lfg2025/archy
1
0
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

Verify scoped peer identity proofs before restricted content access

Browse Source
This commit is contained in:
archipelago
2026-10-06 06:07:55 -04:00
parent 6fba95fe5a
commit a9edcd6b3e
10 changed files with 438 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/archipelago/src/api/handler/content.rs
+75 -10
View File
@@ -7,14 +7,48 @@ use hyper::{Response, StatusCode};
use super::{is_valid_app_id, ApiHandler};
impl ApiHandler {
pub(super) async fn handle_content_catalog(config: &Config) -> Result<Response<hyper::Body>> {
match content_server::load_catalog(&config.data_dir).await {
fn verified_content_peer(
&self,
path: &str,
headers: &hyper::HeaderMap,
) -> Result<Option<String>> {
let audience = crate::identity::did_key_from_pubkey_hex(&self.self_pubkey_hex)?;
crate::content_auth::incoming(headers, &audience, path, chrono::Utc::now().timestamp())
}
async fn content_access_context(
&self,
path: &str,
headers: &hyper::HeaderMap,
) -> Result<(Option<String>, bool, bool)> {
let peer = self.verified_content_peer(path, headers)?;
let known = if let Some(did) = &peer {
crate::federation::load_nodes(&self.config.data_dir)
.await?
.iter()
.any(|node| &node.did == did)
} else {
false
};
let owner = match crate::session::extract_session_cookie(headers) {
Some(token) => self.session_store.validate(&token).await,
None => false,
};
Ok((peer, known, owner))
}
pub(super) async fn handle_content_catalog(
&self,
headers: &hyper::HeaderMap,
) -> Result<Response<hyper::Body>> {
let (peer, known, owner) = self.content_access_context("/content", headers).await?;
match content_server::load_catalog(&self.config.data_dir).await {
Ok(catalog) => {
// Only expose public metadata for available items
let items: Vec<serde_json::Value> = catalog
.items
.iter()
.filter(|i| !matches!(i.availability, content_server::Availability::Nobody))
.filter(|item| content_server::visible_to(item, peer.as_deref(), known, owner))
.map(|i| {
serde_json::json!({
"id": i.id,
@@ -82,11 +116,18 @@ impl ApiHandler {
.map(|s| s.to_string())
});
// Extract federation peer DID from X-Federation-DID header
let peer_did = headers
.get("x-federation-did")
.and_then(|v| v.to_str().ok())
.map(|s| s.to_string());
let peer_did = match self.verified_content_peer(path, headers) {
Ok(peer) => peer,
Err(_) => {
return Ok(build_response(
StatusCode::FORBIDDEN,
"application/json",
hyper::Body::from(
r#"{"error":"Peer authentication failed. Check both nodes are updated and their clocks are correct."}"#,
),
))
}
};
// The authenticated local operator never pays for their own node's
// content: validate the session cookie (same discipline as the model
@@ -249,7 +290,11 @@ impl ApiHandler {
/// Seller side (#46): mint a Lightning invoice for a paid catalog item so a
/// buyer can pay from any external wallet. Path: GET /content/{id}/invoice.
/// Records a pending entitlement keyed by the invoice's payment hash.
pub(super) async fn handle_content_invoice(&self, path: &str) -> Result<Response<hyper::Body>> {
pub(super) async fn handle_content_invoice(
&self,
path: &str,
headers: &hyper::HeaderMap,
) -> Result<Response<hyper::Body>> {
let content_id = path
.strip_prefix("/content/")
.and_then(|s| s.strip_suffix("/invoice"))
@@ -262,6 +307,7 @@ impl ApiHandler {
));
}
let (peer, known, owner) = self.content_access_context(path, headers).await?;
let catalog = content_server::load_catalog(&self.config.data_dir)
.await
.unwrap_or_default();
@@ -275,6 +321,13 @@ impl ApiHandler {
))
}
};
if !content_server::visible_to(item, peer.as_deref(), known, owner) {
return Ok(build_response(
StatusCode::NOT_FOUND,
"text/plain",
hyper::Body::from("Content not found"),
));
}
let price_sats = match &item.access {
content_server::AccessControl::Paid { price_sats, .. } => *price_sats,
_ => {
@@ -359,7 +412,11 @@ impl ApiHandler {
/// Seller side (#46): issue a fresh on-chain address for a paid catalog item
/// so a buyer can pay on-chain. Path: GET /content/{id}/onchain. Records a
/// pending entitlement keyed by the address; price doubles as expected amount.
