@serve.zone/interfaces 31.6.0 → 31.8.0

package/ts/runtime.networkprojection.ts

@@ -1,11 +1,15 @@
 import * as plugins from './plugins.runtime.js';
-import type { IRuntimeAuthorityReferenceV1 } from './data/runtimeassignment.js';
+import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './data/runtimeassignment.js';
 import type { IRuntimeNetworkProjectionV1 } from './data/networkprojection.js';
 import { snapshotRuntimeNetworkNodeScopeV1, snapshotRuntimeNetworkProjectionV1, validateRuntimeNetworkProjectionV1 } from './data/networkprojection.js';
 import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
 import { computeRuntimeNetworkSigningAuthorityV1Digest, runtimeNetworkSigningV1Contract,
   snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
-import { failNetwork, networkCanonical, networkEqual, networkReferenceOf, requireNetwork } from './private/networkcontract.js';
+import type { IRuntimeNetworkDnsLeaseRenewal, ISignedRuntimeNetworkDnsLeaseRenewal } from './data/networklease.js';
+import { runtimeNetworkDnsLeaseRenewalContract, snapshotRuntimeNetworkDnsLeaseRenewal,
+  snapshotSignedRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './data/networklease.js';
+import { captureNetwork, failNetwork, networkCanonical, networkEqual, networkReference, networkReferenceOf,
+  networkSameScope, requireNetwork } from './private/networkcontract.js';
 
 /** The private KeyObject is process-local. Persist only through the controller's encrypted secret store. */
 export const createRuntimeNetworkSigningKeyV1 = (): { publicKey: string; privateKey: plugins.crypto.KeyObject } => {
@@ -15,11 +19,47 @@ export const createRuntimeNetworkSigningKeyV1 = (): { publicKey: string; private
   return { publicKey: Buffer.from(jwk.x, 'base64url').toString('hex'), privateKey: pair.privateKey };
 };
 
-const signatureBytes = (authority: IRuntimeAuthorityReferenceV1, projection: IRuntimeNetworkProjectionV1): Uint8Array =>
-  new TextEncoder().encode(networkCanonical({ domain: runtimeNetworkSigningV1Contract.signatureDomain, schemaVersion: 1, authority, projection }));
-const validateAuthority = async (authority: IRuntimeNetworkSigningAuthorityV1, projection: IRuntimeNetworkProjectionV1): Promise<void> => {
-  requireNetwork(authority.publicKey !== null && networkEqual(authority.controller, projection.controller)
+/** What every signed network statement carries besides its content. */
+interface IAuthoritySignature {
+  authority: IRuntimeAuthorityReferenceV1;
+  signature: string;
+}
+
+const projectionEnvelope = (authority: IRuntimeAuthorityReferenceV1, projection: IRuntimeNetworkProjectionV1) =>
+  ({ domain: runtimeNetworkSigningV1Contract.signatureDomain, schemaVersion: 1, authority, projection });
+const renewalEnvelope = (authority: IRuntimeAuthorityReferenceV1, renewal: IRuntimeNetworkDnsLeaseRenewal) =>
+  ({ domain: runtimeNetworkDnsLeaseRenewalContract.signatureDomain, authority, renewal });
+const envelopeBytes = (envelope: object): Uint8Array => new TextEncoder().encode(networkCanonical(envelope));
+
+/** A revoked revision has no key; any other must be intact and belong to the controller that owns the content. */
+const liveKeyOf = async (authority: IRuntimeNetworkSigningAuthorityV1, contentController: IRuntimeControllerV1): Promise<string> => {
+  const { publicKey } = authority;
+  requireNetwork(publicKey !== null && networkEqual(authority.controller, contentController)
     && authority.digest === await computeRuntimeNetworkSigningAuthorityV1Digest(authority));
+  return publicKey;
+};
+
+/** Sign as the authority's revision, and only with the private half of its live key. */
+const signAs = async (
+  authority: IRuntimeNetworkSigningAuthorityV1, privateKey: plugins.crypto.KeyObject, contentController: IRuntimeControllerV1,
+  envelopeOf: (reference: IRuntimeAuthorityReferenceV1) => object,
+): Promise<IAuthoritySignature> => {
+  requireNetwork(privateKey instanceof plugins.crypto.KeyObject && privateKey.type === 'private' && privateKey.asymmetricKeyType === 'ed25519');
+  const derived = plugins.crypto.createPublicKey(privateKey).export({ format: 'jwk' });
+  const publicKey = await liveKeyOf(authority, contentController);
+  requireNetwork(typeof derived.x === 'string' && Buffer.from(derived.x, 'base64url').toString('hex') === publicKey);
+  const reference = networkReferenceOf(authority);
+  return { authority: reference, signature: plugins.crypto.sign(null, envelopeBytes(envelopeOf(reference)), privateKey).toString('hex') };
+};
+
+/** The receiver's own trusted revision decides; the envelope only names which revision it claims. */
+const requireSignedBy = async (
+  trusted: IRuntimeNetworkSigningAuthorityV1, signed: IAuthoritySignature, contentController: IRuntimeControllerV1, envelope: object,
+): Promise<void> => {
+  requireNetwork(networkEqual(signed.authority, networkReferenceOf(trusted)));
+  const key = plugins.crypto.createPublicKey({ format: 'jwk', key: { kty: 'OKP', crv: 'Ed25519',
+    x: Buffer.from(await liveKeyOf(trusted, contentController), 'hex').toString('base64url') } });
+  requireNetwork(plugins.crypto.verify(null, envelopeBytes(envelope), key, Buffer.from(signed.signature, 'hex')));
 };
 
