voxa-code 0.1.0__py3-none-any.whl

server/appattest.py

@@ -0,0 +1,310 @@
+"""Verify Apple App Attest attestations and assertions (real cryptography).
+
+App Attest binds an anonymous device account to a key generated inside the
+device's Secure Enclave. The flow, per Apple's "Validating Apps That Connect to
+Your Server":
+
+  * ATTESTATION (once, at registration): the app calls
+    `DCAppAttestService.attestKey` with a server-issued challenge and sends us the
+    CBOR attestation object. We verify the embedded X.509 chain roots to Apple's
+    App Attest root, that the challenge-derived nonce matches the one Apple signed
+    into the leaf certificate, that the key id equals the SHA-256 of the attested
+    public key, and that the relying-party id hash matches our app id. On success
+    we trust and store the device's public key.
+
+  * ASSERTION (per request, later): the app signs a challenge/payload with the
+    same key; we verify the ECDSA signature with the stored public key and that
+    the signature counter strictly increases (replay guard).
+
+Everything fails CLOSED: any missing field, malformed structure, or mismatch
+returns None. We never trust a leaf signature without rooting the chain to the
+bundled Apple App Attest root (an attacker controls the leaf otherwise).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+
+import cbor2
+from cryptography import x509
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec, padding
+from cryptography.x509.oid import ObjectIdentifier
+
+logger = logging.getLogger(__name__)
+
+# Apple's App Attest root, shipped so verification works out of the box. Override
+# with VOXA_APPATTEST_ROOT (e.g. tests point it at a synthetic root).
+_BUNDLED_ROOT = os.path.join(
+    os.path.dirname(__file__), "certs", "Apple_App_Attestation_Root_CA.pem"
+)
+
+# OID Apple stamps the attestation nonce into on the leaf certificate.
+_NONCE_OID = ObjectIdentifier("1.2.840.113635.100.8.2")
+
+# aaguid values Apple sets in authData. Production keys use "appattest" + NULs;
+# development keys use the literal "appattestdevelop".
+_AAGUID_PROD = b"appattest\x00\x00\x00\x00\x00\x00\x00"
+_AAGUID_DEV = b"appattestdevelop"
+
+
+def _root_path() -> str:
+    return os.environ.get("VOXA_APPATTEST_ROOT", "").strip() or _BUNDLED_ROOT
+
+
+def _der_len(data: bytes, i: int) -> tuple[int, int]:
+    """Read a DER length starting at index i; return (length, index_after_length)."""
+    first = data[i]
+    i += 1
+    if first < 0x80:
+        return first, i
+    n = first & 0x7F
+    length = int.from_bytes(data[i : i + n], "big")
+    return length, i + n
+
+
+def _extract_attest_nonce(der: bytes) -> bytes | None:
+    """Pull the nonce octet string out of the leaf's App Attest extension.
+
+    The extension value is DER: SEQUENCE { [1] EXPLICIT OCTET STRING nonce }.
+    """
+    try:
+        i = 0
+        if der[i] != 0x30:  # SEQUENCE
+            return None
+        i += 1
+        _, i = _der_len(der, i)
+        if der[i] != 0xA1:  # [1] context-specific, constructed
+            return None
+        i += 1
+        _, i = _der_len(der, i)
+        if der[i] != 0x04:  # OCTET STRING
+            return None
+        i += 1
+        ln, i = _der_len(der, i)
+        return der[i : i + ln]
+    except Exception:
+        return None
+
+
+def _verify_chain(chain: list[x509.Certificate]) -> bool:
+    """Verify the presented cert chain (leaf -> ... -> top) roots to the pinned
+    Apple App Attest root. Every link's signature must check out AND the top of
+    the chain must be, or be signed by, our trusted root. Fails closed."""
+    root_path = _root_path()
+    if not os.path.exists(root_path):
+        logger.error("App Attest root cert not found at %s; refusing attestation", root_path)
+        return False
+    if not chain:
+        return False
+    try:
+        with open(root_path, "rb") as f:
+            root = x509.load_pem_x509_certificate(f.read())
+
+        def signed_by(parent: x509.Certificate, child: x509.Certificate) -> bool:
+            pub = parent.public_key()
+            try:
+                if isinstance(pub, ec.EllipticCurvePublicKey):
+                    pub.verify(child.signature, child.tbs_certificate_bytes,
+                               ec.ECDSA(child.signature_hash_algorithm))
+                else:
+                    pub.verify(child.signature, child.tbs_certificate_bytes,
+                               padding.PKCS1v15(), child.signature_hash_algorithm)
+                return True
+            except Exception:
+                return False
+
+        for child, parent in zip(chain, chain[1:]):
+            if not signed_by(parent, child):
+                return False
+
+        top = chain[-1]
+        if top.fingerprint(hashes.SHA256()) == root.fingerprint(hashes.SHA256()):
+            return True
+        return signed_by(root, top)
+    except Exception:
+        logger.warning("App Attest chain verification error", exc_info=True)
+        return False
+
+
+def _cose_ec_public_key(cose: bytes):
+    """Parse a COSE_Key (EC2/P-256) and return (cryptography EC public key, raw
+    uncompressed point 0x04||x||y). Returns None on any mismatch."""
