Add TSS versioning & expiration

[kajoseph]

Description

Adds versioning and expiration to TSS sessions to ensure a) there's some finality to sessions, and b) there's clarity around upgrades

Changelog

• Adds versioning to TSS
• Adds expiration to TSS sessions

Testing Notes

Tests have been added for both cases

---

Checklist

• I have read CONTRIBUTING.md and verified that this PR follows the guidelines and requirements outlined in it.

[Copilot]

Pull request overview

This PR adds TSS scheme version negotiation and session expiration to the Bitcore Wallet Service (BWS) and Bitcore Wallet Client (BWC) TSS flows, aiming to improve upgrade clarity and ensure TSS sessions eventually terminate.

Changes:

• Added client/server TSS version checks (min/max bounds + session-version matching) for both keygen and signing.
• Added time-limited TSS sessions (created timestamp + default TTL) and enforced expiry during authenticated TSS operations.
• Updated BWC to send scheme versions, and expanded test coverage for versioning + expiration scenarios.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/bitcore-wallet-service/src/lib/tss.ts	Adds scheme version enforcement and signature immutability checks in TSS keygen/sign flows.
packages/bitcore-wallet-service/src/lib/routes/tss.ts	Threads version through TSS HTTP endpoints and documents route groupings.
packages/bitcore-wallet-service/src/lib/routes/middleware/verifyTssMessage.ts	Switches to throwing ClientErrors and returning structured API errors via helper.
packages/bitcore-wallet-service/src/lib/routes/middleware/authTssRequest.ts	Adds session attachment typing and enforces session expiration for authenticated TSS requests.
packages/bitcore-wallet-service/src/lib/model/tsssign.ts	Adds createdOn/timeLimit to signing session model and threads version into model creation.
packages/bitcore-wallet-service/src/lib/model/tsskeygen.ts	Adds version parameter and sets a default TTL for keygen sessions.
packages/bitcore-wallet-service/src/lib/errors/errordefinitions.ts	Adds new TSS error codes/messages (expired, mismatch version, final sig mismatch).
packages/bitcore-wallet-service/src/lib/common/defaults.ts	Bumps default scheme versions to 1.1 and adds default TTL constants.
packages/bitcore-wallet-service/src/lib/common/constants.ts	Sets max scheme versions and introduces min server versions for keygen/sign.
packages/bitcore-wallet-client/test/tss.test.ts	Adds/updates tests for client version gating and session expiration behaviors.
packages/bitcore-wallet-client/test/data/initialKeyGenState.json	Adds fixture data to reproduce/restore a keygen session for expiry tests.
packages/bitcore-wallet-client/src/lib/tsssign.ts	Sends signing scheme version on start and per-round message submits.
packages/bitcore-wallet-client/src/lib/tsskey.ts	Sends keygen scheme version on start/join and per-round message submits.
packages/bitcore-wallet-client/src/lib/common/constants.ts	Introduces client-side TSS scheme version constants.

Suppressed comments (2)

packages/bitcore-wallet-service/src/lib/tss.ts:447

• Signing session expiration is only enforced via authTssRequest() (GET/store endpoints). The authenticated POST /v1/tss/sign/:id uses authRequest() instead and can still accept and mutate an expired signing session, which undermines the intended expiration semantics.

    if (session) {
      if (!this._isValidBroadcastMessage({ message }) && !this._isValidP2pMessage({ message })) {
        throw Errors.TSS_INVALID_MESSAGE.withMessage('Invalid message provided');
      }

packages/bitcore-wallet-service/src/lib/tss.ts:432

• Number(params.version || 1.0) can produce NaN (e.g. non-numeric input), and NaN bypasses the current bounds checks. Reject non-finite versions explicitly so the API fails fast with a clear error instead of creating sessions that later always mismatch.

    const version = Number(params.version || 1.0);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

packages/bitcore-wallet-service/src/lib/tss.ts:96

• Keygen version gating is comparing against the siggen min/max constants (TSS_SIGGEN_SCHEME_*) instead of the keygen constants. This will incorrectly gate keygen requests if the allowed ranges diverge (and is already inconsistent with the naming).

    if (version < Constants.TSS_SIGGEN_SCHEME_MIN_SERVER_VERSION) {
      throw Errors.UPGRADE_NEEDED;
    }
    if (version > Constants.TSS_SIGGEN_SCHEME_VERSION_MAX) {
      throw Errors.UPGRADE_NEEDED.withMessage('TSS version too new: ' + version);
    }