chore: refactoring & tests for ensureDelegatedIdentityKey with Secure Store

peter-sanderson · peter-sanderson · commit 3bdbfbf92347 · 2025-12-05T21:32:11.000+01:00
diff --git a/suite-common/secure-storage/src/index.ts b/suite-common/secure-storage/src/index.ts
@@ -6,3 +6,4 @@ export type {
     EncryptionError,
 } from './secureStorage';
 export { asEncryptedHex, EncryptionUnavailable, DecryptionFailed } from './secureStorage';
+export type { SecureStorageDep } from './secureStorage';
diff --git a/suite-common/secure-storage/src/secureStorage.ts b/suite-common/secure-storage/src/secureStorage.ts
@@ -27,6 +27,8 @@ export const DecryptionFailed = (): DecryptionFailed => ({
 export type EncryptionError = EncryptionUnavailable;
 export type DecryptionError = EncryptionUnavailable | DecryptionFailed;
 
+export type SecureStorageDep = { secureStorage: SecureStorage };
+
 export interface SecureStorage {
     encrypt: <T extends EncryptableBranded>(params: {
         value: T;
diff --git a/suite-common/suite-sync-storage/src/Owner.ts b/suite-common/suite-sync-storage/src/Owner.ts
@@ -11,3 +11,5 @@ export const CreateSuiteSyncOwnerError = (message: string): CreateSuiteSyncOwner
 export type CreateSuiteSyncOwner = (params: {
     data: string;
 }) => Result<SuiteSyncOwner, CreateSuiteSyncOwnerError>;
+
+export type CreateSuiteSyncOwnerDep = { createSuiteSyncOwner: CreateSuiteSyncOwner };
diff --git a/suite-common/suite-sync-storage/src/index.ts b/suite-common/suite-sync-storage/src/index.ts
@@ -2,10 +2,11 @@ export type {
     SuiteSyncStorageRepository,
     CreateSuiteSyncStorageRepository,
     CreateSuiteStorage,
+    CreateSuiteStorageDep,
 } from './SuiteSyncStorageRepository';
 export { createSuiteSyncStorageRepositoryFactory } from './SuiteSyncStorageRepository';
 export type { SuiteSyncStorage } from './SuiteSyncStorage';
-export type { CreateSuiteSyncOwner } from './Owner';
+export type { CreateSuiteSyncOwner, CreateSuiteSyncOwnerDep } from './Owner';
 export { CreateSuiteSyncOwnerError } from './Owner';
 export type {
     SuiteSync,
diff --git a/suite-common/suite-sync/src/createSuiteSyncCompositionRoot.ts b/suite-common/suite-sync/src/createSuiteSyncCompositionRoot.ts
@@ -1,17 +1,18 @@
 import { Dispatch } from '@reduxjs/toolkit';
 
-import { SecureStorage } from '@suite-common/secure-storage';
+import { SecureStorageDep } from '@suite-common/secure-storage';
 import {
-    CreateSuiteStorage,
-    CreateSuiteSyncOwner,
+    CreateSuiteStorageDep,
+    CreateSuiteSyncOwnerDep,
     SuiteSync,
     createSuiteSyncStorageRepositoryFactory,
 } from '@suite-common/suite-sync-storage';
 import {
     createEnsureDelegatedIdentityKey,
-    createGetDelegatedIdentityKey,
+    createLoadDelegatedIdentityKeyFromState,
     createSaveDelegatedIdentityKey,
     selectAllDeviceOwners,
+    selectDeviceDelegatedIdentityKey,
 } from '@suite-common/wallet-core';
 
 import {
@@ -29,13 +30,12 @@ import { selectSuiteSyncRelayUrl } from './suiteSyncSelectors';
 import { createTurnOffSuiteSync } from './turnOffSuiteSync';
 
 type CreateSuiteSyncCompositionRootDeps = {
-    createSuiteStorage: CreateSuiteStorage;
-    createSuiteSyncOwner: CreateSuiteSyncOwner;
     getState: () => any;
     dispatch: Dispatch;
     trezorConnect: EnsureSuiteSyncOwnerDeps['trezorConnect'];
-    secureStorage: SecureStorage;
-};
+} & CreateSuiteStorageDep &
+    CreateSuiteSyncOwnerDep &
+    SecureStorageDep;
 
 export const createSuiteSyncCompositionRoot = (
     deps: CreateSuiteSyncCompositionRootDeps,
@@ -61,10 +61,11 @@ export const createSuiteSyncCompositionRoot = (
 
