MarketTakers/arbiter
6
0
Fork 0
Code Issues 14 Pull Requests 4 Packages Projects Releases Wiki Activity

Compare commits

base: MarketTakers:feat-auto-fix-lints
Branches Tags
MarketTakers:main MarketTakers:terminate-VaultGate-connection-after-vault-lockout MarketTakers:hashable-integrable-macro MarketTakers:zeroized-bootstrap-token MarketTakers:push-zvwxtnqkumlx MarketTakers:feat-auto-fix-lints MarketTakers:feat-shamir MarketTakers:enforcing-integrity MarketTakers:push-wxnlsulvnrpz MarketTakers:check-uac-cerf MarketTakers:impl-useragent_delete_grant MarketTakers:Client-key-replacement-attack MarketTakers:critical-fix-CI-check-all-features MarketTakers:win-service MarketTakers:fix-proto-build-script MarketTakers:terrors-refactor MarketTakers:PoC-terrors MarketTakers:push-lspnytwuyulm MarketTakers:key-alternative MarketTakers:push-yyxvkwvyspxv MarketTakers:security-breaktrougth
..
compare: MarketTakers:hashable-integrable-macro
Branches Tags
MarketTakers:terminate-VaultGate-connection-after-vault-lockout MarketTakers:hashable-integrable-macro MarketTakers:main MarketTakers:zeroized-bootstrap-token MarketTakers:push-zvwxtnqkumlx MarketTakers:feat-auto-fix-lints MarketTakers:feat-shamir MarketTakers:enforcing-integrity MarketTakers:push-wxnlsulvnrpz MarketTakers:check-uac-cerf MarketTakers:impl-useragent_delete_grant MarketTakers:Client-key-replacement-attack MarketTakers:critical-fix-CI-check-all-features MarketTakers:win-service MarketTakers:fix-proto-build-script MarketTakers:terrors-refactor MarketTakers:PoC-terrors MarketTakers:push-lspnytwuyulm MarketTakers:key-alternative MarketTakers:push-yyxvkwvyspxv MarketTakers:security-breaktrougth

4 Commits
feat-auto- ... hashable-i

Author SHA1 Message Date
CleverWild
0779d0db13 feat(macros): enhance Integrable derive with validation and versioning improvements
Some checks failed
ci/woodpecker/pr/server-audit Pipeline failed
Details
ci/woodpecker/pr/server-vet Pipeline failed
Details
ci/woodpecker/pr/server-lint Pipeline was successful
Details
ci/woodpecker/pr/server-test Pipeline was successful
Details
2026-06-30 19:55:28 +02:00
CleverWild
11a2d8c8f3 refactor(integrity): migrate impl Integrable to #[derive(Integrable)] 2026-06-29 16:58:36 +02:00
CleverWild
d861ff80be feat(macros): add #[derive(Integrable)] proc-macro 2026-06-29 16:58:35 +02:00
CleverWild
647f0c8519 refactor(crypto): move Integrable trait to arbiter-crypto 2026-06-29 16:58:35 +02:00
439 changed files with 79492 additions and 79190 deletions
Expand all files Collapse all files

22
.claude/memory/feedback_widget_decomposition.md
View File

@@ -1,11 +1,11 @@
--- ---
name: Widget decomposition and provider subscriptions name: Widget decomposition and provider subscriptions
description: Prefer splitting screens into multiple focused files/widgets; each widget subscribes to its own relevant providers description: Prefer splitting screens into multiple focused files/widgets; each widget subscribes to its own relevant providers
type: feedback type: feedback
--- ---
Split screens into multiple smaller widgets across multiple files. Each widget should subscribe only to the providers it needs (`ref.watch` at lowest possible level), rather than having one large screen widget that watches everything and passes data down as parameters. Split screens into multiple smaller widgets across multiple files. Each widget should subscribe only to the providers it needs (`ref.watch` at lowest possible level), rather than having one large screen widget that watches everything and passes data down as parameters.
**Why:** Reduces unnecessary rebuilds; improves readability; each file has one clear responsibility. **Why:** Reduces unnecessary rebuilds; improves readability; each file has one clear responsibility.
**How to apply:** When building a new screen, identify which sub-widgets need their own provider subscriptions and extract them into separate files (e.g., `widgets/grant_card.dart` watches enrichment providers itself, rather than the screen doing it and passing resolved strings down). **How to apply:** When building a new screen, identify which sub-widgets need their own provider subscriptions and extract them into separate files (e.g., `widgets/grant_card.dart` watches enrichment providers itself, rather than the screen doing it and passing resolved strings down).

12
.gitignore vendored
View File

@@ -1,6 +1,6 @@
target/ target/
scripts/__pycache__/ scripts/__pycache__/
.DS_Store .DS_Store
.cargo/config.toml .cargo/config.toml
.vscode/ .vscode/
docs/superpowers docs/superpowers

50
.woodpecker/server-audit.yaml
View File

@@ -1,26 +1,26 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: audit - name: audit
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
# Install only the necessary Rust toolchain and test runner to speed up the CI # Install only the necessary Rust toolchain and test runner to speed up the CI
- mise install rust - mise install rust
- mise install cargo:cargo-audit - mise install cargo:cargo-audit
- mise exec cargo:cargo-audit -- cargo audit - mise exec cargo:cargo-audit -- cargo audit

45
.woodpecker/server-clippy-fix.yaml
View File

@@ -1,45 +0,0 @@
when:
- event: push
branch: main
path:
include: ['.woodpecker/server-*.yaml', 'server/**']
steps:
- name: clippy-fix
image: jdxcode/mise:latest
directory: server
environment:
CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry
GITEA_TOKEN:
from_secret: GITEA_TOKEN
GITEA_URL:
from_secret: GITEA_URL
volumes:
- cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry
commands:
- apt-get update && apt-get install -y pkg-config curl
- mise install rust
- mise install protoc
- mise exec rust -- cargo clippy --fix --allow-dirty --all
- |
cd ..
if git diff --quiet HEAD; then
echo "No machine-applicable clippy fixes found, nothing to do."
exit 0
fi
git config user.email "bot@arbiter"
git config user.name "Clippy Bot"
git add -A
git commit -m "fix(clippy): apply auto-fixable linting suggestions"
git config http.extraHeader "Authorization: token ${GITEA_TOKEN}"
git push --force origin HEAD:refs/heads/bot/clippy-fixes
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-X POST "${GITEA_URL}/api/v1/repos/${CI_REPO}/pulls" \
-H "Authorization: token ${GITEA_TOKEN}" \
-H "Content-Type: application/json" \
-d "{\"title\":\"fix(clippy): apply auto-fixable linting suggestions\",\"head\":\"bot/clippy-fixes\",\"base\":\"main\",\"body\":\"Automated clippy fixes generated by CI bot.\"}")
echo "Gitea API response: ${HTTP_STATUS}"
[ "$HTTP_STATUS" = "201" ] || [ "$HTTP_STATUS" = "409" ] || [ "$HTTP_STATUS" = "422" ] || exit 1

48
.woodpecker/server-lint.yaml
View File

@@ -1,25 +1,25 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: lint - name: lint
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
- mise install rust - mise install rust
- mise install protoc - mise install protoc
- mise exec rust -- cargo clippy --all -- -D warnings - mise exec rust -- cargo clippy --all -- -D warnings

52
.woodpecker/server-test.yaml
View File

@@ -1,27 +1,27 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: test - name: test
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
# Install only the necessary Rust toolchain and test runner to speed up the CI # Install only the necessary Rust toolchain and test runner to speed up the CI
- mise install rust - mise install rust
- mise install protoc - mise install protoc
- mise install cargo:cargo-nextest - mise install cargo:cargo-nextest
- mise exec cargo:cargo-nextest -- cargo nextest run --no-fail-fast --all-features - mise exec cargo:cargo-nextest -- cargo nextest run --no-fail-fast --all-features

50
.woodpecker/server-vet.yaml
View File

@@ -1,26 +1,26 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/server-*.yaml', 'server/**'] include: ['.woodpecker/server-*.yaml', 'server/**']
steps: steps:
- name: vet - name: vet
image: jdxcode/mise:latest image: jdxcode/mise:latest
directory: server directory: server
environment: environment:
CARGO_TERM_COLOR: always CARGO_TERM_COLOR: always
CARGO_TARGET_DIR: /usr/local/cargo/target CARGO_TARGET_DIR: /usr/local/cargo/target
CARGO_HOME: /usr/local/cargo/registry CARGO_HOME: /usr/local/cargo/registry
volumes: volumes:
- cargo-target:/usr/local/cargo/target - cargo-target:/usr/local/cargo/target
- cargo-registry:/usr/local/cargo/registry - cargo-registry:/usr/local/cargo/registry
commands: commands:
- apt-get update && apt-get install -y pkg-config - apt-get update && apt-get install -y pkg-config
# Install only the necessary Rust toolchain and test runner to speed up the CI # Install only the necessary Rust toolchain and test runner to speed up the CI
- mise install rust - mise install rust
- mise install cargo:cargo-vet - mise install cargo:cargo-vet
- mise exec cargo:cargo-vet -- cargo vet - mise exec cargo:cargo-vet -- cargo vet

34
.woodpecker/useragent-analyze.yaml
View File

@@ -1,18 +1,18 @@
when: when:
- event: pull_request - event: pull_request
path: path:
include: ['.woodpecker/useragent-*.yaml', 'useragent/**'] include: ['.woodpecker/useragent-*.yaml', 'useragent/**']
- event: push - event: push
branch: main branch: main
path: path:
include: ['.woodpecker/useragent-*.yaml', 'useragent/**'] include: ['.woodpecker/useragent-*.yaml', 'useragent/**']
steps: steps:
- name: analyze - name: analyze
image: jdxcode/mise:latest image: jdxcode/mise:latest
commands: commands:
- mise install flutter - mise install flutter
- mise install protoc - mise install protoc
# Reruns codegen to catch protocol drift # Reruns codegen to catch protocol drift
- mise codegen - mise codegen
- cd useragent/ && flutter analyze - cd useragent/ && flutter analyze

298
AGENTS.md
View File

@@ -1,149 +1,149 @@
# AGENTS.md # AGENTS.md
This file provides guidance to Codex (Codex.ai/code) when working with code in this repository. This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
## Project Overview ## Project Overview
Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of: Arbiter is a **permissioned signing service** for cryptocurrency wallets. It consists of:
- **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies - **`server/`** — Rust gRPC daemon that holds encrypted keys and enforces policies
- **`operator/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf - **`operator/`** — Flutter desktop app (macOS/Windows) with a Rust backend via Rinf
- **`protobufs/`** — Protocol Buffer definitions shared between server and client - **`protobufs/`** — Protocol Buffer definitions shared between server and client
The vault never exposes key material; it only produces signatures when requests satisfy configured policies. The vault never exposes key material; it only produces signatures when requests satisfy configured policies.
## Toolchain Setup ## Toolchain Setup
Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools: Tools are managed via [mise](https://mise.jdx.dev/). Install all required tools:
```sh ```sh
mise install mise install
``` ```
Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite). Key versions: Rust 1.93.0 (with clippy), Flutter 3.38.9-stable, protoc 29.6, diesel_cli 2.3.6 (sqlite).
## Server (Rust workspace at `server/`) ## Server (Rust workspace at `server/`)
### Crates ### Crates
| Crate | Purpose | | Crate | Purpose |
|---|---| |---|---|
| `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` | | `arbiter-proto` | Generated gRPC stubs + protobuf types; compiled from `protobufs/*.proto` via `tonic-prost-build` |
| `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation | | `arbiter-server` | Main daemon — actors, DB, EVM policy engine, gRPC service implementation |
| `arbiter-operator` | Rust client library for the operator side of the gRPC protocol | | `arbiter-operator` | Rust client library for the operator side of the gRPC protocol |
| `arbiter-client` | Rust client library for SDK clients | | `arbiter-client` | Rust client library for SDK clients |
### Common Commands ### Common Commands
```sh ```sh
cd server cd server
# Build # Build
cargo build cargo build
# Run the server daemon # Run the server daemon
cargo run -p arbiter-server cargo run -p arbiter-server
# Run all tests (preferred over cargo test) # Run all tests (preferred over cargo test)
cargo nextest run cargo nextest run
# Run a single test # Run a single test
cargo nextest run <test_name> cargo nextest run <test_name>
# Lint # Lint
cargo clippy cargo clippy
# Security audit # Security audit
cargo audit cargo audit
# Check unused dependencies # Check unused dependencies
cargo shear cargo shear
# Run snapshot tests and update snapshots # Run snapshot tests and update snapshots
cargo insta review cargo insta review
``` ```
### Architecture ### Architecture
The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`: The server is actor-based using the **kameo** crate. All long-lived state lives in `GlobalActors`:
- **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run. - **`Bootstrapper`** — Manages the one-time bootstrap token written to `~/.arbiter/bootstrap_token` on first run.
- **`Vault`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell. - **`Vault`** — Holds the encrypted root key and manages the Sealed/Unsealed vault state machine. On unseal, decrypts the root key into a `memsafe` hardened memory cell.
- **`FlowCoordinator`** — Coordinates cross-connection flow between operators and SDK clients. - **`FlowCoordinator`** — Coordinates cross-connection flow between operators and SDK clients.
- **`EvmActor`** — Handles EVM transaction policy enforcement and signing. - **`EvmActor`** — Handles EVM transaction policy enforcement and signing.
Per-connection actors live under `actors/operator/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules. Per-connection actors live under `actors/operator/` and `actors/client/`, each with `auth` (challenge-response authentication) and `session` (post-auth operations) sub-modules.
**Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`. **Database:** SQLite via `diesel-async` + `bb8` connection pool. Schema managed by embedded Diesel migrations in `crates/arbiter-server/migrations/`. DB file lives at `~/.arbiter/arbiter.sqlite`. Tests use a temp-file DB via `db::create_test_pool()`.
**Cryptography:** **Cryptography:**
- Authentication: ed25519 (challenge-response, nonce-tracked per peer) - Authentication: ed25519 (challenge-response, nonce-tracked per peer)
- Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal) - Encryption at rest: XChaCha20-Poly1305 (versioned via `scheme` field for transparent migration on unseal)
- Password KDF: Argon2 - Password KDF: Argon2
- Unseal transport: X25519 ephemeral key exchange - Unseal transport: X25519 ephemeral key exchange
- TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl` - TLS: self-signed certificate (aws-lc-rs backend), fingerprint distributed via `ArbiterUrl`
**Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run). **Protocol:** gRPC with Protocol Buffers. The `ArbiterUrl` type encodes host, port, CA cert, and bootstrap token into a single shareable string (printed to console on first run).
### Proto Regeneration ### Proto Regeneration
When `.proto` files in `protobufs/` change, rebuild to regenerate: When `.proto` files in `protobufs/` change, rebuild to regenerate:
```sh ```sh
cd server && cargo build -p arbiter-proto cd server && cargo build -p arbiter-proto
``` ```
### Database Migrations ### Database Migrations
```sh ```sh
# Create a new migration # Create a new migration
diesel migration generate <name> --migration-dir crates/arbiter-server/migrations diesel migration generate <name> --migration-dir crates/arbiter-server/migrations
# Run migrations manually (server also runs them on startup) # Run migrations manually (server also runs them on startup)
diesel migration run --migration-dir crates/arbiter-server/migrations diesel migration run --migration-dir crates/arbiter-server/migrations
``` ```
### Code Conventions ### Code Conventions
**`#[must_use]` Attribute:** **`#[must_use]` Attribute:**
Apply the `#[must_use]` attribute to return types of functions where the return value is critical and should not be accidentally ignored. This is commonly used for: Apply the `#[must_use]` attribute to return types of functions where the return value is critical and should not be accidentally ignored. This is commonly used for:
- Methods that return `bool` indicating success/failure or validation state - Methods that return `bool` indicating success/failure or validation state
- Any function where ignoring the return value indicates a logic error - Any function where ignoring the return value indicates a logic error
Do not apply `#[must_use]` redundantly to items (types or functions) that are already annotated with `#[must_use]`. Do not apply `#[must_use]` redundantly to items (types or functions) that are already annotated with `#[must_use]`.
Example: Example:
```rust ```rust
#[must_use] #[must_use]
pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool { pub fn verify(&self, nonce: i32, context: &[u8], signature: &Signature) -> bool {
// verification logic // verification logic
} }
``` ```
This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures. This forces callers to either use the return value or explicitly ignore it with `let _ = ...;`, preventing silent failures.
## Operator (Flutter + Rinf at `operator/`) ## Operator (Flutter + Rinf at `operator/`)
The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `operator/native/hub/` as a separate crate that uses `arbiter-operator` for the gRPC client. The Flutter app uses [Rinf](https://rinf.cunarist.org) to call Rust code. The Rust logic lives in `operator/native/hub/` as a separate crate that uses `arbiter-operator` for the gRPC client.
Communication between Dart and Rust uses typed **signals** defined in `operator/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings: Communication between Dart and Rust uses typed **signals** defined in `operator/native/hub/src/signals/`. After modifying signal structs, regenerate Dart bindings:
```sh ```sh
cd operator && rinf gen cd operator && rinf gen
``` ```
### Common Commands ### Common Commands
```sh ```sh
cd operator cd operator
# Run the app (macOS or Windows) # Run the app (macOS or Windows)
flutter run flutter run
# Regenerate Rust↔Dart signal bindings # Regenerate Rust↔Dart signal bindings
rinf gen rinf gen
# Analyze Dart code # Analyze Dart code
flutter analyze flutter analyze
``` ```
The Rinf Rust entry point is `operator/native/hub/src/lib.rs`. It spawns actors defined in `operator/native/hub/src/actors/` which handle Dart↔server communication via signals. The Rinf Rust entry point is `operator/native/hub/src/lib.rs`. It spawns actors defined in `operator/native/hub/src/actors/` which handle Dart↔server communication via signals.

2
CLAUDE.md
View File

@@ -1 +1 @@
Refer to @AGENTS.md for instructions. Refer to @AGENTS.md for instructions.

380
LICENSE
View File

@@ -1,190 +1,190 @@
Apache License Apache License
Version 2.0, January 2004 Version 2.0, January 2004
http://www.apache.org/licenses/ http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions. 1. Definitions.
"License" shall mean the terms and conditions for use, reproduction, "License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document. and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by "Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License. the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all "Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition, control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the "control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity. outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity "You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License. exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications, "Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation including but not limited to software source code, documentation
source, and configuration files. source, and configuration files.
"Object" form shall mean any form resulting from mechanical "Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation, not limited to compiled object code, generated documentation,
and conversions to other media types. and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or "Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work copyright notice that is included in or attached to the work
(an example is provided in the Appendix below). (an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object "Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of, separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof. the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including "Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted" the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems, communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution." designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity "Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work. subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of 2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual, this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of, copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form. Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of 3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual, this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made, (except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work, use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s) Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate granted to You under this License for that Work shall terminate
as of the date such litigation is filed. as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the 4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You modifications, and in Source or Object form, provided that You
meet the following conditions: meet the following conditions:
(a) You must give any other recipients of the Work or (a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices (b) You must cause any modified files to carry prominent notices
stating that You changed the files; and stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works (c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work, attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of excluding those notices that do not pertain to any part of
the Derivative Works; and the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its (d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or, documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed that such additional attribution notices cannot be construed
as modifying the License. as modifying the License.
You may add Your own copyright statement to Your modifications and You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use, for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License. the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise, 5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions. this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions. with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade 6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor, names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file. origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or 7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS, Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License. risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory, 8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise, whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special, liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill, Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages. has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing 9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer, the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity, and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify, of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability. of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS END OF TERMS AND CONDITIONS
Copyright 2026 MarketTakers Copyright 2026 MarketTakers
Licensed under the Apache License, Version 2.0 (the "License"); Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0 http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS, distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and See the License for the specific language governing permissions and
limitations under the License. limitations under the License.

24
README.md
View File

@@ -1,13 +1,13 @@
# Arbiter # Arbiter
> Policy-first multi-client wallet daemon, allowing permissioned transactions across blockchains > Policy-first multi-client wallet daemon, allowing permissioned transactions across blockchains
## Security warning ## Security warning
Arbiter can't meaningfully protect against host compromise. Potential attack flow: Arbiter can't meaningfully protect against host compromise. Potential attack flow:
- Attacker steals TLS keys from database - Attacker steals TLS keys from database
- Pretends to be server; just accepts operator challenge solutions - Pretends to be server; just accepts operator challenge solutions
- Pretend to be in sealed state and performing DH with client - Pretend to be in sealed state and performing DH with client
- Steals user password and derives seal key - Steals user password and derives seal key
While this attack is highly targetive, it's still possible. While this attack is highly targetive, it's still possible.
> This software is experimental. Do not use with funds you cannot afford to lose. > This software is experimental. Do not use with funds you cannot afford to lose.

62
app/.dart_tool/extension_discovery/README.md
View File

@@ -1,31 +1,31 @@
Extension Discovery Cache Extension Discovery Cache
========================= =========================
This folder is used by `package:extension_discovery` to cache lists of This folder is used by `package:extension_discovery` to cache lists of
packages that contains extensions for other packages. packages that contains extensions for other packages.
DO NOT USE THIS FOLDER DO NOT USE THIS FOLDER
---------------------- ----------------------
* Do not read (or rely) the contents of this folder. * Do not read (or rely) the contents of this folder.
* Do write to this folder. * Do write to this folder.
If you're interested in the lists of extensions stored in this folder use the If you're interested in the lists of extensions stored in this folder use the
API offered by package `extension_discovery` to get this information. API offered by package `extension_discovery` to get this information.
If this package doesn't work for your use-case, then don't try to read the If this package doesn't work for your use-case, then don't try to read the
contents of this folder. It may change, and will not remain stable. contents of this folder. It may change, and will not remain stable.
Use package `extension_discovery` Use package `extension_discovery`
--------------------------------- ---------------------------------
If you want to access information from this folder. If you want to access information from this folder.
Feel free to delete this folder Feel free to delete this folder
------------------------------- -------------------------------
Files in this folder act as a cache, and the cache is discarded if the files Files in this folder act as a cache, and the cache is discarded if the files
are older than the modification time of `.dart_tool/package_config.json`. are older than the modification time of `.dart_tool/package_config.json`.
Hence, it should never be necessary to clear this cache manually, if you find a Hence, it should never be necessary to clear this cache manually, if you find a
need to do please file a bug. need to do please file a bug.

356
app/.dart_tool/package_config.json
View File

@@ -1,178 +1,178 @@
{ {
"configVersion": 2, "configVersion": 2,
"packages": [ "packages": [
{ {
"name": "async", "name": "async",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "boolean_selector", "name": "boolean_selector",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "characters", "name": "characters",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "clock", "name": "clock",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "collection", "name": "collection",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "cupertino_icons", "name": "cupertino_icons",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "fake_async", "name": "fake_async",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.3" "languageVersion": "3.3"
}, },
{ {
"name": "flutter", "name": "flutter",
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter", "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "flutter_lints", "name": "flutter_lints",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "flutter_test", "name": "flutter_test",
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test", "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "leak_tracker", "name": "leak_tracker",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.2" "languageVersion": "3.2"
}, },
{ {
"name": "leak_tracker_flutter_testing", "name": "leak_tracker_flutter_testing",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.2" "languageVersion": "3.2"
}, },
{ {
"name": "leak_tracker_testing", "name": "leak_tracker_testing",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.2" "languageVersion": "3.2"
}, },
{ {
"name": "lints", "name": "lints",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "matcher", "name": "matcher",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "material_color_utilities", "name": "material_color_utilities",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "2.17" "languageVersion": "2.17"
}, },
{ {
"name": "meta", "name": "meta",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.5" "languageVersion": "3.5"
}, },
{ {
"name": "path", "name": "path",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "sky_engine", "name": "sky_engine",
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine", "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.8" "languageVersion": "3.8"
}, },
{ {
"name": "source_span", "name": "source_span",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "stack_trace", "name": "stack_trace",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.4" "languageVersion": "3.4"
}, },
{ {
"name": "stream_channel", "name": "stream_channel",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.3" "languageVersion": "3.3"
}, },
{ {
"name": "string_scanner", "name": "string_scanner",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "term_glyph", "name": "term_glyph",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "test_api", "name": "test_api",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.5" "languageVersion": "3.5"
}, },
{ {
"name": "vector_math", "name": "vector_math",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.1" "languageVersion": "3.1"
}, },
{ {
"name": "vm_service", "name": "vm_service",
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2", "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.5" "languageVersion": "3.5"
}, },
{ {
"name": "app", "name": "app",
"rootUri": "../", "rootUri": "../",
"packageUri": "lib/", "packageUri": "lib/",
"languageVersion": "3.10" "languageVersion": "3.10"
} }
], ],
"generator": "pub", "generator": "pub",
"generatorVersion": "3.10.8", "generatorVersion": "3.10.8",
"flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable", "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
"flutterVersion": "3.38.9", "flutterVersion": "3.38.9",
"pubCache": "file:///Users/kaska/.pub-cache" "pubCache": "file:///Users/kaska/.pub-cache"
} }

458
app/.dart_tool/package_graph.json
View File

@@ -1,230 +1,230 @@
{ {
"roots": [ "roots": [
"app" "app"
], ],
"packages": [ "packages": [
{ {
"name": "app", "name": "app",
"version": "1.0.0+1", "version": "1.0.0+1",
"dependencies": [ "dependencies": [
"cupertino_icons", "cupertino_icons",
"flutter" "flutter"
], ],
"devDependencies": [ "devDependencies": [
"flutter_lints", "flutter_lints",
"flutter_test" "flutter_test"
] ]
}, },
{ {
"name": "flutter_lints", "name": "flutter_lints",
"version": "6.0.0", "version": "6.0.0",
"dependencies": [ "dependencies": [
"lints" "lints"
] ]
}, },
{ {
"name": "flutter_test", "name": "flutter_test",
"version": "0.0.0", "version": "0.0.0",
"dependencies": [ "dependencies": [
"clock", "clock",
"collection", "collection",
"fake_async", "fake_async",
"flutter", "flutter",
"leak_tracker_flutter_testing", "leak_tracker_flutter_testing",
"matcher", "matcher",
"meta", "meta",
"path", "path",
"stack_trace", "stack_trace",
"stream_channel", "stream_channel",
"test_api", "test_api",
"vector_math" "vector_math"
] ]
}, },
{ {
"name": "cupertino_icons", "name": "cupertino_icons",
"version": "1.0.8", "version": "1.0.8",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "flutter", "name": "flutter",
"version": "0.0.0", "version": "0.0.0",
"dependencies": [ "dependencies": [
"characters", "characters",
"collection", "collection",
"material_color_utilities", "material_color_utilities",
"meta", "meta",
"sky_engine", "sky_engine",
"vector_math" "vector_math"
] ]
}, },
{ {
"name": "lints", "name": "lints",
"version": "6.1.0", "version": "6.1.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "stream_channel", "name": "stream_channel",
"version": "2.1.4", "version": "2.1.4",
"dependencies": [ "dependencies": [
"async" "async"
] ]
}, },
{ {
"name": "meta", "name": "meta",
"version": "1.17.0", "version": "1.17.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "collection", "name": "collection",
"version": "1.19.1", "version": "1.19.1",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "leak_tracker_flutter_testing", "name": "leak_tracker_flutter_testing",
"version": "3.0.10", "version": "3.0.10",
"dependencies": [ "dependencies": [
"flutter", "flutter",
"leak_tracker", "leak_tracker",
"leak_tracker_testing", "leak_tracker_testing",
"matcher", "matcher",
"meta" "meta"
] ]
}, },
{ {
"name": "vector_math", "name": "vector_math",
"version": "2.2.0", "version": "2.2.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "stack_trace", "name": "stack_trace",
"version": "1.12.1", "version": "1.12.1",
"dependencies": [ "dependencies": [
"path" "path"
] ]
}, },
{ {
"name": "clock", "name": "clock",
"version": "1.1.2", "version": "1.1.2",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "fake_async", "name": "fake_async",
"version": "1.3.3", "version": "1.3.3",
"dependencies": [ "dependencies": [
"clock", "clock",
"collection" "collection"
] ]
}, },
{ {
"name": "path", "name": "path",
"version": "1.9.1", "version": "1.9.1",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "matcher", "name": "matcher",
"version": "0.12.17", "version": "0.12.17",
"dependencies": [ "dependencies": [
"async", "async",
"meta", "meta",
"stack_trace", "stack_trace",
"term_glyph", "term_glyph",
"test_api" "test_api"
] ]
}, },
{ {
"name": "test_api", "name": "test_api",
"version": "0.7.7", "version": "0.7.7",
"dependencies": [ "dependencies": [
"async", "async",
"boolean_selector", "boolean_selector",
"collection", "collection",
"meta", "meta",
"source_span", "source_span",
"stack_trace", "stack_trace",
"stream_channel", "stream_channel",
"string_scanner", "string_scanner",
"term_glyph" "term_glyph"
] ]
}, },
{ {
"name": "sky_engine", "name": "sky_engine",
"version": "0.0.0", "version": "0.0.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "material_color_utilities", "name": "material_color_utilities",
"version": "0.11.1", "version": "0.11.1",
"dependencies": [ "dependencies": [
"collection" "collection"
] ]
}, },
{ {
"name": "characters", "name": "characters",
"version": "1.4.0", "version": "1.4.0",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "async", "name": "async",
"version": "2.13.0", "version": "2.13.0",
"dependencies": [ "dependencies": [
"collection", "collection",
"meta" "meta"
] ]
}, },
{ {
"name": "leak_tracker_testing", "name": "leak_tracker_testing",
"version": "3.0.2", "version": "3.0.2",
"dependencies": [ "dependencies": [
"leak_tracker", "leak_tracker",
"matcher", "matcher",
"meta" "meta"
] ]
}, },
{ {
"name": "leak_tracker", "name": "leak_tracker",
"version": "11.0.2", "version": "11.0.2",
"dependencies": [ "dependencies": [
"clock", "clock",
"collection", "collection",
"meta", "meta",
"path", "path",
"vm_service" "vm_service"
] ]
}, },
{ {
"name": "term_glyph", "name": "term_glyph",
"version": "1.2.2", "version": "1.2.2",
"dependencies": [] "dependencies": []
}, },
{ {
"name": "string_scanner", "name": "string_scanner",
"version": "1.4.1", "version": "1.4.1",
"dependencies": [ "dependencies": [
"source_span" "source_span"
] ]
}, },
{ {
"name": "source_span", "name": "source_span",
"version": "1.10.2", "version": "1.10.2",
"dependencies": [ "dependencies": [
"collection", "collection",
"path", "path",
"term_glyph" "term_glyph"
] ]
}, },
{ {
"name": "boolean_selector", "name": "boolean_selector",
"version": "2.1.2", "version": "2.1.2",
"dependencies": [ "dependencies": [
"source_span", "source_span",
"string_scanner" "string_scanner"
] ]
}, },
{ {
"name": "vm_service", "name": "vm_service",
"version": "15.0.2", "version": "15.0.2",
"dependencies": [] "dependencies": []
} }
], ],
"configVersion": 1 "configVersion": 1
} }

22
app/macos/Flutter/ephemeral/Flutter-Generated.xcconfig
View File

@@ -1,11 +1,11 @@
// This is a generated file; do not edit or check into version control. // This is a generated file; do not edit or check into version control.
FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable
FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app
COCOAPODS_PARALLEL_CODE_SIGN=true COCOAPODS_PARALLEL_CODE_SIGN=true
FLUTTER_BUILD_DIR=build FLUTTER_BUILD_DIR=build
FLUTTER_BUILD_NAME=1.0.0 FLUTTER_BUILD_NAME=1.0.0
FLUTTER_BUILD_NUMBER=1 FLUTTER_BUILD_NUMBER=1
DART_OBFUSCATION=false DART_OBFUSCATION=false
TRACK_WIDGET_CREATION=true TRACK_WIDGET_CREATION=true
TREE_SHAKE_ICONS=false TREE_SHAKE_ICONS=false
PACKAGE_CONFIG=.dart_tool/package_config.json PACKAGE_CONFIG=.dart_tool/package_config.json

24
app/macos/Flutter/ephemeral/flutter_export_environment.sh
View File

@@ -1,12 +1,12 @@
#!/bin/sh #!/bin/sh
# This is a generated file; do not edit or check into version control. # This is a generated file; do not edit or check into version control.
export "FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable" export "FLUTTER_ROOT=/Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable"
export "FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app" export "FLUTTER_APPLICATION_PATH=/Users/kaska/Documents/Projects/Major/arbiter/app"
export "COCOAPODS_PARALLEL_CODE_SIGN=true" export "COCOAPODS_PARALLEL_CODE_SIGN=true"
export "FLUTTER_BUILD_DIR=build" export "FLUTTER_BUILD_DIR=build"
export "FLUTTER_BUILD_NAME=1.0.0" export "FLUTTER_BUILD_NAME=1.0.0"
export "FLUTTER_BUILD_NUMBER=1" export "FLUTTER_BUILD_NUMBER=1"
export "DART_OBFUSCATION=false" export "DART_OBFUSCATION=false"
export "TRACK_WIDGET_CREATION=true" export "TRACK_WIDGET_CREATION=true"
export "TREE_SHAKE_ICONS=false" export "TREE_SHAKE_ICONS=false"
export "PACKAGE_CONFIG=.dart_tool/package_config.json" export "PACKAGE_CONFIG=.dart_tool/package_config.json"

