Feature: create/import keystore wallet (password-encrypted) + docstrings

Author: philogicae

src/aleph/sdk/account.py

@@ -3,7 +3,7 @@
 from pathlib import Path
 from typing import Optional, Type, TypeVar
 
-from aleph.sdk.chains.common import get_fallback_private_key
+from aleph.sdk.chains.common import get_fallback_private_key, load_key
 from aleph.sdk.chains.ethereum import ETHAccount
 from aleph.sdk.chains.remote import RemoteAccount
 from aleph.sdk.conf import settings
@@ -15,13 +15,33 @@
 
 
 def account_from_hex_string(private_key_str: str, account_type: Type[T]) -> T:
+    """
+    Loads an account from a hexadecimal string representation of a private key.
+
+    Args:
+        private_key_str (str): The private key as a hexadecimal string.
+        account_type (Type[T]): The type of account to load.
+
+    Returns:
+        T: An instance of the specified account type.
+    """
     if private_key_str.startswith("0x"):
         private_key_str = private_key_str[2:]
     return account_type(bytes.fromhex(private_key_str))
 
 
 def account_from_file(private_key_path: Path, account_type: Type[T]) -> T:
-    private_key = private_key_path.read_bytes()
+    """
+    Loads an account from a private key stored in a file (plain text or keystore).
+
+    Args:
+        private_key_path (Path): The path to the file containing the private key.
+        account_type (Type[T]): The type of account to load.
+
+    Returns:
+        T: An instance of the specified account type.
+    """
+    private_key = load_key(private_key_path)
     return account_type(private_key)
 
 

src/aleph/sdk/chains/common.py

@@ -1,10 +1,14 @@
+import json
 import logging
 from abc import ABC, abstractmethod
+from functools import lru_cache
 from pathlib import Path
 from typing import Dict, Optional
 
 from coincurve.keys import PrivateKey
+from rich.prompt import Console, Prompt, Text
 from typing_extensions import deprecated
+from web3 import Web3
 
 from aleph.sdk.conf import settings
 from aleph.sdk.utils import enum_as_str
@@ -143,22 +147,141 @@ async def decrypt(self, content: bytes) -> bytes:
             raise NotImplementedError
 
 
-# Start of the ugly stuff
 def generate_key() -> bytes:
+    """
+    Generate a new private key.
+
+    Returns:
+    bytes: The generated private key as bytes.
+    """
+
     privkey = PrivateKey()
     return privkey.secret
 
 
+def create_key() -> bytes:
+    """
+    Create or import a private key.
+
+    This function allows the user to either import an existing private key
+    or generate a new one. If the user chooses to import a key, they can
+    enter a private key in hexadecimal format or a passphrase.
+
+    Returns:
+    bytes: The private key as bytes. 7e0c27fff7e434ec5aa47127e7bcdce81c4eba6f3ce980f425b60b1cd019a947
+    """
+    if Prompt.ask("Import an existing wallet", choices=["y", "n"], default="n") == "y":
+        data = Prompt.ask("Enter your private key or passphrase")
+        # private key
+        if data.startswith("0x") and len(data) == 66:
+            return bytes.fromhex(data[2:])
+        elif len(data) == 64:
+            return bytes.fromhex(data)
+        # passphrase
+        elif len(data.split()) in [12, 24]:
+            w3 = Web3()
+            w3.eth.account.enable_unaudited_hdwallet_features()
+            return w3.eth.account.from_mnemonic(data.strip()).key
+        raise ValueError("Invalid private key or passphrase")
+    return generate_key()
+
+
+def save_key(private_key: bytes, path: Path):
+    """
+    Save a private key to a file.
+
+    Parameters:
+    private_key (bytes): The private key as bytes.
+    path (Path): The path to the private key file.
+
+    Returns:
+    None
+    """
+    address = None
+    path.parent.mkdir(exist_ok=True, parents=True)
+    if path.name.endswith(".key"):
+        path.write_bytes(private_key)
+        address = Web3().to_checksum_address(
+            Web3().eth.account.from_key(private_key).address
+        )
+    elif path.name.endswith(".json"):
+        password = Prompt.ask(
+            "Enter a password to encrypt your keystore", password=True
+        )
+        keystore = Web3().eth.account.encrypt(private_key, password)
+        path.write_text(json.dumps(keystore))
+        address = Web3().to_checksum_address(
+            Web3().eth.account.from_key(private_key).address
+        )
+    if not address:
+        raise ValueError("Unsupported private key file format")
+    confirmation = Text.assemble(
+        "\nYour address: ",
+        Text(address, style="cyan"),
+        "\nSaved file: ",
+        Text(str(path), style="orange1"),
+        "\n",
+    )
+    Console().print(confirmation)
+
+
+@lru_cache(maxsize=1)
+def load_key(private_key_path: Path) -> bytes:
+    """
+    Load a private key from a file.
+
+    This function supports two types of private key files:
+    1. Unencrypted .key files.
+    2. Encrypted .json keystore files.
+
+    Parameters:
+    private_key_path (Path): The path to the private key file.
+
+    Returns:
+    bytes: The private key as bytes.
+
+    Raises:
+    FileNotFoundError: If the private key file does not exist.
+    ValueError: If the private key file is not a .key or .json file.
+    """
+    if not private_key_path.exists():
+        raise FileNotFoundError("Private key file not found")
+    elif private_key_path.name.endswith(".key"):
+        return private_key_path.read_bytes()
+    elif private_key_path.name.endswith(".json"):
+        keystore = private_key_path.read_text()
+        password = Prompt.ask("Keystore password", password=True)
+        try:
+            return Web3().eth.account.decrypt(keystore, password)
+        except ValueError:
+            raise ValueError("Invalid password")
+    raise ValueError("Unsupported private key file format")
+
+
 def get_fallback_private_key(path: Optional[Path] = None) -> bytes:
+    """
+    Retrieve or create a fallback private key.
+
+    This function attempts to load a private key from the specified path.
+    If the path is not provided, it defaults to the path specified in the
+    settings. If the file does not exist or is empty, a new private key
+    is generated and saved to the specified path. A symlink is also created
+    to use this key by default.
+
+    Parameters:
+    path (Optional[Path]): The path to the private key file. If not provided,
+                           the default path from settings is used.
+
+    Returns:
+    bytes: The private key as bytes.
+    """
     path = path or settings.PRIVATE_KEY_FILE
     private_key: bytes
     if path.exists() and path.stat().st_size > 0:
-        private_key = path.read_bytes()
+        private_key = load_key(path)
     else:
-        private_key = generate_key()
-        path.parent.mkdir(exist_ok=True, parents=True)
-        path.write_bytes(private_key)
-
+        private_key = create_key()
+        save_key(private_key, path)
         default_key_path = path.parent / "default.key"
 