     // Todo: this shall be extracted upstream in the composition root
     const ensureDelegatedIdentityKey = createEnsureDelegatedIdentityKey({
-        getDelegatedIdentityKey: createGetDelegatedIdentityKey({
+        loadDelegatedIdentityKeyFromState: createLoadDelegatedIdentityKeyFromState({
             dispatch: deps.dispatch,
-            getState: deps.getState,
             secureStorage: deps.secureStorage,
+            getDeviceDelegatedIdentityKey: deviceId =>
+                selectDeviceDelegatedIdentityKey(deps.getState(), deviceId),
         }),
         saveDelegatedIdentityKey: createSaveDelegatedIdentityKey({
             dispatch: deps.dispatch,
diff --git a/suite-common/suite-sync/src/device/ensureSuiteSyncOwnerKeys.ts b/suite-common/suite-sync/src/device/ensureSuiteSyncOwnerKeys.ts
@@ -35,6 +35,10 @@ export type EnsureSuiteSyncOwnerKeys = (
     >
 >;
 
+export type EnsureSuiteSyncOwnerDep = {
+    ensureSuiteSyncOwnerKeys: EnsureSuiteSyncOwnerKeys;
+};
+
 export const createEnsureSuiteSyncOwnerKeys =
     (deps: EnsureSuiteSyncOwnerDeps): EnsureSuiteSyncOwnerKeys =>
     async ({ device, delegatedKey }) => {
diff --git a/suite-common/suite-sync/src/refreshSuiteSyncKeys.ts b/suite-common/suite-sync/src/refreshSuiteSyncKeys.ts
@@ -1,27 +1,25 @@
 import { Dispatch } from '@reduxjs/toolkit';
 
-import { EncryptionUnavailable } from '@suite-common/secure-storage';
 import { CreateSuiteSyncOwnerError } from '@suite-common/suite-sync-storage';
 import { TrezorDevice } from '@suite-common/suite-types';
 import {
     DeviceCancelledErr,
     DeviceError,
-    EnsureDelegatedIdentityKey,
+    EnsureDelegatedIdentityKeyDep,
     ProofOfDelegatedSignFailed,
     deviceActions,
     selectDevices,
 } from '@suite-common/wallet-core';
 import { isTrezorDeviceWithState } from '@suite-common/wallet-utils';
 import { Result, err, ok } from '@trezor/type-utils';
 
-import { EnsureSuiteSyncOwnerKeys } from './device/ensureSuiteSyncOwnerKeys';
+import { EnsureSuiteSyncOwnerDep } from './device/ensureSuiteSyncOwnerKeys';
 
 export type RefreshSuiteSyncKeysDeps = {
     getState: () => any;
     dispatch: Dispatch;
-    ensureDelegatedIdentityKey: EnsureDelegatedIdentityKey;
-    ensureSuiteSyncOwnerKeys: EnsureSuiteSyncOwnerKeys;
-};
+} & EnsureSuiteSyncOwnerDep &
+    EnsureDelegatedIdentityKeyDep;
 
 type RefreshSuiteSyncKeysParams = {
     device: TrezorDevice;
@@ -42,7 +40,6 @@ export type RefreshSuiteSyncKeys = (
         void,
         | DeviceError
         | DeviceCancelledErr
-        | EncryptionUnavailable
         | DeviceDoesNotSupportSuiteSyncErr
         | ProofOfDelegatedSignFailed
         | CreateSuiteSyncOwnerError
@@ -69,9 +66,7 @@ export const createRefreshSuiteSyncKeys =
             return err(DeviceDoesNotSupportSuiteSyncErr());
         }
 
