Updates

source/auth/auth.ts

@@ -1,110 +1,122 @@
-import type { Database } from '../services/storage/database';
+import type { Database } from '../services/storage/database.ts';
 
 import { hexToBin, instantiateSecp256k1, type Secp256k1, sha256 } from '@bitauth/libauth';
-import { UnauthorizedError } from '../errors/unauthorized-error';
+import { UnauthorizedError } from '../errors/unauthorized-error.ts';
 
 export type AuthSecp256k1RequiredDeps = {
-  database: Database;
+    database: Database;
-}
+};
 
 export type AuthSecp256k1OptionalDeps = {
-  secp256k1: Secp256k1;
+    secp256k1: Secp256k1;
-}
+};
 export type AuthSecp256k1Deps = AuthSecp256k1RequiredDeps & Partial<AuthSecp256k1OptionalDeps>;
 
 export type AuthSecp256k1Options = {
-  timestampWindowMs: number;
+    timestampWindowMs: number;
-}
+};
 
 export class AuthSecp256k1 {
-  /**
+    /**
-   * Create a new instance of AuthSecp256k1
+     * Create a new instance of AuthSecp256k1
-   * @returns A new instance of AuthSecp256k1
+     * @returns A new instance of AuthSecp256k1
-   */
+     */
-  static async create(inputDeps: AuthSecp256k1Deps, options: AuthSecp256k1Options): Promise<AuthSecp256k1> {
+    static async create(inputDeps: AuthSecp256k1Deps, options: AuthSecp256k1Options): Promise<AuthSecp256k1> {
-    const deps = {
+        const deps = {
-      secp256k1: await instantiateSecp256k1(),
+            secp256k1: await instantiateSecp256k1(),
-      ...inputDeps,
+            ...inputDeps,
+        };
+
+        return new AuthSecp256k1(deps, options);
     }
 
-    return new AuthSecp256k1(deps, options);
+    /**
-  }
+     * TODO: Consider adding a Record<string, Mutex> where each key is the signature to guarantee signatures arent being processed concurrently.
+     */
+    readonly #deps: Required<AuthSecp256k1Deps>;
+    readonly #options: AuthSecp256k1Options;
 
-  /**
+    /**
-   * TODO: Consider adding a Record<string, Mutex> where each key is the signature to guarantee signatures arent being processed concurrently.
+     * @param deps - The dependencies to use
-   */
+     * @param options - The options to use
-
+     */
-  /**
+    private constructor(deps: Required<AuthSecp256k1Deps>, options: AuthSecp256k1Options) {
-   * @param deps - The dependencies to use
+        this.#deps = deps;
-   * @param options - The options to use
+        this.#options = options;
-   */
-  private constructor(private readonly deps: Required<AuthSecp256k1Deps>, private readonly options: AuthSecp256k1Options) {}
-
-  /**
-   * Verify a signature
-   * @param publicKeyHex - The public key to verify the signature against
-   * @param signatureHex - The signature to verify
-   * @param payload - The payload to verify the signature against
-   * @returns Whether the signature is valid
-   */
-  async verifySignature(publicKeyHex: string, signatureHex: string, payload: string): Promise<boolean> {
-    return true;
-    // Convert the public key and signature to binary
-    const publicKey = hexToBin(publicKeyHex);
-    const signature = hexToBin(signatureHex);
-
-    // Convert the payload to bytes and compute the sha256 hash
-    const payloadBytes = new TextEncoder().encode(payload);
-    const messageHash = sha256.hash(payloadBytes);
-
-    // Verify the signature
-    const verified = await this.deps.secp256k1.verifySignatureDERLowS(signature, publicKey, messageHash);
-
-    // If the signature is not valid, throw an unauthorized error
-    if (!verified) {
-      throw new UnauthorizedError('Invalid signature');
     }
 
-    // Return the verified signature
+    /**
-    return verified;
+     * Verify a signature
-  }
+     * @param publicKeyHex - The public key to verify the signature against
+     * @param signatureHex - The signature to verify
+     * @param payload - The payload to verify the signature against
+     * @returns Whether the signature is valid
+     */
+    async verifySignature(publicKeyHex: string, signatureHex: string, payload: string): Promise<boolean> {
+        // Convert the public key and signature to binary
+        const publicKey = hexToBin(publicKeyHex);
+        const signature = hexToBin(signatureHex);
 
