feature/1114 implement account interface (#1167)

- **refactor: move session-related code to middleware package**
- **refactor: update PKL build process and adjust related
configurations**
- **feat: integrate base.cosmos.v1 Genesis module**
- **refactor: pass session context to modal rendering functions**
- **refactor: move nebula package to app directory and update templ
version**
- **refactor: Move home section video view to dedicated directory**
- **refactor: remove unused views file**
- **refactor: move styles and UI components to global scope**
- **refactor: Rename images.go to cdn.go**
- **feat: Add Empty State Illustrations**
- **refactor: Consolidate Vault Index Logic**
- **fix: References to App.wasm and remove Vault Directory embedded CDN
files**
- **refactor: Move CDN types to Models**
- **fix: Correct line numbers in templ error messages for
arch_templ.go**
- **refactor: use common types for peer roles**
- **refactor: move common types and ORM to a shared package**
- **fix: Config import dwn**
- **refactor: move nebula directory to app**
- **feat: Rebuild nebula**
- **fix: correct file paths in panels templates**
- **feat: Remove duplicate types**
- **refactor: Move dwn to pkg/core**
- **refactor: Binary Structure**
- **feat: Introduce Crypto Pkg**
- **fix: Broken Process Start**
- **feat: Update pkg/* structure**
- **feat: Refactor PKL Structure**
- **build: update pkl build process**
- **chore: Remove Empty Files**
- **refactor: remove unused macaroon package**
- **feat: Add WebAwesome Components**
- **refactor: consolidate build and generation tasks into a single
taskfile, remove redundant makefile targets**
- **refactor: refactor server and move components to pkg/core/dwn**
- **build: update go modules**
- **refactor: move gateway logic into dedicated hway command**
- **feat: Add KSS (Krawczyk-Song-Song) MPC cryptography module**
- **feat: Implement MPC-based JWT signing and UCAN token generation**
- **feat: add support for MPC-based JWT signing**
- **feat: Implement MPC-based UCAN capabilities for smart accounts**
- **feat: add address field to keyshareSource**
- **feat: Add comprehensive MPC test suite for keyshares, UCAN tokens,
and token attenuations**
- **refactor: improve MPC keyshare management and signing process**
- **feat: enhance MPC capability hierarchy documentation**
- **refactor: rename GenerateKeyshares function to NewKeyshareSource for
clarity**
- **refactor: remove unused Ethereum address computation**
- **feat: Add HasHandle and IsAuthenticated methods to HTTPContext**
- **refactor: Add context.Context support to session HTTPContext**
- **refactor: Resolve context interface conflicts in HTTPContext**
- **feat: Add session ID context key and helper functions**
- **feat: Update WebApp Page Rendering**
- **refactor: Simplify context management by using single HTTPContext
key**
- **refactor: Simplify HTTPContext creation and context management in
session middleware**
- **refactor: refactor session middleware to use a single data
structure**
- **refactor: Simplify HTTPContext implementation and session data
handling**
- **refactor: Improve session context handling and prevent nil pointer
errors**
- **refactor: Improve session context handling with nil safety and type
support**
- **refactor: improve session data injection**
- **feat: add full-screen modal component and update registration flow**
- **chore: add .air.toml to .gitignore**
- **feat: add Air to devbox and update dependencies**

