Migrate JWT to SIWE for App registration in e2e test utils #475

Spacesai1or · 2026-01-30T23:57:25Z

No description provided.

vercel · 2026-01-30T23:57:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vincent-app-dashboard	Ready	Preview, Comment	Jan 31, 2026 0:52am
vincent-dashboard-2.0	Ready	Preview, Comment	Jan 31, 2026 0:52am

awisniew207

Copilot

Pull request overview

This pull request migrates authentication from JWT to SIWE (Sign-In with Ethereum) for app registration operations in the e2e test utilities. The change implements EIP-4361 compliant SIWE authentication for interacting with the Vincent Registry API, replacing the previous JWT-based approach.

Changes:

Implemented new SIWE authentication using EIP-4361 standard with secure nonce generation and message signing
Updated app registration API functions (registerApp, registerAppVersion, setActiveAppVersion) to use SIWE authentication headers
Enhanced test validations for serialized permission accounts with proper base64 decoding
Removed redundant appId parameter from completeAppInstallation request body (already in URL path)
Added .env.example documentation for environment variables

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/generateSiweAuth.ts	New SIWE authentication implementation with domain/URI inference, nonce generation, and EIP-4361 message formatting
packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/registerApp.ts	Updated to use SIWE authentication instead of JWT
packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/registerAppVersion.ts	Updated to use SIWE authentication instead of JWT
packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/setActiveAppVersion.ts	Updated to use SIWE authentication instead of JWT
packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/completeAppInstallation.ts	Removed redundant appId from request body
packages/libs/e2e-test-utils/test/setupVincentDevEnv.spec.ts	Added non-null assertions for optional agentSmartAccount property and improved base64/JSON validation for serializedPermissionAccount
packages/libs/e2e-test-utils/package.json	Version bump to 4.0.1-alpha.0 for pre-release
packages/libs/e2e-test-utils/.env.example	New environment variable documentation

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-31T00:01:34Z

packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/generateSiweAuth.ts

+  domain: domainOverride,
+}: {
+  appManagerPrivateKey: `0x${string}`;
+  vincentApiUrl?: string;


The vincentApiUrl parameter is marked as optional but it's required by all callers (registerApp, registerAppVersion, setActiveVersion). This creates a type safety issue where the function could be called without a vincentApiUrl, leading to the fallback localhost defaults. Consider making this parameter required or documenting the intended use case for when it should be omitted.

Suggested change

vincentApiUrl?: string;

vincentApiUrl: string;

Copilot · 2026-01-31T00:01:34Z

packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/generateSiweAuth.ts

+
+  // Check if it's production API
+  if (urlObj.hostname === 'api.heyvincent.ai') {
+    return {


The production domain 'vincent-dashboard-20.vercel.app' is hardcoded in the domain inference logic. If this domain changes in the future (e.g., to 'vincent-dashboard-21.vercel.app'), this code will need to be updated. Consider making this configurable through an environment variable or documenting that this is expected to match the production dashboard domain.

Copilot · 2026-01-31T00:01:34Z

packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/generateSiweAuth.ts

+    nonce,
+    issuedAt,
+    expirationTime,
+    statement = 'Sign in with Ethereum to authenticate with Vincent Registry API',


The chainId is hardcoded to 85452 (Base Sepolia) in the SIWE message creation. However, the codebase appears to support multiple chains including Base mainnet (chain ID 8453). The chain ID in a SIWE message should match the actual chain being used for authentication. Consider making the chainId configurable or deriving it from the vincentRegistryChain configuration to ensure the SIWE message accurately represents the chain the signer is authenticating for.

Copilot

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-31T00:12:09Z

packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/generateSiweAuth.ts

+  // Check if it's production API
+  if (urlObj.hostname === 'api.heyvincent.ai') {
+    return {
+      domain: 'vincent-dashboard-20.vercel.app',


The production domain 'vincent-dashboard-20.vercel.app' appears to be hardcoded with a version-specific deployment identifier ('20'). If the dashboard is redeployed with a different identifier, this will break SIWE authentication. Consider whether this domain should be:

Configurable via environment variable

Made dynamic to handle different Vercel deployment versions

Use a stable production domain (e.g., 'dashboard.heyvincent.ai' if available)

Copilot · 2026-01-31T00:12:09Z

packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/generateSiweAuth.ts

+    issuedAt,
+    expirationTime,
+    statement = 'Sign in with Ethereum to authenticate with Vincent Registry API',
+    chainId = 85452,


The chainId is hardcoded to 85452 (Base Sepolia) in the SIWE message. While this might be the primary test chain, consider making this configurable to support different deployment environments. The chainId in SIWE messages should ideally match the chain where the user's wallet/account is being used, which may vary depending on the environment (e.g., mainnet Base vs Base Sepolia).

Copilot

Pull request overview

Copilot reviewed 9 out of 12 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-31T00:27:36Z

packages/libs/e2e-test-utils/package.json

-    "@lit-protocol/vincent-app-sdk": "workspace:*",
-    "@lit-protocol/contracts-sdk": "^7.2.3",
-    "@lit-protocol/pkp-ethers": "^7.3.1",
    "@lit-protocol/vincent-contracts-sdk": "workspace:*",


The package still imports @lit-protocol/contracts-sdk (specifically LitContracts in src/setup-dev-env/wallets/ensureWalletHasCapacityCredit.ts), but it's being removed from direct dependencies. While this dependency is transitively available through @lit-protocol/vincent-contracts-sdk, relying on transitive dependencies is fragile and can break if the parent package removes it. Consider either keeping @lit-protocol/contracts-sdk as a direct dependency or refactoring ensureWalletHasCapacityCredit to not use it.

