rob thijssenandClaude Opus 5
ec1399f3f3
The mirror of the same mistake in keyring.createFromJson, fixed the same way. restoreAccount passed `decodeAddress(json.address)` as the public key. For the curve schemes that is correct — the address *is* the public key. An ML-DSA account id is a one-way Poseidon2 hash, so this constructed a pair whose "public key" was a hash of the public key. It did not throw; it produced a pair that was simply wrong. The public key is in `json.encoded`, still encrypted, and the pair is returned *locked* with callers reading `pair.address` off it long before a password appears. So it now passes an accountId — carried as data, used for the address while locked, and checked against the real key once decodePkcs8 supplies one. That check matters here as much as in the keyring: the address field sits outside the encrypted blob, so a tampered one decodes cleanly and yields an account displaying an address its key cannot sign for. The 'ed25519' fallback for version-0 JSON is left alone. Those files predate the crypto type being recorded and are by definition not Quantus, so the guess is safe — but it is commented, because quantus/common#6 removes ed25519 from KeypairType and this becomes a refusal. Build plumbing, all of it dev-time only and all replaced by publishing these packages to a registry (quantus/extension#2): Resolutions point @polkadot/{keyring,util-crypto,networks,util} at the sibling `common` checkout's build output, and @quantus/crypto at `wasm`. tsconfig.base.json gains `*.d.ts` path mappings for them. Without these, node resolves the portal symlink to its realpath and `@polkadot/util-crypto` then resolves inside *common's* tree, where it is the workspace source directory with no exports map — so EncryptedJson silently fails to resolve and KeyringPair$Json loses `encoded` and `encoding`. The `*.d.ts` substitution has to come first because NodeNext will not infer an extension for a bare path, and looks for a `types` directory instead of `types.d.ts`. tsconfig.json overrides those with the runtime `.js` view, because @polkadot/dev-ts reads that file and would otherwise import a declaration file as a module ("Debug Failure. Output generation failed"). tsc reads tsconfig.build.json, which extends the base directly, so each gets the view it needs. The test script sets --preserve-symlinks, which yarn itself warns is required for portals: without it the realpath problem above recurs at runtime. Incidentally, `yarn lint` errors drop from 25 to 8 — resolving those types removed a pile of `any`. The remaining 8 are upstream's own, in loadContract and allowGenesis, and are left alone. Refs quantus/ui#1 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
30 lines
1.2 KiB
JSON
30 lines
1.2 KiB
JSON
{
|
|
"extends": "./tsconfig.base.json",
|
|
"compilerOptions": {
|
|
"baseUrl": "./packages",
|
|
"composite": false,
|
|
// Overrides the `*.d.ts` mappings in tsconfig.base.json for the *runtime*
|
|
// loader. `@polkadot/dev-ts` reads this file (following `extends`, with the
|
|
// child winning) and would otherwise try to import a declaration file as a
|
|
// module — "Debug Failure. Output generation failed".
|
|
//
|
|
// tsc reads tsconfig.build.json, which extends the base directly and so
|
|
// keeps the declaration mappings it needs. Both views disappear once these
|
|
// packages come from a registry; see quantus/extension#2.
|
|
"paths": {
|
|
"@polkadot/keyring": ["../../common/packages/keyring/build/index.js"],
|
|
"@polkadot/keyring/*": ["../../common/packages/keyring/build/*"],
|
|
"@polkadot/networks": ["../../common/packages/networks/build/index.js"],
|
|
"@polkadot/networks/*": ["../../common/packages/networks/build/*"],
|
|
"@polkadot/util-crypto": ["../../common/packages/util-crypto/build/index.js"],
|
|
"@polkadot/util-crypto/*": ["../../common/packages/util-crypto/build/*"]
|
|
}
|
|
},
|
|
"include": [
|
|
"packages/**/src/**/*"
|
|
],
|
|
"exclude": [
|
|
"**/node_modules/**/*"
|
|
]
|
|
}
|