@7h3/protocol 0.5.0 → 0.5.2

package/sdk/rust/src/http.rs

@@ -1,145 +0,0 @@
-//! HTTP binding for 7h3 Protocol — signs and verifies per-request envelopes.
-//!
-//! The signed envelope rides in the `x-7h3-envelope` request header.
-
-use crate::{
-    create_envelope, sign_envelope_ed25519, validate_envelope, verify_envelope_ed25519,
-    ProtocolBody, ProtocolEnvelope,
-};
-use std::collections::HashMap;
-
-pub const DEFAULT_HEADER: &str = "x-7h3-envelope";
-
-/// Reason an HTTP envelope verification failed.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum VerifyFailReason {
-    MissingHeader,
-    MalformedEnvelope(String),
-    UnknownSender(String),
-    InvalidSignature,
-    TtlExpired,
-}
-
-impl std::fmt::Display for VerifyFailReason {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::MissingHeader => write!(f, "missing-header"),
-            Self::MalformedEnvelope(d) => write!(f, "malformed-envelope: {d}"),
-            Self::UnknownSender(s) => write!(f, "unknown-sender: {s}"),
-            Self::InvalidSignature => write!(f, "invalid-signature"),
-            Self::TtlExpired => write!(f, "ttl-expired"),
-        }
-    }
-}
-
-/// Simple in-memory key registry mapping sender_id → base64url-encoded SPKI public key.
-pub struct StaticKeyRegistry {
-    keys: HashMap<String, String>,
-}
-
-impl StaticKeyRegistry {
-    pub fn new(keys: HashMap<String, String>) -> Self {
-        Self { keys }
-    }
-
-    pub fn get_public_key(&self, sender_id: &str) -> Option<&str> {
-        self.keys.get(sender_id).map(|s| s.as_str())
-    }
-}
-
-/// Input for signing an outbound HTTP request.
-pub struct EnvelopeInput {
-    pub sender: String,
-    pub recipient: Option<String>,
-    pub ttl_ms: i64,
-    pub body: ProtocolBody,
-    pub key_id: String,
-}
-
-fn now_ms() -> i64 {
-    std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_millis() as i64
-}
-
-/// Verify a 7h3 envelope from HTTP headers (generic over header map type).
-/// `headers` is a flat map of lowercase header names → values.
-pub fn verify_http_envelope(
-    headers: &HashMap<String, String>,
-    registry: &StaticKeyRegistry,
-    header_name: Option<&str>,
-    strict_ttl: bool,
-) -> Result<ProtocolEnvelope, VerifyFailReason> {
-    let hname = header_name.unwrap_or(DEFAULT_HEADER);
-    let raw = headers
-        .get(hname)
-        .or_else(|| headers.get(&hname.to_lowercase()))
-        .ok_or(VerifyFailReason::MissingHeader)?;
-
-    let envelope: ProtocolEnvelope = serde_json::from_str(raw)
-        .map_err(|e| VerifyFailReason::MalformedEnvelope(e.to_string()))?;
-
-    let sig = envelope
-        .signature
-        .as_ref()
-        .ok_or_else(|| VerifyFailReason::MalformedEnvelope("missing signature".into()))?;
-
-    if strict_ttl {
-        let now = now_ms();
-        let diags = validate_envelope(&envelope, Some(now));
-        if diags.iter().any(|d| d.level == "error") {
-            return Err(VerifyFailReason::TtlExpired);
-        }
-    }
-
-    let sender = &envelope.header.sender;
-    match sig.alg.as_str() {
-        "ED25519" => {
-            let pub_key = registry
-                .get_public_key(sender)
-                .ok_or_else(|| VerifyFailReason::UnknownSender(sender.clone()))?;
-            let valid = verify_envelope_ed25519(&envelope, pub_key)
-                .map_err(|e| VerifyFailReason::MalformedEnvelope(e))?;
-            if !valid {
-                return Err(VerifyFailReason::InvalidSignature);
-            }
-        }
-        "HS256" => {
-            let key_id = &sig.key_id;
-            return Err(VerifyFailReason::UnknownSender(format!(
-                "HMAC key {key_id}: use StaticHmacRegistry"
-            )));
-        }
-        alg => {
-            return Err(VerifyFailReason::MalformedEnvelope(format!(
-                "unsupported alg: {alg}"
-            )));
-        }
-    }
-
-    Ok(envelope)
-}
-
-/// Sign an outbound HTTP request — returns the header name and JSON-serialized envelope value.
-pub fn sign_http_request(
-    input: &EnvelopeInput,
-    private_key: &str,
-    header_name: Option<&str>,
-) -> Result<(String, String), Box<dyn std::error::Error>> {
-    let now = now_ms();
-    let envelope = create_envelope(
-        &input.sender,
-        input.recipient.as_deref(),
-        &input.body.intent,
-        &input.body.content,
-        input.body.capability.as_deref(),
-        input.body.correlation_id.as_deref(),
-        now,
-        input.ttl_ms,
-    );
-    let signed = sign_envelope_ed25519(&envelope, private_key, &input.key_id)
-        .map_err(|e| -> Box<dyn std::error::Error> { e.into() })?;
-    let value = serde_json::to_string(&signed)?;
-    Ok((header_name.unwrap_or(DEFAULT_HEADER).to_string(), value))
-}

