go/ucan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

various sanding everywhere towards building the tookit

Browse Source
This commit is contained in:
Michael Muré
2024-11-20 12:34:24 +01:00
parent 1098e76cba
commit e980d6c0b9
13 changed files with 176 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
token/delegation/delegation.go
View File

@@ -48,7 +48,7 @@ type Token struct {
// New creates a validated Token from the provided parameters and options.
//
// When creating a delegated token, the Issuer's (iss) DID is assembed
// When creating a delegated token, the Issuer's (iss) DID is assembled
// using the public key associated with the private key sent as the first
// parameter.
func New(privKey crypto.PrivKey, aud did.DID, cmd command.Command, pol policy.Policy, opts ...Option) (*Token, error) {

13
token/delegation/delegationtest/token.go
View File

@@ -2,14 +2,13 @@ package delegationtest
import (
"embed"
"fmt"
"path/filepath"
"sync"
"github.com/ipfs/go-cid"
"github.com/ucan-wg/go-ucan/pkg/command"
"github.com/ucan-wg/go-ucan/token/delegation"
"github.com/ucan-wg/go-ucan/token/invocation"
)
const (
@@ -41,11 +40,11 @@ var fs embed.FS
var (
once sync.Once
ldr invocation.DelegationLoader
ldr delegation.Loader
err error
)
var _ invocation.DelegationLoader = (*delegationLoader)(nil)
var _ delegation.Loader = (*delegationLoader)(nil)
type delegationLoader struct {
tokens map[cid.Cid]*delegation.Token
@@ -54,7 +53,7 @@ type delegationLoader struct {
// GetDelegationLoader returns a singleton instance of a test
// DelegationLoader containing all the tokens present in the data/
// directory.
func GetDelegationLoader() (invocation.DelegationLoader, error) {
func GetDelegationLoader() (delegation.Loader, error) {
once.Do(func() {
ldr, err = loadDelegations()
})
@@ -66,13 +65,13 @@ func GetDelegationLoader() (invocation.DelegationLoader, error) {
func (l *delegationLoader) GetDelegation(id cid.Cid) (*delegation.Token, error) {
tkn, ok := l.tokens[id]
if !ok {
return nil, fmt.Errorf("%w: CID %s", invocation.ErrMissingDelegation, id.String())
return nil, delegation.ErrDelegationNotFound
}
return tkn, nil
}
func loadDelegations() (invocation.DelegationLoader, error) {
func loadDelegations() (delegation.Loader, error) {
dirEntries, err := fs.ReadDir("data")
if err != nil {
return nil, err

6
token/delegation/delegationtest/token_test.go
View File

@@ -6,8 +6,9 @@ import (
"github.com/ipfs/go-cid"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/ucan-wg/go-ucan/token/delegation"
"github.com/ucan-wg/go-ucan/token/delegation/delegationtest"
"github.com/ucan-wg/go-ucan/token/invocation"
)
func TestGetDelegation(t *testing.T) {
@@ -25,8 +26,7 @@ func TestGetDelegation(t *testing.T) {
t.Parallel()
tkn, err := delegationtest.GetDelegation(cid.Undef)
require.ErrorIs(t, err, invocation.ErrMissingDelegation)
require.ErrorContains(t, err, "CID b")
require.ErrorIs(t, err, delegation.ErrDelegationNotFound)
assert.Nil(t, tkn)
})
}

17
token/delegation/loader.go Normal file
View File

@@ -0,0 +1,17 @@
package delegation
import (
"fmt"
"github.com/ipfs/go-cid"
)
// ErrDelegationNotFound is returned if a delegation token is not found
var ErrDelegationNotFound = fmt.Errorf("delegation not found")
// Loader is a delegation token loader.
type Loader interface {
// GetDelegation returns the delegation.Token matching the given CID.
// If not found, ErrDelegationNotFound is returned.
GetDelegation(cid cid.Cid) (*Token, error)
}

19
token/internal/nonce/nonce.go
View File

@@ -2,8 +2,25 @@ package nonce
import "crypto/rand"
// Generate creates a 12-byte random nonce.
// TODO: some crypto scheme require more, is that our case?
//
// The spec mention:
// The REQUIRED nonce parameter nonce MAY be any value.
// A randomly generated string is RECOMMENDED to provide a unique UCAN, though it MAY
// also be a monotonically increasing count of the number of links in the hash chain.
// This field helps prevent replay attacks and ensures a unique CID per delegation.
// The iss, aud, and exp fields together will often ensure that UCANs are unique,
// but adding the nonce ensures uniqueness.
//
// The recommended size of the nonce differs by key type. In many cases, a random
// 12-byte nonce is sufficient. If uncertain, check the nonce in your DID's crypto suite.
//
// 12 bytes is 10^28, 16 bytes is 10^38. Both sounds like a lot of random to achieve
// those goals, but maybe the crypto voodoo require more.
//
// The rust implementation use 16 bytes nonce.
// Generate creates a 12-byte random nonce.
func Generate() ([]byte, error) {
res := make([]byte, 12)
_, err := rand.Read(res)