-  async verifyUniqueRequest(signature: string): Promise<boolean> {
+        // Convert the payload to bytes and compute the sha256 hash
-    if (!signature) {
+        const payloadBytes = new TextEncoder().encode(payload);
-      throw new UnauthorizedError('Signature is required');
+        const messageHash = sha256.hash(payloadBytes);
+
+        // Verify the signature
+        const verified = this.#deps.secp256k1.verifySignatureDERLowS(signature, publicKey, messageHash);
+
+        // If the signature is not valid, throw an unauthorized error
+        if (!verified) {
+            throw new UnauthorizedError('Invalid signature');
+        }
+
+        // Return the verified signature
+        return verified;
     }
 
-    console.log('Verifying unique request', signature);
+    /**
+     * Verify a signature is unique and add it to the database if it is
+     *
+     * @param signature - The signature to verify
+     * @returns Whether the signature is unique
+     */
+    async verifyUniqueRequest(signature: string): Promise<boolean> {
+        // If the signature is not provided, throw an unauthorized error
+        if (!signature) {
+            throw new UnauthorizedError('Signature is required');
+        }
 
-    // Check if the signature has been used before
+        // Check if the signature has been used before
-    const request = await this.deps.database.db.
+        const request = await this.#deps.database.db.selectFrom('authed_requests').selectAll()
-      selectFrom('authed_requests')
+.where('signature', '=', signature)
-      .selectAll()
+.executeTakeFirst();
-      .where('signature', '=', signature)
+
-      .executeTakeFirst();
+        // If the signature has been used before, throw an unauthorized error
-    
+        if (request) {
-    if (request) {
+            throw new UnauthorizedError('Request already used');
-      throw new UnauthorizedError('Request already used');
+        }
+
+        // Add the signature to the requests table
+        await this.#deps.database.db.insertInto('authed_requests').values({ signature })
+.execute();
+
+        // Return true if the signature is valid
+        return true;
     }
 
-    // Add the signature to the requests table
+    /**
-    await this.deps.database.db.insertInto('authed_requests').values({ signature }).execute();
+     * Assert that a timestamp is within a allowed window
+     * @param timestamp - The timestamp to check
+     * @param windowMs - The window in milliseconds
+     *
+     * @throws An {@link UnauthorizedError} if the timestamp is outside the allowed window
+     */
+    assertTimestampFreshness(timestamp: number, windowMs = this.#options.timestampWindowMs): void {
+        // Subtract the timestamp from the current time to get the age in milliseconds
+        const age = Math.abs(Date.now() - timestamp);
 
-    // Return true if the signature is valid
+        // If the timestamp is outside the allowed window, throw an unauthorized error
-    return true;
+        if (age > windowMs) {
-  }
+            throw new UnauthorizedError('Timestamp outside allowed window');
-
+        }
-  /**
-   * Assert that a timestamp is within a allowed window
-   * @param timestamp - The timestamp to check
-   * @param windowMs - The window in milliseconds
-   *
-   * @throws An {@link UnauthorizedError} if the timestamp is outside the allowed window
-   */
-  assertTimestampFreshness(timestamp: number, windowMs = this.options.timestampWindowMs): void {
-    const age = Math.abs(Date.now() - timestamp);
-    if (age > windowMs) {
-      throw new UnauthorizedError('Timestamp outside allowed window');
     }
-  }
+}
-}

source/index.ts

@@ -88,7 +88,10 @@ export class App {
     startUniqueRequestCleanup(cleanupIntervalMs: number, timestampWindowMs: number): void {
         // Every 10 seconds, we will cleanup the requests table
         setInterval(async () => {
-            await this.database.db.deleteFrom('authed_requests').where('timestamp', '<', Date.now() - timestampWindowMs).execute();
+            await this.database.db
+                .deleteFrom('authed_requests')
+                .where('timestamp', '<', Date.now() - timestampWindowMs)
+                .execute();
         }, cleanupIntervalMs);
     }
 }

source/services/router.ts

@@ -24,24 +24,30 @@ export type ApplicationRequest = {
 };
 
 export type ApplicationRouterDependencies = {
+
     /** Authentication service. */
     auth: AuthSecp256k1;
 };
 
