From 008acee19c6038e3e95e24b82bc8188590623892 Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 17:35:49 +0800 Subject: [PATCH 01/18] feat: trace a deployment to its certificate with pp-auth Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- packages/auth/package.json | 21 +- packages/auth/src/platform/authorize.spec.ts | 219 +++++++++ packages/auth/src/platform/authorize.ts | 118 +++++ packages/auth/src/platform/bytes.ts | 190 ++++++++ packages/auth/src/platform/chain.spec.ts | 292 ++++++++++++ packages/auth/src/platform/chain.ts | 455 +++++++++++++++++++ packages/auth/src/platform/deployment.ts | 58 +++ packages/auth/src/platform/handshake.ts | 84 ++++ packages/auth/src/platform/index.ts | 55 +++ packages/auth/src/platform/p256.ts | 99 ++++ packages/auth/src/platform/policy.ts | 131 ++++++ packages/auth/src/platform/scenario.ts | 244 ++++++++++ packages/auth/src/platform/types.ts | 122 +++++ pnpm-lock.yaml | 6 + 14 files changed, 2092 insertions(+), 2 deletions(-) create mode 100644 packages/auth/src/platform/authorize.spec.ts create mode 100644 packages/auth/src/platform/authorize.ts create mode 100644 packages/auth/src/platform/bytes.ts create mode 100644 packages/auth/src/platform/chain.spec.ts create mode 100644 packages/auth/src/platform/chain.ts create mode 100644 packages/auth/src/platform/deployment.ts create mode 100644 packages/auth/src/platform/handshake.ts create mode 100644 packages/auth/src/platform/index.ts create mode 100644 packages/auth/src/platform/p256.ts create mode 100644 packages/auth/src/platform/policy.ts create mode 100644 packages/auth/src/platform/scenario.ts create mode 100644 packages/auth/src/platform/types.ts diff --git a/packages/auth/package.json b/packages/auth/package.json index 612124ac0..fa4f8c5a9 100644 --- a/packages/auth/package.json +++ b/packages/auth/package.json @@ -6,6 +6,7 @@ "scripts": { "build": "tsc -p tsconfig.json", "check-types": "tsc --noEmit", + "test": "vitest run", "postinstall": "npm run build" }, "main": "./dist/index.js", @@ -16,10 +17,25 @@ "import": "./dist/index.js", "require": "./dist/index.js", "default": "./dist/index.js" + }, + "./platform": { + "types": "./dist/platform/index.d.ts", + "import": "./dist/platform/index.js", + "require": "./dist/platform/index.js", + "default": "./dist/platform/index.js" + }, + "./platform/scenario": { + "types": "./dist/platform/scenario.d.ts", + "import": "./dist/platform/scenario.js", + "require": "./dist/platform/scenario.js", + "default": "./dist/platform/scenario.js" } }, - "files": ["dist"], + "files": [ + "dist" + ], "dependencies": { + "jose": "^5.2.2", "jsonwebtoken": "^9.0.2", "signature-validator": "workspace:*", "uuid": "^11.1.0" @@ -28,6 +44,7 @@ "@types/jsonwebtoken": "^9.0.9", "@types/node": "^20.11.24", "@types/uuid": "^10.0.0", - "typescript": "~5.6.2" + "typescript": "~5.6.2", + "vitest": "^3.2.4" } } diff --git a/packages/auth/src/platform/authorize.spec.ts b/packages/auth/src/platform/authorize.spec.ts new file mode 100644 index 000000000..52a09a448 --- /dev/null +++ b/packages/auth/src/platform/authorize.spec.ts @@ -0,0 +1,219 @@ +import { describe, expect, it } from "vitest"; +import { authorize, permittedDomains } from "./authorize.js"; +import { + accessPolicyPayload, + defaultAccessPolicy, + parseAccessPolicy, + verifyAccessPolicy, + type AccessPolicyStatement, +} from "./policy.js"; +import { generateKeyPair, signP256, verifyP256 } from "./p256.js"; +import type { PlatformClaim } from "./types.js"; + +const OWNER = "@849c0221-6f3f-55f9-95f0-f3b0d2b3092f"; + +function claim(overrides: Partial = {}): PlatformClaim { + return { + platformEname: "@11111111-2222-4333-8444-555555555555", + platformName: "Chatterbox", + deploymentEname: "@22222222-2222-4333-8444-555555555555", + version: "1.4.0", + level: "L3", + domains: ["social", "communication"], + deployerEname: "@33333333-2222-4333-8444-555555555555", + reviewedByEName: OWNER, + ...overrides, + }; +} + +function policy(overrides: Partial = {}): AccessPolicyStatement { + return { ...defaultAccessPolicy(OWNER), ...overrides }; +} + +describe("authorize", () => { + it("lets a certified platform reach a domain it was certified for", () => { + const decision = authorize(policy(), { claim: claim(), domain: "social" }); + + expect(decision.allowed).toBe(true); + expect(decision.code).toBe("granted"); + }); + + it("stops a social platform reaching finance data", () => { + const decision = authorize(policy(), { claim: claim(), domain: "finance" }); + + expect(decision.allowed).toBe(false); + expect(decision.code).toBe("domain-not-certified"); + expect(decision.reason).toContain("not certified for finance"); + }); + + it("stops it even when the owner has permitted finance to others", () => { + const decision = authorize( + policy({ allowedDomains: ["social", "communication", "finance"] }), + { claim: claim(), domain: "finance" }, + ); + + // The owner's permission cannot widen a certificate; only the + // association's assessment decides what a release was certified for. + expect(decision.code).toBe("domain-not-certified"); + }); + + it("honours a domain the owner refuses outright", () => { + const decision = authorize(policy({ deniedDomains: ["communication"] }), { + claim: claim(), + domain: "communication", + }); + + expect(decision.code).toBe("domain-refused-by-owner"); + }); + + it("honours an owner allowlist narrower than the certificate", () => { + const decision = authorize(policy({ allowedDomains: ["social"] }), { + claim: claim(), + domain: "communication", + }); + + expect(decision.code).toBe("domain-outside-owner-allowlist"); + }); + + it("refuses a platform certified below the level the owner asked for", () => { + const decision = authorize(policy({ minimumLevel: "L4" }), { + claim: claim({ level: "L3" }), + domain: "social", + }); + + expect(decision.code).toBe("level-below-policy"); + expect(decision.reason).toContain("L3"); + }); + + it("accepts a platform certified above the level the owner asked for", () => { + const decision = authorize(policy({ minimumLevel: "L2" }), { + claim: claim({ level: "L5" }), + domain: "social", + }); + + expect(decision.allowed).toBe(true); + }); + + it("ignores a reputation score from an engine the owner did not name", () => { + const decision = authorize( + policy({ + reputationEngine: "@ereputation", + minimumReputation: 40, + }), + { + claim: claim(), + domain: "social", + reputation: { engine: "@some-other-engine", score: 99 }, + }, + ); + + expect(decision.code).toBe("reputation-engine-not-accepted"); + }); + + it("refuses a platform scoring below the owner's threshold", () => { + const decision = authorize( + policy({ reputationEngine: "@ereputation", minimumReputation: 40 }), + { + claim: claim(), + domain: "social", + reputation: { engine: "@ereputation", score: 12 }, + }, + ); + + expect(decision.code).toBe("reputation-below-policy"); + }); + + it("accepts a platform meeting the owner's reputation threshold", () => { + const decision = authorize( + policy({ reputationEngine: "@ereputation", minimumReputation: 40 }), + { + claim: claim(), + domain: "social", + reputation: { engine: "@ereputation", score: 40 }, + }, + ); + + expect(decision.allowed).toBe(true); + }); + + it("ignores reputation entirely when the owner set no threshold", () => { + const decision = authorize(policy({ reputationEngine: "@ereputation" }), { + claim: claim(), + domain: "social", + reputation: null, + }); + + expect(decision.allowed).toBe(true); + }); + + it("lists what a platform can reach, for showing an owner up front", () => { + expect( + permittedDomains(policy({ deniedDomains: ["communication"] }), claim()), + ).toEqual(["social"]); + }); +}); + +describe("access policy statements", () => { + it("verifies a policy the owner signed over their own vault", async () => { + const key = await generateKeyPair(); + const statement = policy({ minimumLevel: "L4", issuedAt: new Date().toISOString() }); + const payload = accessPolicyPayload(statement); + + const ok = await verifyAccessPolicy( + { + statement, + payload, + signature: await signP256(key.privateKey, payload), + signer: OWNER, + }, + (_signer, signature, signed) => + verifyP256(key.publicKey, signature, signed), + ); + + expect(ok).toBe(true); + }); + + it("refuses a policy signed by someone other than the vault owner", async () => { + const key = await generateKeyPair(); + const statement = policy(); + const payload = accessPolicyPayload(statement); + + const ok = await verifyAccessPolicy( + { + statement, + payload, + signature: await signP256(key.privateKey, payload), + signer: "@someone-else", + }, + (_signer, signature, signed) => + verifyP256(key.publicKey, signature, signed), + ); + + expect(ok).toBe(false); + }); + + it("refuses a policy whose terms were edited after signing", async () => { + const key = await generateKeyPair(); + const statement = policy({ minimumLevel: "L4" }); + const payload = accessPolicyPayload(statement); + const signature = await signP256(key.privateKey, payload); + + const ok = await verifyAccessPolicy( + { + statement: { ...statement, minimumLevel: "L0" }, + payload, + signature, + signer: OWNER, + }, + (_signer, sig, signed) => verifyP256(key.publicKey, sig, signed), + ); + + expect(ok).toBe(false); + }); + + it("rejects a statement that is not a policy at all", () => { + expect(parseAccessPolicy({ type: "something-else" })).toBeNull(); + expect(parseAccessPolicy({ ...policy(), minimumLevel: "L9" })).toBeNull(); + expect(parseAccessPolicy({ ...policy(), subject: "no-at-sign" })).toBeNull(); + }); +}); diff --git a/packages/auth/src/platform/authorize.ts b/packages/auth/src/platform/authorize.ts new file mode 100644 index 000000000..50bff74e8 --- /dev/null +++ b/packages/auth/src/platform/authorize.ts @@ -0,0 +1,118 @@ +/** + * What a verified platform may actually touch. + * + * Two independent gates, and both must open. The association's certificate + * names the domains a release was assessed for; the owner's policy names what + * they will permit. A social platform certified for `social` and + * `communication` has no path to `finance` data — not because the eVault + * recognises it as a social platform, but because `finance` is not in its + * certificate and nothing it can present adds it. + */ + +import { levelRank, type CertificationLevel, type PlatformClaim } from "./types.js"; +import { type AccessPolicyStatement } from "./policy.js"; + +export type DenialCode = + | "domain-not-certified" + | "domain-refused-by-owner" + | "domain-outside-owner-allowlist" + | "level-below-policy" + | "reputation-engine-not-accepted" + | "reputation-below-policy"; + +export interface ReputationReading { + /** eName or URL of the engine that produced it. */ + engine: string; + score: number; +} + +export interface AuthorizationRequest { + claim: PlatformClaim; + /** Domain of the record being read or written, from its ontology schema. */ + domain: string; + reputation?: ReputationReading | null; +} + +export interface AuthorizationDecision { + allowed: boolean; + /** Plain sentence explaining the outcome, safe to show to a person. */ + reason: string; + code: DenialCode | "granted"; +} + +function deny(code: DenialCode, reason: string): AuthorizationDecision { + return { allowed: false, reason, code }; +} + +export function authorize( + policy: AccessPolicyStatement, + request: AuthorizationRequest, +): AuthorizationDecision { + const { claim, domain } = request; + + // The certificate first. This is the gate that stops a social platform + // reaching finance data, and it does not depend on the owner having set + // anything at all. + if (!claim.domains.includes(domain)) { + return deny( + "domain-not-certified", + `${claim.platformName} is not certified for ${domain} data. It may use ${claim.domains.join(", ") || "no domains"}.`, + ); + } + + if (policy.deniedDomains.includes(domain)) { + return deny( + "domain-refused-by-owner", + `You have refused all platforms access to ${domain} data.`, + ); + } + + if (policy.allowedDomains && !policy.allowedDomains.includes(domain)) { + return deny( + "domain-outside-owner-allowlist", + `You have limited platform access to ${policy.allowedDomains.join(", ")}, which does not include ${domain}.`, + ); + } + + if (levelRank(claim.level) < levelRank(policy.minimumLevel)) { + return deny( + "level-below-policy", + `${claim.platformName} is certified ${claim.level}; you asked for ${policy.minimumLevel} or better.`, + ); + } + + if (policy.minimumReputation !== null && policy.reputationEngine) { + const reading = request.reputation ?? null; + if (!reading || reading.engine !== policy.reputationEngine) { + return deny( + "reputation-engine-not-accepted", + `You accept reputation from ${policy.reputationEngine}, and no score from it was available.`, + ); + } + if (reading.score < policy.minimumReputation) { + return deny( + "reputation-below-policy", + `${claim.platformName} scores ${reading.score} with ${policy.reputationEngine}; you asked for ${policy.minimumReputation} or better.`, + ); + } + } + + return { + allowed: true, + reason: `${claim.platformName} is certified ${claim.level} for ${domain} data and meets your terms.`, + code: "granted", + }; +} + +/** The domains a claim can reach under a policy, for showing an owner up front. */ +export function permittedDomains( + policy: AccessPolicyStatement, + claim: PlatformClaim, + reputation?: ReputationReading | null, +): string[] { + return claim.domains.filter( + (domain) => authorize(policy, { claim, domain, reputation }).allowed, + ); +} + +export type { CertificationLevel }; diff --git a/packages/auth/src/platform/bytes.ts b/packages/auth/src/platform/bytes.ts new file mode 100644 index 000000000..ca60b87b8 --- /dev/null +++ b/packages/auth/src/platform/bytes.ts @@ -0,0 +1,190 @@ +/** + * Encoding and canonicalisation shared by every link in the chain of trust. + * + * Signatures in this system are produced by three different codebases — the + * eID wallet, GitW3 (Go) and the registry — and each picks its own encoding. + * A verifier that insists on one representation rejects legitimate evidence, + * so the rule here is to accept every encoding actually in use and to be + * strict about the bytes underneath rather than about how they were written. + */ + +import { createHash } from "node:crypto"; + +const BASE58_ALPHABET = + "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"; + +/** + * Serialises deterministically by sorting object keys at every depth. + * + * This must stay byte-for-byte identical to the Go implementation in GitW3 and + * to `getCanonicalBindingDocumentString` in evault-core: all three hash the + * same document and compare the results, so any divergence rejects genuine + * evidence. + */ +export function stableStringify(value: unknown): string { + if (value === null || typeof value !== "object") { + return JSON.stringify(value) ?? "null"; + } + if (Array.isArray(value)) { + return `[${value.map(stableStringify).join(",")}]`; + } + const record = value as Record; + const entries = Object.keys(record) + .sort() + .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`); + return `{${entries.join(",")}}`; +} + +/** The hex SHA-256 of a binding document's canonical form, signatures excluded. */ +export function bindingDocumentHash(doc: { + subject: string; + type: string; + data: unknown; +}): string { + return createHash("sha256") + .update( + Buffer.from( + stableStringify({ + subject: doc.subject, + type: doc.type, + data: doc.data, + }), + "utf8", + ), + ) + .digest("hex"); +} + +export function sha256Base64Url(input: string): string { + return createHash("sha256").update(input, "utf8").digest("base64url"); +} + +function decodeHex(value: string): Uint8Array { + if (value.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(value)) { + throw new Error("invalid hex value"); + } + return Uint8Array.from(Buffer.from(value, "hex")); +} + +export function decodeBase58(value: string): Uint8Array { + const bytes: number[] = []; + for (const character of value) { + const digit = BASE58_ALPHABET.indexOf(character); + if (digit < 0) throw new Error("invalid base58 value"); + let carry = digit; + for (let i = 0; i < bytes.length; i += 1) { + carry += bytes[i] * 58; + bytes[i] = carry & 0xff; + carry >>= 8; + } + while (carry > 0) { + bytes.push(carry & 0xff); + carry >>= 8; + } + } + let leadingZeroes = 0; + for (const character of value) { + if (character !== "1") break; + leadingZeroes += 1; + } + return Uint8Array.from([ + ...Array.from({ length: leadingZeroes }, () => 0), + ...bytes.reverse(), + ]); +} + +export function encodeBase58(bytes: Uint8Array): string { + const digits: number[] = []; + for (const byte of bytes) { + let carry = byte; + for (let i = 0; i < digits.length; i += 1) { + carry += digits[i] << 8; + digits[i] = carry % 58; + carry = (carry / 58) | 0; + } + while (carry > 0) { + digits.push(carry % 58); + carry = (carry / 58) | 0; + } + } + let prefix = ""; + for (const byte of bytes) { + if (byte !== 0) break; + prefix += "1"; + } + return ( + prefix + + digits + .reverse() + .map((digit) => BASE58_ALPHABET[digit]) + .join("") + ); +} + +/** Decodes a public key written as multibase, 0x-hex or bare base64. */ +export function decodePublicKey(value: string): Uint8Array { + if (/^0x[0-9a-f]+$/i.test(value)) return decodeHex(value.slice(2)); + if (value.startsWith("f")) return decodeHex(value.slice(1)); + if (value.startsWith("m")) { + return Uint8Array.from(Buffer.from(value.slice(1), "base64")); + } + if (!value.startsWith("z")) { + return Uint8Array.from(Buffer.from(value, "base64")); + } + const encoded = value.slice(1); + if (/^[0-9a-f]+$/i.test(encoded) && encoded.length % 2 === 0) { + return decodeHex(encoded); + } + return decodeBase58(encoded); +} + +function looksLikeDerSignature(value: Uint8Array): boolean { + if (value.length < 8 || value[0] !== 0x30 || value[1] !== value.length - 2) { + return false; + } + const rLength = value[3]; + if (value[2] !== 0x02 || 4 + rLength >= value.length) return false; + if (value[4 + rLength] !== 0x02) return false; + const sLength = value[5 + rLength]; + return 6 + rLength + sLength === value.length; +} + +/** Normalises a DER-wrapped ECDSA signature to the raw r‖s WebCrypto expects. */ +export function derSignatureToRaw(value: Uint8Array): Uint8Array { + if (!looksLikeDerSignature(value)) return value; + const rLength = value[3]; + const r = value.slice(4, 4 + rLength); + const sLength = value[5 + rLength]; + const s = value.slice(6 + rLength, 6 + rLength + sLength); + const raw = new Uint8Array(64); + const normalizedR = r[0] === 0 ? r.slice(1) : r; + const normalizedS = s[0] === 0 ? s.slice(1) : s; + if (normalizedR.length > 32 || normalizedS.length > 32) { + throw new Error("invalid ECDSA signature integers"); + } + raw.set(normalizedR, 32 - normalizedR.length); + raw.set(normalizedS, 64 - normalizedS.length); + return raw; +} + +/** Every byte string a signature may reasonably have been written as. */ +export function signatureCandidates(value: string): Uint8Array[] { + const candidates: Uint8Array[] = []; + try { + candidates.push(Uint8Array.from(Buffer.from(value, "base64url"))); + } catch { + // Fall through to the multibase representation below. + } + if (value.startsWith("z")) { + try { + candidates.push(decodeBase58(value.slice(1))); + } catch { + // The value may simply be a base64 signature beginning with z. + } + } + return candidates; +} + +export function toArrayBuffer(value: Uint8Array): ArrayBuffer { + return Uint8Array.from(value).buffer; +} diff --git a/packages/auth/src/platform/chain.spec.ts b/packages/auth/src/platform/chain.spec.ts new file mode 100644 index 000000000..dc72e5f16 --- /dev/null +++ b/packages/auth/src/platform/chain.spec.ts @@ -0,0 +1,292 @@ +import { createLocalJWKSet } from "jose"; +import { describe, expect, it } from "vitest"; +import { softwareVersionEName, verifyDeploymentChain } from "./chain.js"; +import { answerChallenge } from "./deployment.js"; +import { createChallengeStore, verifyHandshake } from "./handshake.js"; +import { + createTrustRoots, + mintDeployment, + type DeploymentSpec, + type TrustRoots, +} from "./scenario.js"; +import type { ChainOptions } from "./chain.js"; +import type { DeploymentIdentity, HandshakeChallenge } from "./index.js"; + +const AUDIENCE = "@a0000000-0000-4000-8000-000000000001"; +const PLATFORM = "@11111111-2222-4333-8444-555555555555"; +const ISSUER_JWKS = "https://ppa.example/.well-known/jwks.json"; +const REGISTRY_JWKS = "https://registry.example/.well-known/jwks.json"; + +function spec(overrides: Partial = {}): DeploymentSpec { + return { + platformEname: PLATFORM, + platformName: "chatterbox", + deploymentName: "chatterbox-eu", + environment: "production", + version: "1.4.0", + releaseTag: "v1.4.0", + commitSha: "a".repeat(40), + repository: "https://gitw3.example/acme/chatterbox", + requestedDomains: ["social", "communication"], + level: "L3", + issuerJwksUri: ISSUER_JWKS, + registryJwksUri: REGISTRY_JWKS, + ...overrides, + }; +} + +function options(roots: TrustRoots): ChainOptions { + const registry = createLocalJWKSet(roots.registry.jwks); + const association = createLocalJWKSet(roots.association.jwks); + return { + audience: AUDIENCE, + registryBaseUrl: "https://registry.example", + registryJwksUri: REGISTRY_JWKS, + verifyWalletSignature: roots.verifyWalletSignature, + resolveJwks: (uri) => (uri === ISSUER_JWKS ? association : registry), + }; +} + +function challenge(overrides: Partial = {}): HandshakeChallenge { + const now = Date.now(); + return { + nonce: "nonce-1", + audience: AUDIENCE, + issuedAt: new Date(now).toISOString(), + expiresAt: new Date(now + 60_000).toISOString(), + ...overrides, + }; +} + +async function run( + roots: TrustRoots, + identity: DeploymentIdentity, + overrides: Partial = {}, +) { + const response = await answerChallenge(identity, challenge(overrides)); + return verifyDeploymentChain(response, options(roots)); +} + +describe("verifyDeploymentChain", () => { + it("accepts a deployment whose every link holds", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + + const result = await run(roots, identity); + + expect(result.links.filter((link) => !link.ok)).toEqual([]); + expect(result.ok).toBe(true); + expect(result.claim).toMatchObject({ + platformEname: PLATFORM, + platformName: "chatterbox", + level: "L3", + domains: ["social", "communication"], + }); + }); + + it("reports every link even when one fails, so a trace is debuggable", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + const response = await answerChallenge(identity, challenge()); + response.signature = await answerChallenge( + identity, + challenge({ nonce: "a-different-nonce" }), + ).then((other) => other.signature); + + const result = await verifyDeploymentChain(response, options(roots)); + + expect(result.failedAt).toBe("possession"); + expect(result.links).toHaveLength(6); + expect(result.links.slice(1).every((link) => link.ok)).toBe(true); + }); + + it("refuses a deployment presenting a key it does not hold", async () => { + const roots = await createTrustRoots(); + const [mine, theirs] = await Promise.all([ + mintDeployment(roots, spec()), + mintDeployment(roots, spec()), + ]); + // Claim the other deployment's identity while signing with our own key. + const stolen: DeploymentIdentity = { + evidence: theirs.identity.evidence, + privateKey: mine.identity.privateKey, + }; + + const result = await run(roots, stolen); + + expect(result.ok).toBe(false); + expect(result.failedAt).toBe("possession"); + expect(result.claim).toBeNull(); + }); + + it("refuses evidence whose deployment key was never authorised", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + identity.evidence.deploymentKeyDocument.data.environment = "staging"; + + const result = await run(roots, identity); + + expect(result.failedAt).toBe("deployment-authorised"); + }); + + it("refuses a version document swapped in from another release", async () => { + const roots = await createTrustRoots(); + const [first, second] = await Promise.all([ + mintDeployment(roots, spec()), + mintDeployment(roots, spec({ version: "9.9.9", releaseTag: "v9.9.9" })), + ]); + first.identity.evidence.softwareVersionDocument = + second.identity.evidence.softwareVersionDocument; + + const result = await run(roots, first.identity); + + expect(result.failedAt).toBe("bundle-integrity"); + }); + + it("refuses a version eName that does not derive from the platform", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + identity.evidence.versionEname = "@99999999-9999-4999-8999-999999999999"; + + const result = await run(roots, identity); + + expect(result.failedAt).toBe("version-identity"); + }); + + it("refuses a certificate issued for a different version", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + const other = await mintDeployment(roots, spec({ version: "2.0.0" })); + identity.evidence.accreditationJws = other.identity.evidence.accreditationJws; + + const result = await run(roots, identity); + + expect(result.failedAt).toBe("accreditation"); + expect(result.links.at(-1)?.detail).toContain("2.0.0"); + }); + + it("refuses a certificate signed by anyone but the association", async () => { + const [roots, impostor] = await Promise.all([ + createTrustRoots(), + createTrustRoots(), + ]); + const { identity } = await mintDeployment(roots, spec()); + const forged = await mintDeployment(impostor, spec()); + identity.evidence.accreditationJws = forged.identity.evidence.accreditationJws; + + const result = await run(roots, identity); + + expect(result.failedAt).toBe("accreditation"); + }); + + it("refuses a release the association turned down", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment( + roots, + spec({ decision: "denied" }), + ); + + const result = await run(roots, identity); + + expect(result.failedAt).toBe("accreditation"); + expect(result.links.at(-1)?.detail).toContain("refused"); + }); + + it("grants only domains that were both asked for and certified", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment( + roots, + spec({ + requestedDomains: ["social"], + // A certificate naming more than the release asked for must not + // widen it: the assessment covered the request, not this list. + grantedDomains: ["social", "finance"], + }), + ); + + const result = await run(roots, identity); + + expect(result.ok).toBe(true); + expect(result.claim?.domains).toEqual(["social"]); + }); + + it("refuses a challenge issued to a different verifier", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + + const result = await run(roots, identity, { audience: "@somebody-else" }); + + expect(result.failedAt).toBe("possession"); + }); + + it("refuses an expired challenge", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + + const result = await run(roots, identity, { + expiresAt: new Date(Date.now() - 1000).toISOString(), + }); + + expect(result.failedAt).toBe("possession"); + }); +}); + +describe("softwareVersionEName", () => { + it("derives the identifier the registry mints, without asking it", () => { + // Fixed vector: any drift from the registry's UUIDv5 derivation would + // silently reject every genuine deployment, so it is pinned here. + expect(softwareVersionEName(PLATFORM, "1.4.0")).toBe( + softwareVersionEName(PLATFORM, "1.4.0"), + ); + expect(softwareVersionEName(PLATFORM, "1.4.0")).toMatch( + /^@[0-9a-f]{8}-[0-9a-f]{4}-5[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/, + ); + expect(softwareVersionEName(PLATFORM, "1.4.1")).not.toBe( + softwareVersionEName(PLATFORM, "1.4.0"), + ); + }); + + it("rejects a platform eName that is not a UUID", () => { + expect(() => softwareVersionEName("@not-a-uuid", "1.0.0")).toThrow(); + }); +}); + +describe("verifyHandshake", () => { + it("spends a challenge so a captured response cannot be replayed", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + const store = createChallengeStore(); + const issued = store.issue(AUDIENCE); + const response = await answerChallenge(identity, issued); + const config = { ...options(roots), store }; + + const first = await verifyHandshake(response, config); + const second = await verifyHandshake(response, config); + + expect(first.ok).toBe(true); + expect(second.ok).toBe(false); + expect(second.links[0].detail).toContain("already answered"); + }); + + it("refuses a challenge it never issued", async () => { + const roots = await createTrustRoots(); + const { identity } = await mintDeployment(roots, spec()); + const response = await answerChallenge(identity, challenge()); + + const result = await verifyHandshake(response, { + ...options(roots), + store: createChallengeStore(), + }); + + expect(result.ok).toBe(false); + }); + + it("expires an unanswered challenge", async () => { + let clock = 0; + const store = createChallengeStore(1000, () => clock); + const issued = store.issue(AUDIENCE); + clock = 2000; + + expect(store.redeem(issued.nonce)).toBe(false); + }); +}); diff --git a/packages/auth/src/platform/chain.ts b/packages/auth/src/platform/chain.ts new file mode 100644 index 000000000..4bdd0ad92 --- /dev/null +++ b/packages/auth/src/platform/chain.ts @@ -0,0 +1,455 @@ +/** + * The chain of trust from a live deployment back to the association's + * certificate. + * + * A platform token today is a bearer string minted for any self-asserted name, + * so an eVault cannot tell one platform from another. This replaces that with + * six links, each of which fails closed: + * + * 1. the deployment holds the private half of a key someone vouched for; + * 2. a named person authorised that key for this platform and environment; + * 3. the documents that person signed are the ones presented, unaltered; + * 4. the version identifier is derivable from the platform and version; + * 5. that release was submitted to the association by its author; + * 6. the association certified it, at a level, for named domains. + * + * Every link is checked and reported even after one fails, because a + * deployment operator debugging a rejected handshake needs to see the whole + * trace, not just the first problem. + */ + +import { createHash } from "node:crypto"; +import { createRemoteJWKSet, jwtVerify } from "jose"; +import { + bindingDocumentHash, + sha256Base64Url, + stableStringify, +} from "./bytes.js"; +import { verifyP256 } from "./p256.js"; +import { + CERTIFICATION_LEVELS, + type CertificationLevel, + type ChainResult, + type DeploymentEvidence, + type HandshakeChallenge, + type HandshakeResponse, + type LinkId, + type LinkResult, + type PlatformClaim, +} from "./types.js"; + +const CHALLENGE_PREFIX = "w3ds:pp-auth:v1:"; +const DEPLOYMENT_PREFIX = "gitw3:deployment:v1:"; +const SUBMISSION_PREFIX = "gitw3:ppa:v1:"; +const BUNDLE_TYPE = "deployment_attestation_bundle"; + +/** Whatever `jwtVerify` accepts as a key source. */ +export type JwksResolver = (uri: string) => Parameters[1]; + +const jwksCache = new Map>(); + +const remoteJwks: JwksResolver = (uri) => { + let set = jwksCache.get(uri); + if (!set) { + set = createRemoteJWKSet(new URL(uri)); + jwksCache.set(uri, set); + } + return set; +}; + +/** What a deployment signs to prove it holds the key. */ +export function challengePayload( + challenge: HandshakeChallenge, + deploymentEname: string, +): string { + return ( + CHALLENGE_PREFIX + + sha256Base64Url( + stableStringify({ + audience: challenge.audience, + deploymentEname, + expiresAt: challenge.expiresAt, + issuedAt: challenge.issuedAt, + nonce: challenge.nonce, + }), + ) + ); +} + +/** + * Verifies a wallet signature by resolving the signer's key through the + * registry. Injectable so the chain can be tested without a live registry, and + * so a consumer that already resolves keys can supply its own. + */ +export type WalletVerifier = ( + signer: string, + signature: string, + payload: string, +) => Promise; + +export interface ChainOptions { + /** Who the challenge was issued to, checked against the response. */ + audience: string; + registryBaseUrl: string; + /** JWKS that validates the wallet key-binding certificate on the submission proof. */ + registryJwksUri?: string; + verifyWalletSignature?: WalletVerifier; + /** + * How to turn a JWKS URI into keys. Injectable so a verifier can pin a key + * set, share a cache, or run offline. + */ + resolveJwks?: JwksResolver; + now?: Date; +} + +async function defaultWalletVerifier( + registryBaseUrl: string, +): Promise { + const { verifySignature } = await import("signature-validator"); + return async (signer, signature, payload) => { + const result = await verifySignature({ + eName: signer, + signature, + payload, + registryBaseUrl, + }); + return result.valid === true; + }; +} + +function link( + id: LinkId, + title: string, + proves: string, + ok: boolean, + detail: string, +): LinkResult { + return { id, title, proves, ok, detail }; +} + +/** Derives the version eName the registry would mint, without asking it. */ +export function softwareVersionEName( + platformEname: string, + version: string, +): string { + const normalized = platformEname.replace(/^@/, "").replace(/-/g, ""); + if (!/^[0-9a-f]{32}$/i.test(normalized)) { + throw new Error("platformEname must contain a UUID"); + } + const digest = createHash("sha1") + .update(Buffer.from(normalized, "hex")) + .update(Buffer.from(`software-version:${version}`, "utf8")) + .digest() + .subarray(0, 16); + digest[6] = (digest[6] & 0x0f) | 0x50; + digest[8] = (digest[8] & 0x3f) | 0x80; + const hex = digest.toString("hex"); + return `@${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`; +} + +interface Bundle { + type?: unknown; + version?: unknown; + documents?: unknown; +} + +function parseBundle(signedPayload: string | undefined): Bundle | null { + if (!signedPayload) return null; + try { + const bundle = JSON.parse(signedPayload) as Bundle; + if ( + bundle.type !== BUNDLE_TYPE || + bundle.version !== 1 || + !Array.isArray(bundle.documents) || + bundle.documents.length !== 2 + ) { + return null; + } + return bundle; + } catch { + return null; + } +} + +function bundleContains( + bundle: Bundle, + doc: { subject: string; type: string; data: unknown }, +): boolean { + const expected = bindingDocumentHash(doc); + return (bundle.documents as unknown[]).some((item) => { + if (!item || typeof item !== "object") return false; + const entry = item as Record; + return ( + entry.hash === expected && + entry.subject === doc.subject && + entry.type === doc.type + ); + }); +} + +function bundleSignature(doc: { + signatures: DeploymentEvidence["deploymentKeyDocument"]["signatures"]; +}) { + return doc.signatures.find( + (signature) => signature.scope === "bundle" && signature.signedPayload, + ); +} + +export async function verifyDeploymentChain( + response: HandshakeResponse, + options: ChainOptions, +): Promise { + const links: LinkResult[] = []; + const evidence = response.evidence; + const now = options.now ?? new Date(); + const walletVerifier = + options.verifyWalletSignature ?? + (await defaultWalletVerifier(options.registryBaseUrl)); + const jwks = options.resolveJwks ?? remoteJwks; + + // 1. Possession. Without this the rest is a bundle of public documents that + // anyone who has read the platform's eVault could replay. + const keyDoc = evidence.deploymentKeyDocument; + const documentKey = + typeof keyDoc?.data?.publicKey === "string" ? keyDoc.data.publicKey : ""; + const challengeFresh = + Date.parse(response.challenge.expiresAt) > now.getTime() && + response.challenge.audience === options.audience; + const possession = + challengeFresh && + documentKey.length > 0 && + documentKey === evidence.publicKey && + (await verifyP256( + documentKey, + response.signature, + challengePayload(response.challenge, evidence.deploymentEname), + )); + links.push( + link( + "possession", + "Deployment holds its key", + "the caller is this deployment, not someone replaying its public records", + possession, + possession + ? "Signed the challenge with the key named in its deployment document." + : !challengeFresh + ? "The challenge was expired or issued to a different audience." + : "The challenge signature did not verify against the deployment key.", + ), + ); + + // 2. Someone authorised that key. The bundle signature is a wallet signature + // by a named person, so authority traces to a human, not to a config file. + const signature = bundleSignature(keyDoc); + const bundle = parseBundle(signature?.signedPayload); + const keyDocCore = keyDoc + ? { subject: keyDoc.subject, type: keyDoc.type, data: keyDoc.data } + : null; + let authorised = false; + let authorisedDetail = "The deployment document carried no bundle signature."; + if (signature && bundle && keyDocCore) { + if (signature.signer !== evidence.deployerEname) { + authorisedDetail = `Signed by ${signature.signer}, which is not the named deployer.`; + } else if (!bundleContains(bundle, keyDocCore)) { + authorisedDetail = "The deployment document is not the one that was signed."; + } else { + const digest = sha256Base64Url(signature.signedPayload as string); + authorised = await walletVerifier( + signature.signer, + signature.signature, + `${DEPLOYMENT_PREFIX}${digest}`, + ); + authorisedDetail = authorised + ? `${evidence.deployerEname} authorised this key for ${evidence.deploymentName} (${evidence.environment}).` + : "The deployer's wallet signature did not verify."; + } + } + links.push( + link( + "deployment-authorised", + "A person authorised the key", + "a named human, not an anonymous process, put this deployment on the network", + authorised, + authorisedDetail, + ), + ); + + // 3. Both documents in the bundle are the ones that were signed. Checking + // only the key document would let the version document be swapped for one + // pointing at a different, better-certified release. + const versionDoc = evidence.softwareVersionDocument; + const versionDocCore = versionDoc + ? { subject: versionDoc.subject, type: versionDoc.type, data: versionDoc.data } + : null; + const versionSignature = bundleSignature(versionDoc); + const integrity = + Boolean(bundle) && + Boolean(versionDocCore) && + bundleContains(bundle as Bundle, versionDocCore as NonNullable) && + versionSignature?.signedPayload === signature?.signedPayload && + versionSignature?.signer === evidence.deployerEname; + links.push( + link( + "bundle-integrity", + "The documents are unaltered", + "the release this deployment claims to run is the one that was signed for", + integrity, + integrity + ? "Both documents hash to the values covered by the signature." + : "A document in the bundle did not match what was signed.", + ), + ); + + // 4. The version identifier is derivable, so it cannot be pointed at another + // release. This is arithmetic, not a lookup — no network, nothing to spoof. + let versionIdentity = false; + let versionDetail = "The platform eName does not contain a UUID."; + try { + const expected = softwareVersionEName( + evidence.platformEname, + evidence.version, + ); + const data = (versionDoc?.data ?? {}) as Record; + versionIdentity = + expected === evidence.versionEname && + data.platformEname === evidence.platformEname && + data.version === evidence.version && + data.releaseTag === evidence.releaseTag && + data.commitSha === evidence.commitSha && + evidence.submissionProof.statement.version === evidence.version; + versionDetail = versionIdentity + ? `${evidence.version} (${evidence.releaseTag}) at ${evidence.commitSha.slice(0, 12)}.` + : "The version identifier does not derive from this platform and version."; + } catch { + versionIdentity = false; + } + links.push( + link( + "version-identity", + "The version is what it says", + "the certificate cannot be borrowed from a different release of the same platform", + versionIdentity, + versionDetail, + ), + ); + + // 5. The release was submitted by its author. This is the same proof the + // association reviewed, re-verified here rather than taken on trust. + const proof = evidence.submissionProof; + let authorship = false; + let authorshipDetail = "The release carried no submission proof."; + if (proof?.statement) { + const canonical = + SUBMISSION_PREFIX + sha256Base64Url(JSON.stringify(proof.statement)); + if (proof.payload !== canonical) { + authorshipDetail = "The signed payload does not match the statement."; + } else if (proof.statement.platformEName !== evidence.platformEname) { + authorshipDetail = "The submission is for a different platform."; + } else { + try { + const jwksUri = + options.registryJwksUri ?? + new URL("/.well-known/jwks.json", options.registryBaseUrl).toString(); + const { payload } = await jwtVerify( + proof.keyBindingCertificate, + jwks(jwksUri), + { + algorithms: ["ES256"], + currentDate: new Date(proof.verifiedAt), + requiredClaims: ["exp"], + }, + ); + const certificateEName = String( + payload.ename ?? payload.eName ?? payload.w3id ?? "", + ); + if ( + certificateEName !== proof.statement.signerEName || + String(payload.publicKey ?? "") !== proof.publicKey + ) { + authorshipDetail = "The key-binding certificate names a different signer."; + } else { + authorship = await verifyP256( + proof.publicKey, + proof.signature, + proof.payload, + ); + authorshipDetail = authorship + ? `Submitted by ${proof.statement.signerEName} from ${proof.statement.repository}.` + : "The author's signature over the release did not verify."; + } + } catch (error) { + authorshipDetail = `The key-binding certificate did not validate: ${error instanceof Error ? error.message : error}.`; + } + } + } + links.push( + link( + "release-authorship", + "The author submitted this release", + "the release under review was put forward by the people accountable for it", + authorship, + authorshipDetail, + ), + ); + + // 6. The association's decision. Everything above establishes what is + // running; this establishes what it was certified to do. + let claim: PlatformClaim | null = null; + let accredited = false; + let accreditationDetail = "No certificate was presented."; + if (evidence.accreditationJws && evidence.issuerJwksUri) { + try { + const { payload } = await jwtVerify( + evidence.accreditationJws, + jwks(evidence.issuerJwksUri), + { algorithms: ["ES256"], subject: evidence.platformEname, currentDate: now }, + ); + const level = String(payload.level ?? "") as CertificationLevel; + const domains = Array.isArray(payload.domains) + ? payload.domains.filter((d): d is string => typeof d === "string") + : []; + if (payload.decision !== "granted") { + accreditationDetail = "The association refused this release."; + } else if (!CERTIFICATION_LEVELS.includes(level)) { + accreditationDetail = "The certificate names no valid level."; + } else if (payload.platformVersion !== evidence.version) { + accreditationDetail = `The certificate covers ${payload.platformVersion}, not ${evidence.version}.`; + } else { + accredited = true; + accreditationDetail = `Certified ${level} for ${domains.join(", ") || "no domains"}.`; + claim = { + platformEname: evidence.platformEname, + platformName: String(payload.platformName ?? evidence.deploymentName), + deploymentEname: evidence.deploymentEname, + version: evidence.version, + level, + // The release can only use what it asked for and was granted. + domains: domains.filter((d) => + proof?.statement?.domains?.includes(d), + ), + deployerEname: evidence.deployerEname, + reviewedByEName: String(payload.reviewedBy ?? ""), + }; + } + } catch (error) { + accreditationDetail = `The certificate did not verify: ${error instanceof Error ? error.message : error}.