feat(concordium): build PLT token sub-accounts during account sync

Author: lysyi3m

.changeset/concordium-plt-token-sub-accounts.md

@@ -0,0 +1,6 @@
+---
+"@ledgerhq/coin-concordium": minor
+"@ledgerhq/live-common": minor
+---
+
+Build PLT token sub-accounts during Concordium account sync, behind the new `enableTokens` coin config flag (off by default). Tokens are resolved from the CAL by on-chain address, per-token pause and allow/deny state is cached on the account, and PLT balances are reported on the `api/` surface.

apps/ledger-live-desktop/src/renderer/families/concordium/OnboardModal/__tests__/OnboardModal.integ.test.tsx

@@ -162,6 +162,7 @@ describe("OnboardModal Integration", () => {
       grpcPort: 443,
       proxyUrl: "https://ccd-wallet-proxy-mainnet.coin.ledger.com",
       minReserve: 0,
+      enableTokens: false,
     }));
   });
 

libs/coin-modules/coin-concordium/src/api/craftTransaction.test.ts

@@ -101,4 +101,24 @@ describe("api/craftTransaction", () => {
     expect(result).toHaveProperty("transaction");
     expect(typeof result.transaction).toBe("string");
   });
+
+  it("should reject a non-native asset instead of crafting a CCD transfer", async () => {
+    const api = createApi("concordium_testnet");
+    const transactionIntent = {
+      intentType: "transaction" as const,
+      type: "send",
+      sender: VALID_ADDRESS,
+      recipient: VALID_ADDRESS_2,
+      amount: BigInt(1000000),
+      asset: { type: "plt", assetReference: "t-USDT" },
+    } as any;
+
+    await expect(api.craftTransaction(context, transactionIntent)).rejects.toThrow(
+      /asset type plt is not supported/,
+    );
+    // Crafting ignores `asset`, so without the guard this would sign a CCD
+    // transfer of the same integer amount. PLT crafting is LIVE-28337.
+    expect(getNextValidSequenceMock).not.toHaveBeenCalled();
+    expect(craftTransactionMock).not.toHaveBeenCalled();
+  });
 });

libs/coin-modules/coin-concordium/src/api/estimateFees.test.ts

@@ -84,4 +84,21 @@ describe("api/estimateFees", () => {
 
     expect(result).toEqual({ value: BigInt(1000) });
   });
+
+  it("should reject a non-native asset rather than return a plausible native fee", async () => {
+    const api = createApi("concordium_testnet");
+    const transactionIntent = {
+      intentType: "transaction" as const,
+      type: "send",
+      sender: VALID_ADDRESS,
+      recipient: VALID_ADDRESS_2,
+      amount: BigInt(1000000),
+      asset: { type: "plt", assetReference: "t-USDT" },
+    } as any;
+
+    await expect(api.estimateFees(context, transactionIntent)).rejects.toThrow(
+      /asset type plt is not supported/,
+    );
+    expect(estimateFeesMock).not.toHaveBeenCalled();
+  });
 });

libs/coin-modules/coin-concordium/src/api/index.ts

@@ -20,6 +20,7 @@ import {
   TransactionType,
 } from "@ledgerhq/concordium-core";
 import BigNumber from "bignumber.js";
+import invariant from "invariant";
 import { validateAddress } from "../bridge/validateAddress";
 import { rejectBalanceOptions } from "@ledgerhq/coin-module-framework/api/getBalance/rejectBalanceOptions";
 import {
@@ -105,11 +106,27 @@ export function createApi(currencyId: string) {
   } satisfies CoinModuleImpl<ConcordiumCoinConfig, ConcordiumMemo>;
 }
 