package/sdk/rust/src/keys.rs

@@ -1,161 +0,0 @@
-//! Key infrastructure for 7h3 Protocol — discovery, rotation, revocation.
-
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
-use std::time::{SystemTime, UNIX_EPOCH};
-
-fn now_ms() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_millis() as u64
-}
-
-/// An entry in the /.well-known/7h3-keys document.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct KeyEntry {
-    pub id: String,
-    pub algorithm: String,    // "Ed25519"
-    #[serde(rename = "publicKey")]
-    pub public_key: String,   // SPKI base64url
-    pub created: u64,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub expires: Option<u64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub revoked: Option<bool>,
-    #[serde(rename = "revokedAt", skip_serializing_if = "Option::is_none")]
-    pub revoked_at: Option<u64>,
-}
-
-/// The /.well-known/7h3-keys document.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct WellKnownKeysDocument {
-    pub version: String,  // "7h3/0.1"
-    pub updated: u64,
-    pub keys: Vec<KeyEntry>,
-}
-
-impl WellKnownKeysDocument {
-    pub fn new(keys: Vec<KeyEntry>) -> Self {
-        Self { version: "7h3/0.1".to_string(), updated: now_ms(), keys }
-    }
-
-    pub fn to_json(&self) -> Result<String, serde_json::Error> {
-        serde_json::to_string(self)
-    }
-
-    pub fn from_json(s: &str) -> Result<Self, serde_json::Error> {
-        serde_json::from_str(s)
-    }
-
-    /// Find an active (non-revoked, non-expired) public key by ID.
-    pub fn get_active_key(&self, key_id: &str) -> Option<&KeyEntry> {
-        let now = now_ms();
-        self.keys.iter().find(|k| {
-            k.id == key_id
-                && !k.revoked.unwrap_or(false)
-                && k.expires.map_or(true, |e| e > now)
-        })
-    }
-}
-
-/// Managed key pair for rotation.
-#[derive(Debug, Clone)]
-pub struct ManagedKeyPair {
-    pub id: String,
-    pub public_key: String,   // SPKI base64url
-    pub private_key: String,  // PKCS8 base64url
-    pub created: u64,
-    pub expires_at: Option<u64>,
-}
-
-/// Manages key pairs with rotation policy.
-pub struct KeyRotationManager {
-    pub max_age_ms: u64,
-    pub overlap_ms: u64,
-    keys: Arc<Mutex<Vec<ManagedKeyPair>>>,
-}
-
-impl KeyRotationManager {
-    pub fn new(max_age_ms: u64, overlap_ms: u64) -> Self {
-        Self {
-            max_age_ms,
-            overlap_ms,
-            keys: Arc::new(Mutex::new(Vec::new())),
-        }
-    }
-
-    pub fn add_key(&self, pair: ManagedKeyPair) {
-        self.keys.lock().unwrap().push(pair);
-    }
-
-    /// Returns the most recently created non-expired key.
-    pub fn get_current_key(&self) -> Option<ManagedKeyPair> {
-        let now = now_ms();
-        let keys = self.keys.lock().unwrap();
-        keys.iter()
-            .filter(|k| k.expires_at.map_or(true, |e| e > now))
-            .max_by_key(|k| k.created)
-            .cloned()
-    }
-
-    /// Build a WellKnownKeysDocument from the managed keys.
-    pub fn get_well_known_document(&self) -> WellKnownKeysDocument {
-        let now = now_ms();
-        let keys = self.keys.lock().unwrap();
-        let entries: Vec<KeyEntry> = keys.iter().map(|k| KeyEntry {
-            id: k.id.clone(),
-            algorithm: "Ed25519".to_string(),
-            public_key: k.public_key.clone(),
-            created: k.created,
-            expires: k.expires_at,
-            revoked: if k.expires_at.map_or(false, |e| e < now) { Some(true) } else { None },
-            revoked_at: None,
-        }).collect();
-        WellKnownKeysDocument::new(entries)
-    }
-}
-
-/// Tracks revoked key IDs in memory.
-#[derive(Default)]
-pub struct RevocationRegistry {
-    revoked: Arc<Mutex<HashMap<String, RevocationEntry>>>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct RevocationEntry {
-    #[serde(rename = "revokedAt")]
-    pub revoked_at: u64,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-}
-
-impl RevocationRegistry {
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    pub fn revoke(&self, key_id: &str, reason: Option<&str>) {
-        self.revoked.lock().unwrap().insert(
-            key_id.to_string(),
-            RevocationEntry { revoked_at: now_ms(), reason: reason.map(String::from) },
-        );
-    }
-
-    pub fn is_revoked(&self, key_id: &str) -> bool {
-        self.revoked.lock().unwrap().contains_key(key_id)
-    }
-
-    pub fn get_list(&self) -> serde_json::Value {
-        let revoked = self.revoked.lock().unwrap();
-        let entries: Vec<serde_json::Value> = revoked.iter().map(|(id, entry)| {
-            let mut obj = serde_json::json!({ "id": id, "revokedAt": entry.revoked_at });
-            if let Some(ref r) = entry.reason {
-                obj["reason"] = serde_json::json!(r);
-            }
-            obj
-        }).collect();
-        serde_json::json!({ "version": "7h3/0.1", "updated": now_ms(), "revokedKeys": entries })
-    }
-}