Properly constrain zkApp party

src/lib/circuit_value.ts

@@ -326,7 +326,15 @@ let complexTypes = new Set(['object', 'function']);
 // TODO properly type this at the interface
 // create recursive type that describes JSON-like structures of circuit types
 // TODO unit-test this
-function circuitValue<T>(typeObj: any): AsFieldElements<T> {
+function circuitValue<T>(
+  typeObj: any,
+  advanced?: { customObjectKeys: string[] }
+): AsFieldElements<T> {
+  let objectKeys =
+    typeof typeObj === 'object'
+      ? advanced?.customObjectKeys ?? Object.keys(typeObj).sort()
+      : [];
+
   function sizeInFields(typeObj: any): number {
     if (!complexTypes.has(typeof typeObj) || typeObj === null) return 0;
     if (Array.isArray(typeObj))
@@ -341,10 +349,7 @@ function circuitValue<T>(typeObj: any): AsFieldElements<T> {
     if (Array.isArray(typeObj))
       return typeObj.map((t, i) => toFields(t, obj[i])).flat();
     if ('toFields' in typeObj) return typeObj.toFields(obj);
-    return Object.keys(typeObj)
-      .sort()
-      .map((k) => toFields(typeObj[k], obj[k]))
-      .flat();
+    return objectKeys.map((k) => toFields(typeObj[k], obj[k])).flat();
   }
   function ofFields(typeObj: any, fields: Field[]): any {
     if (!complexTypes.has(typeof typeObj) || typeObj === null) return null;
@@ -359,21 +364,18 @@ function circuitValue<T>(typeObj: any): AsFieldElements<T> {
       return array;
     }
     if ('ofFields' in typeObj) return typeObj.ofFields(fields);
-    let keys = Object.keys(typeObj).sort();
     let values = ofFields(
-      keys.map((k) => typeObj[k]),
+      objectKeys.map((k) => typeObj[k]),
       fields
     );
-    return Object.fromEntries(keys.map((k, i) => [k, values[i]]));
+    return Object.fromEntries(objectKeys.map((k, i) => [k, values[i]]));
   }
   function check(typeObj: any, obj: any): void {
     if (typeof typeObj !== 'object' || typeObj === null) return;
     if (Array.isArray(typeObj))
       return typeObj.forEach((t, i) => check(t, obj[i]));
     if ('check' in typeObj) return typeObj.check(obj);
-    return Object.keys(typeObj)
-      .sort()
-      .forEach((k) => check(typeObj[k], obj[k]));
+    return objectKeys.forEach((k) => check(typeObj[k], obj[k]));
   }
   return {
     sizeInFields: () => sizeInFields(typeObj),

src/lib/party.ts

@@ -30,6 +30,7 @@ export {
   ZkappStateLength,
   ZkappPublicInput,
   Events,
+  partyToPublicInput,
 };
 
 const ZkappStateLength = 8;
@@ -891,14 +892,23 @@ type PartiesProved = {
   as part of the snark circuit. The block producer will also hash the transaction they receive and pass it as a public input to the verifier.
   Thus, the transaction is fully constrained by the proof - the proof couldn't be used to attest to a different transaction.
  */
-type ZkappPublicInput = [transaction: Field, atParty: Field];
-let ZkappPublicInput = circuitValue<ZkappPublicInput>([Field, Field]);
+type ZkappPublicInput = { party: Field; calls: Field };
+let ZkappPublicInput = circuitValue<ZkappPublicInput>(
+  { party: Field, calls: Field },
+  { customObjectKeys: ['party', 'calls'] }
+);
+
+function partyToPublicInput(self: Party): ZkappPublicInput {
+  // TODO compute `calls` from party's children
+  let party = self.hash();
+  let calls = Field.zero; // zero is the correct value if party has no children
+  return { party, calls };
+}
 
 async function addMissingProofs(parties: Parties): Promise<{
   parties: PartiesProved;
   proofs: (Proof<ZkappPublicInput> | undefined)[];
 }> {
-  let partiesJson = JSON.stringify(partiesToJson(parties));
   type PartyProved = Party & { authorization: Control | LazySignature };
 
   async function addProof(party: Party, index: number) {
@@ -909,7 +919,8 @@ async function addMissingProofs(parties: Parties): Promise<{
     )
       return { partyProved: party as PartyProved, proof: undefined };
     let { method, args, previousProofs, ZkappClass } = party.authorization;
-    let publicInput = Ledger.zkappPublicInput(partiesJson, index);
+    let publicInput = partyToPublicInput(party);
+    let publicInputFields = ZkappPublicInput.toFields(publicInput);
     if (ZkappClass._provers === undefined)
       throw Error(
         `Cannot prove execution of ${method.name}(), no prover found. ` +
@@ -928,7 +939,7 @@ async function addMissingProofs(parties: Parties): Promise<{
         witnesses: args,
         inProver: true,
       },
-      () => provers[i](publicInput, previousProofs)
+      () => provers[i](publicInputFields, previousProofs)
     );
     party.authorization = { proof: Pickles.proofToBase64Transaction(proof) };
     class ZkappProof extends Proof<ZkappPublicInput> {

src/lib/zkapp.ts

@@ -17,6 +17,7 @@ import {
   SetOrKeep,
   ZkappPublicInput,
   Events,
+  partyToPublicInput,
 } from './party';
 import { PrivateKey, PublicKey } from './signature';
 import * as Mina from './mina';
@@ -126,13 +127,11 @@ function wrapMethod(
           // -- so we can add assertions about it
           let publicInput = actualArgs[0];
           actualArgs = actualArgs.slice(1);
-          // FIXME: figure out correct way to constrain public input https://github.com/o1-labs/snarkyjs/issues/98
-          let tail = Field.zero;
-          publicInput[0].assertEquals(publicInput[0]);
-          // checkPublicInput(publicInput, self, tail);
 
           // outside a transaction, just call the method, but check precondition invariants
           let result = method.apply(this, actualArgs);
+          checkPublicInput(publicInput, this.self);
+
           // check the self party right after calling the method
           // TODO: this needs to be done in a unified way for all parties that are created
           assertPreconditionInvariants(this.self);
@@ -175,21 +174,10 @@ function wrapMethod(
   };
 }
 
-function toPublicInput(self: Party, tail: Field) {
-  // TODO hash together party with tail in the right way
-  let atParty = self.hash();
-  let transaction = Ledger.hashTransactionChecked(atParty);
-  return { transaction, atParty };
-}
-function checkPublicInput(
-  [transaction, atParty]: ZkappPublicInput,
-  self: Party,
-  tail: Field
-) {
-  // ATM, we always compute the public input in checked mode to make assertEqual pass
-  let otherInput = toPublicInput(self, tail);
-  atParty.assertEquals(otherInput.atParty);
-  transaction.assertEquals(otherInput.transaction);
+function checkPublicInput({ party, calls }: ZkappPublicInput, self: Party) {
+  let otherInput = partyToPublicInput(self);
+  party.assertEquals(otherInput.party);
+  calls.assertEquals(otherInput.calls);
 }
 
 /**

src/snarky.d.ts

@@ -740,7 +740,7 @@ declare class Ledger {
   static zkappPublicInput(
     txJson: string,
     partyIndex: number
-  ): [transaction: Field, atParty: Field];
+  ): { party: Field; calls: Field };
   static signFieldElement(
     messageHash: Field,
     privateKey: { s: Scalar }