Patterns

const RPC_HOSTS = {
  84532:  { host: /^base-sepolia\.g\.alchemy\.com$/i, minConfirmations: 5 },
  421614: { host: /^arb-sepolia\.g\.alchemy\.com$/i,  minConfirmations: 5 },
};

function assertAllowedRpc(chainId, rpcUrl) {
  const policy = RPC_HOSTS[Number(chainId)];
  if (!policy) throw new Error(`chainId ${chainId} not whitelisted`);

  const parsed = new URL(rpcUrl);
  if (parsed.protocol !== "https:") throw new Error("RPC URL must use https://");
  if (!policy.host.test(parsed.hostname)) throw new Error("RPC host not whitelisted");

  return policy;
}

async function rpc(url, method, params) {
  const res = await fetch(url, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
    redirect: "error",
  });
  const body = await res.json();
  if (body.error) throw new Error(body.error.message);
  return body.result;
}

const SOURCES = ["source-a", "source-b", "source-c"];
const MIN_SOURCES = 2;

async function requireStrictAgreement(fetchSource) {
  const settled = await Promise.allSettled(SOURCES.map(fetchSource));
  const ok = settled
    .filter((r) => r.status === "fulfilled" && r.value != null)
    .map((r) => r.value);

  if (ok.length < MIN_SOURCES) return { authorized: false, reason: "too few sources" };
  if (!ok.every((value) => value === ok[0])) {
    return { authorized: false, reason: "sources disagree", values: ok };
  }

  return { authorized: true, value: ok[0] };
}

import { createAccBuilder } from '@lit-protocol/access-control-conditions';

const conditions = createAccBuilder()
  .on('ethereum')
  .requireEthBalance('1000000000000000000')  // 1 ETH in wei
  .and()
  .on('ethereum')
  .requireNftOwnership('0xContractAddress')
  .build();

// js_params: { pkpId, minBalanceWei, message }
// pkpId doubles as the wallet address to check — it is an Ethereum address.
async function main({ pkpId, minBalanceWei, message }) {
  const provider = new ethers.providers.JsonRpcProvider("https://mainnet.base.org");
  const balance = await provider.getBalance(pkpId);

  if (balance.lt(ethers.BigNumber.from(minBalanceWei))) {
    return {
      error: `Balance ${ethers.utils.formatEther(balance)} ETH is below the required minimum`,
    };
  }

  // Gate passed — sign the message with the PKP.
  const wallet = new ethers.Wallet(await Lit.Actions.getPrivateKey({ pkpId }));
  const signature = await wallet.signMessage(message);

  return { message, signature, balanceEth: ethers.utils.formatEther(balance) };
}

// js_params: { pkpId, contractAddress, requiredAmount, message }
// Gate on ERC-20 token balance instead of ETH.
async function main({ pkpId, contractAddress, requiredAmount, message }) {
  const provider = new ethers.providers.JsonRpcProvider("https://mainnet.base.org");
  const erc20 = new ethers.Contract(
    contractAddress,
    ["function balanceOf(address) view returns (uint256)"],
    provider
  );
  const balance = await erc20.balanceOf(pkpId);

  if (balance.lt(ethers.BigNumber.from(requiredAmount))) {
    return { error: "Insufficient token balance" };
  }

  const wallet = new ethers.Wallet(await Lit.Actions.getPrivateKey({ pkpId }));
  const signature = await wallet.signMessage(message);
  return { message, signature };
}

// js_params: {}  — no caller-supplied parameters needed
async function main() {
  const res = await fetch(
    "https://api.coingecko.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd"
  );
  const data = await res.json();
  const price = data?.ethereum?.usd;

  if (typeof price !== "number") {
    return { error: "Price fetch failed" };
  }

  // Sign with the action's own key — not a PKP.
  // The private key is derived from this action's IPFS CID.
  const actionWallet = new ethers.Wallet(
    await Lit.Actions.getLitActionPrivateKey()
  );

  const payload = `ETH/USD: ${price} at ${Date.now()}`;
  const signature = await actionWallet.signMessage(payload);

  return {
    price,
    payload,
    signature,
    signerAddress: actionWallet.address,
  };
}

async function main({ pkpAddress }) {
  const ALLOWED_PKP = "0xAbc123..."; // your PKP's wallet address

  if (pkpAddress.toLowerCase() !== ALLOWED_PKP.toLowerCase()) {
    throw new Error("Unauthorized: PKP not allowed to run this action");
  }

  // ... rest of your action logic
}

async function main({ signature, message }) {
  const ALLOWED_ADDRESS = "0xAbc123..."; // the authorized caller's wallet address

  // message should contain a nonce or timestamp for replay protection
  const recovered = ethers.utils.verifyMessage(message, signature);
  if (recovered.toLowerCase() !== ALLOWED_ADDRESS.toLowerCase()) {
    throw new Error("Unauthorized: caller signature does not match allowed address");
  }

