@ethernity-cloud/sdk-js 1.6.1 → 1.7.0

package/pynithy/build/securelock/src/etny_exec_serv.py

@@ -0,0 +1,353 @@
+# etny_exec.py
+
+import os
+import sys
+import ast
+import json
+import threading
+import time
+import secrets
+import socket
+import logging
+from flask import Flask, request, jsonify
+from functools import wraps
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
+from pyngrok import ngrok
+from concurrent.futures import ThreadPoolExecutor, TimeoutError
+import importlib
+
+# ===========================
+# Backend Functions Loading
+# ===========================
+
+try:
+    import serverless.backend as backend
+except ImportError:
+    backend = None
+    pass
+
+sdkFunctions = {}
+if backend is not None:
+    for func in backend.__dict__.keys():
+        if func not in backend.__builtins__.keys() and func not in [
+            "__file__",
+            "__cached__",
+            "__builtins__",
+        ]:
+            sdkFunctions.update({func: backend.__dict__[func]})
+
+
+# ===========================
+# Task Status Definitions
+# ===========================
+
+class TaskStatus:
+    SUCCESS = 0
+    SYSTEM_ERROR = 1
+    KEY_ERROR = 2
+    SYNTAX_WARNING = 3
+    BASE_EXCEPTION = 4
+    PAYLOAD_NOT_DEFINED = 5
+    PAYLOAD_CHECKSUM_ERROR = 6
+    INPUT_CHECKSUM_ERROR = 7
+
+
+# ===========================
+# Flask and ngrok Setup
+# ===========================
+
+class EthernityEnclaveServer:
+    def __init__(self, local_port=5000):
+        self.api_key = self.generate_api_key()
+        self.local_port = local_port
+        self.ngrok_url = None
+        self.app = Flask(__name__)
+        self.setup_logging()
+        self.setup_security()
+        self.setup_execution_environment()
+        self.setup_routes()
+        self.server_thread = threading.Thread(target=self.run_flask, daemon=True)
+        self.ngrok_thread = threading.Thread(target=self.start_ngrok, daemon=True)
+    
+    def generate_api_key(self):
+        """Generates a secure random API key."""
+        return secrets.token_hex(16)  # Generates a 32-character hexadecimal string
+    
+    def setup_logging(self):
+        """Configures logging with rotation."""
+        from logging.handlers import RotatingFileHandler
+        handler = RotatingFileHandler('app.log', maxBytes=1000000, backupCount=5)
+        handler.setFormatter(logging.Formatter("%(asctime)s [%(levelname)s] %(message)s"))
+        self.logger = logging.getLogger(__name__)
+        self.logger.setLevel(logging.INFO)
+        self.logger.addHandler(handler)
+        self.logger.info("Logging is set up.")
+    
+    def setup_security(self):
+        """Sets up authentication and rate limiting."""
+        # Authentication Decorator
+        def require_api_key(f):
+            @wraps(f)
+            def decorated(*args, **kwargs):
+                key = request.headers.get('x-api-key')
+                if not key or key != self.api_key:
+                    self.logger.warning("Unauthorized access attempt detected.")
+                    return jsonify({"status": "error", "message": "Unauthorized: Invalid or missing API key."}), 401
+                return f(*args, **kwargs)
+            return decorated
+
+        # Rate Limiting using Flask-Limiter
+        self.limiter = Limiter(
+            self.app,
+            key_func=get_remote_address,
+            default_limits=["200 per day", "50 per hour"]
+        )
+        self.logger.info("Rate limiting enabled: 200 requests/day and 50 requests/hour per IP.")
+        self.require_api_key = require_api_key  # Attach to instance for use in routes
+    
+    def setup_execution_environment(self):
+        """Initializes the secure execution environment."""
+        self.globals_context = {
+            "___etny_result___": self.___etny_result___,
+            **sdkFunctions
+        }
+    
+    def setup_routes(self):
+        """Defines Flask routes."""
+        @self.app.route('/execute', methods=['POST'])
+        @self.require_api_key
+        @self.limiter.limit("10 per minute")  # Additional rate limit for this endpoint
+        def execute():
+            """
+            Executes user-provided Python code and returns the outputs.
+            """
+            data = request.get_json()
+            if not data:
+                self.logger.warning("No JSON payload received.")
+                return jsonify({"status": "error", "message": "Invalid JSON payload."}), 400
+
+            payload = data.get('payload')
+            input_data = data.get('input_data', None)
+
+            if not payload:
+                self.logger.warning("No 'payload' provided in the request.")
