Master (#1262)

* clear * feat: Add everything * fix: Commenht
2026-08-04 18:31:41 +00:00 · 2025-10-03 14:45:52 -04:00
parent 43b4a11c06
commit 13e6c3e84d
1935 changed files with 655061 additions and 40058 deletions
@@ -0,0 +1,267 @@
+// Package commands contains utility functions for the snrd command
+package commands
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/sonr-io/sonr/app"
+	"github.com/sonr-io/sonr/crypto/vrf"
+	"github.com/spf13/cobra"
+)
+
+// VRFKeysCmd returns the VRF key management command
+func VRFKeysCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "vrf",
+		Short: "Manage VRF (Verifiable Random Function) keys",
+		Long: `Manage VRF keys used for consensus-based encryption in multi-validator networks.
+
+VRF keys are required for:
+  - Multi-validator encryption key derivation
+  - Consensus-based key rotation
+  - Deterministic randomness in distributed systems
+
+VRF keys are automatically generated during 'snrd init', but this command
+allows you to inspect or regenerate them if needed.`,
+	}
+
+	cmd.AddCommand(
+		vrfGenerateCmd(),
+		vrfShowCmd(),
+		vrfVerifyCmd(),
+	)
+
+	return cmd
+}
+
+// vrfGenerateCmd creates a command to generate new VRF keys
+func vrfGenerateCmd() *cobra.Command {
+	var chainID string
+	var force bool
+
+	cmd := &cobra.Command{
+		Use:   "generate",
+		Short: "Generate new VRF keypair",
+		Long: `Generate a new VRF keypair for the node.
+
+The keypair is generated deterministically from the chain-id to ensure
+reproducibility. Keys are stored at ~/.sonr/vrf_secret.key with 0600 permissions.
+
+WARNING: Regenerating VRF keys will invalidate any existing consensus-based
+encryption keys. Only do this if you understand the implications.`,
+		Example: `  # Generate VRF keys for a specific chain
+  snrd keys vrf generate --chain-id sonrtest_1-1
+
+  # Force regenerate (overwrite existing keys)
+  snrd keys vrf generate --chain-id sonrtest_1-1 --force`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// Get chain-id
+			if chainID == "" {
+				// Try to read from genesis file
+				var err error
+				chainID, err = getChainIDFromGenesis()
+				if err != nil {
+					return fmt.Errorf("chain-id not provided and could not be read from genesis: %w\n"+
+						"Please provide --chain-id flag", err)
+				}
+			}
+
+			vrfKeyPath := filepath.Join(app.DefaultNodeHome, "vrf_secret.key")
+
+			// Check if keys already exist
+			if _, err := os.Stat(vrfKeyPath); err == nil && !force {
+				return fmt.Errorf("VRF keys already exist at %s\n"+
+					"Use --force flag to overwrite existing keys\n"+
+					"WARNING: Overwriting keys will invalidate existing consensus encryption", vrfKeyPath)
+			}
+
+			// Backup existing keys if they exist
+			if _, err := os.Stat(vrfKeyPath); err == nil && force {
+				backupPath := vrfKeyPath + ".backup"
+				if err := os.Rename(vrfKeyPath, backupPath); err != nil {
+					return fmt.Errorf("failed to backup existing VRF keys: %w", err)
+				}
+				fmt.Printf("Backed up existing keys to: %s\n", backupPath)
+			}
+
+			// Generate VRF keys
+			fmt.Printf("Generating VRF keypair for chain-id: %s\n", chainID)
+
+			entropySource, err := createChainIDEntropySource(chainID)
+			if err != nil {
+				return fmt.Errorf("failed to create entropy source: %w", err)
+			}
+
+			privateKey, err := vrf.GenerateKey(entropySource)
+			if err != nil {
+				return fmt.Errorf("failed to generate VRF keypair: %w", err)
+			}
+
+			// Validate keypair
+			if len(privateKey) != vrf.PrivateKeySize {
+				return fmt.Errorf("invalid VRF private key size: expected %d, got %d",
+					vrf.PrivateKeySize, len(privateKey))
+			}
+
+			publicKey, ok := privateKey.Public()
+			if !ok {
+				return fmt.Errorf("failed to derive public key from VRF private key")
+			}
+
+			// Ensure directory exists
+			if err := os.MkdirAll(app.DefaultNodeHome, 0o750); err != nil {
+				return fmt.Errorf("failed to create node home directory: %w", err)
+			}
+
+			// Store VRF secret key with restrictive permissions
+			if err := os.WriteFile(vrfKeyPath, privateKey, 0o600); err != nil {
+				return fmt.Errorf("failed to save VRF secret key: %w", err)
+			}
+
+			fmt.Printf("✓ VRF keypair generated successfully\n")
+			fmt.Printf("✓ Private key stored at: %s\n", vrfKeyPath)
+			fmt.Printf("✓ Public key (hex): %s\n", hex.EncodeToString(publicKey))
+			fmt.Printf("✓ Key size: %d bytes\n", len(privateKey))
+			fmt.Printf("✓ Permissions: 0600 (owner read/write only)\n")
+
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&chainID, "chain-id", "", "Chain ID for deterministic key generation")
+	cmd.Flags().BoolVar(&force, "force", false, "Force overwrite existing VRF keys (creates backup)")
+
+	return cmd
+}
+
+// vrfShowCmd creates a command to display VRF key information
+func vrfShowCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "show",
+		Short: "Show VRF public key information",
+		Long: `Display information about the node's VRF public key.
