A lexicon-driven AppView for ATProto.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228use hkdf::Hkdf;use hmac::{Hmac, Mac};use k256::ecdsa::{Signature, SigningKey, VerifyingKey, signature::Signer, signature::Verifier};use sha2::Sha256;
use crate::error::AppError;
pub struct SignedCommit { pub hash: [u8; 32], pub ikm: [u8; 32], pub sig: Vec<u8>, pub mac: [u8; 32], pub rev: String,}
pub fn build_context(space_uri: &str, rev: &str, ikm: &[u8; 32]) -> Vec<u8> { let tag = b"atproto-space-v1"; let space_bytes = space_uri.as_bytes(); let rev_bytes = rev.as_bytes();
let mut ctx = Vec::with_capacity(tag.len() + 2 + space_bytes.len() + 2 + rev_bytes.len() + 2 + 32);
ctx.extend_from_slice(tag);
// TLS 1.3 variable-length encoding: big-endian uint16 length prefix ctx.extend_from_slice(&(space_bytes.len() as u16).to_be_bytes()); ctx.extend_from_slice(space_bytes);
ctx.extend_from_slice(&(rev_bytes.len() as u16).to_be_bytes()); ctx.extend_from_slice(rev_bytes);
ctx.extend_from_slice(&(ikm.len() as u16).to_be_bytes()); ctx.extend_from_slice(ikm);
ctx}
pub fn sign_commit( hash: &[u8; 32], space_uri: &str, rev: &str, signing_key: &SigningKey,) -> Result<SignedCommit, AppError> { let mut ikm = [0u8; 32]; rand::RngCore::fill_bytes(&mut rand::rng(), &mut ikm);
let ctx = build_context(space_uri, rev, &ikm);
// sig covers space + rev + ikm, NOT the hash — prevents rebroadcast proof let sig: Signature = signing_key.sign(&ctx);
// mac = HMAC-SHA256(HKDF-SHA256(ikm, ctx), hash) let hk = Hkdf::<Sha256>::new(None, &ikm); let mut derived_key = [0u8; 32]; hk.expand(&ctx, &mut derived_key) .map_err(|e| AppError::Internal(format!("HKDF expand failed: {e}")))?;
let mut mac_hasher = <Hmac<Sha256> as Mac>::new_from_slice(&derived_key) .map_err(|e| AppError::Internal(format!("HMAC init failed: {e}")))?; mac_hasher.update(hash); let mac: [u8; 32] = mac_hasher.finalize().into_bytes().into();
Ok(SignedCommit { hash: *hash, ikm, sig: sig.to_bytes().to_vec(), mac, rev: rev.to_string(), })}
pub fn verify_commit( commit: &SignedCommit, space_uri: &str, verifying_key: &VerifyingKey,) -> Result<(), AppError> { let ctx = build_context(space_uri, &commit.rev, &commit.ikm);
let sig = Signature::from_bytes(commit.sig.as_slice().into()) .map_err(|_| AppError::Auth("invalid commit signature format".into()))?; verifying_key .verify(&ctx, &sig) .map_err(|_| AppError::Auth("commit signature verification failed".into()))?;
// Recompute and verify MAC let hk = Hkdf::<Sha256>::new(None, &commit.ikm); let mut derived_key = [0u8; 32]; hk.expand(&ctx, &mut derived_key) .map_err(|e| AppError::Internal(format!("HKDF expand failed: {e}")))?;
let mut mac_hasher = <Hmac<Sha256> as Mac>::new_from_slice(&derived_key) .map_err(|e| AppError::Internal(format!("HMAC init failed: {e}")))?; mac_hasher.update(&commit.hash);
mac_hasher.verify_slice(&commit.mac).map_err(|_| { AppError::Auth("commit MAC verification failed — repo hash mismatch".into()) })?;
Ok(())}
#[cfg(test)]mod tests { use super::*; use k256::ecdsa::SigningKey;
