feature/1120 leverage service authorization (#1188)

* refactor: remove redundant branch trigger for scheduled releases

* refactor: simplify process-compose commands and improve logging

* refactor: remove redundant  command

* refactor: remove unused error variables and simplify database configuration

* feat: introduce task runner for project automation

* refactor: Remove hardcoded action and method from form components

* refactor: move server setup to main.go and add prometheus metrics

* refactor: move index handlers to render handlers

* refactor: improve user identification logic in gateway and vault handlers

* refactor: rename TitleDescription to TitleDesc for consistency

* feat: integrate go-useragent library for enhanced user agent parsing

* feat: enhance initial view rendering based on device type

* feat: Add support for PostgreSQL database

* fix: Use formatPsqlDSN() to properly set PostgreSQL DSN from command flags

* feat: Add PostgreSQL support with fallback to SQLite in NewGormDB

* feat: Add PostgreSQL connection validation with SQLite fallback

* chore: update golang.org/x/crypto dependency to v0.31.0

* feat: add PKL-based configuration initialization

* refactor: improve file naming consistency in cmd/sonrd

* refactor: Improve init-pkl command with safer config file generation and error handling

* fix: add logging for pkl evaluation results

* refactor: Move credential handling to gateway context

* refactor: Migrate session models to gateway package

* refactor: rename models and update User model

* chore: initial commit for address and pubkey functionality

* refactor: move pubkey package to keys package

* refactor: Rename models and add resolver service

* feat: add gRPC clients for bank, DID, DWN, and SVC modules

* refactor: Migrate title and description components from text package to hero package

* refactor: improve file naming conventions

* feat: add user credential validation

* refactor: rename registration handlers and routes for clarity

* <no value>

* refactor: Decouple database and IPFS interactions from server setup

* refactor: Migrate configuration from class-based to TOML-based structure

* refactor: move network configuration files to sonr.net module

* feature/1120-leverage-service-authorization

* fix: correct DID identifier creation function name

* feat: add compressed and uncompressed public keys to keyset

* refactor: move address packages to crypto/address

* feat: implement pubkey verification

* refactor: remove ECDSA-related functions from keyshare and protocol modules

* feat: Implement ECDSA signature serialization

* <no value>

* feat: add vault service for IPFS token storage

* refactor: update ucan codec to use new DID generation method

* refactor: refactor key management and move address parsers to keys package

* refactor: rename key parsers and move to parsers package

* fix: resolved import issues with the new spec

* feat: improve user onboarding experience by updating button text and functionality

* refactor: update point marshaling and unmarshaling methods to use JSON

* refactor: remove unnecessary DID method from PubKey

* refactor: Rename and refactor MPC key generation functions

* test: Add comprehensive test suite for keyshare generation and validation

* test: Fix keyshare role validation and encoding tests

* feat: Update key share role tests with enclave initialization validation

* test(mpc): refactor tests to focus on public API and remove internal role checks

* refactor: Remove unnecessary role check in initKeyEnclave function

* fix: Enforce strict order for validator and user keyshares in enclave initialization

* fix: Update codec_test to match latest codec implementation

* refactor: Update KeyEnclave to use string-based key shares and improve error handling

* fix: Refactor MPC enclave to use string-based encoding and simplify key management

* refactor: Remove redundant keyshare decoding tests in codec_test.go

* fix: Resolve type conversion issues in MPC crypto enclave initialization

* fix: Convert CID to byte slice in addEnclaveIPFS function

* fix: Resolve type conversion and constant definition errors in MPC crypto utils

* refactor: Simplify KeyShare encoding and role handling in MPC codec

* fix: Resolve JSON unmarshaling type mismatch in KeyShare.Message()

* fix: Refactor KeyEnclave to use struct and Enclave interface

* fix: Resolve type and naming conflicts in MPC crypto package

* refactor: Update codec_test.go to use new KeyEnclave struct fields

* refactor: remove keyshare encoding and decoding logic

* refactor: Remove unused JSON marshaling functions for curve points

* fix: Improve signature serialization and deserialization in MPC crypto

This commit addresses several issues with signature handling:
- Fixed signature length to 65 bytes
- Added proper padding for R and S values
- Added nil and zero value checks
- Improved error messages for signature parsing

The changes ensure more robust signature encoding and decoding, preventing potential nil pointer and invalid signature issues.

* fix: Update signature serialization to match protocol test approach

* refactor: Simplify KeyEnclave struct and improve message handling

* fix: Improve signature serialization and verification in MPC crypto module

* refactor: Simplify enclave validation using IsValid method in test

* refactor: Add marshaling and comprehensive tests for KeyEnclave

* feat: Add JSON marshaling support for Point in KeyEnclave

* refactor: Rename KeyEnclave to Enclave and update related functions

* refactor: Update PubKey verification to use SHA3-256 hashing

* test: Add comprehensive tests for DID and PubKey implementations

* refactor: simplify DID key retrieval

* test: refactor CI workflow and remove unused DIDAuth middleware

* The changes look good! The updated workflows will now:

1. Run tests on push to master
2. Bump the version if the commit doesn't already start with 'bump:'
3. Trigger a release workflow automatically with the new version tag
4. Create and publish the release

A few things to note:
- Make sure you have the `peter-evans/repository-dispatch` action installed/available
- The `commitizen-tools/commitizen-action` should output the new tag for this to work
- Ensure your release workflow can handle the repository dispatch event

Would you like me to review or suggest any additional modifications to the workflows?

* ci(github actions): add build stage dependency for tests

* fix(workflow): update workflow to trigger on PR edits

* test: Update unit test dependencies

* ci: Add GoReleaser dry-run check for merge group events

* test: remove unnecessary dependencies between test jobs

* ci: Make race and coverage tests depend on build tests

pkg/config/hway/Hway.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `sonr.conf.Hway`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.net.Hway`. DO NOT EDIT.
 package hway
 
 import (
@@ -10,8 +10,6 @@ import (
 type Hway interface {
 	GetServePort() int
 
-	GetConfigDir() string
-
 	GetSqliteFile() string
 
 	GetChainId() string
@@ -23,6 +21,8 @@ type Hway interface {
 	GetSonrGrpcUrl() string
 
 	GetSonrRpcUrl() string
+
+	GetPsqlDSN() string
 }
 
 var _ Hway = (*HwayImpl)(nil)
@@ -30,8 +30,6 @@ var _ Hway = (*HwayImpl)(nil)
 type HwayImpl struct {
 	ServePort int `pkl:"servePort"`
 
-	ConfigDir string `pkl:"configDir"`
-
 	SqliteFile string `pkl:"sqliteFile"`
 
 	ChainId string `pkl:"chainId"`
@@ -43,16 +41,14 @@ type HwayImpl struct {
 	SonrGrpcUrl string `pkl:"sonrGrpcUrl"`
 
 	SonrRpcUrl string `pkl:"sonrRpcUrl"`
+
+	PsqlDSN string `pkl:"psqlDSN"`
 }
 
 func (rcv *HwayImpl) GetServePort() int {
 	return rcv.ServePort
 }
 
-func (rcv *HwayImpl) GetConfigDir() string {
-	return rcv.ConfigDir
-}
-
 func (rcv *HwayImpl) GetSqliteFile() string {
 	return rcv.SqliteFile
 }
@@ -77,6 +73,10 @@ func (rcv *HwayImpl) GetSonrRpcUrl() string {
 	return rcv.SonrRpcUrl
 }
 
+func (rcv *HwayImpl) GetPsqlDSN() string {
+	return rcv.PsqlDSN
+}
+
 // LoadFromPath loads the pkl module at the given path and evaluates it into a Hway
 func LoadFromPath(ctx context.Context, path string) (ret Hway, err error) {
 	evaluator, err := pkl.NewEvaluator(ctx, pkl.PreconfiguredOptions)

pkg/config/hway/init.pkl.go

@@ -1,8 +1,8 @@
-// Code generated from Pkl module `sonr.conf.Hway`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.net.Hway`. DO NOT EDIT.
 package hway
 
 import "github.com/apple/pkl-go/pkl"
 
 func init() {
-	pkl.RegisterMapping("sonr.conf.Hway", HwayImpl{})
+	pkl.RegisterMapping("sonr.net.Hway", HwayImpl{})
 }

pkg/config/motr/Config.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `sonr.conf.Motr`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.net.Motr`. DO NOT EDIT.
 package motr
 
 type Config struct {

pkg/config/motr/Environment.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `sonr.conf.Motr`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.net.Motr`. DO NOT EDIT.
 package motr
 
 type Environment struct {

pkg/config/motr/Motr.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `sonr.conf.Motr`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.net.Motr`. DO NOT EDIT.
 package motr
 
 import (

pkg/config/motr/Schema.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `sonr.conf.Motr`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.net.Motr`. DO NOT EDIT.
 package motr
 
 type Schema struct {

pkg/config/motr/init.pkl.go

@@ -1,11 +1,11 @@
-// Code generated from Pkl module `sonr.conf.Motr`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.net.Motr`. DO NOT EDIT.
 package motr
 
 import "github.com/apple/pkl-go/pkl"
 
 func init() {
-	pkl.RegisterMapping("sonr.conf.Motr", Motr{})
-	pkl.RegisterMapping("sonr.conf.Motr#Config", Config{})
-	pkl.RegisterMapping("sonr.conf.Motr#Schema", Schema{})
-	pkl.RegisterMapping("sonr.conf.Motr#Environment", Environment{})
+	pkl.RegisterMapping("sonr.net.Motr", Motr{})
+	pkl.RegisterMapping("sonr.net.Motr#Config", Config{})
+	pkl.RegisterMapping("sonr.net.Motr#Schema", Schema{})
+	pkl.RegisterMapping("sonr.net.Motr#Environment", Environment{})
 }

pkg/database/sessions/models.go

@@ -1,42 +0,0 @@
-package sessions
-
-import (
-	"net/http"
-
-	"github.com/labstack/echo/v4"
-	"gorm.io/gorm"
-)
-
-var (
-	ErrInvalidCredentials = echo.NewHTTPError(http.StatusUnauthorized, "Invalid credentials")
-	ErrInvalidSubject     = echo.NewHTTPError(http.StatusBadRequest, "Invalid subject")
-	ErrInvalidUser        = echo.NewHTTPError(http.StatusBadRequest, "Invalid user")
-
-	ErrUserAlreadyExists = echo.NewHTTPError(http.StatusConflict, "User already exists")
-	ErrUserNotFound      = echo.NewHTTPError(http.StatusNotFound, "User not found")
-)
-
-type User struct {
-	gorm.Model
-	Address string `json:"address"`
-	Handle  string `json:"handle"`
-	Name    string `json:"name"`
-	CID     string `json:"cid"`
-}
-
-type Session struct {
-	gorm.Model
-	ID               string `json:"id" gorm:"primaryKey"`
-	BrowserName      string `json:"browserName"`
-	BrowserVersion   string `json:"browserVersion"`
-	UserArchitecture string `json:"userArchitecture"`
-	Platform         string `json:"platform"`
-	PlatformVersion  string `json:"platformVersion"`
-	DeviceModel      string `json:"deviceModel"`
-	UserHandle       string `json:"userHandle"`
-	FirstName        string `json:"firstName"`
-	LastInitial      string `json:"lastInitial"`
-	VaultAddress     string `json:"vaultAddress"`
-	HumanSum         int    `json:"humanSum"`
-	Challenge        string `json:"challenge"`
-}

pkg/database/sessions/sqlite.go

@@ -1,42 +0,0 @@
-package sessions
-
-import (
-	"os"
-	"path/filepath"
-
-	config "github.com/onsonr/sonr/pkg/config/hway"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-)
-
-// NewGormDB initializes and returns a configured database connection
-func NewGormDB(env config.Hway) (*gorm.DB, error) {
-	path := formatDBPath(env.GetSqliteFile())
-	db, err := gorm.Open(sqlite.Open(path), &gorm.Config{})
-	if err != nil {
-		return nil, err
-	}
-
-	// Migrate the schema
-	db.AutoMigrate(&Session{})
-	db.AutoMigrate(&User{})
-	return db, nil
-}
-
-func formatDBPath(path string) string {
-	home := os.Getenv("HOME")
-	if home == "" {
-		home = os.Getenv("USERPROFILE")
-	}
-	if home == "" {
-		home = "."
-	}
-
-	configDir := filepath.Join(home, ".config", "hway")
-	if err := os.MkdirAll(configDir, 0o755); err != nil {
-		// If we can't create the directory, fall back to current directory
-		return path
-	}
-
-	return filepath.Join(configDir, path)
-}

pkg/didauth/controller/config.go

@@ -2,7 +2,7 @@ package controller
 
 import (
 	"github.com/labstack/echo/v4"
-	"github.com/onsonr/sonr/crypto/ucan/spec"
+	"github.com/onsonr/sonr/crypto/mpc/spec"
 )
 
