Support Wallet Login & Lock/Unlock

[llorllale]

hub-auth resources

View

resource	type	sensitive?	served?	usage
key server URLs	list of URLs	no	yes	edge-agent Vue.js sets up key stores, then initializes wallet
sds server URLs	list of URLs	no	yes	edge-agent Vue.js sets up vaults, then initializes wallet
keyStoreIDs	list of IDs	yes	yes	edge-agent aries-framework-go KMS
SDS vault IDs	list of IDs	yes	yes	edge-agent aries-framework-go storage
user devices info	list of tuples {AAGUID publicKey, x509_cert}	yes	no	when unlocking: validate if device is registered and to which user before giving access to bootstrap resources (primary key is wiped from devices when locked, needs to be fetched from network)
locations of user primary key shares	list of SDS locations of the user's primary key shares (split w/SSS)	yes	yes	a) when unlocking: edge-agent Vue.js needs location + authZ to fetch those shares; b) key server needs locations + authZ to fetch those shares to unlock the user's key store and do crypto operations
authorized wallet callback URIs	list of URIs	no	no	configuration: helps restrict processing of authZ requests to authorized wallets

Breakdown

View

• hub-auth
  • /login endpoint hydra login handler #50
    • serve page with OIDC provider options
    • invokes /oauth2/request endpoint and redirects
  • handleOIDCCallback() should accept login request at hydra and redirect back to hydra
  • /consent endpoint
    • accept consent request at hydra and redirect back to hydra
  • BDD Tests with Hydra BDD tests with Hydra #52
  • setup Hydra
  • BDD Tests
  • GET /bootstrap
    • protect with access_token
    • introspect at Hydra - use sub to locate the user's bootstrap data
  • PUT /bootstrap
    • protect with access_token
    • updates user's bootstrap data
  • configure allowed user devices
    • TODO collection of tuples: {AAGUID, x509_cert} ?
  • POST /device
    • protect with access_token
    • TODO model: {AAGUID, x509_cert} ?
    • validate: AAGUID/x509_cert are allowed
• session expiry
  • expiry of access_tokens Expiration on access_tokens #55

[llorllale]

This was completed.