Skip to content

Commit 06f34cd

Browse files
jonas-ljjonas-lj
authored
Fix verify_zklogin_id and issuer functions (#14100)
## Description Fix `verify_zklogin_id` and `verify_zklogin_issuer` functions such that they transfer the verified id or issuer objects to the sender. ## Test Plan Unit tests ### Type of Change (Check all that apply) - [x] protocol change - [x] user-visible impact - [ ] breaking change for a client SDKs - [x] breaking change for FNs (FN binary must upgrade) - [x] breaking change for validators or node operators (must upgrade binaries) - [ ] breaking change for on-chain data layout - [ ] necessitate either a data wipe or data migration ### Release notes Fix bug in `verify_zklogin_id` and `verify_zklogin_issuer` functions.
1 parent 4d9fa24 commit 06f34cd

File tree

4 files changed

+114
-16
lines changed

4 files changed

+114
-16
lines changed

‎crates/sui-framework/packages/sui-framework/sources/crypto/zklogin_verified_id.move

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module sui::zklogin_verified_id {
55
use std::string::String;
66
use sui::object;
77
use sui::object::UID;
8+
use sui::transfer;
89
use sui::tx_context::TxContext;
910
use sui::tx_context;
1011

@@ -69,9 +70,20 @@ module sui::zklogin_verified_id {
6970
audience: String,
7071
pin_hash: u256,
7172
ctx: &mut TxContext,
72-
): VerifiedID {
73-
assert!(check_zklogin_id(tx_context::sender(ctx), &key_claim_name, &key_claim_value, &issuer, &audience, pin_hash), EInvalidProof);
74-
VerifiedID { id: object::new(ctx), owner: tx_context::sender(ctx), key_claim_name, key_claim_value, issuer, audience}
73+
) {
74+
let sender = tx_context::sender(ctx);
75+
assert!(check_zklogin_id(sender, &key_claim_name, &key_claim_value, &issuer, &audience, pin_hash), EInvalidProof);
76+
transfer::transfer(
77+
VerifiedID {
78+
id: object::new(ctx),
79+
owner: sender,
80+
key_claim_name,
81+
key_claim_value,
82+
issuer,
83+
audience
84+
},
85+
sender
86+
);
7587
}
7688

7789
/// Returns true if `address` was created using zklogin and the given parameters.

‎crates/sui-framework/packages/sui-framework/sources/crypto/zklogin_verified_issuer.move

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
module sui::zklogin_verified_issuer {
55
use std::string::String;
6+
use sui::transfer;
67
use sui::object;
78
use sui::object::UID;
89
use sui::tx_context::TxContext;
@@ -43,9 +44,17 @@ module sui::zklogin_verified_issuer {
4344
address_seed: u256,
4445
issuer: String,
4546
ctx: &mut TxContext,
46-
): VerifiedIssuer {
47-
assert!(check_zklogin_issuer(tx_context::sender(ctx), address_seed, &issuer), EInvalidProof);
48-
VerifiedIssuer {id: object::new(ctx), owner: tx_context::sender(ctx), issuer}
47+
) {
48+
let sender = tx_context::sender(ctx);
49+
assert!(check_zklogin_issuer(sender, address_seed, &issuer), EInvalidProof);
50+
transfer::transfer(
51+
VerifiedIssuer {
52+
id: object::new(ctx),
53+
owner: sender,
54+
issuer
55+
},
56+
sender
57+
)
4958
}
5059

5160
/// Returns true if `address` was created using zklogin with the given issuer and address seed.

‎crates/sui-framework/packages/sui-framework/tests/crypto/zklogin_verified_id_tests.move

Lines changed: 49 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,15 @@
33

44
#[test_only]
55
module sui::zklogin_verified_id_tests {
6-
use sui::zklogin_verified_id::check_zklogin_id;
6+
use sui::zklogin_verified_id::{check_zklogin_id, verify_zklogin_id, VerifiedID};
77
use sui::address;
88
use std::string::utf8;
9+
use sui::bag::add;
10+
use sui::test_scenario;
911