 /** Sign only validated complete state and a matching dedicated private key. */
@@ -28,14 +68,9 @@ export const signRuntimeNetworkProjectionV1 = async (
 ): Promise<ISignedRuntimeNetworkProjectionV1> => {
   try {
     const input = snapshotRuntimeNetworkProjectionV1(projectionValue), authority = snapshotRuntimeNetworkSigningAuthorityV1(authorityValue);
-    requireNetwork(privateKey instanceof plugins.crypto.KeyObject && privateKey.type === 'private' && privateKey.asymmetricKeyType === 'ed25519');
-    const publicKey = plugins.crypto.createPublicKey(privateKey).export({ format: 'jwk' });
-    requireNetwork(typeof publicKey.x === 'string' && Buffer.from(publicKey.x, 'base64url').toString('hex') === authority.publicKey);
     const projection = await validateRuntimeNetworkProjectionV1(input);
-    await validateAuthority(authority, projection);
-    const reference = networkReferenceOf(authority);
-    const signature = plugins.crypto.sign(null, signatureBytes(reference, projection), privateKey).toString('hex');
-    return { schemaVersion: 1, authority: reference, projection, signature };
+    const signed = await signAs(authority, privateKey, projection.controller, reference => projectionEnvelope(reference, projection));
+    return { schemaVersion: 1, authority: signed.authority, projection, signature: signed.signature };
   } catch { return failNetwork(); }
 };
 
@@ -51,14 +86,46 @@ export const verifyRuntimeNetworkProjectionV1 = async (
     const signed = snapshotSignedRuntimeNetworkProjectionV1(value);
     const authority = snapshotRuntimeNetworkSigningAuthorityV1(trustedAuthorityValue);
     const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
-    requireNetwork(networkEqual(signed.authority, networkReferenceOf(authority))
-      && signed.projection.nodeId === trusted.nodeId && signed.projection.runtimeNamespace === trusted.runtimeNamespace
-      && networkEqual(signed.projection.controller, trusted.controller));
-    await validateAuthority(authority, signed.projection);
-    const key = plugins.crypto.createPublicKey({ format: 'jwk', key: { kty: 'OKP', crv: 'Ed25519',
-      x: Buffer.from(authority.publicKey!, 'hex').toString('base64url') } });
-    requireNetwork(plugins.crypto.verify(null, signatureBytes(signed.authority, signed.projection), key, Buffer.from(signed.signature, 'hex')));
+    requireNetwork(networkSameScope(signed.projection, trusted));
+    await requireSignedBy(authority, signed, signed.projection.controller, projectionEnvelope(signed.authority, signed.projection));
     await validateRuntimeNetworkProjectionV1(signed.projection);
     return signed;
   } catch { return failNetwork(); }
 };
+
+/** Sign only a validated renewal, with the same authority and key that sign this controller's projections. */
+export const signRuntimeNetworkDnsLeaseRenewal = async (
+  renewalValue: unknown, authorityValue: unknown, privateKey: plugins.crypto.KeyObject,
+): Promise<ISignedRuntimeNetworkDnsLeaseRenewal> => {
+  try {
+    const input = snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue), authority = snapshotRuntimeNetworkSigningAuthorityV1(authorityValue);
+    const renewal = await validateRuntimeNetworkDnsLeaseRenewal(input);
+    const signed = await signAs(authority, privateKey, renewal.controller, reference => renewalEnvelope(reference, renewal));
+    return { authority: signed.authority, renewal, signature: signed.signature };
+  } catch { return failNetwork(); }
+};
+
+/**
+ * trustedAuthorityValue is receiver-owned persisted trust, NEVER envelope material, and a relay
+ * that delivers the renewal adds no trust to it. projectionAuthorityValue is the authority
+ * reference that signed the projection this renewal extends, which the receiver kept when it
+ * admitted that projection: a renewal is only ever valid under the exact revision that signed its
+ * projection, so a rotated key renews nothing and DNS still waits for a newly signed projection.
+ * This verifies content, scope and signature only: the owner still admits it against its own
+ * admitted projection with `admitRuntimeNetworkDnsLeaseRenewal`, fences the live session and
+ * converts the window with a qualified clock.
+ */
+export const verifyRuntimeNetworkDnsLeaseRenewal = async (
+  value: unknown, trustedAuthorityValue: unknown, trustedScopeValue: unknown, projectionAuthorityValue: unknown,
+): Promise<ISignedRuntimeNetworkDnsLeaseRenewal> => {
+  try {
+    const signed = snapshotSignedRuntimeNetworkDnsLeaseRenewal(value);
+    const authority = snapshotRuntimeNetworkSigningAuthorityV1(trustedAuthorityValue);
+    const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+    const projectionAuthority = networkReference(captureNetwork(projectionAuthorityValue));
+    requireNetwork(networkSameScope(signed.renewal, trusted) && networkEqual(signed.authority, projectionAuthority));
+    await requireSignedBy(authority, signed, signed.renewal.controller, renewalEnvelope(signed.authority, signed.renewal));
+    await validateRuntimeNetworkDnsLeaseRenewal(signed.renewal);
+    return signed;
+  } catch { return failNetwork(); }
+};