feat(api): support signing authorizations (#2613)

Co-authored-by: antazoey <[email protected]>

Author: fubuloubu

.github/workflows/test.yaml

@@ -95,7 +95,7 @@ jobs:
           run: ape test tests/functional -m "not fuzzing" -s --cov=src --cov-append -n auto --dist loadgroup
 
         - name: Run Integration Tests
-          run: ape test tests/integration/cli/test_test.py -m "not fuzzing" -s --cov=src --cov-append -n auto --dist loadgroup
+          run: ape test tests/integration -m "not fuzzing" -s --cov=src --cov-append -n auto --dist loadgroup
 
         - name: Run Performance Tests
           run: ape test tests/performance -s

docs/userguides/accounts.md

@@ -344,6 +344,62 @@ assert recovered_signer == account.address
 assert account.check_signature(message, signature)
 ```
 
+### Signing Authorizations (EIP-7702)
+
+If supported by your current ecosystem and account plugins, Ape exposes the capability to set delegate contracts for EOAs via [EIP-7702](https://eips.ethereum.org/EIPS/eip-7702) signed `SetCode` Authorizations.
+To sign an Authorization, use `account.sign_authorization` as follows:
+
+```py
+from ape_ethereum import Authorization
+sig = account.sign_authorization(contract)
+auth = Authorization.from_signature(
+    address=contract.address,
+    chain_id=<chain ID>,
+    nonce=account.nonce,
+    signature=sig,
+)
+# NOTE: Will execute `methodWithAuth` from `contract` *after* executing authorization
+# NOTE: Make sure to increment the `nonce=` kwarg, as the authorization consumes current nonce
+contract.methodWithAuth(..., authorizations=[auth], sender=account, nonce=account.nonce + 1)
+```
+
+```{caution}
+Authorizations are **extremely dangerous** and can lead to full account compromise via signature.
+**DO NOT SIGN** an authorization unless you know what you are doing.
+```
+
+```{note}
+Not all account plugins support signing Authorizations.
+For instance, most hardware wallets may reject signing EIP-7702 Authorizations unless the delegate has been previously whitelisted in their firmware.
+Also, smart contract wallets (such as Safe) cannot sign these message types as only EOAs can sign them.
+```
+
+Once set, you can see if a delegate contract has been set for your EOA account via `account.delegate`.
+Ape exposes a [convienence subcommand](../commands/accounts.html#accounts-auth) group under `ape accounts` for use in managing your delegations.
+
+Ape also exposes the following convienent higher-level API for working with authorizations in a scripting or testing context:
+
+```py
+assert not account.delegate
+
+# Set `account`'s `.delegate` to `contract`
+account.set_delegate(contract)
+assert account.delegate == contract
+
+# Remove `account`'s `.delegate`
+account.remove_delegate()
+assert not account.delegate
+
+# Temporarily use `contract` as `delegate` (and reset upon exiting context)
+# NOTE: Calls `.set_delegate(contract)` when entering context
+with account.delegate_to(contract) as proxy:
+    # NOTE: `proxy` is `Contract(account, contract_type=contract.contract_type)`
+    assert contract.contract_type == proxy.contract_type
+    proxy.methodWithAuth(..., sender=account)
+# NOTE: calls `remove_delegate()` when exiting context
+assert not account.delegate
+```
+
 ## Automation
 
 If you use your keyfile accounts in automation, such as CI/CD, you may need to programmatically unlock them and enable auto-sign.

src/ape/api/accounts.py

@@ -1,6 +1,7 @@
 import os
 from abc import abstractmethod
 from collections.abc import Iterator
+from contextlib import contextmanager
 from functools import cached_property
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Optional, Union
@@ -18,6 +19,7 @@
 from ape.exceptions import (
     AccountsError,
     AliasAlreadyInUseError,
+    APINotImplementedError,
     ConversionError,
     MethodNonPayableError,
     MissingDeploymentBytecodeError,
@@ -60,9 +62,14 @@ def __dir__(self) -> list[str]:
             self.__class__.call.__name__,
             self.__class__.deploy.__name__,
             self.__class__.prepare_transaction.__name__,
+            self.__class__.sign_authorization.__name__,
             self.__class__.sign_message.__name__,
             self.__class__.sign_transaction.__name__,
             self.__class__.transfer.__name__,
+            self.__class__.delegate.fget.__name__,  # type: ignore[attr-defined]
