feature/1115 execute ucan token (#1177)

- **deps: remove tigerbeetle-go dependency**
- **refactor: remove unused landing page components and models**
- **feat: add pin and publish vault handlers**
- **refactor: move payment and credential services to webui browser
package**
- **refactor: remove unused credentials management components**
- **feat: add landing page components and middleware for credentials and
payments**
- **refactor: remove unused imports in vault config**
- **refactor: remove unused bank, DID, and DWN gRPC clients**
- **refactor: rename client files and improve code structure**
- **feat: add session middleware helpers and landing page components**
- **feat: add user profile registration flow**
- **feat: Implement WebAuthn registration flow**
- **feat: add error view for users without WebAuthn devices**
- **chore: update htmx to include extensions**
- **refactor: rename pin handler to claim handler and update routes**
- **chore: update import paths after moving UI components and styles**
- **fix: address potential server errors by handling and logging them
properly**
- **refactor: move vault config to gateway package and update related
dependencies**
- **style: simplify form styling and remove unnecessary components**
- **feat: improve UI design for registration flow**
- **feat: implement passkey-based authentication**
- **refactor: migrate registration forms to use reusable form
components**
- **refactor: remove tailwindcss setup and use CDN instead**
- **style: update submit button style to use outline variant**
- **refactor: refactor server and IPFS client, remove MPC encryption**
- **refactor: Abstract keyshare functionality and improve message
encoding**
- **refactor: improve keyset JSON marshaling and error handling**
- **feat: add support for digital signatures using MPC keys**
- **fix: Refactor MarshalJSON to use standard json.Marshal for Message
serialization**
- **fix: Encode messages before storing in keyshare structs**
- **style: update form input styles for improved user experience**
- **refactor: improve code structure in registration handlers**
- **refactor: consolidate signer middleware and IPFS interaction**
- **refactor: rename MPC signing and refresh protocol functions**
- **refactor: update hway configuration loading mechanism**
- **feat: integrate database support for sessions and users**
- **refactor: remove devnet infrastructure and simplify build process**
- **docs(guides): add Sonr DID module guide**
- **feat: integrate progress bar into registration form**
- **refactor: migrate WebAuthn dependencies to protocol package**
- **feat: enhance user registration with passkey integration and
improved form styling**
- **refactor: move gateway view handlers to internal pages package**
- **refactor: Move address package to MPC module**
- **feat: integrate turnstile for registration**
- **style: remove unnecessary size attribute from buttons**
- **refactor: rename cookie package to session/cookie**
- **refactor: remove unnecessary types.Session dependency**
- **refactor: rename pkg/core to pkg/chain**
- **refactor: simplify deployment process by removing testnet-specific
Taskfile and devbox configuration**
- **feat: add error redirect functionality and improve routes**
- **feat: implement custom error handling for gateway**
- **chore: update version number to 0.0.7 in template**
- **feat: add IPFS client implementation**
- **feat: Implement full IPFS client interface with comprehensive
methods**
- **refactor: improve IPFS client path handling**
- **refactor: Move UCAN middleware to controller package**
- **feat: add UCAN middleware to motr**
- **refactor: update libp2p dependency**
- **docs: add UCAN specification document**
- **refactor: move UCAN controller logic to common package**
- **refactor: rename exports.go to common.go**
- **feat: add UCAN token support**
- **refactor: migrate UCAN token parsing to dedicated package**
- **refactor: improve CometBFT and app config initialization**
- **refactor: improve deployment scripts and documentation**
- **feat: integrate IPFS and producer middleware**
- **refactor: rename agent directory to aider**
- **fix: correct libp2p import path**
- **refactor: remove redundant dependency**
- **cleanup: remove unnecessary test files**
- **refactor: move attention types to crypto/ucan package**
- **feat: expand capabilities and resource types for UCANs**
- **refactor: rename sonr.go to codec.go and update related imports**
- **feat: add IPFS-based token store**
- **feat: Implement IPFS-based token store with caching and UCAN
integration**
- **feat: Add dynamic attenuation constructor for UCAN presets**
- **fix: Handle missing or invalid attenuation data with
EmptyAttenuation**
- **fix: Update UCAN attenuation tests with correct capability types**
- **feat: integrate UCAN-based authorization into the producer
middleware**
- **refactor: remove unused dependency on go-ucan**
- **refactor: Move address handling logic to DID module**
- **feat: Add support for compressed and uncompressed Secp256k1 public
keys in didkey**
- **test: Add test for generating DID key from MPC keyshares**
- **feat: Add methods for extracting compressed and uncompressed public
keys in share types**
- **feat: Add BaseKeyshare struct with public key conversion methods**
- **refactor: Use compressed and uncompressed public keys in keyshare,
fix public key usage in tests and verification**
- **feat: add support for key generation policy type**
- **fix: correct typo in VaultPermissions constant**
- **refactor: move JWT related code to ucan package**
- **refactor: move UCAN JWT and source code to spec package**

