msgctl 0.1.0a1__py3-none-any.whl

msg/market/delivery.py

@@ -0,0 +1,338 @@
+"""Automatic managed packages and explicitly accepted ciphertext/service evidence."""
+from __future__ import annotations
+
+import hashlib
+
+from msg.core.codec import b64, canonical, decode, digest, loads, wire
+from msg.core.errors import Failure, require
+from msg.core.models import BlobRef, HandlerOutput, ResourceRef
+from msg.market.escrow import settle, transition
+from msg.market.orders import HASH, ORDER
+from msg.market.policy import contract
+from msg.market.targets import enqueue_notification, validate_target
+from msg.plugins.common import check_access, new_id
+from msg.plugins.delivery import _buyer_order, _delivery
+from msg.plugins.orders import _row, _subject, _viewer
+from msg.plugins.schemas import IDENTIFIER, REF, obj
+from msg.plugins.store import _package_row
+
+INLINE = 65536
+PART = 65536
+
+
+async def verify_blob(app, blob):
+    """Bounded-memory verification, including content loss after a deposit."""
+    hasher, size = hashlib.sha256(), 0
+    try:
+        async for chunk in app.contents.read(blob):
+            hasher.update(chunk)
+            size += len(chunk)
+    except FileNotFoundError:
+        raise Failure('package_missing') from None
+    except Failure as exc:
+        if exc.code == 'content_missing':
+            raise Failure('package_missing') from None
+        if exc.code in {'content_truncated','content_size_mismatch'}:
+            raise Failure('package_digest_mismatch') from None
+        raise
+    require(size == blob.size and 'sha256:'+hasher.hexdigest() == blob.digest,
+            'package_digest_mismatch')
+
+
+async def package(app, tx, order):
+    row = await _package_row(tx, order['package_id'])
+    require(row is not None, 'package_missing')
+    require(row[1] == order['listing_id'] and row[3] == order['seller'] and
+            row[4] == order['package_revision'] and row[8] == order['package_digest'] and
+            row[10] == 'managed_instant' and row[5] in {'file','bundle','text'},
+            'package_digest_mismatch')
+    refs, manifest = loads(row[7]), loads(row[6])
+    snapshot = {'seller': row[3], 'listing_id': row[1], 'listing_revision': row[2],
+        'revision': row[4], 'kind': row[5], 'manifest': manifest, 'payload_refs': refs,
+        'total_size': row[9], 'delivery_mode': row[10]}
+    require(digest(snapshot) == order['package_digest'] and 0 <= row[9] <= 1024**4,
+            'package_digest_mismatch')
+    require(1 <= len(refs) <= 32, 'package_digest_mismatch')
+    total = 0
+    for ref in refs:
+        blob = decode(BlobRef, ref['blob'])
+        await verify_blob(app, blob)
+        total += blob.size
+    require(total == row[9], 'package_digest_mismatch')
+    return row[5], manifest, refs
+
+
+def body_for(order, delivery_id, kind, manifest, refs):
+    return {'delivery_id': delivery_id, 'order_id': order['id'],
+        'recipient_subject': order['buyer'], 'kind': kind, 'manifest': manifest,
+        'payload_refs': refs, 'package_digest': order['package_digest'] or
+            contract_digest(order), 'channel': 'site'}
+
+
+def contract_digest(order):
+    # Non-managed goods have no deposited package. This is a terms commitment,
+    # not a false claim that the service/ciphertext content was fixed at checkout.
+    return digest({'listing_revision': order['listing_revision'], 'terms_digest': order['terms_digest']})
+
+
+async def prepare(app, tx, ctx, request, order, kind, manifest, refs, *, envelope=None):
+    require(order['state'] == 'funded' and order['delivered_at'] is None,
+            'order_not_deliverable')
+    validate_target(tx, order, encryption=envelope is not None)
+    delivery_id = new_id('dlv')
+    for ref in refs:
+        await app.contents.pin(decode(BlobRef, ref['blob']), delivery_id)
+    body = body_for(order, delivery_id, kind, manifest, refs)
+    tx.execute('''INSERT INTO store_deliveries
+        (id,order_id,recipient_subject,kind,payload_refs,manifest,package_digest,
+         delivery_digest,channel,state,prepared_at,claimed_at,receipt)
+        VALUES (?,?,?,?,?,?,?,?,'site','prepared',?,NULL,NULL)''',
+        (delivery_id,order['id'],order['buyer'],kind,canonical(refs).decode(),
+         canonical(manifest).decode(),body['package_digest'],digest(body),wire(ctx.now)), write=True)
+    if envelope:
+        tx.execute('INSERT INTO delivery_envelopes(order_id,body) VALUES (?,?)',
+                   (order['id'],canonical(envelope).decode()), write=True)
+    await transition(tx, order, 'delivered', now=ctx.now, actor=ctx.principal.actor,
+                     request_id=request.request_id, reason='verified_delivery')
+    tx.execute('UPDATE store_orders SET delivered_at=? WHERE id=?',
+               (wire(ctx.now),order['id']), write=True)
+    order['delivered_at'] = wire(ctx.now)
+    # Inbox is a minimal reference to the one authoritative order, not a copy.
