feature/1121 implement ucan validation (#1176)

- **refactor: remove unused auth components**
- **refactor: improve devbox configuration and deployment process**
- **refactor: improve devnet and testnet setup**
- **fix: update templ version to v0.2.778**
- **refactor: rename pkl/net.matrix to pkl/matrix.net**
- **refactor: migrate webapp components to nebula**
- **refactor: protobuf types**
- **chore: update dependencies for improved security and stability**
- **feat: implement landing page and vault gateway servers**
- **refactor: Migrate data models to new module structure and update
related files**
- **feature/1121-implement-ucan-validation**
- **refactor: Replace hardcoded constants with model types in attns.go**
- **feature/1121-implement-ucan-validation**
- **chore: add origin Host struct and update main function to handle
multiple hosts**
- **build: remove unused static files from dwn module**
- **build: remove unused static files from dwn module**
- **refactor: Move DWN models to common package**
- **refactor: move models to pkg/common**
- **refactor: move vault web app assets to embed module**
- **refactor: update session middleware import path**
- **chore: configure port labels and auto-forwarding behavior**
- **feat: enhance devcontainer configuration**
- **feat: Add UCAN middleware for Echo with flexible token validation**
- **feat: add JWT middleware for UCAN authentication**
- **refactor: update package URI and versioning in PklProject files**
- **fix: correct sonr.pkl import path**
- **refactor: move JWT related code to auth package**
- **feat: introduce vault configuration retrieval and management**
- **refactor: Move vault components to gateway module and update file
paths**
- **refactor: remove Dexie and SQLite database implementations**
- **feat: enhance frontend with PWA features and WASM integration**
- **feat: add Devbox features and streamline Dockerfile**
- **chore: update dependencies to include TigerBeetle**
- **chore(deps): update go version to 1.23**
- **feat: enhance devnet setup with PATH environment variable and
updated PWA manifest**
- **fix: upgrade tigerbeetle-go dependency and remove indirect
dependency**
- **feat: add PostgreSQL support to devnet and testnet deployments**
- **refactor: rename keyshare cookie to token cookie**
- **feat: upgrade Go version to 1.23.3 and update dependencies**
- **refactor: update devnet and testnet configurations**
- **feat: add IPFS configuration for devnet**
- **I'll help you update the ipfs.config.pkl to include all the peers
from the shell script. Here's the updated configuration:**
- **refactor: move mpc package to crypto directory**
- **feat: add BIP32 support for various cryptocurrencies**
- **feat: enhance ATN.pkl with additional capabilities**
- **refactor: simplify smart account and vault attenuation creation**
- **feat: add new capabilities to the Attenuation type**
- **refactor: Rename MPC files for clarity and consistency**
- **feat: add DIDKey support for cryptographic operations**
- **feat: add devnet and testnet deployment configurations**
- **fix: correct key derivation in bip32 package**
- **refactor: rename crypto/bip32 package to crypto/accaddr**
- **fix: remove duplicate indirect dependency**
- **refactor: move vault package to root directory**
- **refactor: update routes for gateway and vault**
- **refactor: remove obsolete web configuration file**
- **refactor: remove unused TigerBeetle imports and update host
configuration**
- **refactor: adjust styles directory path**
- **feat: add broadcastTx and simulateTx functions to gateway**
- **feat: add PinVault handler**

pkg/common/auth/config.go

@@ -0,0 +1,36 @@
+package auth
+
+import (
+	"github.com/labstack/echo/v4"
+	"github.com/onsonr/sonr/crypto/mpc"
+)
+
+// UCANConfig defines the configuration for UCAN middleware
+type UCANConfig struct {
+	// Skipper defines a function to skip middleware
+	Skipper func(c echo.Context) bool
+
+	// KeySource provides the source for validating UCANs
+	KeySource mpc.KeyshareSource
+
+	// TokenLookup is a string in the form of "<source>:<name>" that is used
+	// to extract token from the request.
+	// Optional. Default value "header:Authorization".
+	// Possible values:
+	// - "header:<name>"
+	// - "query:<name>"
+	// - "param:<name>"
+	// - "cookie:<name>"
+	TokenLookup string
+
+	// AuthScheme to be used in the Authorization header.
+	// Optional. Default value "Bearer".
+	AuthScheme string
+}
+
+// DefaultUCANConfig is the default UCAN middleware config
+var DefaultUCANConfig = UCANConfig{
+	Skipper:     nil,
+	TokenLookup: "header:Authorization",
+	AuthScheme:  "Bearer",
+}

pkg/common/auth/middleware.go

@@ -0,0 +1,119 @@
+package auth
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/labstack/echo/v4"
+	"github.com/onsonr/sonr/crypto/mpc"
+)
+
+// UCAN returns middleware to validate UCAN tokens
+func UCAN(source mpc.KeyshareSource, opts ...Option) echo.MiddlewareFunc {
+	c := DefaultUCANConfig
+	for _, opt := range opts {
+		opt(&c)
+	}
+	c.KeySource = source
+	return UCANWithConfig(c)
+}
+
+// UCANWithConfig returns UCAN middleware with custom config
+func UCANWithConfig(config UCANConfig) echo.MiddlewareFunc {
+	// Defaults
+	if config.Skipper == nil {
+		config.Skipper = DefaultUCANConfig.Skipper
+	}
+	if config.TokenLookup == "" {
+		config.TokenLookup = DefaultUCANConfig.TokenLookup
+	}
+	if config.AuthScheme == "" {
+		config.AuthScheme = DefaultUCANConfig.AuthScheme
+	}
+
+	// Initialize
+	parts := strings.Split(config.TokenLookup, ":")
+	extractor := tokenFromHeader(parts[1], config.AuthScheme)
+	switch parts[0] {
+	case "query":
+		extractor = tokenFromQuery(parts[1])
+	case "param":
+		extractor = tokenFromParam(parts[1])
+	case "cookie":
+		extractor = tokenFromCookie(parts[1])
+	}
+
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			if config.Skipper != nil && config.Skipper(c) {
+				return next(c)
+			}
+
+			auth, err := extractor(c)
+			if err != nil {
+				return echo.NewHTTPError(401, err.Error())
+			}
+
+			parser := config.KeySource.UCANParser()
+			token, err := parser.ParseAndVerify(c.Request().Context(), auth)
+			if err != nil {
+				return echo.NewHTTPError(401, "invalid UCAN token")
+			}
+
+			// Store token in context
+			c.Set("ucan", token)
+			return next(c)
+		}
+	}
+}
+
+// tokenFromHeader extracts token from header
+func tokenFromHeader(header string, authScheme string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		auth := c.Request().Header.Get(header)
+		if auth == "" {
+			return "", fmt.Errorf("missing auth token")
+		}
+		if authScheme == "" {
+			return auth, nil
+		}
+		l := len(authScheme)
+		if len(auth) > l+1 && auth[:l] == authScheme {
+			return auth[l+1:], nil
+		}
+		return "", fmt.Errorf("invalid auth scheme")
+	}
+}
+
+// tokenFromQuery extracts token from query string
+func tokenFromQuery(param string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		token := c.QueryParam(param)
+		if token == "" {
+			return "", fmt.Errorf("missing auth token")
+		}
+		return token, nil
+	}
+}
+
+// tokenFromParam extracts token from url param
+func tokenFromParam(param string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		token := c.Param(param)
+		if token == "" {
+			return "", fmt.Errorf("missing auth token")
+		}
+		return token, nil
+	}
+}
+
+// tokenFromCookie extracts token from cookie
+func tokenFromCookie(name string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		cookie, err := c.Cookie(name)
+		if err != nil {
+			return "", fmt.Errorf("missing auth token")
+		}
+		return cookie.Value, nil
+	}
+}

pkg/common/auth/options.go

@@ -0,0 +1,26 @@
+package auth
+
+import (
+	"github.com/labstack/echo/v4"
+)
+
+type Option func(c *UCANConfig)
+
+func WithSkipper(skipper func(c echo.Context) bool) Option {
+	return func(c *UCANConfig) {
+		c.Skipper = skipper
+	}
+}
+
+func WithAuthScheme(scheme string) Option {
+	return func(c *UCANConfig) {
+		c.AuthScheme = scheme
+	}
+}
+
+// WithTokenLookup sets the token lookup strategy
+func WithTokenLookup(lookup string) Option {
+	return func(c *UCANConfig) {
+		c.TokenLookup = lookup
+	}
+}