feature/1115 execute ucan token (#1177)

- **deps: remove tigerbeetle-go dependency** - **refactor: remove unused landing page components and models** - **feat: add pin and publish vault handlers** - **refactor: move payment and credential services to webui browser package** - **refactor: remove unused credentials management components** - **feat: add landing page components and middleware for credentials and payments** - **refactor: remove unused imports in vault config** - **refactor: remove unused bank, DID, and DWN gRPC clients** - **refactor: rename client files and improve code structure** - **feat: add session middleware helpers and landing page components** - **feat: add user profile registration flow** - **feat: Implement WebAuthn registration flow** - **feat: add error view for users without WebAuthn devices** - **chore: update htmx to include extensions** - **refactor: rename pin handler to claim handler and update routes** - **chore: update import paths after moving UI components and styles** - **fix: address potential server errors by handling and logging them properly** - **refactor: move vault config to gateway package and update related dependencies** - **style: simplify form styling and remove unnecessary components** - **feat: improve UI design for registration flow** - **feat: implement passkey-based authentication** - **refactor: migrate registration forms to use reusable form components** - **refactor: remove tailwindcss setup and use CDN instead** - **style: update submit button style to use outline variant** - **refactor: refactor server and IPFS client, remove MPC encryption** - **refactor: Abstract keyshare functionality and improve message encoding** - **refactor: improve keyset JSON marshaling and error handling** - **feat: add support for digital signatures using MPC keys** - **fix: Refactor MarshalJSON to use standard json.Marshal for Message serialization** - **fix: Encode messages before storing in keyshare structs** - **style: update form input styles for improved user experience** - **refactor: improve code structure in registration handlers** - **refactor: consolidate signer middleware and IPFS interaction** - **refactor: rename MPC signing and refresh protocol functions** - **refactor: update hway configuration loading mechanism** - **feat: integrate database support for sessions and users** - **refactor: remove devnet infrastructure and simplify build process** - **docs(guides): add Sonr DID module guide** - **feat: integrate progress bar into registration form** - **refactor: migrate WebAuthn dependencies to protocol package** - **feat: enhance user registration with passkey integration and improved form styling** - **refactor: move gateway view handlers to internal pages package** - **refactor: Move address package to MPC module** - **feat: integrate turnstile for registration** - **style: remove unnecessary size attribute from buttons** - **refactor: rename cookie package to session/cookie** - **refactor: remove unnecessary types.Session dependency** - **refactor: rename pkg/core to pkg/chain** - **refactor: simplify deployment process by removing testnet-specific Taskfile and devbox configuration** - **feat: add error redirect functionality and improve routes** - **feat: implement custom error handling for gateway** - **chore: update version number to 0.0.7 in template** - **feat: add IPFS client implementation** - **feat: Implement full IPFS client interface with comprehensive methods** - **refactor: improve IPFS client path handling** - **refactor: Move UCAN middleware to controller package** - **feat: add UCAN middleware to motr** - **refactor: update libp2p