feature/1220 origin handle exists method (#1241)

* feat: add docs and CI workflow for publishing to onsonr.dev * (refactor): Move hway,motr executables to their own repos * feat: simplify devnet and testnet configurations * refactor: update import path for didcrypto package * docs(networks): Add README with project overview, architecture, and community links * refactor: Move network configurations to deploy directory * build: update golang version to 1.23 * refactor: move logger interface to appropriate package * refactor: Move devnet configuration to networks/devnet * chore: improve release process with date variable * (chore): Move Crypto Library * refactor: improve code structure and readability in DID module * feat: integrate Trunk CI checks * ci: optimize CI workflow by removing redundant build jobs --------- Co-authored-by: Darp Alakun <i@prad.nu>
2026-08-02 17:31:39 +00:00 · 2025-01-06 17:06:10 +00:00
parent 9bd5e41fa0
commit 807b2e86ec
483 changed files with 8067 additions and 12559 deletions
@@ -0,0 +1,83 @@
+package spec
+
+import (
+	"crypto/sha256"
+
+	"github.com/golang-jwt/jwt"
+)
+
+// MPCSigningMethod implements the SigningMethod interface for MPC-based signing
+type MPCSigningMethod struct {
+	Name string
+	ks   ucanKeyshare
+}
+
+// NewJWTSigningMethod creates a new MPC signing method with the given keyshare source
+func NewJWTSigningMethod(name string, ks ucanKeyshare) *MPCSigningMethod {
+	return &MPCSigningMethod{
+		Name: name,
+		ks:   ks,
+	}
+}
+
+// Alg returns the signing method's name
+func (m *MPCSigningMethod) Alg() string {
+	return m.Name
+}
+
+// Verify verifies the signature using the MPC public key
+func (m *MPCSigningMethod) Verify(signingString, signature string, key interface{}) error {
+	// // Decode the signature
+	// sig, err := base64.RawURLEncoding.DecodeString(signature)
+	// if err != nil {
+	// 	return err
+	// }
+	//
+	// // Hash the signing string
+	// hasher := sha256.New()
+	// hasher.Write([]byte(signingString))
+	// digest := hasher.Sum(nil)
+	// valid, err := m.ks.valShare.PublicKey().Verify(digest, sig)
+	// if !valid || err != nil {
+	// 	return fmt.Errorf("invalid signature")
+	// }
+	return nil
+}
+
+// Sign signs the data using MPC
+func (m *MPCSigningMethod) Sign(signingString string, key interface{}) (string, error) {
+	// Hash the signing string
+	hasher := sha256.New()
+	hasher.Write([]byte(signingString))
+	// digest := hasher.Sum(nil)
+	//
+	// // Create signing functions
+	// signFunc, err := m.ks.userShare.SignFunc(digest)
+	// if err != nil {
+	// 	return "", fmt.Errorf("failed to create sign function: %w", err)
+	// }
+	//
+	// valSignFunc, err := m.ks.valShare.SignFunc(digest)
+	// if err != nil {
+	// 	return "", fmt.Errorf("failed to create validator sign function: %w", err)
+	// }
+
+	// // Run the signing protocol
+	// sig, err := mpc.ExecuteSigning(valSignFunc, signFunc)
+	// if err != nil {
+	// 	return "", fmt.Errorf("failed to run sign protocol: %w", err)
+	// }
+
+	// Encode the signature
+	// encoded := base64.RawURLEncoding.EncodeToString(sig)
+	return "", nil
+}
+
+func init() {
+	// Register the MPC signing method
+	jwt.RegisterSigningMethod("MPC256", func() jwt.SigningMethod {
+		return &MPCSigningMethod{
+			Name: "MPC256",
+		}
+	})
+}
@@ -0,0 +1,126 @@
+package spec
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/onsonr/sonr/crypto/keys"
+	"github.com/onsonr/sonr/crypto/ucan"
+	"lukechampine.com/blake3"
+)
+
+type KeyshareSource interface {
+	ucan.Source
+
+	Address() string
+	Issuer() string
+	ChainCode() ([]byte, error)
+	OriginToken() (*Token, error)
+	SignData(data []byte) ([]byte, error)
+	VerifyData(data []byte, sig []byte) (bool, error)
+	UCANParser() *ucan.TokenParser
+}
+
+//	func NewSource(ks mpc.KeyEnclave) (KeyshareSource, error) {
+//		iss, addr, err := getIssuerDID(val.PublicKey())
+//		if err != nil {
+//			return nil, err
+//		}
+//
+//		return ucanKeyshare{
+//			issuerDID: iss,
+//			addr:      addr,
+//		}, nil
+//	}
+//
+// Address returns the address of the keyshare
+func (k ucanKeyshare) Address() string {
+	return k.addr
+}
+
+// Issuer returns the DID of the issuer of the keyshare
+func (k ucanKeyshare) Issuer() string {
+	return k.issuerDID
+}
+
+// ChainCode returns the chain code of the keyshare
+func (k ucanKeyshare) ChainCode() ([]byte, error) {
+	sig, err := k.SignData([]byte(k.addr))
+	if err != nil {
+		return nil, err
+	}
+	hash := blake3.Sum256(sig)
+	// Return the first 32 bytes of the hash
+	return hash[:32], nil
+}
+
+// DefaultOriginToken returns a default token with the keyshare's issuer as the audience
+func (k ucanKeyshare) OriginToken() (*Token, error) {
+	// att := ucan.NewSmartAccount(k.addr)
+	zero := time.Time{}
+	// return k.NewOriginToken(k.issuerDID, att, nil, zero, zero)
+	return k.newToken(k.issuerDID, nil, nil, nil, zero, zero)
+}
+
+func (k ucanKeyshare) SignData(data []byte) ([]byte, error) {
+	// // Create signing functions
+	// signFunc, err := k.userShare.SignFunc(data)
+	// if err != nil {
+	// 	return nil, fmt.Errorf("failed to create sign function: %w", err)
+	// }
+	//
+	// valSignFunc, err := k.valShare.SignFunc(data)
+	// if err != nil {
+	// 	return nil, fmt.Errorf("failed to create validator sign function: %w", err)
+	// }
+
+	// Run the signing protocol
+	// return mpc.ExecuteSigning(valSignFunc, signFunc)
+	return nil, nil
+}
+
+func (k ucanKeyshare) VerifyData(data []byte, sig []byte) (bool, error) {
+	return false, nil
+	// return k.valShare.PublicKey().Verify(data, sig)
+}
+
+// TokenParser returns a token parser that can be used to parse tokens
+func (k ucanKeyshare) UCANParser() *ucan.TokenParser {
+	caps := ucan.AccountPermissions.GetCapabilities()
+	ac := func(m map[string]interface{}) (ucan.Attenuation, error) {
+		var (
+			cap string
+			rsc ucan.Resource
+		)
+		for key, vali := range m {
+			val, ok := vali.(string)
+			if !ok {
+				return ucan.Attenuation{}, fmt.Errorf(`expected attenuation value to be a string`)
+			}
+
+			if key == ucan.CapKey {
+				cap = val
+			} else {
+			}
+		}
+
+		return ucan.Attenuation{
+			Rsc: rsc,
+			Cap: caps.Cap(cap),
+		}, nil
+	}
+
+	store := ucan.NewMemTokenStore()
+	return ucan.NewTokenParser(ac, customDIDPubKeyResolver{}, store.(ucan.CIDBytesResolver))
+}
+
+// customDIDPubKeyResolver implements the DIDPubKeyResolver interface without
+// any network backing. Works if the key string given contains the public key
+// itself
+type customDIDPubKeyResolver struct{}
+
+// ResolveDIDKey extracts a public key from  a did:key string
+func (customDIDPubKeyResolver) ResolveDIDKey(ctx context.Context, didStr string) (keys.DID, error) {
+	return keys.Parse(didStr)
+}
@@ -0,0 +1,103 @@
+// go:build jwx_es256k
+package spec
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/cosmos/cosmos-sdk/types/bech32"
+	"github.com/golang-jwt/jwt"
+	"github.com/onsonr/sonr/crypto/keys"
+	"github.com/onsonr/sonr/crypto/ucan"
+)
+
+type (
+	Token  = ucan.Token
+	Claims = ucan.Claims
+	Proof  = ucan.Proof
+
+	Attenuations = ucan.Attenuations
+	Fact         = ucan.Fact
+)
+
+var (
+	UCANVersion    = ucan.UCANVersion
+	UCANVersionKey = ucan.UCANVersionKey
+	PrfKey         = ucan.PrfKey
+	FctKey         = ucan.FctKey
+	AttKey         = ucan.AttKey
+	CapKey         = ucan.CapKey
+)
+
+type ucanKeyshare struct {
+	addr      string
+	issuerDID string
+}
+
+func (k ucanKeyshare) NewOriginToken(audienceDID string, att Attenuations, fct []Fact, notBefore, expires time.Time) (*ucan.Token, error) {
+	return k.newToken(audienceDID, nil, att, fct, notBefore, expires)
+}
+
+func (k ucanKeyshare) NewAttenuatedToken(parent *Token, audienceDID string, att ucan.Attenuations, fct []ucan.Fact, nbf, exp time.Time) (*Token, error) {
+	if !parent.Attenuations.Contains(att) {
+		return nil, fmt.Errorf("scope of ucan attenuations must be less than it's parent")
+	}
+	return k.newToken(audienceDID, append(parent.Proofs, Proof(parent.Raw)), att, fct, nbf, exp)
+}
+
+func (k ucanKeyshare) newToken(audienceDID string, prf []Proof, att Attenuations, fct []Fact, nbf, exp time.Time) (*ucan.Token, error) {
+	t := jwt.New(NewJWTSigningMethod("MPC256", k))
+
+	// if _, err := did.Parse(audienceDID); err != nil {
+	// 	return nil, fmt.Errorf("invalid audience DID: %w", err)
+	// }
+
+	t.Header[UCANVersionKey] = UCANVersion
+
+	var (
+		nbfUnix int64
+		expUnix int64
+	)
+
+	if !nbf.IsZero() {
+		nbfUnix = nbf.Unix()
+	}
+	if !exp.IsZero() {
+		expUnix = exp.Unix()
+	}
+
+	// set our claims
+	t.Claims = &Claims{
+		StandardClaims: &jwt.StandardClaims{
+			Issuer:    k.issuerDID,
+			Audience:  audienceDID,
+			NotBefore: nbfUnix,
+			// set the expire time
+			// see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-20#section-4.1.4
+			ExpiresAt: expUnix,
+		},
+		Attenuations: att,
+		Facts:        fct,
+		Proofs:       prf,
+	}
+
+	raw, err := t.SignedString(nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Token{
+		Raw:          raw,
+		Attenuations: att,
+		Facts:        fct,
+		Proofs:       prf,
+	}, nil
+}
+
+func getIssuerDID(pk keys.PubKey) (string, string, error) {
+	addr, err := bech32.ConvertAndEncode("idx", pk.Bytes())
+	if err != nil {
+		return "", "", err
+	}
+	return fmt.Sprintf("did:sonr:%s", addr), addr, nil
+}