@adapt-toolkit/mufl 0.8.0

package/mufl_stdlib/cryptography/attestation/attestation_document.mm

@@ -0,0 +1,68 @@
+// adapt generic attestation document
+library attestation_document loads libraries node_description, identity_proof_document_types, current_transaction_info uses transactions {
+    metadef t_platform_dependent_attestation_document: identity_proof_document_types::t_platform_dependent_attestation_document.
+
+    metadef t_attestation_document: identity_proof_document_types::t_attestation_document.
+  
+    metadef t_create: identity_proof_document_types::t_create.
+
+    metadef t_validate: identity_proof_document_types::t_validate.
+
+    metadef t_attestation_document_interface: identity_proof_document_types::t_attestation_document_interface.
+
+    module interface {
+        hidden {
+            interfaces IS t_attestation_document_interface[] = (,).
+        }
+
+        add_interface = fn (id: int, i: t_attestation_document_interface) {
+            abort provisional "Validation function for attestation document with given id(" + (_str id) + ") already defined." WHEN interfaces id != NIL.
+            interfaces id -> i.
+        }
+
+        get_interface = fn (id: int) -> t_attestation_document_interface {
+            RETURN (interfaces id|).
+        }
+
+        get_creator = fn (id: int) -> t_create {
+            RETURN (interfaces id|) $create.
+        }
+
+        get_validator = fn (id: int) -> t_validate {
+            RETURN (interfaces id|) $validate.
+        }
+    }
+
+    
+    // aborts when validation is failed,) -> TRUE, when succeed
+    validate = fn (ad: t_attestation_document, node_dsc: node_description::t_node_description, timestamp: time) -> bool {
+        ad => ($platform_type_id -> platform_type_id, $platform_dependent_attestation_document -> platform_dependent_attestation_document).
+        abort provisional "Invalid attestation_document type" WHEN (interface::get_interface platform_type_id) == NIL.
+
+        RETURN (interface::get_validator platform_type_id) platform_dependent_attestation_document node_dsc timestamp.
+    }
+
+    create = fn (_) -> t_attestation_document {
+        id = _get_platform_type_id().
+        abort provisional "Invalid platform type id provided." WHEN (interface::get_interface id) == NIL.
+        node_dsc = node_description::create().
+        RETURN (interface::get_creator id) node_dsc.
+    }
+
+    trn readonly create _ 
+    { 
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return create (). 
+    }
+
+    trn readonly validate 
+    _:(
+        $ad -> ad: t_attestation_document,
+        $node_dsc -> node_dsc: node_description::t_node_description,
+        $timestamp -> timestamp: time )
+    {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return validate ad node_dsc timestamp.
+    }
+    
+}

package/mufl_stdlib/cryptography/attestation/config.mufl

@@ -0,0 +1,12 @@
+config script {
+    (
+        $exports->(
+            $libraries->(,),
+            $applications->(,)
+        ), 
+        $imports->(
+            $libraries->(config_load #"../..") $imports $libraries,
+            $applications->(,)
+        )
+    ).
+}

package/mufl_stdlib/cryptography/attestation/container_associated_data.mm

@@ -0,0 +1,12 @@
+library container_associated_data loads libraries control_packet_identity_proof_document, identity_proof_document_types {
+    metadef t_container_associated_data: identity_proof_document_types::t_container_associated_data.
+    
+    create = fn (_) -> t_container_associated_data {
+
+        control_packet_ip_document_hash is hash_code+ = NIL.
+        if _get_platform_type_id() == _get_nitro_platform_type_id() {
+            control_packet_ip_document_hash -> control_packet_identity_proof_document::get_hash().
+        }
+        RETURN ($code_id -> _get_code_id(), $container_id -> _get_container_id(), $control_packet_ip_document_hash -> control_packet_ip_document_hash).
+    }
+}

package/mufl_stdlib/cryptography/attestation/control_packet_identity_proof_document.mm