fn test_signing_key() -> SigningKey { let mut bytes = [0u8; 32]; bytes[31] = 1; // valid non-zero scalar SigningKey::from_bytes((&bytes[..]).into()).unwrap() }
#[test] fn context_string_format() { let ctx = build_context( "ats://did:plc:abc/com.example.forum/main", "3k2abc", &[0xAA; 32], ); // Starts with protocol tag assert!(ctx.starts_with(b"atproto-space-v1")); }
#[test] fn context_includes_all_fields() { let space = "ats://did:plc:abc/com.example.forum/main"; let rev = "3k2abc"; let ikm = [0xBB; 32]; let ctx = build_context(space, rev, &ikm);
// Context must contain the space URI, rev, and ikm assert!(ctx.windows(space.len()).any(|w| w == space.as_bytes())); assert!(ctx.windows(rev.len()).any(|w| w == rev.as_bytes())); assert!(ctx.windows(32).any(|w| w == ikm)); }
#[test] fn sign_and_verify_roundtrip() { let sk = test_signing_key(); let vk = *sk.verifying_key(); let hash = [0xCC; 32]; let space = "ats://did:plc:abc/com.example.forum/main";
let commit = sign_commit(&hash, space, "3k2rev1", &sk).unwrap();
assert_eq!(commit.hash, hash); assert_eq!(commit.rev, "3k2rev1"); assert_eq!(commit.mac.len(), 32); assert!(!commit.sig.is_empty());
assert!(verify_commit(&commit, space, &vk).is_ok()); }
#[test] fn verify_rejects_wrong_key() { let sk1 = test_signing_key(); let mut bytes2 = [0u8; 32]; bytes2[31] = 2; let sk2 = SigningKey::from_bytes((&bytes2[..]).into()).unwrap(); let vk2 = *sk2.verifying_key();
let hash = [0xDD; 32]; let space = "ats://did:plc:abc/com.example.forum/main";
let commit = sign_commit(&hash, space, "rev1", &sk1).unwrap(); assert!(verify_commit(&commit, space, &vk2).is_err()); }
#[test] fn verify_rejects_tampered_hash() { let sk = test_signing_key(); let vk = *sk.verifying_key(); let hash = [0xEE; 32]; let space = "ats://did:plc:abc/com.example.forum/main";
let mut commit = sign_commit(&hash, space, "rev1", &sk).unwrap(); commit.hash[0] ^= 0xFF; // tamper assert!(verify_commit(&commit, space, &vk).is_err()); }
#[test] fn verify_rejects_wrong_space() { let sk = test_signing_key(); let vk = *sk.verifying_key(); let hash = [0xFF; 32];
let commit = sign_commit( &hash, "ats://did:plc:abc/com.example.forum/main", "rev1", &sk, ) .unwrap(); assert!(verify_commit(&commit, "ats://did:plc:xyz/com.example.forum/other", &vk).is_err()); }
#[test] fn different_ikm_per_commit() { let sk = test_signing_key(); let hash = [0xAA; 32]; let space = "ats://did:plc:abc/com.example.forum/main";
let c1 = sign_commit(&hash, space, "rev1", &sk).unwrap(); let c2 = sign_commit(&hash, space, "rev1", &sk).unwrap();
// Each call generates fresh ikm assert_ne!(c1.ikm, c2.ikm); // But both verify let vk = *sk.verifying_key(); assert!(verify_commit(&c1, space, &vk).is_ok()); assert!(verify_commit(&c2, space, &vk).is_ok()); }
#[test] fn verify_rejects_tampered_mac() { let sk = test_signing_key(); let vk = *sk.verifying_key(); let hash = [0xCC; 32]; let space = "ats://did:plc:abc/com.example.forum/main";
let mut commit = sign_commit(&hash, space, "rev1", &sk).unwrap(); assert!(verify_commit(&commit, space, &vk).is_ok()); commit.mac[0] ^= 0xFF; assert!(verify_commit(&commit, space, &vk).is_err()); }}