+    message = {'id': new_id('message'), 'sender': order['seller'], 'actor': order['seller'],
+        'recipient': order['buyer'], 'order_id': order['id'], 'time': wire(ctx.now),
+        'resource': wire(ResourceRef(id=order['buyer'])), 'state': 'delivered', 'source': 'system',
+        'href': '/_orders/'+order['id']+'/_delivery'}
+    tx.execute('INSERT INTO messages VALUES (?,?,?,?,?,?)',
+        (message['id'],order['seller'],order['buyer'],order['buyer'],
+         'delivery:'+order['id'],canonical(message).decode()), write=True)
+    await enqueue_notification(app, tx, ctx, request, order)
+    return _delivery(tx, order['id'])
+
+
+async def automatic(app, tx, ctx, request, order):
+    """An authenticated payment authorizes the pinned managed-instant policy.
+
+    Only verified objective storage faults refund. An arbitrary exception rolls
+    back the executor transaction, rather than turning software bugs into payouts.
+    """
+    try:
+        kind, manifest, refs = await package(app, tx, order)
+    except Failure as exc:
+        if exc.code not in {'package_missing','package_digest_mismatch'}:
+            raise
+        await settle(app, tx, order, now=ctx.now, actor=order['buyer'],
+            request_id=request.request_id, reason=exc.code, refund_minor=order['total_price_minor'])
+        return
+    await prepare(app, tx, ctx, request, order, kind, manifest, refs)
+    await transition(tx, order, 'accepted', now=ctx.now, actor=order['buyer'],
+                     request_id=request.request_id, reason='managed_instant_verified')
+    await settle(app, tx, order, now=ctx.now, actor=order['buyer'],
+                 request_id=request.request_id, reason='managed_instant_verified')
+    # Delivery remains prepared, not claimed. Server fulfilment is not buyer ACK.
+
+
+async def verified(app, tx, order, *, verify_bytes=True):
+    delivery = _delivery(tx, order['id'])
+    require(delivery is not None, 'delivery_not_found')
+    validate_target(tx, order)
+    require(delivery['recipient_subject'] == order['buyer'], 'delivery_recipient_mismatch')
+    expected = body_for(order, delivery['id'], delivery['kind'],
+                        delivery['manifest'], delivery['payload_refs'])
+    require(delivery['package_digest'] == expected['package_digest'] and
+            delivery['delivery_digest'] == digest(expected), 'delivery_digest_mismatch')
+    locked = contract(tx, order['id'])
+    if locked['listing']['delivery_mode'] == 'managed_instant':
+        row = await _package_row(tx, order['package_id'])
+        require(row is not None and row[8] == order['package_digest'] and
+                loads(row[6]) == delivery['manifest'] and loads(row[7]) == delivery['payload_refs'],
+                'delivery_digest_mismatch')
+    elif locked['listing']['delivery_mode'] == 'sealed_manual':
+        envelope = tx.one('SELECT body FROM delivery_envelopes WHERE order_id=?', (order['id'],))
+        require(envelope is not None, 'delivery_digest_mismatch')
+        envelope = loads(envelope[0])
+        require(envelope['recipient_subject'] == order['buyer'] and
+                envelope['recipient_key'] == locked['recipient_key'] and
+                envelope['ciphertext_ref'] == delivery['payload_refs'][0],
+                'delivery_recipient_mismatch')
+    if verify_bytes:
+        for ref in delivery['payload_refs']:
+            await verify_blob(app, decode(BlobRef, ref['blob']))
+    return delivery
+
+
+async def read(app, tx, ctx, request):
+    buyer = _viewer(ctx)
+    order = _buyer_order(tx, request.arguments['order_id'], buyer)
+    delivery = await verified(app, tx, order)
+    payloads, budget = [], INLINE
+    for index, ref in enumerate(delivery['payload_refs']):
+        blob = decode(BlobRef, ref['blob'])
+        item = {'id': ref['id'], 'revision': ref['revision'], 'digest': blob.digest,
+                'size': blob.size, 'media_type': blob.media_type, 'payload_index': index}
+        if blob.size <= budget:
+            item['data'] = b64(await app.contents.read_bytes(blob, limit=INLINE))
+            budget -= blob.size
+        else:
+            item['transfer'] = {'operation':'delivery.transfer_open','arguments':{
+                'order_id':order['id'],'delivery_digest':delivery['delivery_digest'],
+                'payload_index':index}}
+            item['next'] = {'operation': 'delivery.part_get', 'arguments': {