+/**
+ * Crafting ignores `asset` and always emits a native transfer, so without this
+ * a PLT intent would be signed as a CCD transfer of the same integer amount.
+ * `getBalance` reports PLT balances, which makes such an intent constructible;
+ * PLT crafting itself lands in LIVE-28337.
+ */
+function assertNativeAsset(transactionIntent: TransactionIntent<ConcordiumMemo>): void {
+  invariant(
+    transactionIntent.asset.type === "native",
+    "concordium: asset type %s is not supported",
+    transactionIntent.asset.type,
+  );
+}
+
 async function craftTransaction(
   config: ConcordiumCoinConfig,
   transactionIntent: TransactionIntent<ConcordiumMemo>,
   currencyId: string,
 ): Promise<CraftedTransaction> {
+  assertNativeAsset(transactionIntent);
+
   const nextSequenceNumber = await getNextValidSequence(
     config,
     transactionIntent.sender,
@@ -139,6 +156,10 @@ async function estimateFees(
   transactionIntent: TransactionIntent<ConcordiumMemo>,
   currencyId: string,
 ): Promise<FeeEstimation> {
+  // Rejected here too, or a caller gets a plausible native fee for a send that
+  // cannot be crafted.
+  assertNativeAsset(transactionIntent);
+
   const memo =
     "memo" in transactionIntent && transactionIntent.memo?.type === "string"
       ? transactionIntent.memo.value

libs/coin-modules/coin-concordium/src/bridge/index.test.ts

@@ -1,5 +1,32 @@
+import type { ConcordiumAccount } from "../types";
 import { createBridges } from ".";
 
+jest.mock("@ledgerhq/ledger-wallet-framework/bridge/jsHelpers", () => ({
+  getSerializedAddressParameters: jest.fn(),
+  makeSync: jest.fn(() => jest.fn()),
+  makeScanAccounts: jest.fn(() => jest.fn()),
+  mergeOps: jest.fn(),
+}));
+
+jest.mock("../config", () => ({
+  __esModule: true,
+  default: { setCoinConfig: jest.fn(), getCoinConfig: jest.fn() },
+}));
+
+const { makeSync, makeScanAccounts } = jest.requireMock(
+  "@ledgerhq/ledger-wallet-framework/bridge/jsHelpers",
+);
+const coinConfig = jest.requireMock("../config").default;
+
+type PostSync = (initial: ConcordiumAccount, synced: ConcordiumAccount) => ConcordiumAccount;
+
+const account = (subAccounts?: unknown[]): ConcordiumAccount =>
+  ({
+    id: "acc",
+    currency: { id: "concordium_testnet" },
+    ...(subAccounts === undefined ? {} : { subAccounts }),
+  }) as unknown as ConcordiumAccount;
+
 describe("createBridges", () => {
   it("has a currency bridge and an account bridge with required methods", () => {
     expect(createBridges(undefined as any, {} as any)).toEqual({
@@ -28,3 +55,52 @@ describe("createBridges", () => {
     });
   });
 });
+
+/**
+ * Token visibility is cleared in `postSync` rather than in the account shape, so
+ * omitting it from either builder silently reintroduces the empty token section.
+ */
+describe("createBridges token visibility wiring", () => {
+  const build = (enableTokens: boolean): { sync: PostSync; scan: PostSync } => {
+    jest.clearAllMocks();
+    coinConfig.getCoinConfig.mockReturnValue({ enableTokens });
+    createBridges(undefined as never, {} as never);
+
+    return {
+      sync: makeSync.mock.calls[0][0].postSync,
+      scan: makeScanAccounts.mock.calls[0][0].postSync,
+    };
+  };
+
+  it("passes a postSync to both makeSync and makeScanAccounts", () => {
+    const { sync, scan } = build(false);
+
+    expect(sync).toEqual(expect.any(Function));
+    expect(scan).toEqual(expect.any(Function));
+  });
+
+  it.each([
+    ["sync", (b: { sync: PostSync; scan: PostSync }) => b.sync],
+    ["scan", (b: { sync: PostSync; scan: PostSync }) => b.scan],
+  ])("removes subAccounts on the %s path when tokens are off", (_name, pick) => {
+    const result = pick(build(false))(account(), account([{ id: "sub" }]));
+
+    expect("subAccounts" in result).toBe(false);
+  });
+
+  it.each([
+    ["sync", (b: { sync: PostSync; scan: PostSync }) => b.sync],
+    ["scan", (b: { sync: PostSync; scan: PostSync }) => b.scan],
+  ])("keeps subAccounts on the %s path when tokens are on", (_name, pick) => {
+    const built = build(true);
+    const synced = account([{ id: "sub" }]);
+
+    expect(pick(built)(account(), synced)).toBe(synced);
+  });
+
+  it("reads the flag per currency, so one network can differ from the other", () => {
+    build(false).sync(account(), account([]));
+
+    expect(coinConfig.getCoinConfig).toHaveBeenCalledWith("concordium_testnet");
+  });
+});