-        const delegatedKeyResult = await deps.ensureDelegatedIdentityKey({
-            device,
-        });
+        const delegatedKeyResult = await deps.ensureDelegatedIdentityKey({ device });
 
         if (!delegatedKeyResult.ok) {
             return delegatedKeyResult;
diff --git a/suite-common/suite-sync/src/storage/subscribeSuiteSyncStorage.ts b/suite-common/suite-sync/src/storage/subscribeSuiteSyncStorage.ts
@@ -51,8 +51,9 @@ export const createSubscribeSuiteSyncStorage =
                         );
 
                         return;
+
+                    // Those errors are most likely due to Bug in the code or data corruption
                     case 'CreateSuiteSyncOwnerError':
-                    case 'EncryptionUnavailable':
                     case 'ProofOfDelegatedSignFailed':
                         console.error(result.error);
                         // Todo: dispatch better notification
diff --git a/suite-common/wallet-core/src/device/delegatedIdentityKey/ensureDelegatedIdentityKey.ts b/suite-common/wallet-core/src/device/delegatedIdentityKey/ensureDelegatedIdentityKey.ts
@@ -1,34 +1,32 @@
-import { EncryptionUnavailable } from '@suite-common/secure-storage';
 import { DelegatedIdentityKey, TrezorDeviceWithState } from '@suite-common/suite-types';
 // Circular issue, see: https://github.com/trezor/trezor-suite/issues/21553
 import { selectThp } from '@suite-common/thp/src/thpSelectors';
 import { Result, ok } from '@trezor/type-utils';
 
 import { DeviceCancelledErr, DeviceError } from '../deviceUtils';
-import { GetDelegatedIdentityKey } from './getDelegatedIdentityKey';
-import { retrieveDelegatedIdentityKey } from './retrieveDelegatedIdentityKey';
-import { SaveDelegatedIdentityKey } from './saveDelegatedIdentityKey';
+import { LoadDelegatedIdentityKeyFromStateDep } from './loadDelegatedIdentityKeyFromState';
+import { retrieveDelegatedIdentityKeyFromDevice } from './retrieveDelegatedIdentityKeyFromDevice';
+import { SaveDelegatedIdentityKeyDep } from './saveDelegatedIdentityKey';
 
 type EnsureDelegatedIdentityKeyParams = {
     device: TrezorDeviceWithState;
 };
 
 export type EnsureDelegatedIdentityKey = (
     params: EnsureDelegatedIdentityKeyParams,
-) => Promise<
-    Result<DelegatedIdentityKey, DeviceError | DeviceCancelledErr | EncryptionUnavailable>
->;
-
-type EnsureDelegatedIdentityKeyDeps = {
-    getState: () => any;
-    getDelegatedIdentityKey: GetDelegatedIdentityKey;
-    saveDelegatedIdentityKey: SaveDelegatedIdentityKey;
+) => Promise<Result<DelegatedIdentityKey, DeviceError | DeviceCancelledErr>>;
+
+type EnsureDelegatedIdentityKeyDeps = { getState: () => any } & SaveDelegatedIdentityKeyDep &
+    LoadDelegatedIdentityKeyFromStateDep;
+
+export type EnsureDelegatedIdentityKeyDep = {
+    ensureDelegatedIdentityKey: EnsureDelegatedIdentityKey;
 };
 
 export const createEnsureDelegatedIdentityKey =
     (deps: EnsureDelegatedIdentityKeyDeps): EnsureDelegatedIdentityKey =>
     async ({ device }) => {
-        const currentDelegatedKey = await deps.getDelegatedIdentityKey({
+        const currentDelegatedKey = await deps.loadDelegatedIdentityKeyFromState({
             deviceId: device.id,
         });
 
@@ -37,7 +35,7 @@ export const createEnsureDelegatedIdentityKey =
         }
 
         const thpStaticHostKey = selectThp(deps.getState()).staticKey;
-        const result = await retrieveDelegatedIdentityKey({ device, thpStaticHostKey });
+        const result = await retrieveDelegatedIdentityKeyFromDevice({ device, thpStaticHostKey });
 
         if (!result.ok) {
             return result;
diff --git a/suite-common/wallet-core/src/device/delegatedIdentityKey/loadDelegatedIdentityKeyFromState.ts b/suite-common/wallet-core/src/device/delegatedIdentityKey/loadDelegatedIdentityKeyFromState.ts
@@ -1,33 +1,32 @@
 import { Dispatch } from '@reduxjs/toolkit';
 
