Add basic implemntation of key-exchange

web-client/Cargo.toml

@@ -10,17 +10,27 @@ description = """
 crate-type = ["cdylib", "rlib"]
 
 [dependencies]
-vodozemac = { version = "0.2", features = ["js"] }
+aes-gcm = "0.10"
 serde = { version = "1", default-features = false, features = ["derive"] }
 serde_json = { version = "1", default-features = false }
-wasm-bindgen = "0.2"
+wasm-bindgen = { version = "0.2", features = ["serde-serialize"] }
 js-sys = "0.3"
 wasm-bindgen-test = "0.3"
 wasm-bindgen-futures = "0.4.32"
-web-sys = { version = "0.3", features = ["console", "WebSocket", "WebSocketDict", "WebSocketElement"] }
-borsh = "0.9"
+web-sys = { version = "0.3", features = ["console", "WebSocket", "WebSocketDict", "WebSocketElement", "Window"] }
 near-account-id = "0.14.0"
 near-primitives = { version = "0.14.0", package = "near-primitives-core" }
 near-units = "0.2"
 near-client = { path = "../near-client" }
+common-api = { path = "../common-api" }
 url = "2.2"
+futures = "0.3"
+reqwest = { version = "0.11", features = ["json"] }
+console_error_panic_hook = "0.1.7"
+uuid = { version = "1.1.2", features = ["v4", "serde", "js"] }
+blake2 = "0.10"
+base64 = "0.13"
+itertools = "0.10"
+rand = { version = "0.8.5" }
+rand_chacha = "0.3"
+serde-wasm-bindgen = "0.4.3"

web-client/src/errors.rs

@@ -0,0 +1,105 @@
+use near_account_id::ParseAccountError;
+use near_client::Error;
+use wasm_bindgen::prelude::*;
+
+#[wasm_bindgen]
+#[derive(Clone, Debug)]
+pub struct ApiError {
+    r#type: ErrorType,
+    msg: String,
+}
+
+#[wasm_bindgen]
+impl ApiError {
+    pub fn err_msg(&self) -> String {
+        self.msg.clone()
+    }
+
+    pub fn err_type(&self) -> ErrorType {
+        self.r#type
+    }
+}
+
+impl ApiError {
+    pub fn new(r#type: ErrorType, msg: String) -> Self {
+        Self { r#type, msg }
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Clone, Copy, Debug)]
+pub enum ErrorType {
+    Type,
+    Rpc,
+    EmptyBlock,
+    ArgsSerialize,
+    DeserializeTxResp,
+    TransactionSerialize,
+    TransactionExec,
+    TxNotStarted,
+    NoSigner,
+    ParseRpcUrl,
+    BadContractId,
+    Other,
+}
+
+impl From<Error> for ApiError {
+    fn from(error: Error) -> Self {
+        match error {
+            Error::Type(type_err) => Self {
+                r#type: ErrorType::Type,
+                msg: type_err.to_string(),
+            },
+            Error::Rpc { error, method } => Self {
+                r#type: ErrorType::Rpc,
+                msg: format!("Method: [\"{method}\"], Cause: \"{error}\""),
+            },
+            Error::EmptyBlock => Self {
+                r#type: ErrorType::EmptyBlock,
+                msg: error.to_string(),
+            },
+            Error::ArgsSerialize(err) => Self {
+                r#type: ErrorType::ArgsSerialize,
+                msg: err.to_string(),
+            },
+            Error::DeserializeTxResp(err) => Self {
+                r#type: ErrorType::DeserializeTxResp,
+                msg: err.to_string(),
+            },
+            Error::TransactionSerialize(err) => Self {
+                r#type: ErrorType::TransactionSerialize,
+                msg: err.to_string(),
+            },
+            Error::TransactionExec(err) => Self {
+                r#type: ErrorType::TransactionExec,
+                msg: format!("{err:?}"),
+            },
+            Error::TxNotStarted => Self {
+                r#type: ErrorType::TxNotStarted,
+                msg: error.to_string(),
+            },
+            Error::NoSigner => Self {
+                r#type: ErrorType::NoSigner,
+                msg: error.to_string(),
+            },
+        }
+    }
+}
+
+impl From<near_client::types::Error> for ApiError {
+    fn from(err: near_client::types::Error) -> Self {
+        Self {
+            r#type: ErrorType::Type,
+            msg: err.to_string(),
+        }
+    }
+}
+
+impl From<ParseAccountError> for ApiError {
+    fn from(err: ParseAccountError) -> Self {
+        Self::new(
+            ErrorType::BadContractId,
+            format!("AccountId has wrong format. Cause: {err}"),
+        )
+    }
+}

