Merge pull request #9216 from BitGo/WCN-539/withdrawal-flow-attestation-UI

feat(sdk-core): pass optional attestation through multisig send/initiate

Author: mr-neptune

modules/sdk-core/src/bitgo/pendingApproval/pendingApproval.ts

@@ -31,6 +31,8 @@ type PreApproveResult = {
   halfSigned?: string;
 };
 
+// TODO(WCN-541): add optional attestation pass-through for PUT /pendingapprovals/:id (deferred
+// until multisig attestation, WCN-539, is verified end-to-end on staging).
 type ApprovePendingApprovalRequestBody = {
   state: 'approved';
   otp: string | undefined;

modules/sdk-core/src/bitgo/tss/common.ts

@@ -111,6 +111,8 @@ export async function sendSignatureShare(
   const urlPath = '/wallet/' + walletId + '/txrequests/' + txRequestId + addendum + '/signatureshares';
   const reqTracer = reqId || new RequestTracer();
   bitgo.setRequestTracer(reqTracer);
+  // TODO(WCN-541): add optional attestation pass-through for MPC /signatureshares, first round
+  // only (deferred until multisig attestation, WCN-539, is verified end-to-end on staging).
   return bitgo
     .post(bitgo.url(urlPath, 2))
     .send({

modules/sdk-core/src/bitgo/utils/tss/baseTSSUtils.ts

@@ -514,6 +514,8 @@ export default class BaseTssUtils<KeyShare> extends MpcUtils implements ITssUtil
     preview?: boolean,
     reqId?: IRequestTracer
   ): Promise<TxRequest> {
+    // TODO(WCN-541): add optional attestation pass-through for MPC /txrequests (deferred until
+    // multisig attestation, WCN-539, is verified end-to-end on staging).
     const whitelistedParams = {
       intent: {
         ...intentOptions,

modules/sdk-core/src/bitgo/wallet/BuildParams.ts

@@ -64,6 +64,27 @@ export const BuildParamsOffchain = t.partial({
   idfUserId: t.unknown,
 });
 
+/**
+ * WebAuthn attestation proving a passkey user signed off on this withdrawal intent.
+ * Pure pass-through — the SDK does not validate or interpret this payload.
+ *
+ * @bitgo/public-types' TxSendBody now declares this field natively (WCN-539), so /tx/send and
+ * /tx/initiate no longer need a local copy. This one remains for BuildParams (custodial
+ * /tx/build), which has no upstream equivalent yet.
+ *
+ * TODO(WCN-541): add attestation pass-through for MPC (/txrequests, /signatureshares) and
+ * /pendingapprovals — see the TODO(WCN-541) markers in baseTSSUtils.ts, common.ts, and
+ * pendingApproval.ts.
+ */
+export const AttestationPayload = t.type({
+  signature: t.string,
+  credentialId: t.string,
+  clientDataJSON: t.string,
+  authenticatorData: t.string,
+});
+
+export type AttestationPayload = t.TypeOf<typeof AttestationPayload>;
+
 export const BuildParams = t.exact(
   t.intersection([
     BuildParamsUTXO,
@@ -140,6 +161,8 @@ export const BuildParams = t.exact(
       // Bridging parameters for cross-chain operations (e.g., BTC to sBTC)
       bridgingParams: t.unknown,
       defiParams: t.unknown,
+      // WebAuthn attestation for the withdrawal intent (WCN-539) — pass-through only.
+      attestation: AttestationPayload,
     }),
   ])
 );

modules/sdk-core/src/bitgo/wallet/iWallet.ts

@@ -38,6 +38,7 @@ import {
   TxRequest,
 } from '../utils';
 import { SerializedNtilde } from '../../account-lib/mpc/tss/ecdsa/types';
+import { AttestationPayload } from './BuildParams';
 import { IAddressBook } from '../address-book';
 import { WalletUser, AddressQueryResult } from '@bitgo/public-types';
 import { SubmitTransactionResponse } from '../inscriptionBuilder';
@@ -203,6 +204,8 @@ export interface PrebuildTransactionOptions {
   idfUserId?: string;
   idfVersion?: number;
   comment?: string;
+  /** WebAuthn attestation for the withdrawal intent (WCN-539) — pass-through only. */
+  attestation?: AttestationPayload;
   [index: string]: unknown;
   tokenName?: string;
   nftCollectionId?: string;
@@ -883,6 +886,8 @@ export interface SubmitTransactionOptions {
   };
   comment?: string;
   txRequestId?: string;
+  /** WebAuthn attestation for the withdrawal intent (WCN-539) — pass-through only. */
+  attestation?: AttestationPayload;
 }
 
 export interface SendOptions {

modules/sdk-core/test/unit/bitgo/wallet/BuildParams.ts

@@ -1,5 +1,5 @@
 import * as assert from 'assert';
-import { BuildParams } from '../../../../src/bitgo/wallet/BuildParams';
+import { BuildParams, buildParamKeys, AttestationPayload } from '../../../../src/bitgo/wallet/BuildParams';
 
 describe('BuildParams', function () {
   it('enforces codec', function () {
@@ -74,4 +74,36 @@ describe('BuildParams', function () {
       }
     );
   });
+
+  it('should whitelist attestation (WCN-539) while stripping unrelated unknown params', function () {
+    const attestation = {
+      signature: 'sig',
+      credentialId: 'cred-id',
+      clientDataJSON: 'client-data',
+      authenticatorData: 'auth-data',
+    };
+    assert.deepStrictEqual(
+      BuildParams.encode({
+        recipients: [{ amount: '10000', address: '2N9Ego9KidiZR8tMP82g6RaggQtcbR9zNzH' }],
+        attestation,
+        unknownField: 'should be stripped',
+      } as any),
+      {
+        recipients: [{ amount: '10000', address: '2N9Ego9KidiZR8tMP82g6RaggQtcbR9zNzH' }],
+        attestation,
+      }
+    );
+    assert.ok(buildParamKeys.includes('attestation'), 'buildParamKeys must include attestation');
+  });
+
+  it('AttestationPayload codec requires all four fields', function () {
+    const valid = {
+      signature: 'sig',
+      credentialId: 'cred-id',
+      clientDataJSON: 'client-data',
+      authenticatorData: 'auth-data',
+    };
+    assert.strictEqual(AttestationPayload.is(valid), true);
+    assert.strictEqual(AttestationPayload.is({ ...valid, signature: undefined }), false);
+  });
 });

modules/sdk-core/test/unit/bitgo/wallet/SendTransactionRequest.ts

@@ -24,4 +24,13 @@ describe('SendTransactionRequest', function () {
       addressType: 'p2sh',
     });
   });
+
+  it('preserves attestation (WCN-539: @bitgo/public-types TxSendBody declares it natively)', function () {
+    const attestation = { signature: 'sig', credentialId: 'c', clientDataJSON: 'cd', authenticatorData: 'ad' };
+
+    assert.deepStrictEqual(TxSendBody.encode({ txHex: '00', attestation } as any), {
+      txHex: '00',
+      attestation,
+    });
+  });
 });