pkg/crypto/mpc/caps.go

@@ -0,0 +1,117 @@
+package mpc
+
+import (
+	"fmt"
+
+	"github.com/ucan-wg/go-ucan"
+)
+
+// Capability hierarchy for smart account operations
+// ----------------------------------------------
+// OWNER
+//   └─ OPERATOR
+//        ├─ EXECUTE
+//        ├─ PROPOSE
+//        └─ SIGN
+//   └─ SET_POLICY
+//        └─ SET_THRESHOLD
+//   └─ RECOVER
+//        └─ SOCIAL
+
+// Define capability hierarchy for smart account operations
+const (
+	// Root capabilities
+	CAP_OWNER    = "OWNER"    // Full account control
+	CAP_OPERATOR = "OPERATOR" // Can perform operations
+	CAP_OBSERVER = "OBSERVER" // Can view account state
+
+	// Operation capabilities
+	CAP_EXECUTE = "EXECUTE" // Can execute transactions
+	CAP_PROPOSE = "PROPOSE" // Can propose transactions
+	CAP_SIGN    = "SIGN"    // Can sign transactions
+
+	// Policy capabilities
+	CAP_SET_POLICY    = "SET_POLICY"    // Can modify account policies
+	CAP_SET_THRESHOLD = "SET_THRESHOLD" // Can modify signing threshold
+
+	// Recovery capabilities
+	CAP_RECOVER = "RECOVER" // Can initiate recovery
+	CAP_SOCIAL  = "SOCIAL"  // Can act as social recovery
+)
+
+// SmartAccountCapabilities defines the capability hierarchy
+func NewSmartAccountCapabilities() ucan.NestedCapabilities {
+	return ucan.NewNestedCapabilities(
+		CAP_OWNER,
+		CAP_OPERATOR,
+		CAP_OBSERVER,
+		CAP_EXECUTE,
+		CAP_PROPOSE,
+		CAP_SIGN,
+		CAP_SET_POLICY,
+		CAP_SET_THRESHOLD,
+		CAP_RECOVER,
+		CAP_SOCIAL,
+	)
+}
+
+// Resource types for smart account operations
+type ResourceType string
+
+const (
+	RES_ACCOUNT     = "account"
+	RES_TRANSACTION = "tx"
+	RES_POLICY      = "policy"
+	RES_RECOVERY    = "recovery"
+)
+
+// NewSmartAccountResource creates a new resource identifier
+func NewSmartAccountResource(resType ResourceType, path string) ucan.Resource {
+	return ucan.NewStringLengthResource(string(resType), path)
+}
+
+// CreateSmartAccountAttenuations creates default attenuations for a smart account
+func CreateSmartAccountAttenuations(
+	caps ucan.NestedCapabilities,
+	accountAddr string,
+) ucan.Attenuations {
+	return ucan.Attenuations{
+		// Owner capabilities
+		{caps.Cap(CAP_OWNER), NewSmartAccountResource(RES_ACCOUNT, accountAddr)},
+
+		// Operation capabilities
+		{caps.Cap(CAP_EXECUTE), NewSmartAccountResource(RES_TRANSACTION, fmt.Sprintf("%s:*", accountAddr))},
+		{caps.Cap(CAP_PROPOSE), NewSmartAccountResource(RES_TRANSACTION, fmt.Sprintf("%s:*", accountAddr))},
+		{caps.Cap(CAP_SIGN), NewSmartAccountResource(RES_TRANSACTION, fmt.Sprintf("%s:*", accountAddr))},
+
+		// Policy capabilities
+		{caps.Cap(CAP_SET_POLICY), NewSmartAccountResource(RES_POLICY, fmt.Sprintf("%s:*", accountAddr))},
+		{caps.Cap(CAP_SET_THRESHOLD), NewSmartAccountResource(RES_POLICY, fmt.Sprintf("%s:threshold", accountAddr))},
+	}
+}
+
+// Policy represents smart account execution policies
+type PolicyType string
+
+const (
+	POLICY_THRESHOLD = "threshold"
+	POLICY_TIMELOCK  = "timelock"
+	POLICY_WHITELIST = "whitelist"
+)
+
+// CreatePolicyAttenuation creates attenuations for policy management
+func CreatePolicyAttenuation(
+	caps ucan.NestedCapabilities,
+	accountAddr string,
+	policyType PolicyType,
+) ucan.Attenuations {
+	return ucan.Attenuations{
+		{
+			caps.Cap(CAP_SET_POLICY),
+			NewSmartAccountResource(
+				RES_POLICY,
+				fmt.Sprintf("%s:%s", accountAddr, policyType),
+			),
+		},
+	}
+}