@@ -0,0 +1,36 @@
+library control_packet_identity_proof_document loads libraries identity_proof_document_types, current_transaction_info uses transactions
+{
+    is_control_packet is bool = NIL.
+
+    hidden
+    {
+        __ip_doc is identity_proof_document_types::t_identity_proof_document+ = NIL.
+    }
+
+    get_hash = fn (_) -> hash_code+
+    {
+        if (_get_platform_type_id() != _get_nitro_platform_type_id()) || is_control_packet { 
+            return NIL. 
+        }
+
+        if _is_test_mode() && !__ip_doc {
+            return NIL.
+        }
+
+        abort "Control packet identity proof document wasn't set" when !__ip_doc.
+        
+        return _value_id __ip_doc?.
+    }
+
+    trn set_identity_proof_document
+    ip_doc: ?(__ip_doc?)
+    {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        platform_type_id = ip_doc $attestation_document $platform_type_id.
+        abort "Invalid platform type id of control packet identity proof document." when (platform_type_id != _get_nitro_platform_type_id() && !(_is_test_mode())).
+        __ip_doc -> ip_doc.
+        return ::transaction::success [].
+    }
+
+
+}

package/mufl_stdlib/cryptography/attestation/identity_proof_document_impl.mm

@@ -0,0 +1,57 @@
+library identity_proof_document_impl loads libraries identity_proof_document_types, node_description, attestation_document, 
+        key_storage, address_document, address_document_types, platform_dependent_attestation_document 
+{
+    metadef t_identity_proof_document: identity_proof_document_types::t_identity_proof_document.
+
+    validate_signature = fn (hash: hash_code, signature: crypto_signature) -> bool {
+        RETURN key_storage::check_signature hash signature.
+    }
+
+    hidden {
+        validate_signature_by_authorizing_container = fn (hash: hash_code, signature: crypto_signature) -> bool {
+            RETURN address_document::check_signature_by_authorizing_container hash signature.
+        }
+    }
+
+    validate = fn (ip_document: t_identity_proof_document, timestamp: time) -> bool {
+        ip_document => ($node_description -> node_dsc, $attestation_document -> ad).
+        identity = node_dsc $address_document $identity.
+        sign_key_id = identity $default_keys $SIGN.
+        sign_pub IS publickey_sign+ = NIL.
+        sc identity $key_list -- (k->) {
+            if _crypto_get_key_id k == sign_key_id {
+                sign_pub -> k SAFE(publickey_sign).
+                break.
+            }
+        }
+        abort "SIGN key not found in identity key_list" WHEN sign_pub == NIL.
+        abort "Identity proof: container id does not commit to signing key"
+            WHEN (key_storage::address_of_key sign_pub?) != (identity $container_id).
+        identity_hash = _value_id identity.
+        ad_self_sig_valid IS bool = FALSE.
+        sc (node_dsc $address_document $authorizations) -- (sig ->) {
+            if (_crypto_verify_hash_signature identity_hash sig sign_pub?) != NIL {
+                ad_self_sig_valid -> TRUE.
+                break.
+            }
+        }
+        abort "Identity proof: address document self-signature is invalid" WHEN !ad_self_sig_valid.
+        RETURN (attestation_document::validate ad node_dsc timestamp).
+    }
+
+
+    authorize_signature = fn (ad: address_document_types::t_address_document, signature: crypto_signature, no_check_for_authorizations: bool) {
+        // validate signature of the address document. It now could be signed by any container in the current network. Maybe should be accepted only signature from authorizing containers.
+        ad_hash = _value_id ad.
+        abort provisional "Invalid signature of address document." WHEN !(validate_signature ad_hash signature).
+        // register container in the current network
+        address_document::process_address_document ad no_check_for_authorizations. // TODO: how to pass no_check_for_authorizations parameter. Maybe is should not be accested as an argument.
+    }
+
+    create = fn (_) -> t_identity_proof_document {
+        node_dsc = node_description::create().
+        ad = platform_dependent_attestation_document::get_attestation_document (_get_platform_type_id()). 
+        RETURN ($node_description -> node_dsc, $attestation_document -> ad).
+    }
+
+}