+                'order_id': order['id'], 'delivery_digest': delivery['delivery_digest'],
+                'payload_index': index, 'offset': 0, 'length': min(PART,blob.size)}}
+        payloads.append(item)
+    result = {k:v for k,v in delivery.items() if k not in {'id','payload_refs','receipt'}}
+    result.update(delivery_id=delivery['id'], payloads=payloads)
+    return HandlerOutput(data={'delivery': result})
+
+
+async def accept(app, tx, ctx, request):
+    buyer = _subject(ctx)
+    order = _buyer_order(tx, request.arguments['order_id'], buyer)
+    delivery = await verified(app, tx, order)
+    require(delivery['delivery_digest'] == request.arguments['delivery_digest'], 'delivery_mismatch')
+    require(order['state'] in {'delivered','settled'}, 'delivery_not_acceptable')
+    if delivery['state'] == 'claimed':
+        return HandlerOutput(data={'order_id': order['id'], 'state': order['state'],
+            'delivery_id': delivery['id'], 'receipt': delivery['receipt']})
+    settlement = []
+    if order['state'] == 'delivered':
+        await transition(tx, order, 'accepted', now=ctx.now, actor=buyer,
+                         request_id=request.request_id, reason='buyer_acceptance')
+        settlement = await settle(app, tx, order, now=ctx.now, actor=buyer,
+                                  request_id=request.request_id, reason='buyer_acceptance')
+    body = {'order_id': order['id'], 'delivery_id': delivery['id'], 'subject': buyer,
+        'delivery_digest': delivery['delivery_digest'], 'request_digest': request.payload_digest,
+        'claimed_at': wire(ctx.now)}
+    receipt = {'body': body,
+               'signature': wire(app.receipt_signer.sign(canonical(body), purpose='delivery-ack'))}
+    tx.execute("UPDATE store_deliveries SET state='claimed',claimed_at=?,receipt=? WHERE order_id=?",
+        (wire(ctx.now),canonical(receipt).decode(),order['id']), write=True)
+    return HandlerOutput(data={'order_id': order['id'], 'state': order['state'],
+        'delivery_id': delivery['id'], 'receipt': receipt, 'settlement_receipts': settlement})
+
+
+def install(app, op):
+    @op('delivery.get', ORDER, effect='read', version=2)
+    async def get(ctx, request, tx):
+        return await read(app, tx, ctx, request)
+
+    @op('delivery.accept', obj({'order_id': IDENTIFIER, 'delivery_digest': HASH},
+        ('order_id','delivery_digest')), signature=True, version=2)
+    async def claim(ctx, request, tx):
+        return await accept(app, tx, ctx, request)
+
+    @op('delivery.prepare', ORDER, signature=True, version=2)
+    async def prepare_managed(ctx, request, tx):
+        buyer = _subject(ctx)
+        order = _buyer_order(tx, request.arguments['order_id'], buyer)
+        locked = contract(tx, order['id'])
+        require(locked['listing']['delivery_mode'] == 'managed_instant', 'seller_delivery_required')
+        if order['state'] == 'funded':
+            await automatic(app, tx, ctx, request, order)
+        return HandlerOutput(data={'order_id': order['id'], 'state': order['state']})
+
+    @op('delivery.submit', obj({'order_id': IDENTIFIER, 'payload_ref': REF,
+        'payload_digest': HASH, 'recipient_key_id': IDENTIFIER},
+        ('order_id','payload_ref','payload_digest')), signature=True)
+    async def submit(ctx, request, tx):
+        from msg.plugins.communication import direct_ancestor
+        seller = _subject(ctx)
+        order = _row(tx, request.arguments['order_id'], seller)
+        require(order['seller'] == seller, 'order_not_found')
+        locked = contract(tx, order['id'])
+        mode = locked['listing']['delivery_mode']
+        require(mode in {'sealed_manual','service'}, 'order_delivery_mode_unsupported')
+        require(order['state'] == 'funded', 'order_not_deliverable')
+        from datetime import timedelta
+
+        from msg.core.codec import parse_time
+        require(ctx.now < parse_time(order['funded_at']) + timedelta(
+            seconds=locked['policy']['policy']['delivery_timeout_seconds']), 'delivery_deadline_passed')
+        ref = decode(ResourceRef, request.arguments['payload_ref'])
+        require(ref.revision is not None, 'payload_revision_required')
+        resource = await tx.resource(ref.id)
+        require(resource.owner == seller and resource.type in {'file','attachment'} and
+                resource.state == 'active', 'payload_not_owned')
