fix(kms): make the AWS KMS signer support dynamic-fee transactions

Author: renatomaia

Makefile

@@ -553,14 +553,15 @@ check-license: ## Verify license headers on Go source files
 # Discovery (integration-test-shard-check) lists tests with a plain Go
 # toolchain, so the integration package must stay free of the Cartesi CGo
 # dependency for the check to build on the CI setup runner.
-INTEGRATION_SHARDS := basic quorum prt replay restart withdrawal
+INTEGRATION_SHARDS := basic quorum prt replay restart withdrawal awskms
 
 INTEGRATION_SHARD_basic      := ^Test(EchoAuthority|RejectException|MultiApp|EchoAuthorityStaging)$$
 INTEGRATION_SHARD_quorum     := ^Test(EchoQuorum|SameBlockInputs)$$
 INTEGRATION_SHARD_prt        := ^Test(EchoPrt|RejectExceptionPrt|ForeclosePrt)$$
 INTEGRATION_SHARD_replay     := ^Test(Foreclose|ForecloseReplay|DivergentClaim)$$
 INTEGRATION_SHARD_restart    := ^Test(Restart|SnapshotPolicy)$$
 INTEGRATION_SHARD_withdrawal := ^TestWithdrawalLifecycle$$
+INTEGRATION_SHARD_awskms     := ^TestLocalStackAWSTransactOptsFactory$$
 
 # -----------------------------------------------------------------------------
 # Node topology axis — orthogonal to shards.

internal/config/auth/auth.go

@@ -73,7 +73,7 @@ func GetTransactOptsFactory(ctx context.Context, chainId *big.Int) (ethutil.Tran
 			ctx,
 			kmsConfig,
 			aws.String(authAwsKmsKeyId.Value),
-			types.NewEIP155Signer(chainId),
+			types.LatestSignerForChainID(chainId),
 		)
 	default:
 		return nil, fmt.Errorf("no valid authentication method found")

internal/kms/signtx_test.go

@@ -128,6 +128,37 @@ func TestAWSTransactOptsFactorySignsWithSubmitContext(t *testing.T) {
 	require.NoError(t, client.signContext.Err())
 }
 
+func TestAWSTransactOptsFactorySignsDynamicFeeTransaction(t *testing.T) {
+	privateKey, err := crypto.GenerateKey()
+	require.NoError(t, err)
+
+	chainID := big.NewInt(31337)
+	client := newFakeKMSClient(t, privateKey)
+	keyID := "alias/test-key"
+	factory, err := CreateAWSTransactOptsFactory(
+		context.Background(), client, &keyID, ethtypes.LatestSignerForChainID(chainID),
+	)
+	require.NoError(t, err)
+
+	opts, err := factory.NewTransactOpts(context.Background())
+	require.NoError(t, err)
+	tx := ethtypes.NewTx(&ethtypes.DynamicFeeTx{
+		ChainID:   chainID,
+		Nonce:     1,
+		GasTipCap: big.NewInt(1),
+		GasFeeCap: big.NewInt(2),
+		Gas:       21000,
+		To:        &common.Address{0x01},
+		Value:     big.NewInt(3),
+	})
+	signed, err := opts.Signer(opts.From, tx)
+	require.NoError(t, err)
+
+	sender, err := ethtypes.Sender(ethtypes.LatestSignerForChainID(chainID), signed)
+	require.NoError(t, err)
+	require.Equal(t, crypto.PubkeyToAddress(privateKey.PublicKey), sender)
+}
+
 type fakeKMSClient struct {
 	t           *testing.T
 	privateKey  *ecdsa.PrivateKey

test/compose/compose.integration.yaml

@@ -83,6 +83,18 @@ services:
       <<: *env
     restart: "no"
 
