chore: twitter x google account linking scenarios coverage

Author: Frederick-88

packages/wallets/wallet-turnkey/src/index.ts

@@ -1,3 +1,4 @@
+export * from './strategy/types.js'
 export * from './strategy/strategy.js'
 
 export * from './strategy/turnkey/turnkey.js'

packages/wallets/wallet-turnkey/src/strategy/turnkey/oauth.ts

@@ -42,9 +42,7 @@ export class TurnkeyOauthWallet {
     providerName: TurnkeyOAuthProvider
     indexedDbClient: TurnkeyIndexedDbClient
     expirationSeconds?: number
-  }): Promise<
-    { organizationId: string; credentialBundle: string } | undefined
-  > {
+  }): Promise<TurnkeyOauthLoginResponse | undefined> {
     const { client, indexedDbClient, expirationSeconds } = args
 
     const path = args.oauthLoginPath || TURNKEY_OAUTH_PATH

packages/wallets/wallet-turnkey/src/strategy/turnkey/turnkey.ts

@@ -29,6 +29,13 @@ import type {
   TurnkeyMetadata,
   TurnkeyOAuthProvider,
 } from '@injectivelabs/wallet-base'
+import type {
+  TurnkeyOauthProvider,
+  TurnkeyOAuth2Response,
+  TurnkeyOAuthConfirmResponse,
+  TurnkeyOAuth2ConfirmResponse,
+  TurnkeyLinkOAuthProviderResponse,
+} from '../types.js'
 
 export class TurnkeyWallet {
   private otpId?: string
@@ -359,7 +366,10 @@ export class TurnkeyWallet {
     )
   }
 
-  public async confirmOAuth(provider: TurnkeyOAuthProvider, oidcToken: string) {
+  public async confirmOAuth(
+    provider: TurnkeyOAuthProvider,
+    oidcToken: string,
+  ): Promise<TurnkeyOAuthConfirmResponse> {
     if (provider === TurnkeyProvider.Apple) {
       throw new WalletException(
         new Error('Apple sign in option is currently not supported'),
@@ -376,7 +386,16 @@ export class TurnkeyWallet {
       oauthLoginPath: this.metadata.oauthLoginPath || TURNKEY_OAUTH_PATH,
     })
 
-    if (!oauthResult || !oauthResult.credentialBundle) {
+    if (
+      oauthResult &&
+      'status' in oauthResult &&
+      (oauthResult.status === 'link_required' ||
+        oauthResult.status === 'existing_account_detected')
+    ) {
+      return oauthResult
+    }
+
+    if (!oauthResult?.credentialBundle) {
       throw new WalletException(new Error('Unexpected OAuth result'))
     }
 
@@ -398,14 +417,18 @@ export class TurnkeyWallet {
     codeVerifier: string
     targetPublicKey: string
     providerName: TurnkeyOAuthProvider
-  }) {
+  }): Promise<TurnkeyOAuth2ConfirmResponse> {
     const indexedDbClient = await this.getIndexedDbClient()
     const path = this.metadata.oauth2ExchangePath || 'turnkey/oauth2'
 
     const response = await this.client.post<{
-      data: { credentialBundle: string; organizationId: string; email?: string }
+      data: TurnkeyOAuth2Response
     }>(path, { nonce, authCode, codeVerifier, targetPublicKey, providerName })
 
+    if (response?.data?.status === 'link_required') {
+      return response.data
+    }
+
     if (!response?.data?.credentialBundle || !response?.data?.organizationId) {
       throw new WalletException(
         new Error(`${providerName} OAuth2 exchange failed`),
@@ -421,6 +444,79 @@ export class TurnkeyWallet {
     return { session: credentialBundle, email }
   }
 