+        require(await direct_ancestor(tx, ref.id) is None, 'payload_private_conversation')
+        await check_access(app, ctx, request, tx, ref.id, 'read')
+        revision = await tx.revision(ref)
+        blob = revision.content
+        require(blob.digest == request.arguments['payload_digest'], 'delivery_digest_mismatch')
+        await verify_blob(app, blob)
+        payload = {'id': ref.id, 'revision': ref.revision, 'blob': wire(blob)}
+        envelope = None
+        if mode == 'sealed_manual':
+            validate_target(tx, order, encryption=True)
+            require(request.arguments.get('recipient_key_id') == locked['recipient_key']['key_id'],
+                    'delivery_recipient_mismatch')
+            prefix = b''.join([piece async for piece in app.contents.read(blob, (0,min(64,blob.size)))])
+            require(blob.media_type in {'application/age','application/octet-stream'} and
+                    prefix.startswith(b'age-encryption.org/v1\n'), 'encrypted_delivery_required')
+            envelope = {'recipient_subject': order['buyer'], 'recipient_key': locked['recipient_key'],
+                        'ciphertext_ref': payload, 'seller_request_digest': request.payload_digest}
+            manifest = {'encryption': 'age-x25519', 'recipient_key_id': locked['recipient_key']['key_id']}
+        else:
+            require('recipient_key_id' not in request.arguments, 'unexpected_recipient_key')
+            manifest = {'type': 'service-evidence', 'acceptance': 'explicit-buyer-signature'}
+        delivery = await prepare(app, tx, ctx, request, order, locked['listing']['item_kind'],
+                                 manifest, [payload], envelope=envelope)
+        return HandlerOutput(data={'order_id': order['id'], 'delivery_id': delivery['id'],
+            'delivery_digest': delivery['delivery_digest'], 'state': 'delivered'})
+
+    @op('delivery.part_get', obj({'order_id': IDENTIFIER, 'delivery_digest': HASH,
+        'payload_index': {'type': 'integer','minimum': 0,'maximum': 31},
+        'offset': {'type': 'integer','minimum': 0,'maximum': 1024**4},
+        'length': {'type': 'integer','minimum': 1,'maximum': PART}},
+        ('order_id','delivery_digest','payload_index','offset','length')), effect='read')
+    async def part_get(ctx, request, tx):
+        a = request.arguments
+        order = _buyer_order(tx, a['order_id'], _viewer(ctx))
+        delivery = await verified(app, tx, order, verify_bytes=False)
+        require(a['delivery_digest'] == delivery['delivery_digest'], 'delivery_digest_mismatch')
+        require(a['payload_index'] < len(delivery['payload_refs']), 'payload_not_found')
+        blob = decode(BlobRef, delivery['payload_refs'][a['payload_index']]['blob'])
+        start, end = a['offset'], a['offset']+a['length']
+        require(start < end <= blob.size, 'invalid_byte_range')
+        data = b''.join([piece async for piece in app.contents.read(blob, (start,end))])
+        require(len(data) == a['length'], 'delivery_digest_mismatch')
+        following = ({**a, 'offset': end, 'length': min(PART,blob.size-end)} if end<blob.size else None)
+        return HandlerOutput(data={'order_id': order['id'], 'delivery_id': delivery['id'],
+            'delivery_digest': delivery['delivery_digest'], 'payload_digest': blob.digest,
+            'offset': start, 'size': blob.size, 'data': b64(data), 'chunk_digest': digest(data),
+            'next': following})
+
+    @op('delivery.transfer_open', obj({'order_id':IDENTIFIER,'delivery_digest':HASH,
+        'payload_index':{'type':'integer','minimum':0,'maximum':31}},
+        ('order_id','delivery_digest','payload_index')),signature=True)
+    async def transfer_open(ctx, request, tx):
+        from datetime import timedelta
+
+        from msg.core.transfer import TransferService
+        from msg.plugins.common import create_resource
+        from msg.plugins.transfer import negotiate
+        a = request.arguments
+        buyer = _subject(ctx)
+        order = _buyer_order(tx,a['order_id'],buyer)
+        delivery = await verified(app,tx,order)
+        require(a['delivery_digest']==delivery['delivery_digest'],'delivery_digest_mismatch')
+        require(a['payload_index']<len(delivery['payload_refs']),'payload_not_found')
+        blob = decode(BlobRef,delivery['payload_refs'][a['payload_index']]['blob'])
+        parent = tx.one("SELECT id FROM resources WHERE parent=? AND name='files'",(buyer,))