+            self.__class__.set_delegate.__name__,
+            self.__class__.remove_delegate.__name__,
+            self.__class__.delegate_to.__name__,
         ]
 
     @property
@@ -95,16 +102,49 @@ def sign_raw_msghash(self, msghash: "HexBytes") -> Optional[MessageSignature]:
         Args:
           msghash (:class:`~eth_pydantic_types.HexBytes`):
             The message hash to sign. Plugins may or may not support this operation.
-            Default implementation is to raise ``NotImplementedError``.
+            Default implementation is to raise ``APINotImplementedError``.
 
         Returns:
           :class:`~ape.types.signatures.MessageSignature` (optional):
             The signature corresponding to the message.
         """
-        raise NotImplementedError(
+        raise APINotImplementedError(
             f"Raw message signing is not supported by '{self.__class__.__name__}'"
         )
 
+    def sign_authorization(
+        self,
+        address: Any,
+        chain_id: Optional[int] = None,
+        nonce: Optional[int] = None,
+    ) -> Optional[MessageSignature]:
+        """
+        Sign an `EIP-7702 <https://eips.ethereum.org/EIPS/eip-7702>`__ Authorization.
+
+        Args:
+          address (Any): A delegate address to sign the authorization for.
+          chain_id (Optional[int]):
+            The chain ID that the authorization should be valid for.
+            A value of ``0`` means that the authorization is valid for **any chain**.
+            Default tells implementation to use the currently connected network's ``chain_id``.
+          nonce (Optional[int]):
+            The nonce to use to sign authorization with. Defaults to account's current nonce.
+
+        Returns:
+          :class:`~ape.types.signatures.MessageSignature` (optional):
+            The signature corresponding to the message.
+
+        ```{caution}
+        This action has the capability to be extremely destructive to the signer, and might lead to
+        full account compromise. All implementations are recommended to ensure that the signer be
+        made aware of the severity and impact of this action through some callout.
+        ```
+        """
+
+        raise APINotImplementedError(
+            f"Authorization signing is not supported by '{self.__class__.__name__}'"
+        )
+
     @abstractmethod
     def sign_message(self, msg: Any, **signer_options) -> Optional[MessageSignature]:
         """
@@ -438,6 +478,107 @@ def get_deployment_address(self, nonce: Optional[int] = None) -> AddressType:
         nonce = self.nonce if nonce is None else nonce
         return ecosystem.get_deployment_address(self.address, nonce)
 
+    def set_delegate(self, contract: Union[BaseAddress, AddressType, str], **txn_kwargs):
+        """
+        Have the account class override the value of its ``delegate``. For plugins that support
+        this feature, the way they choose to handle it can vary. For example, it could be a call to
+        upgrade itself using some built-in method for a smart wallet (with default txn args) e.g.
+        the Safe smart wallet (https://github.com/ApeWorX/ape-safe), or it could be to use an EIP-
+        7702-like feature available on the network to set a delegate for that account. However if a
+        plugin chooses to handle it, the resulting action (if successful) should make sure that the
+        value that ``self.delegate`` returns is the same as ``contract`` after it is completed.
+
+        By default, this method raises ``APINotImplementedError`` signaling that support is not
+        available for this feature. Calling this may result in other errors if implemented.
+
+        Args:
+            contract (`:class:~ape.contracts.ContractInstance`):
+                The contract instance to override the delegate with.
+            **txn_kwargs: Additional transaction kwargs passed to
+              :meth:`~ape.api.networks.EcosystemAPI.create_transaction`, such as ``gas``
+              ``max_fee``, or ``max_priority_fee``. For a list of available transaction
+              kwargs, see :class:`~ape.api.transactions.TransactionAPI`.
+        """
+        raise APINotImplementedError
+
+    def remove_delegate(self, **txn_kwargs):
+        """