dependency** - **docs: add UCAN specification document** - **refactor: move UCAN controller logic to common package** - **refactor: rename exports.go to common.go** - **feat: add UCAN token support** - **refactor: migrate UCAN token parsing to dedicated package** - **refactor: improve CometBFT and app config initialization** - **refactor: improve deployment scripts and documentation** - **feat: integrate IPFS and producer middleware** - **refactor: rename agent directory to aider** - **fix: correct libp2p import path** - **refactor: remove redundant dependency** - **cleanup: remove unnecessary test files** - **refactor: move attention types to crypto/ucan package** - **feat: expand capabilities and resource types for UCANs** - **refactor: rename sonr.go to codec.go and update related imports** - **feat: add IPFS-based token store** - **feat: Implement IPFS-based token store with caching and UCAN integration** - **feat: Add dynamic attenuation constructor for UCAN presets** - **fix: Handle missing or invalid attenuation data with EmptyAttenuation** - **fix: Update UCAN attenuation tests with correct capability types** - **feat: integrate UCAN-based authorization into the producer middleware** - **refactor: remove unused dependency on go-ucan** - **refactor: Move address handling logic to DID module** - **feat: Add support for compressed and uncompressed Secp256k1 public keys in didkey** - **test: Add test for generating DID key from MPC keyshares** - **feat: Add methods for extracting compressed and uncompressed public keys in share types** - **feat: Add BaseKeyshare struct with public key conversion methods** - **refactor: Use compressed and uncompressed public keys in keyshare, fix public key usage in tests and verification** - **feat: add support for key generation policy type** - **fix: correct typo in VaultPermissions constant** - **refactor: move JWT related code to ucan package** - **refactor: move UCAN JWT and source code to spec package**
2026-08-04 02:11:40 +00:00 · 2024-12-05 20:36:58 -05:00
parent e62ec45e82
commit bd51342fdf
256 changed files with 10823 additions and 7096 deletions
@@ -0,0 +1,98 @@
+package spec
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+
+	"github.com/golang-jwt/jwt"
+	"github.com/onsonr/sonr/crypto/mpc"
+)
+
+// MPCSigningMethod implements the SigningMethod interface for MPC-based signing
+type MPCSigningMethod struct {
+	Name string
+	ks   ucanKeyshare
+}
+
+// NewJWTSigningMethod creates a new MPC signing method with the given keyshare source
+func NewJWTSigningMethod(name string, ks ucanKeyshare) *MPCSigningMethod {
+	return &MPCSigningMethod{
+		Name: name,
+		ks:   ks,
+	}
+}
+
+// Alg returns the signing method's name
+func (m *MPCSigningMethod) Alg() string {
+	return m.Name
+}
+
+// Verify verifies the signature using the MPC public key
+func (m *MPCSigningMethod) Verify(signingString, signature string, key interface{}) error {
+	// Decode the signature
+	sig, err := base64.RawURLEncoding.DecodeString(signature)
+	if err != nil {
+		return err
+	}
+
+	// Hash the signing string
+	hasher := sha256.New()
+	hasher.Write([]byte(signingString))
+	digest := hasher.Sum(nil)
+
+	// Verify using the keyshare's public key
+	valid, err := mpc.VerifySignature(m.ks.valShare.PublicKey(), digest, sig)
+	if err != nil {
+		return fmt.Errorf("failed to verify signature: %w", err)
+	}
+	if !valid {
+		return fmt.Errorf("invalid signature")
+	}
+
+	return nil
+}
+
+// Sign signs the data using MPC
+func (m *MPCSigningMethod) Sign(signingString string, key interface{}) (string, error) {
+	// Hash the signing string
+	hasher := sha256.New()
+	hasher.Write([]byte(signingString))
+	digest := hasher.Sum(nil)
+
+	// Create signing functions
+	signFunc, err := m.ks.userShare.SignFunc(digest)
+	if err != nil {
+		return "", fmt.Errorf("failed to create sign function: %w", err)
+	}
+
+	valSignFunc, err := m.ks.valShare.SignFunc(digest)
+	if err != nil {
+		return "", fmt.Errorf("failed to create validator sign function: %w", err)
+	}
+
+	// Run the signing protocol
+	sig, err := mpc.ExecuteSigning(valSignFunc, signFunc)
+	if err != nil {
+		return "", fmt.Errorf("failed to run sign protocol: %w", err)
+	}
+
+	// Serialize the signature
+	sigBytes, err := mpc.SerializeSignature(sig)
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize signature: %w", err)
+	}
+
+	// Encode the signature
+	encoded := base64.RawURLEncoding.EncodeToString(sigBytes)
+	return encoded, nil
+}
+
+func init() {
+	// Register the MPC signing method
+	jwt.RegisterSigningMethod("MPC256", func() jwt.SigningMethod {
+		return &MPCSigningMethod{
+			Name: "MPC256",
+		}
+	})
+}
@@ -0,0 +1,132 @@
+package spec
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/onsonr/sonr/crypto/mpc"
+	"github.com/onsonr/sonr/crypto/ucan"
+	"github.com/onsonr/sonr/crypto/ucan/didkey"
+	"lukechampine.com/blake3"
+)
+
+type KeyshareSource interface {
+	ucan.Source
+
+	Address() string
+	Issuer() string
+	ChainCode() ([]byte, error)
+	OriginToken() (*Token, error)
+	SignData(data []byte) ([]byte, error)
+	VerifyData(data []byte, sig []byte) (bool, error)
+	UCANParser() *ucan.TokenParser
+}
+
+func NewSource(ks mpc.Keyset) (KeyshareSource, error) {
+	val := ks.Val()
+	user := ks.User()
+	iss, addr, err := ComputeIssuerDID(val.GetPublicKey())
+	if err != nil {
+		return nil, err
+	}
+	return ucanKeyshare{
+		userShare: user,
+		valShare:  val,
+		addr:      addr,
+		issuerDID: iss,
+	}, nil
+}
+
+// Address returns the address of the keyshare
+func (k ucanKeyshare) Address() string {
+	return k.addr
+}
+
+// Issuer returns the DID of the issuer of the keyshare
+func (k ucanKeyshare) Issuer() string {
+	return k.issuerDID
+}
+
+// ChainCode returns the chain code of the keyshare
+func (k ucanKeyshare) ChainCode() ([]byte, error) {
+	sig, err := k.SignData([]byte(k.addr))
+	if err != nil {
+		return nil, err
+	}
+	hash := blake3.Sum256(sig)
+	// Return the first 32 bytes of the hash
+	return hash[:32], nil
+}
+
+// DefaultOriginToken returns a default token with the keyshare's issuer as the audience
+func (k ucanKeyshare) OriginToken() (*Token, error) {
+	att := ucan.NewSmartAccount(k.addr)
+	zero := time.Time{}
+	return k.NewOriginToken(k.issuerDID, att, nil, zero, zero)
+}
+
+func (k ucanKeyshare) SignData(data []byte) ([]byte, error) {
+	// Create signing functions
+	signFunc, err := k.userShare.SignFunc(data)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create sign function: %w", err)
+	}
+
+	valSignFunc, err := k.valShare.SignFunc(data)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create validator sign function: %w", err)
+	}
+
+	// Run the signing protocol
+	sig, err := mpc.ExecuteSigning(valSignFunc, signFunc)
+	if err != nil {
+		return nil, fmt.Errorf("failed to run sign protocol: %w", err)
+	}
+	return mpc.SerializeSignature(sig)
+}
+
+func (k ucanKeyshare) VerifyData(data []byte, sig []byte) (bool, error) {
+	return mpc.VerifySignature(k.userShare.PublicKey(), data, sig)
+}
+
+// TokenParser returns a token parser that can be used to parse tokens
+func (k ucanKeyshare) UCANParser() *ucan.TokenParser {
+	caps := ucan.AccountPermissions.GetCapabilities()
+	ac := func(m map[string]interface{}) (ucan.Attenuation, error) {
+		var (
+			cap string
+			rsc ucan.Resource
+		)
+		for key, vali := range m {
