Feat/gnark zkemail

Cargo.toml

@@ -28,5 +28,6 @@ phf = { version = "0.11.2", features = ["macros"] }
 rsa = { version = "0.9.2" }
 getrandom = { version = "0.2.10", features = ["custom"] }
 p256 = {version = "0.13.2", features = ["ecdsa-core", "arithmetic", "serde"]}
-cosmos-sdk-proto = {package = "xion-cosmos-sdk-proto", version = "0.26.1", default-features = false, features = ["std", "cosmwasm", "xion", "serde"]}
+ed25519-zebra = { version = "4.1.0", features = ["alloc"] }
+cosmos-sdk-proto = {package = "cosmos-sdk-proto", git = "https://github.com/burnt-labs/cosmos-rust", branch = "feat/xion-zk", default-features = false, features = ["cosmwasm", "xion"]}
 url = "2.5.2"

contracts/account/Cargo.toml

@@ -31,4 +31,5 @@ base64             = { workspace = true }
 rsa                = { workspace = true }
 getrandom          = { workspace = true }
 p256               = { workspace = true }
-cosmos-sdk-proto   = { workspace = true }
+ed25519-zebra      = { workspace = true }
+cosmos-sdk-proto   = { workspace = true }

contracts/account/src/auth.rs

@@ -10,6 +10,7 @@ pub mod passkey;
 mod secp256r1;
 mod sign_arb;
 pub mod util;
+pub mod zkemail;
 
 pub mod testing {
     pub use super::sign_arb::wrap_message;
@@ -48,6 +49,12 @@ pub enum AddAuthenticator {
         url: String,
         credential: Binary,
     },
+    ZKEmail {
+        id: u8,
+        email_salt: String,
+        allowed_email_hosts: Vec<String>,
+        signature: Binary,
+    },
 }
 
 impl AddAuthenticator {
@@ -59,18 +66,37 @@ impl AddAuthenticator {
             AddAuthenticator::Jwt { id, .. } => *id,
             AddAuthenticator::Secp256R1 { id, .. } => *id,
             AddAuthenticator::Passkey { id, .. } => *id,
+            AddAuthenticator::ZKEmail { id, .. } => *id,
         }
     }
 }
 
 #[derive(Serialize, Deserialize, Clone, JsonSchema, PartialEq, Debug)]
 pub enum Authenticator {
-    Secp256K1 { pubkey: Binary },
-    Ed25519 { pubkey: Binary },
-    EthWallet { address: String },
-    Jwt { aud: String, sub: String },
-    Secp256R1 { pubkey: Binary },
-    Passkey { url: String, passkey: Binary },
+    Secp256K1 {
+        pubkey: Binary,
+    },
+    Ed25519 {
+        pubkey: Binary,
+    },
+    EthWallet {
+        address: String,
+    },
+    Jwt {
+        aud: String,
+        sub: String,
+    },
+    Secp256R1 {
+        pubkey: Binary,
+    },
+    Passkey {
+        url: String,
+        passkey: Binary,
+    },
+    ZKEmail {
+        email_salt: String,
+        allowed_email_hosts: Vec<String>,
+    },
 }
 
 impl Authenticator {
@@ -144,6 +170,14 @@ impl Authenticator {
 
                 Ok(true)
             }
+            Authenticator::ZKEmail {
+                email_salt,
+                allowed_email_hosts,
+            } => {
+                let tx_bytes_hash = util::base64url_encode(tx_bytes);
+                let verification = zkemail::verify(deps, tx_bytes_hash.as_bytes(), sig_bytes, email_salt, allowed_email_hosts)?;
+                Ok(verification)
+            }
         }
     }
 }

contracts/account/src/auth/util.rs

@@ -2,13 +2,18 @@ use crate::error::ContractError;
 use bech32::{ToBase32, Variant};
 use ripemd::Ripemd160;
 use sha2::{Digest, Sha256};
+use base64::{Engine as _, engine::general_purpose};
 
 pub fn sha256(msg: &[u8]) -> Vec<u8> {
     let mut hasher = Sha256::new();
     hasher.update(msg);
     hasher.finalize().to_vec()
 }
 
+pub fn base64url_encode(msg: &[u8]) -> String {
+    general_purpose::URL_SAFE_NO_PAD.encode(msg)
+}
+
 fn ripemd160(bytes: &[u8]) -> Vec<u8> {
     let mut hasher = Ripemd160::new();
     hasher.update(bytes);
@@ -25,3 +30,35 @@ pub fn derive_addr(prefix: &str, pubkey_bytes: &[u8]) -> Result<String, Contract
         Err(err) => Err(err.into()),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_base64url_encode() {
+        // Test empty input
+        assert_eq!(base64url_encode(b""), "");
+
+        // Test simple string
+        assert_eq!(base64url_encode(b"hello"), "aGVsbG8");
+
+        // Test with special characters
+        assert_eq!(base64url_encode(b"hello world!"), "aGVsbG8gd29ybGQh");
+
+        // Test binary data
+        let binary_data = [0x00, 0x01, 0x02, 0x03, 0xFF];
+        assert_eq!(base64url_encode(&binary_data), "AAECA_8");
+
+        // Test longer binary data
+        let longer_binary = [0x48, 0x65, 0x6C, 0x6C, 0x6F, 0x20, 0x57, 0x6F, 0x72, 0x6C, 0x64];
+        assert_eq!(base64url_encode(&longer_binary), "SGVsbG8gV29ybGQ");
+
+        // Test that it produces URL-safe output (no + or / characters, no padding)
+        let test_data = b"test data with special chars: +/=";
+        let encoded = base64url_encode(test_data);
+        assert!(!encoded.contains('+'));
+        assert!(!encoded.contains('/'));
+        assert!(!encoded.ends_with('='));
+    }
+}