-import { SecureStorage } from '@suite-common/secure-storage';
+import { EncryptedHex, SecureStorageDep } from '@suite-common/secure-storage';
 import { DelegatedIdentityKey } from '@suite-common/suite-types';
 import { exhaustive } from '@trezor/type-utils';
 
 import { deviceActions } from '../deviceActions';
-import { selectPersistentDeviceData } from '../deviceSelectors';
 
-export type GetCurrentDelegatedIdentityKeyDeps = {
-    getState: () => any;
-    secureStorage: SecureStorage;
+export type LoadDelegatedIdentityKeyFromStateDeps = {
+    getDeviceDelegatedIdentityKey: (deviceId: string) => EncryptedHex<DelegatedIdentityKey> | null;
     dispatch: Dispatch;
-};
+} & SecureStorageDep;
 
-export type GetDelegatedIdentityKeyParams = {
+export type LoadDelegatedIdentityKeyFromStateParams = {
     deviceId: string;
 };
 
-export type GetDelegatedIdentityKey = (
-    params: GetDelegatedIdentityKeyParams,
+export type LoadDelegatedIdentityKeyFromStateDep = {
+    loadDelegatedIdentityKeyFromState: LoadDelegatedIdentityKeyFromState;
+};
+
+export type LoadDelegatedIdentityKeyFromState = (
+    params: LoadDelegatedIdentityKeyFromStateParams,
 ) => Promise<DelegatedIdentityKey | null>;
 
-export const createGetDelegatedIdentityKey =
-    (deps: GetCurrentDelegatedIdentityKeyDeps): GetDelegatedIdentityKey =>
+export const createLoadDelegatedIdentityKeyFromState =
+    (deps: LoadDelegatedIdentityKeyFromStateDeps): LoadDelegatedIdentityKeyFromState =>
     async ({ deviceId }) => {
-        const persistedData = selectPersistentDeviceData(deps.getState());
-        const devicePersistedData = persistedData.find(it => it.device_id === deviceId);
-
-        const encryptedCurrentDelegatedKey = devicePersistedData?.delegatedIdentityKey ?? null;
+        const encryptedCurrentDelegatedKey = deps.getDeviceDelegatedIdentityKey(deviceId);
 
         if (encryptedCurrentDelegatedKey === null) {
             return null;
diff --git a/suite-common/wallet-core/src/device/delegatedIdentityKey/retrieveDelegatedIdentityKeyFromDevice.ts b/suite-common/wallet-core/src/device/delegatedIdentityKey/retrieveDelegatedIdentityKeyFromDevice.ts
@@ -9,7 +9,7 @@ type RetrieveDelegatedIdentityKeyParams = {
     thpStaticHostKey: string | undefined;
 };
 
-export const retrieveDelegatedIdentityKey = async ({
+export const retrieveDelegatedIdentityKeyFromDevice = async ({
     device,
     thpStaticHostKey,
 }: RetrieveDelegatedIdentityKeyParams) => {
diff --git a/suite-common/wallet-core/src/device/delegatedIdentityKey/saveDelegatedIdentityKey.ts b/suite-common/wallet-core/src/device/delegatedIdentityKey/saveDelegatedIdentityKey.ts
@@ -18,6 +18,10 @@ type SaveDelegatedIdentityKeyParms = {
 
 export type SaveDelegatedIdentityKey = (params: SaveDelegatedIdentityKeyParms) => Promise<void>;
 