  // ... rest of your action logic
}

const OWNER_ADDRESS = "0xUSERS_ADDRESS"; // stamped in per user

async function main({ action, to, amount, signature, message }) {
  // Derived from THIS action's CID — so a different OWNER_ADDRESS yields a
  // different CID and therefore a different, immutable wallet per user.
  const wallet = new ethers.Wallet(await Lit.Actions.getLitActionPrivateKey());
  if (action === "address") return { walletAddress: wallet.address };

  // Spending is gated on the owner's signature, not on who ran the action.
  if (ethers.utils.verifyMessage(message, signature).toLowerCase() !== OWNER_ADDRESS.toLowerCase()) {
    throw new Error("unauthorized: signer is not the bound owner");
  }
  // ... sign the transfer/transaction the owner authorized
}

Account
 └── Group
      ├── PKP: "user-alice-data-vault"    ← one vault per user
      ├── PKP: "user-bob-data-vault"
      └── PKP: "app-secrets"              ← one vault per concern

// js_params: { pkpId, plaintext }
// Run once to seal a piece of data into the vault.
async function main({ pkpId, plaintext }) {
  const ciphertext = await Lit.Actions.Encrypt({ pkpId, message: plaintext });
  return { ciphertext };
}

// js_params: { pkpId, ciphertext, userToken }
// userToken is a signed JWT or session token the caller supplies to prove identity.
async function main({ pkpId, ciphertext, userToken }) {
  // Verify the caller's token against your auth service.
  const authRes = await fetch("https://auth.your-app.com/verify", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ token: userToken }),
  });
  const auth = await authRes.json();

  if (!auth.valid) {
    return { error: "Unauthorized" };
  }

  // Gate passed — decrypt and return the plaintext.
  const plaintext = await Lit.Actions.Decrypt({ pkpId, ciphertext });
  return { plaintext };
}

// js_params: { pkpId, ciphertext, holderAddress, nftContractAddress }
// Only NFT holders may decrypt.
async function main({ pkpId, ciphertext, holderAddress, nftContractAddress }) {
  const provider = new ethers.providers.JsonRpcProvider("https://mainnet.base.org");
  const nft = new ethers.Contract(
    nftContractAddress,
    ["function balanceOf(address) view returns (uint256)"],
    provider
  );
  const balance = await nft.balanceOf(holderAddress);

  if (balance.eq(0)) {
    return { error: "NFT not held — access denied" };
  }

  const plaintext = await Lit.Actions.Decrypt({ pkpId, ciphertext });
  return { plaintext };
}

// Encrypt the API key portion once and store the ciphertext.
// js_params: { pkpId, apiKey }
async function main({ pkpId, apiKey }) {
  const ciphertext = await Lit.Actions.Encrypt({ pkpId, message: apiKey });
  return { ciphertext };
}

// js_params: { pkpId, encryptedApiKey, targetAddress }
async function main({ pkpId, encryptedApiKey, targetAddress }) {
  // Decrypt the API key inside the TEE — it never leaves the node.
  const apiKey = await Lit.Actions.Decrypt({ pkpId, ciphertext: encryptedApiKey });

  // Assemble the full RPC URL.
  const provider = new ethers.providers.JsonRpcProvider(
    `https://sepolia.infura.io/v3/${apiKey}`
  );

  // Use the provider as normal.
  const balance = await provider.getBalance(targetAddress);

  return { balance: ethers.utils.formatEther(balance) };
}

// js_params: { userPkpId, payload }
// userPkpId is the caller's discrete signing PKP — the gateway has already
// verified it belongs to the caller's account and is permitted in this group.
async function main({ userPkpId, payload }) {
  // Hardcode the app-secrets PKP so a caller cannot substitute their own vault.
  const APP_SECRETS_PKP = "0xAppSecretsVaultAddress";

  // Ciphertext of the shared API key, sealed once against APP_SECRETS_PKP.
  // Bake it in (as here) or pass it from your backend — it is opaque without the key.
  const ENCRYPTED_API_KEY = "<ciphertext>";

  // 1. Decrypt the shared secret inside the TEE using the APP's PKP.
  const apiKey = await Lit.Actions.Decrypt({
    pkpId: APP_SECRETS_PKP,
    ciphertext: ENCRYPTED_API_KEY,
  });

  // 2. Use the secret to do app-level work — the key never leaves the enclave.
  const res = await fetch("https://api.your-service.com/process", {
    method: "POST",
    headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
    body: JSON.stringify(payload),
  });
  const result = await res.json();

  // 3. Sign the result with the USER's own PKP — a wallet the app never controls.
  const userWallet = new ethers.Wallet(
    await Lit.Actions.getPrivateKey({ pkpId: userPkpId })
  );
  const signature = await userWallet.signMessage(JSON.stringify(result));

  // Return the signed result — never the API key.
  return { result, signature, signer: userWallet.address };
}

Account
 └── Group
      ├── IPFS CID: "process-and-sign" action   ← the code above
      ├── PKP: "app-secrets"                     ← shared vault, hardcoded in the action
      ├── PKP: "user-alice-signer"               ← one discrete signer per user
      ├── PKP: "user-bob-signer"
      └── Usage API Key                          ← triggers the action