Updated on 2026-08-14

app/src/main/java/com/tangem/tap/domain/hot/HotWalletAccessor.kt

@@ -1,6 +1,9 @@
 package com.tangem.tap.domain.hot
 
+import com.tangem.common.core.TangemSdkError
+import com.tangem.features.hotwallet.HotWalletPasswordRequester
 import com.tangem.hot.sdk.TangemHotSdk
+import com.tangem.hot.sdk.exception.WrongPasswordException
 import com.tangem.hot.sdk.model.*
 import javax.inject.Inject
 
@@ -12,33 +15,99 @@ class HotWalletAccessor @Inject constructor(
     suspend fun signHashes(hotWalletId: HotWalletId, dataToSign: List<DataToSign>): List<SignedData> {
         val auth = when (hotWalletId.authType) {
             HotWalletId.AuthType.NoPassword -> HotAuth.NoAuth
-            HotWalletId.AuthType.Password -> {
-                hotWalletPasswordRequester.requestPassword(hotWalletId)
-            }
+            HotWalletId.AuthType.Password -> requestPassword(false)
             HotWalletId.AuthType.Biometry -> HotAuth.Biometry
         }
 
-        return runCatching {
+        return runCatchingSdkErrors(hotWalletId, auth) {
             tangemHotSdk.signHashes(
                 unlockHotWallet = UnlockHotWallet(
                     walletId = hotWalletId,
-                    auth = auth,
+                    auth = it,
                 ),
                 dataToSign = dataToSign,
-            )
-        }.getOrElse {
-            if (hotWalletId.authType == HotWalletId.AuthType.Biometry) {
-                val passwordAuth = hotWalletPasswordRequester.requestPassword(hotWalletId)
-                tangemHotSdk.signHashes(
-                    unlockHotWallet = UnlockHotWallet(
-                        walletId = hotWalletId,
-                        auth = passwordAuth,
-                    ),
-                    dataToSign = dataToSign,
-                )
-            } else {
-                throw it
+            ).also {
+                hotWalletPasswordRequester.dismiss()
             }
         }
     }
+
+    private suspend fun <T> runCatchingSdkErrors(
+        hotWalletId: HotWalletId,
+        auth: HotAuth,
+        block: suspend (auth: HotAuth) -> T,
+    ): T {
+        return runCatchingWrongPassInternal(
+            originalAuth = auth,
+            auth = auth,
+            block = { blockAuth ->
+                block(blockAuth).also {
+                    // TODO [REDACTED_TASK_KEY] if user has biometry enabled, we set it as the new auth method
+                    if (blockAuth is HotAuth.Password /*&& has biometry enabled */) {
+                        tangemHotSdk.changeAuth(
+                            unlockHotWallet = UnlockHotWallet(
+                                walletId = hotWalletId,
+                                auth = blockAuth,
+                            ),
+                            auth = HotAuth.Biometry,
+                        )
+                    }
+                }
+            },
+        )
+    }
+
+    private suspend fun <T> runCatchingWrongPassInternal(
+        originalAuth: HotAuth,
+        auth: HotAuth,
+        block: suspend (auth: HotAuth) -> T,
+    ): T = runCatching {
+        block(auth)
+    }.getOrElse { exception ->
+        if (auth is HotAuth.Biometry && exception.isBiometryError()) {
+            // fallback to password if biometry fails
+            val passAuth = requestPassword(true)
+
+            return@getOrElse runCatchingWrongPassInternal(
+                originalAuth = originalAuth,
+                auth = passAuth,
+                block = block,
+            )
+        }
+
+        if (exception !is WrongPasswordException) {
+            throw exception
+        }
+
+        // If the exception is a wrong password, we need to request the password again
+
+        hotWalletPasswordRequester.wrongPassword()
+        val passResult = requestPassword(originalAuth is HotAuth.Biometry)
+
+        runCatchingWrongPassInternal(
+            originalAuth = originalAuth,
+            auth = passResult,
+            block = block,
+        )
+    }
+
+    private suspend fun requestPassword(hasBiometry: Boolean): HotAuth {
+        return hotWalletPasswordRequester.requestPassword(hasBiometry).toAuth() ?: throw TangemSdkError.UserCancelled()
+    }
+
+    private fun Throwable.isBiometryError(): Boolean {
+        return this is TangemSdkError.AuthenticationFailed ||
+            this is TangemSdkError.AuthenticationCanceled ||
+            this is TangemSdkError.AuthenticationLockout ||
+            this is TangemSdkError.AuthenticationUnavailable ||
+            this is TangemSdkError.AuthenticationAlreadyInProgress ||
+            this is TangemSdkError.AuthenticationNotInitialized ||
+            this is TangemSdkError.AuthenticationPermanentLockout
+    }
+
+    private fun HotWalletPasswordRequester.Result.toAuth() = when (this) {
+        HotWalletPasswordRequester.Result.UseBiometry -> HotAuth.Biometry
+        HotWalletPasswordRequester.Result.Dismiss -> null
+        is HotWalletPasswordRequester.Result.EnteredPassword -> this.password
+    }
 }

