diff options
author | vnugent <public@vaughnnugent.com> | 2023-09-06 13:51:13 -0400 |
---|---|---|
committer | vnugent <public@vaughnnugent.com> | 2023-09-06 13:51:13 -0400 |
commit | cd8e865dad326f85ff2357ad90bbd6aa65dea68e (patch) | |
tree | 0d4a0bb8bafc4f807407e99c5e6bf4e1cb34217a /back-end |
initial commit
Diffstat (limited to 'back-end')
35 files changed, 2994 insertions, 0 deletions
diff --git a/back-end/Taskfile.yaml b/back-end/Taskfile.yaml new file mode 100644 index 0000000..6d36177 --- /dev/null +++ b/back-end/Taskfile.yaml @@ -0,0 +1,48 @@ + +#taskfile for building the libraries for admin and clients and creating their packages + +version: '3' + +vars: + DOTNET_BUILD_FLAGS: '/p:RunAnalyzersDuringBuild=false /p:BuildInParallel=true /p:MultiProcessorCompilation=true' + +tasks: + + build: + dir: '{{.USER_WORKING_DIR}}' + cmds: + #build project + - dotnet publish -c release {{.DOTNET_BUILD_FLAGS}} + + #postbuild to package artifaces into the archives for upload + postbuild_success: + dir: '{{.USER_WORKING_DIR}}' + vars: + #output directory for the build artifacts + OUT_DIR: 'bin/release/{{.TARGET_FRAMEWORK}}/publish' + + cmds: + #pack up source code + - task: packsource + + #copy license to output dir + - powershell -Command "cp '{{.MODULE_DIR}}/LICENSE' -Destination '{{.OUT_DIR}}/LICENSE.txt'" + + #tar the plugin output and put it in the bin dir + - cd {{.OUT_DIR}} && tar -czvf '{{.USER_WORKING_DIR}}/bin/release.tgz' . + + packsource: + dir: '{{.USER_WORKING_DIR}}' + internal: true + cmds: + #copy source code to target + - powershell -Command "Get-ChildItem -Include *.cs,*.csproj -Recurse | Where { \$_.FullName -notlike '*\obj\*' -and \$_.FullName -notlike '*\bin\*' } | Resolve-Path -Relative | tar --files-from - -cvzf 'bin/src.tgz'" + + #clean hook + clean: + dir: '{{.USER_WORKING_DIR}}' + ignore_error: true + cmds: + - dotnet clean -c release + - powershell -Command "Remove-Item -Recurse bin" + - powershell -Command "Remove-Item -Recurse obj"
\ No newline at end of file diff --git a/back-end/libs/NVault.Crypto.Secp256k1/src/ContextExtensions.cs b/back-end/libs/NVault.Crypto.Secp256k1/src/ContextExtensions.cs new file mode 100644 index 0000000..b0e8695 --- /dev/null +++ b/back-end/libs/NVault.Crypto.Secp256k1/src/ContextExtensions.cs @@ -0,0 +1,175 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Security.Cryptography; + +using VNLib.Hashing; +using VNLib.Utils; +using VNLib.Utils.Memory; +using VNLib.Utils.Extensions; + +using static NVault.Crypto.Secp256k1.LibSecp256k1; + + +namespace NVault.Crypto.Secp256k1 +{ + public static unsafe class ContextExtensions + { + /// <summary> + /// Creates a new <see cref="Secp256k1Context"/> from the current managed library + /// </summary> + /// <param name="Lib"></param> + /// <returns>The new <see cref="Secp256k1Context"/> object from the library</returns> + /// <exception cref="CryptographicException"></exception> + public static Secp256k1Context CreateContext(this LibSecp256k1 Lib) + { + //Protect for released lib + Lib.SafeLibHandle.ThrowIfClosed(); + + //Create new context + IntPtr context = Lib._create(1); + + if (context == IntPtr.Zero) + { + throw new CryptographicException("Failed to create the new Secp256k1 context"); + } + + return new Secp256k1Context(Lib, context); + } + + /// <summary> + /// Signs a 32byte message digest with the specified secret key on the current context and writes the signature to the specified buffer + /// </summary> + /// <param name="context"></param> + /// <param name="secretKey">The 32byte secret key used to sign messages from the user</param> + /// <param name="digest">The 32byte message digest to compute the signature of</param> + /// <param name="signature">The buffer to write the signature output to, must be at-least 64 bytes</param> + /// <returns>The number of bytes written to the signature buffer, or less than 1 if the operation failed</returns> + public static ERRNO SchnorSignDigest(this in Secp256k1Context context, ReadOnlySpan<byte> secretKey, ReadOnlySpan<byte> digest, Span<byte> signature) + { + //Check the signature buffer size + if (signature.Length < SignatureSize) + { + return ERRNO.E_FAIL; + } + + //Message digest must be exactly 32 bytes long + if (digest.Length != (int)HashAlg.SHA256) + { + return ERRNO.E_FAIL; + } + + //Stack allocated keypair + KeyPair keyPair = new(); + + //Randomize the context and create the keypair + if (!context.CreateKeyPair(&keyPair, secretKey)) + { + return ERRNO.E_FAIL; + } + + //Create the random nonce + byte* random = stackalloc byte[RandomBufferSize]; + + //Fill the buffer with random bytes + context.Lib.GetRandomBytes(new Span<byte>(random, RandomBufferSize)); + + try + { + fixed (byte* sigPtr = signature, digestPtr = digest) + { + //Sign the message hash and write the output to the signature buffer + if (context.Lib._signHash(context.Context, sigPtr, digestPtr, &keyPair, random) != 1) + { + return ERRNO.E_FAIL; + } + } + } + finally + { + //Erase entropy + MemoryUtil.InitializeBlock(random, RandomBufferSize); + + //Clear the keypair, contains the secret key, even if its stack allocated + MemoryUtil.ZeroStruct(&keyPair); + } + + //Signature size is always 64 bytes + return SignatureSize; + } + + /// <summary> + /// Generates an x-only Schnor encoded public key from the specified secret key on the + /// current context and writes it to the specified buffer. + /// </summary> + /// <param name="context"></param> + /// <param name="secretKey">The 32byte secret key used to derrive the public key from</param> + /// <param name="pubKeyBuffer">The buffer to write the x-only Schnor encoded public key</param> + /// <returns>The number of bytes written to the output buffer, or 0 if the operation failed</returns> + /// <exception cref="CryptographicException"></exception> + public static ERRNO GeneratePubKeyFromSecret(this in Secp256k1Context context, ReadOnlySpan<byte> secretKey, Span<byte> pubKeyBuffer) + { + if (secretKey.Length != SecretKeySize) + { + throw new CryptographicException($"Your secret key must be exactly {SecretKeySize} bytes long"); + } + + if (pubKeyBuffer.Length < XOnlyPublicKeySize) + { + throw new CryptographicException($"Your public key buffer must be at least {XOnlyPublicKeySize} bytes long"); + } + + //Protect for released lib + context.Lib.SafeLibHandle.ThrowIfClosed(); + + //Stack allocated keypair and x-only public key + XOnlyPubKey xOnlyPubKey = new(); + KeyPair keyPair = new(); + + try + { + //Init context and keypair + if (!context.CreateKeyPair(&keyPair, secretKey)) + { + return ERRNO.E_FAIL; + } + + //X-only public key from the keypair + if (context.Lib._createXonly(context.Context, &xOnlyPubKey, 0, &keyPair) != 1) + { + return ERRNO.E_FAIL; + } + + fixed (byte* pubBuffer = pubKeyBuffer) + { + //Serialize the public key to the buffer as an X-only public key without leading status byte + if (context.Lib._serializeXonly(context.Context, pubBuffer, &xOnlyPubKey) != 1) + { + return ERRNO.E_FAIL; + } + } + } + finally + { + //Clear the keypair, contains the secret key, even if its stack allocated + MemoryUtil.ZeroStruct(&keyPair); + } + + //PubKey length is constant + return XOnlyPublicKeySize; + } + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.Crypto.Secp256k1/src/IRandomSource.cs b/back-end/libs/NVault.Crypto.Secp256k1/src/IRandomSource.cs new file mode 100644 index 0000000..542fc9c --- /dev/null +++ b/back-end/libs/NVault.Crypto.Secp256k1/src/IRandomSource.cs @@ -0,0 +1,32 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; + +namespace NVault.Crypto.Secp256k1 +{ + /// <summary> + /// Represents a generator for random data, that fills abinary buffer with random bytes + /// on demand. + /// </summary> + public interface IRandomSource + { + /// <summary> + /// Fills the given buffer with random bytes + /// </summary> + /// <param name="buffer">Binary buffer to fill with random data</param> + void GetRandomBytes(Span<byte> buffer); + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.Crypto.Secp256k1/src/LibSecp256k1.cs b/back-end/libs/NVault.Crypto.Secp256k1/src/LibSecp256k1.cs new file mode 100644 index 0000000..2eea450 --- /dev/null +++ b/back-end/libs/NVault.Crypto.Secp256k1/src/LibSecp256k1.cs @@ -0,0 +1,209 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Runtime.InteropServices; + +using VNLib.Hashing; +using VNLib.Utils; +using VNLib.Utils.Native; +using VNLib.Utils.Extensions; + +namespace NVault.Crypto.Secp256k1 +{ + + public unsafe class LibSecp256k1 : VnDisposeable + { + public const int SecretKeySize = 32; + public const int XOnlyPublicKeySize = 32; + public const int SignatureSize = 64; + public const int KeyPairSize = 96; + public const int RandomBufferSize = 32; + + /* + * Unsafe structures that represent the native keypair and x-only public key + * structures. They hold character arrays + */ + [StructLayout(LayoutKind.Sequential)] + internal struct KeyPair + { + public fixed byte data[Length]; + public const int Length = KeyPairSize; + } + + [StructLayout(LayoutKind.Sequential)] + internal struct XOnlyPubKey + { + public fixed byte data[Length]; + public const int Length = 64; + } + + //Native methods + [SafeMethodName("secp256k1_context_create")] + internal delegate IntPtr CreateContext(int flags); + + [SafeMethodName("secp256k1_context_destroy")] + internal delegate void DestroyContext(IntPtr context); + + [SafeMethodName("secp256k1_context_randomize")] + internal delegate int RandomizeContext(IntPtr context, byte* seed32); + + [SafeMethodName("secp256k1_keypair_create")] + internal delegate int KeypairCreate(IntPtr context, KeyPair* keyPair, byte* secretKey); + + [SafeMethodName("secp256k1_keypair_xonly_pub")] + internal delegate int KeypairXOnlyPub(IntPtr ctx, XOnlyPubKey* pubkey, int pk_parity, KeyPair* keypair); + + [SafeMethodName("secp256k1_xonly_pubkey_serialize")] + internal delegate int XOnlyPubkeySerialize(IntPtr ctx, byte* output32, XOnlyPubKey* pubkey); + + [SafeMethodName("secp256k1_schnorrsig_sign32")] + internal delegate int SignHash(IntPtr ctx, byte* sig64, byte* msg32, KeyPair* keypair, byte* aux_rand32); + + /// <summary> + /// Loads the Secp256k1 library from the specified path and creates a wrapper class (loads methods from the library) + /// </summary> + /// <param name="dllPath">The realtive or absolute path to the shared library</param> + /// <param name="search">The DLL probing path pattern</param> + /// <returns>The <see cref="LibSecp256k1"/> library wrapper class</returns> + /// <exception cref="DllNotFoundException"></exception> + /// <exception cref="ArgumentNullException"></exception> + /// <exception cref="MissingMemberException"></exception> + /// <exception cref="EntryPointNotFoundException"></exception> + public static LibSecp256k1 LoadLibrary(string dllPath, DllImportSearchPath search, IRandomSource? random) + { + _ = dllPath?? throw new ArgumentNullException(nameof(dllPath)); + + //try to load the library + SafeLibraryHandle lib = SafeLibraryHandle.LoadLibrary(dllPath, search); + + //try to create the wrapper class, if it fails, dispose the library + try + { + //setup fallback random source if null + random ??