Repository navigation
feat(auth): Sign-in with Ethereum for Better Auth (#23) - #100
Merged
Merged
Conversation
- Configure Better Auth with the SIWE plugin and cryptographic signature verification - Implement EIP-4361 message parsing, domain normalization, and EIP-55 checksumming - Enforce single-use nonces and expiration with replay protection - Add wallet linking (POST /api/auth/siwe/link) and unlinking (POST /api/auth/siwe/unlink) - Protect against account lockouts when unlinking a user's sole authentication method - Integrate LinkedWalletsPanel into the Settings page and add SIWE to SigninForm and SignupForm - Add unit and integration tests covering all acceptance criteria (16 passing tests) - Document authentication architecture and SIWE flows in features/auth/README.md Closes QMeshPy#23
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
Member
|
Emergency Merge! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements wallet-based sign-in (EIP-4361 / Sign-In with Ethereum) alongside the existing email OTP flow in Better Auth, with cryptographic verification, replay protection via single-use nonces, reverse ENS lookup for display names/avatars, and wallet linking/unlinking management.
Closes #23
Part of #1
What is included
1. SIWE Authentication Flow (EIP-4361)
siweplugin andsiweClienton the frontend.@noble/curves(secp256k1) and@noble/hashes(keccak_256), recovering the checksummed Ethereum address from EIP-191personal_signsignatures without heavyweight external dependencies.consumeVerificationValue), guaranteeing replay attempts fail immediately.expirationTime), and not-before timestamp (notBefore).2. Wallet Linking & Unlinking
POST /api/auth/siwe/link): Verifies the SIWE signature and single-use nonce, and associates the wallet with the active session's account without creating duplicate accounts. Rejects attempts if the address is already linked to another account (409 Conflict).POST /api/auth/siwe/unlink): Safeguards against lockout by preventing users from unlinking their sole authentication method (if they have no email and only 1 wallet). Automatically promotes the oldest remaining wallet to primary if the primary is unlinked.GET /api/auth/siwe/wallets): Retrieves all linked addresses with chain IDs, primary flags, creation dates, and reverse ENS names.3. UI Integration
LinkedWalletsPanelto manage linked wallets, copy checksummed addresses, view ENS names, and link/unlink wallets.4. Tests & Documentation
frontend/tests/siwe-auth.test.mjs) with 16 passing tests covering nonce generation, EIP-4361 parsing, domain normalization, signature verification, address recovery, replay protection, domain/chain/expiration rejection, and linking/unlinking rules.frontend/src/features/auth/README.md.Acceptance Criteria Checklist