 // ControllerConfig defines the configuration for UCAN middleware

pkg/didauth/controller/middleware.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 
 	"github.com/labstack/echo/v4"
-	"github.com/onsonr/sonr/crypto/ucan/spec"
+	"github.com/onsonr/sonr/crypto/mpc/spec"
 )
 
 // Middleware returns middleware to validate Middleware tokens

pkg/didauth/producer/context.go

@@ -3,8 +3,7 @@ package producer
 import (
 	"github.com/labstack/echo/v4"
 	"github.com/onsonr/sonr/crypto/ucan"
-	"github.com/onsonr/sonr/crypto/ucan/store"
-	"github.com/onsonr/sonr/pkg/common/ipfs"
+	"github.com/onsonr/sonr/pkg/ipfsapi"
 )
 
 type ProducerContext struct {
@@ -13,8 +12,8 @@ type ProducerContext struct {
 	TokenParser *ucan.TokenParser
 
 	// TokenStore is the token store used to store and retrieve tokens
-	TokenStore store.IPFSTokenStore
+	TokenStore ipfsapi.IPFSTokenStore
 
 	// IPFSClient is the IPFS client used to resolve the UCAN
-	IPFSClient ipfs.Client
+	IPFSClient ipfsapi.Client
 }

pkg/didauth/producer/middleware.go

@@ -3,16 +3,15 @@ package producer
 import (
 	"github.com/onsonr/sonr/crypto/mpc"
 	"github.com/onsonr/sonr/crypto/ucan"
-	"github.com/onsonr/sonr/crypto/ucan/store"
-	"github.com/onsonr/sonr/pkg/common/ipfs"
+	"github.com/onsonr/sonr/pkg/ipfsapi"
 
 	"github.com/labstack/echo/v4"
 )
 
 // Middleware returns middleware to spawn controllers and validate UCAN tokens
-func Middleware(ipfs ipfs.Client, perms ucan.Permissions) echo.MiddlewareFunc {
+func Middleware(ipc ipfsapi.Client, perms ucan.Permissions) echo.MiddlewareFunc {
 	// Setup token store and parser
-	store := store.NewIPFSTokenStore(ipfs)
+	store := ipfsapi.NewUCANStore(ipc)
 	parser := ucan.NewTokenParser(perms.GetConstructor(), store, store)
 
 	// Return middleware
@@ -20,7 +19,7 @@ func Middleware(ipfs ipfs.Client, perms ucan.Permissions) echo.MiddlewareFunc {
 		return func(c echo.Context) error {
 			ctx := ProducerContext{
 				Context:     c,
-				IPFSClient:  ipfs,
+				IPFSClient:  ipc,
 				TokenParser: parser,
 				TokenStore:  store,
 			}
@@ -29,8 +28,8 @@ func Middleware(ipfs ipfs.Client, perms ucan.Permissions) echo.MiddlewareFunc {
 	}
 }
 
-func NewKeyset(c echo.Context) (mpc.Keyset, error) {
-	ks, err := mpc.NewKeyset()
+func NewKeyset(c echo.Context) (mpc.Enclave, error) {
+	ks, err := mpc.GenEnclave()
 	if err != nil {
 		return nil, err
 	}

pkg/ipfsapi/client.go

@@ -1,4 +1,4 @@
-package ipfs
+package ipfsapi
 
 import (
 	"bytes"

pkg/ipfsapi/file.go

@@ -1,4 +1,4 @@
-package ipfs
+package ipfsapi
 
 import (
 	"context"

pkg/ipfsapi/folder.go

@@ -1,4 +1,4 @@
-package ipfs
+package ipfsapi
 
 import (
 	"context"

pkg/ipfsapi/iface.go

@@ -1,4 +1,4 @@
-package ipfs
+package ipfsapi
 
 import "github.com/ipfs/boxo/files"
 

