Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SIWW auth #724

Merged
merged 9 commits into from
Sep 18, 2024
Merged

SIWW auth #724

merged 9 commits into from
Sep 18, 2024

Conversation

r-czajkowski
Copy link
Contributor

@r-czajkowski r-czajkowski commented Sep 11, 2024

This PR adds Sign-In With Wallet auth to the Acre dapp. When a user connects the wallet we create a session by sending a request to the Acre API backend. The session is valid for 3 hours.

SIWW flow:

  1. Dapp asks backend for the session.
  2. If the session exists and it matches the current connected address, a user is logged in.
  3. If a session exists but does not match the current connected address the dapp deletes the session and asks backend for a new nonce (session id).
  4. The user must sign the SIWW message with a given nonce.
  5. Dapp sends the signature, message, and public key to the backend to verify the signature.
  6. If the message is valid, the backend returns the session id in cookies and the user is logged in.

Works as expected. Need to clean up the code and handle errors.
Copy link

netlify bot commented Sep 11, 2024

Deploy Preview for acre-dapp-testnet ready!

Name Link
🔨 Latest commit
🔍 Latest deploy log https://app.netlify.com/sites/acre-dapp-testnet/deploys/66ea87d8ce9b65210b157ad2
😎 Deploy Preview https://deploy-preview-724--acre-dapp-testnet.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Copy link

netlify bot commented Sep 11, 2024

Deploy Preview for acre-dapp ready!

Name Link
🔨 Latest commit
🔍 Latest deploy log https://app.netlify.com/sites/acre-dapp/deploys/66ea87f4ae29c12a731b4ff6
😎 Deploy Preview https://deploy-preview-724--acre-dapp.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Move the Acre API requests to separate functions and set the Acre API
endpoint via env variables.
We should delete session when the backend returns `address` field and
that address is not equal to address returned by connector.
Copy link
Contributor

@kkosiorowska kkosiorowska left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not tested yet, I left a few minor comments.

dapp/src/utils/orangeKit.ts Outdated Show resolved Hide resolved
dapp/src/utils/index.ts Outdated Show resolved Hide resolved
dapp/src/constants/time.ts Outdated Show resolved Hide resolved
@r-czajkowski r-czajkowski marked this pull request as ready for review September 12, 2024 12:07
Pass the public key to create the session and update the flow when a
user changes the account and connects wallet again - we should delete
session (that was created for different account) and ask for a nonce to
create a new session for updated bitcoin address.
Use the time util function to set the `expirationTime` in
`SignInWithWalletMessage` constructor.
Use defined time values to create session expiration time.
kkosiorowska
kkosiorowska previously approved these changes Sep 13, 2024
Copy link
Contributor

@kkosiorowska kkosiorowska left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, I tested the solution and it seems to work well. 🚀🚀🚀

Screenshot 2024-09-13 at 10 30 57

We decided to extend the expiration time of the valid session for the
dapp to 7 days.
Copy link
Contributor

@kkosiorowska kkosiorowska left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested deploy previews and it seems to work well. 🚀

Screenshot 2024-09-18 at 10 03 25

Screenshot 2024-09-18 at 10 02 32

@kkosiorowska kkosiorowska merged commit bfe8ab0 into main Sep 18, 2024
28 checks passed
@kkosiorowska kkosiorowska deleted the siww-auth branch September 18, 2024 08:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants