fix: route auth requests through configured auth transport

Author: thesimplekid

crates/cdk/src/wallet/auth/auth_wallet.rs

@@ -63,13 +63,32 @@ impl AuthWallet {
         oidc_client: Option<OidcClient>,
     ) -> Self {
         let http_client = Arc::new(AuthHttpClient::new(mint_url.clone(), cat));
+        Self::new_with_client(
+            mint_url,
+            localstore,
+            metadata_cache,
+            protected_endpoints,
+            oidc_client,
+            http_client,
+        )
+    }
+
+    /// Create a new [`AuthWallet`] instance with a provided auth connector
+    pub fn new_with_client(
+        mint_url: MintUrl,
+        localstore: Arc<dyn WalletDatabase<database::Error> + Send + Sync>,
+        metadata_cache: Arc<MintMetadataCache>,
+        protected_endpoints: HashMap<ProtectedEndpoint, AuthRequired>,
+        oidc_client: Option<OidcClient>,
+        auth_client: Arc<dyn AuthMintConnector + Send + Sync>,
+    ) -> Self {
         Self {
             mint_url,
             localstore,
             metadata_cache,
             protected_endpoints: Arc::new(RwLock::new(protected_endpoints)),
             refresh_token: Arc::new(RwLock::new(None)),
-            auth_client: http_client,
+            auth_client,
             oidc_client: Arc::new(RwLock::new(oidc_client)),
         }
     }

crates/cdk/src/wallet/builder.rs

@@ -10,7 +10,7 @@ use crate::cdk_database::WalletDatabase;
 use crate::error::Error;
 use crate::mint_url::MintUrl;
 use crate::nuts::CurrencyUnit;
-use crate::wallet::auth::AuthWallet;
+use crate::wallet::auth::{AuthMintConnector, AuthWallet};
 use crate::wallet::mint_metadata_cache::MintMetadataCache;
 use crate::wallet::{HttpClient, MintConnector, SubscriptionManager, Wallet};
 
@@ -21,6 +21,7 @@ pub struct WalletBuilder {
     localstore: Option<Arc<dyn WalletDatabase<database::Error> + Send + Sync>>,
     target_proof_count: Option<usize>,
     auth_wallet: Option<AuthWallet>,
+    auth_connector: Option<Arc<dyn AuthMintConnector + Send + Sync>>,
     seed: Option<[u8; 64]>,
     use_http_subscription: bool,
     client: Option<Arc<dyn MintConnector + Send + Sync>>,
@@ -47,6 +48,7 @@ impl Default for WalletBuilder {
             localstore: None,
             target_proof_count: Some(3),
             auth_wallet: None,
+            auth_connector: None,
             seed: None,
             client: None,
             metadata_cache_ttl: Some(Duration::from_secs(3600)),
@@ -128,6 +130,15 @@ impl WalletBuilder {
         self
     }
 
+    /// Set the auth connector used when an auth wallet is created from mint info
+    pub fn auth_connector(
+        mut self,
+        auth_connector: Arc<dyn AuthMintConnector + Send + Sync>,
+    ) -> Self {
+        self.auth_connector = Some(auth_connector);
+        self
+    }
+
     /// Set the seed bytes
     pub fn seed(mut self, seed: [u8; 64]) -> Self {
         self.seed.zeroize();
@@ -249,6 +260,7 @@ impl WalletBuilder {
             metadata_cache,
             target_proof_count: self.target_proof_count.unwrap_or(3),
             auth_wallet: Arc::new(TokioRwLock::new(auth_wallet)),
+            auth_connector: self.auth_connector.take(),
             #[cfg(feature = "npubcash")]
             npubcash_client: Arc::new(TokioRwLock::new(None)),
             seed,

crates/cdk/src/wallet/mint_connector/http_client.rs

@@ -870,6 +870,35 @@ where
             )),
         }
     }
+
+    /// Create new [`AuthHttpClient`] with a provided transport implementation.
+    pub fn with_transport(mint_url: MintUrl, transport: T, cat: Option<AuthToken>) -> Self {
+        Self {
+            transport: transport.into(),
+            mint_url,
+            cat: Arc::new(RwLock::new(
+                cat.unwrap_or(AuthToken::ClearAuth("".to_string())),
+            )),
+        }
+    }
+
+    /// Create new [`AuthHttpClient`] with a proxy for specific TLDs.
+    /// Specifying `None` for `host_matcher` will use the proxy for all
+    /// requests.
+    pub fn with_proxy(
+        mint_url: MintUrl,
+        proxy: Url,
+        host_matcher: Option<&str>,
+        accept_invalid_certs: bool,
+        cat: Option<AuthToken>,
+    ) -> Result<Self, Error> {
+        let mut transport = T::default();
+        transport
+            .with_proxy(proxy, host_matcher, accept_invalid_certs)
+            .map_err(HttpClient::<T>::map_http_error)?;
+
+        Ok(Self::with_transport(mint_url, transport, cat))
+    }
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]

