@blockcast/mmt-container 0.4.1 → 0.5.0-main.34c7b9c2cfa0

package/src/multicast-auth-catalog.ts

@@ -16,7 +16,7 @@
  */
 
 import { multicastCatalogIssues } from "@blockcast/mmt-base";
-import { manifestKeyFor, type ManifestKey } from "@blockcast/mmt-manifest-verify";
+import { bcProvenanceV2Ctx, type BcProvenanceV2Params, type BcpV2Key } from "@blockcast/mmt-manifest-verify";
 
 export type MulticastAuthScheme = "bc-provenance";
 export type MulticastAuthSig = "ed25519";
@@ -153,11 +153,13 @@ export interface ResolvedMulticastAuthFlow {
 	manifestTimerMs: number;
 	manifestTrack?: string;
 	tracks: Array<{ name: string; packetId: number }>;
+	/** `ctx` recomputed from the catalog (7.2.4); present when `namespaceFields` was given. */
+	ctx?: Uint8Array;
 }
 
 export interface ResolvedMulticastAuthConfig {
 	/** Decoded keys, ascending by `firstEpoch`. */
-	keys: ManifestKey[];
+	keys: BcpV2Key[];
 	minEpoch: number;
 	flows: ResolvedMulticastAuthFlow[];
 }
@@ -171,10 +173,19 @@ export interface ResolvedMulticastAuthConfig {
  * `firstEpoch`, the retired root key) throws, so nothing is admitted and
  * nothing falls back to unauthenticated reception. An endpoint the rules make
  * a receiver ignore yields no flow; the others still bind.
+ *
+ * `namespaceFields` are the Track Namespace Fields of the catalog track, as
+ * MOQT carries them. With them every flow carries the recomputed `ctx`, which
+ * the receiver compares against each record; without them `ctx` is carried
+ * blind (7.2.4).
  */
 export function resolveMulticastAuthCatalog(
 	catalog: unknown,
-	options: { requireAuth?: boolean; catalogNamespace?: string } = {},
+	options: {
+		requireAuth?: boolean;
+		catalogNamespace?: string;
+		namespaceFields?: readonly (string | Uint8Array)[];
+	} = {},
 ): ResolvedMulticastAuthConfig | undefined {
 	if (typeof catalog !== "object" || catalog === null || Array.isArray(catalog)) {
 		throw new Error("[multicast-auth-catalog] catalog must be an object");
@@ -192,10 +203,22 @@ export function resolveMulticastAuthCatalog(
 	}
 	const ignored = new Set(issues.map((issue) => issue.endpointIndex));
 	const endpoints = (multicast!["endpoints"] ?? []) as Array<Record<string, unknown>>;
+	const catalogTracks = ((catalog as Record<string, unknown>)["tracks"] ?? []) as Array<Record<string, unknown>>;
 	const flows: ResolvedMulticastAuthFlow[] = [];
 	endpoints.forEach((endpoint, endpointIndex) => {
 		if (ignored.has(endpointIndex)) return;
 		const flowAuth = endpoint["auth"] as EndpointAuthConfig;
+		const tracks = ((endpoint["tracks"] ?? []) as Array<{ name: string; packetId: number }>).map(({ name, packetId }) => ({
+			name,
+			packetId,
+		}));
+		let ctx: Uint8Array | undefined;
+		if (options.namespaceFields !== undefined) {
+			const params = ctxParams(catalogTracks, tracks);
+			// No catalog entry to hash: the endpoint is ignored, nothing is read unauthenticated.
+			if (params === undefined) return;
+			ctx = bcProvenanceV2Ctx(options.namespaceFields, tracks.map((track) => track.packetId), params);
+		}
 		flows.push({
 			endpointIndex,
 			source: (endpoint["sourceAddress"] ?? flowAuth.senderAddress) as string,
@@ -207,10 +230,8 @@ export function resolveMulticastAuthCatalog(
 			maxAuthDelayMs: flowAuth.maxAuthDelayMs ?? DEFAULT_MAX_AUTH_DELAY_MS,
 			manifestTimerMs: flowAuth.manifestTimerMs ?? DEFAULT_MANIFEST_TIMER_MS,
 			...(flowAuth.manifestTrack === undefined ? {} : { manifestTrack: flowAuth.manifestTrack }),
-			tracks: ((endpoint["tracks"] ?? []) as Array<{ name: string; packetId: number }>).map(({ name, packetId }) => ({
-				name,
-				packetId,
-			})),
+			tracks,
+			...(ctx === undefined ? {} : { ctx }),
 		});
 	});
 	return {
@@ -222,6 +243,55 @@ export function resolveMulticastAuthCatalog(
 	};
 }
 