+                return jsonify({"status": "error", "message": "No payload provided."}), 400
+
+            # Execute the payload
+            result = execute_task(payload, input_data)
+
+            return jsonify(result)
+        
+        @self.app.route('/reload_backend', methods=['POST'])
+        @self.require_api_key
+        def reload_backend():
+            """
+            Reloads backend functions dynamically.
+            """
+            self.logger.info("Reloading backend functions...")
+            global backend, sdkFunctions
+            try:
+                importlib.reload(backend)  # Reload backend module
+                sdkFunctions = {}
+                if backend is not None:
+                    for func in backend.__dict__.keys():
+                        if func not in backend.__builtins__.keys() and func not in [
+                            "__file__",
+                            "__cached__",
+                            "__builtins__",
+                        ]:
+                            sdkFunctions.update({func: backend.__dict__[func]})
+                # Update globals_context with new sdkFunctions
+                self.globals_context.update(sdkFunctions)
+                self.logger.info("Backend functions reloaded successfully.")
+                return jsonify({"status": "success", "message": "Backend functions reloaded successfully."}), 200
+            except Exception as e:
+                self.logger.error(f"Failed to reload backend functions: {e}", exc_info=True)
+                return jsonify({"status": "error", "message": "Failed to reload backend functions."}), 500
+        
+        @self.app.route('/health', methods=['GET'])
+        def health():
+            """Health check endpoint."""
+            return jsonify({"status": "healthy"}), 200
+        
+        @self.app.route('/list_functions', methods=['GET'])
+        @self.require_api_key
+        def list_functions():
+            """
+            Lists all loaded backend functions.
+            """
+            functions = {name: func.__doc__ for name, func in sdkFunctions.items() if callable(func)}
+            return jsonify({"status": "success", "functions": functions}), 200
+    
+    def run_flask(self):
+        """Runs the Flask server."""
+        self.app.run(port=self.local_port, debug=False, use_reloader=False)
+    
+    def start_ngrok(self):
+        """Starts ngrok tunnel to forward the specified port."""
+        try:
+            self.logger.info("Starting ngrok tunnel...")
+            # Authenticate with ngrok
+            ngrok.set_auth_token(os.getenv("NGROK_AUTHTOKEN"))
+            
+            # Forward the port with TLS
+            public_url = ngrok.connect(self.local_port, bind_tls=True)
+            self.ngrok_url = public_url.public_url
+            self.logger.info(f"ngrok tunnel established at {self.ngrok_url}")
+            print(f"ngrok tunnel established at {self.ngrok_url}")
+        except Exception as e:
+            self.logger.error(f"Failed to start ngrok tunnel: {e}", exc_info=True)
+    
+    def start(self):
+        """Starts the Flask server and ngrok tunnel."""
+        self.server_thread.start()
+        self.ngrok_thread.start()
+        self.logger.info("Flask server and ngrok tunnel threads started.")
+    
+    # ===========================
+    # Execution Functions
+    # ===========================
+    
+    def ___etny_result___(self, data):
+        """Handles the result of execution."""
+        # Here, you can implement any post-execution handling if needed
+        # For now, we'll simply return the data
+        return data
+
+def ___etny_result___(data):
+    quit([0, data])
+
+
+def execute_task(payload_data, input_data):
+    return Exec(
+        payload_data,
+        input_data,
+        {"___etny_result___": ___etny_result___, **sdkFunctions},
+    )
+
+
+def Exec(payload_data, input_data, globals=None, locals=None):
+    try:
+        if payload_data is not None:
+            if input_data is not None:
+                globals["___etny_data_set___"] = input_data
+            module = ast.parse(payload_data)
+            outputs = []
+            for node in module.body:
+                if isinstance(node, ast.Expr):
+                    expr_code = compile(
+                        ast.Expression(node.value), filename="<ast>", mode="eval"
+                    )
+                    result = eval(expr_code, globals, locals)
+                    outputs.append(result)
+                else:
+                    # Handle statements if needed
+                    exec(
+                        compile(ast.Module([node], type_ignores=[]), filename="<ast>", mode="exec"),
+                        globals,
+                        locals,
+                    )
+
+            # Function results are arbitrary Python values -- the shipped
+            # esr-counter example returns dicts -- so serialize anything that
+            # is not already a str instead of letting join() raise. None (an
+            # expression statement with no value, e.g. a bare print()) is
+            # dropped, matching REPL semantics.