libs/coin-modules/coin-concordium/src/bridge/index.ts

@@ -26,9 +26,20 @@ import { buildReceive } from "./receive";
 import { assignFromAccountRaw, assignToAccountRaw } from "./serialization";
 import { buildSignOperation } from "./signOperation";
 import { getAccountShape } from "./sync";
+import { stripSubAccounts } from "./tokens";
 import { updateTransaction } from "./updateTransaction";
 import { validateAddress } from "./validateAddress";
 
+/**
+ * See `stripSubAccounts` for why the shape cannot clear tokens itself. Wired
+ * into scanning as well as syncing: a freshly discovered account never reaches
+ * `makeSync`, and would keep an empty array until its first sync.
+ */
+const postSync = (_initial: ConcordiumAccount, synced: ConcordiumAccount): ConcordiumAccount =>
+  concordiumCoinConfig.getCoinConfig(synced.currency.id).enableTokens
+    ? synced
+    : stripSubAccounts(synced);
+
 export function createBridges(
   signerContext: SignerContext<ConcordiumSigner>,
   coinConfig: CoinConfig<ConcordiumCoinConfig>,
@@ -37,7 +48,7 @@ export function createBridges(
 
   const getAddress = resolver(signerContext);
   const receive = buildReceive(signerContext);
-  const scanAccounts = makeScanAccounts({ getAccountShape, getAddressFn: getAddress });
+  const scanAccounts = makeScanAccounts({ getAccountShape, getAddressFn: getAddress, postSync });
   const onboardAccount = buildOnboardAccount(signerContext);
   const pairWalletConnect = buildPairWalletConnect();
 
@@ -48,7 +59,7 @@ export function createBridges(
   };
 
   const signOperation = buildSignOperation(signerContext);
-  const sync = makeSync({ getAccountShape });
+  const sync = makeSync({ getAccountShape, postSync });
 
   const accountBridge: AccountBridge<Transaction, ConcordiumAccount> = {
     broadcast,

libs/coin-modules/coin-concordium/src/bridge/serialization.test.ts

@@ -1,4 +1,5 @@
 import BigNumber from "bignumber.js";
+import type { Account, AccountRaw } from "@ledgerhq/types-live";
 import type {
   ConcordiumAccount,
   ConcordiumAccountRaw,
@@ -18,6 +19,19 @@ import {
   assignFromAccountRaw,
 } from "./serialization";
 
+jest.mock("../config", () => ({
+  __esModule: true,
+  default: { getCoinConfig: jest.fn() },
+}));
+
+const coinConfig = jest.requireMock("../config").default;
+
+// Token state only survives deserialization while the feature is on. The suites
+// below assume it is; "assignFromAccountRaw and the token flag" varies it.
+beforeEach(() => {
+  coinConfig.getCoinConfig.mockReturnValue({ enableTokens: true });
+});
+
 const ACCOUNT_ID = "js:2:concordium_testnet:someaddr:";
 