+        require(parent is not None,'upload_parent_required')
+        await check_access(app,ctx,request,tx,parent[0],'create')
+        # A purchased copy has independent buyer ACL, but references the exact
+        # existing BlobRef. No duplicate payload bytes and no seller ACL bypass
+        # through the generic file API. Only this signed operation can publish it.
+        resource = await create_resource(app,ctx,request,tx,parent=parent[0],type='file',
+            body=blob,media_type=blob.media_type,mode=0o600)
+        async def no_upload(*args):
+            raise Failure('wrong_transfer_direction')
+        limits = negotiate(app,request)
+        service = TransferService(app.metadata,app.contents,app.authorizer,app.clock,
+            publish=no_upload,ttl=app.settings.transfer_ttl,part_bytes=app.settings.max_part_bytes)
+        session = await service.open(ctx,'download',ResourceRef(id=resource.id,revision=resource.revision),
+            blob.size,blob.digest,ctx.now+timedelta(seconds=app.settings.transfer_ttl),limits=limits)
+        return HandlerOutput(resources=(ResourceRef(id=resource.id,revision=resource.revision),),
+            data={'transfer_id':session.id,'order_id':order['id'],'delivery_id':delivery['id'],
+                  'delivery_digest':delivery['delivery_digest'],'size':blob.size,'digest':blob.digest,
+                  'state':session.state,'expires_at':wire(session.expires_at),**limits})

msg/market/delivery_notifications.py

@@ -0,0 +1,110 @@
+"""Optional, buyer-bound email hints; never delivery payloads or payment work.
+
+Facts live in the transactional metadata settings store, not a cache or user
+resource. A signed checkout email is per-order opt-in. An unmatched address stays
+pending until the buyer explicitly verifies it through identity.email_* and
+calls delivery.notify. Checkout never overwrites an existing mailbox.
+"""
+from __future__ import annotations
+
+from dataclasses import replace
+
+from msg.core.errors import require
+from msg.core.models import EffectJob
+from msg.market.delivery_targets import (
+    email_binding, mail_enabled, pickup_url, validate_email_binding, validate_target,
+)
+from msg.plugins.common import new_id
+from msg.plugins.communication import event_id
+
+
+def _key(order_id):
+    return 'delivery_notification:' + order_id
+
+
+def _fact(tx, order):
+    fact = tx.setting(_key(order['id']))
+    require(fact is not None and fact.get('version') == 1 and
+            fact.get('order_id') == order['id'] and fact.get('buyer') == order['buyer'],
+            'delivery_notification_unavailable')
+    validate_target(order)
+    return dict(fact)
+
+
+async def notification_status(app, tx, order_id):
+    fact = tx.setting(_key(order_id))
+    if not fact:
+        return {'state': 'disabled'}
+    if fact['job_id']:
+        job = await tx.job(fact['job_id'])
+        state = {'pending': 'queued', 'running': 'queued', 'done': 'smtp_accepted',
+                 'uncertain': 'delivered_unknown', 'failed': 'failed'}[job.state]
+        if job.state in {'pending', 'running'} and (not fact['enabled'] or not mail_enabled(app)):
+            state = 'disabled'
+        return {'state': state}
+    return {'state': 'pending' if fact['enabled'] and mail_enabled(app) else 'disabled'}
+
+
+async def initialize_notification(app, ctx, request, tx, order, address):
+    if address is None:
+        return {'state': 'disabled'}
+    validate_target(order)
+    handle = (await tx.resource(order['buyer'])).name
+    fact = {'version': 1, 'order_id': order['id'], 'buyer': order['buyer'],
+            'buyer_handle': handle, 'address': address, 'enabled': True,
+            'endpoint': email_binding(tx, order['buyer'], address), 'job_id': None}
+    tx.set_setting(_key(order['id']), fact)
+    return await queue_notification(app, ctx, request, tx, order, enabled=True)
+
+
+async def queue_notification(app, ctx, request, tx, order, *, enabled):
+    fact = _fact(tx, order)
+    require(ctx.principal.actor == ctx.principal.subject == order['buyer'], 'order_not_found')
+    require(order['state'] in {'delivered', 'settled'}, 'order_not_deliverable')
+    fact['enabled'] = enabled
+    tx.set_setting(_key(order['id']), fact)
+    if not enabled or not mail_enabled(app) or fact['job_id'] is not None:
+        # A failed/uncertain external attempt is never revived by another request.
