wallet: route signer keys through Store on legacy miss

Add derivePathPrivKey and resolveDerivedPrivKeyFromStore, and thread a
context through the signing paths (ECDH, SignDigest, ComputeRawSig,
DerivePrivKey and the output/imported-key helpers). When the legacy
waddrmgr lookup misses on a scope or account, resolve the account's
encrypted private key from the Store and derive the leaf key through the
key vault, with precise watch-only and not-in-store errors. Covers
SQL-only accounts that have no mirrored waddrmgr row.

(cherry picked from commit de9ddb6)

Author: yyforyongyu

wallet/signer.go

@@ -552,28 +552,65 @@ func (w *Wallet) fetchManagedPubKeyAddress(path BIP32Path) (
 	return managedPubKeyAddr, nil
 }
 
+// derivePathPrivKey resolves the signing private key for a full BIP-32 path.
+//
+// It first walks the legacy waddrmgr-backed managed-address lookup, which is
+// the fast path for accounts mirrored into waddrmgr. When that lookup misses
+// because the account or its scope only lives in the SQL store, it falls back
+// to the account-level encrypted secret resolved through keyVault. The
+// fallback is gated on a waddrmgr account/scope miss so legacy-backed accounts
+// keep their existing behavior and only genuine store-only accounts take the
+// slower path.
+//
+// The returned private key is owned by the caller, who is responsible for
+// zeroing it once signing completes.
+func (w *Wallet) derivePathPrivKey(ctx context.Context, path BIP32Path) (
+	*btcec.PrivateKey, error) {
+
+	managedPubKeyAddr, err := w.fetchManagedPubKeyAddress(path)
+	switch {
+	case err == nil:
+		privKey, err := managedPubKeyAddr.PrivKey()
+		if err != nil {
+			return nil, fmt.Errorf("cannot get private key: %w", err)
+		}
+
+		return privKey, nil
+
+	case isWaddrmgrAccountClassError(
+		err, waddrmgr.ErrScopeNotFound, waddrmgr.ErrAccountNotFound,
+	):
+
+		privKey, storeErr := w.resolveDerivedPrivKeyFromStore(
+			ctx, path.KeyScope, path.DerivationPath,
+		)
+		if storeErr != nil {
+			return nil, fmt.Errorf("store account fallback after "+
+				"legacy address miss: %w: %w", err, storeErr)
+		}
+
+		return privKey, nil
+
+	default:
+		return nil, err
+	}
+}
+
 // ECDH performs a scalar multiplication (ECDH-like operation) between a key
 // from the wallet and a remote public key. The output returned will be the
 // sha256 of the resulting shared point serialized in compressed format.
-func (w *Wallet) ECDH(_ context.Context, path BIP32Path,
+func (w *Wallet) ECDH(ctx context.Context, path BIP32Path,
 	pub *btcec.PublicKey) ([32]byte, error) {
 
 	err := w.state.canSign()
 	if err != nil {
 		return [32]byte{}, err
 	}
 
-	managedPubKeyAddr, err := w.fetchManagedPubKeyAddress(path)
+	privKey, err := w.derivePathPrivKey(ctx, path)
 	if err != nil {
 		return [32]byte{}, err
 	}
-
-	// Get the private key for the derived address.
-	privKey, err := managedPubKeyAddr.PrivKey()
-	if err != nil {
-		return [32]byte{}, fmt.Errorf("cannot get private key: %w",
-			err)
-	}
 	defer privKey.Zero()
 
 	// Perform the scalar multiplication and hash the result.
@@ -611,7 +648,7 @@ func validateSignDigestIntent(intent *SignDigestIntent) error {
 }
 
 // SignDigest signs a message digest based on the provided intent.
-func (w *Wallet) SignDigest(_ context.Context, path BIP32Path,
+func (w *Wallet) SignDigest(ctx context.Context, path BIP32Path,
 	intent *SignDigestIntent) (Signature, error) {
 
 	err := w.state.canSign()
@@ -624,16 +661,10 @@ func (w *Wallet) SignDigest(_ context.Context, path BIP32Path,
 		return nil, err
 	}
 
