dnx_core/

integrity.rs

use base64::{engine::general_purpose::STANDARD, Engine as _};
use sha2::{Digest, Sha512};

use crate::errors::{DnxError, Result};

/// Computes the SHA-512 hash of the given data and returns it in the format "sha512-<base64>".
///
/// # Arguments
///
/// * `data` - The data to hash
///
/// # Returns
///
/// A string in the format "sha512-<base64>" where <base64> is the standard base64 encoding
/// of the SHA-512 hash.
///
/// # Example
///
/// ```
/// use dnx_core::integrity::compute_sha512;
///
/// let data = b"hello world";
/// let integrity = compute_sha512(data);
/// assert!(integrity.starts_with("sha512-"));
/// ```
pub fn compute_sha512(data: &[u8]) -> String {
    let mut hasher = Sha512::new();
    hasher.update(data);
    let hash = hasher.finalize();
    let encoded = STANDARD.encode(hash);
    format!("sha512-{}", encoded)
}

/// Verifies that the given data matches the expected integrity hash.
///
/// # Arguments
///
/// * `data` - The data to verify
/// * `expected` - The expected integrity hash in the format "sha512-<base64>"
///
/// # Returns
///
/// `Ok(true)` if the data matches the expected hash, `Ok(false)` if it doesn't match,
/// or an error if the expected hash is malformed.
///
/// # Errors
///
/// Returns an error if:
/// - The expected hash doesn't start with "sha512-"
/// - The base64 encoding is invalid
/// - The decoded hash has an unexpected length
///
/// # Example
///
/// ```
/// use dnx_core::integrity::{compute_sha512, verify_integrity};
///
/// let data = b"hello world";
/// let integrity = compute_sha512(data);
/// assert!(verify_integrity(data, &integrity).unwrap());
/// ```
pub fn verify_integrity(data: &[u8], expected: &str) -> Result<bool> {
    // Strip the "sha512-" prefix
    let prefix = "sha512-";
    if !expected.starts_with(prefix) {
        return Err(DnxError::InvalidIntegrity(
            "Integrity hash must start with 'sha512-'".to_string(),
        ));
    }

    let base64_hash = &expected[prefix.len()..];

    // Decode the base64 hash
    let expected_hash = STANDARD
        .decode(base64_hash)
        .map_err(|e| DnxError::InvalidIntegrity(format!("Invalid base64 encoding: {}", e)))?;

    // Compute the actual hash
    let mut hasher = Sha512::new();
    hasher.update(data);
    let actual_hash = hasher.finalize();

    // Compare the hashes
    Ok(expected_hash.as_slice() == actual_hash.as_slice())
}

/// Converts an integrity string to a path-safe string suitable for use as a directory name.
///
/// This function converts standard base64 to URL-safe base64 by replacing `/` with `_` and
/// `+` with `-`. This ensures the resulting string is safe to use as a directory name on
/// NTFS and other file systems.
///
/// # Arguments
///
/// * `integrity` - The integrity string (e.g., "sha512-<base64>")
///
/// # Returns
///
/// A path-safe version of the integrity string
///
/// # Example
///
/// ```
/// use dnx_core::integrity::integrity_to_path_safe;
///
/// let integrity = "sha512-abc+def/ghi==";
/// let safe = integrity_to_path_safe(integrity);
/// assert_eq!(safe, "sha512-abc-def_ghi==");
/// ```
pub fn integrity_to_path_safe(integrity: &str) -> String {
    integrity.replace('/', "_").replace('+', "-")
}

/// A streaming hash calculator that can process data in chunks.
///
/// This is useful for computing integrity hashes of large files or streams without
/// loading all the data into memory at once.
///
/// # Example
///
/// ```
/// use dnx_core::integrity::StreamingHash;
///
/// let mut hasher = StreamingHash::new();
/// hasher.update(b"hello ");
/// hasher.update(b"world");
/// let integrity = hasher.finalize();
/// assert!(integrity.starts_with("sha512-"));
/// ```
pub struct StreamingHash {
    hasher: Sha512,
}

impl StreamingHash {
    /// Creates a new streaming hash calculator.
    pub fn new() -> Self {
        Self {
            hasher: Sha512::new(),
        }
    }

    /// Updates the hash with the given data chunk.
    ///
    /// # Arguments
    ///
    /// * `data` - The data chunk to add to the hash
    pub fn update(&mut self, data: &[u8]) {
        self.hasher.update(data);
    }

    /// Finalizes the hash and returns it in the format "sha512-<base64>".
    ///
    /// This consumes the `StreamingHash` instance.
    ///
    /// # Returns
    ///
    /// A string in the format "sha512-<base64>"
    pub fn finalize(self) -> String {
        let hash = self.hasher.finalize();
        let encoded = STANDARD.encode(hash);
        format!("sha512-{}", encoded)
    }
}

impl Default for StreamingHash {
    fn default() -> Self {
        Self::new()
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_compute_sha512() {
        let data = b"hello world";
        let integrity = compute_sha512(data);
        assert!(integrity.starts_with("sha512-"));
        assert!(integrity.len() > 7);
    }

    #[test]
    fn test_verify_integrity_valid() {
        let data = b"hello world";
        let integrity = compute_sha512(data);
        assert!(verify_integrity(data, &integrity).unwrap());
    }

    #[test]
    fn test_verify_integrity_invalid() {
        let data = b"hello world";
        let wrong_data = b"goodbye world";
        let integrity = compute_sha512(data);
        assert!(!verify_integrity(wrong_data, &integrity).unwrap());
    }

    #[test]
    fn test_verify_integrity_invalid_prefix() {
        let data = b"hello world";
        let result = verify_integrity(data, "sha256-abc123");
        assert!(result.is_err());
    }

    #[test]
    fn test_verify_integrity_invalid_base64() {
        let data = b"hello world";
        let result = verify_integrity(data, "sha512-@@@invalid@@@");
        assert!(result.is_err());
    }

    #[test]
    fn test_integrity_to_path_safe() {
        let integrity = "sha512-abc+def/ghi==";
        let safe = integrity_to_path_safe(integrity);
        assert_eq!(safe, "sha512-abc-def_ghi==");
    }

    #[test]
    fn test_integrity_to_path_safe_no_special_chars() {
        let integrity = "sha512-abcdefghi==";
        let safe = integrity_to_path_safe(integrity);
        assert_eq!(safe, "sha512-abcdefghi==");
    }

    #[test]
    fn test_streaming_hash() {
        let mut hasher = StreamingHash::new();
        hasher.update(b"hello ");
        hasher.update(b"world");
        let integrity = hasher.finalize();

        let direct = compute_sha512(b"hello world");
        assert_eq!(integrity, direct);
    }

    #[test]
    fn test_streaming_hash_empty() {
        let hasher = StreamingHash::new();
        let integrity = hasher.finalize();
        let direct = compute_sha512(b"");
        assert_eq!(integrity, direct);
    }

    #[test]
    fn test_streaming_hash_single_update() {
        let mut hasher = StreamingHash::new();
        hasher.update(b"test data");
        let integrity = hasher.finalize();
        let direct = compute_sha512(b"test data");
        assert_eq!(integrity, direct);
    }
}