668
docs/ARCHITECTURE.md
View File

@@ -1,334 +1,334 @@
# Arbiter # Arbiter
Arbiter is a permissioned signing service for cryptocurrency wallets. It runs as a background service on the user's machine with an optional client application for vault management. Arbiter is a permissioned signing service for cryptocurrency wallets. It runs as a background service on the user's machine with an optional client application for vault management.
**Core principle:** The vault NEVER exposes key material. It only produces signatures when a request satisfies the configured policies. **Core principle:** The vault NEVER exposes key material. It only produces signatures when a request satisfies the configured policies.
--- ---
## 1. Peer Types ## 1. Peer Types
Arbiter distinguishes two kinds of peers: Arbiter distinguishes two kinds of peers:
- **Operator** — A client application used by the owner to manage the vault (create wallets, approve SDK clients, configure policies). - **Operator** — A client application used by the owner to manage the vault (create wallets, approve SDK clients, configure policies).
- **SDK Client** — A consumer of signing capabilities, typically an automation tool. In the future, this could include a browser-based wallet. - **SDK Client** — A consumer of signing capabilities, typically an automation tool. In the future, this could include a browser-based wallet.
- **Recovery Operator** — A dormant recovery participant with narrowly scoped authority used only for custody recovery and operator replacement. - **Recovery Operator** — A dormant recovery participant with narrowly scoped authority used only for custody recovery and operator replacement.
--- ---
## 2. Authentication ## 2. Authentication
### 2.1 Challenge-Response ### 2.1 Challenge-Response
All peers authenticate via public-key cryptography using a challenge-response protocol: All peers authenticate via public-key cryptography using a challenge-response protocol:
1. The peer sends its public key and requests a challenge. 1. The peer sends its public key and requests a challenge.
2. The server looks up the key in its database. If found, it generates a fresh challenge from random bytes plus the current timestamp. 2. The server looks up the key in its database. If found, it generates a fresh challenge from random bytes plus the current timestamp.
3. The peer signs the canonical challenge payload with its private key and sends the signature back. 3. The peer signs the canonical challenge payload with its private key and sends the signature back.
4. The server verifies the signature: 4. The server verifies the signature:
- **Pass:** The connection is considered authenticated. - **Pass:** The connection is considered authenticated.
- **Fail:** The server closes the connection. - **Fail:** The server closes the connection.
Authentication challenges are per-connection, ephemeral values. They are not persisted in the peer tables, and peer records store no challenge state. Authentication challenges are per-connection, ephemeral values. They are not persisted in the peer tables, and peer records store no challenge state.
### 2.2 Operator Bootstrap ### 2.2 Operator Bootstrap
On first run — when no Operators are registered — the server generates a one-time bootstrap token. It is made available in two ways: On first run — when no Operators are registered — the server generates a one-time bootstrap token. It is made available in two ways:
- **Local setup:** Written to `~/.arbiter/bootstrap_token` for automatic discovery by a co-located Operator. - **Local setup:** Written to `~/.arbiter/bootstrap_token` for automatic discovery by a co-located Operator.
- **Remote setup:** Printed to the server's console output. - **Remote setup:** Printed to the server's console output.
The first Operator must present this token alongside the standard challenge-response to complete registration. The first Operator must present this token alongside the standard challenge-response to complete registration.
### 2.3 SDK Client Registration ### 2.3 SDK Client Registration
There is no bootstrap mechanism for SDK clients. They must be explicitly approved by an already-registered Operator. There is no bootstrap mechanism for SDK clients. They must be explicitly approved by an already-registered Operator.
--- ---
## 3. Multi-Operator Governance ## 3. Multi-Operator Governance
When more than one Operator is registered, the vault is treated as having multiple operators. In that mode, sensitive actions are governed by voting rather than by a single operator decision. When more than one Operator is registered, the vault is treated as having multiple operators. In that mode, sensitive actions are governed by voting rather than by a single operator decision.
### 3.1 Voting Rules ### 3.1 Voting Rules
Voting is based on the total number of registered operators: Voting is based on the total number of registered operators:
- **1 operator:** no vote is needed; the single operator decides directly. - **1 operator:** no vote is needed; the single operator decides directly.
- **2 operators:** full consensus is required; both operators must approve. - **2 operators:** full consensus is required; both operators must approve.
- **3 or more operators:** quorum is `floor(N / 2) + 1`. - **3 or more operators:** quorum is `floor(N / 2) + 1`.
For a decision to count, the operator's approval or rejection must be signed by that operator's associated key. Unsigned votes, or votes that fail signature verification, are ignored. For a decision to count, the operator's approval or rejection must be signed by that operator's associated key. Unsigned votes, or votes that fail signature verification, are ignored.
Examples: Examples:
- **3 operators:** 2 approvals required - **3 operators:** 2 approvals required
- **4 operators:** 3 approvals required - **4 operators:** 3 approvals required
### 3.2 Actions Requiring a Vote ### 3.2 Actions Requiring a Vote
In multi-operator mode, a successful vote is required for: In multi-operator mode, a successful vote is required for:
- approving new SDK clients - approving new SDK clients
- granting an SDK client visibility to a wallet - granting an SDK client visibility to a wallet
- approving a one-off transaction - approving a one-off transaction
- approving creation of a persistent grant - approving creation of a persistent grant
- approving operator replacement - approving operator replacement
- approving server updates - approving server updates
- updating Shamir secret-sharing parameters - updating Shamir secret-sharing parameters
### 3.3 Special Rule for Key Rotation ### 3.3 Special Rule for Key Rotation
Key rotation always requires full quorum, regardless of the normal voting threshold. Key rotation always requires full quorum, regardless of the normal voting threshold.
This is stricter than ordinary governance actions because rotating the root key requires every operator to participate in coordinated share refresh/update steps. The root key itself is not redistributed directly, but each operator's share material must be changed consistently. This is stricter than ordinary governance actions because rotating the root key requires every operator to participate in coordinated share refresh/update steps. The root key itself is not redistributed directly, but each operator's share material must be changed consistently.
### 3.4 Root Key Custody ### 3.4 Root Key Custody
When the vault has multiple operators, the vault root key is protected using Shamir secret sharing. When the vault has multiple operators, the vault root key is protected using Shamir secret sharing.
The vault root key is encrypted in a way that requires reconstruction from user-held shares rather than from a single shared password. The vault root key is encrypted in a way that requires reconstruction from user-held shares rather than from a single shared password.
For ordinary operators, the Shamir threshold matches the ordinary governance quorum. For example: For ordinary operators, the Shamir threshold matches the ordinary governance quorum. For example:
- **2 operators:** `2-of-2` - **2 operators:** `2-of-2`
- **3 operators:** `2-of-3` - **3 operators:** `2-of-3`
- **4 operators:** `3-of-4` - **4 operators:** `3-of-4`
In practice, the Shamir share set also includes Recovery Operator shares. This means the effective Shamir parameters are computed over the combined share pool while keeping the same threshold. For example: In practice, the Shamir share set also includes Recovery Operator shares. This means the effective Shamir parameters are computed over the combined share pool while keeping the same threshold. For example:
- **3 ordinary operators + 2 recovery shares:** `2-of-5` - **3 ordinary operators + 2 recovery shares:** `2-of-5`
This ensures that the normal custody threshold follows the ordinary operator quorum, while still allowing dormant recovery shares to exist for break-glass recovery flows. This ensures that the normal custody threshold follows the ordinary operator quorum, while still allowing dormant recovery shares to exist for break-glass recovery flows.
### 3.5 Recovery Operators ### 3.5 Recovery Operators
Recovery Operators are a separate peer type from ordinary vault operators. Recovery Operators are a separate peer type from ordinary vault operators.
Their role is intentionally narrow. They can only: Their role is intentionally narrow. They can only:
- participate in unsealing the vault - participate in unsealing the vault
- vote for operator replacement - vote for operator replacement
Recovery Operators do not participate in routine governance such as approving SDK clients, granting wallet visibility, approving transactions, creating grants, approving server updates, or changing Shamir parameters. Recovery Operators do not participate in routine governance such as approving SDK clients, granting wallet visibility, approving transactions, creating grants, approving server updates, or changing Shamir parameters.
### 3.6 Sleeping and Waking Recovery Operators ### 3.6 Sleeping and Waking Recovery Operators
By default, Recovery Operators are **sleeping** and do not participate in any active flow. By default, Recovery Operators are **sleeping** and do not participate in any active flow.
Any ordinary operator may request that Recovery Operators **wake up**. Any ordinary operator may request that Recovery Operators **wake up**.
Any ordinary operator may also cancel a pending wake-up request. Any ordinary operator may also cancel a pending wake-up request.
This creates a dispute window before recovery powers become active. The default wake-up delay is **14 days**. This creates a dispute window before recovery powers become active. The default wake-up delay is **14 days**.
Recovery Operators are therefore part of the break-glass recovery path rather than the normal operating quorum. Recovery Operators are therefore part of the break-glass recovery path rather than the normal operating quorum.
The high-level recovery flow is: The high-level recovery flow is:
```mermaid ```mermaid
sequenceDiagram sequenceDiagram
autonumber autonumber
actor Op as Ordinary Operator actor Op as Ordinary Operator
participant Server participant Server
actor Other as Other Operator actor Other as Other Operator
actor Rec as Recovery Operator actor Rec as Recovery Operator
Op->>Server: Request recovery wake-up Op->>Server: Request recovery wake-up
Server-->>Op: Wake-up pending Server-->>Op: Wake-up pending
Note over Server: Default dispute window: 14 days Note over Server: Default dispute window: 14 days
alt Wake-up cancelled during dispute window alt Wake-up cancelled during dispute window
Other->>Server: Cancel wake-up Other->>Server: Cancel wake-up
Server-->>Op: Recovery cancelled Server-->>Op: Recovery cancelled
Server-->>Rec: Stay sleeping Server-->>Rec: Stay sleeping
else No cancellation for 14 days else No cancellation for 14 days
Server-->>Rec: Wake up Server-->>Rec: Wake up
Rec->>Server: Join recovery flow Rec->>Server: Join recovery flow
critical Recovery authority critical Recovery authority
Rec->>Server: Participate in unseal Rec->>Server: Participate in unseal
Rec->>Server: Vote on operator replacement Rec->>Server: Vote on operator replacement
end end
Server-->>Op: Recovery mode active Server-->>Op: Recovery mode active
end end
``` ```
### 3.7 Committee Formation ### 3.7 Committee Formation
There are two ways to form a multi-operator committee: There are two ways to form a multi-operator committee:
- convert an existing single-operator vault by adding new operators - convert an existing single-operator vault by adding new operators
- bootstrap an unbootstrapped vault directly into multi-operator mode - bootstrap an unbootstrapped vault directly into multi-operator mode
In both cases, committee formation is a coordinated process. Arbiter does not allow multi-operator custody to emerge implicitly from unrelated registrations. In both cases, committee formation is a coordinated process. Arbiter does not allow multi-operator custody to emerge implicitly from unrelated registrations.
### 3.8 Bootstrapping an Unbootstrapped Vault into Multi-Operator Mode ### 3.8 Bootstrapping an Unbootstrapped Vault into Multi-Operator Mode
When an unbootstrapped vault is initialized as a multi-operator vault, the setup proceeds as follows: When an unbootstrapped vault is initialized as a multi-operator vault, the setup proceeds as follows:
1. An operator connects to the unbootstrapped vault using an Operator and the bootstrap token. 1. An operator connects to the unbootstrapped vault using an Operator and the bootstrap token.
2. During bootstrap setup, that operator declares: 2. During bootstrap setup, that operator declares:
- the total number of ordinary operators - the total number of ordinary operators
- the total number of Recovery Operators - the total number of Recovery Operators
3. The vault enters **multi-bootstrap mode**. 3. The vault enters **multi-bootstrap mode**.
4. While in multi-bootstrap mode: 4. While in multi-bootstrap mode:
- every ordinary operator must connect with an Operator using the bootstrap token - every ordinary operator must connect with an Operator using the bootstrap token
- every Recovery Operator must also connect using the bootstrap token - every Recovery Operator must also connect using the bootstrap token
- each participant is registered individually - each participant is registered individually
- each participant's share is created and protected with that participant's credentials - each participant's share is created and protected with that participant's credentials
5. The vault is considered fully bootstrapped only after all declared operator and recovery-share registrations have completed successfully. 5. The vault is considered fully bootstrapped only after all declared operator and recovery-share registrations have completed successfully.
This means the operator and recovery set is fixed at bootstrap completion time, based on the counts declared when multi-bootstrap mode was entered. This means the operator and recovery set is fixed at bootstrap completion time, based on the counts declared when multi-bootstrap mode was entered.
### 3.9 Special Bootstrap Constraint for Two-Operator Vaults ### 3.9 Special Bootstrap Constraint for Two-Operator Vaults
If a vault is declared with exactly **2 ordinary operators**, Arbiter requires at least **1 Recovery Operator** to be configured during bootstrap. If a vault is declared with exactly **2 ordinary operators**, Arbiter requires at least **1 Recovery Operator** to be configured during bootstrap.
This prevents the worst-case custody failure in which a `2-of-2` operator set becomes permanently unrecoverable after loss of a single operator. This prevents the worst-case custody failure in which a `2-of-2` operator set becomes permanently unrecoverable after loss of a single operator.
--- ---
## 4. Server Identity ## 4. Server Identity
The server proves its identity using TLS with a self-signed certificate. The TLS private key is generated on first run and is long-term; no rotation mechanism exists yet due to the complexity of multi-peer coordination. The server proves its identity using TLS with a self-signed certificate. The TLS private key is generated on first run and is long-term; no rotation mechanism exists yet due to the complexity of multi-peer coordination.
Peers verify the server by its **public key fingerprint**: Peers verify the server by its **public key fingerprint**:
- **Operator (local):** Receives the fingerprint automatically through the bootstrap token. - **Operator (local):** Receives the fingerprint automatically through the bootstrap token.
- **Operator (remote) / SDK Client:** Must receive the fingerprint out-of-band. - **Operator (remote) / SDK Client:** Must receive the fingerprint out-of-band.
> A streamlined setup mechanism using a single connection string is planned but not yet implemented. > A streamlined setup mechanism using a single connection string is planned but not yet implemented.
--- ---
## 5. Key Management ## 5. Key Management
### 5.1 Key Hierarchy ### 5.1 Key Hierarchy
There are three layers of keys: There are three layers of keys:
| Key | Encrypts | Encrypted by | | Key | Encrypts | Encrypted by |
|---|---|---| |---|---|---|
| **User key** (password) | Root key | — (derived from user input) | | **User key** (password) | Root key | — (derived from user input) |
| **Root key** | Wallet keys | User key | | **Root key** | Wallet keys | User key |
| **Wallet keys** | — (used for signing) | Root key | | **Wallet keys** | — (used for signing) | Root key |
This layered design enables: This layered design enables:
- **Password rotation** without re-encrypting every wallet key (only the root key is re-encrypted). - **Password rotation** without re-encrypting every wallet key (only the root key is re-encrypted).
- **Root key rotation** without requiring the user to change their password. - **Root key rotation** without requiring the user to change their password.
### 5.2 Encryption at Rest ### 5.2 Encryption at Rest
The database stores everything in encrypted form using symmetric AEAD. The encryption scheme is versioned to support transparent migration — when the vault unseals, Arbiter automatically re-encrypts any entries that are behind the current scheme version. See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the specific scheme and versioning mechanism. The database stores everything in encrypted form using symmetric AEAD. The encryption scheme is versioned to support transparent migration — when the vault unseals, Arbiter automatically re-encrypts any entries that are behind the current scheme version. See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the specific scheme and versioning mechanism.
--- ---
## 6. Vault Lifecycle ## 6. Vault Lifecycle
### 6.1 Sealed State ### 6.1 Sealed State
On boot, the root key is encrypted and the server cannot perform any signing operations. This state is called **Sealed**. On boot, the root key is encrypted and the server cannot perform any signing operations. This state is called **Sealed**.
### 6.2 Unseal Flow ### 6.2 Unseal Flow
To transition to the **Unsealed** state, an Operator must provide the password: To transition to the **Unsealed** state, an Operator must provide the password:
1. The Operator initiates an unseal request. 1. The Operator initiates an unseal request.
2. The server generates a one-time key pair and returns the public key. 2. The server generates a one-time key pair and returns the public key.
3. The Operator encrypts the user's password with this one-time public key and sends the ciphertext to the server. 3. The Operator encrypts the user's password with this one-time public key and sends the ciphertext to the server.
4. The server decrypts and verifies the password: 4. The server decrypts and verifies the password:
- **Success:** The root key is decrypted and placed into a hardened memory cell. The server transitions to `Unsealed`. Any entries pending encryption scheme migration are re-encrypted. - **Success:** The root key is decrypted and placed into a hardened memory cell. The server transitions to `Unsealed`. Any entries pending encryption scheme migration are re-encrypted.
- **Failure:** The server returns an error indicating the password is incorrect. - **Failure:** The server returns an error indicating the password is incorrect.
### 6.3 Memory Protection ### 6.3 Memory Protection
Once unsealed, the root key must be protected in memory against: Once unsealed, the root key must be protected in memory against:
- Memory dumps - Memory dumps
- Page swaps to disk - Page swaps to disk
- Hibernation files - Hibernation files
See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the current and planned memory protection approaches. See [IMPLEMENTATION.md](IMPLEMENTATION.md) for the current and planned memory protection approaches.
--- ---
## 7. Permission Engine ## 7. Permission Engine
### 7.1 Fundamental Rules ### 7.1 Fundamental Rules
- SDK clients have **no access by default**. - SDK clients have **no access by default**.
- Access is granted **explicitly** by an Operator. - Access is granted **explicitly** by an Operator.
- Grants are scoped to **specific wallets** and governed by **policies**. - Grants are scoped to **specific wallets** and governed by **policies**.
Each blockchain requires its own policy system due to differences in static transaction analysis. Currently, only EVM is supported; Solana support is planned. Each blockchain requires its own policy system due to differences in static transaction analysis. Currently, only EVM is supported; Solana support is planned.
Arbiter is also responsible for ensuring that **transaction nonces are never reused**. Arbiter is also responsible for ensuring that **transaction nonces are never reused**.
### 7.2 EVM Policies ### 7.2 EVM Policies
Every EVM grant is scoped to a specific **wallet** and **chain ID**. Every EVM grant is scoped to a specific **wallet** and **chain ID**.
#### 7.2.0 Transaction Signing Sequence #### 7.2.0 Transaction Signing Sequence
The high-level interaction order is: The high-level interaction order is:
```mermaid ```mermaid
sequenceDiagram sequenceDiagram
autonumber autonumber
actor SDK as SDK Client actor SDK as SDK Client
participant Server participant Server
participant operator as Operator participant operator as Operator
SDK->>Server: SignTransactionRequest SDK->>Server: SignTransactionRequest
Server->>Server: Resolve wallet and wallet visibility Server->>Server: Resolve wallet and wallet visibility
alt Visibility approval required alt Visibility approval required
Server->>operator: Ask for wallet visibility approval Server->>operator: Ask for wallet visibility approval
operator-->>Server: Vote result operator-->>Server: Vote result
end end
Server->>Server: Evaluate transaction Server->>Server: Evaluate transaction
Server->>Server: Load grant and limits context Server->>Server: Load grant and limits context
alt Grant approval required alt Grant approval required
Server->>operator: Ask for execution / grant approval Server->>operator: Ask for execution / grant approval
operator-->>Server: Vote result operator-->>Server: Vote result
opt Create persistent grant opt Create persistent grant
Server->>Server: Create and store grant Server->>Server: Create and store grant
end end
Server->>Server: Retry evaluation Server->>Server: Retry evaluation
end end
critical Final authorization path critical Final authorization path
Server->>Server: Check limits and record execution Server->>Server: Check limits and record execution
Server-->>Server: Signature or evaluation error Server-->>Server: Signature or evaluation error
end end
Server-->>SDK: Signature or error Server-->>SDK: Signature or error
``` ```
#### 7.2.1 Transaction Sub-Grants #### 7.2.1 Transaction Sub-Grants
Arbiter maintains an ever-expanding database of known contracts and their ABIs. Based on contract knowledge, transaction requests fall into three categories: Arbiter maintains an ever-expanding database of known contracts and their ABIs. Based on contract knowledge, transaction requests fall into three categories:
**1. Known contract (ABI available)** **1. Known contract (ABI available)**
The transaction can be decoded and presented with semantic meaning. For example: *"Client X wants to transfer Y USDT to address Z."* The transaction can be decoded and presented with semantic meaning. For example: *"Client X wants to transfer Y USDT to address Z."*
Available restrictions: Available restrictions:
- Volume limits (e.g., "no more than 10,000 tokens ever") - Volume limits (e.g., "no more than 10,000 tokens ever")
- Rate limits (e.g., "no more than 100 tokens per hour") - Rate limits (e.g., "no more than 100 tokens per hour")
**2. Unknown contract (no ABI)** **2. Unknown contract (no ABI)**
The transaction cannot be decoded, so its effects are opaque — it could do anything, including draining all tokens. The user is warned, and if approved, access is granted to all interactions with the contract (matched by the `to` field). The transaction cannot be decoded, so its effects are opaque — it could do anything, including draining all tokens. The user is warned, and if approved, access is granted to all interactions with the contract (matched by the `to` field).
Available restrictions: Available restrictions:
- Transaction count limits (e.g., "no more than 100 transactions ever") - Transaction count limits (e.g., "no more than 100 transactions ever")
- Rate limits (e.g., "no more than 5 transactions per hour") - Rate limits (e.g., "no more than 5 transactions per hour")
**3. Plain ether transfer (no calldata)** **3. Plain ether transfer (no calldata)**
These transactions have no `calldata` and therefore cannot interact with contracts. They can be subject to the same volume and rate restrictions as above. These transactions have no `calldata` and therefore cannot interact with contracts. They can be subject to the same volume and rate restrictions as above.
#### 7.2.2 Global Limits #### 7.2.2 Global Limits
In addition to sub-grant-specific restrictions, the following limits can be applied across all grant types: In addition to sub-grant-specific restrictions, the following limits can be applied across all grant types:
- **Gas limit** — Maximum gas per transaction. - **Gas limit** — Maximum gas per transaction.
- **Time-window restrictions** — e.g., signing allowed only 08:00–20:00 on Mondays and Thursdays. - **Time-window restrictions** — e.g., signing allowed only 08:00–20:00 on Mondays and Thursdays.

452
docs/IMPLEMENTATION.md
View File

@@ -1,226 +1,226 @@
# Implementation Details # Implementation Details
This document covers concrete technology choices and dependencies. For the architectural design, see [ARCHITECTURE.md](ARCHITECTURE.md). This document covers concrete technology choices and dependencies. For the architectural design, see [ARCHITECTURE.md](ARCHITECTURE.md).
--- ---
## Client Connection Flow ## Client Connection Flow
### Authentication Result Semantics ### Authentication Result Semantics
Authentication no longer uses an implicit success-only response shape. Both `client` and `operator` return explicit auth status enums over the wire. Authentication no longer uses an implicit success-only response shape. Both `client` and `operator` return explicit auth status enums over the wire.
- **Client:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `APPROVAL_DENIED`, `NO_OPERATORS_ONLINE`, or `INTERNAL` - **Client:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `APPROVAL_DENIED`, `NO_OPERATORS_ONLINE`, or `INTERNAL`
- **Operator:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `BOOTSTRAP_REQUIRED`, `TOKEN_INVALID`, or `INTERNAL` - **Operator:** `AuthResult` may return `SUCCESS`, `INVALID_KEY`, `INVALID_SIGNATURE`, `BOOTSTRAP_REQUIRED`, `TOKEN_INVALID`, or `INTERNAL`
This makes transport-level failures and actor/domain-level auth failures distinct: This makes transport-level failures and actor/domain-level auth failures distinct:
- **Transport/protocol failures** are surfaced as stream/status errors - **Transport/protocol failures** are surfaced as stream/status errors
- **Authentication failures** are surfaced as successful protocol responses carrying an explicit auth status - **Authentication failures** are surfaced as successful protocol responses carrying an explicit auth status
Clients are expected to handle these status codes directly and present the concrete failure reason to the user. Clients are expected to handle these status codes directly and present the concrete failure reason to the user.
### New Client Approval ### New Client Approval
When a client whose public key is not yet in the database connects, all connected operators are asked to approve the connection. The first operator to respond determines the outcome; remaining requests are cancelled via a watch channel. When a client whose public key is not yet in the database connects, all connected operators are asked to approve the connection. The first operator to respond determines the outcome; remaining requests are cancelled via a watch channel.
```mermaid ```mermaid
flowchart TD flowchart TD
A([Client connects]) --> B[Receive AuthChallengeRequest] A([Client connects]) --> B[Receive AuthChallengeRequest]
B --> C{pubkey in DB?} B --> C{pubkey in DB?}
C -- yes --> G[Generate AuthChallenge] C -- yes --> G[Generate AuthChallenge]
C -- no --> E[Ask all Operators:\nClientConnectionRequest] C -- no --> E[Ask all Operators:\nClientConnectionRequest]
E --> F{First response} E --> F{First response}
F -- denied --> Z([Reject connection]) F -- denied --> Z([Reject connection])
F -- approved --> F2[Cancel remaining\nOperator requests] F -- approved --> F2[Cancel remaining\nOperator requests]
F2 --> F3[INSERT client] F2 --> F3[INSERT client]
F3 --> G F3 --> G
G --> H[Send AuthChallenge\ntimestamp + random bytes] G --> H[Send AuthChallenge\ntimestamp + random bytes]
H --> I[Receive AuthChallengeSolution] H --> I[Receive AuthChallengeSolution]
I --> K{Signature valid?} I --> K{Signature valid?}
K -- no --> Z K -- no --> Z
K -- yes --> J([Session started]) K -- yes --> J([Session started])
``` ```
Auth challenges are generated from fresh random bytes plus a nanosecond timestamp. The server keeps the issued challenge only in the in-flight authentication state for that connection, then verifies the signature against the same canonical challenge payload. Auth challenges are generated from fresh random bytes plus a nanosecond timestamp. The server keeps the issued challenge only in the in-flight authentication state for that connection, then verifies the signature against the same canonical challenge payload.
The authentication schema stores peer identity, not replay counters: The authentication schema stores peer identity, not replay counters:
- `program_client` stores the SDK client's public key, metadata binding, and timestamps. - `program_client` stores the SDK client's public key, metadata binding, and timestamps.
- `operator_client` stores the Operator public key and timestamps. - `operator_client` stores the Operator public key and timestamps.
- Neither table stores an authentication nonce, and challenge generation does not update either table. - Neither table stores an authentication nonce, and challenge generation does not update either table.
--- ---
## Cryptography ## Cryptography
### Authentication ### Authentication
- **Client protocol:** ML-DSA - **Client protocol:** ML-DSA
### User-Agent Authentication ### User-Agent Authentication
Operator authentication supports multiple signature schemes because platform-provided "hardware-bound" keys do not expose a uniform algorithm across operating systems and hardware. Operator authentication supports multiple signature schemes because platform-provided "hardware-bound" keys do not expose a uniform algorithm across operating systems and hardware.
- **Supported schemes:** ML-DSA - **Supported schemes:** ML-DSA
- **Why:** Secure Enclave (MacOS) support them natively, on other platforms we could emulate while they roll-out - **Why:** Secure Enclave (MacOS) support them natively, on other platforms we could emulate while they roll-out
### Encryption at Rest ### Encryption at Rest
- **Scheme:** Symmetric AEAD — currently **XChaCha20-Poly1305** - **Scheme:** Symmetric AEAD — currently **XChaCha20-Poly1305**
- **Version tracking:** Each `aead_encrypted` database entry carries a `scheme` field denoting the version, enabling transparent migration on unseal - **Version tracking:** Each `aead_encrypted` database entry carries a `scheme` field denoting the version, enabling transparent migration on unseal
### Server Identity ### Server Identity
- **Transport:** TLS with a self-signed certificate - **Transport:** TLS with a self-signed certificate
- **Key type:** Generated on first run; long-term (no rotation mechanism yet) - **Key type:** Generated on first run; long-term (no rotation mechanism yet)
--- ---
## Communication ## Communication
- **Protocol:** gRPC with Protocol Buffers - **Protocol:** gRPC with Protocol Buffers
- **Request/response matching:** multiplexed over a single bidirectional stream using per-connection request IDs - **Request/response matching:** multiplexed over a single bidirectional stream using per-connection request IDs
- **Server identity distribution:** `ServerInfo` protobuf struct containing the TLS public key fingerprint - **Server identity distribution:** `ServerInfo` protobuf struct containing the TLS public key fingerprint
- **Future consideration:** grpc-web lacks bidirectional stream support, so a browser-based wallet may require protojson over WebSocket - **Future consideration:** grpc-web lacks bidirectional stream support, so a browser-based wallet may require protojson over WebSocket
### Request Multiplexing ### Request Multiplexing
Both `client` and `operator` connections support multiple in-flight requests over one gRPC bidi stream. Both `client` and `operator` connections support multiple in-flight requests over one gRPC bidi stream.
- Every request carries a monotonically increasing request ID - Every request carries a monotonically increasing request ID
- Every normal response echoes the request ID it corresponds to - Every normal response echoes the request ID it corresponds to
- Out-of-band server messages omit the response ID entirely - Out-of-band server messages omit the response ID entirely
- The server rejects already-seen request IDs at the transport adapter boundary before business logic sees the message - The server rejects already-seen request IDs at the transport adapter boundary before business logic sees the message
This keeps request correlation entirely in transport/client connection code while leaving actor and domain handlers unaware of request IDs. This keeps request correlation entirely in transport/client connection code while leaving actor and domain handlers unaware of request IDs.
--- ---
## EVM Policy Engine ## EVM Policy Engine
### Overview ### Overview
The EVM engine classifies incoming transactions, enforces grant constraints, and records executions. It is the sole path through which a wallet key is used for signing. The EVM engine classifies incoming transactions, enforces grant constraints, and records executions. It is the sole path through which a wallet key is used for signing.
The central abstraction is the `Policy` trait. Each implementation handles one semantic transaction category and owns its own database tables for grant storage and transaction logging. The central abstraction is the `Policy` trait. Each implementation handles one semantic transaction category and owns its own database tables for grant storage and transaction logging.
### Transaction Evaluation Flow ### Transaction Evaluation Flow
`Engine::evaluate_transaction` runs the following steps in order: `Engine::evaluate_transaction` runs the following steps in order:
1. **Classify** — Each registered policy's `analyze(context)` inspects the transaction fields (`chain`, `to`, `value`, `calldata`). The first one returning `Some(meaning)` wins. If none match, the transaction is rejected as `UnsupportedTransactionType`. 1. **Classify** — Each registered policy's `analyze(context)` inspects the transaction fields (`chain`, `to`, `value`, `calldata`). The first one returning `Some(meaning)` wins. If none match, the transaction is rejected as `UnsupportedTransactionType`.
2. **Find grant** — `Policy::try_find_grant` queries for a non-revoked grant covering this wallet, client, chain, and target address. 2. **Find grant** — `Policy::try_find_grant` queries for a non-revoked grant covering this wallet, client, chain, and target address.
3. **Check shared constraints** — `check_shared_constraints` runs in the engine before any policy-specific logic. It enforces the validity window, gas fee caps, and transaction count rate limit (see below). 3. **Check shared constraints** — `check_shared_constraints` runs in the engine before any policy-specific logic. It enforces the validity window, gas fee caps, and transaction count rate limit (see below).
4. **Evaluate** — `Policy::evaluate` checks the decoded meaning against the grant's policy-specific constraints and returns any violations. 4. **Evaluate** — `Policy::evaluate` checks the decoded meaning against the grant's policy-specific constraints and returns any violations.
5. **Record** — If `RunKind::Execution` and there are no violations, the engine writes to `evm_transaction_log` and calls `Policy::record_transaction` for any policy-specific logging (e.g., token transfer volume). 5. **Record** — If `RunKind::Execution` and there are no violations, the engine writes to `evm_transaction_log` and calls `Policy::record_transaction` for any policy-specific logging (e.g., token transfer volume).
The detailed branch structure is shown below: The detailed branch structure is shown below:
```mermaid ```mermaid
flowchart TD flowchart TD
A[SDK Client sends sign transaction request] --> B[Server resolves wallet] A[SDK Client sends sign transaction request] --> B[Server resolves wallet]
B --> C{Wallet exists?} B --> C{Wallet exists?}
C -- No --> Z1[Return wallet not found error] C -- No --> Z1[Return wallet not found error]
C -- Yes --> D[Check SDK client wallet visibility] C -- Yes --> D[Check SDK client wallet visibility]
D --> E{Wallet visible to SDK client?} D --> E{Wallet visible to SDK client?}
E -- No --> F[Start wallet visibility voting flow] E -- No --> F[Start wallet visibility voting flow]
F --> G{Vote approved?} F --> G{Vote approved?}
G -- No --> Z2[Return wallet access denied error] G -- No --> Z2[Return wallet access denied error]
G -- Yes --> H[Persist wallet visibility] G -- Yes --> H[Persist wallet visibility]
E -- Yes --> I[Classify transaction meaning] E -- Yes --> I[Classify transaction meaning]
H --> I H --> I
I --> J{Meaning supported?} I --> J{Meaning supported?}
J -- No --> Z3[Return unsupported transaction error] J -- No --> Z3[Return unsupported transaction error]
J -- Yes --> K[Find matching grant] J -- Yes --> K[Find matching grant]
K --> L{Grant exists?} K --> L{Grant exists?}
L -- Yes --> M[Check grant limits] L -- Yes --> M[Check grant limits]
L -- No --> N[Start execution or grant voting flow] L -- No --> N[Start execution or grant voting flow]
N --> O{Operator decision} N --> O{Operator decision}
O -- Reject --> Z4[Return no matching grant error] O -- Reject --> Z4[Return no matching grant error]
O -- Allow once --> M O -- Allow once --> M
O -- Create grant --> P[Create grant with user-selected limits] O -- Create grant --> P[Create grant with user-selected limits]
P --> Q[Persist grant] P --> Q[Persist grant]
Q --> M Q --> M
M --> R{Limits exceeded?} M --> R{Limits exceeded?}
R -- Yes --> Z5[Return evaluation error] R -- Yes --> Z5[Return evaluation error]
R -- No --> S[Record transaction in logs] R -- No --> S[Record transaction in logs]
S --> T[Produce signature] S --> T[Produce signature]
T --> U[Return signature to SDK client] T --> U[Return signature to SDK client]
note1[Limit checks include volume, count, and gas constraints.] note1[Limit checks include volume, count, and gas constraints.]
note2[Grant lookup depends on classified meaning, such as ether transfer or token transfer.] note2[Grant lookup depends on classified meaning, such as ether transfer or token transfer.]
K -. uses .-> note2 K -. uses .-> note2
M -. checks .-> note1 M -. checks .-> note1
``` ```
### Policy Trait ### Policy Trait
| Method | Purpose | | Method | Purpose |
|---|---| |---|---|
| `analyze` | Pure — classifies a transaction into a typed `Meaning`, or `None` if this policy doesn't apply | | `analyze` | Pure — classifies a transaction into a typed `Meaning`, or `None` if this policy doesn't apply |
| `evaluate` | Checks the `Meaning` against a `Grant`; returns a list of `EvalViolation`s | | `evaluate` | Checks the `Meaning` against a `Grant`; returns a list of `EvalViolation`s |
| `create_grant` | Inserts policy-specific rows; returns the specific grant ID | | `create_grant` | Inserts policy-specific rows; returns the specific grant ID |
| `try_find_grant` | Finds a matching non-revoked grant for the given `EvalContext` | | `try_find_grant` | Finds a matching non-revoked grant for the given `EvalContext` |
| `find_all_grants` | Returns all non-revoked grants (used for listing) | | `find_all_grants` | Returns all non-revoked grants (used for listing) |
| `record_transaction` | Persists policy-specific data after execution | | `record_transaction` | Persists policy-specific data after execution |
`analyze` and `evaluate` are intentionally separate: classification is pure and cheap, while evaluation may involve DB queries (e.g., fetching past transfer volume). `analyze` and `evaluate` are intentionally separate: classification is pure and cheap, while evaluation may involve DB queries (e.g., fetching past transfer volume).
### Registered Policies ### Registered Policies
**EtherTransfer** — plain ETH transfers (empty calldata) **EtherTransfer** — plain ETH transfers (empty calldata)
- Grant requires: allowlist of recipient addresses + one volumetric rate limit (max ETH over a time window) - Grant requires: allowlist of recipient addresses + one volumetric rate limit (max ETH over a time window)
- Violations: recipient not in allowlist, cumulative ETH volume exceeded - Violations: recipient not in allowlist, cumulative ETH volume exceeded
**TokenTransfer** — ERC-20 `transfer(address,uint256)` calls **TokenTransfer** — ERC-20 `transfer(address,uint256)` calls
- Recognised by ABI-decoding the `transfer(address,uint256)` selector against a static registry of known token contracts (`arbiter_tokens_registry`) - Recognised by ABI-decoding the `transfer(address,uint256)` selector against a static registry of known token contracts (`arbiter_tokens_registry`)
- Grant requires: token contract address, optional recipient restriction, zero or more volumetric rate limits - Grant requires: token contract address, optional recipient restriction, zero or more volumetric rate limits
- Violations: recipient mismatch, any volumetric limit exceeded - Violations: recipient mismatch, any volumetric limit exceeded
### Grant Model ### Grant Model
Every grant has two layers: Every grant has two layers:
- **Shared (`evm_basic_grant`)** — wallet, chain, validity period, gas fee caps, transaction count rate limit. One row per grant regardless of type. - **Shared (`evm_basic_grant`)** — wallet, chain, validity period, gas fee caps, transaction count rate limit. One row per grant regardless of type.
- **Specific** — policy-owned tables (`evm_ether_transfer_grant`, `evm_token_transfer_grant`) holding type-specific configuration. - **Specific** — policy-owned tables (`evm_ether_transfer_grant`, `evm_token_transfer_grant`) holding type-specific configuration.
`find_all_grants` uses a `#[diesel::auto_type]` base join between the specific and shared tables, then batch-loads related rows (targets, volume limits) in two additional queries to avoid N+1. `find_all_grants` uses a `#[diesel::auto_type]` base join between the specific and shared tables, then batch-loads related rows (targets, volume limits) in two additional queries to avoid N+1.
The engine exposes `list_all_grants` which collects across all policy types into `Vec<Grant<SpecificGrant>>` via a blanket `From<Grant<S>> for Grant<SpecificGrant>` conversion. The engine exposes `list_all_grants` which collects across all policy types into `Vec<Grant<SpecificGrant>>` via a blanket `From<Grant<S>> for Grant<SpecificGrant>` conversion.
### Shared Constraints (enforced by the engine) ### Shared Constraints (enforced by the engine)
These are checked centrally in `check_shared_constraints` before policy evaluation: These are checked centrally in `check_shared_constraints` before policy evaluation:
| Constraint | Fields | Behaviour | | Constraint | Fields | Behaviour |
|---|---|---| |---|---|---|
| Validity window | `valid_from`, `valid_until` | Emits `InvalidTime` if current time is outside the range | | Validity window | `valid_from`, `valid_until` | Emits `InvalidTime` if current time is outside the range |
| Gas fee cap | `max_gas_fee_per_gas`, `max_priority_fee_per_gas` | Emits `GasLimitExceeded` if either cap is breached | | Gas fee cap | `max_gas_fee_per_gas`, `max_priority_fee_per_gas` | Emits `GasLimitExceeded` if either cap is breached |
| Tx count rate limit | `rate_limit` (`count` + `window`) | Counts rows in `evm_transaction_log` within the window; emits `RateLimitExceeded` if at or above the limit | | Tx count rate limit | `rate_limit` (`count` + `window`) | Counts rows in `evm_transaction_log` within the window; emits `RateLimitExceeded` if at or above the limit |
--- ---
### Known Limitations ### Known Limitations
- **Only EIP-1559 transactions are supported.** Legacy and EIP-2930 types are rejected outright. - **Only EIP-1559 transactions are supported.** Legacy and EIP-2930 types are rejected outright.
- **No opaque-calldata (unknown contract) grant type.** The architecture describes a category for unrecognised contracts, but no policy implements it yet. Any transaction that is not a plain ETH transfer or a known ERC-20 transfer is unconditionally rejected. - **No opaque-calldata (unknown contract) grant type.** The architecture describes a category for unrecognised contracts, but no policy implements it yet. Any transaction that is not a plain ETH transfer or a known ERC-20 transfer is unconditionally rejected.
- **Token registry is static.** Tokens are recognised only if they appear in the hard-coded `arbiter_tokens_registry` crate. There is no mechanism to register additional contracts at runtime. - **Token registry is static.** Tokens are recognised only if they appear in the hard-coded `arbiter_tokens_registry` crate. There is no mechanism to register additional contracts at runtime.
--- ---
## Memory Protection ## Memory Protection
The unsealed root key must be held in a hardened memory cell resistant to dumps, page swaps, and hibernation. The unsealed root key must be held in a hardened memory cell resistant to dumps, page swaps, and hibernation.
- **Current:** A dedicated memory-protection abstraction is in place, with `memsafe` used behind that abstraction today - **Current:** A dedicated memory-protection abstraction is in place, with `memsafe` used behind that abstraction today
- **Planned:** Additional backends can be introduced behind the same abstraction, including a custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows) - **Planned:** Additional backends can be introduced behind the same abstraction, including a custom implementation based on `mlock` (Unix) and `VirtualProtect` (Windows)

2616
docs/superpowers/plans/2026-03-28-grant-creation-refactor.md
View File

File diff suppressed because it is too large Load Diff

1642
docs/superpowers/plans/2026-03-28-grant-grid-view.md
View File

File diff suppressed because it is too large Load Diff

340
docs/superpowers/specs/2026-03-28-grant-grid-view-design.md
View File

@@ -1,170 +1,170 @@
# Grant Grid View — Design Spec # Grant Grid View — Design Spec
**Date:** 2026-03-28 **Date:** 2026-03-28
## Overview ## Overview
Add a "Grants" dashboard tab to the Flutter operator app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About. Add a "Grants" dashboard tab to the Flutter operator app that displays all EVM grants as a card-based grid. Each card shows a compact summary (type, chain, wallet address, client name) with a revoke action. The tab integrates into the existing `AdaptiveScaffold` navigation alongside Wallets, Clients, and About.
## Scope ## Scope
- New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs - New `walletAccessListProvider` for fetching wallet access entries with their DB row IDs
- New `EvmGrantsScreen` as a dashboard tab - New `EvmGrantsScreen` as a dashboard tab
- Grant card widget with enriched display (type, chain, wallet, client) - Grant card widget with enriched display (type, chain, wallet, client)
- Revoke action wired to existing `executeRevokeEvmGrant` mutation - Revoke action wired to existing `executeRevokeEvmGrant` mutation
- Dashboard tab bar and router updated - Dashboard tab bar and router updated
- New token-transfer accent color added to `Palette` - New token-transfer accent color added to `Palette`
**Out of scope:** Fixing grant creation (separate task). **Out of scope:** Fixing grant creation (separate task).
--- ---
## Data Layer ## Data Layer
### `walletAccessListProvider` ### `walletAccessListProvider`
**File:** `operator/lib/providers/sdk_clients/wallet_access_list.dart` **File:** `operator/lib/providers/sdk_clients/wallet_access_list.dart`
- `@riverpod` class, watches `connectionManagerProvider.future` - `@riverpod` class, watches `connectionManagerProvider.future`
- Returns `List<SdkClientWalletAccess>?` (null when not connected) - Returns `List<SdkClientWalletAccess>?` (null when not connected)
- Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId` - Each entry: `.id` (wallet_access_id), `.access.walletId`, `.access.sdkClientId`
- Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()` - Exposes a `refresh()` method following the same pattern as `EvmGrants.refresh()`
### Enrichment at render time (Approach A) ### Enrichment at render time (Approach A)
The `EvmGrantsScreen` watches four providers: The `EvmGrantsScreen` watches four providers:
1. `evmGrantsProvider` — the grant list 1. `evmGrantsProvider` — the grant list
2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id) 2. `walletAccessListProvider` — to resolve wallet_access_id → (wallet_id, sdk_client_id)
3. `evmProvider` — to resolve wallet_id → wallet address 3. `evmProvider` — to resolve wallet_id → wallet address
4. `sdkClientsProvider` — to resolve sdk_client_id → client name 4. `sdkClientsProvider` — to resolve sdk_client_id → client name
All lookups are in-memory Maps built inside the build method; no extra model class needed. All lookups are in-memory Maps built inside the build method; no extra model class needed.
Fallbacks: Fallbacks:
- Wallet address not found → `"Access #N"` where N is the wallet_access_id - Wallet address not found → `"Access #N"` where N is the wallet_access_id
- Client name not found → `"Client #N"` where N is the sdk_client_id - Client name not found → `"Client #N"` where N is the sdk_client_id
--- ---
## Route Structure ## Route Structure
``` ```
/dashboard /dashboard
/evm ← existing (Wallets tab) /evm ← existing (Wallets tab)
/clients ← existing (Clients tab) /clients ← existing (Clients tab)
/grants ← NEW (Grants tab) /grants ← NEW (Grants tab)
/about ← existing /about ← existing
/evm-grants/create ← existing push route (unchanged) /evm-grants/create ← existing push route (unchanged)
``` ```
### Changes to `router.dart` ### Changes to `router.dart`
Add inside dashboard children: Add inside dashboard children:
```dart ```dart
AutoRoute(page: EvmGrantsRoute.page, path: 'grants'), AutoRoute(page: EvmGrantsRoute.page, path: 'grants'),
``` ```
### Changes to `dashboard.dart` ### Changes to `dashboard.dart`
Add to `routes` list: Add to `routes` list:
```dart ```dart
const EvmGrantsRoute() const EvmGrantsRoute()
``` ```
Add `NavigationDestination`: Add `NavigationDestination`:
```dart ```dart
NavigationDestination( NavigationDestination(
icon: Icon(Icons.policy_outlined), icon: Icon(Icons.policy_outlined),
selectedIcon: Icon(Icons.policy), selectedIcon: Icon(Icons.policy),
label: 'Grants', label: 'Grants',
), ),
``` ```
--- ---
## Screen: `EvmGrantsScreen` ## Screen: `EvmGrantsScreen`
**File:** `operator/lib/screens/dashboard/evm/grants/grants.dart` **File:** `operator/lib/screens/dashboard/evm/grants/grants.dart`
``` ```
Scaffold Scaffold
└─ SafeArea └─ SafeArea
└─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider) └─ RefreshIndicator.adaptive (refreshes evmGrantsProvider + walletAccessListProvider)
└─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics) └─ ListView (BouncingScrollPhysics + AlwaysScrollableScrollPhysics)
├─ PageHeader ├─ PageHeader
│ title: 'EVM Grants' │ title: 'EVM Grants'
│ isBusy: evmGrantsProvider.isLoading │ isBusy: evmGrantsProvider.isLoading
│ actions: [CreateGrantButton, RefreshButton] │ actions: [CreateGrantButton, RefreshButton]
├─ SizedBox(height: 1.8.h) ├─ SizedBox(height: 1.8.h)
└─ <content> └─ <content>
``` ```
### State handling ### State handling
Matches the pattern from `EvmScreen` and `ClientsScreen`: Matches the pattern from `EvmScreen` and `ClientsScreen`:
| State | Display | | State | Display |
|---|---| |---|---|
| Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" | | Loading (no data yet) | `_StatePanel` with spinner, "Loading grants" |
| Error | `_StatePanel` with coral icon, error message, Retry button | | Error | `_StatePanel` with coral icon, error message, Retry button |
| No connection | `_StatePanel`, "No active server connection" | | No connection | `_StatePanel`, "No active server connection" |
| Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut | | Empty list | `_StatePanel`, "No grants yet", with Create Grant shortcut |
| Data | Column of `_GrantCard` widgets | | Data | Column of `_GrantCard` widgets |
### Header actions ### Header actions
**CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`. **CreateGrantButton:** `FilledButton.icon` with `Icons.add_rounded`, pushes `CreateEvmGrantRoute()` via `context.router.push(...)`.
**RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`. **RefreshButton:** `OutlinedButton.icon` with `Icons.refresh`, calls `ref.read(evmGrantsProvider.notifier).refresh()`.
--- ---
## Grant Card: `_GrantCard` ## Grant Card: `_GrantCard`
**Layout:** **Layout:**
``` ```
Container (rounded 24, Palette.cream bg, Palette.line border) Container (rounded 24, Palette.cream bg, Palette.line border)
└─ IntrinsicHeight > Row └─ IntrinsicHeight > Row
├─ Accent strip (0.8.w wide, full height, rounded left) ├─ Accent strip (0.8.w wide, full height, rounded left)
└─ Padding > Column └─ Padding > Column
├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton ├─ Row 1: TypeBadge + ChainChip + Spacer + RevokeButton
└─ Row 2: WalletText + "·" + ClientText └─ Row 2: WalletText + "·" + ClientText
``` ```
**Accent color by grant type:** **Accent color by grant type:**
- Ether transfer → `Palette.coral` - Ether transfer → `Palette.coral`
- Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`) - Token transfer → `Palette.token` (new entry in `Palette` — indigo, e.g. `Color(0xFF5C6BC0)`)
**TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`. **TypeBadge:** Small pill container with accent color background at 15% opacity, accent-colored text. Label: `'Ether'` or `'Token'`.
**ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color. **ChainChip:** Small container: `'Chain ${grant.shared.chainId}'`, muted ink color.
**WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family. **WalletText:** Short hex address (`0xabc...def`) from wallet lookup, `bodySmall`, monospace font family.
**ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink. **ClientText:** Client name from `sdkClientsProvider` lookup, or fallback string. `bodySmall`, muted ink.
**RevokeButton:** **RevokeButton:**
- `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'` - `OutlinedButton` with `Icons.block_rounded` icon, label `'Revoke'`
- `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))` - `foregroundColor: Palette.coral`, `side: BorderSide(color: Palette.coral.withValues(alpha: 0.4))`
- Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight - Disabled (replaced with `CircularProgressIndicator`) while `revokeEvmGrantMutation` is pending — note: this is a single global mutation, so all revoke buttons disable while any revoke is in flight
- On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error - On press: calls `executeRevokeEvmGrant(ref, grantId: grant.id)`; shows `SnackBar` on error
--- ---
## Adaptive Sizing ## Adaptive Sizing
All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values. All sizing uses `sizer` units (`1.h`, `1.w`, etc.). No hardcoded pixel values.
--- ---
## Files to Create / Modify ## Files to Create / Modify
| File | Action | | File | Action |
|---|---| |---|---|
| `lib/theme/palette.dart` | Modify — add `Palette.token` color | | `lib/theme/palette.dart` | Modify — add `Palette.token` color |
| `lib/providers/sdk_clients/wallet_access_list.dart` | Create | | `lib/providers/sdk_clients/wallet_access_list.dart` | Create |
| `lib/screens/dashboard/evm/grants/grants.dart` | Create | | `lib/screens/dashboard/evm/grants/grants.dart` | Create |
| `lib/router.dart` | Modify — add grants route to dashboard children | | `lib/router.dart` | Modify — add grants route to dashboard children |
| `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations | | `lib/screens/dashboard.dart` | Modify — add tab to routes list and NavigationDestinations |

48
mise.toml
View File

@@ -1,24 +1,24 @@
[tools] [tools]
"cargo:diesel_cli" = { version = "2.3.7", features = "sqlite,sqlite-bundled", default-features = "false" } "cargo:diesel_cli" = { version = "2.3.7", features = "sqlite,sqlite-bundled", default-features = "false" }
"cargo:cargo-audit" = "0.22.1" "cargo:cargo-audit" = "0.22.1"
"cargo:cargo-vet" = "0.10.2" "cargo:cargo-vet" = "0.10.2"
flutter = "3.41.7-stable" flutter = "3.41.7-stable"
protoc = "29.6" protoc = "29.6"
rust = { version = "1.95.0", components = "clippy,rust-analyzer" } rust = { version = "1.95.0", components = "clippy,rust-analyzer" }
"cargo:cargo-features-manager" = "0.12.0" "cargo:cargo-features-manager" = "0.12.0"
"cargo:cargo-nextest" = "0.9.133" "cargo:cargo-nextest" = "0.9.133"
"cargo:cargo-shear" = "latest" "cargo:cargo-shear" = "latest"
"cargo:cargo-insta" = "1.47.2" "cargo:cargo-insta" = "1.47.2"
python = "3.14.4" python = "3.14.4"
ast-grep = "0.42.1" ast-grep = "0.42.1"
"cargo:cargo-edit" = "0.13.10" "cargo:cargo-edit" = "0.13.10"
"cargo:cargo-mutants" = "27.0.0" "cargo:cargo-mutants" = "27.0.0"
"cargo:flutter_rust_bridge_codegen" = "2.12.0" "cargo:flutter_rust_bridge_codegen" = "2.12.0"
[tasks.codegen] [tasks.codegen]
sources = ['protobufs/*.proto', 'protobufs/**/*.proto'] sources = ['protobufs/*.proto', 'protobufs/**/*.proto']
outputs = ['useragent/lib/proto/**'] outputs = ['useragent/lib/proto/**']
run = ''' run = '''
dart pub global activate protoc_plugin && \ dart pub global activate protoc_plugin && \
protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort) protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
''' '''

32
protobufs/arbiter.proto
View File

@@ -1,16 +1,16 @@
syntax = "proto3"; syntax = "proto3";
package arbiter; package arbiter;
import "client.proto"; import "client.proto";
import "operator.proto"; import "operator.proto";
message ServerInfo { message ServerInfo {
string version = 1; string version = 1;
bytes cert_public_key = 2; bytes cert_public_key = 2;
} }
service ArbiterService { service ArbiterService {
rpc Client(stream arbiter.client.ClientRequest) returns (stream arbiter.client.ClientResponse); rpc Client(stream arbiter.client.ClientRequest) returns (stream arbiter.client.ClientResponse);
rpc Operator(stream arbiter.operator.OperatorRequest) returns (stream arbiter.operator.OperatorResponse); rpc Operator(stream arbiter.operator.OperatorRequest) returns (stream arbiter.operator.OperatorResponse);
} }

50
protobufs/client.proto
View File

@@ -1,25 +1,25 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client; package arbiter.client;
import "client/auth.proto"; import "client/auth.proto";
import "client/evm.proto"; import "client/evm.proto";
import "client/vault.proto"; import "client/vault.proto";
message ClientRequest { message ClientRequest {
int32 request_id = 4; int32 request_id = 4;
oneof payload { oneof payload {
auth.Request auth = 1; auth.Request auth = 1;
vault.Request vault = 2; vault.Request vault = 2;
evm.Request evm = 3; evm.Request evm = 3;
} }
} }
message ClientResponse { message ClientResponse {
optional int32 request_id = 7; optional int32 request_id = 7;
oneof payload { oneof payload {
auth.Response auth = 1; auth.Response auth = 1;
vault.Response vault = 2; vault.Response vault = 2;
evm.Response evm = 3; evm.Response evm = 3;
} }
} }

86
protobufs/client/auth.proto
View File

@@ -1,43 +1,43 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client.auth; package arbiter.client.auth;
import "shared/client.proto"; import "shared/client.proto";
message AuthChallengeRequest { message AuthChallengeRequest {
bytes pubkey = 1; bytes pubkey = 1;
arbiter.shared.ClientInfo client_info = 2; arbiter.shared.ClientInfo client_info = 2;
} }
message AuthChallenge { message AuthChallenge {
uint64 timestamp_nanos = 1; uint64 timestamp_nanos = 1;
bytes random = 2; bytes random = 2;
} }
message AuthChallengeSolution { message AuthChallengeSolution {
bytes signature = 1; bytes signature = 1;
} }
enum AuthResult { enum AuthResult {
AUTH_RESULT_UNSPECIFIED = 0; AUTH_RESULT_UNSPECIFIED = 0;
AUTH_RESULT_SUCCESS = 1; AUTH_RESULT_SUCCESS = 1;
AUTH_RESULT_INVALID_KEY = 2; AUTH_RESULT_INVALID_KEY = 2;
AUTH_RESULT_INVALID_SIGNATURE = 3; AUTH_RESULT_INVALID_SIGNATURE = 3;
AUTH_RESULT_APPROVAL_DENIED = 4; AUTH_RESULT_APPROVAL_DENIED = 4;
AUTH_RESULT_NO_OPERATORS_ONLINE = 5; AUTH_RESULT_NO_OPERATORS_ONLINE = 5;
AUTH_RESULT_INTERNAL = 6; AUTH_RESULT_INTERNAL = 6;
} }
message Request { message Request {
oneof payload { oneof payload {
AuthChallengeRequest challenge_request = 1; AuthChallengeRequest challenge_request = 1;
AuthChallengeSolution challenge_solution = 2; AuthChallengeSolution challenge_solution = 2;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
AuthChallenge challenge = 1; AuthChallenge challenge = 1;
AuthResult result = 2; AuthResult result = 2;
} }
} }

38
protobufs/client/evm.proto
View File

@@ -1,19 +1,19 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client.evm; package arbiter.client.evm;
import "evm.proto"; import "evm.proto";
message Request { message Request {
oneof payload { oneof payload {
arbiter.evm.EvmSignTransactionRequest sign_transaction = 1; arbiter.evm.EvmSignTransactionRequest sign_transaction = 1;
arbiter.evm.EvmAnalyzeTransactionRequest analyze_transaction = 2; arbiter.evm.EvmAnalyzeTransactionRequest analyze_transaction = 2;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.evm.EvmSignTransactionResponse sign_transaction = 1; arbiter.evm.EvmSignTransactionResponse sign_transaction = 1;
arbiter.evm.EvmAnalyzeTransactionResponse analyze_transaction = 2; arbiter.evm.EvmAnalyzeTransactionResponse analyze_transaction = 2;
} }
} }

36
protobufs/client/vault.proto
View File

@@ -1,18 +1,18 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.client.vault; package arbiter.client.vault;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
import "shared/vault.proto"; import "shared/vault.proto";
message Request { message Request {
oneof payload { oneof payload {
google.protobuf.Empty query_state = 1; google.protobuf.Empty query_state = 1;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.shared.VaultState state = 1; arbiter.shared.VaultState state = 1;
} }
} }

306
protobufs/evm.proto
View File

@@ -1,153 +1,153 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.evm; package arbiter.evm;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto"; import "google/protobuf/timestamp.proto";
import "shared/evm.proto"; import "shared/evm.proto";
enum EvmError { enum EvmError {
EVM_ERROR_UNSPECIFIED = 0; EVM_ERROR_UNSPECIFIED = 0;
EVM_ERROR_VAULT_SEALED = 1; EVM_ERROR_VAULT_SEALED = 1;
EVM_ERROR_INTERNAL = 2; EVM_ERROR_INTERNAL = 2;
} }
message WalletEntry { message WalletEntry {
int32 id = 1; int32 id = 1;
bytes address = 2; // 20-byte Ethereum address bytes address = 2; // 20-byte Ethereum address
} }
message WalletList { message WalletList {
repeated WalletEntry wallets = 1; repeated WalletEntry wallets = 1;
} }
message WalletCreateResponse { message WalletCreateResponse {
oneof result { oneof result {
WalletEntry wallet = 1; WalletEntry wallet = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
message WalletListResponse { message WalletListResponse {
oneof result { oneof result {
WalletList wallets = 1; WalletList wallets = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
// --- Grant types --- // --- Grant types ---
message TransactionRateLimit { message TransactionRateLimit {
uint32 count = 1; uint32 count = 1;
int64 window_secs = 2; int64 window_secs = 2;
} }
message VolumeRateLimit { message VolumeRateLimit {
bytes max_volume = 1; // U256 as big-endian bytes bytes max_volume = 1; // U256 as big-endian bytes
int64 window_secs = 2; int64 window_secs = 2;
} }
message SharedSettings { message SharedSettings {
int32 wallet_access_id = 1; int32 wallet_access_id = 1;
uint64 chain_id = 2; uint64 chain_id = 2;
optional google.protobuf.Timestamp valid_from = 3; optional google.protobuf.Timestamp valid_from = 3;
optional google.protobuf.Timestamp valid_until = 4; optional google.protobuf.Timestamp valid_until = 4;
optional bytes max_gas_fee_per_gas = 5; // U256 as big-endian bytes optional bytes max_gas_fee_per_gas = 5; // U256 as big-endian bytes
optional bytes max_priority_fee_per_gas = 6; // U256 as big-endian bytes optional bytes max_priority_fee_per_gas = 6; // U256 as big-endian bytes
optional TransactionRateLimit rate_limit = 7; optional TransactionRateLimit rate_limit = 7;
} }
message EtherTransferSettings { message EtherTransferSettings {
repeated bytes targets = 1; // list of 20-byte Ethereum addresses repeated bytes targets = 1; // list of 20-byte Ethereum addresses
VolumeRateLimit limit = 2; VolumeRateLimit limit = 2;
} }
message TokenTransferSettings { message TokenTransferSettings {
bytes token_contract = 1; // 20-byte Ethereum address bytes token_contract = 1; // 20-byte Ethereum address
optional bytes target = 2; // 20-byte Ethereum address; absent means any recipient allowed optional bytes target = 2; // 20-byte Ethereum address; absent means any recipient allowed
repeated VolumeRateLimit volume_limits = 3; repeated VolumeRateLimit volume_limits = 3;
} }
message SpecificGrant { message SpecificGrant {
oneof grant { oneof grant {
EtherTransferSettings ether_transfer = 1; EtherTransferSettings ether_transfer = 1;
TokenTransferSettings token_transfer = 2; TokenTransferSettings token_transfer = 2;
} }
} }
// --- Operator grant management --- // --- Operator grant management ---
message EvmGrantCreateRequest { message EvmGrantCreateRequest {
SharedSettings shared = 1; SharedSettings shared = 1;
SpecificGrant specific = 2; SpecificGrant specific = 2;
} }
message EvmGrantCreateResponse { message EvmGrantCreateResponse {
oneof result { oneof result {
int32 grant_id = 1; int32 grant_id = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
message EvmGrantDeleteRequest { message EvmGrantDeleteRequest {
int32 grant_id = 1; int32 grant_id = 1;
} }
message EvmGrantDeleteResponse { message EvmGrantDeleteResponse {
oneof result { oneof result {
google.protobuf.Empty ok = 1; google.protobuf.Empty ok = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
// Basic grant info returned in grant listings // Basic grant info returned in grant listings
message GrantEntry { message GrantEntry {
int32 id = 1; int32 id = 1;
int32 wallet_access_id = 2; int32 wallet_access_id = 2;
SharedSettings shared = 3; SharedSettings shared = 3;
SpecificGrant specific = 4; SpecificGrant specific = 4;
} }
message EvmGrantListRequest { message EvmGrantListRequest {
optional int32 wallet_access_id = 1; optional int32 wallet_access_id = 1;
} }
message EvmGrantListResponse { message EvmGrantListResponse {
oneof result { oneof result {
EvmGrantList grants = 1; EvmGrantList grants = 1;
EvmError error = 2; EvmError error = 2;
} }
} }
message EvmGrantList { message EvmGrantList {
repeated GrantEntry grants = 1; repeated GrantEntry grants = 1;
} }
// --- Client transaction operations --- // --- Client transaction operations ---
message EvmSignTransactionRequest { message EvmSignTransactionRequest {
bytes wallet_address = 1; // 20-byte Ethereum address bytes wallet_address = 1; // 20-byte Ethereum address
bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction (unsigned) bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction (unsigned)
} }
// oneof because signing and evaluation happen atomically — a signing failure // oneof because signing and evaluation happen atomically — a signing failure
// is always either an eval error or an internal error, never a partial success // is always either an eval error or an internal error, never a partial success
message EvmSignTransactionResponse { message EvmSignTransactionResponse {
oneof result { oneof result {
bytes signature = 1; // 65-byte signature: r[32] || s[32] || v[1] bytes signature = 1; // 65-byte signature: r[32] || s[32] || v[1]
arbiter.shared.evm.TransactionEvalError eval_error = 2; arbiter.shared.evm.TransactionEvalError eval_error = 2;
EvmError error = 3; EvmError error = 3;
} }
} }
message EvmAnalyzeTransactionRequest { message EvmAnalyzeTransactionRequest {
bytes wallet_address = 1; // 20-byte Ethereum address bytes wallet_address = 1; // 20-byte Ethereum address
bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction bytes rlp_transaction = 2; // RLP-encoded EIP-1559 transaction
} }
message EvmAnalyzeTransactionResponse { message EvmAnalyzeTransactionResponse {
oneof result { oneof result {
arbiter.shared.evm.SpecificMeaning meaning = 1; arbiter.shared.evm.SpecificMeaning meaning = 1;
arbiter.shared.evm.TransactionEvalError eval_error = 2; arbiter.shared.evm.TransactionEvalError eval_error = 2;
EvmError error = 3; EvmError error = 3;
} }
} }

56
protobufs/operator.proto
View File

@@ -1,28 +1,28 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator; package arbiter.operator;
import "operator/auth.proto"; import "operator/auth.proto";
import "operator/evm.proto"; import "operator/evm.proto";
import "operator/sdk_client.proto"; import "operator/sdk_client.proto";
import "operator/vault/vault.proto"; import "operator/vault/vault.proto";
message OperatorRequest { message OperatorRequest {
int32 id = 16; int32 id = 16;
oneof payload { oneof payload {
auth.Request auth = 1; auth.Request auth = 1;
vault.Request vault = 2; vault.Request vault = 2;
evm.Request evm = 3; evm.Request evm = 3;
sdk_client.Request sdk_client = 4; sdk_client.Request sdk_client = 4;
} }
} }
message OperatorResponse { message OperatorResponse {
optional int32 id = 16; optional int32 id = 16;
oneof payload { oneof payload {
auth.Response auth = 1; auth.Response auth = 1;
vault.Response vault = 2; vault.Response vault = 2;
evm.Response evm = 3; evm.Response evm = 3;
sdk_client.Response sdk_client = 4; sdk_client.Response sdk_client = 4;
} }
} }

82
protobufs/operator/auth.proto
View File

@@ -1,41 +1,41 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.auth; package arbiter.operator.auth;
message AuthChallengeRequest { message AuthChallengeRequest {
bytes pubkey = 1; bytes pubkey = 1;
optional string bootstrap_token = 2; optional string bootstrap_token = 2;
} }
message AuthChallenge { message AuthChallenge {
uint64 timestamp_nanos = 1; uint64 timestamp_nanos = 1;
bytes random = 2; bytes random = 2;
} }
message AuthChallengeSolution { message AuthChallengeSolution {
bytes signature = 1; bytes signature = 1;
} }
enum AuthResult { enum AuthResult {
AUTH_RESULT_UNSPECIFIED = 0; AUTH_RESULT_UNSPECIFIED = 0;
AUTH_RESULT_SUCCESS = 1; AUTH_RESULT_SUCCESS = 1;
AUTH_RESULT_INVALID_KEY = 2; AUTH_RESULT_INVALID_KEY = 2;
AUTH_RESULT_INVALID_SIGNATURE = 3; AUTH_RESULT_INVALID_SIGNATURE = 3;
AUTH_RESULT_BOOTSTRAP_REQUIRED = 4; AUTH_RESULT_BOOTSTRAP_REQUIRED = 4;
AUTH_RESULT_TOKEN_INVALID = 5; AUTH_RESULT_TOKEN_INVALID = 5;
AUTH_RESULT_INTERNAL = 6; AUTH_RESULT_INTERNAL = 6;
} }
message Request { message Request {
oneof payload { oneof payload {
AuthChallengeRequest challenge_request = 1; AuthChallengeRequest challenge_request = 1;
AuthChallengeSolution challenge_solution = 2; AuthChallengeSolution challenge_solution = 2;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
AuthChallenge challenge = 1; AuthChallenge challenge = 1;
AuthResult result = 2; AuthResult result = 2;
} }
} }

66
protobufs/operator/evm.proto
View File

@@ -1,33 +1,33 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.evm; package arbiter.operator.evm;
import "evm.proto"; import "evm.proto";
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
message SignTransactionRequest { message SignTransactionRequest {
int32 client_id = 1; int32 client_id = 1;
arbiter.evm.EvmSignTransactionRequest request = 2; arbiter.evm.EvmSignTransactionRequest request = 2;
} }
message Request { message Request {
oneof payload { oneof payload {
google.protobuf.Empty wallet_create = 1; google.protobuf.Empty wallet_create = 1;
google.protobuf.Empty wallet_list = 2; google.protobuf.Empty wallet_list = 2;
arbiter.evm.EvmGrantCreateRequest grant_create = 3; arbiter.evm.EvmGrantCreateRequest grant_create = 3;
arbiter.evm.EvmGrantDeleteRequest grant_delete = 4; arbiter.evm.EvmGrantDeleteRequest grant_delete = 4;
arbiter.evm.EvmGrantListRequest grant_list = 5; arbiter.evm.EvmGrantListRequest grant_list = 5;
SignTransactionRequest sign_transaction = 6; SignTransactionRequest sign_transaction = 6;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.evm.WalletCreateResponse wallet_create = 1; arbiter.evm.WalletCreateResponse wallet_create = 1;
arbiter.evm.WalletListResponse wallet_list = 2; arbiter.evm.WalletListResponse wallet_list = 2;
arbiter.evm.EvmGrantCreateResponse grant_create = 3; arbiter.evm.EvmGrantCreateResponse grant_create = 3;
arbiter.evm.EvmGrantDeleteResponse grant_delete = 4; arbiter.evm.EvmGrantDeleteResponse grant_delete = 4;
arbiter.evm.EvmGrantListResponse grant_list = 5; arbiter.evm.EvmGrantListResponse grant_list = 5;
arbiter.evm.EvmSignTransactionResponse sign_transaction = 6; arbiter.evm.EvmSignTransactionResponse sign_transaction = 6;
} }
} }

200
protobufs/operator/sdk_client.proto
View File

@@ -1,100 +1,100 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.sdk_client; package arbiter.operator.sdk_client;
import "shared/client.proto"; import "shared/client.proto";
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
enum Error { enum Error {
ERROR_UNSPECIFIED = 0; ERROR_UNSPECIFIED = 0;
ERROR_ALREADY_EXISTS = 1; ERROR_ALREADY_EXISTS = 1;
ERROR_NOT_FOUND = 2; ERROR_NOT_FOUND = 2;
ERROR_HAS_RELATED_DATA = 3; // hard-delete blocked by FK (client has grants or transaction logs) ERROR_HAS_RELATED_DATA = 3; // hard-delete blocked by FK (client has grants or transaction logs)
ERROR_INTERNAL = 4; ERROR_INTERNAL = 4;
} }
message RevokeRequest { message RevokeRequest {
int32 client_id = 1; int32 client_id = 1;
} }
message Entry { message Entry {
int32 id = 1; int32 id = 1;
bytes pubkey = 2; bytes pubkey = 2;
arbiter.shared.ClientInfo info = 3; arbiter.shared.ClientInfo info = 3;
int32 created_at = 4; int32 created_at = 4;
} }
message List { message List {
repeated Entry clients = 1; repeated Entry clients = 1;
} }
message RevokeResponse { message RevokeResponse {
oneof result { oneof result {
google.protobuf.Empty ok = 1; google.protobuf.Empty ok = 1;
Error error = 2; Error error = 2;
} }
} }
message ListResponse { message ListResponse {
oneof result { oneof result {
List clients = 1; List clients = 1;
Error error = 2; Error error = 2;
} }
} }
message ConnectionRequest { message ConnectionRequest {
bytes pubkey = 1; bytes pubkey = 1;
arbiter.shared.ClientInfo info = 2; arbiter.shared.ClientInfo info = 2;
} }
message ConnectionResponse { message ConnectionResponse {
bool approved = 1; bool approved = 1;
bytes pubkey = 2; bytes pubkey = 2;
} }
message ConnectionCancel { message ConnectionCancel {
bytes pubkey = 1; bytes pubkey = 1;
} }
message WalletAccess { message WalletAccess {
int32 wallet_id = 1; int32 wallet_id = 1;
int32 sdk_client_id = 2; int32 sdk_client_id = 2;
} }
message WalletAccessEntry { message WalletAccessEntry {
int32 id = 1; int32 id = 1;
WalletAccess access = 2; WalletAccess access = 2;
} }
message GrantWalletAccess { message GrantWalletAccess {
repeated WalletAccess accesses = 1; repeated WalletAccess accesses = 1;
} }
message RevokeWalletAccess { message RevokeWalletAccess {
repeated int32 accesses = 1; repeated int32 accesses = 1;
} }
message ListWalletAccessResponse { message ListWalletAccessResponse {
repeated WalletAccessEntry accesses = 1; repeated WalletAccessEntry accesses = 1;
} }
message Request { message Request {
oneof payload { oneof payload {
ConnectionResponse connection_response = 1; ConnectionResponse connection_response = 1;
RevokeRequest revoke = 2; RevokeRequest revoke = 2;
google.protobuf.Empty list = 3; google.protobuf.Empty list = 3;
GrantWalletAccess grant_wallet_access = 4; GrantWalletAccess grant_wallet_access = 4;
RevokeWalletAccess revoke_wallet_access = 5; RevokeWalletAccess revoke_wallet_access = 5;
google.protobuf.Empty list_wallet_access = 6; google.protobuf.Empty list_wallet_access = 6;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
ConnectionRequest connection_request = 1; ConnectionRequest connection_request = 1;
ConnectionCancel connection_cancel = 2; ConnectionCancel connection_cancel = 2;
RevokeResponse revoke = 3; RevokeResponse revoke = 3;
ListResponse list = 4; ListResponse list = 4;
ListWalletAccessResponse list_wallet_access = 5; ListWalletAccessResponse list_wallet_access = 5;
} }
} }

48
protobufs/operator/vault/bootstrap.proto
View File

@@ -1,24 +1,24 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.vault.bootstrap; package arbiter.operator.vault.bootstrap;
message BootstrapEncryptedKey { message BootstrapEncryptedKey {
bytes nonce = 1; bytes nonce = 1;
bytes ciphertext = 2; bytes ciphertext = 2;
bytes associated_data = 3; bytes associated_data = 3;
} }
enum BootstrapResult { enum BootstrapResult {
BOOTSTRAP_RESULT_UNSPECIFIED = 0; BOOTSTRAP_RESULT_UNSPECIFIED = 0;
BOOTSTRAP_RESULT_SUCCESS = 1; BOOTSTRAP_RESULT_SUCCESS = 1;
BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2; BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
BOOTSTRAP_RESULT_INVALID_KEY = 3; BOOTSTRAP_RESULT_INVALID_KEY = 3;
} }
message Request { message Request {
BootstrapEncryptedKey encrypted_key = 2; BootstrapEncryptedKey encrypted_key = 2;
} }
message Response { message Response {
BootstrapResult result = 1; BootstrapResult result = 1;
} }

74
protobufs/operator/vault/unseal.proto
View File

@@ -1,37 +1,37 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.vault.unseal; package arbiter.operator.vault.unseal;
message UnsealStart { message UnsealStart {
bytes client_pubkey = 1; bytes client_pubkey = 1;
} }
message UnsealStartResponse { message UnsealStartResponse {
bytes server_pubkey = 1; bytes server_pubkey = 1;
} }
message UnsealEncryptedKey { message UnsealEncryptedKey {
bytes nonce = 1; bytes nonce = 1;
bytes ciphertext = 2; bytes ciphertext = 2;
bytes associated_data = 3; bytes associated_data = 3;
} }
enum UnsealResult { enum UnsealResult {
UNSEAL_RESULT_UNSPECIFIED = 0; UNSEAL_RESULT_UNSPECIFIED = 0;
UNSEAL_RESULT_SUCCESS = 1; UNSEAL_RESULT_SUCCESS = 1;
UNSEAL_RESULT_INVALID_KEY = 2; UNSEAL_RESULT_INVALID_KEY = 2;
UNSEAL_RESULT_UNBOOTSTRAPPED = 3; UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
} }
message Request { message Request {
oneof payload { oneof payload {
UnsealStart start = 1; UnsealStart start = 1;
UnsealEncryptedKey encrypted_key = 2; UnsealEncryptedKey encrypted_key = 2;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
UnsealStartResponse start = 1; UnsealStartResponse start = 1;
UnsealResult result = 2; UnsealResult result = 2;
} }
} }

48
protobufs/operator/vault/vault.proto
View File

@@ -1,24 +1,24 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.operator.vault; package arbiter.operator.vault;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
import "shared/vault.proto"; import "shared/vault.proto";
import "operator/vault/bootstrap.proto"; import "operator/vault/bootstrap.proto";
import "operator/vault/unseal.proto"; import "operator/vault/unseal.proto";
message Request { message Request {
oneof payload { oneof payload {
google.protobuf.Empty query_state = 1; google.protobuf.Empty query_state = 1;
unseal.Request unseal = 2; unseal.Request unseal = 2;
bootstrap.Request bootstrap = 3; bootstrap.Request bootstrap = 3;
} }
} }
message Response { message Response {
oneof payload { oneof payload {
arbiter.shared.VaultState state = 1; arbiter.shared.VaultState state = 1;
unseal.Response unseal = 2; unseal.Response unseal = 2;
bootstrap.Response bootstrap = 3; bootstrap.Response bootstrap = 3;
} }
} }

18
protobufs/shared/client.proto
View File

@@ -1,9 +1,9 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.shared; package arbiter.shared;
message ClientInfo { message ClientInfo {
string name = 1; string name = 1;
optional string description = 2; optional string description = 2;
optional string version = 3; optional string version = 3;
} }

148
protobufs/shared/evm.proto
View File

@@ -1,74 +1,74 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.shared.evm; package arbiter.shared.evm;
import "google/protobuf/empty.proto"; import "google/protobuf/empty.proto";
message EtherTransferMeaning { message EtherTransferMeaning {
bytes to = 1; // 20-byte Ethereum address bytes to = 1; // 20-byte Ethereum address
bytes value = 2; // U256 as big-endian bytes bytes value = 2; // U256 as big-endian bytes
} }
message TokenInfo { message TokenInfo {
string symbol = 1; string symbol = 1;
bytes address = 2; // 20-byte Ethereum address bytes address = 2; // 20-byte Ethereum address
uint64 chain_id = 3; uint64 chain_id = 3;
} }
// Mirror of token_transfers::Meaning // Mirror of token_transfers::Meaning
message TokenTransferMeaning { message TokenTransferMeaning {
TokenInfo token = 1; TokenInfo token = 1;
bytes to = 2; // 20-byte Ethereum address bytes to = 2; // 20-byte Ethereum address
bytes value = 3; // U256 as big-endian bytes bytes value = 3; // U256 as big-endian bytes
} }
// Mirror of policies::SpecificMeaning // Mirror of policies::SpecificMeaning
message SpecificMeaning { message SpecificMeaning {
oneof meaning { oneof meaning {
EtherTransferMeaning ether_transfer = 1; EtherTransferMeaning ether_transfer = 1;
TokenTransferMeaning token_transfer = 2; TokenTransferMeaning token_transfer = 2;
} }
} }
message GasLimitExceededViolation { message GasLimitExceededViolation {
optional bytes max_gas_fee_per_gas = 1; // U256 as big-endian bytes optional bytes max_gas_fee_per_gas = 1; // U256 as big-endian bytes
optional bytes max_priority_fee_per_gas = 2; // U256 as big-endian bytes optional bytes max_priority_fee_per_gas = 2; // U256 as big-endian bytes
} }
message EvalViolation { message EvalViolation {
message ChainIdMismatch { message ChainIdMismatch {
uint64 expected = 1; uint64 expected = 1;
uint64 actual = 2; uint64 actual = 2;
} }
oneof kind { oneof kind {
bytes invalid_target = 1; // 20-byte Ethereum address bytes invalid_target = 1; // 20-byte Ethereum address
GasLimitExceededViolation gas_limit_exceeded = 2; GasLimitExceededViolation gas_limit_exceeded = 2;
google.protobuf.Empty rate_limit_exceeded = 3; google.protobuf.Empty rate_limit_exceeded = 3;
google.protobuf.Empty volumetric_limit_exceeded = 4; google.protobuf.Empty volumetric_limit_exceeded = 4;
google.protobuf.Empty invalid_time = 5; google.protobuf.Empty invalid_time = 5;
google.protobuf.Empty invalid_transaction_type = 6; google.protobuf.Empty invalid_transaction_type = 6;
ChainIdMismatch chain_id_mismatch = 7; ChainIdMismatch chain_id_mismatch = 7;
} }
} }
// Transaction was classified but no grant covers it // Transaction was classified but no grant covers it
message NoMatchingGrantError { message NoMatchingGrantError {
SpecificMeaning meaning = 1; SpecificMeaning meaning = 1;
} }
// Transaction was classified and a grant was found, but constraints were violated // Transaction was classified and a grant was found, but constraints were violated
message PolicyViolationsError { message PolicyViolationsError {
SpecificMeaning meaning = 1; SpecificMeaning meaning = 1;
repeated EvalViolation violations = 2; repeated EvalViolation violations = 2;
} }
// top-level error returned when transaction evaluation fails // top-level error returned when transaction evaluation fails
message TransactionEvalError { message TransactionEvalError {
oneof kind { oneof kind {
google.protobuf.Empty contract_creation_not_supported = 1; google.protobuf.Empty contract_creation_not_supported = 1;
google.protobuf.Empty unsupported_transaction_type = 2; google.protobuf.Empty unsupported_transaction_type = 2;
NoMatchingGrantError no_matching_grant = 3; NoMatchingGrantError no_matching_grant = 3;
PolicyViolationsError policy_violations = 4; PolicyViolationsError policy_violations = 4;
} }
} }

22
protobufs/shared/vault.proto
View File

@@ -1,11 +1,11 @@
syntax = "proto3"; syntax = "proto3";
package arbiter.shared; package arbiter.shared;
enum VaultState { enum VaultState {
VAULT_STATE_UNSPECIFIED = 0; VAULT_STATE_UNSPECIFIED = 0;
VAULT_STATE_UNBOOTSTRAPPED = 1; VAULT_STATE_UNBOOTSTRAPPED = 1;
VAULT_STATE_SEALED = 2; VAULT_STATE_SEALED = 2;
VAULT_STATE_UNSEALED = 3; VAULT_STATE_UNSEALED = 3;
VAULT_STATE_ERROR = 4; VAULT_STATE_ERROR = 4;
} }

300
scripts/gen_erc20_registry.py
View File

@@ -1,150 +1,150 @@
#!/usr/bin/env python3 #!/usr/bin/env python3
""" """
Fetch the Uniswap default token list and emit Rust `TokenInfo` statics. Fetch the Uniswap default token list and emit Rust `TokenInfo` statics.
Usage: Usage:
python3 gen_erc20_registry.py # fetch from IPFS python3 gen_erc20_registry.py # fetch from IPFS
python3 gen_erc20_registry.py tokens.json # local file python3 gen_erc20_registry.py tokens.json # local file
python3 gen_erc20_registry.py tokens.json out.rs # custom output file python3 gen_erc20_registry.py tokens.json out.rs # custom output file
""" """
import json import json
import re import re
import sys import sys
import unicodedata import unicodedata
import urllib.request import urllib.request
UNISWAP_URL = "https://ipfs.io/ipns/tokens.uniswap.org" UNISWAP_URL = "https://ipfs.io/ipns/tokens.uniswap.org"
SOLANA_CHAIN_ID = 501000101 SOLANA_CHAIN_ID = 501000101
IDENTIFIER_RE = re.compile(r"[^A-Za-z0-9]+") IDENTIFIER_RE = re.compile(r"[^A-Za-z0-9]+")
def load_tokens(source=None): def load_tokens(source=None):
if source: if source:
with open(source) as f: with open(source) as f:
return json.load(f) return json.load(f)
req = urllib.request.Request( req = urllib.request.Request(
UNISWAP_URL, UNISWAP_URL,
headers={"Accept": "application/json", "User-Agent": "gen_tokens/1.0"}, headers={"Accept": "application/json", "User-Agent": "gen_tokens/1.0"},
) )
with urllib.request.urlopen(req, timeout=60) as resp: with urllib.request.urlopen(req, timeout=60) as resp:
return json.loads(resp.read()) return json.loads(resp.read())
def escape(s: str) -> str: def escape(s: str) -> str:
return s.replace("\\", "\\\\").replace('"', '\\"') return s.replace("\\", "\\\\").replace('"', '\\"')
def to_screaming_case(name: str) -> str: def to_screaming_case(name: str) -> str:
normalized = unicodedata.normalize("NFKD", name or "") normalized = unicodedata.normalize("NFKD", name or "")
ascii_name = normalized.encode("ascii", "ignore").decode("ascii") ascii_name = normalized.encode("ascii", "ignore").decode("ascii")
snake = IDENTIFIER_RE.sub("_", ascii_name).strip("_").upper() snake = IDENTIFIER_RE.sub("_", ascii_name).strip("_").upper()
if not snake: if not snake:
snake = "TOKEN" snake = "TOKEN"
if snake[0].isdigit(): if snake[0].isdigit():
snake = f"TOKEN_{snake}" snake = f"TOKEN_{snake}"
return snake return snake
def static_name_for_token(token: dict, used_names: set[str]) -> str: def static_name_for_token(token: dict, used_names: set[str]) -> str:
base = to_screaming_case(token.get("name", "")) base = to_screaming_case(token.get("name", ""))
if base not in used_names: if base not in used_names:
used_names.add(base) used_names.add(base)
return base return base
address = token["address"] address = token["address"]
suffix = f"{token['chainId']}_{address[2:].upper()[-8:]}" suffix = f"{token['chainId']}_{address[2:].upper()[-8:]}"
candidate = f"{base}_{suffix}" candidate = f"{base}_{suffix}"
i = 2 i = 2
while candidate in used_names: while candidate in used_names:
candidate = f"{base}_{suffix}_{i}" candidate = f"{base}_{suffix}_{i}"
i += 1 i += 1
used_names.add(candidate) used_names.add(candidate)
return candidate return candidate
def main(): def main():
source = sys.argv[1] if len(sys.argv) > 1 else None source = sys.argv[1] if len(sys.argv) > 1 else None
output = sys.argv[2] if len(sys.argv) > 2 else "generated_tokens.rs" output = sys.argv[2] if len(sys.argv) > 2 else "generated_tokens.rs"
data = load_tokens(source) data = load_tokens(source)
tokens = data["tokens"] tokens = data["tokens"]
# Deduplicate by (chainId, address) # Deduplicate by (chainId, address)
seen = set() seen = set()
unique = [] unique = []
for t in tokens: for t in tokens:
key = (t["chainId"], t["address"].lower()) key = (t["chainId"], t["address"].lower())
if key not in seen: if key not in seen:
seen.add(key) seen.add(key)
unique.append(t) unique.append(t)
unique.sort(key=lambda t: (t["chainId"], t.get("symbol", "").upper())) unique.sort(key=lambda t: (t["chainId"], t.get("symbol", "").upper()))
evm_tokens = [t for t in unique if t["chainId"] != SOLANA_CHAIN_ID] evm_tokens = [t for t in unique if t["chainId"] != SOLANA_CHAIN_ID]
ver = data["version"] ver = data["version"]
lines = [] lines = []
w = lines.append w = lines.append
w( w(
f"// Auto-generated from Uniswap token list v{ver['major']}.{ver['minor']}.{ver['patch']}" f"// Auto-generated from Uniswap token list v{ver['major']}.{ver['minor']}.{ver['patch']}"
) )
w(f"// {len(evm_tokens)} tokens") w(f"// {len(evm_tokens)} tokens")
w("// DO NOT EDIT - regenerate with gen_erc20_registry.py") w("// DO NOT EDIT - regenerate with gen_erc20_registry.py")
w("") w("")
used_static_names = set() used_static_names = set()
token_statics = [] token_statics = []
for t in evm_tokens: for t in evm_tokens:
static_name = static_name_for_token(t, used_static_names) static_name = static_name_for_token(t, used_static_names)
token_statics.append((static_name, t)) token_statics.append((static_name, t))
for static_name, t in token_statics: for static_name, t in token_statics:
addr = t["address"] addr = t["address"]
name = escape(t.get("name", "")) name = escape(t.get("name", ""))
symbol = escape(t.get("symbol", "")) symbol = escape(t.get("symbol", ""))
decimals = t.get("decimals", 18) decimals = t.get("decimals", 18)
logo = t.get("logoURI") logo = t.get("logoURI")
chain = t["chainId"] chain = t["chainId"]
logo_val = f'Some("{escape(logo)}")' if logo else "None" logo_val = f'Some("{escape(logo)}")' if logo else "None"
w(f"pub static {static_name}: TokenInfo = TokenInfo {{") w(f"pub static {static_name}: TokenInfo = TokenInfo {{")
w(f' name: "{name}",') w(f' name: "{name}",')
w(f' symbol: "{symbol}",') w(f' symbol: "{symbol}",')
w(f" decimals: {decimals},") w(f" decimals: {decimals},")
w(f' contract: address!("{addr}"),') w(f' contract: address!("{addr}"),')
w(f" chain: {chain},") w(f" chain: {chain},")
w(f" logo_uri: {logo_val},") w(f" logo_uri: {logo_val},")
w("};") w("};")
w("") w("")
w("pub static TOKENS: &[&TokenInfo] = &[") w("pub static TOKENS: &[&TokenInfo] = &[")
for static_name, _ in token_statics: for static_name, _ in token_statics:
w(f" &{static_name},") w(f" &{static_name},")
w("];") w("];")
w("") w("")
w("pub fn get_token(") w("pub fn get_token(")
w(" chain_id: alloy::primitives::ChainId,") w(" chain_id: alloy::primitives::ChainId,")
w(" address: alloy::primitives::Address,") w(" address: alloy::primitives::Address,")
w(") -> Option<&'static TokenInfo> {") w(") -> Option<&'static TokenInfo> {")
w(" match (chain_id, address) {") w(" match (chain_id, address) {")
for static_name, t in token_statics: for static_name, t in token_statics:
w( w(
f' ({t["chainId"]}, addr) if addr == address!("{t["address"]}") => Some(&{static_name}),' f' ({t["chainId"]}, addr) if addr == address!("{t["address"]}") => Some(&{static_name}),'
) )
w(" _ => None,") w(" _ => None,")
w(" }") w(" }")
w("}") w("}")
w("") w("")
with open(output, "w") as f: with open(output, "w") as f:
f.write("\n".join(lines)) f.write("\n".join(lines))
print(f"Wrote {len(token_statics)} tokens to {output}") print(f"Wrote {len(token_statics)} tokens to {output}")
if __name__ == "__main__": if __name__ == "__main__":
main() main()

26
server/.cargo/audit.toml
View File

@@ -1,13 +1,13 @@
[advisories] [advisories]
# RUSTSEC-2023-0071: Marvin Attack timing side-channel in rsa crate. # RUSTSEC-2023-0071: Marvin Attack timing side-channel in rsa crate.
# No fixed version is available upstream. # No fixed version is available upstream.
# RSA support is required for Windows Hello / KeyCredentialManager # RSA support is required for Windows Hello / KeyCredentialManager
# (https://learn.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager.requestcreateasync), # (https://learn.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager.requestcreateasync),
# which only issues RSA-2048 keys. # which only issues RSA-2048 keys.
# Mitigations in place: # Mitigations in place:
# - Signing uses BlindedSigningKey (PSS+SHA-256), which applies blinding to # - Signing uses BlindedSigningKey (PSS+SHA-256), which applies blinding to
# protect the private key from timing recovery during signing. # protect the private key from timing recovery during signing.
# - RSA decryption is never performed; we only verify public-key signatures. # - RSA decryption is never performed; we only verify public-key signatures.
# - The attack requires local, high-resolution timing access against the # - The attack requires local, high-resolution timing access against the
# signing process, which is not exposed in our threat model. # signing process, which is not exposed in our threat model.
ignore = ["RUSTSEC-2023-0071"] ignore = ["RUSTSEC-2023-0071"]

4
server/.cargo/config.toml
View File

@@ -1,2 +1,2 @@
[env] [env]
MACOSX_DEPLOYMENT_TARGET = "26.3" MACOSX_DEPLOYMENT_TARGET = "26.3"

2
server/.cargo/mutants.toml
View File

@@ -1 +1 @@
test_tool = "nextest" test_tool = "nextest"

2
server/.gitignore vendored
View File

@@ -1,2 +1,2 @@
mutants.out/ mutants.out/
mutants.out.old/ mutants.out.old/

12753
server/Cargo.lock generated
View File

File diff suppressed because it is too large Load Diff

341
server/Cargo.toml
View File

@@ -1,171 +1,170 @@
[workspace] [workspace]
members = [ members = [
"crates/*", "crates/*",
] ]
resolver = "3" resolver = "3"
[workspace.dependencies] [workspace.dependencies]
alloy = "2.0.4" alloy = "2.0.4"
async-trait = "0.1.89" async-trait = "0.1.89"
base64 = "0.22.1" base64 = "0.22.1"
chrono = { version = "0.4.44", features = ["serde"] } chrono = { version = "0.4.44", features = ["serde"] }
futures = "0.3.32" futures = "0.3.32"
k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] } k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"} kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"} kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
hmac = "0.13.0" hmac = "0.13.0"
miette = { version = "7.6.0", features = ["fancy", "serde"] } miette = { version = "7.6.0", features = ["fancy", "serde"] }
ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] } ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
mutants = "0.0.4" mutants = "0.0.4"
prost = "0.14.3" prost = "0.14.3"
prost-types = { version = "0.14.3", features = ["chrono"] } prost-types = { version = "0.14.3", features = ["chrono"] }
rand = "0.10.1" rand = "0.10.1"
rcgen = { version = "0.14.7", features = [ "aws_lc_rs", "pem", "x509-parser", "zeroize" ], default-features = false } rcgen = { version = "0.14.7", features = [ "aws_lc_rs", "pem", "x509-parser", "zeroize" ], default-features = false }
rstest = "0.26.1" rstest = "0.26.1"
rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false } rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
rustls-pki-types = "1.14.1" rustls-pki-types = "1.14.1"
sha2 = "0.11" sha2 = "0.11"
smlang = "0.8.0" smlang = "0.8.0"
thiserror = "2.0.18" thiserror = "2.0.18"
tokio = { version = "1.52.1", features = ["full"] } tokio = { version = "1.52.1", features = ["full"] }
tokio-stream = { version = "0.1.18", features = ["full"] } tokio-stream = { version = "0.1.18", features = ["full"] }
tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] } tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
tracing = "0.1.44" tracing = "0.1.44"
x25519-dalek = { version = "2.0.1", features = ["getrandom"] } x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
[workspace.lints.rust] [workspace.lints.rust]
missing_unsafe_on_extern = "deny" missing_unsafe_on_extern = "deny"
unsafe_attr_outside_unsafe = "deny" unsafe_attr_outside_unsafe = "deny"
unsafe_op_in_unsafe_fn = "deny" unsafe_op_in_unsafe_fn = "deny"
unstable_features = "deny" unstable_features = "deny"
deprecated_safe_2024 = "warn" deprecated_safe_2024 = "warn"
ffi_unwind_calls = "warn" ffi_unwind_calls = "warn"
linker_messages = "warn" linker_messages = "warn"
elided_lifetimes_in_paths = "warn" elided_lifetimes_in_paths = "warn"
explicit_outlives_requirements = "warn" explicit_outlives_requirements = "warn"
impl-trait-overcaptures = "warn" impl-trait-overcaptures = "warn"
impl-trait-redundant-captures = "warn" impl-trait-redundant-captures = "warn"
redundant_lifetimes = "warn" redundant_lifetimes = "warn"
single_use_lifetimes = "warn" single_use_lifetimes = "warn"
unused_lifetimes = "warn" unused_lifetimes = "warn"
macro_use_extern_crate = "warn" macro_use_extern_crate = "warn"
redundant_imports = "warn" redundant_imports = "warn"
unused_import_braces = "warn" unused_import_braces = "warn"
unused_macro_rules = "warn" unused_macro_rules = "warn"
unused_qualifications = "warn" unused_qualifications = "warn"
unit_bindings = "warn" unit_bindings = "warn"
# missing_docs = "warn" # ENABLE BY THE FIRST MAJOR VERSION!! # missing_docs = "warn" # ENABLE BY THE FIRST MAJOR VERSION!!
unnameable_types = "warn" unnameable_types = "warn"
[workspace.lints.clippy] [workspace.lints.clippy]
derive_partial_eq_without_eq = "allow" derive_partial_eq_without_eq = "allow"
future_not_send = "allow" future_not_send = "allow"
inconsistent_struct_constructor = "allow" inconsistent_struct_constructor = "allow"
inline_always = "allow" inline_always = "allow"
missing_errors_doc = "allow" missing_errors_doc = "allow"
missing_fields_in_debug = "allow" missing_fields_in_debug = "allow"
missing_panics_doc = "allow" missing_panics_doc = "allow"
must_use_candidate = "allow" must_use_candidate = "allow"
needless_pass_by_ref_mut = "allow" needless_pass_by_ref_mut = "allow"
pub_underscore_fields = "allow" pub_underscore_fields = "allow"
redundant_pub_crate = "allow" redundant_pub_crate = "allow"
uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {}) uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability
# restriction lints # restriction lints
alloc_instead_of_core = "warn" alloc_instead_of_core = "warn"
allow_attributes_without_reason = "warn" allow_attributes_without_reason = "warn"
as_conversions = "warn" as_conversions = "warn"
assertions_on_result_states = "warn" assertions_on_result_states = "warn"
cfg_not_test = "warn" cfg_not_test = "warn"
clone_on_ref_ptr = "warn" clone_on_ref_ptr = "warn"
cognitive_complexity = "warn" cognitive_complexity = "warn"
create_dir = "warn" create_dir = "warn"
dbg_macro = "warn" dbg_macro = "warn"
decimal_literal_representation = "warn" decimal_literal_representation = "warn"
default_union_representation = "warn" default_union_representation = "warn"
deref_by_slicing = "warn" deref_by_slicing = "warn"
disallowed_script_idents = "warn" disallowed_script_idents = "warn"
doc_include_without_cfg = "warn" doc_include_without_cfg = "warn"
empty_drop = "warn" empty_drop = "warn"
empty_enum_variants_with_brackets = "warn" empty_enum_variants_with_brackets = "warn"
empty_structs_with_brackets = "warn" empty_structs_with_brackets = "warn"
exit = "warn" exit = "warn"
filetype_is_file = "warn" filetype_is_file = "warn"
float_arithmetic = "warn" float_arithmetic = "warn"
float_cmp_const = "warn" float_cmp_const = "warn"
fn_to_numeric_cast_any = "warn" fn_to_numeric_cast_any = "warn"
get_unwrap = "warn" get_unwrap = "warn"
if_then_some_else_none = "warn" if_then_some_else_none = "warn"
indexing_slicing = "warn" indexing_slicing = "warn"
infinite_loop = "warn" infinite_loop = "warn"
inline_asm_x86_att_syntax = "warn" inline_asm_x86_att_syntax = "warn"
inline_asm_x86_intel_syntax = "warn" inline_asm_x86_intel_syntax = "warn"
integer_division = "warn" integer_division = "warn"
large_include_file = "warn" large_include_file = "warn"
lossy_float_literal = "warn" lossy_float_literal = "warn"
map_with_unused_argument_over_ranges = "warn" map_with_unused_argument_over_ranges = "warn"
mem_forget = "warn" mem_forget = "warn"
missing_assert_message = "warn" missing_assert_message = "warn"
mixed_read_write_in_expression = "warn" mixed_read_write_in_expression = "warn"
modulo_arithmetic = "warn" modulo_arithmetic = "warn"
multiple_unsafe_ops_per_block = "warn" multiple_unsafe_ops_per_block = "warn"
mutex_atomic = "warn" mutex_atomic = "warn"
mutex_integer = "warn" mutex_integer = "warn"
needless_raw_strings = "warn" needless_raw_strings = "warn"
non_ascii_literal = "warn" non_ascii_literal = "warn"
non_zero_suggestions = "warn" non_zero_suggestions = "warn"
pathbuf_init_then_push = "warn" pathbuf_init_then_push = "warn"
pointer_format = "warn" pointer_format = "warn"
precedence_bits = "warn" precedence_bits = "warn"
pub_without_shorthand = "warn" pub_without_shorthand = "warn"
rc_buffer = "warn" rc_buffer = "warn"
rc_mutex = "warn" rc_mutex = "warn"
redundant_test_prefix = "warn" redundant_test_prefix = "warn"
redundant_type_annotations = "warn" redundant_type_annotations = "warn"
ref_patterns = "warn" renamed_function_params = "warn"
renamed_function_params = "warn" rest_pat_in_fully_bound_structs = "warn"
rest_pat_in_fully_bound_structs = "warn" return_and_then = "warn"
return_and_then = "warn" semicolon_inside_block = "warn"
semicolon_inside_block = "warn" str_to_string = "warn"
str_to_string = "warn" string_add = "warn"
string_add = "warn" string_lit_chars_any = "warn"
string_lit_chars_any = "warn" string_slice = "warn"
string_slice = "warn" suspicious_xor_used_as_pow = "warn"
suspicious_xor_used_as_pow = "warn" try_err = "warn"
try_err = "warn" undocumented_unsafe_blocks = "warn"
undocumented_unsafe_blocks = "warn" uninlined_format_args = "warn"
uninlined_format_args = "warn" unnecessary_safety_comment = "warn"
unnecessary_safety_comment = "warn" unnecessary_safety_doc = "warn"
unnecessary_safety_doc = "warn" unnecessary_self_imports = "warn"
unnecessary_self_imports = "warn" unneeded_field_pattern = "warn"
unneeded_field_pattern = "warn" unused_result_ok = "warn"
unused_result_ok = "warn" verbose_file_reads = "warn"
verbose_file_reads = "warn"
# cargo lints
# cargo lints negative_feature_names = "warn"
negative_feature_names = "warn" redundant_feature_names = "warn"
redundant_feature_names = "warn" wildcard_dependencies = "warn"
wildcard_dependencies = "warn"
# ENABLE BY THE FIRST MAJOR VERSION!!
# ENABLE BY THE FIRST MAJOR VERSION!! # todo = "warn"
# todo = "warn" # unimplemented = "warn"
# unimplemented = "warn" # panic = "warn"
# panic = "warn" # panic_in_result_fn = "warn"
# panic_in_result_fn = "warn" #
# # cargo_common_metadata = "warn"
# cargo_common_metadata = "warn" # multiple_crate_versions = "warn" # a controversial option since it's really difficult to maintain
# multiple_crate_versions = "warn" # a controversial option since it's really difficult to maintain
disallowed_methods = "deny"
disallowed_methods = "deny"
nursery = { level = "warn", priority = -1 }
nursery = { level = "warn", priority = -1 } pedantic = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }
type_repetition_in_bounds = "allow" # sometimes, it's better for readability this way
type_repetition_in_bounds = "allow" # sometimes, it's better for readability this way

56
server/clippy.toml
View File

@@ -1,28 +1,28 @@
disallowed-methods = [ disallowed-methods = [
# RSA decryption is forbidden: the rsa crate has RUSTSEC-2023-0071 (Marvin Attack). # RSA decryption is forbidden: the rsa crate has RUSTSEC-2023-0071 (Marvin Attack).
# We only use RSA for Windows Hello (KeyCredentialManager) public-key verification — decryption # We only use RSA for Windows Hello (KeyCredentialManager) public-key verification — decryption
# is never required and must not be introduced. # is never required and must not be introduced.
{ path = "rsa::RsaPrivateKey::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." }, { path = "rsa::RsaPrivateKey::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." },
{ path = "rsa::RsaPrivateKey::decrypt_blinded", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." }, { path = "rsa::RsaPrivateKey::decrypt_blinded", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). Only PSS signing/verification is permitted." },
{ path = "rsa::traits::Decryptor::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt() on rsa::{pkcs1v15,oaep}::DecryptingKey." }, { path = "rsa::traits::Decryptor::decrypt", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
{ path = "rsa::traits::RandomizedDecryptor::decrypt_with_rng", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt_with_rng() on rsa::{pkcs1v15,oaep}::DecryptingKey." }, { path = "rsa::traits::RandomizedDecryptor::decrypt_with_rng", reason = "RSA decryption is forbidden (RUSTSEC-2023-0071 Marvin Attack). This blocks decrypt_with_rng() on rsa::{pkcs1v15,oaep}::DecryptingKey." },
] ]
allow-indexing-slicing-in-tests = true allow-indexing-slicing-in-tests = true
allow-panic-in-tests = true allow-panic-in-tests = true
check-inconsistent-struct-field-initializers = true check-inconsistent-struct-field-initializers = true
suppress-restriction-lint-in-const = true suppress-restriction-lint-in-const = true
allow-renamed-params-for = [ allow-renamed-params-for = [
"core::convert::From", "core::convert::From",
"core::convert::TryFrom", "core::convert::TryFrom",
"core::str::FromStr", "core::str::FromStr",
"kameo::actor::Actor", "kameo::actor::Actor",
] ]
module-items-ordered-within-groupings = ["UPPER_SNAKE_CASE"] module-items-ordered-within-groupings = ["UPPER_SNAKE_CASE"]
source-item-ordering = ["enum"] source-item-ordering = ["enum"]
trait-assoc-item-kinds-order = [ trait-assoc-item-kinds-order = [
"const", "const",
"type", "type",
"fn", "fn",
] # community tested standard ] # community tested standard

58
server/crates/arbiter-client/Cargo.toml
View File

@@ -1,29 +1,29 @@
[package] [package]
name = "arbiter-client" name = "arbiter-client"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
repository = "https://git.markettakers.org/MarketTakers/arbiter" repository = "https://git.markettakers.org/MarketTakers/arbiter"
license = "Apache-2.0" license = "Apache-2.0"
[lints] [lints]
workspace = true workspace = true
[features] [features]
evm = ["dep:alloy"] evm = ["dep:alloy"]
[dependencies] [dependencies]
arbiter-proto.path = "../arbiter-proto" arbiter-proto.path = "../arbiter-proto"
arbiter-crypto.path = "../arbiter-crypto" arbiter-crypto.path = "../arbiter-crypto"
alloy = { workspace = true, optional = true } alloy = { workspace = true, optional = true }
tonic.workspace = true tonic.workspace = true
tonic.features = ["tls-aws-lc"] tonic.features = ["tls-aws-lc"]
tokio.workspace = true tokio.workspace = true
tokio-stream.workspace = true tokio-stream.workspace = true
thiserror.workspace = true thiserror.workspace = true
http = "1.4.0" http = "1.4.0"
rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] } rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
async-trait.workspace = true async-trait.workspace = true
chrono.workspace = true chrono.workspace = true
[lib] [lib]
doctest = false doctest = false

320
server/crates/arbiter-client/src/auth.rs
View File

@@ -1,160 +1,160 @@
use crate::{ use crate::{
storage::StorageError, storage::StorageError,
transport::{ClientTransport, next_request_id}, transport::{ClientTransport, next_request_id},
}; };
use arbiter_crypto::authn::{self, CLIENT_CONTEXT, SigningKey}; use arbiter_crypto::authn::{self, CLIENT_CONTEXT, SigningKey};
use arbiter_proto::{ use arbiter_proto::{
ClientMetadata, ClientMetadata,
proto::{ proto::{
client::{ client::{
ClientRequest, ClientRequest,
auth::{ auth::{
self as proto_auth, AuthChallenge, AuthChallengeRequest, AuthChallengeSolution, self as proto_auth, AuthChallenge, AuthChallengeRequest, AuthChallengeSolution,
AuthResult, request::Payload as AuthRequestPayload, AuthResult, request::Payload as AuthRequestPayload,
response::Payload as AuthResponsePayload, response::Payload as AuthResponsePayload,
}, },
client_request::Payload as ClientRequestPayload, client_request::Payload as ClientRequestPayload,
client_response::Payload as ClientResponsePayload, client_response::Payload as ClientResponsePayload,
}, },
shared::ClientInfo as ProtoClientInfo, shared::ClientInfo as ProtoClientInfo,
}, },
}; };
use chrono::DateTime; use chrono::DateTime;
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum AuthError { pub enum AuthError {
#[error("Server sent invalid auth challenge")] #[error("Server sent invalid auth challenge")]
InvalidChallenge, InvalidChallenge,
#[error("Client approval denied by Operator")] #[error("Client approval denied by Operator")]
ApprovalDenied, ApprovalDenied,
#[error("Auth challenge was not returned by server")] #[error("Auth challenge was not returned by server")]
MissingAuthChallenge, MissingAuthChallenge,
#[error("No Operators online to approve client")] #[error("No Operators online to approve client")]
NoOperatorsOnline, NoOperatorsOnline,
#[error("Signing key storage error")] #[error("Signing key storage error")]
Storage(#[from] StorageError), Storage(#[from] StorageError),
#[error("Unexpected auth response payload")] #[error("Unexpected auth response payload")]
UnexpectedAuthResponse, UnexpectedAuthResponse,
} }
fn map_auth_result(code: i32) -> AuthError { fn map_auth_result(code: i32) -> AuthError {
match AuthResult::try_from(code).unwrap_or(AuthResult::Unspecified) { match AuthResult::try_from(code).unwrap_or(AuthResult::Unspecified) {
AuthResult::ApprovalDenied => AuthError::ApprovalDenied, AuthResult::ApprovalDenied => AuthError::ApprovalDenied,
AuthResult::NoOperatorsOnline => AuthError::NoOperatorsOnline, AuthResult::NoOperatorsOnline => AuthError::NoOperatorsOnline,
AuthResult::Unspecified AuthResult::Unspecified
| AuthResult::Success | AuthResult::Success
| AuthResult::InvalidKey | AuthResult::InvalidKey
| AuthResult::InvalidSignature | AuthResult::InvalidSignature
| AuthResult::Internal => AuthError::UnexpectedAuthResponse, | AuthResult::Internal => AuthError::UnexpectedAuthResponse,
} }
} }
async fn send_auth_challenge_request( async fn send_auth_challenge_request(
transport: &mut ClientTransport, transport: &mut ClientTransport,
metadata: ClientMetadata, metadata: ClientMetadata,
key: &SigningKey, key: &SigningKey,
) -> Result<(), AuthError> { ) -> Result<(), AuthError> {
transport transport
.send(ClientRequest { .send(ClientRequest {
request_id: next_request_id(), request_id: next_request_id(),
payload: Some(ClientRequestPayload::Auth(proto_auth::Request { payload: Some(ClientRequestPayload::Auth(proto_auth::Request {
payload: Some(AuthRequestPayload::ChallengeRequest(AuthChallengeRequest { payload: Some(AuthRequestPayload::ChallengeRequest(AuthChallengeRequest {
pubkey: key.public_key().to_bytes(), pubkey: key.public_key().to_bytes(),
client_info: Some(ProtoClientInfo { client_info: Some(ProtoClientInfo {
name: metadata.name, name: metadata.name,
description: metadata.description, description: metadata.description,
version: metadata.version, version: metadata.version,
}), }),
})), })),
})), })),
}) })
.await .await
.map_err(|_| AuthError::UnexpectedAuthResponse) .map_err(|_| AuthError::UnexpectedAuthResponse)
} }
async fn receive_auth_challenge( async fn receive_auth_challenge(
transport: &mut ClientTransport, transport: &mut ClientTransport,
) -> Result<AuthChallenge, AuthError> { ) -> Result<AuthChallenge, AuthError> {
let response = transport let response = transport
.recv() .recv()
.await .await
.map_err(|_| AuthError::MissingAuthChallenge)?; .map_err(|_| AuthError::MissingAuthChallenge)?;
let payload = response.payload.ok_or(AuthError::MissingAuthChallenge)?; let payload = response.payload.ok_or(AuthError::MissingAuthChallenge)?;
match payload { match payload {
ClientResponsePayload::Auth(response) => match response.payload { ClientResponsePayload::Auth(response) => match response.payload {
Some(AuthResponsePayload::Challenge(challenge)) => Ok(challenge), Some(AuthResponsePayload::Challenge(challenge)) => Ok(challenge),
Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)), Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)),
None => Err(AuthError::MissingAuthChallenge), None => Err(AuthError::MissingAuthChallenge),
}, },
_ => Err(AuthError::UnexpectedAuthResponse), _ => Err(AuthError::UnexpectedAuthResponse),
} }
} }
async fn send_auth_challenge_solution( async fn send_auth_challenge_solution(
transport: &mut ClientTransport, transport: &mut ClientTransport,
key: &SigningKey, key: &SigningKey,
challenge: AuthChallenge, challenge: AuthChallenge,
) -> Result<(), AuthError> { ) -> Result<(), AuthError> {
let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed()); let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
let challenge = authn::AuthChallenge { let challenge = authn::AuthChallenge {
nonce: *challenge nonce: *challenge
.random .random
.as_array() .as_array()
.ok_or(AuthError::InvalidChallenge)?, .ok_or(AuthError::InvalidChallenge)?,
timestamp, timestamp,
}; };
let challenge_payload: Vec<u8> = challenge.format(); let challenge_payload: Vec<u8> = challenge.format();
let signature = key let signature = key
.sign_message(&challenge_payload, CLIENT_CONTEXT) .sign_message(&challenge_payload, CLIENT_CONTEXT)
.map_err(|_| AuthError::UnexpectedAuthResponse)? .map_err(|_| AuthError::UnexpectedAuthResponse)?
.to_bytes(); .to_bytes();
transport transport
.send(ClientRequest { .send(ClientRequest {
request_id: next_request_id(), request_id: next_request_id(),
payload: Some(ClientRequestPayload::Auth(proto_auth::Request { payload: Some(ClientRequestPayload::Auth(proto_auth::Request {
payload: Some(AuthRequestPayload::ChallengeSolution( payload: Some(AuthRequestPayload::ChallengeSolution(
AuthChallengeSolution { signature }, AuthChallengeSolution { signature },
)), )),
})), })),
}) })
.await .await
.map_err(|_| AuthError::UnexpectedAuthResponse) .map_err(|_| AuthError::UnexpectedAuthResponse)
} }
async fn receive_auth_confirmation(transport: &mut ClientTransport) -> Result<(), AuthError> { async fn receive_auth_confirmation(transport: &mut ClientTransport) -> Result<(), AuthError> {
let response = transport let response = transport
.recv() .recv()
.await .await
.map_err(|_| AuthError::UnexpectedAuthResponse)?; .map_err(|_| AuthError::UnexpectedAuthResponse)?;
let payload = response.payload.ok_or(AuthError::UnexpectedAuthResponse)?; let payload = response.payload.ok_or(AuthError::UnexpectedAuthResponse)?;
match payload { match payload {
ClientResponsePayload::Auth(response) => match response.payload { ClientResponsePayload::Auth(response) => match response.payload {
Some(AuthResponsePayload::Result(result)) Some(AuthResponsePayload::Result(result))
if AuthResult::try_from(result).ok() == Some(AuthResult::Success) => if AuthResult::try_from(result).ok() == Some(AuthResult::Success) =>
{ {
Ok(()) Ok(())
} }
Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)), Some(AuthResponsePayload::Result(result)) => Err(map_auth_result(result)),
_ => Err(AuthError::UnexpectedAuthResponse), _ => Err(AuthError::UnexpectedAuthResponse),
}, },
_ => Err(AuthError::UnexpectedAuthResponse), _ => Err(AuthError::UnexpectedAuthResponse),
} }
} }
pub async fn authenticate( pub async fn authenticate(
transport: &mut ClientTransport, transport: &mut ClientTransport,
metadata: ClientMetadata, metadata: ClientMetadata,
key: &SigningKey, key: &SigningKey,
) -> Result<(), AuthError> { ) -> Result<(), AuthError> {
send_auth_challenge_request(transport, metadata, key).await?; send_auth_challenge_request(transport, metadata, key).await?;
let challenge = receive_auth_challenge(transport).await?; let challenge = receive_auth_challenge(transport).await?;
send_auth_challenge_solution(transport, key, challenge).await?; send_auth_challenge_solution(transport, key, challenge).await?;
receive_auth_confirmation(transport).await receive_auth_confirmation(transport).await
} }

88
server/crates/arbiter-client/src/bin/test_connect.rs
View File

@@ -1,44 +1,44 @@
use arbiter_client::ArbiterClient; use arbiter_client::ArbiterClient;
use arbiter_proto::{ClientMetadata, url::ArbiterUrl}; use arbiter_proto::{ClientMetadata, url::ArbiterUrl};
use std::io::{self, Write}; use std::io::{self, Write};
#[tokio::main] #[tokio::main]
async fn main() { async fn main() {
println!("Testing connection to Arbiter server..."); println!("Testing connection to Arbiter server...");
print!("Enter ArbiterUrl: "); print!("Enter ArbiterUrl: ");
let _ = io::stdout().flush(); let _ = io::stdout().flush();
let mut input = String::new(); let mut input = String::new();
if let Err(err) = io::stdin().read_line(&mut input) { if let Err(err) = io::stdin().read_line(&mut input) {
eprintln!("Failed to read input: {err}"); eprintln!("Failed to read input: {err}");
return; return;
} }
let input = input.trim(); let input = input.trim();
if input.is_empty() { if input.is_empty() {
eprintln!("ArbiterUrl cannot be empty"); eprintln!("ArbiterUrl cannot be empty");
return; return;
} }
let url = match ArbiterUrl::try_from(input) { let url = match ArbiterUrl::try_from(input) {
Ok(url) => url, Ok(url) => url,
Err(err) => { Err(err) => {
eprintln!("Invalid ArbiterUrl: {err}"); eprintln!("Invalid ArbiterUrl: {err}");
return; return;
} }
}; };
println!("{url:#?}"); println!("{url:#?}");
let metadata = ClientMetadata { let metadata = ClientMetadata {
name: "arbiter-client test_connect".to_owned(), name: "arbiter-client test_connect".to_owned(),
description: Some("Manual connection smoke test".to_owned()), description: Some("Manual connection smoke test".to_owned()),
version: Some(env!("CARGO_PKG_VERSION").to_owned()), version: Some(env!("CARGO_PKG_VERSION").to_owned()),
}; };
match ArbiterClient::connect(url, metadata).await { match ArbiterClient::connect(url, metadata).await {
Ok(_) => println!("Connected and authenticated successfully."), Ok(_) => println!("Connected and authenticated successfully."),
Err(err) => eprintln!("Failed to connect: {err:#?}"), Err(err) => eprintln!("Failed to connect: {err:#?}"),
} }
} }

202
server/crates/arbiter-client/src/client.rs
View File

@@ -1,101 +1,101 @@
#[cfg(feature = "evm")] #[cfg(feature = "evm")]
use crate::wallets::evm::ArbiterEvmWallet; use crate::wallets::evm::ArbiterEvmWallet;
use crate::{ use crate::{
StorageError, StorageError,
auth::{AuthError, authenticate}, auth::{AuthError, authenticate},
storage::{FileSigningKeyStorage, SigningKeyStorage}, storage::{FileSigningKeyStorage, SigningKeyStorage},
transport::{BUFFER_LENGTH, ClientTransport}, transport::{BUFFER_LENGTH, ClientTransport},
}; };
use arbiter_crypto::authn::SigningKey; use arbiter_crypto::authn::SigningKey;
use arbiter_proto::{ use arbiter_proto::{
ClientMetadata, proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl, ClientMetadata, proto::arbiter_service_client::ArbiterServiceClient, url::ArbiterUrl,
}; };
use std::sync::Arc; use std::sync::Arc;
use tokio::sync::{Mutex, mpsc}; use tokio::sync::{Mutex, mpsc};
use tokio_stream::wrappers::ReceiverStream; use tokio_stream::wrappers::ReceiverStream;
use tonic::transport::ClientTlsConfig; use tonic::transport::ClientTlsConfig;
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum ArbiterClientError { pub enum ArbiterClientError {
#[error("Authentication error")] #[error("Authentication error")]
Authentication(#[from] AuthError), Authentication(#[from] AuthError),
#[error("Could not establish connection")] #[error("Could not establish connection")]
Connection(#[from] tonic::transport::Error), Connection(#[from] tonic::transport::Error),
#[error("gRPC error")] #[error("gRPC error")]
Grpc(#[from] tonic::Status), Grpc(#[from] tonic::Status),
#[error("Invalid CA certificate")] #[error("Invalid CA certificate")]
InvalidCaCert(#[from] webpki::Error), InvalidCaCert(#[from] webpki::Error),
#[error("Invalid server URI")] #[error("Invalid server URI")]
InvalidUri(#[from] http::uri::InvalidUri), InvalidUri(#[from] http::uri::InvalidUri),
#[error("Storage error")] #[error("Storage error")]
Storage(#[from] StorageError), Storage(#[from] StorageError),
} }
pub struct ArbiterClient { pub struct ArbiterClient {
#[expect( #[expect(
dead_code, dead_code,
reason = "transport will be used in future methods for sending requests and receiving responses" reason = "transport will be used in future methods for sending requests and receiving responses"
)] )]
transport: Arc<Mutex<ClientTransport>>, transport: Arc<Mutex<ClientTransport>>,
} }
impl ArbiterClient { impl ArbiterClient {
pub async fn connect( pub async fn connect(
url: ArbiterUrl, url: ArbiterUrl,
metadata: ClientMetadata, metadata: ClientMetadata,
) -> Result<Self, ArbiterClientError> { ) -> Result<Self, ArbiterClientError> {
let storage = FileSigningKeyStorage::from_default_location()?; let storage = FileSigningKeyStorage::from_default_location()?;
Self::connect_with_storage(url, metadata, &storage).await Self::connect_with_storage(url, metadata, &storage).await
} }
pub async fn connect_with_storage<S: SigningKeyStorage>( pub async fn connect_with_storage<S: SigningKeyStorage>(
url: ArbiterUrl, url: ArbiterUrl,
metadata: ClientMetadata, metadata: ClientMetadata,
storage: &S, storage: &S,
) -> Result<Self, ArbiterClientError> { ) -> Result<Self, ArbiterClientError> {
let key = storage.load_or_create()?; let key = storage.load_or_create()?;
Self::connect_with_key(url, metadata, key).await Self::connect_with_key(url, metadata, key).await
} }
pub async fn connect_with_key( pub async fn connect_with_key(
url: ArbiterUrl, url: ArbiterUrl,
metadata: ClientMetadata, metadata: ClientMetadata,
key: SigningKey, key: SigningKey,
) -> Result<Self, ArbiterClientError> { ) -> Result<Self, ArbiterClientError> {
let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned(); let anchor = webpki::anchor_from_trusted_cert(&url.ca_cert)?.to_owned();
let tls = ClientTlsConfig::new().trust_anchor(anchor); let tls = ClientTlsConfig::new().trust_anchor(anchor);
let channel = let channel =
tonic::transport::Channel::from_shared(format!("https://{}:{}", url.host, url.port))? tonic::transport::Channel::from_shared(format!("https://{}:{}", url.host, url.port))?
.tls_config(tls)? .tls_config(tls)?
.connect() .connect()
.await?; .await?;
let mut client = ArbiterServiceClient::new(channel); let mut client = ArbiterServiceClient::new(channel);
let (tx, rx) = mpsc::channel(BUFFER_LENGTH); let (tx, rx) = mpsc::channel(BUFFER_LENGTH);
let response_stream = client.client(ReceiverStream::new(rx)).await?.into_inner(); let response_stream = client.client(ReceiverStream::new(rx)).await?.into_inner();
let mut transport = ClientTransport { let mut transport = ClientTransport {
sender: tx, sender: tx,
receiver: response_stream, receiver: response_stream,
}; };
authenticate(&mut transport, metadata, &key).await?; authenticate(&mut transport, metadata, &key).await?;
Ok(Self { Ok(Self {
transport: Arc::new(Mutex::new(transport)), transport: Arc::new(Mutex::new(transport)),
}) })
} }
#[cfg(feature = "evm")] #[cfg(feature = "evm")]
#[expect(clippy::unused_async, reason = "false positive")] #[expect(clippy::unused_async, reason = "false positive")]
pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, ArbiterClientError> { pub async fn evm_wallets(&self) -> Result<Vec<ArbiterEvmWallet>, ArbiterClientError> {
todo!("fetch EVM wallet list from server") todo!("fetch EVM wallet list from server")
} }
} }

24
server/crates/arbiter-client/src/lib.rs
View File

@@ -1,12 +1,12 @@
mod auth; mod auth;
mod client; mod client;
mod storage; mod storage;
mod transport; mod transport;
pub mod wallets; pub mod wallets;
pub use auth::AuthError; pub use auth::AuthError;
pub use client::{ArbiterClient, ArbiterClientError}; pub use client::{ArbiterClient, ArbiterClientError};
pub use storage::{FileSigningKeyStorage, SigningKeyStorage, StorageError}; pub use storage::{FileSigningKeyStorage, SigningKeyStorage, StorageError};
#[cfg(feature = "evm")] #[cfg(feature = "evm")]
pub use wallets::evm::{ArbiterEvmSignTransactionError, ArbiterEvmWallet}; pub use wallets::evm::{ArbiterEvmSignTransactionError, ArbiterEvmWallet};

268
server/crates/arbiter-client/src/storage.rs
View File

@@ -1,134 +1,134 @@
use arbiter_crypto::authn::SigningKey; use arbiter_crypto::authn::SigningKey;
use arbiter_proto::home_path; use arbiter_proto::home_path;
use std::path::{Path, PathBuf}; use std::path::{Path, PathBuf};
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum StorageError { pub enum StorageError {
#[error("Invalid signing key length in storage: expected {expected} bytes, got {actual} bytes")] #[error("Invalid signing key length in storage: expected {expected} bytes, got {actual} bytes")]
InvalidKeyLength { expected: usize, actual: usize }, InvalidKeyLength { expected: usize, actual: usize },
#[error("I/O error")] #[error("I/O error")]
Io(#[from] std::io::Error), Io(#[from] std::io::Error),
} }
pub trait SigningKeyStorage { pub trait SigningKeyStorage {
fn load_or_create(&self) -> Result<SigningKey, StorageError>; fn load_or_create(&self) -> Result<SigningKey, StorageError>;
} }
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub struct FileSigningKeyStorage { pub struct FileSigningKeyStorage {
path: PathBuf, path: PathBuf,
} }
impl FileSigningKeyStorage { impl FileSigningKeyStorage {
pub const DEFAULT_FILE_NAME: &str = "sdk_client_ml_dsa.key"; pub const DEFAULT_FILE_NAME: &str = "sdk_client_ml_dsa.key";
pub fn new(path: impl Into<PathBuf>) -> Self { pub fn new(path: impl Into<PathBuf>) -> Self {
Self { path: path.into() } Self { path: path.into() }
} }
pub fn from_default_location() -> Result<Self, StorageError> { pub fn from_default_location() -> Result<Self, StorageError> {
Ok(Self::new(home_path()?.join(Self::DEFAULT_FILE_NAME))) Ok(Self::new(home_path()?.join(Self::DEFAULT_FILE_NAME)))
} }
fn read_key(path: &Path) -> Result<SigningKey, StorageError> { fn read_key(path: &Path) -> Result<SigningKey, StorageError> {
let bytes = std::fs::read(path)?; let bytes = std::fs::read(path)?;
let raw: [u8; 32] = let raw: [u8; 32] =
bytes bytes
.try_into() .try_into()
.map_err(|v: Vec<u8>| StorageError::InvalidKeyLength { .map_err(|v: Vec<u8>| StorageError::InvalidKeyLength {
expected: 32, expected: 32,
actual: v.len(), actual: v.len(),
})?; })?;
Ok(SigningKey::from_seed(raw)) Ok(SigningKey::from_seed(raw))
} }
} }
impl SigningKeyStorage for FileSigningKeyStorage { impl SigningKeyStorage for FileSigningKeyStorage {
fn load_or_create(&self) -> Result<SigningKey, StorageError> { fn load_or_create(&self) -> Result<SigningKey, StorageError> {
if let Some(parent) = self.path.parent() { if let Some(parent) = self.path.parent() {
std::fs::create_dir_all(parent)?; std::fs::create_dir_all(parent)?;
} }
if self.path.exists() { if self.path.exists() {
return Self::read_key(&self.path); return Self::read_key(&self.path);
} }
let key = SigningKey::generate(); let key = SigningKey::generate();
let raw_key = key.to_seed(); let raw_key = key.to_seed();
// Use create_new to prevent accidental overwrite if another process creates the key first. // Use create_new to prevent accidental overwrite if another process creates the key first.
match std::fs::OpenOptions::new() match std::fs::OpenOptions::new()
.create_new(true) .create_new(true)
.write(true) .write(true)
.open(&self.path) .open(&self.path)
{ {
Ok(mut file) => { Ok(mut file) => {
use std::io::Write as _; use std::io::Write as _;
file.write_all(&raw_key)?; file.write_all(&raw_key)?;
Ok(key) Ok(key)
} }
Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => { Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => {
Self::read_key(&self.path) Self::read_key(&self.path)
} }
Err(err) => Err(StorageError::Io(err)), Err(err) => Err(StorageError::Io(err)),
} }
} }
} }
#[cfg(test)] #[cfg(test)]
mod tests { mod tests {
use super::{FileSigningKeyStorage, SigningKeyStorage, StorageError}; use super::{FileSigningKeyStorage, SigningKeyStorage, StorageError};
fn unique_temp_key_path() -> std::path::PathBuf { fn unique_temp_key_path() -> std::path::PathBuf {
let nanos = std::time::SystemTime::now() let nanos = std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH) .duration_since(std::time::UNIX_EPOCH)
.expect("clock should be after unix epoch") .expect("clock should be after unix epoch")
.as_nanos(); .as_nanos();
std::env::temp_dir().join(format!( std::env::temp_dir().join(format!(
"arbiter-client-key-{}-{}.bin", "arbiter-client-key-{}-{}.bin",
std::process::id(), std::process::id(),
nanos nanos
)) ))
} }
#[test] #[test]
fn file_storage_creates_and_reuses_key() { fn file_storage_creates_and_reuses_key() {
let path = unique_temp_key_path(); let path = unique_temp_key_path();
let storage = FileSigningKeyStorage::new(path.clone()); let storage = FileSigningKeyStorage::new(path.clone());
let key_a = storage let key_a = storage
.load_or_create() .load_or_create()
.expect("first load_or_create should create key"); .expect("first load_or_create should create key");
let key_b = storage let key_b = storage
.load_or_create() .load_or_create()
.expect("second load_or_create should read same key"); .expect("second load_or_create should read same key");
assert_eq!(key_a.to_seed(), key_b.to_seed()); assert_eq!(key_a.to_seed(), key_b.to_seed());
assert!(path.exists()); assert!(path.exists());
std::fs::remove_file(path).expect("temp key file should be removable"); std::fs::remove_file(path).expect("temp key file should be removable");
} }
#[test] #[test]
fn file_storage_rejects_invalid_key_length() { fn file_storage_rejects_invalid_key_length() {
let path = unique_temp_key_path(); let path = unique_temp_key_path();
std::fs::write(&path, [42u8; 31]).expect("should write invalid key file"); std::fs::write(&path, [42u8; 31]).expect("should write invalid key file");
let storage = FileSigningKeyStorage::new(path.clone()); let storage = FileSigningKeyStorage::new(path.clone());
let err = storage let err = storage
.load_or_create() .load_or_create()
.expect_err("storage should reject non-32-byte key file"); .expect_err("storage should reject non-32-byte key file");
match err { match err {
StorageError::InvalidKeyLength { expected, actual } => { StorageError::InvalidKeyLength { expected, actual } => {
assert_eq!(expected, 32); assert_eq!(expected, 32);
assert_eq!(actual, 31); assert_eq!(actual, 31);
} }
other @ StorageError::Io(_) => panic!("unexpected error: {other:?}"), other @ StorageError::Io(_) => panic!("unexpected error: {other:?}"),
} }
std::fs::remove_file(path).expect("temp key file should be removable"); std::fs::remove_file(path).expect("temp key file should be removable");
} }
} }

82
server/crates/arbiter-client/src/transport.rs
View File

@@ -1,41 +1,41 @@
use arbiter_proto::proto::client::{ClientRequest, ClientResponse}; use arbiter_proto::proto::client::{ClientRequest, ClientResponse};
use std::sync::atomic::{AtomicI32, Ordering}; use std::sync::atomic::{AtomicI32, Ordering};
use tokio::sync::mpsc; use tokio::sync::mpsc;
pub const BUFFER_LENGTH: usize = 16; pub const BUFFER_LENGTH: usize = 16;
static NEXT_REQUEST_ID: AtomicI32 = AtomicI32::new(1); static NEXT_REQUEST_ID: AtomicI32 = AtomicI32::new(1);
pub fn next_request_id() -> i32 { pub fn next_request_id() -> i32 {
NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed) NEXT_REQUEST_ID.fetch_add(1, Ordering::Relaxed)
} }
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum ClientSignError { pub enum ClientSignError {
#[error("Transport channel closed")] #[error("Transport channel closed")]
ChannelClosed, ChannelClosed,
#[error("Connection closed by server")] #[error("Connection closed by server")]
ConnectionClosed, ConnectionClosed,
} }
pub struct ClientTransport { pub struct ClientTransport {
pub(crate) sender: mpsc::Sender<ClientRequest>, pub(crate) sender: mpsc::Sender<ClientRequest>,
pub(crate) receiver: tonic::Streaming<ClientResponse>, pub(crate) receiver: tonic::Streaming<ClientResponse>,
} }
impl ClientTransport { impl ClientTransport {
pub(crate) async fn send(&mut self, request: ClientRequest) -> Result<(), ClientSignError> { pub(crate) async fn send(&mut self, request: ClientRequest) -> Result<(), ClientSignError> {
self.sender self.sender
.send(request) .send(request)
.await .await
.map_err(|_| ClientSignError::ChannelClosed) .map_err(|_| ClientSignError::ChannelClosed)
} }
pub(crate) async fn recv(&mut self) -> Result<ClientResponse, ClientSignError> { pub(crate) async fn recv(&mut self) -> Result<ClientResponse, ClientSignError> {
match self.receiver.message().await { match self.receiver.message().await {
Ok(Some(resp)) => Ok(resp), Ok(Some(resp)) => Ok(resp),
Ok(None) | Err(_) => Err(ClientSignError::ConnectionClosed), Ok(None) | Err(_) => Err(ClientSignError::ConnectionClosed),
} }
} }
} }

394
server/crates/arbiter-client/src/wallets/evm.rs
View File

@@ -1,197 +1,197 @@
use crate::transport::{ClientTransport, next_request_id}; use crate::transport::{ClientTransport, next_request_id};
use arbiter_proto::proto::{ use arbiter_proto::proto::{
client::{ client::{
ClientRequest, ClientRequest,
client_request::Payload as ClientRequestPayload, client_request::Payload as ClientRequestPayload,
client_response::Payload as ClientResponsePayload, client_response::Payload as ClientResponsePayload,
evm::{ evm::{
self as proto_evm, request::Payload as EvmRequestPayload, self as proto_evm, request::Payload as EvmRequestPayload,
response::Payload as EvmResponsePayload, response::Payload as EvmResponsePayload,
}, },
}, },
evm::{ evm::{
EvmSignTransactionRequest, EvmSignTransactionRequest,
evm_sign_transaction_response::Result as EvmSignTransactionResult, evm_sign_transaction_response::Result as EvmSignTransactionResult,
}, },
shared::evm::TransactionEvalError, shared::evm::TransactionEvalError,
}; };
use alloy::{ use alloy::{
consensus::SignableTransaction, consensus::SignableTransaction,
network::TxSigner, network::TxSigner,
primitives::{Address, B256, ChainId, Signature}, primitives::{Address, B256, ChainId, Signature},
signers::{Error, Result, Signer}, signers::{Error, Result, Signer},
}; };
use async_trait::async_trait; use async_trait::async_trait;
use std::sync::Arc; use std::sync::Arc;
use tokio::sync::Mutex; use tokio::sync::Mutex;
/// A typed error payload returned by [`ArbiterEvmWallet`] transaction signing. /// A typed error payload returned by [`ArbiterEvmWallet`] transaction signing.
/// ///
/// This is wrapped into `alloy::signers::Error::Other`, so consumers can downcast by [`TryFrom`] and /// This is wrapped into `alloy::signers::Error::Other`, so consumers can downcast by [`TryFrom`] and
/// interpret the concrete policy evaluation failure instead of parsing strings. /// interpret the concrete policy evaluation failure instead of parsing strings.
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
#[non_exhaustive] #[non_exhaustive]
pub enum ArbiterEvmSignTransactionError { pub enum ArbiterEvmSignTransactionError {
#[error("transaction rejected by policy: {0:?}")] #[error("transaction rejected by policy: {0:?}")]
PolicyEval(TransactionEvalError), PolicyEval(TransactionEvalError),
} }
impl<'a> TryFrom<&'a Error> for &'a ArbiterEvmSignTransactionError { impl<'a> TryFrom<&'a Error> for &'a ArbiterEvmSignTransactionError {
type Error = (); type Error = ();
fn try_from(value: &'a Error) -> Result<Self, Self::Error> { fn try_from(value: &'a Error) -> Result<Self, Self::Error> {
if let Error::Other(inner) = value if let Error::Other(inner) = value
&& let Some(eval_error) = inner.downcast_ref() && let Some(eval_error) = inner.downcast_ref()
{ {
Ok(eval_error) Ok(eval_error)
} else { } else {
Err(()) Err(())
} }
} }
} }
pub struct ArbiterEvmWallet { pub struct ArbiterEvmWallet {
transport: Arc<Mutex<ClientTransport>>, transport: Arc<Mutex<ClientTransport>>,
address: Address, address: Address,
chain_id: Option<ChainId>, chain_id: Option<ChainId>,
} }
impl ArbiterEvmWallet { impl ArbiterEvmWallet {
#[expect( #[expect(
dead_code, dead_code,
reason = "new will be used in future methods for creating wallets with different parameters" reason = "new will be used in future methods for creating wallets with different parameters"
)] )]
pub(crate) const fn new(transport: Arc<Mutex<ClientTransport>>, address: Address) -> Self { pub(crate) const fn new(transport: Arc<Mutex<ClientTransport>>, address: Address) -> Self {
Self { Self {
transport, transport,
address, address,
chain_id: None, chain_id: None,
} }
} }
pub const fn address(&self) -> Address { pub const fn address(&self) -> Address {
self.address self.address
} }
#[must_use] #[must_use]
pub const fn with_chain_id(mut self, chain_id: ChainId) -> Self { pub const fn with_chain_id(mut self, chain_id: ChainId) -> Self {
self.chain_id = Some(chain_id); self.chain_id = Some(chain_id);
self self
} }
fn validate_chain_id(&self, tx: &mut dyn SignableTransaction<Signature>) -> Result<()> { fn validate_chain_id(&self, tx: &mut dyn SignableTransaction<Signature>) -> Result<()> {
if let Some(chain_id) = self.chain_id if let Some(chain_id) = self.chain_id
&& !tx.set_chain_id_checked(chain_id) && !tx.set_chain_id_checked(chain_id)
{ {
return Err(Error::TransactionChainIdMismatch { return Err(Error::TransactionChainIdMismatch {
signer: chain_id, signer: chain_id,
tx: tx.chain_id().unwrap(), tx: tx.chain_id().unwrap(),
}); });
} }
Ok(()) Ok(())
} }
} }
#[async_trait] #[async_trait]
impl Signer for ArbiterEvmWallet { impl Signer for ArbiterEvmWallet {
async fn sign_hash(&self, _hash: &B256) -> Result<Signature> { async fn sign_hash(&self, _hash: &B256) -> Result<Signature> {
Err(Error::other( Err(Error::other(
"hash-only signing is not supported for ArbiterEvmWallet; use transaction signing", "hash-only signing is not supported for ArbiterEvmWallet; use transaction signing",
)) ))
} }
fn address(&self) -> Address { fn address(&self) -> Address {
self.address self.address
} }
fn chain_id(&self) -> Option<ChainId> { fn chain_id(&self) -> Option<ChainId> {
self.chain_id self.chain_id
} }
fn set_chain_id(&mut self, chain_id: Option<ChainId>) { fn set_chain_id(&mut self, chain_id: Option<ChainId>) {
self.chain_id = chain_id; self.chain_id = chain_id;
} }
} }
#[async_trait] #[async_trait]
impl TxSigner<Signature> for ArbiterEvmWallet { impl TxSigner<Signature> for ArbiterEvmWallet {
fn address(&self) -> Address { fn address(&self) -> Address {
self.address self.address
} }
async fn sign_transaction( async fn sign_transaction(
&self, &self,
tx: &mut dyn SignableTransaction<Signature>, tx: &mut dyn SignableTransaction<Signature>,
) -> Result<Signature> { ) -> Result<Signature> {
self.validate_chain_id(tx)?; self.validate_chain_id(tx)?;
let mut transport = self.transport.lock().await; let mut transport = self.transport.lock().await;
let request_id = next_request_id(); let request_id = next_request_id();
let rlp_transaction = tx.encoded_for_signing(); let rlp_transaction = tx.encoded_for_signing();
transport transport
.send(ClientRequest { .send(ClientRequest {
request_id, request_id,
payload: Some(ClientRequestPayload::Evm(proto_evm::Request { payload: Some(ClientRequestPayload::Evm(proto_evm::Request {
payload: Some(EvmRequestPayload::SignTransaction( payload: Some(EvmRequestPayload::SignTransaction(
EvmSignTransactionRequest { EvmSignTransactionRequest {
wallet_address: self.address.to_vec(), wallet_address: self.address.to_vec(),
rlp_transaction, rlp_transaction,
}, },
)), )),
})), })),
}) })
.await .await
.map_err(|_| Error::other("failed to send evm sign transaction request"))?; .map_err(|_| Error::other("failed to send evm sign transaction request"))?;
let response = transport let response = transport
.recv() .recv()
.await .await
.map_err(|_| Error::other("failed to receive evm sign transaction response"))?; .map_err(|_| Error::other("failed to receive evm sign transaction response"))?;
drop(transport); drop(transport);
if response.request_id != Some(request_id) { if response.request_id != Some(request_id) {
return Err(Error::other( return Err(Error::other(
"received mismatched response id for evm sign transaction", "received mismatched response id for evm sign transaction",
)); ));
} }
let payload = response let payload = response
.payload .payload
.ok_or_else(|| Error::other("missing evm sign transaction response payload"))?; .ok_or_else(|| Error::other("missing evm sign transaction response payload"))?;
let ClientResponsePayload::Evm(proto_evm::Response { let ClientResponsePayload::Evm(proto_evm::Response {
payload: Some(payload), payload: Some(payload),
}) = payload }) = payload
else { else {
return Err(Error::other( return Err(Error::other(
"unexpected response payload for evm sign transaction request", "unexpected response payload for evm sign transaction request",
)); ));
}; };
let EvmResponsePayload::SignTransaction(response) = payload else { let EvmResponsePayload::SignTransaction(response) = payload else {
return Err(Error::other( return Err(Error::other(
"unexpected evm response payload for sign transaction request", "unexpected evm response payload for sign transaction request",
)); ));
}; };
let result = response let result = response
.result .result
.ok_or_else(|| Error::other("missing evm sign transaction result"))?; .ok_or_else(|| Error::other("missing evm sign transaction result"))?;
match result { match result {
EvmSignTransactionResult::Signature(signature) => { EvmSignTransactionResult::Signature(signature) => {
Signature::try_from(signature.as_slice()) Signature::try_from(signature.as_slice())
.map_err(|_| Error::other("invalid signature returned by server")) .map_err(|_| Error::other("invalid signature returned by server"))
} }
EvmSignTransactionResult::EvalError(eval_error) => Err(Error::other( EvmSignTransactionResult::EvalError(eval_error) => Err(Error::other(
ArbiterEvmSignTransactionError::PolicyEval(eval_error), ArbiterEvmSignTransactionError::PolicyEval(eval_error),
)), )),
EvmSignTransactionResult::Error(code) => Err(Error::other(format!( EvmSignTransactionResult::Error(code) => Err(Error::other(format!(
"server failed to sign transaction with error code {code}" "server failed to sign transaction with error code {code}"
))), ))),
} }
} }
} }

4
server/crates/arbiter-client/src/wallets/mod.rs
View File

@@ -1,2 +1,2 @@
#[cfg(feature = "evm")] #[cfg(feature = "evm")]
pub mod evm; pub mod evm;

2
server/crates/arbiter-crypto/.gitignore vendored
View File

@@ -1 +1 @@
/target /target

50
server/crates/arbiter-crypto/Cargo.toml
View File

@@ -1,25 +1,25 @@
[package] [package]
name = "arbiter-crypto" name = "arbiter-crypto"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
[dependencies] [dependencies]
ml-dsa = {workspace = true, optional = true } ml-dsa = {workspace = true, optional = true }
rand = {workspace = true, optional = true} rand = {workspace = true, optional = true}
memsafe = {version = "0.4.0", optional = true} memsafe = {version = "0.4.0", optional = true}
hmac.workspace = true hmac.workspace = true
alloy.workspace = true alloy.workspace = true
x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] } x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
chrono.workspace = true chrono.workspace = true
thiserror.workspace = true thiserror.workspace = true
[lints] [lints]
workspace = true workspace = true
[features] [features]
default = ["authn", "safecell"] default = ["authn", "safecell"]
authn = ["dep:ml-dsa", "dep:rand"] authn = ["dep:ml-dsa", "dep:rand"]
safecell = ["dep:memsafe"] safecell = ["dep:memsafe"]
[lib] [lib]
doctest = false doctest = false

4
server/crates/arbiter-crypto/src/authn/mod.rs
View File

@@ -1,2 +1,2 @@
pub mod v1; pub mod v1;
pub use v1::*; pub use v1::*;

504
server/crates/arbiter-crypto/src/authn/v1.rs
View File

@@ -1,252 +1,252 @@
use chrono::{DateTime, Utc}; use chrono::{DateTime, Utc};
use hmac::digest::Digest; use hmac::digest::Digest;
use ml_dsa::{ use ml_dsa::{
EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature, EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _, SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
}; };
use rand::RngExt; use rand::RngExt;
pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client"; pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client";
pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator"; pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator";
const NONCE_SIZE: usize = 32; const NONCE_SIZE: usize = 32;
#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)] #[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
#[error("invalid length: expected {expected} bytes, got {actual} bytes")] #[error("invalid length: expected {expected} bytes, got {actual} bytes")]
pub struct InvalidLength { pub struct InvalidLength {
pub expected: usize, pub expected: usize,
pub actual: usize, pub actual: usize,
} }
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub struct AuthChallenge { pub struct AuthChallenge {
pub nonce: [u8; NONCE_SIZE], pub nonce: [u8; NONCE_SIZE],
pub timestamp: DateTime<Utc>, pub timestamp: DateTime<Utc>,
} }
impl AuthChallenge { impl AuthChallenge {
pub fn generate(rng: &mut impl rand::CryptoRng) -> Self { pub fn generate(rng: &mut impl rand::CryptoRng) -> Self {
let timestamp = Utc::now(); let timestamp = Utc::now();
let nonce = { let nonce = {
let mut array = [0; NONCE_SIZE]; let mut array = [0; NONCE_SIZE];
rng.fill(&mut array); rng.fill(&mut array);
array array
}; };
Self { nonce, timestamp } Self { nonce, timestamp }
} }
pub fn format(&self) -> Vec<u8> { pub fn format(&self) -> Vec<u8> {
{ {
let mut buffer = Vec::from(self.nonce); let mut buffer = Vec::from(self.nonce);
let stamp = self let stamp = self
.timestamp .timestamp
.timestamp_nanos_opt() .timestamp_nanos_opt()
.expect("We would be long dead by the time this triggers :)"); .expect("We would be long dead by the time this triggers :)");
buffer.extend_from_slice(stamp.to_be_bytes().as_slice()); buffer.extend_from_slice(stamp.to_be_bytes().as_slice());
buffer buffer
} }
} }
pub fn from_parts(nonce: &[u8], timestamp: i64) -> Result<Self, InvalidLength> { pub fn from_parts(nonce: &[u8], timestamp: i64) -> Result<Self, InvalidLength> {
let random_nonce = nonce.as_array().ok_or(InvalidLength { let random_nonce = nonce.as_array().ok_or(InvalidLength {
expected: NONCE_SIZE, expected: NONCE_SIZE,
actual: nonce.len(), actual: nonce.len(),
})?; })?;
Ok(Self { Ok(Self {
nonce: *random_nonce, nonce: *random_nonce,
timestamp: DateTime::from_timestamp_nanos(timestamp), timestamp: DateTime::from_timestamp_nanos(timestamp),
}) })
} }
} }
pub type KeyParams = MlDsa87; pub type KeyParams = MlDsa87;
#[derive(Clone, Debug, PartialEq)] #[derive(Clone, Debug, PartialEq)]
pub struct PublicKey(Box<MlDsaVerifyingKey<KeyParams>>); pub struct PublicKey(Box<MlDsaVerifyingKey<KeyParams>>);
impl crate::hashing::Hashable for PublicKey { impl crate::hashing::Hashable for PublicKey {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.to_bytes()); hasher.update(self.to_bytes());
} }
} }
#[derive(Clone, Debug, PartialEq)] #[derive(Clone, Debug, PartialEq)]
pub struct Signature(Box<MlDsaSignature<KeyParams>>); pub struct Signature(Box<MlDsaSignature<KeyParams>>);
#[derive(Debug)] #[derive(Debug)]
pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>); pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);
impl PublicKey { impl PublicKey {
pub fn to_bytes(&self) -> Vec<u8> { pub fn to_bytes(&self) -> Vec<u8> {
self.0.encode().0.to_vec() self.0.encode().0.to_vec()
} }
#[must_use] #[must_use]
pub fn verify(&self, challenge: &AuthChallenge, context: &[u8], signature: &Signature) -> bool { pub fn verify(&self, challenge: &AuthChallenge, context: &[u8], signature: &Signature) -> bool {
let challenge = challenge.format(); let challenge = challenge.format();
self.0 self.0
.verify_with_context(&challenge, context, &signature.0) .verify_with_context(&challenge, context, &signature.0)
} }
} }
impl Signature { impl Signature {
pub fn to_bytes(&self) -> Vec<u8> { pub fn to_bytes(&self) -> Vec<u8> {
self.0.encode().0.to_vec() self.0.encode().0.to_vec()
} }
} }
impl SigningKey { impl SigningKey {
pub fn generate() -> Self { pub fn generate() -> Self {
Self(Box::new(KeyParams::key_gen(&mut rand::rng()))) Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
} }
pub fn from_seed(seed: [u8; 32]) -> Self { pub fn from_seed(seed: [u8; 32]) -> Self {
Self(Box::new(KeyParams::from_seed(&Seed::from(seed)))) Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
} }
pub fn to_seed(&self) -> [u8; 32] { pub fn to_seed(&self) -> [u8; 32] {
self.0.to_seed().into() self.0.to_seed().into()
} }
pub fn public_key(&self) -> PublicKey { pub fn public_key(&self) -> PublicKey {
self.0.verifying_key().into() self.0.verifying_key().into()
} }
pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> { pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
self.0 self.0
.signing_key() .signing_key()
.sign_deterministic(message, context) .sign_deterministic(message, context)
.map(Into::into) .map(Into::into)
} }
pub fn sign_challenge( pub fn sign_challenge(
&self, &self,
challenge: &AuthChallenge, challenge: &AuthChallenge,
context: &[u8], context: &[u8],
) -> Result<Signature, Error> { ) -> Result<Signature, Error> {
let challenge = challenge.format(); let challenge = challenge.format();
self.sign_message(&challenge, context) self.sign_message(&challenge, context)
} }
} }
impl From<MlDsaVerifyingKey<KeyParams>> for PublicKey { impl From<MlDsaVerifyingKey<KeyParams>> for PublicKey {
fn from(value: MlDsaVerifyingKey<KeyParams>) -> Self { fn from(value: MlDsaVerifyingKey<KeyParams>) -> Self {
Self(Box::new(value)) Self(Box::new(value))
} }
} }
impl From<MlDsaSignature<KeyParams>> for Signature { impl From<MlDsaSignature<KeyParams>> for Signature {
fn from(value: MlDsaSignature<KeyParams>) -> Self { fn from(value: MlDsaSignature<KeyParams>) -> Self {
Self(Box::new(value)) Self(Box::new(value))
} }
} }
impl From<MlDsaSigningKey<KeyParams>> for SigningKey { impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
fn from(value: MlDsaSigningKey<KeyParams>) -> Self { fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
Self(Box::new(value)) Self(Box::new(value))
} }
} }
impl TryFrom<Vec<u8>> for PublicKey { impl TryFrom<Vec<u8>> for PublicKey {
type Error = (); type Error = ();
fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> { fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> {
Self::try_from(value.as_slice()) Self::try_from(value.as_slice())
} }
} }
impl TryFrom<&'_ [u8]> for PublicKey { impl TryFrom<&'_ [u8]> for PublicKey {
type Error = (); type Error = ();
fn try_from(value: &[u8]) -> Result<Self, Self::Error> { fn try_from(value: &[u8]) -> Result<Self, Self::Error> {
let encoded = EncodedVerifyingKey::<KeyParams>::try_from(value).map_err(|_| ())?; let encoded = EncodedVerifyingKey::<KeyParams>::try_from(value).map_err(|_| ())?;
Ok(Self(Box::new(MlDsaVerifyingKey::decode(&encoded)))) Ok(Self(Box::new(MlDsaVerifyingKey::decode(&encoded))))
} }
} }
impl TryFrom<Vec<u8>> for Signature { impl TryFrom<Vec<u8>> for Signature {
type Error = (); type Error = ();
fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> { fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> {
Self::try_from(value.as_slice()) Self::try_from(value.as_slice())
} }
} }
impl TryFrom<&'_ [u8]> for Signature { impl TryFrom<&'_ [u8]> for Signature {
type Error = (); type Error = ();
fn try_from(value: &[u8]) -> Result<Self, Self::Error> { fn try_from(value: &[u8]) -> Result<Self, Self::Error> {
MlDsaSignature::try_from(value) MlDsaSignature::try_from(value)
.map(|sig| Self(Box::new(sig))) .map(|sig| Self(Box::new(sig)))
.map_err(|_| ()) .map_err(|_| ())
} }
} }
#[cfg(test)] #[cfg(test)]
mod tests { mod tests {
use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _}; use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};
use crate::authn::AuthChallenge; use crate::authn::AuthChallenge;
use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT}; use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
#[test] #[test]
fn public_key_round_trip_decodes() { fn public_key_round_trip_decodes() {
let key = MlDsa87::key_gen(&mut rand::rng()); let key = MlDsa87::key_gen(&mut rand::rng());
let encoded = PublicKey::from(key.verifying_key()).to_bytes(); let encoded = PublicKey::from(key.verifying_key()).to_bytes();
let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode"); let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");
assert_eq!(decoded, PublicKey::from(key.verifying_key())); assert_eq!(decoded, PublicKey::from(key.verifying_key()));
} }
#[test] #[test]
fn signature_round_trip_decodes() { fn signature_round_trip_decodes() {
let key = SigningKey::generate(); let key = SigningKey::generate();
let signature = key let signature = key
.sign_message(b"challenge", CLIENT_CONTEXT) .sign_message(b"challenge", CLIENT_CONTEXT)
.expect("signature should be created"); .expect("signature should be created");
let decoded = let decoded =
Signature::try_from(signature.to_bytes().as_slice()).expect("signature should decode"); Signature::try_from(signature.to_bytes().as_slice()).expect("signature should decode");
assert_eq!(decoded, signature); assert_eq!(decoded, signature);
} }
#[test] #[test]
fn challenge_verification_uses_context_and_canonical_key_bytes() { fn challenge_verification_uses_context_and_canonical_key_bytes() {
let key = SigningKey::generate(); let key = SigningKey::generate();
let public_key = key.public_key(); let public_key = key.public_key();
let challenge = AuthChallenge::generate(&mut rand::rng()); let challenge = AuthChallenge::generate(&mut rand::rng());
let signature = key let signature = key
.sign_challenge(&challenge, CLIENT_CONTEXT) .sign_challenge(&challenge, CLIENT_CONTEXT)
.expect("signature should be created"); .expect("signature should be created");
assert!(public_key.verify(&challenge, CLIENT_CONTEXT, &signature)); assert!(public_key.verify(&challenge, CLIENT_CONTEXT, &signature));
assert!(!public_key.verify(&challenge, OPERATOR_CONTEXT, &signature)); assert!(!public_key.verify(&challenge, OPERATOR_CONTEXT, &signature));
} }
#[test] #[test]
fn signing_key_round_trip_seed_preserves_public_key_and_signing() { fn signing_key_round_trip_seed_preserves_public_key_and_signing() {
let original = SigningKey::generate(); let original = SigningKey::generate();
let restored = SigningKey::from_seed(original.to_seed()); let restored = SigningKey::from_seed(original.to_seed());
assert_eq!(restored.public_key(), original.public_key()); assert_eq!(restored.public_key(), original.public_key());
let challenge = AuthChallenge::generate(&mut rand::rng()); let challenge = AuthChallenge::generate(&mut rand::rng());
let signature = restored let signature = restored
.sign_challenge(&challenge, CLIENT_CONTEXT) .sign_challenge(&challenge, CLIENT_CONTEXT)
.expect("signature should be created"); .expect("signature should be created");
assert!( assert!(
restored restored
.public_key() .public_key()
.verify(&challenge, CLIENT_CONTEXT, &signature) .verify(&challenge, CLIENT_CONTEXT, &signature)
); );
} }
} }

224
server/crates/arbiter-crypto/src/hashing.rs
View File

@@ -1,112 +1,112 @@
use std::collections::HashSet; use std::collections::HashSet;
pub use hmac::digest::Digest; pub use hmac::digest::Digest;
/// Deterministically hash a value by feeding its fields into the hasher in a consistent order. /// Deterministically hash a value by feeding its fields into the hasher in a consistent order.
#[diagnostic::on_unimplemented( #[diagnostic::on_unimplemented(
note = "for local types consider adding `#[derive(arbiter_macros::Hashable)]` to your `{Self}` type", note = "for local types consider adding `#[derive(arbiter_macros::Hashable)]` to your `{Self}` type",
note = "for types from other crates check whether the crate offers a `Hashable` implementation" note = "for types from other crates check whether the crate offers a `Hashable` implementation"
)] )]
pub trait Hashable { pub trait Hashable {
fn hash<H: Digest>(&self, hasher: &mut H); fn hash<H: Digest>(&self, hasher: &mut H);
} }
macro_rules! impl_numeric { macro_rules! impl_numeric {
($($t:ty),*) => { ($($t:ty),*) => {
$( $(
impl Hashable for $t { impl Hashable for $t {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(&self.to_be_bytes()); hasher.update(&self.to_be_bytes());
} }
} }
)* )*
}; };
} }
impl_numeric!(u8, u16, u32, u64, i8, i16, i32, i64); impl_numeric!(u8, u16, u32, u64, i8, i16, i32, i64);
impl Hashable for &[u8] { impl Hashable for &[u8] {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self); hasher.update(self);
} }
} }
impl Hashable for String { impl Hashable for String {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.as_bytes()); hasher.update(self.as_bytes());
} }
} }
impl<T: Hashable + PartialOrd> Hashable for Vec<T> { impl<T: Hashable + PartialOrd> Hashable for Vec<T> {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
let ref_sorted = { let ref_sorted = {
let mut sorted = self.iter().collect::<Vec<_>>(); let mut sorted = self.iter().collect::<Vec<_>>();
sorted.sort_by(|a, b| a.partial_cmp(b).unwrap()); sorted.sort_by(|a, b| a.partial_cmp(b).unwrap());
sorted sorted
}; };
for item in ref_sorted { for item in ref_sorted {
item.hash(hasher); item.hash(hasher);
} }
} }
} }
impl<T: Hashable + PartialOrd, S: std::hash::BuildHasher> Hashable for HashSet<T, S> { impl<T: Hashable + PartialOrd, S: std::hash::BuildHasher> Hashable for HashSet<T, S> {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
let ref_sorted = { let ref_sorted = {
let mut sorted = self.iter().collect::<Vec<_>>(); let mut sorted = self.iter().collect::<Vec<_>>();
sorted.sort_by(|a, b| a.partial_cmp(b).unwrap()); sorted.sort_by(|a, b| a.partial_cmp(b).unwrap());
sorted sorted
}; };
for item in ref_sorted { for item in ref_sorted {
item.hash(hasher); item.hash(hasher);
} }
} }
} }
impl<T: Hashable> Hashable for Option<T> { impl<T: Hashable> Hashable for Option<T> {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
match self { match self {
Some(value) => { Some(value) => {
hasher.update([1]); hasher.update([1]);
value.hash(hasher); value.hash(hasher);
} }
None => hasher.update([0]), None => hasher.update([0]),
} }
} }
} }
impl<T: Hashable> Hashable for Box<T> { impl<T: Hashable> Hashable for Box<T> {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
self.as_ref().hash(hasher); self.as_ref().hash(hasher);
} }
} }
impl<T: Hashable> Hashable for &T { impl<T: Hashable> Hashable for &T {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
(*self).hash(hasher); (*self).hash(hasher);
} }
} }
impl Hashable for alloy::primitives::Address { impl Hashable for alloy::primitives::Address {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.as_slice()); hasher.update(self.as_slice());
} }
} }
impl Hashable for alloy::primitives::U256 { impl Hashable for alloy::primitives::U256 {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.to_be_bytes::<32>()); hasher.update(self.to_be_bytes::<32>());
} }
} }
impl Hashable for chrono::Duration { impl Hashable for chrono::Duration {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.num_seconds().to_be_bytes()); hasher.update(self.num_seconds().to_be_bytes());
} }
} }
impl Hashable for chrono::DateTime<chrono::Utc> { impl Hashable for chrono::DateTime<chrono::Utc> {
fn hash<H: Digest>(&self, hasher: &mut H) { fn hash<H: Digest>(&self, hasher: &mut H) {
hasher.update(self.timestamp_millis().to_be_bytes()); hasher.update(self.timestamp_millis().to_be_bytes());
} }
} }

49
server/crates/arbiter-crypto/src/integrity.rs Normal file
View File

@@ -0,0 +1,49 @@
use crate::hashing::Hashable;
/// Marks a struct as a participant in the database integrity system.
///
/// Implementors are protected by an HMAC-SHA256 MAC stored in the
/// `integrity_envelope` table. The MAC is computed over:
///
/// ```text
/// HMAC-SHA256(key, len(KIND) || KIND || len(entity_id) || entity_id || VERSION || SHA256(Hashable))
/// ```
///
/// Both `KIND` and `VERSION` act as domain separators — they prevent a valid
/// MAC for one entity type or schema version from being accepted for another.
///
/// # Deriving
///
/// Use `#[derive(Integrable)]` with the `#[integrable(kind = "...")]` attribute.
/// `VERSION` is computed automatically as an FNV-1a hash of the struct's field
/// names and types, so it changes whenever the schema changes without any manual
/// bookkeeping.
///
/// ```rust,ignore
/// #[derive(Hashable, Integrable)]
/// #[integrable(kind = "operator_credentials")]
/// pub struct OperatorCredentials {
/// pub pubkey: PublicKey,
/// }
/// ```
///
/// # Upgrading schema
///
/// When fields are added, removed, or reordered, `VERSION` changes automatically.
/// Existing MAC records in the database will return [`PayloadVersionMismatch`] on
/// verification — this is the signal to re-sign all rows for this `KIND` as part
/// of a migration.
///
/// [`PayloadVersionMismatch`]: crate::integrity::Integrable
pub trait Integrable: Hashable {
/// Stable name of this entity type as stored in `integrity_envelope.entity_kind`.
///
/// Must be a valid schema name: starts with a letter, contains only `[a-zA-Z0-9_]`,
/// and must be globally unique across all `Integrable` types in the system.
const KIND: &'static str;
/// FNV-1a hash of the struct's field names and types at the time the derive
/// macro ran. Changes automatically when the schema changes, invalidating
/// existing MACs and signalling that a migration is required.
const VERSION: i32;
}

15
server/crates/arbiter-crypto/src/lib.rs
View File

@@ -1,7 +1,8 @@
#[cfg(feature = "authn")] #[cfg(feature = "authn")]
pub mod authn; pub mod authn;
pub mod hashing; pub mod hashing;
#[cfg(feature = "safecell")] pub mod integrity;
pub mod safecell; #[cfg(feature = "safecell")]
pub mod safecell;
pub use x_wing;
pub use x_wing;

236
server/crates/arbiter-crypto/src/safecell.rs
View File

@@ -1,118 +1,118 @@
use memsafe::MemSafe; use memsafe::MemSafe;
use std::{ use std::{
any::type_name, any::type_name,
fmt, fmt,
ops::{Deref, DerefMut}, ops::{Deref, DerefMut},
}; };
pub trait SafeCellHandle<T> { pub trait SafeCellHandle<T> {
type CellRead<'a>: Deref<Target = T> type CellRead<'a>: Deref<Target = T>
where where
Self: 'a, Self: 'a,
T: 'a; T: 'a;
type CellWrite<'a>: Deref<Target = T> + DerefMut<Target = T> type CellWrite<'a>: Deref<Target = T> + DerefMut<Target = T>
where where
Self: 'a, Self: 'a,
T: 'a; T: 'a;
fn new(value: T) -> Self fn new(value: T) -> Self
where where
Self: Sized; Self: Sized;
fn read(&mut self) -> Self::CellRead<'_>; fn read(&mut self) -> Self::CellRead<'_>;
fn write(&mut self) -> Self::CellWrite<'_>; fn write(&mut self) -> Self::CellWrite<'_>;
fn new_inline<F>(f: F) -> Self fn new_inline<F>(f: F) -> Self
where where
Self: Sized, Self: Sized,
T: Default, T: Default,
F: for<'a> FnOnce(&'a mut T), F: for<'a> FnOnce(&'a mut T),
{ {
let mut cell = Self::new(T::default()); let mut cell = Self::new(T::default());
{ {
let mut handle = cell.write(); let mut handle = cell.write();
f(&mut *handle); f(&mut *handle);
} }
cell cell
} }
#[inline(always)] #[inline(always)]
fn read_inline<F, R>(&mut self, f: F) -> R fn read_inline<F, R>(&mut self, f: F) -> R
where where
F: FnOnce(&T) -> R, F: FnOnce(&T) -> R,
{ {
f(&*self.read()) f(&*self.read())
} }
#[inline(always)] #[inline(always)]
fn write_inline<F, R>(&mut self, f: F) -> R fn write_inline<F, R>(&mut self, f: F) -> R
where where
F: FnOnce(&mut T) -> R, F: FnOnce(&mut T) -> R,
{ {
f(&mut *self.write()) f(&mut *self.write())
} }
} }
pub struct MemSafeCell<T>(MemSafe<T>); pub struct MemSafeCell<T>(MemSafe<T>);
impl<T> fmt::Debug for MemSafeCell<T> { impl<T> fmt::Debug for MemSafeCell<T> {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
f.debug_struct("MemSafeCell") f.debug_struct("MemSafeCell")
.field("inner", &format_args!("<protected {}>", type_name::<T>())) .field("inner", &format_args!("<protected {}>", type_name::<T>()))
.finish() .finish()
} }
} }
impl<T> SafeCellHandle<T> for MemSafeCell<T> { impl<T> SafeCellHandle<T> for MemSafeCell<T> {
type CellRead<'a> type CellRead<'a>
= memsafe::MemSafeRead<'a, T> = memsafe::MemSafeRead<'a, T>
where where
Self: 'a, Self: 'a,
T: 'a; T: 'a;
type CellWrite<'a> type CellWrite<'a>
= memsafe::MemSafeWrite<'a, T> = memsafe::MemSafeWrite<'a, T>
where where
Self: 'a, Self: 'a,
T: 'a; T: 'a;
fn new(value: T) -> Self { fn new(value: T) -> Self {
match MemSafe::new(value) { match MemSafe::new(value) {
Ok(inner) => Self(inner), Ok(inner) => Self(inner),
Err(err) => { Err(err) => {
// If protected memory cannot be allocated, process integrity is compromised. // If protected memory cannot be allocated, process integrity is compromised.
abort_memory_breach("safe cell allocation", &err) abort_memory_breach("safe cell allocation", &err)
} }
} }
} }
#[inline(always)] #[inline(always)]
fn read(&mut self) -> Self::CellRead<'_> { fn read(&mut self) -> Self::CellRead<'_> {
match self.0.read() { match self.0.read() {
Ok(inner) => inner, Ok(inner) => inner,
Err(err) => abort_memory_breach("safe cell read", &err), Err(err) => abort_memory_breach("safe cell read", &err),
} }
} }
#[inline(always)] #[inline(always)]
fn write(&mut self) -> Self::CellWrite<'_> { fn write(&mut self) -> Self::CellWrite<'_> {
match self.0.write() { match self.0.write() {
Ok(inner) => inner, Ok(inner) => inner,
Err(err) => { Err(err) => {
// If protected memory becomes unwritable here, treat it as a fatal memory breach. // If protected memory becomes unwritable here, treat it as a fatal memory breach.
abort_memory_breach("safe cell write", &err) abort_memory_breach("safe cell write", &err)
} }
} }
} }
} }
fn abort_memory_breach(action: &str, err: &memsafe::error::MemoryError) -> ! { fn abort_memory_breach(action: &str, err: &memsafe::error::MemoryError) -> ! {
eprintln!("fatal {action}: {err}"); eprintln!("fatal {action}: {err}");
// SAFETY: Intentionally cause a segmentation fault to prevent further execution in a compromised state. // SAFETY: Intentionally cause a segmentation fault to prevent further execution in a compromised state.
unsafe { unsafe {
let unsafe_pointer = std::ptr::null_mut::<u8>(); let unsafe_pointer = std::ptr::null_mut::<u8>();
std::ptr::write_volatile(unsafe_pointer, 0); std::ptr::write_volatile(unsafe_pointer, 0);
} }
std::process::abort(); std::process::abort();
} }
pub type SafeCell<T> = MemSafeCell<T>; pub type SafeCell<T> = MemSafeCell<T>;

39
server/crates/arbiter-macros/Cargo.toml
View File

@@ -1,19 +1,20 @@
[package] [package]
name = "arbiter-macros" name = "arbiter-macros"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
[lib] [lib]
proc-macro = true proc-macro = true
doctest = false doctest = false
[dependencies] [dependencies]
proc-macro2 = "1.0" proc-macro2 = "1.0"
quote = "1.0" quote = "1.0"
syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] } syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
[dev-dependencies] [dev-dependencies]
arbiter-crypto = { path = "../arbiter-crypto" } arbiter-crypto = { path = "../arbiter-crypto" }
trybuild = { version = "1.0", features = ["diff"] }
[lints]
workspace = true [lints]
workspace = true

246
server/crates/arbiter-macros/src/hashable.rs
View File

@@ -1,131 +1,115 @@
use crate::utils::{HASHABLE_TRAIT_PATH, HMAC_DIGEST_PATH}; use crate::utils::{HASHABLE_TRAIT_PATH, HMAC_DIGEST_PATH};
use proc_macro2::{Span, TokenStream, TokenTree}; use proc_macro2::{Span, TokenStream, TokenTree};
use quote::quote; use quote::quote;
use syn::{DataStruct, DeriveInput, Fields, Generics, Index, parse_quote, spanned::Spanned}; use syn::{DataStruct, DeriveInput, Fields, Generics, Index, parse_quote, spanned::Spanned};
pub(crate) fn derive(input: &DeriveInput) -> TokenStream { pub(crate) fn derive(input: &DeriveInput) -> TokenStream {
match &input.data { match &input.data {
syn::Data::Struct(struct_data) => hashable_struct(input, struct_data), syn::Data::Struct(struct_data) => hashable_struct(input, struct_data),
syn::Data::Enum(_) => { syn::Data::Enum(_) => {
syn::Error::new_spanned(input, "Hashable can currently be derived only for structs") syn::Error::new_spanned(input, "Hashable can currently be derived only for structs")
.to_compile_error() .to_compile_error()
} }
syn::Data::Union(_) => { syn::Data::Union(_) => {
syn::Error::new_spanned(input, "Hashable cannot be derived for unions") syn::Error::new_spanned(input, "Hashable cannot be derived for unions")
.to_compile_error() .to_compile_error()
} }
} }
} }
fn hashable_struct(input: &DeriveInput, struct_data: &DataStruct) -> TokenStream { fn hashable_struct(input: &DeriveInput, struct_data: &DataStruct) -> TokenStream {
let ident = &input.ident; let ident = &input.ident;
let hashable_trait = HASHABLE_TRAIT_PATH.to_path(); let hashable_trait = HASHABLE_TRAIT_PATH.to_path();
let hmac_digest = HMAC_DIGEST_PATH.to_path(); let hmac_digest = HMAC_DIGEST_PATH.to_path();
let generics = add_hashable_bounds(input.generics.clone(), &hashable_trait); let generics = add_hashable_bounds(input.generics.clone(), &hashable_trait);
let field_accesses = collect_field_accesses(struct_data); let field_accesses = collect_field_accesses(struct_data);
let hash_calls = build_hash_calls(&field_accesses, &hashable_trait); let hash_calls = build_hash_calls(&field_accesses, &hashable_trait);
let (impl_generics, ty_generics, where_clause) = generics.split_for_impl(); let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
quote! { quote! {
#[automatically_derived] #[automatically_derived]
impl #impl_generics #hashable_trait for #ident #ty_generics #where_clause { impl #impl_generics #hashable_trait for #ident #ty_generics #where_clause {
fn hash<H: #hmac_digest>(&self, hasher: &mut H) { fn hash<H: #hmac_digest>(&self, hasher: &mut H) {
#(#hash_calls)* #(#hash_calls)*
} }
} }
} }
} }
fn add_hashable_bounds(mut generics: Generics, hashable_trait: &syn::Path) -> Generics { fn add_hashable_bounds(mut generics: Generics, hashable_trait: &syn::Path) -> Generics {
for type_param in generics.type_params_mut() { for type_param in generics.type_params_mut() {
type_param.bounds.push(parse_quote!(#hashable_trait)); type_param.bounds.push(parse_quote!(#hashable_trait));
} }
generics generics
} }
struct FieldAccess { struct FieldAccess {
access: TokenStream, access: TokenStream,
span: Span, span: Span,
} }
fn collect_field_accesses(struct_data: &DataStruct) -> Vec<FieldAccess> { fn collect_field_accesses(struct_data: &DataStruct) -> Vec<FieldAccess> {
match &struct_data.fields { match &struct_data.fields {
Fields::Named(fields) => { Fields::Named(fields) => crate::utils::sorted_named_fields(fields)
// Keep deterministic alphabetical order for named fields. .into_iter()
// Do not remove this sort, because it keeps hash output stable regardless of source order. .map(|field| {
let mut named_fields = fields let name = field.ident.as_ref().unwrap();
.named FieldAccess {
.iter() access: quote! { #name },
.map(|field| { span: name.span(),
let name = field }
.ident })
.as_ref() .collect(),
.expect("Fields::Named(fields) must have names") Fields::Unnamed(fields) => fields
.clone(); .unnamed
(name.to_string(), name) .iter()
}) .enumerate()
.collect::<Vec<_>>(); .map(|(i, field)| FieldAccess {
access: {
named_fields.sort_by(|a, b| a.0.cmp(&b.0)); let index = Index::from(i);
quote! { #index }
named_fields },
.into_iter() span: field.ty.span(),
.map(|(_, name)| FieldAccess { })
access: quote! { #name }, .collect(),
span: name.span(), Fields::Unit => Vec::new(),
}) }
.collect() }
}
Fields::Unnamed(fields) => fields fn build_hash_calls(
.unnamed field_accesses: &[FieldAccess],
.iter() hashable_trait: &syn::Path,
.enumerate() ) -> Vec<TokenStream> {
.map(|(i, field)| FieldAccess { field_accesses
access: { .iter()
let index = Index::from(i); .map(|field| {
quote! { #index } let access = &field.access;
}, let call = quote! {
span: field.ty.span(), #hashable_trait::hash(&self.#access, hasher);
}) };
.collect(),
Fields::Unit => Vec::new(), respan(call, field.span)
} })
} .collect()
}
fn build_hash_calls(
field_accesses: &[FieldAccess], /// Recursively set span on all tokens, including interpolated ones.
hashable_trait: &syn::Path, fn respan(tokens: TokenStream, span: Span) -> TokenStream {
) -> Vec<TokenStream> { tokens
field_accesses .into_iter()
.iter() .map(|tt| match tt {
.map(|field| { TokenTree::Group(g) => {
let access = &field.access; let mut new = proc_macro2::Group::new(g.delimiter(), respan(g.stream(), span));
let call = quote! { new.set_span(span);
#hashable_trait::hash(&self.#access, hasher); TokenTree::Group(new)
}; }
mut other => {
respan(call, field.span) other.set_span(span);
}) other
.collect() }
} })
.collect()
/// Recursively set span on all tokens, including interpolated ones. }
fn respan(tokens: TokenStream, span: Span) -> TokenStream {
tokens
.into_iter()
.map(|tt| match tt {
TokenTree::Group(g) => {
let mut new = proc_macro2::Group::new(g.delimiter(), respan(g.stream(), span));
new.set_span(span);
TokenTree::Group(new)
}
mut other => {
other.set_span(span);
other
}
})
.collect()
}

134
server/crates/arbiter-macros/src/integrable.rs Normal file
View File

@@ -0,0 +1,134 @@
use crate::utils::INTEGRABLE_TRAIT_PATH;
use proc_macro2::TokenStream;
use quote::quote;
use syn::{DeriveInput, LitStr, spanned::Spanned as _};
struct IntegrableAttr {
kind: String,
}
impl IntegrableAttr {
fn from_attrs(
attrs: &[syn::Attribute],
ident_span: proc_macro2::Span,
) -> Result<Self, syn::Error> {
let mut kind: Option<String> = None;
let mut found = false;
for attr in attrs {
if !attr.path().is_ident("integrable") {
continue;
}
if found {
return Err(syn::Error::new(attr.span(), "duplicate #[integrable] attribute"));
}
found = true;
attr.parse_nested_meta(|meta| {
if meta.path.is_ident("kind") {
let lit: LitStr = meta.value()?.parse()?;
let v = lit.value();
if v.is_empty() {
return Err(syn::Error::new(lit.span(), "kind must not be empty"));
}
if !is_valid_kind(&v) {
return Err(syn::Error::new(
lit.span(),
"kind must be a valid schema name: start with a letter, contain only [a-zA-Z0-9_]",
));
}
kind = Some(v);
} else {
return Err(meta.error("unknown key; expected `kind`"));
}
Ok(())
})?;
}
let kind = kind.ok_or_else(|| {
syn::Error::new(ident_span, "#[integrable(kind = \"...\")] is required")
})?;
Ok(Self { kind })
}
}
fn is_valid_kind(s: &str) -> bool {
let mut chars = s.chars();
matches!(chars.next(), Some(c) if c.is_ascii_alphabetic())
&& chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
}
fn fnv1a(data: &[u8], mut hash: u32) -> u32 {
const FNV_PRIME: u32 = 16_777_619;
for &b in data {
hash ^= u32::from(b);
hash = hash.wrapping_mul(FNV_PRIME);
}
hash
}
// Hashes field names and types using the same alphabetical sort order as Hashable,
// so that source-level field reordering never changes VERSION.
fn compute_version(fields: &syn::Fields) -> i32 {
const FNV_OFFSET: u32 = 2_166_136_261;
let mut hash = FNV_OFFSET;
match fields {
syn::Fields::Named(named) => {
for field in crate::utils::sorted_named_fields(named) {
let name = field.ident.as_ref().unwrap().to_string();
let ty = &field.ty;
hash = fnv1a(name.as_bytes(), hash);
hash = fnv1a(quote!(#ty).to_string().as_bytes(), hash);
}
}
syn::Fields::Unnamed(unnamed) => {
for (i, field) in unnamed.unnamed.iter().enumerate() {
let ty = &field.ty;
hash = fnv1a(i.to_string().as_bytes(), hash);
hash = fnv1a(quote!(#ty).to_string().as_bytes(), hash);
}
}
syn::Fields::Unit => {}
}
// Clear sign bit to guarantee a positive i32; substitute 0 → 1.
let v = (hash >> 1).cast_signed();
if v == 0 { 1 } else { v }
}
pub(crate) fn derive(input: &DeriveInput) -> TokenStream {
let syn::Data::Struct(ref data) = input.data else {
return syn::Error::new(
input.ident.span(),
"#[derive(Integrable)] is only supported on structs",
)
.to_compile_error();
};
let integrable_trait = INTEGRABLE_TRAIT_PATH.to_path();
let hashable_trait = crate::utils::HASHABLE_TRAIT_PATH.to_path();
let ident = &input.ident;
let mut generics = input.generics.clone();
for type_param in generics.type_params_mut() {
type_param.bounds.push(syn::parse_quote!(#hashable_trait));
}
let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
let attr = match IntegrableAttr::from_attrs(&input.attrs, input.ident.span()) {
Ok(a) => a,
Err(e) => return e.to_compile_error(),
};
let kind = attr.kind;
let version = compute_version(&data.fields);
quote! {
#[automatically_derived]
impl #impl_generics #integrable_trait for #ident #ty_generics #where_clause {
const KIND: &'static str = #kind;
const VERSION: i32 = #version;
}
}
}

27
server/crates/arbiter-macros/src/lib.rs
View File

@@ -1,10 +1,17 @@
use syn::{DeriveInput, parse_macro_input}; use syn::{DeriveInput, parse_macro_input};
mod hashable; mod hashable;
mod utils; mod integrable;
mod utils;
#[proc_macro_derive(Hashable)]
pub fn derive_hashable(input: proc_macro::TokenStream) -> proc_macro::TokenStream { #[proc_macro_derive(Hashable)]
let input = parse_macro_input!(input as DeriveInput); pub fn derive_hashable(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
hashable::derive(&input).into() let input = parse_macro_input!(input as DeriveInput);
} hashable::derive(&input).into()
}
#[proc_macro_derive(Integrable, attributes(integrable))]
pub fn derive_integrable(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
let input = parse_macro_input!(input as DeriveInput);
integrable::derive(&input).into()
}

59
server/crates/arbiter-macros/src/utils.rs
View File

@@ -1,24 +1,35 @@
pub(crate) struct ToPath(pub &'static str); pub(crate) struct ToPath(pub &'static str);
impl ToPath { impl ToPath {
pub(crate) fn to_path(&self) -> syn::Path { pub(crate) fn to_path(&self) -> syn::Path {
syn::parse_str(self.0).expect("Invalid path") syn::parse_str(self.0).expect("Invalid path")
} }
} }
macro_rules! ensure_path { macro_rules! ensure_path {
($path:path as $name:ident) => { ($path:path as $name:ident) => {
const _: () = { const _: () = {
#[cfg(test)] #[cfg(test)]
#[expect( #[expect(
unused_imports, unused_imports,
reason = "Ensures the path is valid and will cause a compile error if not" reason = "Ensures the path is valid and will cause a compile error if not"
)] )]
use $path as _; use $path as _;
}; };
pub(crate) const $name: ToPath = ToPath(stringify!($path)); pub(crate) const $name: ToPath = ToPath(stringify!($path));
}; };
} }
ensure_path!(::arbiter_crypto::hashing::Hashable as HASHABLE_TRAIT_PATH); ensure_path!(::arbiter_crypto::hashing::Hashable as HASHABLE_TRAIT_PATH);
ensure_path!(::arbiter_crypto::hashing::Digest as HMAC_DIGEST_PATH); ensure_path!(::arbiter_crypto::hashing::Digest as HMAC_DIGEST_PATH);
ensure_path!(::arbiter_crypto::integrity::Integrable as INTEGRABLE_TRAIT_PATH);
/// Returns named struct fields sorted alphabetically by name.
/// Both `Hashable` and `Integrable` derive macros must iterate fields in the
/// same deterministic order so that source-level reordering never changes
/// either the runtime hash or the compile-time VERSION.
pub(crate) fn sorted_named_fields(fields: &syn::FieldsNamed) -> Vec<&syn::Field> {
let mut v: Vec<&syn::Field> = fields.named.iter().collect();
v.sort_by_key(|f| f.ident.as_ref().unwrap().to_string());
v
}

53
server/crates/arbiter-macros/tests/integrable.rs Normal file
View File

@@ -0,0 +1,53 @@
use arbiter_crypto::integrity::Integrable;
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
#[integrable(kind = "test_entity")]
struct TestEntity {
value: i32,
}
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
#[integrable(kind = "other_entity")]
struct OtherEntity {
label: String,
count: u64,
}
#[test]
fn kind_is_set_correctly() {
assert_eq!(<TestEntity as Integrable>::KIND, "test_entity");
assert_eq!(<OtherEntity as Integrable>::KIND, "other_entity");
}
#[test]
fn version_is_positive() {
const {
assert!(<TestEntity as Integrable>::VERSION > 0);
assert!(<OtherEntity as Integrable>::VERSION > 0);
}
}
#[test]
fn different_field_layouts_produce_different_versions() {
assert_ne!(
<TestEntity as Integrable>::VERSION,
<OtherEntity as Integrable>::VERSION,
);
}
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
#[integrable(kind = "generic_entity")]
struct GenericEntity<T> {
inner: T,
}
#[test]
fn generic_struct_derives_integrable() {
assert_eq!(
<GenericEntity<TestEntity> as Integrable>::KIND,
"generic_entity"
);
const {
assert!(<GenericEntity<TestEntity> as Integrable>::VERSION > 0);
}
}

5
server/crates/arbiter-macros/tests/integrable_errors.rs Normal file
View File

@@ -0,0 +1,5 @@
#[test]
fn integrable_compile_fail() {
let t = trybuild::TestCases::new();
t.compile_fail("tests/ui/integrable/*.rs");
}

8
server/crates/arbiter-macros/tests/ui/integrable/duplicate_attr.rs Normal file
View File

@@ -0,0 +1,8 @@
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
#[integrable(kind = "entity_a")]
#[integrable(kind = "entity_b")]
struct DuplicateAttr {
value: i32,
}
fn main() {}

5
server/crates/arbiter-macros/tests/ui/integrable/duplicate_attr.stderr Normal file
View File

@@ -0,0 +1,5 @@
error: duplicate #[integrable] attribute
--> tests/ui/integrable/duplicate_attr.rs:3:1
|
3 | #[integrable(kind = "entity_b")]
| ^

7
server/crates/arbiter-macros/tests/ui/integrable/empty_kind.rs Normal file
View File

@@ -0,0 +1,7 @@
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
#[integrable(kind = "")]
struct EmptyKind {
value: i32,
}
fn main() {}

5
server/crates/arbiter-macros/tests/ui/integrable/empty_kind.stderr Normal file
View File

@@ -0,0 +1,5 @@
error: kind must not be empty
--> tests/ui/integrable/empty_kind.rs:2:21
|
2 | #[integrable(kind = "")]
| ^^

8
server/crates/arbiter-macros/tests/ui/integrable/enum_not_supported.rs Normal file
View File

@@ -0,0 +1,8 @@
#[derive(arbiter_macros::Integrable)]
#[integrable(kind = "my_enum")]
enum MyEnum {
A,
B,
}
fn main() {}

5
server/crates/arbiter-macros/tests/ui/integrable/enum_not_supported.stderr Normal file
View File

@@ -0,0 +1,5 @@
error: #[derive(Integrable)] is only supported on structs
--> tests/ui/integrable/enum_not_supported.rs:3:6
|
3 | enum MyEnum {
| ^^^^^^

7
server/crates/arbiter-macros/tests/ui/integrable/invalid_kind.rs Normal file
View File

@@ -0,0 +1,7 @@
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
#[integrable(kind = "bad kind!")]
struct InvalidKind {
value: i32,
}
fn main() {}

5
server/crates/arbiter-macros/tests/ui/integrable/invalid_kind.stderr Normal file
View File

@@ -0,0 +1,5 @@
error: kind must be a valid schema name: start with a letter, contain only [a-zA-Z0-9_]
--> tests/ui/integrable/invalid_kind.rs:2:21
|
2 | #[integrable(kind = "bad kind!")]
| ^^^^^^^^^^^

6
server/crates/arbiter-macros/tests/ui/integrable/missing_attr.rs Normal file
View File

@@ -0,0 +1,6 @@
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
struct MissingAttr {
value: i32,
}
fn main() {}

5
server/crates/arbiter-macros/tests/ui/integrable/missing_attr.stderr Normal file
View File

@@ -0,0 +1,5 @@
error: #[integrable(kind = "...")] is required
--> tests/ui/integrable/missing_attr.rs:2:8
|
2 | struct MissingAttr {
| ^^^^^^^^^^^

70
server/crates/arbiter-proto/Cargo.toml
View File

@@ -1,35 +1,35 @@
[package] [package]
name = "arbiter-proto" name = "arbiter-proto"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
repository = "https://git.markettakers.org/MarketTakers/arbiter" repository = "https://git.markettakers.org/MarketTakers/arbiter"
license = "Apache-2.0" license = "Apache-2.0"
[dependencies] [dependencies]
tonic.workspace = true tonic.workspace = true
tokio.workspace = true tokio.workspace = true
futures.workspace = true futures.workspace = true
tonic-prost = "0.14.5" tonic-prost = "0.14.5"
prost.workspace = true prost.workspace = true
kameo.workspace = true kameo.workspace = true
url = "2.5.8" url = "2.5.8"
miette.workspace = true miette.workspace = true
thiserror.workspace = true thiserror.workspace = true
rustls-pki-types.workspace = true rustls-pki-types.workspace = true
base64.workspace = true base64.workspace = true
prost-types.workspace = true prost-types.workspace = true
async-trait.workspace = true async-trait.workspace = true
tokio-stream.workspace = true tokio-stream.workspace = true
[build-dependencies] [build-dependencies]
tonic-prost-build = "0.14.5" tonic-prost-build = "0.14.5"
[dev-dependencies] [dev-dependencies]
rstest.workspace = true rstest.workspace = true
rcgen.workspace = true rcgen.workspace = true
[lib] [lib]
doctest = false doctest = false
[package.metadata.cargo-shear] [package.metadata.cargo-shear]
ignored = ["tonic-prost", "prost"] ignored = ["tonic-prost", "prost"]

42
server/crates/arbiter-proto/build.rs
View File

@@ -1,21 +1,21 @@
use tonic_prost_build::configure; use tonic_prost_build::configure;
static PROTOBUF_DIR: &str = "../../../protobufs"; static PROTOBUF_DIR: &str = "../../../protobufs";
fn main() -> Result<(), Box<dyn std::error::Error>> { fn main() -> Result<(), Box<dyn std::error::Error>> {
println!("cargo::rerun-if-changed={PROTOBUF_DIR}"); println!("cargo::rerun-if-changed={PROTOBUF_DIR}");
configure() configure()
.message_attribute(".", "#[derive(::kameo::Reply)]") .message_attribute(".", "#[derive(::kameo::Reply)]")
.compile_protos( .compile_protos(
&[ &[
format!("{}/arbiter.proto", PROTOBUF_DIR), format!("{}/arbiter.proto", PROTOBUF_DIR),
format!("{}/operator.proto", PROTOBUF_DIR), format!("{}/operator.proto", PROTOBUF_DIR),
format!("{}/client.proto", PROTOBUF_DIR), format!("{}/client.proto", PROTOBUF_DIR),
format!("{}/evm.proto", PROTOBUF_DIR), format!("{}/evm.proto", PROTOBUF_DIR),
], ],
&[PROTOBUF_DIR.to_string()], &[PROTOBUF_DIR.to_string()],
) )
.unwrap(); .unwrap();
Ok(()) Ok(())
} }

168
server/crates/arbiter-proto/src/lib.rs
View File

@@ -1,84 +1,84 @@
pub mod transport; pub mod transport;
pub mod url; pub mod url;
pub mod proto { pub mod proto {
tonic::include_proto!("arbiter"); tonic::include_proto!("arbiter");
pub mod shared { pub mod shared {
tonic::include_proto!("arbiter.shared"); tonic::include_proto!("arbiter.shared");
pub mod evm { pub mod evm {
tonic::include_proto!("arbiter.shared.evm"); tonic::include_proto!("arbiter.shared.evm");
} }
} }
pub mod operator { pub mod operator {
tonic::include_proto!("arbiter.operator"); tonic::include_proto!("arbiter.operator");
pub mod auth { pub mod auth {
tonic::include_proto!("arbiter.operator.auth"); tonic::include_proto!("arbiter.operator.auth");
} }
pub mod evm { pub mod evm {
tonic::include_proto!("arbiter.operator.evm"); tonic::include_proto!("arbiter.operator.evm");
} }
pub mod sdk_client { pub mod sdk_client {
tonic::include_proto!("arbiter.operator.sdk_client"); tonic::include_proto!("arbiter.operator.sdk_client");
} }
pub mod vault { pub mod vault {
tonic::include_proto!("arbiter.operator.vault"); tonic::include_proto!("arbiter.operator.vault");
pub mod bootstrap { pub mod bootstrap {
tonic::include_proto!("arbiter.operator.vault.bootstrap"); tonic::include_proto!("arbiter.operator.vault.bootstrap");
} }
pub mod unseal { pub mod unseal {
tonic::include_proto!("arbiter.operator.vault.unseal"); tonic::include_proto!("arbiter.operator.vault.unseal");
} }
} }
} }
pub mod client { pub mod client {
tonic::include_proto!("arbiter.client"); tonic::include_proto!("arbiter.client");
pub mod auth { pub mod auth {
tonic::include_proto!("arbiter.client.auth"); tonic::include_proto!("arbiter.client.auth");
} }
pub mod evm { pub mod evm {
tonic::include_proto!("arbiter.client.evm"); tonic::include_proto!("arbiter.client.evm");
} }
pub mod vault { pub mod vault {
tonic::include_proto!("arbiter.client.vault"); tonic::include_proto!("arbiter.client.vault");
} }
} }
pub mod evm { pub mod evm {
tonic::include_proto!("arbiter.evm"); tonic::include_proto!("arbiter.evm");
} }
} }
#[derive(Debug, Clone, PartialEq, Eq)] #[derive(Debug, Clone, PartialEq, Eq)]
pub struct ClientMetadata { pub struct ClientMetadata {
pub name: String, pub name: String,
pub description: Option<String>, pub description: Option<String>,
pub version: Option<String>, pub version: Option<String>,
} }
pub static BOOTSTRAP_PATH: &str = "bootstrap_token"; pub static BOOTSTRAP_PATH: &str = "bootstrap_token";
pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> { pub fn home_path() -> Result<std::path::PathBuf, std::io::Error> {
static ARBITER_HOME: &str = ".arbiter"; static ARBITER_HOME: &str = ".arbiter";
let home_dir = std::env::home_dir().ok_or(std::io::Error::new( let home_dir = std::env::home_dir().ok_or(std::io::Error::new(
std::io::ErrorKind::PermissionDenied, std::io::ErrorKind::PermissionDenied,
"can not get home directory", "can not get home directory",
))?; ))?;
let arbiter_home = home_dir.join(ARBITER_HOME); let arbiter_home = home_dir.join(ARBITER_HOME);
std::fs::create_dir_all(&arbiter_home)?; std::fs::create_dir_all(&arbiter_home)?;
Ok(arbiter_home) Ok(arbiter_home)
} }

436
server/crates/arbiter-proto/src/transport.rs
View File

@@ -1,218 +1,218 @@
//! Transport-facing abstractions shared by protocol/session code. //! Transport-facing abstractions shared by protocol/session code.
//! //!
//! This module defines a small set of transport traits that actors and other //! This module defines a small set of transport traits that actors and other
//! protocol code can depend on without knowing anything about the concrete //! protocol code can depend on without knowing anything about the concrete
//! transport underneath. //! transport underneath.
//! //!
//! The abstraction is split into: //! The abstraction is split into:
//! - [`Sender`] for outbound delivery //! - [`Sender`] for outbound delivery
//! - [`Receiver`] for inbound delivery //! - [`Receiver`] for inbound delivery
//! - [`Bi`] as the combined duplex form (`Sender + Receiver`) //! - [`Bi`] as the combined duplex form (`Sender + Receiver`)
//! //!
//! This split lets code depend only on the half it actually needs. For //! This split lets code depend only on the half it actually needs. For
//! example, some actor/session code only sends out-of-band messages, while //! example, some actor/session code only sends out-of-band messages, while
//! auth/state-machine code may need full duplex access. //! auth/state-machine code may need full duplex access.
//! //!
//! [`Bi`] remains intentionally minimal and transport-agnostic: //! [`Bi`] remains intentionally minimal and transport-agnostic:
//! - [`Receiver::recv`] yields inbound messages //! - [`Receiver::recv`] yields inbound messages
//! - [`Sender::send`] accepts outbound messages //! - [`Sender::send`] accepts outbound messages
//! //!
//! Transport-specific adapters, including protobuf or gRPC bridges, live in the //! Transport-specific adapters, including protobuf or gRPC bridges, live in the
//! crates that own those boundaries rather than in `arbiter-proto`. //! crates that own those boundaries rather than in `arbiter-proto`.
//! //!
//! [`Bi`] deliberately does not model request/response correlation. Some //! [`Bi`] deliberately does not model request/response correlation. Some
//! transports may carry multiplexed request/response traffic, some may emit //! transports may carry multiplexed request/response traffic, some may emit
//! out-of-band messages, and some may be one-message-at-a-time state machines. //! out-of-band messages, and some may be one-message-at-a-time state machines.
//! Correlation concerns such as request IDs, pending response maps, and //! Correlation concerns such as request IDs, pending response maps, and
//! out-of-band routing belong in the adapter or connection layer built on top //! out-of-band routing belong in the adapter or connection layer built on top
//! of [`Bi`], not in this abstraction itself. //! of [`Bi`], not in this abstraction itself.
//! //!
//! # Generic Ordering Rule //! # Generic Ordering Rule
//! //!
//! This module consistently uses `Inbound` first and `Outbound` second in //! This module consistently uses `Inbound` first and `Outbound` second in
//! generic parameter lists. //! generic parameter lists.
//! //!
//! For [`Receiver`], [`Sender`], and [`Bi`], this means: //! For [`Receiver`], [`Sender`], and [`Bi`], this means:
//! - `Receiver<Inbound>` //! - `Receiver<Inbound>`
//! - `Sender<Outbound>` //! - `Sender<Outbound>`
//! - `Bi<Inbound, Outbound>` //! - `Bi<Inbound, Outbound>`
//! //!
//! Concretely, for [`Bi`]: //! Concretely, for [`Bi`]:
//! - `recv() -> Option<Inbound>` //! - `recv() -> Option<Inbound>`
//! - `send(Outbound)` //! - `send(Outbound)`
//! //!
//! [`expect_message`] is a small helper for linear protocol steps: it reads one //! [`expect_message`] is a small helper for linear protocol steps: it reads one
//! inbound message from a transport and extracts a typed value from it, failing //! inbound message from a transport and extracts a typed value from it, failing
//! if the channel closes or the message shape is not what the caller expected. //! if the channel closes or the message shape is not what the caller expected.
//! //!
//! [`DummyTransport`] is a no-op implementation useful for tests and local //! [`DummyTransport`] is a no-op implementation useful for tests and local
//! actor execution where no real stream exists. //! actor execution where no real stream exists.
//! //!
//! # Design Notes //! # Design Notes
//! //!
//! - [`Bi::send`] returns [`Error`] only for transport delivery failures, such //! - [`Bi::send`] returns [`Error`] only for transport delivery failures, such
//! as a closed outbound channel. //! as a closed outbound channel.
//! - [`Bi::recv`] returns `None` when the underlying transport closes. //! - [`Bi::recv`] returns `None` when the underlying transport closes.
//! - Message translation is intentionally out of scope for this module. //! - Message translation is intentionally out of scope for this module.
use async_trait::async_trait; use async_trait::async_trait;
use kameo::{error::Infallible, prelude::*}; use kameo::{error::Infallible, prelude::*};
use std::marker::PhantomData; use std::marker::PhantomData;
/// Errors returned by transport adapters implementing [`Bi`]. /// Errors returned by transport adapters implementing [`Bi`].
#[derive(thiserror::Error, Debug)] #[derive(thiserror::Error, Debug)]
pub enum Error { pub enum Error {
#[error("Transport channel is closed")] #[error("Transport channel is closed")]
ChannelClosed, ChannelClosed,
#[error("Unexpected message received")] #[error("Unexpected message received")]
UnexpectedMessage, UnexpectedMessage,
} }
/// Receives one message from `transport` and extracts a value from it using /// Receives one message from `transport` and extracts a value from it using
/// `extractor`. Returns [`Error::ChannelClosed`] if the transport closes and /// `extractor`. Returns [`Error::ChannelClosed`] if the transport closes and
/// [`Error::UnexpectedMessage`] if `extractor` returns `None`. /// [`Error::UnexpectedMessage`] if `extractor` returns `None`.
pub async fn expect_message<T, Inbound, Outbound, Target, F>( pub async fn expect_message<T, Inbound, Outbound, Target, F>(
transport: &mut T, transport: &mut T,
extractor: F, extractor: F,
) -> Result<Target, Error> ) -> Result<Target, Error>
where where
T: Bi<Inbound, Outbound> + ?Sized, T: Bi<Inbound, Outbound> + ?Sized,
F: FnOnce(Inbound) -> Option<Target>, F: FnOnce(Inbound) -> Option<Target>,
{ {
let msg = transport.recv().await.ok_or(Error::ChannelClosed)?; let msg = transport.recv().await.ok_or(Error::ChannelClosed)?;
extractor(msg).ok_or(Error::UnexpectedMessage) extractor(msg).ok_or(Error::UnexpectedMessage)
} }
#[async_trait] #[async_trait]
pub trait Sender<Outbound>: Send + Sync { pub trait Sender<Outbound>: Send + Sync {
async fn send(&mut self, item: Outbound) -> Result<(), Error>; async fn send(&mut self, item: Outbound) -> Result<(), Error>;
} }
#[async_trait] #[async_trait]
pub trait Receiver<Inbound>: Send + Sync { pub trait Receiver<Inbound>: Send + Sync {
async fn recv(&mut self) -> Option<Inbound>; async fn recv(&mut self) -> Option<Inbound>;
} }
/// Minimal bidirectional transport abstraction used by protocol code. /// Minimal bidirectional transport abstraction used by protocol code.
/// ///
/// `Bi<Inbound, Outbound>` is the combined duplex form of [`Sender`] and /// `Bi<Inbound, Outbound>` is the combined duplex form of [`Sender`] and
/// [`Receiver`]. /// [`Receiver`].
/// ///
/// It models a channel with: /// It models a channel with:
/// - inbound items of type `Inbound` read via [`Bi::recv`] /// - inbound items of type `Inbound` read via [`Bi::recv`]
/// - outbound items of type `Outbound` written via [`Bi::send`] /// - outbound items of type `Outbound` written via [`Bi::send`]
/// ///
/// It does not imply request/response sequencing, one-at-a-time exchange, or /// It does not imply request/response sequencing, one-at-a-time exchange, or
/// any built-in correlation mechanism between inbound and outbound items. /// any built-in correlation mechanism between inbound and outbound items.
pub trait Bi<Inbound, Outbound>: Sender<Outbound> + Receiver<Inbound> + Send + Sync {} pub trait Bi<Inbound, Outbound>: Sender<Outbound> + Receiver<Inbound> + Send + Sync {}
#[async_trait] #[async_trait]
impl<T, Outbound> Sender<Outbound> for &mut T impl<T, Outbound> Sender<Outbound> for &mut T
where where
T: Sender<Outbound> + ?Sized, T: Sender<Outbound> + ?Sized,
Outbound: Send + 'static, Outbound: Send + 'static,
{ {
async fn send(&mut self, item: Outbound) -> Result<(), Error> { async fn send(&mut self, item: Outbound) -> Result<(), Error> {
(**self).send(item).await (**self).send(item).await
} }
} }
#[async_trait] #[async_trait]
impl<T, Inbound> Receiver<Inbound> for &mut T impl<T, Inbound> Receiver<Inbound> for &mut T
where where
T: Receiver<Inbound> + ?Sized, T: Receiver<Inbound> + ?Sized,
Inbound: Send + 'static, Inbound: Send + 'static,
{ {
async fn recv(&mut self) -> Option<Inbound> { async fn recv(&mut self) -> Option<Inbound> {
(**self).recv().await (**self).recv().await
} }
} }
impl<T, Inbound, Outbound> Bi<Inbound, Outbound> for &mut T impl<T, Inbound, Outbound> Bi<Inbound, Outbound> for &mut T
where where
T: Bi<Inbound, Outbound> + ?Sized, T: Bi<Inbound, Outbound> + ?Sized,
Inbound: Send + 'static, Inbound: Send + 'static,
Outbound: Send + 'static, Outbound: Send + 'static,
{ {
} }
pub trait SplittableBi<Inbound, Outbound>: Bi<Inbound, Outbound> { pub trait SplittableBi<Inbound, Outbound>: Bi<Inbound, Outbound> {
type Sender: Sender<Outbound>; type Sender: Sender<Outbound>;
type Receiver: Receiver<Inbound>; type Receiver: Receiver<Inbound>;
fn split(self) -> (Self::Sender, Self::Receiver); fn split(self) -> (Self::Sender, Self::Receiver);
fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self; fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self;
} }
/// No-op [`Bi`] transport for tests and manual actor usage. /// No-op [`Bi`] transport for tests and manual actor usage.
/// ///
/// `send` drops all items and succeeds. [`Bi::recv`] never resolves and therefore /// `send` drops all items and succeeds. [`Bi::recv`] never resolves and therefore
/// does not busy-wait or spuriously close the stream. /// does not busy-wait or spuriously close the stream.
pub struct DummyTransport<Inbound, Outbound> { pub struct DummyTransport<Inbound, Outbound> {
_marker: PhantomData<(Inbound, Outbound)>, _marker: PhantomData<(Inbound, Outbound)>,
} }
impl<Inbound, Outbound> Default for DummyTransport<Inbound, Outbound> { impl<Inbound, Outbound> Default for DummyTransport<Inbound, Outbound> {
fn default() -> Self { fn default() -> Self {
Self { Self {
_marker: PhantomData, _marker: PhantomData,
} }
} }
} }
#[async_trait] #[async_trait]
impl<Inbound, Outbound> Sender<Outbound> for DummyTransport<Inbound, Outbound> impl<Inbound, Outbound> Sender<Outbound> for DummyTransport<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn send(&mut self, _item: Outbound) -> Result<(), Error> { async fn send(&mut self, _item: Outbound) -> Result<(), Error> {
Ok(()) Ok(())
} }
} }
#[async_trait] #[async_trait]
impl<Inbound, Outbound> Receiver<Inbound> for DummyTransport<Inbound, Outbound> impl<Inbound, Outbound> Receiver<Inbound> for DummyTransport<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn recv(&mut self) -> Option<Inbound> { async fn recv(&mut self) -> Option<Inbound> {
std::future::pending::<()>().await; std::future::pending::<()>().await;
None None
} }
} }
impl<Inbound, Outbound> Bi<Inbound, Outbound> for DummyTransport<Inbound, Outbound> impl<Inbound, Outbound> Bi<Inbound, Outbound> for DummyTransport<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
} }
pub mod grpc; pub mod grpc;
#[derive(thiserror::Error, Debug)] #[derive(thiserror::Error, Debug)]
pub enum ForwardError<I> { pub enum ForwardError<I> {
#[error("Transport error: {0}")] #[error("Transport error: {0}")]
Transport(#[from] Error), Transport(#[from] Error),
#[error("Actor delivery error: {0}")] #[error("Actor delivery error: {0}")]
Actor(SendError<I>), Actor(SendError<I>),
} }
pub async fn forward_to_actor<Transport, Inbound, Outbound, Handler>( pub async fn forward_to_actor<Transport, Inbound, Outbound, Handler>(
transport: &mut Transport, transport: &mut Transport,
actor: &ActorRef<Handler>, actor: &ActorRef<Handler>,
) -> Result<(), ForwardError<Inbound>> ) -> Result<(), ForwardError<Inbound>>
where where
Transport: Bi<Inbound, <Outbound as Reply>::Ok>, Transport: Bi<Inbound, <Outbound as Reply>::Ok>,
Handler: Actor + Message<Inbound, Reply = Outbound>, Handler: Actor + Message<Inbound, Reply = Outbound>,
Inbound: Send + 'static, Inbound: Send + 'static,
Outbound: Send + 'static + Reply<Error = Infallible>, // `Infallible` to enforce contract that `Outbound` carries handler-level error Outbound: Send + 'static + Reply<Error = Infallible>, // `Infallible` to enforce contract that `Outbound` carries handler-level error
{ {
while let Some(request) = transport.recv().await { while let Some(request) = transport.recv().await {
let resp = actor.ask(request).await.map_err(ForwardError::Actor)?; let resp = actor.ask(request).await.map_err(ForwardError::Actor)?;
transport.send(resp).await? transport.send(resp).await?
} }
Err(Error::ChannelClosed.into()) Err(Error::ChannelClosed.into())
} }

212
server/crates/arbiter-proto/src/transport/grpc.rs
View File

@@ -1,106 +1,106 @@
use super::{Bi, Receiver, Sender}; use super::{Bi, Receiver, Sender};
use async_trait::async_trait; use async_trait::async_trait;
use futures::StreamExt; use futures::StreamExt;
use tokio::sync::mpsc; use tokio::sync::mpsc;
use tokio_stream::wrappers::ReceiverStream; use tokio_stream::wrappers::ReceiverStream;
pub struct GrpcSender<Outbound> { pub struct GrpcSender<Outbound> {
tx: mpsc::Sender<Result<Outbound, tonic::Status>>, tx: mpsc::Sender<Result<Outbound, tonic::Status>>,
} }
#[async_trait] #[async_trait]
impl<Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcSender<Outbound> impl<Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcSender<Outbound>
where where
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> { async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> {
self.tx self.tx
.send(item) .send(item)
.await .await
.map_err(|_| super::Error::ChannelClosed) .map_err(|_| super::Error::ChannelClosed)
} }
} }
pub struct GrpcReceiver<Inbound> { pub struct GrpcReceiver<Inbound> {
rx: tonic::Streaming<Inbound>, rx: tonic::Streaming<Inbound>,
} }
#[async_trait] #[async_trait]
impl<Inbound> Receiver<Result<Inbound, tonic::Status>> for GrpcReceiver<Inbound> impl<Inbound> Receiver<Result<Inbound, tonic::Status>> for GrpcReceiver<Inbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
{ {
async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> { async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> {
self.rx.next().await self.rx.next().await
} }
} }
pub struct GrpcBi<Inbound, Outbound> { pub struct GrpcBi<Inbound, Outbound> {
sender: GrpcSender<Outbound>, sender: GrpcSender<Outbound>,
receiver: GrpcReceiver<Inbound>, receiver: GrpcReceiver<Inbound>,
} }
impl<Inbound, Outbound> GrpcBi<Inbound, Outbound> impl<Inbound, Outbound> GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
pub fn from_bi_stream( pub fn from_bi_stream(
receiver: tonic::Streaming<Inbound>, receiver: tonic::Streaming<Inbound>,
) -> (Self, ReceiverStream<Result<Outbound, tonic::Status>>) { ) -> (Self, ReceiverStream<Result<Outbound, tonic::Status>>) {
let (tx, rx) = mpsc::channel(10); let (tx, rx) = mpsc::channel(10);
let sender = GrpcSender { tx }; let sender = GrpcSender { tx };
let receiver = GrpcReceiver { rx: receiver }; let receiver = GrpcReceiver { rx: receiver };
let bi = GrpcBi { sender, receiver }; let bi = GrpcBi { sender, receiver };
(bi, ReceiverStream::new(rx)) (bi, ReceiverStream::new(rx))
} }
} }
#[async_trait] #[async_trait]
impl<Inbound, Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcBi<Inbound, Outbound> impl<Inbound, Outbound> Sender<Result<Outbound, tonic::Status>> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> { async fn send(&mut self, item: Result<Outbound, tonic::Status>) -> Result<(), super::Error> {
self.sender.send(item).await self.sender.send(item).await
} }
} }
#[async_trait] #[async_trait]
impl<Inbound, Outbound> Receiver<Result<Inbound, tonic::Status>> for GrpcBi<Inbound, Outbound> impl<Inbound, Outbound> Receiver<Result<Inbound, tonic::Status>> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> { async fn recv(&mut self) -> Option<Result<Inbound, tonic::Status>> {
self.receiver.recv().await self.receiver.recv().await
} }
} }
impl<Inbound, Outbound> Bi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>> impl<Inbound, Outbound> Bi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>>
for GrpcBi<Inbound, Outbound> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
} }
impl<Inbound, Outbound> impl<Inbound, Outbound>
super::SplittableBi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>> super::SplittableBi<Result<Inbound, tonic::Status>, Result<Outbound, tonic::Status>>
for GrpcBi<Inbound, Outbound> for GrpcBi<Inbound, Outbound>
where where
Inbound: Send + Sync + 'static, Inbound: Send + Sync + 'static,
Outbound: Send + Sync + 'static, Outbound: Send + Sync + 'static,
{ {
type Sender = GrpcSender<Outbound>; type Sender = GrpcSender<Outbound>;
type Receiver = GrpcReceiver<Inbound>; type Receiver = GrpcReceiver<Inbound>;
fn split(self) -> (Self::Sender, Self::Receiver) { fn split(self) -> (Self::Sender, Self::Receiver) {
(self.sender, self.receiver) (self.sender, self.receiver)
} }
fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self { fn from_parts(sender: Self::Sender, receiver: Self::Receiver) -> Self {
GrpcBi { sender, receiver } GrpcBi { sender, receiver }
} }
} }

256
server/crates/arbiter-proto/src/url.rs
View File

@@ -1,128 +1,128 @@
use base64::{Engine as _, prelude::BASE64_URL_SAFE}; use base64::{Engine as _, prelude::BASE64_URL_SAFE};
use rustls_pki_types::CertificateDer; use rustls_pki_types::CertificateDer;
use std::fmt::Display; use std::fmt::Display;
const ARBITER_URL_SCHEME: &str = "arbiter"; const ARBITER_URL_SCHEME: &str = "arbiter";
const CERT_QUERY_KEY: &str = "cert"; const CERT_QUERY_KEY: &str = "cert";
const BOOTSTRAP_TOKEN_QUERY_KEY: &str = "bootstrap_token"; const BOOTSTRAP_TOKEN_QUERY_KEY: &str = "bootstrap_token";
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub struct ArbiterUrl { pub struct ArbiterUrl {
pub host: String, pub host: String,
pub port: u16, pub port: u16,
pub ca_cert: CertificateDer<'static>, pub ca_cert: CertificateDer<'static>,
pub bootstrap_token: Option<String>, pub bootstrap_token: Option<String>,
} }
impl Display for ArbiterUrl { impl Display for ArbiterUrl {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut base = format!( let mut base = format!(
"{ARBITER_URL_SCHEME}://{}:{}?{CERT_QUERY_KEY}={}", "{ARBITER_URL_SCHEME}://{}:{}?{CERT_QUERY_KEY}={}",
self.host, self.host,
self.port, self.port,
BASE64_URL_SAFE.encode(&self.ca_cert) BASE64_URL_SAFE.encode(&self.ca_cert)
); );
if let Some(token) = &self.bootstrap_token { if let Some(token) = &self.bootstrap_token {
base.push_str(&format!("&{BOOTSTRAP_TOKEN_QUERY_KEY}={}", token)); base.push_str(&format!("&{BOOTSTRAP_TOKEN_QUERY_KEY}={}", token));
} }
f.write_str(&base) f.write_str(&base)
} }
} }
#[derive(Debug, thiserror::Error, miette::Diagnostic)] #[derive(Debug, thiserror::Error, miette::Diagnostic)]
pub enum Error { pub enum Error {
#[error("Invalid URL scheme, expected '{ARBITER_URL_SCHEME}://'")] #[error("Invalid URL scheme, expected '{ARBITER_URL_SCHEME}://'")]
#[diagnostic( #[diagnostic(
code(arbiter::url::invalid_scheme), code(arbiter::url::invalid_scheme),
help("The URL must start with '{ARBITER_URL_SCHEME}://'") help("The URL must start with '{ARBITER_URL_SCHEME}://'")
)] )]
InvalidScheme, InvalidScheme,
#[error("Missing host in URL")] #[error("Missing host in URL")]
#[diagnostic( #[diagnostic(
code(arbiter::url::missing_host), code(arbiter::url::missing_host),
help("The URL must include a host, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:<port>'") help("The URL must include a host, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:<port>'")
)] )]
MissingHost, MissingHost,
#[error("Missing port in URL")] #[error("Missing port in URL")]
#[diagnostic( #[diagnostic(
code(arbiter::url::missing_port), code(arbiter::url::missing_port),
help("The URL must include a port, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:1234'") help("The URL must include a port, e.g., '{ARBITER_URL_SCHEME}://127.0.0.1:1234'")
)] )]
MissingPort, MissingPort,
#[error("Missing 'cert' query parameter in URL")] #[error("Missing 'cert' query parameter in URL")]
#[diagnostic( #[diagnostic(
code(arbiter::url::missing_cert), code(arbiter::url::missing_cert),
help("The URL must include a 'cert' query parameter") help("The URL must include a 'cert' query parameter")
)] )]
MissingCert, MissingCert,
#[error("Invalid base64 in 'cert' query parameter: {0}")] #[error("Invalid base64 in 'cert' query parameter: {0}")]
#[diagnostic(code(arbiter::url::invalid_cert_base64))] #[diagnostic(code(arbiter::url::invalid_cert_base64))]
InvalidCertBase64(#[from] base64::DecodeError), InvalidCertBase64(#[from] base64::DecodeError),
} }
impl<'a> TryFrom<&'a str> for ArbiterUrl { impl<'a> TryFrom<&'a str> for ArbiterUrl {
type Error = Error; type Error = Error;
fn try_from(value: &'a str) -> Result<Self, Self::Error> { fn try_from(value: &'a str) -> Result<Self, Self::Error> {
let url = url::Url::parse(value).map_err(|_| Error::InvalidScheme)?; let url = url::Url::parse(value).map_err(|_| Error::InvalidScheme)?;
if url.scheme() != ARBITER_URL_SCHEME { if url.scheme() != ARBITER_URL_SCHEME {
return Err(Error::InvalidScheme); return Err(Error::InvalidScheme);
} }
let host = url.host_str().ok_or(Error::MissingHost)?.to_string(); let host = url.host_str().ok_or(Error::MissingHost)?.to_string();
let port = url.port().ok_or(Error::MissingPort)?; let port = url.port().ok_or(Error::MissingPort)?;
let cert_str = url let cert_str = url
.query_pairs() .query_pairs()
.find(|(k, _)| k == CERT_QUERY_KEY) .find(|(k, _)| k == CERT_QUERY_KEY)
.ok_or(Error::MissingCert)? .ok_or(Error::MissingCert)?
.1; .1;
let cert = BASE64_URL_SAFE.decode(cert_str.as_ref())?; let cert = BASE64_URL_SAFE.decode(cert_str.as_ref())?;
let cert = CertificateDer::from_slice(&cert).into_owned(); let cert = CertificateDer::from_slice(&cert).into_owned();
let bootstrap_token = url let bootstrap_token = url
.query_pairs() .query_pairs()
.find(|(k, _)| k == BOOTSTRAP_TOKEN_QUERY_KEY) .find(|(k, _)| k == BOOTSTRAP_TOKEN_QUERY_KEY)
.map(|(_, v)| v.to_string()); .map(|(_, v)| v.to_string());
Ok(ArbiterUrl { Ok(ArbiterUrl {
host, host,
port, port,
ca_cert: cert, ca_cert: cert,
bootstrap_token, bootstrap_token,
}) })
} }
} }
#[cfg(test)] #[cfg(test)]
mod tests { mod tests {
use rcgen::generate_simple_self_signed; use rcgen::generate_simple_self_signed;
use rstest::rstest; use rstest::rstest;
use super::*; use super::*;
#[rstest] #[rstest]
fn parsing_correctness( fn parsing_correctness(
#[values("127.0.0.1", "localhost", "192.168.1.1", "some.domain.com")] host: &str, #[values("127.0.0.1", "localhost", "192.168.1.1", "some.domain.com")] host: &str,
#[values(None, Some("token123".to_string()))] bootstrap_token: Option<String>, #[values(None, Some("token123".to_string()))] bootstrap_token: Option<String>,
) { ) {
let cert = generate_simple_self_signed(&["Arbiter CA".into()]).unwrap(); let cert = generate_simple_self_signed(&["Arbiter CA".into()]).unwrap();
let cert = cert.cert.der(); let cert = cert.cert.der();
let url = ArbiterUrl { let url = ArbiterUrl {
host: host.to_string(), host: host.to_string(),
port: 1234, port: 1234,
ca_cert: cert.clone().into_owned(), ca_cert: cert.clone().into_owned(),
bootstrap_token, bootstrap_token,
}; };
let url_str = url.to_string(); let url_str = url.to_string();
let parsed_url = ArbiterUrl::try_from(url_str.as_str()).unwrap(); let parsed_url = ArbiterUrl::try_from(url_str.as_str()).unwrap();
assert_eq!(url.host, parsed_url.host); assert_eq!(url.host, parsed_url.host);
assert_eq!(url.port, parsed_url.port); assert_eq!(url.port, parsed_url.port);
assert_eq!(url.ca_cert.to_vec(), parsed_url.ca_cert.to_vec()); assert_eq!(url.ca_cert.to_vec(), parsed_url.ca_cert.to_vec());
assert_eq!(url.bootstrap_token, parsed_url.bootstrap_token); assert_eq!(url.bootstrap_token, parsed_url.bootstrap_token);
} }
} }

122
server/crates/arbiter-server/Cargo.toml
View File

@@ -1,61 +1,61 @@
[package] [package]
name = "arbiter-server" name = "arbiter-server"
version = "0.1.0" version = "0.1.0"
edition = "2024" edition = "2024"
repository = "https://git.markettakers.org/MarketTakers/arbiter" repository = "https://git.markettakers.org/MarketTakers/arbiter"
license = "Apache-2.0" license = "Apache-2.0"
[lints] [lints]
workspace = true workspace = true
[dependencies] [dependencies]
diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] } diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
diesel-async = { version = "0.9.0", features = [ diesel-async = { version = "0.9.0", features = [
"bb8", "bb8",
"migrations", "migrations",
"sqlite", "sqlite",
"tokio", "tokio",
] } ] }
arbiter-proto.path = "../arbiter-proto" arbiter-proto.path = "../arbiter-proto"
arbiter-crypto.path = "../arbiter-crypto" arbiter-crypto.path = "../arbiter-crypto"
arbiter-macros.path = "../arbiter-macros" arbiter-macros.path = "../arbiter-macros"
tracing.workspace = true tracing.workspace = true
tracing-subscriber = { version = "0.3", features = ["env-filter"] } tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tonic.workspace = true tonic.workspace = true
tonic.features = ["tls-aws-lc"] tonic.features = ["tls-aws-lc"]
tokio.workspace = true tokio.workspace = true
rustls.workspace = true rustls.workspace = true
smlang.workspace = true smlang.workspace = true
thiserror.workspace = true thiserror.workspace = true
diesel_migrations = { version = "2.3.2", features = ["sqlite"] } diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
async-trait.workspace = true async-trait.workspace = true
tokio-stream.workspace = true tokio-stream.workspace = true
rand.workspace = true rand.workspace = true
rcgen.workspace = true rcgen.workspace = true
chrono.workspace = true chrono.workspace = true
kameo.workspace = true kameo.workspace = true
chacha20poly1305 = { version = "0.10.1", features = ["std"] } chacha20poly1305 = { version = "0.10.1", features = ["std"] }
argon2 = { version = "0.5.3", features = ["zeroize"] } argon2 = { version = "0.5.3", features = ["zeroize"] }
restructed = "0.2.2" restructed = "0.2.2"
strum = { version = "0.28.0", features = ["derive"] } strum = { version = "0.28.0", features = ["derive"] }
pem = "3.0.6" pem = "3.0.6"
sha2.workspace = true sha2.workspace = true
hmac.workspace = true hmac.workspace = true
alloy.workspace = true alloy.workspace = true
prost-types.workspace = true prost-types.workspace = true
arbiter-tokens-registry.path = "../arbiter-tokens-registry" arbiter-tokens-registry.path = "../arbiter-tokens-registry"
anyhow = "1.0.102" anyhow = "1.0.102"
mutants.workspace = true mutants.workspace = true
subtle = "2.6.1" subtle = "2.6.1"
x25519-dalek.workspace = true x25519-dalek.workspace = true
k256.workspace = true k256.workspace = true
kameo_actors.workspace = true kameo_actors.workspace = true
[dev-dependencies] [dev-dependencies]
proptest = "1.11.0" proptest = "1.11.0"
rstest.workspace = true rstest.workspace = true
test-log = { version = "0.2", default-features = false, features = ["trace"] } test-log = { version = "0.2", default-features = false, features = ["trace"] }
ml-dsa.workspace = true ml-dsa.workspace = true
[lib] [lib]
doctest = false doctest = false

18
server/crates/arbiter-server/diesel.toml
View File

@@ -1,9 +1,9 @@
# For documentation on how to configure this file, # For documentation on how to configure this file,
# see https://diesel.rs/guides/configuring-diesel-cli # see https://diesel.rs/guides/configuring-diesel-cli
[print_schema] [print_schema]
file = "src/db/schema.rs" file = "src/db/schema.rs"
custom_type_derives = ["diesel::query_builder::QueryId", "Clone"] custom_type_derives = ["diesel::query_builder::QueryId", "Clone"]
[migrations_directory] [migrations_directory]
dir = "migrations" dir = "migrations"

2
server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/down.sql
View File

@@ -1 +1 @@
-- This file should undo anything in `up.sql` -- This file should undo anything in `up.sql`

412
server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
View File

@@ -1,206 +1,206 @@
create table if not exists root_key_history ( create table if not exists root_key_history (
id INTEGER not null PRIMARY KEY, id INTEGER not null PRIMARY KEY,
-- root key stored as aead encrypted artifact, with only difference that it's decrypted by unseal key (derived from user password) -- root key stored as aead encrypted artifact, with only difference that it's decrypted by unseal key (derived from user password)
root_key_encryption_nonce blob not null default(1), -- if re-encrypted, this should be incremented. Used for encrypting root key root_key_encryption_nonce blob not null default(1), -- if re-encrypted, this should be incremented. Used for encrypting root key
data_encryption_nonce blob not null default(1), -- nonce used for encrypting with key itself data_encryption_nonce blob not null default(1), -- nonce used for encrypting with key itself
ciphertext blob not null, ciphertext blob not null,
tag blob not null, tag blob not null,
schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm
salt blob not null -- for key deriviation salt blob not null -- for key deriviation
) STRICT; ) STRICT;
create table if not exists aead_encrypted ( create table if not exists aead_encrypted (
id INTEGER not null PRIMARY KEY, id INTEGER not null PRIMARY KEY,
current_nonce blob not null default(1), -- if re-encrypted, this should be incremented current_nonce blob not null default(1), -- if re-encrypted, this should be incremented
ciphertext blob not null, ciphertext blob not null,
tag blob not null, tag blob not null,
schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm schema_version integer not null default(1), -- server would need to reencrypt, because this means that we have changed algorithm
associated_root_key_id integer not null references root_key_history (id) on delete RESTRICT, associated_root_key_id integer not null references root_key_history (id) on delete RESTRICT,
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists uniq_nonce_per_root_key on aead_encrypted ( create unique index if not exists uniq_nonce_per_root_key on aead_encrypted (
current_nonce, current_nonce,
associated_root_key_id associated_root_key_id
); );
create table if not exists tls_history ( create table if not exists tls_history (
id INTEGER not null PRIMARY KEY, id INTEGER not null PRIMARY KEY,
cert text not null, cert text not null,
cert_key text not null, -- PEM Encoded private key cert_key text not null, -- PEM Encoded private key
ca_cert text not null, ca_cert text not null,
ca_key text not null, -- PEM Encoded private key ca_key text not null, -- PEM Encoded private key
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
-- This is a singleton -- This is a singleton
create table if not exists arbiter_settings ( create table if not exists arbiter_settings (
id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1 id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
tls_id integer references tls_history (id) on delete RESTRICT tls_id integer references tls_history (id) on delete RESTRICT
) STRICT; ) STRICT;
insert into arbiter_settings (id) values (1) on conflict do nothing; insert into arbiter_settings (id) values (1) on conflict do nothing;
-- ensure singleton row exists -- ensure singleton row exists
create table if not exists operator_client ( create table if not exists operator_client (
id integer not null primary key, id integer not null primary key,
public_key blob not null, public_key blob not null,
created_at integer not null default(unixepoch ('now')), created_at integer not null default(unixepoch ('now')),
updated_at integer not null default(unixepoch ('now')) updated_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists uniq_operator_client_public_key on operator_client (public_key); create unique index if not exists uniq_operator_client_public_key on operator_client (public_key);
create table if not exists client_metadata ( create table if not exists client_metadata (
id integer not null primary key, id integer not null primary key,
name text not null, -- human-readable name for the client name text not null, -- human-readable name for the client
description text, -- optional description for the client description text, -- optional description for the client
version text, -- client version for tracking and debugging version text, -- client version for tracking and debugging
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
-- created to track history of changes -- created to track history of changes
create table if not exists client_metadata_history ( create table if not exists client_metadata_history (
id integer not null primary key, id integer not null primary key,
metadata_id integer not null references client_metadata (id) on delete cascade, metadata_id integer not null references client_metadata (id) on delete cascade,
client_id integer not null references program_client (id) on delete cascade, client_id integer not null references program_client (id) on delete cascade,
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists uniq_metadata_binding_client on client_metadata_history (client_id); create unique index if not exists uniq_metadata_binding_client on client_metadata_history (client_id);
create table if not exists program_client ( create table if not exists program_client (
id integer not null primary key, id integer not null primary key,
public_key blob not null, public_key blob not null,
metadata_id integer not null references client_metadata (id) on delete cascade, metadata_id integer not null references client_metadata (id) on delete cascade,
created_at integer not null default(unixepoch ('now')), created_at integer not null default(unixepoch ('now')),
updated_at integer not null default(unixepoch ('now')) updated_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists program_client_public_key_unique create unique index if not exists program_client_public_key_unique
on program_client (public_key); on program_client (public_key);
create unique index if not exists uniq_program_client_public_key on program_client (public_key); create unique index if not exists uniq_program_client_public_key on program_client (public_key);
create table if not exists evm_wallet ( create table if not exists evm_wallet (
id integer not null primary key, id integer not null primary key,
address blob not null, -- 20-byte Ethereum address address blob not null, -- 20-byte Ethereum address
aead_encrypted_id integer not null references aead_encrypted (id) on delete RESTRICT, aead_encrypted_id integer not null references aead_encrypted (id) on delete RESTRICT,
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists uniq_evm_wallet_address on evm_wallet (address); create unique index if not exists uniq_evm_wallet_address on evm_wallet (address);
create unique index if not exists uniq_evm_wallet_aead on evm_wallet (aead_encrypted_id); create unique index if not exists uniq_evm_wallet_aead on evm_wallet (aead_encrypted_id);
create table if not exists evm_wallet_access ( create table if not exists evm_wallet_access (
id integer not null primary key, id integer not null primary key,
wallet_id integer not null references evm_wallet (id) on delete cascade, wallet_id integer not null references evm_wallet (id) on delete cascade,
client_id integer not null references program_client (id) on delete cascade, client_id integer not null references program_client (id) on delete cascade,
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists uniq_wallet_access on evm_wallet_access (wallet_id, client_id); create unique index if not exists uniq_wallet_access on evm_wallet_access (wallet_id, client_id);
create table if not exists evm_ether_transfer_limit ( create table if not exists evm_ether_transfer_limit (
id integer not null primary key, id integer not null primary key,
window_secs integer not null, -- window duration in seconds window_secs integer not null, -- window duration in seconds
max_volume blob not null -- big-endian 32-byte U256 max_volume blob not null -- big-endian 32-byte U256
) STRICT; ) STRICT;
-- Shared grant properties: client scope, timeframe, fee caps, and rate limit -- Shared grant properties: client scope, timeframe, fee caps, and rate limit
create table if not exists evm_basic_grant ( create table if not exists evm_basic_grant (
id integer not null primary key, id integer not null primary key,
wallet_access_id integer not null references evm_wallet_access (id) on delete restrict, wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
chain_id integer not null, -- EIP-155 chain ID chain_id integer not null, -- EIP-155 chain ID
valid_from integer, -- unix timestamp (seconds), null = no lower bound valid_from integer, -- unix timestamp (seconds), null = no lower bound
valid_until integer, -- unix timestamp (seconds), null = no upper bound valid_until integer, -- unix timestamp (seconds), null = no upper bound
max_gas_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited max_gas_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
max_priority_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited max_priority_fee_per_gas blob, -- big-endian 32-byte U256, null = unlimited
rate_limit_count integer, -- max transactions in window, null = unlimited rate_limit_count integer, -- max transactions in window, null = unlimited
rate_limit_window_secs integer, -- window duration in seconds, null = unlimited rate_limit_window_secs integer, -- window duration in seconds, null = unlimited
revoked_at integer, -- unix timestamp when revoked, null = still active revoked_at integer, -- unix timestamp when revoked, null = still active
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
-- Shared transaction log for all EVM grants, used for rate limit tracking and auditing -- Shared transaction log for all EVM grants, used for rate limit tracking and auditing
create table if not exists evm_transaction_log ( create table if not exists evm_transaction_log (
id integer not null primary key, id integer not null primary key,
wallet_access_id integer not null references evm_wallet_access (id) on delete restrict, wallet_access_id integer not null references evm_wallet_access (id) on delete restrict,
grant_id integer not null references evm_basic_grant (id) on delete restrict, grant_id integer not null references evm_basic_grant (id) on delete restrict,
chain_id integer not null, chain_id integer not null,
eth_value blob not null, -- always present on any EVM tx eth_value blob not null, -- always present on any EVM tx
signed_at integer not null default(unixepoch ('now')) signed_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create index if not exists idx_evm_basic_grant_access_chain on evm_basic_grant (wallet_access_id, chain_id); create index if not exists idx_evm_basic_grant_access_chain on evm_basic_grant (wallet_access_id, chain_id);
-- =============================== -- ===============================
-- ERC20 token transfer grant -- ERC20 token transfer grant
-- =============================== -- ===============================
create table if not exists evm_token_transfer_grant ( create table if not exists evm_token_transfer_grant (
id integer not null primary key, id integer not null primary key,
basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade, basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
token_contract blob not null, -- 20-byte ERC20 contract address token_contract blob not null, -- 20-byte ERC20 contract address
receiver blob -- 20-byte recipient address or null if every recipient allowed receiver blob -- 20-byte recipient address or null if every recipient allowed
) STRICT; ) STRICT;
-- Per-window volume limits for token transfer grants -- Per-window volume limits for token transfer grants
create table if not exists evm_token_transfer_volume_limit ( create table if not exists evm_token_transfer_volume_limit (
id integer not null primary key, id integer not null primary key,
grant_id integer not null references evm_token_transfer_grant (id) on delete cascade, grant_id integer not null references evm_token_transfer_grant (id) on delete cascade,
window_secs integer not null, -- window duration in seconds window_secs integer not null, -- window duration in seconds
max_volume blob not null -- big-endian 32-byte U256 max_volume blob not null -- big-endian 32-byte U256
) STRICT; ) STRICT;
-- Log table for token transfer grant usage -- Log table for token transfer grant usage
create table if not exists evm_token_transfer_log ( create table if not exists evm_token_transfer_log (
id integer not null primary key, id integer not null primary key,
grant_id integer not null references evm_token_transfer_grant (id) on delete restrict, grant_id integer not null references evm_token_transfer_grant (id) on delete restrict,
log_id integer not null references evm_transaction_log (id) on delete restrict, log_id integer not null references evm_transaction_log (id) on delete restrict,
chain_id integer not null, -- EIP-155 chain ID chain_id integer not null, -- EIP-155 chain ID
token_contract blob not null, -- 20-byte ERC20 contract address token_contract blob not null, -- 20-byte ERC20 contract address
recipient_address blob not null, -- 20-byte recipient address recipient_address blob not null, -- 20-byte recipient address
value blob not null, -- big-endian 32-byte U256 value blob not null, -- big-endian 32-byte U256
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log (grant_id); create index if not exists idx_token_transfer_log_grant on evm_token_transfer_log (grant_id);
create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log (log_id); create index if not exists idx_token_transfer_log_log_id on evm_token_transfer_log (log_id);
create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log (chain_id); create index if not exists idx_token_transfer_log_chain on evm_token_transfer_log (chain_id);
-- =============================== -- ===============================
-- Ether transfer grant (uses base log) -- Ether transfer grant (uses base log)
-- =============================== -- ===============================
create table if not exists evm_ether_transfer_grant ( create table if not exists evm_ether_transfer_grant (
id integer not null primary key, id integer not null primary key,
basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade, basic_grant_id integer not null unique references evm_basic_grant (id) on delete cascade,
limit_id integer not null references evm_ether_transfer_limit (id) on delete restrict limit_id integer not null references evm_ether_transfer_limit (id) on delete restrict
) STRICT; ) STRICT;
-- Specific recipient addresses for an ether transfer grant -- Specific recipient addresses for an ether transfer grant
create table if not exists evm_ether_transfer_grant_target ( create table if not exists evm_ether_transfer_grant_target (
id integer not null primary key, id integer not null primary key,
grant_id integer not null references evm_ether_transfer_grant (id) on delete cascade, grant_id integer not null references evm_ether_transfer_grant (id) on delete cascade,
address blob not null -- 20-byte recipient address address blob not null -- 20-byte recipient address
) STRICT; ) STRICT;
create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target (grant_id, address); create unique index if not exists uniq_ether_transfer_target on evm_ether_transfer_grant_target (grant_id, address);
-- =============================== -- ===============================
-- Integrity Envelopes -- Integrity Envelopes
-- =============================== -- ===============================
create table if not exists integrity_envelope ( create table if not exists integrity_envelope (
id integer not null primary key, id integer not null primary key,
entity_kind text not null, entity_kind text not null,
entity_id blob not null, entity_id blob not null,
payload_version integer not null, payload_version integer not null,
key_version integer not null, key_version integer not null,
mac blob not null, -- 20-byte recipient address mac blob not null, -- 20-byte recipient address
signed_at integer not null default(unixepoch ('now')), signed_at integer not null default(unixepoch ('now')),
created_at integer not null default(unixepoch ('now')) created_at integer not null default(unixepoch ('now'))
) STRICT; ) STRICT;
create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id); create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id);

196
server/crates/arbiter-server/src/actors/bootstrap.rs
View File

@@ -1,98 +1,98 @@
use crate::db::{self, DatabasePool, schema}; use crate::db::{self, DatabasePool, schema};
use arbiter_proto::{BOOTSTRAP_PATH, home_path}; use arbiter_proto::{BOOTSTRAP_PATH, home_path};
use diesel::QueryDsl; use diesel::QueryDsl;
use diesel_async::RunQueryDsl; use diesel_async::RunQueryDsl;
use kameo::{Actor, messages}; use kameo::{Actor, messages};
use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng}; use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
use subtle::ConstantTimeEq as _; use subtle::ConstantTimeEq as _;
use thiserror::Error; use thiserror::Error;
const TOKEN_LENGTH: usize = 64; const TOKEN_LENGTH: usize = 64;
pub async fn generate_token() -> Result<String, std::io::Error> { pub async fn generate_token() -> Result<String, std::io::Error> {
let rng: StdRng = make_rng(); let rng: StdRng = make_rng();
let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold( let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
String::default(), String::default(),
|mut accum, char| { |mut accum, char| {
accum += char.to_string().as_str(); accum += char.to_string().as_str();
accum accum
}, },
); );
tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?; tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
Ok(token) Ok(token)
} }
#[derive(Error, Debug)] #[derive(Error, Debug)]
pub enum Error { pub enum Error {
#[error("Database error: {0}")] #[error("Database error: {0}")]
Database(#[from] db::PoolError), Database(#[from] db::PoolError),
#[error("I/O error: {0}")] #[error("I/O error: {0}")]
Io(#[from] std::io::Error), Io(#[from] std::io::Error),
#[error("Database query error: {0}")] #[error("Database query error: {0}")]
Query(#[from] diesel::result::Error), Query(#[from] diesel::result::Error),
} }
#[derive(Actor)] #[derive(Actor)]
pub struct Bootstrapper { pub struct Bootstrapper {
token: Option<String>, token: Option<String>,
} }
impl Bootstrapper { impl Bootstrapper {
pub async fn new(db: &DatabasePool) -> Result<Self, Error> { pub async fn new(db: &DatabasePool) -> Result<Self, Error> {
let row_count: i64 = { let row_count: i64 = {
let mut conn = db.get().await?; let mut conn = db.get().await?;
schema::operator_client::table schema::operator_client::table
.count() .count()
.get_result(&mut conn) .get_result(&mut conn)
.await? .await?
}; };
let token = if row_count == 0 { let token = if row_count == 0 {
let token = generate_token().await?; let token = generate_token().await?;
Some(token) Some(token)
} else { } else {
None None
}; };
Ok(Self { token }) Ok(Self { token })
} }
} }
#[messages] #[messages]
impl Bootstrapper { impl Bootstrapper {
#[message] #[message]
pub fn is_correct_token(&self, token: String) -> bool { pub fn is_correct_token(&self, token: String) -> bool {
self.token.as_ref().is_some_and(|expected| { self.token.as_ref().is_some_and(|expected| {
let expected_bytes = expected.as_bytes(); let expected_bytes = expected.as_bytes();
let token_bytes = token.as_bytes(); let token_bytes = token.as_bytes();
let choice = expected_bytes.ct_eq(token_bytes); let choice = expected_bytes.ct_eq(token_bytes);
bool::from(choice) bool::from(choice)
}) })
} }
#[message] #[message]
pub fn consume_token(&mut self, token: String) -> bool { pub fn consume_token(&mut self, token: String) -> bool {
if self.is_correct_token(token) { if self.is_correct_token(token) {
self.token = None; self.token = None;
true true
} else { } else {
false false
} }
} }
} }
#[messages] #[messages]
impl Bootstrapper { impl Bootstrapper {
#[message] #[message]
pub fn get_token(&self) -> Option<String> { pub fn get_token(&self) -> Option<String> {
self.token.clone() self.token.clone()
} }
} }

520
server/crates/arbiter-server/src/actors/evm/mod.rs
View File

@@ -1,260 +1,260 @@
use crate::{ use crate::{
actors::vault::{CreateNew, Decrypt, Vault}, actors::vault::{CreateNew, Decrypt, Vault},
crypto::integrity, crypto::integrity,
db::{ db::{
DatabaseError, DatabasePool, DatabaseError, DatabasePool,
models::{self}, models::{self},
schema, schema,
}, },
evm::{ evm::{
self, ListError, RunKind, self, ListError, RunKind,
policies::{ policies::{
CombinedSettings, Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning, CombinedSettings, Grant, SharedGrantSettings, SpecificGrant, SpecificMeaning,
ether_transfer::EtherTransfer, token_transfers::TokenTransfer, ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
}, },
}, },
}; };
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _}; use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
use alloy::{ use alloy::{
consensus::TxEip1559, network::TxSignerSync as _, primitives::Address, signers::Signature, consensus::TxEip1559, network::TxSignerSync as _, primitives::Address, signers::Signature,
}; };
use diesel::{ use diesel::{
ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into, ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into,
}; };
use diesel_async::RunQueryDsl; use diesel_async::RunQueryDsl;
use kameo::{Actor, actor::ActorRef, messages}; use kameo::{Actor, actor::ActorRef, messages};
use rand::{SeedableRng, rng, rngs::StdRng}; use rand::{SeedableRng, rng, rngs::StdRng};
pub use crate::evm::safe_signer; pub use crate::evm::safe_signer;
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum SignTransactionError { pub enum SignTransactionError {
#[error("Wallet not found")] #[error("Wallet not found")]
WalletNotFound, WalletNotFound,
#[error("Database error: {0}")] #[error("Database error: {0}")]
Database(#[from] DatabaseError), Database(#[from] DatabaseError),
#[error("Vault error: {0}")] #[error("Vault error: {0}")]
Vault(#[from] crate::actors::vault::Error), Vault(#[from] crate::actors::vault::Error),
#[error("Vault mailbox error")] #[error("Vault mailbox error")]
VaultSend, VaultSend,
#[error("Signing error: {0}")] #[error("Signing error: {0}")]
Signing(#[from] alloy::signers::Error), Signing(#[from] alloy::signers::Error),
#[error("Policy error: {0}")] #[error("Policy error: {0}")]
Vet(#[from] evm::VetError), Vet(#[from] evm::VetError),
} }
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum Error { pub enum Error {
#[error("Vault error: {0}")] #[error("Vault error: {0}")]
Vault(#[from] crate::actors::vault::Error), Vault(#[from] crate::actors::vault::Error),
#[error("Vault mailbox error")] #[error("Vault mailbox error")]
VaultSend, VaultSend,
#[error("Database error: {0}")] #[error("Database error: {0}")]
Database(#[from] DatabaseError), Database(#[from] DatabaseError),
#[error("Integrity violation: {0}")] #[error("Integrity violation: {0}")]
Integrity(#[from] integrity::Error), Integrity(#[from] integrity::Error),
} }
#[derive(Actor)] #[derive(Actor)]
pub struct EvmActor { pub struct EvmActor {
pub vault: ActorRef<Vault>, pub vault: ActorRef<Vault>,
pub db: DatabasePool, pub db: DatabasePool,
pub rng: StdRng, pub rng: StdRng,
pub engine: evm::Engine, pub engine: evm::Engine,
} }
impl EvmActor { impl EvmActor {
pub fn new(vault: ActorRef<Vault>, db: DatabasePool) -> Self { pub fn new(vault: ActorRef<Vault>, db: DatabasePool) -> Self {
// is it safe to seed rng from system once? // is it safe to seed rng from system once?
// todo: audit // todo: audit
let rng = StdRng::from_rng(&mut rng()); let rng = StdRng::from_rng(&mut rng());
let engine = evm::Engine::new(db.clone(), vault.clone()); let engine = evm::Engine::new(db.clone(), vault.clone());
Self { Self {
vault, vault,
db, db,
rng, rng,
engine, engine,
} }
} }
} }
#[messages] #[messages]
impl EvmActor { impl EvmActor {
#[message] #[message]
pub async fn generate(&mut self) -> Result<(i32, Address), Error> { pub async fn generate(&mut self) -> Result<(i32, Address), Error> {
let (mut key_cell, address) = safe_signer::generate(&mut self.rng); let (mut key_cell, address) = safe_signer::generate(&mut self.rng);
let plaintext = key_cell.read_inline(|reader| SafeCell::new(reader.to_vec())); let plaintext = key_cell.read_inline(|reader| SafeCell::new(reader.to_vec()));
let aead_id: i32 = self let aead_id: i32 = self
.vault .vault
.ask(CreateNew { plaintext }) .ask(CreateNew { plaintext })
.await .await
.map_err(|_| Error::VaultSend)?; .map_err(|_| Error::VaultSend)?;
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let wallet_id = insert_into(schema::evm_wallet::table) let wallet_id = insert_into(schema::evm_wallet::table)
.values(&models::NewEvmWallet { .values(&models::NewEvmWallet {
address: address.as_slice().to_vec(), address: address.as_slice().to_vec(),
aead_encrypted_id: aead_id, aead_encrypted_id: aead_id,
}) })
.returning(schema::evm_wallet::id) .returning(schema::evm_wallet::id)
.get_result(&mut conn) .get_result(&mut conn)
.await .await
.map_err(DatabaseError::from)?; .map_err(DatabaseError::from)?;
Ok((wallet_id, address)) Ok((wallet_id, address))
} }
#[message] #[message]
pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> { pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let rows: Vec<models::EvmWallet> = schema::evm_wallet::table let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
.select(models::EvmWallet::as_select()) .select(models::EvmWallet::as_select())
.load(&mut conn) .load(&mut conn)
.await .await
.map_err(DatabaseError::from)?; .map_err(DatabaseError::from)?;
Ok(rows Ok(rows
.into_iter() .into_iter()
.map(|w| (w.id, Address::from_slice(&w.address))) .map(|w| (w.id, Address::from_slice(&w.address)))
.collect()) .collect())
} }
} }
#[messages] #[messages]
impl EvmActor { impl EvmActor {
#[message] #[message]
pub async fn operator_create_grant( pub async fn operator_create_grant(
&mut self, &mut self,
basic: SharedGrantSettings, basic: SharedGrantSettings,
grant: SpecificGrant, grant: SpecificGrant,
) -> Result<i32, Error> { ) -> Result<i32, Error> {
match grant { match grant {
SpecificGrant::EtherTransfer(settings) => self SpecificGrant::EtherTransfer(settings) => self
.engine .engine
.create_grant::<EtherTransfer>(CombinedSettings { .create_grant::<EtherTransfer>(CombinedSettings {
shared: basic, shared: basic,
specific: settings, specific: settings,
}) })
.await .await
.map_err(Error::from), .map_err(Error::from),
SpecificGrant::TokenTransfer(settings) => self SpecificGrant::TokenTransfer(settings) => self
.engine .engine
.create_grant::<TokenTransfer>(CombinedSettings { .create_grant::<TokenTransfer>(CombinedSettings {
shared: basic, shared: basic,
specific: settings, specific: settings,
}) })
.await .await
.map_err(Error::from), .map_err(Error::from),
} }
} }
#[message] #[message]
pub async fn useragent_delete_grant( pub async fn useragent_delete_grant(
&mut self, &mut self,
grant_id: i32, grant_id: i32,
) -> Result<(), Error> { ) -> Result<(), Error> {
self.engine self.engine
.revoke_grant(grant_id) .revoke_grant(grant_id)
.await .await
.map_err(Error::from) .map_err(Error::from)
} }
#[message] #[message]
pub async fn operator_list_grants(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> { pub async fn operator_list_grants(&mut self) -> Result<Vec<Grant<SpecificGrant>>, Error> {
match self.engine.list_all_grants().await { match self.engine.list_all_grants().await {
Ok(grants) => Ok(grants), Ok(grants) => Ok(grants),
Err(ListError::Database(db_err)) => Err(Error::Database(db_err)), Err(ListError::Database(db_err)) => Err(Error::Database(db_err)),
Err(ListError::Integrity(integrity_err)) => Err(Error::Integrity(integrity_err)), Err(ListError::Integrity(integrity_err)) => Err(Error::Integrity(integrity_err)),
} }
} }
#[message] #[message]
pub async fn shared_analyze_transaction( pub async fn shared_analyze_transaction(
&mut self, &mut self,
client_id: i32, client_id: i32,
wallet_address: Address, wallet_address: Address,
transaction: TxEip1559, transaction: TxEip1559,
) -> Result<SpecificMeaning, SignTransactionError> { ) -> Result<SpecificMeaning, SignTransactionError> {
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let wallet = schema::evm_wallet::table let wallet = schema::evm_wallet::table
.select(models::EvmWallet::as_select()) .select(models::EvmWallet::as_select())
.filter(schema::evm_wallet::address.eq(wallet_address.as_slice())) .filter(schema::evm_wallet::address.eq(wallet_address.as_slice()))
.first(&mut conn) .first(&mut conn)
.await .await
.optional() .optional()
.map_err(DatabaseError::from)? .map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?; .ok_or(SignTransactionError::WalletNotFound)?;
let wallet_access = schema::evm_wallet_access::table let wallet_access = schema::evm_wallet_access::table
.select(models::EvmWalletAccess::as_select()) .select(models::EvmWalletAccess::as_select())
.filter(schema::evm_wallet_access::wallet_id.eq(wallet.id)) .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
.filter(schema::evm_wallet_access::client_id.eq(client_id)) .filter(schema::evm_wallet_access::client_id.eq(client_id))
.first(&mut conn) .first(&mut conn)
.await .await
.optional() .optional()
.map_err(DatabaseError::from)? .map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?; .ok_or(SignTransactionError::WalletNotFound)?;
drop(conn); drop(conn);
let meaning = self let meaning = self
.engine .engine
.evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution) .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
.await?; .await?;
Ok(meaning) Ok(meaning)
} }
#[message] #[message]
pub async fn client_sign_transaction( pub async fn client_sign_transaction(
&mut self, &mut self,
client_id: i32, client_id: i32,
wallet_address: Address, wallet_address: Address,
mut transaction: TxEip1559, mut transaction: TxEip1559,
) -> Result<Signature, SignTransactionError> { ) -> Result<Signature, SignTransactionError> {
let mut conn = self.db.get().await.map_err(DatabaseError::from)?; let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
let wallet = schema::evm_wallet::table let wallet = schema::evm_wallet::table
.select(models::EvmWallet::as_select()) .select(models::EvmWallet::as_select())
.filter(schema::evm_wallet::address.eq(wallet_address.as_slice())) .filter(schema::evm_wallet::address.eq(wallet_address.as_slice()))
.first(&mut conn) .first(&mut conn)
.await .await
.optional() .optional()
.map_err(DatabaseError::from)? .map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?; .ok_or(SignTransactionError::WalletNotFound)?;
let wallet_access = schema::evm_wallet_access::table let wallet_access = schema::evm_wallet_access::table
.select(models::EvmWalletAccess::as_select()) .select(models::EvmWalletAccess::as_select())
.filter(schema::evm_wallet_access::wallet_id.eq(wallet.id)) .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
.filter(schema::evm_wallet_access::client_id.eq(client_id)) .filter(schema::evm_wallet_access::client_id.eq(client_id))
.first(&mut conn) .first(&mut conn)
.await .await
.optional() .optional()
.map_err(DatabaseError::from)? .map_err(DatabaseError::from)?
.ok_or(SignTransactionError::WalletNotFound)?; .ok_or(SignTransactionError::WalletNotFound)?;
drop(conn); drop(conn);
let raw_key: SafeCell<Vec<u8>> = self let raw_key: SafeCell<Vec<u8>> = self
.vault .vault
.ask(Decrypt { .ask(Decrypt {
aead_id: wallet.aead_encrypted_id, aead_id: wallet.aead_encrypted_id,
}) })
.await .await
.map_err(|_| SignTransactionError::VaultSend)?; .map_err(|_| SignTransactionError::VaultSend)?;
let signer = safe_signer::SafeSigner::from_cell(raw_key)?; let signer = safe_signer::SafeSigner::from_cell(raw_key)?;
self.engine self.engine
.evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution) .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
.await?; .await?;
Ok(signer.sign_transaction_sync(&mut transaction)?) Ok(signer.sign_transaction_sync(&mut transaction)?)
} }
} }

254
server/crates/arbiter-server/src/actors/flow_coordinator/client_connect_approval.rs
View File

@@ -1,127 +1,127 @@
use crate::{ use crate::{
actors::flow_coordinator::ApprovalError, actors::flow_coordinator::ApprovalError,
peers::{ peers::{
client::ClientProfile, client::ClientProfile,
operator::{OperatorSession, session::BeginNewClientApproval}, operator::{OperatorSession, session::BeginNewClientApproval},
}, },
}; };
use kameo::{ use kameo::{
Actor, messages, Actor, messages,
prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef}, prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
reply::ReplySender, reply::ReplySender,
}; };
use std::{ops::ControlFlow, time::Duration}; use std::{ops::ControlFlow, time::Duration};
const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30); const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30);
pub struct Args { pub struct Args {
pub client: ClientProfile, pub client: ClientProfile,
pub operators: Vec<ActorRef<OperatorSession>>, pub operators: Vec<ActorRef<OperatorSession>>,
pub reply: ReplySender<Result<bool, ApprovalError>>, pub reply: ReplySender<Result<bool, ApprovalError>>,
} }
pub struct ClientApprovalController { pub struct ClientApprovalController {
/// Number of operators that have not yet responded (approval or denial) or died. /// Number of operators that have not yet responded (approval or denial) or died.
pending: usize, pending: usize,
/// Number of approvals received so far. /// Number of approvals received so far.
approved: usize, approved: usize,
reply: Option<ReplySender<Result<bool, ApprovalError>>>, reply: Option<ReplySender<Result<bool, ApprovalError>>>,
} }
impl ClientApprovalController { impl ClientApprovalController {
fn send_reply(&mut self, result: Result<bool, ApprovalError>) { fn send_reply(&mut self, result: Result<bool, ApprovalError>) {
if let Some(reply) = self.reply.take() { if let Some(reply) = self.reply.take() {
reply.send(result); reply.send(result);
} }
} }
} }
impl Actor for ClientApprovalController { impl Actor for ClientApprovalController {
type Args = Args; type Args = Args;
type Error = (); type Error = ();
async fn on_start( async fn on_start(
Args { Args {
client, client,
operators, operators,
reply, reply,
}: Self::Args, }: Self::Args,
actor_ref: ActorRef<Self>, actor_ref: ActorRef<Self>,
) -> Result<Self, Self::Error> { ) -> Result<Self, Self::Error> {
let this = Self { let this = Self {
pending: operators.len(), pending: operators.len(),
approved: 0, approved: 0,
reply: Some(reply), reply: Some(reply),
}; };
for operator in operators { for operator in operators {
actor_ref.link(&operator).await; actor_ref.link(&operator).await;
let _ = operator let _ = operator
.tell(BeginNewClientApproval { .tell(BeginNewClientApproval {
client: client.clone(), client: client.clone(),
controller: actor_ref.clone(), controller: actor_ref.clone(),
}) })
.await; .await;
} }
let weak = actor_ref.downgrade(); let weak = actor_ref.downgrade();
tokio::spawn(async move { tokio::spawn(async move {
tokio::time::sleep(APPROVAL_TIMEOUT).await; tokio::time::sleep(APPROVAL_TIMEOUT).await;
if let Some(r) = weak.upgrade() { if let Some(r) = weak.upgrade() {
let _ = r.tell(OnApprovalTimeout {}).await; let _ = r.tell(OnApprovalTimeout {}).await;
} }
}); });
Ok(this) Ok(this)
} }
async fn on_link_died( async fn on_link_died(
&mut self, &mut self,
_: WeakActorRef<Self>, _: WeakActorRef<Self>,
_: ActorId, _: ActorId,
_: ActorStopReason, _: ActorStopReason,
) -> Result<ControlFlow<ActorStopReason>, Self::Error> { ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
// A linked operator died before responding — counts as a non-approval. // A linked operator died before responding — counts as a non-approval.
self.pending = self.pending.saturating_sub(1); self.pending = self.pending.saturating_sub(1);
if self.pending == 0 { if self.pending == 0 {
// At least one operator didn't approve: deny. // At least one operator didn't approve: deny.
self.send_reply(Ok(false)); self.send_reply(Ok(false));
return Ok(ControlFlow::Break(ActorStopReason::Normal)); return Ok(ControlFlow::Break(ActorStopReason::Normal));
} }
Ok(ControlFlow::Continue(())) Ok(ControlFlow::Continue(()))
} }
} }
#[messages] #[messages]
impl ClientApprovalController { impl ClientApprovalController {
#[message(ctx)] #[message(ctx)]
pub fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) { pub fn client_approval_answer(&mut self, approved: bool, ctx: &mut Context<Self, ()>) {
if !approved { if !approved {
// Denial wins immediately regardless of other pending responses. // Denial wins immediately regardless of other pending responses.
self.send_reply(Ok(false)); self.send_reply(Ok(false));
ctx.stop(); ctx.stop();
return; return;
} }
self.approved += 1; self.approved += 1;
self.pending = self.pending.saturating_sub(1); self.pending = self.pending.saturating_sub(1);
if self.pending == 0 { if self.pending == 0 {
// Every connected operator approved. // Every connected operator approved.
self.send_reply(Ok(true)); self.send_reply(Ok(true));
ctx.stop(); ctx.stop();
} }
} }
/// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded /// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
/// by then is treated as a denial to prevent zombie sessions from blocking the flow. /// by then is treated as a denial to prevent zombie sessions from blocking the flow.
#[message(ctx)] #[message(ctx)]
pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) { pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
if self.pending > 0 { if self.pending > 0 {
self.send_reply(Ok(false)); self.send_reply(Ok(false));
ctx.stop(); ctx.stop();
} }
} }
} }

228
server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
View File

@@ -1,114 +1,114 @@
use crate::{ use crate::{
actors::{ actors::{
flow_coordinator::client_connect_approval::ClientApprovalController, flow_coordinator::client_connect_approval::ClientApprovalController,
operator_registry::{GetConnected, OperatorRegistry}, operator_registry::{GetConnected, OperatorRegistry},
}, },
peers::client::{ClientProfile, session::ClientSession}, peers::client::{ClientProfile, session::ClientSession},
}; };
use kameo::{ use kameo::{
Actor, Actor,
actor::{ActorId, ActorRef, Spawn}, actor::{ActorId, ActorRef, Spawn},
messages, messages,
prelude::{ActorStopReason, Context, WeakActorRef}, prelude::{ActorStopReason, Context, WeakActorRef},
reply::DelegatedReply, reply::DelegatedReply,
}; };
use std::{collections::HashMap, ops::ControlFlow}; use std::{collections::HashMap, ops::ControlFlow};
use tracing::info; use tracing::info;
pub mod client_connect_approval; pub mod client_connect_approval;
pub struct FlowCoordinator { pub struct FlowCoordinator {
pub clients: HashMap<ActorId, ActorRef<ClientSession>>, pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
operator_registry: ActorRef<OperatorRegistry>, operator_registry: ActorRef<OperatorRegistry>,
} }
impl FlowCoordinator { impl FlowCoordinator {
pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self { pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self {
Self { Self {
clients: HashMap::default(), clients: HashMap::default(),
operator_registry, operator_registry,
} }
} }
} }
impl Actor for FlowCoordinator { impl Actor for FlowCoordinator {
type Args = Self; type Args = Self;
type Error = (); type Error = ();
async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> { async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
Ok(args) Ok(args)
} }
async fn on_link_died( async fn on_link_died(
&mut self, &mut self,
_: WeakActorRef<Self>, _: WeakActorRef<Self>,
id: ActorId, id: ActorId,
_: ActorStopReason, _: ActorStopReason,
) -> Result<ControlFlow<ActorStopReason>, Self::Error> { ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
if self.clients.remove(&id).is_some() { if self.clients.remove(&id).is_some() {
info!( info!(
?id, ?id,
actor = "FlowCoordinator", actor = "FlowCoordinator",
event = "client.disconnected" event = "client.disconnected"
); );
} else { } else {
info!( info!(
?id, ?id,
actor = "FlowCoordinator", actor = "FlowCoordinator",
event = "unknown.actor.disconnected" event = "unknown.actor.disconnected"
); );
} }
Ok(ControlFlow::Continue(())) Ok(ControlFlow::Continue(()))
} }
} }
#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)] #[derive(Debug, thiserror::Error, Clone, PartialEq, Eq, Hash)]
pub enum ApprovalError { pub enum ApprovalError {
#[error("No operators connected")] #[error("No operators connected")]
NoOperatorsConnected, NoOperatorsConnected,
} }
#[messages] #[messages]
impl FlowCoordinator { impl FlowCoordinator {
#[message(ctx)] #[message(ctx)]
pub async fn register_client( pub async fn register_client(
&mut self, &mut self,
actor: ActorRef<ClientSession>, actor: ActorRef<ClientSession>,
ctx: &mut Context<Self, ()>, ctx: &mut Context<Self, ()>,
) { ) {
info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected"); info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
ctx.actor_ref().link(&actor).await; ctx.actor_ref().link(&actor).await;
self.clients.insert(actor.id(), actor); self.clients.insert(actor.id(), actor);
} }
#[message(ctx)] #[message(ctx)]
pub async fn request_client_approval( pub async fn request_client_approval(
&mut self, &mut self,
client: ClientProfile, client: ClientProfile,
ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>, ctx: &mut Context<Self, DelegatedReply<Result<bool, ApprovalError>>>,
) -> DelegatedReply<Result<bool, ApprovalError>> { ) -> DelegatedReply<Result<bool, ApprovalError>> {
let (reply, Some(reply_sender)) = ctx.reply_sender() else { let (reply, Some(reply_sender)) = ctx.reply_sender() else {
unreachable!("Expected `request_client_approval` to have callback channel"); unreachable!("Expected `request_client_approval` to have callback channel");
}; };
let Ok(refs) = self.operator_registry.ask(GetConnected).await else { let Ok(refs) = self.operator_registry.ask(GetConnected).await else {
reply_sender.send(Err(ApprovalError::NoOperatorsConnected)); reply_sender.send(Err(ApprovalError::NoOperatorsConnected));
return reply; return reply;
}; };
if refs.is_empty() { if refs.is_empty() {
reply_sender.send(Err(ApprovalError::NoOperatorsConnected)); reply_sender.send(Err(ApprovalError::NoOperatorsConnected));
return reply; return reply;
} }
ClientApprovalController::spawn(client_connect_approval::Args { ClientApprovalController::spawn(client_connect_approval::Args {
client, client,
operators: refs, operators: refs,
reply: reply_sender, reply: reply_sender,
}); });
reply reply
} }
} }

118
server/crates/arbiter-server/src/actors/mod.rs
View File

@@ -1,59 +1,59 @@
use crate::{ use crate::{
actors::{ actors::{
bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator, bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
operator_registry::OperatorRegistry, vault::Vault, operator_registry::OperatorRegistry, vault::Vault,
}, },
db, db,
}; };
use kameo::actor::{ActorRef, Spawn}; use kameo::actor::{ActorRef, Spawn};
use kameo_actors::{DeliveryStrategy, message_bus::MessageBus}; use kameo_actors::{DeliveryStrategy, message_bus::MessageBus};
use thiserror::Error; use thiserror::Error;
pub mod bootstrap; pub mod bootstrap;
pub mod evm; pub mod evm;
pub mod flow_coordinator; pub mod flow_coordinator;
pub mod operator_registry; pub mod operator_registry;
pub mod vault; pub mod vault;
#[derive(Error, Debug)] #[derive(Error, Debug)]
pub enum SpawnError { pub enum SpawnError {
#[error("Failed to spawn Bootstrapper actor")] #[error("Failed to spawn Bootstrapper actor")]
Bootstrapper(#[from] bootstrap::Error), Bootstrapper(#[from] bootstrap::Error),
#[error("Failed to spawn Vault actor")] #[error("Failed to spawn Vault actor")]
Vault(#[from] vault::Error), Vault(#[from] vault::Error),
} }
/// Long-lived actors that are shared across all connections and handle global state and operations /// Long-lived actors that are shared across all connections and handle global state and operations
#[derive(Clone)] #[derive(Clone)]
pub struct GlobalActors { pub struct GlobalActors {
pub vault: ActorRef<Vault>, pub vault: ActorRef<Vault>,
pub bootstrapper: ActorRef<Bootstrapper>, pub bootstrapper: ActorRef<Bootstrapper>,
pub flow_coordinator: ActorRef<FlowCoordinator>, pub flow_coordinator: ActorRef<FlowCoordinator>,
pub operator_registry: ActorRef<OperatorRegistry>, pub operator_registry: ActorRef<OperatorRegistry>,
pub evm: ActorRef<EvmActor>, pub evm: ActorRef<EvmActor>,
pub events: ActorRef<MessageBus>, pub events: ActorRef<MessageBus>,
} }
impl GlobalActors { impl GlobalActors {
pub fn spawn_message_bus() -> ActorRef<MessageBus> { pub fn spawn_message_bus() -> ActorRef<MessageBus> {
MessageBus::spawn(MessageBus::new(DeliveryStrategy::Guaranteed)) MessageBus::spawn(MessageBus::new(DeliveryStrategy::Guaranteed))
} }
pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> { pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
let message_bus = Self::spawn_message_bus(); let message_bus = Self::spawn_message_bus();
let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?); let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?);
let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default()); let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
Ok(Self { Ok(Self {
bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?), bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)), evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
vault: key_holder, vault: key_holder,
flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new( flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new(
operator_registry.clone(), operator_registry.clone(),
)), )),
operator_registry, operator_registry,
events: message_bus, events: message_bus,
}) })
} }
} }

122
server/crates/arbiter-server/src/actors/operator_registry.rs
View File

@@ -1,61 +1,61 @@
use crate::peers::operator::OperatorSession; use crate::peers::operator::OperatorSession;
use kameo::{ use kameo::{
Actor, Actor,
actor::{ActorId, ActorRef}, actor::{ActorId, ActorRef},
error::Infallible, error::Infallible,
messages, messages,
prelude::{ActorStopReason, Context, WeakActorRef}, prelude::{ActorStopReason, Context, WeakActorRef},
}; };
use std::{collections::HashMap, ops::ControlFlow}; use std::{collections::HashMap, ops::ControlFlow};
use tracing::info; use tracing::info;
#[derive(Default)] #[derive(Default)]
pub struct OperatorRegistry { pub struct OperatorRegistry {
connected: HashMap<ActorId, ActorRef<OperatorSession>>, connected: HashMap<ActorId, ActorRef<OperatorSession>>,
} }
impl Actor for OperatorRegistry { impl Actor for OperatorRegistry {
type Args = Self; type Args = Self;
type Error = Infallible; type Error = Infallible;
async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> { async fn on_start(args: Self::Args, _: ActorRef<Self>) -> Result<Self, Self::Error> {
Ok(args) Ok(args)
} }
async fn on_link_died( async fn on_link_died(
&mut self, &mut self,
_: WeakActorRef<Self>, _: WeakActorRef<Self>,
id: ActorId, id: ActorId,
_: ActorStopReason, _: ActorStopReason,
) -> Result<ControlFlow<ActorStopReason>, Self::Error> { ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
if self.connected.remove(&id).is_some() { if self.connected.remove(&id).is_some() {
info!( info!(
?id, ?id,
actor = "OperatorRegistry", actor = "OperatorRegistry",
event = "operator.disconnected" event = "operator.disconnected"
); );
} }
Ok(ControlFlow::Continue(())) Ok(ControlFlow::Continue(()))
} }
} }
#[messages] #[messages]
impl OperatorRegistry { impl OperatorRegistry {
#[message(ctx)] #[message(ctx)]
pub async fn connect_operator( pub async fn connect_operator(
&mut self, &mut self,
actor: ActorRef<OperatorSession>, actor: ActorRef<OperatorSession>,
ctx: &mut Context<Self, ()>, ctx: &mut Context<Self, ()>,
) { ) {
info!(id = %actor.id(), actor = "OperatorRegistry", event = "operator.connected"); info!(id = %actor.id(), actor = "OperatorRegistry", event = "operator.connected");
ctx.actor_ref().link(&actor).await; ctx.actor_ref().link(&actor).await;
self.connected.insert(actor.id(), actor); self.connected.insert(actor.id(), actor);
} }
#[message] #[message]
pub fn get_connected(&self) -> Vec<ActorRef<OperatorSession>> { pub fn get_connected(&self) -> Vec<ActorRef<OperatorSession>> {
self.connected.values().cloned().collect() self.connected.values().cloned().collect()
} }
} }

924
server/crates/arbiter-server/src/actors/vault/mod.rs
View File

@@ -1,462 +1,462 @@
use crate::{ use crate::{
crypto::{ crypto::{
KeyCell, derive_key, KeyCell, derive_key,
encryption::v1::{self, Nonce}, encryption::v1::{self, Nonce},
integrity::v1::HmacSha256, integrity::v1::HmacSha256,
}, },
db::{ db::{
self, self,
models::{self, RootKeyHistory}, models::{self, RootKeyHistory},
schema::{self}, schema::{self},
}, },
}; };
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _}; use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
use chrono::Utc; use chrono::Utc;
use diesel::{ use diesel::{
ExpressionMethods as _, OptionalExtension, QueryDsl, SelectableHelper, ExpressionMethods as _, OptionalExtension, QueryDsl, SelectableHelper,
dsl::{insert_into, update}, dsl::{insert_into, update},
}; };
use diesel_async::{AsyncConnection, RunQueryDsl}; use diesel_async::{AsyncConnection, RunQueryDsl};
use hmac::{KeyInit as _, Mac as _}; use hmac::{KeyInit as _, Mac as _};
use kameo::{Actor, Reply, actor::ActorRef, messages}; use kameo::{Actor, Reply, actor::ActorRef, messages};
use kameo_actors::message_bus::{MessageBus, Publish}; use kameo_actors::message_bus::{MessageBus, Publish};
use strum::{EnumDiscriminants, IntoDiscriminant}; use strum::{EnumDiscriminants, IntoDiscriminant};
use tracing::{error, info}; use tracing::{error, info};
pub mod events { pub mod events {
#[derive(Clone, Copy)] #[derive(Clone, Copy)]
pub struct Bootstrapped; pub struct Bootstrapped;
#[derive(Clone, Copy)] #[derive(Clone, Copy)]
pub struct Unsealed; pub struct Unsealed;
#[derive(Clone, Copy)] #[derive(Clone, Copy)]
pub struct VaultResealed; pub struct VaultResealed;
} }
#[derive(Debug, thiserror::Error)] #[derive(Debug, thiserror::Error)]
pub enum Error { pub enum Error {
#[error("Vault is already bootstrapped")] #[error("Vault is already bootstrapped")]
AlreadyBootstrapped, AlreadyBootstrapped,
#[error("Vault is not bootstrapped")] #[error("Vault is not bootstrapped")]
NotBootstrapped, NotBootstrapped,
#[error("Vault is sealed")] #[error("Vault is sealed")]
Sealed, Sealed,
#[error("Invalid key provided")] #[error("Invalid key provided")]
InvalidKey, InvalidKey,
#[error("Requested aead entry not found")] #[error("Requested aead entry not found")]
NotFound, NotFound,
#[error("Encryption error: {0}")] #[error("Encryption error: {0}")]
Encryption(#[from] chacha20poly1305::aead::Error), Encryption(#[from] chacha20poly1305::aead::Error),
#[error("Database error: {0}")] #[error("Database error: {0}")]
DatabaseConnection(#[from] db::PoolError), DatabaseConnection(#[from] db::PoolError),
#[error("Database transaction error: {0}")] #[error("Database transaction error: {0}")]
DatabaseTransaction(#[from] diesel::result::Error), DatabaseTransaction(#[from] diesel::result::Error),
#[error("Broken database")] #[error("Broken database")]
BrokenDatabase, BrokenDatabase,
} }
struct Unsealed { struct Unsealed {
root_key_history_id: i32, root_key_history_id: i32,
root_key: KeyCell, root_key: KeyCell,
} }
#[derive(Default, EnumDiscriminants)] #[derive(Default, EnumDiscriminants)]
#[strum_discriminants(derive(Reply), vis(pub), name(VaultState))] #[strum_discriminants(derive(Reply), vis(pub), name(VaultState))]
enum State { enum State {
#[default] #[default]
Unbootstrapped, Unbootstrapped,
Sealed { Sealed {
root_key_history_id: i32, root_key_history_id: i32,
}, },
Unsealed(Unsealed), Unsealed(Unsealed),
} }
/// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed). /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
/// ///
/// Provides API for encrypting and decrypting data using the vault root key. /// Provides API for encrypting and decrypting data using the vault root key.
/// Abstraction over database to make sure nonces are never reused and encryption keys are never exposed in plaintext outside of this actor. /// Abstraction over database to make sure nonces are never reused and encryption keys are never exposed in plaintext outside of this actor.
#[derive(Actor)] #[derive(Actor)]
pub struct Vault { pub struct Vault {
db: db::DatabasePool, db: db::DatabasePool,
state: State, state: State,
events: ActorRef<MessageBus>, events: ActorRef<MessageBus>,
} }
#[messages] #[messages]
impl Vault { impl Vault {
pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> { pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
let state = { let state = {
let mut conn = db.get().await?; let mut conn = db.get().await?;
let (root_key_history,) = schema::arbiter_settings::table let (root_key_history,) = schema::arbiter_settings::table
.left_join(schema::root_key_history::table) .left_join(schema::root_key_history::table)
.select((Option::<RootKeyHistory>::as_select(),)) .select((Option::<RootKeyHistory>::as_select(),))
.get_result::<(Option<RootKeyHistory>,)>(&mut conn) .get_result::<(Option<RootKeyHistory>,)>(&mut conn)
.await?; .await?;
match root_key_history { match root_key_history {
Some(root_key_history) => State::Sealed { Some(root_key_history) => State::Sealed {
root_key_history_id: root_key_history.id, root_key_history_id: root_key_history.id,
}, },
None => State::Unbootstrapped, None => State::Unbootstrapped,
} }
}; };
Ok(Self { db, state, events }) Ok(Self { db, state, events })
} }
// Exclusive transaction to avoid race condtions if multiple vaults write // Exclusive transaction to avoid race condtions if multiple vaults write
// additional layer of protection against nonce-reuse // additional layer of protection against nonce-reuse
async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> { async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
let mut conn = pool.get().await?; let mut conn = pool.get().await?;
let nonce = conn let nonce = conn
.exclusive_transaction(async |conn| { .exclusive_transaction(async |conn| {
let current_nonce: Vec<u8> = schema::root_key_history::table let current_nonce: Vec<u8> = schema::root_key_history::table
.filter(schema::root_key_history::id.eq(root_key_id)) .filter(schema::root_key_history::id.eq(root_key_id))
.select(schema::root_key_history::data_encryption_nonce) .select(schema::root_key_history::data_encryption_nonce)
.first(&mut *conn) .first(&mut *conn)
.await?; .await?;
let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| { let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
error!( error!(
"Broken database: invalid nonce for root key history id={}", "Broken database: invalid nonce for root key history id={}",
root_key_id root_key_id
); );
Error::BrokenDatabase Error::BrokenDatabase
})?; })?;
nonce.increment(); nonce.increment();
update(schema::root_key_history::table) update(schema::root_key_history::table)
.filter(schema::root_key_history::id.eq(root_key_id)) .filter(schema::root_key_history::id.eq(root_key_id))
.set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec())) .set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec()))
.execute(&mut *conn) .execute(&mut *conn)
.await?; .await?;
Result::<_, Error>::Ok(nonce) Result::<_, Error>::Ok(nonce)
}) })
.await?; .await?;
Ok(nonce) Ok(nonce)
} }
const fn expect_unsealed(state: &mut State) -> Result<&mut Unsealed, Error> { const fn expect_unsealed(state: &mut State) -> Result<&mut Unsealed, Error> {
match state { match state {
State::Unsealed(unsealed) => Ok(unsealed), State::Unsealed(unsealed) => Ok(unsealed),
State::Unbootstrapped => Err(Error::NotBootstrapped), State::Unbootstrapped => Err(Error::NotBootstrapped),
State::Sealed { .. } => Err(Error::Sealed), State::Sealed { .. } => Err(Error::Sealed),
} }
} }
#[message] #[message]
pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> { pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
if !matches!(self.state, State::Unbootstrapped) { if !matches!(self.state, State::Unbootstrapped) {
return Err(Error::AlreadyBootstrapped); return Err(Error::AlreadyBootstrapped);
} }
let salt = v1::generate_salt(); let salt = v1::generate_salt();
let mut seal_key = derive_key(seal_key_raw, &salt); let mut seal_key = derive_key(seal_key_raw, &salt);
let mut root_key = KeyCell::new_secure_random(); let mut root_key = KeyCell::new_secure_random();
// Zero nonces are fine because they are one-time // Zero nonces are fine because they are one-time
let root_key_nonce = Nonce::default(); let root_key_nonce = Nonce::default();
let data_encryption_nonce = Nonce::default(); let data_encryption_nonce = Nonce::default();
let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| { let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
let root_key_reader = reader.as_slice(); let root_key_reader = reader.as_slice();
seal_key seal_key
.encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader) .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
.map_err(|err| { .map_err(|err| {
error!(?err, "Fatal bootstrap error"); error!(?err, "Fatal bootstrap error");
Error::Encryption(err) Error::Encryption(err)
}) })
})?; })?;
let mut conn = self.db.get().await?; let mut conn = self.db.get().await?;
let data_encryption_nonce_bytes = data_encryption_nonce.to_vec(); let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
let root_key_history_id = conn let root_key_history_id = conn
.transaction(async |conn| { .transaction(async |conn| {
let root_key_history_id: i32 = insert_into(schema::root_key_history::table) let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
.values(&models::NewRootKeyHistory { .values(&models::NewRootKeyHistory {
ciphertext: root_key_ciphertext.clone(), ciphertext: root_key_ciphertext.clone(),
tag: v1::ROOT_KEY_TAG.to_vec(), tag: v1::ROOT_KEY_TAG.to_vec(),
root_key_encryption_nonce: root_key_nonce.to_vec(), root_key_encryption_nonce: root_key_nonce.to_vec(),
data_encryption_nonce: data_encryption_nonce_bytes.clone(), data_encryption_nonce: data_encryption_nonce_bytes.clone(),
schema_version: 1, schema_version: 1,
salt: salt.to_vec(), salt: salt.to_vec(),
}) })
.returning(schema::root_key_history::id) .returning(schema::root_key_history::id)
.get_result(&mut *conn) .get_result(&mut *conn)
.await?; .await?;
update(schema::arbiter_settings::table) update(schema::arbiter_settings::table)
.set(schema::arbiter_settings::root_key_id.eq(root_key_history_id)) .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
.execute(&mut *conn) .execute(&mut *conn)
.await?; .await?;
Result::<_, diesel::result::Error>::Ok(root_key_history_id) Result::<_, diesel::result::Error>::Ok(root_key_history_id)
}) })
.await?; .await?;
self.state = State::Unsealed(Unsealed { self.state = State::Unsealed(Unsealed {
root_key, root_key,
root_key_history_id, root_key_history_id,
}); });
info!("Vault bootstrapped successfully"); info!("Vault bootstrapped successfully");
let _ = self.events.tell(Publish(events::Bootstrapped)).await; let _ = self.events.tell(Publish(events::Bootstrapped)).await;
Ok(()) Ok(())
} }
#[message] #[message]
pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> { pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
let State::Sealed { let State::Sealed {
root_key_history_id, root_key_history_id,
} = &self.state } = &self.state
else { else {
return Err(Error::NotBootstrapped); return Err(Error::NotBootstrapped);
}; };
// We don't want to hold connection while doing expensive KDF work // We don't want to hold connection while doing expensive KDF work
let current_key = { let current_key = {
let mut conn = self.db.get().await?; let mut conn = self.db.get().await?;
schema::root_key_history::table schema::root_key_history::table
.filter(schema::root_key_history::id.eq(*root_key_history_id)) .filter(schema::root_key_history::id.eq(*root_key_history_id))
.select(RootKeyHistory::as_select()) .select(RootKeyHistory::as_select())
.first(&mut conn) .first(&mut conn)
.await? .await?
}; };
let salt = &current_key.salt; let salt = &current_key.salt;
let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| { let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
error!("Broken database: invalid salt for root key"); error!("Broken database: invalid salt for root key");
Error::BrokenDatabase Error::BrokenDatabase
})?; })?;
let mut seal_key = derive_key(seal_key_raw, &salt); let mut seal_key = derive_key(seal_key_raw, &salt);
let mut root_key = SafeCell::new(current_key.ciphertext.clone()); let mut root_key = SafeCell::new(current_key.ciphertext.clone());
let nonce = let nonce =
Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| { Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| {
error!("Broken database: invalid nonce for root key"); error!("Broken database: invalid nonce for root key");
Error::BrokenDatabase Error::BrokenDatabase
})?; })?;
seal_key seal_key
.decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key) .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
.map_err(|err| { .map_err(|err| {
error!(?err, "Failed to unseal root key: invalid seal key"); error!(?err, "Failed to unseal root key: invalid seal key");
Error::InvalidKey Error::InvalidKey
})?; })?;
self.state = State::Unsealed(Unsealed { self.state = State::Unsealed(Unsealed {
root_key_history_id: current_key.id, root_key_history_id: current_key.id,
root_key: KeyCell::try_from(root_key).map_err(|err| { root_key: KeyCell::try_from(root_key).map_err(|err| {
error!(?err, "Broken database: invalid encryption key size"); error!(?err, "Broken database: invalid encryption key size");
Error::BrokenDatabase Error::BrokenDatabase
})?, })?,
}); });
info!("Vault unsealed successfully"); info!("Vault unsealed successfully");
let _ = self.events.tell(Publish(events::Unsealed)).await; let _ = self.events.tell(Publish(events::Unsealed)).await;
Ok(()) Ok(())
} }
#[message] #[message]
pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> { pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?; let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;
let row: models::AeadEncrypted = { let row: models::AeadEncrypted = {
let mut conn = self.db.get().await?; let mut conn = self.db.get().await?;
schema::aead_encrypted::table schema::aead_encrypted::table
.select(models::AeadEncrypted::as_select()) .select(models::AeadEncrypted::as_select())
.filter(schema::aead_encrypted::id.eq(aead_id)) .filter(schema::aead_encrypted::id.eq(aead_id))
.first(&mut conn) .first(&mut conn)
.await .await
.optional()? .optional()?
.ok_or(Error::NotFound)? .ok_or(Error::NotFound)?
}; };
let nonce = Nonce::try_from(row.current_nonce.as_slice()).map_err(|()| { let nonce = Nonce::try_from(row.current_nonce.as_slice()).map_err(|()| {
error!( error!(
"Broken database: invalid nonce for aead_encrypted id={}", "Broken database: invalid nonce for aead_encrypted id={}",
aead_id aead_id
); );
Error::BrokenDatabase Error::BrokenDatabase
})?; })?;
let mut output = SafeCell::new(row.ciphertext); let mut output = SafeCell::new(row.ciphertext);
root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?; root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
Ok(output) Ok(output)
} }
// Creates new `aead_encrypted` entry in the database and returns it's ID // Creates new `aead_encrypted` entry in the database and returns it's ID
#[message] #[message]
pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> { pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
let Unsealed { let Unsealed {
root_key, root_key,
root_key_history_id, root_key_history_id,
} = Self::expect_unsealed(&mut self.state)?; } = Self::expect_unsealed(&mut self.state)?;
// Order matters here - `get_new_nonce` acquires connection, so we need to call it before next acquire // Order matters here - `get_new_nonce` acquires connection, so we need to call it before next acquire
// Borrow checker note: &mut borrow a few lines above is disjoint from this field // Borrow checker note: &mut borrow a few lines above is disjoint from this field
let nonce = Self::get_new_nonce(&self.db, *root_key_history_id).await?; let nonce = Self::get_new_nonce(&self.db, *root_key_history_id).await?;
let mut ciphertext_buffer = plaintext.write(); let mut ciphertext_buffer = plaintext.write();
let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut(); let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?; root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;
let ciphertext = std::mem::take(ciphertext_buffer); let ciphertext = std::mem::take(ciphertext_buffer);
let mut conn = self.db.get().await?; let mut conn = self.db.get().await?;
let aead_id: i32 = insert_into(schema::aead_encrypted::table) let aead_id: i32 = insert_into(schema::aead_encrypted::table)
.values(&models::NewAeadEncrypted { .values(&models::NewAeadEncrypted {
ciphertext, ciphertext,
tag: v1::TAG.to_vec(), tag: v1::TAG.to_vec(),
current_nonce: nonce.to_vec(), current_nonce: nonce.to_vec(),
schema_version: 1, schema_version: 1,
associated_root_key_id: *root_key_history_id, associated_root_key_id: *root_key_history_id,
created_at: Utc::now().into(), created_at: Utc::now().into(),
}) })
.returning(schema::aead_encrypted::id) .returning(schema::aead_encrypted::id)
.get_result(&mut conn) .get_result(&mut conn)
.await?; .await?;
Ok(aead_id) Ok(aead_id)
} }
#[message] #[message]
pub fn get_state(&self) -> VaultState { pub fn get_state(&self) -> VaultState {
self.state.discriminant() self.state.discriminant()
} }
#[message] #[message]
pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> { pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
let Unsealed { let Unsealed {
root_key, root_key,
root_key_history_id, root_key_history_id,
} = Self::expect_unsealed(&mut self.state)?; } = Self::expect_unsealed(&mut self.state)?;
let mut hmac = root_key.0.read_inline(|k| { let mut hmac = root_key.0.read_inline(|k| {
HmacSha256::new_from_slice(k) HmacSha256::new_from_slice(k)
.unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size")) .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
}); });
hmac.update(&root_key_history_id.to_be_bytes()); hmac.update(&root_key_history_id.to_be_bytes());
hmac.update(&mac_input); hmac.update(&mac_input);
let mac = hmac.finalize().into_bytes().to_vec(); let mac = hmac.finalize().into_bytes().to_vec();
Ok((*root_key_history_id, mac)) Ok((*root_key_history_id, mac))
} }
#[message] #[message]
pub fn verify_integrity( pub fn verify_integrity(
&mut self, &mut self,
mac_input: Vec<u8>, mac_input: Vec<u8>,
expected_mac: Vec<u8>, expected_mac: Vec<u8>,
key_version: i32, key_version: i32,
) -> Result<bool, Error> { ) -> Result<bool, Error> {
let Unsealed { let Unsealed {
root_key, root_key,
root_key_history_id, root_key_history_id,
} = Self::expect_unsealed(&mut self.state)?; } = Self::expect_unsealed(&mut self.state)?;
if *root_key_history_id != key_version { if *root_key_history_id != key_version {
return Ok(false); return Ok(false);
} }
let mut hmac = root_key.0.read_inline(|k| { let mut hmac = root_key.0.read_inline(|k| {
HmacSha256::new_from_slice(k) HmacSha256::new_from_slice(k)
.unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size")) .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
}); });
hmac.update(&key_version.to_be_bytes()); hmac.update(&key_version.to_be_bytes());
hmac.update(&mac_input); hmac.update(&mac_input);
Ok(hmac.verify_slice(&expected_mac).is_ok()) Ok(hmac.verify_slice(&expected_mac).is_ok())
} }
#[message] #[message]
pub async fn seal(&mut self) -> Result<(), Error> { pub async fn seal(&mut self) -> Result<(), Error> {
let Unsealed { let Unsealed {
root_key_history_id, root_key_history_id,
.. ..
} = Self::expect_unsealed(&mut self.state)?; } = Self::expect_unsealed(&mut self.state)?;
self.state = State::Sealed { self.state = State::Sealed {
root_key_history_id: *root_key_history_id, root_key_history_id: *root_key_history_id,
}; };
let _ = self.events.tell(Publish(events::VaultResealed)).await; let _ = self.events.tell(Publish(events::VaultResealed)).await;
Ok(()) Ok(())
} }
} }
#[cfg(test)] #[cfg(test)]
mod tests { mod tests {
use crate::actors::GlobalActors; use crate::actors::GlobalActors;
use arbiter_crypto::safecell::SafeCellHandle as _; use arbiter_crypto::safecell::SafeCellHandle as _;
use super::*; use super::*;
async fn bootstrapped_actor(db: &db::DatabasePool) -> Vault { async fn bootstrapped_actor(db: &db::DatabasePool) -> Vault {
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus()) let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
.await .await
.unwrap(); .unwrap();
let seal_key = SafeCell::new(b"test-seal-key".to_vec()); let seal_key = SafeCell::new(b"test-seal-key".to_vec());
actor.bootstrap(seal_key).await.unwrap(); actor.bootstrap(seal_key).await.unwrap();
actor actor
} }
#[tokio::test] #[tokio::test]
#[test_log::test] #[test_log::test]
async fn nonce_monotonic_even_when_nonce_allocation_interleaves() { async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
let db = db::create_test_pool().await; let db = db::create_test_pool().await;
let mut actor = bootstrapped_actor(&db).await; let mut actor = bootstrapped_actor(&db).await;
let State::Unsealed(Unsealed { let State::Unsealed(Unsealed {
root_key_history_id, root_key_history_id,
.. ..
}) = actor.state }) = actor.state
else { else {
panic!("expected unsealed state") panic!("expected unsealed state")
}; };
let n1 = Vault::get_new_nonce(&db, root_key_history_id) let n1 = Vault::get_new_nonce(&db, root_key_history_id)
.await .await
.unwrap(); .unwrap();
let n2 = Vault::get_new_nonce(&db, root_key_history_id) let n2 = Vault::get_new_nonce(&db, root_key_history_id)
.await .await
.unwrap(); .unwrap();
assert!(n2.to_vec() > n1.to_vec(), "nonce must increase"); assert!(n2.to_vec() > n1.to_vec(), "nonce must increase");
let mut conn = db.get().await.unwrap(); let mut conn = db.get().await.unwrap();
let root_row: RootKeyHistory = schema::root_key_history::table let root_row: RootKeyHistory = schema::root_key_history::table
.select(RootKeyHistory::as_select()) .select(RootKeyHistory::as_select())
.first(&mut conn) .first(&mut conn)
.await .await
.unwrap(); .unwrap();
assert_eq!(root_row.data_encryption_nonce, n2.to_vec()); assert_eq!(root_row.data_encryption_nonce, n2.to_vec());
let id = actor let id = actor
.create_new(SafeCell::new(b"post-interleave".to_vec())) .create_new(SafeCell::new(b"post-interleave".to_vec()))
.await .await
.unwrap(); .unwrap();
let row: models::AeadEncrypted = schema::aead_encrypted::table let row: models::AeadEncrypted = schema::aead_encrypted::table
.filter(schema::aead_encrypted::id.eq(id)) .filter(schema::aead_encrypted::id.eq(id))
.select(models::AeadEncrypted::as_select()) .select(models::AeadEncrypted::as_select())
.first(&mut conn) .first(&mut conn)
.await .await
.unwrap(); .unwrap();
assert!( assert!(
row.current_nonce > n2.to_vec(), row.current_nonce > n2.to_vec(),
"next write must advance nonce" "next write must advance nonce"
); );
} }
} }

114
server/crates/arbiter-server/src/context/mod.rs
View File

@@ -1,57 +1,57 @@
use crate::{ use crate::{
actors::GlobalActors, actors::GlobalActors,
context::tls::TlsManager, context::tls::TlsManager,
db::{self}, db::{self},
}; };
use std::sync::Arc; use std::sync::Arc;
use thiserror::Error; use thiserror::Error;
pub mod tls; pub mod tls;
#[derive(Error, Debug)] #[derive(Error, Debug)]
pub enum InitError { pub enum InitError {
#[error("Database setup failed: {0}")] #[error("Database setup failed: {0}")]
DatabaseSetup(#[from] db::DatabaseSetupError), DatabaseSetup(#[from] db::DatabaseSetupError),
#[error("Connection acquire failed: {0}")] #[error("Connection acquire failed: {0}")]
DatabasePool(#[from] db::PoolError), DatabasePool(#[from] db::PoolError),
#[error("Database query error: {0}")] #[error("Database query error: {0}")]
DatabaseQuery(#[from] diesel::result::Error), DatabaseQuery(#[from] diesel::result::Error),
#[error("TLS initialization failed: {0}")] #[error("TLS initialization failed: {0}")]
Tls(#[from] tls::InitError), Tls(#[from] tls::InitError),
#[error("Actor spawn failed: {0}")] #[error("Actor spawn failed: {0}")]
ActorSpawn(#[from] crate::actors::SpawnError), ActorSpawn(#[from] crate::actors::SpawnError),
#[error("I/O Error: {0}")] #[error("I/O Error: {0}")]
Io(#[from] std::io::Error), Io(#[from] std::io::Error),
} }
pub struct __ServerContextInner { pub struct __ServerContextInner {
pub db: db::DatabasePool, pub db: db::DatabasePool,
pub tls: TlsManager, pub tls: TlsManager,
pub actors: GlobalActors, pub actors: GlobalActors,
} }
#[derive(Clone)] #[derive(Clone)]
pub struct ServerContext(Arc<__ServerContextInner>); pub struct ServerContext(Arc<__ServerContextInner>);
impl std::ops::Deref for ServerContext { impl std::ops::Deref for ServerContext {
type Target = __ServerContextInner; type Target = __ServerContextInner;
fn deref(&self) -> &Self::Target { fn deref(&self) -> &Self::Target {
&self.0 &self.0
} }
} }
impl ServerContext { impl ServerContext {
pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> { pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> {
Ok(Self(Arc::new(__ServerContextInner { Ok(Self(Arc::new(__ServerContextInner {
actors: GlobalActors::spawn(db.clone()).await?, actors: GlobalActors::spawn(db.clone()).await?,
tls: TlsManager::new(db.clone()).await?, tls: TlsManager::new(db.clone()).await?,
db, db,
}))) })))
} }
} }

514
server/crates/arbiter-server/src/context/tls.rs
View File

@@ -1,257 +1,257 @@
use crate::db::{ use crate::db::{
self, self,
models::{NewTlsHistory, TlsHistory}, models::{NewTlsHistory, TlsHistory},
schema::{ schema::{
arbiter_settings, arbiter_settings,
tls_history::{self}, tls_history::{self},
}, },
}; };
use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper as _}; use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper as _};
use diesel_async::{AsyncConnection, RunQueryDsl}; use diesel_async::{AsyncConnection, RunQueryDsl};
use pem::Pem; use pem::Pem;
use rcgen::{ use rcgen::{
BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType, BasicConstraints, Certificate, CertificateParams, CertifiedIssuer, DistinguishedName, DnType,
IsCa, Issuer, KeyPair, KeyUsagePurpose, SanType, IsCa, Issuer, KeyPair, KeyUsagePurpose, SanType,
}; };
use rustls::pki_types::pem::PemObject; use rustls::pki_types::pem::PemObject;
use std::{net::Ipv4Addr, string::FromUtf8Error}; use std::{net::Ipv4Addr, string::FromUtf8Error};
use thiserror::Error; use thiserror::Error;
use tonic::transport::CertificateDer; use tonic::transport::CertificateDer;
const ENCODE_CONFIG: pem::EncodeConfig = { const ENCODE_CONFIG: pem::EncodeConfig = {
let line_ending = if cfg!(target_family = "windows") { let line_ending = if cfg!(target_family = "windows") {
pem::LineEnding::CRLF pem::LineEnding::CRLF
} else { } else {
pem::LineEnding::LF pem::LineEnding::LF
}; };
pem::EncodeConfig::new().set_line_ending(line_ending) pem::EncodeConfig::new().set_line_ending(line_ending)
}; };
#[derive(Error, Debug)] #[derive(Error, Debug)]
pub enum InitError { pub enum InitError {
#[error("Key generation error during TLS initialization: {0}")] #[error("Key generation error during TLS initialization: {0}")]
KeyGeneration(#[from] rcgen::Error), KeyGeneration(#[from] rcgen::Error),
#[error("Key invalid format: {0}")] #[error("Key invalid format: {0}")]
KeyInvalidFormat(#[from] FromUtf8Error), KeyInvalidFormat(#[from] FromUtf8Error),
#[error("Key deserialization error: {0}")] #[error("Key deserialization error: {0}")]
KeyDeserializationError(rcgen::Error), KeyDeserializationError(rcgen::Error),
#[error("Database error during TLS initialization: {0}")] #[error("Database error during TLS initialization: {0}")]
DatabaseError(#[from] diesel::result::Error), DatabaseError(#[from] diesel::result::Error),
#[error("Pem deserialization error during TLS initialization: {0}")] #[error("Pem deserialization error during TLS initialization: {0}")]
PemDeserializationError(#[from] rustls::pki_types::pem::Error), PemDeserializationError(#[from] rustls::pki_types::pem::Error),
#[error("Database pool acquire error during TLS initialization: {0}")] #[error("Database pool acquire error during TLS initialization: {0}")]
DatabasePoolAcquire(#[from] db::PoolError), DatabasePoolAcquire(#[from] db::PoolError),
} }
pub type PemCert = String; pub type PemCert = String;
pub fn encode_cert_to_pem(cert: &CertificateDer<'_>) -> PemCert { pub fn encode_cert_to_pem(cert: &CertificateDer<'_>) -> PemCert {
pem::encode_config(&Pem::new("CERTIFICATE", cert.to_vec()), ENCODE_CONFIG) pem::encode_config(&Pem::new("CERTIFICATE", cert.to_vec()), ENCODE_CONFIG)
} }
#[expect( #[expect(
unused, unused,
reason = "may be needed for future cert rotation implementation" reason = "may be needed for future cert rotation implementation"
)] )]
struct SerializedTls { struct SerializedTls {
cert_pem: PemCert, cert_pem: PemCert,
cert_key_pem: String, cert_key_pem: String,
} }
struct TlsCa { struct TlsCa {
issuer: Issuer<'static, KeyPair>, issuer: Issuer<'static, KeyPair>,
cert: CertificateDer<'static>, cert: CertificateDer<'static>,
} }
impl TlsCa { impl TlsCa {
fn generate() -> Result<Self, InitError> { fn generate() -> Result<Self, InitError> {
let keypair = KeyPair::generate()?; let keypair = KeyPair::generate()?;
let mut params = CertificateParams::new(["Arbiter Instance CA".into()])?; let mut params = CertificateParams::new(["Arbiter Instance CA".into()])?;
params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained); params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
params.key_usages = vec![ params.key_usages = vec![
KeyUsagePurpose::KeyCertSign, KeyUsagePurpose::KeyCertSign,
KeyUsagePurpose::CrlSign, KeyUsagePurpose::CrlSign,
KeyUsagePurpose::DigitalSignature, KeyUsagePurpose::DigitalSignature,
]; ];
let mut dn = DistinguishedName::new(); let mut dn = DistinguishedName::new();
dn.push(DnType::CommonName, "Arbiter Instance CA"); dn.push(DnType::CommonName, "Arbiter Instance CA");
params.distinguished_name = dn; params.distinguished_name = dn;
let certified_issuer = CertifiedIssuer::self_signed(params, keypair)?; let certified_issuer = CertifiedIssuer::self_signed(params, keypair)?;
let cert_key_pem = certified_issuer.key().serialize_pem(); let cert_key_pem = certified_issuer.key().serialize_pem();
#[expect( #[expect(
clippy::unwrap_used, clippy::unwrap_used,
reason = "Broken cert couldn't bootstrap server anyway" reason = "Broken cert couldn't bootstrap server anyway"
)] )]
let issuer = Issuer::from_ca_cert_pem( let issuer = Issuer::from_ca_cert_pem(
&certified_issuer.pem(), &certified_issuer.pem(),
KeyPair::from_pem(cert_key_pem.as_ref()).unwrap(), KeyPair::from_pem(cert_key_pem.as_ref()).unwrap(),
) )
.unwrap(); .unwrap();
Ok(Self { Ok(Self {
issuer, issuer,
cert: certified_issuer.der().clone(), cert: certified_issuer.der().clone(),
}) })
} }
fn generate_leaf(&self) -> Result<TlsCert, InitError> { fn generate_leaf(&self) -> Result<TlsCert, InitError> {
let cert_key = KeyPair::generate()?; let cert_key = KeyPair::generate()?;
let mut params = CertificateParams::new(["Arbiter Instance Leaf".into()])?; let mut params = CertificateParams::new(["Arbiter Instance Leaf".into()])?;
params.is_ca = IsCa::NoCa; params.is_ca = IsCa::NoCa;
params.key_usages = vec![ params.key_usages = vec![
KeyUsagePurpose::DigitalSignature, KeyUsagePurpose::DigitalSignature,
KeyUsagePurpose::KeyEncipherment, KeyUsagePurpose::KeyEncipherment,
]; ];
params params
.subject_alt_names .subject_alt_names
.push(SanType::IpAddress(Ipv4Addr::LOCALHOST.into())); .push(SanType::IpAddress(Ipv4Addr::LOCALHOST.into()));
let mut dn = DistinguishedName::new(); let mut dn = DistinguishedName::new();
dn.push(DnType::CommonName, "Arbiter Instance Leaf"); dn.push(DnType::CommonName, "Arbiter Instance Leaf");
params.distinguished_name = dn; params.distinguished_name = dn;
let new_cert = params.signed_by(&cert_key, &self.issuer)?; let new_cert = params.signed_by(&cert_key, &self.issuer)?;
Ok(TlsCert { Ok(TlsCert {
cert: new_cert, cert: new_cert,
cert_key, cert_key,
}) })
} }
#[expect( #[expect(
unused, unused,
clippy::unnecessary_wraps, clippy::unnecessary_wraps,
reason = "may be needed for future cert rotation implementation" reason = "may be needed for future cert rotation implementation"
)] )]
fn serialize(&self) -> Result<SerializedTls, InitError> { fn serialize(&self) -> Result<SerializedTls, InitError> {
let cert_key_pem = self.issuer.key().serialize_pem(); let cert_key_pem = self.issuer.key().serialize_pem();
Ok(SerializedTls { Ok(SerializedTls {
cert_pem: encode_cert_to_pem(&self.cert), cert_pem: encode_cert_to_pem(&self.cert),
cert_key_pem, cert_key_pem,
}) })
} }
#[expect( #[expect(
unused, unused,
reason = "may be needed for future cert rotation implementation" reason = "may be needed for future cert rotation implementation"
)] )]
fn try_deserialize(cert_pem: &str, cert_key_pem: &str) -> Result<Self, InitError> { fn try_deserialize(cert_pem: &str, cert_key_pem: &str) -> Result<Self, InitError> {
let keypair = let keypair =
KeyPair::from_pem(cert_key_pem).map_err(InitError::KeyDeserializationError)?; KeyPair::from_pem(cert_key_pem).map_err(InitError::KeyDeserializationError)?;
let issuer = Issuer::from_ca_cert_pem(cert_pem, keypair)?; let issuer = Issuer::from_ca_cert_pem(cert_pem, keypair)?;
Ok(Self { Ok(Self {
issuer, issuer,
cert: CertificateDer::from_pem_slice(cert_pem.as_bytes())?, cert: CertificateDer::from_pem_slice(cert_pem.as_bytes())?,
}) })
} }
} }
struct TlsCert { struct TlsCert {
cert: Certificate, cert: Certificate,
cert_key: KeyPair, cert_key: KeyPair,
} }
// TODO: Implement cert rotation // TODO: Implement cert rotation
pub struct TlsManager { pub struct TlsManager {
cert: CertificateDer<'static>, cert: CertificateDer<'static>,
keypair: KeyPair, keypair: KeyPair,
ca_cert: CertificateDer<'static>, ca_cert: CertificateDer<'static>,
_db: db::DatabasePool, _db: db::DatabasePool,
} }
impl TlsManager { impl TlsManager {
pub async fn generate_new(db: &db::DatabasePool) -> Result<Self, InitError> { pub async fn generate_new(db: &db::DatabasePool) -> Result<Self, InitError> {
let ca = TlsCa::generate()?; let ca = TlsCa::generate()?;
let new_cert = ca.generate_leaf()?; let new_cert = ca.generate_leaf()?;
{ {
let mut conn = db.get().await?; let mut conn = db.get().await?;
conn.transaction(async |conn| { conn.transaction(async |conn| {
let new_tls_history = NewTlsHistory { let new_tls_history = NewTlsHistory {
cert: new_cert.cert.pem(), cert: new_cert.cert.pem(),
cert_key: new_cert.cert_key.serialize_pem(), cert_key: new_cert.cert_key.serialize_pem(),
ca_cert: encode_cert_to_pem(&ca.cert), ca_cert: encode_cert_to_pem(&ca.cert),
ca_key: ca.issuer.key().serialize_pem(), ca_key: ca.issuer.key().serialize_pem(),
}; };
let inserted_tls_history: i32 = diesel::insert_into(tls_history::table) let inserted_tls_history: i32 = diesel::insert_into(tls_history::table)
.values(&new_tls_history) .values(&new_tls_history)
.returning(tls_history::id) .returning(tls_history::id)
.get_result(&mut *conn) .get_result(&mut *conn)
.await?; .await?;
diesel::update(arbiter_settings::table) diesel::update(arbiter_settings::table)
.set(arbiter_settings::tls_id.eq(inserted_tls_history)) .set(arbiter_settings::tls_id.eq(inserted_tls_history))
.execute(&mut *conn) .execute(&mut *conn)
.await?; .await?;
Result::<_, diesel::result::Error>::Ok(()) Result::<_, diesel::result::Error>::Ok(())
}) })
.await?; .await?;
} }
Ok(Self { Ok(Self {
cert: new_cert.cert.der().clone(), cert: new_cert.cert.der().clone(),
keypair: new_cert.cert_key, keypair: new_cert.cert_key,
ca_cert: ca.cert, ca_cert: ca.cert,
_db: db.clone(), _db: db.clone(),
}) })
} }
pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> { pub async fn new(db: db::DatabasePool) -> Result<Self, InitError> {
let cert_data: Option<TlsHistory> = { let cert_data: Option<TlsHistory> = {
let mut conn = db.get().await?; let mut conn = db.get().await?;
arbiter_settings::table arbiter_settings::table
.left_join(tls_history::table) .left_join(tls_history::table)
.select(Option::<TlsHistory>::as_select()) .select(Option::<TlsHistory>::as_select())
.first(&mut conn) .first(&mut conn)
.await? .await?
}; };
match cert_data { match cert_data {
Some(data) => { Some(data) => {
let try_load = || -> Result<_, Box<dyn std::error::Error>> { let try_load = || -> Result<_, Box<dyn std::error::Error>> {
let keypair = KeyPair::from_pem(&data.cert_key)?; let keypair = KeyPair::from_pem(&data.cert_key)?;
let cert = CertificateDer::from_pem_slice(data.cert.as_bytes())?; let cert = CertificateDer::from_pem_slice(data.cert.as_bytes())?;
let ca_cert = CertificateDer::from_pem_slice(data.ca_cert.as_bytes())?; let ca_cert = CertificateDer::from_pem_slice(data.ca_cert.as_bytes())?;
Ok(Self { Ok(Self {
cert, cert,
keypair, keypair,
ca_cert, ca_cert,
_db: db.clone(), _db: db.clone(),
}) })
}; };
match try_load() { match try_load() {
Ok(manager) => Ok(manager), Ok(manager) => Ok(manager),
Err(e) => { Err(e) => {
eprintln!("Failed to load existing TLS certs: {e}. Generating new ones."); eprintln!("Failed to load existing TLS certs: {e}. Generating new ones.");
Self::generate_new(&db).await Self::generate_new(&db).await
} }
} }
} }
None => Self::generate_new(&db).await, None => Self::generate_new(&db).await,
} }
} }
pub const fn cert(&self) -> &CertificateDer<'static> { pub const fn cert(&self) -> &CertificateDer<'static> {
&self.cert &self.cert
} }
pub const fn ca_cert(&self) -> &CertificateDer<'static> { pub const fn ca_cert(&self) -> &CertificateDer<'static> {
&self.ca_cert &self.ca_cert
} }
pub fn cert_pem(&self) -> PemCert { pub fn cert_pem(&self) -> PemCert {
encode_cert_to_pem(&self.cert) encode_cert_to_pem(&self.cert)
} }
pub fn key_pem(&self) -> String { pub fn key_pem(&self) -> String {
self.keypair.serialize_pem() self.keypair.serialize_pem()
} }
} }

Some files were not shown because too many files have changed in this diff Show More