Something went wrong. Try again.
A lexicon-driven AppView for ATProto.
Something went wrong. Try again.
Rust
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316use base64::Engine;use base64::engine::general_purpose::URL_SAFE_NO_PAD;use p256::ecdsa::SigningKey;use rand::RngCore;use sha2::{Digest, Sha256};use uuid::Uuid;
use crate::db::{DatabaseBackend, adapt_sql, now_rfc3339};use crate::error::AppError;use crate::plugin::encryption::{decrypt, encrypt};use crate::spaces::credential::{ DEFAULT_CREDENTIAL_TTL_SECS, SpaceCredentialClaims, sign_credential, verify_credential,};use crate::spaces::types::{AccessMode, Space};
pub struct IssuedCredential { pub token: String, pub expires_at: String,}
pub async fn issue_credential( pool: &sqlx::AnyPool, backend: DatabaseBackend, encryption_key: &[u8; 32], space: &Space, subject_did: &str, client_id: Option<&str>,) -> Result<IssuedCredential, AppError> { check_app_access(space, client_id)?;
let private_jwk = get_or_create_signing_key(pool, backend, encryption_key, space).await?;
let now = std::time::SystemTime::now() .duration_since(std::time::UNIX_EPOCH) .unwrap() .as_secs(); let exp = now + DEFAULT_CREDENTIAL_TTL_SECS;
let claims = SpaceCredentialClaims { iss: space.owner_did.clone(), sub: subject_did.to_string(), space: format!("{}/{}/{}", space.owner_did, space.type_nsid, space.skey), scope: "read".into(), iat: now, exp, };
let token = sign_credential(&claims, &private_jwk)?;
let token_hash = hex::encode(Sha256::digest(token.as_bytes())); store_credential_record(pool, backend, &space.id, subject_did, &token_hash, exp).await?;
let expires_at = chrono::DateTime::from_timestamp(exp as i64, 0) .map(|dt| dt.to_rfc3339()) .unwrap_or_default();
Ok(IssuedCredential { token, expires_at })}
pub async fn refresh_credential( pool: &sqlx::AnyPool, backend: DatabaseBackend, encryption_key: &[u8; 32], space: &Space, current_token: &str,) -> Result<IssuedCredential, AppError> { let public_jwk = get_public_key(pool, backend, encryption_key, space).await?; let claims = verify_credential(current_token, &public_jwk)?;
issue_credential(pool, backend, encryption_key, space, &claims.sub, None).await}
pub fn check_app_access(space: &Space, client_id: Option<&str>) -> Result<(), AppError> { let Some(client_id) = client_id else { return Ok(()); };
match space.access_mode { AccessMode::DefaultDeny => { if let Some(ref allowlist) = space.app_allowlist { if !allowlist.iter().any(|id| id == client_id) { return Err(AppError::Forbidden( "This app is not authorized to access this space".into(), )); } } else { return Err(AppError::Forbidden( "Space is in default_deny mode with no allowlist".into(), )); } } AccessMode::DefaultAllow => { if let Some(ref denylist) = space.app_denylist && denylist.iter().any(|id| id == client_id) { return Err(AppError::Forbidden( "This app has been denied access to this space".into(), )); } } }
Ok(())}
async fn get_or_create_signing_key( pool: &sqlx::AnyPool, backend: DatabaseBackend, encryption_key: &[u8; 32], space: &Space,) -> Result<serde_json::Value, AppError> { let sql = adapt_sql( "SELECT signing_key_enc FROM space_dids WHERE space_id = ?", backend, ); let row: Option<(Vec<u8>,)> = sqlx::query_as(&sql) .bind(&space.id) .fetch_optional(pool) .await .map_err(|e| AppError::Internal(format!("failed to look up space signing key: {e}")))?;
if let Some((encrypted,)) = row { let decrypted = decrypt(encryption_key, &encrypted) .map_err(|e| AppError::Internal(format!("failed to decrypt signing key: {e}")))?; let jwk: serde_json::Value = serde_json::from_slice(&decrypted) .map_err(|e| AppError::Internal(format!("failed to parse signing key: {e}")))?; return Ok(jwk); }
let keypair = generate_space_keypair()?; let key_bytes = serde_json::to_vec(&keypair.private_jwk) .map_err(|e| AppError::Internal(format!("failed to serialize signing key: {e}")))?; let encrypted_signing = encrypt(encryption_key, &key_bytes) .map_err(|e| AppError::Internal(format!("failed to encrypt signing key: {e}")))?;
// Rotation key is a separate keypair for recovery let rotation_keypair = generate_space_keypair()?; let rotation_bytes = serde_json::to_vec(&rotation_keypair.private_jwk) .map_err(|e| AppError::Internal(format!("failed to serialize rotation key: {e}")))?; let encrypted_rotation = encrypt(encryption_key, &rotation_bytes) .map_err(|e| AppError::Internal(format!("failed to encrypt rotation key: {e}")))?;