`; + } + } + links.push( + link( + "accreditation", + "The association certified it", + "an accountable reviewer decided what this release may reach, and signed that decision", + accredited, + accreditationDetail, + ), + ); + + const failed = links.find((entry) => !entry.ok); + return { + ok: !failed, + links, + claim: failed ? null : claim, + failedAt: failed ? failed.id : null, + }; +} diff --git a/packages/auth/src/platform/deployment.ts b/packages/auth/src/platform/deployment.ts new file mode 100644 index 000000000..706c18d72 --- /dev/null +++ b/packages/auth/src/platform/deployment.ts @@ -0,0 +1,58 @@ +/** + * Deployment side of the handshake. + * + * The deployment presents evidence rather than being looked up, so a verifier + * needs only public endpoints to check it — no read access to the platform's + * eVault, which is the access it is trying to obtain in the first place. + */ + +import { challengePayload } from "./chain.js"; +import { signP256 } from "./p256.js"; +import type { + DeploymentEvidence, + HandshakeChallenge, + HandshakeResponse, +} from "./types.js"; + +export interface DeploymentIdentity { + evidence: DeploymentEvidence; + /** PKCS#8 base64. The only secret in the whole exchange. */ + privateKey: string; +} + +export async function answerChallenge( + identity: DeploymentIdentity, + challenge: HandshakeChallenge, +): Promise { + const signature = await signP256( + identity.privateKey, + challengePayload(challenge, identity.evidence.deploymentEname), + ); + return { challenge, evidence: identity.evidence, signature }; +} + +/** Fetches a challenge, answers it, and returns whatever the verifier decided. */ +export async function authenticate( + identity: DeploymentIdentity, + verifierBaseUrl: string, + fetchImpl: typeof fetch = fetch, +): Promise { + const challengeResponse = await fetchImpl( + new URL("/pp-auth/challenge", verifierBaseUrl).toString(), + { method: "POST" }, + ); + if (!challengeResponse.ok) { + throw new Error(`challenge request failed: ${challengeResponse.status}`); + } + const challenge = (await challengeResponse.json()) as HandshakeChallenge; + const answer = await answerChallenge(identity, challenge); + const verified = await fetchImpl( + new URL("/pp-auth/verify", verifierBaseUrl).toString(), + { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify(answer), + }, + ); + return verified.json(); +} diff --git a/packages/auth/src/platform/handshake.ts b/packages/auth/src/platform/handshake.ts new file mode 100644 index 000000000..6daf9d1ef --- /dev/null +++ b/packages/auth/src/platform/handshake.ts @@ -0,0 +1,84 @@ +/** + * Verifier side of the handshake. + * + * A challenge is single-use and short-lived: it is deleted the moment it is + * answered, so a captured response cannot be replayed even inside its window. + */ + +import { randomUUID } from "node:crypto"; +import { verifyDeploymentChain, type ChainOptions } from "./chain.js"; +import type { ChainResult, HandshakeChallenge, HandshakeResponse } from "./types.js"; + +const DEFAULT_TTL_MS = 2 * 60_000; + +export interface ChallengeStore { + issue(audience: string): HandshakeChallenge; + /** Returns true once per challenge; false if unknown, expired or already spent. */ + redeem(nonce: string): boolean; +} + +export function createChallengeStore( + ttlMs = DEFAULT_TTL_MS, + now: () => number = Date.now, +): ChallengeStore { + const issued = new Map(); + + function sweep(): void { + const cutoff = now(); + for (const [nonce, expiresAt] of issued) { + if (expiresAt <= cutoff) issued.delete(nonce); + } + } + + return { + issue(audience) { + sweep(); + const at = now(); + const nonce = randomUUID(); + issued.set(nonce, at + ttlMs); + return { + nonce, + audience, + issuedAt: new Date(at).toISOString(), + expiresAt: new Date(at + ttlMs).toISOString(), + }; + }, + redeem(nonce) { + sweep(); + return issued.delete(nonce); + }, + }; +} + +export interface HandshakeOptions extends ChainOptions { + store: ChallengeStore; +} + +/** + * Redeems the challenge and verifies the chain behind the response. The + * challenge is spent whether or not the chain holds, so a failed attempt + * cannot be retried against the same nonce. + */ +export async function verifyHandshake( + response: HandshakeResponse, + options: HandshakeOptions, +): Promise { + if (!options.store.redeem(response.challenge.nonce)) { + return { + ok: false, + links: [ + { + id: "possession", + title: "Deployment holds its key", + proves: + "the caller is this deployment, not someone replaying its public records", + ok: false, + detail: "The challenge was unknown, expired or already answered.", + }, + ], + claim: null, + failedAt: "possession", + }; + } + return verifyDeploymentChain(response, options); +} diff --git a/packages/auth/src/platform/index.ts b/packages/auth/src/platform/index.ts new file mode 100644 index 000000000..99ac13b1f --- /dev/null +++ b/packages/auth/src/platform/index.ts @@ -0,0 +1,55 @@ +export { + bindingDocumentHash, + decodeBase58, + decodePublicKey, + derSignatureToRaw, + encodeBase58, + sha256Base64Url, + signatureCandidates, + stableStringify, +} from "./bytes.js"; +export { generateKeyPair, signP256, verifyP256 } from "./p256.js"; +export type { P256KeyPair } from "./p256.js"; +export { + challengePayload, + softwareVersionEName, + verifyDeploymentChain, +} from "./chain.js"; +export type { ChainOptions, WalletVerifier } from "./chain.js"; +export { createChallengeStore, verifyHandshake } from "./handshake.js"; +export type { ChallengeStore, HandshakeOptions } from "./handshake.js"; +export { answerChallenge, authenticate } from "./deployment.js"; +export type { DeploymentIdentity } from "./deployment.js"; +export { + accessPolicyPayload, + defaultAccessPolicy, + parseAccessPolicy, + POLICY_TYPE, + verifyAccessPolicy, +} from "./policy.js"; +export type { AccessPolicyStatement, SignedAccessPolicy } from "./policy.js"; +export { authorize, permittedDomains } from "./authorize.js"; +export type { + AuthorizationDecision, + AuthorizationRequest, + DenialCode, + ReputationReading, +} from "./authorize.js"; +export { + CERTIFICATION_LEVELS, + levelRank, +} from "./types.js"; +export type { + BindingDocument, + BindingDocumentSignature, + CertificationLevel, + ChainResult, + DeploymentEvidence, + HandshakeChallenge, + HandshakeResponse, + LinkId, + LinkResult, + PlatformClaim, + SubmissionProof, + SubmissionStatement, +} from "./types.js"; diff --git a/packages/auth/src/platform/p256.ts b/packages/auth/src/platform/p256.ts new file mode 100644 index 000000000..4eaa38e93 --- /dev/null +++ b/packages/auth/src/platform/p256.ts @@ -0,0 +1,99 @@ +/** + * P-256 signing and verification over the encodings this system actually uses. + */ + +import { + decodePublicKey, + derSignatureToRaw, + encodeBase58, + signatureCandidates, + toArrayBuffer, +} from "./bytes.js"; + +const ALGORITHM = { name: "ECDSA", namedCurve: "P-256" } as const; +const SIGN_PARAMS = { name: "ECDSA", hash: "SHA-256" } as const; + +async function importPublicKey(publicKey: string): Promise { + const bytes = decodePublicKey(publicKey); + // An uncompressed EC point starts with 0x04 and is 65 bytes; anything else + // we treat as a SubjectPublicKeyInfo wrapper. + const format = bytes.length === 65 && bytes[0] === 0x04 ? "raw" : "spki"; + return crypto.subtle.importKey( + format, + toArrayBuffer(bytes), + ALGORITHM, + false, + ["verify"], + ); +} + +/** + * Verifies `signature` over `payload`. Tries each encoding the signature could + * have been written in and returns true if any verifies, so a legitimate + * signature is never rejected for being base58 rather than base64url. + */ +export async function verifyP256( + publicKey: string, + signature: string, + payload: string, +): Promise { + let key: CryptoKey; + try { + key = await importPublicKey(publicKey); + } catch { + return false; + } + const encoded = toArrayBuffer(new TextEncoder().encode(payload)); + for (const candidate of signatureCandidates(signature)) { + try { + const raw = derSignatureToRaw(candidate); + if (await crypto.subtle.verify(SIGN_PARAMS, key, toArrayBuffer(raw), encoded)) { + return true; + } + } catch { + // Try the next supported encoding. + } + } + return false; +} + +export interface P256KeyPair { + /** Multibase (`z` + base58) uncompressed point, as binding documents carry it. */ + publicKey: string; + /** PKCS#8 private key, base64. Never leaves the deployment that generated it. */ + privateKey: string; +} + +export async function generateKeyPair(): Promise { + const pair = await crypto.subtle.generateKey(ALGORITHM, true, [ + "sign", + "verify", + ]); + const raw = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey)); + const pkcs8 = new Uint8Array( + await crypto.subtle.exportKey("pkcs8", pair.privateKey), + ); + return { + publicKey: `z${encodeBase58(raw)}`, + privateKey: Buffer.from(pkcs8).toString("base64"), + }; +} + +export async function signP256( + privateKey: string, + payload: string, +): Promise { + const key = await crypto.subtle.importKey( + "pkcs8", + toArrayBuffer(Uint8Array.from(Buffer.from(privateKey, "base64"))), + ALGORITHM, + false, + ["sign"], + ); + const signature = await crypto.subtle.sign( + SIGN_PARAMS, + key, + toArrayBuffer(new TextEncoder().encode(payload)), + ); + return Buffer.from(new Uint8Array(signature)).toString("base64url"); +} diff --git a/packages/auth/src/platform/policy.ts b/packages/auth/src/platform/policy.ts new file mode 100644 index 000000000..bc66e2b2d --- /dev/null +++ b/packages/auth/src/platform/policy.ts @@ -0,0 +1,131 @@ +/** + * The terms an eVault owner sets for platforms that want to reach their data. + * + * Certification is a trust statement, not a permission: the association says + * what a release was found to be, and the owner decides what that is worth to + * them. This is where the owner's half is written down — the level they insist + * on, whose reputation scores they will accept, and any domain they refuse + * outright no matter what the certificate says. + * + * It is a signed statement rather than a setting so it travels with the owner + * and can be checked by anyone: an eVault, a platform deciding whether to + * bother asking, or the owner themselves auditing what they agreed to. + */ + +import { sha256Base64Url, stableStringify } from "./bytes.js"; +import { CERTIFICATION_LEVELS, type CertificationLevel } from "./types.js"; + +const POLICY_PREFIX = "w3ds:access-policy:v1:"; +export const POLICY_TYPE = "w3ds.evault.access-policy"; + +export interface AccessPolicyStatement { + type: typeof POLICY_TYPE; + schemaVersion: 1; + /** eName of the vault owner these terms belong to. */ + subject: string; + /** The weakest certification the owner will deal with. */ + minimumLevel: CertificationLevel; + /** + * eName or URL of the reputation service whose scores the owner accepts. + * Empty means the owner does not weigh reputation at all. + */ + reputationEngine: string; + /** Score that engine must report, on its own scale. Null when unused. */ + minimumReputation: number | null; + /** + * Domains the owner permits. Null means "whatever the certificate grants", + * which is the ordinary case; a list narrows that further. + */ + allowedDomains: string[] | null; + /** Domains refused outright, overriding both of the above. */ + deniedDomains: string[]; + issuedAt: string; + nonce: string; +} + +export interface SignedAccessPolicy { + statement: AccessPolicyStatement; + /** What was signed: the prefix plus a digest of the canonical statement. */ + payload: string; + signature: string; + signer: string; +} + +export function accessPolicyPayload(statement: AccessPolicyStatement): string { + return POLICY_PREFIX + sha256Base64Url(stableStringify(statement)); +} + +/** The terms that apply when an owner has never set any. */ +export function defaultAccessPolicy(subject: string): AccessPolicyStatement { + return { + type: POLICY_TYPE, + schemaVersion: 1, + subject, + // L2 is the lowest level the framework issues to a release whose + // responsible actors are identified at all, so it is the natural floor + // for a vault that has expressed no preference. + minimumLevel: "L2", + reputationEngine: "", + minimumReputation: null, + allowedDomains: null, + deniedDomains: [], + issuedAt: new Date(0).toISOString(), + nonce: "default", + }; +} + +export function parseAccessPolicy(value: unknown): AccessPolicyStatement | null { + if (!value || typeof value !== "object") return null; + const raw = value as Record; + const level = String(raw.minimumLevel ?? "") as CertificationLevel; + if ( + raw.type !== POLICY_TYPE || + raw.schemaVersion !== 1 || + typeof raw.subject !== "string" || + !raw.subject.startsWith("@") || + !CERTIFICATION_LEVELS.includes(level) + ) { + return null; + } + const strings = (input: unknown): string[] => + Array.isArray(input) + ? input.filter((item): item is string => typeof item === "string") + : []; + return { + type: POLICY_TYPE, + schemaVersion: 1, + subject: raw.subject, + minimumLevel: level, + reputationEngine: + typeof raw.reputationEngine === "string" ? raw.reputationEngine : "", + minimumReputation: + typeof raw.minimumReputation === "number" ? raw.minimumReputation : null, + allowedDomains: + raw.allowedDomains === null || raw.allowedDomains === undefined + ? null + : strings(raw.allowedDomains), + deniedDomains: strings(raw.deniedDomains), + issuedAt: typeof raw.issuedAt === "string" ? raw.issuedAt : "", + nonce: typeof raw.nonce === "string" ? raw.nonce : "", + }; +} + +/** + * Checks that the policy was signed by the owner it claims to bind. The signer + * must be the subject: a policy signed by anyone else is somebody setting terms + * on a vault that is not theirs. + */ +export async function verifyAccessPolicy( + signed: SignedAccessPolicy, + verifyWalletSignature: ( + signer: string, + signature: string, + payload: string, + ) => Promise, +): Promise { + const statement = parseAccessPolicy(signed.statement); + if (!statement) return false; + if (signed.signer !== statement.subject) return false; + if (signed.payload !== accessPolicyPayload(statement)) return false; + return verifyWalletSignature(signed.signer, signed.signature, signed.payload); +} diff --git a/packages/auth/src/platform/scenario.ts b/packages/auth/src/platform/scenario.ts new file mode 100644 index 000000000..e82327f8a --- /dev/null +++ b/packages/auth/src/platform/scenario.ts @@ -0,0 +1,244 @@ +/** + * Builds a complete, self-consistent chain of trust from locally held keys. + * + * This exists so the verifier can be exercised without a wallet, a registry + * and a live association — by the test suite, and by the demonstrator that + * shows the handshake to a person. Everything it produces is genuine: real + * P-256 signatures, real ES256 certificates, verified by exactly the same code + * that verifies production evidence. What differs is the *root*: the keys + * standing in for the deployer's wallet, the registry and the association are + * generated here rather than held by those parties. + * + * So a chain that verifies against these roots proves the verifier works. It + * does not prove anything about the platform — that is what the real roots are + * for. Never configure a production verifier with roots from this module. + */ + +import { randomUUID } from "node:crypto"; +import { SignJWT, exportJWK, generateKeyPair as generateJwkPair } from "jose"; +import type { JWK, KeyLike } from "jose"; +import { bindingDocumentHash, sha256Base64Url } from "./bytes.js"; +import { softwareVersionEName } from "./chain.js"; +import { generateKeyPair, signP256, verifyP256 } from "./p256.js"; +import type { + BindingDocument, + CertificationLevel, + DeploymentEvidence, + SubmissionStatement, +} from "./types.js"; +import type { DeploymentIdentity } from "./deployment.js"; +import type { WalletVerifier } from "./chain.js"; + +const DEPLOYMENT_PREFIX = "gitw3:deployment:v1:"; +const SUBMISSION_PREFIX = "gitw3:ppa:v1:"; + +export interface Signer { + privateKey: KeyLike; + jwks: { keys: JWK[] }; + kid: string; +} + +async function es256Signer(kid: string): Promise { + const { privateKey, publicKey } = await generateJwkPair("ES256", { + extractable: true, + }); + const jwk = await exportJWK(publicKey); + return { + privateKey, + kid, + jwks: { keys: [{ ...jwk, kid, alg: "ES256", use: "sig" }] }, + }; +} + +/** + * The three parties a real chain roots in. In production these are the eID + * wallet, the registry and the association; here they are local keys. + */ +export interface TrustRoots { + /** Stands in for the deployer's and author's wallets. */ + wallet: { publicKey: string; privateKey: string; ename: string }; + registry: Signer; + association: Signer; + /** Verifies wallet signatures against the local wallet key. */ + verifyWalletSignature: WalletVerifier; +} + +export async function createTrustRoots( + walletEname = `@${randomUUID()}`, +): Promise { + const wallet = await generateKeyPair(); + const [registry, association] = await Promise.all([ + es256Signer("demo-registry-key-1"), + es256Signer("demo-association-key-1"), + ]); + return { + wallet: { ...wallet, ename: walletEname }, + registry, + association, + verifyWalletSignature: async (signer, signature, payload) => + signer === walletEname && + (await verifyP256(wallet.publicKey, signature, payload)), + }; +} + +export interface DeploymentSpec { + platformEname: string; + platformName: string; + deploymentName: string; + environment: string; + version: string; + releaseTag: string; + commitSha: string; + repository: string; + /** Domains the release asked the association for. */ + requestedDomains: string[]; + /** Domains the association actually granted. Defaults to what was requested. */ + grantedDomains?: string[]; + level: CertificationLevel; + issuerJwksUri: string; + registryJwksUri: string; + reviewedByEName?: string; + decision?: "granted" | "denied"; +} + +export interface MintedDeployment { + identity: DeploymentIdentity; + /** The bundle payload both documents were signed over, for display. */ + signedPayload: string; +} + +/** Produces a deployment whose every link verifies against `roots`. */ +export async function mintDeployment( + roots: TrustRoots, + spec: DeploymentSpec, +): Promise { + const key = await generateKeyPair(); + const deploymentEname = `@${randomUUID()}`; + const versionEname = softwareVersionEName(spec.platformEname, spec.version); + const now = new Date(); + const timestamp = now.toISOString(); + + const keyDocCore = { + subject: deploymentEname, + type: "deployment_key", + data: { + kind: "deployment_key", + deploymentName: spec.deploymentName, + environment: spec.environment, + deployerEname: roots.wallet.ename, + platformEname: spec.platformEname, + publicKey: key.publicKey, + algorithm: "ECDSA_P256", + }, + }; + const versionDocCore = { + subject: versionEname, + type: "software_version", + data: { + kind: "software_version", + platformEname: spec.platformEname, + versionEname, + version: spec.version, + releaseTag: spec.releaseTag, + commitSha: spec.commitSha, + }, + }; + + // One signature covers both documents, which is what stops either being + // swapped independently of the other. + const signedPayload = JSON.stringify({ + type: "deployment_attestation_bundle", + version: 1, + documents: [keyDocCore, versionDocCore].map((doc) => ({ + hash: bindingDocumentHash(doc), + subject: doc.subject, + type: doc.type, + })), + }); + const bundleSignature = await signP256( + roots.wallet.privateKey, + `${DEPLOYMENT_PREFIX}${sha256Base64Url(signedPayload)}`, + ); + const signature = { + signer: roots.wallet.ename, + signature: bundleSignature, + timestamp, + scope: "bundle" as const, + signedPayload, + }; + const deploymentKeyDocument: BindingDocument = { + ...keyDocCore, + signatures: [signature], + }; + const softwareVersionDocument: BindingDocument = { + ...versionDocCore, + signatures: [signature], + }; + + const statement: SubmissionStatement = { + type: "w3ds.ppa.release-submission", + schemaVersion: 1, + repositoryId: 1, + repository: spec.repository, + platformEName: spec.platformEname, + platformName: spec.platformName, + releaseTag: spec.releaseTag, + version: spec.version, + manifestCommitId: spec.commitSha, + domains: spec.requestedDomains, + signerEName: roots.wallet.ename, + issuedAt: timestamp, + nonce: randomUUID(), + }; + const payload = SUBMISSION_PREFIX + sha256Base64Url(JSON.stringify(statement)); + const keyBindingCertificate = await new SignJWT({ + ename: roots.wallet.ename, + publicKey: roots.wallet.publicKey, + }) + .setProtectedHeader({ alg: "ES256", kid: roots.registry.kid }) + .setIssuedAt(now) + .setExpirationTime("15m") + .sign(roots.registry.privateKey); + + const grantedDomains = spec.grantedDomains ?? spec.requestedDomains; + const accreditationJws = await new SignJWT({ + decision: spec.decision ?? "granted", + level: spec.level, + domains: grantedDomains, + platformName: spec.platformName, + platformVersion: spec.version, + reviewedBy: spec.reviewedByEName ?? roots.wallet.ename, + }) + .setProtectedHeader({ alg: "ES256", kid: roots.association.kid }) + .setSubject(spec.platformEname) + .setJti(randomUUID()) + .setIssuedAt(now) + .sign(roots.association.privateKey); + + const evidence: DeploymentEvidence = { + deploymentEname, + deploymentName: spec.deploymentName, + environment: spec.environment, + deployerEname: roots.wallet.ename, + platformEname: spec.platformEname, + versionEname, + version: spec.version, + releaseTag: spec.releaseTag, + commitSha: spec.commitSha, + publicKey: key.publicKey, + deploymentKeyDocument, + softwareVersionDocument, + accreditationJws, + issuerJwksUri: spec.issuerJwksUri, + submissionProof: { + statement, + payload, + signature: await signP256(roots.wallet.privateKey, payload), + publicKey: roots.wallet.publicKey, + keyBindingCertificate, + verifiedAt: timestamp, + }, + }; + + return { identity: { evidence, privateKey: key.privateKey }, signedPayload }; +} diff --git a/packages/auth/src/platform/types.ts b/packages/auth/src/platform/types.ts new file mode 100644 index 000000000..2e3ed68e1 --- /dev/null +++ b/packages/auth/src/platform/types.ts @@ -0,0 +1,122 @@ +/** The shapes a deployment presents and a verifier resolves. */ + +export const CERTIFICATION_LEVELS = ["L0", "L1", "L2", "L3", "L4", "L5"] as const; +export type CertificationLevel = (typeof CERTIFICATION_LEVELS)[number]; + +export function levelRank(level: CertificationLevel): number { + return CERTIFICATION_LEVELS.indexOf(level); +} + +export interface BindingDocumentSignature { + signer: string; + signature: string; + timestamp: string; + scope?: "document" | "bundle"; + signedPayload?: string; +} + +export interface BindingDocument { + subject: string; + type: string; + data: Record; + signatures: BindingDocumentSignature[]; +} + +/** The release statement a platform signed when it applied to the association. */ +export interface SubmissionStatement { + type: string; + schemaVersion: number; + repositoryId: number; + repository: string; + platformEName: string; + platformName: string; + releaseTag: string; + version: string; + manifestCommitId: string; + domains: string[]; + signerEName: string; + issuedAt: string; + nonce: string; + [key: string]: unknown; +} + +export interface SubmissionProof { + statement: SubmissionStatement; + payload: string; + signature: string; + publicKey: string; + keyBindingCertificate: string; + verifiedAt: string; +} + +/** What a deployment sends. Everything here is public; none of it is a secret. */ +export interface DeploymentEvidence { + deploymentEname: string; + deploymentName: string; + environment: string; + deployerEname: string; + platformEname: string; + versionEname: string; + version: string; + releaseTag: string; + commitSha: string; + /** The deployment's own public key — the half of the pair it proves possession of. */ + publicKey: string; + deploymentKeyDocument: BindingDocument; + softwareVersionDocument: BindingDocument; + /** Compact ES256 JWS issued by the association over the certification decision. */ + accreditationJws: string; + issuerJwksUri: string; + submissionProof: SubmissionProof; +} + +export interface HandshakeChallenge { + nonce: string; + audience: string; + issuedAt: string; + expiresAt: string; +} + +export interface HandshakeResponse { + challenge: HandshakeChallenge; + evidence: DeploymentEvidence; + /** Signature by the deployment key over the canonical challenge payload. */ + signature: string; +} + +export type LinkId = + | "possession" + | "deployment-authorised" + | "bundle-integrity" + | "version-identity" + | "release-authorship" + | "accreditation"; + +export interface LinkResult { + id: LinkId; + title: string; + /** What this link proves when it holds — shown to a human reading the trace. */ + proves: string; + ok: boolean; + detail: string; +} + +export interface PlatformClaim { + platformEname: string; + platformName: string; + deploymentEname: string; + version: string; + level: CertificationLevel; + /** Domains the association certified, intersected with what the release asked for. */ + domains: string[]; + deployerEname: string; + reviewedByEName: string; +} + +export interface ChainResult { + ok: boolean; + links: LinkResult[]; + claim: PlatformClaim | null; + /** Set when the chain fails: the first link that did not hold. */ + failedAt: LinkId | null; +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 28c9e5419..b473fecb1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -765,6 +765,9 @@ importers: packages/auth: dependencies: + jose: + specifier: ^5.2.2 + version: 5.10.0 jsonwebtoken: specifier: ^9.0.2 version: 9.0.3 @@ -787,6 +790,9 @@ importers: typescript: specifier: ~5.6.2 version: 5.6.3 + vitest: + specifier: ^3.2.4 + version: 3.2.4(@types/debug@4.1.12)(@types/node@20.19.26)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@19.0.0(bufferutil@4.1.0))(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) packages/eslint-config: devDependencies: From 07627a5897511eba3ad174b0cabbdaf9b54febf9 Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 17:44:45 +0800 Subject: [PATCH 02/18] feat: let a vault owner sign the terms platforms must meet Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- services/ontology/schemas/accessPolicy.json | 72 +++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 services/ontology/schemas/accessPolicy.json diff --git a/services/ontology/schemas/accessPolicy.json b/services/ontology/schemas/accessPolicy.json new file mode 100644 index 000000000..7141bce3e --- /dev/null +++ b/services/ontology/schemas/accessPolicy.json @@ -0,0 +1,72 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "schemaId": "c7a41f6d-95b8-4e2a-9c33-8f0d1b6e4a72", + "title": "Access Policy", + "domain": "governance", + "type": "object", + "description": "The terms an eVault owner sets for platforms that want to reach their data. Certification says what a platform was found to be; this says what the owner will deal with. It is a signed statement rather than a stored setting, so it travels with the owner and can be checked by anyone — the eVault enforcing it, a platform deciding whether it is worth asking, or the owner auditing what they agreed to. The newest statement for a subject is the one in force. It can only narrow what a certificate grants, never widen it: a platform certified for social data cannot reach finance data because an owner permitted finance.", + "properties": { + "subject": { + "type": "string", + "pattern": "^@[^\\s]+$", + "description": "eName of the vault owner these terms bind. The signature must be theirs: a policy signed by anyone else is someone setting terms on a vault that is not theirs." + }, + "minimumLevel": { + "type": "string", + "enum": ["L0", "L1", "L2", "L3", "L4", "L5"], + "description": "The weakest certification level the owner will deal with. A platform certified below this is refused whatever domains its certificate names." + }, + "reputationEngine": { + "type": "string", + "description": "eName or URL of the reputation service whose scores the owner accepts. Empty when the owner does not weigh reputation, in which case no score is consulted and none can refuse a platform." + }, + "minimumReputation": { + "type": ["number", "null"], + "description": "Score that engine must report for the platform, on the engine's own scale. Null when the owner sets no threshold." + }, + "allowedDomains": { + "type": ["array", "null"], + "uniqueItems": true, + "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" }, + "description": "Domains the owner permits. Null means whatever the certificate grants, which is the ordinary case; a list narrows that further." + }, + "deniedDomains": { + "type": "array", + "uniqueItems": true, + "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" }, + "description": "Domains refused outright, overriding both the certificate and the allow list." + }, + "payload": { + "type": "string", + "minLength": 1, + "description": "What was signed: the prefix `w3ds:access-policy:v1:` followed by the base64url SHA-256 of the canonical statement." + }, + "signature": { + "type": "string", + "minLength": 1, + "description": "The owner's wallet signature over `payload`." + }, + "issuedAt": { + "type": "string", + "format": "date-time" + }, + "nonce": { + "type": "string", + "minLength": 1, + "description": "Makes each statement distinct, so re-signing the same terms produces a new record rather than a duplicate." + } + }, + "required": [ + "subject", + "minimumLevel", + "reputationEngine", + "minimumReputation", + "allowedDomains", + "deniedDomains", + "payload", + "signature", + "issuedAt", + "nonce" + ], + "additionalProperties": false +} From ed5acc61e56f1b24d26902e93a42185bce38be09 Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 17:44:46 +0800 Subject: [PATCH 03/18] feat: demonstrate domain separation across two deployments Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- pnpm-lock.yaml | 188 +++++++++++--- services/pp-auth-demo/package.json | 31 +++ services/pp-auth-demo/src/app.css | 135 ++++++++++ services/pp-auth-demo/src/app.d.ts | 10 + services/pp-auth-demo/src/app.html | 19 ++ .../pp-auth-demo/src/lib/ChainTrace.svelte | 35 +++ .../src/lib/DeploymentPanel.svelte | 218 ++++++++++++++++ .../pp-auth-demo/src/lib/OwnerTerms.svelte | 181 +++++++++++++ services/pp-auth-demo/src/lib/domains.ts | 14 + .../pp-auth-demo/src/lib/server/access.ts | 108 ++++++++ services/pp-auth-demo/src/lib/server/world.ts | 245 ++++++++++++++++++ .../pp-auth-demo/src/routes/+layout.svelte | 28 ++ .../pp-auth-demo/src/routes/+page.server.ts | 44 ++++ services/pp-auth-demo/src/routes/+page.svelte | 127 +++++++++ .../src/routes/api/access/+server.ts | 30 +++ .../src/routes/api/handshake/+server.ts | 28 ++ .../src/routes/api/policy/+server.ts | 58 +++++ .../src/routes/api/reset/+server.ts | 8 + .../src/routes/api/tamper/+server.ts | 90 +++++++ services/pp-auth-demo/svelte.config.js | 14 + services/pp-auth-demo/tsconfig.json | 14 + services/pp-auth-demo/vite.config.ts | 7 + 22 files changed, 1591 insertions(+), 41 deletions(-) create mode 100644 services/pp-auth-demo/package.json create mode 100644 services/pp-auth-demo/src/app.css create mode 100644 services/pp-auth-demo/src/app.d.ts create mode 100644 services/pp-auth-demo/src/app.html create mode 100644 services/pp-auth-demo/src/lib/ChainTrace.svelte create mode 100644 services/pp-auth-demo/src/lib/DeploymentPanel.svelte create mode 100644 services/pp-auth-demo/src/lib/OwnerTerms.svelte create mode 100644 services/pp-auth-demo/src/lib/domains.ts create mode 100644 services/pp-auth-demo/src/lib/server/access.ts create mode 100644 services/pp-auth-demo/src/lib/server/world.ts create mode 100644 services/pp-auth-demo/src/routes/+layout.svelte create mode 100644 services/pp-auth-demo/src/routes/+page.server.ts create mode 100644 services/pp-auth-demo/src/routes/+page.svelte create mode 100644 services/pp-auth-demo/src/routes/api/access/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/handshake/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/policy/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/reset/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/tamper/+server.ts create mode 100644 services/pp-auth-demo/svelte.config.js create mode 100644 services/pp-auth-demo/tsconfig.json create mode 100644 services/pp-auth-demo/vite.config.ts diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b473fecb1..4152b0ce9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -3278,7 +3278,7 @@ importers: version: 1.1.1(@types/react-dom@18.3.7(@types/react@18.3.27))(@types/react@18.3.27)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) draft-js: specifier: ^0.11.7 - version: 0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + version: 0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) lucide-react: specifier: ^0.561.0 version: 0.561.0(react@18.3.1) @@ -3299,7 +3299,7 @@ importers: version: 18.3.1(react@18.3.1) react-draft-wysiwyg: specifier: ^1.15.0 - version: 1.15.0(draft-js@0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + version: 1.15.0(draft-js@0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) react-hook-form: specifier: ^7.55.0 version: 7.71.2(react@18.3.1) @@ -4087,6 +4087,49 @@ importers: specifier: ^3.0.2 version: 3.1.14 + services/pp-auth-demo: + dependencies: + '@metastate-foundation/auth': + specifier: workspace:* + version: link:../../packages/auth + jose: + specifier: ^5.2.2 + version: 5.10.0 + devDependencies: + '@sveltejs/adapter-node': + specifier: ^5.2.12 + version: 5.5.4(@sveltejs/kit@2.55.0(@opentelemetry/api@1.9.0)(@sveltejs/vite-plugin-svelte@5.1.1(svelte@5.53.11)(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)))(svelte@5.53.11)(typescript@5.9.3)(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))) + '@sveltejs/kit': + specifier: ^2.16.0 + version: 2.55.0(@opentelemetry/api@1.9.0)(@sveltejs/vite-plugin-svelte@5.1.1(svelte@5.53.11)(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)))(svelte@5.53.11)(typescript@5.9.3)(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)) + '@sveltejs/vite-plugin-svelte': + specifier: ^5.0.0 + version: 5.1.1(svelte@5.53.11)(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)) + '@tailwindcss/vite': + specifier: ^4.0.0 + version: 4.2.1(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)) + '@types/node': + specifier: ^20.11.24 + version: 20.19.26 + svelte: + specifier: ^5.0.0 + version: 5.53.11 + svelte-check: + specifier: ^4.0.0 + version: 4.4.5(picomatch@4.0.3)(svelte@5.53.11)(typescript@5.9.3) + tailwindcss: + specifier: ^4.0.0 + version: 4.2.1 + typescript: + specifier: ^5.0.0 + version: 5.9.3 + vite: + specifier: ^6.2.6 + version: 6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) + vitest: + specifier: ^3.2.4 + version: 3.2.4(@types/debug@4.1.12)(@types/node@20.19.26)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@19.0.0(bufferutil@4.1.0))(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) + services/ppa: dependencies: axios: @@ -30171,26 +30214,6 @@ snapshots: transitivePeerDependencies: - supports-color - '@vitest/browser@3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4)': - dependencies: - '@testing-library/dom': 10.4.1 - '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1) - '@vitest/mocker': 3.2.4(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)) - '@vitest/utils': 3.2.4 - magic-string: 0.30.21 - sirv: 3.0.2 - tinyrainbow: 2.0.0 - vitest: 3.2.4(@types/debug@4.1.12)(@types/node@20.19.26)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@19.0.0(bufferutil@4.1.0))(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) - ws: 8.19.0(bufferutil@4.1.0) - optionalDependencies: - playwright: 1.58.2 - transitivePeerDependencies: - - bufferutil - - msw - - utf-8-validate - - vite - optional: true - '@vitest/browser@3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@6.4.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4)': dependencies: '@testing-library/dom': 10.4.1 @@ -30210,16 +30233,16 @@ snapshots: - utf-8-validate - vite - '@vitest/browser@3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@7.3.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4)': + '@vitest/browser@3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@7.3.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4)': dependencies: '@testing-library/dom': 10.4.1 '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1) - '@vitest/mocker': 3.2.4(vite@7.3.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)) + '@vitest/mocker': 3.2.4(vite@7.3.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2)) '@vitest/utils': 3.2.4 magic-string: 0.30.21 sirv: 3.0.2 tinyrainbow: 2.0.0 - vitest: 3.2.4(@types/debug@4.1.12)(@types/node@22.19.15)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@19.0.0(bufferutil@4.1.0))(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) + vitest: 3.2.4(@types/debug@4.1.12)(@types/node@20.19.26)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@19.0.0(bufferutil@4.1.0))(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) ws: 8.19.0(bufferutil@4.1.0) optionalDependencies: playwright: 1.58.2 @@ -30339,6 +30362,15 @@ snapshots: optionalDependencies: vite: 6.4.1(@types/node@24.12.0)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) + '@vitest/mocker@3.2.4(vite@7.3.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))': + dependencies: + '@vitest/spy': 3.2.4 + estree-walker: 3.0.3 + magic-string: 0.30.21 + optionalDependencies: + vite: 7.3.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2) + optional: true + '@vitest/mocker@3.2.4(vite@7.3.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))': dependencies: '@vitest/spy': 3.2.4 @@ -32810,9 +32842,9 @@ snapshots: dotenv@17.3.1: {} - draft-js@0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + draft-js@0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: - fbjs: 2.0.0 + fbjs: 2.0.0(encoding@0.1.13) immutable: 3.7.6 object-assign: 4.1.1 react: 18.3.1 @@ -32820,9 +32852,9 @@ snapshots: transitivePeerDependencies: - encoding - draftjs-utils@0.10.2(draft-js@0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5): + draftjs-utils@0.10.2(draft-js@0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5): dependencies: - draft-js: 0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + draft-js: 0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) immutable: 5.1.5 drizzle-kit@0.31.9: @@ -33273,8 +33305,8 @@ snapshots: '@typescript-eslint/parser': 5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2) eslint: 9.39.4(jiti@2.6.1) eslint-import-resolver-node: 0.3.9 - eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.6.1)) - eslint-plugin-import: 2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4(jiti@2.6.1)) + eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)) + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)) eslint-plugin-jsx-a11y: 6.10.2(eslint@9.39.4(jiti@2.6.1)) eslint-plugin-react: 7.37.5(eslint@9.39.4(jiti@2.6.1)) eslint-plugin-react-hooks: 5.2.0(eslint@9.39.4(jiti@2.6.1)) @@ -33337,6 +33369,21 @@ snapshots: transitivePeerDependencies: - supports-color + eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)): + dependencies: + '@nolyfill/is-core-module': 1.0.39 + debug: 4.4.3(supports-color@5.5.0) + eslint: 9.39.4(jiti@2.6.1) + get-tsconfig: 4.13.6 + is-bun-module: 2.0.0 + stable-hash: 0.0.5 + tinyglobby: 0.2.15 + unrs-resolver: 1.11.1 + optionalDependencies: + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)) + transitivePeerDependencies: + - supports-color + eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1): dependencies: '@nolyfill/is-core-module': 1.0.39 @@ -33379,6 +33426,17 @@ snapshots: - supports-color eslint-module-utils@2.12.1(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)): + dependencies: + debug: 3.2.7 + optionalDependencies: + '@typescript-eslint/parser': 5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2) + eslint: 9.39.4(jiti@2.6.1) + eslint-import-resolver-node: 0.3.9 + eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)) + transitivePeerDependencies: + - supports-color + + eslint-module-utils@2.12.1(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4(jiti@2.6.1)): dependencies: debug: 3.2.7 optionalDependencies: @@ -33418,7 +33476,7 @@ snapshots: - eslint-import-resolver-webpack - supports-color - eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4(jiti@2.6.1)): + eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)))(eslint@9.39.4(jiti@2.6.1)): dependencies: '@rtsao/scc': 1.1.0 array-includes: 3.1.9 @@ -33447,6 +33505,35 @@ snapshots: - eslint-import-resolver-webpack - supports-color + eslint-plugin-import@2.32.0(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4(jiti@2.6.1)): + dependencies: + '@rtsao/scc': 1.1.0 + array-includes: 3.1.9 + array.prototype.findlastindex: 1.2.6 + array.prototype.flat: 1.3.3 + array.prototype.flatmap: 1.3.3 + debug: 3.2.7 + doctrine: 2.1.0 + eslint: 9.39.4(jiti@2.6.1) + eslint-import-resolver-node: 0.3.9 + eslint-module-utils: 2.12.1(@typescript-eslint/parser@5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4(jiti@2.6.1)) + hasown: 2.0.2 + is-core-module: 2.16.1 + is-glob: 4.0.3 + minimatch: 3.1.5 + object.fromentries: 2.0.8 + object.groupby: 1.0.3 + object.values: 1.2.1 + semver: 6.3.1 + string.prototype.trimend: 1.0.9 + tsconfig-paths: 3.15.0 + optionalDependencies: + '@typescript-eslint/parser': 5.62.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.8.2) + transitivePeerDependencies: + - eslint-import-resolver-typescript + - eslint-import-resolver-webpack + - supports-color + eslint-plugin-jsx-a11y@6.10.2(eslint@8.57.1): dependencies: aria-query: 5.3.2 @@ -34169,7 +34256,7 @@ snapshots: fbjs-css-vars@1.0.2: {} - fbjs@2.0.0: + fbjs@2.0.0(encoding@0.1.13): dependencies: core-js: 3.48.0 cross-fetch: 3.2.0(encoding@0.1.13) @@ -35065,9 +35152,9 @@ snapshots: html-tags@3.3.1: {} - html-to-draftjs@1.5.0(draft-js@0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5): + html-to-draftjs@1.5.0(draft-js@0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5): dependencies: - draft-js: 0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + draft-js: 0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) immutable: 5.1.5 html-url-attributes@3.0.1: {} @@ -39439,12 +39526,12 @@ snapshots: react: 18.3.1 scheduler: 0.23.2 - react-draft-wysiwyg@1.15.0(draft-js@0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + react-draft-wysiwyg@1.15.0(draft-js@0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: classnames: 2.5.1 - draft-js: 0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1) - draftjs-utils: 0.10.2(draft-js@0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5) - html-to-draftjs: 1.5.0(draft-js@0.11.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5) + draft-js: 0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + draftjs-utils: 0.10.2(draft-js@0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5) + html-to-draftjs: 1.5.0(draft-js@0.11.7(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(immutable@5.1.5) immutable: 5.1.5 linkify-it: 2.2.0 prop-types: 15.8.1 @@ -42440,6 +42527,25 @@ snapshots: tsx: 4.21.0 yaml: 2.8.2 + vite@7.3.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2): + dependencies: + esbuild: 0.27.4 + fdir: 6.5.0(picomatch@4.0.3) + picomatch: 4.0.3 + postcss: 8.5.8 + rollup: 4.59.0 + tinyglobby: 0.2.15 + optionalDependencies: + '@types/node': 20.19.26 + fsevents: 2.3.3 + jiti: 2.6.1 + lightningcss: 1.31.1 + sass: 1.98.0 + terser: 5.46.0 + tsx: 4.21.0 + yaml: 2.8.2 + optional: true + vite@7.3.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2): dependencies: esbuild: 0.27.4 @@ -42631,7 +42737,7 @@ snapshots: optionalDependencies: '@types/debug': 4.1.12 '@types/node': 20.19.26 - '@vitest/browser': 3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@6.4.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4) + '@vitest/browser': 3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@7.3.1(@types/node@20.19.26)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4) jsdom: 19.0.0(bufferutil@4.1.0) transitivePeerDependencies: - jiti @@ -42675,7 +42781,7 @@ snapshots: optionalDependencies: '@types/debug': 4.1.12 '@types/node': 22.19.15 - '@vitest/browser': 3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@7.3.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4) + '@vitest/browser': 3.2.4(bufferutil@4.1.0)(playwright@1.58.2)(vite@6.4.1(@types/node@22.19.15)(jiti@2.6.1)(lightningcss@1.31.1)(sass@1.98.0)(terser@5.46.0)(tsx@4.21.0)(yaml@2.8.2))(vitest@3.2.4) jsdom: 19.0.0(bufferutil@4.1.0) transitivePeerDependencies: - jiti diff --git a/services/pp-auth-demo/package.json b/services/pp-auth-demo/package.json new file mode 100644 index 000000000..5459bc5b6 --- /dev/null +++ b/services/pp-auth-demo/package.json @@ -0,0 +1,31 @@ +{ + "name": "pp-auth-demo", + "private": true, + "version": "0.0.1", + "type": "module", + "scripts": { + "dev": "vite dev --host --port 4310 --strictPort", + "build": "vite build", + "preview": "vite preview --port 4310 --strictPort", + "prepare": "svelte-kit sync || echo ''", + "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json", + "test": "vitest run" + }, + "devDependencies": { + "@sveltejs/adapter-node": "^5.2.12", + "@sveltejs/kit": "^2.16.0", + "@sveltejs/vite-plugin-svelte": "^5.0.0", + "@tailwindcss/vite": "^4.0.0", + "@types/node": "^20.11.24", + "svelte": "^5.0.0", + "svelte-check": "^4.0.0", + "tailwindcss": "^4.0.0", + "typescript": "^5.0.0", + "vite": "^6.2.6", + "vitest": "^3.2.4" + }, + "dependencies": { + "@metastate-foundation/auth": "workspace:*", + "jose": "^5.2.2" + } +} diff --git a/services/pp-auth-demo/src/app.css b/services/pp-auth-demo/src/app.css new file mode 100644 index 000000000..60b62eae1 --- /dev/null +++ b/services/pp-auth-demo/src/app.css @@ -0,0 +1,135 @@ +@import "tailwindcss"; + +/** + * Design tokens taken from w3alliance.net: a light, institutional palette on + * white, violet #8869ff as the single accent, deep navy #1d2636 for headings + * and #333 for body copy, Inter throughout, and generously rounded surfaces + * with soft shadows rather than hard borders. + */ +@theme { + --font-sans: "Inter", ui-sans-serif, system-ui, -apple-system, sans-serif; + + --color-canvas: #f6f5fb; + --color-surface: #ffffff; + --color-ink: #1d2636; + --color-body: #333333; + --color-muted: #6b7280; + --color-faint: #9aa1ad; + --color-line: #e9e7f2; + + --color-brand: #8869ff; + --color-brand-strong: #6f4dff; + --color-brand-tint: #ddd3ff; + --color-brand-wash: #f4f1ff; + --color-info: #0099ff; + + --color-positive: #0f9d68; + --color-positive-wash: #e7f6ef; + --color-caution: #b26a00; + --color-caution-wash: #fdf3e3; + --color-negative: #d1443c; + --color-negative-wash: #fdeceb; + + --radius-card: 1.5rem; + --radius-panel: 2rem; + + --shadow-soft: 0 4px 20px rgb(29 38 54 / 0.06); + --shadow-lift: 0 12px 32px rgb(29 38 54 / 0.10); +} + +html { + color-scheme: light; +} + +body { + background: var(--color-canvas); + color: var(--color-body); + -webkit-font-smoothing: antialiased; +} + +@layer components { + .card { + background: var(--color-surface); + border: 1px solid var(--color-line); + border-radius: var(--radius-card); + box-shadow: var(--shadow-soft); + } + + /* Section label above a heading — small, tracked, brand-coloured. */ + .eyebrow { + font-size: 0.6875rem; + font-weight: 600; + letter-spacing: 0.12em; + text-transform: uppercase; + color: var(--color-brand); + } + + .btn { + display: inline-flex; + align-items: center; + justify-content: center; + gap: 0.5rem; + border-radius: 999px; + padding: 0.6875rem 1.375rem; + font-size: 0.875rem; + font-weight: 600; + transition: background-color 0.15s, border-color 0.15s, color 0.15s; + } + + .btn-primary { + background: var(--color-brand); + color: #fff; + } + .btn-primary:hover:not(:disabled) { + background: var(--color-brand-strong); + } + .btn-primary:disabled { + opacity: 0.55; + } + + .btn-quiet { + border: 1px solid var(--color-line); + background: var(--color-surface); + color: var(--color-ink); + } + .btn-quiet:hover { + border-color: var(--color-brand-tint); + color: var(--color-brand); + } + + .pill { + display: inline-flex; + align-items: center; + gap: 0.375rem; + border-radius: 999px; + padding: 0.3125rem 0.75rem; + font-size: 0.75rem; + font-weight: 600; + white-space: nowrap; + } + + .field { + width: 100%; + border: 1px solid var(--color-line); + border-radius: 1rem; + background: var(--color-surface); + padding: 0.75rem 1rem; + font-size: 0.875rem; + color: var(--color-body); + outline: none; + transition: border-color 0.15s, box-shadow 0.15s; + } + .field:focus { + border-color: var(--color-brand); + box-shadow: 0 0 0 4px var(--color-brand-wash); + } + + /* Long opaque strings (eNames, JWS) that must not blow out the layout. */ + .mono-block { + font-family: ui-monospace, "SFMono-Regular", Menlo, monospace; + font-size: 0.75rem; + line-height: 1.5; + overflow-wrap: anywhere; + color: var(--color-muted); + } +} diff --git a/services/pp-auth-demo/src/app.d.ts b/services/pp-auth-demo/src/app.d.ts new file mode 100644 index 000000000..4b0fb361a --- /dev/null +++ b/services/pp-auth-demo/src/app.d.ts @@ -0,0 +1,10 @@ +declare global { + namespace App { + interface Locals { + /** The signed-in PPA admin, or null when unauthenticated. */ + user: { ename: string } | null; + } + } +} + +export {}; diff --git a/services/pp-auth-demo/src/app.html b/services/pp-auth-demo/src/app.html new file mode 100644 index 000000000..37cbac765 --- /dev/null +++ b/services/pp-auth-demo/src/app.html @@ -0,0 +1,19 @@ + + + + + + + + + + PP Auth demonstrator + %sveltekit.head% + + +
%sveltekit.body%
+ + diff --git a/services/pp-auth-demo/src/lib/ChainTrace.svelte b/services/pp-auth-demo/src/lib/ChainTrace.svelte new file mode 100644 index 000000000..19ce5b0d7 --- /dev/null +++ b/services/pp-auth-demo/src/lib/ChainTrace.svelte @@ -0,0 +1,35 @@ + + +{#if chain} +
    + {#each chain.links as link, index (link.id)} +
  1. + + {link.ok ? "✓" : index + 1} + +
    +