crates/cdk/src/wallet/mint_connector/mod.rs

@@ -25,6 +25,9 @@ pub mod transport;
 pub type AuthHttpClient = http_client::AuthHttpClient<transport::Async>;
 /// Default Http Client with async transport (non-Tor)
 pub type HttpClient = http_client::HttpClient<transport::Async>;
+/// Tor Auth HTTP Client with async transport (only when `tor` feature is enabled and not on wasm32)
+#[cfg(all(feature = "tor", not(target_arch = "wasm32")))]
+pub type TorAuthHttpClient = http_client::AuthHttpClient<transport::TorAsync>;
 /// Tor Http Client with async transport (only when `tor` feature is enabled and not on wasm32)
 #[cfg(all(feature = "tor", not(target_arch = "wasm32")))]
 pub type TorHttpClient = http_client::HttpClient<transport::TorAsync>;

crates/cdk/src/wallet/mod.rs

@@ -42,7 +42,7 @@ mod blind_signature;
 #[cfg(feature = "nostr")]
 mod nostr_backup;
 #[cfg(all(feature = "tor", not(target_arch = "wasm32")))]
-pub use mint_connector::TorHttpClient;
+pub use mint_connector::{TorAuthHttpClient, TorHttpClient};
 mod balance;
 mod builder;
 mod issue;
@@ -130,6 +130,7 @@ pub struct Wallet {
     /// The targeted amount of proofs to have at each size
     pub target_proof_count: usize,
     auth_wallet: Arc<TokioRwLock<Option<AuthWallet>>>,
+    auth_connector: Option<Arc<dyn AuthMintConnector + Send + Sync>>,
     #[cfg(feature = "npubcash")]
     npubcash_client: Arc<TokioRwLock<Option<Arc<cdk_npubcash::NpubCashClient>>>>,
     seed: [u8; 64],
@@ -434,14 +435,24 @@ impl Wallet {
                     None => {
                         tracing::info!("Mint has auth enabled; creating auth wallet");
 
-                        let new_auth_wallet = AuthWallet::new(
-                            self.mint_url.clone(),
-                            None,
-                            self.localstore.clone(),
-                            self.metadata_cache.clone(),
-                            protected_endpoints,
-                            oidc_client,
-                        );
+                        let new_auth_wallet = match self.auth_connector.as_ref() {
+                            Some(auth_connector) => AuthWallet::new_with_client(
+                                self.mint_url.clone(),
+                                self.localstore.clone(),
+                                self.metadata_cache.clone(),
+                                protected_endpoints,
+                                oidc_client,
+                                auth_connector.clone(),
+                            ),
+                            None => AuthWallet::new(
+                                self.mint_url.clone(),
+                                None,
+                                self.localstore.clone(),
+                                self.metadata_cache.clone(),
+                                protected_endpoints,
+                                oidc_client,
+                            ),
+                        };
                         *auth_wallet = Some(new_auth_wallet.clone());
 
                         self.client
@@ -993,10 +1004,106 @@ impl Drop for Wallet {
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Mutex;
+
+    use async_trait::async_trait;
+    use bitcoin::bip32::DerivationPath;
+    use bitcoin::secp256k1::Secp256k1;
+    use cdk_common::nut02::KeySetVersion;
+    use cdk_common::nuts::{KeySet, KeySetInfo, KeysetResponse, MintKeySet};
+
     use super::*;
-    use crate::nuts::{BlindSignature, BlindedMessage, PreMint, PreMintSecrets};
+    use crate::nuts::{AuthToken, BlindSignature, BlindedMessage, PreMint, PreMintSecrets};
     use crate::secret::Secret;
 
