Shielded AccessControl

contracts/shieldedAccessControl/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@openzeppelin-compact/shielded-access-control",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "compact": "compact-compiler",
+    "build": "compact-builder && tsc",
+    "test": "vitest run",
+    "types": "tsc -p tsconfig.json --noEmit",
+    "clean": "git clean -fXd"
+  },
+  "dependencies": {
+    "@openzeppelin-compact/compact": "workspace:^"
+  },
+  "devDependencies": {
+    "@types/node": "22.14.0",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.2.2",
+    "vitest": "^3.1.3"
+  }
+}

contracts/shieldedAccessControl/src/ShieldedAccessControlUtils.compact

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: MIT
+
+pragma language_version >= 0.16.0;
+
+/**
+ * @module ShieldedAccessControlUtils.
+ * @description A library for common utilities used in the Shielded Access Control module.
+ */
+module ShieldedAccessControlUtils {
+  import CompactStandardLibrary;
+
+  /**
+   * @description Returns whether `keyOrAddress` is a ContractAddress type.
+   *
+   * Disclosures:
+   *
+   * - The type data of `keyOrAddress` - a ZswapCoinPublicKey or ContractAddress.
+   *
+   * @param {Either<ZswapCoinPublicKey, ContractAddress>} keyOrAddress - The target value to check, either a ZswapCoinPublicKey or a ContractAddress.
+   * @return {Boolean} - Returns true if `keyOrAddress` is a ContractAddress.
+   */
+  export pure circuit isContractAddress(keyOrAddress: Either<ZswapCoinPublicKey, ContractAddress>): Boolean {
+    return disclose(!keyOrAddress.is_left);
+  }
+}

contracts/shieldedAccessControl/src/test/mocks/MockShieldedAccessControl.compact

@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: MIT
+
+pragma language_version >= 0.16.0;
+
+import CompactStandardLibrary;
+
+import "../../ShieldedAccessControl" prefix ShieldedAccessControl_;
+
+export {
+  ZswapCoinPublicKey,
+  ContractAddress,
+  Either,
+  Maybe,
+  ShieldedAccessControl_DEFAULT_ADMIN_ROLE,
+  ShieldedAccessControl__salt,
+  ShieldedAccessControl__operatorRoles
+};
+
+export circuit hasRole(roleId: Bytes<32>, account: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): Boolean {
+  return ShieldedAccessControl_hasRole(roleId, account, nonce);
+}
+
+export circuit assertOnlyRole(roleId: Bytes<32>, nonce: Bytes<32>): [] {
+  ShieldedAccessControl_assertOnlyRole(roleId, nonce);
+}
+
+export circuit _checkRole(roleId: Bytes<32>, account: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): [] {
+  ShieldedAccessControl__checkRole(roleId, account, nonce);
+}
+
+export circuit _checkMerkleTree(roleId: Bytes<32>, account: Bytes<32>, nonce: Bytes<32>): Boolean {
+  return ShieldedAccessControl__checkMerkleTree(roleId, account, nonce);
+}
+
+export circuit getRoleAdmin(roleId: Bytes<32>): Bytes<32> {
+  return ShieldedAccessControl_getRoleAdmin(roleId);
+}
+
+export circuit grantRole(roleId: Bytes<32>, account: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): [] {
+  ShieldedAccessControl_grantRole(roleId, account, nonce);
+}
+
+export circuit revokeRole(roleId: Bytes<32>, account: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): [] {
+  ShieldedAccessControl_revokeRole(roleId, account, nonce);
+}
+
+export circuit renounceRole(roleId: Bytes<32>, callerConfirmation: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): [] {
+  ShieldedAccessControl_renounceRole(roleId, callerConfirmation, nonce);
+}
+
+export circuit _setRoleAdmin(roleId: Bytes<32>, adminRole: Bytes<32>): [] {
+  ShieldedAccessControl__setRoleAdmin(roleId, adminRole);
+}
+
+export circuit _grantRole(roleId: Bytes<32>, account: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): Boolean {
+  return ShieldedAccessControl__grantRole(roleId, account, nonce);
+}
+
+export circuit _unsafeGrantRole(roleId: Bytes<32>, account: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): Boolean {
+  return ShieldedAccessControl__unsafeGrantRole(roleId, account, nonce);
+}
+
+export circuit _revokeRole(roleId: Bytes<32>, account: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): Boolean {
+  return ShieldedAccessControl__revokeRole(roleId, account, nonce);
+}
+
+export circuit _requestRole(roleId: Bytes<32>): [] {
+  ShieldedAccessControl__requestRole(roleId);
+}
+
+export circuit _recoverRoles(): [] {
+  ShieldedAccessControl__recoverRoles();
+}