+        Has the account class remove the override for the value of its ``delegate``. For plugins
+        that support this feature, the way they choose to handle it can vary. For example, on a
+        network using an EIP7702-like feature available it will reset the delegate to empty.
+        However, if a plugin chooses to handle it, the resulting action (if successful) should
+        make sure that the value that ``self.delegate`` returns ``None`` after it is completed.
+
+        By default, this method raises ``APINotImplementedError`` signaling that support is not
+        available for this feature. Calling this may result in other errors if implemented.
+
+        Args:
+            **txn_kwargs: Additional transaction kwargs passed to
+              :meth:`~ape.api.networks.EcosystemAPI.create_transaction`, such as ``gas``
+              ``max_fee``, or ``max_priority_fee``. For a list of available transaction
+              kwargs, see :class:`~ape.api.transactions.TransactionAPI`.
+        """
+        raise APINotImplementedError
+
+    @contextmanager
+    def delegate_to(
+        self,
+        new_delegate: Union[BaseAddress, AddressType, str],
+        set_txn_kwargs: Optional[dict] = None,
+        reset_txn_kwargs: Optional[dict] = None,
+        **txn_kwargs,
+    ) -> Iterator[BaseAddress]:
+        """
+        Temporarily override the value of ``delegate`` for the account inside of a context manager,
+        and yields a contract instance object whose interface matches that of ``new_delegate``.
+        This is useful for ensuring that delegation is only temporarily extended to an account when
+        doing a critical action temporarily, such as using an EIP7702 delegate module.
+
+        Args:
+            new_delegate (`:class:~ape.contracts.ContractInstance`):
+                The contract instance to override the `delegate` with.
+            set_txn_kwargs (dict | None): Additional transaction kwargs passed to
+              :meth:`~ape.api.networks.EcosystemAPI.create_transaction` for the
+              :meth:`AccountAPI.set_delegate` method, such as ``gas``, ``max_fee``, or
+              ``max_priority_fee``. Overrides the values provided via ``txn_kwargs``. For a list of
+              available transaction kwargs, see :class:`~ape.api.transactions.TransactionAPI`.
+            reset_txn_kwargs (dict | None): Additional transaction kwargs passed to
+              :meth:`~ape.api.networks.EcosystemAPI.create_transaction` for the
+              :meth:`AccountAPI.remove_delegate` method, such as ``gas``, ``max_fee``, or
+              ``max_priority_fee``. Overrides the values provided via ``txn_kwargs``. For a list of
+              available transaction kwargs, see :class:`~ape.api.transactions.TransactionAPI`.
+            **txn_kwargs: Additional transaction kwargs passed to
+              :meth:`~ape.api.networks.EcosystemAPI.create_transaction`, such as ``gas``
+              ``max_fee``, or ``max_priority_fee``. For a list of available transaction
+              kwargs, see :class:`~ape.api.transactions.TransactionAPI`.
+
+        Returns:
+            `:class:~ape.contracts.ContractInstance`:
+                The contract instance of this account with the interface of `contract`.
+        """
+        set_txn_kwargs = {**txn_kwargs, **(set_txn_kwargs or {})}
+        existing_delegate = self.delegate
+
+        self.set_delegate(new_delegate, **set_txn_kwargs)
+
+        # NOTE: Do not cache this type as it is temporary
+        from ape.contracts import ContractInstance
+
+        # This is helpful for using it immediately to send things as self
+        with self.account_manager.use_sender(self):
+            if isinstance(new_delegate, ContractInstance):
+                # NOTE: Do not cache this
+                yield ContractInstance(self.address, contract_type=new_delegate.contract_type)
+
+            else:
+                yield self
+
+        reset_txn_kwargs = {**txn_kwargs, **(reset_txn_kwargs or {})}
+        if existing_delegate:
+            self.set_delegate(existing_delegate, **reset_txn_kwargs)
+        else:
+            self.remove_delegate(**reset_txn_kwargs)
+
 
 class AccountContainerAPI(BaseInterfaceModel):
     """
@@ -534,7 +675,7 @@ def append(self, account: AccountAPI):
         self.__setitem__(account.address, account)
 
