Master (#1262)

* clear * feat: Add everything * fix: Commenht
2026-08-04 18:31:41 +00:00 · 2025-10-03 14:45:52 -04:00
parent 43b4a11c06
commit 13e6c3e84d
1935 changed files with 655061 additions and 40058 deletions
@@ -2,6 +2,8 @@ package keeper

 import (
 	"context"
+	"fmt"
+	"strings"

 	"github.com/cosmos/cosmos-sdk/codec"

@@ -13,8 +15,10 @@ import (
 	"cosmossdk.io/log"
 	"cosmossdk.io/orm/model/ormdb"

-	apiv1 "github.com/sonr-io/snrd/api/svc/v1"
-	"github.com/sonr-io/snrd/x/svc/types"
+	apiv1 "github.com/sonr-io/sonr/api/svc/v1"
+	"github.com/sonr-io/sonr/crypto/keys"
+	"github.com/sonr-io/sonr/crypto/ucan"
+	"github.com/sonr-io/sonr/x/svc/types"
 )

 type Keeper struct {
@@ -27,6 +31,13 @@ type Keeper struct {
 	Params collections.Item[types.Params]
 	OrmDB  apiv1.StateStore

+	// dependencies
+	didKeeper types.DIDKeeper
+
+	// UCAN functionality
+	ucanVerifier        *ucan.Verifier
+	permissionValidator *PermissionValidator
+
 	authority string
 }

@@ -36,6 +47,7 @@ func NewKeeper(
 	storeService storetypes.KVStoreService,
 	logger log.Logger,
 	authority string,
+	didKeeper types.DIDKeeper,
 ) Keeper {
 	logger = logger.With(log.ModuleKey, "x/"+types.ModuleName)

@@ -45,7 +57,10 @@ func NewKeeper(
 		authority = authtypes.NewModuleAddress(govtypes.ModuleName).String()
 	}

-	db, err := ormdb.NewModuleDB(&types.ORMModuleSchema, ormdb.ModuleDBOptions{KVStoreService: storeService})
+	db, err := ormdb.NewModuleDB(
+		&types.ORMModuleSchema,
+		ormdb.ModuleDBOptions{KVStoreService: storeService},
+	)
 	if err != nil {
 		panic(err)
 	}
@@ -55,14 +70,25 @@ func NewKeeper(
 		panic(err)
 	}

+	// Create UCAN verifier with DID resolver
+	didResolver := &DIDKeeperResolver{didKeeper: didKeeper}
+	ucanVerifier := ucan.NewVerifier(didResolver)
+
 	k := Keeper{
 		cdc:    cdc,
 		logger: logger,

-		Params: collections.NewItem(sb, types.ParamsKey, "params", codec.CollValue[types.Params](cdc)),
-		OrmDB:  store,
+		Params: collections.NewItem(
+			sb,
+			types.ParamsKey,
+			"params",
+			codec.CollValue[types.Params](cdc),
+		),
+		OrmDB: store,

-		authority: authority,
+		didKeeper:    didKeeper,
+		ucanVerifier: ucanVerifier,
+		authority:    authority,
 	}

 	schema, err := sb.Build()
@@ -72,21 +98,51 @@ func NewKeeper(

 	k.Schema = schema

+	// Initialize UCAN permission validator (after keeper is fully constructed)
+	k.permissionValidator = NewPermissionValidator(k)
+
 	return k
 }

+// GetPermissionValidator returns the UCAN permission validator
+func (k Keeper) GetPermissionValidator() *PermissionValidator {
+	return k.permissionValidator
+}
+
 func (k Keeper) Logger() log.Logger {
 	return k.logger
 }

 // InitGenesis initializes the module's state from a genesis state.
 func (k *Keeper) InitGenesis(ctx context.Context, data *types.GenesisState) error {
-
 	if err := data.Params.Validate(); err != nil {
 		return err
 	}

-	return k.Params.Set(ctx, data.Params)
+	// Set parameters
+	if err := k.Params.Set(ctx, data.Params); err != nil {
+		return err
+	}
+
+	// Import capabilities
+	for _, capability := range data.Capabilities {
+		// Convert to types.ServiceCapability for storage
+		cap := &types.ServiceCapability{
+			CapabilityId: capability.CapabilityId,
+			ServiceId:    capability.ServiceId,
+			Domain:       capability.Domain,
+			Abilities:    capability.Abilities,
+			Owner:        capability.Owner,
+			CreatedAt:    capability.CreatedAt,
+			ExpiresAt:    capability.ExpiresAt,
+			Revoked:      capability.Revoked,
+		}
+		if err := k.StoreCapability(ctx, cap); err != nil {
+			return fmt.Errorf("failed to import capability %s: %w", capability.CapabilityId, err)
+		}
+	}
+
+	return nil
 }

