Flow control hooks

{
  "backupShares": ["{...}", "{...}"]
}

model CustodianBackupShare {
  id           String   @id @default(cuid())
  clientId     String
  backupMethod String   @default("UNKNOWN")
  share        String
  createdAt    DateTime @default(now())

  @@unique([clientId, backupMethod])
}

model ClientBackupShare {
  id           String   @id @default(cuid())
  clientId     String
  backupMethod String   @default("UNKNOWN")
  cipherText   String
  createdAt    DateTime @default(now())

  @@unique([clientId, backupMethod])
}

import crypto from 'crypto'
import express, { NextFunction, Request, Response } from 'express'
import { PrismaClient } from '@prisma/client'

const db = new PrismaClient()
const app = express()
app.use(express.json())

const requireEnv = (name: string): string => {
  const value = process.env[name]
  if (!value) {
    throw new Error(`${name} is not set`)
  }
  return value
}

const WEBHOOK_SECRET = requireEnv('PORTAL_FLOW_CONTROL_SECRET')
const ENCRYPTION_KEY = Buffer.from(requireEnv('BACKUP_SHARE_ENCRYPTION_KEY'), 'base64')

const encrypt = (plaintext: string): string => {
  const iv = crypto.randomBytes(12)
  const cipher = crypto.createCipheriv('aes-256-gcm', ENCRYPTION_KEY, iv)
  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
  return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString('base64')
}

const decrypt = (encrypted: string): string => {
  const data = Buffer.from(encrypted, 'base64')
  const decipher = crypto.createDecipheriv('aes-256-gcm', ENCRYPTION_KEY, data.subarray(0, 12))
  decipher.setAuthTag(data.subarray(12, 28))
  return Buffer.concat([decipher.update(data.subarray(28)), decipher.final()]).toString('utf8')
}

const verifySecret = (req: Request, res: Response, next: NextFunction) => {
  const received = Buffer.from(req.get('X-Webhook-Secret') ?? '')
  const expected = Buffer.from(WEBHOOK_SECRET)

  if (
    received.length !== expected.length ||
    !crypto.timingSafeEqual(received, expected)
  ) {
    return res.status(401).send()
  }

  next()
}

app.use(verifySecret)

app.post('/sign-approval', (req: Request, res: Response) => {
  const { clientId, signingRequest } = req.body.data

  if (isAllowed(clientId, signingRequest)) {
    return res.status(200).send()
  }

  res.status(400).send()
})

app.post('/backup', async (req: Request, res: Response) => {
  const { backupMethod = 'UNKNOWN', clientId, share } = req.body
  const encryptedShare = encrypt(share)

  await db.custodianBackupShare.upsert({
    where: { clientId_backupMethod: { clientId, backupMethod } },
    create: { backupMethod, clientId, share: encryptedShare },
    update: { share: encryptedShare },
  })

  res.status(200).send()
})

app.post('/backup/fetch', async (req: Request, res: Response) => {
  const { clientId } = req.body

  const rows = await db.custodianBackupShare.findMany({ where: { clientId } })

  res.status(200).json({ backupShares: rows.map((row) => decrypt(row.share)) })
})

const isAllowed = (clientId: string, signingRequest: { method?: string }) =>
  signingRequest.method !== 'eth_signTypedData_v4'

app.listen(3000)