     def __setitem__(self, address: AddressType, account: AccountAPI):
-        raise NotImplementedError("Must define this method to use `container.append(acct)`.")
+        raise APINotImplementedError("Must define this method to use `container.append(acct)`.")
 
     def remove(self, account: AccountAPI):
         """
@@ -563,7 +704,7 @@ def __delitem__(self, address: AddressType):
         Args:
             address (:class:`~ape.types.address.AddressType`): The address of the account to delete.
         """
-        raise NotImplementedError("Must define this method to use `container.remove(acct)`.")
+        raise APINotImplementedError("Must define this method to use `container.remove(acct)`.")
 
     def __contains__(self, address: AddressType) -> bool:
         """
@@ -689,7 +830,7 @@ def address(self) -> AddressType:
         return self.raw_address
 
     def sign_message(self, msg: Any, **signer_options) -> Optional[MessageSignature]:
-        raise NotImplementedError("This account cannot sign messages")
+        raise APINotImplementedError("This account cannot sign messages")
 
     def sign_transaction(self, txn: TransactionAPI, **signer_options) -> Optional[TransactionAPI]:
         # Returns input transaction unsigned (since it doesn't have access to the key)

src/ape/api/address.py

@@ -1,8 +1,6 @@
 from abc import abstractmethod
 from functools import cached_property
-from typing import TYPE_CHECKING, Any
-
-from eth_pydantic_types import HexBytes
+from typing import TYPE_CHECKING, Any, Optional
 
 from ape.exceptions import AccountsError, ConversionError
 from ape.types.address import AddressType
@@ -171,15 +169,34 @@ def codesize(self) -> int:
         The number of bytes in the smart contract.
         """
 
-        return len(self.code)
+        code = self.code
+        return len(code) if isinstance(code, bytes) else len(bytes.fromhex(code.lstrip("0x")))
 
     @property
     def is_contract(self) -> bool:
         """
         ``True`` when there is code associated with the address.
         """
 
-        return len(HexBytes(self.code)) > 0
+        return self.codesize > 0
+
+    @property
+    def delegate(self) -> Optional["BaseAddress"]:
+        """
+        Check and see if Account has a "delegate" contract, which is a contract that this account
+        delegates functionality to. This could be from many contexts, such as a Smart Wallet like
+        Safe (https://github.com/ApeWorX/ape-safe) which has a Singleton class it forwards to, or
+        an EOA using an EIP7702-style delegate. Returning ``None`` means that the account does not
+        have a delegate.
+
+        The default behavior is to use `:class:~ape.managers.ChainManager.get_delegate` to check if
+        the account has a proxy, such as ``SafeProxy`` for ``ape-safe`` or an EIP7702 delegate.
+
+        Returns:
+            Optional[`:class:~ape.contracts.ContractInstance`]:
+                The contract instance of the delegate contract (if available).
+        """
+        return self.chain_manager.get_delegate(self.address)
 
     @cached_property
     def history(self) -> "AccountHistory":

src/ape/managers/chain.py

@@ -9,7 +9,7 @@
 from rich.box import SIMPLE
 from rich.table import Table
 
-from ape.api.address import BaseAddress
+from ape.api.address import Address, BaseAddress
 from ape.api.providers import BlockAPI
 from ape.api.query import (
     AccountTransactionQuery,
@@ -22,6 +22,7 @@
     APINotImplementedError,
     BlockNotFoundError,
     ChainError,
+    ContractNotFoundError,
     ProviderNotConnectedError,
     QueryEngineError,
     TransactionNotFoundError,
@@ -1016,3 +1017,18 @@ def get_code(
         code = self.provider.get_code(address)
         self._code[network.ecosystem.name][network.name][address] = code
         return code
+
+    def get_delegate(self, address: AddressType) -> Optional[BaseAddress]:
+        ecosystem = self.provider.network.ecosystem
+
+        if not (proxy_info := ecosystem.get_proxy_info(address)):
+            return None
+
+        # NOTE: Do this every time because it can change?
+        self.contracts.cache_proxy_info(address, proxy_info)
+
+        try:
+            return self.contracts.instance_at(proxy_info.target)
+
+        except ContractNotFoundError:
+            return Address(proxy_info.target)