nest-plugins-reference 0.1.0__tar.gz → 0.1.1__tar.gz

{nest_plugins_reference-0.1.0 → nest_plugins_reference-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nest-plugins-reference
-Version: 0.1.0
+Version: 0.1.1
 Summary: NEST reference plugins: default implementations for all 12 layers
 Project-URL: Homepage, https://github.com/mariagorskikh/nest
 Project-URL: Repository, https://github.com/mariagorskikh/nest

{nest_plugins_reference-0.1.0 → nest_plugins_reference-0.1.1}/nest_plugins_reference/__init__.py

@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: Apache-2.0
 """NEST reference plugins: default implementations for all 12 layers."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

{nest_plugins_reference-0.1.0 → nest_plugins_reference-0.1.1}/nest_plugins_reference/auth/jwt_auth.py

@@ -85,6 +85,9 @@ class JwtAuth:
             raise ValueError(msg)
 
         data = json.loads(payload_str)
+        if data["exp"] < self._now():
+            msg = "Token has expired"
+            raise ValueError(msg)
         return AuthContext(
             subject=AgentId(data["sub"]),
             scopes=data["scopes"],

nest_plugins_reference-0.1.1/nest_plugins_reference/identity/did_key.py

@@ -0,0 +1,198 @@
+# SPDX-License-Identifier: Apache-2.0
+"""DID:key identity plugin — deterministic public-key signatures for simulation.
+
+This is intentionally dependency-free and deterministic so traces replay
+byte-for-byte.  It is not production cryptography; for real deployments, swap
+to a proper Ed25519 implementation.
+
+Example::
+
+    identity = DidKeyIdentity(AgentId("a1"), seed=b"secret")
+    sig = identity.sign(b"payload")
+    ok = identity.verify(b"payload", sig, AgentId("a1"))
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+
+from nest_core.types import AgentId, AgentIdentity, Signature
+
+
+class DidKeyIdentity:
+    """Public-verifiable identity for simulation.
+
+    Example::
+
+        ident = DidKeyIdentity(AgentId("a1"), seed=b"seed")
+        sig = ident.sign(b"hello")
+    """
+
+    def __init__(self, agent_id: AgentId, seed: bytes = b"") -> None:
+        self._agent_id = agent_id
+        self._seed = seed
+        self._public_numbers, self._private_exponent = _derive_keypair(seed, agent_id)
+        self._public_key = _encode_public_key(self._public_numbers)
+        self._known_keys: dict[AgentId, tuple[int, int]] = {agent_id: self._public_numbers}
+
+    def register_peer(
+        self,
+        agent_id: AgentId,
+        public_key: bytes,
+        private_key: bytes | None = None,
+    ) -> None:
+        """Register a peer's public key for verification.
+
+        Example::
+
+            ident.register_peer(AgentId("a2"), peer_pk)
+        """
+        if private_key is not None:
+            msg = "register_peer accepts public keys only"
+            raise ValueError(msg)
+        self._known_keys[agent_id] = _decode_public_key(public_key)
+
+    @property
+    def public_key(self) -> bytes:
+        """This agent's public key.
+
+        Example::
+
+            pk = ident.public_key
+        """
+        return self._public_key
+
+    def sign(self, payload: bytes) -> Signature:
+        """Sign a payload with this agent's private key.
+
+        Example::
+
+            sig = ident.sign(b"data")
+        """
+        n, _e = self._public_numbers
+        digest = _digest_int(payload, n)
+        sig_int = pow(digest, self._private_exponent, n)
+        size = (n.bit_length() + 7) // 8
+        sig_bytes = sig_int.to_bytes(size, "big")
+        return Signature(signer=self._agent_id, value=sig_bytes, algorithm="sim-rsa-sha256")
+
+    def verify(self, payload: bytes, sig: Signature, agent: AgentId) -> bool:
+        """Verify a signature from a given agent.
+
+        Example::
+
+            ok = ident.verify(b"data", sig, AgentId("a1"))
+        """
+        if sig.signer != agent:
+            return False
+        public_numbers = self._known_keys.get(agent)
+        if public_numbers is None:
+            return False
+        n, e = public_numbers
+        sig_int = int.from_bytes(sig.value, "big")
