feat: notifications - user storage controller

app/scripts/controllers/user-storage/auth-snap-requests.ts

@@ -0,0 +1,18 @@
+import { SnapId } from '@metamask/snaps-sdk';
+import { HandlerType } from '@metamask/snaps-utils';
+
+const snapId = 'npm:@metamask/message-signing-snap' as SnapId;
+
+export function createSnapSignMessageRequest(message: `metamask:${string}`) {
+  return {
+    snapId,
+    origin: '',
+    handler: HandlerType.OnRpcRequest,
+    request: {
+      jsonrpc: '2.0',
+      method: 'signMessage',
+      params: { message },
+      id: 1,
+    },
+  };
+}

app/scripts/controllers/user-storage/encryption.ts

@@ -0,0 +1,117 @@
+import sjcl from 'sjcl';
+
+// Encryption / Decryption taken from - https://github.com/luke-park/SecureCompatibleEncryptionExamples/blob/master/TypeScript/SCEE-sjcl.ts
+class EncryptorDecryptor {
+  #BITS_PER_WORD = 32;
+
+  #ALGORITHM_NONCE_SIZE = 3; // 32-bit words.
+
+  #ALGORITHM_KEY_SIZE = 4; // 32-bit words.
+
+  #PBKDF2_SALT_SIZE = 4; // 32-bit words.
+
+  #PBKDF2_ITERATIONS = 32767;
+
+  encryptString = (plaintext: string, password: string): string => {
+    // Generate a 128-bit salt using a CSPRNG.
+    const salt = sjcl.random.randomWords(this.#PBKDF2_SALT_SIZE);
+
+    // Derive a key using PBKDF2.
+    const key = sjcl.misc.pbkdf2(
+      password,
+      salt,
+      this.#PBKDF2_ITERATIONS,
+      this.#ALGORITHM_KEY_SIZE * this.#BITS_PER_WORD,
+    );
+
+    // Encrypt and prepend salt.
+    const plaintextRaw = sjcl.codec.utf8String.toBits(plaintext);
+    const ciphertextAndNonceAndSalt = sjcl.bitArray.concat(
+      salt,
+      this.#encrypt(plaintextRaw, key),
+    );
+
+    return sjcl.codec.base64.fromBits(ciphertextAndNonceAndSalt);
+  };
+
+  decryptString = (
+    base64CiphertextAndNonceAndSalt: string,
+    password: string,
+  ): string => {
+    // Decode the base64.
+    const ciphertextAndNonceAndSalt = sjcl.codec.base64.toBits(
+      base64CiphertextAndNonceAndSalt,
+    );
+
+    // Create buffers of salt and ciphertextAndNonce.
+    const salt = sjcl.bitArray.bitSlice(
+      ciphertextAndNonceAndSalt,
+      0,
+      this.#PBKDF2_SALT_SIZE * this.#BITS_PER_WORD,
+    );
+
+    const ciphertextAndNonce = sjcl.bitArray.bitSlice(
+      ciphertextAndNonceAndSalt,
+      this.#PBKDF2_SALT_SIZE * this.#BITS_PER_WORD,
+      ciphertextAndNonceAndSalt.length * this.#BITS_PER_WORD,
+    );
+
+    // Derive the key using PBKDF2.
+    const key = sjcl.misc.pbkdf2(
+      password,
+      salt,
+      this.#PBKDF2_ITERATIONS,
+      this.#ALGORITHM_KEY_SIZE * this.#BITS_PER_WORD,
+    );
+
+    // Decrypt and return result.
+    return sjcl.codec.utf8String.fromBits(
+      this.#decrypt(ciphertextAndNonce, key),
+    );
+  };
+
+  #encrypt = (plaintext: sjcl.BitArray, key: number[]): sjcl.BitArray => {
+    // Generate a 96-bit nonce using a CSPRNG.
+    const nonce = sjcl.random.randomWords(this.#ALGORITHM_NONCE_SIZE);
+
+    // Encrypt and prepend nonce.
+    const ciphertext = sjcl.mode.gcm.encrypt(
+      // eslint-disable-next-line new-cap
+      new sjcl.cipher.aes(key),
+      plaintext,
+      nonce,
+    );
+
+    return sjcl.bitArray.concat(nonce, ciphertext);
+  };
+
+  #decrypt = (
+    ciphertextAndNonce: sjcl.BitArray,
+    key: number[],
+  ): sjcl.BitArray => {
+    // Create buffers of nonce and ciphertext.
+    const nonce = sjcl.bitArray.bitSlice(
+      ciphertextAndNonce,
+      0,
+      this.#ALGORITHM_NONCE_SIZE * this.#BITS_PER_WORD,
+    );
+
+    const ciphertext = sjcl.bitArray.bitSlice(
+      ciphertextAndNonce,
+      this.#ALGORITHM_NONCE_SIZE * this.#BITS_PER_WORD,
+      ciphertextAndNonce.length * this.#BITS_PER_WORD,
+    );
+
+    // Decrypt and return result.
+    // eslint-disable-next-line new-cap
+    return sjcl.mode.gcm.decrypt(new sjcl.cipher.aes(key), ciphertext, nonce);
+  };
+}
+
+const encryption = new EncryptorDecryptor();
+export default encryption;
+
+export function createSHA256Hash(data: string): string {
+  const hashedData = sjcl.hash.sha256.hash(data);
+  return sjcl.codec.hex.fromBits(hashedData);
+}