pkg/ipfsapi/ucans.go

@@ -0,0 +1,142 @@
+package ipfsapi
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"sync"
+
+	"github.com/golang-jwt/jwt"
+	"github.com/ipfs/go-cid"
+	"github.com/onsonr/sonr/crypto/keys"
+	"github.com/onsonr/sonr/crypto/ucan"
+)
+
+type IPFSTokenStore interface {
+	ucan.TokenStore
+	ResolveCIDBytes(ctx context.Context, id cid.Cid) ([]byte, error)
+	ResolveDIDKey(ctx context.Context, did string) (keys.DID, error)
+}
+
+// ipfsUCANStore is a token store that uses IPFS to store tokens. It uses the memory store as a cache
+// for CID strings to be used as keys for retrieving tokens.
+type ipfsUCANStore struct {
+	sync.Mutex
+	ipfs  Client
+	cache map[string]string
+}
+
+// NewUCANStore creates a new IPFS-backed token store
+func NewUCANStore(ipfsClient Client) IPFSTokenStore {
+	return &ipfsUCANStore{
+		ipfs:  ipfsClient,
+		cache: make(map[string]string),
+	}
+}
+
+func (st *ipfsUCANStore) PutToken(ctx context.Context, key string, raw string) error {
+	// Validate token format
+	p := &jwt.Parser{
+		UseJSONNumber:        true,
+		SkipClaimsValidation: false,
+	}
+	if _, _, err := p.ParseUnverified(raw, jwt.MapClaims{}); err != nil {
+		return fmt.Errorf("%w: %s", ucan.ErrInvalidToken, err)
+	}
+
+	// Store token in IPFS
+	cid, err := st.ipfs.Add([]byte(raw))
+	if err != nil {
+		return fmt.Errorf("failed to store token in IPFS: %w", err)
+	}
+
+	// Update cache
+	st.Lock()
+	defer st.Unlock()
+	st.cache[key] = cid
+	return nil
+}
+
+func (st *ipfsUCANStore) RawToken(ctx context.Context, key string) (string, error) {
+	st.Lock()
+	cid, exists := st.cache[key]
+	st.Unlock()
+
+	if !exists {
+		return "", ucan.ErrTokenNotFound
+	}
+
+	// Retrieve token from IPFS
+	data, err := st.ipfs.Get(cid)
+	if err != nil {
+		return "", fmt.Errorf("failed to retrieve token from IPFS: %w", err)
+	}
+
+	return string(data), nil
+}
+
+func (st *ipfsUCANStore) DeleteToken(ctx context.Context, key string) error {
+	st.Lock()
+	defer st.Unlock()
+
+	cid, exists := st.cache[key]
+	if !exists {
+		return ucan.ErrTokenNotFound
+	}
+
+	// Unpin from IPFS
+	if err := st.ipfs.Unpin(cid); err != nil {
+		return fmt.Errorf("failed to unpin token from IPFS: %w", err)
+	}
+
+	delete(st.cache, key)
+	return nil
+}
+
+func (st *ipfsUCANStore) ListTokens(ctx context.Context, offset, limit int) ([]ucan.RawToken, error) {
+	st.Lock()
+	defer st.Unlock()
+
+	tokens := make(ucan.RawTokens, 0, len(st.cache))
+	for key, cid := range st.cache {
+		data, err := st.ipfs.Get(cid)
+		if err != nil {
+			continue // Skip invalid tokens
+		}
+		tokens = append(tokens, ucan.RawToken{
+			Key: key,
+			Raw: string(data),
+		})
+	}
+
+	// Sort tokens
+	sort.Sort(tokens)
+
+	// Apply pagination
+	if offset >= len(tokens) {
+		return []ucan.RawToken{}, nil
+	}
+
+	end := offset + limit
+	if end > len(tokens) || limit <= 0 {
+		end = len(tokens)
+	}
+
+	return tokens[offset:end], nil
+}
+
+func (st *ipfsUCANStore) ResolveCIDBytes(ctx context.Context, id cid.Cid) ([]byte, error) {
+	data, err := st.ipfs.Get(id.String())
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve CID bytes: %w", err)
+	}
+	return data, nil
+}
+
+func (st *ipfsUCANStore) ResolveDIDKey(ctx context.Context, did string) (keys.DID, error) {
+	id, err := keys.Parse(did)
+	if err != nil {
+		return keys.DID{}, fmt.Errorf("failed to parse DID: %w", err)
+	}
+	return id, nil
+}