Skip to content

Package updates#181

Merged
sschiessl-bcp merged 90 commits intobitshares:developfrom
BTS-CM:package_updates
Aug 14, 2022
Merged

Package updates#181
sschiessl-bcp merged 90 commits intobitshares:developfrom
BTS-CM:package_updates

Conversation

@abitmore
Copy link
Member

@abitmore abitmore commented Apr 24, 2022

Tracker for development by @grctest.

(The following is copied from #181 (comment))

Summary of changes in PR:

  • npm-check-updates was initially used to identify packages which could be updated
    • About half of the packages were able to be updated with minor changes
    • Some of the updated packages introduced severe breaking changes, namely vue2 -> vue3
      • The update to Vue3 required a refactoring of every (30+) components to using the composition API https://vuejs.org/api/composition-api-setup.html#basic-usage
      • Most of the vue2 related packages did/do not have equivalent vue3 packages, resulting in their replacement/removal being warranted.
        • Removed with no replacement: Password strength indicator (Custom zxcvbn component required)
        • Replaced: Bootstrap -> balm-ui
        • Replaced vue-multiselect with balm-ui selector component

Security changes

  • sha512 hashing password that's stored in memory after login
    • Edge case: Restoring from old beet backup would be encrypted with raw password instead of the hash, so legacy checkbox was included for anyone who might have restored an old wallet instead of creating a new wallet.
  • Removed cert stored in repo, fetches cert from beet cert repo
    • Automated tools search for these certs & report to the issuer
    • We should consider encrypting/encoding the external repo cert to further hide cert
  • Beet client doesn't respond to queries unless logged in
  • Additional store getter functions created to reduce handling of excessive data in vue components
  • Uplift of packages across the board for security vulnerability bump
  • Prompts are now much more isolated from the rest of the wallet, now launch their own electron BrowserWindow where user input data is passed as url encoded parameters. These prompts are isolated and can't access the main beet window state.
  • elliptic replaced with secp from "@noble/secp256k1" and @noble/ed25519 for key exchange

UI changes

  • Language selector component hidden from dashboard since there's only one language
  • Main electron window bar isn't skinned
    • pro: easier to move the window, uses system app frame
    • con: no longer goes to task tray when closed
    • Could be re-implemented
  • Balm-UI used instead of Bootstrap, deviating from the brand guide
  • Debug console can be accessed via 'alt' then view -> debug tools.
  • Sending BEET to system tray is also in the view menu.
  • Balance in dashboard and linked apps list in settings are now scroll-able lists

New functionality

  • Sign NFT_Object for NFT creation
  • Broadcast & Update assets - for NFT issuance tool
  • Prompts are now isolated popup windows instead of alert boxes within the main window

Maintenance based decisions

  • After updating packages the icons broke, so the skinned window frame was replaced with system window frame.
  • Elliptic package was replaced as it hadn't been updated in more than 2 years
  • The custom BeetWS WebSocket implementation was replaced with socket.io
    • This prove to require a large refactoring of the beetserver, blockchainfactory and beet-js library.
    • It's far more maintained & supports multiple environments

Updated several of the packages
Removed node-sass and chalk dependencies
swapped i18next fs backend
WIP: Need to fix an issue with the debug console button not triggering (remote)
latest electron package doesn't care about 'enableRemoteModule: true' anymore, remote variable was undefined.
removed hardcoded ssl, uses http and socket.io
updated and replaced packages
popups don't work
api calls all are WIP
removed incompatible packages
switching from bootstrap to balm ui for vue3 support
multiselects need to be replaced with @vueform/multiselect or the balm-ui menus
readline swapped to linebyline
different i18n setup & package
removing password strength meter, could reimplement with zxcvbn manually later
Started migrating the component files to the vue3 composition api <script setup> format. This still needs to be applied to a dozen+ files.
Pop ups still need work, they inherit an abstract component which will be converted into vue lib functions instead of an inherited component for composition api use.

