Skip to content
This repository was archived by the owner on Jul 10, 2025. It is now read-only.

Add built-in service to sign data and verify signatures #110

Merged
merged 15 commits into from
Dec 10, 2021
Merged

Add built-in service to sign data and verify signatures #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
b49b045
Implement signing service
coder11 Dec 6, 2021
a9beeca
Add tests for signing service
coder11 Dec 6, 2021
f91062d
Handle negative cases
coder11 Dec 6, 2021
f4b4947
js-base64 to dev deps
coder11 Dec 6, 2021
164d38b
Update src/__test__/unit/builtInHandler.spec.ts
coder11 Dec 6, 2021
20ed85a
Checking peer id and tetraplets
coder11 Dec 7, 2021
cdaa840
Merge origin branch
coder11 Dec 7, 2021
f2d9f71
Fix trust graph and registry names
coder11 Dec 8, 2021
87a3471
Impove comments in builtin handler test
coder11 Dec 8, 2021
efc887c
rename security to signer
coder11 Dec 9, 2021
6cd28fa
finally rename signer to sig
coder11 Dec 9, 2021
ddd7f41
Additional unit tests for signing service
coder11 Dec 9, 2021
e0e0747
moar tests
coder11 Dec 9, 2021
e1f1448
unknownError => error
coder11 Dec 9, 2021
fa143fa
Merge branch 'master' into signing-service
coder11 Dec 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@
"@chainsafe/libp2p-noise": "4.0.0",
"@fluencelabs/avm": "^0.17.6",
"async": "3.2.0",
"base64-js": "1.5.1",
"bs58": "4.0.1",
"cids": "0.8.1",
"it-length-prefixed": "3.0.1",
Expand All @@ -44,6 +43,7 @@
"jest": "^26.6.3",
"ts-jest": "^26.5.4",
"typedoc": "^0.21.9",
"typescript": "^4.0.0"
"typescript": "^4.0.0",
"js-base64": "^3.7.2"
}
}
262 changes: 229 additions & 33 deletions src/__test__/unit/builtInHandler.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,41 +1,75 @@
import each from 'jest-each';
import { CallServiceData } from '../../internal/commonTypes';
import { defaultServices } from '../../internal/defaultServices';

describe('Tests for default handler', () => {
// prettier-ignore
each`
serviceId | fnName | args | retCode | result
${'op'} | ${'identity'} | ${[]} | ${0} | ${{}}
${'op'} | ${'identity'} | ${[1]} | ${0} | ${1}
${'op'} | ${'identity'} | ${[1, 2]} | ${1} | ${'identity accepts up to 1 arguments, received 2 arguments'}

${'op'} | ${'noop'} | ${[1, 2]} | ${0} | ${{}}

${'op'} | ${'array'} | ${[1, 2, 3]} | ${0} | ${[1, 2, 3]}
import each from 'jest-each';
import { BuiltInServiceContext, builtInServices } from '../../internal/builtInServices';
import { KeyPair } from '../../internal/KeyPair';
import { toUint8Array } from 'js-base64';

${'op'} | ${'concat'} | ${[[1, 2], [3, 4], [5, 6]]} | ${0} | ${[1, 2, 3, 4, 5, 6]}
${'op'} | ${'concat'} | ${[[1, 2]]} | ${0} | ${[1, 2]}
${'op'} | ${'concat'} | ${[]} | ${0} | ${[]}
${'op'} | ${'concat'} | ${[1, [1, 2], 1]} | ${1} | ${"All arguments of 'concat' must be arrays: arguments 0, 2 are not"}
const key = '+cmeYlZKj+MfSa9dpHV+BmLPm6wq4inGlsPlQ1GvtPk=';

${'op'} | ${'string_to_b58'} | ${["test"]} | ${0} | ${"3yZe7d"}
${'op'} | ${'string_to_b58'} | ${["test", 1]} | ${1} | ${"string_to_b58 accepts only one string argument"}
const context = (async () => {
const keyBytes = toUint8Array(key);
const kp = await KeyPair.fromEd25519SK(keyBytes);
const res: BuiltInServiceContext = {
peerKeyPair: kp,
peerId: kp.Libp2pPeerId.toB58String(),
};
return res;
})();

${'op'} | ${'string_from_b58'} | ${["3yZe7d"]} | ${0} | ${"test"}
${'op'} | ${'string_from_b58'} | ${["3yZe7d", 1]} | ${1} | ${"string_from_b58 accepts only one string argument"}
const testData = [1, 2, 3, 4, 5, 6, 7, 9, 10];

${'op'} | ${'bytes_to_b58'} | ${[[116, 101, 115, 116]]} | ${0} | ${"3yZe7d"}
${'op'} | ${'bytes_to_b58'} | ${[[116, 101, 115, 116], 1]} | ${1} | ${"bytes_to_b58 accepts only single argument: array of numbers"}
// signature produced by KeyPair created from key above (`key` variable)
const testDataSig = [
224, 104, 245, 206, 140, 248, 27, 72, 68, 133, 111, 10, 164, 197, 242, 132, 107, 77, 224, 67, 99, 106, 76, 29, 144,
121, 122, 169, 36, 173, 58, 80, 170, 102, 137, 253, 157, 247, 168, 87, 162, 223, 188, 214, 203, 220, 52, 246, 29,
86, 77, 71, 224, 248, 16, 213, 254, 75, 78, 239, 243, 222, 241, 15,
];

${'op'} | ${'bytes_from_b58'} | ${["3yZe7d"]} | ${0} | ${[116, 101, 115, 116]}
${'op'} | ${'bytes_from_b58'} | ${["3yZe7d", 1]} | ${1} | ${"bytes_from_b58 accepts only one string argument"}
// signature produced by KeyPair created from some random KeyPair
const testDataWrongSig = [
116, 247, 189, 118, 236, 53, 147, 123, 219, 75, 176, 105, 101, 108, 233, 137, 97, 14, 146, 132, 252, 70, 51, 153,
237, 167, 156, 150, 36, 90, 229, 108, 166, 231, 255, 137, 8, 246, 125, 0, 213, 150, 83, 196, 237, 221, 131, 159,
157, 159, 25, 109, 95, 160, 181, 65, 254, 238, 47, 156, 240, 151, 58, 14,
];

${'peer'} | ${'timeout'} | ${[200, []]} | ${0} | ${[]}}
${'peer'} | ${'timeout'} | ${[200, ['test']]} | ${0} | ${['test']}}
${'peer'} | ${'timeout'} | ${[]} | ${1} | ${'timeout accepts exactly two arguments: timeout duration in ms and a message string'}}
${'peer'} | ${'timeout'} | ${[200, 'test', 1]} | ${1} | ${'timeout accepts exactly two arguments: timeout duration in ms and a message string'}}

describe('Tests for default handler', () => {
// prettier-ignore
each`
serviceId | fnName | args | retCode | result
${'op'} | ${'identity'} | ${[]} | ${0} | ${{}}
${'op'} | ${'identity'} | ${[1]} | ${0} | ${1}
${'op'} | ${'identity'} | ${[1, 2]} | ${1} | ${'identity accepts up to 1 arguments, received 2 arguments'}

${'op'} | ${'noop'} | ${[1, 2]} | ${0} | ${{}}

${'op'} | ${'array'} | ${[1, 2, 3]} | ${0} | ${[1, 2, 3]}

${'op'} | ${'concat'} | ${[[1, 2], [3, 4], [5, 6]]} | ${0} | ${[1, 2, 3, 4, 5, 6]}
${'op'} | ${'concat'} | ${[[1, 2]]} | ${0} | ${[1, 2]}
${'op'} | ${'concat'} | ${[]} | ${0} | ${[]}
${'op'} | ${'concat'} | ${[1, [1, 2], 1]} | ${1} | ${"All arguments of 'concat' must be arrays: arguments 0, 2 are not"}

${'op'} | ${'string_to_b58'} | ${["test"]} | ${0} | ${"3yZe7d"}
${'op'} | ${'string_to_b58'} | ${["test", 1]} | ${1} | ${"string_to_b58 accepts only one string argument"}

${'op'} | ${'string_from_b58'} | ${["3yZe7d"]} | ${0} | ${"test"}
${'op'} | ${'string_from_b58'} | ${["3yZe7d", 1]} | ${1} | ${"string_from_b58 accepts only one string argument"}

${'op'} | ${'bytes_to_b58'} | ${[[116, 101, 115, 116]]} | ${0} | ${"3yZe7d"}
${'op'} | ${'bytes_to_b58'} | ${[[116, 101, 115, 116], 1]} | ${1} | ${"bytes_to_b58 accepts only single argument: array of numbers"}

${'op'} | ${'bytes_from_b58'} | ${["3yZe7d"]} | ${0} | ${[116, 101, 115, 116]}
${'op'} | ${'bytes_from_b58'} | ${["3yZe7d", 1]} | ${1} | ${"bytes_from_b58 accepts only one string argument"}

${'peer'} | ${'timeout'} | ${[200, []]} | ${0} | ${[]}}
${'peer'} | ${'timeout'} | ${[200, ['test']]} | ${0} | ${['test']}}
${'peer'} | ${'timeout'} | ${[]} | ${1} | ${'timeout accepts exactly two arguments: timeout duration in ms and a message string'}}
${'peer'} | ${'timeout'} | ${[200, 'test', 1]} | ${1} | ${'timeout accepts exactly two arguments: timeout duration in ms and a message string'}}

${'sig'} | ${'verify'} | ${[testData, testDataSig]} | ${0} | ${true}}
${'sig'} | ${'verify'} | ${[testData, testDataWrongSig]} | ${0} | ${false}}
${'sig'} | ${'sign'} | ${[]} | ${1} | ${'sign accepts exactly one argument: data be signed in format of u8 array of bytes'}}
${'sig'} | ${'verify'} | ${[testData]} | ${1} | ${'verify accepts exactly two arguments: data and signature, both in format of u8 array of bytes'}}
`.test(
//
'$fnName with $args expected retcode: $retCode and result: $result',
Expand All @@ -56,7 +90,7 @@ describe('Tests for default handler', () => {
};

// act
const fn = defaultServices[req.serviceId][req.fnName];
const fn = builtInServices(await context)[req.serviceId][req.fnName];
const res = await fn(req);

// assert
Expand Down Expand Up @@ -84,7 +118,7 @@ describe('Tests for default handler', () => {
};

// act
const fn = defaultServices[req.serviceId][req.fnName];
const fn = builtInServices(await context)[req.serviceId][req.fnName];
const res = await fn(req);

// assert
Expand All @@ -93,4 +127,166 @@ describe('Tests for default handler', () => {
result: 'The JS implementation of Peer does not support identify',
});
});

it('sig.sign should create the correct signature', async () => {
// arrange
const ctx = await context;
const req: CallServiceData = {
serviceId: 'sig',
fnName: 'sign',
args: [testData],
tetraplets: [
[
{
function_name: 'get_trust_bytes',
json_path: '',
peer_pk: '',
service_id: 'trust-graph',
},
],
],
particleContext: {
particleId: 'some',
initPeerId: ctx.peerId,
timestamp: 595951200,
ttl: 595961200,
signature: 'sig',
},
};

// act
const fn = builtInServices(ctx)[req.serviceId][req.fnName];
const res = await fn(req);

// assert
expect(res).toMatchObject({
retCode: 0,
result: testDataSig,
});
});

it('sign-verify call chain should work', async () => {
const ctx = await context;
const signReq: CallServiceData = {
serviceId: 'sig',
fnName: 'sign',
args: [testData],
tetraplets: [
[
{
function_name: 'get_trust_bytes',
json_path: '',
peer_pk: '',
service_id: 'trust-graph',
},
],
],
particleContext: {
particleId: 'some',
initPeerId: ctx.peerId,
timestamp: 595951200,
ttl: 595961200,
signature: 'sig',
},
};

const signFn = builtInServices(ctx)[signReq.serviceId][signReq.fnName];
const signRes = await signFn(signReq);

const verifyReq: CallServiceData = {
serviceId: 'sig',
fnName: 'verify',
args: [testData, signRes.result],
tetraplets: [],
particleContext: {
particleId: 'some',
initPeerId: ctx.peerId,
timestamp: 595951200,
ttl: 595961200,
signature: 'sig',
},
};

const verifyFn = builtInServices(ctx)[verifyReq.serviceId][verifyReq.fnName];
const verifyRes = await verifyFn(verifyReq);

expect(verifyRes).toMatchObject({
retCode: 0,
result: true,
});
});

it('sig.sign should not allow data from incorrect services', async () => {
// arrange
const ctx = await context;
const req: CallServiceData = {
serviceId: 'sig',
fnName: 'sign',
args: [testData],
tetraplets: [
[
{
function_name: 'some-other-fn',
json_path: '',
peer_pk: '',
service_id: 'cool-service',
},
],
],
particleContext: {
particleId: 'some',
initPeerId: ctx.peerId,
timestamp: 595951200,
ttl: 595961200,
signature: 'sig',
},
};

// act
const fn = builtInServices(ctx)[req.serviceId][req.fnName];
const res = await fn(req);

// assert
expect(res).toMatchObject({
retCode: 1,
result: expect.stringContaining("Only data from the following services is allowed to be signed:"),
});
});

it('sig.sign should not allow particles initiated from other peers', async () => {
// arrange
const ctx = await context;
const req: CallServiceData = {
serviceId: 'sig',
fnName: 'sign',
args: [testData],
tetraplets: [
[
{
function_name: 'some-other-fn',
json_path: '',
peer_pk: '',
service_id: 'cool-service',
},
],
],
particleContext: {
particleId: 'some',
initPeerId: (await KeyPair.randomEd25519()).Libp2pPeerId.toB58String(),
timestamp: 595951200,
ttl: 595961200,
signature: 'sig',
},
};

// act
const fn = builtInServices(ctx)[req.serviceId][req.fnName];
const res = await fn(req);

// assert
expect(res).toMatchObject({
retCode: 1,
result: 'sign is only allowed to be called on the same peer the particle was initiated from',
});
});
});
Loading