@dxos/client-services 0.1.0

package/src/packlets/identity/identity-manager.test.ts

@@ -0,0 +1,121 @@
+//
+// Copyright 2022 DXOS.org
+//
+
+import expect from 'expect';
+
+import { valueEncoding, MetadataStore } from '@dxos/echo-db';
+import { FeedFactory, FeedStore } from '@dxos/feed-store';
+import { Keyring } from '@dxos/keyring';
+import { MemorySignalManager, MemorySignalManagerContext } from '@dxos/messaging';
+import { ModelFactory } from '@dxos/model-factory';
+import { MemoryTransportFactory, NetworkManager } from '@dxos/network-manager';
+import { ObjectModel } from '@dxos/object-model';
+import type { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
+import { createStorage, Storage, StorageType } from '@dxos/random-access-storage';
+import { afterTest } from '@dxos/testutils';
+
+import { IdentityManager } from './identity-manager';
+
+describe('identity/identity-manager', function () {
+  const setupPeer = async ({
+    signalContext = new MemorySignalManagerContext(),
+    storage = createStorage({ type: StorageType.RAM })
+  }: {
+    signalContext?: MemorySignalManagerContext;
+    storage?: Storage;
+  } = {}) => {
+    const metadataStore = new MetadataStore(storage.createDirectory('metadata'));
+
+    const keyring = new Keyring(storage.createDirectory('keyring'));
+    const feedStore = new FeedStore<FeedMessage>({
+      factory: new FeedFactory<FeedMessage>({
+        root: storage.createDirectory('feeds'),
+        signer: keyring,
+        hypercore: {
+          valueEncoding
+        }
+      })
+    });
+
+    afterTest(() => feedStore.close());
+
+    const networkManager = new NetworkManager({
+      signalManager: new MemorySignalManager(signalContext),
+      transportFactory: MemoryTransportFactory
+    });
+
+    const identityManager = new IdentityManager(
+      metadataStore,
+      feedStore,
+      keyring,
+      networkManager,
+      new ModelFactory().registerModel(ObjectModel)
+    );
+
+    return {
+      identityManager,
+      feedStore
+    };
+  };
+
+  it('creates identity', async function () {
+    const { identityManager } = await setupPeer();
+    await identityManager.open();
+    afterTest(() => identityManager.close());
+
+    const identity = await identityManager.createIdentity();
+    expect(identity).toBeTruthy();
+  });
+
+  it('reload from storage', async function () {
+    const storage = createStorage({ type: StorageType.RAM });
+
+    const peer1 = await setupPeer({ storage });
+    await peer1.identityManager.open();
+    const identity1 = await peer1.identityManager.createIdentity();
+    await peer1.identityManager.close();
+    await peer1.feedStore.close();
+
+    const peer2 = await setupPeer({ storage });
+    await peer2.identityManager.open();
+
+    expect(peer2.identityManager.identity).toBeDefined();
+    expect(peer2.identityManager.identity!.identityKey).toEqual(identity1.identityKey);
+    expect(peer2.identityManager.identity!.deviceKey).toEqual(identity1.deviceKey);
+
+    // TODO(dmaretskyi): Check that identity is "alive" (space is working and can write mutations).
+  });
+
+  it('admit another device', async function () {
+    const signalContext = new MemorySignalManagerContext();
+
+    const peer1 = await setupPeer({ signalContext });
+    const identity1 = await peer1.identityManager.createIdentity();
+
+    const peer2 = await setupPeer({ signalContext });
+
+    // Identity2 is not yet ready at this point. Peer1 needs to admit peer2 device key and feed keys.
+    const identity2 = await peer2.identityManager.acceptIdentity({
+      identityKey: identity1.identityKey,
+      haloSpaceKey: identity1.haloSpaceKey,
+      haloGenesisFeedKey: identity1.haloGenesisFeedKey
+    });
+
+    await identity1.controlPipeline.writer.write({
+      '@type': 'dxos.echo.feed.CredentialsMessage',
+      credential: await identity1.getIdentityCredentialSigner().createCredential({
+        subject: identity2.deviceKey,
+        assertion: {
+          '@type': 'dxos.halo.credentials.AuthorizedDevice',
+          identityKey: identity2.identityKey,
+          deviceKey: identity2.deviceKey
+        }
+      })
+    });
+
+    // TODO(dmaretskyi): We'd also need to admit device2's feeds otherwise messages from them won't be processed by the pipeline.
