fix: build error

Author: think-in-universe

kms/src/ckd.rs

@@ -21,9 +21,9 @@ use blstrs::{G1Affine, G1Projective, G2Affine, G2Projective, Scalar};
 use elliptic_curve::{group::prime::PrimeCurveAffine as _, Field as _, Group as _};
 use hkdf::Hkdf;
 use rand_core::OsRng;
+use serde::Deserialize;
 use sha2::Sha256;
 use sha3::{Digest, Sha3_256};
-use serde::{Deserialize, Serialize};
 
 // Constants matching NEAR MPC contract
 const BLS12381G1_PUBLIC_KEY_SIZE: usize = 48;
@@ -47,11 +47,11 @@ pub struct MpcConfig {
     pub near_rpc_url: String,
 }
 
-#[derive(Deserialize)]
-struct Bls12381G1PublicKey(String);
+#[derive(Clone, Debug, Deserialize)]
+pub struct Bls12381G1PublicKey(String);
 
 /// MPC CKD response (big_y, big_c from MPC network)
-#[derive(Debug, Clone, Deserialize)]
+#[derive(Clone, Debug, Deserialize)]
 pub struct CkdResponse {
     pub big_y: Bls12381G1PublicKey,
     pub big_c: Bls12381G1PublicKey,
@@ -136,15 +136,15 @@ pub fn near_format_to_g2(s: &str) -> Result<G2Projective> {
 
 /// Decrypt MPC response and verify signature
 pub fn decrypt_and_verify_mpc_response(
-    big_y: &str,
-    big_c: &str,
+    big_y: &Bls12381G1PublicKey,
+    big_c: &Bls12381G1PublicKey,
     ephemeral_private_key: Scalar,
     mpc_public_key: &str,
     app_id: &[u8],
 ) -> Result<[u8; BLS12381G1_PUBLIC_KEY_SIZE]> {
     // Parse G1 points
-    let big_y_point = near_format_to_g1(big_y)?;
-    let big_c_point = near_format_to_g1(big_c)?;
+    let big_y_point = near_format_to_g1(&big_y.0)?;
+    let big_c_point = near_format_to_g1(&big_c.0)?;
 
     // Parse MPC public key (G2)
     let mpc_pk = near_format_to_g2(mpc_public_key)?;
@@ -206,7 +206,7 @@ pub fn derive_final_key(
 /// 3. Derives the final 32-byte key using HKDF
 /// 4. Returns the key that can be used as K256 signing key
 pub fn derive_root_key_from_mpc(
-    mpc_response: &CKDResponse,
+    mpc_response: &CkdResponse,
     ephemeral_private_key: Scalar,
     mpc_config: &MpcConfig,
     kms_account_id: &str,

kms/src/near_kms_client.rs

@@ -11,13 +11,13 @@ use anyhow::{Context, Result};
 use fs_err as fs;
 use hex;
 use near_api::{
-    SecretKey,
     types::{AccountId, Data},
-    Contract, NetworkConfig, Signer,
+    Contract, NetworkConfig, SecretKey, Signer,
 };
-use std::sync::Arc;
+use near_crypto::InMemorySigner;
 use serde::{Deserialize, Serialize};
 use std::str::FromStr;
+use std::sync::Arc;
 
 use crate::ckd::CkdResponse;
 use crate::config::KmsConfig;
@@ -46,12 +46,14 @@ impl NearKmsClient {
         network_config: NetworkConfig,
         mpc_contract_id: String,
         kms_contract_id: String,
-        signer: Option<near_crypto::InMemorySigner>,
+        signer: Option<InMemorySigner>,
     ) -> Result<Self> {
-        let mpc_contract_id: AccountId = mpc_contract_id.parse()
+        let mpc_contract_id: AccountId = mpc_contract_id
+            .parse()
             .context("Failed to parse MPC contract ID")?;
 
-        let kms_contract_id: AccountId = kms_contract_id.parse()
+        let kms_contract_id: AccountId = kms_contract_id
+            .parse()
             .context("Failed to parse KMS contract ID")?;
 
         let (signer_account_id, near_api_signer) = if let Some(in_memory_signer) = signer {
@@ -64,7 +66,9 @@ impl NearKmsClient {
             let signer = Signer::from_secret_key(near_api_secret_key)
                 .context("Failed to create near-api Signer")?;
 
-            let account_id: AccountId = in_memory_signer.account_id.to_string()
+            let account_id: AccountId = in_memory_signer
+                .account_id
+                .to_string()
                 .parse()
                 .context("Failed to parse account ID")?;
 
@@ -87,7 +91,8 @@ impl NearKmsClient {
 
     /// Get MPC public key from the contract
     pub async fn get_mpc_public_key(&self, domain_id: u64) -> Result<String> {
-        let current_value: Data<String> = self.mpc_contract
+        let current_value: Data<String> = self
+            .mpc_contract
             .call_function("public_key", serde_json::json!({ "domain_id": domain_id }))
             .read_only()
             .fetch_from(&self.network_config)
@@ -113,7 +118,10 @@ impl NearKmsClient {
             .signer
             .as_ref()
             .context("NEAR signer required for KMS root key requests")?;
-        let signer_account_id = self.signer_account_id.expect("Signer account ID required for KMS root key requests")?;
+        let signer_account_id = self
+            .signer_account_id
+            .as_ref()
+            .context("Signer account ID required for KMS root key requests")?;
 