pub(super) async fn handle_content_onchain(&self, path: &str) -> Result<Response<hyper::Body>> {
pub(super) async fn handle_content_onchain(
&self,
path: &str,
headers: &hyper::HeaderMap,
) -> Result<Response<hyper::Body>> {
let content_id = path
.strip_prefix("/content/")
.and_then(|s| s.strip_suffix("/onchain"))
@@ -371,9 +428,17 @@ impl ApiHandler {
hyper::Body::from("Invalid content ID"),
));
}
let (peer, known, owner) = self.content_access_context(path, headers).await?;
let catalog = content_server::load_catalog(&self.config.data_dir)
.await
.unwrap_or_default();
if !content_server::visible_to(item, peer.as_deref(), known, owner) {
return Ok(build_response(
StatusCode::NOT_FOUND,
"text/plain",
hyper::Body::from("Content not found"),
));
}
let price_sats = match catalog.items.iter().find(|i| i.id == content_id) {
Some(i) => match &i.access {
content_server::AccessControl::Paid { price_sats, .. } => {
core/archipelago/src/api/handler/mod.rs
+3 -3
View File
@@ -591,7 +591,7 @@ impl ApiHandler {
// Lightning-invoice peer-file sale (#46): mint invoice / poll settlement
(Method::GET, p) if p.starts_with("/content/") && p.ends_with("/invoice") => {
self.handle_content_invoice(p).await
self.handle_content_invoice(p, &headers).await
}
(Method::GET, p) if p.starts_with("/content/") && p.contains("/invoice-status/") => {
self.handle_content_invoice_status(p).await
@@ -602,7 +602,7 @@ impl ApiHandler {
self.handle_content_onchain_status(p).await
}
(Method::GET, p) if p.starts_with("/content/") && p.ends_with("/onchain") => {
self.handle_content_onchain(p).await
self.handle_content_onchain(p, &headers).await
}
// Content serving — peers access shared content over Tor (no session auth);
@@ -612,7 +612,7 @@ impl ApiHandler {
}
// Content catalog — list available content (no session auth, for peers)
(Method::GET, "/content") => Self::handle_content_catalog(&self.config).await,
(Method::GET, "/content") => self.handle_content_catalog(&headers).await,
// Electrs status — unauthenticated (read-only sync status)
(Method::GET, "/electrs-status") => Self::handle_electrs_status().await,
core/archipelago/src/api/handler/proxy.rs
+1
View File
@@ -261,6 +261,7 @@ impl ApiHandler {
if let Some(r) = headers.get("range").and_then(|v| v.to_str().ok()) {
req = req.header("Range", r.to_string());
}
let req = req.authenticate_content(&self.config.data_dir).await?;
match req.send_get().await {
Ok((resp, transport)) => {
if resp.status().is_redirection() {
core/archipelago/src/api/rpc/content.rs
+20
View File
@@ -450,6 +450,8 @@ impl RpcHandler {
.header("X-Federation-DID", local_did)
.timeout(std::time::Duration::from_secs(120))
.fips_timeout(std::time::Duration::from_secs(8))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
.context("Failed to connect to peer")?;
@@ -540,6 +542,8 @@ impl RpcHandler {
// against the UI's 30s deadline — users saw errors, not
// fallback.
.fips_timeout(std::time::Duration::from_secs(6))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
.context("Failed to connect to peer")?;
@@ -710,6 +714,8 @@ impl RpcHandler {
.header("X-Payment-Token", token_str.clone())
.single_delivery()
.timeout(std::time::Duration::from_secs(900))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
{
@@ -829,6 +835,8 @@ impl RpcHandler {
.header("X-Federation-DID", local_did)
.timeout(std::time::Duration::from_secs(25))
.fips_timeout(std::time::Duration::from_secs(6))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
{
@@ -893,6 +901,8 @@ impl RpcHandler {
.service(crate::settings::transport::PeerService::PeerFiles)
.timeout(std::time::Duration::from_secs(15))
.fips_timeout(std::time::Duration::from_secs(6))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
{
@@ -985,6 +995,8 @@ impl RpcHandler {
.header("X-Federation-DID", local_did)
.header("X-Invoice-Hash", payment_hash.to_string())
.timeout(std::time::Duration::from_secs(900))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
{
@@ -1083,6 +1095,8 @@ impl RpcHandler {
.header("X-Federation-DID", local_did)
.timeout(std::time::Duration::from_secs(25))
.fips_timeout(std::time::Duration::from_secs(6))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
{
@@ -1142,6 +1156,8 @@ impl RpcHandler {
.service(crate::settings::transport::PeerService::PeerFiles)
.timeout(std::time::Duration::from_secs(15))
.fips_timeout(std::time::Duration::from_secs(6))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
{
@@ -1199,6 +1215,8 @@ impl RpcHandler {
.header("X-Federation-DID", local_did)
.header("X-Onchain-Address", address.to_string())
.timeout(std::time::Duration::from_secs(900))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
{
@@ -1279,6 +1297,8 @@ impl RpcHandler {
.require_fips()
.timeout(std::time::Duration::from_secs(30))
.fips_timeout(std::time::Duration::from_secs(6))
.authenticate_content(&self.config.data_dir)
.await?
.send_get()
.await
.context("Failed to connect to peer for preview")?;
core/archipelago/src/content_auth.rs
+234
View File
@@ -0,0 +1,234 @@
//! Short-lived, route- and recipient-bound proofs for peer content reads.
//! A claimed X-Federation-DID is never authentication. Sign with the existing
//! node Ed25519 identity; public shares remain readable without a peer proof.
use anyhow::{Context, Result};
use base64::Engine;
use ed25519_dalek::{Signature, Signer, VerifyingKey};
use serde::{Deserialize, Serialize};
use std::path::Path;
pub const HEADER: &str = "x-archipelago-content-auth";
const MAX_AGE: u64 = 60;
#[derive(Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct Proof {
did: String,
audience: String,
path: String,
range: String,
timestamp: i64,
signature: String,
}
impl Proof {
fn preimage(&self) -> Result<Vec<u8>> {
Ok(serde_json::to_vec(&(
"archipelago-content-auth-v1",
"GET",
&self.did,
&self.audience,
&self.path,
&self.range,
self.timestamp,
))?)
}
}
fn sign(
identity: &crate::identity::NodeIdentity,
audience: &str,
path: &str,
range: &str,
now: i64,
) -> Result<String> {
let mut proof = Proof {
did: identity.did_key()?,
audience: audience.into(),
path: path.into(),
range: range.into(),
timestamp: now,
signature: String::new(),
};
proof.signature = hex::encode(identity.signing_key().sign(&proof.preimage()?).to_bytes());
Ok(base64::engine::general_purpose::STANDARD.encode(serde_json::to_vec(&proof)?))
}
/// Only authenticated federation identity bindings are used as the audience.
