feat(sdk-coin-dot): add MPCv2 support to recoverConsolidations

Detect signing material once in recoverConsolidations() and thread it
into each recover() iteration via an optional precomputedMaterial param,
avoiding per-address keycard decryption. Drops DotRecoveryOptions and
multisigTypeVersion field in favour of the EddsaSigningMaterial union.
Removes non-null assertions and as-any casts throughout.

Ticket: WCI-1236

Author: vibhavgo

modules/sdk-coin-dot/src/dot.ts

@@ -30,6 +30,10 @@ import {
   AuditDecryptedKeyParams,
   verifyEddsaTssWalletAddress,
   TxIntentMismatchRecipientError,
+  getEddsaSigningMaterial as sharedGetEddsaSigningMaterial,
+  signEddsaMpcV2RecoveryTx,
+  EddsaSigningMaterial,
+  decryptKeychainPrivateKey,
 } from '@bitgo/sdk-core';
 import { BaseCoin as StaticsBaseCoin, coins, PolkadotSpecNameType } from '@bitgo/statics';
 import {
@@ -347,7 +351,7 @@ export class Dot extends BaseCoin {
    * @returns {MPCTx} the serialized transaction hex string and index
    * of the address being swept
    */
-  async recover(params: MPCRecoveryOptions): Promise<MPCTx | MPCSweepTxs> {
+  async recover(params: MPCRecoveryOptions, precomputedMaterial?: EddsaSigningMaterial): Promise<MPCTx | MPCSweepTxs> {
     if (!params.bitgoKey) {
       throw new Error('missing bitgoKey');
     }
@@ -403,43 +407,43 @@ export class Dot extends BaseCoin {
         throw new Error('missing wallet passphrase');
       }
 
-      // Clean up whitespace from entered values
       const userKey = params.userKey.replace(/\s/g, '');
       const backupKey = params.backupKey.replace(/\s/g, '');
-
-      // Decrypt private keys from KeyCard values
-      let userPrv;
-      try {
-        userPrv = await this.bitgo.decrypt({
-          input: userKey,
-          password: params.walletPassphrase,
-        });
-      } catch (e) {
-        throw new Error(`Error decrypting user keychain: ${e.message}`);
-      }
-      /** TODO BG-52419 Implement Codec for parsing */
-      const userSigningMaterial = JSON.parse(userPrv) as EDDSAMethodTypes.UserSigningMaterial;
-
-      let backupPrv;
-      try {
-        backupPrv = await this.bitgo.decrypt({
-          input: backupKey,
-          password: params.walletPassphrase,
+      const dotKeyPair = new DotKeyPair({ pub: accountId });
+      const signingMaterial =
+        precomputedMaterial ?? (await this.getEddsaSigningMaterial(userKey, params.walletPassphrase));
+
+      if (signingMaterial.version === 'v2') {
+        const signature = await this.signDotMpcV2Recovery({
+          message: unsignedTransaction.signablePayload,
+          userKey: signingMaterial.encryptedUserKey,
+          backupKey,
+          walletPassphrase: params.walletPassphrase,
+          bitgoKey,
+          derivationPath: currPath,
+          bitgo: this.bitgo,
         });
-      } catch (e) {
-        throw new Error(`Error decrypting backup keychain: ${e.message}`);
+        txnBuilder.addSignature({ pub: dotKeyPair.getKeys().pub }, signature);
+      } else {
+        /** TODO BG-52419 Implement Codec for parsing */
+        const userSigningMaterial = JSON.parse(signingMaterial.userPrv) as EDDSAMethodTypes.UserSigningMaterial;
+        const backupPrv = await decryptKeychainPrivateKey(
+          this.bitgo,
+          { encryptedPrv: backupKey },
+          params.walletPassphrase
+        );
+        if (!backupPrv) {
+          throw new Error('Error decrypting backup keychain: invalid password or corrupted key');
+        }
+        const backupSigningMaterial = JSON.parse(backupPrv) as EDDSAMethodTypes.BackupSigningMaterial;
+        const signatureHex = await EDDSAMethods.getTSSSignature(
+          userSigningMaterial,
+          backupSigningMaterial,
+          currPath,
+          unsignedTransaction
+        );
+        txnBuilder.addSignature({ pub: dotKeyPair.getKeys().pub }, signatureHex);
       }
-      const backupSigningMaterial = JSON.parse(backupPrv) as EDDSAMethodTypes.BackupSigningMaterial;
-
-      // add signature
-      const signatureHex = await EDDSAMethods.getTSSSignature(
-        userSigningMaterial,
-        backupSigningMaterial,
-        currPath,
-        unsignedTransaction
-      );
-      const dotKeyPair = new DotKeyPair({ pub: accountId });
-      txnBuilder.addSignature({ pub: dotKeyPair.getKeys().pub }, signatureHex);
       const signedTransaction = await txnBuilder.build();
       serializedTx = signedTransaction.toBroadcastFormat();
     } else {
@@ -506,16 +510,24 @@ export class Dot extends BaseCoin {
     }
 
     const bitgoKey = params.bitgoKey.replace(/\s/g, '');
-    const MPC = await EDDSAMethods.getInitializedMpcInstance();
+    const userKey = params.userKey?.replace(/\s/g, '') ?? '';
+
+    // Detect signing material once to avoid re-decrypting the keycard on every loop iteration.
+    const signingMaterial = params.walletPassphrase
+      ? await this.getEddsaSigningMaterial(userKey, params.walletPassphrase)
+      : undefined;
+
     const baseIndex = 0;
     const basePath = params.seed ? getDerivationPath(params.seed) + `/${baseIndex}` : `m/${baseIndex}`;
-    const accountId = MPC.deriveUnhardened(bitgoKey, basePath).slice(0, 64);
+    const accountId = (await EDDSAMethods.getInitializedMpcInstance())
+      .deriveUnhardened(bitgoKey, basePath)
+      .slice(0, 64);
     const baseAddress = this.getAddressFromPublicKey(accountId);
 
     const consolidationTransactions: any[] = [];
     let lastScanIndex = startIdx;
     for (let i = startIdx; i < endIdx; i++) {
-      const recoverParams = {
+      const recoverParams: MPCRecoveryOptions = {
         userKey: params.userKey,
         backupKey: params.backupKey,
         bitgoKey: params.bitgoKey,
@@ -527,7 +539,7 @@ export class Dot extends BaseCoin {
 
       let recoveryTransaction;
       try {
-        recoveryTransaction = await this.recover(recoverParams);
+        recoveryTransaction = await this.recover(recoverParams, signingMaterial);
       } catch (e) {
         if (e.message === 'Did not find address with funds to recover') {
           lastScanIndex = i;
@@ -742,6 +754,14 @@ export class Dot extends BaseCoin {
     return new TransactionBuilderFactory(coins.get(this.getChain()));
   }
 
+  protected async getEddsaSigningMaterial(userKey: string, walletPassphrase: string): Promise<EddsaSigningMaterial> {
+    return sharedGetEddsaSigningMaterial(userKey.replace(/\s/g, ''), walletPassphrase, this.bitgo);
+  }
+
+  protected async signDotMpcV2Recovery(params: Parameters<typeof signEddsaMpcV2RecoveryTx>[0]): Promise<Buffer> {
+    return signEddsaMpcV2RecoveryTx(params);
+  }
+
   /** @inheritDoc */
   auditDecryptedKey({ publicKey, prv, multiSigType }: AuditDecryptedKeyParams) {
     if (multiSigType !== 'tss') {