1012
#[test]
1113
fun test_check_zklogin_id() {
12-
let address = address::from_bytes(x"1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b");
14+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
1315
let kc_name = utf8(b"sub");
1416
let kc_value = utf8(b"106294049240999307923");
1517
let aud = utf8(b"575519204237-msop9ep45u2uo98hapqmngv8d84qdc8k.apps.googleusercontent.com");
@@ -41,7 +43,7 @@ module sui::zklogin_verified_id_tests {
4143
fun test_check_zklogin_id_upper_bounds() {
4244
// Set kc_name, kc_value and aud to be as long as they can be (32, 115 and 145 bytes respectively) and verify
4345
// that the check function doesn't abort.
44-
let address = address::from_bytes(x"1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b");
46+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
4547
let kc_name = utf8(b"qvKbuwvu6LTnYocFPwz1EiIClFUAuMC3");
4648
let kc_value = utf8(b"BA7SREzYLKG5opithujfrU8SFaSpKI4zezu8Vb2GBPVpZsMUpYVeXl6oEAo84ryIlbHOqrMWpI7mlTfvr7HYxiF70jdyIY4rPOOpuJIYWwN3o1olTP2");
4749
let aud = utf8(b"munO2fnn2XnBNq5fXRmSmhC4GPL3yX4Rv9fGoECXTsmniR8dwkPTefbmLF08zh7BnVcaxriii4dEPNwzEF2puLIHmJoeuYbQxV84J9of4NRaL3IhwImVGubgPHWfMfCuGuedCdLn6KUdJsgG1");
@@ -53,7 +55,7 @@ module sui::zklogin_verified_id_tests {
5355
#[test]
5456
#[expected_failure(abort_code = sui::zklogin_verified_id::EInvalidInput)]
5557
fun test_check_zklogin_id_long_kc_name() {
56-
let address = address::from_bytes(x"1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b");
58+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
5759
// Should at most be 32 bytes
5860
let long_kc_name = utf8(b"qvKbuwvu6LTnYocFPwz1EiIClFUAuMC3G");
5961
let kc_value = utf8(b"106294049240999307923");
@@ -66,7 +68,7 @@ module sui::zklogin_verified_id_tests {
6668
#[test]
6769
#[expected_failure(abort_code = sui::zklogin_verified_id::EInvalidInput)]
6870
fun test_check_zklogin_id_long_aud() {
69-
let address = address::from_bytes(x"1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b");
71+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
7072
let kc_name = utf8(b"sub");
7173
// Should at most be 115 bytes
7274
let long_kc_value = utf8(b"BA7SREzYLKG5opithujfrU8SFaSpKI4zezu8Vb2GBPVpZsMUpYVeXl6oEAo84ryIlbHOqrMWpI7mlTfvr7HYxiF70jdyIY4rPOOpuJIYWwN3o1olTP2c");
@@ -79,7 +81,7 @@ module sui::zklogin_verified_id_tests {
7981
#[test]
8082
#[expected_failure(abort_code = sui::zklogin_verified_id::EInvalidInput)]
8183
fun test_check_zklogin_id_long_kc_value() {
82-
let address = address::from_bytes(x"1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b");
84+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
8385
let kc_name = utf8(b"sub");
8486
let kc_value = utf8(b"106294049240999307923");
8587
// Should be at most 145 bytes
@@ -88,4 +90,45 @@ module sui::zklogin_verified_id_tests {
8890
let salt_hash = 15232766888716517538274372547598053531354666056102343895255590477425668733026u256;
8991
check_zklogin_id(address, &kc_name, &kc_value, &iss, &long_aud, salt_hash);
9092
}
93+
94+
#[test]
95+
fun test_verified_id() {
96+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
97+
98+
let kc_name = utf8(b"sub");
99+
let kc_value = utf8(b"106294049240999307923");
100+
let aud = utf8(b"575519204237-msop9ep45u2uo98hapqmngv8d84qdc8k.apps.googleusercontent.com");
101+
let iss = utf8(b"https://accounts.google.com");
102+
let salt_hash = 15232766888716517538274372547598053531354666056102343895255590477425668733026u256;
103+
104+
let scenario_val = test_scenario::begin(address);
105+
let scenario = &mut scenario_val;
106+
{
107+
verify_zklogin_id(kc_name, kc_value, iss, aud, salt_hash, test_scenario::ctx(scenario));
108+
};
109+
test_scenario::next_tx(scenario, address);
110+
{
111+
assert!(test_scenario::has_most_recent_for_sender<VerifiedID>(scenario), 0);
112+
};
113+
test_scenario::end(scenario_val);
114+
}
115+
116+
#[test]
117+
#[expected_failure(abort_code = sui::zklogin_verified_id::EInvalidProof)]
118+
fun test_invalid_verified_issuer() {
119+
let other_address = @0x1;
120+
121+
let kc_name = utf8(b"sub");
122+
let kc_value = utf8(b"106294049240999307923");
123+
let aud = utf8(b"575519204237-msop9ep45u2uo98hapqmngv8d84qdc8k.apps.googleusercontent.com");
124+
let iss = utf8(b"https://accounts.google.com");
125+
let salt_hash = 15232766888716517538274372547598053531354666056102343895255590477425668733026u256;
126+
127+
let scenario_val = test_scenario::begin(other_address);
128+
let scenario = &mut scenario_val;
129+
{
130+
verify_zklogin_id(kc_name, kc_value, iss, aud, salt_hash, test_scenario::ctx(scenario));
131+
};
132+
test_scenario::end(scenario_val);
133+
}
91134
}