= new FallbackRandom(); + + //Create the lib + return new LibSecp256k1(lib, random); + } + catch + { + //Dispose the library if the creation failed + lib.Dispose(); + throw; + } + } + + /// <summary> + /// The underlying library handle + /// </summary> + public SafeLibraryHandle SafeLibHandle { get; } + + internal readonly KeypairCreate _createKeyPair; + internal readonly CreateContext _create; + internal readonly RandomizeContext _randomize; + internal readonly DestroyContext _destroy; + internal readonly KeypairXOnlyPub _createXonly; + internal readonly XOnlyPubkeySerialize _serializeXonly; + internal readonly SignHash _signHash; + private readonly IRandomSource _randomSource; + + /// <summary> + /// Creates a new instance of the <see cref="LibSecp256k1"/> class from the specified library handle + /// </summary> + /// <param name="handle">The library handle that referrences the secp256k1 platform specific library</param> + /// <remarks> + /// This method attempts to capture all the native methods from the library, which may throw if the library is not valid. + /// </remarks> + /// <exception cref="ArgumentNullException"></exception> + /// <exception cref="MissingMemberException"></exception> + /// <exception cref="EntryPointNotFoundException"></exception> + public LibSecp256k1(SafeLibraryHandle handle, IRandomSource randomSource) + { + //Store library handle + SafeLibHandle = handle ?? throw new ArgumentNullException(nameof(handle)); + + //Get all method handles and store them + _create = handle.DangerousGetMethod<CreateContext>(); + _createKeyPair = handle.DangerousGetMethod<KeypairCreate>(); + _randomize = handle.DangerousGetMethod<RandomizeContext>(); + _destroy = handle.DangerousGetMethod<DestroyContext>(); + _createXonly = handle.DangerousGetMethod<KeypairXOnlyPub>(); + _serializeXonly = handle.DangerousGetMethod<XOnlyPubkeySerialize>(); + _signHash = handle.DangerousGetMethod<SignHash>(); + + //Store random source + _randomSource = randomSource; + } + + /// <summary> + /// Creates a new instance of the <see cref="LibSecp256k1"/> class from the specified library handle + /// with a fallback random source + /// </summary> + /// <param name="handle">The library handle</param> + /// <exception cref="ArgumentNullException"></exception> + /// <exception cref="MissingMemberException"></exception> + /// <exception cref="EntryPointNotFoundException"></exception> + public LibSecp256k1(SafeLibraryHandle handle):this(handle, new FallbackRandom()) + {} + + /// <summary> + /// Generates a new secret key and writes it to the specified buffer. The buffer size must be exactly <see cref="SecretKeySize"/> bytes long + /// </summary> + /// <param name="buffer">The secret key buffer</param> + /// <exception cref="ArgumentException"></exception> + public void CreateSecretKey(Span<byte> buffer) + { + //Protect for released lib + SafeLibHandle.ThrowIfClosed(); + + if(buffer.Length != SecretKeySize) + { + throw new ArgumentException($"Buffer must be exactly {SecretKeySize} bytes long", nameof(buffer)); + } + + //Fill the buffer with random bytes + _randomSource.GetRandomBytes(buffer); + } + + /// <summary> + /// Fills the given buffer with random bytes from + /// the internal random source + /// </summary> + /// <param name="buffer">The buffer to fill with random data</param> + public void GetRandomBytes(Span<byte> buffer) + { + //Protect for released lib + SafeLibHandle.ThrowIfClosed(); + + _randomSource.GetRandomBytes(buffer); + } + + protected override void Free() + { + //Free native library + SafeLibHandle.Dispose(); + } + + private record class FallbackRandom : IRandomSource + { + public void GetRandomBytes(Span<byte> buffer) + { + //Use the random generator from the crypto lib + RandomHash.GetRandomBytes(buffer); + } + } + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.Crypto.Secp256k1/src/NVault.Crypto.Secp256k1.csproj b/back-end/libs/NVault.Crypto.Secp256k1/src/NVault.Crypto.Secp256k1.csproj new file mode 100644 index 0000000..fd64768 --- /dev/null +++ b/back-end/libs/NVault.Crypto.Secp256k1/src/NVault.Crypto.Secp256k1.csproj @@ -0,0 +1,27 @@ +<Project Sdk="Microsoft.NET.Sdk"> + + <PropertyGroup> + <TargetFramework>net6.0</TargetFramework> + <Nullable>enable</Nullable> + <AllowUnsafeBlocks>true</AllowUnsafeBlocks> + <PackageReadmeFile>README.md</PackageReadmeFile> + <RootNamespace>NVault.Crypto.Secp256k1</RootNamespace> + <AssemblyName>NVault.Crypto.Secp256k1</AssemblyName> + </PropertyGroup> + + <PropertyGroup> + <Authors>Vaughn Nugent</Authors> + <Company>Vaughn Nugent</Company> + <Product>NVault.Crypto.Secp256k1</Product> + <Description>Provides a managed library for the Bitcoin Core secp256k1 library, along with other helper types for NVault</Description> + <Copyright>Copyright © 2023 Vaughn Nugent</Copyright> + <PackageProjectUrl>https://www.vaughnnugent.com/resources/software/modules/NVault</PackageProjectUrl> + <RepositoryUrl>https://github.com/VnUgE/NVault/tree/master/</RepositoryUrl> + </PropertyGroup> + + <ItemGroup> + <PackageReference Include="VNLib.Hashing.Portable" Version="0.1.0-ci0070" /> + <PackageReference Include="VNLib.Utils" Version="0.1.0-ci0070" /> + </ItemGroup> + +</Project> diff --git a/back-end/libs/NVault.Crypto.Secp256k1/src/Secp256k1Context.cs b/back-end/libs/NVault.Crypto.Secp256k1/src/Secp256k1Context.cs new file mode 100644 index 0000000..8aac0b8 --- /dev/null +++ b/back-end/libs/NVault.Crypto.Secp256k1/src/Secp256k1Context.cs @@ -0,0 +1,79 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; + +using VNLib.Utils.Extensions; +using VNLib.Utils.Memory; + +using static NVault.Crypto.Secp256k1.LibSecp256k1; + +namespace NVault.Crypto.Secp256k1 +{ + /// <summary> + /// Represents a Secp256k1 context, it is used to randomize the instance, create key pairs, + /// and frees the context when disposed + /// </summary> + /// <param name="Lib">The <see cref="LibSecp256k1"/> library instance</param> + /// <param name="Context">A pointer to the initialized context instance</param> + public readonly record struct Secp256k1Context(LibSecp256k1 Lib, IntPtr Context) : IDisposable + { + /// <summary> + /// Randomizes the context with random data using the library's random source + /// </summary> + /// <returns>True if the context was successfully randomized, false otherwise</returns> + public unsafe readonly bool Randomize() + { + Lib.SafeLibHandle.ThrowIfClosed(); + + //Randomze the context + byte* entropy = stackalloc byte[RandomBufferSize]; + + //Get random bytes + Lib.GetRandomBytes(new Span<byte>(entropy, RandomBufferSize)); + + //call native randomize method + bool result = Lib._randomize(Context, entropy) == 1; + + //Zero the randomness buffer before returning to avoid leaking random data + MemoryUtil.InitializeBlock(entropy, RandomBufferSize); + + return result; + } + + internal unsafe readonly bool CreateKeyPair(KeyPair* keyPair, ReadOnlySpan<byte> secretKey) + { + Lib.SafeLibHandle.ThrowIfClosed(); + + fixed (byte* sk = secretKey) + { + //Create the keypair from the secret key + return Lib._createKeyPair(Context, keyPair, sk) == 1; + } + } + + /// <summary> + /// Releases the context instance and frees the memory + /// </summary> + public readonly void Dispose() + { + if (Context != IntPtr.Zero) + { + //Free the context + Lib._destroy(Context); + } + } + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.Crypto.Secp256k1/src/UnmanagedRandomSource.cs b/back-end/libs/NVault.Crypto.Secp256k1/src/UnmanagedRandomSource.cs new file mode 100644 index 0000000..d4d9a06 --- /dev/null +++ b/back-end/libs/NVault.Crypto.Secp256k1/src/UnmanagedRandomSource.cs @@ -0,0 +1,101 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Runtime.InteropServices; + +using VNLib.Utils; +using VNLib.Utils.Native; +using VNLib.Utils.Extensions; + +namespace NVault.Crypto.Secp256k1 +{ + + /// <summary> + /// A wrapper class for an unmanaged random source that conforms to the <see cref="IRandomSource"/> interface + /// </summary> + public class UnmanagedRandomSource : VnDisposeable, IRandomSource + { + public const string METHOD_NAME = "getRandomBytes"; + + unsafe delegate void UnmanagedRandomSourceDelegate(byte* buffer, int size); + + + private readonly bool OwnsHandle; + private readonly SafeLibraryHandle _library; + private readonly UnmanagedRandomSourceDelegate _getRandomBytes; + + /// <summary> + /// Loads the unmanaged random source from the given library + /// and attempts to get the random bytes method <see cref="METHOD_NAME"/> + /// </summary> + /// <param name="path"></param> + /// <param name="search"></param> + /// <returns>The wrapped library that conforms to the <see cref="IRandomSource"/></returns> + public static UnmanagedRandomSource LoadLibrary(string path, DllImportSearchPath search) + { + //Try to load the library + SafeLibraryHandle lib = SafeLibraryHandle.LoadLibrary(path, search); + try + { + return new UnmanagedRandomSource(lib, true); + } + catch + { + //release lib + lib.Dispose(); + throw; + } + } + + /// <summary> + /// Creates the unmanaged random source from the given library + /// </summary> + /// <param name="lib">The library handle to wrap</param> + /// <exception cref="ObjectDisposedException"></exception> + /// <exception cref="EntryPointNotFoundException"></exception> + public UnmanagedRandomSource(SafeLibraryHandle lib, bool ownsHandle) + { + lib.ThrowIfClosed(); + + _library = lib; + + //get the method delegate + _getRandomBytes = lib.DangerousGetMethod<UnmanagedRandomSourceDelegate>(METHOD_NAME); + + OwnsHandle = ownsHandle; + } + + public unsafe void GetRandomBytes(Span<byte> buffer) + { + _library.ThrowIfClosed(); + + //Fix buffer and call unmanaged method + fixed(byte* ptr = buffer) + { + _getRandomBytes(ptr, buffer.Length); + } + } + + ///<inheritdoc/> + protected override void Free() + { + if (OwnsHandle) + { + _library.Dispose(); + } + } + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.VaultExtensions/src/IClientAccessScope.cs b/back-end/libs/NVault.VaultExtensions/src/IClientAccessScope.cs new file mode 100644 index 0000000..7a83fd7 --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/IClientAccessScope.cs @@ -0,0 +1,48 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Collections.Generic; + +namespace NVault.VaultExtensions +{ + /// <summary> + /// Represents a user auth token access scope + /// configuration. + /// </summary> + public interface IClientAccessScope + { + /// <summary> + /// The list of policies for new token generation + /// </summary> + IList<string> Policies { get; } + + /// <summary> + /// Allows the user to renew the access token + /// </summary> + bool Renewable { get; } + + /// <summary> + /// The token + /// </summary> + string TokenTtl { get; } + + /// <summary> + /// The explicit number of token uses allowed by the genreated token, + /// 0 for unlimited uses + /// </summary> + int NumberOfUses { get; } + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.VaultExtensions/src/IKvVaultStore.cs b/back-end/libs/NVault.VaultExtensions/src/IKvVaultStore.cs new file mode 100644 index 0000000..261bd7c --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/IKvVaultStore.cs @@ -0,0 +1,52 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System.Threading.Tasks; + +using VNLib.Utils.Memory; + +namespace NVault.VaultExtensions +{ + /// <summary> + /// Represents a vault key-value store that can be used to store secrets + /// </summary> + public interface IKvVaultStore + { + /// <summary> + /// Deletes a secret from the vault + /// </summary> + /// <param name="user">The user scope of the secret</param> + /// <param name="path">The path to the secret</param> + /// <returns>A task that returns when the operation has completed</returns> + Task DeleteSecretAsync(VaultUserScope user, string path); + + /// <summary> + /// Sets a secret in the vault at the specified path and user scope + /// </summary> + /// <param name="user">The user scope to store the value at</param> + /// <param name="path">The path to the secret</param> + /// <param name="secret">The secret value to set</param> + /// <returns>A task that resolves when the secret has been updated</returns> + Task SetSecretAsync(VaultUserScope user, string path, PrivateString secret); + + /// <summary> + /// Gets a secret from the vault at the specified path and user scope + /// </summary> + /// <param name="user">The user scope to get the value from</param> + /// <param name="path">The secret path</param> + /// <returns>A task that resolves the secret if found, null otherwise</returns> + Task<PrivateString?> GetSecretAsync(VaultUserScope user, string path); + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.VaultExtensions/src/IVaultClientScope.cs b/back-end/libs/NVault.VaultExtensions/src/IVaultClientScope.cs new file mode 100644 index 0000000..873a115 --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/IVaultClientScope.cs @@ -0,0 +1,33 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +namespace NVault.VaultExtensions +{ + /// <summary> + /// Represents a vault client scope configuration + /// </summary> + public interface IVaultClientScope + { + /// <summary> + /// The mount point for the vault + /// </summary> + string? MountPoint { get; } + + /// <summary> + /// The entry path for the vault + /// </summary> + string? EntryPath { get; } + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.VaultExtensions/src/IVaultKvClientScope.cs b/back-end/libs/NVault.VaultExtensions/src/IVaultKvClientScope.cs new file mode 100644 index 0000000..951f5e2 --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/IVaultKvClientScope.cs @@ -0,0 +1,29 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +namespace NVault.VaultExtensions +{ + /// <summary> + /// A key-value specific scoped client + /// </summary> + public interface IVaultKvClientScope : IVaultClientScope + { + /// <summary> + /// The property to store the secret value in the + /// storage dictionary + /// </summary> + string StorageProperty { get; } + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.VaultExtensions/src/KvVaultStorage.cs b/back-end/libs/NVault.VaultExtensions/src/KvVaultStorage.cs new file mode 100644 index 0000000..b679404 --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/KvVaultStorage.cs @@ -0,0 +1,66 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System.Threading.Tasks; + +using VaultSharp; + +using VNLib.Utils.Memory; + +namespace NVault.VaultExtensions +{ + /// <summary> + /// An abstract kv storage implementation that uses the vault client to store secrets + /// </summary> + public abstract class KvVaultStorage : IKvVaultStore + { + /// <summary> + /// The vault client + /// </summary> + protected abstract IVaultClient Client { get; } + + /// <summary> + /// The storage scope + /// </summary> + protected abstract IVaultKvClientScope Scope { get; } + + public virtual Task DeleteSecretAsync(VaultUserScope user, string path) + { + string tPath = TranslatePath(path); + return Client.DeleteSecretAsync(Scope, user, tPath); + } + + public virtual Task SetSecretAsync(VaultUserScope user, string path, PrivateString secret) + { + string tPath = TranslatePath(path); + return Client.SetSecretAsync(Scope, user, tPath, secret); + } + + public virtual Task<PrivateString?> GetSecretAsync(VaultUserScope user, string path) + { + string tPath = TranslatePath(path); + return Client.GetSecretAsync(Scope, user, tPath); + } + + /// <summary> + /// Translates a realtive item path to a full path + /// within the scope of the storage. This may be used to + /// extend the scope of the operation + /// </summary> + /// <param name="path">The item path to scope</param> + /// <returns>The further scoped vault path for the item</returns> + public virtual string TranslatePath(string path) => path; + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.VaultExtensions/src/NVault.VaultExtensions.csproj b/back-end/libs/NVault.VaultExtensions/src/NVault.VaultExtensions.csproj new file mode 100644 index 0000000..43f3e15 --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/NVault.VaultExtensions.csproj @@ -0,0 +1,27 @@ +<Project Sdk="Microsoft.NET.Sdk"> + + <PropertyGroup> + <TargetFramework>net6.0</TargetFramework> + <Nullable>enable</Nullable> + <AllowUnsafeBlocks>true</AllowUnsafeBlocks> + <PackageReadmeFile>README.md</PackageReadmeFile> + <RootNamespace>NVault.VaultExtensions</RootNamespace> + <AssemblyName>NVault.VaultExtensions</AssemblyName> + </PropertyGroup> + + <PropertyGroup> + <Authors>Vaughn Nugent</Authors> + <Company>Vaughn Nugent</Company> + <Product>NVault.VaultExtensions</Product> + <Description>A Hashicorp Vault unified extension library for NVault</Description> + <Copyright>Copyright © 2023 Vaughn Nugent</Copyright> + <PackageProjectUrl>https://www.vaughnnugent.com/resources/software/modules/NVault</PackageProjectUrl> + <RepositoryUrl>https://github.com/VnUgE/NVault/tree/master/</RepositoryUrl> + </PropertyGroup> + + <ItemGroup> + <PackageReference Include="VaultSharp" Version="1.13.0.1" /> + <PackageReference Include="VNLib.Plugins.Extensions.Loading" Version="0.1.0-ci0033" /> + </ItemGroup> + +</Project> diff --git a/back-end/libs/NVault.VaultExtensions/src/VaultClientExtensions.cs b/back-end/libs/NVault.VaultExtensions/src/VaultClientExtensions.cs new file mode 100644 index 0000000..5a7c637 --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/VaultClientExtensions.cs @@ -0,0 +1,156 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System.Threading; +using System.Threading.Tasks; +using System.Collections.Generic; + +using VaultSharp; +using VaultSharp.V1.Commons; + +using VNLib.Utils.Memory; +using VNLib.Plugins.Essentials.Extensions; + + +namespace NVault.VaultExtensions +{ + + public static class VaultClientExtensions + { + + private static string GetKeyPath(IVaultClientScope client, in VaultUserScope scope, string itemPath) + { + //Allow for null entry path + return client.EntryPath == null ? $"{scope.UserId}/{itemPath}" : $"{client.EntryPath}/{scope.UserId}/{itemPath}"; + } + + + public static Task<PrivateString?> GetSecretAsync(this IVaultClient client, IVaultKvClientScope scope, VaultUserScope user, string path) + { + return GetSecretAsync(client, scope, user, path, scope.StorageProperty); + } + + public static async Task<PrivateString?> GetSecretAsync(this IVaultClient client, IVaultClientScope scope, VaultUserScope user, string path, string property) + { + //Get the path complete path for the scope + string fullPath = GetKeyPath(scope, user, path); + + //Get the secret from the vault + Secret<SecretData> result = await client.V1.Secrets.KeyValue.V2.ReadSecretAsync(fullPath, mountPoint:scope.MountPoint); + + //Try to get the secret value from the store + string? value = result.Data.Data.GetValueOrDefault(property)?.ToString(); + + //Return the secret value as a private string + return value == null ? null : new PrivateString(value); + } + + /// <summary> + /// Writes a secret to the vault that is scoped by the vault scope, and the user scope. + /// </summary> + /// <param name="client"></param> + /// <param name="scope">The client scope configuration</param> + /// <param name="user">The user scope to isolate the </param> + /// <param name="path">The item path within the current scope</param> + /// <param name="secret">The secret value to set at the desired property</param> + /// <returns>A task that resolves when the secret has been updated</returns> + public static async Task<CurrentSecretMetadata> SetSecretAsync(this IVaultClient client, IVaultKvClientScope scope, VaultUserScope user, string path, PrivateString secret) + { + Dictionary<string, string> secretDict = new() + { + //Dangerous cast, but we know the type + { scope.StorageProperty, (string)secret } + }; + + //Await the result so we be sure the secret is not destroyed + return await SetSecretAsync(client, scope, user, path, secretDict); + } + + /// <summary> + /// Writes a secret to the vault that is scoped by the vault scope, and the user scope. + /// </summary> + /// <param name="client"></param> + /// <param name="scope">The client scope configuration</param> + /// <param name="user">The user scope to isolate