+  localstack:
+    image: localstack/localstack:4.14.0
+    networks:
+      - devnet
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:4566/_localstack/health"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+    environment:
+      SERVICES: kms
+
   # The node is started and managed by TestMain inside the test process.
   # This ensures all tests (including restart and snapshot policy tests)
   # run with the same infrastructure in both local and CI environments.
@@ -99,6 +111,8 @@ services:
         condition: service_healthy
       dapp-builder:
         condition: service_completed_successfully
+      localstack:
+        condition: service_healthy
     volumes:
       - dapp_images:/var/lib/cartesi-rollups-node/dapps:ro
       - node_logs:/var/lib/cartesi-rollups-node/logs
@@ -125,6 +139,12 @@ services:
       CARTESI_TEST_ERC20_WITHDRAWAL_DAPP_PATH: /var/lib/cartesi-rollups-node/dapps/erc20-withdrawal-dapp
       CARTESI_TEST_NODE_LOG_FILE: /var/lib/cartesi-rollups-node/logs/node.log
       CARTESI_INSPECT_URL: http://localhost:10012/
+      # test/integration/localstack_integration_test.go
+      AWS_ACCESS_KEY_ID: test
+      AWS_SECRET_ACCESS_KEY: test
+      AWS_REGION: us-east-1
+      LOCALSTACK_KMS_ENDPOINT: http://localstack:4566
+      LOCALSTACK_KMS_REQUIRED: "true"
 
 volumes:
   dapp_images:

test/integration/localstack_integration_test.go

@@ -0,0 +1,84 @@
+// (c) Cartesi and individual authors (see AUTHORS)
+// SPDX-License-Identifier: Apache-2.0 (see LICENSE)
+
+//go:build endtoendtests
+
+package integration
+
+import (
+	"context"
+	"math/big"
+	"os"
+	"testing"
+
+	"github.com/cartesi/rollups-node/internal/kms"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	awskms "github.com/aws/aws-sdk-go-v2/service/kms"
+	kmstypes "github.com/aws/aws-sdk-go-v2/service/kms/types"
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/core/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLocalStackAWSTransactOptsFactory(t *testing.T) {
+	endpoint := os.Getenv("LOCALSTACK_KMS_ENDPOINT")
+	if endpoint == "" {
+		t.Skip("LOCALSTACK_KMS_ENDPOINT is not set; skipping LocalStack KMS integration test")
+	}
+	ctx := context.Background()
+	cfg, err := config.LoadDefaultConfig(ctx,
+		config.WithRegion("us-east-1"),
+		config.WithBaseEndpoint(endpoint),
+	)
+	require.NoError(t, err)
+	client := awskms.NewFromConfig(cfg)
+
+	created, err := client.CreateKey(ctx, &awskms.CreateKeyInput{
+		KeyUsage: kmstypes.KeyUsageTypeSignVerify,
+		KeySpec:  kmstypes.KeySpecEccSecgP256k1,
+	})
+	if err != nil {
+		message := "unable to create key on LocalStack"
+		if os.Getenv("LOCALSTACK_KMS_REQUIRED") == "true" {
+			t.Fatalf("%s: %v", message, err)
+		}
+		t.Skipf("%s: %v", message, err)
+	}
+	require.NotNil(t, created.KeyMetadata)
+	require.NotNil(t, created.KeyMetadata.KeyId)
+
+	chainID := big.NewInt(31337)
+	factory, err := kms.CreateAWSTransactOptsFactory(
+		ctx, client, created.KeyMetadata.KeyId, types.LatestSignerForChainID(chainID),
+	)
+	require.NoError(t, err)
+	require.NotEqual(t, common.Address{}, factory.From())
+	opts, err := factory.NewTransactOpts(ctx)
+	require.NoError(t, err)
+
+	to := common.Address{0x01}
+	tests := map[string]*types.Transaction{
+		"legacy": types.NewTx(&types.LegacyTx{
+			Nonce: 1, GasPrice: big.NewInt(2), Gas: 21000, To: &to, Value: big.NewInt(3),
+		}),
+		"dynamic fee": types.NewTx(&types.DynamicFeeTx{
+			ChainID: chainID, Nonce: 2, GasTipCap: big.NewInt(1), GasFeeCap: big.NewInt(2),
+			Gas: 21000, To: &to, Value: big.NewInt(3),
+		}),
+	}
+	for name, tx := range tests {
+		t.Run(name, func(t *testing.T) {
+			signed, err := opts.Signer(opts.From, tx)
+			require.NoError(t, err)
+			sender, err := types.Sender(types.LatestSignerForChainID(chainID), signed)
+			require.NoError(t, err)
+			require.Equal(t, factory.From(), sender)
+		})
+	}
+
+	_, _ = client.ScheduleKeyDeletion(ctx, &awskms.ScheduleKeyDeletionInput{
+		KeyId: created.KeyMetadata.KeyId, PendingWindowInDays: aws.Int32(7), //nolint:mnd
+	})
+}