-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Linked multi query #67
Changes from 11 commits
cf901a5
99d382e
d4bea0f
3adf6b7
adbc6a9
b32830b
13e926e
484da29
83b612e
361f6a9
3681c9a
54bf151
4689cd2
81bf2fc
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -310,6 +310,83 @@ func CreateContractInvokeRequestWithMessage( | |
} | ||
} | ||
|
||
// ValidateAuthRequest verifies auth request message | ||
func ValidateAuthRequest(request protocol.AuthorizationRequestMessage) error { | ||
groupIDValidationMap := make(map[int][]pubsignals.Query) | ||
|
||
for _, proofRequest := range request.Body.Scope { | ||
proofRequestQuery, err := unmarshalQuery(proofRequest.Query) | ||
if err != nil { | ||
return err | ||
} | ||
groupID := proofRequestQuery.GroupID | ||
if groupID != 0 { | ||
existingQueries := groupIDValidationMap[groupID] | ||
|
||
// Validate that all requests in the group have the same schema, issuer, and circuit | ||
for _, existingQuery := range existingQueries { | ||
if existingQuery.Type != proofRequestQuery.Type { | ||
return errors.New("all requests in the group should have the same type") | ||
} | ||
|
||
if existingQuery.Context != proofRequestQuery.Context { | ||
return errors.New("all requests in the group should have the same context") | ||
} | ||
|
||
allowedIssuers := proofRequestQuery.AllowedIssuers | ||
existingRequestAllowedIssuers := existingQuery.AllowedIssuers | ||
if !checkIssuersEquality(allowedIssuers, existingRequestAllowedIssuers) { | ||
return errors.New("all requests in the group should have the same issuer") | ||
} | ||
} | ||
|
||
groupIDValidationMap[groupID] = append(existingQueries, proofRequestQuery) | ||
} | ||
} | ||
|
||
return nil | ||
} | ||
|
||
func unmarshalQuery(queryMap map[string]interface{}) (out pubsignals.Query, err error) { | ||
// prepare query from request | ||
queryBytes, err := json.Marshal(queryMap) | ||
if err != nil { | ||
return out, err | ||
} | ||
err = json.Unmarshal(queryBytes, &out) | ||
if err != nil { | ||
return out, err | ||
} | ||
return out, nil | ||
} | ||
|
||
func checkIssuersEquality(issuers1, issuers2 []string) bool { | ||
if len(issuers1) != len(issuers2) { | ||
return false | ||
} | ||
|
||
for _, issuer := range issuers1 { | ||
found := false | ||
for _, existingIssuer := range issuers2 { | ||
if issuer == existingIssuer || existingIssuer == "*" { | ||
found = true | ||
break | ||
} | ||
} | ||
|
||
if !found { | ||
return false | ||
} | ||
} | ||
|
||
return true | ||
} | ||
|
||
type linkIDRequestID struct { | ||
linkID *big.Int | ||
requestID uint32 | ||
} | ||
|
||
// VerifyAuthResponse performs verification of auth response based on auth request | ||
func (v *Verifier) VerifyAuthResponse( | ||
ctx context.Context, | ||
|
@@ -326,7 +403,20 @@ func (v *Verifier) VerifyAuthResponse( | |
return errors.Errorf("sender of the request is not a target of response - expected %s, given %s", request.From, response.To) | ||
} | ||
|
||
err := ValidateAuthRequest(request) | ||
if err != nil { | ||
return err | ||
} | ||
|
||
groupIDToLinkIDMap := make(map[int][]linkIDRequestID) | ||
for _, proofRequest := range request.Body.Scope { | ||
// prepare query from request | ||
query, err := unmarshalQuery(proofRequest.Query) | ||
if err != nil { | ||
return err | ||
} | ||
groupID := query.GroupID | ||
|
||
proofResponse := findProofByRequestID(response.Body.Scope, proofRequest.ID) | ||
if proofResponse == nil { | ||
return errors.Errorf("proof for zk request id %v is presented not found", proofRequest.ID) | ||
|
@@ -349,17 +439,6 @@ func (v *Verifier) VerifyAuthResponse( | |
return errors.Wrap(err, fmt.Sprintf("circuit with id %s is not supported by library", proofRequest.CircuitID)) | ||
} | ||
|
||
// prepare query from request | ||
queryBytes, err := json.Marshal(proofRequest.Query) | ||
if err != nil { | ||
return err | ||
} | ||
var query pubsignals.Query | ||
err = json.Unmarshal(queryBytes, &query) | ||
if err != nil { | ||
return err | ||
} | ||
|
||
// verify proof author | ||
|
||
err = cv.VerifyIDOwnership(response.From, big.NewInt(int64(proofResponse.ID))) | ||
|
@@ -384,7 +463,7 @@ func (v *Verifier) VerifyAuthResponse( | |
} | ||
proofRequest.Params[pubsignals.ParamNameVerifierDID] = verifierDID | ||
|
||
err = cv.VerifyQuery(ctx, query, v.documentLoader, rawMessage, proofRequest.Params, opts...) | ||
pubSignals, err := cv.VerifyQuery(ctx, query, v.documentLoader, rawMessage, proofRequest.Params, opts...) | ||
if err != nil { | ||
return err | ||
} | ||
|
@@ -394,11 +473,48 @@ func (v *Verifier) VerifyAuthResponse( | |
return err | ||
} | ||
|
||
if response.From == "" { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. move There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. moved |
||
return errors.Errorf("proof response doesn't contain from field") | ||
} | ||
|
||
err = verifyGroupIDMathch(pubSignals.LinkID, groupID, proofResponse.ID, groupIDToLinkIDMap) | ||
if err != nil { | ||
return err | ||
} | ||
|
||
} | ||
|
||
return nil | ||
} | ||
|
||
func verifyGroupIDMathch(linkID *big.Int, groupID int, requestID uint32, groupIDToLinkIDMap map[int][]linkIDRequestID) error { | ||
if groupID == 0 { | ||
return nil | ||
} | ||
if linkID != nil { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. else { There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. fixed |
||
if existingLinks, exists := groupIDToLinkIDMap[groupID]; exists { | ||
linkIDMap := linkIDRequestID{linkID: linkID, requestID: requestID} | ||
groupIDToLinkIDMap[groupID] = append(existingLinks, linkIDMap) | ||
} else { | ||
linkIDMap := linkIDRequestID{linkID: linkID, requestID: requestID} | ||
groupIDToLinkIDMap[groupID] = []linkIDRequestID{linkIDMap} | ||
} | ||
} | ||
// verify grouping links | ||
for groupIDfromMap, metas := range groupIDToLinkIDMap { | ||
// Check that all linkIDs are the same | ||
if len(metas) > 1 { | ||
firstLinkID := metas[0].linkID | ||
for _, meta := range metas[1:] { | ||
if meta.linkID.Cmp(firstLinkID) != 0 { | ||
return errors.Errorf("Link id validation failed for group %d, request linkID to requestIds info: %v", groupIDfromMap, metas) | ||
} | ||
} | ||
} | ||
} | ||
return nil | ||
} | ||
|
||
// VerifyJWZ performs verification of jwz token | ||
func (v *Verifier) VerifyJWZ( | ||
ctx context.Context, | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
remove
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
removed