+/** A positive integer that fits the u32 it is hashed as (7.2.4), else `0`. */
+function positiveInteger(value: unknown): number {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 0xffffffff ? value : 0;
+}
+
+/**
+ * `params_hash` inputs (7.2.4): the catalog entry of the endpoint's
+ * lowest-`packetId` media track or, for a repair-only endpoint, of the source
+ * its lowest-`packetId` repair track repairs (`depends`, else the track whose
+ * `fec.repairTrack` names it). A timescale or group duration that does not
+ * resolve to an integer tick count is `0`.
+ */
+function ctxParams(
+	catalogTracks: Array<Record<string, unknown>>,
+	listed: Array<{ name: string; packetId: number }>,
+): BcProvenanceV2Params | undefined {
+	const byName = new Map(catalogTracks.map((track) => [track["name"], track]));
+	const ordered = [...listed].sort((a, b) => a.packetId - b.packetId).map(({ name }) => byName.get(name));
+	let entry = ordered.find((track) => track !== undefined && track["packaging"] !== "fec-repair");
+	if (entry === undefined) {
+		const repair = ordered.find((track) => track !== undefined);
+		if (repair === undefined) return undefined;
+		const depends = repair["depends"];
+		entry = Array.isArray(depends) && depends.length === 1
+			? byName.get(depends[0])
+			: catalogTracks.find((track) => (track["fec"] as Record<string, unknown> | undefined)?.["repairTrack"] === repair["name"]);
+		if (entry === undefined) return undefined;
+	}
+	const timescale = positiveInteger(entry["timescale"]);
+	const ms = positiveInteger(entry["groupDurationMs"]);
+	const groupDurationTicks = positiveInteger(entry["groupDurationTicks"]) ||
+		positiveInteger(timescale && (ms * timescale) % 1000 === 0 ? (ms * timescale) / 1000 : 0);
+	const fec = entry["fec"] as Record<string, unknown> | undefined;
+	return {
+		codec: typeof entry["codec"] === "string" ? entry["codec"] : "",
+		timescale,
+		groupDurationTicks,
+		...(fec === undefined || fec === null ? {} : {
+			fec: {
+				algorithm: typeof fec["algorithm"] === "string" ? fec["algorithm"] : "",
+				sourceSymbols: positiveInteger(fec["sourceSymbols"]),
+				repairSymbols: positiveInteger(fec["repairSymbols"]),
+				symbolSize: positiveInteger(fec["symbolSize"]),
+				interleaveDepthMs: positiveInteger(fec["interleaveDepthMs"]),
+			},
+		}),
+	};
+}
+
 /** The key that signs a record of `kid` at `epoch`, or `undefined` when that
  * `kid` does not sign it (7.2.7: such a record is dropped before verification). */
 export function multicastAuthKeyFor(
@@ -229,5 +299,8 @@ export function multicastAuthKeyFor(
 	kid: number,
 	epoch: number,
 ): Uint8Array | undefined {
-	return manifestKeyFor(resolved.keys, epoch, kid);
+	// `keys` is ascending by firstEpoch with unique kid and firstEpoch (resolve throws otherwise).
+	const signers = resolved.keys.filter((key) => key.firstEpoch <= epoch);
+	const signer = signers[signers.length - 1];
+	return signer?.kid === kid ? signer.publicKey : undefined;
 }