Add JWT authentication on top of SIWE contract auth

Author: ptrus

.env.example

@@ -30,3 +30,51 @@ ACCOUNTING_GAS_LIMIT=500000
 # Background service configuration
 DEPOSIT_POLL_INTERVAL=1
 WITHDRAWAL_POLL_INTERVAL=12
+
+# =============================================================================
+# JWT Authentication Configuration
+# =============================================================================
+
+# JWT token expiration time in hours (default: 12)
+# JWT_EXPIRY_HOURS=12
+
+# Refresh token expiration time in days (default: 7)
+# JWT_REFRESH_EXPIRY_DAYS=7
+
+# JWT issuer claim - identifies who issued the token (default: flexvaults)
+# JWT_ISSUER=flexvaults
+
+# JWT audience claim - identifies intended recipients (default: flexvaults)
+# JWT_AUDIENCE=flexvaults
+
+# =============================================================================
+# SIWE / AuthToken Configuration
+# =============================================================================
+
+# SIWE domain for authentication (required)
+# This must match the domain in client SIWE messages (e.g., "localhost:5173" or "flexvaults.com")
+SIWE_DOMAIN=localhost:5173
+
+# Directory for storing auth tokens and nonces (default: .auth_tokens)
+# Uses SQLite via diskcache for process-safe storage
+# AUTH_TOKEN_STORAGE_DIR=.auth_tokens
+
+# SIWE nonce expiration time in seconds (default: 300 = 5 minutes)
+# Bounds the window for SIWE message replay at the API level
+# SIWE_NONCE_EXPIRY_SECONDS=300
+
+# Auth token validity period in seconds (default: 86400 = 24 hours)
+# This is the lifetime of SIWE-based auth tokens for contract view calls
+# AUTH_TOKEN_VALIDITY_SECONDS=86400
+
+# =============================================================================
+# TEE / ROFL Key Management
+# =============================================================================
+
+# TODO: Remove DISABLE_ROFL_KEYS when Sapphire localnet e2e tests are available.
+# Set to "1" to disable ROFL-derived keys (for local development/testing)
+# When disabled:
+#   - JWT signing uses randomly generated Ed25519 keys (not persistent across restarts)
+#   - AuthToken encryption uses deterministic test key (bytes32(1))
+# In production (ROFL TEE), keys are derived from TEE-bound seeds for persistence
+# DISABLE_ROFL_KEYS=1

Makefile

@@ -10,7 +10,7 @@ run:
 	uv run python -m src.main
 
 test:
-	uv run pytest
+	DISABLE_ROFL_KEYS=1 uv run pytest
 
 lint:
 	uv run ruff check src test

pyproject.toml

@@ -19,6 +19,10 @@ dependencies = [
     "oasis-rofl-client>=0.2.0",
     "oasis-sapphire-py>=0.4.0",
     "cachetools>=5.0.0",
+    "siwe>=4.3.0",
+    "PyJWT>=2.8.0",
+    "cryptography>=41.0.0",
+    "diskcache>=5.6.3",
 ]
 
 [project.optional-dependencies]

solidity/bun.lock

@@ -1,14 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
-
 import {SignatureRSV, A13e} from "@oasisprotocol/sapphire-contracts/contracts/auth/A13e.sol";
-import {
-    ParsedSiweMessage,
-    SiweParser
-} from "@oasisprotocol/sapphire-contracts/contracts/SiweParser.sol";
 import {Sapphire} from "@oasisprotocol/sapphire-contracts/contracts/Sapphire.sol";
+import {Subcall} from "@oasisprotocol/sapphire-contracts/contracts/Subcall.sol";
 