-const accountSchema = z.object({
+const accountSchema = z
-    'x-public-key': z.string(),
+    .object({
-    'x-signature': z.string(),
+        'x-public-key': z.string(),
-    'x-timestamp': z.coerce.number(),
+        'x-signature': z.string(),
-}).transform((data) => ({
+        'x-timestamp': z.coerce.number(),
-    publicKey: data['x-public-key'],
+    })
-    signature: data['x-signature'],
+    .transform((data) => ({
-    timestamp: data['x-timestamp'],
+        publicKey: data['x-public-key'],
-}));
+        signature: data['x-signature'],
+        timestamp: data['x-timestamp'],
+    }));
 
 /** Exact-match application routing shared by every wire transport. */
 export class ApplicationRouter {
     /** @param routes - Validated route table keyed by exact path. */
-    private constructor(private readonly deps: ApplicationRouterDependencies, private readonly routes: ReadonlyMap<string, RouteDefinition>) {}
+    private constructor(
+        private readonly deps: ApplicationRouterDependencies,
+        private readonly routes: ReadonlyMap<string, RouteDefinition>,
+    ) {}
 
     /**
      * Load and validate the complete route table before accepting traffic.
@@ -74,11 +80,8 @@ export class ApplicationRouter {
      * @param connection - Shared connection stream for this transport session.
      */
     async dispatch(request: ApplicationRequest, connection: BaseStream): Promise<void> {
+        // Authenticate the headers on the request.
         const { publicKey, signature, timestamp } = accountSchema.parse(request.headers);
-        // Authenticate the headers on the request. (TODO: Remove the defaults, just here for testing)
-        // const publicKey = request.headers?.['x-public-key'] || 'public-key';
-        // const signature = request.headers?.['x-signature'] || 'signature';
-        // const timestamp = request.headers?.['x-timestamp'] || Date.now();
 
         // Make sure the request signature is valid and hasnt been used before
         await this.deps.auth.verifyUniqueRequest(signature);

source/services/storage/migrations/001-resources.ts

@@ -26,7 +26,7 @@ export const up = async (db: Kysely<DatabaseTables>): Promise<void> => {
         .addColumn('signature', 'text', (col) => col.notNull())
         .addPrimaryKeyConstraint('pk_resource_data', [ 'resource_id', 'public_key' ])
         .execute();
-    
+
     // Table for authed requests
     // We will store the signature and the timestamp of the request, and we will clear out rows that are older than our msTimeout for our auth
     await db.schema
@@ -46,5 +46,7 @@ export const up = async (db: Kysely<DatabaseTables>): Promise<void> => {
 export const down = async (db: Kysely<DatabaseTables>): Promise<void> => {
     await db.schema.dropTable('resource_data').ifExists()
 .execute();
-    await db.schema.dropTable('authed_requests').ifExists().execute();
+
+    await db.schema.dropTable('authed_requests').ifExists()
+.execute();
 };

source/services/storage/tables.ts

@@ -28,6 +28,7 @@ export interface ResourceDataTable {
 }
 
 export interface AuthedRequestsTable {
+
     /** Signature of the request. */
     signature: string;
 
@@ -35,29 +36,6 @@ export interface AuthedRequestsTable {
     timestamp: Timestamp;
 }
 
-// export interface PaymentsTable {
-//     /** Unique identifier for the payment. */
-//     payment_id: string;
-
-//     /** Public key of the account in the transaction */
-//     public_key: string;
-
-//     /** Amount of the payment. This can be positive or negative.*/
-//     amount: number;
-
-//     /** Timestamp of the payment. */
-//     timestamp: Timestamp;
-
-//     /** Signature of the payment. */
-//     signature: string;
-
-//     /** Hash of the message that was signed. */
-//     message_hash: string;
-
-//     /** Resource ID of the payment. */
-//     resource_id: string;
-// }
-
 /** Complete Kysely schema mapping for the sync server database. */
 export interface DatabaseTables {
     resource_data: ResourceDataTable;

test/services/config.test.ts

@@ -18,7 +18,7 @@ const testConfigDefaultsTo1MiBRequestBodyLimit = (): void => {
     expect(config.server.host).toBe('0.0.0.0');
     expect(config.server.cors.origin).toBe('*');
     expect(config.server.cors.methods).toEqual([ 'GET', 'POST', 'PUT', 'DELETE', 'OPTIONS' ]);
-    expect(config.server.cors.allowedHeaders).toEqual([ 'Content-Type', 'cache-control', 'X-Timestamp', 'X-PublicKey', 'X-Signature' ]);
+    expect(config.server.cors.allowedHeaders).toEqual([ 'Content-Type', 'cache-control', 'X-Timestamp', 'X-Public-Key', 'X-Signature' ]);
     expect(config.auth.timestampWindowMs).toBe(300000);
 };
 

test/services/router.test.ts

@@ -1,9 +1,35 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
 import type { RouteDefinition, RouteModule } from '../../source/routes/types.ts';
 import { ApplicationRouter } from '../../source/services/router.ts';
 import { TestConnection } from '../helpers/test-connection.ts';
 
