feature/1121 implement ucan validation (#1176)

- **refactor: remove unused auth components**
- **refactor: improve devbox configuration and deployment process**
- **refactor: improve devnet and testnet setup**
- **fix: update templ version to v0.2.778**
- **refactor: rename pkl/net.matrix to pkl/matrix.net**
- **refactor: migrate webapp components to nebula**
- **refactor: protobuf types**
- **chore: update dependencies for improved security and stability**
- **feat: implement landing page and vault gateway servers**
- **refactor: Migrate data models to new module structure and update
related files**
- **feature/1121-implement-ucan-validation**
- **refactor: Replace hardcoded constants with model types in attns.go**
- **feature/1121-implement-ucan-validation**
- **chore: add origin Host struct and update main function to handle
multiple hosts**
- **build: remove unused static files from dwn module**
- **build: remove unused static files from dwn module**
- **refactor: Move DWN models to common package**
- **refactor: move models to pkg/common**
- **refactor: move vault web app assets to embed module**
- **refactor: update session middleware import path**
- **chore: configure port labels and auto-forwarding behavior**
- **feat: enhance devcontainer configuration**
- **feat: Add UCAN middleware for Echo with flexible token validation**
- **feat: add JWT middleware for UCAN authentication**
- **refactor: update package URI and versioning in PklProject files**
- **fix: correct sonr.pkl import path**
- **refactor: move JWT related code to auth package**
- **feat: introduce vault configuration retrieval and management**
- **refactor: Move vault components to gateway module and update file
paths**
- **refactor: remove Dexie and SQLite database implementations**
- **feat: enhance frontend with PWA features and WASM integration**
- **feat: add Devbox features and streamline Dockerfile**
- **chore: update dependencies to include TigerBeetle**
- **chore(deps): update go version to 1.23**
- **feat: enhance devnet setup with PATH environment variable and
updated PWA manifest**
- **fix: upgrade tigerbeetle-go dependency and remove indirect
dependency**
- **feat: add PostgreSQL support to devnet and testnet deployments**
- **refactor: rename keyshare cookie to token cookie**
- **feat: upgrade Go version to 1.23.3 and update dependencies**
- **refactor: update devnet and testnet configurations**
- **feat: add IPFS configuration for devnet**
- **I'll help you update the ipfs.config.pkl to include all the peers
from the shell script. Here's the updated configuration:**
- **refactor: move mpc package to crypto directory**
- **feat: add BIP32 support for various cryptocurrencies**
- **feat: enhance ATN.pkl with additional capabilities**
- **refactor: simplify smart account and vault attenuation creation**
- **feat: add new capabilities to the Attenuation type**
- **refactor: Rename MPC files for clarity and consistency**
- **feat: add DIDKey support for cryptographic operations**
- **feat: add devnet and testnet deployment configurations**
- **fix: correct key derivation in bip32 package**
- **refactor: rename crypto/bip32 package to crypto/accaddr**
- **fix: remove duplicate indirect dependency**
- **refactor: move vault package to root directory**
- **refactor: update routes for gateway and vault**
- **refactor: remove obsolete web configuration file**
- **refactor: remove unused TigerBeetle imports and update host
configuration**
- **refactor: adjust styles directory path**
- **feat: add broadcastTx and simulateTx functions to gateway**
- **feat: add PinVault handler**

crypto/mpc/ucan.go

@@ -0,0 +1,95 @@
+package mpc
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/golang-jwt/jwt"
+	"github.com/ucan-wg/go-ucan"
+)
+
+type (
+	Token  = ucan.Token
+	Claims = ucan.Claims
+	Proof  = ucan.Proof
+
+	Attenuations = ucan.Attenuations
+	Fact         = ucan.Fact
+)
+
+var (
+	UCANVersion    = ucan.UCANVersion
+	UCANVersionKey = ucan.UCANVersionKey
+	PrfKey         = ucan.PrfKey
+	FctKey         = ucan.FctKey
+	AttKey         = ucan.AttKey
+	CapKey         = ucan.CapKey
+)
+
+type ucanKeyshare struct {
+	userShare *UserKeyshare
+	valShare  *ValKeyshare
+
+	addr      string
+	issuerDID string
+}
+
+func (k ucanKeyshare) NewOriginToken(audienceDID string, att Attenuations, fct []Fact, notBefore, expires time.Time) (*ucan.Token, error) {
+	return k.newToken(audienceDID, nil, att, fct, notBefore, expires)
+}
+
+func (k ucanKeyshare) NewAttenuatedToken(parent *Token, audienceDID string, att ucan.Attenuations, fct []ucan.Fact, nbf, exp time.Time) (*Token, error) {
+	if !parent.Attenuations.Contains(att) {
+		return nil, fmt.Errorf("scope of ucan attenuations must be less than it's parent")
+	}
+	return k.newToken(audienceDID, append(parent.Proofs, Proof(parent.Raw)), att, fct, nbf, exp)
+}
+
+func (k ucanKeyshare) newToken(audienceDID string, prf []Proof, att Attenuations, fct []Fact, nbf, exp time.Time) (*ucan.Token, error) {
+	t := jwt.New(NewJWTSigningMethod("MPC256", k))
+
+	// if _, err := did.Parse(audienceDID); err != nil {
+	// 	return nil, fmt.Errorf("invalid audience DID: %w", err)
+	// }
+
+	t.Header[UCANVersionKey] = UCANVersion
+
+	var (
+		nbfUnix int64
+		expUnix int64
+	)
+
+	if !nbf.IsZero() {
+		nbfUnix = nbf.Unix()
+	}
+	if !exp.IsZero() {
+		expUnix = exp.Unix()
+	}
+
+	// set our claims
+	t.Claims = &Claims{
+		StandardClaims: &jwt.StandardClaims{
+			Issuer:    k.issuerDID,
+			Audience:  audienceDID,
+			NotBefore: nbfUnix,
+			// set the expire time
+			// see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-20#section-4.1.4
+			ExpiresAt: expUnix,
+		},
+		Attenuations: att,
+		Facts:        fct,
+		Proofs:       prf,
+	}
+
+	raw, err := t.SignedString(nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Token{
+		Raw:          raw,
+		Attenuations: att,
+		Facts:        fct,
+		Proofs:       prf,
+	}, nil
+}