fix(bws): bind TSS keygen partyId to the submitting copayer

packages/bitcore-wallet-service/src/lib/tss-keygen-party.ts

@@ -0,0 +1,28 @@
+import { Errors } from './errors/errordefinitions';
+
+/**
+ * Bind a keygen submitter to a single party slot.
+ * Sign already checks (copayerId, partyId). Keygen did not.
+ */
+export function assertKeygenPartyOwnership(params: {
+  participants: Array<string | null | undefined>;
+  partyId: number;
+  copayerId: string;
+  n: number;
+}): void {
+  const { participants, partyId, copayerId, n } = params;
+
+  if (!Number.isInteger(partyId) || partyId < 0 || partyId >= n) {
+    throw Errors.TSS_INVALID_MESSAGE.withMessage('Invalid partyId provided: ' + partyId);
+  }
+
+  const occupiedBy = participants[partyId];
+  if (occupiedBy && occupiedBy !== copayerId) {
+    throw Errors.TSS_NON_PARTICIPANT.withMessage('Party already claimed');
+  }
+
+  const existingParty = participants.findIndex((participant) => participant === copayerId);
+  if (existingParty !== -1 && existingParty !== partyId) {
+    throw Errors.TSS_MAX_PARTICIPANTS_REACHED.withMessage('Copayer already joined as a different party');
+  }
+}

packages/bitcore-wallet-service/src/lib/tss.ts

@@ -6,6 +6,7 @@ import { ITssKeyMessageObject, TssKeyGenModel } from './model/tsskeygen';
 import { ITssSigMessageObject, TssSigGenModel } from './model/tsssign';
 import { WalletService, checkRequired } from './server';
 import { Storage } from './storage';
+import { assertKeygenPartyOwnership } from './tss-keygen-party';
 
 class TssKeyGenClass {
   /**
@@ -111,6 +112,12 @@ class TssKeyGenClass {
         throw Errors.TSS_MISMATCH_VERSION.withMessage(`TSS version (${version}) does not match session version (${session.schemeVersion})`);
       }
 
+      assertKeygenPartyOwnership({
+        participants: session.participants,
+        partyId: message.partyId,
+        copayerId,
+        n: session.n
+      });
 
       if (!session.participants[message.partyId]) {
         if (!this._checkPassword({ session, password })) {

packages/bitcore-wallet-service/test/tss-keygen-party.test.ts

@@ -0,0 +1,73 @@
+'use strict';
+
+import * as chai from 'chai';
+import { Errors } from '../src/lib/errors/errordefinitions';
+import { assertKeygenPartyOwnership } from '../src/lib/tss-keygen-party';
+
+const expect = chai.expect;
+
+describe('assertKeygenPartyOwnership', function() {
+  it('allows a new party to claim an empty slot', function() {
+    expect(function() {
+      assertKeygenPartyOwnership({
+        participants: ['alice', undefined],
+        partyId: 1,
+        copayerId: 'bob',
+        n: 3
+      });
+    }).to.not.throw();
+  });
+
+  it('allows the occupying copayer to keep submitting as that party', function() {
+    expect(function() {
+      assertKeygenPartyOwnership({
+        participants: ['alice', 'bob'],
+        partyId: 1,
+        copayerId: 'bob',
+        n: 3
+      });
+    }).to.not.throw();
+  });
+
+  it('rejects a submitter for a slot already claimed by someone else', function() {
+    try {
+      assertKeygenPartyOwnership({
+        participants: ['alice', 'bob'],
+        partyId: 1,
+        copayerId: 'mallory',
+        n: 3
+      });
+      throw new Error('expected throw');
+    } catch (err) {
+      expect(err.code).to.equal(Errors.codes.TSS_NON_PARTICIPANT);
+    }
+  });
+
+  it('rejects a copayer claiming a second party slot', function() {
+    try {
+      assertKeygenPartyOwnership({
+        participants: ['alice', undefined],
+        partyId: 1,
+        copayerId: 'alice',
+        n: 3
+      });
+      throw new Error('expected throw');
+    } catch (err) {
+      expect(err.code).to.equal(Errors.codes.TSS_MAX_PARTICIPANTS_REACHED);
+    }
+  });
+
+  it('rejects a partyId outside [0, n)', function() {
+    try {
+      assertKeygenPartyOwnership({
+        participants: ['alice'],
+        partyId: 3,
+        copayerId: 'bob',
+        n: 3
+      });
+      throw new Error('expected throw');
+    } catch (err) {
+      expect(err.code).to.equal(Errors.codes.TSS_INVALID_MESSAGE);
+    }
+  });
+});