@ibgib/core-gib 0.1.63 → 0.1.65

package/src/keystone/keystone-helpers.mts

@@ -1,4 +1,4 @@
-import { extractErrorMsg, hash, HashAlgorithm, pretty } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { extractErrorMsg, hash, HashAlgorithm, pretty, getUUID } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { GIB } from "@ibgib/ts-gib/dist/V1/constants.mjs";
 import { Ib, IbGibAddr, TransformResult } from "@ibgib/ts-gib/dist/types.mjs";
 import { getIbAndGib, getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
@@ -8,7 +8,7 @@ import { Factory_V1 } from "@ibgib/ts-gib/dist/V1/factory.mjs";
 import { getGib } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 
 import { GLOBAL_LOG_A_LOT } from "../core-constants.mjs";
-import { KEYSTONE_ATOM, KEYSTONE_HASH_MAX_ROUNDS, KEYSTONE_POOL_ID_REGEXP, KEYSTONE_SALT_REGEXP, KEYSTONE_USERNAME_REGEXP, KEYSTONE_DESCRIPTION_REGEXP, KEYSTONE_VERB_MANAGE } from "./keystone-constants.mjs";
+import { KEYSTONE_ATOM, KEYSTONE_HASH_MAX_ROUNDS, KEYSTONE_POOL_ID_REGEXP, KEYSTONE_SALT_REGEXP, KEYSTONE_USERNAME_REGEXP, KEYSTONE_DESCRIPTION_REGEXP, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE } from "./keystone-constants.mjs";
 import {
     KeystoneData_V1, KeystoneIbGib_V1, KeystoneIb_V1, KeystoneChallengePool,
     DeterministicResult, KeystoneProof, KeystonePoolConfig,
@@ -18,6 +18,11 @@ import {
     KEYSTONE_CHALLENGE_TYPE_VALID_VALUES,
     KeystonePoolConfig_HashV1,
     DelegateKeystoneInfo,
+    ClaimDetails,
+    ClaimDetails_AddPool,
+    ClaimDetails_RemovePool,
+    ClaimDetails_ReplacePool,
+    ClaimDetails_ChangePassword
 } from "./keystone-types.mjs";
 import { MetaspaceService } from "../witness/space/metaspace/metaspace-types.mjs";
 import { IbGibSpaceAny } from "../witness/space/space-base-v1.mjs";
@@ -360,6 +365,7 @@ export async function applyReplenishmentStrategy({
     masterSecret,
     strategy,
     config,
+    verb,
 }: {
     prevPools: KeystoneChallengePool[],
     targetPoolId: string,
@@ -370,6 +376,7 @@ export async function applyReplenishmentStrategy({
      */
     strategy: any, // Typed as 'any' or 'KeystoneStrategyAny' to avoid circular dep if possible
     config: KeystonePoolConfig,
+    verb?: string,
 }): Promise<KeystoneChallengePool[]> {
     const lc = `[applyReplenishmentStrategy]`;
     try {
@@ -381,7 +388,10 @@ export async function applyReplenishmentStrategy({
         const poolSecret = await strategy.derivePoolSecret({ masterSecret });
         const timestamp = Date.now().toString();
 
-        const strategyType = config.behavior.replenish;
+        let strategyType = config.behavior.replenish;
+        if (verb === KEYSTONE_VERB_REVOKE) {
+            strategyType = KeystoneReplenishStrategy.deleteAll;
+        }
 
         if (strategyType === KeystoneReplenishStrategy.topUp) {
             // Remove consumed
@@ -399,17 +409,10 @@ export async function applyReplenishmentStrategy({
                 pool.challenges[newId] = await strategy.generateChallenge({ solution });
             }
         } else if (strategyType === KeystoneReplenishStrategy.replaceAll) {
-            pool.challenges = {};
-
-            for (let i = 0; i < config.behavior.size; i++) {
-                const newId = await generateOpaqueChallengeId({
-                    salt: config.salt, timestamp, index: i
-                });
-                const solution = await strategy.generateSolution({
-                    poolSecret, poolId: pool.id, challengeId: newId
-                });
-                pool.challenges[newId] = await strategy.generateChallenge({ solution });
-            }
+            pool.challenges = await generatePoolChallenges({
+                config,
+                masterSecret
+            });
         } else if (strategyType === KeystoneReplenishStrategy.consume) {
             consumedIds.forEach(id => delete pool.challenges[id]);
         } else if (strategyType === KeystoneReplenishStrategy.deleteAll) {
@@ -466,6 +469,13 @@ export async function solveAndReplenish({
 