the </param> + /// <param name="path">The item path within the current scope</param> + /// <param name="secret">The secret value to set at the desired property</param> + /// <returns>A task that resolves when the secret has been updated</returns> + public static async Task<CurrentSecretMetadata> SetSecretAsync(this IVaultClient client, IVaultClientScope scope, VaultUserScope user, string path, IDictionary<string, string> secret) + { + //Get the path complete path for the scope + string fullPath = GetKeyPath(scope, user, path); + + //Get the secret from the vault + Secret<CurrentSecretMetadata> result = await client.V1.Secrets.KeyValue.V2.WriteSecretAsync(fullPath, secret, mountPoint:scope.MountPoint); + + return result.Data; + } + + /// <summary> + /// Deletes a secret from the vault that is scoped by the vault scope, and the user scope. + /// </summary> + /// <param name="client"></param> + /// <param name="scope">The client scope</param> + /// <param name="user">The vault user scope</param> + /// <param name="path">The path to the storage</param> + /// <returns>A task that resolves when the delete operation has completed</returns> + public static Task DeleteSecretAsync(this IVaultClient client, IVaultClientScope scope, VaultUserScope user, string path) + { + string fullApth = GetKeyPath(scope, user, path); + return client.V1.Secrets.KeyValue.V2.DeleteSecretAsync(fullApth, mountPoint:scope.MountPoint); + } + + /// <summary> + /// Deletes a secret from the vault + /// </summary> + /// <param name="user">The user scope of the secret</param> + /// <param name="path">The path to the secret</param> + /// <param name="cancellation">A token to cancel the operation</param> + /// <returns>A task that returns when the operation has completed</returns> + public static Task DeleteSecretAsync(this IKvVaultStore store, VaultUserScope user, string path, CancellationToken cancellation) + { + return store.DeleteSecretAsync(user, path).WaitAsync(cancellation); + } + + + /// <summary> + /// Gets a secret from the vault at the specified path and user scope + /// </summary> + /// <param name="user">The user scope to get the value from</param> + /// <param name="path">The secret path</param> + /// <param name="cancellation">A token to cancel the operation</param> + /// <returns>A task that resolves the secret if found, null otherwise</returns> + public static Task<PrivateString?> GetSecretAsync(this IKvVaultStore store, VaultUserScope user, string path, CancellationToken cancellation) + { + return store.GetSecretAsync(user, path).WaitAsync(cancellation); + } + + + /// <summary> + /// Sets a secret in the vault at the specified path and user scope + /// </summary> + /// <param name="user">The user scope to store the value at</param> + /// <param name="path">The path to the secret</param> + /// <param name="secret">The secret value to set</param> + /// <param name="cancellation">The cancellation token</param> + /// <returns>A task that resolves when the secret has been updated</returns> + public static Task SetSecretAsync(this IKvVaultStore store, VaultUserScope user, string path, PrivateString secret, CancellationToken cancellation) + { + return store.SetSecretAsync(user, path, secret).WaitAsync(cancellation); + } + + + } +}
\ No newline at end of file diff --git a/back-end/libs/NVault.VaultExtensions/src/VaultUserScope.cs b/back-end/libs/NVault.VaultExtensions/src/VaultUserScope.cs new file mode 100644 index 0000000..b70028e --- /dev/null +++ b/back-end/libs/NVault.VaultExtensions/src/VaultUserScope.cs @@ -0,0 +1,25 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +namespace NVault.VaultExtensions +{ + /// <summary> + /// Represents a user scope for the vault. It isolates the user's + /// secrets from other users. + /// </summary> + /// <param name="UserId">The id of the user to scope the vault to</param> + public readonly record struct VaultUserScope(string UserId) + { } +}
\ No newline at end of file diff --git a/back-end/plugins/nvault/src/Base64KeyEncoder.cs b/back-end/plugins/nvault/src/Base64KeyEncoder.cs new file mode 100644 index 0000000..6e852ef --- /dev/null +++ b/back-end/plugins/nvault/src/Base64KeyEncoder.cs @@ -0,0 +1,31 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Buffers.Text; + +using VNLib.Utils; + +namespace NVault.Plugins.Vault +{ + class Base64KeyEncoder : INostrKeyEncoder + { + public int GetKeyBufferSize(ReadOnlySpan<char> keyData) => Base64.GetMaxEncodedToUtf8Length(keyData.Length); + + public ERRNO DecodeKey(ReadOnlySpan<char> keyData, Span<byte> buffer) => VnEncoding.TryFromBase64Chars(keyData, buffer); + + public string? EncodeKey(ReadOnlySpan<byte> buffer) => Convert.ToBase64String(buffer); + } +} diff --git a/back-end/plugins/nvault/src/Endpoints/Endpoint.cs b/back-end/plugins/nvault/src/Endpoints/Endpoint.cs new file mode 100644 index 0000000..00309d1 --- /dev/null +++ b/back-end/plugins/nvault/src/Endpoints/Endpoint.cs @@ -0,0 +1,424 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Net; +using System.Text.Json; +using System.Threading.Tasks; +using System.Collections.Generic; + +using Microsoft.EntityFrameworkCore; + +using FluentValidation; + +using NVault.VaultExtensions; + +using VNLib.Plugins; +using VNLib.Plugins.Essentials; +using VNLib.Plugins.Essentials.Endpoints; +using VNLib.Plugins.Essentials.Extensions; +using VNLib.Plugins.Extensions.Loading; +using VNLib.Plugins.Extensions.Validation; +using VNLib.Plugins.Extensions.Loading.Sql; +using VNLib.Plugins.Extensions.Data.Extensions; + +using NVault.Plugins.Vault.Model; + +namespace NVault.Plugins.Vault.Endpoints +{ + + [ConfigurationName("endpoint")] + internal class Endpoint : ProtectedWebEndpoint + { + private static IValidator<NostrEvent> EventValidator { get; } = NostrEvent.GetValidator(); + private static IValidator<NostrRelay> RelayValidator { get; } = NostrRelay.GetValidator(); + private static IValidator<NostrKeyMeta> KeyMetaValidator { get; } = NostrKeyMeta.GetValidator(); + private static IValidator<CreateKeyRequest> CreateKeyRequestValidator { get; } = CreateKeyRequest.GetValidator(); + + private readonly INostrOperations _vault; + private readonly NostrRelayStore _relays; + private readonly NostrKeyMetaStore _publicKeyStore; + private readonly bool AllowDelete; + + public Endpoint(PluginBase plugin, IConfigScope config) + { + string? path = config["path"].GetString(); + InitPathAndLog(path, plugin.Log); + + AllowDelete = config.TryGetValue("allow_delete", out JsonElement adEl) && adEl.GetBoolean(); + + + DbContextOptions options = plugin.GetContextOptions(); + + _relays = new NostrRelayStore(options); + _publicKeyStore = new NostrKeyMetaStore(options); + _vault = new NostrOpProvider(plugin); + } + + + protected override async ValueTask<VfReturnType> GetAsync(HttpEntity entity) + { + //Check the operation flag + if(entity.QueryArgs.IsArgumentSet("type", "getRelays")) + { + //Get all relays + List<NostrRelay> relays = _relays.ListRental.Rent(); + + await _relays.GetUserPageAsync(relays, entity.Session.UserID, 0, 100); + + //Return all relays for the user + entity.CloseResponseJson(HttpStatusCode.OK, relays); + + _relays.ListRental.Return(relays); + + return VfReturnType.VirtualSkip; + } + + //Get pubkey + if (entity.QueryArgs.IsArgumentSet("type", "getKeys")) + { + List<NostrKeyMeta> keys = _publicKeyStore.ListRental.Rent(); + + //Get the first public key for the user + await _publicKeyStore.GetUserPageAsync(keys, entity.Session.UserID, 0, 100); + + //Return all keys for the user + entity.CloseResponseJson(HttpStatusCode.OK, keys); + + _publicKeyStore.ListRental.Return(keys); + + return VfReturnType.VirtualSkip; + } + + return VfReturnType.NotFound; + } + + protected override async ValueTask<VfReturnType> PostAsync(HttpEntity entity) + { + + //Get the operation argument + if(entity.QueryArgs.IsArgumentSet("type", "signEvent")) + { + ValErrWebMessage webm = new(); + + //Get the event + NostrEvent? ev = await entity.GetJsonFromFileAsync<NostrEvent>(); + + if(webm.Assert(ev != null, "Bad request")) + { + entity.CloseResponseJson(HttpStatusCode.BadRequest, webm); + return VfReturnType.VirtualSkip; + } + + //Basic validate the message + if(!EventValidator.Validate(ev, webm)) + { + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + //Get the key metadata + NostrKeyMeta? keyMeta = await _publicKeyStore.GetSingleUserRecordAsync(ev.KeyId, entity.Session.UserID); + if(webm.Assert(keyMeta != null, "Key not found")) + { + entity.CloseResponseJson(HttpStatusCode.NotFound, webm); + return VfReturnType.VirtualSkip; + } + + //If no public key is set, use the key metadata + if(string.IsNullOrWhiteSpace(ev.PublicKey)) + { + ev.PublicKey = keyMeta.Value; + } + + //Event public key must match the key metadata + if(webm.Assert(keyMeta.Value.Equals(ev.PublicKey, StringComparison.OrdinalIgnoreCase), "Key mismatch")) + { + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + //Create user scope + VaultUserScope scope = new(entity.Session.UserID); + + //try to sign the event + bool result = await _vault.SignEventAsync(scope, keyMeta, ev, entity.EventCancellation); + + if(webm.Assert(result, "Failed to sign nostr event")) + { + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + webm.Result = ev; + webm.Success = true; + + //Return the signed event + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + return VfReturnType.NotFound; + } + + protected override async ValueTask<VfReturnType> PatchAsync(HttpEntity entity) + { + ValErrWebMessage webm = new(); + + //Check for relay update + if (entity.QueryArgs.IsArgumentSet("type", "relay")) + { + //Get the new relay item + NostrRelay? relay = await entity.GetJsonFromFileAsync<NostrRelay>(); + + if(webm.Assert(relay != null, "No relay specified")) + { + entity.CloseResponseJson(HttpStatusCode.BadRequest, webm); + return VfReturnType.VirtualSkip; + } + + //Validate + if (!RelayValidator.Validate(relay, webm)) + { + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + //Cleanup relay message + relay.CleanupFromUser(); + + //Update or create the relay for the user + if(await _relays.CreateUserRecordAsync(relay, entity.Session.UserID)) + { + webm.Result = "Successfully updated relay"; + webm.Success = true; + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + webm.Result = "Failed to update relay"; + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + //Allow updating key metdata + if(entity.QueryArgs.IsArgumentSet("type", "identity")) + { + //Get