 // ExportGenesis exports the module's state to a genesis state.
@@ -96,7 +152,304 @@ func (k *Keeper) ExportGenesis(ctx context.Context) *types.GenesisState {
 		panic(err)
 	}

+	// Export all capabilities
+	var capabilities []types.ServiceCapability
+
+	// Iterate through all capabilities in the ORM
+	iter, err := k.OrmDB.ServiceCapabilityTable().List(ctx, apiv1.ServiceCapabilityPrimaryKey{})
+	if err != nil {
+		panic(fmt.Errorf("failed to list capabilities for export: %w", err))
+	}
+	defer iter.Close()
+
+	for iter.Next() {
+		apiCap, err := iter.Value()
+		if err != nil {
+			panic(fmt.Errorf("failed to get capability during export: %w", err))
+		}
+
+		// Convert from API type to types
+		cap := types.ServiceCapability{
+			CapabilityId: apiCap.CapabilityId,
+			ServiceId:    apiCap.ServiceId,
+			Domain:       apiCap.Domain,
+			Abilities:    apiCap.Abilities,
+			Owner:        apiCap.Owner,
+			CreatedAt:    apiCap.CreatedAt,
+			ExpiresAt:    apiCap.ExpiresAt,
+			Revoked:      apiCap.Revoked,
+		}
+		capabilities = append(capabilities, cap)
+	}
+
 	return &types.GenesisState{
-		Params: params,
+		Params:       params,
+		Capabilities: capabilities,
 	}
 }
+
+// VerifyServiceRegistration verifies service registration and domain ownership
+func (k Keeper) VerifyServiceRegistration(
+	ctx context.Context,
+	serviceID string,
+	domain string,
+) (bool, error) {
+	if serviceID == "" {
+		return false, types.ErrInvalidServiceID
+	}
+
+	if domain == "" {
+		return false, types.ErrDomainNotVerified
+	}
+
+	// Check if the service exists
+	service, err := k.OrmDB.ServiceTable().Get(ctx, serviceID)
+	if err != nil {
+		return false, types.ErrInvalidServiceID
+	}
+
+	// Verify the service belongs to the specified domain
+	if service.Domain != domain {
+		return false, types.ErrDomainNotVerified
+	}
+
+	// Check if the domain is verified
+	if !k.IsVerifiedDomain(ctx, domain) {
+		return false, types.ErrDomainNotVerified
+	}
+
+	// Check if the service is active
+	if service.Status != apiv1.ServiceStatus_SERVICE_STATUS_ACTIVE {
+		return false, types.ErrInvalidServiceID
+	}
+
+	return true, nil
+}
+
+// GetService gets service by ID
+func (k Keeper) GetService(ctx context.Context, serviceID string) (*types.Service, error) {
+	if serviceID == "" {
+		return nil, types.ErrInvalidServiceID
+	}
+
+	// Get service from ORM
+	service, err := k.OrmDB.ServiceTable().Get(ctx, serviceID)
+	if err != nil {
+		return nil, types.ErrInvalidServiceID
+	}
+
+	// Convert v1.Service to types.Service
+	return &types.Service{
+		Id:                service.Id,
+		Domain:            service.Domain,
+		Owner:             service.Owner,
+		RootCapabilityCid: service.RootCapabilityCid,
+		Permissions:       service.Permissions,
+		Status:            types.ServiceStatus(service.Status),
+		CreatedAt:         service.CreatedAt,
+		UpdatedAt:         service.UpdatedAt,
+	}, nil
+}
+
+// IsDomainVerified checks if domain is verified
+func (k Keeper) IsDomainVerified(ctx context.Context, domain string, owner string) (bool, error) {
+	if domain == "" {
+		return false, types.ErrDomainNotVerified
+	}
+
+	// Get domain verification record
+	verification, err := k.OrmDB.DomainVerificationTable().Get(ctx, domain)
+	if err != nil {
+		return false, types.ErrDomainNotVerified
+	}
+
+	// Check if the domain is verified
+	if verification.Status != apiv1.DomainVerificationStatus_DOMAIN_VERIFICATION_STATUS_VERIFIED {
+		return false, nil
+	}
+
+	// Check if the owner matches (if provided)
+	if owner != "" && verification.Owner != owner {
+		return false, nil
+	}
+
+	// Check if the verification hasn't expired
+	if k.isDomainVerificationExpired(verification) {
+		return false, nil
+	}
+
+	return true, nil
+}
+
+// GetServicesByDomain gets services by domain
+func (k Keeper) GetServicesByDomain(ctx context.Context, domain string) ([]types.Service, error) {
+	if domain == "" {
+		return nil, types.ErrDomainNotVerified
+	}
+
+	// Create index key for domain
+	domainKey := apiv1.ServiceDomainIndexKey{}.WithDomain(domain)
+
+	// List services by domain
+	iter, err := k.OrmDB.ServiceTable().List(ctx, domainKey)
+	if err != nil {
+		return nil, err
+	}