‎crates/sui-framework/packages/sui-framework/tests/crypto/zklogin_verified_issuer_tests.move

Lines changed: 38 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,18 @@
33

44
#[test_only]
55
module sui::zklogin_verified_issuer_tests {
6-
use sui::zklogin_verified_issuer::check_zklogin_issuer;
7-
use sui::address;
6+
use sui::zklogin_verified_issuer::{check_zklogin_issuer, verify_zklogin_issuer, VerifiedIssuer};
87
use std::string::utf8;
8+
use sui::test_scenario;
99

1010
#[test]
1111
fun test_check_zklogin_issuer() {
12-
let address = address::from_bytes(x"1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b");
12+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
1313
let iss = utf8(b"https://accounts.google.com");
1414
let address_seed = 3006596378422062745101035755700472756930796952630484939867684134047976874601u256;
1515
assert!(check_zklogin_issuer(address, address_seed, &iss,), 0);
1616

17-
let other_address = address::from_bytes(x"006b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b");
17+
let other_address = @0x006b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
1818
assert!(!check_zklogin_issuer(other_address, address_seed, &iss), 1);
1919

2020
let other_address_seed = 1234u256;
@@ -23,4 +23,38 @@ module sui::zklogin_verified_issuer_tests {
2323
let other_iss = utf8(b"https://other.issuer.com");
2424
assert!(!check_zklogin_issuer(address, address_seed, &other_iss), 3);
2525
}
26+
27+
#[test]
28+
fun test_verified_issuer() {
29+
let address = @0x1c6b623a2f2c91333df730c98d220f11484953b391a3818680f922c264cc0c6b;
30+
let iss = utf8(b"https://accounts.google.com");
31+
let address_seed = 3006596378422062745101035755700472756930796952630484939867684134047976874601u256;
32+
33+
assert!(check_zklogin_issuer(address, address_seed, &iss), 0);
34+
35+
let scenario_val = test_scenario::begin(address);
36+
let scenario = &mut scenario_val;
37+
{
38+
verify_zklogin_issuer(address_seed, iss, test_scenario::ctx(scenario));
39+
};
40+
test_scenario::next_tx(scenario, address);
41+
{
42+
assert!(test_scenario::has_most_recent_for_sender<VerifiedIssuer>(scenario), 1);
43+
};
44+
test_scenario::end(scenario_val);
45+
}
46+
47+
#[test]
48+
#[expected_failure(abort_code = sui::zklogin_verified_issuer::EInvalidProof)]
49+
fun test_invalid_verified_issuer() {
50+
let other_address = @0x1;
51+
let iss = utf8(b"https://accounts.google.com");
52+
let address_seed = 3006596378422062745101035755700472756930796952630484939867684134047976874601u256;
53+
let scenario_val = test_scenario::begin(other_address);
54+
let scenario = &mut scenario_val;
55+
{
56+
verify_zklogin_issuer(address_seed, iss, test_scenario::ctx(scenario));
57+
};
58+
test_scenario::end(scenario_val);
59+
}
2660
}

0 commit comments

Comments
 (0)