+            rendered = [
+                out if isinstance(out, str) else json.dumps(out, default=str)
+                for out in outputs
+                if out is not None
+            ]
+            return ___etny_result___("\n".join(rendered))
+        else:
+            return (
+                TaskStatus.PAYLOAD_NOT_DEFINED,
+                "Could not find the source file to execute",
+            )
+
+        return TaskStatus.SUCCESS, "TASK EXECUTED SUCCESSFULLY"
+    except SystemExit as e:
+        # A task returns its result ONLY through ___etny_result___(data) ->
+        # quit([code, data]) -> SystemExit carrying [code, data]. Honor that
+        # embedded code. Handled BEFORE SystemError: the read path's web3/crypto
+        # C-extensions intermittently raise a spurious SystemError during the
+        # SystemExit unwind, which previously stamped SYSTEM_ERROR onto a task
+        # that had already produced the correct value (~50% false read failure).
+        import traceback
+        try:
+            code, data = e.args[0][0], e.args[0][1]
+        except Exception:
+            tb = traceback.format_exc()
+            logging.error("SystemExit without [code, data]: %r -- %s", e, tb)
+            return TaskStatus.SYSTEM_ERROR, f"SYSTEM_ERROR: {e!r}\n{tb}"
+        if code == 0:
+            return TaskStatus.SUCCESS, data
+        return int(code), data
+    except SystemError as e:
+        # A spurious SystemError may replace the SystemExit mid-unwind; recover
+        # the real result from the chained exception before failing.
+        import traceback
+        for chained in (getattr(e, "__context__", None), getattr(e, "__cause__", None)):
+            if isinstance(chained, SystemExit):
+                try:
+                    code, data = chained.args[0][0], chained.args[0][1]
+                except Exception:
+                    continue
+                logging.warning(
+                    "SystemError during result unwind; recovered result from "
+                    "chained SystemExit (code=%r). Native error: %r", code, e)
+                if code == 0:
+                    return TaskStatus.SUCCESS, data
+                return int(code), data
+        tb = traceback.format_exc()
+        logging.error("SystemError in payload execution: %r -- %s", e, tb)
+        return TaskStatus.SYSTEM_ERROR, f"SYSTEM_ERROR: {e!r}\n{tb}"
+    except KeyError as e:
+        return TaskStatus.KEY_ERROR, e.args[0]
+    except SyntaxWarning as e:
+        return TaskStatus.SYNTAX_WARNING, e.args[0]
+    except BaseException as e:
+        import traceback
+        try:
+            if e.args[0][0] == 0:
+                return TaskStatus.SUCCESS, e.args[0][1]
+        except Exception:
+            pass
+        tb = traceback.format_exc()
+        logging.error("BaseException in payload execution: %r -- %s", e, tb)
+        return TaskStatus.BASE_EXCEPTION, f"BASE_EXCEPTION: {e!r}\n{tb}"
+
+
+# ===========================
+# Main Execution
+# ===========================
+
+def main():
+    # Initialize and start the EthernityEnclaveServer
+    server = EthernityEnclaveServer(local_port=5000)
+    server.start()
+
+    # Wait briefly to ensure ngrok tunnel is established
+    time.sleep(2)
+
+    if not server.ngrok_url:
+        print("Failed to establish ngrok tunnel.")
+        sys.exit(1)
+
+    print("EthernityEnclaveServer is running!")
+    print(f"ngrok URL: {server.ngrok_url}")
+    print(f"API Key: {server.api_key}")
+
+    # Keep the main thread alive to continue listening for replies
+    try:
+        while True:
+            time.sleep(1)
+    except KeyboardInterrupt:
+        print("Shutting down the EthernityEnclaveServer.")
+        # Disconnect all ngrok tunnels
+        ngrok.kill()
+        sys.exit()
+
+if __name__ == "__main__":
+    main()

package/pynithy/build/securelock/src/etny_session_exec.py

@@ -0,0 +1,245 @@
+"""Interactive session executor for the securelock enclave.
+
+Runs when the trustedzone staged 'session.config.securelock'. The payload
+context is created once and kept alive; every streamed input is delivered
+to the handler the payload registered:
+
+    def ___etny_on_input___(data):
+        ...
+        return "reply"
+
+A payload that defines no handler is not session-aware: each input is
+answered with an explicit error output (no silent re-execution fallback),
+so the dApp developer sees the problem on the first message.