         # If the symlink exists but does not point to a file, delete it.

src/aleph/sdk/conf.py

@@ -13,8 +13,12 @@
 class Settings(BaseSettings):
     CONFIG_HOME: Optional[str] = None
 
-    # In case the user does not want to bother with handling private keys himself,
-    # do an ugly and insecure write and read from disk to this file.
+    # Two methods for storing your private key:
+    # 1. *.key: The private key is written to and read from an unencrypted file.
+    #           This method is less secure as the key is stored in plain text.
+    # 2. *.json: The private key is stored in a keystore file, encrypted with a password.
+    #           This method is more secure as the key is protected by encryption.
+    # If the file is missing, a new private key will be created.
     PRIVATE_KEY_FILE: Path = Field(
         default=Path("ethereum.key"),
         description="Path to the private key used to sign messages and transactions",
@@ -115,16 +119,16 @@ class Settings(BaseSettings):
         ),
     }
     # Add all placeholders to allow easy dynamic setup of CHAINS
-    CHAINS_SEPOLIA_ACTIVE: Optional[bool]
-    CHAINS_ETH_ACTIVE: Optional[bool]
-    CHAINS_AVAX_ACTIVE: Optional[bool]
-    CHAINS_BASE_ACTIVE: Optional[bool]
-    CHAINS_BSC_ACTIVE: Optional[bool]
-    CHAINS_SEPOLIA_RPC: Optional[str]
-    CHAINS_ETH_RPC: Optional[str]
-    CHAINS_AVAX_RPC: Optional[str]
-    CHAINS_BASE_RPC: Optional[str]
-    CHAINS_BSC_RPC: Optional[str]
+    CHAINS_SEPOLIA_ACTIVE: Optional[bool] = None
+    CHAINS_ETH_ACTIVE: Optional[bool] = None
+    CHAINS_AVAX_ACTIVE: Optional[bool] = None
+    CHAINS_BASE_ACTIVE: Optional[bool] = None
+    CHAINS_BSC_ACTIVE: Optional[bool] = None
+    CHAINS_SEPOLIA_RPC: Optional[str] = None
+    CHAINS_ETH_RPC: Optional[str] = None
+    CHAINS_AVAX_RPC: Optional[str] = None
+    CHAINS_BASE_RPC: Optional[str] = None
+    CHAINS_BSC_RPC: Optional[str] = None
 
     # Dns resolver
     DNS_IPFS_DOMAIN = "ipfs.public.aleph.sh"
@@ -153,11 +157,9 @@ class Config:
     settings = Settings()
 
 assert settings.CONFIG_HOME
-if str(settings.PRIVATE_KEY_FILE) == "ethereum.key":
-    settings.PRIVATE_KEY_FILE = Path(
-        settings.CONFIG_HOME, "private-keys", "ethereum.key"
-    )
-
+pk_file = str(settings.PRIVATE_KEY_FILE.name)
+if pk_file.endswith(".key") or pk_file.endswith(".json"):
+    settings.PRIVATE_KEY_FILE = Path(settings.CONFIG_HOME, "private-keys", pk_file)
 if str(settings.PRIVATE_MNEMONIC_FILE) == "substrate.mnemonic":
     settings.PRIVATE_MNEMONIC_FILE = Path(
         settings.CONFIG_HOME, "private-keys", "substrate.mnemonic"