Harvmaster/sync-server-v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added auth and request storage

Browse Source
This commit is contained in:
Harvmaster
2026-08-31 12:28:18 +00:00
parent 6febaf327a
commit 1ca9648c09
21 changed files with 634 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/routes/account.ts
+105
View File
@@ -0,0 +1,105 @@
import { z } from "zod";
import type { AuthSecp256k1 } from '../auth/auth.ts';
import type { Database } from "../services/storage/database.ts";
import type { RouteDefinition, RouteStream } from './types.ts';
import type { Accounts } from '../auth/accounts.ts';
import { HTTP_STATUS_CODE_NOT_IMPLEMENTED, HTTP_STATUS_CODE_SUCCESS } from "../constants.ts";
import { UnauthorizedError } from '../errors/index.ts';
const accountSchema = z.object({
publicKey: z.string(),
signature: z.string(),
timestamp: z.coerce.number(),
});
const setBalanceSchema = z.object({
amount: z.number(),
});
export class AccountRoute {
constructor(private readonly database: Database, private readonly auth: AuthSecp256k1, private readonly accounts: Accounts) {}
async getRoutes(): Promise<Array<RouteDefinition>> {
return [
{
url: '/account',
handler: this.getAccount.bind(this),
},
{
url: '/account/balance',
handler: this.getAccount.bind(this),
},
{
url: '/account/setbalance',
handler: this.setBalance.bind(this),
},
// This one may not make sense. It could be a large overhead for something that most wont use?
// Maybe make this an optional endpoint or one that we don't support, but the client can try to hit or something?
{
url: '/account/ledger',
handler: this.getLedger.bind(this),
}
];
}
async getAccount(stream: RouteStream): Promise<void> {
// Get the public key, signature and timestamp from the headers
const { publicKey, signature, timestamp } = accountSchema.parse(stream.headers);
// Create the canonical payload for the signature verification
const payload = `${stream.path}:${timestamp}`;
// Verify the signature
const verified = await this.auth.verifySignature(publicKey, signature, payload);
if (!verified) {
throw new UnauthorizedError('Invalid signature');
}
// Get the account's balance from the database
const balance = await this.accounts.getBalance(publicKey);
// Send the balance to the client
stream.send({
statusCode: HTTP_STATUS_CODE_SUCCESS,
body: balance,
});
}
async setBalance(stream: RouteStream): Promise<void> {
const { publicKey, signature, timestamp } = accountSchema.parse(stream.headers);
const { amount } = setBalanceSchema.parse(stream.body);
// Create the canonical payload for the signature verification
const payload = `${stream.path}:${timestamp}`;
// Verify the signature
const verified = await this.auth.verifySignature(publicKey, signature, payload);
if (!verified) {
throw new UnauthorizedError('Invalid signature');
}
// Get the account's balance from the database
const balance = await this.accounts.getBalance(publicKey);
// Set the balance to the database
await this.accounts.setBalance(publicKey, amount);
// Send the balance to the client
stream.send({
statusCode: HTTP_STATUS_CODE_SUCCESS,
body: balance,
});
}
async getLedger(stream: RouteStream): Promise<void> {
stream.send({
statusCode: HTTP_STATUS_CODE_NOT_IMPLEMENTED,
body: 'Not implemented',
});
}
}
source/routes/resources.ts
+42 -80
View File
@@ -1,14 +1,16 @@
import { createHash } from 'node:crypto';
import { hexToBin, instantiateSecp256k1, type Secp256k1 } from '@bitauth/libauth';
// NOTE: Replace this with libauth sha256
import { toExtendedJson } from '@xo-cash/utils';
import { z } from 'zod';
import { HTTP_STATUS_CODE_NOT_ACCEPTED } from '../constants.ts';
import type{ AuthSecp256k1 } from '../auth/auth.ts';
import type { BaseBroadcaster } from '../services/broadcaster.ts';
import { ApplicationError, UnauthorizedError } from '../errors/index.ts';
import type { Database } from '../services/storage/database.ts';
import type { RouteDefinition, RouteModule, RouteStream } from './types.ts';
import type { Accounts } from '../auth/accounts.ts';
/**
* Schema to validate a single write resource.
@@ -56,16 +58,11 @@ type WriteResource = z.infer<typeof writeResource>;
* RouteStream API.