+    try:
+        key = cbor2.loads(cose)
+        if not isinstance(key, dict):
+            return None
+        if key.get(1) != 2:        # kty must be EC2
+            return None
+        if key.get(-1) != 1:       # crv must be P-256
+            return None
+        x = key.get(-2)
+        y = key.get(-3)
+        if not isinstance(x, (bytes, bytearray)) or not isinstance(y, (bytes, bytearray)):
+            return None
+        if len(x) != 32 or len(y) != 32:
+            return None
+        numbers = ec.EllipticCurvePublicNumbers(
+            int.from_bytes(x, "big"), int.from_bytes(y, "big"), ec.SECP256R1())
+        pub = numbers.public_key()
+        raw = b"\x04" + bytes(x) + bytes(y)
+        return pub, raw
+    except Exception:
+        return None
+
+
+def verify_attestation(attestation: bytes, key_id: bytes, challenge: bytes,
+                       app_id: str, *, allow_dev: bool = True) -> dict | None:
+    """Verify an App Attest attestation object.
+
+    Returns {"public_key_pem": <PEM str>, "counter": int, "receipt": bytes|None}
+    on success, else None (fails closed on any mismatch).
+    """
+    try:
+        obj = cbor2.loads(attestation)
+    except Exception:
+        logger.warning("App Attest: attestation is not valid CBOR")
+        return None
+    if not isinstance(obj, dict) or obj.get("fmt") != "apple-appattest":
+        logger.warning("App Attest: unexpected fmt")
+        return None
+    att_stmt = obj.get("attStmt")
+    auth_data = obj.get("authData")
+    if not isinstance(att_stmt, dict) or not isinstance(auth_data, (bytes, bytearray)):
+        return None
+    auth_data = bytes(auth_data)
+    x5c = att_stmt.get("x5c")
+    if not isinstance(x5c, list) or len(x5c) < 1:
+        return None
+
+    # (1) Build + verify the certificate chain to Apple's root.
+    try:
+        chain = [x509.load_der_x509_certificate(bytes(c)) for c in x5c]
+    except Exception:
+        logger.warning("App Attest: could not parse x5c chain")
+        return None
+    if not _verify_chain(chain):
+        logger.warning("App Attest: chain did not root to trusted Apple root; rejecting")
+        return None
+    cred_cert = chain[0]
+
+    # (2) nonce = SHA256(authData || SHA256(challenge)).
+    client_data_hash = hashlib.sha256(bytes(challenge)).digest()
+    nonce = hashlib.sha256(auth_data + client_data_hash).digest()
+
+    # (3) The leaf must carry exactly this nonce in Apple's extension.
+    try:
+        ext = cred_cert.extensions.get_extension_for_oid(_NONCE_OID)
+        cert_nonce = _extract_attest_nonce(ext.value.value)
+    except Exception:
+        logger.warning("App Attest: leaf missing nonce extension")
+        return None
+    if cert_nonce is None or cert_nonce != nonce:
+        logger.warning("App Attest: nonce mismatch (wrong challenge or forged attestation)")
+        return None
+
+    # (4) Parse authData.
+    if len(auth_data) < 37:
+        return None
+    rp_id_hash = auth_data[0:32]
+    if rp_id_hash != hashlib.sha256(app_id.encode()).digest():
+        logger.warning("App Attest: rpIdHash != sha256(app_id)")
+        return None
+    # flags = auth_data[32]  (unused for attestation beyond presence)
+    sign_count = int.from_bytes(auth_data[33:37], "big")
+    # Attested credential data follows: aaguid(16) credIdLen(2) credId COSEKey.