         const strategy = KeystoneStrategyFactory.create({ config: pool.config });
         const poolSecret = await strategy.derivePoolSecret({ masterSecret });
+
+        // Verify secret correctness before solving
+        const isSecretCorrect = await verifyPoolSecret({ pool, signingSecret: masterSecret });
+        if (!isSecretCorrect) {
+            throw new Error(`Crypto Violation: Invalid signing secret for pool: ${pool.id} (E: 8a4c2b1d3e5f6a7b8c9d0e1f2a3b4c5f)`);
+        }
+
         const solutions: KeystoneSolution[] = [];
 
         // 1. Solve
@@ -490,7 +500,8 @@ export async function solveAndReplenish({
             consumedIds: challengeIds,
             masterSecret,
             strategy,
-            config: pool.config
+            config: pool.config,
+            verb: claim.verb
         });
 
         return { proof, nextPools };
@@ -873,6 +884,190 @@ export async function validateKeystoneTransition({
             }
         }
 
+        // Claim details verification (transition validation)
+        const signingPoolIds = new Set(currData.proofs.map(p => p.solutions?.[0]?.poolId).filter(Boolean));
+
+        for (const proof of currData.proofs) {
+            const claim = proof.claim;
+            if (claim?.details) {
+                const details = claim.details;
+                const type = details.type;
+                const info = details.info;
+
+                if (type === 'add-pool') {
+                    // Cast info to ClaimDetails_AddPool
+                    const addInfo = info as ClaimDetails_AddPool;
+                    if (!addInfo || !Array.isArray(addInfo.add) || addInfo.add.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: 1fa2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+
+                    // Verify that the set of pools in current equals previous plus the added pools
+                    const prevIds = new Set(prevData.challengePools.map(p => p.id));
+                    const currIds = new Set(currData.challengePools.map(p => p.id));
+
+                    // All added pools must be in current
+                    for (const id of addInfo.add) {
+                        if (!currIds.has(id)) {
+                            errors.push(`ClaimDetails_AddPool lists pool ${id} but it is missing in the evolved keystone. (E: 2fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (prevIds.has(id)) {
+                            errors.push(`ClaimDetails_AddPool attempts to add existing pool ${id}. (E: 3fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+
+                    // Verify size
+                    if (currData.challengePools.length !== prevData.challengePools.length + addInfo.add.length) {
+                        errors.push(`Structural mismatch: expected ${prevData.challengePools.length + addInfo.add.length} pools, found ${currData.challengePools.length}. (E: 4fa2a8cb28c9b60e68994511a5825)`);
+                    }
+
+                    // Verify all previous pools are unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) {
+                            errors.push(`Existing pool ${prevPool.id} was removed during add-pool transition. (E: 5fa2a8cb28c9b60e68994511a5825)`);
+                            continue;
+                        }
+                        // Verify configuration did not change
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Existing pool config ${prevPool.id} was mutated during add-pool transition. (E: 6fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                        // Verify challenges did not change, unless this was the signing pool used to authorize the transition
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Existing pool challenges ${prevPool.id} were mutated during add-pool transition. (E: 7fa2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+
+                } else if (type === 'replace-pool') {
+                    const replaceInfo = info as ClaimDetails_ReplacePool;
+                    if (!replaceInfo || typeof replaceInfo.replace !== 'string' || !replaceInfo.replace) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: 8fa2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+
+                    const targetId = replaceInfo.replace;
+
+                    // Verify that the set of pool IDs in current equals previous
+                    const prevIds = prevData.challengePools.map(p => p.id).sort();
+                    const currIds = currData.challengePools.map(p => p.id).sort();
+                    if (JSON.stringify(prevIds) !== JSON.stringify(currIds)) {
+                        errors.push(`replace-pool transition mutated the pool IDs set. (E: 9fa2a8cb28c9b60e68994511a5825)`);
+                    }
+
+                    // Assert target pool was replaced (challenges modified)