*/
export class DataRoute implements RouteModule {
/**
* Promise to instantiate the secp256k1 library
* This is a bit annoying, but keeping a single instance alive makes more sense than instantiating it for each verification.
*/
private readonly secp256k1Promise: Promise<Secp256k1> = instantiateSecp256k1();
constructor(
private readonly database: Database,
private readonly broadcaster: BaseBroadcaster,
private readonly timestampWindowMs: number,
private readonly auth: AuthSecp256k1,
private readonly accounts: Accounts,
) {}
/** Declare exact routes; each handler owns its stream behavior. */
@@ -92,7 +89,7 @@ export class DataRoute implements RouteModule {
/** Reads the requested resources from the database, returning all instances for each resource */
async getData(stream: RouteStream): Promise<void> {
const resourceIds = this.getResourceIds(stream);
const resourceIds = resourceIdsSchema.parse(stream.body).resourceId;
// Remove duplicates.
const uniqueIds = [ ...new Set(resourceIds) ];
@@ -107,7 +104,7 @@ export class DataRoute implements RouteModule {
// Read the data from the database.
const rows = await this.database.db
.selectFrom('resource_data')
.select([ 'resource_id', 'public_key', 'blob', 'timestamp' ])
.select([ 'resource_id', 'public_key', 'blob', 'timestamp', 'signature' ])
.where('resource_id', 'in', uniqueIds)
.orderBy('timestamp', 'asc')
.execute();
@@ -118,6 +115,7 @@ export class DataRoute implements RouteModule {
publicKey: row.public_key,
blob: new Uint8Array(row.blob),
timestamp: row.timestamp,
signature: row.signature,
}));
await stream.send(formattedRows);
@@ -132,6 +130,10 @@ export class DataRoute implements RouteModule {
async writeData(stream: RouteStream): Promise<void> {
const { resources } = writeBody.parse(stream.body);
// temporarily disable the signature verification for testing
// const publicKey = stream.headers?.['x-public-key']
const publicKey = 'public-key';
// Authenticate the whole batch before producing any storage side effects.
// A single bad signature rejects the entire write — no partial commits.
await Promise.all(resources.map((resource) => this.verifyWriteResource(resource)));
@@ -141,11 +143,22 @@ export class DataRoute implements RouteModule {
resourceId: resource.id,
publicKey: resource.publicKey,
blob: Buffer.from(resource.value),
signature: resource.signature,
}));
// Get the total size of the bytes being written
const totalSize = rows.reduce((acc, row) => acc + row.blob.length, 0);
if (!await this.accounts.hasSufficientBalance(publicKey, totalSize)) {
throw new ApplicationError(203, 'Insufficient balance');
}
// Set the balance of the public key
await this.accounts.deductBalance(publicKey, totalSize);
// Upsert every row atomically; conflicts update blob and timestamp only.
await this.database.db.transaction().execute(async (trx) => {
for (const { resourceId, publicKey, blob } of rows) {
for (const { resourceId, publicKey, blob, signature } of rows) {
await trx
.insertInto('resource_data')
.values({
@@ -153,6 +166,7 @@ export class DataRoute implements RouteModule {
public_key: publicKey,
blob,
timestamp,
signature,
})
.onConflict((oc) =>
oc.columns([ 'resource_id', 'public_key' ]).doUpdateSet({
@@ -164,36 +178,38 @@ export class DataRoute implements RouteModule {
});
// Format the rows into the written resource responses.
const written = rows.map(({ resourceId, publicKey, blob }) => ({
resourceId,
const written = rows.map(({ resourceId, publicKey, blob, signature }) => ({
instance: {
resourceId,
publicKey,
blob: new Uint8Array(blob),
timestamp,
signature,
},
}));
// Notify subscribers on each changed resource. Topic names are scoped per
// resource id so clients only receive events for resources they joined.
for (const { resourceId, instance } of written) {
await this.broadcaster.publish(DataRoute.resourceTopic(resourceId), {
for (const { instance } of written) {
await this.broadcaster.publish(DataRoute.resourceTopic(instance.resourceId), {
type: 'instance-changed',
data: { resourceId, ...instance },
data: instance,
});
}
// Return the persisted instances so the writer can confirm what was stored.
await stream.send({
resources: written.map(({ resourceId, instance }) => ({
id: resourceId,
resources: written.map(({ instance }) => ({
id: instance.resourceId,
...instance,
})),
balance: await this.accounts.getBalance(publicKey),
});
}
/** Subscribe this connection to future changes for the requested resources. */
async subscribeData(stream: RouteStream): Promise<void> {
const resourceIds = this.getResourceIds(stream);
const resourceIds = resourceIdsSchema.parse(stream.body).resourceId;
const topics = resourceIds.map((resourceId) => DataRoute.resourceTopic(resourceId));
@@ -209,7 +225,7 @@ export class DataRoute implements RouteModule {
* unsubscribe implicitly by aborting the HTTP request.
