Session Keys & Account Abstraction

// Session key encryption using AES-256-GCM
interface SessionKeyEncryption {
  algorithm: "aes-256-gcm";
  keyDerivation: "scrypt";
  keyLength: 32;      // 256 bits
  ivLength: 16;       // 128 bits
  tagLength: 16;      // 128 bits
  saltLength: 32;     // 256 bits
}

// Encryption process
class SessionKeyCrypto {
  async encryptSessionKey(
    privateKey: string,
    userSignature: string
  ): Promise<string> {
    // Generate random salt and IV
    const salt = randomBytes(this.saltLength);
    const iv = randomBytes(this.ivLength);
    
    // Derive encryption key from user signature
    const key = await scrypt(userSignature, salt, this.keyLength);
    
    // Encrypt with AES-256-GCM
    const cipher = createCipheriv(this.algorithm, key, iv);
    let encrypted = cipher.update(privateKey, "utf8", "hex");
    encrypted += cipher.final("hex");
    
    // Get authentication tag
    const tag = cipher.getAuthTag();
    
    // Combine all components
    return Buffer.concat([salt, iv, tag, Buffer.from(encrypted, "hex")])
      .toString("base64");
  }
}

interface SessionPermission {
  operation: string;           // "send", "swap", "stake", "approve"
  maxAmountPerTx: string;     // Maximum per transaction (in wei/native units)
  maxDailyAmount: string;     // Daily spending limit
  allowedContracts: string[]; // Whitelisted contract addresses
  requireConfirmation: boolean; // Manual approval for large amounts
  emergencyStop: boolean;     // Emergency suspension flag
}

// Example permission configurations
const permissions: SessionPermission[] = [
  {
    operation: "send",
    maxAmountPerTx: "0.1",      // 0.1 ETH per transaction
    maxDailyAmount: "1.0",      // 1.0 ETH per day
    allowedContracts: ["*"],    // Any recipient address
    requireConfirmation: false,
    emergencyStop: false
  },
  {
    operation: "swap",
    maxAmountPerTx: "1000",     // $1000 worth per swap
    maxDailyAmount: "5000",     // $5000 per day
    allowedContracts: [
      "0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506", // Sushiswap
      "0xE592427A0AEce92De3Edee1F18E0157C05861564"  // Uniswap V3
    ],
    requireConfirmation: true,  // Require approval for large swaps
    emergencyStop: false
  }
];

interface SessionKeyTimeBounds {
  validUntil: Date;           // Absolute expiration time
  dailyResetAt: Date;         // Daily limit reset time
  createdAt: Date;            // Creation timestamp
  lastUsedAt?: Date;          // Last usage timestamp
  
  // Usage tracking
  totalUsedAmount: string;    // Lifetime usage
  dailyUsedAmount: string;    // Current day usage
}

// Example time configuration
const timeBounds = {
  validUntil: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours
  dailyResetAt: new Date(),   // Reset at midnight UTC
  maxIdleTime: 2 * 60 * 60 * 1000, // 2 hours idle timeout
};

interface BlockchainDetection {
  // Detects AI agents with blockchain tools
  detectAIAgentBlockchain(node: WorkflowNode): boolean;
  
  // Detects direct blockchain blocks  
  detectDirectBlockchain(node: WorkflowNode): boolean;
  
  // Estimates spending requirements
  estimateSpending(nodes: BlockchainNode[]): SpendingEstimate;
  
  // Determines required chains
  detectRequiredChains(nodes: BlockchainNode[]): string[];
}

interface BlockchainNode {
  node: WorkflowNode;
  chains: string[];           // Required blockchain networks
  tools: MCPTool[];          // Required MCP tools
  estimatedSpending: string; // Estimated spending amount
}

// Session key creation with Magic SDK
class MagicSessionKeyCreation {
  async createSessionKey(
    request: CreateSessionKeyRequest,
    magic: Magic
  ): Promise<SessionKeyResult> {
    
    // Get user wallet address from Magic
    const userMetadata = await magic.user.getInfo();
    const walletAddress = userMetadata.publicAddress;
    
    // Create delegation message
    const delegationMessage = {
      userAddress: walletAddress,
      sessionPublicKey: request.sessionPublicKey,
      chainId: request.chainId,
      securityLevel: request.securityLevel,
      validUntil: request.validUntil.toISOString(),
      permissions: request.permissions,
      timestamp: new Date().toISOString(),
      nonce: generateNonce()
    };
    
    // Sign delegation with Magic's secure UI
    const provider = new ethers.BrowserProvider(magic.rpcProvider);
    const signer = await provider.getSigner();
    const signature = await signer.signMessage(
      JSON.stringify(delegationMessage)
    );
    