+        return await notification_status(app, tx, order['id'])
+    if fact['endpoint'] is None:
+        fact['endpoint'] = email_binding(tx, order['buyer'], fact['address'])
+    if fact['endpoint'] is None:
+        return {'state': 'pending'}
+    validate_email_binding(tx, order, fact['endpoint'])
+    job_id = new_id('job')
+    fact['job_id'] = job_id
+    tx.set_setting(_key(order['id']), fact)
+    await tx.enqueue(EffectJob(id=job_id, event_id=event_id(request, order['buyer']),
+        kind='mail', dedupe_key='order:' + order['id'] + ':' + order['buyer'] + ':mail',
+        principal=ctx.principal, operation=request.operation,
+        arguments={'order_id': order['id'], 'recipient_subject': order['buyer'],
+                   'contract_version': request.contract_version, 'order_notification': True},
+        state='pending', attempts=0, next_attempt_at=ctx.now, lease_until=None))
+    return {'state': 'queued'}
+
+
+async def project_notification(app, tx, job, principal):
+    """Reconstruct the allowlisted message only after every live owner check."""
+    from msg.plugins.orders import _row
+    from msg.plugins.delivery import _delivery, _verified_delivery
+    require(mail_enabled(app), 'mail_disabled')
+    require((job.operation, job.arguments.get('contract_version')) in {
+        ('orders.buy', 2), ('delivery.notify', 1)}, 'invalid_delivery_notification')
+    buyer = job.arguments['recipient_subject']
+    require(principal.actor == principal.subject == buyer, 'delivery_recipient_mismatch')
+    await app.authorizer.require_base(principal,
+        f"{job.operation}@{job.arguments['contract_version']}", buyer, tx)
+    order = _row(tx, job.arguments['order_id'], buyer)
+    require(order['buyer'] == buyer and order['state'] in {'delivered', 'settled'},
+            'delivery_recipient_mismatch')
+    fact = _fact(tx, order)
+    require(fact['job_id'] == job.id and fact['enabled'], 'notification_disabled')
+    delivery = _delivery(tx, order['id'])
+    await _verified_delivery(app, tx, order, delivery)
+    recipient = validate_email_binding(tx, order, fact['endpoint'])
+    require(fact['address'] == recipient, 'delivery_recipient_mismatch')
+    link = pickup_url(app, order['id'])
+    text = order['id'] + '\n' + fact['buyer_handle'] + '\n' + link + '\n'
+    # Never forward a caller/job-selected subject, text, attachment or token.
+    return replace(job, arguments={'recipient': recipient, 'recipient_subject': buyer,
+        'subject': 'msg order ready', 'text': text})

msg/market/delivery_targets.py

@@ -0,0 +1,76 @@
+"""One current buyer binding for site delivery and optional email projections."""
+from __future__ import annotations
+
+from urllib.parse import urlsplit
+
+from msg.core.codec import decode, loads, wire
+from msg.core.errors import Failure, require
+from msg.core.email_address import validate_address
+from msg.core.models import EmailSettings
+
+
+def mail_enabled(app):
+    config = app.settings.server.mail
+    return config is not None and config.enabled
+
+
+def pickup_url(app, order_id):
+    """Build a non-capability link without leaking credentials from configuration."""