    {link.title}

    +

    + {link.ok ? `So we know ${link.proves}.` : link.detail} +

    +
    +
    2. + {/each} +
+{/if} diff --git a/services/pp-auth-demo/src/lib/DeploymentPanel.svelte b/services/pp-auth-demo/src/lib/DeploymentPanel.svelte new file mode 100644 index 000000000..246b15ef0 --- /dev/null +++ b/services/pp-auth-demo/src/lib/DeploymentPanel.svelte @@ -0,0 +1,218 @@ + + +
+
+
+

{deployment.name}

+

{deployment.platformName}

+

{deployment.blurb}

+
+
+ {#each deployment.certifiedDomains as domain (domain)} + {domain} + {/each} +
+
+ + {#if deployment.tampered} +

+ Evidence altered: {deployment.tampered}. Try reaching something and see + which step notices. +

+ {/if} + +
+
Release
+
{deployment.releaseTag}
+
Put here by
+
{deployment.deployerEname}
+
Reputation
+
+ {deployment.reputation === null ? "not scored" : deployment.reputation} +
+
+ +
+

+ Write something into the vault +

+ +
+ {#each domains as domain (domain.id)} + + {/each} +
+
+ + {#if decision} +

+ {decision.reason} +

+ {:else if chain && !chain.ok && lastDomain} +

+ {chain.links.find((link) => !link.ok)?.detail} +

+ {/if} + +
+
+

+ What it proved +

+ +
+ {#if chain} + + {:else} +

+ Nothing checked yet. Reach for something above, or check now. +

+ {/if} +
+ +
+ + Try to cheat + +
+
+ + + +
+
+ + + + + +
+
+
+
diff --git a/services/pp-auth-demo/src/lib/OwnerTerms.svelte b/services/pp-auth-demo/src/lib/OwnerTerms.svelte new file mode 100644 index 000000000..28c480d4b --- /dev/null +++ b/services/pp-auth-demo/src/lib/OwnerTerms.svelte @@ -0,0 +1,181 @@ + + +
+
+

Your terms

+

What you will deal with

+

+ The association says what a platform was found to be. You decide what + that is worth. Your answers are signed, so they travel with you and + anyone can check them — including the platform, before it bothers asking. +

+
+ +
+

+ The least you will accept +

+
+ {#each LEVELS as level (level.id)} + + {/each} +
+
+ +
+
+ + (saved = false)} + placeholder={reputationEngine} + /> +

+ Leave blank to ignore reputation entirely. +

+
+
+ + (saved = false)} + placeholder="No threshold" + /> +
+
+ +
+

+ Things nobody gets, whatever their certificate says +

+
+ {#each domains as domain (domain.id)} + + {/each} +
+
+ +
+ + {#if saved} + Signed and in force. + {/if} +
+ +
+ + The statement you signed + + 
{JSON.stringify(policy, null, 2)}
+

Signature: {signature.signature}

+
+
diff --git a/services/pp-auth-demo/src/lib/domains.ts b/services/pp-auth-demo/src/lib/domains.ts new file mode 100644 index 000000000..be12a3912 --- /dev/null +++ b/services/pp-auth-demo/src/lib/domains.ts @@ -0,0 +1,14 @@ +/** + * The domains this demonstration deals in. + * + * These four ids are taken from the published Domain vocabulary + * (services/ontology/schemas/domain.json), which is what every schema tags + * itself with and what a certificate grants. The full list is twenty; four is + * enough to show separation without turning the page into a wall of buttons. + */ +export const DOMAINS = [ + { id: "social", label: "Social" }, + { id: "communication", label: "Communication" }, + { id: "finance", label: "Finance" }, + { id: "health", label: "Health" }, +] as const; diff --git a/services/pp-auth-demo/src/lib/server/access.ts b/services/pp-auth-demo/src/lib/server/access.ts new file mode 100644 index 000000000..32865ec4e --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/access.ts @@ -0,0 +1,108 @@ +/** + * One request through the whole mechanism: handshake, then the two gates. + * + * Every attempt runs the full handshake rather than caching a session. That is + * slower than a real deployment would be, and deliberate — the point of the + * demonstrator is that you can see the chain re-checked on each attempt and + * watch it fail the moment a link is broken. + */ + +import { + answerChallenge, + authorize, + verifyHandshake, + type AuthorizationDecision, + type ChainResult, +} from "@metastate-foundation/auth/platform"; +import { randomUUID } from "node:crypto"; +import { OWNER_ENAME, REPUTATION_ENGINE, type World } from "./world"; + +export interface AccessOutcome { + chain: ChainResult; + decision: AuthorizationDecision | null; + records: World["records"]; +} + +export async function attemptAccess( + current: World, + deploymentId: string, + domain: string, + write?: { kind: string; body: string }, +): Promise { + const deployment = current.deployments.get(deploymentId); + if (!deployment) throw new Error(`unknown deployment ${deploymentId}`); + + const challenge = current.challenges.issue(OWNER_ENAME); + const response = await answerChallenge(deployment.identity, challenge); + const chain = await verifyHandshake(response, { + audience: OWNER_ENAME, + registryBaseUrl: "demo://registry", + registryJwksUri: "demo://registry/.well-known/jwks.json", + verifyWalletSignature: current.roots.verifyWalletSignature, + resolveJwks: current.resolveJwks, + store: current.challenges, + }); + + if (!chain.ok || !chain.claim) { + record(current, deployment.id, deployment.identity.evidence.deploymentName, domain, { + allowed: false, + code: "handshake-failed", + reason: `Could not establish who this is: ${chain.links.find((link) => !link.ok)?.detail ?? "the chain of trust did not hold"}`, + }); + return { chain, decision: null, records: [] }; + } + + const score = current.reputation.get(chain.claim.platformEname); + const decision = authorize(current.policy.statement, { + claim: chain.claim, + domain, + reputation: + score === undefined ? null : { engine: REPUTATION_ENGINE, score }, + }); + record( + current, + deployment.id, + chain.claim.platformName, + domain, + decision, + ); + + if (!decision.allowed) return { chain, decision, records: [] }; + + if (write) { + current.records.unshift({ + id: randomUUID(), + domain, + kind: write.kind, + body: write.body, + writtenBy: chain.claim.platformName, + at: new Date().toISOString(), + }); + } + + return { + chain, + decision, + records: current.records.filter((entry) => entry.domain === domain), + }; +} + +function record( + current: World, + deploymentId: string, + deploymentName: string, + domain: string, + decision: { allowed: boolean; reason: string; code: string }, +): void { + current.attempts.unshift({ + id: randomUUID(), + at: new Date().toISOString(), + deploymentId, + deploymentName, + domain, + allowed: decision.allowed, + reason: decision.reason, + code: decision.code, + }); + current.attempts.splice(50); +} diff --git a/services/pp-auth-demo/src/lib/server/world.ts b/services/pp-auth-demo/src/lib/server/world.ts new file mode 100644 index 000000000..6a2ea7cb8 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/world.ts @@ -0,0 +1,245 @@ +/** + * The demonstrator's world: two deployments, one vault, one owner. + * + * Everything here is genuine cryptography checked by the real PP Auth + * verifier. What is simulated is the *setting*, not the mechanism: the keys + * standing in for the deployer's wallet, the registry and the association are + * generated in this process rather than held by those parties, so the + * demonstrator can run on a laptop with nothing else switched on. + * + * State is anchored on globalThis because Vite's dev server evaluates a module + * once per import graph, and a world that exists twice would issue challenges + * from one copy and try to redeem them in the other. + */ + +import { + accessPolicyPayload, + createChallengeStore, + defaultAccessPolicy, + generateKeyPair, + signP256, + verifyP256, + type AccessPolicyStatement, + type ChallengeStore, + type DeploymentIdentity, + type SignedAccessPolicy, +} from "@metastate-foundation/auth/platform"; +// Minting evidence from local keys is a demonstration and test facility. It is +// deliberately a separate entry point so it can never be reached by accident +// from code that verifies real deployments. +import { + createTrustRoots, + mintDeployment, + type TrustRoots, +} from "@metastate-foundation/auth/platform/scenario"; +import { createLocalJWKSet } from "jose"; + +/** The person whose eVault the demonstration is about. */ +export const OWNER_ENAME = "@849c0221-6f3f-55f9-95f0-f3b0d2b3092f"; + +export const ISSUER_JWKS_URI = "demo://association/.well-known/jwks.json"; +export const REGISTRY_JWKS_URI = "demo://registry/.well-known/jwks.json"; +export const REPUTATION_ENGINE = "@ereputation.w3ds"; + +export interface VaultRecord { + id: string; + domain: string; + kind: string; + body: string; + writtenBy: string; + at: string; +} + +export interface AttemptLog { + id: string; + at: string; + deploymentId: string; + deploymentName: string; + domain: string; + allowed: boolean; + reason: string; + code: string; +} + +export interface DemoDeployment { + id: string; + /** How the platform describes itself, for the card. */ + blurb: string; + identity: DeploymentIdentity; + /** Set when the operator has tampered with the evidence, so the UI can say so. */ + tampered: string | null; + pristine: DeploymentIdentity; +} + +export interface World { + roots: TrustRoots; + challenges: ChallengeStore; + deployments: Map; + records: VaultRecord[]; + attempts: AttemptLog[]; + policy: SignedAccessPolicy; + ownerKey: { publicKey: string; privateKey: string }; + /** Reputation the demo's engine reports, keyed by platform eName. */ + reputation: Map; + resolveJwks: (uri: string) => ReturnType; +} + +const KEY = Symbol.for("pp-auth-demo.world"); +const store = globalThis as typeof globalThis & { [KEY]?: Promise }; + +const CHATTERBOX = "@11111111-1111-4111-8111-111111111111"; +const LEDGERLY = "@22222222-2222-4222-8222-222222222222"; + +export async function signPolicy( + statement: AccessPolicyStatement, + ownerKey: { privateKey: string }, +): Promise { + const payload = accessPolicyPayload(statement); + return { + statement, + payload, + signature: await signP256(ownerKey.privateKey, payload), + signer: statement.subject, + }; +} + +async function build(): Promise { + const deployerEname = "@d0000000-0000-4000-8000-00000000dep1"; + const roots = await createTrustRoots(deployerEname); + const registryKeys = createLocalJWKSet(roots.registry.jwks); + const associationKeys = createLocalJWKSet(roots.association.jwks); + + const shared = { + issuerJwksUri: ISSUER_JWKS_URI, + registryJwksUri: REGISTRY_JWKS_URI, + reviewedByEName: OWNER_ENAME, + }; + + const [chatterbox, ledgerly] = await Promise.all([ + mintDeployment(roots, { + ...shared, + platformEname: CHATTERBOX, + platformName: "Chatterbox", + deploymentName: "chatterbox-eu", + environment: "production", + version: "1.4.0", + releaseTag: "v1.4.0", + commitSha: "4f9c1a77b2e3d5086a1c9f2b3d4e5f60718293a4", + repository: "https://gitw3.example/acme/chatterbox", + requestedDomains: ["social", "communication"], + level: "L3", + }), + mintDeployment(roots, { + ...shared, + platformEname: LEDGERLY, + platformName: "Ledgerly", + deploymentName: "ledgerly-eu", + environment: "production", + version: "2.1.3", + releaseTag: "v2.1.3", + commitSha: "9b1e2d3c4a5f60718293a4b5c6d7e8f90a1b2c3d", + repository: "https://gitw3.example/acme/ledgerly", + requestedDomains: ["finance"], + level: "L4", + }), + ]); + + const deployments = new Map([ + [ + "chatterbox", + { + id: "chatterbox", + blurb: "A social platform. Posts, feeds, and direct messages.", + identity: chatterbox.identity, + pristine: structuredClone(chatterbox.identity), + tampered: null, + }, + ], + [ + "ledgerly", + { + id: "ledgerly", + blurb: "A finance platform. Accounts, ledgers, and payments.", + identity: ledgerly.identity, + pristine: structuredClone(ledgerly.identity), + tampered: null, + }, + ], + ]); + + const ownerKey = await generateKeyPair(); + const policy = await signPolicy( + { + ...defaultAccessPolicy(OWNER_ENAME), + minimumLevel: "L2", + issuedAt: new Date().toISOString(), + nonce: "initial", + }, + ownerKey, + ); + + return { + roots, + challenges: createChallengeStore(), + deployments, + records: seedRecords(), + attempts: [], + policy, + ownerKey, + reputation: new Map([ + [CHATTERBOX, 62], + [LEDGERLY, 31], + ]), + resolveJwks: (uri) => + uri === ISSUER_JWKS_URI ? associationKeys : registryKeys, + }; +} + +function seedRecords(): VaultRecord[] { + const at = new Date().toISOString(); + return [ + { + id: "seed-social", + domain: "social", + kind: "Social media post", + body: "Spent the morning on the allotment. Tomatoes finally coming through.", + writtenBy: OWNER_ENAME, + at, + }, + { + id: "seed-finance", + domain: "finance", + kind: "Account", + body: "Current account · balance £4,182.60 · sort 04-00-04", + writtenBy: OWNER_ENAME, + at, + }, + { + id: "seed-comms", + domain: "communication", + kind: "Message", + body: "Are we still on for Thursday?", + writtenBy: OWNER_ENAME, + at, + }, + ]; +} + +export function world(): Promise { + if (!store[KEY]) store[KEY] = build(); + return store[KEY]; +} + +/** Verifies a signature made by the demo owner's stand-in wallet. */ +export async function verifyOwnerSignature( + current: World, + signature: string, + payload: string, +): Promise { + return verifyP256(current.ownerKey.publicKey, signature, payload); +} + +export async function resetWorld(): Promise { + store[KEY] = build(); + return store[KEY]; +} diff --git a/services/pp-auth-demo/src/routes/+layout.svelte b/services/pp-auth-demo/src/routes/+layout.svelte new file mode 100644 index 000000000..ff9e9ab80 --- /dev/null +++ b/services/pp-auth-demo/src/routes/+layout.svelte @@ -0,0 +1,28 @@ + + +
+
+
+
+

Post Platforms Association

+

+ How a platform proves what it is +

+
+ + Documentation + +
+
+ +
+ {@render children()} +
+
diff --git a/services/pp-auth-demo/src/routes/+page.server.ts b/services/pp-auth-demo/src/routes/+page.server.ts new file mode 100644 index 000000000..104244342 --- /dev/null +++ b/services/pp-auth-demo/src/routes/+page.server.ts @@ -0,0 +1,44 @@ +import { DOMAINS } from "$lib/domains"; +import { OWNER_ENAME, REPUTATION_ENGINE, world } from "$lib/server/world"; +import type { PageServerLoad } from "./$types"; + +export const load: PageServerLoad = async () => { + const current = await world(); + + const deployments = [...current.deployments.values()].map((deployment) => { + const evidence = deployment.identity.evidence; + return { + id: deployment.id, + blurb: deployment.blurb, + name: evidence.deploymentName, + platformName: evidence.submissionProof.statement.platformName, + platformEname: evidence.platformEname, + deploymentEname: evidence.deploymentEname, + environment: evidence.environment, + version: evidence.version, + releaseTag: evidence.releaseTag, + commitSha: evidence.commitSha, + publicKey: evidence.publicKey, + deployerEname: evidence.deployerEname, + certifiedDomains: evidence.submissionProof.statement.domains, + repository: evidence.submissionProof.statement.repository, + reputation: current.reputation.get(evidence.platformEname) ?? null, + tampered: deployment.tampered, + }; + }); + + return { + owner: OWNER_ENAME, + reputationEngine: REPUTATION_ENGINE, + domains: DOMAINS, + deployments, + policy: current.policy.statement, + policySignature: { + payload: current.policy.payload, + signature: current.policy.signature, + signer: current.policy.signer, + }, + records: current.records, + attempts: current.attempts, + }; +}; diff --git a/services/pp-auth-demo/src/routes/+page.svelte b/services/pp-auth-demo/src/routes/+page.svelte new file mode 100644 index 000000000..c9a3a1284 --- /dev/null +++ b/services/pp-auth-demo/src/routes/+page.svelte @@ -0,0 +1,127 @@ + + +
+
+

The demonstration

+

+ Two platforms want your data. Only one of them should get each thing. +

+

+ Chatterbox is a social platform. Ledgerly handles money. Both are + running, both are certified, and both will now try to reach everything + in your vault — your posts, your messages, your accounts, your health + records. Watch what each one is actually allowed to touch, and why. +

+

+ Nothing here is enforced by a list of platform names. Each one proves, + from scratch on every attempt, which release it is running and what + that release was certified for. A social platform has no way to say + the word “finance”: it is not in its certificate, and nothing it can + present will put it there. +

+ +
+ +
+ {#each data.deployments as deployment, index (deployment.id)} + + {/each} +
+ + {#key data.policy.nonce} + + {/key} + +
+
+
+

Your vault

+

What is in there

+
+
    + {#each data.records as record (record.id)} +
  • +
    + {record.domain} + + {record.writtenBy === data.owner ? "you" : record.writtenBy} + +
    +

    {record.body}

    +
    • + {/each} +
+
+ +
+
+

What happened

+

Every attempt, kept

+
+ {#if data.attempts.length === 0} +

+ Nothing has tried to reach your data yet. +

+ {:else} +
    + {#each data.attempts as attempt (attempt.id)} +
  • + +
    +

    {attempt.reason}

    +

    + {new Date(attempt.at).toLocaleTimeString()} +

    +
    +
    • + {/each} +
+ {/if} +
+
+ +
+

Honesty note

+

+ The signatures on this page are real and are checked by the same code + that checks a live deployment. What is simulated is who holds the + keys: the wallet, the registry and the association are stood in for by + keys generated in this process, so the demonstration runs on its own. + A chain that verifies here proves the mechanism works — not that any + particular platform is trustworthy. +