+    if len(auth_data) < 37 + 16 + 2:
+        return None
+    aaguid = auth_data[37:53]
+    if aaguid == _AAGUID_PROD:
+        pass
+    elif aaguid == _AAGUID_DEV:
+        if not allow_dev:
+            logger.warning("App Attest: development aaguid rejected (allow_dev off)")
+            return None
+    else:
+        logger.warning("App Attest: unexpected aaguid")
+        return None
+    cred_id_len = int.from_bytes(auth_data[53:55], "big")
+    cred_id_start = 55
+    cred_id_end = cred_id_start + cred_id_len
+    if len(auth_data) < cred_id_end:
+        return None
+    cred_id = auth_data[cred_id_start:cred_id_end]
+    if cred_id != bytes(key_id):
+        logger.warning("App Attest: credId != key_id")
+        return None
+    cose = auth_data[cred_id_end:]
+
+    # (5) Extract the P-256 public key and confirm key_id == sha256(raw pubkey).
+    parsed = _cose_ec_public_key(cose)
+    if parsed is None:
+        logger.warning("App Attest: bad COSE public key")
+        return None
+    pub, raw = parsed
+    if hashlib.sha256(raw).digest() != bytes(key_id):
+        logger.warning("App Attest: key_id != sha256(public key)")
+        return None
+
+    pem = pub.public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    ).decode()
+    return {
+        "public_key_pem": pem,
+        "counter": sign_count,
+        "receipt": att_stmt.get("receipt"),
+    }
+
+
+def verify_assertion(assertion: bytes, client_data: bytes, public_key_pem: str,
+                     app_id: str, prev_counter: int) -> int | None:
+    """Verify an App Attest assertion signed by a previously attested key.
+
+    Returns the new (strictly increasing) signature counter, or None if the
+    signature is invalid, the rpIdHash is wrong, or the counter did not advance.
+    """
+    try:
+        obj = cbor2.loads(assertion)
+    except Exception:
+        return None
+    if not isinstance(obj, dict):
+        return None
+    signature = obj.get("signature")
+    authenticator_data = obj.get("authenticatorData")
+    if not isinstance(signature, (bytes, bytearray)) or \
+            not isinstance(authenticator_data, (bytes, bytearray)):
+        return None
+    signature = bytes(signature)
+    authenticator_data = bytes(authenticator_data)
+
+    # nonce = SHA256(authenticatorData || SHA256(clientData)); the ECDSA signature
+    # is over that nonce. Verifying over the concatenation with ES256 is identical
+    # (ES256 applies SHA256 first), so let cryptography hash it.
+    client_data_hash = hashlib.sha256(bytes(client_data)).digest()
+    try:
+        pub = serialization.load_pem_public_key(public_key_pem.encode())
+    except Exception:
+        return None
+    if not isinstance(pub, ec.EllipticCurvePublicKey):
+        return None
+    try:
+        pub.verify(signature, authenticator_data + client_data_hash,
+                   ec.ECDSA(hashes.SHA256()))
+    except InvalidSignature:
+        return None
+    except Exception:
+        return None
+
+    if len(authenticator_data) < 37:
+        return None
+    rp_id_hash = authenticator_data[0:32]
+    if rp_id_hash != hashlib.sha256(app_id.encode()).digest():
+        return None
+    sign_count = int.from_bytes(authenticator_data[33:37], "big")
+    if sign_count <= prev_counter:  # replay / non-advancing counter
+        return None
+    return sign_count

server/appstore.py

@@ -0,0 +1,141 @@
+"""Verify Apple StoreKit 2 signed transactions (JWS).
+
+A StoreKit 2 transaction is a JWS whose protected header carries the signing
+certificate chain in `x5c` (leaf -> intermediate -> Apple root). Verification:
+  1. take the leaf cert from x5c, use its public key to check the JWS signature,
+  2. confirm the x5c chain roots to Apple's real root CA (MANDATORY),
+  3. read the payload (productId, transactionId, bundleId, expiresDate).
+
+Step 2 is mandatory and fails closed: the leaf cert travels inside the token, so
+leaf-signature-only verification is trivially forgeable (an attacker signs with
+their own key + cert). We ship Apple's public root ("Apple Root CA - G3") in
+`certs/AppleRootCA-G3.pem` and verify the presented chain against it. Override
+with APPLE_ROOT_CERT only to point at a different trusted root (e.g. tests).
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import logging
+import os
+
+logger = logging.getLogger(__name__)
+
+# Apple's public StoreKit root, shipped with the package so verification works
+# out of the box (SHA-256 63:34:3A:BF:...:91:79). APPLE_ROOT_CERT overrides it.