*/
async unsubscribeData(stream: RouteStream): Promise<void> {
const resourceIds = this.getResourceIds(stream);
const resourceIds = resourceIdsSchema.parse(stream.body).resourceId;
// If the stream is not bidirectional, throw an error.
if (!stream.bidirectional) {
@@ -224,14 +240,6 @@ export class DataRoute implements RouteModule {
await stream.send({});
}
/** Extract resource id list from the decoded request body. */
private getResourceIds(stream: RouteStream): string[] {
const body =
typeof stream.body === 'object' && stream.body !== null && !Array.isArray(stream.body) ? (stream.body as Record<string, unknown>) : {};
return resourceIdsSchema.parse(body).resourceId;
}
/**
* Verify one write's timestamp freshness and secp256k1 signature.
*
@@ -239,62 +247,16 @@ export class DataRoute implements RouteModule {
* id, and value — not the raw HTTP/WebSocket envelope.
*/
private async verifyWriteResource(resource: WriteResource): Promise<void> {
this.assertFreshTimestamp(resource.timestamp);
this.auth.assertTimestampFreshness(resource.timestamp);
if (!(await this.verifySignature(resource.publicKey, resource.signature, DataRoute.canonicalWritePayload(resource)))) {
// Compile the signature payload as `Timestamp:ID:Value`
const signaturePayload = `${resource.timestamp}:${resource.id}:${toExtendedJson(resource.value)}`;
if (!(await this.auth.verifySignature(resource.publicKey, resource.signature, signaturePayload))) {
throw new UnauthorizedError('Invalid resource signature');
}
}
/**
* Reject writes with stale timestamps to limit replay window.
*
* Both past and future timestamps outside the window are rejected.
*/
private assertFreshTimestamp(timestamp: number): void {
const age = Math.abs(Date.now() - timestamp);
if (age > this.timestampWindowMs) {
throw new UnauthorizedError('Timestamp outside allowed window');
}
}
/**
* Verify a secp256k1 signature.
*
* @param publicKeyHex - The public key to verify the signature against.
* @param signatureHex - The signature to verify.
* @param payload - The payload to verify the signature against.
* @returns Whether the signature is valid.
*/
private async verifySignature(publicKeyHex: string, signatureHex: string, payload: string): Promise<boolean> {
const secp256k1 = await this.secp256k1Promise;
try {
// Convert the public key and signature to binary.
const publicKey = hexToBin(publicKeyHex);
const signature = hexToBin(signatureHex);
// Create a SHA-256 hash of the payload.
const messageHash = createHash('sha256').update(payload)
.digest();
// Low-S normalization rejects malleable signature encodings.
return secp256k1.verifySignatureDERLowS(signature, publicKey, messageHash);
} catch {
return false;
}
}
/**
* Build the transport-independent payload authenticated by each signature.
*
* canonicalBody ensures Uint8Array values hash consistently regardless of
* whether the client sent them over HTTP or WebSocket.
*/
private static canonicalWritePayload(resource: WriteResource): string {
return `${resource.timestamp}${resource.id}${toExtendedJson(resource.value)}`;
}
/** Broadcaster topic for a single resource's instance-changed events. */
private static resourceTopic(resourceId: string): string {
return `resource:${resourceId}`;
source/routes/types.ts
+7
View File
@@ -1,5 +1,8 @@
import type { BaseStream } from '../services/stream/base-stream.js';
/** Canonical request headers exposed to transport-neutral route handlers. */
export type RequestHeaders = Readonly<Record<string, string>>;
export type RouteSendOptions = {
/** Defaults to `response`; any other value sends an application event. */
@@ -20,7 +23,11 @@ export interface RouteStream {
/** Connection shared by every request on the same transport session. */
readonly connection: BaseStream;
/** Canonical route path selected for this request. */
readonly path: string;
readonly body: unknown;
readonly headers: RequestHeaders;
readonly streaming: boolean;
readonly bidirectional: boolean;