Delegated Access for EVM Wallets

use dynamic_waas_sdk::decrypt_delegated_webhook_data;

// Your RSA private key (PEM-encoded PKCS#8). Load from a secrets manager — never hardcode.
let rsa_private_key_pem = std::env::var("DYNAMIC_DELEGATED_RSA_PRIVATE_KEY_PEM")?;

let decrypted = decrypt_delegated_webhook_data(
    &rsa_private_key_pem,
    &payload.encrypted_share,
    &payload.encrypted_wallet_api_key,
)?;

// decrypted.share         — Vec<u8>, the MPC server key share (sensitive)
// decrypted.wallet_api_key — String, the per-wallet API key (sensitive)

use dynamic_waas_sdk::{DelegatedWalletClient, DelegatedWalletClientOpts};
use dynamic_waas_sdk_evm::DelegatedEvmWalletClient;

let delegated = DelegatedWalletClient::new(
    DelegatedWalletClientOpts::new(env_id, decrypted.wallet_api_key.clone()),
)?;
let evm = DelegatedEvmWalletClient::new(&delegated);

let opts = DelegatedWalletClientOpts::new(env_id, wallet_api_key)
    .base_api_url("https://app.dynamic-preprod.xyz") // optional
    .base_mpc_relay_url("https://mpc.dynamic-preprod.xyz"); // optional

use dynamic_waas_sdk::{ServerKeyShare, WalletProperties};

let wallet_properties = WalletProperties {
    chain_name: "EVM".to_string(),
    wallet_id: payload.wallet_id.clone(),
    account_address: payload.account_address.clone(),
    threshold_signature_scheme: Default::default(),
    derivation_path: None,
    address_type: None,
    external_server_key_shares_backup_info: None,
};

let external_server_key_shares = vec![ServerKeyShare {
    /* fields populated from decrypted.share — see docs.rs for the exact shape */
    ..Default::default()
}];

let signature = evm
    .sign_message(
        &wallet_properties,
        &external_server_key_shares,
        "Hello, World!",
    )
    .await?;

delegated.revoke_delegation(&wallet_id).await?;

use dynamic_waas_sdk::{DelegatedWalletClient, DelegatedWalletClientOpts};
use dynamic_waas_sdk_evm::DelegatedEvmWalletClient;

pub struct DelegatedWalletService {
    env_id: String,
    rsa_private_key_pem: String,
    vault: VaultClient,
    audit: AuditLog,
}

impl DelegatedWalletService {
    pub async fn handle_webhook(&self, payload: WebhookPayload) -> anyhow::Result<()> {
        let decrypted = dynamic_waas_sdk::decrypt_delegated_webhook_data(
            &self.rsa_private_key_pem,
            &payload.encrypted_share,
            &payload.encrypted_wallet_api_key,
        )?;

        // Vault both pieces — encrypted at rest, KMS-wrapped.
        self.vault
            .write_envelope(
                &format!("delegated:{}", payload.wallet_id),
                &decrypted,
            )
            .await?;

        self.audit.log("delegation_granted", &payload.wallet_id).await?;
        Ok(())
    }

    pub async fn sign_message(
        &self,
        wallet_id: &str,
        message: &str,
    ) -> anyhow::Result<String> {
        let creds = self.vault.read_envelope(&format!("delegated:{wallet_id}")).await?;

        let delegated = DelegatedWalletClient::new(
            DelegatedWalletClientOpts::new(&self.env_id, creds.wallet_api_key),
        )?;
        let evm = DelegatedEvmWalletClient::new(&delegated);

        let signature = evm
            .sign_message(&creds.wallet_properties, &creds.shares, message)
            .await?;

        self.audit.log("sign_message", wallet_id).await?;
        Ok(signature)
    }
}