1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168

use anyhow::Result;
use cid::Cid;
use libipld_cbor::DagCborCodec;
use noosphere_storage::BlockStore;
use serde::{Deserialize, Serialize};

use super::{AddressBookIpld, AuthorityIpld, ContentIpld, Did, Link};

/// The root of the sphere, containing pointers to public details such as names
/// and links, as well as "sealed" (private) data. While public details are accessible
/// to all, sealed data is encrypted at rest and only accessible to the user who
/// owns the sphere.
#[derive(Debug, Eq, PartialEq, Clone, Serialize, Deserialize)]
pub struct SphereIpld {
    /// A DID that is the identity of the originating key that owns the sphere
    pub identity: Did,

    /// The public links for the sphere
    pub content: Link<ContentIpld>,

    /// The public pet names for the sphere
    pub address_book: Link<AddressBookIpld>,

    /// Authorization and revocation state for non-owner keys
    pub authority: Link<AuthorityIpld>,

    /// The non-public content of the sphere
    pub private: Option<Cid>,
}

impl SphereIpld {
    /// Initialize a new, empty [SphereIpld] with a given [Did] sphere identity.
    pub async fn new<S>(identity: &Did, store: &mut S) -> Result<SphereIpld>
    where
        S: BlockStore,
    {
        let content_ipld = ContentIpld::empty(store).await?;
        let content = store.save::<DagCborCodec, _>(&content_ipld).await?.into();

        let address_book_ipld = AddressBookIpld::empty(store).await?;
        let address_book = store
            .save::<DagCborCodec, _>(&address_book_ipld)
            .await?
            .into();

        let authority_ipld = AuthorityIpld::empty(store).await?;
        let authority = store.save::<DagCborCodec, _>(&authority_ipld).await?.into();

        Ok(SphereIpld {
            identity: identity.clone(),
            content,
            address_book,
            authority,
            private: None,
        })
    }
}

#[cfg(test)]
mod tests {
    use anyhow::Result;
    use libipld_cbor::DagCborCodec;
    use ucan::{builder::UcanBuilder, crypto::KeyMaterial, store::UcanJwtStore};
    #[cfg(target_arch = "wasm32")]
    use wasm_bindgen_test::wasm_bindgen_test;

    use crate::{
        authority::{generate_capability, generate_ed25519_key, SphereAbility},
        data::{ContentType, Did, Header, MemoIpld, SphereIpld},
        view::Sphere,
    };

    use noosphere_storage::{BlockStore, MemoryStorage, SphereDb};

    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test)]
    #[cfg_attr(not(target_arch = "wasm32"), tokio::test)]
    async fn it_can_be_signed_by_identity_key_and_verified() -> Result<()> {
        let identity_credential = generate_ed25519_key();
        let identity = Did(identity_credential.get_did().await?);

        let mut store = SphereDb::new(&MemoryStorage::default()).await?;

        let sphere = SphereIpld::new(&identity, &mut store).await?;

        let sphere_cid = store.save::<DagCborCodec, _>(&sphere).await?;

        let mut memo = MemoIpld {
            parent: None,
            headers: vec![(
                Header::ContentType.to_string(),
                ContentType::Sphere.to_string(),
            )],
            body: sphere_cid,
        };

        let capability = generate_capability(&identity, SphereAbility::Authorize);

        let authorization = UcanBuilder::default()
            .issued_by(&identity_credential)
            .for_audience(&identity)
            .with_lifetime(100)
            .claiming_capability(&capability)
            .build()?
            .sign()
            .await?;

        memo.sign(&identity_credential, Some(&authorization))
            .await?;

        store.write_token(&authorization.encode()?).await?;

        let memo_cid = store.save::<DagCborCodec, _>(&memo).await?.into();

        let sphere = Sphere::at(&memo_cid, &store);

        sphere.verify_signature().await?;

        Ok(())
    }

    #[cfg_attr(target_arch = "wasm32", wasm_bindgen_test)]
    #[cfg_attr(not(target_arch = "wasm32"), tokio::test)]
    async fn it_can_be_signed_by_an_authorized_key_and_verified() -> Result<()> {
        let identity_credential = generate_ed25519_key();
        let authorized_credential = generate_ed25519_key();

        let identity = Did(identity_credential.get_did().await?);
        let authorized = Did(authorized_credential.get_did().await?);

        let mut store = SphereDb::new(&MemoryStorage::default()).await?;

        let sphere = SphereIpld::new(&identity, &mut store).await?;

        let sphere_cid = store.save::<DagCborCodec, _>(&sphere).await?;

        let mut memo = MemoIpld {
            parent: None,
            headers: vec![(
                Header::ContentType.to_string(),
                ContentType::Sphere.to_string(),
            )],
            body: sphere_cid,
        };

        let capability = generate_capability(&identity, SphereAbility::Authorize);
        let authorization = UcanBuilder::default()
            .issued_by(&identity_credential)
            .for_audience(&authorized)
            .with_lifetime(100)
            .claiming_capability(&capability)
            .build()?
            .sign()
            .await?;

        memo.sign(&authorized_credential, Some(&authorization))
            .await?;

        store.write_token(&authorization.encode().unwrap()).await?;

        let memo_cid = store.save::<DagCborCodec, _>(&memo).await?.into();

        let sphere = Sphere::at(&memo_cid, &store);

        sphere.verify_signature().await?;

        Ok(())
    }
}