Master (#1262)

* clear

* feat: Add everything

* fix: Commenht

x/dwn/client/plugin/plugin.go

@@ -0,0 +1,203 @@
+// Package plugin provides a high-level interface for interacting with the Motor WebAssembly enclave plugin.
+//
+// The Motor plugin operates as an MPC-based UCAN (User-Controlled Authorization Networks)
+// KeyshareSource, providing sophisticated decentralized authorization capabilities. This package abstracts the
+// underlying WASM implementation and provides type-safe method calls for:
+//
+// - UCAN token creation and delegation
+// - MPC-based cryptographic signing and verification
+// - DID generation and identity management
+// - Secure enclave configuration and management
+//
+// # Usage Example
+//
+// Basic usage with enclave configuration:
+//
+//	ctx := context.Background()
+//	enclaveData, _ := json.Marshal(&mpc.EnclaveData{...})
+//	plugin, err := LoadPluginWithEnclave(ctx, "sonr-testnet-1", enclaveData, nil)
+//	if err != nil {
+//		log.Fatal(err)
+//	}
+//
+//	// Create UCAN token
+//	req := &NewOriginTokenRequest{
+//		AudienceDID: "did:sonr:audience",
+//		Attenuations: []map[string]any{
+//			{"can": []string{"sign"}, "with": "vault://example"},
+//		},
+//	}
+//	resp, err := plugin.NewOriginToken(req)
+package plugin
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	extism "github.com/extism/go-sdk"
+)
+
+// Plugin defines the interface for cryptographic operations provided by the WebAssembly enclave.
+// It abstracts the underlying WASM implementation and provides type-safe method calls.
+// Updated to match the refactored MPC-based UCAN KeyshareSource Motor plugin.
+type Plugin interface {
+	// UCAN Token Operations
+
+	// NewOriginToken creates a new UCAN origin token using MPC signing.
+	NewOriginToken(req *NewOriginTokenRequest) (*UCANTokenResponse, error)
+
+	// NewAttenuatedToken creates a delegated UCAN token with attenuated permissions.
+	NewAttenuatedToken(req *NewAttenuatedTokenRequest) (*UCANTokenResponse, error)
+
+	// Cryptographic Operations
+
+	// SignData signs arbitrary data using the MPC enclave.
+	SignData(req *SignDataRequest) (*SignDataResponse, error)
+
+	// VerifyData verifies a signature against data using the MPC enclave.
+	VerifyData(req *VerifyDataRequest) (*VerifyDataResponse, error)
+
+	// Identity Operations
+
+	// GetIssuerDID retrieves the issuer DID, address, and chain code from the enclave.
+	GetIssuerDID() (*GetIssuerDIDResponse, error)
+}
+
+// LoadPluginWithEnclave initializes and loads the WebAssembly MPC-based UCAN enclave plugin
+// with the specified enclave configuration. This method provides basic enclave configuration
+// but does not include advanced features like health monitoring and automatic recovery.
+//
+// For production use, consider LoadPluginWithManager which provides enhanced lifecycle management.
+//
+// Parameters:
+//   - ctx: Context for plugin initialization
+//   - chainID: Chain ID for the enclave (e.g., "sonr-testnet-1")
+//   - enclaveData: JSON-encoded MPC enclave data
+//   - vaultConfig: Optional vault configuration parameters
+//
+// Returns a Plugin interface for UCAN token operations and MPC cryptographic functions.
+func LoadPluginWithEnclave(
+	ctx context.Context,
+	chainID string,
+	enclaveData []byte,
+	vaultConfig map[string]any,
+) (Plugin, error) {
+	// Verify WASM integrity before loading
+	if err := VerifyPluginIntegrity(motrPluginBytes); err != nil {
+		return nil, fmt.Errorf("WASM integrity verification failed: %w", err)
+	}
+
+	manifest := GetManifestWithEnclave(chainID, enclaveData, vaultConfig)
+	cfg := GetPluginConfig()
+	plugin, err := extism.NewPlugin(ctx, manifest, cfg, []extism.HostFunction{})
+	if err != nil {
+		return nil, err
+	}
+	return &pluginImpl{plugin: plugin}, nil
+}
+
+// LoadPluginWithManager loads a Motor plugin using the enhanced plugin manager.
+// This is the recommended method for production use as it provides:
+//   - Health monitoring and automatic recovery
+//   - Plugin instance caching and reuse
+//   - Comprehensive configuration validation
+//   - Background cleanup of expired instances
+//
+// Parameters:
+//   - ctx: Context for plugin initialization
+//   - config: Complete enclave configuration including timeouts, security settings, etc.
+//
+// Returns a managed Plugin interface with enhanced error handling and recovery.
+func LoadPluginWithManager(ctx context.Context, config *EnclaveConfig) (Plugin, error) {
+	return DefaultManager.LoadPlugin(ctx, config)
+}
+
+type pluginImpl struct {
+	plugin *extism.Plugin
+}
+
+// UCAN Token Operations - Primary interface for the refactored Motor plugin
+
+func (p *pluginImpl) NewOriginToken(req *NewOriginTokenRequest) (*UCANTokenResponse, error) {
+	reqBytes, err := json.Marshal(req)
+	if err != nil {
+		return nil, err
+	}
+	_, r, err := p.plugin.Call("new_origin_token", reqBytes)
+	if err != nil {
+		return nil, err
+	}
+	var resp UCANTokenResponse
+	if err := json.Unmarshal(r, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// NewAttenuatedToken creates an attenuated UCAN token by delegating from a parent token.
+func (p *pluginImpl) NewAttenuatedToken(
+	req *NewAttenuatedTokenRequest,
+) (*UCANTokenResponse, error) {
+	reqBytes, err := json.Marshal(req)
+	if err != nil {
+		return nil, err
+	}
+	_, r, err := p.plugin.Call("new_attenuated_token", reqBytes)
+	if err != nil {
+		return nil, err
+	}
+	var resp UCANTokenResponse
+	if err := json.Unmarshal(r, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// Cryptographic Operations
+
+func (p *pluginImpl) SignData(req *SignDataRequest) (*SignDataResponse, error) {
+	reqBytes, err := json.Marshal(req)
+	if err != nil {
+		return nil, err
+	}
+	_, r, err := p.plugin.Call("sign_data", reqBytes)
+	if err != nil {
+		return nil, err
+	}
+	var resp SignDataResponse
+	if err := json.Unmarshal(r, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (p *pluginImpl) VerifyData(req *VerifyDataRequest) (*VerifyDataResponse, error) {
+	reqBytes, err := json.Marshal(req)
+	if err != nil {
+		return nil, err
+	}
+	_, r, err := p.plugin.Call("verify_data", reqBytes)
+	if err != nil {
+		return nil, err
+	}
+	var resp VerifyDataResponse
+	if err := json.Unmarshal(r, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// Identity Operations
+
+func (p *pluginImpl) GetIssuerDID() (*GetIssuerDIDResponse, error) {
+	_, r, err := p.plugin.Call("get_issuer_did", []byte{})
+	if err != nil {
+		return nil, err
+	}
+	var resp GetIssuerDIDResponse
+	if err := json.Unmarshal(r, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}