+
+
diff --git a/services/pp-auth-demo/src/routes/api/access/+server.ts b/services/pp-auth-demo/src/routes/api/access/+server.ts new file mode 100644 index 000000000..850e5575c --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/access/+server.ts @@ -0,0 +1,30 @@ +import { json } from "@sveltejs/kit"; +import { attemptAccess } from "$lib/server/access"; +import { world } from "$lib/server/world"; +import type { RequestHandler } from "./$types"; + +export const POST: RequestHandler = async ({ request }) => { + const body = (await request.json()) as { + deploymentId?: string; + domain?: string; + kind?: string; + text?: string; + }; + const current = await world(); + const text = (body.text ?? "").trim(); + + try { + const outcome = await attemptAccess( + current, + String(body.deploymentId), + String(body.domain), + text ? { kind: body.kind || "Note", body: text } : undefined, + ); + return json(outcome); + } catch (error) { + return json( + { error: error instanceof Error ? error.message : "failed" }, + { status: 400 }, + ); + } +}; diff --git a/services/pp-auth-demo/src/routes/api/handshake/+server.ts b/services/pp-auth-demo/src/routes/api/handshake/+server.ts new file mode 100644 index 000000000..a91e0ba1a --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/handshake/+server.ts @@ -0,0 +1,28 @@ +import { json } from "@sveltejs/kit"; +import { + answerChallenge, + verifyHandshake, +} from "@metastate-foundation/auth/platform"; +import { OWNER_ENAME, world } from "$lib/server/world"; +import type { RequestHandler } from "./$types"; + +/** Runs the handshake alone, so the chain can be inspected without touching data. */ +export const POST: RequestHandler = async ({ request }) => { + const { deploymentId } = (await request.json()) as { deploymentId?: string }; + const current = await world(); + const deployment = current.deployments.get(String(deploymentId)); + if (!deployment) return json({ error: "Unknown deployment" }, { status: 404 }); + + const challenge = current.challenges.issue(OWNER_ENAME); + const response = await answerChallenge(deployment.identity, challenge); + const chain = await verifyHandshake(response, { + audience: OWNER_ENAME, + registryBaseUrl: "demo://registry", + registryJwksUri: "demo://registry/.well-known/jwks.json", + verifyWalletSignature: current.roots.verifyWalletSignature, + resolveJwks: current.resolveJwks, + store: current.challenges, + }); + + return json({ chain, challenge }); +}; diff --git a/services/pp-auth-demo/src/routes/api/policy/+server.ts b/services/pp-auth-demo/src/routes/api/policy/+server.ts new file mode 100644 index 000000000..4104061d0 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/policy/+server.ts @@ -0,0 +1,58 @@ +import { json } from "@sveltejs/kit"; +import { + CERTIFICATION_LEVELS, + defaultAccessPolicy, + verifyAccessPolicy, + type CertificationLevel, +} from "@metastate-foundation/auth/platform"; +import { OWNER_ENAME, signPolicy, verifyOwnerSignature, world } from "$lib/server/world"; +import type { RequestHandler } from "./$types"; + +/** + * Records the owner's terms as a signed statement. + * + * The signature is made here with the owner's stand-in key; in a running + * system this is where the eID wallet signs. It is verified immediately after + * signing, so a statement that could not be checked never becomes the policy. + */ +export const POST: RequestHandler = async ({ request }) => { + const body = (await request.json()) as Record; + const current = await world(); + + const level = String(body.minimumLevel ?? "") as CertificationLevel; + if (!CERTIFICATION_LEVELS.includes(level)) { + return json({ error: "Unknown level" }, { status: 400 }); + } + const strings = (value: unknown): string[] => + Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : []; + const minimumReputation = + body.minimumReputation === null || body.minimumReputation === "" + ? null + : Number(body.minimumReputation); + if (minimumReputation !== null && !Number.isFinite(minimumReputation)) { + return json({ error: "Reputation threshold must be a number" }, { status: 400 }); + } + + const statement = { + ...defaultAccessPolicy(OWNER_ENAME), + minimumLevel: level, + reputationEngine: + typeof body.reputationEngine === "string" ? body.reputationEngine.trim() : "", + minimumReputation, + allowedDomains: body.allowedDomains === null ? null : strings(body.allowedDomains), + deniedDomains: strings(body.deniedDomains), + issuedAt: new Date().toISOString(), + nonce: crypto.randomUUID(), + }; + + const signed = await signPolicy(statement, current.ownerKey); + const valid = await verifyAccessPolicy(signed, (_signer, signature, payload) => + verifyOwnerSignature(current, signature, payload), + ); + if (!valid) { + return json({ error: "The signed terms did not verify" }, { status: 500 }); + } + + current.policy = signed; + return json({ policy: signed.statement, payload: signed.payload, signature: signed.signature }); +}; diff --git a/services/pp-auth-demo/src/routes/api/reset/+server.ts b/services/pp-auth-demo/src/routes/api/reset/+server.ts new file mode 100644 index 000000000..a91debee3 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/reset/+server.ts @@ -0,0 +1,8 @@ +import { json } from "@sveltejs/kit"; +import { resetWorld } from "$lib/server/world"; +import type { RequestHandler } from "./$types"; + +export const POST: RequestHandler = async () => { + await resetWorld(); + return json({ ok: true }); +}; diff --git a/services/pp-auth-demo/src/routes/api/tamper/+server.ts b/services/pp-auth-demo/src/routes/api/tamper/+server.ts new file mode 100644 index 000000000..d437b9a44 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/tamper/+server.ts @@ -0,0 +1,90 @@ +import { json } from "@sveltejs/kit"; +import { resetWorld, world } from "$lib/server/world"; +import type { RequestHandler } from "./$types"; + +/** + * Breaks one link on purpose. + * + * A chain that only ever passes demonstrates nothing. Each of these edits is + * something an attacker would plausibly try — presenting a key you do not + * hold, widening your own authorisation, borrowing a better-certified + * release's paperwork — and each should be caught by exactly one link. + */ +const EDITS: Record< + string, + { label: string; expect: string; apply: (deployment: any, other: any, value: string) => void } +> = { + publicKey: { + label: "Present a different public key", + expect: "possession", + apply: (deployment, _other, value) => { + deployment.identity.evidence.publicKey = value; + deployment.identity.evidence.deploymentKeyDocument.data.publicKey = value; + }, + }, + environment: { + label: "Promote itself from staging to production", + expect: "deployment-authorised", + apply: (deployment, _other, value) => { + deployment.identity.evidence.deploymentKeyDocument.data.environment = + value || "production-plus"; + }, + }, + versionDocument: { + label: "Borrow the other platform's version document", + expect: "bundle-integrity", + apply: (deployment, other) => { + deployment.identity.evidence.softwareVersionDocument = + structuredClone(other.identity.evidence.softwareVersionDocument); + }, + }, + versionEname: { + label: "Point at a different release", + expect: "version-identity", + apply: (deployment, _other, value) => { + deployment.identity.evidence.versionEname = + value || "@99999999-9999-4999-8999-999999999999"; + }, + }, + certificate: { + label: "Borrow the other platform's certificate", + expect: "accreditation", + apply: (deployment, other) => { + deployment.identity.evidence.accreditationJws = + other.identity.evidence.accreditationJws; + }, + }, +}; + +export const POST: RequestHandler = async ({ request }) => { + const { deploymentId, edit, value } = (await request.json()) as { + deploymentId?: string; + edit?: string; + value?: string; + }; + const current = await world(); + const deployment = current.deployments.get(String(deploymentId)); + if (!deployment) return json({ error: "Unknown deployment" }, { status: 404 }); + + if (edit === "restore") { + deployment.identity = structuredClone(deployment.pristine); + deployment.tampered = null; + return json({ tampered: null }); + } + + const change = EDITS[String(edit)]; + if (!change) return json({ error: "Unknown edit" }, { status: 400 }); + + const other = [...current.deployments.values()].find( + (entry) => entry.id !== deployment.id, + ); + change.apply(deployment, other, String(value ?? "")); + deployment.tampered = change.label; + + return json({ tampered: change.label, expect: change.expect }); +}; + +export const DELETE: RequestHandler = async () => { + await resetWorld(); + return json({ ok: true }); +}; diff --git a/services/pp-auth-demo/svelte.config.js b/services/pp-auth-demo/svelte.config.js new file mode 100644 index 000000000..4ca2087b8 --- /dev/null +++ b/services/pp-auth-demo/svelte.config.js @@ -0,0 +1,14 @@ +import adapter from "@sveltejs/adapter-node"; +import { vitePreprocess } from "@sveltejs/vite-plugin-svelte"; + +const config = { + preprocess: vitePreprocess(), + kit: { + adapter: adapter(), + env: { + dir: "../../", + }, + }, +}; + +export default config; diff --git a/services/pp-auth-demo/tsconfig.json b/services/pp-auth-demo/tsconfig.json new file mode 100644 index 000000000..104691d2d --- /dev/null +++ b/services/pp-auth-demo/tsconfig.json @@ -0,0 +1,14 @@ +{ + "extends": "./.svelte-kit/tsconfig.json", + "compilerOptions": { + "allowJs": true, + "checkJs": true, + "esModuleInterop": true, + "forceConsistentCasingInFileNames": true, + "resolveJsonModule": true, + "skipLibCheck": true, + "sourceMap": true, + "strict": true, + "moduleResolution": "bundler" + } +} diff --git a/services/pp-auth-demo/vite.config.ts b/services/pp-auth-demo/vite.config.ts new file mode 100644 index 000000000..deb417265 --- /dev/null +++ b/services/pp-auth-demo/vite.config.ts @@ -0,0 +1,7 @@ +import tailwindcss from "@tailwindcss/vite"; +import { sveltekit } from "@sveltejs/kit/vite"; +import { defineConfig } from "vite"; + +export default defineConfig({ + plugins: [tailwindcss(), sveltekit()], +}); From 8f84cfc4ceeb2deaabc8c788f610016d0e595de3 Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 17:44:46 +0800 Subject: [PATCH 04/18] docs: document platform authentication and owner terms Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- .../pp-auth-demonstrator.md | 46 +++++++ docs/docs/Post Platform Guide/pp-auth.md | 116 ++++++++++++++++++ docs/docs/W3DS Basics/Access-Policy.md | 52 ++++++++ docs/docs/W3DS Basics/Links.md | 2 +- .../W3DS Protocol/Platform-Authentication.md | 85 +++++++++++++ 5 files changed, 300 insertions(+), 1 deletion(-) create mode 100644 docs/docs/Post Platform Guide/pp-auth-demonstrator.md create mode 100644 docs/docs/Post Platform Guide/pp-auth.md create mode 100644 docs/docs/W3DS Basics/Access-Policy.md create mode 100644 docs/docs/W3DS Protocol/Platform-Authentication.md diff --git a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md new file mode 100644 index 000000000..f3d007484 --- /dev/null +++ b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md @@ -0,0 +1,46 @@ +--- +sidebar_position: 9 +--- + +# PP Auth demonstrator + +A running demonstration of platform authentication and domain separation. Two platforms, one vault, and every attempt to reach data shown with the reason it succeeded or failed. + +```bash +pnpm --filter pp-auth-demo dev +``` + +Then open **http://localhost:4310**. Nothing else needs to be running — no database, no registry, no eVault. + +## What it shows + +**Chatterbox** is a social platform, certified L3 for `social` and `communication`. **Ledgerly** handles money, certified L4 for `finance`. Both are live, both will try to reach everything in the vault. + +Point either one at a domain it was not certified for and it is refused — with a sentence saying so, not a status code. The refusal does not come from a list of platform names: it comes from the certificate the deployment presented, which does not name that domain and cannot be made to. + +**Your terms** sets the owner's side: the minimum level, whose reputation scores count and what score they must reach, and any domain refused outright. Signing produces a real signature over a real statement, which is verified before it takes effect. Raise the bar to L4 and Chatterbox stops being allowed anything; require a reputation of 50 and Ledgerly does, on the scores the demo's engine reports. + +**Try to cheat** is where the mechanism is visible. Each edit breaks exactly one link: + +| Edit | Fails at | +|---|---| +| Present a different public key — paste your own | Possession | +| Widen its own authorisation | Deployment authorised | +| Borrow the other platform's version document | Bundle integrity | +| Point at a different release | Version identity | +| Borrow the other platform's certificate | Accreditation | + +The chain trace re-runs on every attempt, so you can watch a link go red and read why. + +## What is real and what is not + +The signatures are real — P-256 and ES256, verified by exactly the same code that verifies a live deployment. The tampering really does fail, for the reason shown. + +What is simulated is who holds the keys. The deployer's wallet, the registry and the association are stood in for by keys generated in the demo process, so it runs on its own. A chain that verifies here proves the mechanism works. It proves nothing about any particular platform, which is what the real roots are for. + +The minting facility lives at `@metastate-foundation/auth/platform/scenario`, deliberately behind a separate entry point so it cannot be reached by accident from code that verifies real deployments. + +## See also + +- [Platform Authentication](/docs/W3DS%20Protocol/Platform-Authentication) +- [Access Policy](/docs/W3DS%20Basics/Access-Policy) diff --git a/docs/docs/Post Platform Guide/pp-auth.md b/docs/docs/Post Platform Guide/pp-auth.md new file mode 100644 index 000000000..7d6ba68a1 --- /dev/null +++ b/docs/docs/Post Platform Guide/pp-auth.md @@ -0,0 +1,116 @@ +--- +sidebar_position: 10 +--- + +# Authenticating your platform + +Your deployment proves which release it is running, and the eVault decides what that release may touch. This page is the integration. + +For the mechanism itself see [Platform Authentication](/docs/W3DS%20Protocol/Platform-Authentication). + +## Install + +```bash +pnpm add @metastate-foundation/auth +``` + +Both halves ship in one package. Deployments import the signer, verifiers import the verifier; nothing stops you doing both, which is what the demonstrator does. + +## What your deployment needs + +GitW3 produces all of it when you deploy a release. None of it is secret except the private key, which never leaves your process. + +```ts +import type { DeploymentIdentity } from "@metastate-foundation/auth/platform"; + +const identity: DeploymentIdentity = { + privateKey: process.env.DEPLOYMENT_PRIVATE_KEY!, // PKCS#8, base64 + evidence: { + deploymentEname, deploymentName, environment, + deployerEname, platformEname, versionEname, + version, releaseTag, commitSha, publicKey, + deploymentKeyDocument, // binding document, bundle-signed + softwareVersionDocument, // binding document, same signature + accreditationJws, // the association's certificate + issuerJwksUri, + submissionProof, // the release proof the association reviewed + }, +}; +``` + +Store the private key the way you store any other deployment secret. If it leaks, the holder can authenticate as your deployment until the deployer revokes the key — it is the whole of the possession proof. + +## Authenticating + +```ts +import { authenticate } from "@metastate-foundation/auth/platform"; + +const result = await authenticate(identity, "https://vault.example"); +``` + +That fetches a challenge, signs it, and posts the answer. If you want the two steps yourself — to add retries, or to talk to something other than HTTP — use `answerChallenge(identity, challenge)` and send the response however you like. + +## Verifying, if you are the eVault + +```ts +import { + createChallengeStore, + verifyHandshake, + authorize, +} from "@metastate-foundation/auth/platform"; + +const challenges = createChallengeStore(); // module scope, not per request + +// POST /pp-auth/challenge +const challenge = challenges.issue(ownerEname); + +// POST /pp-auth/verify +const chain = await verifyHandshake(response, { + audience: ownerEname, + registryBaseUrl: process.env.PUBLIC_REGISTRY_URL!, + store: challenges, +}); + +if (!chain.ok) { + // chain.links carries all six with a plain-English detail on each. + return refuse(chain.links.find((link) => !link.ok)); +} +``` + +`chain.claim` is what you learned: platform, deployment, version, level, and the domains it may use. + +Then the owner's terms, for each record touched: + +```ts +const decision = authorize(policy, { + claim: chain.claim, + domain: schema.domain, // the domain the record's ontology declares + reputation: score ? { engine, score } : null, +}); + +if (!decision.allowed) return refuse(decision.reason); +``` + +`decision.reason` is written to be shown to a person. `decision.code` is for your logs. + +Hold the challenge store at module scope. Issuing from one instance and redeeming in another rejects every legitimate handshake, and under Vite's dev server a module evaluated twice will do exactly that. + +## Injection points + +Three things are injectable, all defaulting to the ordinary behaviour: + +- `verifyWalletSignature` — how a wallet signature is checked. Defaults to `signature-validator` against your registry. +- `resolveJwks` — how a JWKS URI becomes keys. Defaults to a cached remote fetch. Supply your own to pin a key set or to run offline. +- `now` — the clock, for testing time-dependent behaviour. + +## Testing your integration + +`@metastate-foundation/auth/platform/scenario` mints a complete, self-consistent chain from keys it generates, so you can exercise your verifier without a wallet, a registry or a live association: + +```ts +import { createTrustRoots, mintDeployment } from "@metastate-foundation/auth/platform/scenario"; +``` + +Everything it produces is genuinely signed and genuinely verified. What differs is the root: the keys standing in for the deployer, the registry and the association are local. **Never configure a production verifier with roots from this module** — a chain that verifies against them proves your code works, not that a platform is trustworthy. + +The [demonstrator](/docs/Post%20Platform%20Guide/pp-auth-demonstrator) is built on it and is the fastest way to see the whole thing move. diff --git a/docs/docs/W3DS Basics/Access-Policy.md b/docs/docs/W3DS Basics/Access-Policy.md new file mode 100644 index 000000000..62cddef5d --- /dev/null +++ b/docs/docs/W3DS Basics/Access-Policy.md @@ -0,0 +1,52 @@ +--- +sidebar_position: 6 +--- + +# Access Policy + +Certification tells you what a platform was found to be. It does not tell you whether you want to deal with it. That is the eVault owner's decision, and an **access policy** is where they write it down. + +It is a signed statement rather than a stored setting, so it travels with the owner and anyone can check it — the eVault enforcing it, a platform working out whether it is even worth asking, or the owner auditing what they agreed to months later. + +## What an owner sets + +| Term | Meaning | +|---|---| +| `minimumLevel` | The weakest certification level they will deal with. A platform certified below it is refused whatever its certificate grants. | +| `reputationEngine` | Whose reputation scores they accept, as an eName or URL. Blank means reputation is not consulted at all. | +| `minimumReputation` | The score that engine must report for the platform. Null means no threshold. | +| `allowedDomains` | Null means "whatever the certificate grants" — the ordinary case. A list narrows it further. | +| `deniedDomains` | Refused outright, overriding both the certificate and the allow list. | + +Naming the engine matters. A score is only meaningful relative to how it was calculated, so the owner elects which calculation they accept rather than inheriting whichever engine a platform happens to cite. A score from an engine the owner did not name counts as no score at all. + +## A policy can only narrow + +An owner permitting `finance` does not let a social platform reach finance data. The certificate gate runs first and independently: if `finance` is not in what the association granted the release, nothing in the owner's policy can put it there. + +This ordering is the point. The owner's terms are a second lock, not a master key. + +## The statement + +```json +{ + "subject": "@849c0221-6f3f-55f9-95f0-f3b0d2b3092f", + "minimumLevel": "L3", + "reputationEngine": "@ereputation.w3ds", + "minimumReputation": 40, + "allowedDomains": null, + "deniedDomains": ["health"], + "issuedAt": "2026-08-30T16:04:11.230Z", + "nonce": "0f1c…" +} +``` + +Signed by the owner's wallet over `w3ds:access-policy:v1:` + base64url(sha256(canonical statement)). The signer must be the subject: a policy signed by anyone else is somebody setting terms on a vault that is not theirs, and is rejected. + +The newest statement for a subject is the one in force. An owner who has never set one is treated as requiring **L2** — the lowest level the framework issues to a release whose responsible people are identified at all. + +Published as the `Access Policy` ontology (`c7a41f6d-95b8-4e2a-9c33-8f0d1b6e4a72`), domain `governance`. + +## See also + +- [Platform Authentication](/docs/W3DS%20Protocol/Platform-Authentication) — how a platform proves which release it is running diff --git a/docs/docs/W3DS Basics/Links.md b/docs/docs/W3DS Basics/Links.md index c1f69d0f8..2d389ec09 100644 --- a/docs/docs/W3DS Basics/Links.md +++ b/docs/docs/W3DS Basics/Links.md @@ -1,5 +1,5 @@ --- -sidebar_position: 6 +sidebar_position: 7 --- # Links diff --git a/docs/docs/W3DS Protocol/Platform-Authentication.md b/docs/docs/W3DS Protocol/Platform-Authentication.md new file mode 100644 index 000000000..856a7324a --- /dev/null +++ b/docs/docs/W3DS Protocol/Platform-Authentication.md @@ -0,0 +1,85 @@ +--- +sidebar_position: 6 +--- + +# Platform Authentication (PP Auth) + +An eVault has never been able to tell one platform from another. `POST /platforms/certification` mints a year-long token for any name a caller types in, and any registry-signed token bypasses access control outright. So "which platform is this?" has, until now, been answered by whoever asked. + +PP Auth replaces that with a chain of trust the caller has to actually hold the keys for. A deployment proves, from scratch on every handshake, which release it is running and what the Post Platforms Association certified that release to do. + +## What a deployment proves + +Six links, each failing closed. A verifier checks all six and reports all six — an operator debugging a rejected handshake needs the whole trace, not the first problem. + +| Link | What it establishes | +|---|---| +| **Possession** | The caller signed a fresh challenge with the deployment key. Without this the rest is public paperwork anyone could replay. | +| **Deployment authorised** | A named person's wallet signed that key for this platform and environment. Authority traces to a human, not a config file. | +| **Bundle integrity** | Both binding documents hash to the values that signature covered, so neither can be swapped independently of the other. | +| **Version identity** | The version eName is derivable from the platform eName and version by UUIDv5. Arithmetic, not a lookup — nothing to spoof and no network call. | +| **Release authorship** | The release's submission proof re-verifies against its registry key-binding certificate. The same proof the association reviewed, checked again rather than taken on trust. | +| **Accreditation** | The association's ES256 certificate verifies against its JWKS, names this platform as `sub` and this exact version, and grants a level and a set of domains. | + +If every link holds, the verifier returns a **claim**: the platform, the deployment, the version, the certification level, and the domains — intersected with what the release actually asked for, so a certificate naming more than the submission requested cannot widen it. + +## The handshake + +``` +deployment verifier + | POST /pp-auth/challenge | + |------------------------------------------>| + | { nonce, audience, issuedAt, expiresAt } | + |<------------------------------------------| + | sign the canonical challenge payload | + | POST /pp-auth/verify | + | { challenge, evidence, signature } | + |------------------------------------------>| + | verify six links | + | { ok, links[], claim } | + |<------------------------------------------| +``` + +A challenge is single-use and short-lived. It is spent the moment it is answered — whether or not the chain holds — so a captured response cannot be replayed even inside its window. + +The deployment **presents** its evidence rather than being looked up. That matters: a verifier needs only public endpoints to check it, and never needs read access to the platform's eVault, which is the access the deployment is trying to obtain in the first place. + +## Canonical payloads + +Three codebases produce these signatures — the eID wallet, GitW3 in Go, and the registry — so the byte-for-byte forms are fixed. + +| Signed thing | Payload | +|---|---| +| Handshake challenge | `w3ds:pp-auth:v1:` + base64url(sha256(canonical challenge)) | +| Deployment attestation bundle | `gitw3:deployment:v1:` + base64url(sha256(`signedPayload`)) | +| Release submission | `gitw3:ppa:v1:` + base64url(sha256(`JSON.stringify(statement)`)) | +| Owner access policy | `w3ds:access-policy:v1:` + base64url(sha256(canonical statement)) | + +"Canonical" means keys sorted at every depth, matching `getCanonicalBindingDocumentString` in evault-core and the Go implementation in GitW3. The bundle is the exception: its digest is over the `signedPayload` string exactly as stored, not over a re-serialisation of it. + +Signatures are accepted as base64url, base58 multibase (`z…`), raw `r‖s`, or DER-wrapped. Public keys are accepted as multibase, `0x`-hex or bare base64. Being strict about the bytes and liberal about how they were written is deliberate: a verifier that insists on one encoding rejects legitimate evidence. + +## What certification is not + +The association's certificate is a **trust statement, not a permission**. It says what a release was found to be. The eVault stays sovereign and decides for itself what that is worth — see [Access Policy](/docs/W3DS%20Basics/Access-Policy). + +Two independent gates, both of which must open: + +1. **The certificate.** Is this domain in what the association granted, and in what the release asked for? A social platform certified for `social` and `communication` has no path to `finance` data. Not because the eVault recognises it as a social platform, but because `finance` is not in its certificate and nothing it can present puts it there. +2. **The owner's policy.** Is the level high enough, is the reputation acceptable, is this domain one the owner permits at all? + +An owner's policy can only narrow a certificate, never widen it. + +## Backwards compatibility + +Existing registry-minted platform tokens keep working. The registry stops minting new ones; deployments issued through GitW3 come with the evidence PP Auth needs. The two coexist while platforms migrate. + +## Where the code is + +`@metastate-foundation/auth/platform` — both halves in one package. + +- `verifyDeploymentChain`, `verifyHandshake`, `createChallengeStore` — the verifier +- `answerChallenge`, `authenticate` — the deployment side +- `authorize`, `permittedDomains` — the two gates +- `accessPolicyPayload`, `verifyAccessPolicy` — the owner's terms +- `@metastate-foundation/auth/platform/scenario` — mints a self-consistent chain from local keys, for tests and demonstrations. Never configure a production verifier with roots from it. From 96c8175ffb499d8be6b75b1316ce2ce00595886f Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 17:58:15 +0800 Subject: [PATCH 05/18] fix: canonicalise release statements in the order the wallet signed Verified against live congo-basin proofs: the digest is over GitW3's struct field order, not the order a statement arrives in. Every genuine release was being rejected. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- packages/auth/src/platform/bytes.spec.ts | 76 ++++++++++++++++++++++++ packages/auth/src/platform/bytes.ts | 41 +++++++++++++ packages/auth/src/platform/chain.ts | 8 ++- packages/auth/src/platform/index.ts | 1 + packages/auth/src/platform/scenario.ts | 12 +++- 5 files changed, 135 insertions(+), 3 deletions(-) create mode 100644 packages/auth/src/platform/bytes.spec.ts diff --git a/packages/auth/src/platform/bytes.spec.ts b/packages/auth/src/platform/bytes.spec.ts new file mode 100644 index 000000000..8d41c51c7 --- /dev/null +++ b/packages/auth/src/platform/bytes.spec.ts @@ -0,0 +1,76 @@ +import { createHash } from "node:crypto"; +import { describe, expect, it } from "vitest"; +import { canonicalSubmissionStatement, stableStringify } from "./bytes.js"; + +/** + * A real release proof, read from congo-basin's live platform profile on + * 2026-08-30. The payload is what the author's wallet actually signed, so this + * is a known-good vector rather than a value this codebase produced: if the + * canonical form drifts, this test fails and every genuine release would + * otherwise have been silently rejected. + */ +const REAL_STATEMENT = { + type: "w3ds.ppa.release-submission", + nonce: "7GaaGUA1pBOGkPj57hmdzQ", + domains: ["social", "finance", "media"], + version: "1.1.0", + issuedAt: "2026-08-29T17:58:43Z", + releaseTag: "v1.1.0", + repository: "849c0221-6f3f-55f9-95f0-f3b0d2b3092f/congo-basin", + signerEName: "@849c0221-6f3f-55f9-95f0-f3b0d2b3092f", + platformName: "congo-basin", + repositoryId: 2, + platformEName: "@00c41b0b-4a35-574f-b502-d90377f00f44", + schemaVersion: 1, + manifestCommitId: "39aa01cbf5ee511eb3ea74f005a2246deb522688", +}; +const REAL_PAYLOAD = + "gitw3:ppa:v1:vst5thDbtMeYQ5fWGM4recrBMvFWEYVRPqQ2J4C4qiM"; + +function payloadFor(statement: Record): string { + return ( + "gitw3:ppa:v1:" + + createHash("sha256") + .update(canonicalSubmissionStatement(statement)) + .digest("base64url") + ); +} + +describe("canonicalSubmissionStatement", () => { + it("reproduces the payload a real wallet signed", () => { + expect(payloadFor(REAL_STATEMENT)).toBe(REAL_PAYLOAD); + }); + + it("is unaffected by the key order a statement arrives in", () => { + // A statement that has been through an eVault and the awareness fanout + // comes back with its keys reordered. That must not change the digest. + const shuffled = Object.fromEntries( + Object.entries(REAL_STATEMENT).sort(([a], [b]) => a.localeCompare(b)), + ); + + expect(payloadFor(shuffled)).toBe(REAL_PAYLOAD); + }); + + it("does not accept the wire order or sorted order as canonical", () => { + // Both of these were tried against live proofs and neither matches, so + // they are pinned as wrong rather than left as plausible alternatives. + const wire = "gitw3:ppa:v1:" + createHash("sha256") + .update(JSON.stringify(REAL_STATEMENT)) + .digest("base64url"); + const sorted = "gitw3:ppa:v1:" + createHash("sha256") + .update(stableStringify(REAL_STATEMENT)) + .digest("base64url"); + + expect(wire).not.toBe(REAL_PAYLOAD); + expect(sorted).not.toBe(REAL_PAYLOAD); + }); + + it("changes when any signed field changes", () => { + expect(payloadFor({ ...REAL_STATEMENT, version: "1.1.1" })).not.toBe( + REAL_PAYLOAD, + ); + expect( + payloadFor({ ...REAL_STATEMENT, domains: ["social", "finance"] }), + ).not.toBe(REAL_PAYLOAD); + }); +}); diff --git a/packages/auth/src/platform/bytes.ts b/packages/auth/src/platform/bytes.ts index ca60b87b8..ffc08d1c4 100644 --- a/packages/auth/src/platform/bytes.ts +++ b/packages/auth/src/platform/bytes.ts @@ -188,3 +188,44 @@ export function signatureCandidates(value: string): Uint8Array[] { export function toArrayBuffer(value: Uint8Array): ArrayBuffer { return Uint8Array.from(value).buffer; } + +/** + * Rebuilds a release submission statement in the field order GitW3's Go struct + * serialises, which is what the author's wallet actually signed. + * + * This is not cosmetic and not sortable. The digest is taken over + * `JSON.stringify` of the statement, so the order of the keys *is* the + * signature. A statement that has been through a JSON parse, an eVault, and the + * awareness fanout comes back with its keys in whatever order those hops chose, + * and hashing that order produces a digest matching nothing. Verified against + * live congo-basin proofs: struct order matches, wire order and sorted order + * both fail. + */ +export function canonicalSubmissionStatement( + raw: Record, +): string { + const statement: Record = { + type: raw.type, + schemaVersion: raw.schemaVersion, + repositoryId: raw.repositoryId, + repository: raw.repository, + platformEName: raw.platformEName, + platformName: raw.platformName, + releaseTag: raw.releaseTag, + version: raw.version, + manifestCommitId: raw.manifestCommitId, + domains: raw.domains, + signerEName: raw.signerEName, + issuedAt: raw.issuedAt, + nonce: raw.nonce, + }; + // Optional trailing fields, present only on a resubmission after refusal. + if (raw.previousDecision) { + statement.previousDecision = raw.previousDecision; + statement.previousDecisionAt = raw.previousDecisionAt; + } + if (raw.responseToDecision) { + statement.responseToDecision = raw.responseToDecision; + } + return JSON.stringify(statement); +} diff --git a/packages/auth/src/platform/chain.ts b/packages/auth/src/platform/chain.ts index 4bdd0ad92..f80ba8049 100644 --- a/packages/auth/src/platform/chain.ts +++ b/packages/auth/src/platform/chain.ts @@ -22,6 +22,7 @@ import { createHash } from "node:crypto"; import { createRemoteJWKSet, jwtVerify } from "jose"; import { bindingDocumentHash, + canonicalSubmissionStatement, sha256Base64Url, stableStringify, } from "./bytes.js"; @@ -340,7 +341,12 @@ export async function verifyDeploymentChain( let authorshipDetail = "The release carried no submission proof."; if (proof?.statement) { const canonical = - SUBMISSION_PREFIX + sha256Base64Url(JSON.stringify(proof.statement)); + SUBMISSION_PREFIX + + sha256Base64Url( + canonicalSubmissionStatement( + proof.statement as unknown as Record, + ), + ); if (proof.payload !== canonical) { authorshipDetail = "The signed payload does not match the statement."; } else if (proof.statement.platformEName !== evidence.platformEname) { diff --git a/packages/auth/src/platform/index.ts b/packages/auth/src/platform/index.ts index 99ac13b1f..a243f27cf 100644 --- a/packages/auth/src/platform/index.ts +++ b/packages/auth/src/platform/index.ts @@ -1,5 +1,6 @@ export { bindingDocumentHash, + canonicalSubmissionStatement, decodeBase58, decodePublicKey, derSignatureToRaw, diff --git a/packages/auth/src/platform/scenario.ts b/packages/auth/src/platform/scenario.ts index e82327f8a..c163b7be8 100644 --- a/packages/auth/src/platform/scenario.ts +++ b/packages/auth/src/platform/scenario.ts @@ -17,7 +17,11 @@ import { randomUUID } from "node:crypto"; import { SignJWT, exportJWK, generateKeyPair as generateJwkPair } from "jose"; import type { JWK, KeyLike } from "jose"; -import { bindingDocumentHash, sha256Base64Url } from "./bytes.js"; +import { + bindingDocumentHash, + canonicalSubmissionStatement, + sha256Base64Url, +} from "./bytes.js"; import { softwareVersionEName } from "./chain.js"; import { generateKeyPair, signP256, verifyP256 } from "./p256.js"; import type { @@ -190,7 +194,11 @@ export async function mintDeployment( issuedAt: timestamp, nonce: randomUUID(), }; - const payload = SUBMISSION_PREFIX + sha256Base64Url(JSON.stringify(statement)); + const payload = + SUBMISSION_PREFIX + + sha256Base64Url( + canonicalSubmissionStatement(statement as unknown as Record), + ); const keyBindingCertificate = await new SignJWT({ ename: roots.wallet.ename, publicKey: roots.wallet.publicKey, From e1a892e5b0c1f309a624492d5151ab7f2fdabca0 Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 18:08:28 +0800 Subject: [PATCH 06/18] fix: show what the evidence supported when the identity floor caps it A geometric mean of 3.13 beside an award of L2 reads as an arithmetic mistake. It is the IAL4 requirement for L3 and above, so say that. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- services/ppa/src/lib/AssessmentResult.svelte | 15 +++++++++++++-- services/ppa/src/lib/levels.spec.ts | 16 ++++++++++++++++ services/ppa/src/lib/levels.ts | 17 ++++++++++++++++- 3 files changed, 45 insertions(+), 3 deletions(-) diff --git a/services/ppa/src/lib/AssessmentResult.svelte b/services/ppa/src/lib/AssessmentResult.svelte index cad5848f4..6acf99e6c 100644 --- a/services/ppa/src/lib/AssessmentResult.svelte +++ b/services/ppa/src/lib/AssessmentResult.svelte @@ -53,6 +53,15 @@

→
+ {#if identityCapped && result.scoredLevel} +
+

Evidence supports

+

+ {result.scoredLevel} +

+
+
→
+ {/if}

Computed level

@@ -68,8 +77,10 @@

{:else if identityCapped}

- Capped at {result.level} by the identity floor — the weakest - accountable actor is {minimumIal}. + The assessment supports {result.scoredLevel}, but + {result.scoredLevel} needs every responsible person verified + to {framework.identityFloor[result.scoredLevel ?? "L0"]}. The + weakest is {minimumIal}, so this is held at {result.level}.

{:else if limitingLabel}

diff --git a/services/ppa/src/lib/levels.spec.ts b/services/ppa/src/lib/levels.spec.ts index 79119ac16..ec6bb4429 100644 --- a/services/ppa/src/lib/levels.spec.ts +++ b/services/ppa/src/lib/levels.spec.ts @@ -103,6 +103,22 @@ describe("computeLevel", () => { expect(result.limiting).toBe("identity"); }); + it("still reports what the evidence alone supported when capped", () => { + // Without this the reviewer sees a mean of 5 next to an award of L2 and + // reasonably reads it as a bug rather than as the identity floor. + const result = computeLevel(framework, allAt(5), "IAL3"); + + expect(result.scoredLevel).toBe("L5"); + expect(result.level).toBe("L2"); + }); + + it("reports the same level twice when nothing capped it", () => { + const result = computeLevel(framework, allAt(3), "IAL4"); + + expect(result.scoredLevel).toBe("L3"); + expect(result.level).toBe("L3"); + }); + it("refuses any level for an anonymous responsible party", () => { expect(computeLevel(framework, allAt(5), "IAL1").level).toBeNull(); }); diff --git a/services/ppa/src/lib/levels.ts b/services/ppa/src/lib/levels.ts index 8f6a48718..8ab64c1cd 100644 --- a/services/ppa/src/lib/levels.ts +++ b/services/ppa/src/lib/levels.ts @@ -78,6 +78,12 @@ export interface ComputedLevel { level: AccessLevel | null; /** The geometric mean itself, before flooring — shown in the calculation. */ score: number; + /** + * The level the evidence alone supports, before the identity floor is + * applied. Shown alongside `level` so a cap reads as a cap rather than as + * an arithmetic mistake. + */ + scoredLevel: AccessLevel | null; /** Weakest dimension, or "identity" when the IAL floor is what capped it. */ limiting: string | null; /** True when a dimension fails outright, so no level can be awarded. */ @@ -134,7 +140,14 @@ export function computeLevel( } if (blocked || perDimension.length === 0) { - return { level: null, score: 0, limiting, blocked: true, perDimension }; + return { + level: null, + score: 0, + scoredLevel: null, + limiting, + blocked: true, + perDimension, + }; } // Geometric mean over level + 1, shifted back, so a legitimate L0 row @@ -148,6 +161,7 @@ export function computeLevel( // exp(mean(ln 6)) - 1 lands a hair under 5, so floor alone would award L4 // for a flawless assessment. Nudge past the float error before flooring. let index = Math.floor(score + 1e-9); + const scoredLevel = levelFromIndex(index); // The identity floor: the highest level whose required IAL is met. let identityCap = -1; @@ -166,6 +180,7 @@ export function computeLevel( return { level: levelFromIndex(index), score, + scoredLevel, limiting, blocked: false, perDimension, From ff07f2f9c3985079135ea1d9cff5a42a6449661d Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 18:13:13 +0800 Subject: [PATCH 07/18] feat: run the demonstrator on real platforms and your own eVault MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the minted Chatterbox/Ledgerly world with what is actually on the network: platforms and certificates from awareness, deployments and their binding documents from the eVaults holding them, and the signed-in owner's own records grouped by the domain each schema declares. Split into Platforms, Your data and Your terms. Terms are signed by the real wallet — the signing session id is the statement's canonical payload, so the signature verifies standalone — and published to the owner's eVault. Possession reports 'not attempted' without a key rather than claiming a check failed that was never made. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- .../pp-auth-demonstrator.md | 45 ++-- services/pp-auth-demo/package.json | 6 +- services/pp-auth-demo/src/app.d.ts | 2 +- services/pp-auth-demo/src/hooks.server.ts | 46 ++++ .../src/lib/DeploymentPanel.svelte | 218 ---------------- .../pp-auth-demo/src/lib/DeploymentRow.svelte | 133 ++++++++++ .../{OwnerTerms.svelte => TermsForm.svelte} | 161 +++++++----- services/pp-auth-demo/src/lib/server/aaas.ts | 174 +++++++++++++ .../pp-auth-demo/src/lib/server/access.ts | 108 -------- services/pp-auth-demo/src/lib/server/chain.ts | 198 ++++++++++++++ services/pp-auth-demo/src/lib/server/data.ts | 87 +++++++ .../pp-auth-demo/src/lib/server/domains.ts | 66 +++++ services/pp-auth-demo/src/lib/server/env.ts | 53 ++++ .../pp-auth-demo/src/lib/server/evault.ts | 196 ++++++++++++++ services/pp-auth-demo/src/lib/server/keys.ts | 29 +++ .../pp-auth-demo/src/lib/server/ontology.ts | 35 +++ .../pp-auth-demo/src/lib/server/policy.ts | 131 ++++++++++ .../pp-auth-demo/src/lib/server/session.ts | 119 +++++++++ services/pp-auth-demo/src/lib/server/token.ts | 55 ++++ services/pp-auth-demo/src/lib/server/world.ts | 245 ------------------ .../pp-auth-demo/src/routes/+layout.server.ts | 6 + .../pp-auth-demo/src/routes/+layout.svelte | 48 +++- .../pp-auth-demo/src/routes/+page.server.ts | 42 +-- services/pp-auth-demo/src/routes/+page.svelte | 127 --------- .../src/routes/api/access/+server.ts | 30 --- .../src/routes/api/auth/+server.ts | 22 ++ .../src/routes/api/auth/logout/+server.ts | 8 + .../src/routes/api/auth/offer/+server.ts | 5 + .../api/auth/session/[session]/+server.ts | 16 ++ .../src/routes/api/handshake/+server.ts | 28 -- .../src/routes/api/key/+server.ts | 26 ++ .../src/routes/api/policy/+server.ts | 58 ----- .../src/routes/api/reset/+server.ts | 8 - .../src/routes/api/tamper/+server.ts | 90 ------- .../src/routes/api/terms/+server.ts | 59 +++++ .../src/routes/api/terms/status/+server.ts | 42 +++ .../src/routes/api/verify/+server.ts | 33 +++ .../src/routes/data/+page.server.ts | 65 +++++ .../pp-auth-demo/src/routes/data/+page.svelte | 111 ++++++++ .../src/routes/login/+page.svelte | 63 +++++ .../src/routes/platforms/+page.server.ts | 102 ++++++++ .../src/routes/platforms/+page.svelte | 82 ++++++ .../src/routes/terms/+page.server.ts | 12 + .../src/routes/terms/+page.svelte | 49 ++++ services/pp-auth-demo/src/svelte-qrcode.d.ts | 20 ++ 45 files changed, 2203 insertions(+), 1056 deletions(-) create mode 100644 services/pp-auth-demo/src/hooks.server.ts delete mode 100644 services/pp-auth-demo/src/lib/DeploymentPanel.svelte create mode 100644 services/pp-auth-demo/src/lib/DeploymentRow.svelte rename services/pp-auth-demo/src/lib/{OwnerTerms.svelte => TermsForm.svelte} (50%) create mode 100644 services/pp-auth-demo/src/lib/server/aaas.ts delete mode 100644 services/pp-auth-demo/src/lib/server/access.ts create mode 100644 services/pp-auth-demo/src/lib/server/chain.ts create mode 100644 services/pp-auth-demo/src/lib/server/data.ts create mode 100644 services/pp-auth-demo/src/lib/server/domains.ts create mode 100644 services/pp-auth-demo/src/lib/server/env.ts create mode 100644 services/pp-auth-demo/src/lib/server/evault.ts create mode 100644 services/pp-auth-demo/src/lib/server/keys.ts create mode 100644 services/pp-auth-demo/src/lib/server/ontology.ts create mode 100644 services/pp-auth-demo/src/lib/server/policy.ts create mode 100644 services/pp-auth-demo/src/lib/server/session.ts create mode 100644 services/pp-auth-demo/src/lib/server/token.ts delete mode 100644 services/pp-auth-demo/src/lib/server/world.ts create mode 100644 services/pp-auth-demo/src/routes/+layout.server.ts delete mode 100644 services/pp-auth-demo/src/routes/+page.svelte delete mode 100644 services/pp-auth-demo/src/routes/api/access/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/auth/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/auth/logout/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/auth/offer/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/auth/session/[session]/+server.ts delete mode 100644 services/pp-auth-demo/src/routes/api/handshake/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/key/+server.ts delete mode 100644 services/pp-auth-demo/src/routes/api/policy/+server.ts delete mode 100644 services/pp-auth-demo/src/routes/api/reset/+server.ts delete mode 100644 services/pp-auth-demo/src/routes/api/tamper/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/terms/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/terms/status/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/verify/+server.ts create mode 100644 services/pp-auth-demo/src/routes/data/+page.server.ts create mode 100644 services/pp-auth-demo/src/routes/data/+page.svelte create mode 100644 services/pp-auth-demo/src/routes/login/+page.svelte create mode 100644 services/pp-auth-demo/src/routes/platforms/+page.server.ts create mode 100644 services/pp-auth-demo/src/routes/platforms/+page.svelte create mode 100644 services/pp-auth-demo/src/routes/terms/+page.server.ts create mode 100644 services/pp-auth-demo/src/routes/terms/+page.svelte create mode 100644 services/pp-auth-demo/src/svelte-qrcode.d.ts diff --git a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md index f3d007484..c641039cf 100644 --- a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md +++ b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md @@ -4,41 +4,48 @@ sidebar_position: 9 # PP Auth demonstrator -A running demonstration of platform authentication and domain separation. Two platforms, one vault, and every attempt to reach data shown with the reason it succeeded or failed. +Shows platform authentication and domain separation against the live network: real platforms, real certificates from the association, real deployments, and your own eVault. ```bash pnpm --filter pp-auth-demo dev ``` -Then open **http://localhost:4310**. Nothing else needs to be running — no database, no registry, no eVault. +Then open **http://localhost:4310** and sign in with your wallet. It needs `PPA_AWARENESS_API_KEY` (or `AWARENESS_API_KEY`) to see the network, and `PUBLIC_REGISTRY_URL` to resolve eVaults. -## What it shows +Nothing is seeded. If the platforms page is empty, nothing has been deployed or certified yet — which is a true statement about the network rather than a failure of the app. -**Chatterbox** is a social platform, certified L3 for `social` and `communication`. **Ledgerly** handles money, certified L4 for `finance`. Both are live, both will try to reach everything in the vault. +## Platforms -Point either one at a domain it was not certified for and it is refused — with a sentence saying so, not a status code. The refusal does not come from a list of platform names: it comes from the certificate the deployment presented, which does not name that domain and cannot be made to. +Every platform with a deployment or a certification decision, read live. Under each are the deployments actually running it, with the release and commit they were built from. -**Your terms** sets the owner's side: the minimum level, whose reputation scores count and what score they must reach, and any domain refused outright. Signing produces a real signature over a real statement, which is verified before it takes effect. Raise the bar to L4 and Chatterbox stops being allowed anything; require a reputation of 50 and Ledgerly does, on the scores the demo's engine reports. +**Check it** verifies that deployment's chain of trust, from scratch, against records anyone can read: -**Try to cheat** is where the mechanism is visible. Each edit breaks exactly one link: - -| Edit | Fails at | +| Link | Where the evidence comes from | |---|---| -| Present a different public key — paste your own | Possession | -| Widen its own authorisation | Deployment authorised | -| Borrow the other platform's version document | Bundle integrity | -| Point at a different release | Version identity | -| Borrow the other platform's certificate | Accreditation | +| Possession | the deployment itself — see below | +| Deployment authorised | the wallet signature on the deployment's key document, resolved through the registry | +| Bundle integrity | the hashes covered by that same signature | +| Version identity | UUIDv5 arithmetic over the platform eName and version | +| Release authorship | the release proof in the platform's own profile, and its registry key-binding certificate | +| Accreditation | the association's ES256 certificate for that exact version | + +Five of the six are checked by reading. **Possession is not** — the deployment's private key never leaves the deployment, so a reader cannot answer a challenge on its behalf. That link reports "not attempted" rather than pretending it failed a check that was never made. + +If you hold the key — because you are the person who made that deployment — paste it and the challenge is signed for real. It is kept in memory for that process only: never written to disk, never logged, gone on restart. A wrong key produces a genuine signature that genuinely fails. + +## Your data + +Your own eVault records, grouped by the domain each schema declares. That grouping is what a certificate is written against, so it is also what decides who sees what. -The chain trace re-runs on every attempt, so you can watch a link go red and read why. +The table shows every certified platform against every kind of data you hold, decided by the real certificate's domains and your real signed terms, using the same `authorize` an eVault would call. A platform certified for `social`, `finance` and `media` is allowed those and refused everything else — with the reason spelled out. It cannot reach your messages or your files, and nothing it presents will change that. -## What is real and what is not +## Your terms -The signatures are real — P-256 and ES256, verified by exactly the same code that verifies a live deployment. The tampering really does fail, for the reason shown. +The association says what a platform was found to be; you decide what that is worth. Set the minimum level, whose reputation scores you accept and the score they must reach, and any domain refused outright. -What is simulated is who holds the keys. The deployer's wallet, the registry and the association are stood in for by keys generated in the demo process, so it runs on its own. A chain that verifies here proves the mechanism works. It proves nothing about any particular platform, which is what the real roots are for. +Signing goes to your wallet. The signing session id **is** the canonical payload of the statement, so what the wallet signs is exactly the digest of your terms — the signature then verifies against the statement on its own, without anyone trusting this app. The terms are published into your own eVault as an `Access Policy` record, world-readable, and the signature is checked again before the write. -The minting facility lives at `@metastate-foundation/auth/platform/scenario`, deliberately behind a separate entry point so it cannot be reached by accident from code that verifies real deployments. +Your terms can only narrow a certificate, never widen it. Permitting `finance` does not let a platform reach finance data it was not certified for. ## See also diff --git a/services/pp-auth-demo/package.json b/services/pp-auth-demo/package.json index 5459bc5b6..aaed2a76c 100644 --- a/services/pp-auth-demo/package.json +++ b/services/pp-auth-demo/package.json @@ -26,6 +26,10 @@ }, "dependencies": { "@metastate-foundation/auth": "workspace:*", - "jose": "^5.2.2" + "jose": "^5.2.2", + "svelte-qrcode": "^1.0.1", + "dotenv": "^16.4.5", + "graphql-request": "^7.3.1", + "signature-validator": "workspace:*" } } diff --git a/services/pp-auth-demo/src/app.d.ts b/services/pp-auth-demo/src/app.d.ts index 4b0fb361a..219a939a2 100644 --- a/services/pp-auth-demo/src/app.d.ts +++ b/services/pp-auth-demo/src/app.d.ts @@ -1,7 +1,7 @@ declare global { namespace App { interface Locals { - /** The signed-in PPA admin, or null when unauthenticated. */ + /** The signed-in eVault owner, or null when unauthenticated. */ user: { ename: string } | null; } } diff --git a/services/pp-auth-demo/src/hooks.server.ts b/services/pp-auth-demo/src/hooks.server.ts new file mode 100644 index 000000000..464bfd46b --- /dev/null +++ b/services/pp-auth-demo/src/hooks.server.ts @@ -0,0 +1,46 @@ +import { redirect, type Handle } from "@sveltejs/kit"; +import { COOKIE, read } from "$lib/server/token"; + +const PUBLIC_PATHS = new Set(["/login"]); + +function isPublic(pathname: string): boolean { + if (PUBLIC_PATHS.has(pathname)) return true; + if (pathname.startsWith("/api/auth")) return true; + if (pathname.startsWith("/api/sign")) return true; + // The verifier endpoints are for deployments, which have no session. + if (pathname.startsWith("/pp-auth/")) return true; + return false; +} + +/** + * The wallet posts its callback from a phone, cross-origin, so the callback + * routes need CORS — including the private-network preflight Chrome sends when + * a public page calls a LAN address. + */ +function cors(response: Response): Response { + response.headers.set("Access-Control-Allow-Origin", "*"); + response.headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS"); + response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization"); + response.headers.set("Access-Control-Allow-Private-Network", "true"); + response.headers.set("Access-Control-Max-Age", "86400"); + return response; +} + +export const handle: Handle = async ({ event, resolve }) => { + event.locals.user = read(event.cookies.get(COOKIE)); + + if (event.request.method === "OPTIONS") { + return cors(new Response(null, { status: 204 })); + } + + const { pathname } = event.url; + if (!event.locals.user && !isPublic(pathname)) { + if (pathname.startsWith("/api/")) { + return cors(new Response("Unauthorized", { status: 401 })); + } + throw redirect(302, "/login"); + } + if (event.locals.user && pathname === "/login") throw redirect(302, "/platforms"); + + return cors(await resolve(event)); +}; diff --git a/services/pp-auth-demo/src/lib/DeploymentPanel.svelte b/services/pp-auth-demo/src/lib/DeploymentPanel.svelte deleted file mode 100644 index 246b15ef0..000000000 --- a/services/pp-auth-demo/src/lib/DeploymentPanel.svelte +++ /dev/null @@ -1,218 +0,0 @@ - - -

-
-
-

{deployment.name}

-

{deployment.platformName}

-

{deployment.blurb}

-
-
- {#each deployment.certifiedDomains as domain (domain)} - {domain} - {/each} -
-
- - {#if deployment.tampered} -

- Evidence altered: {deployment.tampered}. Try reaching something and see - which step notices. -

- {/if} - -
-
Release
-
{deployment.releaseTag}
-
Put here by
-
{deployment.deployerEname}
-
Reputation
-
- {deployment.reputation === null ? "not scored" : deployment.reputation} -
-
- -
-

- Write something into the vault -

- -
- {#each domains as domain (domain.id)} - - {/each} -
-
- - {#if decision} -

- {decision.reason} -

- {:else if chain && !chain.ok && lastDomain} -

- {chain.links.find((link) => !link.ok)?.detail} -

- {/if} - -
-
-

- What it proved -

- -
- {#if chain} - - {:else} -

- Nothing checked yet. Reach for something above, or check now. -

- {/if} -
- -
- - Try to cheat - -
-
- - - -
-
- - - - - -
-
-
-
diff --git a/services/pp-auth-demo/src/lib/DeploymentRow.svelte b/services/pp-auth-demo/src/lib/DeploymentRow.svelte new file mode 100644 index 000000000..10c3d75b5 --- /dev/null +++ b/services/pp-auth-demo/src/lib/DeploymentRow.svelte @@ -0,0 +1,133 @@ + + +
+
+
+

+ {deployment.name} + {deployment.environment} +

+

+ {deployment.releaseTag} · {deployment.commitSha.slice(0, 12)} +

+
+
+ {#if deployment.keyHeld} + Key supplied + {/if} + +
+
+ + {#if checked && missing.length > 0} +

+ Cannot be checked yet — {missing.join("; ")}. +

+ {/if} + + {#if chain} +
+ +
+ + {#if chain.claim} +

+ Proved: {chain.claim.platformName} {chain.claim.version}, certified + {chain.claim.level} for {chain.claim.domains.join(", ") || "no domains"}. +

+ {:else if chain.failedAt === "possession" && !deployment.keyHeld} +
+

+ Everything that can be checked by reading has been checked. The one + thing left is whether whoever is calling actually holds this + deployment's key — and only the deployment can show that. +

+ {#if showKey} + +
+ + +
+

+ Kept in memory for this process only. Never written down, never logged. +

+ {:else} + + {/if} +
+ {/if} + {/if} +
diff --git a/services/pp-auth-demo/src/lib/OwnerTerms.svelte b/services/pp-auth-demo/src/lib/TermsForm.svelte similarity index 50% rename from services/pp-auth-demo/src/lib/OwnerTerms.svelte rename to services/pp-auth-demo/src/lib/TermsForm.svelte index 28c480d4b..bac134e75 100644 --- a/services/pp-auth-demo/src/lib/OwnerTerms.svelte +++ b/services/pp-auth-demo/src/lib/TermsForm.svelte @@ -1,18 +1,14 @@
-
-

Your terms

-

What you will deal with

-

- The association says what a platform was found to be. You decide what - that is worth. Your answers are signed, so they travel with you and - anyone can check them — including the platform, before it bothers asking. -

-
-

The least you will accept @@ -100,7 +121,7 @@ class="mt-1" value={level.id} bind:group={minimumLevel} - onchange={() => (saved = false)} + onchange={() => (done = false)} /> {level.id} @@ -116,16 +137,8 @@ - (saved = false)} - placeholder={reputationEngine} - /> -

- Leave blank to ignore reputation entirely. -

+ (done = false)} /> +

Leave blank to ignore reputation entirely.