contracts/shieldedAccessControl/src/witnesses/ShieldedAccessControlWitnesses.ts

@@ -0,0 +1,214 @@
+import { Buffer } from 'node:buffer';
+import {
+  constructorContext,
+  decodeCoinPublicKey,
+  type MerkleTreePath,
+  QueryContext,
+  type WitnessContext,
+} from '@midnight-ntwrk/compact-runtime';
+import { encodeContractAddress } from '@midnight-ntwrk/ledger';
+import { sampleContractAddress } from '@midnight-ntwrk/zswap';
+import {
+  type ContractAddress,
+  type Either,
+  type Ledger,
+  Contract as MockShieldedAccessControl,
+  type ZswapCoinPublicKey,
+} from '../artifacts/MockShieldedAccessControl/contract/index.cjs'; // Combined imports
+
+const { hkdfSync } = await import('node:crypto');
+
+const KEYLEN = 32;
+
+/**
+ * @description The respective `nonce` value for a given `roleId` should be at the same index
+ * for each array of `Buffer`s
+ */
+export type ShieldedAccessControlPrivateState = {
+  secretKey: Buffer;
+  nonces: Buffer[];
+  roleIds: Buffer[];
+};
+
+/**
+ * @description Generates a nonce value using the following scheme: HKDF-SHA256(SK, "role-nonce" | roleId | PK)
+ * @param secretKey - The secret key associated with the contract.
+ * @param roleId - The role identifier.
+ * @param salt - A salt value.
+ * @param account - The public key of an account.
+ *
+ * @returns A unique nonce value for `roleId`
+ */
+function generateNonce(
+  secretKey: Buffer,
+  roleId: Buffer,
+  salt: Buffer,
+  account: Buffer,
+): Buffer {
+  const domainString = Buffer.from('role-nonce');
+  const info = Buffer.concat([domainString, roleId, account]);
+  const nonce = hkdfSync('sha512', secretKey, salt, info, KEYLEN);
+
+  return Buffer.from(nonce);
+}
+
+/**
+ * @description A stub function that simulates a successful role approval
+ * @param account - The public key of an account.
+ * @param roleId - The role identifier.
+ * @param nonce - The nonce associated with `roleId`.
+ *
+ * @returns Whether the account was approved for a role
+ */
+function sendRoleRequestToAdmin(
+  _account: Buffer,
+  _roleId: Buffer,
+  _nonce: Buffer,
+) {
+  return true;
+}
+
+export const ShieldedAccessControlWitnesses = {
+  /**
+   * @description Typescript implementation of the `getRoleCommitmentPath` witness function.
+   * @param privateState - The current private state.
+   * @param ledger - A snapshot of the current ledger state.
+   * @param roleCommitment - The role commitment to query.
+   * @param index - The index of `roleCommitment`in the Merkle tree.
+   *
+   * @returns An array of the private state and the Merkle tree path of `roleCommitment`
+   * in the `_operatorRoles` Merkle tree.
+   */
+  getRoleCommitmentPath: (
+    {
+      ledger,
+      privateState,
+    }: WitnessContext<Ledger, ShieldedAccessControlPrivateState>,
+    roleCommitment: Uint8Array,
+    index: bigint,
+  ): [ShieldedAccessControlPrivateState, MerkleTreePath<Uint8Array>] => {
+    const merkleTreePath =
+      ledger.ShieldedAccessControl__operatorRoles.pathForLeaf(
+        index,
+        roleCommitment,
+      );
+    return [privateState, merkleTreePath];
+  },
+  /**
+   * @description Typescript implementation of the `recoverNonce` witness function. Simulates calls to the `hasRole` circuit
+   * to determine if the account has the specified role. Updates the private state with any found roles.
+   * @param privateState - The current private state.
+   * @param ledger - A snapshot of the current ledger state.
+   * @param contractAddress - The address of the contract.
+   * @param account - The public key associated with a role.
+   * @param salt - A salt value.
+   *
+   * @returns An array of the new private state and the empty tuple
+   */
+  recoverRoles: (
+    {
+      ledger,
+      privateState,
+      contractAddress,
+    }: WitnessContext<Ledger, ShieldedAccessControlPrivateState>,
+    account: Uint8Array,