web-client/src/lib.rs

@@ -1,74 +1,414 @@
-use std::str::FromStr;
-
+use aes_gcm::{
+    aead::{Aead, KeyInit},
+    Aes256Gcm, Nonce as AesNonce,
+};
+use futures::lock::Mutex;
+use itertools::Itertools;
+use near_account_id::AccountId;
+use rand::{RngCore, SeedableRng};
 use serde_json::json;
 use wasm_bindgen::prelude::*;
 
-use near_client::{
-    client::{NearClient, Signer},
-    types::crypto::Keypair,
+use near_client::client::{NearClient, Signer};
+
+use js_sys::Promise;
+use near_primitives::types::Nonce;
+
+use std::{ops::DerefMut, str::FromStr, sync::Arc};
+
+use blake2::{
+    digest::{Update, VariableOutput},
+    Blake2bVar,
+};
+
+mod errors;
+use common_api::crypto::{
+    key_exchange::{Public, Secret},
+    Key as _,
 };
 
+use errors::{ApiError, ErrorType};
+
+#[allow(unused_macros)]
 macro_rules! console_log {
     ($($t:tt)*) => (web_sys::console::log_1(&format!($($t)*).into()))
 }
 
-#[wasm_bindgen]
-pub async fn greet() -> Result<(), JsValue> {
-    // let socket = web_sys::WebSocket::new("ws://127.0.0.1:3000/ws")?;
-    // let cl_socket = socket.clone();
-    // let on_open = Closure::<dyn Fn()>::new(move || {
-    //     console_log!("Open A socket");
-    //     cl_socket.send_with_str("Init Message").unwrap();
-    // });
-    // socket.set_onopen(Some(on_open.as_ref().unchecked_ref()));
-    // on_open.forget();
+type Result<T> = std::result::Result<T, ApiError>;
 
+#[wasm_bindgen(start)]
+pub fn start() -> std::result::Result<(), JsValue> {
+    console_error_panic_hook::set_once();
     Ok(())
 }
 
+struct Handler {
+    contract_id: AccountId,
+    owner_sk: Secret,
+    url: url::Url,
+}
+
 #[wasm_bindgen]
-pub async fn send_transaction(
-    keypair: String,
-    nounce: near_primitives::types::Nonce,
-    account_id: String,
-) -> Result<(), JsValue> {
-    let signer = near_account_id::AccountId::from_str(&account_id)
-        .map_err(|err| JsValue::from_str(&format!("Error {err}")))?;
-    let contract_id = near_account_id::AccountId::from_str("contract1.demoacc.testnet")
-        .map_err(|err| JsValue::from_str(&format!("Error {err}")))?;
-
-    console_log!("SignAcc");
-    let mut signer_acc = Signer::new(&keypair, signer, nounce)
-        .map_err(|err| JsValue::from_str(&format!("Error {err}")))?;
-
-    console_log!("Keypair");
-    let keypair = Keypair::from_encoded(&keypair)
-        .map_err(|err| JsValue::from_str(&format!("Error {err}")))?;
-
-    console_log!("Near Client");
-    let near_client = NearClient::new(url::Url::from_str("https://rpc.testnet.near.org").unwrap())
-        .map_err(|err| JsValue::from_str(&format!("Error {err}")))?;
-
-    console_log!("Call");
-    let build = near_client
-        .function_call(&mut signer_acc, &contract_id, "add_key")
-        .gas(near_units::parse_gas!("300 T") as u64)
-        .args(json!({
-            "id": "Some",
-            "value": String::from(keypair.public_key)
-        }))
-        .build()
-        .map_err(|err| JsValue::from_str(&format!("Error {err}")))?;
-
-    console_log!("Build");
-    let res = build
-        .commit_async()
-        .await
-        .map_err(|err| JsValue::from_str(&format!("Error {err}")))?;
-
-    console_log!("Response: {}", res);
+pub struct ProvisionerConfig {
+    contract_id: AccountId,
+    rpc_url: url::Url,
+    key_exchange_url: url::Url,
+}
 