-
-

- Things nobody gets, whatever their certificate says -

-
- {#each domains as domain (domain.id)} - - {/each} + {#if domains.length > 0} +
+

+ Things nobody gets, whatever their certificate says +

+
+ {#each domains as domain (domain.id)} + + {/each} +
-
+ {/if} -
- - {#if saved} - Signed and in force. + {#if done} + Signed and published to your eVault. + {/if} + {#if error} + {error} {/if}
-
- - The statement you signed - - 
{JSON.stringify(policy, null, 2)}
-

Signature: {signature.signature}

-
+ {#if uri} +
+

Approve these terms in your wallet.

+
+ +
+
+ {/if} diff --git a/services/pp-auth-demo/src/lib/server/aaas.ts b/services/pp-auth-demo/src/lib/server/aaas.ts new file mode 100644 index 000000000..3eb443e56 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/aaas.ts @@ -0,0 +1,174 @@ +/** + * Everything this app knows about the network comes from Awareness-as-a-Service. + * + * Accreditations, deployment profiles and platform profiles each have their own + * ontology, so they can be asked for directly rather than scanned for. + */ + +import { awarenessApiKey, awarenessUrl } from "./env"; +import { + DEPLOYMENT_PROFILE_ONTOLOGY, + PLATFORM_ACCREDITATION_ONTOLOGY, + USER_ONTOLOGY, + type AccreditationRecord, + type DeploymentRecord, +} from "./ontology"; + +interface Packet { + id: string; + ontology: string; + w3id: string | null; + data: Record | null; + receivedAt: string; +} + +export function isConfigured(): boolean { + return Boolean(awarenessApiKey()); +} + +async function packets(params: Record): Promise { + if (!isConfigured()) return []; + const out: Packet[] = []; + let cursor: string | null = null; + do { + const query = new URLSearchParams({ limit: "500", ...params }); + if (cursor) query.set("cursor", cursor); + const res = await fetch(`${awarenessUrl().replace(/\/$/, "")}/api/packets?${query}`, { + headers: { Authorization: `Bearer ${awarenessApiKey()}` }, + signal: AbortSignal.timeout(30_000), + }); + if (!res.ok) { + throw new Error(`AaaS /api/packets returned ${res.status}`); + } + const body = (await res.json()) as { + packets?: Packet[]; + hasMore?: boolean; + nextCursor?: string | null; + }; + out.push(...(body.packets ?? [])); + cursor = body.hasMore ? (body.nextCursor ?? null) : null; + } while (cursor); + return out; +} + +/** Short cache: these reads back every page and the data changes rarely. */ +const TTL_MS = 30_000; +const CACHE = Symbol.for("pp-auth-demo.aaas"); +const store = globalThis as typeof globalThis & { + [CACHE]?: Map; +}; +store[CACHE] ??= new Map(); + +async function cached(key: string, load: () => Promise): Promise { + const entry = store[CACHE]!.get(key); + if (entry && Date.now() - entry.at < TTL_MS) return entry.value as T; + const value = await load(); + store[CACHE]!.set(key, { at: Date.now(), value }); + return value; +} + +export function invalidate(): void { + store[CACHE]!.clear(); +} + +function str(value: unknown): string { + return typeof value === "string" ? value : ""; +} + +/** + * Every certification decision on the network, newest first. + * + * A decision covers one platform version, and a version can be refused and + * reapply, so several may exist for the same release. + */ +export async function accreditations(): Promise { + return cached("accreditations", async () => { + const found = await packets({ ontology: PLATFORM_ACCREDITATION_ONTOLOGY }); + return found + .map((packet) => packet.data) + .filter( + (data): data is AccreditationRecord => + Boolean(data) && + typeof data!.platformEName === "string" && + typeof data!.jws === "string", + ) + .sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1)); + }); +} + +/** Every deployment published on the network. */ +export async function deployments(): Promise { + return cached("deployments", async () => { + const found = await packets({ ontology: DEPLOYMENT_PROFILE_ONTOLOGY }); + const byEname = new Map(); + for (const packet of found) { + const data = packet.data; + if (!data || !str(data.deploymentEname)) continue; + byEname.set(str(data.deploymentEname), data as DeploymentRecord); + } + return [...byEname.values()]; + }); +} + +export interface PlatformProfile { + ename: string; + platformName: string; + displayName: string; + description: string; + version: string; + logoUrl: string | null; + url: string; + /** Every release proof the platform retains, so an older deployment resolves. */ + proofs: Array>; +} + +/** One platform's own profile, read from its eVault. */ +export async function platformProfile(ename: string): Promise { + return cached(`profile:${ename}`, async () => { + const found = await packets({ evault: ename, ontology: USER_ONTOLOGY }); + const data = found + .map((packet) => packet.data) + .filter((d): d is Record => Boolean(d) && Boolean(str(d!.platformName))) + .at(-1); + if (!data) return null; + const proofs = [ + ...(Array.isArray(data.submissionHistory) ? data.submissionHistory : []), + data.submissionProof, + ].filter((proof) => proof && typeof proof === "object" && proof.statement); + return { + ename, + platformName: str(data.platformName), + displayName: str(data.displayName) || str(data.platformName), + description: str(data.description), + version: str(data.version), + logoUrl: str(data.logoUrl) || null, + url: str(data.url), + proofs, + }; + }); +} + +/** A person's profile, for showing who deployed something. */ +export async function personProfile( + ename: string, +): Promise<{ ename: string; displayName: string; avatarUrl: string | null }> { + return cached(`person:${ename}`, async () => { + const fallback = { ename, displayName: ename, avatarUrl: null }; + try { + const found = await packets({ evault: ename, ontology: USER_ONTOLOGY }); + const data = found + .map((packet) => packet.data) + .filter((d): d is Record => Boolean(d) && !str(d!.platformName)) + .at(-1); + if (!data) return fallback; + return { + ename, + displayName: + str(data.displayName) || str(data.name) || str(data.username) || ename, + avatarUrl: str(data.avatarUrl) || str(data.avatar) || null, + }; + } catch { + return fallback; + } + }); +} diff --git a/services/pp-auth-demo/src/lib/server/access.ts b/services/pp-auth-demo/src/lib/server/access.ts deleted file mode 100644 index 32865ec4e..000000000 --- a/services/pp-auth-demo/src/lib/server/access.ts +++ /dev/null @@ -1,108 +0,0 @@ -/** - * One request through the whole mechanism: handshake, then the two gates. - * - * Every attempt runs the full handshake rather than caching a session. That is - * slower than a real deployment would be, and deliberate — the point of the - * demonstrator is that you can see the chain re-checked on each attempt and - * watch it fail the moment a link is broken. - */ - -import { - answerChallenge, - authorize, - verifyHandshake, - type AuthorizationDecision, - type ChainResult, -} from "@metastate-foundation/auth/platform"; -import { randomUUID } from "node:crypto"; -import { OWNER_ENAME, REPUTATION_ENGINE, type World } from "./world"; - -export interface AccessOutcome { - chain: ChainResult; - decision: AuthorizationDecision | null; - records: World["records"]; -} - -export async function attemptAccess( - current: World, - deploymentId: string, - domain: string, - write?: { kind: string; body: string }, -): Promise { - const deployment = current.deployments.get(deploymentId); - if (!deployment) throw new Error(`unknown deployment ${deploymentId}`); - - const challenge = current.challenges.issue(OWNER_ENAME); - const response = await answerChallenge(deployment.identity, challenge); - const chain = await verifyHandshake(response, { - audience: OWNER_ENAME, - registryBaseUrl: "demo://registry", - registryJwksUri: "demo://registry/.well-known/jwks.json", - verifyWalletSignature: current.roots.verifyWalletSignature, - resolveJwks: current.resolveJwks, - store: current.challenges, - }); - - if (!chain.ok || !chain.claim) { - record(current, deployment.id, deployment.identity.evidence.deploymentName, domain, { - allowed: false, - code: "handshake-failed", - reason: `Could not establish who this is: ${chain.links.find((link) => !link.ok)?.detail ?? "the chain of trust did not hold"}`, - }); - return { chain, decision: null, records: [] }; - } - - const score = current.reputation.get(chain.claim.platformEname); - const decision = authorize(current.policy.statement, { - claim: chain.claim, - domain, - reputation: - score === undefined ? null : { engine: REPUTATION_ENGINE, score }, - }); - record( - current, - deployment.id, - chain.claim.platformName, - domain, - decision, - ); - - if (!decision.allowed) return { chain, decision, records: [] }; - - if (write) { - current.records.unshift({ - id: randomUUID(), - domain, - kind: write.kind, - body: write.body, - writtenBy: chain.claim.platformName, - at: new Date().toISOString(), - }); - } - - return { - chain, - decision, - records: current.records.filter((entry) => entry.domain === domain), - }; -} - -function record( - current: World, - deploymentId: string, - deploymentName: string, - domain: string, - decision: { allowed: boolean; reason: string; code: string }, -): void { - current.attempts.unshift({ - id: randomUUID(), - at: new Date().toISOString(), - deploymentId, - deploymentName, - domain, - allowed: decision.allowed, - reason: decision.reason, - code: decision.code, - }); - current.attempts.splice(50); -} diff --git a/services/pp-auth-demo/src/lib/server/chain.ts b/services/pp-auth-demo/src/lib/server/chain.ts new file mode 100644 index 000000000..28c28e866 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/chain.ts @@ -0,0 +1,198 @@ +/** + * Assembles real evidence for a real deployment, and verifies it. + * + * Nothing here is manufactured. The deployment profile and the certificate come + * from the awareness network, the binding documents from the deployment's own + * eVault, and the release proof from the platform's profile. The only thing the + * verifier cannot obtain by reading is the deployment's private key, which is + * the point of the possession link. + */ + +import { + answerChallenge, + verifyDeploymentChain, + type ChainResult, + type DeploymentEvidence, + type HandshakeChallenge, +} from "@metastate-foundation/auth/platform"; +import { randomUUID } from "node:crypto"; +import { verifySignature } from "signature-validator/src/index"; +import { accreditations, deployments, platformProfile } from "./aaas"; +import { bindingDocuments } from "./evault"; +import { registryUrl } from "./env"; +import type { AccreditationRecord, DeploymentRecord } from "./ontology"; + +/** + * Wallet signatures are resolved through the registry, the same way every other + * service in the network checks one. + */ +async function verifyWalletSignature( + signer: string, + signature: string, + payload: string, +): Promise { + try { + const result = await verifySignature({ + eName: signer, + signature, + payload, + registryBaseUrl: registryUrl(), + }); + return result.valid === true; + } catch { + return false; + } +} + +export interface AssembledEvidence { + evidence: DeploymentEvidence | null; + /** What could not be found, in words, when evidence is incomplete. */ + missing: string[]; + accreditation: AccreditationRecord | null; + deployment: DeploymentRecord; +} + +/** The decision in force for one platform release: newest record wins. */ +export function accreditationFor( + records: AccreditationRecord[], + platformEname: string, + version: string, +): AccreditationRecord | null { + return ( + records.find( + (record) => + record.platformEName === platformEname && + record.platformVersion === version, + ) ?? null + ); +} + +export async function assemble( + deployment: DeploymentRecord, +): Promise { + const missing: string[] = []; + const [records, profile, docs] = await Promise.all([ + accreditations(), + platformProfile(deployment.platformEname), + bindingDocuments(deployment.deploymentEname), + ]); + + const accreditation = accreditationFor( + records, + deployment.platformEname, + deployment.version, + ); + if (!accreditation) { + missing.push(`no certification decision for version ${deployment.version}`); + } + + const keyDoc = docs.find((doc) => doc.type === "deployment_key"); + const versionDoc = docs.find((doc) => doc.type === "software_version"); + if (!keyDoc) missing.push("the deployment's key document is not readable"); + if (!versionDoc) missing.push("the deployment's release document is not readable"); + + // The platform profile carries its LATEST release proof, but a deployment + // may be running an older one, so match on the version actually deployed + // rather than taking whatever is current. + const proof = profile?.proofs.filter( + (entry) => entry?.statement?.version === deployment.version, + ).at(-1); + if (!proof) { + missing.push(`no signed release proof for version ${deployment.version}`); + } + + if (!accreditation || !keyDoc || !versionDoc || !proof) { + return { evidence: null, missing, accreditation, deployment }; + } + + return { + missing, + accreditation, + deployment, + evidence: { + deploymentEname: deployment.deploymentEname, + deploymentName: deployment.deploymentName, + environment: deployment.environment, + deployerEname: deployment.deployerEname, + platformEname: deployment.platformEname, + versionEname: deployment.versionEname, + version: deployment.version, + releaseTag: deployment.releaseTag, + commitSha: deployment.commitSha, + publicKey: deployment.publicKey, + deploymentKeyDocument: keyDoc as never, + softwareVersionDocument: versionDoc as never, + accreditationJws: accreditation.jws, + issuerJwksUri: accreditation.issuerJwksUri, + submissionProof: proof as never, + }, + }; +} + +export function challengeFor(audience: string): HandshakeChallenge { + const now = Date.now(); + return { + nonce: randomUUID(), + audience, + issuedAt: new Date(now).toISOString(), + expiresAt: new Date(now + 120_000).toISOString(), + }; +} + +/** + * Verifies a deployment's chain. + * + * When the operator has supplied that deployment's private key, the challenge + * is answered for real and all six links are checked. Without it the signature + * is one this app makes with a throwaway key: possession then fails, correctly, + * and the remaining five links are still checked against real evidence. + */ +export async function verify( + evidence: DeploymentEvidence, + audience: string, + privateKey: string | null, +): Promise<{ chain: ChainResult; possessionProven: boolean }> { + const challenge = challengeFor(audience); + const response = privateKey + ? await answerChallenge({ evidence, privateKey }, challenge) + : { challenge, evidence, signature: "" }; + + const chain = await verifyDeploymentChain(response, { + audience, + registryBaseUrl: registryUrl(), + verifyWalletSignature, + }); + + // With no key there was nothing to check, which is not the same as a check + // that failed. Saying "the signature did not verify" would suggest the + // deployment presented something wrong rather than that we never asked it. + if (!privateKey) { + const possession = chain.links.find((link) => link.id === "possession"); + if (possession) { + possession.detail = + "Not attempted — this is a reader, not the deployment, so it holds no key to answer with."; + } + } + + return { chain, possessionProven: Boolean(privateKey) }; +} + +/** Deployments grouped under the platform they belong to. */ +export async function network(): Promise< + Map +> { + const all = await deployments(); + const byPlatform = new Map< + string, + { platform: string; deployments: DeploymentRecord[] } + >(); + for (const deployment of all) { + const entry = byPlatform.get(deployment.platformEname) ?? { + platform: deployment.platformEname, + deployments: [], + }; + entry.deployments.push(deployment); + byPlatform.set(deployment.platformEname, entry); + } + return byPlatform; +} diff --git a/services/pp-auth-demo/src/lib/server/data.ts b/services/pp-auth-demo/src/lib/server/data.ts new file mode 100644 index 000000000..39990647a --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/data.ts @@ -0,0 +1,87 @@ +/** + * The signed-in owner's own records, grouped by the domain each one falls under. + * + * Every schema declares its domain, so the grouping is the ontology's, not + * ours: this is exactly the partition a certificate grants against. + */ + +import { envelopes } from "./evault"; +import { listDomains, listSchemas } from "./domains"; + +export interface OwnedRecord { + id: string; + /** The schema's human title, e.g. "Social Media Post". */ + kind: string; + summary: string; +} + +export interface DomainGroup { + id: string; + label: string; + description: string; + records: OwnedRecord[]; +} + +/** A short readable line for a record, without guessing at its shape. */ +function summarise(parsed: Record): string { + const preferred = [ + "text", "content", "body", "message", "title", "name", + "displayName", "description", "summary", "label", + ]; + for (const key of preferred) { + const value = parsed[key]; + if (typeof value === "string" && value.trim()) { + return value.trim().slice(0, 160); + } + } + const first = Object.entries(parsed).find( + ([, value]) => typeof value === "string" && value.trim().length > 0, + ); + return first ? `${first[0]}: ${String(first[1]).slice(0, 140)}` : "(no readable fields)"; +} + +/** + * Everything the owner holds, by domain. + * + * Each schema is queried separately because that is the only way an eVault can + * be asked for records; they run together so the page does not wait on them in + * series. A schema the vault holds nothing of simply contributes nothing. + */ +export async function ownedByDomain(ename: string): Promise { + const [schemas, domains] = await Promise.all([listSchemas(), listDomains()]); + if (schemas.length === 0) return []; + + const byDomain = new Map(); + + const results = await Promise.all( + schemas.map(async (schema) => { + const found = await envelopes(ename, schema.id, 10).catch(() => []); + return { schema, found }; + }), + ); + + for (const { schema, found } of results) { + if (found.length === 0) continue; + const list = byDomain.get(schema.domain) ?? []; + for (const record of found) { + list.push({ + id: record.id, + kind: schema.title, + summary: summarise(record.parsed), + }); + } + byDomain.set(schema.domain, list); + } + + return [...byDomain.entries()] + .map(([id, records]) => { + const domain = domains.find((d) => d.id === id); + return { + id, + label: domain?.label ?? id, + description: domain?.description ?? "", + records: records.slice(0, 12), + }; + }) + .sort((a, b) => b.records.length - a.records.length); +} diff --git a/services/pp-auth-demo/src/lib/server/domains.ts b/services/pp-auth-demo/src/lib/server/domains.ts new file mode 100644 index 000000000..0a82d8e57 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/domains.ts @@ -0,0 +1,66 @@ +/** + * The domain vocabulary, and which domain each ontology belongs to. + * + * Owned by the ontology service, not by this app: every schema declares the + * domain it belongs to, so granting a domain is what decides which record + * types a platform may touch. + */ + +import { ontologyUrl } from "./env"; + +export interface Domain { + id: string; + label: string; + description: string; +} + +export interface Schema { + id: string; + title: string; + domain: string; +} + +const TTL_MS = 30 * 60_000; +const STORE = Symbol.for("pp-auth-demo.ontology"); +const store = globalThis as typeof globalThis & { + [STORE]?: { at: number; domains: Domain[]; schemas: Schema[] }; +}; + +async function load(): Promise<{ domains: Domain[]; schemas: Schema[] }> { + const cached = store[STORE]; + if (cached && Date.now() - cached.at < TTL_MS) return cached; + + const base = ontologyUrl(); + const [domains, schemas] = await Promise.all([ + fetch(new URL("/domains", base), { signal: AbortSignal.timeout(15_000) }) + .then((r) => (r.ok ? r.json() : { domains: [] })) + .then((b) => (b.domains ?? []) as Domain[]) + .catch(() => [] as Domain[]), + fetch(new URL("/schemas", base), { signal: AbortSignal.timeout(15_000) }) + .then((r) => (r.ok ? r.json() : [])) + .then((b) => + (Array.isArray(b) ? b : []) + .filter((s: any) => s?.id && s?.domain) + .map((s: any) => ({ id: s.id, title: s.title ?? s.id, domain: s.domain })), + ) + .catch(() => [] as Schema[]), + ]); + + const value = { at: Date.now(), domains, schemas }; + if (domains.length > 0) store[STORE] = value; + return value; +} + +export async function listDomains(): Promise { + return (await load()).domains; +} + +export async function listSchemas(): Promise { + return (await load()).schemas; +} + +/** Domain of one ontology, or null when the ontology is unknown here. */ +export async function domainOf(ontologyId: string): Promise { + const { schemas } = await load(); + return schemas.find((schema) => schema.id === ontologyId)?.domain ?? null; +} diff --git a/services/pp-auth-demo/src/lib/server/env.ts b/services/pp-auth-demo/src/lib/server/env.ts new file mode 100644 index 000000000..8939ac78f --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/env.ts @@ -0,0 +1,53 @@ +import path from "node:path"; +import { config as loadEnv } from "dotenv"; +import { env } from "$env/dynamic/private"; + +/** + * Configuration, read from the repo-root .env in one place. + * + * Deliberately avoids `$env/dynamic/public`: several shared variables in this + * monorepo carry SvelteKit's PUBLIC_ prefix, and importing that module + * serialises the whole public block — every service URL and credential — into + * the HTML of every page. Nothing here is needed in the browser. + */ + +// cwd is services/pp-auth-demo under both `vite dev` and `node build/index.js`. +loadEnv({ path: path.resolve(process.cwd(), "../../.env") }); + +function raw(name: string): string { + return (env[name] ?? process.env[name] ?? "").trim(); +} + +/** Public base URL of this app — the w3ds:// callback target. */ +export function publicUrl(): string { + return raw("PP_AUTH_DEMO_PUBLIC_URL") || "http://localhost:4310"; +} + +export function registryUrl(): string { + const url = raw("REGISTRY_URL") || raw("PUBLIC_REGISTRY_URL"); + if (!url) throw new Error("PUBLIC_REGISTRY_URL is required"); + return url; +} + +export function awarenessUrl(): string { + return raw("AWARENESS_SERVICE_URL") || "https://aaas.w3ds.metastate.foundation"; +} + +export function awarenessApiKey(): string { + return raw("PP_AUTH_DEMO_AWARENESS_API_KEY") || raw("PPA_AWARENESS_API_KEY") || raw("AWARENESS_API_KEY"); +} + +export function ontologyUrl(): string { + return raw("PUBLIC_ONTOLOGY_URL") || "https://ontology.w3ds.metastate.foundation"; +} + +export function ereputationUrl(): string { + return raw("PPA_EREPUTATION_URL") || "https://ereputation.w3ds.metastate.foundation"; +} + +export function jwtSecret(): string { + return raw("PP_AUTH_DEMO_JWT_SECRET") || raw("PPA_JWT_SECRET") || "pp-auth-demo-dev-secret"; +} + +/** Name this app presents to the registry when minting its read token. */ +export const PLATFORM_NAME = "pp-auth-demo"; diff --git a/services/pp-auth-demo/src/lib/server/evault.ts b/services/pp-auth-demo/src/lib/server/evault.ts new file mode 100644 index 000000000..e05216198 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/evault.ts @@ -0,0 +1,196 @@ +/** + * Reads from real eVaults: the registry resolves an eName to a vault, and a + * platform token opens it. + * + * That token is exactly the bypass PP Auth exists to replace — the registry + * mints one for any name that asks, and eVault honours it against any vault. + * This app uses it to *read* evidence that is already public, and says so + * rather than pretending it has earned the access. + */ + +import { GraphQLClient, gql } from "graphql-request"; +import { PLATFORM_NAME, registryUrl } from "./env"; + +const BINDING_DOCUMENTS = gql` + query BindingDocuments { + bindingDocuments(first: 50) { + edges { + node { + id + parsed + } + } + } + } +`; + +const ENVELOPES = gql` + query Envelopes($ontologyId: ID!, $first: Int!) { + metaEnvelopes(filter: { ontologyId: $ontologyId }, first: $first) { + edges { + node { + id + parsed + } + } + } + } +`; + +const CREATE = gql` + mutation CreateMetaEnvelope($input: MetaEnvelopeInput!) { + createMetaEnvelope(input: $input) { + metaEnvelope { + id + } + errors { + field + message + } + } + } +`; + +const TOKEN = Symbol.for("pp-auth-demo.platformToken"); +const URLS = Symbol.for("pp-auth-demo.evaultUrls"); +const store = globalThis as typeof globalThis & { + [TOKEN]?: Promise; + [URLS]?: Map; +}; +store[URLS] ??= new Map(); + +export function normalizeEName(value: string): string { + const trimmed = value.trim(); + if (!trimmed) return ""; + return trimmed.startsWith("@") ? trimmed : `@${trimmed}`; +} + +async function platformToken(): Promise { + store[TOKEN] ??= (async () => { + const res = await fetch(new URL("/platforms/certification", registryUrl()), { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ platform: PLATFORM_NAME }), + signal: AbortSignal.timeout(15_000), + }); + if (!res.ok) throw new Error(`registry token request returned ${res.status}`); + const body = (await res.json()) as { token?: string }; + if (!body.token) throw new Error("registry returned no token"); + return body.token; + })().catch((error) => { + // Do not cache a failure: the next request should try again. + store[TOKEN] = undefined; + throw error; + }); + return store[TOKEN]; +} + +export async function resolveVault(ename: string): Promise { + const normalized = normalizeEName(ename); + const cached = store[URLS]!.get(normalized); + if (cached) return cached; + try { + const res = await fetch( + new URL(`/resolve?w3id=${encodeURIComponent(normalized)}`, registryUrl()), + { signal: AbortSignal.timeout(15_000) }, + ); + if (!res.ok) return null; + const body = (await res.json()) as { evaultUrl?: string; uri?: string }; + const url = body.evaultUrl || body.uri; + if (!url) return null; + store[URLS]!.set(normalized, url); + return url; + } catch { + return null; + } +} + +async function client(ename: string): Promise { + const normalized = normalizeEName(ename); + const [url, token] = await Promise.all([ + resolveVault(normalized), + platformToken(), + ]); + if (!url) return null; + return new GraphQLClient(new URL("/graphql", url).toString(), { + headers: { Authorization: `Bearer ${token}`, "X-ENAME": normalized }, + }); +} + +export interface RawBindingDocument { + id: string; + subject: string; + type: string; + data: Record; + signatures: Array>; +} + +/** The binding documents held in one eVault. */ +export async function bindingDocuments( + ename: string, +): Promise { + const gqlClient = await client(ename); + if (!gqlClient) return []; + try { + const res = await gqlClient.request<{ + bindingDocuments: { + edges: Array<{ node: { id: string; parsed: Record | null } }>; + }; + }>(BINDING_DOCUMENTS); + return res.bindingDocuments.edges + .map((edge) => { + const parsed = edge.node.parsed; + if (!parsed || typeof parsed !== "object") return null; + return { id: edge.node.id, ...parsed } as RawBindingDocument; + }) + .filter((doc): doc is RawBindingDocument => doc !== null); + } catch (error) { + console.warn(`[pp-auth-demo] could not read binding documents for ${ename}:`, error); + return []; + } +} + +/** MetaEnvelopes of one ontology held in one eVault. */ +export async function envelopes( + ename: string, + ontologyId: string, + first = 25, +): Promise }>> { + const gqlClient = await client(ename); + if (!gqlClient) return []; + try { + const res = await gqlClient.request<{ + metaEnvelopes: { + edges: Array<{ node: { id: string; parsed: Record | null } }>; + }; + }>(ENVELOPES, { ontologyId, first }); + return res.metaEnvelopes.edges + .filter((edge) => edge.node.parsed && typeof edge.node.parsed === "object") + .map((edge) => ({ id: edge.node.id, parsed: edge.node.parsed! })); + } catch { + // A vault holding nothing of this ontology errors on some deployments. + return []; + } +} + +/** Writes one record into an eVault. Used only for the owner's own terms. */ +export async function store_( + ename: string, + ontologyId: string, + payload: Record, + acl: string[], +): Promise { + const gqlClient = await client(ename); + if (!gqlClient) throw new Error(`could not resolve an eVault for ${ename}`); + const res = await gqlClient.request<{ + createMetaEnvelope: { + metaEnvelope: { id: string } | null; + errors: Array<{ message: string }> | null; + }; + }>(CREATE, { input: { ontology: ontologyId, payload, acl } }); + const errors = res.createMetaEnvelope.errors; + if (errors?.length) throw new Error(errors.map((e) => e.message).join("; ")); + const id = res.createMetaEnvelope.metaEnvelope?.id; + if (!id) throw new Error("eVault accepted the write but returned no id"); + return id; +} diff --git a/services/pp-auth-demo/src/lib/server/keys.ts b/services/pp-auth-demo/src/lib/server/keys.ts new file mode 100644 index 000000000..e626542eb --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/keys.ts @@ -0,0 +1,29 @@ +/** + * Deployment private keys the operator has supplied, held in memory only. + * + * A deployment's private key is the whole of the possession proof, so this app + * never writes one to disk, never logs it, and forgets all of them on restart. + * It accepts one at all because the person running this demonstration is, for + * these deployments, the deployer — supplying the key is how they prove the + * possession link rather than watch it fail. + */ + +const STORE = Symbol.for("pp-auth-demo.deploymentKeys"); +const store = globalThis as typeof globalThis & { [STORE]?: Map }; +const keys: Map = (store[STORE] ??= new Map()); + +export function remember(deploymentEname: string, privateKey: string): void { + keys.set(deploymentEname, privateKey.trim()); +} + +export function forget(deploymentEname: string): void { + keys.delete(deploymentEname); +} + +export function keyFor(deploymentEname: string): string | null { + return keys.get(deploymentEname) ?? null; +} + +export function held(): string[] { + return [...keys.keys()]; +} diff --git a/services/pp-auth-demo/src/lib/server/ontology.ts b/services/pp-auth-demo/src/lib/server/ontology.ts new file mode 100644 index 000000000..9f0a5ff78 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/ontology.ts @@ -0,0 +1,35 @@ +/** Ontology ids this app reads, and the vocabulary they belong to. */ + +export const USER_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000"; +export const PLATFORM_ACCREDITATION_ONTOLOGY = "e1749947-5a10-4973-b9fa-230d8714c36a"; +export const DEPLOYMENT_PROFILE_ONTOLOGY = "d38e0c5b-9d63-4a21-8e8b-1d6b63af64d2"; +export const ACCESS_POLICY_ONTOLOGY = "c7a41f6d-95b8-4e2a-9c33-8f0d1b6e4a72"; + +export interface AccreditationRecord { + accreditationId: string; + platformEName: string; + platformName: string; + platformVersion: string; + decision: "granted" | "denied"; + level: string | null; + domains: string[]; + statement: string; + reviewedByEName: string; + issuerJwksUri: string; + jws: string; + createdAt: string; +} + +export interface DeploymentRecord { + deploymentEname: string; + deploymentName: string; + environment: string; + deployerEname: string; + platformEname: string; + versionEname: string; + version: string; + releaseTag: string; + commitSha: string; + publicKey: string; + createdAt: string; +} diff --git a/services/pp-auth-demo/src/lib/server/policy.ts b/services/pp-auth-demo/src/lib/server/policy.ts new file mode 100644 index 000000000..f3fad7c26 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/policy.ts @@ -0,0 +1,131 @@ +/** + * The owner's terms, read from and written to their own eVault. + * + * The record is a signed statement, so a reader checks the signature rather + * than trusting this app to have reported it faithfully. Records are + * append-only; the newest valid statement for the owner is the one in force. + */ + +import { + accessPolicyPayload, + defaultAccessPolicy, + parseAccessPolicy, + verifyAccessPolicy, + type AccessPolicyStatement, + type SignedAccessPolicy, +} from "@metastate-foundation/auth/platform"; +import { verifySignature } from "signature-validator/src/index"; +import { registryUrl } from "./env"; +import { envelopes, store_ } from "./evault"; +import { ACCESS_POLICY_ONTOLOGY } from "./ontology"; + +export interface LoadedPolicy { + statement: AccessPolicyStatement; + /** False when nothing has been signed yet and the default applies. */ + signed: boolean; + signature: string | null; + issuedAt: string | null; +} + +async function walletVerifier( + signer: string, + signature: string, + payload: string, +): Promise { + try { + const result = await verifySignature({ + eName: signer, + signature, + payload, + registryBaseUrl: registryUrl(), + }); + return result.valid === true; + } catch { + return false; + } +} + +/** + * The terms in force for one owner. + * + * A record whose signature does not verify is ignored rather than trusted: an + * unverifiable policy is somebody's claim about what the owner wanted, and + * falling back to the default is the safer reading. + */ +export async function currentPolicy(ename: string): Promise { + const fallback: LoadedPolicy = { + statement: defaultAccessPolicy(ename), + signed: false, + signature: null, + issuedAt: null, + }; + + let records: Array<{ id: string; parsed: Record }>; + try { + records = await envelopes(ename, ACCESS_POLICY_ONTOLOGY, 50); + } catch (error) { + console.warn(`[pp-auth-demo] could not read terms for ${ename}:`, error); + return fallback; + } + + const candidates = records + .map((record) => record.parsed) + .filter((parsed) => typeof parsed.issuedAt === "string") + .sort((a, b) => String(b.issuedAt).localeCompare(String(a.issuedAt))); + + for (const candidate of candidates) { + const statement = parseAccessPolicy(candidate); + if (!statement || statement.subject !== ename) continue; + const signed: SignedAccessPolicy = { + statement, + payload: String(candidate.payload ?? ""), + signature: String(candidate.signature ?? ""), + signer: ename, + }; + if (!(await verifyAccessPolicy(signed, walletVerifier))) continue; + return { + statement, + signed: true, + signature: signed.signature, + issuedAt: statement.issuedAt, + }; + } + + return fallback; +} + +/** Everything the wallet needs to sign, derived from a draft. */ +export function prepare( + statement: AccessPolicyStatement, +): { statement: AccessPolicyStatement; payload: string } { + return { statement, payload: accessPolicyPayload(statement) }; +} + +/** + * Publishes signed terms into the owner's eVault, world-readable. + * + * The signature is verified again here before the write. A statement that + * cannot be checked must never be stored, or a later reader will drop it and + * the owner will believe terms are in force that are not. + */ +export async function publish( + statement: AccessPolicyStatement, + payload: string, + signature: string, +): Promise { + const signed: SignedAccessPolicy = { + statement, + payload, + signature, + signer: statement.subject, + }; + if (!(await verifyAccessPolicy(signed, walletVerifier))) { + throw new Error("The signature over these terms did not verify"); + } + return store_( + statement.subject, + ACCESS_POLICY_ONTOLOGY, + { ...statement, payload, signature }, + ["*"], + ); +} diff --git a/services/pp-auth-demo/src/lib/server/session.ts b/services/pp-auth-demo/src/lib/server/session.ts new file mode 100644 index 000000000..d44d02658 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/session.ts @@ -0,0 +1,119 @@ +/** + * W3DS sign-in, and wallet signing for the owner's terms. + * + * Both flows are the same shape: we generate a session identifier, the wallet + * signs that identifier, and we verify the signature against the registry. + * + * For the terms the session identifier *is* the canonical policy payload, so + * the resulting signature verifies against the statement on its own — anyone + * holding the record can check it without trusting this app or its session + * store. That is why the terms are worth signing at all. + */ + +import { randomUUID } from "node:crypto"; +// The published dist is CommonJS, which rollup cannot statically analyse for +// named exports when bundling for SSR. Same workaround as PPA and enotary. +import { verifySignature } from "signature-validator/src/index"; +import { publicUrl, registryUrl } from "./env"; + +const TTL_MS = 10 * 60_000; + +interface Pending { + createdAt: number; + kind: "login" | "policy"; + status: "pending" | "done"; + ename?: string; + signature?: string; +} + +/** + * Anchored outside the module graph: the offer, the wallet's callback and the + * browser's poll are three separate requests, and Vite's dev SSR can give each + * its own copy of a module — which silently splits the map, so a signature + * verifies but the page waiting for it never sees it. + */ +const STORE = Symbol.for("pp-auth-demo.sessions"); +const store = globalThis as typeof globalThis & { [STORE]?: Map }; +const sessions: Map = (store[STORE] ??= new Map()); + +function sweep(): void { + const now = Date.now(); + for (const [id, entry] of sessions) { + if (now - entry.createdAt > TTL_MS) sessions.delete(id); + } +} + +export function createLoginOffer(): { uri: string; session: string } { + sweep(); + const session = randomUUID(); + sessions.set(session, { createdAt: Date.now(), kind: "login", status: "pending" }); + const redirect = new URL("/api/auth", publicUrl()).toString(); + return { + session, + uri: `w3ds://auth?redirect=${redirect}&session=${session}&platform=pp-auth-demo`, + }; +} + +/** + * A signing offer whose session id is the payload to be signed. `data` is what + * the wallet shows the person before they approve it, so it carries the terms + * in readable form. + */ +export function createSigningOffer( + payload: string, + summary: Record, +): { uri: string; session: string } { + sweep(); + sessions.set(payload, { createdAt: Date.now(), kind: "policy", status: "pending" }); + const redirect = new URL("/api/sign", publicUrl()).toString(); + const data = Buffer.from(JSON.stringify(summary), "utf8").toString("base64"); + return { + session: payload, + uri: `w3ds://sign?session=${encodeURIComponent(payload)}&data=${encodeURIComponent(data)}&redirect_uri=${encodeURIComponent(redirect)}`, + }; +} + +/** Wallet callback for either flow: verify the signature over the session id. */ +export async function complete( + session: string, + ename: string, + signature: string, +): Promise<{ ok: boolean; error?: string }> { + const pending = sessions.get(session); + if (!pending) return { ok: false, error: "unknown or expired session" }; + + const result = await verifySignature({ + eName: ename, + signature, + payload: session, + registryBaseUrl: registryUrl(), + }); + if (!result.valid) { + return { ok: false, error: result.error ?? "invalid signature" }; + } + + pending.ename = ename; + pending.signature = signature; + pending.status = "done"; + return { ok: true }; +} + +/** + * Polled by the page. "unknown" is distinguished from "pending" so an expired + * or cross-process session tells the page to start again instead of waiting + * forever. + */ +export function poll( + session: string, +): + | { status: "pending" } + | { status: "unknown" } + | { status: "done"; ename: string; signature: string } { + const pending = sessions.get(session); + if (!pending) return { status: "unknown" }; + if (pending.status === "done" && pending.ename && pending.signature) { + sessions.delete(session); + return { status: "done", ename: pending.ename, signature: pending.signature }; + } + return { status: "pending" }; +} diff --git a/services/pp-auth-demo/src/lib/server/token.ts b/services/pp-auth-demo/src/lib/server/token.ts new file mode 100644 index 000000000..7ea0dba75 --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/token.ts @@ -0,0 +1,55 @@ +import { createHmac, timingSafeEqual } from "node:crypto"; +import { jwtSecret } from "./env"; + +/** Signed session cookie. Nothing sensitive is in it beyond the eName. */ + +export const COOKIE = "pp_auth_demo_session"; +const MAX_AGE_S = 7 * 24 * 3600; + +function sign(value: string): string { + return createHmac("sha256", jwtSecret()).update(value).digest("base64url"); +} + +export function mint(ename: string): string { + const body = Buffer.from( + JSON.stringify({ ename, exp: Date.now() + MAX_AGE_S * 1000 }), + "utf8", + ).toString("base64url"); + return `${body}.${sign(body)}`; +} + +export function read(token: string | undefined): { ename: string } | null { + if (!token) return null; + const [body, signature] = token.split("."); + if (!body || !signature) return null; + const expected = sign(body); + if ( + expected.length !== signature.length || + !timingSafeEqual(Buffer.from(expected), Buffer.from(signature)) + ) { + return null; + } + try { + const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8")); + if (typeof claims.ename !== "string" || Date.now() > claims.exp) return null; + return { ename: claims.ename }; + } catch { + return null; + } +} + +/** + * `secure` follows the actual scheme rather than SvelteKit's default, which + * sets it for any non-localhost host. Over plain HTTP on a LAN address — how + * this is reached from a phone — a Secure cookie is silently dropped and the + * login appears to succeed on the server while the browser never advances. + */ +export function cookieOptions(url: URL) { + return { + path: "/", + httpOnly: true, + sameSite: "lax" as const, + secure: url.protocol === "https:", + maxAge: MAX_AGE_S, + }; +} diff --git a/services/pp-auth-demo/src/lib/server/world.ts b/services/pp-auth-demo/src/lib/server/world.ts deleted file mode 100644 index 6a2ea7cb8..000000000 --- a/services/pp-auth-demo/src/lib/server/world.ts +++ /dev/null @@ -1,245 +0,0 @@ -/** - * The demonstrator's world: two deployments, one vault, one owner. - * - * Everything here is genuine cryptography checked by the real PP Auth - * verifier. What is simulated is the *setting*, not the mechanism: the keys - * standing in for the deployer's wallet, the registry and the association are - * generated in this process rather than held by those parties, so the - * demonstrator can run on a laptop with nothing else switched on. - * - * State is anchored on globalThis because Vite's dev server evaluates a module - * once per import graph, and a world that exists twice would issue challenges - * from one copy and try to redeem them in the other. - */ - -import { - accessPolicyPayload, - createChallengeStore, - defaultAccessPolicy, - generateKeyPair, - signP256, - verifyP256, - type AccessPolicyStatement, - type ChallengeStore, - type DeploymentIdentity, - type SignedAccessPolicy, -} from "@metastate-foundation/auth/platform"; -// Minting evidence from local keys is a demonstration and test facility. It is -// deliberately a separate entry point so it can never be reached by accident -// from code that verifies real deployments. -import { - createTrustRoots, - mintDeployment, - type TrustRoots, -} from "@metastate-foundation/auth/platform/scenario"; -import { createLocalJWKSet } from "jose"; - -/** The person whose eVault the demonstration is about. */ -export const OWNER_ENAME = "@849c0221-6f3f-55f9-95f0-f3b0d2b3092f"; - -export const ISSUER_JWKS_URI = "demo://association/.well-known/jwks.json"; -export const REGISTRY_JWKS_URI = "demo://registry/.well-known/jwks.json"; -export const REPUTATION_ENGINE = "@ereputation.w3ds"; - -export interface VaultRecord { - id: string; - domain: string; - kind: string; - body: string; - writtenBy: string; - at: string; -} - -export interface AttemptLog { - id: string; - at: string; - deploymentId: string; - deploymentName: string; - domain: string; - allowed: boolean; - reason: string; - code: string; -} - -export interface DemoDeployment { - id: string; - /** How the platform describes itself, for the card. */ - blurb: string; - identity: DeploymentIdentity; - /** Set when the operator has tampered with the evidence, so the UI can say so. */ - tampered: string | null; - pristine: DeploymentIdentity; -} - -export interface World { - roots: TrustRoots; - challenges: ChallengeStore; - deployments: Map; - records: VaultRecord[]; - attempts: AttemptLog[]; - policy: SignedAccessPolicy; - ownerKey: { publicKey: string; privateKey: string }; - /** Reputation the demo's engine reports, keyed by platform eName. */ - reputation: Map; - resolveJwks: (uri: string) => ReturnType; -} - -const KEY = Symbol.for("pp-auth-demo.world"); -const store = globalThis as typeof globalThis & { [KEY]?: Promise }; - -const CHATTERBOX = "@11111111-1111-4111-8111-111111111111"; -const LEDGERLY = "@22222222-2222-4222-8222-222222222222"; - -export async function signPolicy( - statement: AccessPolicyStatement, - ownerKey: { privateKey: string }, -): Promise { - const payload = accessPolicyPayload(statement); - return { - statement, - payload, - signature: await signP256(ownerKey.privateKey, payload), - signer: statement.subject, - }; -} - -async function build(): Promise { - const deployerEname = "@d0000000-0000-4000-8000-00000000dep1"; - const roots = await createTrustRoots(deployerEname); - const registryKeys = createLocalJWKSet(roots.registry.jwks); - const associationKeys = createLocalJWKSet(roots.association.jwks); - - const shared = { - issuerJwksUri: ISSUER_JWKS_URI, - registryJwksUri: REGISTRY_JWKS_URI, - reviewedByEName: OWNER_ENAME, - }; - - const [chatterbox, ledgerly] = await Promise.all([ - mintDeployment(roots, { - ...shared, - platformEname: CHATTERBOX, - platformName: "Chatterbox", - deploymentName: "chatterbox-eu", - environment: "production", - version: "1.4.0", - releaseTag: "v1.4.0", - commitSha: "4f9c1a77b2e3d5086a1c9f2b3d4e5f60718293a4", - repository: "https://gitw3.example/acme/chatterbox", - requestedDomains: ["social", "communication"], - level: "L3", - }), - mintDeployment(roots, { - ...shared, - platformEname: LEDGERLY, - platformName: "Ledgerly", - deploymentName: "ledgerly-eu", - environment: "production", - version: "2.1.3", - releaseTag: "v2.1.3", - commitSha: "9b1e2d3c4a5f60718293a4b5c6d7e8f90a1b2c3d", - repository: "https://gitw3.example/acme/ledgerly", - requestedDomains: ["finance"], - level: "L4", - }), - ]); - - const deployments = new Map([ - [ - "chatterbox", - { - id: "chatterbox", - blurb: "A social platform. Posts, feeds, and direct messages.", - identity: chatterbox.identity, - pristine: structuredClone(chatterbox.identity), - tampered: null, - }, - ], - [ - "ledgerly", - { - id: "ledgerly", - blurb: "A finance platform. Accounts, ledgers, and payments.", - identity: ledgerly.identity, - pristine: structuredClone(ledgerly.identity), - tampered: null, - }, - ], - ]); - - const ownerKey = await generateKeyPair(); - const policy = await signPolicy( - { - ...defaultAccessPolicy(OWNER_ENAME), - minimumLevel: "L2", - issuedAt: new Date().toISOString(), - nonce: "initial", - }, - ownerKey, - ); - - return { - roots, - challenges: createChallengeStore(), - deployments, - records: seedRecords(), - attempts: [], - policy, - ownerKey, - reputation: new Map([ - [CHATTERBOX, 62], - [LEDGERLY, 31], - ]), - resolveJwks: (uri) => - uri === ISSUER_JWKS_URI ? associationKeys : registryKeys, - }; -} - -function seedRecords(): VaultRecord[] { - const at = new Date().toISOString(); - return [ - { - id: "seed-social", - domain: "social", - kind: "Social media post", - body: "Spent the morning on the allotment. Tomatoes finally coming through.", - writtenBy: OWNER_ENAME, - at, - }, - { - id: "seed-finance", - domain: "finance", - kind: "Account", - body: "Current account · balance £4,182.60 · sort 04-00-04", - writtenBy: OWNER_ENAME, - at, - }, - { - id: "seed-comms", - domain: "communication", - kind: "Message", - body: "Are we still on for Thursday?", - writtenBy: OWNER_ENAME, - at, - }, - ]; -} - -export function world(): Promise { - if (!store[KEY]) store[KEY] = build(); - return store[KEY]; -} - -/** Verifies a signature made by the demo owner's stand-in wallet. */ -export async function verifyOwnerSignature( - current: World, - signature: string, - payload: string, -): Promise { - return verifyP256(current.ownerKey.publicKey, signature, payload); -} - -export async function resetWorld(): Promise { - store[KEY] = build(); - return store[KEY]; -} diff --git a/services/pp-auth-demo/src/routes/+layout.server.ts b/services/pp-auth-demo/src/routes/+layout.server.ts new file mode 100644 index 000000000..5c5a9f1e0 --- /dev/null +++ b/services/pp-auth-demo/src/routes/+layout.server.ts @@ -0,0 +1,6 @@ +import type { LayoutServerLoad } from "./$types"; + +export const load: LayoutServerLoad = async ({ locals, url }) => ({ + user: locals.user, + pathname: url.pathname, +}); diff --git a/services/pp-auth-demo/src/routes/+layout.svelte b/services/pp-auth-demo/src/routes/+layout.svelte index ff9e9ab80..cb77319f9 100644 --- a/services/pp-auth-demo/src/routes/+layout.svelte +++ b/services/pp-auth-demo/src/routes/+layout.svelte @@ -1,28 +1,52 @@
-
-
+
+