the key metadata + NostrKeyMeta? meta = await entity.GetJsonFromFileAsync<NostrKeyMeta>(); + + if(webm.Assert(meta != null, "No key metadata specified")) + { + entity.CloseResponseJson(HttpStatusCode.BadRequest, webm); + return VfReturnType.VirtualSkip; + } + + //Validate the key metadata + if(!KeyMetaValidator.Validate(meta, webm)) + { + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + meta.CleanupFromUser(); + + //Get the original record + NostrKeyMeta? original = await _publicKeyStore.GetSingleUserRecordAsync(meta.Id, entity.Session.UserID); + + if(webm.Assert(original != null, "Key metadata not found")) + { + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + //Merge the metadata + original.Merge(meta); + + //Update the key metadata for the user + if(await _publicKeyStore.UpdateUserRecordAsync(original, entity.Session.UserID)) + { + webm.Result = "Successfully updated key metadata"; + webm.Success = true; + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + webm.Result = "Failed to update key metadata"; + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + return VfReturnType.NotFound; + } + + protected override async ValueTask<VfReturnType> PutAsync(HttpEntity entity) + { + //Allow creating a new identity + if(entity.QueryArgs.IsArgumentSet("type", "identity")) + { + ValErrWebMessage webm = new(); + + CreateKeyRequest? request = await entity.GetJsonFromFileAsync<CreateKeyRequest>(); + + if(webm.Assert(request != null, "Invalid key request")) + { + entity.CloseResponseJson(HttpStatusCode.BadRequest, webm); + return VfReturnType.VirtualSkip; + } + + if(!CreateKeyRequestValidator.Validate(request, webm)) + { + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + //try to create the record for the user first + NostrKeyMeta newKey = new() + { + UserId = entity.Session.UserID, + UserName = request.UserName, + //Create temporary key + Value = Guid.NewGuid().ToString("n") + }; + + //Create the key metadata record before we generate the keypair + if(!await _publicKeyStore.CreateUserRecordAsync(newKey, entity.Session.UserID)) + { + //Failed to create key metadata record + webm.Result = "Failed to create key"; + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + //Create new user scope + VaultUserScope scope = new(entity.Session.UserID); + + bool result; + + if (string.IsNullOrWhiteSpace(request.ExistingKey)) + { + //Create a new keypair/identity for the user + result = await _vault.CreateCredentialAsync(scope, newKey, entity.EventCancellation); + } + else + { + //From exising key + result = await _vault.CreateFromExistingAsync(scope, newKey, request.ExistingKey, entity.EventCancellation); + } + + if (result == false) + { + //Delete the meta entry from the store + await _publicKeyStore.DeleteUserRecordAsync(newKey.Id, entity.Session.UserID); + + webm.Result = "Failed to create new identity"; + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + /* + * Update the key now that the vault has updated the entity. + * + * We dont care if this fails because the key is already created, it will + * just be empty, which is fine, the user can update/delete it later. + */ + await _publicKeyStore.UpdateUserRecordAsync(newKey, entity.Session.UserID); + + //Store the new key + webm.Result = newKey; + webm.Success = true; + + //Return the new key info + entity.CloseResponse(webm); + return VfReturnType.VirtualSkip; + } + + return VfReturnType.NotFound; + } + + protected override async ValueTask<VfReturnType> DeleteAsync(HttpEntity entity) + { + ValErrWebMessage webMessage = new (); + + if(entity.QueryArgs.IsArgumentSet("type", "identity")) + { + if (webMessage.Assert(AllowDelete, "Deleting identies are now allowed")) + { + entity.CloseResponseJson(HttpStatusCode.Forbidden, webMessage); + return VfReturnType.VirtualSkip; + } + + if (!entity.QueryArgs.TryGetNonEmptyValue("key_id", out string? keyId)) + { + webMessage.Result = "No key id specified"; + entity.CloseResponseJson(HttpStatusCode.BadRequest, webMessage); + return VfReturnType.VirtualSkip; + } + + //Get the key metadata + NostrKeyMeta? meta = await _publicKeyStore.GetSingleUserRecordAsync(keyId, entity.Session.UserID); + + if (webMessage.Assert(meta != null, "Key metadata not found")) + { + entity.CloseResponseJson(HttpStatusCode.NotFound, webMessage); + return VfReturnType.VirtualSkip; + } + + //Delete the key from the vault + VaultUserScope scope = new(entity.Session.UserID); + + //Delete the key from the vault + await _vault.DeleteCredentialAsync(scope, meta, entity.EventCancellation); + + //Remove the key metadata + await _publicKeyStore.DeleteUserRecordAsync(keyId, entity.Session.UserID); + + webMessage.Result = "Successfully deleted identity"; + webMessage.Success = true; + entity.CloseResponseJson(HttpStatusCode.OK, webMessage); + return VfReturnType.VirtualSkip; + } + + return VfReturnType.NotFound; + } + + sealed class CreateKeyRequest + { + public string? UserName { get; set; } + + public string? ExistingKey { get; set; } + + public static IValidator<CreateKeyRequest> GetValidator() + { + InlineValidator<CreateKeyRequest> val = new(); + + val.RuleFor(r => r.UserName) + .NotEmpty() + .Length(1, 100) + .IllegalCharacters(); + + //If a user-key is specified, it must be 64 characters long hexadecimal + val.When(p => !string.IsNullOrWhiteSpace(p.ExistingKey), () => + { + val.RuleFor(r => r.ExistingKey) + .Length(64) + .AlphaNumericOnly(); + }); + + return val; + } + } + } +} diff --git a/back-end/plugins/nvault/src/INostrCryptoProvider.cs b/back-end/plugins/nvault/src/INostrCryptoProvider.cs new file mode 100644 index 0000000..805eb21 --- /dev/null +++ b/back-end/plugins/nvault/src/INostrCryptoProvider.cs @@ -0,0 +1,66 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; + +using VNLib.Utils; + +namespace NVault.Plugins.Vault +{ + internal interface INostrCryptoProvider + { + /// <summary> + /// Gets the size of the buffer required to hold a signature data + /// </summary> + /// <returns>The size of the required buffer</returns> + int GetSignatureBufferSize(); + + /// <summary> + /// Signs a message digest with the specified private key and writes + /// the signature to the specified buffer. + /// </summary> + /// <param name="key"></param> + /// <param name="digest"></param> + /// <param name="signatureBuffer"></param> + /// <returns>The number of bytes written to the signature buffer, 0 or less if the operation failed</returns> + ERRNO SignMessage(ReadOnlySpan<byte> key, ReadOnlySpan<byte> digest, Span<byte> signatureBuffer); + + /// <summary> + /// Determines the exact size of the buffer required to hold a key pair during + /// creation + /// </summary> + /// <returns>The structure containing the exact sizes of the buffers to allocate</returns> + KeyBufferSizes GetKeyBufferSize(); + + /// <summary> + /// Generates a new key pair and writes the key outputs to the specified buffers. + /// The buffers will be at-leat the size of the values returned by <see cref="GetKeyBufferSize"/> + /// </summary> + /// <param name="publicKey">A buffer to write the public key to</param> + /// <param name="privateKey">A buffer to write the private key to</param> + /// <returns>True if the operation succeeded</returns> + bool TryGenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey); + + /// <summary> + /// Recovers the public key from the specified private key and writes it to the specified buffer + /// </summary> + /// <param name="privateKey">The readonly private key</param> + /// <param name="pubKey">The recovered public key</param> + /// <returns>True if the operation succeeded, false otherwise</returns> + bool RecoverPublicKey(ReadOnlySpan<byte> privateKey, Span<byte> pubKey); + } + + readonly record struct KeyBufferSizes(int PrivateKeySize, int PublicKeySize); +} diff --git a/back-end/plugins/nvault/src/INostrKeyEncoder.cs b/back-end/plugins/nvault/src/INostrKeyEncoder.cs new file mode 100644 index 0000000..a76ab19 --- /dev/null +++ b/back-end/plugins/nvault/src/INostrKeyEncoder.cs @@ -0,0 +1,50 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; + +using VNLib.Utils; + +namespace NVault.Plugins.Vault +{ + /// <summary> + /// Converts secp256k1 private keys to and from strings to store in + /// in the vault storage + /// </summary> + internal interface INostrKeyEncoder + { + /// <summary> + /// Gets the size of the buffer required to hold the key data to decode + /// </summary> + /// <param name="keyData">The encoded key buffer</param> + /// <returns>The minum size of the buffer required to decode the key</returns> + int GetKeyBufferSize(ReadOnlySpan<char> keyData); + + /// <summary> + /// Decodes the specified key data into the specified buffer + /// </summary> + /// <param name="keyData">The key character buffer</param> + /// <param name="buffer">The binary output buffer</param> + /// <returns>The number of bytes encoded, 0 or less if the operation failed</returns> + ERRNO DecodeKey(ReadOnlySpan<char> keyData, Span<byte> buffer); + + /// <summary> + /// Encodes the specified key buffer into a string + /// </summary> + /// <param name="buffer">The key to encode</param> + /// <returns>The encoded string if possible</returns> + string? EncodeKey(ReadOnlySpan<byte> buffer); + } +} diff --git a/back-end/plugins/nvault/src/INostrOperations.cs b/back-end/plugins/nvault/src/INostrOperations.cs new file mode 100644 index 0000000..b7d82a2 --- /dev/null +++ b/back-end/plugins/nvault/src/INostrOperations.cs @@ -0,0 +1,35 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System.Threading; +using System.Threading.Tasks; + +using NVault.Plugins.Vault.Model; + +using NVault.VaultExtensions; + +namespace NVault.Plugins.Vault +{ + internal interface INostrOperations + { + Task<bool> SignEventAsync(VaultUserScope scope, NostrKeyMeta keyMeta, NostrEvent evnt, CancellationToken cancellation); + + Task<bool> CreateCredentialAsync(VaultUserScope scope, NostrKeyMeta newKey, CancellationToken cancellation); + + Task<bool> CreateFromExistingAsync(VaultUserScope scope, NostrKeyMeta newKey, string hexKey, CancellationToken cancellation); + + Task DeleteCredentialAsync(VaultUserScope scope, NostrKeyMeta key, CancellationToken cancellation); + } +} diff --git a/back-end/plugins/nvault/src/INostrVault.cs b/back-end/plugins/nvault/src/INostrVault.cs new file mode 100644 index 0000000..37bc05e --- /dev/null +++ b/back-end/plugins/nvault/src/INostrVault.cs @@ -0,0 +1,33 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System.Threading; +using System.Threading.Tasks; + +using NVault.VaultExtensions; + +using VNLib.Utils.Memory; + +namespace NVault.Plugins.Vault +{ + interface INostrVault + { + Task<PrivateString?