+export type SaveDelegatedIdentityKeyDep = {
+    saveDelegatedIdentityKey: SaveDelegatedIdentityKey;
+};
+
 export const createSaveDelegatedIdentityKey =
     (deps: SaveDelegatedIdentityKeyDeps): SaveDelegatedIdentityKey =>
     async ({ deviceId, delegatedIdentityKey }) => {
diff --git a/suite-common/wallet-core/src/device/delegatedIdentityKey/tests/loadDelegatedIdentityKeyFromState.test.ts b/suite-common/wallet-core/src/device/delegatedIdentityKey/tests/loadDelegatedIdentityKeyFromState.test.ts
@@ -0,0 +1,54 @@
+import {
+    DecryptionFailed,
+    EncryptableBranded,
+    EncryptedHex,
+    EncryptionUnavailable,
+    asEncryptedHex,
+} from '@suite-common/secure-storage';
+import { err, ok } from '@trezor/type-utils';
+
+import { createLoadDelegatedIdentityKeyFromState } from '../loadDelegatedIdentityKeyFromState';
+
+describe(createLoadDelegatedIdentityKeyFromState.name, () => {
+    it('gets the encrypted key', async () => {
+        const getDelegatedIdentityKey = createLoadDelegatedIdentityKeyFromState({
+            dispatch: () => {},
+            getDeviceDelegatedIdentityKey: () => asEncryptedHex('delegated-key-<encrypted>'),
+            secureStorage: {
+                encrypt: () => {
+                    throw new Error('Not expected!');
+                },
+                decrypt: <T extends EncryptableBranded>({ value }: { value: EncryptedHex<T> }) =>
+                    Promise.resolve(ok(value.replace('<encrypted>', '') as T)),
+            },
+        });
+
+        const result = await getDelegatedIdentityKey({ deviceId: 'device-id-123' });
+
+        expect(result).toBe('delegated-key-');
+    });
+
+    it.each([
+        [
+            'returns null, when key is there but decryption fails',
+            EncryptionUnavailable('encryption unavailable'),
+        ],
+        ['returns null, when key is there but decryption fails', DecryptionFailed()],
+    ])('%s', async (_, error) => {
+        const getDelegatedIdentityKey = createLoadDelegatedIdentityKeyFromState({
+            dispatch: () => {},
+            getDeviceDelegatedIdentityKey: () => asEncryptedHex('delegated-key-<encrypted>'),
+            secureStorage: {
+                encrypt: () => {
+                    throw new Error('Not expected!');
+                },
+                decrypt: <T extends EncryptableBranded>(_: { value: EncryptedHex<T> }) =>
+                    Promise.resolve(err(error)),
+            },
+        });
+
+        const result = await getDelegatedIdentityKey({ deviceId: 'device-id-123' });
+
+        expect(result).toBe(null);
+    });
+});
diff --git a/suite-common/wallet-core/src/device/deviceSelectors.ts b/suite-common/wallet-core/src/device/deviceSelectors.ts
@@ -655,3 +655,9 @@ export const selectAllDeviceOwners = createMemoizedSelector([selectDevices], dev
         return acc;
     }, [] as SuiteSyncOwner[]),
 );
+
+export const selectDeviceDelegatedIdentityKey = createMemoizedSelector(
+    [selectPersistentDeviceData, (_state, deviceId: string) => deviceId],
+    (persistentDeviceData, deviceId) =>
+        persistentDeviceData.find(d => d.device_id === deviceId)?.delegatedIdentityKey ?? null,
+);
diff --git a/suite-common/wallet-core/src/index.ts b/suite-common/wallet-core/src/index.ts
@@ -11,9 +11,8 @@ export * from './blockchain/blockchainSelectors';
 export * from './blockchain/blockchainThunks';
 export * from './device/delegatedIdentityKey/getProofOfDelegatedIdentity';
 export * from './device/delegatedIdentityKey/ensureDelegatedIdentityKey';
-export * from './device/delegatedIdentityKey/retrieveDelegatedIdentityKey';
 export * from './device/delegatedIdentityKey/saveDelegatedIdentityKey';
-export * from './device/delegatedIdentityKey/getDelegatedIdentityKey';
+export * from './device/delegatedIdentityKey/loadDelegatedIdentityKeyFromState';
 export * from './device/deviceActions';
 export * from './device/deviceConstants';
 export * from './device/deviceReducer';