be aware this commit won't build, it's a partial dev commit to avoid loss of progression.
Pop-ups are next
Webpack changes
Package updates & removing 2 multiselect packages in favour of palm-ui's select component.
Switch to using mitt package to replace the eventbus emit/on messaging, as vue3 doesn't support this feature directly. Perhaps this could be replaced entirely by using ipcrenderer/ipcmain?
Looking into refactoring the pop ups to use an additional modal browserview.
Runs with errors, development use only.
Changing tooltip mechanism
preparing modal window for prompts
removed queue for alerts, one at a time
migrated more of the components
Nearing implementation of modal prompts, setting modal window title and passing args through query-strings
replacing this.$* with direct import references
Next step is to ipcrender call the modals, rather than enter via $refs.popup.show & ipcrender on accept/reject.
Nearly complete popup migration, still need to verify the usage of the whitelist checkbox mechanism & whether we're calling the ipcrenderer correctly to close after _accept||_reject.
Show system notification on 'notify' now.
Removing logic from component {{ var }} sections as per vue3.
Injecting emitter properly in components.
The beetframe was visually glitching, so it was removed.
You can easily move the app around, you can trigger a hidden menu via the ALT button, and trigger dev tools from the view menu.
Unfortunately it no longer closes to the task tray, WIP!
adding german
trying to change language from the hidden menu
Almost complete the cloud account auth route, ran into bitsharesjs issue #92
Added node connection selection to step 1 of the add account wizard
Adding next/back buttons to the import method components
Removing 'set' functions
Debugging network connection issues & initial node config choices
removed invalid nodes
added node dropdown props
fixing settingsstore issues
Using develop branch of bitsharesjs to get around crypto bug
Developing the dashboard, account select, balance and account detail components.
Small changes to setting store mutators.
Trying to load modals on link request
Fixing css font loading errors
Removing unnecessary component
Added modal.js back
Moving logic to beetserver away from components
balm ui select
balances pagination
Client now waits for modal response properly
Remove console logs
@sschiessl-bcp
Copy link
Collaborator

It is now displaying properly on my Laptop, nothing cut out anymore!

Signing a message is now also working properly. What is the purpose of the Signature Verification dialog?

@grctest
Copy link
Contributor

grctest commented Jul 17, 2022

The sign message example script immediately attempts to verify the signed message, by verifying the signed message it proves that the signed message was valid. The prompt requests permission to perform the verification, perhaps the info could be conveyed better in the prompt?

I could have made it a separate script, but then would have needed to save the output of the signMessage script for input in the verifyMessage script.

After looking more into the mkcert option for https, I've decided to reintroduce part of the old https method, to improve compatibility. Will update the beet-js to detect if https or http is up & commit once working.

@sschiessl-bcp
Copy link
Collaborator

The sign message example script immediately attempts to verify the signed message, by verifying the signed message it proves that the signed message was valid. The prompt requests permission to perform the verification, perhaps the info could be conveyed better in the prompt?

I could have made it a separate script, but then would have needed to save the output of the signMessage script for input in the verifyMessage script.

After looking more into the mkcert option for https, I've decided to reintroduce part of the old https method, to improve compatibility. Will update the beet-js to detect if https or http is up & commit once working.

That's an unnecessary double check for the user. No single one will actually validate that signature by hand since you just created it. You can of course validate the signature directly after creating it, but asking the user to OK that is breaking UX. User must trust Beet to sign properly.

@grctest
Copy link
Contributor

grctest commented Jul 17, 2022

Alright, I'll make the message verification automatic without user prompt.

grctest added 5 commits July 17, 2022 21:46
Remove prompt for message verification.
Reintroduce git fetched https w/ http fallback.
Was previously signing null instead of the payload text
Revert to running both https and http servers again
Introduce signNFT JSON prompt function
Required prior to issuing an NFT, as nft_object data requires signature
@grctest
Copy link
Contributor

grctest commented Jul 19, 2022

Message verification prompt is gone now.
Reintroduced https alongside http, fetches certs from beet cert repo.
Added an nft_object signing api function prompt for streamlining NFT issuance on BTS.
Also fixed an issue with the signmessage function, it was signing null instead of messageText.

I feel like this is ready for merge at this point :)

grctest added 8 commits July 22, 2022 00:08
Added progress indication for the dashboard balance and the bitshares cloud password login.
Padding, margins, making the prompt contents more readable
Improve health checks for BTS wss connections
If node connection fails during balance lookup, temp ban it so we switch nodes.
User supplied data is now properly encoded/decoded when launching a prompt.
When a bitshares user attempts to inject a create_asset or update_asset command, a prompt will now be shown in beet. Still needs final callback debuging however these tx types broadcast through beet now.
Filter accounts based on requested chain
Properly return result from apuUtils.
@sschiessl-bcp sschiessl-bcp marked this pull request as ready for review August 4, 2022 21:16
@sschiessl-bcp
Copy link
Collaborator

There are some UX issues and other minor issues to be worked out, but general flow works.