-	managedPubKeyAddr, err := w.fetchManagedPubKeyAddress(path)
+	privKey, err := w.derivePathPrivKey(ctx, path)
 	if err != nil {
 		return nil, err
 	}
-
-	// Get the private key for the derived address.
-	privKey, err := managedPubKeyAddr.PrivKey()
-	if err != nil {
-		return nil, fmt.Errorf("cannot get private key: %w", err)
-	}
 	defer privKey.Zero()
 
 	// Now, sign the message using the derived private key. This is all
@@ -708,7 +739,7 @@ func (w *Wallet) ComputeUnlockingScript(ctx context.Context,
 		return nil, err
 	}
 
-	privKey, err := w.privKeyForOutput(scriptInfo)
+	privKey, err := w.privKeyForOutput(ctx, scriptInfo)
 	if err != nil {
 		return nil, err
 	}
@@ -730,19 +761,20 @@ func (w *Wallet) ComputeUnlockingScript(ctx context.Context,
 
 // privKeyForOutput returns the private key needed to sign for the given
 // wallet-controlled output.
-func (w *Wallet) privKeyForOutput(scriptInfo OutputScriptInfo) (
+func (w *Wallet) privKeyForOutput(ctx context.Context,
+	scriptInfo OutputScriptInfo) (
 	*btcec.PrivateKey, error) {
 
 	if canUseAddressInfoDerivation(scriptInfo.AddressInfo) {
-		return w.privKeyForAddressInfo(scriptInfo.AddressInfo)
+		return w.privKeyForAddressInfo(ctx, scriptInfo.AddressInfo)
 	}
 
 	pubKeyAddr, err := w.loadManagedPubKeyAddr(scriptInfo.Addr)
 	if err != nil {
 		return nil, err
 	}
 
-	return w.resolvePrivKey(pubKeyAddr)
+	return w.resolvePrivKey(ctx, pubKeyAddr)
 }
 
 // canUseAddressInfoDerivation reports whether address metadata contains enough
@@ -757,7 +789,8 @@ func canUseAddressInfoDerivation(addressInfo AddressInfo) bool {
 
 // privKeyForAddressInfo derives the private key described by store-backed
 // address metadata.
-func (w *Wallet) privKeyForAddressInfo(addressInfo AddressInfo) (
+func (w *Wallet) privKeyForAddressInfo(ctx context.Context,
+	addressInfo AddressInfo) (
 	*btcec.PrivateKey, error) {
 
 	derivation := addressInfo.Derivation
@@ -774,7 +807,9 @@ func (w *Wallet) privKeyForAddressInfo(addressInfo AddressInfo) (
 		MasterKeyFingerprint: derivation.MasterKeyFingerprint,
 	}
 
-	return w.resolveDerivedPathPrivKey(derivation.KeyScope, derivationPath)
+	return w.resolveDerivedPathPrivKey(
+		ctx, derivation.KeyScope, derivationPath,
+	)
 }
 
 // loadManagedPubKeyAddr loads a managed pubkey address for signer-private key
@@ -811,7 +846,8 @@ func (w *Wallet) loadManagedPubKeyAddr(addr address.Address) (
 
 // resolvePrivKey resolves the private key for a managed pubkey address without
 // using output-script inspection as the private-key lookup seam.
-func (w *Wallet) resolvePrivKey(pubKeyAddr waddrmgr.ManagedPubKeyAddress) (
+func (w *Wallet) resolvePrivKey(ctx context.Context,
+	pubKeyAddr waddrmgr.ManagedPubKeyAddress) (
 	*btcec.PrivateKey, error) {
 
 	// Imported spendable keys have no derivation path, so we fall back to the
@@ -831,25 +867,39 @@ func (w *Wallet) resolvePrivKey(pubKeyAddr waddrmgr.ManagedPubKeyAddress) (
 			pubKeyAddr.Address())
 	}
 
-	return w.resolveDerivedPathPrivKey(keyScope, derivationPath)
+	return w.resolveDerivedPathPrivKey(ctx, keyScope, derivationPath)
 }
 