package/mufl_stdlib/cryptography/attestation/identity_proof_document_types.mm

@@ -0,0 +1,45 @@
+library identity_proof_document_types loads library address_document_types {
+    metadef t_container_associated_data: (
+        $code_id -> hash_code,
+        $container_id -> global_id,
+        $control_packet_ip_document_hash -> hash_code+ // NILable, since a control packet is only available in the enclave environment
+    ). // and other data in the future
+
+    metadef t_node_description: (
+        $address_document -> address_document_types::t_address_document,
+        $container_associated_data -> t_container_associated_data
+    ).
+    
+    metadef t_platform_dependent_attestation_document: any.
+
+    metadef t_attestation_document: ($platform_dependent_attestation_document -> t_platform_dependent_attestation_document,
+                                     $platform_type_id -> int).
+  
+    metadef t_create: (t_node_description->t_attestation_document).
+
+    metadef t_validate: (t_platform_dependent_attestation_document->t_node_description->time->bool).
+
+    metadef t_attestation_document_interface: (
+        $create -> t_create,
+        $validate -> t_validate
+    ).
+
+
+    metadef t_identity_proof_document: (
+        $node_description -> t_node_description,
+        $attestation_document -> t_attestation_document
+    ).
+
+    hidden {
+        m_my_ipd IS t_identity_proof_document+ = NIL.
+    }
+
+    set_my_ipd = fn (ipd: t_identity_proof_document) -> nil {
+        m_my_ipd -> ipd.
+    }
+
+    get_my_ipd = fn (_) -> t_identity_proof_document+ {
+        RETURN m_my_ipd.
+    }
+
+}

package/mufl_stdlib/cryptography/attestation/node_description.mm

@@ -0,0 +1,9 @@
+library node_description loads libraries address_document, container_associated_data, identity_proof_document_types {
+    metadef t_node_description: identity_proof_document_types::t_node_description.
+
+    create = fn (_) -> t_node_description {
+        ad = address_document::get_my_address_document().
+        associated_data = container_associated_data::create().
+        return ($address_document -> ad, $container_associated_data -> associated_data).
+    }
+}

package/mufl_stdlib/cryptography/attestation/platform_dependent_attestation_document/browser/browser_attestation_document.mm

@@ -0,0 +1,25 @@
+library browser_attestation_document loads libraries platform_dependent_attestation_document, node_description, attestation_document {
+
+    metadef type: ($user_data -> hash_code).
+
+    _create_browser_ad = fn (user_data: hash_code) -> type {
+        RETURN ($user_data -> user_data).
+    }
+
+    hidden {
+        type_id = platform_dependent_attestation_document::platform_type::wasm_browser.
+        create = fn (node_description: node_description::t_node_description) -> attestation_document::t_attestation_document{
+            ad = _create_browser_ad (_value_id node_description).
+            RETURN (
+                $platform_dependent_attestation_document -> ad,
+                $platform_type_id -> type_id
+            ).
+        }
+
+        validate = fn (ad: any, node_dsc: node_description::t_node_description, timestamp: time) -> bool {
+            RETURN TRUE.
+        }
+
+        attestation_document::interface::add_interface type_id ($create -> create as(attestation_document::t_create), $validate -> validate as(attestation_document::t_validate)).
+    }
+}

package/mufl_stdlib/cryptography/attestation/platform_dependent_attestation_document/browser/config.mufl

@@ -0,0 +1,12 @@
+config script {
+    (
+        $exports->(
+            $libraries->(,),
+            $applications->(,)
+        ), 
+        $imports->(
+            $libraries->(config_load #"../../../..") $imports $libraries,
+            $applications->(,)
+        )
+    ).
+}

package/mufl_stdlib/cryptography/attestation/platform_dependent_attestation_document/config.mufl

@@ -0,0 +1,12 @@
+config script {
+    (
+        $exports->(
+            $libraries->(,),
+            $applications->(,)
+        ), 
+        $imports->(
+            $libraries->(config_load #"../../..") $imports $libraries,
+            $applications->(,)
+        )
+    ).
+}

package/mufl_stdlib/cryptography/attestation/platform_dependent_attestation_document/native/config.mufl

@@ -0,0 +1,12 @@
+config script {
+    (
+        $exports->(
+            $libraries->(,),
+            $applications->(,)
+        ), 
+        $imports->(
+            $libraries->(config_load #"../../../..") $imports $libraries,
+            $applications->(,)
+        )
+    ).
+}

package/mufl_stdlib/cryptography/attestation/platform_dependent_attestation_document/native/native_attestation_document.mm