 function createRawOperation(overrides?: Partial<RawOperation>): RawOperation {
@@ -353,3 +367,74 @@ describe("mapRawOperationToBridgeOperation", () => {
     expect(result.blockHash).toBeNull();
   });
 });
+
+/**
+ * Deserialization is the one account-producing path no `postSync` covers, so
+ * the flag has to be enforced here too.
+ */
+describe("assignFromAccountRaw and the token flag", () => {
+  const storedTokens = { "t-USDT": { transferStatus: "allowed" } };
+
+  const raw = () =>
+    ({
+      concordiumResources: {
+        isOnboarded: true,
+        credId: "",
+        publicKey: "",
+        identityIndex: 0,
+        credNumber: 0,
+        ipIdentity: 0,
+        tokens: { ...storedTokens },
+      },
+    }) as unknown as AccountRaw;
+
+  const account = () =>
+    ({
+      currency: { id: "concordium_testnet", family: "concordium" },
+      subAccounts: [{ id: "sub", type: "TokenAccount" }],
+    }) as unknown as Account;
+
+  beforeEach(() => jest.clearAllMocks());
+
+  it("drops sub-accounts and stored token state when the flag is off", () => {
+    coinConfig.getCoinConfig.mockReturnValue({ enableTokens: false });
+    const target = account();
+
+    assignFromAccountRaw(raw(), target);
+
+    expect(target.subAccounts).toBeUndefined();
+    expect(
+      "tokens" in (target as never as { concordiumResources: object }).concordiumResources,
+    ).toBe(false);
+  });
+
+  it("keeps both when the flag is on", () => {
+    coinConfig.getCoinConfig.mockReturnValue({ enableTokens: true });
+    const target = account();
+
+    assignFromAccountRaw(raw(), target);
+
+    expect(target.subAccounts).toHaveLength(1);
+    expect(
+      (target as never as { concordiumResources: { tokens?: object } }).concordiumResources.tokens,
+    ).toEqual(storedTokens);
+  });
+
+  it.each([
+    [
+      "the config cannot be resolved",
+      () => {
+        throw new Error("MissingCoinConfig");
+      },
+    ],
+    ["the flag is absent from the config", () => ({})],
+  ])("fails closed and strips tokens when %s", (_case, impl) => {
+    // An unreadable flag must not expose token UI for a feature that is off by
+    // default. Sub-accounts are rebuilt from chain on the next sync.
+    coinConfig.getCoinConfig.mockImplementation(impl);
+    const target = account();
+
+    expect(() => assignFromAccountRaw(raw(), target)).not.toThrow();
+    expect(target.subAccounts).toBeUndefined();
+  });
+});

libs/coin-modules/coin-concordium/src/bridge/serialization.ts

@@ -7,6 +7,8 @@ import type {
   ConcordiumResources,
   RawOperation,
 } from "../types";
+import coinConfig from "../config";
+import { applyTokensToResources } from "./tokens";
 
 export function isConcordiumAccount(account: Account): account is ConcordiumAccount {
   return account.currency?.family === "concordium" && "concordiumResources" in account;
@@ -54,14 +56,43 @@ export function assignToAccountRaw(account: Account, accountRaw: AccountRaw): vo
   );
 }
 
+/**
+ * Reads the token flag, treating an unreadable config as off.
+ *
+ * `getCoinConfig` throws when unset, but that does not mean "too early":
+ * `fromAccountRaw` awaits `getAccountBridgeByFamily`, which loads the family
+ * setup, and concordium's setup seeds the config at module initialization. A
+ * throw therefore signals abnormal config resolution, where failing closed is
+ * right — exposing token UI for a feature that is off by default is worse than
+ * rebuilding sub-accounts from chain on the next sync.
+ */
+function tokensEnabled(currencyId: string): boolean {
+  try {
+    return coinConfig.getCoinConfig(currencyId).enableTokens === true;
+  } catch {
+    return false;
+  }
+}
+
 export function assignFromAccountRaw(accountRaw: AccountRaw, account: Account): void {
   if (!isConcordiumAccountRaw(accountRaw) || !accountRaw.concordiumResources) {
     return;
   }
 
-  (account as ConcordiumAccount).concordiumResources = copyResources(
-    accountRaw.concordiumResources,
-  );
+  const resources = copyResources(accountRaw.concordiumResources);
+
+  // The only account-producing path no `postSync` covers: the framework assigns
+  // the raw token sub-accounts just before calling this hook, so without a strip
+  // here disabling the flag would hold only until the next app start.
+  if (!tokensEnabled(account.currency.id)) {
+    (account as ConcordiumAccount).concordiumResources = applyTokensToResources(resources, {
+      kind: "cleared",
+    });
+    delete account.subAccounts;
+    return;
+  }
+
+  (account as ConcordiumAccount).concordiumResources = resources;
 }
 
 export function mapRawOperationToBridgeOperation(op: RawOperation, accountId: string): Operation {