+import type { AuthSecp256k1 } from '../../source/auth/auth.ts';
+
+/**
+ * A controlled request is a request that is controlled by the test.
+ * It is used to control the request flow and ensure that the request is completed in the correct order.
+ */
+type ControlledRequest = {
+    request: Promise<void>;
+    started: Promise<void>;
+    release: () => void;
+};
+
+/**
+ * A mock of the AuthSecp256k1 service
+ */
+const auth = {
+    verifySignature: vi.fn().mockResolvedValue(true),
+    verifyUniqueRequest: vi.fn().mockResolvedValue(true),
+    assertTimestampFreshness: vi.fn().mockResolvedValue(true),
+} as unknown as AuthSecp256k1;
+
+/**
+ * A helper function to create a route module with the given routes
+ * @param routes - The routes to create the module with
+ * @returns The created route module
+ */
 const moduleWith = (routes: RouteDefinition[]): RouteModule => {
     return {
         async getRoutes(): Promise<RouteDefinition[]> {
@@ -16,75 +42,130 @@ describe('ApplicationRouter initialization', (): void => {
     it('rejects duplicate exact paths during startup', async (): Promise<void> => {
         const route = { url: '/echo', handler: (): void => undefined };
 
-        await expect(ApplicationRouter.create([ moduleWith([ route ]), moduleWith([ route ]) ])).rejects.toThrow('Duplicate application route: /echo');
+        await expect(ApplicationRouter.create({ auth }, [ moduleWith([ route ]), moduleWith([ route ]) ])).rejects.toThrow('Duplicate application route: /echo');
     });
 
     it.each([ 'echo', '/', '/items/:id', '/items?active=true', '/items#active' ])('rejects the invalid route path %s', async (url): Promise<void> => {
-        await expect(ApplicationRouter.create([ moduleWith([{ url, handler: (): void => undefined }]) ])).rejects.toThrow('Invalid application route');
+        await expect(ApplicationRouter.create({ auth }, [ moduleWith([{ url, handler: (): void => undefined }]) ])).rejects.toThrow('Invalid application route');
     });
 });
 
 describe('ApplicationRouter dispatch', (): void => {
     it('binds the connection, body, and request ID to one route stream', async (): Promise<void> => {
         const connection = new TestConnection(false, false);
-        const router = await ApplicationRouter.create([
+        const router = await ApplicationRouter.create({ auth }, [
             moduleWith([
                 {
                     url: '/echo',
                     handler: async (stream): Promise<void> => {
                         expect(stream.connection).toBe(connection);
                         expect(stream.path).toBe('/echo');
-                        expect(stream.headers).toEqual({ 'x-request-token': 'route-1' });
+                        expect(stream.headers).toEqual({ 'x-public-key': 'public-key', 'x-signature': 'signature', 'x-timestamp': '1000' });
                         await stream.send(stream.body);
                     },
                 },
             ]),
         ]);
 
-        await router.dispatch({ path: '/echo', body: { value: 1 }, requestId: 'request-1', headers: { 'x-request-token': 'route-1' } }, connection);
+        await router.dispatch(
+            {
+                path: '/echo',
+                body: { value: 1 },
+                requestId: '1',
+                headers: { 'x-public-key': 'public-key', 'x-signature': 'signature', 'x-timestamp': '1000' },
+            },
+            connection,
+        );
 
         expect(connection.messages).toEqual([
             {
-                id: 'request-1',
+                id: '1',
                 type: 'response',
                 statusCode: 200,
                 body: { value: 1 },
             },
         ]);
 