 // resolveDerivedPathPrivKey resolves one derived private key through the scoped
 // manager cache or the database-backed fallback.
-func (w *Wallet) resolveDerivedPathPrivKey(keyScope waddrmgr.KeyScope,
+func (w *Wallet) resolveDerivedPathPrivKey(ctx context.Context,
+	keyScope waddrmgr.KeyScope,
 	derivationPath waddrmgr.DerivationPath) (*btcec.PrivateKey, error) {
 
-	// TODO(yy): SQL-only accounts (created via Store.CreateDerivedAccount
-	// without a mirrored legacy waddrmgr account) miss both
-	// DeriveFromKeyPathCache and the DB-backed DeriveFromKeyPath fallback
-	// below because the legacy waddrmgr has no row for them. The
-	// signer-store PR (impl-tx-creator-store) will replace this path for
-	// SQL-only accounts with a keyVault-backed derivation: fetch
-	// account_secrets.encrypted_priv_key, decrypt via w.keyVault, and
-	// derive at branch/index locally — symmetric to deriveAddressData's
-	// AccountPubKey plumbing on the public-key side.
+	// SQL-only accounts (created via Store.CreateDerivedAccount without a
+	// mirrored legacy waddrmgr account) miss both DeriveFromKeyPathCache
+	// and the DB-backed DeriveFromKeyPath fallback below because the legacy
+	// waddrmgr has no row for them. Each of those misses therefore falls
+	// through to resolveDerivedPrivKeyFromStore, which fetches
+	// account_secrets.encrypted_priv_key, decrypts it via w.keyVault, and
+	// derives at branch/index locally.
 	accountManager, err := w.addrStore.FetchScopedKeyManager(keyScope)
 	if err != nil {
+		if isWaddrmgrAccountClassError(
+			err, waddrmgr.ErrScopeNotFound, waddrmgr.ErrAccountNotFound,
+		) {
+
+			privKey, storeErr := w.resolveDerivedPrivKeyFromStore(
+				ctx, keyScope, derivationPath,
+			)
+			if storeErr != nil {
+				return nil, fmt.Errorf("store account fallback after "+
+					"legacy scope miss: %w: %w", err, storeErr)
+			}
+
+			return privKey, nil
+		}
+
 		return nil, fmt.Errorf("fetch scoped key manager: %w", err)
 	}
 
@@ -861,11 +911,28 @@ func (w *Wallet) resolveDerivedPathPrivKey(keyScope waddrmgr.KeyScope,
 	// Only a cold account cache warrants the slower DB-backed fallback. Other
 	// derivation errors are real failures that re-running through the database
 	// will not repair.
-	if !waddrmgr.IsError(err, waddrmgr.ErrAccountNotCached) {
+	if !isWaddrmgrAccountClassError(err, waddrmgr.ErrAccountNotCached) {
 		return nil, fmt.Errorf("derive private key from cache: %w", err)
 	}
 
-	return w.resolveDerivedPrivKey(accountManager, derivationPath)
+	privKey, err = w.resolveDerivedPrivKey(accountManager, derivationPath)
+	if err == nil {
+		return privKey, nil
+	}
+
+	if !isWaddrmgrAccountClassError(err, waddrmgr.ErrAccountNotFound) {
+		return nil, err
+	}
+
+	privKey, storeErr := w.resolveDerivedPrivKeyFromStore(
+		ctx, keyScope, derivationPath,
+	)
+	if storeErr != nil {
+		return nil, fmt.Errorf("store account fallback after legacy "+
+			"account miss: %w: %w", err, storeErr)
+	}
+
+	return privKey, nil
 }
 
 // resolveDerivedPrivKey resolves one derived private key through the normal
@@ -905,6 +972,44 @@ func (w *Wallet) resolveDerivedPrivKey(accountManager waddrmgr.AccountStore,
 	return privKey, nil
 }
 
