feat: Session Key Registry by wjmelements · Pull Request #209 · FilOzone/synapse-sdk

wjmelements · 2025-09-10T00:44:52Z

Reviewer @rvagg
Closes #186

Changes

create SessionKey
synapse.setSession
synapse.getClient
test storage.createContext with session key
document usage
verify works with curio via utils/example-storage-e2e.js

rvagg · 2025-09-10T00:50:15Z

+import { ethers } from 'ethers'
+import { CONTRACT_ABIS, CONTRACT_ADDRESSES, getFilecoinNetworkType } from '../utils/index.ts'
+
+export const CREATE_DATA_SET_TYPEHASH = ethers.id(


I think we could lift up EIP712_TYPES in pdp/auth.ts into types.ts and reconstruct these strings using that data so we don't have to repeat ourselves?

I don't think there's an ethers util to make typehash from eth_signTypedData_v4 types. I can move the code though.

wjmelements · 2025-09-10T00:51:00Z

test:node passes but test:browser fails:

Error: NetworkUtils getFilecoinNetworkType failed: Failed to detect network: Unexpected URL: https://api.calibration.node.glif.io/rpc/v1

I'll look into this tomorrow.

rvagg · 2025-09-10T00:57:59Z

+      const synapse = await Synapse.create({ signer })
+      const sessionKeySigner = new ethers.Wallet(PRIVATE_KEYS.key2, provider)
+      const sessionKey = synapse.setSession(sessionKeySigner)


Am I right in assuming that setSession() is something we expose for advanced and internal use and not something we expect the user to do manually in the normal case and that we'd be able to handle the dirty work of generating a temporary key for some period while the SDK is active? Or do you think we need to make this the user's responsibility to set this up and make it work, we'll just deal with it if they have gone to the trouble?

I don't want the sdk to be opinionated on how the key is generated or stored.

OK, as long as we have really good docs about how to make the most of this - one of the goals of the SDK is to make the golden path very easy, with sensible default and sensible opinions, but also provide ways to take over and do what you want with it. We can't expect our users to want to think too deeply about what we're offering so the more we can give them the better.

wjmelements · 2025-09-10T19:26:51Z

test:node passes but test:browser fails:

Error: NetworkUtils getFilecoinNetworkType failed: Failed to detect network: Unexpected URL: https://api.calibration.node.glif.io/rpc/v1

I am unsure why server.use doesn't cover this. The failure happens during Synapse.create and seems to happen because ethers.Provider.getNetwork makes a GET request (rather than a POST request):

[MSW] Warning: intercepted a request without a matching request handler:

  • GET https://api.calibration.node.glif.io/rpc/v1

I will look into ethers to see why it does that. Here is the trace up to that get request:

      at _FetchRequest.getUrl2 (/Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/utils/geturl-browser.ts:48:26)
      at _FetchRequest.#send (/Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/utils/fetch.ts:539:33)
      at _FetchRequest.send (/Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/utils/fetch.ts:594:21)
      at JsonRpcProvider._send (/Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/providers/provider-jsonrpc.ts:1271:40)
      at /Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/providers/provider-jsonrpc.ts:734:38
      at JsonRpcProvider._detectNetwork (/Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/providers/provider-jsonrpc.ts:749:9)
      at /Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/providers/abstract-provider.ts:878:48
      at JsonRpcProvider.getNetwork (/Users/will/projects/synapse-sdk/node_modules/ethers/src.ts/providers/abstract-provider.ts:887:13)
      at getFilecoinNetworkType (/Users/will/projects/synapse-sdk/src/utils/network.ts:21:34)

wjmelements · 2025-09-10T21:45:12Z

I am unsure why server.use doesn't cover this. The failure happens during Synapse.create and seems to happen because ethers.Provider.getNetwork makes a GET request (rather than a POST request):
[MSW] Warning: intercepted a request without a matching request handler:

  • GET https://api.calibration.node.glif.io/rpc/v1
I will look into ethers to see why it does that. Here is the trace up to that get request:

via npm link, I have verified that ethers does window.fetch with a RequestInit that has method "POST". I also verified that the RequestInit body is not falsy. This helped me deduce that the reason it failed was that I was overriding global fetch without preserving the RequestInit options.

socket-security · 2025-10-07T20:28:01Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ox@0.9.6 ⏵ 0.9.9	⁺¹		⁺²	⁺⁴

View full report

rvagg · 2025-10-08T10:02:52Z

@hugomrdias this has become a blocker for the Filecoin Pin demo site — current plan is to deploy a site that uses a shared wallet, but not wanting to do it by embedding the private key in the site. So instead, we use session keys to set up a long-expiry key with a wallet for the demo, give it perms to create data set and add roots, then run the whole thing in that mode. We'd need to instantiate Synapse with a private-key-less wallet (I'm guessing we might have to implement a custom ether.js Wallet that throws on signMessage() and sendTransaction() but can at least getAddress()), but give it the session key which can be embedded in the page safely.

