Use Domino with Dynamic

import { createParticipantBackend } from "@domino-sdk/relay/portal-proxy"
import { createRemoteJWKSet, errors, jwtVerify } from "jose"

type Credential = {
  format?: string
  address?: string
  chain?: string
  wallet_provider?: string
}

const chains: Record<string, "eip155" | "solana"> = {
  eip155: "eip155",
  evm: "eip155",
  solana: "solana",
}

/** The wallets in a Dynamic JWT's `verified_credentials`, embedded wallets first, at most 20. */
export function dynamicWallets(credentials: Credential[]) {
  const embedded = (credential: Credential) =>
    credential.wallet_provider === "embeddedWallet"

  return credentials
    .filter(
      (credential) =>
        credential.format === "blockchain" &&
        credential.address &&
        chains[credential.chain ?? ""]
    )
    .sort((a, b) => Number(embedded(b)) - Number(embedded(a)))
    .slice(0, 20)
    .map((credential) => ({
      kind: "wallet" as const,
      chain: chains[credential.chain ?? ""],
      address: credential.address ?? "",
    }))
}

/** Verifies the Dynamic JWT the browser sends against the environment's public keys. */
export function dynamicAuthenticate(config: { environmentId: string }) {
  const jwks = createRemoteJWKSet(
    new URL(
      `https://app.dynamicauth.com/api/v0/sdk/${config.environmentId}/.well-known/jwks`
    )
  )

  return async (request: Request) => {
    const token = request.headers
      .get("Authorization")
      ?.match(/^Bearer (\S+)$/)?.[1]

    if (!token) {
      return null
    }

    try {
      const { payload } = await jwtVerify<{
        scope?: string
        verified_credentials?: Credential[]
      }>(token, jwks, {
        issuer: `app.dynamicauth.com/${config.environmentId}`,
        algorithms: ["RS256"],
      })

      // A session still waiting on MFA or a required form has no `user:basic` scope yet.
      if (!payload.sub || !payload.scope?.split(" ").includes("user:basic")) {
        return null
      }

      return {
        subject: payload.sub,
        accounts: dynamicWallets(payload.verified_credentials ?? []),
      }
    } catch (error) {
      // A forged, expired or misaddressed token is a signed-out visitor. Anything else, such as
      // the provider's keys failing to load, is a fault.
      if (
        [
          errors.JWTClaimValidationFailed,
          errors.JWTExpired,
          errors.JWSSignatureVerificationFailed,
          errors.JWSInvalid,
          errors.JWTInvalid,
          errors.JWKSNoMatchingKey,
          errors.JOSEAlgNotAllowed,
        ].some((type) => error instanceof type)
      ) {
        return null
      }

      throw error
    }
  }
}

let backend: ReturnType<typeof createParticipantBackend> | undefined

/** The `/relay/*` handler, built once so the verifier keeps its keys between requests. */
export function participant(env: {
  APP_IDENTITY_KEY: string
  DYNAMIC_ENVIRONMENT_ID: string
}) {
  backend ??= createParticipantBackend({
    baseUrl: "https://relay.domino.run",
    origin: "https://app.example.com",
    integrationKey: env.APP_IDENTITY_KEY,
    authenticate: dynamicAuthenticate({
      environmentId: env.DYNAMIC_ENVIRONMENT_ID,
    }),
  })

  return backend
}

import { createBrowserRelayClient } from "@domino-sdk/relay/browser"
import { RelayProvider } from "@domino-sdk/relay/react"
import type { ReactNode } from "react"

// From @dynamic-labs/sdk-react-core: the JWT, or undefined when nobody is logged in.
declare function getAuthToken(): string | undefined

const relay = createBrowserRelayClient({
  baseUrl: "/relay",
  getToken: async () => getAuthToken() ?? null,
})

export function Community({ children }: { children: ReactNode }) {
  return <RelayProvider client={relay}>{children}</RelayProvider>
}

import type { WalletSigner } from "@domino-sdk/relay"
import { useWallets } from "@domino-sdk/relay/react"

// From @dynamic-labs/sdk-react-core: useUserWallets().find((wallet) =>
// wallet.connector.isEmbeddedWallet && wallet.chain === "EVM").
declare const embeddedWallet: {
  address: string
  signMessage(message: string): Promise<string | undefined>
}

const dynamicSigner: WalletSigner = {
  chain: "eip155",
  name: "Dynamic",
  address: async () => embeddedWallet.address,
  async sign(message) {
    const signature = await embeddedWallet.signMessage(message)

    if (!signature) {
      throw new Error("The wallet returned no signature.")
    }

    return { signature }
  },
}

export function useProveEmbeddedWallet() {
  const { link } = useWallets()

  return () => link(dynamicSigner)
}