+    // This would mean that peer2 has replicated it's device credential chain from peer1 and is ready to issue credentials.
+    await identity2.ready();
+  });
+});

package/src/packlets/identity/identity-manager.ts

@@ -0,0 +1,207 @@
+//
+// Copyright 2022 DXOS.org
+//
+
+import assert from 'assert';
+
+import { Event } from '@dxos/async';
+import { CredentialGenerator } from '@dxos/credentials';
+import {
+  MOCK_AUTH_PROVIDER,
+  MOCK_AUTH_VERIFIER,
+  MetadataStore,
+  Space,
+  SwarmIdentity,
+  Database,
+  SpaceProtocol
+} from '@dxos/echo-db';
+import { FeedStore } from '@dxos/feed-store';
+import { Keyring } from '@dxos/keyring';
+import { PublicKey } from '@dxos/keys';
+import { log } from '@dxos/log';
+import { ModelFactory } from '@dxos/model-factory';
+import { NetworkManager, Plugin } from '@dxos/network-manager';
+import { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
+import { AdmittedFeed, IdentityRecord, SpaceRecord } from '@dxos/protocols/proto/dxos/halo/credentials';
+
+import { Identity } from '../identity';
+
+interface ConstructSpaceParams {
+  spaceRecord: SpaceRecord;
+  swarmIdentity: SwarmIdentity;
+  networkPlugins?: Plugin[];
+}
+
+export type JoinIdentityParams = {
+  identityKey: PublicKey;
+  haloSpaceKey: PublicKey;
+  haloGenesisFeedKey: PublicKey;
+};
+
+// TODO(dmaretskyi): Rename: represents the peer's state machine.
+export class IdentityManager {
+  readonly stateUpdate = new Event();
+
+  private _identity?: Identity;
+
+  // TODO(burdon): IdentityManagerParams.
+  // TODO(dmaretskyi): Perhaps this should take/generate the peerKey outside of an initialized identity.
+  constructor(
+    private readonly _metadataStore: MetadataStore,
+    private readonly _feedStore: FeedStore<FeedMessage>,
+    private readonly _keyring: Keyring,
+    private readonly _networkManager: NetworkManager,
+    private readonly _modelFactory: ModelFactory
+  ) {}
+
+  get identity() {
+    return this._identity;
+  }
+
+  async open() {
+    await this._metadataStore.load();
+
+    const identityRecord = this._metadataStore.getIdentityRecord();
+    if (identityRecord) {
+      this._identity = await this._constructIdentity(identityRecord);
+      await this._identity.open();
+      await this._identity.ready();
+      this.stateUpdate.emit();
+    }
+  }
+
+  async close() {
+    await this._identity?.close();
+  }
+
+  private async _constructIdentity(identityRecord: IdentityRecord) {
+    assert(!this._identity);
+    log('constructing identity', { identityRecord });
+
+    const space = await this._constructSpace({
+      spaceRecord: identityRecord.haloSpace,
+      swarmIdentity: {
+        peerKey: identityRecord.deviceKey,
+        credentialProvider: MOCK_AUTH_PROVIDER,
+        credentialAuthenticator: MOCK_AUTH_VERIFIER
+      }
+    });
+
+    log('done', { identityKey: identityRecord.identityKey });
+    return new Identity({
+      space,
+      signer: this._keyring,
+      identityKey: identityRecord.identityKey,
+      deviceKey: identityRecord.deviceKey
+    });
+  }
+
+  private async _constructSpace({ spaceRecord, swarmIdentity }: ConstructSpaceParams) {
+    const controlFeed = await this._feedStore.openFeed(spaceRecord.writeControlFeedKey, { writable: true });
+    const dataFeed = await this._feedStore.openFeed(spaceRecord.writeDataFeedKey, { writable: true });
+
+    // The genesis feed will be the same as the control feed if the space was created by the local agent.
+    // NOTE: Must be initialized after writable feeds so that it is in a writable state.