28
token/invocation/invocation.go
View File

@@ -102,34 +102,38 @@ func New(iss, sub did.DID, cmd command.Command, prf []cid.Cid, opts ...Option) (
return &tkn, nil
}
func (t *Token) ExecutionAllowed(loader DelegationLoader) (bool, error) {
func (t *Token) ExecutionAllowed(loader delegation.Loader) error {
return t.executionAllowed(loader, t.arguments)
}
func (t *Token) ExecutionAllowedWithArgsHook(loader DelegationLoader, hook func(*args.Args) *args.Args) (bool, error) {
return t.executionAllowed(loader, hook(t.arguments))
func (t *Token) ExecutionAllowedWithArgsHook(loader delegation.Loader, hook func(args args.ReadOnly) (*args.Args, error)) error {
newArgs, err := hook(t.arguments.ReadOnly())
if err != nil {
return err
}
return t.executionAllowed(loader, newArgs)
}
func (t *Token) executionAllowed(loader DelegationLoader, arguments *args.Args) (bool, error) {
func (t *Token) executionAllowed(loader delegation.Loader, arguments *args.Args) error {
delegations, err := t.loadProofs(loader)
if err != nil {
// All referenced delegations must be available - 4b
return false, err
return err
}
if err := t.verifyProofs(delegations); err != nil {
return false, err
return err
}
if err := t.verifyTimeBound(delegations); err != nil {
return false, err
return err
}
if err := t.verifyArgs(delegations, arguments); err != nil {
return false, err
return err
}
return true, nil
return nil
}
// Issuer returns the did.DID representing the Token's issuer.
@@ -154,8 +158,8 @@ func (t *Token) Command() command.Command {
// Arguments returns the arguments to be used when the command is
// invoked.
func (t *Token) Arguments() *args.Args {
return t.arguments
func (t *Token) Arguments() args.ReadOnly {
return t.arguments.ReadOnly()
}
// Proof() returns the ordered list of cid.Cid which reference the
@@ -225,7 +229,7 @@ func (t *Token) validate() error {
return errs
}
func (t *Token) loadProofs(loader DelegationLoader) (res []*delegation.Token, err error) {
func (t *Token) loadProofs(loader delegation.Loader) (res []*delegation.Token, err error) {
res = make([]*delegation.Token, len(t.proof))
for i, c := range t.proof {
res[i], err = loader.GetDelegation(c)

11
token/invocation/invocation_test.go
View File

@@ -5,13 +5,12 @@ import (
"github.com/ipfs/go-cid"
"github.com/stretchr/testify/require"
"github.com/ucan-wg/go-ucan/did/didtest"
"github.com/ucan-wg/go-ucan/pkg/args"
"github.com/ucan-wg/go-ucan/pkg/command"
"github.com/ucan-wg/go-ucan/token/delegation/delegationtest"
"github.com/ucan-wg/go-ucan/token/invocation"
"github.com/stretchr/testify/assert"
)
const (
@@ -118,7 +117,7 @@ func TestToken_ExecutionAllowed(t *testing.T) {
})
}
func test(t *testing.T, persona didtest.Persona, cmd command.Command, args *args.Args, prf []cid.Cid, opts ...invocation.Option) (bool, error) {
func test(t *testing.T, persona didtest.Persona, cmd command.Command, args *args.Args, prf []cid.Cid, opts ...invocation.Option) error {
t.Helper()
tkn, err := invocation.New(persona.DID(t), didtest.PersonaAlice.DID(t), cmd, prf, opts...)
@@ -131,13 +130,11 @@ func test(t *testing.T, persona didtest.Persona, cmd command.Command, args *args
}
func testFails(t *testing.T, expErr error, persona didtest.Persona, cmd command.Command, args *args.Args, prf []cid.Cid, opts ...invocation.Option) {
ok, err := test(t, persona, cmd, args, prf, opts...)
err := test(t, persona, cmd, args, prf, opts...)
require.ErrorIs(t, err, expErr)
assert.False(t, ok)
}
func testPasses(t *testing.T, persona didtest.Persona, cmd command.Command, args *args.Args, prf []cid.Cid, opts ...invocation.Option) {
ok, err := test(t, persona, cmd, args, prf, opts...)
err := test(t, persona, cmd, args, prf, opts...)
require.NoError(t, err)
assert.True(t, ok)
}

6
token/invocation/proof.go
View File

@@ -4,8 +4,6 @@ import (
"fmt"
"time"
"github.com/ipfs/go-cid"
"github.com/ucan-wg/go-ucan/pkg/args"
"github.com/ucan-wg/go-ucan/pkg/policy"
"github.com/ucan-wg/go-ucan/token/delegation"
@@ -49,10 +47,6 @@ import (
// a. The policy must "match" the arguments. (verifyArgs below)
// b. The nonce (if present) is not reused. (out of scope for go-ucan)
type DelegationLoader interface {
GetDelegation(cid cid.Cid) (*delegation.Token, error)
}
// verifyProofs controls that the proof chain allows the invocation:
// - principal alignment
// - command alignment