-    Ok(())
+#[wasm_bindgen]
+impl ProvisionerConfig {
+    #[wasm_bindgen(constructor)]
+    pub fn new(
+        contract_id: String,
+        rpc_url: &str,
+        exchange_url: &str,
+    ) -> Result<ProvisionerConfig> {
+        let rpc_url = url::Url::from_str(rpc_url)
+            .map_err(|err| ApiError::new(ErrorType::ParseRpcUrl, err.to_string()))?;
+        let key_exchange_url = url::Url::from_str(exchange_url)
+            .map_err(|err| ApiError::new(ErrorType::ParseRpcUrl, err.to_string()))?;
+        let contract_id = AccountId::from_str(&contract_id).map_err(Into::<ApiError>::into)?;
+
+        Ok(Self {
+            contract_id,
+            rpc_url,
+            key_exchange_url,
+        })
+    }
+}
+
+#[wasm_bindgen]
+pub struct KeyProvisioner {
+    client: Arc<NearClient>,
+    participants: Arc<Mutex<Option<Vec<String>>>>,
+    signer: Arc<Mutex<Signer>>,
+    handler: Arc<Handler>,
+}
+
+impl KeyProvisioner {
+    fn handler(&self) -> Arc<Handler> {
+        Arc::clone(&self.handler)
+    }
+
+    fn client(&self) -> Arc<NearClient> {
+        Arc::clone(&self.client)
+    }
+
+    fn signer(&self) -> Arc<Mutex<Signer>> {
+        Arc::clone(&self.signer)
+    }
+}
+
+#[wasm_bindgen]
+impl KeyProvisioner {
+    #[wasm_bindgen(constructor)]
+    pub fn new(
+        keypair_str: String,
+        nonce: Nonce,
+        account_id: String,
+        config: ProvisionerConfig,
+    ) -> Result<KeyProvisioner> {
+        let client = Arc::new(NearClient::new(config.rpc_url).map_err(ApiError::from)?);
+        let signer = Arc::new(Mutex::new(
+            Signer::new(
+                &keypair_str,
+                AccountId::from_str(&account_id).map_err(Into::<ApiError>::into)?,
+                nonce,
+            )
+            .map_err(ApiError::from)?,
+        ));
+        let handler = Arc::new(Handler {
+            contract_id: config.contract_id,
+            owner_sk: new_secret()?,
+            url: config.key_exchange_url,
+        });
+
+        Ok(Self {
+            client,
+            signer,
+            handler,
+            participants: Arc::new(Mutex::new(None)),
+        })
+    }
+
+    pub fn init(&self, participants_set: js_sys::Set) -> Promise {
+        let handler = self.handler();
+        let client = self.client();
+        let signer = self.signer();
+        let participants_lock = self.participants.clone();
+
+        wasm_bindgen_futures::future_to_promise(async move {
+            let exchange_uuid = uuid::Uuid::new_v4();
+            let (contract_id, owner_pk) =
+                { (handler.contract_id.clone(), Public::from(&handler.owner_sk)) };
+
+            let res: Vec<Result<String>> = participants_set
+                .keys()
+                .into_iter()
+                .map(|item| {
+                    item.map(|it| {
+                        it.as_string()
+                            .ok_or_else(|| {
+                                ApiError::new(
+                                    ErrorType::Other,
+                                    "participants_set is empty".to_owned(),
+                                )
+                            })
+                            .map_err(ApiError::from)
+                    })
+                })
+                .try_collect()?;
+
+            let participants: Vec<String> = res.into_iter().try_collect()?;
+
+            client
+                .function_call(
+                    signer.lock().await.deref_mut(),
+                    &contract_id,
+                    "init_meeting",
+                )
+                .gas(near_units::parse_gas!("20 T") as u64)
+                .args(json!({
+                    "owner_public_key": base64::encode(owner_pk.to_bytes()),
+                    "id": exchange_uuid.to_string(),
+                    "participants": participants,
+                }))
+                .build()
+                .map_err(ApiError::from)?
+                .commit::<()>()
+                .await
+                .map_err(ApiError::from)?;
+
+            *participants_lock.lock_owned().await = Some(participants);
+
+            Ok(JsValue::from_str(&exchange_uuid.to_string()))
+        })
+    }
+
+    pub fn send_keys(&self, meeting_id: String) -> Promise {
+        let handler = self.handler();
+        let client = self.client();
+        let participants_lock = self.participants.clone();
+        wasm_bindgen_futures::future_to_promise(async move {
+            let guard = participants_lock.lock().await;