> GetKeyAsync(VaultUserScope scope, string keyId, CancellationToken cancellation); + + Task SetKeyAsync(VaultUserScope scope, string keyId, PrivateString keyData, CancellationToken cancellation); + + Task DeleteKeyAsync(VaultUserScope scope, string keyId, CancellationToken cancellation); + } +} diff --git a/back-end/plugins/nvault/src/ManagedCryptoprovider.cs b/back-end/plugins/nvault/src/ManagedCryptoprovider.cs new file mode 100644 index 0000000..b34f220 --- /dev/null +++ b/back-end/plugins/nvault/src/ManagedCryptoprovider.cs @@ -0,0 +1,81 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Text.Json; +using System.Collections.Generic; + +using VNLib.Utils; +using VNLib.Utils.Logging; +using VNLib.Plugins; +using VNLib.Plugins.Extensions.Loading; + +using NVault.Crypto.Secp256k1; + +namespace NVault.Plugins.Vault +{ + [ConfigurationName("crypto")] + internal class ManagedCryptoprovider : INostrCryptoProvider + { + private readonly INostrCryptoProvider _provider; + + public ManagedCryptoprovider(PluginBase plugin, IConfigScope config) + { + IRandomSource? random = null; + + //See if a random source is specified + if (config.TryGetValue("lib_random", out JsonElement randomel)) + { + bool isManaged = randomel.GetProperty("lib_type").GetString() == "managed"; + string path = randomel.GetProperty("lib_path").GetString() ?? throw new KeyNotFoundException("Missing required key 'lib_path' in 'lib_random' element"); + + if (isManaged) + { + //Load managed assembly, plugin will manage lifetime + random = plugin.LoadAssembly<IRandomSource>(path).Resource; + } + else + { + //load unmanaged lib + random = UnmanagedRandomSource.LoadLibrary(path, System.Runtime.InteropServices.DllImportSearchPath.SafeDirectories); + + //Register for unload to cleanup unmanaged lib + _ = plugin.RegisterForUnload(((UnmanagedRandomSource)random).Dispose); + } + } + + string nativePath = config["native_lib"].GetString()!; + + //Load native library path + _provider = NativeSecp256k1Library.LoadLibrary(nativePath, random); + plugin.Log.Verbose("Loaded native Secp256k1 library from {path}", nativePath); + } + + ///<inheritdoc/> + public int GetSignatureBufferSize() => _provider.GetSignatureBufferSize(); + + ///<inheritdoc/> + public ERRNO SignMessage(ReadOnlySpan<byte> key, ReadOnlySpan<byte> digest, Span<byte> signatureBuffer) => _provider.SignMessage(key, digest, signatureBuffer); + + ///<inheritdoc/> + public KeyBufferSizes GetKeyBufferSize() => _provider.GetKeyBufferSize(); + + ///<inheritdoc/> + public bool TryGenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey) => _provider.TryGenerateKeyPair(publicKey, privateKey); + + ///<inheritdoc/> + public bool RecoverPublicKey(ReadOnlySpan<byte> privateKey, Span<byte> pubKey) => _provider.RecoverPublicKey(privateKey, pubKey); + } +} diff --git a/back-end/plugins/nvault/src/ManagedVaultClient.cs b/back-end/plugins/nvault/src/ManagedVaultClient.cs new file mode 100644 index 0000000..ff7977c --- /dev/null +++ b/back-end/plugins/nvault/src/ManagedVaultClient.cs @@ -0,0 +1,71 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using VNLib.Plugins; +using VNLib.Plugins.Extensions.Loading; + +using VaultSharp; +using VaultSharp.V1.AuthMethods.Token; + +using NVault.VaultExtensions; + +namespace NVault.Plugins.Vault +{ + [ConfigurationName("nostr_vault")] + internal sealed class ManagedVaultClient : KvVaultStorage + { + protected override IVaultClient Client { get; } + protected override IVaultKvClientScope Scope { get; } + + public ManagedVaultClient(PluginBase plugin, IConfigScope config) + { + Scope = new KvScope() + { + MountPoint = config["mount"].GetString(), + EntryPath = config["entry"].GetString() ?? "nostr", + //Keys are stored in the key property + StorageProperty = "key" + }; + + //Create the client + Client = CreateClient(config); + } + + private static IVaultClient CreateClient(IConfigScope config) + { + TokenAuthMethodInfo am = new(config["token"].GetString()); + + VaultClientSettings settings = new(config["url"].GetString(), am) + { }; + + return new VaultClient(settings); + } + + ///<inheritdoc/> + public override string TranslatePath(string path) + { + //Prefix with the keys file path + return $"keys/{path}"; + } + + + private sealed class KvScope : IVaultKvClientScope + { + public string StorageProperty { get; init; } = ""; + public string? MountPoint { get; init; } + public string? EntryPath { get; init; } + } + } +} diff --git a/back-end/plugins/nvault/src/Model/NostrContext.cs b/back-end/plugins/nvault/src/Model/NostrContext.cs new file mode 100644 index 0000000..b70a38e --- /dev/null +++ b/back-end/plugins/nvault/src/Model/NostrContext.cs @@ -0,0 +1,100 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using Microsoft.EntityFrameworkCore; + +using VNLib.Plugins.Extensions.Data; +using VNLib.Plugins.Extensions.Loading.Sql; + +namespace NVault.Plugins.Vault.Model +{ + + internal class NostrContext : TransactionalDbContext, IDbTableDefinition + { + public DbSet<NostrRelay> Relays { get; set; } + + public DbSet<NostrKeyMeta> PublicKeys { get; set; } + + public NostrContext() + { } + + public NostrContext(DbContextOptions options) : base(options) + { } + + public void OnDatabaseCreating(IDbContextBuilder builder, object? userState) + { + //Configure relay table + builder.DefineTable<NostrRelay>(nameof(Relays)) + .WithColumn(r => r.Id) + .MaxLength(50) + .Next() + + .WithColumn(r => r.UserId) + .Next() + + //Url is unique + .WithColumn(r => r.Url) + .Unique() + .AllowNull(false) + .Next() + + //Default flags is 0 (none) + .WithColumn(r => (int)r.Flags) + .AllowNull(false) + .WithDefault(0) + .Next() + + .WithColumn(r => r.Created) + .AllowNull(false) + .Next() + + .WithColumn(r => r.LastModified) + .AllowNull(false) + .Next() + + //Finally, version, it should be set to the timestamp from annotations + .WithColumn(r => r.Version); + + //Setup public key table + builder.DefineTable<NostrKeyMeta>(nameof(PublicKeys)) + .WithColumn(r => r.Id) + .Next() + + .WithColumn(r => r.UserId) + .Next() + + .WithColumn(r => r.UserName) + .AllowNull(true) + .Next() + + //Public key is unique + .WithColumn(r => r.Value) + .Unique() + .AllowNull(false) + .Next() + + .WithColumn(r => r.Created) + .AllowNull(false) + .Next() + + .WithColumn(r => r.LastModified) + .AllowNull(false) + .Next() + + //Finally, version, it should be set to the timestamp from annotations + .WithColumn(r => r.Version); + } + } +} diff --git a/back-end/plugins/nvault/src/Model/NostrEvent.cs b/back-end/plugins/nvault/src/Model/NostrEvent.cs new file mode 100644 index 0000000..ccd5a2c --- /dev/null +++ b/back-end/plugins/nvault/src/Model/NostrEvent.cs @@ -0,0 +1,90 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System.Text.Json.Serialization; + +using FluentValidation; + +using VNLib.Plugins.Extensions.Validation; + + +namespace NVault.Plugins.Vault.Model +{ + internal sealed class NostrEvent + { + public const int MAX_CONTENT_LENGTH = 16 * 1024; + + [JsonPropertyName("KeyId")] + public string? KeyId { get; set; } + + [JsonPropertyName("id")] + public string? Id { get; set; } + + [JsonPropertyName("pubkey")] + public string? PublicKey { get; set; } + + [JsonPropertyName("created_at")] + public long? Timestamp { get; set; } + + [JsonPropertyName("kind")] + public NostrMessageKind? MessageKind { get; set; } + + [JsonPropertyName("content")] + public string? Content { get; set; } + + [JsonPropertyName("sig")] + public string? Signature { get; set; } + + [JsonPropertyName("tags")] + public string[]?[]? Tags { get; set; } + + public static IValidator<NostrEvent> GetValidator() + { + InlineValidator<NostrEvent> val = new(); + + //Event id should be empty, we will generate it while computing the hash + val.RuleFor(ev => ev.Id) + //ids are 32 bytes hex encoded + .Length(64) + .AlphaNumericOnly(); + + //No signature set + val.RuleFor(ev => ev.Signature) + .Empty(); + + //If pubkey is defined, must set a 64 byte hex encoded string + val.RuleFor(ev => ev.PublicKey!) + .AlphaNumericOnly() + .When(ev => ev.PublicKey != null) + .Length(64); + + val.RuleFor(ev => ev.Content) + .Length(0, MAX_CONTENT_LENGTH); + + val.RuleFor(ev => ev.Content) + //Content must be specifed when kind is a text note + .NotEmpty() + .When(ev => ev.MessageKind == NostrMessageKind.TextNote); + + //Must have a key identity + val.RuleFor(ev => ev.KeyId) + .NotEmpty() + .Length(12, 64) + .AlphaNumericOnly(); + + return val; + } + } +}
\ No newline at end of file diff --git a/back-end/plugins/nvault/src/Model/NostrKeyMeta.cs b/back-end/plugins/nvault/src/Model/NostrKeyMeta.cs new file mode 100644 index 0000000..2e18ba7 --- /dev/null +++ b/back-end/plugins/nvault/src/Model/NostrKeyMeta.cs @@ -0,0 +1,89 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.ComponentModel.DataAnnotations; +using System.Text.Json.Serialization; + +using FluentValidation; + +using VNLib.Plugins.Extensions.Data; +using VNLib.Plugins.Extensions.Data.Abstractions; +using VNLib.Plugins.Extensions.Validation; + +namespace NVault.Plugins.Vault.Model +{ + internal class NostrKeyMeta : DbModelBase, IUserEntity + { + [Key] + [MaxLength(50)] + public override string Id { get; set; } + public override DateTime Created { get; set; } + public override DateTime LastModified { get; set; } + + [JsonPropertyName("PublicKey")] + [MaxLength(500)] + public string? Value { get; set; } + + [JsonIgnore] + [MaxLength(50)] + public string? UserId { get; set; } + + [MaxLength(100)] + public string? UserName { get; set; } + + public void CleanupFromUser() + { + //Forbidden fields + Created = DateTime.MinValue; + LastModified = DateTime.MinValue; + UserId = null; + + //User is not allowed to change the key value + Value = null; + + //Trim up username + UserName = UserName?.Trim(); + } + + public void Merge(NostrKeyMeta other) + { + if (other == null) + throw new ArgumentNullException(nameof(other)); + + //We only update username and key value + UserName = other.UserName; + } + + public static IValidator<NostrKeyMeta> GetValidator() + { + InlineValidator<NostrKeyMeta> val = new(); + + val.RuleFor(r => r.Id) + .NotEmpty() + //Max id length is 64 hex characters + .MaximumLength(64) + //must only be hex characters + .AlphaNumericOnly(); + + val.RuleFor(r => r.UserName) + .NotEmpty() + .Length(1, 100) + .IllegalCharacters(); + + return val; + } + } +} diff --git a/back-end/plugins/nvault/src/Model/NostrKeyMetaStore.cs b/back-end/plugins/nvault/src/Model/NostrKeyMetaStore.cs new file mode 100644 index 0000000..96d0a3c --- /dev/null +++ b/back-end/plugins/nvault/src/Model/NostrKeyMetaStore.cs @@ -0,0 +1,79 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Linq; + +using Microsoft.EntityFrameworkCore; + +using VNLib.Plugins.Extensions.Data; +using VNLib.Plugins.Extensions.Data.Abstractions; + +namespace NVault.Plugins.Vault.Model +{ + internal sealed class NostrKeyMetaStore : DbStore<NostrKeyMeta> + { + private readonly DbContextOptions _options; + + public NostrKeyMetaStore(DbContextOptions options) => _options = options; + + ///<inheritdoc/> + public override IDbQueryLookup<NostrKeyMeta> QueryTable { get; } = new DbQueries(); + + ///<inheritdoc/> + public override IDbContextHandle GetNewContext() => new NostrContext(_options); + + ///<inheritdoc/> + public override string GetNewRecordId() => Guid.NewGuid().ToString("N"); + + ///<inheritdoc/> + public override void OnRecordUpdate(NostrKeyMeta newRecord, NostrKeyMeta currentRecord) + { + //Update username and key value + currentRecord.UserName = newRecord.UserName; + currentRecord.Value = newRecord.Value; + + currentRecord.UserId = newRecord.UserId; + + //Update last modified time + newRecord.LastModified = DateTime.UtcNow; + } + + sealed record class DbQueries : IDbQueryLookup<NostrKeyMeta> + { + ///<inheritdoc/> + public IQueryable<NostrKeyMeta> GetCollectionQueryBuilder(IDbContextHandle context, params string[] constraints) + { + string userId = constraints[0]; + + return from r in context.Set<NostrKeyMeta>() + where r.UserId == userId + select r; + } + + ///<inheritdoc/> + public IQueryable<NostrKeyMeta> GetSingleQueryBuilder(IDbContextHandle context, params string[] constraints) + { + string id = constraints[0]; + string userId = constraints[1]; + + //Get relay for the given user by its id + return from r in context.Set<NostrKeyMeta>() + where r.Id == id && r.UserId == userId + select r; + } + } + } +} diff --git a/back-end/plugins/nvault/src/Model/NostrRelay.cs b/back-end/plugins/nvault/src/Model/NostrRelay.cs new file mode 100644 index 0000000..e80d268 --- /dev/null +++ b/back-end/plugins/nvault/src/Model/NostrRelay.cs @@ -0,0 +1,86 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Text.Json.Serialization; +using System.ComponentModel.DataAnnotations; + +using FluentValidation; + +using Microsoft.EntityFrameworkCore; + +using VNLib.Plugins.Extensions.Data; +using VNLib.Plugins.Extensions.Data.Abstractions; +using VNLib.Plugins.Extensions.Validation; + +namespace NVault.Plugins.Vault.Model +{ + [Index(nameof(Url))] + internal class NostrRelay : DbModelBase, IUserEntity + { + [Key] + [MaxLength(50)] + [JsonPropertyName("id")] + public override string Id { get; set; } + public override DateTime Created { get; set; } + public override DateTime LastModified { get; set; } + + [JsonPropertyName("url")] + [MaxLength(200)] + public string Url { get; set; } + + [JsonPropertyName("flags")] + public NostrRelayFlags Flags { get; set; } + + [JsonIgnore] + [MaxLength(50)] + public string UserId { get; set; } + + public void CleanupFromUser() + { + //Forbidden fields + Created = DateTime.MinValue; + LastModified = DateTime.MinValue; + UserId = null; + + //trim up url + Url = Url?.Trim(); + } + + public static IValidator<NostrRelay> GetValidator() + { + InlineValidator<NostrRelay> val = new(); + + //Must specify a relay id + val.RuleFor(r => r.Id) + .NotEmpty() + //Must be length 64 hex characters + .MaximumLength(50) + //must only be hex characters + .AlphaNumericOnly(); + + val.RuleFor(r => r.Url) + .NotEmpty() + .Length(5, 200) + .IllegalCharacters(); + + //Must set read/write flag, may be 0 for none/not allowed + val.RuleFor(r => r.Flags) + .NotEmpty(); + + return val; + } + } +} diff --git a/back-end/plugins/nvault/src/Model/NostrRelayFlags.cs b/back-end/plugins/nvault/src/Model/NostrRelayFlags.cs new file mode 100644 index 0000000..352ff11 --- /dev/null +++ b/back-end/plugins/nvault/src/Model/NostrRelayFlags.cs @@ -0,0 +1,24 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +namespace NVault.Plugins.Vault.Model +{ + internal enum NostrRelayFlags + { + None = 0, + Read = 1, + Write = 2, + } +} diff --git a/back-end/plugins/nvault/src/Model/NostrRelayStore.cs b/back-end/plugins/nvault/src/Model/NostrRelayStore.cs new file mode 100644 index 0000000..42f48ab --- /dev/null +++ b/back-end/plugins/nvault/src/Model/NostrRelayStore.cs @@ -0,0 +1,78 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Linq; + +using Microsoft.EntityFrameworkCore; + +using VNLib.Plugins.Extensions.Data; +using VNLib.Plugins.Extensions.Data.Abstractions; + +namespace NVault.Plugins.Vault.Model +{ + internal class NostrRelayStore : DbStore<NostrRelay> + { + private readonly DbContextOptions _options; + + public NostrRelayStore(DbContextOptions options) + { + _options = options; + } + + ///<inheritdoc/> + public override IDbQueryLookup<NostrRelay> QueryTable { get; } = new DbQueries(); + + ///<inheritdoc/> + public override IDbContextHandle GetNewContext() => new NostrContext(_options); + + ///<inheritdoc/> + public override string GetNewRecordId() => Guid.NewGuid().ToString("N"); + + + public override void OnRecordUpdate(NostrRelay newRecord, NostrRelay currentRecord) + { + currentRecord.Flags = newRecord.Flags; + currentRecord.Url = newRecord.Url; + currentRecord.UserId = newRecord.UserId; + + //Update times + newRecord.LastModified = DateTime.UtcNow; + } + + sealed record class DbQueries() : IDbQueryLookup<NostrRelay> + { + public IQueryable<NostrRelay> GetCollectionQueryBuilder(IDbContextHandle context, params string[] constraints) + { + string userId = constraints[0]; + + return from r in context.Set<NostrRelay>() + where r.UserId == userId + select r; + } + + public IQueryable<NostrRelay> GetSingleQueryBuilder(IDbContextHandle context, params string[] constraints) + { + string id = constraints[0]; + string userId = constraints[1]; + + //Get relay for the given user by its id + return from r in context.Set<NostrRelay>() + where r.Id == id && r.UserId == userId + select r; + } + } + } +} diff --git a/back-end/plugins/nvault/src/NVault.csproj b/back-end/plugins/nvault/src/NVault.csproj new file mode 100644 index 0000000..a507418 --- /dev/null +++ b/back-end/plugins/nvault/src/NVault.csproj @@ -0,0 +1,34 @@ +<Project Sdk="Microsoft.NET.Sdk"> + + <PropertyGroup> + <TargetFramework>net6.0</TargetFramework> + <Nullable>enable</Nullable> + <EnableDynamicLoading>true</EnableDynamicLoading> + <PackageReadmeFile>README.md</PackageReadmeFile> + <RootNamespace>NVault.Plugins.Vault</RootNamespace> + <AssemblyName>NVault</AssemblyName> + </PropertyGroup> + + <PropertyGroup> + <Authors>Vaughn Nugent</Authors> + <Company>Vaughn Nugent</Company> + <Product>Nvault</Product> + <Description>A VNLib.Plugins.Essentials framework plugin that provides a nostr vault backend called NVault</Description> + <Copyright>Copyright © 2023 Vaughn Nugent</Copyright> + <PackageProjectUrl>https://www.vaughnnugent.com/resources/software/modules/NVault</PackageProjectUrl> + <RepositoryUrl>https://github.com/VnUgE/NVault/tree/master/</RepositoryUrl> + </PropertyGroup> + + <ItemGroup> + <PackageReference Include="FluentValidation" Version="11.7.1" /> + <PackageReference Include="VNLib.Plugins.Extensions.Data" Version="0.1.0-ci0033" /> + <PackageReference Include="VNLib.Plugins.Extensions.Validation" Version="0.1.0-ci0033" /> + <PackageReference Include="VVNLib.Plugins.Extensions.Loading.Sql" Version="0.1.0-ci0033" /> + </ItemGroup> + + <ItemGroup> + <ProjectReference Include="..\..\..\libs\NVault.Crypto.Secp256k1\src\NVault.Crypto.Secp256k1.csproj" /> + <ProjectReference Include="..\..\..\libs\NVault.VaultExtensions\src\NVault.VaultExtensions.csproj" /> + </ItemGroup> + +</Project> diff --git a/back-end/plugins/nvault/src/NativeSecp256k1Library.cs b/back-end/plugins/nvault/src/NativeSecp256k1Library.cs new file mode 100644 index 0000000..67143fc --- /dev/null +++ b/back-end/plugins/nvault/src/NativeSecp256k1Library.cs @@ -0,0 +1,109 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; + +using NVault.Crypto.Secp256k1; + +using VNLib.Utils; + +namespace NVault.Plugins.Vault +{ + internal sealed class NativeSecp256k1Library : VnDisposeable, INostrCryptoProvider + { + private readonly LibSecp256k1 _lib; + + private NativeSecp256k1Library(LibSecp256k1 lib) + { + _lib = lib; + } + + /// <summary> + /// Loads the native library from the specified path + /// </summary> + /// <param name="libFilePath">The library path</param> + /// <param name="random">The optional random source</param> + /// <returns>The loaded <see cref="NativeSecp256k1Library"/></returns> + public static NativeSecp256k1Library LoadLibrary(string libFilePath, IRandomSource? random) + { + LibSecp256k1 lib = LibSecp256k1.LoadLibrary(libFilePath, System.Runtime.InteropServices.DllImportSearchPath.SafeDirectories, random); + return new(lib); + } + + //Key sizes are constant + ///<inheritdoc/> + public KeyBufferSizes GetKeyBufferSize() => new(LibSecp256k1.SecretKeySize, LibSecp256k1.XOnlyPublicKeySize); + + //Signature sizes are constant + ///<inheritdoc/> + public int GetSignatureBufferSize() => LibSecp256k1.SignatureSize; + + ///<inheritdoc/> + public bool RecoverPublicKey(ReadOnlySpan<byte> privateKey, Span<byte> pubKey) + { + Check(); + + //Init new context + using Secp256k1Context context = _lib.CreateContext(); + + //Randomize context + if (!context.Randomize()) + { + return false; + } + + //Recover public key from the privatkey + return context.GeneratePubKeyFromSecret(privateKey, pubKey) == LibSecp256k1.XOnlyPublicKeySize; + } + + ///<inheritdoc/> + public ERRNO SignMessage(ReadOnlySpan<byte> key, ReadOnlySpan<byte> digest, Span<byte> signatureBuffer) + { + Check(); + + //Init new context + using Secp256k1Context context = _lib.CreateContext(); + + //Randomize context + if (!context.Randomize()) + { + return false; + } + + //Sign the message + return context.SchnorSignDigest(key, digest, signatureBuffer); + } + + ///<inheritdoc/> + public bool TryGenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey) + { + //Trim buffers to the exact size required to avoid exceptions in the native lib + privateKey = privateKey[..LibSecp256k1.SecretKeySize]; + publicKey = publicKey[..LibSecp256k1.XOnlyPublicKeySize]; + + //Create the secret key + _lib.CreateSecretKey(privateKey); + + //Create the public key + return RecoverPublicKey(privateKey, publicKey); + } + + ///<inheritdoc/> + protected override void Free() + { + _lib.Dispose(); + } + } +}
\ No newline at end of file diff --git a/back-end/plugins/nvault/src/NostrEntry.cs b/back-end/plugins/nvault/src/NostrEntry.cs new file mode 100644 index 0000000..bdb78bb --- /dev/null +++ b/back-end/plugins/nvault/src/NostrEntry.cs @@ -0,0 +1,55 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; + +using VNLib.Utils.Logging; +using VNLib.Plugins; +using VNLib.Plugins.Extensions.Loading.Routing; +using VNLib.Plugins.Extensions.Loading; +using VNLib.Plugins.Extensions.Loading.Sql; + +using NVault.Plugins.Vault.Model; +using NVault.Plugins.Vault.Endpoints; + +namespace NVault.Plugins.Vault +{ + public sealed class NostrEntry : PluginBase + { + public override string PluginName { get; } = "NVault"; + + protected override void OnLoad() + { + //Load the endpoint + this.Route<Endpoint>(); + + //Create the database + _ = this.ObserveWork(() => this.EnsureDbCreatedAsync<NostrContext>(this), 1800); + + Log.Information("Plugin loaded"); + } + + protected override void OnUnLoad() + { + Log.Information("Plugin unloaded"); + + } + + protected override void ProcessHostCommand(string cmd) + { + throw new NotImplementedException(); + } + } +}
\ No newline at end of file diff --git a/back-end/plugins/nvault/src/NostrMessageKind.cs b/back-end/plugins/nvault/src/NostrMessageKind.cs new file mode 100644 index 0000000..2a53928 --- /dev/null +++ b/back-end/plugins/nvault/src/NostrMessageKind.cs @@ -0,0 +1,70 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +namespace NVault.Plugins.Vault +{ + internal enum NostrMessageKind + { + SetMetaData, + TextNote, + RecommendedServer, + Contacts, + EncryptedMessage, + EventDeletion, + Reposts, + Reaction, + BadgeAward, + + ChannelCreation = 40, + ChannelMetadata = 41, + ChannelMessage = 42, + ChannelHideMessage = 43, + ChannelMuteUser = 44, + + FileMetadata = 1063, + + Reporting = 1984, + + ZapRequest = 9734, + Zap = 9735, + + MuteList = 10000, + PinList = 10001, + RelayListMetadata = 10002, + + WalletInfo = 13194, + + ClientAuthenticate = 22242, + + WalletRequest = 23194, + WalletResponse = 23195, + + NostrConnect = 24133, + + CategorizedPeopleList = 30000, + CategorizedBookmarkList = 30001, + + ProfileBadges = 30008, + BadgeDefinition = 30009, + + CreateOrUpdateStall = 30017, + CreateOrUpdateAProduct = 30018, + + LongFormContent = 30023, + + ApplicationSpecificData = 30078, + + } +}
\ No newline at end of file diff --git a/back-end/plugins/nvault/src/NostrOpProvider.cs b/back-end/plugins/nvault/src/NostrOpProvider.cs new file mode 100644 index 0000000..0f6b1ed --- /dev/null +++ b/back-end/plugins/nvault/src/NostrOpProvider.cs @@ -0,0 +1,282 @@ +// Copyright (C) 2023 Vaughn Nugent +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as +// published by the Free Software Foundation, either version 3 of the +// License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see <https://www.gnu.org/licenses/>. + +using System; +using System.Threading; +using System.Text.Json; +using System.Threading.Tasks; +using System.Text.Encodings.Web; +using System.Security.Cryptography; + +using NVault.VaultExtensions; + +using VNLib.Hashing; +using VNLib.Utils; +using VNLib.Utils.IO; +using VNLib.Utils.Memory; +using VNLib.Utils.Extensions; +using VNLib.Plugins; +using VNLib.Plugins.Extensions.Loading; + +using NVault.Plugins.Vault.Model; + +namespace NVault.Plugins.Vault +{ + internal sealed class NostrOpProvider : INostrOperations + { + private static JavaScriptEncoder _encoder { get; } = GetJsEncoder(); + + readonly IKvVaultStore _vault; + readonly INostrKeyEncoder _keyEncoder; + readonly INostrCryptoProvider _cryptoProvider; + + public NostrOpProvider(PluginBase plugin) + { + //Use base64 key encoder + _keyEncoder = new Base64KeyEncoder(); + + //Setup crypto provider + _cryptoProvider = plugin.CreateService<ManagedCryptoprovider>(); + + //Get the vault + _vault = plugin.CreateService<ManagedVaultClient>(); + } + + ///<inheritdoc/> + public Task<bool> CreateCredentialAsync(VaultUserScope scope, NostrKeyMeta newKey, CancellationToken cancellation) + { + //Calculate the required buffer size + KeyBufferSizes bufSizes = _cryptoProvider.GetKeyBufferSize(); + + //Alloc the buffer + using IMemoryHandle<byte> buffHandle = MemoryUtil.SafeAllocNearestPage(bufSizes.PublicKeySize + bufSizes.PrivateKeySize, true); + + //Breakup buffers + Span<byte> privKey = buffHandle.Span[..bufSizes.PrivateKeySize]; + Span<byte> pubKey = buffHandle.Span[bufSizes.PrivateKeySize..]; + + //Generate the keypair + bool err = _cryptoProvider.TryGenerateKeyPair(pubKey, privKey); + + if (!err) + { + return Task.FromResult(false); + } + + //Trim the buffers + privKey = privKey[..bufSizes.PrivateKeySize]; + pubKey = pubKey[..bufSizes.PublicKeySize]; + + //Encode the private key + PrivateString? privateKey = (PrivateString?)_keyEncoder.EncodeKey(privKey); + + //Public key is hexadecimal (lowercase) + newKey.Value = Convert.ToHexString(pubKey).ToLower(); + + //Zero the buffers + MemoryUtil.InitializeBlock(buffHandle.Span); + + if (privateKey == null) + { + return Task.FromResult(false); + } + + //Store the keypair in the vault + return StorePivKeyAsync(scope, newKey, privateKey, cancellation); + } + + ///<inheritdoc/ + public Task<bool> CreateFromExistingAsync(VaultUserScope scope, NostrKeyMeta newKey, string hexKey, CancellationToken cancellation) + { + //Calculate the required buffer size + KeyBufferSizes bufSizes = _cryptoProvider.GetKeyBufferSize(); + + Span<byte> pubkeyBuffer = stackalloc byte[bufSizes.PublicKeySize]; + + //Recover the private key from the hex string + byte[] privKeyBuffer = Convert.FromHexString(hexKey); + + try + { + //Recover keypair from private key + if (!_cryptoProvider.RecoverPublicKey(privKeyBuffer, pubkeyBuffer)) + { + return Task.FromResult(false); + } + + //Encode the private key + PrivateString? privateKey = (PrivateString?)_keyEncoder.EncodeKey(privKeyBuffer); + + if (privateKey == null) + { + return Task.FromResult(false); + } + + //Public key is hexadecimal (lowercase) + newKey.Value = Convert.ToHexString(pubkeyBuffer).ToLower(); + + //Store the keypair in the vault + return StorePivKeyAsync(scope, newKey, privateKey, cancellation); + } + finally + { + //Always zero the private key buffer + MemoryUtil.InitializeBlock(privKeyBuffer.AsSpan()); + } + } + + private async Task<bool> StorePivKeyAsync(VaultUserScope scope, NostrKeyMeta meta, PrivateString key, CancellationToken cancellation) + { + //Store the key in the vault + await _vault.SetSecretAsync(scope, meta.Id, key, cancellation); + + //Erase the key + key.Erase(); + + return true; + } + + ///<inheritdoc/> + public Task DeleteCredentialAsync(VaultUserScope scope, NostrKeyMeta key, CancellationToken cancellation) => _vault.DeleteSecretAsync(scope, key.Id, cancellation); + + ///<inheritdoc/> + public async Task<bool> SignEventAsync(VaultUserScope scope, NostrKeyMeta keyMeta, NostrEvent evnt, CancellationToken cancellation) + { + //Get key data from the vault + PrivateString? secret = await _vault.GetSecretAsync(scope, keyMeta.Id, cancellation); + + return secret != null && SignMessage(secret, evnt); + } + + private bool SignMessage(PrivateString vaultKey, NostrEvent ev) + { + //Decode the key + int keyBufSize = _keyEncoder.GetKeyBufferSize(vaultKey); + + //Get the signature buffer size + int sigBufSize = _cryptoProvider.GetSignatureBufferSize(); + + //Alloc key buffer + using IMemoryHandle<byte> buffHandle = MemoryUtil.SafeAllocNearestPage(keyBufSize + sigBufSize, true); + + //Wrap the buffer + EvBuffer buffer = new(buffHandle, keyBufSize, sigBufSize, (int)HashAlg.SHA256); + + try + { + //Decode the key + ERRNO keySize = _keyEncoder.DecodeKey(vaultKey, buffer.KeyBuffer); + + if (!keySize) + { + return false; + } + + //Get the event id/event digest from the event + GetNostrEventId(ev, buffer.HashBuffer); + + //Store the event id + ev.Id = Convert.ToHexString(buffer.HashBuffer).ToLower(); + + //Sign the event + ERRNO sigSize = _cryptoProvider.SignMessage(buffer.KeyBuffer[..(int)keySize], buffer.HashBuffer, buffer.SigBuffer); + + if (!sigSize) + { + return false; + } + + //Store the signature as loewrcase hex + ev.Signature = Convert.ToHexString(buffer.SigBuffer[..(int)sigSize]).ToLower(); + return true; + } + finally + { + //Zero the key buffer and key + MemoryUtil.InitializeBlock(buffHandle.Span); + vaultKey.Erase(); + } + } + + private void GetNostrEventId(NostrEvent evnt, Span<byte> idHash) + { + + JsonWriterOptions options = new() + { + Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping, + Indented = false, + MaxDepth = 4 + }; + + using VnMemoryStream ms = new(); + using (Utf8JsonWriter writer = new(ms, options)) + { + //Start the array + writer.WriteStartArray(); + + //Write 0 to start the array + writer.WriteNumberValue(0); + + //We need the public key to be lower case + Span<char> lower = stackalloc char[evnt.PublicKey!.Length]; + evnt.PublicKey.AsSpan().ToLowerInvariant(lower); + + //Write public key, which is hex encoded + writer.WriteStringValue(lower); + + //Created-at time + writer.WriteNumberValue(evnt.Timestamp!.Value); + + //Kind (as number) + writer.WriteNumberValue((int)evnt.MessageKind!.Value); + + //tags (as array of strings) + JsonSerializer.Serialize(writer, evnt.Tags); + + //Content as a string + writer.WriteStringValue(evnt.Content); + + //End the array + writer.WriteEndArray(); + } + + string raw = System.Text.Encoding.UTF8.GetString(ms.AsSpan()); + + //Compute the hash + if (!ManagedHash.ComputeHash(ms.AsSpan(), idHash, HashAlg.SHA256)) + { + throw new CryptographicException("Failed to compute event data hash"); + } + } + + private static JavaScriptEncoder GetJsEncoder() + { + TextEncoderSettings s = new(); + + s.AllowCharacters('+'); + + return JavaScriptEncoder.Create(s); + } + + readonly record struct EvBuffer(IMemoryHandle<byte> Handle, int KeySize, int SigSize, int HashSize) + { + public readonly Span<byte> KeyBuffer => Handle.Span[..KeySize]; + + public readonly Span<byte> SigBuffer => Handle.AsSpan(KeySize, SigSize); + + public readonly Span<byte> HashBuffer => Handle.AsSpan(KeySize + SigSize, HashSize); + } + } +} |