-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactored crypto, addresses, and the engines auth to be better plugg…
…able with custom / new auth (#335) * refactored crypto, addresses, and the engines auth to be better pluggable with custom / new auth * added gavins changes * changed public key logging from base64 to hex * better abstracted away the authenticators, as suggested by Jon * added jons changed
- Loading branch information
Showing
65 changed files
with
868 additions
and
1,829 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| /* | ||
| Package auth provides an interface for developers to implement their own Kwil authentication drivers. | ||
| Similar to Go's database/sql package, developers can implement the `Authenticator` interface and register it with the `RegisterAuthenticator` function. | ||
| */ | ||
| package auth | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "strings" | ||
| ) | ||
|
|
||
| // Authenticator is an interface for authenticating an incoming call | ||
| // It is made to work with keypair authentication | ||
| type Authenticator interface { | ||
| // Verify verifies the signature against the given public key and data. | ||
| Verify(sender, msg, signature []byte) error | ||
|
|
||
| // Address returns an address from a public key | ||
| Address(sender []byte) (string, error) | ||
| } | ||
|
|
||
| var registeredAuthenticators = make(map[string]Authenticator) | ||
|
|
||
| // RegisterAuthenticator registers an authenticator with a given name | ||
| func RegisterAuthenticator(name string, auth Authenticator) error { | ||
| name = strings.ToLower(name) | ||
| if _, ok := registeredAuthenticators[name]; ok { | ||
| return fmt.Errorf("%w: %s", ErrAuthenticatorExists, name) | ||
| } | ||
|
|
||
| registeredAuthenticators[name] = auth | ||
| return nil | ||
| } | ||
|
|
||
| // getAuthenticator returns an authenticator by the name it was registered with | ||
| func getAuthenticator(name string) (Authenticator, error) { | ||
| name = strings.ToLower(name) | ||
| auth, ok := registeredAuthenticators[name] | ||
| if !ok { | ||
| return nil, fmt.Errorf("%w: %s", ErrAuthenticatorNotFound, name) | ||
| } | ||
|
|
||
| return auth, nil | ||
| } | ||
|
|
||
| // GetAddress returns an address from a public key and authenticator type | ||
| func GetAddress(authType string, sender []byte) (string, error) { | ||
| auth, err := getAuthenticator(authType) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| return auth.Address(sender) | ||
| } | ||
|
|
||
| var ( | ||
| // ErrAuthenticatorExists is returned when an authenticator is already registered | ||
| ErrAuthenticatorExists = errors.New("authenticator already exists") | ||
| // ErrAuthenticatorNotFound is returned when an authenticator is not found | ||
| ErrAuthenticatorNotFound = errors.New("authenticator not found") | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| package auth_test | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/kwilteam/kwil-db/pkg/auth" | ||
| "github.com/kwilteam/kwil-db/pkg/crypto" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| const ( | ||
| secp256k1Key = "f1aa5a7966c3863ccde3047f6a1e266cdc0c76b399e256b8fede92b1c69e4f4e" | ||
| ed25519Key = "7c67e60fce0c403ff40193a3128e5f3d8c2139aed36d76d7b5f1e70ec19c43f00aa611bf555596912bc6f9a9f169f8785918e7bab9924001895798ff13f05842" | ||
| ) | ||
|
|
||
| func Test_Auth(t *testing.T) { | ||
|
|
||
| // testCase will take a signer | ||
| // it will sign a message and verify the signature using | ||
| // the proper authenticator. It will then check that the | ||
| // address is correct | ||
| type testCase struct { | ||
| name string | ||
| signer auth.Signer | ||
| address string | ||
| } | ||
|
|
||
| var msg = []byte("foo") | ||
|
|
||
| testCases := []testCase{ | ||
| { | ||
| name: "eth personal sign", | ||
| signer: newEthSigner(secp256k1Key), | ||
| address: "0xc89D42189f0450C2b2c3c61f58Ec5d628176A1E7", | ||
| }, | ||
| { | ||
| name: "cometbft secp256k1", | ||
| signer: newCometBftSigner(secp256k1Key), | ||
| address: "6E741B9E60A1DFB6FE40B53069CFBD00A6C1FC88", | ||
| }, | ||
| { | ||
| name: "ed25519", | ||
| signer: newEd25519Signer(ed25519Key), | ||
| // ed25519 doesn't really have the concept of address, so it is just the hex public key | ||
| address: "0aa611bf555596912bc6f9a9f169f8785918e7bab9924001895798ff13f05842", | ||
| }, | ||
| { | ||
| name: "near", | ||
| signer: newNearSigner(ed25519Key), | ||
| address: "0aa611bf555596912bc6f9a9f169f8785918e7bab9924001895798ff13f05842", | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range testCases { | ||
| t.Run(tc.name, func(t *testing.T) { | ||
| sig, err := tc.signer.Sign(msg) | ||
| assert.NoError(t, err) | ||
|
|
||
| // verify the signature | ||
| err = sig.Verify(tc.signer.PublicKey(), msg) | ||
| assert.NoError(t, err) | ||
|
|
||
| // check the address | ||
| address, err := auth.GetAddress(sig.Type, tc.signer.PublicKey()) | ||
| assert.NoError(t, err) | ||
|
|
||
| assert.Equal(t, tc.address, address) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func newEthSigner(pkey string) *auth.EthPersonalSigner { | ||
| secpKey, err := crypto.Secp256k1PrivateKeyFromHex(pkey) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| return &auth.EthPersonalSigner{Secp256k1PrivateKey: *secpKey} | ||
| } | ||
|
|
||
| func newCometBftSigner(pkey string) *auth.CometBftSecp256k1Signer { | ||
| secpKey, err := crypto.Secp256k1PrivateKeyFromHex(pkey) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| return &auth.CometBftSecp256k1Signer{Secp256k1PrivateKey: *secpKey} | ||
| } | ||
|
|
||
| func newEd25519Signer(pkey string) *auth.Ed25519Signer { | ||
| edKey, err := crypto.Ed25519PrivateKeyFromHex(pkey) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| return &auth.Ed25519Signer{Ed25519PrivateKey: *edKey} | ||
| } | ||
|
|
||
| func newNearSigner(pkey string) *auth.NearSigner { | ||
| edKey, err := crypto.Ed25519PrivateKeyFromHex(pkey) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| return &auth.NearSigner{Ed25519PrivateKey: *edKey} | ||
| } |
Oops, something went wrong.