app/src/main/java/com/tangem/tap/domain/hot/TangemHotWalletSigner.kt

@@ -0,0 +1,98 @@
+package com.tangem.tap.domain.hot
+
+import com.tangem.blockchain.common.TransactionSigner
+import com.tangem.blockchain.common.Wallet
+import com.tangem.common.CompletionResult
+import com.tangem.common.core.TangemSdkError
+import com.tangem.common.map
+import com.tangem.domain.wallets.models.UserWallet
+import com.tangem.hot.sdk.model.DataToSign
+import com.tangem.operations.sign.SignData
+import dagger.assisted.Assisted
+import dagger.assisted.AssistedFactory
+import dagger.assisted.AssistedInject
+import timber.log.Timber
+
+class TangemHotWalletSigner @AssistedInject constructor(
+    @Assisted private val userWallet: UserWallet.Hot,
+    private val hotWalletAccessor: HotWalletAccessor,
+) : TransactionSigner {
+
+    override suspend fun sign(hash: ByteArray, publicKey: Wallet.PublicKey): CompletionResult<ByteArray> {
+        return sign(listOf(hash), publicKey).map { it.first() }
+    }
+
+    override suspend fun sign(
+        hashes: List<ByteArray>,
+        publicKey: Wallet.PublicKey,
+    ): CompletionResult<List<ByteArray>> {
+        val wallet = userWallet.wallets.orEmpty().firstOrNull { it.publicKey.contentEquals(publicKey.seedKey) }
+            ?: return CompletionResult.Failure(
+                TangemSdkError.ExceptionError(IllegalStateException("wallet is locked")),
+            )
+
+        val result = runCatching {
+            hotWalletAccessor.signHashes(
+                hotWalletId = userWallet.hotWalletId,
+                dataToSign = listOf(
+                    DataToSign(
+                        curve = wallet.curve,
+                        hashes = hashes,
+                        derivationPath = publicKey.derivationPath,
+                    ),
+                ),
+            )
+        }.getOrElse {
+            Timber.e(it)
+            return if (it is TangemSdkError) {
+                CompletionResult.Failure(it)
+            } else {
+                CompletionResult.Failure(TangemSdkError.ExceptionError(it))
+            }
+        }
+
+        return CompletionResult.Success(result.map { it.signatures }.flatten())
+    }
+
+    override suspend fun multiSign(
+        dataToSign: List<SignData>,
+        publicKey: Wallet.PublicKey,
+    ): CompletionResult<Map<ByteArray, ByteArray>> {
+        val result = runCatching {
+            hotWalletAccessor.signHashes(
+                hotWalletId = userWallet.hotWalletId,
+                dataToSign = dataToSign.map { signData ->
+                    val wallet =
+                        userWallet.wallets.orEmpty().firstOrNull { it.publicKey.contentEquals(signData.publicKey) }
+                            ?: return CompletionResult.Failure(
+                                TangemSdkError.ExceptionError(IllegalStateException("wallet is locked")),
+                            )
+
+                    DataToSign(
+                        curve = wallet.curve,
+                        hashes = listOf(signData.hash),
+                        derivationPath = signData.derivationPath,
+                    )
+                },
+            )
+        }.getOrElse {
+            Timber.e(it)
+            return if (it is TangemSdkError) {
+                CompletionResult.Failure(it)
+            } else {
+                CompletionResult.Failure(TangemSdkError.ExceptionError(it))
+            }
+        }
+
+        return CompletionResult.Success(
+            result.mapIndexed { index, data ->
+                dataToSign[index].publicKey to data.signatures.first()
+            }.toMap(),
+        )
+    }
+
+    @AssistedFactory
+    interface Factory {
+        fun create(@Assisted userWallet: UserWallet.Hot): TangemHotWalletSigner
+    }
+}

app/src/main/java/com/tangem/tap/domain/userWalletList/utils/Mapper.kt

@@ -117,5 +117,5 @@ internal fun UserWallet.lock(): UserWallet = when (this) {
             ),
         )
     }
-    is UserWallet.Hot -> TODO("[REDACTED_TASK_KEY]")
+    is UserWallet.Hot -> copy(wallets = null)
 }