         // Create request arguments
         let args = RequestKmsRootKeyArgs {
@@ -128,7 +136,7 @@ impl NearKmsClient {
             .kms_contract
             .call_function("request_kms_root_key", args)
             .transaction()
-            .with_signer(self.signer_account_id.clone(), signer.clone())
+            .with_signer(signer_account_id, signer.clone())
             .send_to(&self.network_config)
             .await
             .context("Failed to call KMS contract")?;
@@ -145,7 +153,7 @@ impl NearKmsClient {
         // The return value from Promise callbacks needs to be extracted from the appropriate receipt outcome
         // This may require checking the receipt IDs and following the Promise chain, or using
         // a helper method if the API provides one
-        
+
         // For now, return an error indicating this needs implementation
         // The actual implementation will depend on how the near-api library exposes
         // the return values from Promise callbacks in receipt outcomes
@@ -172,16 +180,14 @@ impl NearKmsClient {
 
 /// Generate a random NEAR implicit account signer
 /// The account ID is derived from the Ed25519 public key (64 hex characters)
-pub fn generate_near_implicit_signer() -> Result<near_crypto::InMemorySigner> {
-    use near_crypto::{InMemorySigner, SecretKey};
-
+pub fn generate_near_implicit_signer() -> Result<InMemorySigner> {
     // Generate random Ed25519 keypair
-    let secret_key = SecretKey::from_random(near_crypto::KeyType::ED25519);
+    let secret_key = near_crypto::SecretKey::from_random(near_crypto::KeyType::ED25519);
 
     // Derive implicit account ID from public key (hex encode the 32-byte public key)
     let public_key = secret_key.public_key();
-        use byte_slice_cast::AsByteSlice;
-        let account_id = match public_key {
+    use byte_slice_cast::AsByteSlice;
+    let account_id = match public_key {
         near_crypto::PublicKey::ED25519(pk) => {
             // Implicit account ID is the hex-encoded public key (64 characters)
             hex::encode(pk.as_byte_slice())
@@ -226,8 +232,6 @@ pub fn load_or_generate_near_signer(
             .as_str()
             .context("Missing secret_key in signer file")?;
 
-        use near_crypto::{InMemorySigner, SecretKey};
-
         let account_id_parsed: near_account_id::AccountId = account_id_str
             .parse()
             .context("Failed to parse account ID from signer file")?;
@@ -236,7 +240,8 @@ pub fn load_or_generate_near_signer(
 
         tracing::info!("Loaded existing NEAR signer: {}", account_id_str);
         Ok(Some(InMemorySigner::from_secret_key(
-            account_id_parsed, secret_key,
+            account_id_parsed,
+            secret_key,
         )))
     } else {
         // Generate new signer

kms/src/onboard_service.rs

@@ -162,15 +162,15 @@ impl Keys {
         quote_enabled: bool,
     ) -> Result<Self> {
         // Derive CA key from root key using deterministic key derivation
-        let ca_key = kdf::derive_ecdsa_key_pair_from_bytes(&root_key, &[b"ca-key"])
+        let ca_key = kdf::derive_p256_key_pair_from_bytes(&root_key, &[b"ca-key"])
             .context("Failed to derive CA key from MPC root key")?;
 
         // Derive tmp CA key from root key
-        let tmp_ca_key = kdf::derive_ecdsa_key_pair_from_bytes(&root_key, &[b"tmp-ca-key"])
+        let tmp_ca_key = kdf::derive_p256_key_pair_from_bytes(&root_key, &[b"tmp-ca-key"])
             .context("Failed to derive tmp CA key from MPC root key")?;
 
         // Derive RPC key from root key
-        let rpc_key = kdf::derive_ecdsa_key_pair_from_bytes(&root_key, &[b"rpc-key"])
+        let rpc_key = kdf::derive_p256_key_pair_from_bytes(&root_key, &[b"rpc-key"])
             .context("Failed to derive RPC key from MPC root key")?;
 
         // Use root key directly as K256 key (it's already 32 bytes)
@@ -426,7 +426,7 @@ async fn try_derive_keys_from_mpc(
     let mpc_domain_id = near.mpc_domain_id;
 
     let network_id = near.network_id.as_deref().unwrap_or("testnet");
-    let network_config = NetworkConfig::from_rpc_url(network_id, &rpc_url);
+    let network_config = NetworkConfig::from_rpc_url(network_id, rpc_url.parse().unwrap());
 
     // Load or generate NEAR signer (implicit account)
     let signer = load_or_generate_near_signer(cfg)?;
@@ -446,7 +446,12 @@ async fn try_derive_keys_from_mpc(
     tracing::info!("  Domain ID: {}", mpc_domain_id);
     tracing::info!("  Signer Account ID: {}", signer.account_id);
 
-    let kms_client = NearKmsClient::new(network_config, mpc_contract_id.clone(), kms_contract_id.clone(), Some(signer))?;
+    let kms_client = NearKmsClient::new(
+        network_config,
+        mpc_contract_id.clone(),
+        kms_contract_id.clone(),
+        Some(signer),
+    )?;
 
     let mpc_public_key = kms_client.get_mpc_public_key(mpc_domain_id).await?;