+    const genesisFeed = await this._feedStore.openFeed(spaceRecord.genesisFeedKey);
+
+    const protocol = new SpaceProtocol({
+      topic: spaceRecord.spaceKey,
+      identity: swarmIdentity,
+      networkManager: this._networkManager
+    });
+
+    return new Space({
+      spaceKey: spaceRecord.spaceKey,
+      protocol,
+      genesisFeed,
+      controlFeed,
+      dataFeed,
+      feedProvider: (feedKey) => this._feedStore.openFeed(feedKey),
+      databaseFactory: async ({ databaseBackend }) =>
+        new Database(this._modelFactory, databaseBackend, swarmIdentity.peerKey)
+    });
+  }
+
+  async createIdentity() {
+    assert(!this._identity, 'Identity already exists.');
+    log('creating identity...');
+
+    const controlFeedKey = await this._keyring.createKey();
+    const identityRecord: IdentityRecord = {
+      identityKey: await this._keyring.createKey(),
+      deviceKey: await this._keyring.createKey(),
+      haloSpace: {
+        spaceKey: await this._keyring.createKey(),
+        genesisFeedKey: controlFeedKey,
+        writeControlFeedKey: controlFeedKey,
+        writeDataFeedKey: await this._keyring.createKey()
+      }
+    };
+
+    const identity = await this._constructIdentity(identityRecord);
+    await identity.open();
+
+    {
+      const generator = new CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
+      const credentials = [
+        // Space genesis.
+        ...(await generator.createSpaceGenesis(
+          identityRecord.haloSpace.spaceKey,
+          identityRecord.haloSpace.genesisFeedKey
+        )),
+
+        // Feed admission.
+        await generator.createFeedAdmission(
+          identityRecord.haloSpace.spaceKey,
+          identityRecord.haloSpace.writeDataFeedKey,
+          AdmittedFeed.Designation.DATA
+        ),
+
+        // Device authorization (writes device chain).
+        await generator.createDeviceAuthorization(identityRecord.deviceKey)
+      ];
+
+      for (const credential of credentials) {
+        await identity.controlPipeline.writer.write({
+          '@type': 'dxos.echo.feed.CredentialsMessage',
+          credential
+        });
+      }
+    }
+
+    // await this._keyring.deleteKey(identityRecord.identity_key);
+    // await this._keyring.deleteKey(identityRecord.halo_space.space_key);
+
+    await this._metadataStore.setIdentityRecord(identityRecord);
+    this._identity = identity;
+    await this._identity.ready();
+    this.stateUpdate.emit();
+
+    log('created identity', { identityKey: identity.identityKey });
+    return identity;
+  }
+
+  /**
+   * Accept an existing identity. Expects it's device key to be authorized.
+   */
+  async acceptIdentity(params: JoinIdentityParams) {
+    log('accepting identity', { params });
+    assert(!this._identity, 'Identity already exists.');
+
+    const identity = await this._constructIdentity({
+      identityKey: params.identityKey,
+      deviceKey: await this._keyring.createKey(),
+      haloSpace: {
+        spaceKey: params.haloSpaceKey,
+        genesisFeedKey: params.haloGenesisFeedKey,
+        writeControlFeedKey: await this._keyring.createKey(),
+        writeDataFeedKey: await this._keyring.createKey()
+      }
+    });
+
+    await identity.open();
+    this._identity = identity;
+    this.stateUpdate.emit();
+    return identity;
+  }
+}

package/src/packlets/identity/identity.test.ts

@@ -0,0 +1,295 @@
+//
+// Copyright 2022 DXOS.org
+//
+
+import expect from 'expect';
+
+import { CredentialGenerator, verifyCredential, createCredentialSignerWithKey } from '@dxos/credentials';
+import { valueEncoding, Database, MOCK_AUTH_PROVIDER, MOCK_AUTH_VERIFIER, Space, SpaceProtocol } from '@dxos/echo-db';
+import { FeedFactory, FeedStore } from '@dxos/feed-store';
+import { Keyring } from '@dxos/keyring';
+import { PublicKey } from '@dxos/keys';
+import { MemorySignalManager, MemorySignalManagerContext } from '@dxos/messaging';
+import { ModelFactory } from '@dxos/model-factory';
+import { MemoryTransportFactory, NetworkManager } from '@dxos/network-manager';
+import { ObjectModel } from '@dxos/object-model';
+import { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
+import { AdmittedFeed } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { createStorage, StorageType } from '@dxos/random-access-storage';
+import { afterTest } from '@dxos/testutils';
+