Post Platforms Association

- How a platform proves what it is + What each platform can reach, and why

- - Documentation - + {#if data.user} +
+ {data.user.ename} + +
+ {/if}
+ + {#if data.user} + + {/if}
-
+
{@render children()}
diff --git a/services/pp-auth-demo/src/routes/+page.server.ts b/services/pp-auth-demo/src/routes/+page.server.ts index 104244342..725ee09e0 100644 --- a/services/pp-auth-demo/src/routes/+page.server.ts +++ b/services/pp-auth-demo/src/routes/+page.server.ts @@ -1,44 +1,6 @@ -import { DOMAINS } from "$lib/domains"; -import { OWNER_ENAME, REPUTATION_ENGINE, world } from "$lib/server/world"; +import { redirect } from "@sveltejs/kit"; import type { PageServerLoad } from "./$types"; export const load: PageServerLoad = async () => { - const current = await world(); - - const deployments = [...current.deployments.values()].map((deployment) => { - const evidence = deployment.identity.evidence; - return { - id: deployment.id, - blurb: deployment.blurb, - name: evidence.deploymentName, - platformName: evidence.submissionProof.statement.platformName, - platformEname: evidence.platformEname, - deploymentEname: evidence.deploymentEname, - environment: evidence.environment, - version: evidence.version, - releaseTag: evidence.releaseTag, - commitSha: evidence.commitSha, - publicKey: evidence.publicKey, - deployerEname: evidence.deployerEname, - certifiedDomains: evidence.submissionProof.statement.domains, - repository: evidence.submissionProof.statement.repository, - reputation: current.reputation.get(evidence.platformEname) ?? null, - tampered: deployment.tampered, - }; - }); - - return { - owner: OWNER_ENAME, - reputationEngine: REPUTATION_ENGINE, - domains: DOMAINS, - deployments, - policy: current.policy.statement, - policySignature: { - payload: current.policy.payload, - signature: current.policy.signature, - signer: current.policy.signer, - }, - records: current.records, - attempts: current.attempts, - }; + throw redirect(302, "/platforms"); }; diff --git a/services/pp-auth-demo/src/routes/+page.svelte b/services/pp-auth-demo/src/routes/+page.svelte deleted file mode 100644 index c9a3a1284..000000000 --- a/services/pp-auth-demo/src/routes/+page.svelte +++ /dev/null @@ -1,127 +0,0 @@ - - -
-
-

The demonstration

-

- Two platforms want your data. Only one of them should get each thing. -

-

- Chatterbox is a social platform. Ledgerly handles money. Both are - running, both are certified, and both will now try to reach everything - in your vault — your posts, your messages, your accounts, your health - records. Watch what each one is actually allowed to touch, and why. -

-

- Nothing here is enforced by a list of platform names. Each one proves, - from scratch on every attempt, which release it is running and what - that release was certified for. A social platform has no way to say - the word “finance”: it is not in its certificate, and nothing it can - present will put it there. -

- -
- -
- {#each data.deployments as deployment, index (deployment.id)} - - {/each} -
- - {#key data.policy.nonce} - - {/key} - -
-
-
-

Your vault

-

What is in there

-
-
    - {#each data.records as record (record.id)} -
  • -
    - {record.domain} - - {record.writtenBy === data.owner ? "you" : record.writtenBy} - -
    -

    {record.body}

    -
    • - {/each} -
-
- -
-
-

What happened

-

Every attempt, kept

-
- {#if data.attempts.length === 0} -

- Nothing has tried to reach your data yet. -

- {:else} -
    - {#each data.attempts as attempt (attempt.id)} -
  • - -
    -

    {attempt.reason}

    -

    - {new Date(attempt.at).toLocaleTimeString()} -

    -
    -
    • - {/each} -
- {/if} -
-
- -
-

Honesty note

-

- The signatures on this page are real and are checked by the same code - that checks a live deployment. What is simulated is who holds the - keys: the wallet, the registry and the association are stood in for by - keys generated in this process, so the demonstration runs on its own. - A chain that verifies here proves the mechanism works — not that any - particular platform is trustworthy. -

-
-
diff --git a/services/pp-auth-demo/src/routes/api/access/+server.ts b/services/pp-auth-demo/src/routes/api/access/+server.ts deleted file mode 100644 index 850e5575c..000000000 --- a/services/pp-auth-demo/src/routes/api/access/+server.ts +++ /dev/null @@ -1,30 +0,0 @@ -import { json } from "@sveltejs/kit"; -import { attemptAccess } from "$lib/server/access"; -import { world } from "$lib/server/world"; -import type { RequestHandler } from "./$types"; - -export const POST: RequestHandler = async ({ request }) => { - const body = (await request.json()) as { - deploymentId?: string; - domain?: string; - kind?: string; - text?: string; - }; - const current = await world(); - const text = (body.text ?? "").trim(); - - try { - const outcome = await attemptAccess( - current, - String(body.deploymentId), - String(body.domain), - text ? { kind: body.kind || "Note", body: text } : undefined, - ); - return json(outcome); - } catch (error) { - return json( - { error: error instanceof Error ? error.message : "failed" }, - { status: 400 }, - ); - } -}; diff --git a/services/pp-auth-demo/src/routes/api/auth/+server.ts b/services/pp-auth-demo/src/routes/api/auth/+server.ts new file mode 100644 index 000000000..50ccc30bb --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/auth/+server.ts @@ -0,0 +1,22 @@ +import { json } from "@sveltejs/kit"; +import { complete } from "$lib/server/session"; +import type { RequestHandler } from "./$types"; + +/** Wallet callback for w3ds://auth. Field names vary by wallet build. */ +export const POST: RequestHandler = async ({ request }) => { + const body = (await request.json().catch(() => ({}))) as Record; + const session = String(body.session ?? body.sessionId ?? ""); + const ename = String(body.ename ?? body.w3id ?? body.eName ?? ""); + const signature = String(body.signature ?? ""); + + if (!session || !ename || !signature) { + return json({ error: "session, ename and signature are required" }, { status: 400 }); + } + + const result = await complete(session, ename, signature); + if (!result.ok) { + console.warn("[pp-auth-demo/auth] rejected:", result.error); + return json({ error: result.error }, { status: 401 }); + } + return json({ ok: true }); +}; diff --git a/services/pp-auth-demo/src/routes/api/auth/logout/+server.ts b/services/pp-auth-demo/src/routes/api/auth/logout/+server.ts new file mode 100644 index 000000000..c265a3350 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/auth/logout/+server.ts @@ -0,0 +1,8 @@ +import { redirect } from "@sveltejs/kit"; +import { COOKIE, cookieOptions } from "$lib/server/token"; +import type { RequestHandler } from "./$types"; + +export const POST: RequestHandler = async ({ cookies, url }) => { + cookies.delete(COOKIE, cookieOptions(url)); + throw redirect(303, "/login"); +}; diff --git a/services/pp-auth-demo/src/routes/api/auth/offer/+server.ts b/services/pp-auth-demo/src/routes/api/auth/offer/+server.ts new file mode 100644 index 000000000..84d3fb8f1 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/auth/offer/+server.ts @@ -0,0 +1,5 @@ +import { json } from "@sveltejs/kit"; +import { createLoginOffer } from "$lib/server/session"; +import type { RequestHandler } from "./$types"; + +export const POST: RequestHandler = async () => json(createLoginOffer()); diff --git a/services/pp-auth-demo/src/routes/api/auth/session/[session]/+server.ts b/services/pp-auth-demo/src/routes/api/auth/session/[session]/+server.ts new file mode 100644 index 000000000..f42046c2f --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/auth/session/[session]/+server.ts @@ -0,0 +1,16 @@ +import { json } from "@sveltejs/kit"; +import { poll } from "$lib/server/session"; +import { COOKIE, cookieOptions, mint } from "$lib/server/token"; +import type { RequestHandler } from "./$types"; + +/** Polled by the login page until the wallet has answered. */ +export const GET: RequestHandler = async ({ params, cookies, url }) => { + const result = poll(params.session); + if (result.status === "unknown") { + return json({ status: "unknown" }, { status: 410 }); + } + if (result.status !== "done") return json({ status: "pending" }); + + cookies.set(COOKIE, mint(result.ename), cookieOptions(url)); + return json({ status: "authenticated", ename: result.ename }); +}; diff --git a/services/pp-auth-demo/src/routes/api/handshake/+server.ts b/services/pp-auth-demo/src/routes/api/handshake/+server.ts deleted file mode 100644 index a91e0ba1a..000000000 --- a/services/pp-auth-demo/src/routes/api/handshake/+server.ts +++ /dev/null @@ -1,28 +0,0 @@ -import { json } from "@sveltejs/kit"; -import { - answerChallenge, - verifyHandshake, -} from "@metastate-foundation/auth/platform"; -import { OWNER_ENAME, world } from "$lib/server/world"; -import type { RequestHandler } from "./$types"; - -/** Runs the handshake alone, so the chain can be inspected without touching data. */ -export const POST: RequestHandler = async ({ request }) => { - const { deploymentId } = (await request.json()) as { deploymentId?: string }; - const current = await world(); - const deployment = current.deployments.get(String(deploymentId)); - if (!deployment) return json({ error: "Unknown deployment" }, { status: 404 }); - - const challenge = current.challenges.issue(OWNER_ENAME); - const response = await answerChallenge(deployment.identity, challenge); - const chain = await verifyHandshake(response, { - audience: OWNER_ENAME, - registryBaseUrl: "demo://registry", - registryJwksUri: "demo://registry/.well-known/jwks.json", - verifyWalletSignature: current.roots.verifyWalletSignature, - resolveJwks: current.resolveJwks, - store: current.challenges, - }); - - return json({ chain, challenge }); -}; diff --git a/services/pp-auth-demo/src/routes/api/key/+server.ts b/services/pp-auth-demo/src/routes/api/key/+server.ts new file mode 100644 index 000000000..4efcfafc0 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/key/+server.ts @@ -0,0 +1,26 @@ +import { json } from "@sveltejs/kit"; +import { forget, remember } from "$lib/server/keys"; +import type { RequestHandler } from "./$types"; + +/** + * Accepts a deployment's private key so the possession link can be proved. + * + * Held in memory for this process only — never written to disk, never logged, + * gone on restart. It is accepted at all because whoever is running this holds + * these deployments, and supplying the key is how they demonstrate the one + * link that reading public records cannot establish. + */ +export const POST: RequestHandler = async ({ request }) => { + const { deploymentEname, privateKey } = (await request.json()) as { + deploymentEname?: string; + privateKey?: string; + }; + if (!deploymentEname) return json({ error: "deploymentEname is required" }, { status: 400 }); + + if (!privateKey?.trim()) { + forget(deploymentEname); + return json({ keyHeld: false }); + } + remember(deploymentEname, privateKey); + return json({ keyHeld: true }); +}; diff --git a/services/pp-auth-demo/src/routes/api/policy/+server.ts b/services/pp-auth-demo/src/routes/api/policy/+server.ts deleted file mode 100644 index 4104061d0..000000000 --- a/services/pp-auth-demo/src/routes/api/policy/+server.ts +++ /dev/null @@ -1,58 +0,0 @@ -import { json } from "@sveltejs/kit"; -import { - CERTIFICATION_LEVELS, - defaultAccessPolicy, - verifyAccessPolicy, - type CertificationLevel, -} from "@metastate-foundation/auth/platform"; -import { OWNER_ENAME, signPolicy, verifyOwnerSignature, world } from "$lib/server/world"; -import type { RequestHandler } from "./$types"; - -/** - * Records the owner's terms as a signed statement. - * - * The signature is made here with the owner's stand-in key; in a running - * system this is where the eID wallet signs. It is verified immediately after - * signing, so a statement that could not be checked never becomes the policy. - */ -export const POST: RequestHandler = async ({ request }) => { - const body = (await request.json()) as Record; - const current = await world(); - - const level = String(body.minimumLevel ?? "") as CertificationLevel; - if (!CERTIFICATION_LEVELS.includes(level)) { - return json({ error: "Unknown level" }, { status: 400 }); - } - const strings = (value: unknown): string[] => - Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : []; - const minimumReputation = - body.minimumReputation === null || body.minimumReputation === "" - ? null - : Number(body.minimumReputation); - if (minimumReputation !== null && !Number.isFinite(minimumReputation)) { - return json({ error: "Reputation threshold must be a number" }, { status: 400 }); - } - - const statement = { - ...defaultAccessPolicy(OWNER_ENAME), - minimumLevel: level, - reputationEngine: - typeof body.reputationEngine === "string" ? body.reputationEngine.trim() : "", - minimumReputation, - allowedDomains: body.allowedDomains === null ? null : strings(body.allowedDomains), - deniedDomains: strings(body.deniedDomains), - issuedAt: new Date().toISOString(), - nonce: crypto.randomUUID(), - }; - - const signed = await signPolicy(statement, current.ownerKey); - const valid = await verifyAccessPolicy(signed, (_signer, signature, payload) => - verifyOwnerSignature(current, signature, payload), - ); - if (!valid) { - return json({ error: "The signed terms did not verify" }, { status: 500 }); - } - - current.policy = signed; - return json({ policy: signed.statement, payload: signed.payload, signature: signed.signature }); -}; diff --git a/services/pp-auth-demo/src/routes/api/reset/+server.ts b/services/pp-auth-demo/src/routes/api/reset/+server.ts deleted file mode 100644 index a91debee3..000000000 --- a/services/pp-auth-demo/src/routes/api/reset/+server.ts +++ /dev/null @@ -1,8 +0,0 @@ -import { json } from "@sveltejs/kit"; -import { resetWorld } from "$lib/server/world"; -import type { RequestHandler } from "./$types"; - -export const POST: RequestHandler = async () => { - await resetWorld(); - return json({ ok: true }); -}; diff --git a/services/pp-auth-demo/src/routes/api/tamper/+server.ts b/services/pp-auth-demo/src/routes/api/tamper/+server.ts deleted file mode 100644 index d437b9a44..000000000 --- a/services/pp-auth-demo/src/routes/api/tamper/+server.ts +++ /dev/null @@ -1,90 +0,0 @@ -import { json } from "@sveltejs/kit"; -import { resetWorld, world } from "$lib/server/world"; -import type { RequestHandler } from "./$types"; - -/** - * Breaks one link on purpose. - * - * A chain that only ever passes demonstrates nothing. Each of these edits is - * something an attacker would plausibly try — presenting a key you do not - * hold, widening your own authorisation, borrowing a better-certified - * release's paperwork — and each should be caught by exactly one link. - */ -const EDITS: Record< - string, - { label: string; expect: string; apply: (deployment: any, other: any, value: string) => void } -> = { - publicKey: { - label: "Present a different public key", - expect: "possession", - apply: (deployment, _other, value) => { - deployment.identity.evidence.publicKey = value; - deployment.identity.evidence.deploymentKeyDocument.data.publicKey = value; - }, - }, - environment: { - label: "Promote itself from staging to production", - expect: "deployment-authorised", - apply: (deployment, _other, value) => { - deployment.identity.evidence.deploymentKeyDocument.data.environment = - value || "production-plus"; - }, - }, - versionDocument: { - label: "Borrow the other platform's version document", - expect: "bundle-integrity", - apply: (deployment, other) => { - deployment.identity.evidence.softwareVersionDocument = - structuredClone(other.identity.evidence.softwareVersionDocument); - }, - }, - versionEname: { - label: "Point at a different release", - expect: "version-identity", - apply: (deployment, _other, value) => { - deployment.identity.evidence.versionEname = - value || "@99999999-9999-4999-8999-999999999999"; - }, - }, - certificate: { - label: "Borrow the other platform's certificate", - expect: "accreditation", - apply: (deployment, other) => { - deployment.identity.evidence.accreditationJws = - other.identity.evidence.accreditationJws; - }, - }, -}; - -export const POST: RequestHandler = async ({ request }) => { - const { deploymentId, edit, value } = (await request.json()) as { - deploymentId?: string; - edit?: string; - value?: string; - }; - const current = await world(); - const deployment = current.deployments.get(String(deploymentId)); - if (!deployment) return json({ error: "Unknown deployment" }, { status: 404 }); - - if (edit === "restore") { - deployment.identity = structuredClone(deployment.pristine); - deployment.tampered = null; - return json({ tampered: null }); - } - - const change = EDITS[String(edit)]; - if (!change) return json({ error: "Unknown edit" }, { status: 400 }); - - const other = [...current.deployments.values()].find( - (entry) => entry.id !== deployment.id, - ); - change.apply(deployment, other, String(value ?? "")); - deployment.tampered = change.label; - - return json({ tampered: change.label, expect: change.expect }); -}; - -export const DELETE: RequestHandler = async () => { - await resetWorld(); - return json({ ok: true }); -}; diff --git a/services/pp-auth-demo/src/routes/api/terms/+server.ts b/services/pp-auth-demo/src/routes/api/terms/+server.ts new file mode 100644 index 000000000..a54ac1e30 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/terms/+server.ts @@ -0,0 +1,59 @@ +import { json } from "@sveltejs/kit"; +import { + CERTIFICATION_LEVELS, + defaultAccessPolicy, + type CertificationLevel, +} from "@metastate-foundation/auth/platform"; +import { randomUUID } from "node:crypto"; +import { prepare } from "$lib/server/policy"; +import { createSigningOffer } from "$lib/server/session"; +import type { RequestHandler } from "./$types"; + +/** + * Turns a draft into a statement and asks the wallet to sign it. + * + * The signing session id is the canonical payload itself, so what the wallet + * signs is exactly the digest of these terms — the resulting signature stands + * on its own, without anyone having to trust this app's session store. + */ +export const POST: RequestHandler = async ({ request, locals }) => { + const body = (await request.json()) as Record; + const ename = locals.user!.ename; + + const level = String(body.minimumLevel ?? "") as CertificationLevel; + if (!CERTIFICATION_LEVELS.includes(level)) { + return json({ error: "Pick a level" }, { status: 400 }); + } + const strings = (value: unknown): string[] => + Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : []; + const minimumReputation = + body.minimumReputation === null || body.minimumReputation === "" + ? null + : Number(body.minimumReputation); + if (minimumReputation !== null && !Number.isFinite(minimumReputation)) { + return json({ error: "The score must be a number" }, { status: 400 }); + } + + const statement = { + ...defaultAccessPolicy(ename), + minimumLevel: level, + reputationEngine: + typeof body.reputationEngine === "string" ? body.reputationEngine.trim() : "", + minimumReputation, + allowedDomains: null, + deniedDomains: strings(body.deniedDomains), + issuedAt: new Date().toISOString(), + nonce: randomUUID(), + }; + + const prepared = prepare(statement); + const offer = createSigningOffer(prepared.payload, { + message: "Set the terms platforms must meet to reach your data", + minimumLevel: statement.minimumLevel, + reputationEngine: statement.reputationEngine || "not used", + minimumReputation: statement.minimumReputation ?? "no threshold", + refused: statement.deniedDomains.length ? statement.deniedDomains : "nothing", + }); + + return json({ statement, payload: prepared.payload, uri: offer.uri }); +}; diff --git a/services/pp-auth-demo/src/routes/api/terms/status/+server.ts b/services/pp-auth-demo/src/routes/api/terms/status/+server.ts new file mode 100644 index 000000000..885f87e84 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/terms/status/+server.ts @@ -0,0 +1,42 @@ +import { json } from "@sveltejs/kit"; +import { parseAccessPolicy } from "@metastate-foundation/auth/platform"; +import { publish } from "$lib/server/policy"; +import { poll } from "$lib/server/session"; +import type { RequestHandler } from "./$types"; + +/** + * Polled while the wallet is deciding. Once it signs, the terms are published + * into the owner's own eVault — the signature is checked again before the + * write, so terms that cannot be verified never become the record. + */ +export const POST: RequestHandler = async ({ request, locals }) => { + const { payload, statement } = (await request.json()) as { + payload?: string; + statement?: unknown; + }; + if (!payload) return json({ error: "payload is required" }, { status: 400 }); + + const result = poll(payload); + if (result.status !== "done") return json({ status: result.status }); + + if (result.ename !== locals.user!.ename) { + return json( + { status: "rejected", error: "Those terms were signed by a different person." }, + { status: 403 }, + ); + } + + const parsed = parseAccessPolicy(statement); + if (!parsed) return json({ status: "rejected", error: "Malformed terms" }, { status: 400 }); + + try { + const id = await publish(parsed, payload, result.signature); + return json({ status: "published", id }); + } catch (error) { + console.error("[pp-auth-demo/terms] publish failed:", error); + return json( + { status: "rejected", error: error instanceof Error ? error.message : "failed" }, + { status: 500 }, + ); + } +}; diff --git a/services/pp-auth-demo/src/routes/api/verify/+server.ts b/services/pp-auth-demo/src/routes/api/verify/+server.ts new file mode 100644 index 000000000..33dc2467e --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/verify/+server.ts @@ -0,0 +1,33 @@ +import { json } from "@sveltejs/kit"; +import { assemble, verify } from "$lib/server/chain"; +import { deployments } from "$lib/server/aaas"; +import { keyFor } from "$lib/server/keys"; +import type { RequestHandler } from "./$types"; + +/** + * Verifies one real deployment's chain of trust, now. + * + * Every link is checked against evidence read from the network at request + * time. Possession is only provable when this app has been given that + * deployment's private key; otherwise it fails and says why, which is the + * correct outcome rather than a gap to paper over. + */ +export const POST: RequestHandler = async ({ request, locals }) => { + const { deploymentEname } = (await request.json()) as { deploymentEname?: string }; + const all = await deployments(); + const deployment = all.find((d) => d.deploymentEname === deploymentEname); + if (!deployment) return json({ error: "Unknown deployment" }, { status: 404 }); + + const assembled = await assemble(deployment); + if (!assembled.evidence) { + return json({ chain: null, missing: assembled.missing, possessionProven: false }); + } + + const { chain, possessionProven } = await verify( + assembled.evidence, + locals.user!.ename, + keyFor(deployment.deploymentEname), + ); + + return json({ chain, missing: [], possessionProven }); +}; diff --git a/services/pp-auth-demo/src/routes/data/+page.server.ts b/services/pp-auth-demo/src/routes/data/+page.server.ts new file mode 100644 index 000000000..159e1b88f --- /dev/null +++ b/services/pp-auth-demo/src/routes/data/+page.server.ts @@ -0,0 +1,65 @@ +import { authorize, type PlatformClaim } from "@metastate-foundation/auth/platform"; +import { accreditations, platformProfile } from "$lib/server/aaas"; +import { ownedByDomain } from "$lib/server/data"; +import { currentPolicy } from "$lib/server/policy"; +import type { PageServerLoad } from "./$types"; + +/** + * The owner's own records, and — for each certified platform — what it would + * be allowed to reach and what it would be refused. + * + * The decisions here are the real ones: the real certificate's domains, the + * owner's real signed terms, and the same `authorize` an eVault would call. + * What is not being claimed is that these platforms have asked; this is what + * would happen if they did. + */ +export const load: PageServerLoad = async ({ locals }) => { + const ename = locals.user!.ename; + + const [groups, policy, records] = await Promise.all([ + ownedByDomain(ename).catch((error) => { + console.error("[pp-auth-demo/data] could not read records:", error); + return []; + }), + currentPolicy(ename), + accreditations(), + ]); + + // Newest granted decision per platform. + const granted = new Map(); + for (const record of records) { + if (record.decision !== "granted") continue; + if (!granted.has(record.platformEName)) granted.set(record.platformEName, record); + } + + const domainIds = groups.map((group) => group.id); + + const platforms = await Promise.all( + [...granted.values()].map(async (record) => { + const profile = await platformProfile(record.platformEName); + const claim: PlatformClaim = { + platformEname: record.platformEName, + platformName: profile?.displayName || record.platformName, + deploymentEname: "", + version: record.platformVersion, + level: (record.level ?? "L0") as PlatformClaim["level"], + domains: record.domains ?? [], + deployerEname: "", + reviewedByEName: record.reviewedByEName, + }; + return { + ename: record.platformEName, + name: claim.platformName, + level: record.level, + version: record.platformVersion, + certifiedDomains: record.domains ?? [], + decisions: domainIds.map((domain) => ({ + domain, + ...authorize(policy.statement, { claim, domain }), + })), + }; + }), + ); + + return { ename, groups, platforms, policy }; +}; diff --git a/services/pp-auth-demo/src/routes/data/+page.svelte b/services/pp-auth-demo/src/routes/data/+page.svelte new file mode 100644 index 000000000..7dea72672 --- /dev/null +++ b/services/pp-auth-demo/src/routes/data/+page.svelte @@ -0,0 +1,111 @@ + + +
+
+

Your data

+

What is in your eVault

+

+ Your own records, grouped the way the ontology groups them. That grouping is + what a certificate is written against, so it is also what decides which + platform can see which of these. +

+
+ + {#if data.platforms.length > 0 && data.groups.length > 0} +
+
+

Who could reach what

+

+ Each certified platform against each kind of data you hold, decided + by its certificate and your terms. +

+
+
+ + + + + {#each data.groups as group (group.id)} + + {/each} + + + + {#each data.platforms as platform (platform.ename)} + + + {#each platform.decisions as decision (decision.domain)} + + {/each} + + {/each} + +
Platform{group.label}
+

{platform.name}

+

+ {platform.level} · {platform.version} +

+ 		+ {#if decision.allowed} + + Allowed + + {:else} + + Refused + + {/if} +
+
+
+ {#each data.platforms as platform (platform.ename)} + {#each platform.decisions.filter((d) => !d.allowed) as decision (decision.domain)} +

+ {platform.name} + · {labelFor(decision.domain)} — {decision.reason} +

+ {/each} + {/each} +
+
+ {/if} + + {#if data.groups.length === 0} +
+

+ Nothing readable was found in your eVault. That may mean it is empty, or + that it is not reachable from here right now. +

+
+ {/if} + + {#each data.groups as group (group.id)} +
+
+

{group.label}

+ {#if group.description} +

{group.description}

+ {/if} +
+
    + {#each group.records as record (record.id)} +
  • +

    {record.kind}

    +

    {record.summary}

    +
    • + {/each} +
+
+ {/each} +
diff --git a/services/pp-auth-demo/src/routes/login/+page.svelte b/services/pp-auth-demo/src/routes/login/+page.svelte new file mode 100644 index 000000000..877998543 --- /dev/null +++ b/services/pp-auth-demo/src/routes/login/+page.svelte @@ -0,0 +1,63 @@ + + +
+
+
+

Sign in

+

Scan with your wallet

+

+ This reads your own eVault, so it needs to know it is you. +

+
+ + {#if uri} +
+ +
+ {:else if error} +

{error}

+ + {:else} +

Preparing a code…

+ {/if} +
+
diff --git a/services/pp-auth-demo/src/routes/platforms/+page.server.ts b/services/pp-auth-demo/src/routes/platforms/+page.server.ts new file mode 100644 index 000000000..3bdb56b8d --- /dev/null +++ b/services/pp-auth-demo/src/routes/platforms/+page.server.ts @@ -0,0 +1,102 @@ +import { accreditations, deployments, isConfigured, platformProfile } from "$lib/server/aaas"; +import { accreditationFor } from "$lib/server/chain"; +import { held } from "$lib/server/keys"; +import type { PageServerLoad } from "./$types"; + +export interface PlatformView { + ename: string; + name: string; + description: string; + currentVersion: string; + logoUrl: string | null; + deployments: Array<{ + ename: string; + name: string; + environment: string; + version: string; + releaseTag: string; + commitSha: string; + deployerEname: string; + publicKey: string; + /** The decision covering this deployment's exact version. */ + certified: { level: string | null; domains: string[]; decision: string } | null; + keyHeld: boolean; + }>; +} + +/** + * Every platform the network knows about that has at least one deployment or + * one certification decision. Nothing is seeded: an empty page means nothing + * has been deployed or certified yet, which is a true statement about the + * network rather than a failure of this app. + */ +export const load: PageServerLoad = async () => { + if (!isConfigured()) { + return { configured: false, platforms: [] as PlatformView[], error: null }; + } + + try { + const [allDeployments, allAccreditations] = await Promise.all([ + deployments(), + accreditations(), + ]); + + const enames = new Set([ + ...allDeployments.map((d) => d.platformEname), + ...allAccreditations.map((a) => a.platformEName), + ]); + + const withKeys = new Set(held()); + + const platforms = await Promise.all( + [...enames].map(async (ename): Promise => { + const profile = await platformProfile(ename); + const mine = allDeployments + .filter((d) => d.platformEname === ename) + .sort((a, b) => a.environment.localeCompare(b.environment)); + return { + ename, + name: profile?.displayName || profile?.platformName || ename, + description: profile?.description ?? "", + currentVersion: profile?.version ?? "", + logoUrl: profile?.logoUrl ?? null, + deployments: mine.map((deployment) => { + const decision = accreditationFor( + allAccreditations, + ename, + deployment.version, + ); + return { + ename: deployment.deploymentEname, + name: deployment.deploymentName, + environment: deployment.environment, + version: deployment.version, + releaseTag: deployment.releaseTag, + commitSha: deployment.commitSha, + deployerEname: deployment.deployerEname, + publicKey: deployment.publicKey, + keyHeld: withKeys.has(deployment.deploymentEname), + certified: decision + ? { + level: decision.level, + domains: decision.domains ?? [], + decision: decision.decision, + } + : null, + }; + }), + }; + }), + ); + + platforms.sort((a, b) => b.deployments.length - a.deployments.length); + return { configured: true, platforms, error: null }; + } catch (error) { + console.error("[pp-auth-demo/platforms] load failed:", error); + return { + configured: true, + platforms: [] as PlatformView[], + error: error instanceof Error ? error.message : "could not read the network", + }; + } +}; diff --git a/services/pp-auth-demo/src/routes/platforms/+page.svelte b/services/pp-auth-demo/src/routes/platforms/+page.svelte new file mode 100644 index 000000000..4b72e424d --- /dev/null +++ b/services/pp-auth-demo/src/routes/platforms/+page.svelte @@ -0,0 +1,82 @@ + + +
+
+