+    origin = app.settings.service_url
+    require(isinstance(origin, str) and
+            all(ord(c) > 32 and ord(c) != 127 for c in origin) and
+            '\\' not in origin, 'invalid_delivery_origin')
+    try:
+        base = urlsplit(origin)
+        valid = (base.scheme in {'http', 'https'} and base.hostname and
+                 base.username is None and base.password is None and
+                 not base.query and not base.fragment)
+        base.port  # Validate malformed/out-of-range ports as well as IPv6 syntax.
+    except ValueError:
+        raise Failure('invalid_delivery_origin') from None
+    require(valid, 'invalid_delivery_origin')
+    return origin.rstrip('/') + '/_orders/' + order_id + '/_delivery'
+
+
+def account_email(tx, buyer):
+    """Read the live account row once; endpoint encodings remain version-specific."""
+    row = tx.one('SELECT generation,body FROM emails WHERE subject=?', (buyer,))
+    if row is None:
+        return None, None
+    email = decode(EmailSettings, loads(row[1]))
+    require(email.subject_id == buyer, 'delivery_recipient_mismatch')
+    return row[0], email
+
+
+def validate_target(order, delivery=None):
+    require(order['delivery_target'] == {
+        'subject_id': order['buyer'], 'channel': 'site'},
+        'delivery_recipient_mismatch')
+    if delivery is not None:
+        require(delivery['order_id'] == order['id'] and
+                delivery['recipient_subject'] == order['buyer'] and
+                delivery['channel'] == 'site', 'delivery_recipient_mismatch')
+
+
+def email_binding(tx, buyer, address):
+    """Unverified/unmatched addresses are pending, never an authorized target.
+
+    The existing single-email row is the endpoint. Its generation also fences
+    revoke/reverify and address reuse; equality of the address alone is unsafe.
+    """
+    generation, email = account_email(tx, buyer)
+    if email is None or email.address != address or email.verified_at is None:
+        return None
+    validate_address(email.address)
+    return {'endpoint_id': 'email:' + buyer, 'owner': buyer,
+            'generation': generation, 'address_snapshot': address,
+            'verified_at': wire(email.verified_at)}
+
+
+def validate_email_binding(tx, order, binding):
+    validate_target(order)
+    require(isinstance(binding, dict) and binding.get('owner') == order['buyer'],
+            'delivery_recipient_mismatch')
+    current = email_binding(tx, order['buyer'], binding.get('address_snapshot'))
+    require(current is not None and current == binding, 'delivery_recipient_mismatch')
+    return current['address_snapshot']

msg/market/email.py

@@ -0,0 +1,100 @@
+"""Optional checkout-address verification, separate from account email settings.
+
+The emailed proof cannot authenticate or identify an order. Verification also
+requires the original buyer's current signed request. An endpoint never changes
+owner; a disabled endpoint is not reactivated by retries or a restored job.
+"""
+from __future__ import annotations
+
+import secrets
+from dataclasses import replace
+from datetime import timedelta
+
+from msg.core.codec import b64, canonical, digest, parse_time, wire
+from msg.core.errors import require
+from msg.core.models import EffectJob, HandlerOutput
+from msg.market.targets import enqueue_notification, mail_enabled, save_target, validate_target
+from msg.plugins.common import new_id
+from msg.plugins.orders import _row, _subject
+from msg.plugins.schemas import IDENTIFIER, obj
+
+
+async def verification_message(app, tx, ctx, request, order):
+    chosen = order['delivery_target'].get('email', {})
+    if (not mail_enabled(app) or chosen.get('endpoint_id') or
+            not chosen.get('address_snapshot')):
+        return
+    token, challenge_id = b64(secrets.token_bytes(32)), new_id('evc')
+    tx.execute('''INSERT INTO delivery_email_challenges
+        (id,order_id,subject,address,verifier,expires_at) VALUES (?,?,?,?,?,?)''',
+        (challenge_id,order['id'],order['buyer'],chosen['address_snapshot'],digest(token),
+         wire(ctx.now+timedelta(minutes=15))), write=True)
+    save_target(tx, order, {**order['delivery_target'], 'email': {
+        **chosen, 'challenge_id':challenge_id, 'state':'pending'}})
+    await tx.enqueue(EffectJob(id=new_id('job'),event_id=challenge_id,kind='market_email_verify',
+        dedupe_key='market-verify:'+challenge_id,principal=ctx.principal,
+        operation=request.operation,arguments={'challenge_id':challenge_id,'token':token},
+        state='pending',attempts=0,next_attempt_at=ctx.now,lease_until=None))
+
+
+async def render_verification(app, tx, job):
+    row = tx.one('''SELECT order_id,subject,address,verifier,expires_at,consumed
+        FROM delivery_email_challenges WHERE id=?''', (job.arguments['challenge_id'],))
+    require(row is not None and not row[5] and parse_time(row[4])>app.clock() and
+            row[1] == job.principal.subject == job.principal.actor and
+            digest(job.arguments['token']) == row[3], 'email_challenge_expired')
+    order = _row(tx,row[0],row[1])
+    chosen = order['delivery_target'].get('email',{})
+    require(order['buyer']==row[1] and chosen.get('challenge_id')==job.arguments['challenge_id'] and
+            chosen.get('address_snapshot')==row[2] and chosen.get('endpoint_id') is None and
+            order['state'] in {'created','funded','delivered','settled'}, 'email_challenge_expired')
+    # No order ID, buyer handle, goods, pickup link or authority in this text.