+        if sig_int >= n:
+            return False
+        expected = _digest_int(payload, n)
+        actual = pow(sig_int, e, n)
+        return actual == expected
+
+    async def resolve(self, agent: AgentId) -> AgentIdentity:
+        """Resolve an agent ID to its identity record.
+
+        Example::
+
+            info = await ident.resolve(AgentId("a1"))
+        """
+        public_numbers = self._known_keys.get(agent)
+        pk = _encode_public_key(public_numbers) if public_numbers is not None else b""
+        return AgentIdentity(
+            agent_id=agent,
+            public_key=pk,
+            method="did:key",
+        )
+
+
+_PUBLIC_EXPONENT = 65537
+
+
+def _derive_keypair(seed: bytes, agent_id: AgentId) -> tuple[tuple[int, int], int]:
+    p = _derive_prime(seed, agent_id, b"p")
+    q = _derive_prime(seed, agent_id, b"q")
+    counter = 0
+    while p == q or math.gcd(_PUBLIC_EXPONENT, (p - 1) * (q - 1)) != 1:
+        counter += 1
+        q = _derive_prime(seed, agent_id, b"q" + counter.to_bytes(2, "big"))
+    n = p * q
+    phi = (p - 1) * (q - 1)
+    d = pow(_PUBLIC_EXPONENT, -1, phi)
+    return (n, _PUBLIC_EXPONENT), d
+
+
+def _derive_prime(seed: bytes, agent_id: AgentId, label: bytes) -> int:
+    counter = 0
+    while True:
+        material = seed + b":" + str(agent_id).encode() + b":" + label + counter.to_bytes(4, "big")
+        digest = hashlib.sha512(material).digest()
+        candidate = int.from_bytes(digest[:32], "big")
+        candidate |= 1
+        candidate |= 1 << 255
+        if _is_probable_prime(candidate):
+            return candidate
+        counter += 1
+
+
+def _is_probable_prime(n: int) -> bool:
+    if n < 2:
+        return False
+    small_primes = (2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37)
+    for prime in small_primes:
+        if n == prime:
+            return True
+        if n % prime == 0:
+            return False
+
+    d = n - 1
+    s = 0
+    while d % 2 == 0:
+        s += 1
+        d //= 2
+
+    for base in small_primes:
+        if base >= n:
+            continue
+        x = pow(base, d, n)
+        if x in (1, n - 1):
+            continue
+        for _ in range(s - 1):
+            x = pow(x, 2, n)
+            if x == n - 1:
+                break
+        else:
+            return False
+    return True
+
+
+def _encode_public_key(public_numbers: tuple[int, int]) -> bytes:
+    n, e = public_numbers
+    return json.dumps(
+        {"alg": "sim-rsa-sha256", "e": e, "n": format(n, "x")},
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("ascii")
+
+
+def _decode_public_key(public_key: bytes) -> tuple[int, int]:
+    try:
+        data = json.loads(public_key.decode("ascii"))
+        if data.get("alg") != "sim-rsa-sha256":
+            raise ValueError
+        return int(data["n"], 16), int(data["e"])
+    except (KeyError, TypeError, ValueError, json.JSONDecodeError) as exc:
+        msg = "Invalid public key"
+        raise ValueError(msg) from exc
+
+
+def _digest_int(payload: bytes, modulus: int) -> int:
+    return int.from_bytes(hashlib.sha256(payload).digest(), "big") % modulus

{nest_plugins_reference-0.1.0 → nest_plugins_reference-0.1.1}/nest_plugins_reference/payments/prepaid_credits.py

@@ -29,10 +29,17 @@ class PrepaidCredits:
         receipt = await pay.pay(AgentId("a2"), Money(amount=50), PaymentRef("p1"))
     """
 
-    def __init__(self, agent_id: AgentId, initial_balance: int = 1000) -> None:
+    def __init__(
+        self,
+        agent_id: AgentId,
+        initial_balance: int = 1000,
+        balances: dict[AgentId, int] | None = None,
+        payments: dict[PaymentRef, Receipt] | None = None,
+    ) -> None:
         self._agent_id = agent_id
-        self._balances: dict[AgentId, int] = {agent_id: initial_balance}
-        self._payments: dict[PaymentRef, Receipt] = {}
+        self._balances = balances if balances is not None else {}
+        self._balances.setdefault(agent_id, initial_balance)
+        self._payments = payments if payments is not None else {}
 
