im-core 0.1.0

Rust IM SDK for Awiki clients built on Agent Network Protocol (ANP)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

use anp::PrivateKeyMaterial;
use rusqlite::Connection;
use serde_json::Value;

use super::client::DirectSecureClientInput;

pub(crate) struct DirectSecureIdentityMaterial {
    pub(crate) owner_identity_id: String,
    pub(crate) owner_did: String,
    pub(crate) identity_name: String,
    pub(crate) signing_key_id: String,
    pub(crate) agreement_key_id: String,
    pub(crate) signing_private_pem: String,
    pub(crate) agreement_private_pem: String,
    pub(crate) local_did_document: Value,
}

impl DirectSecureIdentityMaterial {
    pub(crate) fn client_input<'a>(
        &self,
        local_state: &'a Connection,
    ) -> DirectSecureClientInput<'a> {
        DirectSecureClientInput {
            owner_identity_id: self.owner_identity_id.clone(),
            owner_did: self.owner_did.clone(),
            identity_name: self.identity_name.clone(),
            signing_key_id: self.signing_key_id.clone(),
            agreement_key_id: self.agreement_key_id.clone(),
            signing_private_pem: self.signing_private_pem.clone(),
            agreement_private_pem: self.agreement_private_pem.clone(),
            local_did_document: self.local_did_document.clone(),
            local_state,
        }
    }
}

pub(crate) struct DirectSecureAgreementMaterial {
    pub(crate) agreement_key_id: String,
    pub(crate) agreement_private_pem: String,
}

pub(crate) fn local_identity_material(
    client: &crate::core::ImClient,
) -> crate::ImResult<DirectSecureIdentityMaterial> {
    let runtime = client.runtime();
    let local_did_document = runtime.key_provider.did_document()?;
    let signing_private_pem = runtime.key_provider.default_signing_private_pem()?;
    let agreement_private_pem = runtime.key_provider.e2ee_agreement_private_pem()?;
    let owner_did = client.did().as_str().to_owned();
    Ok(DirectSecureIdentityMaterial {
        owner_identity_id: client.current_identity().id.as_str().to_owned(),
        owner_did: owner_did.clone(),
        identity_name: client
            .current_identity()
            .local_alias
            .clone()
            .unwrap_or_else(|| client.current_identity().id.as_str().to_owned()),
        signing_key_id: format!("{owner_did}#key-1"),
        agreement_key_id: format!("{owner_did}#key-3"),
        signing_private_pem,
        agreement_private_pem,
        local_did_document,
    })
}

pub(crate) fn agreement_material(
    client: &crate::core::ImClient,
) -> crate::ImResult<DirectSecureAgreementMaterial> {
    let owner_did = client.did().as_str().to_owned();
    Ok(DirectSecureAgreementMaterial {
        agreement_key_id: format!("{owner_did}#key-3"),
        agreement_private_pem: client.runtime().key_provider.e2ee_agreement_private_pem()?,
    })
}

pub(crate) fn agreement_private_key(
    client: &crate::core::ImClient,
) -> crate::ImResult<PrivateKeyMaterial> {
    let material = agreement_material(client)?;
    PrivateKeyMaterial::from_pem(&material.agreement_private_pem).map_err(|err| {
        crate::ImError::Serialization {
            detail: format!("parse direct E2EE agreement private key: {err}"),
        }
    })
}

pub(crate) fn local_did_document(client: &crate::core::ImClient) -> crate::ImResult<Value> {
    client.runtime().key_provider.did_document()
}

#[cfg(test)]
mod tests {
    #[test]
    fn secure_direct_key_material_scanner_rejects_runtime_secret_path_reads() {
        let manifest_dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
        let files = [
            "src/internal/secure_direct/prepare.rs",
            "src/internal/secure_direct/send.rs",
            "src/internal/secure_direct/incoming.rs",
            "src/internal/secure_direct/async_send.rs",
            "src/internal/secure_direct/async_receive.rs",
        ];
        let forbidden = [
            "runtime.private_key_path",
            "runtime.e2ee_agreement_private_key_path",
            "runtime.did_document_path",
            ".private_key_path.clone()",
            ".e2ee_agreement_private_key_path.clone()",
            ".did_document_path.clone()",
        ];
        for file in files {
            let path = manifest_dir.join(file);
            let source = std::fs::read_to_string(&path).expect("secure direct source should read");
            for pattern in forbidden {
                assert!(
                    !source.contains(pattern),
                    "{file} must not contain `{pattern}`; use secure_direct::identity_material"
                );
            }
        }
    }
}