    // Create session key via API
    return await this.sessionKeyAPI.create({
      delegationMessage,
      signature,
      sessionKeyData: request
    });
  }
}

enum SessionEventType {
  CREATED = "created",
  USED = "used",
  VALIDATED = "validated", 
  REVOKED = "revoked",
  EXPIRED = "expired",
  SECURITY_ALERT = "security_alert",
  SPENDING_ALERT = "spending_alert"
}

interface SessionEvent {
  sessionKeyId: string;
  eventType: SessionEventType;
  eventData: {
    operation?: string;
    amount?: string;
    transactionHash?: string;
    reason?: string;
    metadata?: Record<string, any>;
  };
  severity: "info" | "warning" | "error" | "critical";
  ipAddress?: string;
  userAgent?: string;
  createdAt: Date;
}

// Automatic event logging
class SessionEventLogger {
  async logTransactionAttempt(
    sessionKeyId: string,
    operation: string,
    amount: string,
    success: boolean
  ): Promise<void> {
    await this.createEvent({
      sessionKeyId,
      eventType: success ? SessionEventType.USED : SessionEventType.SECURITY_ALERT,
      eventData: { operation, amount, success },
      severity: success ? "info" : "warning"
    });
  }
}

interface SessionKeyValidator {
  // Basic validation
  validateSessionExists(sessionKeyId: string): Promise<boolean>;
  validateNotExpired(sessionKey: SessionKeyData): boolean;
  validateNotRevoked(sessionKey: SessionKeyData): boolean;
  
  // Permission validation  
  validateOperationAllowed(operation: string, permissions: SessionPermission[]): boolean;
  validateAmountLimits(amount: string, permission: SessionPermission): boolean;
  validateDailyLimits(amount: string, currentUsage: string, limit: string): boolean;
  validateContractAddress(address: string, allowedContracts: string[]): boolean;
  
  // Security validation
  validateSpendingPatterns(usage: UsagePattern): SecurityResult;
  validateTransactionContext(context: TransactionContext): SecurityResult;
  detectAnomalousActivity(sessionKey: SessionKeyData): SecurityResult;
}

// Example validation flow
class TransactionValidator {
  async validateTransaction(
    sessionKeyId: string,
    operation: string,
    amount: string,
    toAddress: string
  ): Promise<ValidationResult> {
    
    const sessionKey = await this.getSessionKey(sessionKeyId);
    const errors: string[] = [];
    
    // Basic checks
    if (!sessionKey) errors.push("Session key not found");
    if (sessionKey.status !== "ACTIVE") errors.push(`Session is ${sessionKey.status}`);
    if (new Date() > sessionKey.validUntil) errors.push("Session expired");
    
    // Permission checks
    const permission = sessionKey.permissions.find(p => p.operation === operation);
    if (!permission) errors.push(`Operation '${operation}' not permitted`);
    
    if (permission) {
      // Amount limits
      if (parseFloat(amount) > parseFloat(permission.maxAmountPerTx)) {
        errors.push(`Amount exceeds per-transaction limit`);
      }
      
      // Daily limits
      const dailyUsed = parseFloat(sessionKey.dailyUsedAmount);
      const dailyLimit = parseFloat(permission.maxDailyAmount);
      if (dailyUsed + parseFloat(amount) > dailyLimit) {
        errors.push(`Would exceed daily spending limit`);
      }
      
      // Contract whitelist
      if (permission.allowedContracts.length > 0 && 
          !permission.allowedContracts.includes(toAddress) &&
          !permission.allowedContracts.includes("*")) {
        errors.push(`Address not in whitelist`);
      }
    }
    
    return {
      isValid: errors.length === 0,
      errors,
      remainingDailyAmount: permission ? 
        (parseFloat(permission.maxDailyAmount) - parseFloat(sessionKey.dailyUsedAmount)).toString() :
        undefined
    };
  }
}

// Real-time spending tracking
interface SpendingTracker {
  // Track usage by session key
  recordTransaction(
    sessionKeyId: string, 
    amount: string, 
    transactionHash: string
  ): Promise<void>;
  
  // Get current usage statistics
  getCurrentUsage(sessionKeyId: string): Promise<UsageStats>;
  
  // Check if transaction would exceed limits
  wouldExceedLimits(
    sessionKeyId: string,
    operation: string, 
    amount: string
  ): Promise<boolean>;
  
  // Reset daily limits (automated)
  resetDailyLimits(): Promise<void>;
}

interface UsageStats {
  totalTransactions: number;
  totalAmount: string;
  dailyTransactions: number;
  dailyAmount: string;
  remainingDailyAmount: string;
  largestTransaction: string;
  averageTransactionSize: string;
}

// Example production configuration
const productionSessionConfig = {
  securityLevel: SecurityLevel.ENHANCED,
  permissions: [
    {
      operation: "swap",
      maxAmountPerTx: "100.0",        // Conservative per-tx limit
      maxDailyAmount: "1000.0",       // Reasonable daily limit
      allowedContracts: [
        "0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506" // Only trusted DEX
      ],
      requireConfirmation: true,       // Require approval for large amounts
      emergencyStop: false
    }
  ],
  duration: 24 * 60 * 60 * 1000,     // 24 hours maximum
  alerts: [
    { threshold: 50, method: "push" }, // 50% spending alert
    { threshold: 80, method: "email" }  // 80% spending alert
  ],
  emergencyContacts: ["admin@company.com", "+1234567890"]
};