     def balance(self, agent: AgentId) -> int:
         """Check an agent's balance.
@@ -59,6 +66,13 @@ class PrepaidCredits:
 
             receipt = await pay.pay(AgentId("a2"), Money(amount=50), PaymentRef("p1"))
         """
+        if amount.amount <= 0:
+            msg = f"Payment amount must be positive: {amount.amount}"
+            raise ValueError(msg)
+        if ref in self._payments:
+            msg = f"Duplicate payment reference: {ref}"
+            raise ValueError(msg)
+
         payer_balance = self._balances.get(self._agent_id, 0)
         if payer_balance < amount.amount:
             msg = f"Insufficient balance: {payer_balance} < {amount.amount}"
@@ -94,6 +108,14 @@ class PrepaidCredits:
             msg = f"Payment not found: {ref}"
             raise ValueError(msg)
 
-        self._balances[receipt.payee] = self._balances.get(receipt.payee, 0) - receipt.amount.amount
+        payee_balance = self._balances.get(receipt.payee, 0)
+        if payee_balance < receipt.amount.amount:
+            msg = (
+                f"Insufficient balance for refund: {receipt.payee} has "
+                f"{payee_balance}, needs {receipt.amount.amount}"
+            )
+            raise ValueError(msg)
+
+        self._balances[receipt.payee] = payee_balance - receipt.amount.amount
         self._balances[receipt.payer] = self._balances.get(receipt.payer, 0) + receipt.amount.amount
         del self._payments[ref]

{nest_plugins_reference-0.1.0 → nest_plugins_reference-0.1.1}/pyproject.toml

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 [project]
 name = "nest-plugins-reference"
-version = "0.1.0"
+version = "0.1.1"
 description = "NEST reference plugins: default implementations for all 12 layers"
 readme = "README.md"
 requires-python = ">=3.12"

{nest_plugins_reference-0.1.0 → nest_plugins_reference-0.1.1}/tests/test_imports.py

@@ -6,4 +6,4 @@ def test_nest_plugins_reference_imports() -> None:
     """Importing nest_plugins_reference should succeed and expose a version string."""
     import nest_plugins_reference
 
-    assert nest_plugins_reference.__version__ == "0.1.0"
+    assert nest_plugins_reference.__version__ == "0.1.1"

{nest_plugins_reference-0.1.0 → nest_plugins_reference-0.1.1}/tests/test_plugins.py

@@ -16,6 +16,7 @@ from nest_core.types import (
     PaymentRef,
     PaymentStatus,
     Query,
+    Receipt,
     ServiceRef,
     Statement,
     Task,
@@ -122,6 +123,23 @@ class TestDidKeyIdentity:
         sig = ident.sign(b"payload")
         assert not ident.verify(b"wrong", sig, AgentId("a1"))
 
+    def test_verify_peer_with_public_key_only(self) -> None:
+        from nest_plugins_reference.identity.did_key import DidKeyIdentity
+
+        sender = DidKeyIdentity(AgentId("a1"), seed=b"seed")
+        verifier = DidKeyIdentity(AgentId("a2"), seed=b"seed")
+        verifier.register_peer(AgentId("a1"), sender.public_key)
+
+        sig = sender.sign(b"payload")
+        assert verifier.verify(b"payload", sig, AgentId("a1"))
+
+    def test_register_peer_rejects_private_key(self) -> None:
+        from nest_plugins_reference.identity.did_key import DidKeyIdentity
+
+        ident = DidKeyIdentity(AgentId("a1"), seed=b"seed")
+        with pytest.raises(ValueError, match="public keys only"):
+            ident.register_peer(AgentId("a2"), ident.public_key, private_key=b"secret")
+
     @pytest.mark.asyncio
     async def test_resolve(self) -> None:
         from nest_plugins_reference.identity.did_key import DidKeyIdentity
@@ -302,6 +320,29 @@ class TestPrepaidCredits:
         q = await pay.quote(ServiceRef("svc"))
         assert q.price.amount == 10
 