app/scripts/controllers/user-storage/mocks/mockServices.ts

@@ -0,0 +1,40 @@
+import nock from 'nock';
+import { USER_STORAGE_ENDPOINT, GetUserStorageResponse } from '../services';
+import { createEntryPath } from '../schema';
+import { MOCK_ENCRYPTED_STORAGE_DATA, MOCK_STORAGE_KEY } from './mockStorage';
+
+export const MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT = `${USER_STORAGE_ENDPOINT}${createEntryPath(
+  'notification_settings',
+  MOCK_STORAGE_KEY,
+)}`;
+
+type MockReply = {
+  status: number;
+  body?: Record<string, unknown>;
+};
+
+const MOCK_GET_USER_STORAGE_RESPONSE: GetUserStorageResponse = {
+  HashedKey: 'HASHED_KEY',
+  Data: MOCK_ENCRYPTED_STORAGE_DATA,
+};
+export function mockEndpointGetUserStorage(mockReply?: MockReply) {
+  const reply = mockReply ?? {
+    status: 200,
+    body: MOCK_GET_USER_STORAGE_RESPONSE,
+  };
+
+  const mockEndpoint = nock(MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT)
+    .get('')
+    .reply(reply.status, reply.body);
+
+  return mockEndpoint;
+}
+
+export function mockEndpointUpsertUserStorage(
+  mockReply?: Pick<MockReply, 'status'>,
+) {
+  const mockEndpoint = nock(MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT)
+    .put('')
+    .reply(mockReply?.status ?? 204);
+  return mockEndpoint;
+}

app/scripts/controllers/user-storage/mocks/mockStorage.ts

@@ -0,0 +1,9 @@
+import encryption, { createSHA256Hash } from '../encryption';
+
+export const MOCK_STORAGE_KEY_SIGNATURE = 'mockStorageKey';
+export const MOCK_STORAGE_KEY = createSHA256Hash(MOCK_STORAGE_KEY_SIGNATURE);
+export const MOCK_STORAGE_DATA = JSON.stringify({ hello: 'world' });
+export const MOCK_ENCRYPTED_STORAGE_DATA = encryption.encryptString(
+  MOCK_STORAGE_DATA,
+  MOCK_STORAGE_KEY,
+);

app/scripts/controllers/user-storage/schema.ts

@@ -0,0 +1,38 @@
+import { createSHA256Hash } from './encryption';
+
+type UserStorageEntry = { path: string; entryName: string };
+
+/**
+ * The User Storage Endpoint requires a path and an entry name.
+ * Developers can provide additional paths by extending this variable below
+ */
+export const USER_STORAGE_ENTRIES = {
+  notification_settings: {
+    path: 'notifications',
+    entryName: 'notification_settings',
+  },
+} satisfies Record<string, UserStorageEntry>;
+
+export type UserStorageEntryKeys = keyof typeof USER_STORAGE_ENTRIES;
+
+/**
+ * Constructs a unique entry path for a user.
+ * This can be done due to the uniqueness of the storage key (no users will share the same storage key).
+ * The users entry is a unique hash that cannot be reversed.
+ *
+ * @param entryKey
+ * @param storageKey
+ * @returns
+ */
+export function createEntryPath(
+  entryKey: UserStorageEntryKeys,
+  storageKey: string,
+): string {
+  const entry = USER_STORAGE_ENTRIES[entryKey];
+  if (!entry) {
+    throw new Error(`user-storage - invalid entry provided: ${entryKey}`);
+  }
+
+  const hashedKey = createSHA256Hash(entry.entryName + storageKey);
+  return `/${entry.path}/${hashedKey}`;
+}