+// resolveDerivedPrivKeyFromStore resolves one derived private key from the
+// account-level encrypted secret stored behind the wallet store.
+func (w *Wallet) resolveDerivedPrivKeyFromStore(ctx context.Context,
+	keyScope waddrmgr.KeyScope,
+	path waddrmgr.DerivationPath) (*btcec.PrivateKey, error) {
+
+	if w.cache == nil {
+		return nil, fmt.Errorf("%w: cache", ErrMissingParam)
+	}
+
+	secret, err := w.cache.GetAccountSecret(ctx, db.GetAccountSecretQuery{
+		WalletID:      w.id,
+		Scope:         db.KeyScope(keyScope),
+		AccountNumber: &path.InternalAccount,
+	})
+	switch {
+	case errors.Is(err, db.ErrAccountSecretUnavailable),
+		errors.Is(err, db.ErrAccountNotFound):
+
+		return nil, ErrAccountNotInStore
+
+	case err != nil:
+		return nil, fmt.Errorf("fetch account secret: %w", err)
+	}
+
+	if len(secret.EncryptedPrivateKey) == 0 {
+		return nil, ErrWatchOnlyAccount
+	}
+
+	if w.keyVault == nil {
+		return nil, fmt.Errorf("%w: keyVault", ErrMissingParam)
+	}
+
+	return deriveStoredAccountChildKey(
+		w.keyVault, secret.EncryptedPrivateKey, path,
+	)
+}
+
 // deriveStoredAccountChildKey decrypts an account's encrypted private key with
 // the wallet's keyVault and walks the branch and index derivation to produce
 // the leaf private key. The decrypted byte slice and intermediate HD keys are
@@ -1054,26 +1159,18 @@ func redeemSigScript(redeemScript []byte) ([]byte, error) {
 
 // ComputeRawSig generates a raw signature for a single transaction input. The
 // caller is responsible for assembling the final witness.
-func (w *Wallet) ComputeRawSig(_ context.Context, params *RawSigParams) (
+func (w *Wallet) ComputeRawSig(ctx context.Context, params *RawSigParams) (
 	RawSignature, error) {
 
 	err := w.state.canSign()
 	if err != nil {
 		return nil, err
 	}
 
-	// Get the managed address for the specified derivation path. This will
-	// be used to retrieve the private key.
-	managedAddr, err := w.fetchManagedPubKeyAddress(params.Path)
+	privKey, err := w.derivePathPrivKey(ctx, params.Path)
 	if err != nil {
 		return nil, err
 	}
-
-	// Get the private key for the address.
-	privKey, err := managedAddr.PrivKey()
-	if err != nil {
-		return nil, fmt.Errorf("cannot get private key: %w", err)
-	}
 	defer privKey.Zero()
 
 	// If a tweaker is provided, we'll use it to tweak the private key.
@@ -1099,25 +1196,15 @@ func (w *Wallet) ComputeRawSig(_ context.Context, params *RawSigParams) (
 // path.
 //
 // DANGER: This method exports sensitive key material.
-func (w *Wallet) DerivePrivKey(_ context.Context, path BIP32Path) (
+func (w *Wallet) DerivePrivKey(ctx context.Context, path BIP32Path) (
 	*btcec.PrivateKey, error) {
 
 	err := w.state.canSign()
 	if err != nil {
 		return nil, err
 	}
 
-	managedPubKeyAddr, err := w.fetchManagedPubKeyAddress(path)
-	if err != nil {
-		return nil, err
-	}
-
-	privKey, err := managedPubKeyAddr.PrivKey()
-	if err != nil {
-		return nil, fmt.Errorf("cannot get private key: %w", err)
-	}
-
-	return privKey, nil
+	return w.derivePathPrivKey(ctx, path)
 }
 
 // GetPrivKeyForAddress returns the private key for a given address.
@@ -1140,7 +1227,7 @@ func (w *Wallet) GetPrivKeyForAddress(ctx context.Context, a address.Address) (
 	info, err := w.GetAddressInfo(ctx, a)
 	switch {
 	case err == nil && canUseAddressInfoDerivation(info):
-		return w.privKeyForAddressInfo(info)
+		return w.privKeyForAddressInfo(ctx, info)
 
 	case err == nil:
 		// Store record exists but no usable derivation info