this-me 0.3.2

Rust ground for the modern .me semantic kernel.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160

use std::collections::BTreeMap;

use this_me::kernel::{
    generate_p256_key_pair, wrap_secret_v1, ExecuteError, ExecuteValue, Kernel, Value,
    WrappedSecretOutput,
};

fn object(entries: impl IntoIterator<Item = (&'static str, Value)>) -> Value {
    Value::Object(
        entries
            .into_iter()
            .map(|(key, value)| (key.to_string(), value))
            .collect::<BTreeMap<_, _>>(),
    )
}

fn envelope(kid: &str) -> Value {
    object([
        ("version", Value::from(1_u64)),
        ("class", Value::from("identity-key")),
        ("kid", Value::from(kid)),
        (
            "encryption",
            object([
                ("kex", Value::from("ECDH-ES")),
                ("kdf", Value::from("HKDF-SHA-256")),
                ("aead", Value::from("AES-256-GCM")),
                ("iv", Value::from("test-iv")),
                ("salt", Value::from("test-salt")),
                ("tag", Value::from("test-tag")),
                ("ciphertext", Value::from("test-ciphertext")),
                ("ephemeralPK", object([("crv", Value::from("P-256"))])),
            ]),
        ),
    ])
}

#[test]
fn keyspace_write_read_and_manifest_match_typescript_routes() {
    let mut kernel = Kernel::new();
    let envelope = envelope("orgboat.keysCustomName");
    let recipient = generate_p256_key_pair().unwrap();

    kernel
        .install_recipient_key("self.master", recipient.private_key.to_bytes())
        .unwrap();

    assert_eq!(
        kernel
            .execute(
                "me://self:write/keys/orgboat.keysCustomName",
                Some(ExecuteValue::WrappedKeyWrite {
                    envelope: envelope.clone(),
                    recipient_key_id: Some("self.master".to_string()),
                }),
            )
            .unwrap(),
        ExecuteValue::WrappedKey(envelope.clone())
    );

    assert_eq!(
        kernel
            .execute("me://self:read/keys/orgboat.keysCustomName", None)
            .unwrap(),
        ExecuteValue::WrappedKey(envelope)
    );

    let ExecuteValue::KeySpaceManifest(manifest) =
        kernel.execute("me://self:read/keys", None).unwrap()
    else {
        panic!("self:read/keys should return a manifest");
    };
    assert_eq!(
        manifest
            .get("orgboat.keysCustomName")
            .and_then(|entry| entry.recipient_key_id.as_deref()),
        Some("self.master")
    );
}

#[test]
fn keyspace_envelopes_survive_snapshot_but_recipient_keys_do_not() {
    let mut kernel = Kernel::new();
    let recipient = generate_p256_key_pair().unwrap();
    let envelope = wrap_secret_v1(
        "orgboat-super-secret",
        &recipient.public_key,
        "orgboat.keysCustomName",
        "identity-key",
        Some(&recipient.public_key),
        None,
    )
    .unwrap();

    kernel
        .install_recipient_key("self.master", recipient.private_key.to_bytes())
        .unwrap();
    kernel
        .execute(
            "me://self:write/keys/orgboat.keysCustomName",
            Some(ExecuteValue::WrappedKeyWrite {
                envelope: envelope.clone(),
                recipient_key_id: Some("self.master".to_string()),
            }),
        )
        .unwrap();

    let snapshot = kernel.export_snapshot();
    assert!(snapshot.key_spaces.contains_key("orgboat.keysCustomName"));

    let mut recovered = Kernel::hydrate(snapshot).unwrap();
    assert_eq!(
        recovered
            .execute("me://self:read/keys/orgboat.keysCustomName", None)
            .unwrap(),
        ExecuteValue::WrappedKey(envelope)
    );

    let error = recovered
        .execute("me://self:open/keys/orgboat.keysCustomName", None)
        .unwrap_err();
    assert!(matches!(
        error,
        ExecuteError::NoRecipientPrivateKey(key_id) if key_id == "orgboat.keysCustomName"
    ));

    recovered
        .install_recipient_key("self.master", recipient.private_key.to_bytes())
        .unwrap();
    assert_eq!(
        recovered
            .execute(
                "me://self:use/keys/orgboat.keysCustomName",
                Some(ExecuteValue::WrappedKeyOpenOptions {
                    recipient_key_id: None,
                    recipient_private_key: None,
                    output: WrappedSecretOutput::Utf8,
                }),
            )
            .unwrap(),
        ExecuteValue::Value(Value::from("orgboat-super-secret"))
    );
}

#[test]
fn invalid_wrapped_key_envelopes_are_rejected() {
    let mut kernel = Kernel::new();

    let error = kernel
        .execute(
            "me://self:write/keys/app",
            Some(ExecuteValue::Value(object([(
                "version",
                Value::from(2_u64),
            )]))),
        )
        .unwrap_err();

    assert!(matches!(error, ExecuteError::InvalidWrappedKeyEnvelope));
}