app/scripts/controllers/user-storage/services.test.ts

@@ -0,0 +1,89 @@
+import {
+  mockEndpointGetUserStorage,
+  mockEndpointUpsertUserStorage,
+} from './mocks/mockServices';
+import {
+  MOCK_ENCRYPTED_STORAGE_DATA,
+  MOCK_STORAGE_DATA,
+  MOCK_STORAGE_KEY,
+} from './mocks/mockStorage';
+import {
+  GetUserStorageResponse,
+  getUserStorage,
+  upsertUserStorage,
+} from './services';
+
+describe('user-storage/services.ts - getUserStorage() tests', () => {
+  test('returns user storage data', async () => {
+    const mockGetUserStorage = mockEndpointGetUserStorage();
+    const result = await actCallGetUserStorage();
+
+    mockGetUserStorage.done();
+    expect(result).toBe(MOCK_STORAGE_DATA);
+  });
+
+  test('returns null if endpoint does not have entry', async () => {
+    const mockGetUserStorage = mockEndpointGetUserStorage({ status: 404 });
+    const result = await actCallGetUserStorage();
+
+    mockGetUserStorage.done();
+    expect(result).toBe(null);
+  });
+
+  test('returns null if endpoint fails', async () => {
+    const mockGetUserStorage = mockEndpointGetUserStorage({ status: 500 });
+    const result = await actCallGetUserStorage();
+
+    mockGetUserStorage.done();
+    expect(result).toBe(null);
+  });
+
+  test('returns null if unable to decrypt data', async () => {
+    const badResponseData: GetUserStorageResponse = {
+      HashedKey: 'MOCK_HASH',
+      Data: 'Bad Encrypted Data',
+    };
+    const mockGetUserStorage = mockEndpointGetUserStorage({
+      status: 200,
+      body: badResponseData,
+    });
+    const result = await actCallGetUserStorage();
+
+    mockGetUserStorage.done();
+    expect(result).toBe(null);
+  });
+
+  function actCallGetUserStorage() {
+    return getUserStorage({
+      bearerToken: 'MOCK_BEARER_TOKEN',
+      entryKey: 'notification_settings',
+      storageKey: MOCK_STORAGE_KEY,
+    });
+  }
+});
+
+describe('user-storage/services.ts - upsertUserStorage() tests', () => {
+  test('invokes upsert endpoint with no errors', async () => {
+    const mockUpsertUserStorage = mockEndpointUpsertUserStorage();
+    await actCallUpsertUserStorage();
+
+    expect(mockUpsertUserStorage.isDone()).toBe(true);
+  });
+
+  test('throws error if unable to upsert user storage', async () => {
+    const mockUpsertUserStorage = mockEndpointUpsertUserStorage({
+      status: 500,
+    });
+
+    await expect(actCallUpsertUserStorage()).rejects.toThrow();
+    mockUpsertUserStorage.done();
+  });
+
+  function actCallUpsertUserStorage() {
+    return upsertUserStorage(MOCK_ENCRYPTED_STORAGE_DATA, {
+      bearerToken: 'MOCK_BEARER_TOKEN',
+      entryKey: 'notification_settings',
+      storageKey: MOCK_STORAGE_KEY,
+    });
+  }
+});

app/scripts/controllers/user-storage/services.ts

@@ -0,0 +1,78 @@
+import encryption from './encryption';
+import { UserStorageEntryKeys, createEntryPath } from './schema';
+
+export const USER_STORAGE_API = process.env.USER_STORAGE_API || '';
+export const USER_STORAGE_ENDPOINT = `${USER_STORAGE_API}/api/v1/userstorage`;
+
+export type GetUserStorageResponse = {
+  HashedKey: string;
+  Data: string;
+};
+
+export type UserStorageOptions = {
+  bearerToken: string;
+  entryKey: UserStorageEntryKeys;
+  storageKey: string;
+};
+
+export async function getUserStorage(
+  opts: UserStorageOptions,
+): Promise<string | null> {
+  const path = createEntryPath(opts.entryKey, opts.storageKey);
+  const url = new URL(`${USER_STORAGE_ENDPOINT}${path}`);
+
+  const encryptedData = await fetch(url.toString(), {
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${opts.bearerToken}`,
+    },
+  })
+    .then((r) => {
+      if (r.status === 404) {
+        // Acceptable Error
+        return null;
+      }
+      if (r.status !== 200) {
+        throw new Error('Unable to get User Storage');
+      }
+      return r.json();
+    })
+    .then((r: GetUserStorageResponse | null) => r?.Data)
+    .catch(() => null);
+
+  if (!encryptedData) {
+    return null;
+  }
+
+  try {
+    const decryptedData = encryption.decryptString(
+      encryptedData,
+      opts.storageKey,
+    );
+    return decryptedData;
+  } catch {
+    return null;
+  }
+}
+
+export async function upsertUserStorage(
+  data: string,
+  opts: UserStorageOptions,
+): Promise<void> {
+  const encryptedData = encryption.encryptString(data, opts.storageKey);
+  const path = createEntryPath(opts.entryKey, opts.storageKey);
+  const url = new URL(`${USER_STORAGE_ENDPOINT}${path}`);
+
+  const res = await fetch(url.toString(), {
+    method: 'PUT',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${opts.bearerToken}`,
+    },
+    body: JSON.stringify({ data: encryptedData }),
+  });
+
+  if (!res.ok) {
+    throw new Error('user-storage - unable to upsert data');
+  }
+}