+            let participants = guard
+                .as_ref()
+                .ok_or_else(|| ApiError::new(ErrorType::Other, "Empty participants".to_owned()))?;
+
+            let (contract_id, url) = { (handler.contract_id.clone(), handler.url.to_string()) };
+
+            let participants_keys =
+                futures::future::try_join_all(participants.iter().map(|participant| {
+                    let client_cp = client.clone();
+                    let contract_cp = contract_id.clone();
+                    let meeting_id_cp = meeting_id.clone();
+                    async move {
+                        loop {
+                            let resp = client_cp
+                                .view::<Option<String>>(
+                                    &contract_cp,
+                                    "public_key",
+                                    Some(json!({
+                                        "id": meeting_id_cp,
+                                        "participant_id": participant.to_string()
+                                    })),
+                                )
+                                .await
+                                .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?;
+
+                            if let Some(key) = resp {
+                                return Ok::<(String, String), ApiError>((
+                                    key,
+                                    participant.to_string(),
+                                ));
+                            }
+                        }
+                    }
+                }))
+                .await?;
+
+            let keys: Vec<(Public, String)> = participants_keys
+                .into_iter()
+                .map(|(pk, participant_id)| {
+                    base64::decode(&pk)
+                        .map(|it| (it, participant_id))
+                        .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+                        .and_then(|(pk_bytes, participant_id)| {
+                            Public::try_from_bytes(&pk_bytes)
+                                .map(|it| (it, participant_id))
+                                .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+                        })
+                })
+                .try_collect()?;
+
+            let aes_secret = base64::encode(new_secret()?.to_bytes());
+
+            let encrypted_keys: Vec<(Vec<u8>, String)> = keys
+                .into_iter()
+                .map(|(pk, participant_id)| {
+                    let res_key = handler.owner_sk.exchange(&pk);
+                    encrypt(&res_key, aes_secret.as_bytes(), participant_id)
+                })
+                .try_collect()?;
+
+            let _: Vec<reqwest::Response> = futures::future::try_join_all(
+                encrypted_keys.into_iter().map(|(bytes, participant_id)| {
+                    let client = reqwest::ClientBuilder::new().build().unwrap();
+                    client
+                        .post(format!("{url}/meeting"))
+                        .query(&[
+                            ("id", serde_json::to_value(meeting_id.clone()).unwrap()),
+                            ("participant", serde_json::to_value(participant_id).unwrap()),
+                        ])
+                        .json(&serde_json::Value::String(base64::encode(bytes)))
+                        .send()
+                }),
+            )
+            .await
+            .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?
+            .into_iter()
+            .map(|it| {
+                it.error_for_status()
+                    .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+            })
+            .try_collect()?;
+
+            Ok(JsValue::from_str(&aes_secret))
+        })
+    }
+
+    pub fn get_key(&self, meeting_id: String) -> Promise {
+        let handler = self.handler();
+        let client = self.client();
+        let signer = self.signer();
+
+        wasm_bindgen_futures::future_to_promise(async move {
+            let signer = signer.lock().await;
+            let (contract_id, sk, url) = {
+                (
+                    handler.contract_id.clone(),
+                    &handler.owner_sk,
+                    handler.url.to_string(),
+                )
+            };
+            loop {
+                let http_client = reqwest::ClientBuilder::new().build().unwrap();
+                let msg = http_client
+                    .get(format!("{}/meeting", &url))
+                    .query(&[
+                        ("id", serde_json::to_value(meeting_id.clone()).unwrap()),
+                        (
+                            "participant",
+                            serde_json::to_value(signer.account()).unwrap(),
+                        ),
+                    ])
+                    .send()
+                    .await
+                    .and_then(|it| it.error_for_status())
+                    .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?
+                    .text()
+                    .await
+                    .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?;
+
+                if msg.is_empty() {
+                    continue;
+                }
+
+                let owner_pub_key = client
+                    .view::<Option<String>>(
+                        &contract_id,
+                        "owner_key",
+                        Some(serde_json::json!({
+                            "id": meeting_id.to_string()
+                        })),
+                    )
+                    .await
+                    .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?;
+
+                if let Some(owner_pk) = owner_pub_key {
+                    let bytes = base64::decode(owner_pk)
+                        .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?;
+                    let owner_pk = Public::try_from_bytes(&bytes)
+                        .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?;
+                    let key = sk.exchange(&owner_pk);
+
+                    let msg_bytes = base64::decode(msg)
+                        .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?;
+                    let decrypted_msg = decrypt(&key, &msg_bytes)?;
+
+                    return Ok(JsValue::from_str(
+                        std::str::from_utf8(&decrypted_msg)
+                            .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?,
+                    ));
+                }
+            }
+        })
+    }
+
+    pub fn push_to_near(&self, meeting_id: String) -> Promise {
+        let handler = self.handler();
+        let client = self.client();
+        let signer = self.signer();
+        wasm_bindgen_futures::future_to_promise(async move {
+            let (contract_id, pk) =
+                { (handler.contract_id.clone(), Public::from(&handler.owner_sk)) };
+            client
+                .function_call(signer.lock().await.deref_mut(), &contract_id, "set_key")
+                .gas(near_units::parse_gas!("300 T") as u64)
+                .args(json!({
+                    "id": meeting_id.to_string(),
+                    "pk": base64::encode(pk.to_bytes()),
+                }))
+                .build()
+                .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?
+                .commit::<()>()
+                .await
+                .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))?;
+
+            Ok(JsValue::undefined())
+        })
+    }
+}
+
+fn new_secret() -> Result<Secret> {
+    use rand_chacha::ChaChaRng;
+    let mut chacha = ChaChaRng::from_entropy();
+    let mut bytes = [0_u8; 32];
+    chacha.fill_bytes(&mut bytes);
+    Secret::try_from_bytes(&bytes).map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+}
+
+fn encrypt(
+    exchange_key: &[u8],
+    secret: &[u8],
+    participant_id: String,
+) -> Result<(Vec<u8>, String)> {
+    aes(exchange_key)
+        .and_then(|it: Aes256Gcm| {
+            it.encrypt(AesNonce::from_slice(b"unique nonce"), secret)
+                .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+        })
+        .map(|encrypted_msg| (encrypted_msg, participant_id))
+}
+
+fn decrypt(exchange_key: &[u8], secret: &[u8]) -> Result<Vec<u8>> {
+    aes(exchange_key).and_then(|it: Aes256Gcm| {
+        it.decrypt(AesNonce::from_slice(b"unique nonce"), secret)
+            .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+    })
+}
+
+fn aes(exchange_key: &[u8]) -> Result<Aes256Gcm> {
+    Blake2bVar::new(32)
+        .map(|mut kdf| {
+            kdf.update(exchange_key);
+            kdf.finalize_boxed()
+        })
+        .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+        .and_then(|it| {
+            Aes256Gcm::new_from_slice(&it)
+                .map_err(|err| ApiError::new(ErrorType::Other, err.to_string()))
+        })
 }
 
 #[cfg(test)]