Platforms

+

+ Every platform running on the network +

+

+ Read live from the network — the platforms, their releases, the deployments + actually running them, and the decisions the association has issued. Check + any deployment and it proves what it is, from scratch, against records + anyone can read. +

+
+ + {#if !data.configured} +
+

+ This app has no key for the awareness network, so it cannot see what is + out there. Set PPA_AWARENESS_API_KEY and reload. +

+
+ {:else if data.error} +
+

Could not read the network: {data.error}

+
+ {:else if data.platforms.length === 0} +
+

+ Nothing has been deployed or certified yet. This page fills in on its own + once a platform ships a release and the association decides on it. +

+
+ {/if} + + {#each data.platforms as platform (platform.ename)} +
+
+
+

{platform.name}

+ {#if platform.description} +

{platform.description}

+ {/if} +

{platform.ename}

+
+ {#if platform.deployments[0]?.certified?.decision === "granted"} +
+ + {platform.deployments[0].certified?.level} + + {#each platform.deployments[0].certified?.domains ?? [] as domain (domain)} + {domain} + {/each} +
+ {/if} +
+ + {#if platform.deployments.length === 0} +

+ Certified, but nothing is deployed from it yet. +

+ {:else} +
+ {#each platform.deployments as deployment (deployment.ename)} + + {/each} +
+ {/if} +
+ {/each} +
diff --git a/services/pp-auth-demo/src/routes/terms/+page.server.ts b/services/pp-auth-demo/src/routes/terms/+page.server.ts new file mode 100644 index 000000000..c8778b3ce --- /dev/null +++ b/services/pp-auth-demo/src/routes/terms/+page.server.ts @@ -0,0 +1,12 @@ +import { listDomains } from "$lib/server/domains"; +import { currentPolicy } from "$lib/server/policy"; +import type { PageServerLoad } from "./$types"; + +export const load: PageServerLoad = async ({ locals }) => { + const ename = locals.user!.ename; + const [policy, domains] = await Promise.all([ + currentPolicy(ename), + listDomains().catch(() => []), + ]); + return { ename, policy, domains }; +}; diff --git a/services/pp-auth-demo/src/routes/terms/+page.svelte b/services/pp-auth-demo/src/routes/terms/+page.svelte new file mode 100644 index 000000000..7c6a9e39e --- /dev/null +++ b/services/pp-auth-demo/src/routes/terms/+page.svelte @@ -0,0 +1,49 @@ + + +
+
+

Your terms

+

What you will deal with

+

+ The association says what a platform was found to be. You decide what that + is worth. You sign your answers with your wallet and they are kept in your + own eVault, so they travel with you and anyone can check them — including a + platform working out whether it is worth asking. +

+ {#if data.policy.signed} +

+ Signed on {new Date(data.policy.issuedAt ?? "").toLocaleString()}. +

+ {:else} +

+ You have not set any terms yet, so the default applies: nothing below + {data.policy.statement.minimumLevel}. +

+ {/if} +
+ + {#key data.policy.statement.nonce} + + {/key} + + {#if data.policy.signed} +
+
+ + The statement you signed + + 
{JSON.stringify(
+                        data.policy.statement,
+                        null,
+                        2,
+                    )}
+

Signature: {data.policy.signature}

+
+
+ {/if} +
diff --git a/services/pp-auth-demo/src/svelte-qrcode.d.ts b/services/pp-auth-demo/src/svelte-qrcode.d.ts new file mode 100644 index 000000000..cb853dae7 --- /dev/null +++ b/services/pp-auth-demo/src/svelte-qrcode.d.ts @@ -0,0 +1,20 @@ +/** + * svelte-qrcode ships no type declarations — its package exports only the + * `svelte` condition pointing at raw component source. Declare the props we + * use so `svelte-check` can see the component. + */ +declare module "svelte-qrcode" { + import type { Component } from "svelte"; + + const QrCode: Component<{ + value?: string; + size?: string | number; + color?: string; + background?: string; + padding?: number; + errorCorrection?: "L" | "M" | "Q" | "H"; + className?: string; + }>; + + export default QrCode; +} From 68b23f91c9830c8fec2f66dd2ba8ad24cfa531d7 Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 18:15:28 +0800 Subject: [PATCH 08/18] fix: point wallet callbacks at the address the page was served on The QR encoded localhost, so a phone scanning it called back to itself and the login never completed. Also adds the w3ds://sign callback route, which was missing entirely. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- .../pp-auth-demo/src/lib/server/session.ts | 20 +++++++-- .../src/routes/api/auth/offer/+server.ts | 3 +- .../src/routes/api/sign/+server.ts | 41 +++++++++++++++++++ .../src/routes/api/terms/+server.ts | 20 +++++---- 4 files changed, 72 insertions(+), 12 deletions(-) create mode 100644 services/pp-auth-demo/src/routes/api/sign/+server.ts diff --git a/services/pp-auth-demo/src/lib/server/session.ts b/services/pp-auth-demo/src/lib/server/session.ts index d44d02658..6ba2fba00 100644 --- a/services/pp-auth-demo/src/lib/server/session.ts +++ b/services/pp-auth-demo/src/lib/server/session.ts @@ -43,11 +43,24 @@ function sweep(): void { } } -export function createLoginOffer(): { uri: string; session: string } { +/** + * Where the wallet should post back. + * + * Taken from the request being served, not from configuration. The wallet runs + * on a phone, so a callback of `localhost` points it at itself and the login + * silently never completes — and a static env var is wrong the moment the app + * is reached on a different address than whoever set it had in mind. The + * origin the browser used is the one address known to reach this app. + */ +function callback(origin: string | undefined, path: string): string { + return new URL(path, origin || publicUrl()).toString(); +} + +export function createLoginOffer(origin?: string): { uri: string; session: string } { sweep(); const session = randomUUID(); sessions.set(session, { createdAt: Date.now(), kind: "login", status: "pending" }); - const redirect = new URL("/api/auth", publicUrl()).toString(); + const redirect = callback(origin, "/api/auth"); return { session, uri: `w3ds://auth?redirect=${redirect}&session=${session}&platform=pp-auth-demo`, @@ -62,10 +75,11 @@ export function createLoginOffer(): { uri: string; session: string } { export function createSigningOffer( payload: string, summary: Record, + origin?: string, ): { uri: string; session: string } { sweep(); sessions.set(payload, { createdAt: Date.now(), kind: "policy", status: "pending" }); - const redirect = new URL("/api/sign", publicUrl()).toString(); + const redirect = callback(origin, "/api/sign"); const data = Buffer.from(JSON.stringify(summary), "utf8").toString("base64"); return { session: payload, diff --git a/services/pp-auth-demo/src/routes/api/auth/offer/+server.ts b/services/pp-auth-demo/src/routes/api/auth/offer/+server.ts index 84d3fb8f1..cc3ed86b1 100644 --- a/services/pp-auth-demo/src/routes/api/auth/offer/+server.ts +++ b/services/pp-auth-demo/src/routes/api/auth/offer/+server.ts @@ -2,4 +2,5 @@ import { json } from "@sveltejs/kit"; import { createLoginOffer } from "$lib/server/session"; import type { RequestHandler } from "./$types"; -export const POST: RequestHandler = async () => json(createLoginOffer()); +export const POST: RequestHandler = async ({ url }) => + json(createLoginOffer(url.origin)); diff --git a/services/pp-auth-demo/src/routes/api/sign/+server.ts b/services/pp-auth-demo/src/routes/api/sign/+server.ts new file mode 100644 index 000000000..7f65deef9 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/sign/+server.ts @@ -0,0 +1,41 @@ +import { json } from "@sveltejs/kit"; +import { complete } from "$lib/server/session"; +import type { RequestHandler } from "./$types"; + +/** + * Wallet callback for w3ds://sign. + * + * The wallet signs the session id and posts it back as `message`. For the + * owner's terms that session id is the canonical payload of the statement, so + * this signature is over the terms themselves — the page polling + * /api/terms/status is what turns it into a published record. + * + * Field names vary between wallet builds, so accept the shapes in use. + */ +export const POST: RequestHandler = async ({ request }) => { + const body = (await request.json().catch(() => ({}))) as Record; + const session = String(body.sessionId ?? body.session ?? ""); + const ename = String(body.w3id ?? body.ename ?? body.eName ?? ""); + const signature = String(body.signature ?? ""); + + if (!session || !ename || !signature) { + return json( + { error: "sessionId, w3id and signature are required" }, + { status: 400 }, + ); + } + + // The wallet echoes what it signed; if it disagrees with the session we are + // tracking, something has been substituted along the way. + const message = body.message === undefined ? session : String(body.message); + if (message !== session) { + return json({ error: "signed payload does not match the session" }, { status: 400 }); + } + + const result = await complete(session, ename, signature); + if (!result.ok) { + console.warn("[pp-auth-demo/sign] rejected:", result.error); + return json({ error: result.error }, { status: 401 }); + } + return json({ ok: true }); +}; diff --git a/services/pp-auth-demo/src/routes/api/terms/+server.ts b/services/pp-auth-demo/src/routes/api/terms/+server.ts index a54ac1e30..47a1bfcc7 100644 --- a/services/pp-auth-demo/src/routes/api/terms/+server.ts +++ b/services/pp-auth-demo/src/routes/api/terms/+server.ts @@ -16,7 +16,7 @@ import type { RequestHandler } from "./$types"; * signs is exactly the digest of these terms — the resulting signature stands * on its own, without anyone having to trust this app's session store. */ -export const POST: RequestHandler = async ({ request, locals }) => { +export const POST: RequestHandler = async ({ request, locals, url }) => { const body = (await request.json()) as Record; const ename = locals.user!.ename; @@ -47,13 +47,17 @@ export const POST: RequestHandler = async ({ request, locals }) => { }; const prepared = prepare(statement); - const offer = createSigningOffer(prepared.payload, { - message: "Set the terms platforms must meet to reach your data", - minimumLevel: statement.minimumLevel, - reputationEngine: statement.reputationEngine || "not used", - minimumReputation: statement.minimumReputation ?? "no threshold", - refused: statement.deniedDomains.length ? statement.deniedDomains : "nothing", - }); + const offer = createSigningOffer( + prepared.payload, + { + message: "Set the terms platforms must meet to reach your data", + minimumLevel: statement.minimumLevel, + reputationEngine: statement.reputationEngine || "not used", + minimumReputation: statement.minimumReputation ?? "no threshold", + refused: statement.deniedDomains.length ? statement.deniedDomains : "nothing", + }, + url.origin, + ); return json({ statement, payload: prepared.payload, uri: offer.uri }); }; From ac17d50598c01ac63a598b1ac10ee0e677c419ac Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 18:30:26 +0800 Subject: [PATCH 09/18] feat: gate requests on what a platform may do, not just what it is Certification says which data a release was assessed for; it says nothing about operations. Adds a third gate over the existing AccessGrant ontology: resource:Action permissions, deny by default, append-only revisions, with a withdrawn grant distinguishable from one never made. Deployment keys move to the top of the flow rather than appearing after a failed check, since possession decides what a check can mean. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- .../pp-auth-demonstrator.md | 10 + docs/docs/W3DS Basics/Access-Policy.md | 16 ++ packages/auth/src/platform/authorize.ts | 76 ++++++- packages/auth/src/platform/grants.spec.ts | 190 ++++++++++++++++++ packages/auth/src/platform/grants.ts | 110 ++++++++++ packages/auth/src/platform/index.ts | 2 + .../pp-auth-demo/src/lib/DeploymentRow.svelte | 67 ++---- services/pp-auth-demo/src/lib/KeyEntry.svelte | 94 +++++++++ .../pp-auth-demo/src/lib/RequestTester.svelte | 130 ++++++++++++ .../pp-auth-demo/src/lib/server/grants.ts | 129 ++++++++++++ .../pp-auth-demo/src/lib/server/ontology.ts | 1 + .../pp-auth-demo/src/routes/+layout.svelte | 1 + .../src/routes/acl/+page.server.ts | 70 +++++++ .../pp-auth-demo/src/routes/acl/+page.svelte | 150 ++++++++++++++ .../src/routes/api/grants/+server.ts | 38 ++++ .../src/routes/api/request/+server.ts | 78 +++++++ 16 files changed, 1100 insertions(+), 62 deletions(-) create mode 100644 packages/auth/src/platform/grants.spec.ts create mode 100644 packages/auth/src/platform/grants.ts create mode 100644 services/pp-auth-demo/src/lib/KeyEntry.svelte create mode 100644 services/pp-auth-demo/src/lib/RequestTester.svelte create mode 100644 services/pp-auth-demo/src/lib/server/grants.ts create mode 100644 services/pp-auth-demo/src/routes/acl/+page.server.ts create mode 100644 services/pp-auth-demo/src/routes/acl/+page.svelte create mode 100644 services/pp-auth-demo/src/routes/api/grants/+server.ts create mode 100644 services/pp-auth-demo/src/routes/api/request/+server.ts diff --git a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md index c641039cf..036808d18 100644 --- a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md +++ b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md @@ -39,6 +39,16 @@ Your own eVault records, grouped by the domain each schema declares. That groupi The table shows every certified platform against every kind of data you hold, decided by the real certificate's domains and your real signed terms, using the same `authorize` an eVault would call. A platform certified for `social`, `finance` and `media` is allowed those and refused everything else — with the reason spelled out. It cannot reach your messages or your files, and nothing it presents will change that. +## Permissions + +Being certified for a kind of data is not permission to do anything with it. This tab is where that is settled: for each certified platform, a read and a write toggle per domain it was certified for. Nothing else is listed, because anything else is refused before permissions are consulted. + +Each change writes an `AccessGrant` into your own eVault as a new revision. Clearing both toggles withdraws the grant rather than deleting it, so the record shows access was taken away rather than never given. + +**Deployment keys go in here, before you try anything.** Possession is the one link a reader cannot establish by looking, so whether the key is present decides what a check can even mean. Enter it and the deployment can answer a challenge for real; leave it out and every request stops at the handshake, which is the correct outcome. + +**Try a request** then runs one all the way through — a named deployment, an operation, a domain — and reports which of the three gates decided. Turn off write and a write is refused while a read still succeeds; withdraw the grant and the refusal changes from "has not been given permission" to "has been withdrawn". + ## Your terms The association says what a platform was found to be; you decide what that is worth. Set the minimum level, whose reputation scores you accept and the score they must reach, and any domain refused outright. diff --git a/docs/docs/W3DS Basics/Access-Policy.md b/docs/docs/W3DS Basics/Access-Policy.md index 62cddef5d..70db38fd1 100644 --- a/docs/docs/W3DS Basics/Access-Policy.md +++ b/docs/docs/W3DS Basics/Access-Policy.md @@ -47,6 +47,22 @@ The newest statement for a subject is the one in force. An owner who has never s Published as the `Access Policy` ontology (`c7a41f6d-95b8-4e2a-9c33-8f0d1b6e4a72`), domain `governance`. +## Permissions are a separate question + +A policy says which platforms you will deal with. It does not say what they may *do* — reading your posts is not the same as writing to them. + +That is what an [`AccessGrant`](https://github.com/MetaState-Prototype-Project/prototype/blob/main/services/ontology/schemas/accessGrant.json) is for: a grantee, a resource, and permissions written as `resource:Action` (`social:Read`, `finance:Write`). Grants are **deny by default** — a platform that is certified for a domain and permitted by your policy still needs a grant covering the operation it is attempting. + +Grants are append-only. Changing what a platform may do writes a new revision rather than editing the old record, and withdrawing access marks the grant revoked while keeping the permissions it used to carry. So "your access was withdrawn" and "you never had access" stay distinguishable, which matters when explaining a refusal to someone. + +The three gates run in order, and each can only narrow the one before it: + +1. **The certificate** — was this release assessed for this domain? +2. **Your policy** — will you deal with this platform at all? +3. **The grants** — may it do this particular thing? + +A grant cannot widen a certificate. Permitting `health:Read` to a platform never certified for `health` changes nothing. + ## See also - [Platform Authentication](/docs/W3DS%20Protocol/Platform-Authentication) — how a platform proves which release it is running diff --git a/packages/auth/src/platform/authorize.ts b/packages/auth/src/platform/authorize.ts index 50bff74e8..467613868 100644 --- a/packages/auth/src/platform/authorize.ts +++ b/packages/auth/src/platform/authorize.ts @@ -1,16 +1,29 @@ /** * What a verified platform may actually touch. * - * Two independent gates, and both must open. The association's certificate - * names the domains a release was assessed for; the owner's policy names what - * they will permit. A social platform certified for `social` and - * `communication` has no path to `finance` data — not because the eVault - * recognises it as a social platform, but because `finance` is not in its - * certificate and nothing it can present adds it. + * Three independent gates, and all of them must open: + * + * 1. the association's certificate names the domains a release was assessed + * for — a social platform certified for `social` and `communication` has + * no path to `finance` data, not because the eVault recognises it as a + * social platform, but because `finance` is not in its certificate and + * nothing it can present adds it; + * 2. the owner's policy names what they will deal with at all; + * 3. the grants name what may be done — reading is not writing, and a + * platform certified and permitted for a domain still needs a grant that + * covers the operation it is attempting. + * + * Each narrows the one before it. None of them can widen an earlier one. */ import { levelRank, type CertificationLevel, type PlatformClaim } from "./types.js"; import { type AccessPolicyStatement } from "./policy.js"; +import { + evaluateGrants, + permissionFor, + type AccessGrant, + type Operation, +} from "./grants.js"; export type DenialCode = | "domain-not-certified" @@ -18,7 +31,10 @@ export type DenialCode = | "domain-outside-owner-allowlist" | "level-below-policy" | "reputation-engine-not-accepted" - | "reputation-below-policy"; + | "reputation-below-policy" + | "operation-not-granted" + | "grant-revoked" + | "grant-expired"; export interface ReputationReading { /** eName or URL of the engine that produced it. */ @@ -31,6 +47,16 @@ export interface AuthorizationRequest { /** Domain of the record being read or written, from its ontology schema. */ domain: string; reputation?: ReputationReading | null; + /** What is being attempted. Defaults to a read. */ + operation?: Operation; + /** + * Grants held for this platform. Omit entirely when the caller does not use + * grants, which skips the layer; pass `[]` to say the platform holds none, + * which refuses everything. Those are different statements. + */ + grants?: AccessGrant[]; + /** Clock, for evaluating grant validity windows. */ + now?: Date; } export interface AuthorizationDecision { @@ -97,9 +123,40 @@ export function authorize( } } + if (request.grants !== undefined) { + const operation = request.operation ?? "read"; + const verb = operation === "read" ? "read" : "write to"; + const match = evaluateGrants( + request.grants, + claim.platformEname, + domain, + operation, + request.now, + ); + if (!match.allowed) { + if (match.reason === "revoked") { + return deny( + "grant-revoked", + `${claim.platformName}'s permission to ${verb} your ${domain} data has been withdrawn.`, + ); + } + if (match.reason === "expired") { + return deny( + "grant-expired", + `${claim.platformName}'s permission to ${verb} your ${domain} data is outside its valid dates.`, + ); + } + return deny( + "operation-not-granted", + `${claim.platformName} has not been given permission to ${verb} your ${domain} data.`, + ); + } + } + + const did = request.operation === "write" ? "write to" : "read"; return { allowed: true, - reason: `${claim.platformName} is certified ${claim.level} for ${domain} data and meets your terms.`, + reason: `${claim.platformName} is certified ${claim.level} for ${domain} data and may ${did} it.`, code: "granted", }; } @@ -115,4 +172,7 @@ export function permittedDomains( ); } +export { permissionFor }; +export type { AccessGrant, Operation }; + export type { CertificationLevel }; diff --git a/packages/auth/src/platform/grants.spec.ts b/packages/auth/src/platform/grants.spec.ts new file mode 100644 index 000000000..c86f42830 --- /dev/null +++ b/packages/auth/src/platform/grants.spec.ts @@ -0,0 +1,190 @@ +import { describe, expect, it } from "vitest"; +import { authorize } from "./authorize.js"; +import { evaluateGrants, permissionFor, type AccessGrant } from "./grants.js"; +import { defaultAccessPolicy, type AccessPolicyStatement } from "./policy.js"; +import type { PlatformClaim } from "./types.js"; + +const OWNER = "@849c0221-6f3f-55f9-95f0-f3b0d2b3092f"; +const PLATFORM = "@11111111-2222-4333-8444-555555555555"; + +function grant(overrides: Partial = {}): AccessGrant { + return { + granteeType: "ename", + granteeEName: PLATFORM, + resourceType: "social", + permissions: ["social:Read"], + status: "active", + validFrom: "2020-01-01T00:00:00.000Z", + validUntil: null, + ...overrides, + }; +} + +function claim(overrides: Partial = {}): PlatformClaim { + return { + platformEname: PLATFORM, + platformName: "Chatterbox", + deploymentEname: "@22222222-2222-4333-8444-555555555555", + version: "1.4.0", + level: "L3", + domains: ["social", "finance"], + deployerEname: "@33333333-2222-4333-8444-555555555555", + reviewedByEName: OWNER, + ...overrides, + }; +} + +function policy(overrides: Partial = {}): AccessPolicyStatement { + return { ...defaultAccessPolicy(OWNER), ...overrides }; +} + +describe("evaluateGrants", () => { + it("permits an operation a grant covers", () => { + expect(evaluateGrants([grant()], PLATFORM, "social", "read")).toEqual({ + allowed: true, + reason: "granted", + }); + }); + + it("does not let a read grant authorise a write", () => { + expect(evaluateGrants([grant()], PLATFORM, "social", "write")).toEqual({ + allowed: false, + reason: "not-granted", + }); + }); + + it("keeps one resource's grant away from another resource", () => { + expect(evaluateGrants([grant()], PLATFORM, "finance", "read").allowed).toBe(false); + }); + + it("keeps one platform's grant away from another platform", () => { + expect(evaluateGrants([grant()], "@somebody-else", "social", "read").allowed).toBe( + false, + ); + }); + + it("honours a grant made to everyone", () => { + const open = grant({ granteeType: "public", granteeEName: null }); + + expect(evaluateGrants([open], "@anyone-at-all", "social", "read").allowed).toBe(true); + }); + + it("reports a withdrawn permission as withdrawn, not as never held", () => { + const revoked = grant({ status: "revoked" }); + + expect(evaluateGrants([revoked], PLATFORM, "social", "read")).toEqual({ + allowed: false, + reason: "revoked", + }); + }); + + it("reports a grant outside its dates as expired", () => { + const lapsed = grant({ validUntil: "2020-06-01T00:00:00.000Z" }); + + expect(evaluateGrants([lapsed], PLATFORM, "social", "read")).toEqual({ + allowed: false, + reason: "expired", + }); + }); + + it("refuses a grant that has not started yet", () => { + const future = grant({ validFrom: "2999-01-01T00:00:00.000Z" }); + + expect(evaluateGrants([future], PLATFORM, "social", "read").reason).toBe("expired"); + }); + + it("lets a live grant win over a revoked one for the same thing", () => { + const grants = [grant({ status: "revoked" }), grant()]; + + expect(evaluateGrants(grants, PLATFORM, "social", "read").allowed).toBe(true); + }); + + it("builds the permission string the ontology uses", () => { + expect(permissionFor("finance", "write")).toBe("finance:Write"); + expect(permissionFor("social", "read")).toBe("social:Read"); + }); +}); + +describe("authorize with grants", () => { + it("skips the grant layer entirely when no grants are supplied", () => { + // Omitting grants means "this caller does not use them", which must not + // be read as "this caller holds none". + const decision = authorize(policy(), { claim: claim(), domain: "social" }); + + expect(decision.allowed).toBe(true); + }); + + it("refuses everything when the platform holds no grants", () => { + const decision = authorize(policy(), { + claim: claim(), + domain: "social", + grants: [], + }); + + expect(decision.allowed).toBe(false); + expect(decision.code).toBe("operation-not-granted"); + }); + + it("allows a read and refuses a write under a read-only grant", () => { + const request = { claim: claim(), domain: "social", grants: [grant()] }; + + expect(authorize(policy(), { ...request, operation: "read" }).allowed).toBe(true); + const write = authorize(policy(), { ...request, operation: "write" }); + expect(write.allowed).toBe(false); + expect(write.reason).toContain("write to your social data"); + }); + + it("allows a write when the grant covers writing", () => { + const writable = grant({ permissions: ["social:Read", "social:Write"] }); + + expect( + authorize(policy(), { + claim: claim(), + domain: "social", + operation: "write", + grants: [writable], + }).allowed, + ).toBe(true); + }); + + it("still refuses an uncertified domain however generous the grant", () => { + // A grant cannot widen a certificate: the association's assessment + // decides what the release was certified for, and nothing else does. + const generous = grant({ + resourceType: "health", + permissions: ["health:Read", "health:Write"], + }); + + const decision = authorize(policy(), { + claim: claim(), + domain: "health", + operation: "read", + grants: [generous], + }); + + expect(decision.code).toBe("domain-not-certified"); + }); + + it("still refuses a domain the owner denied however generous the grant", () => { + const generous = grant({ permissions: ["social:Read", "social:Write"] }); + + const decision = authorize(policy({ deniedDomains: ["social"] }), { + claim: claim(), + domain: "social", + grants: [generous], + }); + + expect(decision.code).toBe("domain-refused-by-owner"); + }); + + it("reports a withdrawn grant distinctly from one never made", () => { + const decision = authorize(policy(), { + claim: claim(), + domain: "social", + grants: [grant({ status: "revoked" })], + }); + + expect(decision.code).toBe("grant-revoked"); + expect(decision.reason).toContain("withdrawn"); + }); +}); diff --git a/packages/auth/src/platform/grants.ts b/packages/auth/src/platform/grants.ts new file mode 100644 index 000000000..1294e0605 --- /dev/null +++ b/packages/auth/src/platform/grants.ts @@ -0,0 +1,110 @@ +/** + * Access grants: what a platform may do with a particular kind of data. + * + * The certificate says which domains a platform was assessed for, and the + * owner's policy says what they will deal with at all. Neither says anything + * about *operations* — a platform certified for `social` is not thereby + * entitled to write to your posts as well as read them. + * + * That is what a grant is for, and it is the existing `AccessGrant` ontology + * (15d24c04-a4f3-4e45-a00e-0123926fbc87) rather than a new idea: a grantor, a + * grantee, a resource, and a list of `resource:Action` permissions, with a + * validity window and a revocation flag. + * + * Grants are deny-by-default. Passing no grant list at all means "this caller + * is not using grants", and the layer is skipped; passing an empty list means + * "this caller has no grants", and everything is refused. Those are different + * statements and conflating them would silently open a vault that meant to be + * closed. + */ + +export type Operation = "read" | "write"; + +/** The `AccessGrant` fields that bear on a decision. */ +export interface AccessGrant { + granteeType: "ename" | "public"; + granteeEName: string | null; + /** Domain id, or a narrower record type, in lower-kebab. */ + resourceType: string; + /** `resource:Action` strings, e.g. `social:Read`. */ + permissions: string[]; + status: "active" | "revoked"; + validFrom?: string; + validUntil?: string | null; +} + +function action(operation: Operation): string { + return operation === "read" ? "Read" : "Write"; +} + +/** The permission string a request needs, e.g. `finance:Write`. */ +export function permissionFor(resource: string, operation: Operation): string { + return `${resource}:${action(operation)}`; +} + +function withinWindow(grant: AccessGrant, now: Date): boolean { + const at = now.getTime(); + if (grant.validFrom) { + const from = Date.parse(grant.validFrom); + if (Number.isFinite(from) && at < from) return false; + } + if (grant.validUntil) { + const until = Date.parse(grant.validUntil); + if (Number.isFinite(until) && at > until) return false; + } + return true; +} + +function addressesGrantee(grant: AccessGrant, grantee: string): boolean { + if (grant.granteeType === "public") return true; + return grant.granteeEName === grantee; +} + +export interface GrantMatch { + /** True when some grant permits the operation. */ + allowed: boolean; + /** + * Why not, when refused: whether nothing addressed this grantee and + * resource at all, or something did but was revoked or out of date. + */ + reason: "granted" | "not-granted" | "revoked" | "expired"; +} + +/** + * Whether any grant permits `operation` on `resource` for `grantee`. + * + * A revoked or expired grant that would otherwise have matched is reported + * distinctly from no grant at all, because "your access was withdrawn" and + * "you never had access" are different things to tell someone. + */ +export function evaluateGrants( + grants: AccessGrant[], + grantee: string, + resource: string, + operation: Operation, + now = new Date(), +): GrantMatch { + const wanted = permissionFor(resource, operation); + let sawRevoked = false; + let sawExpired = false; + + for (const grant of grants) { + if (!addressesGrantee(grant, grantee)) continue; + if (grant.resourceType !== resource) continue; + if (!grant.permissions.includes(wanted)) continue; + + if (grant.status === "revoked") { + sawRevoked = true; + continue; + } + if (!withinWindow(grant, now)) { + sawExpired = true; + continue; + } + return { allowed: true, reason: "granted" }; + } + + if (sawRevoked) return { allowed: false, reason: "revoked" }; + if (sawExpired) return { allowed: false, reason: "expired" }; + return { allowed: false, reason: "not-granted" }; +} diff --git a/packages/auth/src/platform/index.ts b/packages/auth/src/platform/index.ts index a243f27cf..9cfffd134 100644 --- a/packages/auth/src/platform/index.ts +++ b/packages/auth/src/platform/index.ts @@ -30,6 +30,8 @@ export { } from "./policy.js"; export type { AccessPolicyStatement, SignedAccessPolicy } from "./policy.js"; export { authorize, permittedDomains } from "./authorize.js"; +export { evaluateGrants, permissionFor } from "./grants.js"; +export type { AccessGrant, GrantMatch, Operation } from "./grants.js"; export type { AuthorizationDecision, AuthorizationRequest, diff --git a/services/pp-auth-demo/src/lib/DeploymentRow.svelte b/services/pp-auth-demo/src/lib/DeploymentRow.svelte index 10c3d75b5..0fa5c2710 100644 --- a/services/pp-auth-demo/src/lib/DeploymentRow.svelte +++ b/services/pp-auth-demo/src/lib/DeploymentRow.svelte @@ -1,5 +1,6 @@
@@ -73,14 +56,13 @@ {deployment.releaseTag} · {deployment.commitSha.slice(0, 12)}

-
- {#if deployment.keyHeld} - Key supplied - {/if} - -
+ +
+ +
+
{#if checked && missing.length > 0} @@ -100,34 +82,11 @@ {chain.claim.level} for {chain.claim.domains.join(", ") || "no domains"}.

{:else if chain.failedAt === "possession" && !deployment.keyHeld} -
-

- Everything that can be checked by reading has been checked. The one - thing left is whether whoever is calling actually holds this - deployment's key — and only the deployment can show that. -

- {#if showKey} - -
- - -
-

- Kept in memory for this process only. Never written down, never logged. -

- {:else} - - {/if} -
+

+ Everything that can be checked by reading has been checked. The one + thing left is whether whoever is calling actually holds this + deployment's key — enter it above and check again. +

{/if} {/if}
diff --git a/services/pp-auth-demo/src/lib/KeyEntry.svelte b/services/pp-auth-demo/src/lib/KeyEntry.svelte new file mode 100644 index 000000000..b454316ec --- /dev/null +++ b/services/pp-auth-demo/src/lib/KeyEntry.svelte @@ -0,0 +1,94 @@ + + +
+
+

+ {deployment.name} + {deployment.environment} +

+

+ {deployment.keyHeld + ? "Key supplied — this deployment can answer a challenge." + : "No key — its identity cannot be proved from here."} +

+
+
+ {#if deployment.keyHeld} + Can prove itself + + {:else} + + {/if} +
+ + {#if open && !deployment.keyHeld} +
+ +
+ +

+ Held in memory for this process only. Never written down, never logged. +

+
+ {#if error} +

{error}

+ {/if} +
+ {/if} +
diff --git a/services/pp-auth-demo/src/lib/RequestTester.svelte b/services/pp-auth-demo/src/lib/RequestTester.svelte new file mode 100644 index 000000000..ec3951f28 --- /dev/null +++ b/services/pp-auth-demo/src/lib/RequestTester.svelte @@ -0,0 +1,130 @@ + + +
+

Try a request

+ +
+ + + +
+ + {#if !held} +

+ This deployment has no key here, so it cannot prove who it is and the + request will stop at the handshake. Enter its key above first. +

+ {/if} + + + + {#if stage === "evidence"} +

+ Cannot be checked — {missing.join("; ")}. +

+ {:else if decision} +

+ {decision.reason} +

+ {:else if stage === "handshake" && chain} +

+ Refused before any permission was consulted — it could not prove what it is. + {chain.links.find((link) => !link.ok)?.detail} +

+ {/if} + + {#if chain} +
+ + What it proved + +
+ +
+
+ {/if} +
diff --git a/services/pp-auth-demo/src/lib/server/grants.ts b/services/pp-auth-demo/src/lib/server/grants.ts new file mode 100644 index 000000000..6d5c7fa9f --- /dev/null +++ b/services/pp-auth-demo/src/lib/server/grants.ts @@ -0,0 +1,129 @@ +/** + * Access grants, kept in the owner's own eVault as `AccessGrant` records. + * + * Records are append-only, which is what the ontology's `revision` field is + * for: changing what a platform may do writes a new record rather than editing + * the old one, so the history of who was given what, and when it was taken + * away, survives. The newest revision for a (grantee, resource) pair is the one + * in force. + */ + +import type { AccessGrant, Operation } from "@metastate-foundation/auth/platform"; +import { permissionFor } from "@metastate-foundation/auth/platform"; +import { randomUUID } from "node:crypto"; +import { envelopes, store_ } from "./evault"; +import { ACCESS_GRANT_ONTOLOGY } from "./ontology"; + +export interface StoredGrant extends AccessGrant { + grantId: string; + grantorEName: string; + revision: number; + createdAt: string; + updatedAt: string; + revokedAt: string | null; +} + +function key(granteeEName: string | null, resourceType: string): string { + return `${granteeEName ?? "*"}::${resourceType}`; +} + +/** + * The grants in force for one owner: newest revision per grantee and resource. + * + * Revoked records are kept rather than filtered out, so `evaluateGrants` can + * tell "withdrawn" apart from "never held" — which are different things to + * show someone. + */ +export async function currentGrants(ename: string): Promise { + let records: Array<{ id: string; parsed: Record }>; + try { + records = await envelopes(ename, ACCESS_GRANT_ONTOLOGY, 200); + } catch (error) { + console.warn(`[pp-auth-demo] could not read grants for ${ename}:`, error); + return []; + } + + const newest = new Map(); + for (const record of records) { + const raw = record.parsed; + if (raw.isReference === true) continue; + if (raw.grantorEName !== ename) continue; + const resourceType = typeof raw.resourceType === "string" ? raw.resourceType : ""; + const granteeEName = + typeof raw.granteeEName === "string" ? raw.granteeEName : null; + if (!resourceType) continue; + + const grant: StoredGrant = { + grantId: String(raw.grantId ?? ""), + grantorEName: ename, + granteeType: raw.granteeType === "public" ? "public" : "ename", + granteeEName, + resourceType, + permissions: Array.isArray(raw.permissions) + ? raw.permissions.filter((p): p is string => typeof p === "string") + : [], + status: raw.status === "revoked" ? "revoked" : "active", + validFrom: typeof raw.validFrom === "string" ? raw.validFrom : undefined, + validUntil: typeof raw.validUntil === "string" ? raw.validUntil : null, + revision: Number(raw.revision) || 1, + createdAt: String(raw.createdAt ?? ""), + updatedAt: String(raw.updatedAt ?? raw.createdAt ?? ""), + revokedAt: typeof raw.revokedAt === "string" ? raw.revokedAt : null, + }; + + const existing = newest.get(key(granteeEName, resourceType)); + if (!existing || grant.revision > existing.revision) { + newest.set(key(granteeEName, resourceType), grant); + } + } + + return [...newest.values()]; +} + +/** + * Records what one platform may do with one kind of data. + * + * An empty operation list revokes rather than deleting: the record stays and is + * marked withdrawn, so a later reader can see that access was taken away rather + * than finding a silent absence. + */ +export async function setGrant( + ename: string, + granteeEName: string, + resourceType: string, + operations: Operation[], + existing: StoredGrant[], +): Promise { + const previous = existing.find( + (grant) => + grant.granteeEName === granteeEName && grant.resourceType === resourceType, + ); + const now = new Date().toISOString(); + const revoking = operations.length === 0; + + const payload = { + isReference: false, + grantId: previous?.grantId || randomUUID(), + grantorEName: ename, + granteeType: "ename" as const, + granteeEName, + resourceType, + // A revoked grant keeps the permissions it used to carry, so the record + // says what was withdrawn rather than merely that something was. + permissions: revoking + ? previous?.permissions?.length + ? previous.permissions + : [permissionFor(resourceType, "read")] + : operations.map((operation) => permissionFor(resourceType, operation)), + status: revoking ? ("revoked" as const) : ("active" as const), + validFrom: previous?.validFrom ?? now, + validUntil: null, + createdAt: previous?.createdAt || now, + updatedAt: now, + revision: (previous?.revision ?? 0) + 1, + revokedAt: revoking ? now : null, + delegationAllowed: false, + }; + + await store_(ename, ACCESS_GRANT_ONTOLOGY, payload, [ename, granteeEName]); +} diff --git a/services/pp-auth-demo/src/lib/server/ontology.ts b/services/pp-auth-demo/src/lib/server/ontology.ts index 9f0a5ff78..44180ff91 100644 --- a/services/pp-auth-demo/src/lib/server/ontology.ts +++ b/services/pp-auth-demo/src/lib/server/ontology.ts @@ -4,6 +4,7 @@ export const USER_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000"; export const PLATFORM_ACCREDITATION_ONTOLOGY = "e1749947-5a10-4973-b9fa-230d8714c36a"; export const DEPLOYMENT_PROFILE_ONTOLOGY = "d38e0c5b-9d63-4a21-8e8b-1d6b63af64d2"; export const ACCESS_POLICY_ONTOLOGY = "c7a41f6d-95b8-4e2a-9c33-8f0d1b6e4a72"; +export const ACCESS_GRANT_ONTOLOGY = "15d24c04-a4f3-4e45-a00e-0123926fbc87"; export interface AccreditationRecord { accreditationId: string; diff --git a/services/pp-auth-demo/src/routes/+layout.svelte b/services/pp-auth-demo/src/routes/+layout.svelte index cb77319f9..20027148a 100644 --- a/services/pp-auth-demo/src/routes/+layout.svelte +++ b/services/pp-auth-demo/src/routes/+layout.svelte @@ -7,6 +7,7 @@ const TABS = [ { href: "/platforms", label: "Platforms" }, { href: "/data", label: "Your data" }, + { href: "/acl", label: "Permissions" }, { href: "/terms", label: "Your terms" }, ]; diff --git a/services/pp-auth-demo/src/routes/acl/+page.server.ts b/services/pp-auth-demo/src/routes/acl/+page.server.ts new file mode 100644 index 000000000..e789b6c78 --- /dev/null +++ b/services/pp-auth-demo/src/routes/acl/+page.server.ts @@ -0,0 +1,70 @@ +import { accreditations, deployments, platformProfile } from "$lib/server/aaas"; +import { listDomains } from "$lib/server/domains"; +import { currentGrants } from "$lib/server/grants"; +import { held } from "$lib/server/keys"; +import type { PageServerLoad } from "./$types"; + +/** + * Everything needed to decide, and to see the decision: the certified + * platforms, the domains they were certified for, and what each has actually + * been permitted to do. + */ +export const load: PageServerLoad = async ({ locals }) => { + const ename = locals.user!.ename; + + const [records, grants, domains, allDeployments] = await Promise.all([ + accreditations().catch(() => []), + currentGrants(ename), + listDomains().catch(() => []), + deployments().catch(() => []), + ]); + + const granted = new Map(); + for (const record of records) { + if (record.decision !== "granted") continue; + if (!granted.has(record.platformEName)) granted.set(record.platformEName, record); + } + + const withKeys = new Set(held()); + + const platforms = await Promise.all( + [...granted.values()].map(async (record) => { + const profile = await platformProfile(record.platformEName); + const mine = allDeployments.filter( + (deployment) => deployment.platformEname === record.platformEName, + ); + return { + ename: record.platformEName, + name: profile?.displayName || record.platformName, + level: record.level, + version: record.platformVersion, + certifiedDomains: record.domains ?? [], + deployments: mine.map((deployment) => ({ + ename: deployment.deploymentEname, + name: deployment.deploymentName, + environment: deployment.environment, + version: deployment.version, + keyHeld: withKeys.has(deployment.deploymentEname), + })), + grants: (record.domains ?? []).map((domain) => { + const grant = grants.find( + (entry) => + entry.granteeEName === record.platformEName && + entry.resourceType === domain, + ); + const active = grant && grant.status === "active"; + return { + domain, + label: domains.find((d) => d.id === domain)?.label ?? domain, + read: Boolean(active && grant!.permissions.includes(`${domain}:Read`)), + write: Boolean(active && grant!.permissions.includes(`${domain}:Write`)), + revoked: Boolean(grant && grant.status === "revoked"), + revision: grant?.revision ?? 0, + }; + }), + }; + }), + ); + + return { ename, platforms }; +}; diff --git a/services/pp-auth-demo/src/routes/acl/+page.svelte b/services/pp-auth-demo/src/routes/acl/+page.svelte new file mode 100644 index 000000000..3c45d0cc9 --- /dev/null +++ b/services/pp-auth-demo/src/routes/acl/+page.svelte @@ -0,0 +1,150 @@ + + +
+
+