I know you want to try and come up with a better API for this, but do you mind if we merge this, or some form of it ASAP, and mutate it later just to get something released and usable by filecoin-pin? I'm fine with breaking and improving this if we come up with a better approach later, I just don't want that to be a blocker.

hugomrdias · 2025-10-08T10:10:04Z

sure, does this have the fix for create dataset it needs the owner address in the extra data and not the session key address, cant seem to find it here

rjan90 · 2025-10-08T15:03:02Z

We will merge this as is, after getting in the owner address fix

wjmelements · 2025-10-08T17:51:24Z

investigating this error

❌ Error: Failed to create data set: 500 Internal Server Error - Failed to send transaction: failed to estimate gas: message execution failed (exit=[33], revert reason=[message failed with backtrace:
00: f0169791 (method 3844450837) -- contract reverted at 75 (33)
01: f0169791 (method 6) -- contract reverted at 4535 (33)
02: f0169800 (method 3844450837) -- contract reverted at 75 (33)
03: f0169800 (method 6) -- contract reverted at 10988 (33)
04: f0169792 (method 3844450837) -- contract reverted at 9618 (33)
 (RetCode=33)], vm error=[0xeef23db600000000000000000000000048884f0e81006cf3a3997dc8b39e6632e70b247600000000000000000000000080617b65fd2eea1d7fde2b4f85977670690ed348])

wjmelements · 2025-10-08T17:57:45Z

investigating this error

❌ Error: Failed to create data set: 500 Internal Server Error - Failed to send transaction: failed to estimate gas: message execution failed (exit=[33], revert reason=[message failed with backtrace:
00: f0169791 (method 3844450837) -- contract reverted at 75 (33)
01: f0169791 (method 6) -- contract reverted at 4535 (33)
02: f0169800 (method 3844450837) -- contract reverted at 75 (33)
03: f0169800 (method 6) -- contract reverted at 10988 (33)
04: f0169792 (method 3844450837) -- contract reverted at 9618 (33)
 (RetCode=33)], vm error=[0xeef23db600000000000000000000000048884f0e81006cf3a3997dc8b39e6632e70b247600000000000000000000000080617b65fd2eea1d7fde2b4f85977670690ed348])

It's OperatorNotApproved(address,address). So probably there is disagreement between client and server about which is the current warm storage contract.

This reverts commit 069c60b.

wjmelements · 2025-10-08T18:09:21Z

investigating this error

❌ Error: Failed to create data set: 500 Internal Server Error - Failed to send transaction: failed to estimate gas: message execution failed (exit=[33], revert reason=[message failed with backtrace:
00: f0169791 (method 3844450837) -- contract reverted at 75 (33)
01: f0169791 (method 6) -- contract reverted at 4535 (33)
02: f0169800 (method 3844450837) -- contract reverted at 75 (33)
03: f0169800 (method 6) -- contract reverted at 10988 (33)
04: f0169792 (method 3844450837) -- contract reverted at 9618 (33)
 (RetCode=33)], vm error=[0xeef23db600000000000000000000000048884f0e81006cf3a3997dc8b39e6632e70b247600000000000000000000000080617b65fd2eea1d7fde2b4f85977670690ed348])

It's OperatorNotApproved(address,address). So probably there is disagreement between client and server about which is the current warm storage contract.

This error happens after verifyCreateDataSetSignature which is suspicious because a create data signature for one should not be replayable for another. I will check what else may be causing this.

wjmelements · 2025-10-08T18:14:01Z

I will check what else may be causing this.

I might have skipped utils/post-deploy-setup.js

rvagg · 2025-10-09T00:48:59Z

@wjmelements FYI post-deploy-setup.js can now be replaced with npx filecoin-pin payments setup which does a nicer job of getting your wallet set up as a client. On the SP side, if you're running a test miner, sp-tool.js does that stuff, although it is a bit manual.

