Use Domino with Para

import { createParticipantBackend } from "@domino-sdk/relay/portal-proxy"
import { createRemoteJWKSet, errors, jwtVerify } from "jose"

// Your app's Cosmos chain: Para's token names no chain ID, and Domino needs one.
const cosmos = { network: "cosmos:cosmoshub-4", prefix: "cosmos" } as const

type ParaWallet = { type?: string; address?: string }

/** A wallet Domino can link, or null for a chain it doesn't take. */
function wallet({ type, address = "" }: ParaWallet) {
  if (type === "EVM") {
    return { kind: "wallet", chain: "eip155", address } as const
  }

  if (type === "SOLANA") {
    return { kind: "wallet", chain: "solana", address } as const
  }

  // Only your chain's addresses: another prefix is another Cosmos chain.
  if (
    type === "COSMOS" &&
    address.slice(0, address.lastIndexOf("1")) === cosmos.prefix
  ) {
    return {
      kind: "wallet",
      chain: "cosmos",
      network: cosmos.network,
      address,
    } as const
  }

  return null
}

/**
 * The wallets in a Para JWT: its embedded `wallets` first, then the external wallet the user
 * signed in with, at most 20.
 */
export function paraWallets(data: {
  wallets?: ParaWallet[]
  externalWallet?: ParaWallet
}) {
  return [...(data.wallets ?? []), data.externalWallet]
    .map((entry) => (entry ? wallet(entry) : null))
    .filter((account) => account !== null)
    .slice(0, 20)
}

/** Verifies the JWT from Para's `issueJwt()` against Para's public keys and your API key's ID. */
export function paraAuthenticate(config: {
  /** The `aud` of your app's tokens: your Para API key's ID. */
  apiKeyId: string
  /** `https://api.getpara.com`, or `https://api.beta.getpara.com` for Para's beta environment. */
  apiUrl: string
}) {
  const jwks = createRemoteJWKSet(
    new URL("/.well-known/jwks.json", config.apiUrl)
  )

  return async (request: Request) => {
    const token = request.headers
      .get("Authorization")
      ?.match(/^Bearer (\S+)$/)?.[1]

    if (!token) {
      return null
    }

    try {
      const { payload } = await jwtVerify<{
        data?: { wallets?: ParaWallet[]; externalWallet?: ParaWallet }
      }>(token, jwks, { audience: config.apiKeyId })

      return payload.sub
        ? { subject: payload.sub, accounts: paraWallets(payload.data ?? {}) }
        : null
    } catch (error) {
      // A forged, expired or misaddressed token is a signed-out visitor. Anything else, such as
      // the provider's keys failing to load, is a fault.
      if (
        [
          errors.JWTClaimValidationFailed,
          errors.JWTExpired,
          errors.JWSSignatureVerificationFailed,
          errors.JWSInvalid,
          errors.JWTInvalid,
          errors.JWKSNoMatchingKey,
          errors.JOSEAlgNotAllowed,
        ].some((type) => error instanceof type)
      ) {
        return null
      }

      throw error
    }
  }
}

let backend: ReturnType<typeof createParticipantBackend> | undefined

/** The `/relay/*` handler, built once so the verifier keeps its keys between requests. */
export function participant(env: {
  APP_IDENTITY_KEY: string
  PARA_API_KEY_ID: string
}) {
  backend ??= createParticipantBackend({
    baseUrl: "https://relay.domino.run",
    origin: "https://app.example.com",
    integrationKey: env.APP_IDENTITY_KEY,
    authenticate: paraAuthenticate({
      apiKeyId: env.PARA_API_KEY_ID,
      apiUrl: "https://api.getpara.com",
    }),
  })

  return backend
}

import { createBrowserRelayClient } from "@domino-sdk/relay/browser"
import { RelayProvider } from "@domino-sdk/relay/react"
import type { ReactNode } from "react"

// From @getpara/react-sdk or @getpara/web-sdk: the Para client your app created.
declare const para: {
  isFullyLoggedIn(): Promise<boolean>
  issueJwt(): Promise<{ token: string }>
}

let issued: { token: string; expiresAt: number } | undefined

async function paraToken() {
  if (!(await para.isFullyLoggedIn())) return null

  if (!issued || issued.expiresAt < Date.now() + 60_000) {
    const { token } = await para.issueJwt()
    const { exp } = JSON.parse(atob(token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/")))
    issued = { token, expiresAt: exp * 1000 }
  }

  return issued.token
}

const relay = createBrowserRelayClient({ baseUrl: "/relay", getToken: paraToken })

export function Community({ children }: { children: ReactNode }) {
  return <RelayProvider client={relay}>{children}</RelayProvider>
}

import type { WalletSigner } from "@domino-sdk/relay"
import { useWallets } from "@domino-sdk/relay/react"

// From @getpara/viem-v2-integration: createParaAccount(para), a viem account.
declare const account: {
  address: `0x${string}`
  signMessage(input: { message: string }): Promise<`0x${string}`>
}

const paraSigner: WalletSigner = {
  chain: "eip155",
  name: "Para",
  address: async () => account.address,
  sign: async (message) => ({ signature: await account.signMessage({ message }) }),
}

export function useProveEmbeddedWallet() {
  const { link } = useWallets()

  return () => link(paraSigner)
}