+  public async linkOAuthProvider({
+    oidcToken,
+    providerName,
+  }: {
+    oidcToken: string
+    providerName: TurnkeyOAuthProvider
+  }): Promise<TurnkeyLinkOAuthProviderResponse> {
+    const indexedDbClient = await this.getIndexedDbClient()
+    const { organizationId } = await this.getSession()
+
+    if (!organizationId) {
+      throw new WalletException(
+        new Error('Turnkey organization not found. Please login again.'),
+      )
+    }
+
+    const user = await indexedDbClient.getWhoami({ organizationId })
+    let userId = user?.userId
+
+    if (!userId) {
+      const { users } = await indexedDbClient.getUsers({ organizationId })
+
+      if (users.length !== 1) {
+        throw new WalletException(
+          new Error('Unable to resolve current Turnkey user.'),
+        )
+      }
+
+      userId = users[0].userId
+    }
+
+    await indexedDbClient.createOauthProviders({
+      userId,
+      organizationId,
+      oauthProviders: [{ providerName, oidcToken }],
+    })
+
+    return { organizationId }
+  }
+
+  public async getCurrentOauthProviders(): Promise<TurnkeyOauthProvider[]> {
+    const indexedDbClient = await this.getIndexedDbClient()
+    const { organizationId } = await this.getSession()
+
+    if (!organizationId) {
+      throw new WalletException(
+        new Error('Turnkey organization not found. Please login again.'),
+      )
+    }
+
+    const user = await indexedDbClient.getWhoami({ organizationId })
+    let userId = user?.userId
+
+    if (!userId) {
+      const { users } = await indexedDbClient.getUsers({ organizationId })
+
+      if (users.length !== 1) {
+        throw new WalletException(
+          new Error('Unable to resolve current Turnkey user.'),
+        )
+      }
+
+      userId = users[0].userId
+    }
+
+    const { oauthProviders } = await indexedDbClient.getOauthProviders({
+      organizationId,
+      userId,
+    })
+
+    return oauthProviders
+  }
+
   public async refreshSession() {
     const session = await this.getSession()
     const indexedDbClient = await this.getIndexedDbClient()

packages/wallets/wallet-turnkey/src/strategy/types.ts

@@ -1,3 +1,5 @@
+import type { TurnkeyOAuthProvider } from '@injectivelabs/wallet-base'
+
 export const TurnkeyErrorCodes = {
   UserLoggedOut: 7,
 } as const
@@ -30,16 +32,80 @@ export type TurnkeyEnableArgs =
 
 export type TurnkeyOTPCredentialsResponse = {
   otpId: string
+  email?: string
+  userName?: string
   organizationId: string
+  status?: 'existing_account_detected'
 }
 
 export type TurnkeyConfirmEmailOTPResponse = {
   session: string
   organizationId: string
 }
 
-export type TurnkeyOauthLoginResponse = {
+export type TurnkeyOauthAuthenticatedResponse = {
+  message?: string
+  organizationId: string
+  credentialBundle: string
+}
+
+export type TurnkeyExistingAccountDetectedResponse = {
+  email?: string
+  message?: string
+  userName?: string
+  organizationId: string
+  credentialBundle: string
+  status: 'existing_account_detected'
+}
+
+export type TurnkeyOAuth2AuthenticatedResponse = {
+  email?: string
   organizationId: string
+  status?: 'authenticated'
   credentialBundle: string
-  message: string
+}
+
+export type TurnkeyOAuth2LinkRequiredResponse = {
+  email: string
+  oidcToken: string
+  expiresAt?: number
+  organizationId: string
+  status: 'link_required'
+  providerName: TurnkeyOAuthProvider
+}
+
+export type TurnkeyOAuthLinkRequiredResponse = TurnkeyOAuth2LinkRequiredResponse
+
+export type TurnkeyOAuth2Response =
+  | TurnkeyOAuth2AuthenticatedResponse
+  | TurnkeyOAuth2LinkRequiredResponse
+  | TurnkeyExistingAccountDetectedResponse
+
+export type TurnkeyOauthLoginResponse =
+  | TurnkeyOauthAuthenticatedResponse
+  | TurnkeyOAuth2LinkRequiredResponse
+  | TurnkeyExistingAccountDetectedResponse
+
+export type TurnkeyOAuthConfirmResponse =
+  | string
+  | TurnkeyOAuthLinkRequiredResponse
+  | TurnkeyExistingAccountDetectedResponse
+
+export type TurnkeyOAuth2ConfirmResponse =
+  | {
+      email?: string
+      session: string
+    }
+  | TurnkeyOAuthLinkRequiredResponse
+
+export type TurnkeyLinkOAuthProviderResponse = {
+  organizationId: string
+}
+
+export type TurnkeyOauthProvider = {
+  issuer: string
+  subject: string
+  audience: string
+  providerId: string
+  providerName: string
 }