+    salt: Uint8Array,
+  ): [ShieldedAccessControlPrivateState, []] => {
+    const roles = [ledger.ShieldedAccessControl_DEFAULT_ADMIN_ROLE];
+    const coinPubKey = decodeCoinPublicKey(account);
+    const newPrivateState: ShieldedAccessControlPrivateState = {
+      secretKey: privateState.secretKey,
+      roleIds: [],
+      nonces: [],
+    };
+
+    const contract =
+      new MockShieldedAccessControl<ShieldedAccessControlPrivateState>(
+        ShieldedAccessControlWitnesses,
+      );
+    const {
+      currentPrivateState,
+      currentContractState,
+      currentZswapLocalState,
+    } = contract.initialState(
+      constructorContext(
+        { secretKey: privateState.secretKey, nonces: [], roleIds: [] },
+        coinPubKey,
+      ),
+    );
+    const circuitContext = {
+      currentPrivateState,
+      currentZswapLocalState,
+      originalState: currentContractState,
+      transactionContext: new QueryContext(
+        currentContractState.data,
+        contractAddress,
+      ),
+    };
+
+    for (let i = 0; i < roles.length; i++) {
+      const role = roles[i];
+      const nonce = generateNonce(
+        privateState.secretKey,
+        Buffer.from(role),
+        Buffer.from(salt),
+        Buffer.from(account),
+      );
+      const eitherAccount: Either<ZswapCoinPublicKey, ContractAddress> = {
+        is_left: true,
+        left: { bytes: account },
+        right: { bytes: encodeContractAddress(sampleContractAddress()) },
+      };
+
+      try {
+        const hasRole = contract.impureCircuits.hasRole(
+          circuitContext,
+          role,
+          eitherAccount,
+          nonce,
+        );
+        if (hasRole) {
+          newPrivateState.nonces.push(nonce);
+          newPrivateState.roleIds.push(Buffer.from(role));
+        }
+      } catch (err) {
+        console.log(err);
+      }
+    }
+
+    return [newPrivateState, []];
+  },
+  /**
+   * @description Typescript implementation of the `requestRole` witness function.
+   * @param privateState - The current private state.
+   * @param roleId - The role identifier.
+   * @param account - The public key requesting a role.
+   * @param salt - A salt value.
+   *
+   * @returns An array of the new private state and an empty array
+   */
+  requestRole: (
+    { privateState }: WitnessContext<Ledger, ShieldedAccessControlPrivateState>,
+    roleId: Uint8Array,
+    account: Uint8Array,
+    salt: Uint8Array,
+  ): [ShieldedAccessControlPrivateState, []] => {
+    const saltBuff = Buffer.from(salt);
+    const roleIdBuff = Buffer.from(roleId);
+    const accountBuff = Buffer.from(account);
+    const nonce = generateNonce(
+      privateState.secretKey,
+      roleIdBuff,
+      saltBuff,
+      accountBuff,
+    );
+    const isApproved = sendRoleRequestToAdmin(accountBuff, roleIdBuff, nonce);
+
+    if (isApproved) {
+      privateState.nonces.push(nonce);
+      privateState.roleIds.push(roleIdBuff);
+    }
+
+    return [privateState, []];
+  },
+};

contracts/shieldedAccessControl/tsconfig.build.json

@@ -0,0 +1,5 @@
+{
+  "extends": "./tsconfig.json",
+  "exclude": ["src/test/**/*.ts"],
+  "compilerOptions": {}
+}

contracts/shieldedAccessControl/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  "include": [
+    "src/**/*.ts"
+  ],
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "lib": [
+      "ES2022"
+    ],
+    "target": "ES2022",
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "allowJs": true,
+    "forceConsistentCasingInFileNames": true,
+    "noImplicitAny": true,
+    "strict": true,
+    "isolatedModules": true,
+    "sourceMap": true,
+    "resolveJsonModule": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  }
+}

contracts/shieldedAccessControl/vitest.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['src/test/**/*.test.ts'],
+    reporters: 'verbose',
+  },
+});