Skip to content

Adds key rotation to agent#3

Open
mattlockyer wants to merge 15 commits intomainfrom
key-rotation
Open

Adds key rotation to agent#3
mattlockyer wants to merge 15 commits intomainfrom
key-rotation

Conversation

@mattlockyer
Copy link
Contributor

@mattlockyer mattlockyer commented Aug 25, 2025

In order to add multiple keys to an agent account, you should be able to simply call addAgentKey AFTER deriveAgentAccount, based on some predefined number of keys you want the agent to have accessible.

addAgentKey is async and adding 1 key at a time, we might want to improve this with a batch call.

@PiVortex
Copy link
Collaborator

Do you want to add it to the API image?

I think the flow should be that you specify a number of keys you want to create the account with in your environment variables. Once the account is derived, it will batch add that many keys, we limit the number of keys you can have to the maximum you can add in a batch, this should be enough (shouldnt need more to add more than twenty), if not then we can look about adding loops of batches.

Each function call you increment the key index

When you create the keys it should print the array of public keys added to the terminal, I think this would be useful, making it easier to verify that no keys have been added outside of the enclave?

Copy link
Collaborator

@PiVortex PiVortex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets chat about what we're exporting

console.log('register_agent result', registerAgentRes);

// adding keys
const number = 10;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets have it grab from environment variables. By default it should just be 1. Do we know the limit of how many you can add in an action? Lets set a limit so people cant try to add more than possible

* @param {any} args - Arguments to pass to the agent account method
* @returns A promise that resolves with the result of the agent method call.
*/
export async function agent(methodName: string, args: any = {}): Promise<any> {
export async function apiCall(path: string, args: any = {}): Promise<any> {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keep internal, not export?

src/near.ts Outdated
return balance;
};

export const addKeysFromSecrets = async (secrets) => {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dont export, this means users can add keys by using shade-agent-js

When we publish shade-agent-js we should reallly just publish the API wrapper and not publish any of the other files so its clearer what can and can't be accessed. If people would want to use the functions like this because they are doing something very custom I think its better it being published as a seperate lib

* @param {Buffer | undefined} hash - User provided hash for seed phrase generation. When undefined, it will try to use TEE hardware entropy or JS crypto.
* @returns {Promise<string>} The derived account ID
*/
export async function deriveAgentAccount(hash: Buffer | undefined) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dont export

src/index.ts Outdated
@@ -2,7 +2,6 @@ export { TappdClient } from './tappd';
export {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dont export these things, unless we want to create a new package with these helpers in

@PiVortex
Copy link
Collaborator

There is POST and GET routes here, since this is not a REST API it's pretty standard to use default to POST for all routes. I know it sounds weird to POST for getting an account ID but I think it simplifies things a lot

See https://docs.near.org/api/rpc/setup

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants