Coverage / crates/spectra-core/src/keys.rs 76.6%

pub fn default_home() -> PathBuf {

    if let Some(h) = std::env::var_os("SPECTRA_HOME").filter(|h| !h.is_empty()) {

        return PathBuf::from(h);

}

    pub fn generate(name: &str, contact: &str) -> KeyPair {

        let secret = SecretKey::generate();

        let identity = secret.identity(name, contact, crate::ids::now_ms());

        KeyPair { key: identity.hash(), identity, secret }

    }

    pub fn sign(&self, message: &[u8]) -> Signature {

        self.secret.sign(&self.key, message)

    }

    pub fn create_home(home: &Path, name: &str, contact: &str) -> Result<KeyPair> {

        if current_key(home)?.is_some() {

            bail!("{} already holds an identity", home.display());

        }

        let pair = KeyPair::generate(name, contact);

        fs::create_dir_all(home).with_context(|| format!("creating {}", home.display()))?;

            fs::set_permissions(home, fs::Permissions::from_mode(0o700))?;

        pair.write(home)?;

        Ok(pair)

    }

    fn write(&self, home: &Path) -> Result<()> {

        let keys = home.join("keys");

        write_atomic_private(&keys.join(format!("{}.secret", self.key.to_hex())), &self.secret.encode(&self.key))?;

        write_atomic(&keys.join(format!("{}.identity", self.key.to_hex())), &self.identity.encode())?;

        write_atomic(

            &home.join("identity.toml"),

            format!(

                "# The identity this home signs with (spec §8.0).\ncurrent = \"{}\"\nname = {}\n",

                self.key.to_hex(),

                toml_str(&self.identity.name)

            )

            .as_bytes(),

        Ok(())

    }

    pub fn load_home(home: &Path) -> Result<KeyPair> {

        let keys = home.join("keys");

        let key = match current_key(home)? {

            Some(k) => k,

                let secrets: Vec<PathBuf> = fs::read_dir(&keys)

                    .with_context(|| format!("{} holds no identity (spectra identity create)", home.display()))?

        KeyPair::load_key(home, &key)

    }

    pub fn load_key(home: &Path, key: &KeyId) -> Result<KeyPair> {

        let keys = home.join("keys");

        KeyPair::load(&keys.join(format!("{}.secret", key.to_hex())), &keys.join(format!("{}.identity", key.to_hex())))

    }

    pub fn load(secret: &Path, identity: &Path) -> Result<KeyPair> {

        let (key, secret_key) = SecretKey::decode(&fs::read(secret).with_context(|| format!("reading {}", secret.display()))?)

            .map_err(|e| anyhow::anyhow!("{}: {e}", secret.display()))?;

        let identity = Identity::decode(&fs::read(identity).with_context(|| format!("reading {}", identity.display()))?)

            .map_err(|e| anyhow::anyhow!("{}: {e}", identity.display()))?;

        if identity.hash() != key {

        }

        if !secret_key.matches(&identity) {

        }

        Ok(KeyPair { key, identity, secret: secret_key })

    }

    pub fn instance(data: &Path, name: &str) -> Result<KeyPair> {

        let keys = data.join("keys");

        let (secret, identity) = (keys.join("instance.secret"), keys.join("instance.identity"));

        if secret.exists() {

            return KeyPair::load(&secret, &identity);

        }

        fs::create_dir_all(&keys)?;

        let pair = KeyPair::generate(name, "");

        write_atomic_private(&secret, &pair.secret.encode(&pair.key))?;

        write_atomic(&identity, &pair.identity.encode())?;

        Ok(pair)

    }

    pub fn succeed(&self, home: &Path, delegates: Vec<Delegate>) -> Result<KeyPair> {

        let identity = self.identity.successor(delegates, self.identity.expires, crate::ids::now_ms());

        let next = KeyPair { key: identity.hash(), identity, secret: self.secret.clone() };

        next.write(home)?;

        Ok(next)

    }

pub fn delegate(home: &Path, key: KeyId, expires: Option<u64>) -> Result<KeyPair> {

    let cur = KeyPair::load_home(home)?;

    let mut d: Vec<Delegate> = cur.identity.delegates.iter().filter(|x| x.key != key).cloned().collect();

    d.push(Delegate { key, expires });

    cur.succeed(home, d)

}

pub fn undelegate(home: &Path, key: KeyId) -> Result<KeyPair> {

    let cur = KeyPair::load_home(home)?;

    let d = cur.identity.delegates.iter().filter(|x| x.key != key).cloned().collect();

    cur.succeed(home, d)

}

pub fn home_identity(home: &Path) -> Result<Identity> {

    let key = current_key(home)?.with_context(|| format!("{} holds no identity (spectra identity create)", home.display()))?;

    let path = home.join("keys").join(format!("{}.identity", key.to_hex()));

    Identity::decode(&fs::read(&path).with_context(|| format!("reading {}", path.display()))?)

        .map_err(|e| anyhow::anyhow!("{}: {e}", path.display()))

}

fn current_key(home: &Path) -> Result<Option<KeyId>> {

    let path = home.join("identity.toml");

    let Ok(text) = fs::read_to_string(&path) else { return Ok(None) };

    let table: toml::Table = text.parse().with_context(|| format!("reading {}", path.display()))?;

    match table.get("current").and_then(|v| v.as_str()) {

        Some(hex) => Ok(Some(KeyId::from_hex(hex).with_context(|| format!("{}: current is not a KeyId", path.display()))?)),

}

fn toml_str(s: &str) -> String {

    toml::Value::String(s.to_string()).to_string()

}

    fn a_home_made_here_reads_back_signs_and_delegates() {

        let dir = tempfile::tempdir().unwrap();

        let made = KeyPair::create_home(dir.path(), "Andy McCall", "").unwrap();

        let read = KeyPair::load_home(dir.path()).unwrap();

        assert_eq!(made.key, read.key);

        assert_eq!(home_identity(dir.path()).unwrap().hash(), made.key);

        let msg = b"spectra1 test message of some length";

        crate::identity::verify(&made.identity, &read.sign(msg), msg).unwrap();

        assert!(KeyPair::create_home(dir.path(), "again", "").is_err());

        let agent = KeyPair::generate("claude", "");

        let next = delegate(dir.path(), agent.key, Some(u64::MAX)).unwrap();

        assert_eq!(next.identity.previous, Some(made.key));

        assert_eq!(KeyPair::load_home(dir.path()).unwrap().key, next.key, "the successor is current");

        assert!(next.identity.delegates_to(&agent.key, 1));

        assert!(KeyPair::load_key(dir.path(), &made.key).is_ok(), "the old identity is kept");

        let after = undelegate(dir.path(), agent.key).unwrap();

        assert!(!after.identity.delegates_to(&agent.key, 1));

    }

    fn the_instance_key_is_made_once() {

        let dir = tempfile::tempdir().unwrap();

        let a = KeyPair::instance(dir.path(), "laptop").unwrap();

        let b = KeyPair::instance(dir.path(), "laptop").unwrap();

        assert_eq!(a.key, b.key);

    }