ockam_command 0.150.0

End-to-end encryption and mutual authentication for distributed applications.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134

use std::path::PathBuf;

use clap::Args;
use colorful::Colorful;
use miette::miette;
use tokio::sync::Mutex;
use tokio::try_join;

use crate::CommandGlobalOpts;
use ockam::identity::{CredentialRepository, CredentialSqlxDatabase, Identifier};
use ockam::Context;
use ockam_api::{fmt_log, fmt_ok};

use crate::credential::verify::verify_credential;
use crate::node::util::initialize_default_node;
use crate::node::NodeOpts;
use crate::util::parsers::identity_identifier_parser;

#[derive(Clone, Debug, Args)]
pub struct StoreCommand {
    #[arg(long = "issuer", value_name = "IDENTIFIER", value_parser = identity_identifier_parser)]
    pub issuer: Identifier,

    /// Scope is used to separate credentials given they have the same Issuer&Subject Identifiers
    /// Scope can be an arbitrary value, however project admin, project member, and account admin
    /// credentials have scope of a specific format. See [`CredentialScope`]
    #[arg(long = "scope", value_name = "CREDENTIAL_SCOPE")]
    pub scope: String,

    #[arg(group = "credential_value", value_name = "CREDENTIAL_STRING", long)]
    pub credential: Option<String>,

    #[arg(group = "credential_value", value_name = "CREDENTIAL_FILE", long)]
    pub credential_path: Option<PathBuf>,

    /// Store the identity attributes of the credential for the specified node
    #[command(flatten)]
    pub node_opts: NodeOpts,
}

impl StoreCommand {
    pub fn name(&self) -> String {
        "credential store".into()
    }

    pub async fn run(&self, ctx: &Context, opts: CommandGlobalOpts) -> miette::Result<()> {
        // Set node name in state to store identity attributes to it
        initialize_default_node(ctx, &opts).await?;
        let node_name = opts
            .state
            .get_node_or_default(&self.node_opts.at_node)
            .await?
            .name();
        let state = opts.state.clone();
        let database = state.database();
        let storage = CredentialSqlxDatabase::new(database, &node_name);

        opts.terminal
            .write_line(fmt_log!("Storing credential...\n"))?;

        let is_finished: Mutex<bool> = Mutex::new(false);

        let send_req = async {
            let credential = match verify_credential(
                &opts,
                &self.issuer,
                &self.credential,
                &self.credential_path,
            )
            .await
            {
                Ok(credential) => credential,
                Err(_err) => {
                    *is_finished.lock().await = true;
                    return Err(miette!("Credential is not verified"))?;
                }
            };

            let credential_data = credential
                .credential
                .get_credential_data()
                .map_err(|_| miette!("Invalid credential"))?;
            let purpose_key_data = credential
                .purpose_key_attestation
                .get_attestation_data()
                .map_err(|_| miette!("Invalid credential"))?;

            let subject = match credential_data.subject {
                None => {
                    *is_finished.lock().await = true;
                    return Err(miette!("credential subject is missing"))?;
                }
                Some(subject) => subject,
            };

            // store
            storage
                .put(
                    &subject,
                    &purpose_key_data.subject,
                    &self.scope,
                    credential_data.expires_at,
                    credential.clone(),
                )
                .await
                .map_err(|_e| miette!("Invalid credential"))?;

            *is_finished.lock().await = true;
            credential
                .encode_as_string()
                .map_err(|_e| miette!("Invalid credential"))
        };

        let output_messages = vec![format!("Storing credential...")];

        let progress_output = opts.terminal.loop_messages(&output_messages, &is_finished);

        let (credential, _) = try_join!(send_req, progress_output)?;

        opts.terminal
            .to_stdout()
            .machine(credential.clone())
            .json(serde_json::json!(
                {
                    "issuer": self.issuer,
                    "credential": credential
                }
            ))
            .plain(fmt_ok!("Credential stored\n"))
            .write_line()?;

        Ok(())
    }
}