+    @pytest.mark.asyncio
+    async def test_shared_ledger_debits_calling_agent(self) -> None:
+        from nest_plugins_reference.payments.prepaid_credits import PrepaidCredits
+
+        balances = {AgentId("buyer"): 100, AgentId("seller"): 0}
+        payments: dict[PaymentRef, Receipt] = {}
+        buyer = PrepaidCredits(AgentId("buyer"), balances=balances, payments=payments)
+        seller = PrepaidCredits(AgentId("seller"), balances=balances, payments=payments)
+
+        await buyer.pay(AgentId("seller"), Money(amount=40), PaymentRef("p1"))
+
+        assert buyer.balance(AgentId("buyer")) == 60
+        assert seller.balance(AgentId("seller")) == 40
+        assert await seller.verify_payment(PaymentRef("p1")) == PaymentStatus.CONFIRMED
+
+    @pytest.mark.asyncio
+    async def test_rejects_non_positive_payment(self) -> None:
+        from nest_plugins_reference.payments.prepaid_credits import PrepaidCredits
+
+        pay = PrepaidCredits(AgentId("a1"), initial_balance=100)
+        with pytest.raises(ValueError, match="positive"):
+            await pay.pay(AgentId("a2"), Money(amount=0), PaymentRef("p1"))
+
 
 # ---------------------------------------------------------------------------
 # 8. Coordination: contract_net

nest_plugins_reference-0.1.0/nest_plugins_reference/identity/did_key.py

@@ -1,101 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""DID:key identity plugin — Ed25519 key-based identity.
-
-Uses hashlib for deterministic key derivation in simulation (no real crypto
-needed for testing). For real deployments, swap to a proper Ed25519 library.
-
-Example::
-
-    identity = DidKeyIdentity(AgentId("a1"), seed=b"secret")
-    sig = identity.sign(b"payload")
-    ok = identity.verify(b"payload", sig, AgentId("a1"))
-"""
-
-from __future__ import annotations
-
-import hashlib
-import hmac
-
-from nest_core.types import AgentId, AgentIdentity, Signature
-
-
-class DidKeyIdentity:
-    """Ed25519-style identity using HMAC-SHA256 for simulation.
-
-    Example::
-
-        ident = DidKeyIdentity(AgentId("a1"), seed=b"seed")
-        sig = ident.sign(b"hello")
-    """
-
-    def __init__(self, agent_id: AgentId, seed: bytes = b"") -> None:
-        self._agent_id = agent_id
-        self._seed = seed
-        key_material = hashlib.sha256(seed + agent_id.encode()).digest()
-        self._private_key = key_material
-        self._public_key = hashlib.sha256(key_material).digest()
-        self._known_keys: dict[AgentId, bytes] = {agent_id: self._public_key}
-        self._private_keys: dict[AgentId, bytes] = {agent_id: self._private_key}
-
-    def register_peer(
-        self,
-        agent_id: AgentId,
-        public_key: bytes,
-        private_key: bytes | None = None,
-    ) -> None:
-        """Register a peer's public key (and optionally private key) for verification.
-
-        Example::
-
-            ident.register_peer(AgentId("a2"), peer_pk)
-        """
-        self._known_keys[agent_id] = public_key
-        if private_key is not None:
-            self._private_keys[agent_id] = private_key
-
-    @property
-    def public_key(self) -> bytes:
-        """This agent's public key.
-
-        Example::
-
-            pk = ident.public_key
-        """
-        return self._public_key
-
-    def sign(self, payload: bytes) -> Signature:
-        """Sign a payload with this agent's private key.
-
-        Example::
-
-            sig = ident.sign(b"data")
-        """
-        sig_bytes = hmac.new(self._private_key, payload, hashlib.sha256).digest()
-        return Signature(signer=self._agent_id, value=sig_bytes, algorithm="hmac-sha256")
-
-    def verify(self, payload: bytes, sig: Signature, agent: AgentId) -> bool:
-        """Verify a signature from a given agent.
-
-        Example::
-
-            ok = ident.verify(b"data", sig, AgentId("a1"))
-        """
-        private_key = self._private_keys.get(agent)
-        if private_key is None:
-            return False
-        expected = hmac.new(private_key, payload, hashlib.sha256).digest()
-        return hmac.compare_digest(sig.value, expected)
-
-    async def resolve(self, agent: AgentId) -> AgentIdentity:
-        """Resolve an agent ID to its identity record.
-
-        Example::
-
-            info = await ident.resolve(AgentId("a1"))
-        """
-        pk = self._known_keys.get(agent, b"")
-        return AgentIdentity(
-            agent_id=agent,
-            public_key=pk,
-            method="did:key",
-        )