+
+Objects (all trustedzone<->securelock traffic uses the existing
+encrypted+signed envelope in both directions):
+  session.config.securelock   {order_id, close_after_seconds,
+                               input_cutoff_seconds, max_messages}
+  session.input.<seq>.securelock   one streamed input (+ .sig)
+  session.output.<n>               {"ack": seq, "code": c, "data": out}
+  session.control.securelock       'close'
+
+The TIMEOUT GUARD is the point of this module: the running period ending is
+a COMPLETION, not a failure. The guard arms from the attested
+close_after_seconds delta (monotonic clock -- the enclave never trusts the
+node's wall clock), stops pulling inputs at the cutoff, gives an in-flight
+handler a short grace, and finalizes through the ordinary result path with
+task code SUCCESS and a session summary, e.g.:
+
+    {"session": "v1", "reason": "RUNNING_PERIOD_COMPLETE",
+     "seen": 12, "processed": 12, "emitted": 12, "unprocessed": []}
+
+so a full-duration session reads as 'securelock running period complete'.
+The hard-kill path only remains for a guard that never returns -- a genuine
+fault, refunded via the operator-fault flow.
+"""
+
+import json
+import logging
+import threading
+import time
+
+import etny_exec
+from etny_exec import TaskStatus
+
+HANDLER_NAME = "___etny_on_input___"
+HANDLER_GRACE_SECONDS = 30
+TICK_SECONDS = 2
+
+
+def _render(value):
+    if value is None:
+        return ""
+    return value if isinstance(value, str) else json.dumps(value, default=str)
+
+
+def _resolve_handler(base_globals):
+    """The session input handler, from EITHER the namespaced `ecld.on_input`
+    or the legacy bare `___etny_on_input___`. `ecld.on_input` wins if both are
+    set; returns None if neither is a callable (handler-less payload)."""
+    ecld = base_globals.get("ecld")
+    if ecld is not None:
+        h = getattr(ecld, "on_input", None)
+        if callable(h):
+            return h
+    legacy = base_globals.get(HANDLER_NAME)
+    return legacy if callable(legacy) else None
+
+
+class SecureLockSession:
+    def __init__(self, app):
+        self.app = app
+        cfg = json.loads(app.get_and_verify_trustedzone_object("session.config.securelock"))
+        self.order_id = int(cfg.get("order_id", -1))
+        self.max_messages = int(cfg.get("max_messages", 256))
+        started = time.monotonic()
+        self.close_at = started + float(cfg.get("close_after_seconds", 0))
+        self.cutoff_at = started + float(cfg.get("input_cutoff_seconds", 0))
+        self.seen = 0
+        self.processed = 0
+        self.emitted = 0
+        self.unprocessed = []
+        self.reason = "RUNNING_PERIOD_COMPLETE"
+        self.globals = etny_exec.session_base_globals()
+
+    # ------------------------------------------------------------------ pieces
+
+    def _initial_run(self):
+        """Create the payload context. Its own result is not a session output
+        -- setup code runs, a handler may get defined, state gets created."""
+        code, result = etny_exec.Exec(
+            self.app.payload_data, self.app.input_data, globals=self.globals)
+        logging.info(f"session: payload context created (code {code})")
+        if int(code) != int(TaskStatus.SUCCESS):
+            # A payload that cannot even set up cannot serve a session.
+            self.reason = "PAYLOAD_SETUP_FAILED"
+            return code, result
+        return None
+
+    def _handle(self, seq, data):
+        """Deliver one input; returns (code, output). Runs the handler on a
+        worker thread so a hung payload cannot outlive the timeout guard."""
+        handler = _resolve_handler(self.globals)
+        if not callable(handler):
+            # No silent fallback: a payload without a handler is not
+            # session-aware, so every input gets an explicit, acked error.
+            return (int(TaskStatus.PAYLOAD_NOT_DEFINED),
+                    "SESSION_HANDLER_NOT_DEFINED: this payload defines no "
+                    "session input handler, so streamed inputs cannot be "
+                    "processed. Set ecld.on_input = def handler(data): ... "
+                    "(or the legacy ___etny_on_input___) in the payload and "
+                    "republish.")
+        box = {}
+
+        def work():
+            try:
+                box["out"] = (int(TaskStatus.SUCCESS), _render(handler(data)))
+            except Exception as e:
+                box["out"] = (int(TaskStatus.SYSTEM_ERROR), f"SESSION HANDLER ERROR: {e}")
+
+        worker = threading.Thread(target=work, daemon=True)
+        worker.start()
+        budget = max(HANDLER_GRACE_SECONDS, self.close_at - time.monotonic())
+        worker.join(budget)
+        if worker.is_alive():
+            logging.error(f"session: handler hung on input {seq}; abandoning")
+            self.unprocessed.append(seq)
+            return None
+        return box.get("out", (int(TaskStatus.SYSTEM_ERROR), "SESSION HANDLER LOST"))
+
+    def _session_binding(self, base_name):
+        """The prefix each session object's signature covers ahead of the
+        data: "<challenge>:<order_id>:<object>:", the task binding the
+        trustedzone forwarded in task.securelock extended with the object's
+        own name, so the trustedzone can refuse an object captured from
+        another order, another run, or another sequence position. Empty
+        without a binding (older trustedzone), which then verifies the bare
+        data."""