@sschiessl-bcp
Copy link
Collaborator

@clockworkgr

Beetlejuice Beetlejuice Beetlejuice

Interested in skimming this PR a bit?

@grctest
Copy link
Contributor

grctest commented Aug 4, 2022

Summary of changes in PR:

  • npm-check-updates was initially used to identify packages which could be updated
    • About half of the packages were able to be updated with minor changes
    • Some of the updated packages introduced severe breaking changes, namely vue2 -> vue3
      • The update to Vue3 required a refactoring of every (30+) components to using the composition API https://vuejs.org/api/composition-api-setup.html#basic-usage
      • Most of the vue2 related packages did/do not have equivalent vue3 packages, resulting in their replacement/removal being warranted.
        • Removed with no replacement: Password strength indicator (Custom zxcvbn component required)
        • Replaced: Bootstrap -> balm-ui
        • Replaced vue-multiselect with balm-ui selector component

Security changes

  • sha512 hashing password that's stored in memory after login
    • Edge case: Restoring from old beet backup would be encrypted with raw password instead of the hash, so legacy checkbox was included for anyone who might have restored an old wallet instead of creating a new wallet.
  • Removed cert stored in repo, fetches cert from beet cert repo
    • Automated tools search for these certs & report to the issuer
    • We should consider encrypting/encoding the external repo cert to further hide cert
  • Beet client doesn't respond to queries unless logged in
  • Additional store getter functions created to reduce handling of excessive data in vue components
  • Uplift of packages across the board for security vulnerability bump
  • Prompts are now much more isolated from the rest of the wallet, now launch their own electron BrowserWindow where user input data is passed as url encoded parameters. These prompts are isolated and can't access the main beet window state.
  • elliptic replaced with secp from "@noble/secp256k1" and @noble/ed25519 for key exchange

UI changes

  • Language selector component hidden from dashboard since there's only one language
  • Main electron window bar isn't skinned
    • pro: easier to move the window, uses system app frame
    • con: no longer goes to task tray when closed
    • Could be re-implemented
  • Balm-UI used instead of Bootstrap, deviating from the brand guide
  • Debug console can be accessed via 'alt' then view -> debug tools.
  • Sending BEET to system tray is also in the view menu.
  • Balance in dashboard and linked apps list in settings are now scroll-able lists

New functionality

  • Sign NFT_Object for NFT creation
  • Broadcast & Update assets - for NFT issuance tool
  • Prompts are now isolated popup windows instead of alert boxes within the main window

Maintenance based decisions

  • After updating packages the icons broke, so the skinned window frame was replaced with system window frame.
  • Elliptic package was replaced as it hadn't been updated in more than 2 years
  • The custom BeetWS WebSocket implementation was replaced with socket.io
    • This prove to require a large refactoring of the beetserver, blockchainfactory and beet-js library.
    • It's far more maintained & supports multiple environments

@abitmore
Copy link
Member Author

abitmore commented Aug 5, 2022

Summary of changes in PR:

Thanks. Copied to OP.

Copy link
Member Author

@abitmore abitmore left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed cert stored in repo, fetches cert from beet cert repo

Where is the "beet cert repo"?

@grctest
Copy link
Contributor

grctest commented Aug 5, 2022 via email

@abitmore
Copy link
Member Author

abitmore commented Aug 5, 2022

https://github.com/beetapp/beet-certs

Thanks.

Looks like the certs aren't getting updated automatically. If it's a Let's encrypt cert, since it points to 127.0.0.1, I don't think it can be updated by running certbot via Github Actions.

By the way, we'd better use a repo in the bitshares organization.

@grctest
Copy link
Contributor

grctest commented Aug 12, 2022

Want to create such a bts cert repo? Or shall such a change be introduced in a future pull request?

@sschiessl-bcp
Copy link
Collaborator

This is a monster, lets do with new PR

@sschiessl-bcp sschiessl-bcp merged commit e4bba5d into bitshares:develop Aug 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants