Compare commits
2 Commits
hashable-i
...
e911165137
| Author | SHA1 | Date | |
|---|---|---|---|
|
e911165137 | ||
|
|
a773255935 |
@@ -1,31 +0,0 @@
|
|||||||
Extension Discovery Cache
|
|
||||||
=========================
|
|
||||||
|
|
||||||
This folder is used by `package:extension_discovery` to cache lists of
|
|
||||||
packages that contains extensions for other packages.
|
|
||||||
|
|
||||||
DO NOT USE THIS FOLDER
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
* Do not read (or rely) the contents of this folder.
|
|
||||||
* Do write to this folder.
|
|
||||||
|
|
||||||
If you're interested in the lists of extensions stored in this folder use the
|
|
||||||
API offered by package `extension_discovery` to get this information.
|
|
||||||
|
|
||||||
If this package doesn't work for your use-case, then don't try to read the
|
|
||||||
contents of this folder. It may change, and will not remain stable.
|
|
||||||
|
|
||||||
Use package `extension_discovery`
|
|
||||||
---------------------------------
|
|
||||||
|
|
||||||
If you want to access information from this folder.
|
|
||||||
|
|
||||||
Feel free to delete this folder
|
|
||||||
-------------------------------
|
|
||||||
|
|
||||||
Files in this folder act as a cache, and the cache is discarded if the files
|
|
||||||
are older than the modification time of `.dart_tool/package_config.json`.
|
|
||||||
|
|
||||||
Hence, it should never be necessary to clear this cache manually, if you find a
|
|
||||||
need to do please file a bug.
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}
|
|
||||||
@@ -1,178 +0,0 @@
|
|||||||
{
|
|
||||||
"configVersion": 2,
|
|
||||||
"packages": [
|
|
||||||
{
|
|
||||||
"name": "async",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "boolean_selector",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.1"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "characters",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "clock",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "collection",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "cupertino_icons",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.1"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "fake_async",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.3"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "flutter",
|
|
||||||
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.8"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "flutter_lints",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.8"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "flutter_test",
|
|
||||||
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.8"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "leak_tracker",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.2"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "leak_tracker_flutter_testing",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.2"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "leak_tracker_testing",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.2"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "lints",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.8"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "matcher",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "material_color_utilities",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "2.17"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "meta",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.5"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "path",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "sky_engine",
|
|
||||||
"rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.8"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "source_span",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.1"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "stack_trace",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.4"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "stream_channel",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.3"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "string_scanner",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.1"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "term_glyph",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.1"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "test_api",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.5"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "vector_math",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.1"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "vm_service",
|
|
||||||
"rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.5"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "app",
|
|
||||||
"rootUri": "../",
|
|
||||||
"packageUri": "lib/",
|
|
||||||
"languageVersion": "3.10"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"generator": "pub",
|
|
||||||
"generatorVersion": "3.10.8",
|
|
||||||
"flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
|
|
||||||
"flutterVersion": "3.38.9",
|
|
||||||
"pubCache": "file:///Users/kaska/.pub-cache"
|
|
||||||
}
|
|
||||||
@@ -1,230 +0,0 @@
|
|||||||
{
|
|
||||||
"roots": [
|
|
||||||
"app"
|
|
||||||
],
|
|
||||||
"packages": [
|
|
||||||
{
|
|
||||||
"name": "app",
|
|
||||||
"version": "1.0.0+1",
|
|
||||||
"dependencies": [
|
|
||||||
"cupertino_icons",
|
|
||||||
"flutter"
|
|
||||||
],
|
|
||||||
"devDependencies": [
|
|
||||||
"flutter_lints",
|
|
||||||
"flutter_test"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "flutter_lints",
|
|
||||||
"version": "6.0.0",
|
|
||||||
"dependencies": [
|
|
||||||
"lints"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "flutter_test",
|
|
||||||
"version": "0.0.0",
|
|
||||||
"dependencies": [
|
|
||||||
"clock",
|
|
||||||
"collection",
|
|
||||||
"fake_async",
|
|
||||||
"flutter",
|
|
||||||
"leak_tracker_flutter_testing",
|
|
||||||
"matcher",
|
|
||||||
"meta",
|
|
||||||
"path",
|
|
||||||
"stack_trace",
|
|
||||||
"stream_channel",
|
|
||||||
"test_api",
|
|
||||||
"vector_math"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "cupertino_icons",
|
|
||||||
"version": "1.0.8",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "flutter",
|
|
||||||
"version": "0.0.0",
|
|
||||||
"dependencies": [
|
|
||||||
"characters",
|
|
||||||
"collection",
|
|
||||||
"material_color_utilities",
|
|
||||||
"meta",
|
|
||||||
"sky_engine",
|
|
||||||
"vector_math"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "lints",
|
|
||||||
"version": "6.1.0",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "stream_channel",
|
|
||||||
"version": "2.1.4",
|
|
||||||
"dependencies": [
|
|
||||||
"async"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "meta",
|
|
||||||
"version": "1.17.0",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "collection",
|
|
||||||
"version": "1.19.1",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "leak_tracker_flutter_testing",
|
|
||||||
"version": "3.0.10",
|
|
||||||
"dependencies": [
|
|
||||||
"flutter",
|
|
||||||
"leak_tracker",
|
|
||||||
"leak_tracker_testing",
|
|
||||||
"matcher",
|
|
||||||
"meta"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "vector_math",
|
|
||||||
"version": "2.2.0",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "stack_trace",
|
|
||||||
"version": "1.12.1",
|
|
||||||
"dependencies": [
|
|
||||||
"path"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "clock",
|
|
||||||
"version": "1.1.2",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "fake_async",
|
|
||||||
"version": "1.3.3",
|
|
||||||
"dependencies": [
|
|
||||||
"clock",
|
|
||||||
"collection"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "path",
|
|
||||||
"version": "1.9.1",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "matcher",
|
|
||||||
"version": "0.12.17",
|
|
||||||
"dependencies": [
|
|
||||||
"async",
|
|
||||||
"meta",
|
|
||||||
"stack_trace",
|
|
||||||
"term_glyph",
|
|
||||||
"test_api"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "test_api",
|
|
||||||
"version": "0.7.7",
|
|
||||||
"dependencies": [
|
|
||||||
"async",
|
|
||||||
"boolean_selector",
|
|
||||||
"collection",
|
|
||||||
"meta",
|
|
||||||
"source_span",
|
|
||||||
"stack_trace",
|
|
||||||
"stream_channel",
|
|
||||||
"string_scanner",
|
|
||||||
"term_glyph"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "sky_engine",
|
|
||||||
"version": "0.0.0",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "material_color_utilities",
|
|
||||||
"version": "0.11.1",
|
|
||||||
"dependencies": [
|
|
||||||
"collection"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "characters",
|
|
||||||
"version": "1.4.0",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "async",
|
|
||||||
"version": "2.13.0",
|
|
||||||
"dependencies": [
|
|
||||||
"collection",
|
|
||||||
"meta"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "leak_tracker_testing",
|
|
||||||
"version": "3.0.2",
|
|
||||||
"dependencies": [
|
|
||||||
"leak_tracker",
|
|
||||||
"matcher",
|
|
||||||
"meta"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "leak_tracker",
|
|
||||||
"version": "11.0.2",
|
|
||||||
"dependencies": [
|
|
||||||
"clock",
|
|
||||||
"collection",
|
|
||||||
"meta",
|
|
||||||
"path",
|
|
||||||
"vm_service"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "term_glyph",
|
|
||||||
"version": "1.2.2",
|
|
||||||
"dependencies": []
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "string_scanner",
|
|
||||||
"version": "1.4.1",
|
|
||||||
"dependencies": [
|
|
||||||
"source_span"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "source_span",
|
|
||||||
"version": "1.10.2",
|
|
||||||
"dependencies": [
|
|
||||||
"collection",
|
|
||||||
"path",
|
|
||||||
"term_glyph"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "boolean_selector",
|
|
||||||
"version": "2.1.2",
|
|
||||||
"dependencies": [
|
|
||||||
"source_span",
|
|
||||||
"string_scanner"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "vm_service",
|
|
||||||
"version": "15.0.2",
|
|
||||||
"dependencies": []
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"configVersion": 1
|
|
||||||
}
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
3.38.9
|
|
||||||
@@ -22,3 +22,5 @@ run = '''
|
|||||||
dart pub global activate protoc_plugin && \
|
dart pub global activate protoc_plugin && \
|
||||||
protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
|
protoc --dart_out=grpc:useragent/lib/proto --proto_path=protobufs/ $(find protobufs -name '*.proto' | sort)
|
||||||
'''
|
'''
|
||||||
|
|
||||||
|
[tasks.generate_schema]
|
||||||
|
|||||||
@@ -4,6 +4,7 @@ package arbiter.operator;
|
|||||||
|
|
||||||
import "operator/auth.proto";
|
import "operator/auth.proto";
|
||||||
import "operator/evm.proto";
|
import "operator/evm.proto";
|
||||||
|
import "operator/governance.proto";
|
||||||
import "operator/sdk_client.proto";
|
import "operator/sdk_client.proto";
|
||||||
import "operator/vault/vault.proto";
|
import "operator/vault/vault.proto";
|
||||||
|
|
||||||
@@ -14,6 +15,7 @@ message OperatorRequest {
|
|||||||
vault.Request vault = 2;
|
vault.Request vault = 2;
|
||||||
evm.Request evm = 3;
|
evm.Request evm = 3;
|
||||||
sdk_client.Request sdk_client = 4;
|
sdk_client.Request sdk_client = 4;
|
||||||
|
governance.Request governance = 5;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -24,5 +26,6 @@ message OperatorResponse {
|
|||||||
vault.Response vault = 2;
|
vault.Response vault = 2;
|
||||||
evm.Response evm = 3;
|
evm.Response evm = 3;
|
||||||
sdk_client.Response sdk_client = 4;
|
sdk_client.Response sdk_client = 4;
|
||||||
|
governance.Response governance = 5;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
136
protobufs/operator/governance.proto
Normal file
136
protobufs/operator/governance.proto
Normal file
@@ -0,0 +1,136 @@
|
|||||||
|
syntax = "proto3";
|
||||||
|
|
||||||
|
package arbiter.operator.governance;
|
||||||
|
|
||||||
|
message Request {
|
||||||
|
oneof payload {
|
||||||
|
CreateProposalRequest create = 1;
|
||||||
|
CastVoteRequest vote = 2;
|
||||||
|
QueryPendingRequest query = 3;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
message CreateProposalRequest {
|
||||||
|
oneof kind {
|
||||||
|
ApproveSdkClientPayload approve_sdk_client = 1;
|
||||||
|
GrantWalletAccessPayload grant_wallet_access = 3;
|
||||||
|
ApproveServerUpdatePayload approve_server_update = 4;
|
||||||
|
ReplaceOperatorPayload replace_operator = 5;
|
||||||
|
UpdateShamirParametersPayload update_shamir_parameters = 6;
|
||||||
|
ApprovePersistentGrantPayload approve_persistent_grant = 7;
|
||||||
|
ApproveOneOffTransactionPayload approve_one_off_transaction = 8;
|
||||||
|
}
|
||||||
|
optional uint32 ttl_secs = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ReplaceOperatorPayload {
|
||||||
|
int32 old_operator_id = 1;
|
||||||
|
bytes new_pubkey = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
message UpdateShamirParametersPayload {
|
||||||
|
uint32 new_n = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ApproveServerUpdatePayload {}
|
||||||
|
|
||||||
|
message ApproveSdkClientPayload {
|
||||||
|
int32 client_id = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
message GrantWalletAccessPayload {
|
||||||
|
int32 wallet_id = 1;
|
||||||
|
int32 client_id = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
message CastVoteRequest {
|
||||||
|
int32 proposal_id = 1;
|
||||||
|
bool approve = 2;
|
||||||
|
bytes signature = 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
message QueryPendingRequest {}
|
||||||
|
|
||||||
|
message Response {
|
||||||
|
oneof payload {
|
||||||
|
CreateProposalResponse created = 1;
|
||||||
|
VoteResponse voted = 2;
|
||||||
|
QueryPendingResponse pending = 3;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
message CreateProposalResponse {
|
||||||
|
int32 proposal_id = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
message VoteResponse {
|
||||||
|
VoteOutcome outcome = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
enum VoteOutcome {
|
||||||
|
VOTE_OUTCOME_UNSPECIFIED = 0;
|
||||||
|
VOTE_OUTCOME_PENDING = 1;
|
||||||
|
VOTE_OUTCOME_APPROVED = 2;
|
||||||
|
VOTE_OUTCOME_REJECTED = 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ProposalSummary {
|
||||||
|
int32 id = 1;
|
||||||
|
string kind = 2;
|
||||||
|
int32 initiator_id = 3;
|
||||||
|
int64 expires_at = 4;
|
||||||
|
int64 approve_count = 5;
|
||||||
|
int64 reject_count = 6;
|
||||||
|
}
|
||||||
|
|
||||||
|
message QueryPendingResponse {
|
||||||
|
repeated ProposalSummary proposals = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
message TransactionRateLimitProto {
|
||||||
|
uint32 count = 1;
|
||||||
|
int64 window_secs = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
message VolumeLimitProto {
|
||||||
|
bytes max_volume = 1;
|
||||||
|
int64 window_secs = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
message EtherTransferSpecProto {
|
||||||
|
repeated bytes targets = 1;
|
||||||
|
VolumeLimitProto limit = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
message TokenTransferSpecProto {
|
||||||
|
bytes token_contract = 1;
|
||||||
|
optional bytes target = 2;
|
||||||
|
repeated VolumeLimitProto volume_limits = 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ApproveOneOffTransactionPayload {
|
||||||
|
int32 client_id = 1;
|
||||||
|
bytes wallet_address = 2;
|
||||||
|
uint64 chain_id = 3;
|
||||||
|
uint64 nonce = 4;
|
||||||
|
uint64 gas_limit = 5;
|
||||||
|
bytes max_fee_per_gas = 6;
|
||||||
|
bytes max_priority_fee_per_gas = 7;
|
||||||
|
bytes to = 8;
|
||||||
|
bytes value = 9;
|
||||||
|
bytes input = 10;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ApprovePersistentGrantPayload {
|
||||||
|
int32 wallet_access_id = 1;
|
||||||
|
uint64 chain_id = 2;
|
||||||
|
optional int64 valid_from_secs = 3;
|
||||||
|
optional int64 valid_until_secs = 4;
|
||||||
|
optional bytes max_gas_fee_per_gas = 5;
|
||||||
|
optional bytes max_priority_fee_per_gas = 6;
|
||||||
|
optional TransactionRateLimitProto rate_limit = 7;
|
||||||
|
oneof specific {
|
||||||
|
EtherTransferSpecProto ether_transfer = 8;
|
||||||
|
TokenTransferSpecProto token_transfer = 9;
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -8,15 +8,35 @@ message BootstrapEncryptedKey {
|
|||||||
bytes associated_data = 3;
|
bytes associated_data = 3;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
message DeclareCommittee {
|
||||||
|
uint32 count = 1;
|
||||||
|
uint32 recovery_count = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ContributePassphrase {
|
||||||
|
bytes passphrase = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ContributeRecoveryPassphrase {
|
||||||
|
int32 recovery_operator_id = 1;
|
||||||
|
bytes passphrase = 2;
|
||||||
|
}
|
||||||
|
|
||||||
enum BootstrapResult {
|
enum BootstrapResult {
|
||||||
BOOTSTRAP_RESULT_UNSPECIFIED = 0;
|
BOOTSTRAP_RESULT_UNSPECIFIED = 0;
|
||||||
BOOTSTRAP_RESULT_SUCCESS = 1;
|
BOOTSTRAP_RESULT_SUCCESS = 1;
|
||||||
BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
|
BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
|
||||||
BOOTSTRAP_RESULT_INVALID_KEY = 3;
|
BOOTSTRAP_RESULT_INVALID_KEY = 3;
|
||||||
|
BOOTSTRAP_RESULT_AWAITING_CONTRIBUTIONS = 4;
|
||||||
}
|
}
|
||||||
|
|
||||||
message Request {
|
message Request {
|
||||||
|
oneof payload {
|
||||||
BootstrapEncryptedKey encrypted_key = 2;
|
BootstrapEncryptedKey encrypted_key = 2;
|
||||||
|
DeclareCommittee declare_committee = 3;
|
||||||
|
ContributePassphrase contribute_passphrase = 4;
|
||||||
|
ContributeRecoveryPassphrase contribute_recovery_passphrase = 5;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
message Response {
|
message Response {
|
||||||
|
|||||||
30
protobufs/operator/vault/rekey.proto
Normal file
30
protobufs/operator/vault/rekey.proto
Normal file
@@ -0,0 +1,30 @@
|
|||||||
|
syntax = "proto3";
|
||||||
|
|
||||||
|
package arbiter.operator.vault.rekey;
|
||||||
|
|
||||||
|
message ContributePassphrase {
|
||||||
|
bytes passphrase = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ContributeRecoveryPassphrase {
|
||||||
|
int32 recovery_operator_id = 1;
|
||||||
|
bytes passphrase = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
enum RekeyResult {
|
||||||
|
REKEY_RESULT_UNSPECIFIED = 0;
|
||||||
|
REKEY_RESULT_SUCCESS = 1;
|
||||||
|
REKEY_RESULT_AWAITING_CONTRIBUTIONS = 2;
|
||||||
|
REKEY_RESULT_NOT_IN_PROGRESS = 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
message Request {
|
||||||
|
oneof payload {
|
||||||
|
ContributePassphrase contribute_passphrase = 1;
|
||||||
|
ContributeRecoveryPassphrase contribute_recovery_passphrase = 2;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
message Response {
|
||||||
|
RekeyResult result = 1;
|
||||||
|
}
|
||||||
@@ -15,17 +15,29 @@ message UnsealEncryptedKey {
|
|||||||
bytes associated_data = 3;
|
bytes associated_data = 3;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
message ContributePassphrase {
|
||||||
|
bytes passphrase = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
message ContributeRecoveryPassphrase {
|
||||||
|
int32 recovery_operator_id = 1;
|
||||||
|
bytes passphrase = 2;
|
||||||
|
}
|
||||||
|
|
||||||
enum UnsealResult {
|
enum UnsealResult {
|
||||||
UNSEAL_RESULT_UNSPECIFIED = 0;
|
UNSEAL_RESULT_UNSPECIFIED = 0;
|
||||||
UNSEAL_RESULT_SUCCESS = 1;
|
UNSEAL_RESULT_SUCCESS = 1;
|
||||||
UNSEAL_RESULT_INVALID_KEY = 2;
|
UNSEAL_RESULT_INVALID_KEY = 2;
|
||||||
UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
|
UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
|
||||||
|
UNSEAL_RESULT_AWAITING_CONTRIBUTIONS = 4;
|
||||||
}
|
}
|
||||||
|
|
||||||
message Request {
|
message Request {
|
||||||
oneof payload {
|
oneof payload {
|
||||||
UnsealStart start = 1;
|
UnsealStart start = 1;
|
||||||
UnsealEncryptedKey encrypted_key = 2;
|
UnsealEncryptedKey encrypted_key = 2;
|
||||||
|
ContributePassphrase contribute_passphrase = 3;
|
||||||
|
ContributeRecoveryPassphrase contribute_recovery_passphrase = 4;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -5,6 +5,7 @@ package arbiter.operator.vault;
|
|||||||
import "google/protobuf/empty.proto";
|
import "google/protobuf/empty.proto";
|
||||||
import "shared/vault.proto";
|
import "shared/vault.proto";
|
||||||
import "operator/vault/bootstrap.proto";
|
import "operator/vault/bootstrap.proto";
|
||||||
|
import "operator/vault/rekey.proto";
|
||||||
import "operator/vault/unseal.proto";
|
import "operator/vault/unseal.proto";
|
||||||
|
|
||||||
message Request {
|
message Request {
|
||||||
@@ -12,6 +13,7 @@ message Request {
|
|||||||
google.protobuf.Empty query_state = 1;
|
google.protobuf.Empty query_state = 1;
|
||||||
unseal.Request unseal = 2;
|
unseal.Request unseal = 2;
|
||||||
bootstrap.Request bootstrap = 3;
|
bootstrap.Request bootstrap = 3;
|
||||||
|
rekey.Request rekey = 4;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -20,5 +22,6 @@ message Response {
|
|||||||
arbiter.shared.VaultState state = 1;
|
arbiter.shared.VaultState state = 1;
|
||||||
unseal.Response unseal = 2;
|
unseal.Response unseal = 2;
|
||||||
bootstrap.Response bootstrap = 3;
|
bootstrap.Response bootstrap = 3;
|
||||||
|
rekey.Response rekey = 4;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -5,7 +5,8 @@ package arbiter.shared;
|
|||||||
enum VaultState {
|
enum VaultState {
|
||||||
VAULT_STATE_UNSPECIFIED = 0;
|
VAULT_STATE_UNSPECIFIED = 0;
|
||||||
VAULT_STATE_UNBOOTSTRAPPED = 1;
|
VAULT_STATE_UNBOOTSTRAPPED = 1;
|
||||||
VAULT_STATE_SEALED = 2;
|
VAULT_STATE_BOOSTRAPPING = 2;
|
||||||
VAULT_STATE_UNSEALED = 3;
|
VAULT_STATE_SEALED = 3;
|
||||||
VAULT_STATE_ERROR = 4;
|
VAULT_STATE_UNSEALED = 4;
|
||||||
|
VAULT_STATE_ERROR = 5;
|
||||||
}
|
}
|
||||||
|
|||||||
Binary file not shown.
61
server/Cargo.lock
generated
61
server/Cargo.lock
generated
@@ -719,7 +719,6 @@ dependencies = [
|
|||||||
"proc-macro2",
|
"proc-macro2",
|
||||||
"quote",
|
"quote",
|
||||||
"syn 2.0.117",
|
"syn 2.0.117",
|
||||||
"trybuild",
|
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
@@ -1966,12 +1965,6 @@ dependencies = [
|
|||||||
"syn 2.0.117",
|
"syn 2.0.117",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "dissimilar"
|
|
||||||
version = "1.0.11"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "aeda16ab4059c5fd2a83f2b9c9e9c981327b18aa8e3b313f7e6563799d4f093e"
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "downcast-rs"
|
name = "downcast-rs"
|
||||||
version = "2.0.2"
|
version = "2.0.2"
|
||||||
@@ -3207,7 +3200,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||||||
checksum = "36c791ecdf977c99f45f23280405d7723727470f6689a5e6dbf513ac547ae10d"
|
checksum = "36c791ecdf977c99f45f23280405d7723727470f6689a5e6dbf513ac547ae10d"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"serde",
|
"serde",
|
||||||
"toml 0.9.12+spec-1.1.0",
|
"toml",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
@@ -4979,12 +4972,6 @@ version = "1.0.1"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
|
checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "target-triple"
|
|
||||||
version = "1.0.0"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "591ef38edfb78ca4771ee32cf494cb8771944bee237a9b91fc9c1424ac4b777b"
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "tempfile"
|
name = "tempfile"
|
||||||
version = "3.27.0"
|
version = "3.27.0"
|
||||||
@@ -4998,15 +4985,6 @@ dependencies = [
|
|||||||
"windows-sys 0.61.2",
|
"windows-sys 0.61.2",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "termcolor"
|
|
||||||
version = "1.4.1"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
|
|
||||||
dependencies = [
|
|
||||||
"winapi-util",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "terminal_size"
|
name = "terminal_size"
|
||||||
version = "0.4.4"
|
version = "0.4.4"
|
||||||
@@ -5229,21 +5207,6 @@ dependencies = [
|
|||||||
"winnow 0.7.15",
|
"winnow 0.7.15",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "toml"
|
|
||||||
version = "1.1.2+spec-1.1.0"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
|
|
||||||
dependencies = [
|
|
||||||
"indexmap 2.14.0",
|
|
||||||
"serde_core",
|
|
||||||
"serde_spanned",
|
|
||||||
"toml_datetime 1.1.1+spec-1.1.0",
|
|
||||||
"toml_parser",
|
|
||||||
"toml_writer",
|
|
||||||
"winnow 1.0.2",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "toml_datetime"
|
name = "toml_datetime"
|
||||||
version = "0.7.5+spec-1.1.0"
|
version = "0.7.5+spec-1.1.0"
|
||||||
@@ -5283,12 +5246,6 @@ dependencies = [
|
|||||||
"winnow 1.0.2",
|
"winnow 1.0.2",
|
||||||
]
|
]
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "toml_writer"
|
|
||||||
version = "1.1.1+spec-1.1.0"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "tonic"
|
name = "tonic"
|
||||||
version = "0.14.5"
|
version = "0.14.5"
|
||||||
@@ -5476,22 +5433,6 @@ version = "0.2.5"
|
|||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
|
checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "trybuild"
|
|
||||||
version = "1.0.117"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "0710d4dfbeae4f9c390baa784c49858a7468fa433f3fe5d0ec5ebef651cf59f9"
|
|
||||||
dependencies = [
|
|
||||||
"dissimilar",
|
|
||||||
"glob",
|
|
||||||
"serde",
|
|
||||||
"serde_derive",
|
|
||||||
"serde_json",
|
|
||||||
"target-triple",
|
|
||||||
"termcolor",
|
|
||||||
"toml 1.1.2+spec-1.1.0",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "typenum"
|
name = "typenum"
|
||||||
version = "1.20.0"
|
version = "1.20.0"
|
||||||
|
|||||||
@@ -76,7 +76,6 @@ needless_pass_by_ref_mut = "allow"
|
|||||||
pub_underscore_fields = "allow"
|
pub_underscore_fields = "allow"
|
||||||
redundant_pub_crate = "allow"
|
redundant_pub_crate = "allow"
|
||||||
uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
|
uninhabited_references = "allow" # safe with unsafe_code = "forbid" and standard uninhabited pattern (match *self {})
|
||||||
too-many-lines = "allow" # this is a very common pattern in server code, and it's not always possible to break it down into smaller modules without hurting readability
|
|
||||||
|
|
||||||
# restriction lints
|
# restriction lints
|
||||||
alloc_instead_of_core = "warn"
|
alloc_instead_of_core = "warn"
|
||||||
@@ -129,6 +128,7 @@ rc_buffer = "warn"
|
|||||||
rc_mutex = "warn"
|
rc_mutex = "warn"
|
||||||
redundant_test_prefix = "warn"
|
redundant_test_prefix = "warn"
|
||||||
redundant_type_annotations = "warn"
|
redundant_type_annotations = "warn"
|
||||||
|
ref_patterns = "warn"
|
||||||
renamed_function_params = "warn"
|
renamed_function_params = "warn"
|
||||||
rest_pat_in_fully_bound_structs = "warn"
|
rest_pat_in_fully_bound_structs = "warn"
|
||||||
return_and_then = "warn"
|
return_and_then = "warn"
|
||||||
|
|||||||
@@ -100,7 +100,7 @@ async fn send_auth_challenge_solution(
|
|||||||
key: &SigningKey,
|
key: &SigningKey,
|
||||||
challenge: AuthChallenge,
|
challenge: AuthChallenge,
|
||||||
) -> Result<(), AuthError> {
|
) -> Result<(), AuthError> {
|
||||||
let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos.cast_signed());
|
let timestamp = DateTime::from_timestamp_nanos(challenge.timestamp_nanos as i64);
|
||||||
let challenge = authn::AuthChallenge {
|
let challenge = authn::AuthChallenge {
|
||||||
nonce: *challenge
|
nonce: *challenge
|
||||||
.random
|
.random
|
||||||
|
|||||||
@@ -1,49 +0,0 @@
|
|||||||
use crate::hashing::Hashable;
|
|
||||||
|
|
||||||
/// Marks a struct as a participant in the database integrity system.
|
|
||||||
///
|
|
||||||
/// Implementors are protected by an HMAC-SHA256 MAC stored in the
|
|
||||||
/// `integrity_envelope` table. The MAC is computed over:
|
|
||||||
///
|
|
||||||
/// ```text
|
|
||||||
/// HMAC-SHA256(key, len(KIND) || KIND || len(entity_id) || entity_id || VERSION || SHA256(Hashable))
|
|
||||||
/// ```
|
|
||||||
///
|
|
||||||
/// Both `KIND` and `VERSION` act as domain separators — they prevent a valid
|
|
||||||
/// MAC for one entity type or schema version from being accepted for another.
|
|
||||||
///
|
|
||||||
/// # Deriving
|
|
||||||
///
|
|
||||||
/// Use `#[derive(Integrable)]` with the `#[integrable(kind = "...")]` attribute.
|
|
||||||
/// `VERSION` is computed automatically as an FNV-1a hash of the struct's field
|
|
||||||
/// names and types, so it changes whenever the schema changes without any manual
|
|
||||||
/// bookkeeping.
|
|
||||||
///
|
|
||||||
/// ```rust,ignore
|
|
||||||
/// #[derive(Hashable, Integrable)]
|
|
||||||
/// #[integrable(kind = "operator_credentials")]
|
|
||||||
/// pub struct OperatorCredentials {
|
|
||||||
/// pub pubkey: PublicKey,
|
|
||||||
/// }
|
|
||||||
/// ```
|
|
||||||
///
|
|
||||||
/// # Upgrading schema
|
|
||||||
///
|
|
||||||
/// When fields are added, removed, or reordered, `VERSION` changes automatically.
|
|
||||||
/// Existing MAC records in the database will return [`PayloadVersionMismatch`] on
|
|
||||||
/// verification — this is the signal to re-sign all rows for this `KIND` as part
|
|
||||||
/// of a migration.
|
|
||||||
///
|
|
||||||
/// [`PayloadVersionMismatch`]: crate::integrity::Integrable
|
|
||||||
pub trait Integrable: Hashable {
|
|
||||||
/// Stable name of this entity type as stored in `integrity_envelope.entity_kind`.
|
|
||||||
///
|
|
||||||
/// Must be a valid schema name: starts with a letter, contains only `[a-zA-Z0-9_]`,
|
|
||||||
/// and must be globally unique across all `Integrable` types in the system.
|
|
||||||
const KIND: &'static str;
|
|
||||||
|
|
||||||
/// FNV-1a hash of the struct's field names and types at the time the derive
|
|
||||||
/// macro ran. Changes automatically when the schema changes, invalidating
|
|
||||||
/// existing MACs and signalling that a migration is required.
|
|
||||||
const VERSION: i32;
|
|
||||||
}
|
|
||||||
@@ -1,7 +1,6 @@
|
|||||||
#[cfg(feature = "authn")]
|
#[cfg(feature = "authn")]
|
||||||
pub mod authn;
|
pub mod authn;
|
||||||
pub mod hashing;
|
pub mod hashing;
|
||||||
pub mod integrity;
|
|
||||||
#[cfg(feature = "safecell")]
|
#[cfg(feature = "safecell")]
|
||||||
pub mod safecell;
|
pub mod safecell;
|
||||||
|
|
||||||
|
|||||||
@@ -14,7 +14,6 @@ syn = { version = "2.0", features = ["derive", "fold", "full", "visit-mut"] }
|
|||||||
|
|
||||||
[dev-dependencies]
|
[dev-dependencies]
|
||||||
arbiter-crypto = { path = "../arbiter-crypto" }
|
arbiter-crypto = { path = "../arbiter-crypto" }
|
||||||
trybuild = { version = "1.0", features = ["diff"] }
|
|
||||||
|
|
||||||
[lints]
|
[lints]
|
||||||
workspace = true
|
workspace = true
|
||||||
|
|||||||
@@ -53,16 +53,32 @@ struct FieldAccess {
|
|||||||
|
|
||||||
fn collect_field_accesses(struct_data: &DataStruct) -> Vec<FieldAccess> {
|
fn collect_field_accesses(struct_data: &DataStruct) -> Vec<FieldAccess> {
|
||||||
match &struct_data.fields {
|
match &struct_data.fields {
|
||||||
Fields::Named(fields) => crate::utils::sorted_named_fields(fields)
|
Fields::Named(fields) => {
|
||||||
.into_iter()
|
// Keep deterministic alphabetical order for named fields.
|
||||||
|
// Do not remove this sort, because it keeps hash output stable regardless of source order.
|
||||||
|
let mut named_fields = fields
|
||||||
|
.named
|
||||||
|
.iter()
|
||||||
.map(|field| {
|
.map(|field| {
|
||||||
let name = field.ident.as_ref().unwrap();
|
let name = field
|
||||||
FieldAccess {
|
.ident
|
||||||
|
.as_ref()
|
||||||
|
.expect("Fields::Named(fields) must have names")
|
||||||
|
.clone();
|
||||||
|
(name.to_string(), name)
|
||||||
|
})
|
||||||
|
.collect::<Vec<_>>();
|
||||||
|
|
||||||
|
named_fields.sort_by(|a, b| a.0.cmp(&b.0));
|
||||||
|
|
||||||
|
named_fields
|
||||||
|
.into_iter()
|
||||||
|
.map(|(_, name)| FieldAccess {
|
||||||
access: quote! { #name },
|
access: quote! { #name },
|
||||||
span: name.span(),
|
span: name.span(),
|
||||||
}
|
|
||||||
})
|
})
|
||||||
.collect(),
|
.collect()
|
||||||
|
}
|
||||||
Fields::Unnamed(fields) => fields
|
Fields::Unnamed(fields) => fields
|
||||||
.unnamed
|
.unnamed
|
||||||
.iter()
|
.iter()
|
||||||
|
|||||||
@@ -1,134 +0,0 @@
|
|||||||
use crate::utils::INTEGRABLE_TRAIT_PATH;
|
|
||||||
use proc_macro2::TokenStream;
|
|
||||||
use quote::quote;
|
|
||||||
use syn::{DeriveInput, LitStr, spanned::Spanned as _};
|
|
||||||
|
|
||||||
struct IntegrableAttr {
|
|
||||||
kind: String,
|
|
||||||
}
|
|
||||||
|
|
||||||
impl IntegrableAttr {
|
|
||||||
fn from_attrs(
|
|
||||||
attrs: &[syn::Attribute],
|
|
||||||
ident_span: proc_macro2::Span,
|
|
||||||
) -> Result<Self, syn::Error> {
|
|
||||||
let mut kind: Option<String> = None;
|
|
||||||
let mut found = false;
|
|
||||||
|
|
||||||
for attr in attrs {
|
|
||||||
if !attr.path().is_ident("integrable") {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
if found {
|
|
||||||
return Err(syn::Error::new(attr.span(), "duplicate #[integrable] attribute"));
|
|
||||||
}
|
|
||||||
found = true;
|
|
||||||
attr.parse_nested_meta(|meta| {
|
|
||||||
if meta.path.is_ident("kind") {
|
|
||||||
let lit: LitStr = meta.value()?.parse()?;
|
|
||||||
let v = lit.value();
|
|
||||||
if v.is_empty() {
|
|
||||||
return Err(syn::Error::new(lit.span(), "kind must not be empty"));
|
|
||||||
}
|
|
||||||
if !is_valid_kind(&v) {
|
|
||||||
return Err(syn::Error::new(
|
|
||||||
lit.span(),
|
|
||||||
"kind must be a valid schema name: start with a letter, contain only [a-zA-Z0-9_]",
|
|
||||||
));
|
|
||||||
}
|
|
||||||
kind = Some(v);
|
|
||||||
} else {
|
|
||||||
return Err(meta.error("unknown key; expected `kind`"));
|
|
||||||
}
|
|
||||||
Ok(())
|
|
||||||
})?;
|
|
||||||
}
|
|
||||||
|
|
||||||
let kind = kind.ok_or_else(|| {
|
|
||||||
syn::Error::new(ident_span, "#[integrable(kind = \"...\")] is required")
|
|
||||||
})?;
|
|
||||||
|
|
||||||
Ok(Self { kind })
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
fn is_valid_kind(s: &str) -> bool {
|
|
||||||
let mut chars = s.chars();
|
|
||||||
matches!(chars.next(), Some(c) if c.is_ascii_alphabetic())
|
|
||||||
&& chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
|
|
||||||
}
|
|
||||||
|
|
||||||
fn fnv1a(data: &[u8], mut hash: u32) -> u32 {
|
|
||||||
const FNV_PRIME: u32 = 16_777_619;
|
|
||||||
for &b in data {
|
|
||||||
hash ^= u32::from(b);
|
|
||||||
hash = hash.wrapping_mul(FNV_PRIME);
|
|
||||||
}
|
|
||||||
hash
|
|
||||||
}
|
|
||||||
|
|
||||||
// Hashes field names and types using the same alphabetical sort order as Hashable,
|
|
||||||
// so that source-level field reordering never changes VERSION.
|
|
||||||
fn compute_version(fields: &syn::Fields) -> i32 {
|
|
||||||
const FNV_OFFSET: u32 = 2_166_136_261;
|
|
||||||
let mut hash = FNV_OFFSET;
|
|
||||||
|
|
||||||
match fields {
|
|
||||||
syn::Fields::Named(named) => {
|
|
||||||
for field in crate::utils::sorted_named_fields(named) {
|
|
||||||
let name = field.ident.as_ref().unwrap().to_string();
|
|
||||||
let ty = &field.ty;
|
|
||||||
hash = fnv1a(name.as_bytes(), hash);
|
|
||||||
hash = fnv1a(quote!(#ty).to_string().as_bytes(), hash);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
syn::Fields::Unnamed(unnamed) => {
|
|
||||||
for (i, field) in unnamed.unnamed.iter().enumerate() {
|
|
||||||
let ty = &field.ty;
|
|
||||||
hash = fnv1a(i.to_string().as_bytes(), hash);
|
|
||||||
hash = fnv1a(quote!(#ty).to_string().as_bytes(), hash);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
syn::Fields::Unit => {}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Clear sign bit to guarantee a positive i32; substitute 0 → 1.
|
|
||||||
let v = (hash >> 1).cast_signed();
|
|
||||||
if v == 0 { 1 } else { v }
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn derive(input: &DeriveInput) -> TokenStream {
|
|
||||||
let syn::Data::Struct(ref data) = input.data else {
|
|
||||||
return syn::Error::new(
|
|
||||||
input.ident.span(),
|
|
||||||
"#[derive(Integrable)] is only supported on structs",
|
|
||||||
)
|
|
||||||
.to_compile_error();
|
|
||||||
};
|
|
||||||
|
|
||||||
let integrable_trait = INTEGRABLE_TRAIT_PATH.to_path();
|
|
||||||
let hashable_trait = crate::utils::HASHABLE_TRAIT_PATH.to_path();
|
|
||||||
let ident = &input.ident;
|
|
||||||
|
|
||||||
let mut generics = input.generics.clone();
|
|
||||||
for type_param in generics.type_params_mut() {
|
|
||||||
type_param.bounds.push(syn::parse_quote!(#hashable_trait));
|
|
||||||
}
|
|
||||||
let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
|
|
||||||
|
|
||||||
let attr = match IntegrableAttr::from_attrs(&input.attrs, input.ident.span()) {
|
|
||||||
Ok(a) => a,
|
|
||||||
Err(e) => return e.to_compile_error(),
|
|
||||||
};
|
|
||||||
|
|
||||||
let kind = attr.kind;
|
|
||||||
let version = compute_version(&data.fields);
|
|
||||||
|
|
||||||
quote! {
|
|
||||||
#[automatically_derived]
|
|
||||||
impl #impl_generics #integrable_trait for #ident #ty_generics #where_clause {
|
|
||||||
const KIND: &'static str = #kind;
|
|
||||||
const VERSION: i32 = #version;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,7 +1,6 @@
|
|||||||
use syn::{DeriveInput, parse_macro_input};
|
use syn::{DeriveInput, parse_macro_input};
|
||||||
|
|
||||||
mod hashable;
|
mod hashable;
|
||||||
mod integrable;
|
|
||||||
mod utils;
|
mod utils;
|
||||||
|
|
||||||
#[proc_macro_derive(Hashable)]
|
#[proc_macro_derive(Hashable)]
|
||||||
@@ -9,9 +8,3 @@ pub fn derive_hashable(input: proc_macro::TokenStream) -> proc_macro::TokenStrea
|
|||||||
let input = parse_macro_input!(input as DeriveInput);
|
let input = parse_macro_input!(input as DeriveInput);
|
||||||
hashable::derive(&input).into()
|
hashable::derive(&input).into()
|
||||||
}
|
}
|
||||||
|
|
||||||
#[proc_macro_derive(Integrable, attributes(integrable))]
|
|
||||||
pub fn derive_integrable(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
|
|
||||||
let input = parse_macro_input!(input as DeriveInput);
|
|
||||||
integrable::derive(&input).into()
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -22,14 +22,3 @@ macro_rules! ensure_path {
|
|||||||
|
|
||||||
ensure_path!(::arbiter_crypto::hashing::Hashable as HASHABLE_TRAIT_PATH);
|
ensure_path!(::arbiter_crypto::hashing::Hashable as HASHABLE_TRAIT_PATH);
|
||||||
ensure_path!(::arbiter_crypto::hashing::Digest as HMAC_DIGEST_PATH);
|
ensure_path!(::arbiter_crypto::hashing::Digest as HMAC_DIGEST_PATH);
|
||||||
ensure_path!(::arbiter_crypto::integrity::Integrable as INTEGRABLE_TRAIT_PATH);
|
|
||||||
|
|
||||||
/// Returns named struct fields sorted alphabetically by name.
|
|
||||||
/// Both `Hashable` and `Integrable` derive macros must iterate fields in the
|
|
||||||
/// same deterministic order so that source-level reordering never changes
|
|
||||||
/// either the runtime hash or the compile-time VERSION.
|
|
||||||
pub(crate) fn sorted_named_fields(fields: &syn::FieldsNamed) -> Vec<&syn::Field> {
|
|
||||||
let mut v: Vec<&syn::Field> = fields.named.iter().collect();
|
|
||||||
v.sort_by_key(|f| f.ident.as_ref().unwrap().to_string());
|
|
||||||
v
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -1,53 +0,0 @@
|
|||||||
use arbiter_crypto::integrity::Integrable;
|
|
||||||
|
|
||||||
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
|
||||||
#[integrable(kind = "test_entity")]
|
|
||||||
struct TestEntity {
|
|
||||||
value: i32,
|
|
||||||
}
|
|
||||||
|
|
||||||
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
|
||||||
#[integrable(kind = "other_entity")]
|
|
||||||
struct OtherEntity {
|
|
||||||
label: String,
|
|
||||||
count: u64,
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn kind_is_set_correctly() {
|
|
||||||
assert_eq!(<TestEntity as Integrable>::KIND, "test_entity");
|
|
||||||
assert_eq!(<OtherEntity as Integrable>::KIND, "other_entity");
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn version_is_positive() {
|
|
||||||
const {
|
|
||||||
assert!(<TestEntity as Integrable>::VERSION > 0);
|
|
||||||
assert!(<OtherEntity as Integrable>::VERSION > 0);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn different_field_layouts_produce_different_versions() {
|
|
||||||
assert_ne!(
|
|
||||||
<TestEntity as Integrable>::VERSION,
|
|
||||||
<OtherEntity as Integrable>::VERSION,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
|
||||||
#[integrable(kind = "generic_entity")]
|
|
||||||
struct GenericEntity<T> {
|
|
||||||
inner: T,
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn generic_struct_derives_integrable() {
|
|
||||||
assert_eq!(
|
|
||||||
<GenericEntity<TestEntity> as Integrable>::KIND,
|
|
||||||
"generic_entity"
|
|
||||||
);
|
|
||||||
const {
|
|
||||||
assert!(<GenericEntity<TestEntity> as Integrable>::VERSION > 0);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
#[test]
|
|
||||||
fn integrable_compile_fail() {
|
|
||||||
let t = trybuild::TestCases::new();
|
|
||||||
t.compile_fail("tests/ui/integrable/*.rs");
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
|
||||||
#[integrable(kind = "entity_a")]
|
|
||||||
#[integrable(kind = "entity_b")]
|
|
||||||
struct DuplicateAttr {
|
|
||||||
value: i32,
|
|
||||||
}
|
|
||||||
|
|
||||||
fn main() {}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
error: duplicate #[integrable] attribute
|
|
||||||
--> tests/ui/integrable/duplicate_attr.rs:3:1
|
|
||||||
|
|
|
||||||
3 | #[integrable(kind = "entity_b")]
|
|
||||||
| ^
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
|
||||||
#[integrable(kind = "")]
|
|
||||||
struct EmptyKind {
|
|
||||||
value: i32,
|
|
||||||
}
|
|
||||||
|
|
||||||
fn main() {}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
error: kind must not be empty
|
|
||||||
--> tests/ui/integrable/empty_kind.rs:2:21
|
|
||||||
|
|
|
||||||
2 | #[integrable(kind = "")]
|
|
||||||
| ^^
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
#[derive(arbiter_macros::Integrable)]
|
|
||||||
#[integrable(kind = "my_enum")]
|
|
||||||
enum MyEnum {
|
|
||||||
A,
|
|
||||||
B,
|
|
||||||
}
|
|
||||||
|
|
||||||
fn main() {}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
error: #[derive(Integrable)] is only supported on structs
|
|
||||||
--> tests/ui/integrable/enum_not_supported.rs:3:6
|
|
||||||
|
|
|
||||||
3 | enum MyEnum {
|
|
||||||
| ^^^^^^
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
|
||||||
#[integrable(kind = "bad kind!")]
|
|
||||||
struct InvalidKind {
|
|
||||||
value: i32,
|
|
||||||
}
|
|
||||||
|
|
||||||
fn main() {}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
error: kind must be a valid schema name: start with a letter, contain only [a-zA-Z0-9_]
|
|
||||||
--> tests/ui/integrable/invalid_kind.rs:2:21
|
|
||||||
|
|
|
||||||
2 | #[integrable(kind = "bad kind!")]
|
|
||||||
| ^^^^^^^^^^^
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
#[derive(arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
|
||||||
struct MissingAttr {
|
|
||||||
value: i32,
|
|
||||||
}
|
|
||||||
|
|
||||||
fn main() {}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
error: #[integrable(kind = "...")] is required
|
|
||||||
--> tests/ui/integrable/missing_attr.rs:2:8
|
|
||||||
|
|
|
||||||
2 | struct MissingAttr {
|
|
||||||
| ^^^^^^^^^^^
|
|
||||||
@@ -43,13 +43,24 @@ create table if not exists arbiter_settings (
|
|||||||
insert into arbiter_settings (id) values (1) on conflict do nothing;
|
insert into arbiter_settings (id) values (1) on conflict do nothing;
|
||||||
-- ensure singleton row exists
|
-- ensure singleton row exists
|
||||||
|
|
||||||
create table if not exists operator_client (
|
create table if not exists operator_identity (
|
||||||
id integer not null primary key,
|
id integer not null primary key,
|
||||||
public_key blob not null,
|
public_key blob not null,
|
||||||
created_at integer not null default(unixepoch ('now')),
|
created_at integer not null default(unixepoch ('now')),
|
||||||
updated_at integer not null default(unixepoch ('now'))
|
updated_at integer not null default(unixepoch ('now'))
|
||||||
) STRICT;
|
) STRICT;
|
||||||
create unique index if not exists uniq_operator_client_public_key on operator_client (public_key);
|
create unique index if not exists uniq_operator_identity_public_key on operator_identity (public_key);
|
||||||
|
|
||||||
|
create table if not exists operator (
|
||||||
|
id integer primary key references operator_identity(id) on delete restrict, -- same id as operator_identity
|
||||||
|
|
||||||
|
share blob not null,
|
||||||
|
share_nonce blob not null,
|
||||||
|
|
||||||
|
created_at integer not null default(unixepoch ('now')),
|
||||||
|
updated_at integer not null default(unixepoch ('now'))
|
||||||
|
|
||||||
|
) STRICT;
|
||||||
|
|
||||||
create table if not exists client_metadata (
|
create table if not exists client_metadata (
|
||||||
id integer not null primary key,
|
id integer not null primary key,
|
||||||
|
|||||||
@@ -48,7 +48,7 @@ impl Bootstrapper {
|
|||||||
let row_count: i64 = {
|
let row_count: i64 = {
|
||||||
let mut conn = db.get().await?;
|
let mut conn = db.get().await?;
|
||||||
|
|
||||||
schema::operator_client::table
|
schema::operator::table
|
||||||
.count()
|
.count()
|
||||||
.get_result(&mut conn)
|
.get_result(&mut conn)
|
||||||
.await?
|
.await?
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ use crate::{
|
|||||||
crypto::integrity,
|
crypto::integrity,
|
||||||
db::{
|
db::{
|
||||||
DatabaseError, DatabasePool,
|
DatabaseError, DatabasePool,
|
||||||
models::{self},
|
models::{self, EvmWalletId},
|
||||||
schema,
|
schema,
|
||||||
},
|
},
|
||||||
evm::{
|
evm::{
|
||||||
@@ -116,7 +116,7 @@ impl EvmActor {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#[message]
|
#[message]
|
||||||
pub async fn list_wallets(&self) -> Result<Vec<(i32, Address)>, Error> {
|
pub async fn list_wallets(&self) -> Result<Vec<(EvmWalletId, Address)>, Error> {
|
||||||
let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
|
let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
|
||||||
let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
|
let rows: Vec<models::EvmWallet> = schema::evm_wallet::table
|
||||||
.select(models::EvmWallet::as_select())
|
.select(models::EvmWallet::as_select())
|
||||||
@@ -160,14 +160,29 @@ impl EvmActor {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#[message]
|
#[message]
|
||||||
pub async fn useragent_delete_grant(
|
#[expect(clippy::unused_async, reason = "reserved for impl")]
|
||||||
&mut self,
|
pub async fn operator_delete_grant(&mut self, _grant_id: i32) -> Result<(), Error> {
|
||||||
grant_id: i32,
|
// let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
|
||||||
) -> Result<(), Error> {
|
// let vault = self.vault.clone();
|
||||||
self.engine
|
|
||||||
.revoke_grant(grant_id)
|
// diesel_async::AsyncConnection::transaction(&mut conn, |conn| {
|
||||||
.await
|
// Box::pin(async move {
|
||||||
.map_err(Error::from)
|
// diesel::update(schema::evm_basic_grant::table)
|
||||||
|
// .filter(schema::evm_basic_grant::id.eq(grant_id))
|
||||||
|
// .set(schema::evm_basic_grant::revoked_at.eq(SqliteTimestamp::now()))
|
||||||
|
// .execute(conn)
|
||||||
|
// .await?;
|
||||||
|
|
||||||
|
// let signed = integrity::evm::load_signed_grant_by_basic_id(conn, grant_id).await?;
|
||||||
|
|
||||||
|
// diesel::result::QueryResult::Ok(())
|
||||||
|
// })
|
||||||
|
// })
|
||||||
|
// .await
|
||||||
|
// .map_err(DatabaseError::from)?;
|
||||||
|
|
||||||
|
// Ok(())
|
||||||
|
todo!()
|
||||||
}
|
}
|
||||||
|
|
||||||
#[message]
|
#[message]
|
||||||
|
|||||||
@@ -11,9 +11,7 @@ use kameo::{
|
|||||||
prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
|
prelude::{ActorId, ActorRef, ActorStopReason, Context, WeakActorRef},
|
||||||
reply::ReplySender,
|
reply::ReplySender,
|
||||||
};
|
};
|
||||||
use std::{ops::ControlFlow, time::Duration};
|
use std::ops::ControlFlow;
|
||||||
|
|
||||||
const APPROVAL_TIMEOUT: Duration = Duration::from_secs(30);
|
|
||||||
|
|
||||||
pub struct Args {
|
pub struct Args {
|
||||||
pub client: ClientProfile,
|
pub client: ClientProfile,
|
||||||
@@ -66,14 +64,6 @@ impl Actor for ClientApprovalController {
|
|||||||
.await;
|
.await;
|
||||||
}
|
}
|
||||||
|
|
||||||
let weak = actor_ref.downgrade();
|
|
||||||
tokio::spawn(async move {
|
|
||||||
tokio::time::sleep(APPROVAL_TIMEOUT).await;
|
|
||||||
if let Some(r) = weak.upgrade() {
|
|
||||||
let _ = r.tell(OnApprovalTimeout {}).await;
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
Ok(this)
|
Ok(this)
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -114,14 +104,4 @@ impl ClientApprovalController {
|
|||||||
ctx.stop();
|
ctx.stop();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
/// Fired after `APPROVAL_TIMEOUT` elapses. Any operator that hasn't responded
|
|
||||||
/// by then is treated as a denial to prevent zombie sessions from blocking the flow.
|
|
||||||
#[message(ctx)]
|
|
||||||
pub fn on_approval_timeout(&mut self, ctx: &mut Context<Self, ()>) {
|
|
||||||
if self.pending > 0 {
|
|
||||||
self.send_reply(Ok(false));
|
|
||||||
ctx.stop();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -6,7 +6,7 @@ use crate::{
|
|||||||
},
|
},
|
||||||
db::{
|
db::{
|
||||||
self,
|
self,
|
||||||
models::{self, RootKeyHistory},
|
models::{self, RootKeyHistory, RootKeyHistoryId},
|
||||||
schema::{self},
|
schema::{self},
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
@@ -25,7 +25,6 @@ use strum::{EnumDiscriminants, IntoDiscriminant};
|
|||||||
use tracing::{error, info};
|
use tracing::{error, info};
|
||||||
|
|
||||||
pub mod events {
|
pub mod events {
|
||||||
|
|
||||||
#[derive(Clone, Copy)]
|
#[derive(Clone, Copy)]
|
||||||
pub struct Bootstrapped;
|
pub struct Bootstrapped;
|
||||||
|
|
||||||
@@ -64,7 +63,7 @@ pub enum Error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
struct Unsealed {
|
struct Unsealed {
|
||||||
root_key_history_id: i32,
|
root_key_history_id: RootKeyHistoryId,
|
||||||
root_key: KeyCell,
|
root_key: KeyCell,
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -73,8 +72,9 @@ struct Unsealed {
|
|||||||
enum State {
|
enum State {
|
||||||
#[default]
|
#[default]
|
||||||
Unbootstrapped,
|
Unbootstrapped,
|
||||||
|
|
||||||
Sealed {
|
Sealed {
|
||||||
root_key_history_id: i32,
|
root_key_history_id: RootKeyHistoryId,
|
||||||
},
|
},
|
||||||
Unsealed(Unsealed),
|
Unsealed(Unsealed),
|
||||||
}
|
}
|
||||||
@@ -115,7 +115,10 @@ impl Vault {
|
|||||||
|
|
||||||
// Exclusive transaction to avoid race condtions if multiple vaults write
|
// Exclusive transaction to avoid race condtions if multiple vaults write
|
||||||
// additional layer of protection against nonce-reuse
|
// additional layer of protection against nonce-reuse
|
||||||
async fn get_new_nonce(pool: &db::DatabasePool, root_key_id: i32) -> Result<Nonce, Error> {
|
async fn get_new_nonce(
|
||||||
|
pool: &db::DatabasePool,
|
||||||
|
root_key_id: RootKeyHistoryId,
|
||||||
|
) -> Result<Nonce, Error> {
|
||||||
let mut conn = pool.get().await?;
|
let mut conn = pool.get().await?;
|
||||||
|
|
||||||
let nonce = conn
|
let nonce = conn
|
||||||
@@ -128,7 +131,7 @@ impl Vault {
|
|||||||
|
|
||||||
let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
|
let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
|
||||||
error!(
|
error!(
|
||||||
"Broken database: invalid nonce for root key history id={}",
|
"Broken database: invalid nonce for root key history id={:#?}",
|
||||||
root_key_id
|
root_key_id
|
||||||
);
|
);
|
||||||
Error::BrokenDatabase
|
Error::BrokenDatabase
|
||||||
@@ -184,7 +187,7 @@ impl Vault {
|
|||||||
let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
|
let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
|
||||||
let root_key_history_id = conn
|
let root_key_history_id = conn
|
||||||
.transaction(async |conn| {
|
.transaction(async |conn| {
|
||||||
let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
|
let root_key_history_id = insert_into(schema::root_key_history::table)
|
||||||
.values(&models::NewRootKeyHistory {
|
.values(&models::NewRootKeyHistory {
|
||||||
ciphertext: root_key_ciphertext.clone(),
|
ciphertext: root_key_ciphertext.clone(),
|
||||||
tag: v1::ROOT_KEY_TAG.to_vec(),
|
tag: v1::ROOT_KEY_TAG.to_vec(),
|
||||||
@@ -202,7 +205,9 @@ impl Vault {
|
|||||||
.execute(&mut *conn)
|
.execute(&mut *conn)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
Result::<_, diesel::result::Error>::Ok(root_key_history_id)
|
Result::<_, diesel::result::Error>::Ok(RootKeyHistoryId::from_raw(
|
||||||
|
root_key_history_id,
|
||||||
|
))
|
||||||
})
|
})
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
@@ -340,17 +345,22 @@ impl Vault {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#[message]
|
#[message]
|
||||||
pub fn sign_integrity(&mut self, mac_input: Vec<u8>) -> Result<(i32, Vec<u8>), Error> {
|
pub fn sign_integrity(
|
||||||
|
&mut self,
|
||||||
|
mac_input: Vec<u8>,
|
||||||
|
) -> Result<(RootKeyHistoryId, Vec<u8>), Error> {
|
||||||
let Unsealed {
|
let Unsealed {
|
||||||
root_key,
|
root_key,
|
||||||
root_key_history_id,
|
root_key_history_id,
|
||||||
} = Self::expect_unsealed(&mut self.state)?;
|
} = Self::expect_unsealed(&mut self.state)?;
|
||||||
|
|
||||||
let mut hmac = root_key.0.read_inline(|k| {
|
let mut hmac = root_key
|
||||||
HmacSha256::new_from_slice(k)
|
.0
|
||||||
.unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
|
.read_inline(|k| match HmacSha256::new_from_slice(k) {
|
||||||
|
Ok(v) => v,
|
||||||
|
Err(_) => unreachable!("HMAC accepts keys of any size"),
|
||||||
});
|
});
|
||||||
hmac.update(&root_key_history_id.to_be_bytes());
|
hmac.update(&root_key_history_id.to_raw().to_be_bytes());
|
||||||
hmac.update(&mac_input);
|
hmac.update(&mac_input);
|
||||||
|
|
||||||
let mac = hmac.finalize().into_bytes().to_vec();
|
let mac = hmac.finalize().into_bytes().to_vec();
|
||||||
@@ -362,7 +372,7 @@ impl Vault {
|
|||||||
&mut self,
|
&mut self,
|
||||||
mac_input: Vec<u8>,
|
mac_input: Vec<u8>,
|
||||||
expected_mac: Vec<u8>,
|
expected_mac: Vec<u8>,
|
||||||
key_version: i32,
|
key_version: RootKeyHistoryId,
|
||||||
) -> Result<bool, Error> {
|
) -> Result<bool, Error> {
|
||||||
let Unsealed {
|
let Unsealed {
|
||||||
root_key,
|
root_key,
|
||||||
@@ -373,11 +383,13 @@ impl Vault {
|
|||||||
return Ok(false);
|
return Ok(false);
|
||||||
}
|
}
|
||||||
|
|
||||||
let mut hmac = root_key.0.read_inline(|k| {
|
let mut hmac = root_key
|
||||||
HmacSha256::new_from_slice(k)
|
.0
|
||||||
.unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
|
.read_inline(|k| match HmacSha256::new_from_slice(k) {
|
||||||
|
Ok(v) => v,
|
||||||
|
Err(_) => unreachable!("HMAC accepts keys of any size"),
|
||||||
});
|
});
|
||||||
hmac.update(&key_version.to_be_bytes());
|
hmac.update(&key_version.to_raw().to_be_bytes());
|
||||||
hmac.update(&mac_input);
|
hmac.update(&mac_input);
|
||||||
|
|
||||||
Ok(hmac.verify_slice(&expected_mac).is_ok())
|
Ok(hmac.verify_slice(&expected_mac).is_ok())
|
||||||
@@ -401,6 +413,7 @@ impl Vault {
|
|||||||
#[cfg(test)]
|
#[cfg(test)]
|
||||||
mod tests {
|
mod tests {
|
||||||
use crate::actors::GlobalActors;
|
use crate::actors::GlobalActors;
|
||||||
|
use crate::db::models::RootKeyHistory;
|
||||||
use arbiter_crypto::safecell::SafeCellHandle as _;
|
use arbiter_crypto::safecell::SafeCellHandle as _;
|
||||||
|
|
||||||
use super::*;
|
use super::*;
|
||||||
@@ -419,13 +432,12 @@ mod tests {
|
|||||||
async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
|
async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = bootstrapped_actor(&db).await;
|
let mut actor = bootstrapped_actor(&db).await;
|
||||||
|
let root_key_history_id = match actor.state {
|
||||||
let State::Unsealed(Unsealed {
|
State::Unsealed(Unsealed {
|
||||||
root_key_history_id,
|
root_key_history_id,
|
||||||
..
|
..
|
||||||
}) = actor.state
|
}) => root_key_history_id,
|
||||||
else {
|
_ => panic!("expected unsealed state"),
|
||||||
panic!("expected unsealed state")
|
|
||||||
};
|
};
|
||||||
|
|
||||||
let n1 = Vault::get_new_nonce(&db, root_key_history_id)
|
let n1 = Vault::get_new_nonce(&db, root_key_history_id)
|
||||||
|
|||||||
@@ -52,7 +52,10 @@ pub const INTEGRITY_SUBKEY_TAG: &[u8] = b"arbiter/db-integrity-key/v1";
|
|||||||
|
|
||||||
pub type HmacSha256 = Hmac<Sha256>;
|
pub type HmacSha256 = Hmac<Sha256>;
|
||||||
|
|
||||||
pub use arbiter_crypto::integrity::Integrable;
|
pub trait Integrable: Hashable {
|
||||||
|
const KIND: &'static str;
|
||||||
|
const VERSION: i32 = 1;
|
||||||
|
}
|
||||||
|
|
||||||
fn payload_hash(payload: &impl Hashable) -> [u8; 32] {
|
fn payload_hash(payload: &impl Hashable) -> [u8; 32] {
|
||||||
let mut hasher = Sha256::new();
|
let mut hasher = Sha256::new();
|
||||||
@@ -214,13 +217,15 @@ mod tests {
|
|||||||
};
|
};
|
||||||
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
||||||
|
|
||||||
use super::{Error, sign_entity, verify_entity};
|
use super::{Error, Integrable, sign_entity, verify_entity};
|
||||||
#[derive(Clone, arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
#[derive(Clone, arbiter_macros::Hashable)]
|
||||||
#[integrable(kind = "dummy_entity")]
|
|
||||||
struct DummyEntity {
|
struct DummyEntity {
|
||||||
payload_version: i32,
|
payload_version: i32,
|
||||||
payload: Vec<u8>,
|
payload: Vec<u8>,
|
||||||
}
|
}
|
||||||
|
impl Integrable for DummyEntity {
|
||||||
|
const KIND: &'static str = "dummy_entity";
|
||||||
|
}
|
||||||
|
|
||||||
async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
|
async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
|
||||||
let actor = Vault::spawn(
|
let actor = Vault::spawn(
|
||||||
|
|||||||
@@ -79,10 +79,41 @@ pub mod types {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Debug, FromSqlRow, AsExpression, Clone)]
|
macro_rules! declare_id {
|
||||||
|
($name:ident) => {
|
||||||
|
#[derive(Debug, FromSqlRow, AsExpression, Clone, Hash, Copy, PartialEq, Eq)]
|
||||||
#[diesel(sql_type = Integer)]
|
#[diesel(sql_type = Integer)]
|
||||||
#[repr(transparent)] // hint compiler to optimize the wrapper struct away
|
#[repr(transparent)] // hint compiler to optimize the wrapper struct away
|
||||||
pub struct ChainId(pub i32);
|
pub struct $name(i32);
|
||||||
|
|
||||||
|
impl $name {
|
||||||
|
pub const fn to_raw(self) -> i32 {
|
||||||
|
self.0
|
||||||
|
}
|
||||||
|
pub const fn from_raw(raw: i32) -> Self {
|
||||||
|
Self(raw)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl FromSql<Integer, Sqlite> for $name {
|
||||||
|
fn from_sql(
|
||||||
|
bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
|
||||||
|
) -> diesel::deserialize::Result<Self> {
|
||||||
|
FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
impl ToSql<Integer, Sqlite> for $name {
|
||||||
|
fn to_sql<'b>(
|
||||||
|
&'b self,
|
||||||
|
out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
|
||||||
|
) -> diesel::serialize::Result {
|
||||||
|
ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
declare_id!(ChainId);
|
||||||
|
|
||||||
#[expect(
|
#[expect(
|
||||||
clippy::cast_sign_loss,
|
clippy::cast_sign_loss,
|
||||||
@@ -103,21 +134,13 @@ pub mod types {
|
|||||||
}
|
}
|
||||||
};
|
};
|
||||||
|
|
||||||
impl FromSql<Integer, Sqlite> for ChainId {
|
declare_id!(OperatorId);
|
||||||
fn from_sql(
|
declare_id!(OperatorIdentityId);
|
||||||
bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
|
declare_id!(AeadEncryptedId);
|
||||||
) -> diesel::deserialize::Result<Self> {
|
declare_id!(RootKeyHistoryId);
|
||||||
FromSql::<Integer, Sqlite>::from_sql(bytes).map(Self)
|
declare_id!(TlsHistoryId);
|
||||||
}
|
declare_id!(EvmWalletId);
|
||||||
}
|
declare_id!(ClientId);
|
||||||
impl ToSql<Integer, Sqlite> for ChainId {
|
|
||||||
fn to_sql<'b>(
|
|
||||||
&'b self,
|
|
||||||
out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
|
|
||||||
) -> diesel::serialize::Result {
|
|
||||||
ToSql::<Integer, Sqlite>::to_sql(&self.0, out)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
pub use types::*;
|
pub use types::*;
|
||||||
|
|
||||||
@@ -130,12 +153,12 @@ pub use types::*;
|
|||||||
)]
|
)]
|
||||||
#[diesel(table_name = aead_encrypted, check_for_backend(Sqlite))]
|
#[diesel(table_name = aead_encrypted, check_for_backend(Sqlite))]
|
||||||
pub struct AeadEncrypted {
|
pub struct AeadEncrypted {
|
||||||
pub id: i32,
|
pub id: AeadEncryptedId,
|
||||||
pub ciphertext: Vec<u8>,
|
pub ciphertext: Vec<u8>,
|
||||||
pub tag: Vec<u8>,
|
pub tag: Vec<u8>,
|
||||||
pub current_nonce: Vec<u8>,
|
pub current_nonce: Vec<u8>,
|
||||||
pub schema_version: i32,
|
pub schema_version: i32,
|
||||||
pub associated_root_key_id: i32, // references root_key_history.id
|
pub associated_root_key_id: RootKeyHistoryId,
|
||||||
pub created_at: SqliteTimestamp,
|
pub created_at: SqliteTimestamp,
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -148,7 +171,7 @@ pub struct AeadEncrypted {
|
|||||||
attributes_with = "deriveless"
|
attributes_with = "deriveless"
|
||||||
)]
|
)]
|
||||||
pub struct RootKeyHistory {
|
pub struct RootKeyHistory {
|
||||||
pub id: i32,
|
pub id: RootKeyHistoryId,
|
||||||
pub ciphertext: Vec<u8>,
|
pub ciphertext: Vec<u8>,
|
||||||
pub tag: Vec<u8>,
|
pub tag: Vec<u8>,
|
||||||
pub root_key_encryption_nonce: Vec<u8>,
|
pub root_key_encryption_nonce: Vec<u8>,
|
||||||
@@ -166,7 +189,7 @@ pub struct RootKeyHistory {
|
|||||||
attributes_with = "deriveless"
|
attributes_with = "deriveless"
|
||||||
)]
|
)]
|
||||||
pub struct TlsHistory {
|
pub struct TlsHistory {
|
||||||
pub id: i32,
|
pub id: TlsHistoryId,
|
||||||
pub cert: String,
|
pub cert: String,
|
||||||
pub cert_key: String, // PEM Encoded private key
|
pub cert_key: String, // PEM Encoded private key
|
||||||
pub ca_cert: String, // PEM Encoded certificate for cert signing
|
pub ca_cert: String, // PEM Encoded certificate for cert signing
|
||||||
@@ -191,7 +214,7 @@ pub struct ArbiterSettings {
|
|||||||
attributes_with = "deriveless"
|
attributes_with = "deriveless"
|
||||||
)]
|
)]
|
||||||
pub struct EvmWallet {
|
pub struct EvmWallet {
|
||||||
pub id: i32,
|
pub id: EvmWalletId,
|
||||||
pub address: Vec<u8>,
|
pub address: Vec<u8>,
|
||||||
pub aead_encrypted_id: i32,
|
pub aead_encrypted_id: i32,
|
||||||
pub created_at: SqliteTimestamp,
|
pub created_at: SqliteTimestamp,
|
||||||
@@ -213,7 +236,7 @@ pub struct EvmWallet {
|
|||||||
)]
|
)]
|
||||||
pub struct EvmWalletAccess {
|
pub struct EvmWalletAccess {
|
||||||
pub id: i32,
|
pub id: i32,
|
||||||
pub wallet_id: i32,
|
pub wallet_id: EvmWalletId,
|
||||||
pub client_id: i32,
|
pub client_id: i32,
|
||||||
pub created_at: SqliteTimestamp,
|
pub created_at: SqliteTimestamp,
|
||||||
}
|
}
|
||||||
@@ -240,7 +263,7 @@ pub struct ProgramClientMetadataHistory {
|
|||||||
#[derive(Models, Queryable, Debug, Insertable, Selectable)]
|
#[derive(Models, Queryable, Debug, Insertable, Selectable)]
|
||||||
#[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
|
#[diesel(table_name = schema::program_client, check_for_backend(Sqlite))]
|
||||||
pub struct ProgramClient {
|
pub struct ProgramClient {
|
||||||
pub id: i32,
|
pub id: ClientId,
|
||||||
pub public_key: Vec<u8>,
|
pub public_key: Vec<u8>,
|
||||||
pub metadata_id: i32,
|
pub metadata_id: i32,
|
||||||
pub created_at: SqliteTimestamp,
|
pub created_at: SqliteTimestamp,
|
||||||
@@ -250,12 +273,22 @@ pub struct ProgramClient {
|
|||||||
#[derive(Queryable, Debug)]
|
#[derive(Queryable, Debug)]
|
||||||
#[diesel(table_name = schema::operator_client, check_for_backend(Sqlite))]
|
#[diesel(table_name = schema::operator_client, check_for_backend(Sqlite))]
|
||||||
pub struct OperatorClient {
|
pub struct OperatorClient {
|
||||||
pub id: i32,
|
pub id: OperatorIdentityId,
|
||||||
pub public_key: Vec<u8>,
|
pub public_key: Vec<u8>,
|
||||||
pub created_at: SqliteTimestamp,
|
pub created_at: SqliteTimestamp,
|
||||||
pub updated_at: SqliteTimestamp,
|
pub updated_at: SqliteTimestamp,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[derive(Queryable, Debug)]
|
||||||
|
#[diesel(table_name = schema::operator, check_for_backend(Sqlite))]
|
||||||
|
pub struct Operator {
|
||||||
|
pub id: OperatorId,
|
||||||
|
pub share: Vec<u8>,
|
||||||
|
pub share_nonce: Vec<u8>,
|
||||||
|
pub created_at: SqliteTimestamp,
|
||||||
|
pub updated_at: SqliteTimestamp,
|
||||||
|
}
|
||||||
|
|
||||||
#[derive(Models, Queryable, Debug, Insertable, Selectable)]
|
#[derive(Models, Queryable, Debug, Insertable, Selectable)]
|
||||||
#[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
|
#[diesel(table_name = evm_ether_transfer_limit, check_for_backend(Sqlite))]
|
||||||
#[view(
|
#[view(
|
||||||
@@ -399,7 +432,7 @@ pub struct IntegrityEnvelope {
|
|||||||
pub entity_kind: String,
|
pub entity_kind: String,
|
||||||
pub entity_id: Vec<u8>,
|
pub entity_id: Vec<u8>,
|
||||||
pub payload_version: i32,
|
pub payload_version: i32,
|
||||||
pub key_version: i32,
|
pub key_version: RootKeyHistoryId,
|
||||||
pub mac: Vec<u8>,
|
pub mac: Vec<u8>,
|
||||||
pub signed_at: SqliteTimestamp,
|
pub signed_at: SqliteTimestamp,
|
||||||
pub created_at: SqliteTimestamp,
|
pub created_at: SqliteTimestamp,
|
||||||
|
|||||||
@@ -152,6 +152,25 @@ diesel::table! {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
diesel::table! {
|
||||||
|
operator (id) {
|
||||||
|
id -> Nullable<Integer>,
|
||||||
|
share -> Binary,
|
||||||
|
share_nonce -> Binary,
|
||||||
|
created_at -> Integer,
|
||||||
|
updated_at -> Integer,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
diesel::table! {
|
||||||
|
operator_identity (id) {
|
||||||
|
id -> Integer,
|
||||||
|
public_key -> Binary,
|
||||||
|
created_at -> Integer,
|
||||||
|
updated_at -> Integer,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
diesel::table! {
|
diesel::table! {
|
||||||
program_client (id) {
|
program_client (id) {
|
||||||
id -> Integer,
|
id -> Integer,
|
||||||
@@ -185,15 +204,6 @@ diesel::table! {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
diesel::table! {
|
|
||||||
operator_client (id) {
|
|
||||||
id -> Integer,
|
|
||||||
public_key -> Binary,
|
|
||||||
created_at -> Integer,
|
|
||||||
updated_at -> Integer,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
|
diesel::joinable!(aead_encrypted -> root_key_history (associated_root_key_id));
|
||||||
diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
|
diesel::joinable!(arbiter_settings -> root_key_history (root_key_id));
|
||||||
diesel::joinable!(arbiter_settings -> tls_history (tls_id));
|
diesel::joinable!(arbiter_settings -> tls_history (tls_id));
|
||||||
@@ -212,6 +222,7 @@ diesel::joinable!(evm_transaction_log -> evm_wallet_access (wallet_access_id));
|
|||||||
diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
|
diesel::joinable!(evm_wallet -> aead_encrypted (aead_encrypted_id));
|
||||||
diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
|
diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
|
||||||
diesel::joinable!(evm_wallet_access -> program_client (client_id));
|
diesel::joinable!(evm_wallet_access -> program_client (client_id));
|
||||||
|
diesel::joinable!(operator -> operator_identity (id));
|
||||||
diesel::joinable!(program_client -> client_metadata (metadata_id));
|
diesel::joinable!(program_client -> client_metadata (metadata_id));
|
||||||
|
|
||||||
diesel::allow_tables_to_appear_in_same_query!(
|
diesel::allow_tables_to_appear_in_same_query!(
|
||||||
@@ -230,8 +241,9 @@ diesel::allow_tables_to_appear_in_same_query!(
|
|||||||
evm_wallet,
|
evm_wallet,
|
||||||
evm_wallet_access,
|
evm_wallet_access,
|
||||||
integrity_envelope,
|
integrity_envelope,
|
||||||
|
operator,
|
||||||
|
operator_identity,
|
||||||
program_client,
|
program_client,
|
||||||
root_key_history,
|
root_key_history,
|
||||||
tls_history,
|
tls_history,
|
||||||
operator_client,
|
|
||||||
);
|
);
|
||||||
|
|||||||
@@ -1,34 +1,28 @@
|
|||||||
use diesel_async::{AsyncConnection, RunQueryDsl};
|
|
||||||
use kameo::actor::ActorRef;
|
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
actors::vault::Vault,
|
actors::vault::Vault,
|
||||||
crypto::integrity,
|
crypto::integrity,
|
||||||
db::{
|
db::{
|
||||||
self, DatabaseError,
|
self, DatabaseError,
|
||||||
models::{
|
models::{
|
||||||
EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget,
|
EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
|
||||||
EvmEtherTransferLimit, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
|
|
||||||
EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
|
|
||||||
},
|
},
|
||||||
schema::{self, evm_transaction_log},
|
schema::{self, evm_transaction_log},
|
||||||
},
|
},
|
||||||
evm::policies::{
|
evm::policies::{
|
||||||
CombinedSettings, DatabaseID, EvalContext, EvalViolation, Grant, Policy,
|
CombinedSettings, DatabaseID, EvalContext, EvalViolation, Grant, Policy,
|
||||||
SharedGrantSettings, SpecificGrant, SpecificMeaning, VolumeRateLimit,
|
SharedGrantSettings, SpecificGrant, SpecificMeaning, ether_transfer::EtherTransfer,
|
||||||
ether_transfer::EtherTransfer, token_transfers::TokenTransfer,
|
token_transfers::TokenTransfer,
|
||||||
},
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
use alloy::{
|
use alloy::{
|
||||||
consensus::TxEip1559,
|
consensus::TxEip1559,
|
||||||
primitives::{Address, TxKind, U256},
|
primitives::{TxKind, U256},
|
||||||
};
|
};
|
||||||
use chrono::Utc;
|
use chrono::Utc;
|
||||||
use diesel::{
|
use diesel::{ExpressionMethods as _, QueryDsl as _, QueryResult, insert_into, sqlite::Sqlite};
|
||||||
ExpressionMethods as _, OptionalExtension, QueryDsl as _, QueryResult, SelectableHelper,
|
use diesel_async::{AsyncConnection, RunQueryDsl};
|
||||||
insert_into, sqlite::Sqlite, update,
|
use kameo::actor::ActorRef;
|
||||||
};
|
|
||||||
|
|
||||||
pub mod abi;
|
pub mod abi;
|
||||||
pub mod safe_signer;
|
pub mod safe_signer;
|
||||||
@@ -278,151 +272,6 @@ impl Engine {
|
|||||||
Ok(id)
|
Ok(id)
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn revoke_grant(
|
|
||||||
&self,
|
|
||||||
basic_grant_id: i32,
|
|
||||||
) -> Result<(), DatabaseError> {
|
|
||||||
let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
|
|
||||||
let vault = self.vault.clone();
|
|
||||||
|
|
||||||
conn.transaction(async move |conn| {
|
|
||||||
use crate::db::schema::{
|
|
||||||
evm_basic_grant, evm_ether_transfer_grant, evm_ether_transfer_grant_target,
|
|
||||||
evm_ether_transfer_limit, evm_token_transfer_grant,
|
|
||||||
evm_token_transfer_volume_limit,
|
|
||||||
};
|
|
||||||
|
|
||||||
update(evm_basic_grant::table)
|
|
||||||
.filter(evm_basic_grant::id.eq(basic_grant_id))
|
|
||||||
.set(evm_basic_grant::revoked_at.eq(SqliteTimestamp(Utc::now())))
|
|
||||||
.execute(&mut *conn)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let basic_grant: EvmBasicGrant = evm_basic_grant::table
|
|
||||||
.filter(evm_basic_grant::id.eq(basic_grant_id))
|
|
||||||
.select(EvmBasicGrant::as_select())
|
|
||||||
.first(&mut *conn)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let shared = SharedGrantSettings::try_from_model(basic_grant)?;
|
|
||||||
|
|
||||||
if let Some(ether_grant) = evm_ether_transfer_grant::table
|
|
||||||
.filter(evm_ether_transfer_grant::basic_grant_id.eq(basic_grant_id))
|
|
||||||
.select(EvmEtherTransferGrant::as_select())
|
|
||||||
.first(&mut *conn)
|
|
||||||
.await
|
|
||||||
.optional()?
|
|
||||||
{
|
|
||||||
let target_rows: Vec<EvmEtherTransferGrantTarget> =
|
|
||||||
evm_ether_transfer_grant_target::table
|
|
||||||
.filter(evm_ether_transfer_grant_target::grant_id.eq(ether_grant.id))
|
|
||||||
.select(EvmEtherTransferGrantTarget::as_select())
|
|
||||||
.load(&mut *conn)
|
|
||||||
.await?;
|
|
||||||
let targets: Vec<Address> = target_rows
|
|
||||||
.into_iter()
|
|
||||||
.filter_map(|target| {
|
|
||||||
let arr: [u8; 20] = target.address.try_into().ok()?;
|
|
||||||
Some(Address::from(arr))
|
|
||||||
})
|
|
||||||
.collect();
|
|
||||||
|
|
||||||
let limit: EvmEtherTransferLimit = evm_ether_transfer_limit::table
|
|
||||||
.filter(evm_ether_transfer_limit::id.eq(ether_grant.limit_id))
|
|
||||||
.select(EvmEtherTransferLimit::as_select())
|
|
||||||
.first(&mut *conn)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let settings = CombinedSettings {
|
|
||||||
shared: shared.clone(),
|
|
||||||
specific: policies::ether_transfer::Settings {
|
|
||||||
target: targets,
|
|
||||||
limit: VolumeRateLimit {
|
|
||||||
max_volume: utils::try_bytes_to_u256(&limit.max_volume).map_err(
|
|
||||||
|err| {
|
|
||||||
diesel::result::Error::DeserializationError(Box::new(err))
|
|
||||||
},
|
|
||||||
)?,
|
|
||||||
window: chrono::Duration::seconds(limit.window_secs.into()),
|
|
||||||
},
|
|
||||||
},
|
|
||||||
};
|
|
||||||
|
|
||||||
integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
|
|
||||||
.await
|
|
||||||
.map_err(|_| diesel::result::Error::RollbackTransaction)?;
|
|
||||||
|
|
||||||
return QueryResult::Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
if let Some(token_grant) = evm_token_transfer_grant::table
|
|
||||||
.filter(evm_token_transfer_grant::basic_grant_id.eq(basic_grant_id))
|
|
||||||
.select(EvmTokenTransferGrant::as_select())
|
|
||||||
.first(&mut *conn)
|
|
||||||
.await
|
|
||||||
.optional()?
|
|
||||||
{
|
|
||||||
let volume_limit_rows: Vec<EvmTokenTransferVolumeLimit> =
|
|
||||||
evm_token_transfer_volume_limit::table
|
|
||||||
.filter(evm_token_transfer_volume_limit::grant_id.eq(token_grant.id))
|
|
||||||
.select(EvmTokenTransferVolumeLimit::as_select())
|
|
||||||
.load(&mut *conn)
|
|
||||||
.await?;
|
|
||||||
let volume_limits: Vec<VolumeRateLimit> = volume_limit_rows
|
|
||||||
.into_iter()
|
|
||||||
.map(|row| {
|
|
||||||
Ok(VolumeRateLimit {
|
|
||||||
max_volume: utils::try_bytes_to_u256(&row.max_volume).map_err(
|
|
||||||
|err| {
|
|
||||||
diesel::result::Error::DeserializationError(Box::new(err))
|
|
||||||
},
|
|
||||||
)?,
|
|
||||||
window: chrono::Duration::seconds(row.window_secs.into()),
|
|
||||||
})
|
|
||||||
})
|
|
||||||
.collect::<QueryResult<Vec<_>>>()?;
|
|
||||||
|
|
||||||
let target: Option<Address> = match token_grant.receiver {
|
|
||||||
None => None,
|
|
||||||
Some(bytes) => {
|
|
||||||
let arr: [u8; 20] = bytes.try_into().map_err(|_| {
|
|
||||||
diesel::result::Error::DeserializationError(
|
|
||||||
"Invalid receiver address length".into(),
|
|
||||||
)
|
|
||||||
})?;
|
|
||||||
Some(Address::from(arr))
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
let token_contract: [u8; 20] =
|
|
||||||
token_grant.token_contract.clone().try_into().map_err(|_| {
|
|
||||||
diesel::result::Error::DeserializationError(
|
|
||||||
"Invalid token contract address length".into(),
|
|
||||||
)
|
|
||||||
})?;
|
|
||||||
|
|
||||||
let settings = CombinedSettings {
|
|
||||||
shared,
|
|
||||||
specific: policies::token_transfers::Settings {
|
|
||||||
token_contract: Address::from(token_contract),
|
|
||||||
target,
|
|
||||||
volume_limits,
|
|
||||||
},
|
|
||||||
};
|
|
||||||
|
|
||||||
integrity::sign_entity(&mut *conn, &vault, &settings, basic_grant_id)
|
|
||||||
.await
|
|
||||||
.map_err(|_| diesel::result::Error::RollbackTransaction)?;
|
|
||||||
|
|
||||||
return QueryResult::Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
Err(diesel::result::Error::NotFound)
|
|
||||||
})
|
|
||||||
.await
|
|
||||||
.map_err(DatabaseError::from)
|
|
||||||
}
|
|
||||||
|
|
||||||
async fn list_one_kind<Kind: Policy, Y>(
|
async fn list_one_kind<Kind: Policy, Y>(
|
||||||
&self,
|
&self,
|
||||||
conn: &mut impl AsyncConnection<Backend = Sqlite>,
|
conn: &mut impl AsyncConnection<Backend = Sqlite>,
|
||||||
@@ -502,26 +351,21 @@ impl Engine {
|
|||||||
#[cfg(test)]
|
#[cfg(test)]
|
||||||
mod tests {
|
mod tests {
|
||||||
use alloy::primitives::{Address, Bytes, U256, address};
|
use alloy::primitives::{Address, Bytes, U256, address};
|
||||||
use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
|
|
||||||
use chrono::{Duration, Utc};
|
use chrono::{Duration, Utc};
|
||||||
use diesel::{SelectableHelper, insert_into};
|
use diesel::{SelectableHelper, insert_into};
|
||||||
use diesel_async::RunQueryDsl;
|
use diesel_async::RunQueryDsl;
|
||||||
use kameo::{actor::ActorRef, prelude::Spawn};
|
|
||||||
use rstest::rstest;
|
use rstest::rstest;
|
||||||
|
|
||||||
use crate::actors::{GlobalActors, vault::{Bootstrap, Vault}};
|
|
||||||
use crate::crypto::integrity;
|
|
||||||
use crate::db::{
|
use crate::db::{
|
||||||
self, DatabaseConnection,
|
self, DatabaseConnection,
|
||||||
models::{
|
models::{
|
||||||
EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
|
EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
|
||||||
|
SqliteTimestamp,
|
||||||
},
|
},
|
||||||
schema::{evm_basic_grant, evm_transaction_log},
|
schema::{evm_basic_grant, evm_transaction_log},
|
||||||
};
|
};
|
||||||
use crate::evm::policies::ether_transfer::EtherTransfer;
|
|
||||||
use crate::evm::policies::{
|
use crate::evm::policies::{
|
||||||
CombinedSettings, EvalContext, EvalViolation, Policy, SharedGrantSettings,
|
EvalContext, EvalViolation, SharedGrantSettings, TransactionRateLimit,
|
||||||
TransactionRateLimit, VolumeRateLimit,
|
|
||||||
};
|
};
|
||||||
|
|
||||||
use super::check_shared_constraints;
|
use super::check_shared_constraints;
|
||||||
@@ -534,7 +378,7 @@ mod tests {
|
|||||||
EvalContext {
|
EvalContext {
|
||||||
target: EvmWalletAccess {
|
target: EvmWalletAccess {
|
||||||
id: WALLET_ACCESS_ID,
|
id: WALLET_ACCESS_ID,
|
||||||
wallet_id: 10,
|
wallet_id: EvmWalletId::from_raw(5),
|
||||||
client_id: 20,
|
client_id: 20,
|
||||||
created_at: SqliteTimestamp(Utc::now()),
|
created_at: SqliteTimestamp(Utc::now()),
|
||||||
},
|
},
|
||||||
@@ -553,7 +397,6 @@ mod tests {
|
|||||||
chain: CHAIN_ID,
|
chain: CHAIN_ID,
|
||||||
valid_from: None,
|
valid_from: None,
|
||||||
valid_until: None,
|
valid_until: None,
|
||||||
revoked_at: None,
|
|
||||||
max_gas_fee_per_gas: None,
|
max_gas_fee_per_gas: None,
|
||||||
max_priority_fee_per_gas: None,
|
max_priority_fee_per_gas: None,
|
||||||
rate_limit: None,
|
rate_limit: None,
|
||||||
@@ -762,115 +605,4 @@ mod tests {
|
|||||||
assert!(violations.is_empty());
|
assert!(violations.is_empty());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
async fn bootstrapped_vault(db: &db::DatabasePool) -> ActorRef<Vault> {
|
|
||||||
let actor = Vault::spawn(
|
|
||||||
Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
|
||||||
.await
|
|
||||||
.unwrap(),
|
|
||||||
);
|
|
||||||
actor
|
|
||||||
.ask(Bootstrap {
|
|
||||||
seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
|
|
||||||
})
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
actor
|
|
||||||
}
|
|
||||||
|
|
||||||
#[tokio::test]
|
|
||||||
async fn revoke_grant_preserves_revoked_integrity() {
|
|
||||||
use crate::db::schema::evm_basic_grant;
|
|
||||||
use diesel::ExpressionMethods as _;
|
|
||||||
|
|
||||||
let db = db::create_test_pool().await;
|
|
||||||
let vault = bootstrapped_vault(&db).await;
|
|
||||||
let engine = super::Engine::new(db.clone(), vault.clone());
|
|
||||||
|
|
||||||
let full_grant = CombinedSettings {
|
|
||||||
shared: SharedGrantSettings {
|
|
||||||
wallet_access_id: WALLET_ACCESS_ID,
|
|
||||||
chain: CHAIN_ID,
|
|
||||||
valid_from: None,
|
|
||||||
valid_until: None,
|
|
||||||
revoked_at: None,
|
|
||||||
max_gas_fee_per_gas: None,
|
|
||||||
max_priority_fee_per_gas: None,
|
|
||||||
rate_limit: None,
|
|
||||||
},
|
|
||||||
specific: super::policies::ether_transfer::Settings {
|
|
||||||
target: vec![RECIPIENT],
|
|
||||||
limit: VolumeRateLimit {
|
|
||||||
max_volume: U256::from(100u64),
|
|
||||||
window: Duration::hours(1),
|
|
||||||
},
|
|
||||||
},
|
|
||||||
};
|
|
||||||
|
|
||||||
let grant_id = engine
|
|
||||||
.create_grant::<EtherTransfer>(full_grant)
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
engine.revoke_grant(grant_id).await.unwrap();
|
|
||||||
|
|
||||||
let mut conn = db.get().await.unwrap();
|
|
||||||
diesel::update(evm_basic_grant::table)
|
|
||||||
.filter(evm_basic_grant::id.eq(grant_id))
|
|
||||||
.set(evm_basic_grant::revoked_at.eq::<Option<SqliteTimestamp>>(None))
|
|
||||||
.execute(&mut conn)
|
|
||||||
.await
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
let wallet_access = EvmWalletAccess {
|
|
||||||
id: WALLET_ACCESS_ID,
|
|
||||||
wallet_id: 10,
|
|
||||||
client_id: 20,
|
|
||||||
created_at: SqliteTimestamp(Utc::now()),
|
|
||||||
};
|
|
||||||
let context = EvalContext {
|
|
||||||
target: wallet_access,
|
|
||||||
chain: CHAIN_ID,
|
|
||||||
to: RECIPIENT,
|
|
||||||
value: U256::ONE,
|
|
||||||
calldata: Bytes::new(),
|
|
||||||
max_fee_per_gas: 1,
|
|
||||||
max_priority_fee_per_gas: 1,
|
|
||||||
};
|
|
||||||
|
|
||||||
let grant = EtherTransfer::try_find_grant(
|
|
||||||
&context, &mut conn,
|
|
||||||
)
|
|
||||||
.await
|
|
||||||
.unwrap()
|
|
||||||
.unwrap();
|
|
||||||
|
|
||||||
let result =
|
|
||||||
integrity::verify_entity(&mut conn, &vault, &grant.settings, grant.id).await;
|
|
||||||
|
|
||||||
assert!(matches!(
|
|
||||||
result,
|
|
||||||
Err(integrity::Error::MacMismatch { .. })
|
|
||||||
));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn shared_settings_hash_changes_when_revoked_at_changes() {
|
|
||||||
use arbiter_crypto::hashing::Hashable;
|
|
||||||
use sha2::Digest;
|
|
||||||
|
|
||||||
let active = shared_settings();
|
|
||||||
let revoked = SharedGrantSettings {
|
|
||||||
revoked_at: Some(Utc::now()),
|
|
||||||
..shared_settings()
|
|
||||||
};
|
|
||||||
|
|
||||||
let mut active_hash = sha2::Sha256::new();
|
|
||||||
active.hash(&mut active_hash);
|
|
||||||
|
|
||||||
let mut revoked_hash = sha2::Sha256::new();
|
|
||||||
revoked.hash(&mut revoked_hash);
|
|
||||||
|
|
||||||
assert_ne!(active_hash.finalize(), revoked_hash.finalize());
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -144,7 +144,6 @@ pub struct SharedGrantSettings {
|
|||||||
|
|
||||||
pub valid_from: Option<DateTime<Utc>>,
|
pub valid_from: Option<DateTime<Utc>>,
|
||||||
pub valid_until: Option<DateTime<Utc>>,
|
pub valid_until: Option<DateTime<Utc>>,
|
||||||
pub revoked_at: Option<DateTime<Utc>>,
|
|
||||||
|
|
||||||
pub max_gas_fee_per_gas: Option<U256>,
|
pub max_gas_fee_per_gas: Option<U256>,
|
||||||
pub max_priority_fee_per_gas: Option<U256>,
|
pub max_priority_fee_per_gas: Option<U256>,
|
||||||
@@ -159,7 +158,6 @@ impl SharedGrantSettings {
|
|||||||
chain: model.chain_id.into(),
|
chain: model.chain_id.into(),
|
||||||
valid_from: model.valid_from.map(Into::into),
|
valid_from: model.valid_from.map(Into::into),
|
||||||
valid_until: model.valid_until.map(Into::into),
|
valid_until: model.valid_until.map(Into::into),
|
||||||
revoked_at: model.revoked_at.map(Into::into),
|
|
||||||
max_gas_fee_per_gas: model
|
max_gas_fee_per_gas: model
|
||||||
.max_gas_fee_per_gas
|
.max_gas_fee_per_gas
|
||||||
.map(|b| utils::try_bytes_to_u256(&b))
|
.map(|b| utils::try_bytes_to_u256(&b))
|
||||||
|
|||||||
@@ -1,5 +1,6 @@
|
|||||||
use super::{DatabaseID, EvalContext, EvalViolation};
|
use super::{DatabaseID, EvalContext, EvalViolation};
|
||||||
use crate::{
|
use crate::{
|
||||||
|
crypto::integrity::v1::Integrable,
|
||||||
db::models::{
|
db::models::{
|
||||||
EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget, EvmEtherTransferLimit,
|
EvmBasicGrant, EvmEtherTransferGrant, EvmEtherTransferGrantTarget, EvmEtherTransferLimit,
|
||||||
NewEvmEtherTransferLimit, SqliteTimestamp,
|
NewEvmEtherTransferLimit, SqliteTimestamp,
|
||||||
@@ -51,12 +52,14 @@ impl From<Meaning> for SpecificMeaning {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// A grant for ether transfers, which can be scoped to specific target addresses and volume limits
|
// A grant for ether transfers, which can be scoped to specific target addresses and volume limits
|
||||||
#[derive(Debug, Clone, arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
#[derive(Debug, Clone, arbiter_macros::Hashable)]
|
||||||
#[integrable(kind = "EtherTransfer")]
|
|
||||||
pub struct Settings {
|
pub struct Settings {
|
||||||
pub target: Vec<Address>,
|
pub target: Vec<Address>,
|
||||||
pub limit: VolumeRateLimit,
|
pub limit: VolumeRateLimit,
|
||||||
}
|
}
|
||||||
|
impl Integrable for Settings {
|
||||||
|
const KIND: &'static str = "EtherTransfer";
|
||||||
|
}
|
||||||
|
|
||||||
impl From<Settings> for SpecificGrant {
|
impl From<Settings> for SpecificGrant {
|
||||||
fn from(val: Settings) -> Self {
|
fn from(val: Settings) -> Self {
|
||||||
|
|||||||
@@ -3,7 +3,8 @@ use crate::{
|
|||||||
db::{
|
db::{
|
||||||
self, DatabaseConnection,
|
self, DatabaseConnection,
|
||||||
models::{
|
models::{
|
||||||
EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, NewEvmTransactionLog, SqliteTimestamp,
|
EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
|
||||||
|
SqliteTimestamp,
|
||||||
},
|
},
|
||||||
schema::{evm_basic_grant, evm_transaction_log},
|
schema::{evm_basic_grant, evm_transaction_log},
|
||||||
},
|
},
|
||||||
@@ -31,7 +32,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
|
|||||||
EvalContext {
|
EvalContext {
|
||||||
target: EvmWalletAccess {
|
target: EvmWalletAccess {
|
||||||
id: WALLET_ACCESS_ID,
|
id: WALLET_ACCESS_ID,
|
||||||
wallet_id: 10,
|
wallet_id: EvmWalletId::from_raw(10),
|
||||||
client_id: 20,
|
client_id: 20,
|
||||||
created_at: SqliteTimestamp(Utc::now()),
|
created_at: SqliteTimestamp(Utc::now()),
|
||||||
},
|
},
|
||||||
@@ -79,7 +80,6 @@ fn shared() -> SharedGrantSettings {
|
|||||||
chain: CHAIN_ID,
|
chain: CHAIN_ID,
|
||||||
valid_from: None,
|
valid_from: None,
|
||||||
valid_until: None,
|
valid_until: None,
|
||||||
revoked_at: None,
|
|
||||||
max_gas_fee_per_gas: None,
|
max_gas_fee_per_gas: None,
|
||||||
max_priority_fee_per_gas: None,
|
max_priority_fee_per_gas: None,
|
||||||
rate_limit: None,
|
rate_limit: None,
|
||||||
|
|||||||
@@ -1,5 +1,6 @@
|
|||||||
use super::{DatabaseID, EvalContext, EvalViolation};
|
use super::{DatabaseID, EvalContext, EvalViolation};
|
||||||
use crate::{
|
use crate::{
|
||||||
|
crypto::integrity::Integrable,
|
||||||
db::models::{
|
db::models::{
|
||||||
EvmBasicGrant, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
|
EvmBasicGrant, EvmTokenTransferGrant, EvmTokenTransferVolumeLimit,
|
||||||
NewEvmTokenTransferGrant, NewEvmTokenTransferLog, NewEvmTokenTransferVolumeLimit,
|
NewEvmTokenTransferGrant, NewEvmTokenTransferLog, NewEvmTokenTransferVolumeLimit,
|
||||||
@@ -62,13 +63,15 @@ impl From<Meaning> for SpecificMeaning {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// A grant for token transfers, which can be scoped to specific target addresses and volume limits
|
// A grant for token transfers, which can be scoped to specific target addresses and volume limits
|
||||||
#[derive(Debug, Clone, arbiter_macros::Hashable, arbiter_macros::Integrable)]
|
#[derive(Debug, Clone, arbiter_macros::Hashable)]
|
||||||
#[integrable(kind = "TokenTransfer")]
|
|
||||||
pub struct Settings {
|
pub struct Settings {
|
||||||
pub token_contract: Address,
|
pub token_contract: Address,
|
||||||
pub target: Option<Address>,
|
pub target: Option<Address>,
|
||||||
pub volume_limits: Vec<VolumeRateLimit>,
|
pub volume_limits: Vec<VolumeRateLimit>,
|
||||||
}
|
}
|
||||||
|
impl Integrable for Settings {
|
||||||
|
const KIND: &'static str = "TokenTransfer";
|
||||||
|
}
|
||||||
|
|
||||||
impl From<Settings> for SpecificGrant {
|
impl From<Settings> for SpecificGrant {
|
||||||
fn from(val: Settings) -> Self {
|
fn from(val: Settings) -> Self {
|
||||||
|
|||||||
@@ -2,7 +2,7 @@ use super::{Settings, TokenTransfer};
|
|||||||
use crate::{
|
use crate::{
|
||||||
db::{
|
db::{
|
||||||
self, DatabaseConnection,
|
self, DatabaseConnection,
|
||||||
models::{EvmBasicGrant, EvmWalletAccess, NewEvmBasicGrant, SqliteTimestamp},
|
models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
|
||||||
schema::evm_basic_grant,
|
schema::evm_basic_grant,
|
||||||
},
|
},
|
||||||
evm::{
|
evm::{
|
||||||
@@ -45,7 +45,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
|
|||||||
EvalContext {
|
EvalContext {
|
||||||
target: EvmWalletAccess {
|
target: EvmWalletAccess {
|
||||||
id: WALLET_ACCESS_ID,
|
id: WALLET_ACCESS_ID,
|
||||||
wallet_id: 10,
|
wallet_id: EvmWalletId::from_raw(10),
|
||||||
client_id: 20,
|
client_id: 20,
|
||||||
created_at: SqliteTimestamp(Utc::now()),
|
created_at: SqliteTimestamp(Utc::now()),
|
||||||
},
|
},
|
||||||
@@ -98,7 +98,6 @@ fn shared() -> SharedGrantSettings {
|
|||||||
chain: CHAIN_ID,
|
chain: CHAIN_ID,
|
||||||
valid_from: None,
|
valid_from: None,
|
||||||
valid_until: None,
|
valid_until: None,
|
||||||
revoked_at: None,
|
|
||||||
max_gas_fee_per_gas: None,
|
max_gas_fee_per_gas: None,
|
||||||
max_priority_fee_per_gas: None,
|
max_priority_fee_per_gas: None,
|
||||||
rate_limit: None,
|
rate_limit: None,
|
||||||
|
|||||||
@@ -200,7 +200,7 @@ impl Convert for auth::Outbound {
|
|||||||
.timestamp
|
.timestamp
|
||||||
.timestamp_nanos_opt()
|
.timestamp_nanos_opt()
|
||||||
.expect("timestamp within range")
|
.expect("timestamp within range")
|
||||||
.cast_unsigned(),
|
as u64,
|
||||||
random: challenge.nonce.to_vec(),
|
random: challenge.nonce.to_vec(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -80,7 +80,7 @@ impl Sender<Result<auth::Outbound, auth::Error>> for AuthTransportAdapter<'_> {
|
|||||||
.timestamp
|
.timestamp
|
||||||
.timestamp_nanos_opt()
|
.timestamp_nanos_opt()
|
||||||
.expect("timestamp within range")
|
.expect("timestamp within range")
|
||||||
.cast_unsigned(),
|
as u64,
|
||||||
random: challenge.nonce.to_vec(),
|
random: challenge.nonce.to_vec(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -90,7 +90,7 @@ async fn handle_wallet_list(
|
|||||||
.into_iter()
|
.into_iter()
|
||||||
.map(|(id, address)| WalletEntry {
|
.map(|(id, address)| WalletEntry {
|
||||||
address: address.to_vec(),
|
address: address.to_vec(),
|
||||||
id,
|
id: id.to_raw(),
|
||||||
})
|
})
|
||||||
.collect(),
|
.collect(),
|
||||||
}),
|
}),
|
||||||
|
|||||||
@@ -1,11 +1,10 @@
|
|||||||
use crate::{
|
use crate::{
|
||||||
db::models::{CoreEvmWalletAccess, NewEvmWalletAccess},
|
db::models::{CoreEvmWalletAccess, EvmWalletId, NewEvmWalletAccess},
|
||||||
evm::policies::{
|
evm::policies::{
|
||||||
SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
|
SharedGrantSettings, SpecificGrant, TransactionRateLimit, VolumeRateLimit, ether_transfer,
|
||||||
token_transfers,
|
token_transfers,
|
||||||
},
|
},
|
||||||
grpc::Convert,
|
grpc::{Convert, TryConvert},
|
||||||
grpc::TryConvert,
|
|
||||||
};
|
};
|
||||||
use arbiter_proto::{
|
use arbiter_proto::{
|
||||||
proto::evm::{
|
proto::evm::{
|
||||||
@@ -87,7 +86,6 @@ impl TryConvert for ProtoSharedSettings {
|
|||||||
.valid_until
|
.valid_until
|
||||||
.map(ProtoTimestamp::try_convert)
|
.map(ProtoTimestamp::try_convert)
|
||||||
.transpose()?,
|
.transpose()?,
|
||||||
revoked_at: None,
|
|
||||||
max_gas_fee_per_gas: self
|
max_gas_fee_per_gas: self
|
||||||
.max_gas_fee_per_gas
|
.max_gas_fee_per_gas
|
||||||
.as_deref()
|
.as_deref()
|
||||||
@@ -151,7 +149,7 @@ impl Convert for WalletAccess {
|
|||||||
|
|
||||||
fn convert(self) -> Self::Output {
|
fn convert(self) -> Self::Output {
|
||||||
NewEvmWalletAccess {
|
NewEvmWalletAccess {
|
||||||
wallet_id: self.wallet_id,
|
wallet_id: EvmWalletId::from_raw(self.wallet_id),
|
||||||
client_id: self.sdk_client_id,
|
client_id: self.sdk_client_id,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -166,7 +164,7 @@ impl TryConvert for SdkClientWalletAccess {
|
|||||||
return Err(Status::invalid_argument("Missing wallet access entry"));
|
return Err(Status::invalid_argument("Missing wallet access entry"));
|
||||||
};
|
};
|
||||||
Ok(CoreEvmWalletAccess {
|
Ok(CoreEvmWalletAccess {
|
||||||
wallet_id: access.wallet_id,
|
wallet_id: EvmWalletId::from_raw(access.wallet_id),
|
||||||
client_id: access.sdk_client_id,
|
client_id: access.sdk_client_id,
|
||||||
id: self.id,
|
id: self.id,
|
||||||
})
|
})
|
||||||
|
|||||||
@@ -103,7 +103,7 @@ impl Convert for EvmWalletAccess {
|
|||||||
Self::Output {
|
Self::Output {
|
||||||
id: self.id,
|
id: self.id,
|
||||||
access: Some(WalletAccess {
|
access: Some(WalletAccess {
|
||||||
wallet_id: self.wallet_id,
|
wallet_id: self.wallet_id.to_raw(),
|
||||||
sdk_client_id: self.client_id,
|
sdk_client_id: self.client_id,
|
||||||
}),
|
}),
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -2,7 +2,7 @@ use crate::{
|
|||||||
db::models::NewEvmWalletAccess,
|
db::models::NewEvmWalletAccess,
|
||||||
grpc::Convert,
|
grpc::Convert,
|
||||||
peers::operator::{
|
peers::operator::{
|
||||||
OutOfBand, OperatorSession,
|
OperatorSession, OutOfBand,
|
||||||
session::handlers::{
|
session::handlers::{
|
||||||
HandleGrantEvmWalletAccess, HandleListWalletAccess, HandleNewClientApprove,
|
HandleGrantEvmWalletAccess, HandleListWalletAccess, HandleNewClientApprove,
|
||||||
HandleRevokeEvmWalletAccess, HandleSdkClientList,
|
HandleRevokeEvmWalletAccess, HandleSdkClientList,
|
||||||
@@ -11,8 +11,8 @@ use crate::{
|
|||||||
};
|
};
|
||||||
use arbiter_crypto::authn;
|
use arbiter_crypto::authn;
|
||||||
use arbiter_proto::proto::{
|
use arbiter_proto::proto::{
|
||||||
shared::ClientInfo as ProtoClientMetadata,
|
|
||||||
operator::{
|
operator::{
|
||||||
|
operator_response::Payload as OperatorResponsePayload,
|
||||||
sdk_client::{
|
sdk_client::{
|
||||||
self as proto_sdk_client, ConnectionCancel as ProtoSdkClientConnectionCancel,
|
self as proto_sdk_client, ConnectionCancel as ProtoSdkClientConnectionCancel,
|
||||||
ConnectionRequest as ProtoSdkClientConnectionRequest,
|
ConnectionRequest as ProtoSdkClientConnectionRequest,
|
||||||
@@ -24,8 +24,8 @@ use arbiter_proto::proto::{
|
|||||||
request::Payload as SdkClientRequestPayload,
|
request::Payload as SdkClientRequestPayload,
|
||||||
response::Payload as SdkClientResponsePayload,
|
response::Payload as SdkClientResponsePayload,
|
||||||
},
|
},
|
||||||
operator_response::Payload as OperatorResponsePayload,
|
|
||||||
},
|
},
|
||||||
|
shared::ClientInfo as ProtoClientMetadata,
|
||||||
};
|
};
|
||||||
|
|
||||||
use kameo::actor::ActorRef;
|
use kameo::actor::ActorRef;
|
||||||
@@ -115,7 +115,7 @@ async fn handle_list(
|
|||||||
clients: clients
|
clients: clients
|
||||||
.into_iter()
|
.into_iter()
|
||||||
.map(|(client, metadata)| ProtoSdkClientEntry {
|
.map(|(client, metadata)| ProtoSdkClientEntry {
|
||||||
id: client.id,
|
id: client.id.to_raw(),
|
||||||
pubkey: client.public_key.clone(),
|
pubkey: client.public_key.clone(),
|
||||||
info: Some(ProtoClientMetadata {
|
info: Some(ProtoClientMetadata {
|
||||||
name: metadata.name,
|
name: metadata.name,
|
||||||
|
|||||||
@@ -298,7 +298,7 @@ where
|
|||||||
|
|
||||||
let signature = expect_message(transport, |req: Inbound| match req {
|
let signature = expect_message(transport, |req: Inbound| match req {
|
||||||
Inbound::AuthChallengeSolution { signature } => Some(signature),
|
Inbound::AuthChallengeSolution { signature } => Some(signature),
|
||||||
Inbound::AuthChallengeRequest { .. } => None,
|
_ => None,
|
||||||
})
|
})
|
||||||
.await
|
.await
|
||||||
.map_err(|e| {
|
.map_err(|e| {
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
use crate::{
|
use crate::{
|
||||||
actors::GlobalActors, db, peers::client::session::ClientSession,
|
actors::GlobalActors, crypto::integrity::Integrable, db, peers::client::session::ClientSession,
|
||||||
};
|
};
|
||||||
use arbiter_crypto::authn;
|
use arbiter_crypto::authn;
|
||||||
use arbiter_macros::Hashable;
|
use arbiter_macros::Hashable;
|
||||||
@@ -14,12 +14,15 @@ pub struct ClientProfile {
|
|||||||
pub metadata: ClientMetadata,
|
pub metadata: ClientMetadata,
|
||||||
}
|
}
|
||||||
|
|
||||||
#[derive(Hashable, arbiter_macros::Integrable)]
|
#[derive(Hashable)]
|
||||||
#[integrable(kind = "client_credentials")]
|
|
||||||
pub struct ClientCredentials {
|
pub struct ClientCredentials {
|
||||||
pub pubkey: authn::PublicKey,
|
pub pubkey: authn::PublicKey,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
impl Integrable for ClientCredentials {
|
||||||
|
const KIND: &'static str = "client_credentials";
|
||||||
|
}
|
||||||
|
|
||||||
pub struct ClientConnection {
|
pub struct ClientConnection {
|
||||||
pub(crate) db: db::DatabasePool,
|
pub(crate) db: db::DatabasePool,
|
||||||
pub(crate) actors: GlobalActors,
|
pub(crate) actors: GlobalActors,
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ use super::{
|
|||||||
};
|
};
|
||||||
use crate::{
|
use crate::{
|
||||||
actors::bootstrap::ConsumeToken,
|
actors::bootstrap::ConsumeToken,
|
||||||
db::{DatabasePool, schema::operator_client},
|
db::{DatabasePool, schema::operator_identity},
|
||||||
peers::operator::auth::Outbound,
|
peers::operator::auth::Outbound,
|
||||||
};
|
};
|
||||||
use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
|
use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
|
||||||
@@ -19,7 +19,7 @@ pub(super) struct ChallengeRequest {
|
|||||||
pub(super) bootstrap_token: Option<String>,
|
pub(super) bootstrap_token: Option<String>,
|
||||||
}
|
}
|
||||||
|
|
||||||
pub struct ChallengeContext {
|
pub(super) struct ChallengeContext {
|
||||||
pub(super) challenge: AuthChallenge,
|
pub(super) challenge: AuthChallenge,
|
||||||
pub(super) pubkey: authn::PublicKey,
|
pub(super) pubkey: authn::PublicKey,
|
||||||
pub(super) bootstrap_token: Option<String>,
|
pub(super) bootstrap_token: Option<String>,
|
||||||
@@ -44,9 +44,9 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
|
|||||||
Error::internal("Database unavailable")
|
Error::internal("Database unavailable")
|
||||||
})?;
|
})?;
|
||||||
|
|
||||||
operator_client::table
|
operator_identity::table
|
||||||
.filter(operator_client::public_key.eq(pubkey.to_bytes()))
|
.filter(operator_identity::public_key.eq(pubkey.to_bytes()))
|
||||||
.select(operator_client::id)
|
.select(operator_identity::id)
|
||||||
.first::<i32>(&mut conn)
|
.first::<i32>(&mut conn)
|
||||||
.await
|
.await
|
||||||
.optional()
|
.optional()
|
||||||
@@ -63,9 +63,9 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
|
|||||||
Error::internal("Database unavailable")
|
Error::internal("Database unavailable")
|
||||||
})?;
|
})?;
|
||||||
|
|
||||||
let id: i32 = diesel::insert_into(operator_client::table)
|
let id: i32 = diesel::insert_into(operator_identity::table)
|
||||||
.values((operator_client::public_key.eq(pubkey_bytes),))
|
.values((operator_identity::public_key.eq(pubkey_bytes),))
|
||||||
.returning(operator_client::id)
|
.returning(operator_identity::id)
|
||||||
.get_result(&mut conn)
|
.get_result(&mut conn)
|
||||||
.await
|
.await
|
||||||
.map_err(|e| {
|
.map_err(|e| {
|
||||||
@@ -127,6 +127,8 @@ where
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#[allow(missing_docs)]
|
||||||
|
#[allow(clippy::unused_unit)]
|
||||||
async fn verify_solution(
|
async fn verify_solution(
|
||||||
&mut self,
|
&mut self,
|
||||||
ChallengeContext {
|
ChallengeContext {
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ use crate::{
|
|||||||
GlobalActors,
|
GlobalActors,
|
||||||
vault::{GetState, Vault},
|
vault::{GetState, Vault},
|
||||||
},
|
},
|
||||||
crypto::integrity::{self, AttestationStatus},
|
crypto::integrity::{self, AttestationStatus, Integrable},
|
||||||
db::{DatabaseError, DatabasePool},
|
db::{DatabaseError, DatabasePool},
|
||||||
peers::client::ClientProfile,
|
peers::client::ClientProfile,
|
||||||
};
|
};
|
||||||
@@ -23,13 +23,16 @@ pub mod auth;
|
|||||||
pub mod session;
|
pub mod session;
|
||||||
pub mod vault_gate;
|
pub mod vault_gate;
|
||||||
|
|
||||||
#[derive(Debug, Clone, Hashable, arbiter_macros::Integrable)]
|
#[derive(Debug, Clone, Hashable)]
|
||||||
#[integrable(kind = "operator_credentials")]
|
|
||||||
pub struct Credentials {
|
pub struct Credentials {
|
||||||
pub id: i32,
|
pub id: i32,
|
||||||
pub pubkey: authn::PublicKey,
|
pub pubkey: authn::PublicKey,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
impl Integrable for Credentials {
|
||||||
|
const KIND: &'static str = "operator_credentials";
|
||||||
|
}
|
||||||
|
|
||||||
// Messages, sent by operator to connection client without having a request
|
// Messages, sent by operator to connection client without having a request
|
||||||
#[derive(Debug)]
|
#[derive(Debug)]
|
||||||
pub enum OutOfBand {
|
pub enum OutOfBand {
|
||||||
|
|||||||
@@ -1,12 +1,16 @@
|
|||||||
use super::{Error, OperatorSession};
|
use super::{Error, OperatorSession};
|
||||||
use crate::{
|
use crate::{
|
||||||
actors::evm::{
|
actors::{
|
||||||
|
evm::{
|
||||||
ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
|
ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
|
||||||
SignTransactionError as EvmSignError,
|
SignTransactionError as EvmSignError,
|
||||||
},
|
},
|
||||||
actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer,
|
flow_coordinator::client_connect_approval::ClientApprovalAnswer,
|
||||||
actors::vault::VaultState,
|
vault::VaultState,
|
||||||
db::models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
|
},
|
||||||
|
db::models::{
|
||||||
|
EvmWalletAccess, EvmWalletId, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata,
|
||||||
|
},
|
||||||
evm::policies::{Grant, SpecificGrant},
|
evm::policies::{Grant, SpecificGrant},
|
||||||
};
|
};
|
||||||
use arbiter_crypto::authn;
|
use arbiter_crypto::authn;
|
||||||
@@ -70,7 +74,9 @@ impl OperatorSession {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#[message]
|
#[message]
|
||||||
pub(crate) async fn handle_evm_wallet_list(&mut self) -> Result<Vec<(i32, Address)>, Error> {
|
pub(crate) async fn handle_evm_wallet_list(
|
||||||
|
&mut self,
|
||||||
|
) -> Result<Vec<(EvmWalletId, Address)>, Error> {
|
||||||
match self.props.actors.evm.ask(ListWallets {}).await {
|
match self.props.actors.evm.ask(ListWallets {}).await {
|
||||||
Ok(wallets) => Ok(wallets),
|
Ok(wallets) => Ok(wallets),
|
||||||
Err(err) => {
|
Err(err) => {
|
||||||
@@ -212,7 +218,8 @@ impl OperatorSession {
|
|||||||
&mut self,
|
&mut self,
|
||||||
) -> Result<Vec<EvmWalletAccess>, Error> {
|
) -> Result<Vec<EvmWalletAccess>, Error> {
|
||||||
let mut conn = self.props.db.get().await?;
|
let mut conn = self.props.db.get().await?;
|
||||||
let access_entries = crate::db::schema::evm_wallet_access::table
|
use crate::db::schema::evm_wallet_access;
|
||||||
|
let access_entries = evm_wallet_access::table
|
||||||
.select(EvmWalletAccess::as_select())
|
.select(EvmWalletAccess::as_select())
|
||||||
.load::<_>(&mut conn)
|
.load::<_>(&mut conn)
|
||||||
.await?;
|
.await?;
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
use super::{OutOfBand, OperatorConnection};
|
use super::{OutOfBand, OperatorConnection};
|
||||||
use crate::{
|
use crate::{
|
||||||
actors::{
|
actors::{
|
||||||
flow_coordinator::client_connect_approval::{ClientApprovalAnswer, ClientApprovalController},
|
flow_coordinator::client_connect_approval::ClientApprovalController,
|
||||||
operator_registry::ConnectOperator,
|
operator_registry::ConnectOperator,
|
||||||
},
|
},
|
||||||
peers::client::ClientProfile,
|
peers::client::ClientProfile,
|
||||||
@@ -63,7 +63,7 @@ impl OperatorSession {
|
|||||||
Self {
|
Self {
|
||||||
props,
|
props,
|
||||||
sender,
|
sender,
|
||||||
pending_client_approvals: HashMap::default(),
|
pending_client_approvals: Default::default(),
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -88,7 +88,6 @@ impl OperatorSession {
|
|||||||
actor = "operator",
|
actor = "operator",
|
||||||
event = "failed to announce new client connection"
|
event = "failed to announce new client connection"
|
||||||
);
|
);
|
||||||
let _ = controller.tell(ClientApprovalAnswer { approved: false }).await;
|
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -86,8 +86,8 @@ async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
|
|||||||
.0
|
.0
|
||||||
.to_vec();
|
.to_vec();
|
||||||
|
|
||||||
insert_into(schema::operator_client::table)
|
insert_into(schema::operator_identity::table)
|
||||||
.values((schema::operator_client::public_key.eq(sentinel_key),))
|
.values((schema::operator_identity::public_key.eq(sentinel_key),))
|
||||||
.execute(&mut conn)
|
.execute(&mut conn)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
|
|||||||
@@ -206,8 +206,8 @@ pub async fn bootstrap_token_auth() {
|
|||||||
task.await.unwrap().unwrap();
|
task.await.unwrap().unwrap();
|
||||||
|
|
||||||
let mut conn = db.get().await.unwrap();
|
let mut conn = db.get().await.unwrap();
|
||||||
let stored_pubkey: Vec<u8> = schema::operator_client::table
|
let stored_pubkey: Vec<u8> = schema::operator_identity::table
|
||||||
.select(schema::operator_client::public_key)
|
.select(schema::operator_identity::public_key)
|
||||||
.first::<Vec<u8>>(&mut conn)
|
.first::<Vec<u8>>(&mut conn)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -259,7 +259,7 @@ pub async fn bootstrap_invalid_token_auth() {
|
|||||||
));
|
));
|
||||||
|
|
||||||
let mut conn = db.get().await.unwrap();
|
let mut conn = db.get().await.unwrap();
|
||||||
let count: i64 = schema::operator_client::table
|
let count: i64 = schema::operator_identity::table
|
||||||
.count()
|
.count()
|
||||||
.get_result::<i64>(&mut conn)
|
.get_result::<i64>(&mut conn)
|
||||||
.await
|
.await
|
||||||
@@ -285,9 +285,9 @@ pub async fn challenge_auth() {
|
|||||||
|
|
||||||
{
|
{
|
||||||
let mut conn = db.get().await.unwrap();
|
let mut conn = db.get().await.unwrap();
|
||||||
let id: i32 = insert_into(schema::operator_client::table)
|
let id: i32 = insert_into(schema::operator_identity::table)
|
||||||
.values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
|
.values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
|
||||||
.returning(schema::operator_client::id)
|
.returning(schema::operator_identity::id)
|
||||||
.get_result(&mut conn)
|
.get_result(&mut conn)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -371,8 +371,8 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
|
|||||||
|
|
||||||
{
|
{
|
||||||
let mut conn = db.get().await.unwrap();
|
let mut conn = db.get().await.unwrap();
|
||||||
insert_into(schema::operator_client::table)
|
insert_into(schema::operator_identity::table)
|
||||||
.values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
|
.values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
|
||||||
.execute(&mut conn)
|
.execute(&mut conn)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
@@ -400,7 +400,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
|
|||||||
let challenge = match response {
|
let challenge = match response {
|
||||||
Ok(resp) => match resp {
|
Ok(resp) => match resp {
|
||||||
auth::Outbound::AuthChallenge { challenge } => challenge,
|
auth::Outbound::AuthChallenge { challenge } => challenge,
|
||||||
other @ auth::Outbound::AuthSuccess => panic!("Expected AuthChallenge, got {other:?}"),
|
other => panic!("Expected AuthChallenge, got {other:?}"),
|
||||||
},
|
},
|
||||||
Err(err) => panic!("Expected Ok response, got Err({err:?})"),
|
Err(err) => panic!("Expected Ok response, got Err({err:?})"),
|
||||||
};
|
};
|
||||||
@@ -444,9 +444,9 @@ pub async fn challenge_auth_rejects_invalid_signature() {
|
|||||||
|
|
||||||
{
|
{
|
||||||
let mut conn = db.get().await.unwrap();
|
let mut conn = db.get().await.unwrap();
|
||||||
let id: i32 = insert_into(schema::operator_client::table)
|
let id: i32 = insert_into(schema::operator_identity::table)
|
||||||
.values((schema::operator_client::public_key.eq(pubkey_bytes.clone()),))
|
.values((schema::operator_identity::public_key.eq(pubkey_bytes.clone()),))
|
||||||
.returning(schema::operator_client::id)
|
.returning(schema::operator_identity::id)
|
||||||
.get_result(&mut conn)
|
.get_result(&mut conn)
|
||||||
.await
|
.await
|
||||||
.unwrap();
|
.unwrap();
|
||||||
|
|||||||
@@ -14,7 +14,7 @@ use diesel_async::RunQueryDsl;
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn bootstrap() {
|
async fn test_bootstrap() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
|
||||||
.await
|
.await
|
||||||
@@ -39,7 +39,7 @@ async fn bootstrap() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn bootstrap_rejects_double() {
|
async fn test_bootstrap_rejects_double() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = common::bootstrapped_vault(&db).await;
|
let mut actor = common::bootstrapped_vault(&db).await;
|
||||||
|
|
||||||
@@ -50,7 +50,7 @@ async fn bootstrap_rejects_double() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn create_new_before_bootstrap_fails() {
|
async fn test_create_new_before_bootstrap_fails() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
|
let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
|
||||||
.await
|
.await
|
||||||
@@ -65,7 +65,7 @@ async fn create_new_before_bootstrap_fails() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn decrypt_before_bootstrap_fails() {
|
async fn test_decrypt_before_bootstrap_fails() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
|
let mut actor = Vault::new(db, GlobalActors::spawn_message_bus())
|
||||||
.await
|
.await
|
||||||
@@ -77,7 +77,7 @@ async fn decrypt_before_bootstrap_fails() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn new_restores_sealed_state() {
|
async fn test_new_restores_sealed_state() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let actor = common::bootstrapped_vault(&db).await;
|
let actor = common::bootstrapped_vault(&db).await;
|
||||||
drop(actor);
|
drop(actor);
|
||||||
@@ -91,7 +91,7 @@ async fn new_restores_sealed_state() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn unseal_correct_password() {
|
async fn test_unseal_correct_password() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = common::bootstrapped_vault(&db).await;
|
let mut actor = common::bootstrapped_vault(&db).await;
|
||||||
|
|
||||||
@@ -114,7 +114,7 @@ async fn unseal_correct_password() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn unseal_wrong_then_correct_password() {
|
async fn test_unseal_wrong_then_correct_password() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = common::bootstrapped_vault(&db).await;
|
let mut actor = common::bootstrapped_vault(&db).await;
|
||||||
|
|
||||||
|
|||||||
@@ -12,7 +12,7 @@ use std::collections::HashSet;
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn create_decrypt_roundtrip() {
|
async fn test_create_decrypt_roundtrip() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = common::bootstrapped_vault(&db).await;
|
let mut actor = common::bootstrapped_vault(&db).await;
|
||||||
|
|
||||||
@@ -28,7 +28,7 @@ async fn create_decrypt_roundtrip() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn decrypt_nonexistent_returns_not_found() {
|
async fn test_decrypt_nonexistent_returns_not_found() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = common::bootstrapped_vault(&db).await;
|
let mut actor = common::bootstrapped_vault(&db).await;
|
||||||
|
|
||||||
@@ -38,7 +38,7 @@ async fn decrypt_nonexistent_returns_not_found() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn ciphertext_differs_across_entries() {
|
async fn test_ciphertext_differs_across_entries() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = common::bootstrapped_vault(&db).await;
|
let mut actor = common::bootstrapped_vault(&db).await;
|
||||||
|
|
||||||
@@ -76,7 +76,7 @@ async fn ciphertext_differs_across_entries() {
|
|||||||
|
|
||||||
#[tokio::test]
|
#[tokio::test]
|
||||||
#[test_log::test]
|
#[test_log::test]
|
||||||
async fn nonce_never_reused() {
|
async fn test_nonce_never_reused() {
|
||||||
let db = db::create_test_pool().await;
|
let db = db::create_test_pool().await;
|
||||||
let mut actor = common::bootstrapped_vault(&db).await;
|
let mut actor = common::bootstrapped_vault(&db).await;
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user