Suggested change

"@lit-protocol/vincent-contracts-sdk": "workspace:*",

"@lit-protocol/vincent-contracts-sdk": "workspace:*",

"@lit-protocol/contracts-sdk": "workspace:*",

Copilot · 2026-01-31T00:27:36Z

packages/libs/e2e-test-utils/src/setup-dev-env/vincent-registry-api/generateSiweAuth.ts

+    chainId = 85452,
+    version = '1',


The chainId is hardcoded to 85452 in the SIWE message. According to chainlist.org, this is Base Sepolia's chain ID. However, this value should ideally match the chain where the authentication is happening (Vincent Registry chain). If Vincent Registry can be on different chains (e.g., mainnet Base with chain ID 8453), this hardcoded value could cause authentication issues. Consider making the chainId configurable or deriving it from the vincentRegistryChain parameter that's passed to the functions calling this.

Copilot · 2026-01-31T00:27:37Z

pnpm-lock.yaml

+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me

  tar@7.5.2:
    resolution: {integrity: sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==}
    engines: {node: '>=18'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me


The deprecation warnings for tar versions 6.2.1 and 7.5.2 are being added to the lockfile. These warnings indicate that these versions contain widely publicized security vulnerabilities. While this change is just adding the warning metadata (not changing versions), the project should consider updating to newer versions of tar or updating the dependencies that depend on these old versions to address the security vulnerabilities.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Spacesai1or added 2 commits January 30, 2026 13:38

fix: convert jwt auth to siwe

41c75c3

chore: bump e2e-test-utils to alpha version

4d7da1f

Copilot AI review requested due to automatic review settings January 30, 2026 23:57

Spacesai1or requested review from Ansonhkg, DashKash54 and awisniew207 as code owners January 30, 2026 23:57

Copilot started reviewing on behalf of Spacesai1or January 30, 2026 23:57 View session

vercel bot deployed to Preview – vincent-app-dashboard January 30, 2026 23:59 View deployment

vercel bot deployed to Preview – vincent-dashboard-2.0 January 30, 2026 23:59 View deployment

awisniew207 approved these changes Jan 30, 2026

View reviewed changes

chore: linter

b08cc44

vercel bot had a problem deploying to Preview – vincent-app-dashboard January 31, 2026 00:00 Failure

vercel bot had a problem deploying to Preview – vincent-dashboard-2.0 January 31, 2026 00:00 Failure

Copilot AI reviewed Jan 31, 2026

View reviewed changes

chore: pnpm i

0626329

vercel bot deployed to Preview – vincent-dashboard-2.0 January 31, 2026 00:04 View deployment

vercel bot deployed to Preview – vincent-app-dashboard January 31, 2026 00:04 View deployment

Merge branch 'main' into fix/jwt-to-swi-api-auth

79a0ec9

Copilot AI review requested due to automatic review settings January 31, 2026 00:06

Copilot started reviewing on behalf of Spacesai1or January 31, 2026 00:06 View session

vercel bot deployed to Preview – vincent-dashboard-2.0 January 31, 2026 00:08 View deployment

vercel bot deployed to Preview – vincent-app-dashboard January 31, 2026 00:08 View deployment

Copilot AI reviewed Jan 31, 2026

View reviewed changes

chore: linter

725370c

vercel bot had a problem deploying to Preview – vincent-app-dashboard January 31, 2026 00:20 Failure

vercel bot had a problem deploying to Preview – vincent-dashboard-2.0 January 31, 2026 00:20 Failure

chore: pnpm i

b5f48ef

Copilot AI review requested due to automatic review settings January 31, 2026 00:22

Copilot started reviewing on behalf of Spacesai1or January 31, 2026 00:23 View session

vercel bot deployed to Preview – vincent-app-dashboard January 31, 2026 00:25 View deployment

vercel bot deployed to Preview – vincent-dashboard-2.0 January 31, 2026 00:25 View deployment

Copilot AI reviewed Jan 31, 2026

View reviewed changes

chore: linter fixes

f7da4e2

vercel bot deployed to Preview – vincent-dashboard-2.0 January 31, 2026 00:37 View deployment

vercel bot deployed to Preview – vincent-app-dashboard January 31, 2026 00:37 View deployment

chore: linter

03e38d7

Copilot AI review requested due to automatic review settings January 31, 2026 00:39

Copilot started reviewing on behalf of Spacesai1or January 31, 2026 00:40 View session

vercel bot deployed to Preview – vincent-dashboard-2.0 January 31, 2026 00:42 View deployment

vercel bot deployed to Preview – vincent-app-dashboard January 31, 2026 00:42 View deployment

chore: build errors

b230ec6

vercel bot deployed to Preview – vincent-dashboard-2.0 January 31, 2026 00:51 View deployment

vercel bot deployed to Preview – vincent-app-dashboard January 31, 2026 00:52 View deployment

Copilot AI reviewed Jan 31, 2026

View reviewed changes

Spacesai1or merged commit 382e65b into main Jan 31, 2026
6 checks passed

Spacesai1or deleted the fix/jwt-to-swi-api-auth branch January 31, 2026 00:58

	"@lit-protocol/vincent-contracts-sdk": "workspace:*",
	"@lit-protocol/vincent-contracts-sdk": "workspace:*",
	"@lit-protocol/contracts-sdk": "workspace:*",

Migrate JWT to SIWE for App registration in e2e test utils #475

Migrate JWT to SIWE for App registration in e2e test utils #475

Uh oh!

Conversation

Spacesai1or commented Jan 30, 2026

Uh oh!

vercel bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

awisniew207 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel bot commented Jan 30, 2026 •

edited

Loading