@@ -0,0 +1,25 @@
+library native_attestation_document loads libraries platform_dependent_attestation_document, node_description, attestation_document {
+
+    metadef type: ($user_data -> hash_code).
+
+    _create_native_ad = fn (user_data: hash_code) -> type {
+        RETURN ($user_data -> user_data).
+    }
+
+    hidden {
+        type_id = platform_dependent_attestation_document::platform_type::node_js.
+        create = fn (node_description: node_description::t_node_description) -> attestation_document::t_attestation_document{
+            ad = _create_native_ad (_value_id node_description).
+            RETURN (
+                $platform_dependent_attestation_document -> ad,
+                $platform_type_id -> type_id
+            ).
+        }
+
+        validate = fn (ad: any, node_dsc: node_description::t_node_description, timestamp: time) -> bool {
+            RETURN TRUE.
+        }
+
+        attestation_document::interface::add_interface type_id ($create -> create as(attestation_document::t_create), $validate -> validate as(attestation_document::t_validate)).
+    }
+}

package/mufl_stdlib/cryptography/attestation/platform_dependent_attestation_document/platform_dependent_attestation_document.mm

@@ -0,0 +1,57 @@
+library platform_dependent_attestation_document loads libraries attestation_document, node_description, current_transaction_info uses transactions {
+    module platform_type {
+        hidden
+        {
+            platform_names is (int->>str) = (,).
+            add = fn (idx: int, name: str) -> int {
+                abort "Platform with given index already exists." when (_has platform_names idx).
+                platform_names idx -> name.
+                return idx.
+            }
+        }
+        enclave = add _get_nitro_platform_type_id() "enclave".
+        node_js = add _get_native_platform_type_id() "node js".
+        wasm_browser = add _get_wasm_platform_type_id() "wasm browser".   
+
+        get_platform_name = fn (id: int) -> str {
+            abort provisional "Invalid platform type id." when !(_has platform_names id).
+            return (platform_names id|).
+        }
+    }
+
+    hidden {
+        current_platform is int = _get_platform_type_id().
+        attestation_document is attestation_document::t_attestation_document+ = NIL.
+    }
+
+    get_attestation_document = fn (platform_type_id: int) -> attestation_document::t_attestation_document {
+        abort provisional "Attestation document is not loaded. Consider executing transation ::platform_dependent_attestation_document::load_attestation_document." when attestation_document == NIL.
+        abort provisional 
+            "Platform mismatch. Attestation document platform: " + 
+            (platform_type::get_platform_name current_platform) + 
+            ", expected platform: " + 
+            (platform_type::get_platform_name platform_type_id) 
+        when platform_type_id != current_platform.  
+        return attestation_document?.
+    }
+
+    trn load_attestation_document
+        ad: attestation_document::t_attestation_document {
+            current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+            ad => ($platform_dependent_attestation_document -> _, $platform_type_id -> type_id).
+            abort 
+                "Platform mismatch. Attestation document platform: " + 
+                (platform_type::get_platform_name current_platform) + 
+                ", expected platform: " + 
+                (platform_type::get_platform_name type_id) 
+            when current_platform != type_id.
+            attestation_document -> ad.
+         
+            return transaction::success [].
+        }
+        
+    create = fn (_) {
+        ad = ::attestation_document::create ().
+        return ad.
+    }
+}

package/mufl_stdlib/cryptography/authorizing_container.mm

@@ -0,0 +1,21 @@
+library authorizing_container loads libraries address_document_types, key_storage uses transactions {
+
+    trn sign_ad
+   _: ($ad -> ad: address_document_types::t_address_document){
+        // TODO: check if container registered
+        signature = key_storage::default_sign (_value_id ad).
+        cid = ad $identity $container_id.
+        encrypted_trn = transaction::encrypt ($cid -> cid, $trn -> ($name -> "::address_document::save_ad_signature", $targ -> ($authorizing_container_id -> _get_container_id(), $signature -> signature)), $isemsignature -> TRUE).
+        RETURN transaction::success [
+            transaction::action::send cid encrypted_trn
+        ].
+    }
+
+    trn resend_encrypted
+    _:($trn->tn:($name->str, $targ->any), $target_container_id->cid: global_id) {
+        encrypted_trn = transaction::encrypt ($cid->cid, $trn->tn, $isemsignature->TRUE).
+        RETURN transaction::success [
+            transaction::action::send cid encrypted_trn
+        ].
+    }
+}