 /// @title AuthToken structure for SIWE-based authentication
 struct AuthToken {
@@ -31,29 +26,28 @@ struct AuthToken {
  * The authentication logic (login/authMsgSender) is only supported on Sapphire chains.
  */
 contract AccountingSiweAuth is A13e {
-    string internal _domain;
     bytes32 private _authTokenEncKey;
-    uint256 private constant DEFAULT_VALIDITY = 24 hours;
+    bytes21 private _roflAppId;
 
     error SiweAuth_UnsupportedChain();
-    error SiweAuth_ChainIdMismatch();
-    error SiweAuth_DomainMismatch();
-    error SiweAuth_AddressMismatch();
-    error SiweAuth_NotBeforeInFuture();
     error SiweAuth_Expired();
+    error SiweAuth_NotAuthorizedRofl();
+    error SiweAuth_LoginDisabled();
 
-    constructor(string memory inDomain) {
-        _domain = inDomain;
+    constructor(bytes21 inRoflAppId) {
+        _roflAppId = inRoflAppId;
 
-        if (_isSapphireChainId(block.chainid)) {
-            _authTokenEncKey = bytes32(Sapphire.randomBytes(32, ""));
-        } else {
+        // TODO: Remove non-Sapphire fallback when Sapphire localnet e2e tests are available.
+        // This allows deployment on Hardhat/local networks for unit testing.
+        if (!_isSapphireChainId(block.chainid)) {
             // Deterministic key for non-Sapphire local test networks (e.g., Hardhat).
             // Authentication is not expected to be used off-Sapphire.
+            // On Sapphire, the ROFL service will set the key via setAuthTokenEncKey().
             _authTokenEncKey = bytes32(uint256(1));
         }
     }
 
+    // TODO: Remove when Sapphire localnet e2e tests are available.
     function _isSapphireChainId(uint256 chainId) private pure returns (bool) {
         return chainId == 0x5afe || chainId == 0x5aff || chainId == 0x5afd;
     }
@@ -64,73 +58,30 @@ contract AccountingSiweAuth is A13e {
         }
     }
 
-    function login(string calldata siweMsg, SignatureRSV calldata sig)
+    /// @notice Set the AuthToken encryption key. Can only be called by the authorized ROFL app.
+    /// @dev The ROFL app ID is set at deployment. Only that app can call this function.
+    /// @param newKey The 32-byte Deoxys-II encryption key.
+    function setAuthTokenEncKey(bytes32 newKey) external {
+        if (Subcall.getRoflAppId() != _roflAppId) {
+            revert SiweAuth_NotAuthorizedRofl();
+        }
+        _authTokenEncKey = newKey;
+    }
+
+    /// @notice Login is disabled - use the REST API instead.
+    /// @dev This function is kept for A13e interface compatibility but always reverts.
+    ///      The REST service generates and encrypts AuthTokens directly.
+    function login(string calldata, SignatureRSV calldata)
         external
-        view
+        pure
         override
         returns (bytes memory)
     {
-        _requireSapphire();
-
-        AuthToken memory b;
-
-        // Derive the user's address from the signature.
-        bytes memory eip191msg = abi.encodePacked(
-            "\x19Ethereum Signed Message:\n",
-            Strings.toString(bytes(siweMsg).length),
-            siweMsg
-        );
-        address addr = ecrecover(
-            keccak256(eip191msg),
-            uint8(sig.v),
-            sig.r,
-            sig.s
-        );
-        b.userAddr = addr;
-
-        ParsedSiweMessage memory p = SiweParser.parseSiweMsg(bytes(siweMsg));
-
-        if (p.chainId != block.chainid) {
-            revert SiweAuth_ChainIdMismatch();
-        }
-
-        if (keccak256(p.schemeDomain) != keccak256(bytes(_domain))) {
-            revert SiweAuth_DomainMismatch();
-        }
-        b.domain = string(p.schemeDomain);
-
-        if (p.addr != addr) {
-            revert SiweAuth_AddressMismatch();
-        }
-
-        if (
-            p.notBefore.length != 0 &&
-            block.timestamp <= SiweParser.timestampFromIso(p.notBefore)
-        ) {
-            revert SiweAuth_NotBeforeInFuture();
-        }
-
-        if (p.expirationTime.length != 0) {
-            b.validUntil = SiweParser.timestampFromIso(p.expirationTime);
-        } else {
-            b.validUntil = block.timestamp + DEFAULT_VALIDITY;
-        }
-        if (block.timestamp >= b.validUntil) {
-            revert SiweAuth_Expired();
-        }
-
-        b.statement = string(p.statement);
-
-        b.resources = new string[](p.resources.length);
-        for (uint256 i = 0; i < p.resources.length; i++) {
-            b.resources[i] = string(p.resources[i]);
-        }
-
-        return Sapphire.encrypt(_authTokenEncKey, 0, abi.encode(b), "");
+        revert SiweAuth_LoginDisabled();
     }
 