+import { createHaloAuthProvider, createHaloAuthVerifier } from './authenticator';
+import { Identity } from './identity';
+
+const modelFactory = new ModelFactory().registerModel(ObjectModel);
+
+describe('identity/identity', function () {
+  it('create', async function () {
+    const keyring = new Keyring();
+    const identityKey = await keyring.createKey();
+    const deviceKey = await keyring.createKey();
+    const spaceKey = await keyring.createKey();
+
+    const feedStore = new FeedStore<FeedMessage>({
+      factory: new FeedFactory<FeedMessage>({
+        root: createStorage({ type: StorageType.RAM }).createDirectory(),
+        signer: keyring,
+        hypercore: {
+          valueEncoding
+        }
+      })
+    });
+
+    const createFeed = async () => {
+      const feedKey = await keyring.createKey();
+      return feedStore.openFeed(feedKey, { writable: true });
+    };
+
+    const controlFeed = await createFeed();
+    const dataFeed = await createFeed();
+
+    const protocol = new SpaceProtocol({
+      topic: spaceKey,
+      identity: {
+        peerKey: identityKey,
+        credentialProvider: createHaloAuthProvider(createCredentialSignerWithKey(keyring, deviceKey)),
+        credentialAuthenticator: createHaloAuthVerifier(() => identity.authorizedDeviceKeys)
+      },
+      networkManager: new NetworkManager({
+        signalManager: new MemorySignalManager(new MemorySignalManagerContext()),
+        transportFactory: MemoryTransportFactory
+      })
+    });
+
+    const space: Space = new Space({
+      spaceKey,
+      protocol,
+      genesisFeed: controlFeed,
+      controlFeed,
+      dataFeed,
+      feedProvider: (feedKey) => feedStore.openFeed(feedKey),
+      databaseFactory: async ({ databaseBackend }) => new Database(modelFactory, databaseBackend, deviceKey)
+    });
+
+    const identity = new Identity({
+      signer: keyring,
+      identityKey,
+      deviceKey,
+      space
+    });
+
+    await identity.open();
+    afterTest(() => identity.close());
+
+    //
+    // Identity genesis
+    //
+    {
+      const generator = new CredentialGenerator(keyring, identityKey, deviceKey);
+      const credentials = [
+        ...(await generator.createSpaceGenesis(spaceKey, controlFeed.key)),
+        await generator.createDeviceAuthorization(deviceKey),
+        await generator.createFeedAdmission(spaceKey, dataFeed.key, AdmittedFeed.Designation.DATA)
+      ];
+
+      for (const credential of credentials) {
+        await identity.controlPipeline.writer.write({
+          '@type': 'dxos.echo.feed.CredentialsMessage',
+          credential
+        });
+      }
+    }
+
+    // Wait for identity to be ready.
+    await identity.ready();
+    const identitySigner = identity.getIdentityCredentialSigner();
+    const credential = await identitySigner.createCredential({
+      subject: identityKey,
+      assertion: {
+        '@type': 'dxos.halo.credentials.IdentityProfile',
+        profile: {
+          displayName: 'Alice'
+        }
+      }
+    });
+
+    expect(credential.issuer).toEqual(identityKey);
+    expect(await verifyCredential(credential)).toEqual({ kind: 'pass' });
+  });
+
+  it('two devices', async function () {
+    const signalContext = new MemorySignalManagerContext();
+
+    let spaceKey: PublicKey;
+    let genesisFeedKey: PublicKey;
+    let identity1: Identity;
+    let identity2: Identity;
+
+    //
+    // First device
+    //
+    {
+      const keyring = new Keyring();
+      const identityKey = await keyring.createKey();
+      const deviceKey = await keyring.createKey();
+      spaceKey = await keyring.createKey();
+
+      const feedStore = new FeedStore<FeedMessage>({
+        factory: new FeedFactory<FeedMessage>({
+          root: createStorage({ type: StorageType.RAM }).createDirectory(),
+          signer: keyring,
+          hypercore: {
+            valueEncoding
+          }
+        })
+      });
+
+      const createFeed = async () => {
+        const feedKey = await keyring.createKey();
+        return feedStore.openFeed(feedKey, { writable: true });
+      };
+
+      const controlFeed = await createFeed();
+      genesisFeedKey = controlFeed.key;
+
+      const dataFeed = await createFeed();
+
+      const protocol = new SpaceProtocol({
+        topic: spaceKey,
+        identity: {
+          peerKey: deviceKey,