-        await expect(router.dispatch({ path: '/echo/other', body: {} }, connection)).rejects.toMatchObject({ statusCode: 404 });
+        await expect(router.dispatch(
+                { path: '/echo/other', body: {}, headers: { 'x-public-key': 'public-key', 'x-signature': 'signature', 'x-timestamp': '1000' } },
+                connection,
+            )).rejects.toMatchObject({ statusCode: 404 });
     });
 
     it('preserves correlation when concurrent requests finish out of order', async (): Promise<void> => {
-        const completions = new Map<string, () => void>();
+        const router = await ApplicationRouter.create({ auth }, [
-        const router = await ApplicationRouter.create([
             moduleWith([
                 {
                     url: '/delayed',
                     handler: async (stream): Promise<void> => {
-                        const key = (stream.body as { key: string }).key;
+                        const { key, signalStarted, released } = stream.body as {
-                        const token = stream.headers['x-request-token'];
+                            key: string;
-                        await new Promise<void>((resolve) => completions.set(key, resolve));
+                            signalStarted: () => void;
-                        await stream.send({ key, token });
+                            released: Promise<void>;
+                        };
+
+                        signalStarted();
+
+                        await released;
+                        await stream.send({ key });
                     },
                 },
             ]),
         ]);
-        const connection = new TestConnection(true, true);
 
-        const first = router.dispatch(
+        const connection = new TestConnection(false, false);
-            { path: '/delayed', body: { key: 'A' }, requestId: 'A', headers: { 'x-request-token': 'token-a' } },
-            connection,
-        );
-        const second = router.dispatch(
-            { path: '/delayed', body: { key: 'B' }, requestId: 'B', headers: { 'x-request-token': 'token-b' } },
-            connection,
-        );
 
-        completions.get('B')?.();
+        const createControlledRequest = (key: string): ControlledRequest => {
-        await second;
+            const { promise: started, resolve: signalStarted } = Promise.withResolvers<void>();
-        completions.get('A')?.();
+
-        await first;
+            const { promise: released, resolve: release } = Promise.withResolvers<void>();
+
+            const request = router.dispatch(
+                {
+                    path: '/delayed',
+                    body: {
+                        key,
+                        signalStarted,
+                        released,
+                    },
+                    requestId: key,
+                    headers: {
+                        'x-public-key': 'public-key',
+                        'x-signature': 'signature',
+                        'x-timestamp': '1000',
+                    },
+                },
+                connection,
+            );
+
+            return {
+                request,
+                started,
+                release,
+            };
+        };
+
+        const first = createControlledRequest('A');
+        const second = createControlledRequest('B');
+
+        expect(connection.messages).toEqual([]);
+
+        await Promise.all([ first.started, second.started ]);
+
+        second.release();
+        await second.request;
+
+        expect(connection.messages).toEqual([
+            {
+                id: 'B',
+                type: 'response',
+                statusCode: 200,
+                body: { key: 'B' },
+            },
+        ]);
+
+        first.release();
+        await first.request;
 
         expect(connection.messages).toEqual([
             {
@@ -104,7 +185,7 @@ describe('ApplicationRouter dispatch', (): void => {
 
     it('propagates route failures without infrastructure-specific cleanup', async (): Promise<void> => {
         const error = new Error('route failed');
-        const router = await ApplicationRouter.create([
+        const router = await ApplicationRouter.create({ auth }, [
             moduleWith([
                 {
                     url: '/failure',
@@ -115,6 +196,9 @@ describe('ApplicationRouter dispatch', (): void => {
             ]),
         ]);
 
-        await expect(router.dispatch({ path: '/failure' }, new TestConnection(false, false))).rejects.toBe(error);
+        await expect(router.dispatch(
+                { path: '/failure', headers: { 'x-public-key': 'public-key', 'x-signature': 'signature', 'x-timestamp': '1000' } },
+                new TestConnection(false, false),
+            )).rejects.toBe(error);
     });
 });

tsconfig.json

@@ -2,8 +2,8 @@
     "compilerOptions": {
         "rootDir": "./source",
         "outDir": "./dist",
-        "module": "es2022",
+        "module": "esnext",
-        "target": "es2022",
+        "target": "esnext",
         "skipLibCheck": true,
         "strict": true,
         "moduleResolution": "bundler",
@@ -15,5 +15,5 @@
         "declarationMap": true,
         "types": ["node"]
     },
-    "exclude": ["node_modules/**/*", "dist/**/*"]
+    "exclude": ["node_modules/**/*", "dist/**/*", "test/**/*"]
 }