-    function domain() public view returns (string memory) {
-        return _domain;
+    function roflAppId() public view returns (bytes21) {
+        return _roflAppId;
     }
 
     function authMsgSender(bytes memory token)
@@ -166,10 +117,6 @@ contract AccountingSiweAuth is A13e {
         );
         AuthToken memory b = abi.decode(authTokenEncoded, (AuthToken));
 
-        if (keccak256(bytes(b.domain)) != keccak256(bytes(_domain))) {
-            revert SiweAuth_DomainMismatch();
-        }
-
         if (b.validUntil < block.timestamp) {
             revert SiweAuth_Expired();
         }

solidity/contracts/auth/AccountingSiweAuth.sol

@@ -3,4 +3,6 @@ pragma solidity ^0.8.20;
 
 interface IAccountingSiweAuth {
     function authSender(bytes calldata token) external view returns (address);
+    function setAuthTokenEncKey(bytes32 newKey) external;
+    function roflAppId() external view returns (bytes21);
 }

solidity/contracts/interfaces/IAccountingSiweAuth.sol

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.20;
+
+import {AuthToken} from "../auth/AccountingSiweAuth.sol";
+
+/**
+ * @title MockAuthTokenDecrypt
+ * @notice Test helper for verifying AuthToken ABI encoding compatibility between Python and Solidity.
+ * @dev This contract allows testing the ABI decoding of AuthTokens without requiring Sapphire's
+ *      encryption. Used to verify that Python's eth_abi encoding matches Solidity's abi.decode.
+ *
+ *      The real AccountingSiweAuth uses Sapphire.decrypt() which is only available on Sapphire.
+ *      This mock skips decryption and decodes tokens directly, testing only the struct format.
+ *
+ * TODO: Remove this mock when Sapphire localnet e2e tests are available.
+ */
+contract MockAuthTokenDecrypt {
+    uint256 private constant DEFAULT_VALIDITY = 24 hours;
+
+    error SiweAuth_Expired();
+    error SiweAuth_InvalidTokenFormat();
+
+    constructor() {}
+
+    /**
+     * @notice Decode an ABI-encoded AuthToken and return the user address.
+     * @dev This simulates what authMsgSender() does after decryption on Sapphire.
+     * @param encodedToken ABI-encoded AuthToken (NOT encrypted, for testing only)
+     * @return userAddr The user address from the token
+     */
+    function decodeAuthToken(bytes calldata encodedToken) external view returns (address userAddr) {
+        AuthToken memory token = _decodeAndValidate(encodedToken);
+        return token.userAddr;
+    }
+
+    /**
+     * @notice Decode and return all fields of an AuthToken for testing.
+     * @param encodedToken ABI-encoded AuthToken
+     */
+    function decodeAuthTokenFull(
+        bytes calldata encodedToken
+    )
+        external
+        view
+        returns (
+            string memory tokenDomain,
+            address userAddr,
+            uint256 validUntil,
+            string memory statement,
+            string[] memory resources
+        )
+    {
+        AuthToken memory token = _decodeAndValidate(encodedToken);
+        return (token.domain, token.userAddr, token.validUntil, token.statement, token.resources);
+    }
+
+    /**
+     * @notice Try to decode a token and return success/failure.
+     * @dev Useful for testing invalid token formats without reverting.
+     */
+    function tryDecodeAuthToken(bytes calldata encodedToken) external view returns (bool success, address userAddr) {
+        try this.decodeAuthToken(encodedToken) returns (address addr) {
+            return (true, addr);
+        } catch {
+            return (false, address(0));
+        }
+    }
+
+    /**
+     * @notice Decode and validate an AuthToken.
+     * @dev Performs expiry validation, matching AccountingSiweAuth behavior.
+     */
+    function _decodeAndValidate(bytes calldata encodedToken) internal view returns (AuthToken memory) {
+        if (encodedToken.length == 0) {
+            revert SiweAuth_InvalidTokenFormat();
+        }
+
+        // Decode the AuthToken struct
+        AuthToken memory token = abi.decode(encodedToken, (AuthToken));
+
+        // Validate token hasn't expired
+        if (token.validUntil < block.timestamp) {
+            revert SiweAuth_Expired();
+        }
+
+        return token;
+    }
+
+    /**
+     * @notice Encode an AuthToken to bytes for test vector generation.
+     * @dev Generates ABI-encoded AuthToken that Python should produce identically.
+     */
+    function encodeAuthToken(
+        string calldata tokenDomain,
+        address userAddr,
+        uint256 validUntil,
+        string calldata statement,
+        string[] calldata resources
+    ) external pure returns (bytes memory) {
+        AuthToken memory token = AuthToken({
+            domain: tokenDomain,
+            userAddr: userAddr,
+            validUntil: validUntil,
+            statement: statement,
+            resources: resources
+        });
+        return abi.encode(token);
+    }
+}