+    return replace(job,kind='mail',arguments={'recipient':row[2],
+        'recipient_subject':row[1], 'subject':'msg address verification',
+        'text':canonical({'challenge_id':job.arguments['challenge_id'],
+            'token':job.arguments['token'], 'purpose':'verify this address only'}).decode()})
+
+
+def install(app, op):
+    from msg.market.orders import ORDER, view
+
+    @op('orders.email_verify',obj({'order_id':IDENTIFIER,'challenge_id':IDENTIFIER,
+        'token':{'type':'string','minLength':43,'maxLength':43}},
+        ('order_id','challenge_id','token')),signature=True)
+    async def verify(ctx, request, tx):
+        a, buyer = request.arguments, _subject(ctx)
+        order = _row(tx,a['order_id'],buyer)
+        require(order['buyer']==buyer,'order_not_found')
+        row = tx.one('''SELECT order_id,subject,address,verifier,expires_at,consumed
+            FROM delivery_email_challenges WHERE id=?''',(a['challenge_id'],))
+        chosen = order['delivery_target'].get('email',{})
+        require(row is not None and row[0]==order['id'] and row[1]==buyer and not row[5] and
+                parse_time(row[4])>ctx.now and secrets.compare_digest(row[3],digest(a['token'])) and
+                chosen.get('challenge_id')==a['challenge_id'] and
+                chosen.get('address_snapshot')==row[2] and chosen.get('endpoint_id') is None and
+                order['state'] in {'created','funded','delivered','settled'},'email_challenge_invalid')
+        endpoint = new_id('dep')
+        tx.execute('INSERT INTO delivery_email_endpoints(id,subject,address,verified_at) VALUES (?,?,?,?)',
+            (endpoint,buyer,row[2],wire(ctx.now)),write=True)
+        tx.execute('UPDATE delivery_email_challenges SET consumed=TRUE WHERE id=?',
+            (a['challenge_id'],),write=True)
+        chosen = {k:v for k,v in chosen.items() if k!='challenge_id'}
+        save_target(tx,order,{**order['delivery_target'],'email':{
+            **chosen,'endpoint_id':endpoint,'state':'pending'}})
+        validate_target(tx,order,email=True)
+        if order['delivered_at']:
+            await enqueue_notification(app,tx,ctx,request,order)
+        return HandlerOutput(data={'order':view(tx,order,buyer)})
+
+    @op('orders.email_disable',ORDER,signature=True)
+    async def disable(ctx, request, tx):
+        buyer = _subject(ctx)
+        order = _row(tx,request.arguments['order_id'],buyer)
+        require(order['buyer']==buyer,'order_not_found')
+        chosen = order['delivery_target'].get('email',{})
+        if (chosen.get('endpoint_id') or '').startswith('dep_'):
+            tx.execute('UPDATE delivery_email_endpoints SET active=FALSE WHERE id=? AND subject=?',
+                (chosen['endpoint_id'],buyer),write=True)
+        save_target(tx,order,{**order['delivery_target'],'email':{
+            **chosen,'state':'disabled','notification_disabled':True}})
+        return HandlerOutput(data={'order':view(tx,order,buyer)})