+    fn build_test_auth_keyset(seed_byte: u8) -> KeySet {
+        let secp = Secp256k1::new();
+        let seed = [seed_byte; 32];
+        let path = DerivationPath::from_str("m/0'").expect("valid derivation path");
+        let mint_keyset = MintKeySet::generate_from_seed(
+            &secp,
+            &seed,
+            &[1, 2],
+            CurrencyUnit::Auth,
+            path,
+            0,
+            None,
+            KeySetVersion::Version00,
+        );
+
+        KeySet {
+            id: mint_keyset.id,
+            unit: mint_keyset.unit.clone(),
+            active: None,
+            keys: mint_keyset.keys.into(),
+            input_fee_ppk: mint_keyset.input_fee_ppk,
+            final_expiry: mint_keyset.final_expiry,
+        }
+    }
+
+    #[derive(Debug)]
+    struct CountingAuthConnector {
+        keyset: KeySet,
+        keysets_calls: Arc<Mutex<usize>>,
+        keyset_calls: Arc<Mutex<usize>>,
+    }
+
+    impl CountingAuthConnector {
+        fn new(keyset: KeySet) -> Self {
+            Self {
+                keyset,
+                keysets_calls: Arc::new(Mutex::new(0)),
+                keyset_calls: Arc::new(Mutex::new(0)),
+            }
+        }
+    }
+
+    #[async_trait]
+    impl AuthMintConnector for CountingAuthConnector {
+        async fn get_auth_token(&self) -> Result<AuthToken, Error> {
+            Ok(AuthToken::ClearAuth("dummy".to_string()))
+        }
+
+        async fn set_auth_token(&self, _: AuthToken) -> Result<(), Error> {
+            Ok(())
+        }
+
+        async fn get_mint_info(&self) -> Result<MintInfo, Error> {
+            Ok(MintInfo::default())
+        }
+
+        async fn get_mint_blind_auth_keyset(&self, keyset_id: Id) -> Result<KeySet, Error> {
+            *self.keyset_calls.lock().expect("lock") += 1;
+            if keyset_id == self.keyset.id {
+                Ok(self.keyset.clone())
+            } else {
+                Err(Error::UnknownKeySet)
+            }
+        }
+
+        async fn get_mint_blind_auth_keysets(&self) -> Result<KeysetResponse, Error> {
+            *self.keysets_calls.lock().expect("lock") += 1;
+            Ok(KeysetResponse {
+                keysets: vec![KeySetInfo {
+                    id: self.keyset.id,
+                    unit: CurrencyUnit::Auth,
+                    active: true,
+                    input_fee_ppk: self.keyset.input_fee_ppk,
+                    final_expiry: self.keyset.final_expiry,
+                }],
+            })
+        }
+
+        async fn post_mint_blind_auth(
+            &self,
+            _: crate::nuts::nut22::MintAuthRequest,
+        ) -> Result<crate::nuts::MintResponse, Error> {
+            Err(Error::Custom(
+                "post_mint_blind_auth is not used in this test".to_string(),
+            ))
+        }
+    }
+
     /// Test that restore signature matching works correctly when response is in order
     #[test]
     fn test_restore_signature_matching_in_order() {
@@ -1332,4 +1439,41 @@ mod tests {
             result
         );
     }
+
+    #[tokio::test]
+    async fn fetch_mint_info_uses_configured_auth_connector_for_auth_settings() {
+        use crate::wallet::test_utils::{
+            create_test_db, test_mint_info, test_mint_url, MockMintConnector,
+        };
+
+        let db = create_test_db().await;
+        let mock_client = Arc::new(MockMintConnector::new());
+        let mut mint_info = test_mint_info();
+        mint_info.time = None;
+        mint_info.nuts.nut22 = Some(crate::nuts::BlindAuthSettings::new(10, Vec::new()));
+        mock_client.set_mint_info_response(Ok(mint_info));
+
+        let auth_connector = Arc::new(CountingAuthConnector::new(build_test_auth_keyset(1)));
+        let keysets_calls = auth_connector.keysets_calls.clone();
+        let keyset_calls = auth_connector.keyset_calls.clone();
+
+        let wallet = WalletBuilder::new()
+            .mint_url(test_mint_url())
+            .unit(CurrencyUnit::Sat)
+            .localstore(db)
+            .seed([0u8; 64])
+            .shared_client(mock_client)
+            .auth_connector(auth_connector)
+            .build()
+            .expect("wallet should build");
+
+        wallet
+            .fetch_mint_info()
+            .await
+            .expect("mint info should load and auth keysets should refresh from mock connector");
+
+        assert!(wallet.auth_wallet.read().await.is_some());
+        assert_eq!(*keysets_calls.lock().expect("lock"), 1);
+        assert_eq!(*keyset_calls.lock().expect("lock"), 1);
+    }
 }