solidity/contracts/test/MockAuthTokenDecrypt.sol

@@ -27,7 +27,7 @@
     "@nomicfoundation/hardhat-toolbox": "^4.0.0",
     "@nomicfoundation/hardhat-verify": "^2.0.2",
     "@openzeppelin/hardhat-upgrades": "^3.0.0",
-    "@oasisprotocol/sapphire-contracts": "^0.2.14",
+    "@oasisprotocol/sapphire-contracts": "0.2.15",
     "@oasisprotocol/sapphire-hardhat": "^2.22.2",
     "@oasisprotocol/sapphire-paratime": "^2.3.0",
     "@typechain/ethers-v6": "^0.5.1",
@@ -71,6 +71,7 @@
   "dependencies": {
     "@openzeppelin/contracts": "~5.4.0",
     "@openzeppelin/contracts-upgradeable": "~5.4.0",
+    "bech32": "^1.1.4",
     "cbor": "^10.0.11",
     "solidity-rlp": "^2.0.8"
   }

solidity/package.json

@@ -1,15 +1,19 @@
 import { task } from "hardhat/config";
+import { parseRoflAppId } from "./utils/rofl";
 
 task("deploy")
   .addParam("shoyubashi", "The address of the ShoyuBashi oracle")
   .addParam("provethverifier", "The address of the ProvethVerifier contract")
-  .addParam("domain", "The SIWE domain for authenticated view calls")
+  .addParam("roflappid", "The ROFL app ID (hex 0x... or bech32 rofl1...)")
   .setAction(async (args, hre) => {
     const [deployer] = await hre.ethers.getSigners();
 
+    // Parse ROFL app ID (supports hex and bech32 formats)
+    const roflAppIdHex = parseRoflAppId(args.roflappid);
+
     // Deploy AccountingSiweAuth
     const AccountingSiweAuth = await hre.ethers.getContractFactory("AccountingSiweAuth");
-    const siweAuth = await AccountingSiweAuth.deploy(args.domain, {
+    const siweAuth = await AccountingSiweAuth.deploy(roflAppIdHex, {
       gasLimit: 10000000
     });
     await siweAuth.waitForDeployment();