+        binding = getattr(self.app, "task_binding", None)
+        if not binding:
+            return ""
+        return f"{binding['challenge']}:{binding['order_id']}:{base_name}:"
+
+    def _emit(self, ack_seq, code, data):
+        envelope = json.dumps({"ack": ack_seq, "code": int(code), "data": data})
+        name = f"session.output.{self.emitted}"
+        self.app.encrypt_file_and_push_to_swifstream(
+            envelope, name, signed_prefix=self._session_binding(name))
+        self.emitted += 1
+
+    def _close_requested(self):
+        status, _ = self.app.swift_stream_service.is_object_in_bucket(
+            self.app.etny_bucket, "session.control.securelock")
+        if not status:
+            return False
+        # An unauthenticated close signal is ignored: the node could place an
+        # object in the bucket, but only the trustedzone can SIGN one.
+        try:
+            control = self.app.get_and_verify_trustedzone_object("session.control.securelock")
+            return str(control).strip() == "close"
+        except Exception:
+            return False
+
+    # --------------------------------------------------------------------- run
+
+    def run(self):
+        setup_failure = self._initial_run()
+        if setup_failure is not None:
+            return setup_failure
+        # READINESS HANDSHAKE: tell the trustedzone this securelock speaks the
+        # session protocol AND whether the payload defined an input handler.
+        # A pre-session securelock never writes this (the trustedzone answers
+        # every input with an explicit error), and a handler-less payload is
+        # announced by the trustedzone as a signed code-5 error row on the
+        # DP-request metadata side before any input is even sent.
+        try:
+            ready = json.dumps({
+                "ready": True,
+                "handler": callable(_resolve_handler(self.globals)),
+            })
+            self.app.encrypt_file_and_push_to_swifstream(
+                ready, "session.ready",
+                signed_prefix=self._session_binding("session.ready"))
+        except Exception as e:
+            logging.error(f"session: could not publish readiness: {e}")
+        next_seq = 0
+        while True:
+            now = time.monotonic()
+            if now >= self.close_at:
+                self.reason = "RUNNING_PERIOD_COMPLETE"
+                break
+            if self._close_requested():
+                self.reason = "CLOSED"
+                break
+            if next_seq >= self.max_messages:
+                self.reason = "MESSAGE_CAP"
+                break
+            obj = f"session.input.{next_seq}.securelock"
+            status, _ = self.app.swift_stream_service.is_object_in_bucket(
+                self.app.etny_bucket, obj)
+            if not status:
+                time.sleep(TICK_SECONDS)
+                continue
+            if now >= self.cutoff_at:
+                # Delivered past the cutoff: the trustedzone answers these
+                # with signed late notices; we only stop consuming.
+                self.reason = "RUNNING_PERIOD_COMPLETE"
+                break
+            try:
+                data = self.app.get_and_verify_trustedzone_object(obj)
+            except Exception as e:
+                logging.error(f"session: input {next_seq} failed verification: {e}")
+                time.sleep(TICK_SECONDS)
+                continue
+            self.seen += 1
+            outcome = self._handle(next_seq, data)
+            if outcome is not None:
+                code, out = outcome
+                # Only successful handling counts as processed; error outputs
+                # (handler missing / handler raised) are still emitted+acked
+                # so the dApp sees them, but the summary stays truthful.
+                if int(code) == int(TaskStatus.SUCCESS):
+                    self.processed += 1
+                self._emit(next_seq, code, out)
+            next_seq += 1
+        summary = {
+            "session": "v1",
+            "reason": self.reason,
+            "seen": self.seen,
+            "processed": self.processed,
+            "emitted": self.emitted,
+            "unprocessed": self.unprocessed,
+        }
+        logging.info(f"session: finalizing -- {summary}")
+        return (TaskStatus.SUCCESS, json.dumps(summary))
+
+
+def run_session(app):
+    """Entry point used by securelock.execute(). Any unexpected failure
+    degrades to an ordinary task error, never a hang."""
+    try:
+        return SecureLockSession(app).run()
+    except Exception as e:
+        logging.error(f"session executor failed: {e}")
+        return (TaskStatus.SYSTEM_ERROR, f"SESSION EXECUTOR ERROR: {e}")