package/mufl_stdlib/cryptography/config.mufl

@@ -0,0 +1,12 @@
+config script {
+    (
+        $exports->(
+            $libraries->(,),
+            $applications->(,)
+        ),
+        $imports->(
+            $libraries->(config_load #"..") $imports $libraries,
+            $applications->(,)
+        )
+    ).
+}

package/mufl_stdlib/cryptography/encrypted_channel.mm

@@ -0,0 +1,95 @@
+library encrypted_channel
+loads libraries
+  current_transaction_info,
+  identity_proof_document,
+  attestation_document,
+  browser_attestation_document,
+  address_document,
+  address_document_types,
+  continuation,
+  key_storage
+uses transactions
+{
+  using address_document.
+
+  hidden {
+    _read_or_abort is (bin->any) = fn (_: bin) { abort "_read_or_abort primitive is unset in this library." when TRUE. }
+
+    debug_mode is bool = FALSE.
+  }
+
+  init = fn (_:($_read_or_abort -> read: (bin->any)))
+  {
+      _read_or_abort -> read.
+  }
+
+  fn set_debug_mode (is_debug: bool) {
+    debug_mode -> is_debug.
+  }
+
+  metadef tx_body_t: (
+    $name -> str,
+    $targ -> any
+  ).
+
+  fn send_encrypted_tx(receiver_id: global_id, tx_body: tx_body_t) -> transaction::action::type
+  {
+    if (debug_mode) {
+      return transaction::action::send receiver_id tx_body.
+    }
+    abort "Receiver is not authorized" when key_storage::is_container_registered(receiver_id) != TRUE.
+    encrypted_trn = transaction::encrypt (
+      $cid -> receiver_id,
+      $trn -> tx_body,
+      $isemsignature -> TRUE
+    ).
+    return transaction::action::send receiver_id encrypted_trn.
+  }
+
+  fn check_encrypted_or_abort(_) {
+    if (debug_mode) {
+      return.
+    }
+    abort "Transaction is expected to be encrypted!" when not current_transaction_info::is_encrypted().
+  }
+
+  fn execute_transaction(
+    destination_packet_id: global_id,
+    transaction_producer: any -> transaction::results::type
+  ) -> transaction::results::type
+  {
+    if (debug_mode || key_storage::is_container_registered(destination_packet_id)) {
+      return transaction_producer().
+    }
+
+    return continuation::set_breakpoint
+      (fn(continuation_id: global_id) -> transaction::results::type {
+        return transaction::success [
+          transaction::action::send destination_packet_id (
+            $name -> "::encrypted_channel::request_identity",
+            $targ -> ($continuation_id -> continuation_id, $ad -> get_my_address_document()))
+        ].
+      })
+      (fn(safe _:($peer_ad -> peer_ad: address_document_types::t_address_document)) -> transaction::results::type {
+        abort "encrypted_channel: identity reply from unexpected address"
+          when (peer_ad $identity $container_id) != destination_packet_id.
+        process_address_document peer_ad TRUE.
+        return transaction_producer().
+      }).
+  }
+
+  trn request_identity _:(
+    $continuation_id -> client_continuation_id: global_id,
+    $ad -> requester_ad: address_document_types::t_address_document)
+  {
+    sender_id = current_transaction_info::get_external_envelope_or_abort() $from.
+    abort "Identity request from unexpected address"
+      when (requester_ad $identity $container_id) != sender_id.
+    process_address_document requester_ad TRUE.
+    return transaction::success [
+      transaction::action::send sender_id (
+        $name -> "::continuation::continue_transaction",
+        $targ -> ($id -> client_continuation_id, $args -> ($peer_ad -> get_my_address_document())))
+    ].
+  }
+}