Added allowed-email-hosts field in zk-email auth to whitelist hosts to generate the signatures

Cargo.toml

@@ -28,5 +28,6 @@ phf = { version = "0.11.2", features = ["macros"] }
 rsa = { version = "0.9.2" }
 getrandom = { version = "0.2.10", features = ["custom"] }
 p256 = {version = "0.13.2", features = ["ecdsa-core", "arithmetic", "serde"]}
+ed25519-zebra = { version = "4.1.0", features = ["alloc"] }
 cosmos-sdk-proto = {package = "cosmos-sdk-proto", git = "https://github.com/burnt-labs/cosmos-rust", branch = "feat/xion-zk", default-features = false, features = ["cosmwasm", "xion"]}
 url = "2.5.2"

contracts/account/Cargo.toml

@@ -31,4 +31,5 @@ base64             = { workspace = true }
 rsa                = { workspace = true }
 getrandom          = { workspace = true }
 p256               = { workspace = true }
+ed25519-zebra      = { workspace = true }
 cosmos-sdk-proto   = { workspace = true }

contracts/account/src/auth.rs

@@ -52,6 +52,7 @@ pub enum AddAuthenticator {
     ZKEmail {
         id: u8,
         email_salt: String,
+        allowed_email_hosts: Vec<String>,
         signature: Binary,
     },
 }
@@ -94,6 +95,7 @@ pub enum Authenticator {
     },
     ZKEmail {
         email_salt: String,
+        allowed_email_hosts: Vec<String>,
     },
 }
 
@@ -170,9 +172,10 @@ impl Authenticator {
             }
             Authenticator::ZKEmail {
                 email_salt,
+                allowed_email_hosts,
             } => {
                 let tx_bytes_hash = util::base64url_encode(tx_bytes);
-                let verification = zkemail::verify(deps, tx_bytes_hash.as_bytes(), sig_bytes, email_salt)?;
+                let verification = zkemail::verify(deps, tx_bytes_hash.as_bytes(), sig_bytes, email_salt, allowed_email_hosts)?;
                 Ok(verification)
             }
         }

contracts/account/src/auth/zkemail.rs

@@ -32,6 +32,7 @@ pub fn verify(
     tx_bytes: &[u8],
     sig_bytes: &[u8],
     email_salt: &str,
+    allowed_email_hosts: &[String],
 ) -> ContractResult<bool> {
     // split the sig_bytes into 2 parts proof and publicOutputs
     let sig: ZKEmailSignature = from_json(sig_bytes.to_vec())?;
@@ -43,6 +44,7 @@ pub fn verify(
         proof: serde_json::to_vec(&proof)?,
         public_inputs: public_inputs.clone(),
         email_hash: email_salt.to_string(),
+        allowed_email_hosts: allowed_email_hosts.to_vec(),
     };
 
     let verification_request_bytes = verification_request.to_bytes()?;
@@ -470,19 +472,22 @@ mod tests {
         let signature = sample_zkemail_signature();
         let tx_bytes = "test_transaction";
         let email_salt = "test_salt";
+        let allowed_email_hosts = vec!["example.com".to_string(), "test.com".to_string()];
 
         // Test creating QueryVerifyRequest from signature components
         let verification_request = QueryVerifyRequest {
             tx_bytes: tx_bytes.as_bytes().to_vec(),
             proof: serde_json::to_vec(&signature.proof).unwrap(),
             public_inputs: signature.public_inputs.clone(),
             email_hash: email_salt.to_string(),
+            allowed_email_hosts: allowed_email_hosts.clone(),
         };
 
         // Verify the request is properly constructed
         assert_eq!(verification_request.tx_bytes, tx_bytes.as_bytes());
         assert_eq!(verification_request.email_hash, email_salt.to_string());
         assert_eq!(verification_request.public_inputs, signature.public_inputs);
+        assert_eq!(verification_request.allowed_email_hosts, allowed_email_hosts);
 
         // Verify proof serialization
         let proof_bytes = serde_json::to_vec(&signature.proof).unwrap();

contracts/account/src/contract.rs

@@ -4,7 +4,10 @@ use cosmwasm_std::{
 };
 
 use crate::error::ContractError;
-use crate::execute::{add_auth_method, assert_self, emit, remove_auth_method};
+use crate::execute::{
+    add_auth_method, add_allowed_email_host, assert_self, emit, remove_allowed_email_host,
+    remove_auth_method, update_allowed_email_hosts,
+};
 use crate::msg::{ExecuteMsg, MigrateMsg};
 use crate::{
     error::ContractResult,
@@ -91,6 +94,16 @@ pub fn execute(
         }
         ExecuteMsg::RemoveAuthMethod { id } => remove_auth_method(deps, env, *id),
         ExecuteMsg::Emit { data } => emit(env, data.to_string()),
+        ExecuteMsg::UpdateAllowedEmailHosts {
+            id,
+            allowed_email_hosts,
+        } => update_allowed_email_hosts(deps, env, *id, allowed_email_hosts.clone()),
+        ExecuteMsg::AddAllowedEmailHost { id, email_host } => {
+            add_allowed_email_host(deps, env, *id, email_host.clone())
+        }
+        ExecuteMsg::RemoveAllowedEmailHost { id, email_host } => {
+            remove_allowed_email_host(deps, env, *id, email_host.clone())
+        }
     }
 }
 

contracts/account/src/error.rs

@@ -90,6 +90,15 @@ pub enum ContractError {
 
     #[error("invalid ethereum address")]
     InvalidEthAddress,
+
+    #[error("at least one allowed email host must be present")]
+    NoAllowedEmailHosts,
+
+    #[error("authenticator not found")]
+    AuthenticatorNotFound,
+
+    #[error("operation not supported for this authenticator type")]
+    UnsupportedAuthenticatorOperation,
 }
 
 pub type ContractResult<T> = Result<T, ContractError>;