+
+This command shows the public key without exposing the private key.
+Useful for verifying that VRF keys are properly installed.`,
+		Example: `  # Show VRF key information
+  snrd keys vrf show`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			vrfKeyPath := filepath.Join(app.DefaultNodeHome, "vrf_secret.key")
+
+			// Read VRF private key
+			// #nosec G304 - vrfKeyPath is constructed from trusted DefaultNodeHome constant
+			privateKeyData, err := os.ReadFile(vrfKeyPath)
+			if err != nil {
+				return fmt.Errorf("failed to read VRF keys from %s: %w\n"+
+					"VRF keys may not be initialized. Run 'snrd init' or 'snrd keys vrf generate'",
+					vrfKeyPath, err)
+			}
+
+			// Validate key size
+			if len(privateKeyData) != vrf.PrivateKeySize {
+				return fmt.Errorf("invalid VRF private key size: expected %d, got %d",
+					vrf.PrivateKeySize, len(privateKeyData))
+			}
+
+			privateKey := vrf.PrivateKey(privateKeyData)
+			publicKey, ok := privateKey.Public()
+			if !ok {
+				return fmt.Errorf("failed to derive public key from VRF private key")
+			}
+
+			// Get file info
+			fileInfo, err := os.Stat(vrfKeyPath)
+			if err != nil {
+				return fmt.Errorf("failed to stat VRF key file: %w", err)
+			}
+
+			fmt.Println("VRF Key Information:")
+			fmt.Println("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")
+			fmt.Printf("Key Path:        %s\n", vrfKeyPath)
+			fmt.Printf("Public Key:      %s\n", hex.EncodeToString(publicKey))
+			fmt.Printf("Key Size:        %d bytes\n", len(privateKeyData))
+			fmt.Printf("Public Key Size: %d bytes\n", len(publicKey))
+			fmt.Printf("Permissions:     %s\n", fileInfo.Mode().Perm())
+			fmt.Printf("Modified:        %s\n", fileInfo.ModTime().Format("2006-01-02 15:04:05"))
+
+			// Verify permissions
+			if fileInfo.Mode().Perm() != 0o600 {
+				fmt.Println("\n⚠️  WARNING: VRF key file has incorrect permissions!")
+				fmt.Printf("   Current: %s, Expected: 0600\n", fileInfo.Mode().Perm())
+				fmt.Println("   Run: chmod 0600 " + vrfKeyPath)
+			} else {
+				fmt.Println("\n✓ VRF keys are properly configured")
+			}
+
+			return nil
+		},
+	}
+
+	return cmd
+}
+
+// vrfVerifyCmd creates a command to verify VRF key functionality
+func vrfVerifyCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "verify",
+		Short: "Verify VRF key functionality",
+		Long: `Verify that VRF keys are properly installed and functional.
+
+This command performs a test VRF computation to ensure the keys work correctly.`,
+		Example: `  # Verify VRF keys
+  snrd keys vrf verify`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			vrfKeyPath := filepath.Join(app.DefaultNodeHome, "vrf_secret.key")
+
+			// Read VRF private key
+			// #nosec G304 - vrfKeyPath is constructed from trusted DefaultNodeHome constant
+			privateKeyData, err := os.ReadFile(vrfKeyPath)
+			if err != nil {
+				return fmt.Errorf("failed to read VRF keys: %w", err)
+			}
+
+			if len(privateKeyData) != vrf.PrivateKeySize {
+				return fmt.Errorf("invalid VRF private key size: expected %d, got %d",
+					vrf.PrivateKeySize, len(privateKeyData))
+			}
+
+			privateKey := vrf.PrivateKey(privateKeyData)
+			publicKey, ok := privateKey.Public()
+			if !ok {
+				return fmt.Errorf("failed to derive public key")
+			}
+
+			// Test VRF computation with proof
+			testInput := []byte("test-input-for-verification")
+			vrfOutput, proof := privateKey.Prove(testInput)
+
+			// Verify the output
+			if !publicKey.Verify(testInput, vrfOutput, proof) {
+				return fmt.Errorf("VRF verification failed - keys may be corrupted")
+			}
+
+			// Compute output hash
+			outputHash := sha256.Sum256(vrfOutput)
+
+			fmt.Println("VRF Key Verification:")
+			fmt.Println("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━")
+			fmt.Printf("✓ VRF keys loaded successfully\n")
+			fmt.Printf("✓ Public key derived successfully\n")
+			fmt.Printf("✓ VRF proof generated successfully\n")
+			fmt.Printf("✓ VRF verification successful\n")
+			fmt.Printf("\nTest Output (hex): %s\n", hex.EncodeToString(vrfOutput))
+			fmt.Printf("Proof (hex):       %s\n", hex.EncodeToString(proof))
+			fmt.Printf("Output Hash:       %s\n", hex.EncodeToString(outputHash[:]))
+
+			fmt.Println("\n✓ VRF keys are fully functional")
+
+			return nil
+		},
+	}
+
+	return cmd
+}