+_BUNDLED_ROOT = os.path.join(os.path.dirname(__file__), "certs", "AppleRootCA-G3.pem")
+
+
+def _root_path() -> str:
+    return os.environ.get("APPLE_ROOT_CERT", "").strip() or _BUNDLED_ROOT
+
+
+def _b64url_json(segment: str) -> dict:
+    pad = "=" * (-len(segment) % 4)
+    return json.loads(base64.urlsafe_b64decode(segment + pad))
+
+
+def decode_unverified(jws: str) -> dict:
+    """Decode the payload without checking the signature (never trust alone)."""
+    try:
+        return _b64url_json(jws.split(".")[1])
+    except Exception:
+        return {}
+
+
+def _leaf_public_key_pem(jws: str):
+    header = _b64url_json(jws.split(".")[0])
+    x5c = header.get("x5c") or []
+    if not x5c:
+        return None
+    from cryptography import x509
+    der = base64.b64decode(x5c[0])
+    cert = x509.load_der_x509_certificate(der)
+    from cryptography.hazmat.primitives import serialization
+    return cert.public_key().public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+
+
+def verify_transaction(jws: str, bundle_id: str | None = None) -> dict | None:
+    """Return the verified transaction payload, or None if invalid.
+
+    Verifies the JWS signature with the leaf certificate embedded in the token AND
+    that the embedded chain roots to Apple's trusted root. Both must pass.
+    """
+    import jwt  # PyJWT
+
+    pem = _leaf_public_key_pem(jws)
+    if pem is None:
+        logger.warning("StoreKit transaction has no x5c leaf cert")
+        return None
+    try:
+        payload = jwt.decode(jws, pem, algorithms=["ES256"], options={"verify_aud": False})
+    except Exception as e:
+        logger.warning("StoreKit JWS signature invalid: %s", e)
+        return None
+
+    if bundle_id and payload.get("bundleId") not in (None, bundle_id):
+        logger.warning("StoreKit bundleId mismatch: %s != %s", payload.get("bundleId"), bundle_id)
+        return None
+
+    # MANDATORY chain check. The leaf signature above only proves the token was
+    # signed by whoever's cert is in x5c[0] — which the sender controls — so without
+    # rooting the chain to Apple, anyone can forge a valid-looking transaction.
+    if not _verify_chain(jws):
+        logger.warning("StoreKit cert chain did not verify to Apple's root; rejecting transaction")
+        return None
+
+    return payload
+
+
+def _verify_chain(jws: str) -> bool:
+    """Verify the x5c chain (leaf -> intermediate -> Apple root) against the trusted
+    root. Returns True only when every link's signature checks out AND the top of the
+    presented chain is (or is signed by) our pinned Apple root."""
+    root_path = _root_path()
+    if not os.path.exists(root_path):
+        logger.error("Apple root cert not found at %s; refusing to verify purchases", root_path)
+        return False
+    try:
+        from cryptography import x509
+        from cryptography.hazmat.primitives import hashes
+        from cryptography.hazmat.primitives.asymmetric import ec, padding
+
+        header = _b64url_json(jws.split(".")[0])
+        x5c = header.get("x5c") or []
+        if not x5c:
+            return False
+        chain = [x509.load_der_x509_certificate(base64.b64decode(c)) for c in x5c]
+        with open(root_path, "rb") as f:
+            root = x509.load_pem_x509_certificate(f.read())
+
+        def signed_by(parent, child) -> bool:
+            pub = parent.public_key()
+            try:
+                if isinstance(pub, ec.EllipticCurvePublicKey):
+                    pub.verify(child.signature, child.tbs_certificate_bytes,
+                               ec.ECDSA(child.signature_hash_algorithm))
+                else:
+                    pub.verify(child.signature, child.tbs_certificate_bytes,
+                               padding.PKCS1v15(), child.signature_hash_algorithm)
+                return True
+            except Exception:
+                return False
+
+        # Every presented link must verify: leaf<-intermediate<-...<-top.
+        for child, parent in zip(chain, chain[1:]):
+            if not signed_by(parent, child):
+                return False
+
+        # The top of the presented chain must anchor to OUR pinned Apple root:
+        # either it IS the root (chain includes it), or the root signed it.
+        top = chain[-1]
+        if top.fingerprint(hashes.SHA256()) == root.fingerprint(hashes.SHA256()):
+            return True
+        return signed_by(root, top)
+    except Exception:
+        logger.warning("StoreKit chain verification error", exc_info=True)
+        return False

server/attested_store.py

@@ -0,0 +1,60 @@
+"""Store of App-Attested device keys.
