@@ -66,40 +73,75 @@ class PublicClient extends AbstractClient<Context> {
     throw new Error('resume is not implemented yet');
   }
 
-  beginAuthentication(): Promise<AuthenticationWorkflow> {
+  beginAuthentication(
+    options?: BeginAuthenticationOptions,
+  ): Promise<AuthenticationWorkflow> {
     return Promise.resolve(
       async function* (this: PublicClient): AuthenticationWorkflow {
         const timestamp = Math.floor(Date.now() / 1000);
+        const nonce =
+          options !== undefined && 'nonce' in options ? options.nonce : 0;
         const address = expectEvmAddress(yield { kind: 'requestAddress' });
+
+        if (options !== undefined && 'credentials' in options) {
+          const client = this.createSecureClient(options.credentials, address);
+
+          try {
+            if (
+              (await fetchApiKeys(client)).includes(options.credentials.key)
+            ) {
+              return client;
+            }
+          } catch (error) {
+            if (
+              !(error instanceof RequestRejectedError) ||
+              error.status !== 401
+            ) {
+              throw error;
+            }
+          }
+        }
+
         const signature = yield {
           kind: 'signAuthMessage',
           payload: createL2AuthTypedDataPayload({
             address,
             chainId: this.environment.chainId,
+            nonce,
             timestamp,
           }),
         };
         const credentials = await createOrDeriveApiKey(this, {
           address,
-          nonce: 0,
+          nonce,
           signature: expectSignature(signature),
           timestamp,
         });
 
-        return new SecureClient({
-          ...this.context,
-          credentials,
-        });
+        return this.createSecureClient(credentials, address);
       }.call(this),
     );
   }
+
+  createSecureClient(credentials: ApiKeyCreds, address: string): SecureClient {
+    return new SecureClient({
+      ...this.context,
+      address,
+      credentials,
+    });
+  }
 }
 
 class SecureClient extends AbstractClient<SecureContext> {
   /** @internal */
   get credentials(): ApiKeyCreds {
     return this.context.credentials;
   }
+
+  /** @internal */
+  get address(): string {
+    return this.context.address;
+  }
 }
 
 export type { PublicClient, SecureClient };