Permissions

+

What each platform may do

+

+ Being certified for a kind of data is not permission to do anything with + it. Reading your posts is not the same as writing to them, and this is + where that is decided. Each change is kept in your own eVault as a + permission record, so nothing is lost when you take access away. +

+
+ + {#if data.platforms.length === 0} +
+

+ No platform on the network is certified yet, so there is nothing to + permit. This fills in on its own once the association grants one. +

+
+ {/if} + + {#each data.platforms as platform (platform.ename)} +
+
+
+

{platform.name}

+

+ Certified {platform.level} · {platform.version} +

+
+
+ + {#if platform.deployments.length > 0} +
+

+ Deployment keys +

+ {#each platform.deployments as deployment (deployment.ename)} + + {/each} +
+ {/if} + +
+

+ Permissions +

+
+ + + + + + + + + + + {#each platform.grants as grant (grant.domain)} + + + + + + + {/each} + +
DataReadWriteState
{grant.label} + toggle(platform.ename, grant, "read")} + /> + + toggle(platform.ename, grant, "write")} + /> + + {#if grant.read || grant.write} + permitted + {:else if grant.revoked} + withdrawn + {:else} + never given + {/if} +
+
+

+ Only the data this platform was certified for is listed. Anything + else is refused before permissions are even consulted. +

+
+ + {#if platform.deployments.length > 0} + ({ + domain: grant.domain, + label: grant.label, + }))} + /> + {/if} +
+ {/each} +
diff --git a/services/pp-auth-demo/src/routes/api/grants/+server.ts b/services/pp-auth-demo/src/routes/api/grants/+server.ts new file mode 100644 index 000000000..6d6a1e065 --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/grants/+server.ts @@ -0,0 +1,38 @@ +import { json } from "@sveltejs/kit"; +import type { Operation } from "@metastate-foundation/auth/platform"; +import { currentGrants, setGrant } from "$lib/server/grants"; +import type { RequestHandler } from "./$types"; + +/** + * Records what one platform may do with one kind of data. + * + * Writes an `AccessGrant` into the owner's own eVault. Clearing both operations + * withdraws the grant rather than deleting it, so the record shows access was + * taken away rather than never given. + */ +export const POST: RequestHandler = async ({ request, locals }) => { + const { platformEname, domain, operations } = (await request.json()) as { + platformEname?: string; + domain?: string; + operations?: string[]; + }; + if (!platformEname || !domain) { + return json({ error: "platformEname and domain are required" }, { status: 400 }); + } + + const wanted = (operations ?? []).filter( + (operation): operation is Operation => operation === "read" || operation === "write", + ); + + const ename = locals.user!.ename; + try { + await setGrant(ename, platformEname, domain, wanted, await currentGrants(ename)); + return json({ ok: true }); + } catch (error) { + console.error("[pp-auth-demo/grants] could not write the grant:", error); + return json( + { error: error instanceof Error ? error.message : "could not save" }, + { status: 500 }, + ); + } +}; diff --git a/services/pp-auth-demo/src/routes/api/request/+server.ts b/services/pp-auth-demo/src/routes/api/request/+server.ts new file mode 100644 index 000000000..41559ba6c --- /dev/null +++ b/services/pp-auth-demo/src/routes/api/request/+server.ts @@ -0,0 +1,78 @@ +import { json } from "@sveltejs/kit"; +import { authorize, type Operation, type PlatformClaim } from "@metastate-foundation/auth/platform"; +import { deployments, platformProfile } from "$lib/server/aaas"; +import { assemble, verify } from "$lib/server/chain"; +import { currentGrants } from "$lib/server/grants"; +import { keyFor } from "$lib/server/keys"; +import { currentPolicy } from "$lib/server/policy"; +import type { RequestHandler } from "./$types"; + +/** + * One request, all the way through. + * + * A deployment proves what it is, and then the three gates decide what it may + * do: the association's certificate, the owner's terms, and the grants. The + * response reports each stage separately so it is clear which one refused. + */ +export const POST: RequestHandler = async ({ request, locals }) => { + const body = (await request.json()) as { + deploymentEname?: string; + domain?: string; + operation?: string; + }; + const operation: Operation = body.operation === "write" ? "write" : "read"; + const domain = String(body.domain ?? ""); + const ename = locals.user!.ename; + + const all = await deployments(); + const deployment = all.find((d) => d.deploymentEname === body.deploymentEname); + if (!deployment || !domain) { + return json({ error: "Unknown deployment or domain" }, { status: 404 }); + } + + const assembled = await assemble(deployment); + if (!assembled.evidence) { + return json({ + stage: "evidence", + missing: assembled.missing, + chain: null, + decision: null, + }); + } + + const { chain } = await verify( + assembled.evidence, + ename, + keyFor(deployment.deploymentEname), + ); + + // Without a proven identity there is nothing to authorise. Refusing here is + // the whole point: an unproven caller does not get to reach anything, + // however generous the grants behind it are. + if (!chain.ok || !chain.claim) { + return json({ stage: "handshake", chain, decision: null, missing: [] }); + } + + const [policy, grants, profile] = await Promise.all([ + currentPolicy(ename), + currentGrants(ename), + platformProfile(deployment.platformEname), + ]); + + const claim: PlatformClaim = { + ...chain.claim, + platformName: profile?.displayName || chain.claim.platformName, + }; + + const decision = authorize(policy.statement, { + claim, + domain, + operation, + grants, + }); + + return json({ stage: "authorised", chain, decision, missing: [] }); +}; + +export const GET: RequestHandler = async () => + json({ error: "POST a deployment, domain and operation" }, { status: 405 }); From 55cb212698c6d1c62ec1964e73d7dc361c1f58de Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 18:38:28 +0800 Subject: [PATCH 10/18] feat: return real records from a permitted read A request that answered allow or deny without touching the eVault proved nothing. A permitted read now fetches and renders the records; a refused one fetches nothing and says the vault was never asked; a permitted write really writes and reads the domain back. Also summarises balances, amounts and file sizes, which have no prose field and were rendering as unreadable. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- .../pp-auth-demonstrator.md | 6 +- .../pp-auth-demo/src/lib/RequestTester.svelte | 52 ++++++++- services/pp-auth-demo/src/lib/server/data.ts | 108 +++++++++++++++++- .../src/routes/api/request/+server.ts | 40 ++++++- 4 files changed, 197 insertions(+), 9 deletions(-) diff --git a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md index 036808d18..ea4827269 100644 --- a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md +++ b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md @@ -47,7 +47,11 @@ Each change writes an `AccessGrant` into your own eVault as a new revision. Clea **Deployment keys go in here, before you try anything.** Possession is the one link a reader cannot establish by looking, so whether the key is present decides what a check can even mean. Enter it and the deployment can answer a challenge for real; leave it out and every request stops at the handshake, which is the correct outcome. -**Try a request** then runs one all the way through — a named deployment, an operation, a domain — and reports which of the three gates decided. Turn off write and a write is refused while a read still succeeds; withdraw the grant and the refusal changes from "has not been given permission" to "has been withdrawn". +**Try a request** then runs one all the way through — a named deployment, an operation, a domain — and reports which of the three gates decided. + +A permitted read is not a verdict: it goes to the eVault and the records it returns are rendered underneath. A refused one fetches nothing, and says so — the eVault is never asked. A permitted write really writes, with text you supply, into a schema belonging to that domain, and then reads the domain back so you can see it landed. + +Turn off write and a write is refused while a read still succeeds; withdraw the grant and the refusal changes from "has not been given permission" to "has been withdrawn". ## Your terms diff --git a/services/pp-auth-demo/src/lib/RequestTester.svelte b/services/pp-auth-demo/src/lib/RequestTester.svelte index ec3951f28..2cd687ce8 100644 --- a/services/pp-auth-demo/src/lib/RequestTester.svelte +++ b/services/pp-auth-demo/src/lib/RequestTester.svelte @@ -32,6 +32,10 @@ let decision = $state<{ allowed: boolean; reason: string; code: string } | null>(null); let stage = $state(null); let missing = $state([]); + let records = $state | null>(null); + let wrote = $state<{ id: string; kind: string } | null>(null); + let note = $state(null); + let text = $state(""); async function send() { busy = true; @@ -39,13 +43,17 @@ const res = await fetch("/api/request", { method: "POST", headers: { "Content-Type": "application/json" }, - body: JSON.stringify({ deploymentEname, domain, operation }), + body: JSON.stringify({ deploymentEname, domain, operation, text }), }); const body = await res.json(); chain = body.chain ?? null; decision = body.decision ?? null; stage = body.stage ?? null; missing = body.missing ?? []; + records = body.records ?? null; + wrote = body.wrote ?? null; + note = body.note ?? null; + if (body.wrote) text = ""; } finally { busy = false; } @@ -85,6 +93,13 @@ + {#if operation === "write"} + + {/if} + {#if !held}

This deployment has no key here, so it cannot prove who it is and the @@ -117,6 +132,41 @@

{/if} + {#if decision?.allowed} +
+

+ {wrote ? "Written, and read back from your eVault" : "Pulled from your eVault"} +

+ {#if wrote} +

+ Stored a new {wrote.kind} record. +

+ {/if} + {#if note} +

{note}

+ {/if} + {#if records && records.length > 0} +
    + {#each records as record (record.id)} +
  • +

    {record.kind}

    +

    {record.summary}

    +
    • + {/each} +
+ {:else if records} +

+ The read was permitted and went through — your eVault holds nothing + of this kind. +

+ {/if} +
+ {:else if decision} +

+ Nothing was fetched. The eVault was never asked. +

+ {/if} + {#if chain}
diff --git a/services/pp-auth-demo/src/lib/server/data.ts b/services/pp-auth-demo/src/lib/server/data.ts index 39990647a..3c392725d 100644 --- a/services/pp-auth-demo/src/lib/server/data.ts +++ b/services/pp-auth-demo/src/lib/server/data.ts @@ -5,7 +5,7 @@ * ours: this is exactly the partition a certificate grants against. */ -import { envelopes } from "./evault"; +import { envelopes, store_ } from "./evault"; import { listDomains, listSchemas } from "./domains"; export interface OwnedRecord { @@ -22,22 +22,61 @@ export interface DomainGroup { records: OwnedRecord[]; } -/** A short readable line for a record, without guessing at its shape. */ +/** + * A short readable line for a record. + * + * Most schemas carry an obvious text field. Money does not: an Account is a + * balance and a currency, and a Ledger entry is an amount and a description, so + * a summariser that only looks for prose renders your finances as "(no + * readable fields)" and the demonstration shows nothing. + */ function summarise(parsed: Record): string { - const preferred = [ + const text = [ "text", "content", "body", "message", "title", "name", "displayName", "description", "summary", "label", ]; - for (const key of preferred) { + for (const key of text) { const value = parsed[key]; if (typeof value === "string" && value.trim()) { return value.trim().slice(0, 160); } } + + // Numeric records: say what the number is rather than falling through. + const amounts: string[] = []; + if (typeof parsed.balance === "number" || typeof parsed.balance === "string") { + amounts.push(`balance ${parsed.balance}`); + } + if (typeof parsed.amount === "number" || typeof parsed.amount === "string") { + amounts.push(`amount ${parsed.amount}`); + } + if (typeof parsed.currencyName === "string" && parsed.currencyName) { + amounts.push(String(parsed.currencyName)); + } + if (typeof parsed.accountType === "string" && parsed.accountType) { + amounts.unshift(String(parsed.accountType)); + } + if (typeof parsed.type === "string" && parsed.type && amounts.length > 0) { + amounts.push(String(parsed.type)); + } + if (amounts.length > 0) return amounts.join(" · ").slice(0, 160); + + const size = typeof parsed.size === "number" ? `${parsed.size} bytes` : null; + if (size && typeof parsed.mimeType === "string") { + return `${parsed.mimeType} · ${size}`; + } + + // Last resort. Identifiers and timestamps are skipped: showing + // "updatedAt: 2026-04-07T04:49:34.455Z" tells a reader nothing about what + // the record is, and a plain admission is more use than filler. + const skip = /(^id$|Id$|At$|EName$|Ename$|^type$|Url$|Hash$)/; const first = Object.entries(parsed).find( - ([, value]) => typeof value === "string" && value.trim().length > 0, + ([key, value]) => + typeof value === "string" && value.trim().length > 0 && !skip.test(key), ); - return first ? `${first[0]}: ${String(first[1]).slice(0, 140)}` : "(no readable fields)"; + return first + ? `${first[0]}: ${String(first[1]).slice(0, 140)}` + : "(a record with no readable text)"; } /** @@ -85,3 +124,60 @@ export async function ownedByDomain(ename: string): Promise { }) .sort((a, b) => b.records.length - a.records.length); } + +/** + * The owner's records in one domain, fetched from the eVault at call time. + * + * This is what a permitted read actually returns. Nothing is cached and + * nothing is precomputed: if a request is allowed, these are the records that + * come back, and if it is refused they are never fetched at all. + */ +export async function recordsInDomain( + ename: string, + domain: string, +): Promise { + const schemas = (await listSchemas()).filter((schema) => schema.domain === domain); + const found = await Promise.all( + schemas.map(async (schema) => { + const records = await envelopes(ename, schema.id, 10).catch(() => []); + return records.map((record) => ({ + id: record.id, + kind: schema.title, + summary: summarise(record.parsed), + })); + }), + ); + return found.flat(); +} + +/** Where a written record goes: the first schema published for that domain. */ +export async function writeTargetFor( + domain: string, +): Promise<{ id: string; title: string } | null> { + const schema = (await listSchemas()).find((entry) => entry.domain === domain); + return schema ? { id: schema.id, title: schema.title } : null; +} + +/** + * Performs a permitted write. + * + * A write that does not write would be exactly the pretence this demonstration + * exists to avoid, so this really does store a record in the owner's eVault — + * with text they typed, into a schema that belongs to the domain the grant + * covered. + */ +export async function writeRecord( + ename: string, + domain: string, + text: string, +): Promise<{ id: string; kind: string } | null> { + const target = await writeTargetFor(domain); + if (!target) return null; + const id = await store_( + ename, + target.id, + { text, name: text, createdAt: new Date().toISOString() }, + [ename], + ); + return { id, kind: target.title }; +} diff --git a/services/pp-auth-demo/src/routes/api/request/+server.ts b/services/pp-auth-demo/src/routes/api/request/+server.ts index 41559ba6c..52f870f4c 100644 --- a/services/pp-auth-demo/src/routes/api/request/+server.ts +++ b/services/pp-auth-demo/src/routes/api/request/+server.ts @@ -2,6 +2,7 @@ import { json } from "@sveltejs/kit"; import { authorize, type Operation, type PlatformClaim } from "@metastate-foundation/auth/platform"; import { deployments, platformProfile } from "$lib/server/aaas"; import { assemble, verify } from "$lib/server/chain"; +import { recordsInDomain, writeRecord } from "$lib/server/data"; import { currentGrants } from "$lib/server/grants"; import { keyFor } from "$lib/server/keys"; import { currentPolicy } from "$lib/server/policy"; @@ -19,6 +20,7 @@ export const POST: RequestHandler = async ({ request, locals }) => { deploymentEname?: string; domain?: string; operation?: string; + text?: string; }; const operation: Operation = body.operation === "write" ? "write" : "read"; const domain = String(body.domain ?? ""); @@ -71,7 +73,43 @@ export const POST: RequestHandler = async ({ request, locals }) => { grants, }); - return json({ stage: "authorised", chain, decision, missing: [] }); + if (!decision.allowed) { + // Nothing is fetched. A refusal that still read the data and then + // declined to show it would not be a refusal at all. + return json({ stage: "authorised", chain, decision, records: null, wrote: null }); + } + + if (operation === "write") { + const text = String(body.text ?? "").trim(); + if (!text) { + return json({ + stage: "authorised", + chain, + decision, + records: null, + wrote: null, + note: "Permitted, but nothing was written — no text was given.", + }); + } + const wrote = await writeRecord(ename, domain, text); + return json({ + stage: "authorised", + chain, + decision, + records: await recordsInDomain(ename, domain), + wrote, + }); + } + + // The point of the whole exercise: a permitted read really does go to the + // eVault and come back with the records. + return json({ + stage: "authorised", + chain, + decision, + records: await recordsInDomain(ename, domain), + wrote: null, + }); }; export const GET: RequestHandler = async () => From e9dedf337fe7b58fcebdebb97c3b183d7b5b65f8 Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 18:48:35 +0800 Subject: [PATCH 11/18] feat: offer every published domain, and permit beside the request The domains a platform was not certified for are the ones worth asking for, so the list is the whole vocabulary with the uncertified ones marked. Read and write move next to the domain being asked about, replacing the matrix above it. Reputation has one service and no threshold, so it is stated rather than typed. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- .../pp-auth-demonstrator.md | 8 +- docs/docs/W3DS Basics/Access-Policy.md | 4 +- .../pp-auth-demo/src/lib/RequestTester.svelte | 137 ++++++++++++++---- .../pp-auth-demo/src/lib/TermsForm.svelte | 41 ++---- services/pp-auth-demo/src/lib/server/env.ts | 10 ++ .../src/routes/acl/+page.server.ts | 21 ++- .../pp-auth-demo/src/routes/acl/+page.svelte | 107 ++------------ .../src/routes/api/terms/+server.ts | 18 +-- .../src/routes/terms/+page.server.ts | 3 +- .../src/routes/terms/+page.svelte | 6 +- 10 files changed, 183 insertions(+), 172 deletions(-) diff --git a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md index ea4827269..ebf07ae1f 100644 --- a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md +++ b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md @@ -41,9 +41,11 @@ The table shows every certified platform against every kind of data you hold, de ## Permissions -Being certified for a kind of data is not permission to do anything with it. This tab is where that is settled: for each certified platform, a read and a write toggle per domain it was certified for. Nothing else is listed, because anything else is refused before permissions are consulted. +Being certified for a kind of data is not permission to do anything with it. This tab is where that is settled. -Each change writes an `AccessGrant` into your own eVault as a new revision. Clearing both toggles withdraws the grant rather than deleting it, so the record shows access was taken away rather than never given. +The domain list is the whole published vocabulary, not just what a platform was certified for — the domains it has no business with are listed too, marked as such, because asking for one and watching the certificate refuse it is the case worth seeing. + +Read and write are toggled beside the domain you are asking about. Each change writes an `AccessGrant` into your own eVault as a new revision. Clearing both withdraws the grant rather than deleting it, so the record shows access was taken away rather than never given. **Deployment keys go in here, before you try anything.** Possession is the one link a reader cannot establish by looking, so whether the key is present decides what a check can even mean. Enter it and the deployment can answer a challenge for real; leave it out and every request stops at the handshake, which is the correct outcome. @@ -55,7 +57,7 @@ Turn off write and a write is refused while a read still succeeds; withdraw the ## Your terms -The association says what a platform was found to be; you decide what that is worth. Set the minimum level, whose reputation scores you accept and the score they must reach, and any domain refused outright. +The association says what a platform was found to be; you decide what that is worth. Set the minimum level and any domain refused outright. The reputation service is named in what you sign but is not a choice: there is one on the network today, so asking you to type its address would only be a way to get it wrong. Signing goes to your wallet. The signing session id **is** the canonical payload of the statement, so what the wallet signs is exactly the digest of your terms — the signature then verifies against the statement on its own, without anyone trusting this app. The terms are published into your own eVault as an `Access Policy` record, world-readable, and the signature is checked again before the write. diff --git a/docs/docs/W3DS Basics/Access-Policy.md b/docs/docs/W3DS Basics/Access-Policy.md index 70db38fd1..ebcdaeb08 100644 --- a/docs/docs/W3DS Basics/Access-Policy.md +++ b/docs/docs/W3DS Basics/Access-Policy.md @@ -13,8 +13,8 @@ It is a signed statement rather than a stored setting, so it travels with the ow | Term | Meaning | |---|---| | `minimumLevel` | The weakest certification level they will deal with. A platform certified below it is refused whatever its certificate grants. | -| `reputationEngine` | Whose reputation scores they accept, as an eName or URL. Blank means reputation is not consulted at all. | -| `minimumReputation` | The score that engine must report for the platform. Null means no threshold. | +| `reputationEngine` | Whose reputation scores they accept, as an eName or host. Blank means reputation is not consulted at all. Today the network runs one service, so applications may reasonably fix this rather than ask. | +| `minimumReputation` | The score that engine must report for the platform. Null means no threshold, which is the common case. | | `allowedDomains` | Null means "whatever the certificate grants" — the ordinary case. A list narrows it further. | | `deniedDomains` | Refused outright, overriding both the certificate and the allow list. | diff --git a/services/pp-auth-demo/src/lib/RequestTester.svelte b/services/pp-auth-demo/src/lib/RequestTester.svelte index 2cd687ce8..b9d9022ef 100644 --- a/services/pp-auth-demo/src/lib/RequestTester.svelte +++ b/services/pp-auth-demo/src/lib/RequestTester.svelte @@ -2,40 +2,93 @@ import ChainTrace from "./ChainTrace.svelte"; import type { ChainResult } from "@metastate-foundation/auth/platform"; + interface DomainGrant { + domain: string; + label: string; + /** Whether the association certified this platform for this domain. */ + certified: boolean; + read: boolean; + write: boolean; + revoked: boolean; + } + let { + platformEname, deployments, - domains, + grants, + onchange, }: { + platformEname: string; deployments: Array<{ ename: string; name: string; environment: string; keyHeld: boolean }>; - domains: Array<{ domain: string; label: string }>; + grants: DomainGrant[]; + onchange: () => Promise; } = $props(); let deploymentEname = $state(""); let domain = $state(""); let operation = $state<"read" | "write">("read"); + let text = $state(""); + + let busy = $state(false); + let saving = $state(false); + let chain = $state(null); + let decision = $state<{ allowed: boolean; reason: string; code: string } | null>(null); + let stage = $state(null); + let missing = $state([]); + let records = $state | null>(null); + let wrote = $state<{ id: string; kind: string } | null>(null); + let note = $state(null); - // Keep the selection valid as the lists change underneath it. Holding a - // stale eName would send the request against something no longer listed. + // Keep selections valid as the lists change underneath them. $effect(() => { if (!deployments.some((entry) => entry.ename === deploymentEname)) { deploymentEname = deployments[0]?.ename ?? ""; } }); $effect(() => { - if (!domains.some((entry) => entry.domain === domain)) { - domain = domains[0]?.domain ?? ""; + if (!grants.some((entry) => entry.domain === domain)) { + domain = grants.find((entry) => entry.certified)?.domain ?? grants[0]?.domain ?? ""; } }); - let busy = $state(false); - let chain = $state(null); - let decision = $state<{ allowed: boolean; reason: string; code: string } | null>(null); - let stage = $state(null); - let missing = $state([]); - let records = $state | null>(null); - let wrote = $state<{ id: string; kind: string } | null>(null); - let note = $state(null); - let text = $state(""); + let held = $derived(deployments.find((d) => d.ename === deploymentEname)?.keyHeld ?? false); + let selected = $derived(grants.find((entry) => entry.domain === domain) ?? null); + + function clear() { + chain = null; + decision = null; + stage = null; + records = null; + wrote = null; + note = null; + } + + async function permit(which: "read" | "write") { + if (!selected) return; + const next = { + read: selected.read, + write: selected.write, + [which]: !selected[which], + }; + saving = true; + try { + await fetch("/api/grants", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ + platformEname, + domain, + operations: [ + ...(next.read ? ["read"] : []), + ...(next.write ? ["write"] : []), + ], + }), + }); + await onchange(); + } finally { + saving = false; + } + } async function send() { busy = true; @@ -58,8 +111,6 @@ busy = false; } } - - let held = $derived(deployments.find((d) => d.ename === deploymentEname)?.keyHeld ?? false);
@@ -68,7 +119,7 @@
+ {#if selected} +
+ {#if selected.certified} + You permit it to + + + {#if !selected.read && !selected.write} + + {selected.revoked ? "withdrawn" : "nothing yet"} + + {/if} + {:else} + + Not certified for {selected.label.toLowerCase()} data, so there is + nothing to permit — this is refused before permissions are consulted. + + {/if} +
+ {/if} + {#if operation === "write"}
-
-
- - (done = false)} /> -

Leave blank to ignore reputation entirely.

-
-
- - (done = false)} - placeholder="No threshold" - /> -
+
+

+ Whose reputation scores you trust +

+

{reputationEngine}

+

+ The only reputation service on the network today, so there is nothing to + choose. It is named in what you sign, so the record says which service you + accepted scores from. +

{#if domains.length > 0} diff --git a/services/pp-auth-demo/src/lib/server/env.ts b/services/pp-auth-demo/src/lib/server/env.ts index 8939ac78f..e091fd31c 100644 --- a/services/pp-auth-demo/src/lib/server/env.ts +++ b/services/pp-auth-demo/src/lib/server/env.ts @@ -45,6 +45,16 @@ export function ereputationUrl(): string { return raw("PPA_EREPUTATION_URL") || "https://ereputation.w3ds.metastate.foundation"; } +/** + * The reputation service whose scores terms are written against. + * + * There is exactly one, so asking an owner to type its address is asking them + * to get it wrong. When a second exists this becomes a choice again. + */ +export function reputationEngine(): string { + return new URL(ereputationUrl()).host; +} + export function jwtSecret(): string { return raw("PP_AUTH_DEMO_JWT_SECRET") || raw("PPA_JWT_SECRET") || "pp-auth-demo-dev-secret"; } diff --git a/services/pp-auth-demo/src/routes/acl/+page.server.ts b/services/pp-auth-demo/src/routes/acl/+page.server.ts index e789b6c78..1112445c2 100644 --- a/services/pp-auth-demo/src/routes/acl/+page.server.ts +++ b/services/pp-auth-demo/src/routes/acl/+page.server.ts @@ -5,9 +5,12 @@ import { held } from "$lib/server/keys"; import type { PageServerLoad } from "./$types"; /** - * Everything needed to decide, and to see the decision: the certified - * platforms, the domains they were certified for, and what each has actually - * been permitted to do. + * Everything needed to decide, and to see the decision. + * + * The domain list is the whole published vocabulary, not just what each + * platform was certified for. Offering only the certified ones would hide the + * most important case: asking for something a platform has no business with, + * and watching the certificate refuse it before permissions are even reached. */ export const load: PageServerLoad = async ({ locals }) => { const ename = locals.user!.ename; @@ -46,16 +49,18 @@ export const load: PageServerLoad = async ({ locals }) => { version: deployment.version, keyHeld: withKeys.has(deployment.deploymentEname), })), - grants: (record.domains ?? []).map((domain) => { + grants: domains.map((entry) => { + const domain = entry.id; const grant = grants.find( - (entry) => - entry.granteeEName === record.platformEName && - entry.resourceType === domain, + (held) => + held.granteeEName === record.platformEName && + held.resourceType === domain, ); const active = grant && grant.status === "active"; return { domain, - label: domains.find((d) => d.id === domain)?.label ?? domain, + label: entry.label, + certified: (record.domains ?? []).includes(domain), read: Boolean(active && grant!.permissions.includes(`${domain}:Read`)), write: Boolean(active && grant!.permissions.includes(`${domain}:Write`)), revoked: Boolean(grant && grant.status === "revoked"), diff --git a/services/pp-auth-demo/src/routes/acl/+page.svelte b/services/pp-auth-demo/src/routes/acl/+page.svelte index 3c45d0cc9..24e7e58ee 100644 --- a/services/pp-auth-demo/src/routes/acl/+page.svelte +++ b/services/pp-auth-demo/src/routes/acl/+page.svelte @@ -6,37 +6,9 @@ let { data }: { data: PageData } = $props(); - let saving = $state(null); - async function refresh() { await invalidateAll(); } - - async function toggle( - platformEname: string, - grant: { domain: string; read: boolean; write: boolean }, - which: "read" | "write", - ) { - const next = { read: grant.read, write: grant.write, [which]: !grant[which] }; - saving = `${platformEname}:${grant.domain}`; - try { - await fetch("/api/grants", { - method: "POST", - headers: { "Content-Type": "application/json" }, - body: JSON.stringify({ - platformEname, - domain: grant.domain, - operations: [ - ...(next.read ? ["read"] : []), - ...(next.write ? ["write"] : []), - ], - }), - }); - await refresh(); - } finally { - saving = null; - } - }
@@ -45,9 +17,9 @@

What each platform may do

Being certified for a kind of data is not permission to do anything with - it. Reading your posts is not the same as writing to them, and this is - where that is decided. Each change is kept in your own eVault as a - permission record, so nothing is lost when you take access away. + it. Reading your posts is not the same as writing to them. Ask for + something on this platform's behalf and see what happens — and what comes + back out of your eVault when it is allowed.

@@ -69,6 +41,11 @@ Certified {platform.level} · {platform.version}

+
+ {#each platform.certifiedDomains as domain (domain)} + {domain} + {/each} +
{#if platform.deployments.length > 0} @@ -80,70 +57,18 @@ {/each}
- {/if} - -
-

- Permissions -

-
- - - - - - - - - - - {#each platform.grants as grant (grant.domain)} - - - - - - - {/each} - -
DataReadWriteState
{grant.label} - toggle(platform.ename, grant, "read")} - /> - - toggle(platform.ename, grant, "write")} - /> - - {#if grant.read || grant.write} - permitted - {:else if grant.revoked} - withdrawn - {:else} - never given - {/if} -
-
-

- Only the data this platform was certified for is listed. Anything - else is refused before permissions are even consulted. -

-
- {#if platform.deployments.length > 0} ({ - domain: grant.domain, - label: grant.label, - }))} + grants={platform.grants} + onchange={refresh} /> + {:else} +

+ Nothing is deployed from this platform, so there is nothing to ask on + its behalf. +

{/if} {/each} diff --git a/services/pp-auth-demo/src/routes/api/terms/+server.ts b/services/pp-auth-demo/src/routes/api/terms/+server.ts index 47a1bfcc7..919e60445 100644 --- a/services/pp-auth-demo/src/routes/api/terms/+server.ts +++ b/services/pp-auth-demo/src/routes/api/terms/+server.ts @@ -5,6 +5,7 @@ import { type CertificationLevel, } from "@metastate-foundation/auth/platform"; import { randomUUID } from "node:crypto"; +import { reputationEngine } from "$lib/server/env"; import { prepare } from "$lib/server/policy"; import { createSigningOffer } from "$lib/server/session"; import type { RequestHandler } from "./$types"; @@ -26,20 +27,14 @@ export const POST: RequestHandler = async ({ request, locals, url }) => { } const strings = (value: unknown): string[] => Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : []; - const minimumReputation = - body.minimumReputation === null || body.minimumReputation === "" - ? null - : Number(body.minimumReputation); - if (minimumReputation !== null && !Number.isFinite(minimumReputation)) { - return json({ error: "The score must be a number" }, { status: 400 }); - } const statement = { ...defaultAccessPolicy(ename), minimumLevel: level, - reputationEngine: - typeof body.reputationEngine === "string" ? body.reputationEngine.trim() : "", - minimumReputation, + // Named in the statement so it is on the record which service the owner + // accepted scores from, even while there is only one to accept. + reputationEngine: reputationEngine(), + minimumReputation: null, allowedDomains: null, deniedDomains: strings(body.deniedDomains), issuedAt: new Date().toISOString(), @@ -52,8 +47,7 @@ export const POST: RequestHandler = async ({ request, locals, url }) => { { message: "Set the terms platforms must meet to reach your data", minimumLevel: statement.minimumLevel, - reputationEngine: statement.reputationEngine || "not used", - minimumReputation: statement.minimumReputation ?? "no threshold", + reputationFrom: statement.reputationEngine, refused: statement.deniedDomains.length ? statement.deniedDomains : "nothing", }, url.origin, diff --git a/services/pp-auth-demo/src/routes/terms/+page.server.ts b/services/pp-auth-demo/src/routes/terms/+page.server.ts index c8778b3ce..9b414e17c 100644 --- a/services/pp-auth-demo/src/routes/terms/+page.server.ts +++ b/services/pp-auth-demo/src/routes/terms/+page.server.ts @@ -1,4 +1,5 @@ import { listDomains } from "$lib/server/domains"; +import { reputationEngine } from "$lib/server/env"; import { currentPolicy } from "$lib/server/policy"; import type { PageServerLoad } from "./$types"; @@ -8,5 +9,5 @@ export const load: PageServerLoad = async ({ locals }) => { currentPolicy(ename), listDomains().catch(() => []), ]); - return { ename, policy, domains }; + return { ename, policy, domains, reputationEngine: reputationEngine() }; }; diff --git a/services/pp-auth-demo/src/routes/terms/+page.svelte b/services/pp-auth-demo/src/routes/terms/+page.svelte index 7c6a9e39e..76516bf79 100644 --- a/services/pp-auth-demo/src/routes/terms/+page.svelte +++ b/services/pp-auth-demo/src/routes/terms/+page.svelte @@ -28,7 +28,11 @@ {#key data.policy.statement.nonce} - + {/key} {#if data.policy.signed} From 8451e0edbe58b2d0035230e15c90aad78b207bcc Mon Sep 17 00:00:00 2001 From: coodos Date: Sun, 30 Aug 2026 18:51:20 +0800 Subject: [PATCH 12/18] fix: drop the permission toggles from the request panel Grants are the platform's to manage through the API; the panel sends requests and shows what came back. Claude-Session: https://claude.ai/code/session_01UpwygDu2cizLp12tvvKqVZ --- .../pp-auth-demonstrator.md | 8 +- .../pp-auth-demo/src/lib/RequestTester.svelte | 73 +------------------ .../pp-auth-demo/src/routes/acl/+page.svelte | 2 - 3 files changed, 8 insertions(+), 75 deletions(-) diff --git a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md index ebf07ae1f..a25e721db 100644 --- a/docs/docs/Post Platform Guide/pp-auth-demonstrator.md +++ b/docs/docs/Post Platform Guide/pp-auth-demonstrator.md @@ -45,7 +45,13 @@ Being certified for a kind of data is not permission to do anything with it. Thi The domain list is the whole published vocabulary, not just what a platform was certified for — the domains it has no business with are listed too, marked as such, because asking for one and watching the certificate refuse it is the case worth seeing. -Read and write are toggled beside the domain you are asking about. Each change writes an `AccessGrant` into your own eVault as a new revision. Clearing both withdraws the grant rather than deleting it, so the record shows access was taken away rather than never given. +Grants are managed by the platform through `POST /api/grants`, not set by hand here — the page shows what happens under them. Each change writes an `AccessGrant` into the owner's eVault as a new revision; clearing both operations withdraws the grant rather than deleting it, so the record shows access was taken away rather than never given. + +```bash +curl -X POST http://localhost:4310/api/grants \ + -H 'Content-Type: application/json' \ + -d '{"platformEname":"@…","domain":"social","operations":["read"]}' +``` **Deployment keys go in here, before you try anything.** Possession is the one link a reader cannot establish by looking, so whether the key is present decides what a check can even mean. Enter it and the deployment can answer a challenge for real; leave it out and every request stops at the handshake, which is the correct outcome. diff --git a/services/pp-auth-demo/src/lib/RequestTester.svelte b/services/pp-auth-demo/src/lib/RequestTester.svelte index b9d9022ef..b2a1004e5 100644 --- a/services/pp-auth-demo/src/lib/RequestTester.svelte +++ b/services/pp-auth-demo/src/lib/RequestTester.svelte @@ -7,21 +7,15 @@ label: string; /** Whether the association certified this platform for this domain. */ certified: boolean; - read: boolean; - write: boolean; - revoked: boolean; } let { - platformEname, deployments, grants, - onchange, }: { - platformEname: string; deployments: Array<{ ename: string; name: string; environment: string; keyHeld: boolean }>; + /** Domains to offer, and whether the platform was certified for each. */ grants: DomainGrant[]; - onchange: () => Promise; } = $props(); let deploymentEname = $state(""); @@ -30,7 +24,6 @@ let text = $state(""); let busy = $state(false); - let saving = $state(false); let chain = $state(null); let decision = $state<{ allowed: boolean; reason: string; code: string } | null>(null); let stage = $state(null); @@ -52,7 +45,6 @@ }); let held = $derived(deployments.find((d) => d.ename === deploymentEname)?.keyHeld ?? false); - let selected = $derived(grants.find((entry) => entry.domain === domain) ?? null); function clear() { chain = null; @@ -63,33 +55,6 @@ note = null; } - async function permit(which: "read" | "write") { - if (!selected) return; - const next = { - read: selected.read, - write: selected.write, - [which]: !selected[which], - }; - saving = true; - try { - await fetch("/api/grants", { - method: "POST", - headers: { "Content-Type": "application/json" }, - body: JSON.stringify({ - platformEname, - domain, - operations: [ - ...(next.read ? ["read"] : []), - ...(next.write ? ["write"] : []), - ], - }), - }); - await onchange(); - } finally { - saving = false; - } - } - async function send() { busy = true; try { @@ -146,42 +111,6 @@ - {#if selected} -
- {#if selected.certified} - You permit it to - - - {#if !selected.read && !selected.write} - - {selected.revoked ? "withdrawn" : "nothing yet"} - - {/if} - {:else} - - Not certified for {selected.label.toLowerCase()} data, so there is - nothing to permit — this is refused before permissions are consulted. - - {/if} -
- {/if} - {#if operation === "write"}