+
+JSON-backed (like UserStore/Billing). Maps a key id (hex of the Secure Enclave
+key's id) to the account it attests, the stored P-256 public key (PEM), and the
+last-seen signature counter (for the assertion replay guard). Once a key is
+bound to a `d-<uuid>` account, that account is considered attested: it may mint a
+free trial and open metered sessions when attestation is required.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import threading
+
+
+class AttestedStore:
+    def __init__(self, path: str | None = None):
+        self._path = path or os.environ.get("VOXA_ATTESTED_FILE", "attested.json")
+        self._lock = threading.Lock()
+        self._data: dict = self._load()
+
+    def _load(self) -> dict:
+        try:
+            with open(self._path) as f:
+                return json.load(f)
+        except (OSError, ValueError):
+            return {}
+
+    def _save(self) -> None:
+        tmp = f"{self._path}.tmp"
+        with open(tmp, "w") as f:
+            json.dump(self._data, f)
+        os.replace(tmp, self._path)
+
+    def get(self, key_id: str) -> dict | None:
+        with self._lock:
+            rec = self._data.get(key_id)
+            return dict(rec) if rec else None
+
+    def put(self, key_id: str, account: str, public_key_pem: str, counter: int) -> None:
+        with self._lock:
+            self._data[key_id] = {
+                "account": account,
+                "public_key_pem": public_key_pem,
+                "counter": int(counter),
+            }
+            self._save()
+
+    def update_counter(self, key_id: str, counter: int) -> None:
+        with self._lock:
+            rec = self._data.get(key_id)
+            if rec is not None:
+                rec["counter"] = int(counter)
+                self._save()
+
+    def account_is_attested(self, account: str) -> bool:
+        """True if any stored key is bound to this account."""
+        with self._lock:
+            return any(rec.get("account") == account for rec in self._data.values())

server/auth.py

@@ -0,0 +1,70 @@
+"""Sign in with Apple verification + auth routes for Voxa Cloud."""
+
+from __future__ import annotations
+
+import jwt  # PyJWT
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from jwt import PyJWKClient
+
+from server.users import UserStore, issue_token, verify_token
+
+APPLE_ISS = "https://appleid.apple.com"
+APPLE_JWKS_URL = "https://appleid.apple.com/auth/keys"
+
+
+def verify_apple_identity_token(identity_token: str, bundle_id: str,
+                                jwks_url: str = APPLE_JWKS_URL) -> dict | None:
+    """Verify an Apple identity token (RS256, signed by Apple). Returns the claims
+    (sub, optional email) or None. iss must be Apple; aud must be our bundle id."""
+    try:
+        key = PyJWKClient(jwks_url).get_signing_key_from_jwt(identity_token)
+        return jwt.decode(identity_token, key.key, algorithms=["RS256"],
+                          audience=bundle_id, issuer=APPLE_ISS)
+    except Exception:
+        return None
+
+
+def bearer_user(request: Request, secret: str) -> str | None:
+    """Return the user_id from a verified `Authorization: Bearer <token>` header."""
+    header = request.headers.get("authorization", "")
+    if not header.lower().startswith("bearer "):
+        return None
+    return verify_token(header[7:].strip(), secret)
+
+
+def add_auth_routes(app: FastAPI, users: UserStore, *, secret: str, bundle_id: str,
+                    apple_verifier=verify_apple_identity_token,
+                    billing=None) -> None:
+    @app.post("/auth/apple")
+    async def auth_apple(request: Request):
+        body = await request.json()
+        token = (body or {}).get("identity_token", "")
+        if not token:
+            return JSONResponse({"error": "missing identity_token"}, status_code=400)
+        claims = apple_verifier(token, bundle_id)
+        if not claims or not claims.get("sub"):
+            return JSONResponse({"error": "invalid identity token"}, status_code=401)
+        email = (body or {}).get("email") or claims.get("email")
+        uid = users.find_or_create_apple_user(claims["sub"], email)
+        return {"token": issue_token(uid, secret), "user_id": uid}
+
+    @app.get("/auth/me")
+    async def auth_me(request: Request):
+        uid = bearer_user(request, secret)
+        if not uid:
+            return JSONResponse({"error": "unauthorized"}, status_code=401)
+        user = users.get_user(uid) or {}
+        return {"user_id": uid, "email": user.get("email")}
+
+    @app.delete("/auth/account")
+    async def delete_account(request: Request):
+        """Permanently delete the signed-in account and its data (App Review
+        Guideline 5.1.1(v)). Idempotent: succeeds even if already gone."""
+        uid = bearer_user(request, secret)
+        if not uid:
+            return JSONResponse({"error": "unauthorized"}, status_code=401)
+        users.delete_user(uid)
+        if billing is not None:
+            billing.delete_account(uid)   # drop the account's minute balance/ledger
+        return {"ok": True}