crypto/ucan/spec/source.go

@@ -0,0 +1,132 @@
+package spec
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/onsonr/sonr/crypto/mpc"
+	"github.com/onsonr/sonr/crypto/ucan"
+	"github.com/onsonr/sonr/crypto/ucan/didkey"
+	"lukechampine.com/blake3"
+)
+
+type KeyshareSource interface {
+	ucan.Source
+
+	Address() string
+	Issuer() string
+	ChainCode() ([]byte, error)
+	OriginToken() (*Token, error)
+	SignData(data []byte) ([]byte, error)
+	VerifyData(data []byte, sig []byte) (bool, error)
+	UCANParser() *ucan.TokenParser
+}
+
+func NewSource(ks mpc.Keyset) (KeyshareSource, error) {
+	val := ks.Val()
+	user := ks.User()
+	iss, addr, err := ComputeIssuerDID(val.GetPublicKey())
+	if err != nil {
+		return nil, err
+	}
+	return ucanKeyshare{
+		userShare: user,
+		valShare:  val,
+		addr:      addr,
+		issuerDID: iss,
+	}, nil
+}
+
+// Address returns the address of the keyshare
+func (k ucanKeyshare) Address() string {
+	return k.addr
+}
+
+// Issuer returns the DID of the issuer of the keyshare
+func (k ucanKeyshare) Issuer() string {
+	return k.issuerDID
+}
+
+// ChainCode returns the chain code of the keyshare
+func (k ucanKeyshare) ChainCode() ([]byte, error) {
+	sig, err := k.SignData([]byte(k.addr))
+	if err != nil {
+		return nil, err
+	}
+	hash := blake3.Sum256(sig)
+	// Return the first 32 bytes of the hash
+	return hash[:32], nil
+}
+
+// DefaultOriginToken returns a default token with the keyshare's issuer as the audience
+func (k ucanKeyshare) OriginToken() (*Token, error) {
+	att := ucan.NewSmartAccount(k.addr)
+	zero := time.Time{}
+	return k.NewOriginToken(k.issuerDID, att, nil, zero, zero)
+}
+
+func (k ucanKeyshare) SignData(data []byte) ([]byte, error) {
+	// Create signing functions
+	signFunc, err := k.userShare.SignFunc(data)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create sign function: %w", err)
+	}
+
+	valSignFunc, err := k.valShare.SignFunc(data)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create validator sign function: %w", err)
+	}
+
+	// Run the signing protocol
+	sig, err := mpc.ExecuteSigning(valSignFunc, signFunc)
+	if err != nil {
+		return nil, fmt.Errorf("failed to run sign protocol: %w", err)
+	}
+	return mpc.SerializeSignature(sig)
+}
+
+func (k ucanKeyshare) VerifyData(data []byte, sig []byte) (bool, error) {
+	return mpc.VerifySignature(k.userShare.PublicKey(), data, sig)
+}
+
+// TokenParser returns a token parser that can be used to parse tokens
+func (k ucanKeyshare) UCANParser() *ucan.TokenParser {
+	caps := ucan.AccountPermissions.GetCapabilities()
+	ac := func(m map[string]interface{}) (ucan.Attenuation, error) {
+		var (
+			cap string
+			rsc ucan.Resource
+		)
+		for key, vali := range m {
+			val, ok := vali.(string)
+			if !ok {
+				return ucan.Attenuation{}, fmt.Errorf(`expected attenuation value to be a string`)
+			}
+
+			if key == ucan.CapKey {
+				cap = val
+			} else {
+				rsc = ucan.NewStringLengthResource(key, val)
+			}
+		}
+
+		return ucan.Attenuation{
+			Rsc: rsc,
+			Cap: caps.Cap(cap),
+		}, nil
+	}
+
+	store := ucan.NewMemTokenStore()
+	return ucan.NewTokenParser(ac, customDIDPubKeyResolver{}, store.(ucan.CIDBytesResolver))
+}
+
+// customDIDPubKeyResolver implements the DIDPubKeyResolver interface without
+// any network backing. Works if the key string given contains the public key
+// itself
+type customDIDPubKeyResolver struct{}
+
+// ResolveDIDKey extracts a public key from  a did:key string
+func (customDIDPubKeyResolver) ResolveDIDKey(ctx context.Context, didStr string) (didkey.ID, error) {
+	return didkey.Parse(didStr)
+}