+			val, ok := vali.(string)
+			if !ok {
+				return ucan.Attenuation{}, fmt.Errorf(`expected attenuation value to be a string`)
+			}
+
+			if key == ucan.CapKey {
+				cap = val
+			} else {
+				rsc = ucan.NewStringLengthResource(key, val)
+			}
+		}
+
+		return ucan.Attenuation{
+			Rsc: rsc,
+			Cap: caps.Cap(cap),
+		}, nil
+	}
+
+	store := ucan.NewMemTokenStore()
+	return ucan.NewTokenParser(ac, customDIDPubKeyResolver{}, store.(ucan.CIDBytesResolver))
+}
+
+// customDIDPubKeyResolver implements the DIDPubKeyResolver interface without
+// any network backing. Works if the key string given contains the public key
+// itself
+type customDIDPubKeyResolver struct{}
+
+// ResolveDIDKey extracts a public key from  a did:key string
+func (customDIDPubKeyResolver) ResolveDIDKey(ctx context.Context, didStr string) (didkey.ID, error) {
+	return didkey.Parse(didStr)
+}
@@ -0,0 +1,114 @@
+// go:build jwx_es256k
+package spec
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/cosmos/cosmos-sdk/types/bech32"
+	"github.com/golang-jwt/jwt"
+	"github.com/onsonr/sonr/crypto/mpc"
+	"github.com/onsonr/sonr/crypto/ucan"
+)
+
+type (
+	Token  = ucan.Token
+	Claims = ucan.Claims
+	Proof  = ucan.Proof
+
+	Attenuations = ucan.Attenuations
+	Fact         = ucan.Fact
+)
+
+var (
+	UCANVersion    = ucan.UCANVersion
+	UCANVersionKey = ucan.UCANVersionKey
+	PrfKey         = ucan.PrfKey
+	FctKey         = ucan.FctKey
+	AttKey         = ucan.AttKey
+	CapKey         = ucan.CapKey
+)
+
+type ucanKeyshare struct {
+	userShare *mpc.UserKeyshare
+	valShare  *mpc.ValKeyshare
+
+	addr      string
+	issuerDID string
+}
+
+func (k ucanKeyshare) NewOriginToken(audienceDID string, att Attenuations, fct []Fact, notBefore, expires time.Time) (*ucan.Token, error) {
+	return k.newToken(audienceDID, nil, att, fct, notBefore, expires)
+}
+
+func (k ucanKeyshare) NewAttenuatedToken(parent *Token, audienceDID string, att ucan.Attenuations, fct []ucan.Fact, nbf, exp time.Time) (*Token, error) {
+	if !parent.Attenuations.Contains(att) {
+		return nil, fmt.Errorf("scope of ucan attenuations must be less than it's parent")
+	}
+	return k.newToken(audienceDID, append(parent.Proofs, Proof(parent.Raw)), att, fct, nbf, exp)
+}
+
+func (k ucanKeyshare) newToken(audienceDID string, prf []Proof, att Attenuations, fct []Fact, nbf, exp time.Time) (*ucan.Token, error) {
+	t := jwt.New(NewJWTSigningMethod("MPC256", k))
+
+	// if _, err := did.Parse(audienceDID); err != nil {
+	// 	return nil, fmt.Errorf("invalid audience DID: %w", err)
+	// }
+
+	t.Header[UCANVersionKey] = UCANVersion
+
+	var (
+		nbfUnix int64
+		expUnix int64
+	)
+
+	if !nbf.IsZero() {
+		nbfUnix = nbf.Unix()
+	}
+	if !exp.IsZero() {
+		expUnix = exp.Unix()
+	}
+
+	// set our claims
+	t.Claims = &Claims{
+		StandardClaims: &jwt.StandardClaims{
+			Issuer:    k.issuerDID,
+			Audience:  audienceDID,
+			NotBefore: nbfUnix,
+			// set the expire time
+			// see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-20#section-4.1.4
+			ExpiresAt: expUnix,
+		},
+		Attenuations: att,
+		Facts:        fct,
+		Proofs:       prf,
+	}
+
+	raw, err := t.SignedString(nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Token{
+		Raw:          raw,
+		Attenuations: att,
+		Facts:        fct,
+		Proofs:       prf,
+	}, nil
+}
+
+func ComputeIssuerDID(pk []byte) (string, string, error) {
+	addr, err := ComputeSonrAddr(pk)
+	if err != nil {
+		return "", "", err
+	}
+	return fmt.Sprintf("did:sonr:%s", addr), addr, nil
+}
+
+func ComputeSonrAddr(pk []byte) (string, error) {
+	sonrAddr, err := bech32.ConvertAndEncode("idx", pk)
+	if err != nil {
+		return "", err
+	}
+	return sonrAddr, nil
+}