let now = now_rfc3339(); let insert_sql = adapt_sql( "INSERT INTO space_dids (id, did, space_id, signing_key_enc, rotation_key_enc, created_by, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)", backend, );
sqlx::query(&insert_sql) .bind(Uuid::new_v4().to_string()) .bind(&space.owner_did) .bind(&space.id) .bind(&encrypted_signing) .bind(&encrypted_rotation) .bind(&space.owner_did) .bind(&now) .execute(pool) .await .map_err(|e| AppError::Internal(format!("failed to store space signing key: {e}")))?;
Ok(keypair.private_jwk)}
async fn get_public_key( pool: &sqlx::AnyPool, backend: DatabaseBackend, encryption_key: &[u8; 32], space: &Space,) -> Result<serde_json::Value, AppError> { let private_jwk = get_or_create_signing_key(pool, backend, encryption_key, space).await?; Ok(serde_json::json!({ "kty": "EC", "crv": "P-256", "x": private_jwk["x"], "y": private_jwk["y"], }))}
struct SpaceKeypair { private_jwk: serde_json::Value,}
fn generate_space_keypair() -> Result<SpaceKeypair, AppError> { let mut rng_bytes = [0u8; 32]; rand::rng().fill_bytes(&mut rng_bytes);
let signing_key = SigningKey::from_bytes((&rng_bytes[..]).into()) .map_err(|e| AppError::Internal(format!("failed to generate signing key: {e}")))?;
let verifying_key = signing_key.verifying_key(); let public_point = verifying_key.to_encoded_point(false);
let x_bytes = public_point .x() .ok_or_else(|| AppError::Internal("missing x coordinate".into()))?; let y_bytes = public_point .y() .ok_or_else(|| AppError::Internal("missing y coordinate".into()))?;
let x_b64 = URL_SAFE_NO_PAD.encode(x_bytes); let y_b64 = URL_SAFE_NO_PAD.encode(y_bytes); let d_b64 = URL_SAFE_NO_PAD.encode(rng_bytes);
let private_jwk = serde_json::json!({ "kty": "EC", "crv": "P-256", "x": x_b64, "y": y_b64, "d": d_b64, });
Ok(SpaceKeypair { private_jwk })}
async fn store_credential_record( pool: &sqlx::AnyPool, backend: DatabaseBackend, space_id: &str, issued_to: &str, token_hash: &str, expires_at_epoch: u64,) -> Result<(), AppError> { let now = now_rfc3339(); let expires_at = chrono::DateTime::from_timestamp(expires_at_epoch as i64, 0) .map(|dt| dt.to_rfc3339()) .unwrap_or_default();
let sql = adapt_sql( "INSERT INTO space_credentials (id, space_id, issued_to, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)", backend, );
sqlx::query(&sql) .bind(Uuid::new_v4().to_string()) .bind(space_id) .bind(issued_to) .bind(token_hash) .bind(&expires_at) .bind(&now) .execute(pool) .await .map_err(|e| AppError::Internal(format!("failed to store credential record: {e}")))?;
Ok(())}
#[cfg(test)]mod tests { use super::*; use crate::spaces::types::{AccessMode, Space, SpaceConfig};
fn test_space(access_mode: AccessMode) -> Space { Space { id: "test-space".into(), owner_did: "did:plc:owner".into(), type_nsid: "com.example.forum".into(), skey: "main".into(), display_name: None, description: None, access_mode, app_allowlist: None, app_denylist: None, managing_app_did: None, config: SpaceConfig::default(), created_at: String::new(), updated_at: String::new(), } }
#[test] fn app_access_default_allow_no_lists() { let space = test_space(AccessMode::DefaultAllow); assert!(check_app_access(&space, Some("any-app")).is_ok()); }
#[test] fn app_access_default_allow_denied() { let mut space = test_space(AccessMode::DefaultAllow); space.app_denylist = Some(vec!["bad-app".into()]);
assert!(check_app_access(&space, Some("good-app")).is_ok()); assert!(check_app_access(&space, Some("bad-app")).is_err()); }
#[test] fn app_access_default_deny_no_allowlist() { let space = test_space(AccessMode::DefaultDeny); assert!(check_app_access(&space, Some("any-app")).is_err()); }
#[test] fn app_access_default_deny_allowed() { let mut space = test_space(AccessMode::DefaultDeny); space.app_allowlist = Some(vec!["good-app".into()]);
assert!(check_app_access(&space, Some("good-app")).is_ok()); assert!(check_app_access(&space, Some("other-app")).is_err()); }
#[test] fn app_access_no_client_id_always_passes() { let space = test_space(AccessMode::DefaultDeny); assert!(check_app_access(&space, None).is_ok()); }
#[test] fn generate_keypair_produces_valid_jwk() { let kp = generate_space_keypair().unwrap(); assert_eq!(kp.private_jwk["kty"], "EC"); assert_eq!(kp.private_jwk["crv"], "P-256"); assert!(kp.private_jwk["d"].is_string()); assert!(kp.private_jwk["x"].is_string()); assert!(kp.private_jwk["y"].is_string()); }}