feat: implemented ClaimNetworkAccess and ClaimNetworkAuthority in

preparation for network segregation

wip

src/PolykeyAgent.ts

@@ -52,6 +52,7 @@ import * as workersUtils from './workers/utils';
 import * as clientMiddleware from './client/middleware';
 import clientServerManifest from './client/handlers';
 import agentServerManifest from './nodes/agent/handlers';
+
 /**
  * Optional configuration for `PolykeyAgent`.
  */
@@ -61,6 +62,7 @@ type PolykeyAgentOptions = {
   clientServicePort: number;
   agentServiceHost: string;
   agentServicePort: number;
+  network: string;
   seedNodes: SeedNodes;
   workers: number;
   ipv6Only: boolean;
@@ -160,6 +162,7 @@ class PolykeyAgent {
       agentServiceHost: config.defaultsUser.agentServiceHost,
       agentServicePort: config.defaultsUser.agentServicePort,
       seedNodes: config.defaultsUser.seedNodes,
+      network: config.defaultsUser.network,
       workers: config.defaultsUser.workers,
       ipv6Only: config.defaultsUser.ipv6Only,
       keys: {
@@ -687,6 +690,7 @@ class PolykeyAgent {
         groups: Array<string>;
         port: number;
       };
+      network: string;
       seedNodes: SeedNodes;
     }>;
     workers?: number;
@@ -705,6 +709,7 @@ class PolykeyAgent {
           groups: config.defaultsSystem.mdnsGroups,
           port: config.defaultsSystem.mdnsPort,
         },
+        network: config.defaultsUser.network,
         seedNodes: config.defaultsUser.seedNodes,
       });
       // Register event handlers

src/bootstrap/utils.ts

@@ -30,7 +30,7 @@ import * as utils from '../utils';
 import * as errors from '../errors';
 
 /**
- * Bootstraps the Node Path
+ * Bootstraps the Node Path`
  */
 async function bootstrapState({
   // Required parameters

src/claims/payloads/claimNetworkAccess.ts

@@ -1,6 +1,7 @@
 import type { Claim, SignedClaim } from '../types';
 import type { NodeIdEncoded } from '../../ids/types';
 import type { SignedTokenEncoded } from '../../tokens/types';
+import * as tokensSchema from '../../tokens/schemas';
 import * as ids from '../../ids';
 import * as claimsUtils from '../utils';
 import * as tokensUtils from '../../tokens/utils';
@@ -14,7 +15,8 @@ interface ClaimNetworkAccess extends Claim {
   typ: 'ClaimNetworkAccess';
   iss: NodeIdEncoded;
   sub: NodeIdEncoded;
-  signedClaimNetworkAuthorityEncoded: SignedTokenEncoded;
+  network: string;
+  signedClaimNetworkAuthorityEncoded?: SignedTokenEncoded;
 }
 
 function assertClaimNetworkAccess(
@@ -45,7 +47,18 @@ function assertClaimNetworkAccess(
     );
   }
   if (
-    claimNetworkAccess['signedClaimNetworkAuthorityEncoded'] == null
+    claimNetworkAccess['network'] == null ||
+    typeof claimNetworkAccess['network'] !== 'string'
+  ) {
+    throw new validationErrors.ErrorParse(
+      '`network` property must be a string',
+    );
+  }
+  if (
+    claimNetworkAccess['signedClaimNetworkAuthorityEncoded'] != null &&
+    !tokensSchema.validateSignedTokenEncoded(
+      claimNetworkAccess['signedClaimNetworkAuthorityEncoded'],
+    )
   ) {
     throw new validationErrors.ErrorParse(
       '`signedClaimNetworkAuthorityEncoded` property must be an encoded signed token',

src/claims/payloads/index.ts

@@ -1,3 +1,3 @@
 export * from './claimLinkIdentity';
 export * from './claimLinkNode';
-export * from './claimNetworkNode';
+export * from './claimNetworkAccess';

src/config.ts

@@ -383,6 +383,12 @@ const config = {
      */
     agentServiceHost: '::',
     agentServicePort: 0,
+    /**
+     * Hostname of network to connect to.
+     *
+     * This is defaulted to 'mainnet.polykey.com'.
+     */
+    network: 'mainnet.polykey.com',
     /**
      * Seed nodes.
      *

src/nodes/NodeConnection.ts

@@ -25,7 +25,6 @@ import * as nodesUtils from '../nodes/utils';
 import { never } from '../utils';
 import config from '../config';
 import * as networkUtils from '../network/utils';
-import * as keysUtils from '../keys/utils';
 
 type AgentClientManifest = typeof agentClientManifest;
 

src/nodes/NodeManager.ts

@@ -50,6 +50,8 @@ import * as nodesEvents from './events';
 import * as nodesErrors from './errors';
 import * as agentErrors from './agent/errors';
 import NodeConnectionQueue from './NodeConnectionQueue';
+import { assertClaimNetworkAuthority } from '../claims/payloads/claimNetworkAuthority';
+import { assertClaimNetworkAccess } from '../claims/payloads/claimNetworkAccess';
 import Token from '../tokens/Token';
 import * as keysUtils from '../keys/utils';
 import * as tasksErrors from '../tasks/errors';
@@ -58,8 +60,6 @@ import * as claimsErrors from '../claims/errors';
 import * as utils from '../utils/utils';
 import config from '../config';
 import * as networkUtils from '../network/utils';
-import { ClaimNetworkAccess, assertClaimNetworkAccess } from '../claims/payloads/claimNetworkAccess';
-import { ClaimNetworkAuthority, assertClaimNetworkAuthority } from '@/claims/payloads/claimNetworkAuthority';
 
 const abortEphemeralTaskReason = Symbol('abort ephemeral task reason');
 const abortSingletonTaskReason = Symbol('abort singleton task reason');
@@ -263,43 +263,6 @@ class NodeManager {
           cause: new AggregateError(failedConnectionErrors),
         },
       );
-    } else {
-      // Wip: We should ideally take the fastest connection and use it here for node signing.
-      const conn = successfulConnections[0].value;
-      await this.sigchain.addClaim(
-        {
-          typ: 'ClaimNetworkNode',
-          iss: nodesUtils.encodeNodeId(conn.nodeId),
-          sub: nodesUtils.encodeNodeId(this.keyRing.getNodeId()),
-        },
-        undefined,
-        async (token) => {
-          const halfSignedClaim = token.toSigned();
-          const halfSignedClaimEncoded =
-            claimsUtils.generateSignedClaim(halfSignedClaim);
-          const receivedClaim =
-            await conn.rpcClient.methods.nodesClaimNetworkSign({
-              signedTokenEncoded: halfSignedClaimEncoded,
-            });
-          const signedClaim = claimsUtils.parseSignedClaim(
-            receivedClaim.signedTokenEncoded,
-          );
-          const fullySignedToken = Token.fromSigned(signedClaim);
-          // Check that the signatures are correct
-          const targetNodePublicKey = keysUtils.publicKeyFromNodeId(
-            conn.nodeId,
-          );
-          if (
-            !fullySignedToken.verifyWithPublicKey(
-              this.keyRing.keyPair.publicKey,
-            ) ||
-            !fullySignedToken.verifyWithPublicKey(targetNodePublicKey)
-          ) {
-            throw new claimsErrors.ErrorDoublySignedClaimVerificationFailed();
-          }
-          return fullySignedToken;
-        },
-      );
     }
     if (ctx.signal.aborted) return;
 
@@ -1575,7 +1538,18 @@ class NodeManager {
     ) {
       throw new claimsErrors.ErrorDoublySignedClaimVerificationFailed();
     }
-    const authorityToken = Token.fromEncoded(token.payload.signedClaimNetworkAuthorityEncoded);
+    if (
+      token.payload.network === 'testnet.polykey.com' ||
+      token.payload.network === 'mainnet.polykey.com'
+    ) {
+      return { success: true };
+    }
+    if (token.payload.signedClaimNetworkAuthorityEncoded == null) {
+      throw new claimsErrors.ErrorDoublySignedClaimVerificationFailed();
+    }
+    const authorityToken = Token.fromEncoded(
+      token.payload.signedClaimNetworkAuthorityEncoded,
+    );
     // Verify if the token is signed
     if (
       token.payload.iss !== authorityToken.payload.sub ||
@@ -1597,23 +1571,26 @@ class NodeManager {
     for await (const [_, claim] of this.sigchain.getSignedClaims({})) {
       try {
         assertClaimNetworkAccess(claim.payload);
-      }
-      catch {
+      } catch {
         continue;
       }
-      const tokenNetworkAuthority = Token.fromEncoded(claim.payload.signedClaimNetworkAuthorityEncoded);
+      if (claim.payload.signedClaimNetworkAuthorityEncoded == null) {
+        throw new claimsErrors.ErrorDoublySignedClaimVerificationFailed();
+      }
+      const tokenNetworkAuthority = Token.fromEncoded(
+        claim.payload.signedClaimNetworkAuthorityEncoded,
+      );
       try {
         assertClaimNetworkAuthority(tokenNetworkAuthority.payload);
-      }
-      catch {
+      } catch {
         continue;
       }
       // No need to check if local claims are correctly signed by an Network Authority.
       if (
         authorityToken.verifyWithPublicKey(
           keysUtils.publicKeyFromNodeId(
             nodesUtils.decodeNodeId(claim.payload.iss)!,
-          )
+          ),
         )
       ) {
         success = true;
@@ -1627,7 +1604,7 @@ class NodeManager {
 
     return {
       success: true,
-    }
+    };
   }
 
   /**
@@ -1687,7 +1664,7 @@ class NodeManager {
       );
     }
 
-    // need to await node connection verification, if fail, need to reject connection.
+    // Need to await node connection verification, if fail, need to reject connection.
 
     // When adding a node we need to handle 3 cases
     // 1. The node already exists. We need to update it's last updated field

src/nodes/agent/errors.ts

@@ -24,7 +24,7 @@ class ErrorNodesConnectionSignalRelayVerificationFailed<
 
 class ErrorNodesClaimNetworkVerificationFailed<T> extends ErrorAgent<T> {
   static description = 'Failed to verify claim network message';
-  exitCode = sysexits.UNAVAILABLE
+  exitCode = sysexits.UNAVAILABLE;
 }
 
 export {

src/nodes/agent/handlers/NodesClaimNetworkVerify.ts

@@ -4,15 +4,10 @@ import type {
   AgentRPCResponseResult,
 } from '../types';
 import type NodeManager from '../../../nodes/NodeManager';
-import type { Host, Port } from '../../../network/types';
 import type { JSONValue } from '../../../types';
 import { UnaryHandler } from '@matrixai/rpc';
-import * as x509 from '@peculiar/x509';
 import * as agentErrors from '../errors';
 import * as agentUtils from '../utils';
-import { never } from '../../../utils';
-import * as keysUtils from '../../../keys/utils';
-import * as ids from '../../../ids';
 
 class NodesClaimNetworkVerify extends UnaryHandler<
   {
@@ -30,7 +25,10 @@ class NodesClaimNetworkVerify extends UnaryHandler<
     if (requestingNodeId == null) {
       throw new agentErrors.ErrorAgentNodeIdMissing();
     }
-    return this.container.nodeManager.handleVerifyClaimNetwork(requestingNodeId, input);
+    return this.container.nodeManager.handleVerifyClaimNetwork(
+      requestingNodeId,
+      input,
+    );
   };
 }