+                    const prevTarget = prevData.challengePools.find(p => p.id === targetId);
+                    const currTarget = currData.challengePools.find(p => p.id === targetId);
+                    if (!prevTarget || !currTarget) {
+                        errors.push(`Replaced pool ${targetId} not found in keystone challenge pools. (E: afa2a8cb28c9b60e68994511a5825)`);
+                    }
+
+                    // Verify all other pools are completely unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        if (prevPool.id === targetId) continue;
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) continue;
+
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Unrelated pool config ${prevPool.id} was mutated during replace-pool. (E: bfa2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during replace-pool. (E: cfa2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+                } else if (type === 'remove-pool') {
+                    const removeInfo = info as ClaimDetails_RemovePool;
+                    if (!removeInfo || !Array.isArray(removeInfo.remove) || removeInfo.remove.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: b7a2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+
+                    const removeSet = new Set(removeInfo.remove);
+
+                    // Verify that the set of pool IDs in current equals previous minus the removed pools
+                    const prevIds = new Set(prevData.challengePools.map(p => p.id));
+                    const currIds = new Set(currData.challengePools.map(p => p.id));
+
+                    for (const id of removeInfo.remove) {
+                        if (!prevIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is missing in the previous keystone. (E: c7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (currIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is still present in the evolved keystone. (E: d7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+
+                    // Verify size
+                    if (currData.challengePools.length !== prevData.challengePools.length - removeInfo.remove.length) {
+                        errors.push(`Structural mismatch: expected ${prevData.challengePools.length - removeInfo.remove.length} pools, found ${currData.challengePools.length}. (E: e7a2a8cb28c9b60e68994511a5825)`);
+                    }
+
+                    // Verify all remaining pools are unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        if (removeSet.has(prevPool.id)) continue;
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) {
+                            errors.push(`Pool ${prevPool.id} was unexpectedly removed. (E: f7a2a8cb28c9b60e68994511a5825)`);
+                            continue;
+                        }
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Remaining pool config ${prevPool.id} was mutated during remove-pool. (E: 07a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Remaining pool challenges ${prevPool.id} were mutated during remove-pool. (E: 17a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+
+                } else if (type === 'change-password') {
+                    const changeInfo = info as ClaimDetails_ChangePassword;
+                    if (!changeInfo || !Array.isArray(changeInfo.change) || changeInfo.change.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: dfa2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+
+                    // Verify that the set of pool IDs is unmodified
+                    const prevIds = prevData.challengePools.map(p => p.id).sort();
+                    const currIds = currData.challengePools.map(p => p.id).sort();
+                    if (JSON.stringify(prevIds) !== JSON.stringify(currIds)) {
+                        errors.push(`change-password transition mutated the pool IDs set. (E: efa2a8cb28c9b60e68994511a5825)`);
+                    }
+
+                    const rotatedIds = new Set(changeInfo.change);
+
+                    for (const prevPool of prevData.challengePools) {
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) continue;
+
+                        if (rotatedIds.has(prevPool.id)) {
+                            // Check: rotated pool must not be foreign!
+                            if (prevPool.isForeign) {
+                                errors.push(`Security Violation: Password rotation attempted on foreign pool ${prevPool.id}. (E: ffa2a8cb28c9b60e68994511a5825)`);
+                            }
+                            // Config must be identical except for the salt
+                            const prevConfCopy = { ...prevPool.config, salt: '' };
+                            const currConfCopy = { ...currPool.config, salt: '' };
+                            if (JSON.stringify(prevConfCopy) !== JSON.stringify(currConfCopy)) {