Co-authored-by: William Morriss <wjmelements@gmail.com> Co-authored-by: Rod Vagg <rod@vagg.org>

wjmelements added 13 commits September 9, 2025 18:56

wip SessionKey

80f0832

setSession

87dc972

fix: multicall mocks

79c95a7

fix after rebase

ada4fe7

getClient

4e00621

constant

779a02f

rebase changes from #171

2472bc8

WarmStorageOptions.sessionKeyRegistry

4227234

mock the ping

756369b

mock accounts

f91fb4d

fix return type of account

ccd240e

mock eth_blockNumber and eth_chainId

5e593a9

fix build and lint

0a621cc

wjmelements requested a review from rvagg September 10, 2025 00:44

wjmelements linked an issue Sep 10, 2025 that may be closed by this pull request

Support SessionKeyRegistry #186

Closed

github-project-automation Bot added this to FOC Sep 10, 2025

github-project-automation Bot moved this to 📌 Triage in FOC Sep 10, 2025

wjmelements added the enhancement New feature or request label Sep 10, 2025

wjmelements changed the title ~~Session Key Registry~~ feat: Session Key Registry Sep 10, 2025

wjmelements mentioned this pull request Sep 10, 2025

Support SessionKeyRegistry #186

Closed

rvagg reviewed Sep 10, 2025

View reviewed changes

rvagg added this to the M3: Preview Launch of SDK + Filecoin Pin milestone Sep 10, 2025

rjan90 assigned wjmelements Sep 10, 2025

rjan90 moved this from 📌 Triage to ⌨️ In Progress in FOC Sep 10, 2025

restore global fetch init param in ping mock

63ef322

wjmelements had a problem deploying to github-pages September 10, 2025 21:46 — with GitHub Actions Failure

explicit ox dep

96dd778

revoke function, and more documentation

a049b8e

wjmelements requested review from hugomrdias and rvagg October 7, 2025 21:20

BigLep mentioned this pull request Oct 8, 2025

GA: Filecoin Pin Web Demo filecoin-project/filecoin-pin#45

Closed

10 of 12 tasks

wjmelements added 3 commits October 8, 2025 12:26

move the utils dir

069c60b

restore lint:fix

c5ca7a3

pass client address to createDataSet

fe544bb

hugomrdias requested changes Oct 8, 2025

View reviewed changes

Comment thread packages/synapse-sdk/src/storage/context.ts

Revert "move the utils dir"

9dd0a19

This reverts commit 069c60b.

wjmelements requested a review from hugomrdias October 8, 2025 18:04

hugomrdias approved these changes Oct 8, 2025

View reviewed changes

github-project-automation Bot moved this from ⌨️ In Progress to ✔️ Approved by reviewer in FOC Oct 8, 2025

hugomrdias merged commit 0b0c983 into master Oct 8, 2025
10 checks passed

hugomrdias deleted the session-key-registry branch October 8, 2025 18:10

github-project-automation Bot moved this from ✔️ Approved by reviewer to 🎉 Done in FOC Oct 8, 2025

github-actions Bot mentioned this pull request Oct 8, 2025

chore(master): release synapse-sdk 0.30.0 #288

Merged

BigLep mentioned this pull request Oct 9, 2025

Use a session key instead of a demo wallet private key filecoin-project/filecoin-pin-website#9

Closed

rvagg added a commit that referenced this pull request Oct 14, 2025

feat: add session key support (#209)

6b48ade

Co-authored-by: William Morriss <wjmelements@gmail.com> Co-authored-by: Rod Vagg <rod@vagg.org>

github-actions Bot mentioned this pull request Feb 26, 2026

chore(master): release synapse-sdk 0.38.0 #635

Merged

lordshashank pushed a commit to lordshashank/synapse-sdk that referenced this pull request Mar 9, 2026

feat: add session key support (FilOzone#209)

c47e3de

Co-authored-by: William Morriss <wjmelements@gmail.com> Co-authored-by: Rod Vagg <rod@vagg.org>

Conversation

wjmelements commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

rvagg Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

wjmelements Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

wjmelements commented Sep 10, 2025

Uh oh!

rvagg Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

wjmelements Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

rvagg Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

wjmelements commented Sep 10, 2025

Uh oh!

wjmelements commented Sep 10, 2025

Uh oh!

socket-security Bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rvagg commented Oct 8, 2025

Uh oh!

hugomrdias commented Oct 8, 2025

Uh oh!

rjan90 commented Oct 8, 2025

Uh oh!

wjmelements commented Oct 8, 2025

Uh oh!

Uh oh!

wjmelements commented Oct 8, 2025

Uh oh!

wjmelements commented Oct 8, 2025

Uh oh!

Uh oh!

wjmelements commented Oct 8, 2025

Uh oh!

rvagg commented Oct 9, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

wjmelements commented Sep 10, 2025 •

edited

Loading

socket-security Bot commented Oct 7, 2025 •

edited

Loading