canic_core/workflow/rpc/capability/

proof.rs

use crate::{
    cdk::types::Principal,
    dto::{
        capability::{
            CapabilityProof, CapabilityProofBlob, DelegatedGrantProof, RoleAttestationProof,
        },
        error::Error,
        rpc::{CreateCanisterParent, Request},
    },
    ops::{
        ic::IcOps, storage::children::CanisterChildrenOps,
        storage::registry::subnet::SubnetRegistryOps,
    },
};
use candid::{decode_one, encode_one};
use std::convert::TryFrom;

/// verify_root_structural_proof
///
/// Verify structural proof constraints for capability families that allow it.
pub(super) fn verify_root_structural_proof(capability: &Request) -> Result<(), Error> {
    let caller = IcOps::msg_caller();

    if SubnetRegistryOps::get(caller).is_none() {
        return Err(Error::forbidden(
            "structural proof requires caller to be registered in subnet registry",
        ));
    }

    match capability {
        Request::Cycles(_) => Ok(()),
        Request::CreateCanister(request) => verify_root_structural_create(request),
        Request::UpgradeCanister(request) => {
            verify_root_structural_child_target(caller, request.canister_pid, "upgrade")
        }
        Request::RecycleCanister(request) => {
            verify_root_structural_child_target(caller, request.canister_pid, "recycle")
        }
        Request::IssueRoleAttestation(_) | Request::IssueInternalInvocationProof(_) => {
            Err(Error::forbidden(
                "structural proof is only supported for root cycles, child provision, child upgrade, and child recycle capabilities",
            ))
        }
    }
}

fn verify_root_structural_create(
    request: &crate::dto::rpc::CreateCanisterRequest,
) -> Result<(), Error> {
    if matches!(&request.parent, CreateCanisterParent::ThisCanister) {
        return Ok(());
    }

    Err(Error::forbidden(
        "structural provision proof requires parent=ThisCanister",
    ))
}

fn verify_root_structural_child_target(
    caller: Principal,
    target_pid: Principal,
    operation: &str,
) -> Result<(), Error> {
    let target = SubnetRegistryOps::get(target_pid).ok_or_else(|| {
        Error::forbidden(format!(
            "structural proof requires registered {operation} target"
        ))
    })?;
    if target.parent_pid != Some(caller) {
        return Err(Error::forbidden(format!(
            "structural proof requires {operation} target to be a direct child of caller"
        )));
    }
    Ok(())
}

/// verify_nonroot_structural_cycles_proof
///
/// Verify that a structural cycles request came from a cached direct child.
pub(super) fn verify_nonroot_structural_cycles_proof() -> Result<(), Error> {
    let caller = IcOps::msg_caller();

    if !CanisterChildrenOps::contains_pid(&caller) {
        return Err(Error::forbidden(
            "structural proof requires caller to be a direct child of receiver",
        ));
    }

    Ok(())
}

/// verify_capability_hash_binding
///
/// Ensure the proof hash matches canonical capability payload bytes.
pub(super) fn verify_capability_hash_binding(
    target_canister: Principal,
    capability_version: u16,
    capability: &Request,
    capability_hash: [u8; 32],
) -> Result<(), Error> {
    let expected = super::root_capability_hash(target_canister, capability_version, capability)?;
    if capability_hash != expected {
        return Err(Error::invalid(
            "capability_hash does not match capability payload",
        ));
    }

    Ok(())
}

// --- Wire Encoding ------------------------------------------------------

// Encode the full role-attestation proof into the compact shared wire blob.
pub(super) fn encode_role_attestation_blob(
    proof: &RoleAttestationProof,
) -> Result<CapabilityProofBlob, Error> {
    Ok(CapabilityProofBlob {
        proof_version: proof.proof_version,
        capability_hash: proof.capability_hash,
        payload: encode_one(proof).map_err(|err| {
            Error::internal(format!("failed to encode role attestation proof: {err}"))
        })?,
    })
}

// Decode a role-attestation wire blob back into its concrete proof payload.
pub(super) fn decode_role_attestation_blob(
    blob: &CapabilityProofBlob,
) -> Result<RoleAttestationProof, Error> {
    let proof: RoleAttestationProof = decode_one(&blob.payload)
        .map_err(|err| Error::invalid(format!("failed to decode role attestation proof: {err}")))?;

    if proof.proof_version != blob.proof_version {
        return Err(Error::invalid(
            "role attestation proof_version does not match wire header",
        ));
    }
    if proof.capability_hash != blob.capability_hash {
        return Err(Error::invalid(
            "role attestation capability_hash does not match wire header",
        ));
    }

    Ok(proof)
}

// Encode the full delegated-grant proof into the compact shared wire blob.
pub(super) fn encode_delegated_grant_blob(
    proof: &DelegatedGrantProof,
) -> Result<CapabilityProofBlob, Error> {
    Ok(CapabilityProofBlob {
        proof_version: proof.proof_version,
        capability_hash: proof.capability_hash,
        payload: encode_one(proof).map_err(|err| {
            Error::internal(format!("failed to encode delegated grant proof: {err}"))
        })?,
    })
}

// Decode a delegated-grant wire blob back into its concrete proof payload.
pub(super) fn decode_delegated_grant_blob(
    blob: &CapabilityProofBlob,
) -> Result<DelegatedGrantProof, Error> {
    let proof: DelegatedGrantProof = decode_one(&blob.payload)
        .map_err(|err| Error::invalid(format!("failed to decode delegated grant proof: {err}")))?;

    if proof.proof_version != blob.proof_version {
        return Err(Error::invalid(
            "delegated grant proof_version does not match wire header",
        ));
    }
    if proof.capability_hash != blob.capability_hash {
        return Err(Error::invalid(
            "delegated grant capability_hash does not match wire header",
        ));
    }

    Ok(proof)
}

impl TryFrom<RoleAttestationProof> for CapabilityProof {
    type Error = Error;

    fn try_from(value: RoleAttestationProof) -> Result<Self, Self::Error> {
        Ok(Self::RoleAttestation(encode_role_attestation_blob(&value)?))
    }
}

impl TryFrom<DelegatedGrantProof> for CapabilityProof {
    type Error = Error;

    fn try_from(value: DelegatedGrantProof) -> Result<Self, Self::Error> {
        Ok(Self::DelegatedGrant(encode_delegated_grant_blob(&value)?))
    }
}