+                                errors.push(`Pool config metadata for rotated pool ${prevPool.id} was mutated. (E: 00b2a8cb28c9b60e68994511a5825)`);
+                            }
+                            // Salt must be different
+                            if (prevPool.config.salt === currPool.config.salt) {
+                                errors.push(`Pool salt for rotated pool ${prevPool.id} was not rotated. (E: 01b2a8cb28c9b60e68994511a5825)`);
+                            }
+                        } else {
+                            // Non-rotated pools must be completely unmodified
+                            if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                                errors.push(`Unrelated pool config ${prevPool.id} was mutated during change-password. (E: 02b2a8cb28c9b60e68994511a5825)`);
+                            }
+                            if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                                errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during change-password. (E: 03b2a8cb28c9b60e68994511a5825)`);
+                            }
+                        }
+                    }
+                } else {
+                    errors.push(`Unknown claim details type: ${type}`);
+                }
+            }
+        }
+
         return errors;
     } catch (error) {
         console.error(`${lc} ${extractErrorMsg(error)}`);
@@ -1280,4 +1475,102 @@ export async function getIdentity_throwIfUndefined({
     const identityIbGib = await getIdentity({ metaspace, addr, space });
     if (!identityIbGib) { throw new Error(`addr (${addr}) not found in space: ${space.ib} (E: 7533682e805819cc78bdb0d8960be826)`); }
     return identityIbGib;
+}
+
+/**
+ * Pure helper to generate challenges map for a pool configuration using a masterSecret.
+ */
+export async function generatePoolChallenges({
+    config,
+    masterSecret
+}: {
+    config: KeystonePoolConfig;
+    masterSecret: string;
+}): Promise<{ [challengeId: string]: any }> {
+    const strategy = KeystoneStrategyFactory.create({ config });
+    const poolSecret = await strategy.derivePoolSecret({ masterSecret });
+    const challenges: { [challengeId: string]: any } = {};
+    const targetSize = config.behavior.size;
+    const timestamp = Date.now().toString();
+
+    for (let i = 0; i < targetSize; i++) {
+        const challengeId = await generateOpaqueChallengeId({
+            salt: config.salt,
+            timestamp,
+            index: i
+        });
+        const solution = await strategy.generateSolution({
+            poolSecret,
+            poolId: config.id,
+            challengeId
+        });
+        challenges[challengeId] = await strategy.generateChallenge({ solution });
+    }
+    return challenges;
+}
+
+/**
+ * Pure helper to rotate a pool to a new masterSecret.
+ * Takes the previous pool config, generates a new salt, and builds a new pool with refreshed challenges.
+ */
+export async function rotatePoolChallenges({
+    prevPool,
+    newMasterSecret
+}: {
+    prevPool: KeystoneChallengePool;
+    newMasterSecret: string;
+}): Promise<KeystoneChallengePool> {
+    const prevConfig = prevPool.config;
+    const newSalt = (await getUUID()).substring(0, 16);
+    
+    // Copy the config exactly, updating only the salt
+    const newConfig: KeystonePoolConfig = {
+        ...prevConfig,
+        salt: newSalt
+    };
+
+    const newChallenges = await generatePoolChallenges({
+        config: newConfig,
+        masterSecret: newMasterSecret
+    });
+
+    return {
+        id: prevPool.id,
+        config: newConfig,
+        challenges: newChallenges,
+        ...(prevPool.isForeign !== undefined ? { isForeign: prevPool.isForeign } : {}),
+        ...(prevPool.metadata ? { metadata: prevPool.metadata } : {})
+    };
+}
+
+/**
+ * Pure helper to verify if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+ * Does not mutate any state.
+ */
+export async function verifyPoolSecret({
+    pool,
+    signingSecret
+}: {
+    pool: KeystoneChallengePool;
+    signingSecret: string;
+}): Promise<boolean> {
+    const challengeIds = Object.keys(pool.challenges);
+    if (challengeIds.length === 0) return false;
+
+    try {
+        const firstId = challengeIds[0];
+        const challenge = pool.challenges[firstId];
+
+        const strategy = KeystoneStrategyFactory.create({ config: pool.config });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: signingSecret });
+        const solution = await strategy.generateSolution({
+            poolSecret,
+            poolId: pool.id,
+            challengeId: firstId
+        });
+
+        return await strategy.validateSolution({ solution, challenge });
+    } catch {
+        return false;
+    }
 }