+          credentialProvider: MOCK_AUTH_PROVIDER, // createHaloAuthProvider(createCredentialSignerWithKey(keyring, device_key)),
+          credentialAuthenticator: MOCK_AUTH_VERIFIER // createHaloAuthVerifier(() => identity.authorizedDeviceKeys),
+        },
+        networkManager: new NetworkManager({
+          signalManager: new MemorySignalManager(signalContext),
+          transportFactory: MemoryTransportFactory
+        })
+      });
+
+      const space = new Space({
+        spaceKey,
+        protocol,
+        genesisFeed: controlFeed,
+        controlFeed,
+        dataFeed,
+        feedProvider: (feedKey) => feedStore.openFeed(feedKey),
+        databaseFactory: async ({ databaseBackend }) => new Database(modelFactory, databaseBackend, deviceKey)
+      });
+
+      const identity = (identity1 = new Identity({
+        signer: keyring,
+        identityKey,
+        deviceKey,
+        space
+      }));
+
+      await identity.open();
+      afterTest(() => identity.close());
+
+      //
+      // Identity genesis
+      //
+      {
+        const generator = new CredentialGenerator(keyring, identityKey, deviceKey);
+        const credentials = [
+          ...(await generator.createSpaceGenesis(spaceKey, controlFeed.key)),
+          await generator.createDeviceAuthorization(deviceKey),
+          await generator.createFeedAdmission(spaceKey, dataFeed.key, AdmittedFeed.Designation.DATA)
+        ];
+
+        for (const credential of credentials) {
+          await identity.controlPipeline.writer.write({
+            '@type': 'dxos.echo.feed.CredentialsMessage',
+            credential
+          });
+        }
+      }
+
+      // Wait for identity to be ready.
+      await identity.ready();
+    }
+
+    //
+    // Second device
+    //
+    {
+      const keyring = new Keyring();
+      const deviceKey = await keyring.createKey();
+
+      const feedStore = new FeedStore<FeedMessage>({
+        factory: new FeedFactory<FeedMessage>({
+          root: createStorage({ type: StorageType.RAM }).createDirectory(),
+          signer: keyring,
+          hypercore: {
+            valueEncoding
+          }
+        })
+      });
+
+      const createFeed = async () => {
+        const feedKey = await keyring.createKey();
+        return feedStore.openFeed(feedKey, { writable: true });
+      };
+
+      const controlFeed = await createFeed();
+      const dataFeed = await createFeed();
+
+      const protocol = new SpaceProtocol({
+        topic: spaceKey,
+        identity: {
+          peerKey: deviceKey,
+          credentialProvider: MOCK_AUTH_PROVIDER, // createHaloAuthProvider(createCredentialSignerWithKey(keyring, device_key)),
+          credentialAuthenticator: MOCK_AUTH_VERIFIER // createHaloAuthVerifier(() => identity.authorizedDeviceKeys),
+        },
+        networkManager: new NetworkManager({
+          signalManager: new MemorySignalManager(signalContext),
+          transportFactory: MemoryTransportFactory
+        })
+      });
+
+      const space = new Space({
+        spaceKey,
+        protocol,
+        genesisFeed: await feedStore.openFeed(genesisFeedKey),
+        controlFeed,
+        dataFeed,
+        feedProvider: (feedKey) => feedStore.openFeed(feedKey),
+        databaseFactory: async ({ databaseBackend }) => new Database(modelFactory, databaseBackend, deviceKey)
+      });
+
+      const identity = (identity2 = new Identity({
+        signer: keyring,
+        identityKey: identity1.identityKey,
+        deviceKey,
+        space
+      }));
+
+      await identity.open();
+      afterTest(() => identity.close());
+    }
+
+    //
+    // Second device admission
+    //
+    {
+      const signer = identity1.getIdentityCredentialSigner();
+      void identity1.controlPipeline.writer.write({
+        '@type': 'dxos.echo.feed.CredentialsMessage',
+        credential: await signer.createCredential({
+          subject: identity2.deviceKey,
+          assertion: {
+            '@type': 'dxos.halo.credentials.AuthorizedDevice',
+            identityKey: identity1.identityKey,
+            deviceKey: identity2.deviceKey
+          }
+        })
+      });
+
+      await identity2.ready();
+    }
+
+    expect(Array.from(identity1.authorizedDeviceKeys.values())).toEqual([identity1.deviceKey, identity2.deviceKey]);
+    expect(Array.from(identity2.authorizedDeviceKeys.values())).toEqual([identity1.deviceKey, identity2.deviceKey]);
+  });
+});