+	defer iter.Close()
+
+	var services []types.Service
+	for iter.Next() {
+		service, err := iter.Value()
+		if err != nil {
+			return nil, err
+		}
+
+		// Convert v1.Service to types.Service
+		services = append(services, types.Service{
+			Id:                service.Id,
+			Domain:            service.Domain,
+			Owner:             service.Owner,
+			RootCapabilityCid: service.RootCapabilityCid,
+			Permissions:       service.Permissions,
+			Status:            types.ServiceStatus(service.Status),
+			CreatedAt:         service.CreatedAt,
+			UpdatedAt:         service.UpdatedAt,
+		})
+	}
+
+	return services, nil
+}
+
+// VerifyOrigin validates a relying party origin for WebAuthn operations
+func (k Keeper) VerifyOrigin(ctx context.Context, origin string) error {
+	// Allow localhost origins for development
+	if isLocalhostOrigin(origin) {
+		return nil
+	}
+
+	// Extract domain from origin
+	domain := extractDomainFromOrigin(origin)
+	if domain == "" {
+		return fmt.Errorf("could not extract domain from origin: %s", origin)
+	}
+
+	// Check if domain is verified
+	if !k.IsVerifiedDomain(ctx, domain) {
+		return fmt.Errorf("domain not verified: %s", domain)
+	}
+
+	// Check if there are active services for this domain
+	services, err := k.GetServicesByDomain(ctx, domain)
+	if err != nil {
+		return fmt.Errorf("failed to get services for domain %s: %w", domain, err)
+	}
+
+	if len(services) == 0 {
+		return fmt.Errorf("no services registered for domain: %s", domain)
+	}
+
+	// Check if at least one service is active
+	hasActiveService := false
+	for _, service := range services {
+		if service.Status == types.ServiceStatus_SERVICE_STATUS_ACTIVE {
+			hasActiveService = true
+			break
+		}
+	}
+
+	if !hasActiveService {
+		return fmt.Errorf("no active services found for domain: %s", domain)
+	}
+
+	return nil
+}
+
+// isLocalhostOrigin checks if the origin is a localhost origin
+func isLocalhostOrigin(origin string) bool {
+	localhostPatterns := []string{
+		"http://localhost",
+		"https://localhost",
+		"http://127.0.0.1",
+		"https://127.0.0.1",
+		"http://[::1]",
+		"https://[::1]",
+	}
+
+	for _, pattern := range localhostPatterns {
+		if strings.HasPrefix(origin, pattern) {
+			return true
+		}
+	}
+	return false
+}
+
+// extractDomainFromOrigin extracts the domain from an origin URL
+func extractDomainFromOrigin(origin string) string {
+	// Remove protocol
+	domain := strings.TrimPrefix(origin, "https://")
+	domain = strings.TrimPrefix(domain, "http://")
+
+	// Remove port if present
+	if idx := strings.Index(domain, ":"); idx != -1 {
+		domain = domain[:idx]
+	}
+
+	// Remove path if present
+	if idx := strings.Index(domain, "/"); idx != -1 {
+		domain = domain[:idx]
+	}
+
+	return domain
+}
+
+// ValidateServiceOwnerDID verifies that the service owner has a valid DID document
+func (k Keeper) ValidateServiceOwnerDID(ctx context.Context, ownerDID string) error {
+	if ownerDID == "" {
+		return types.ErrInvalidOwnerDID
+	}
+
+	// Get the DID document
+	didDoc, err := k.didKeeper.GetDIDDocument(ctx, ownerDID)
+	if err != nil {
+		return types.ErrInvalidOwnerDID
+	}
+
+	// Check if the DID document exists
+	if didDoc == nil {
+		return types.ErrInvalidOwnerDID
+	}
+
+	// Check if the DID document is deactivated
+	if didDoc.Deactivated {
+		return types.ErrInvalidOwnerDID
+	}
+
+	// Additional validation: check if the DID document has valid verification methods
+	if len(didDoc.VerificationMethod) == 0 {
+		return types.ErrInvalidOwnerDID
+	}
+
+	return nil
+}
+
+// DIDKeeperResolver adapts the DID keeper to implement the UCAN DIDResolver interface
+type DIDKeeperResolver struct {
+	didKeeper types.DIDKeeper
+}
+
+// ResolveDIDKey resolves a DID string using the DID keeper
+func (r *DIDKeeperResolver) ResolveDIDKey(ctx context.Context, did string) (keys.DID, error) {
+	// Get the DID document from the keeper
+	didDoc, err := r.didKeeper.GetDIDDocument(ctx, did)
+	if err != nil {
+		return keys.DID{}, err
+	}
+
+	if didDoc == nil {
+		return keys.DID{}, types.ErrInvalidOwnerDID
+	}
+
+	// Parse the DID string into a keys.DID
+	// This assumes the DID keeper can provide the public key information
+	return keys.Parse(did)
+}