/// No matching peer means an anonymous request, never a forged peer identity.
pub async fn outgoing(
data_dir: &Path,
onion: &str,
path: &str,
range: &str,
) -> Result<Option<String>> {
let peers = crate::federation::load_nodes(data_dir).await?;
let Some(peer) = peers.iter().find(|peer| peer.onion == onion) else {
return Ok(None);
};
crate::identity::pubkey_bytes_from_did_key(&peer.did)?;
let identity = crate::identity::NodeIdentity::load_existing(&data_dir.join("identity")).await?;
Ok(Some(sign(
&identity,
&peer.did,
path,
range,
chrono::Utc::now().timestamp(),
)?))
}
pub fn incoming(
headers: &hyper::HeaderMap,
audience: &str,
path: &str,
now: i64,
) -> Result<Option<String>> {
let Some(value) = headers.get(HEADER) else {
return Ok(None);
};
anyhow::ensure!(value.as_bytes().len() <= 4096, "Peer proof is too large");
let raw = base64::engine::general_purpose::STANDARD
.decode(value.as_bytes())
.context("Invalid peer proof encoding")?;
let proof: Proof = serde_json::from_slice(&raw).context("Invalid peer proof")?;
let range = headers
.get("range")
.map(|value| value.to_str())
.transpose()?
.unwrap_or("");
anyhow::ensure!(
proof.audience == audience && proof.path == path && proof.range == range,
"Peer proof scope mismatch"
);
anyhow::ensure!(
proof.timestamp.abs_diff(now) <= MAX_AGE,
"Peer proof expired or clock differs"
);
let key = VerifyingKey::from_bytes(&crate::identity::pubkey_bytes_from_did_key(&proof.did)?)?;
let bytes = hex::decode(&proof.signature).context("Invalid peer signature")?;
let signature = Signature::from_slice(&bytes)?;
key.verify_strict(&proof.preimage()?, &signature)
.context("Peer signature rejected")?;
Ok(Some(proof.did))
}
#[cfg(test)]
mod tests {
use super::*;
#[tokio::test]
async fn proof_is_bound_to_signer_recipient_path_range_and_time() {
let dir = tempfile::tempdir().unwrap();
let identity = crate::identity::NodeIdentity::load_or_create(dir.path())
.await
.unwrap();
let audience = crate::identity::did_key_from_pubkey_hex(&hex::encode([7; 32])).unwrap();
let mut headers = hyper::HeaderMap::new();
headers.insert(
HEADER,
sign(&identity, &audience, "/content/film", "bytes=0-9", 1000)
.unwrap()
.parse()
.unwrap(),
);
headers.insert("range", "bytes=0-9".parse().unwrap());
assert_eq!(
incoming(&headers, &audience, "/content/film", 1000).unwrap(),
Some(identity.did_key().unwrap())
);
for (recipient, path, time) in [
(&audience[..], "/content/other", 1000),
(&audience[..], "/content/film", 1061),
(&audience[..], "/content/film", 939),
("other", "/content/film", 1000),
] {
assert!(incoming(&headers, recipient, path, time).is_err());
}
headers.insert("range", "bytes=10-".parse().unwrap());
assert!(incoming(&headers, &audience, "/content/film", 1000).is_err());
headers.insert("range", "bytes=0-9".parse().unwrap());
let mut proof: Proof = serde_json::from_slice(
&base64::engine::general_purpose::STANDARD
.decode(headers[HEADER].as_bytes())
.unwrap(),
)
.unwrap();
proof.did = audience.clone();
headers.insert(
HEADER,
base64::engine::general_purpose::STANDARD
.encode(serde_json::to_vec(&proof).unwrap())
.parse()
.unwrap(),
);
assert!(incoming(&headers, &audience, "/content/film", 1000).is_err());
}
#[tokio::test]
async fn request_signing_never_creates_or_repairs_node_identity() {
let dir = tempfile::tempdir().unwrap();
let missing = dir.path().join("identity");
assert!(crate::identity::NodeIdentity::load_existing(&missing)
.await
.is_err());
assert!(!missing.exists());
tokio::fs::create_dir(&missing).await.unwrap();
tokio::fs::write(missing.join("node_key"), b"damaged")
.await
.unwrap();
assert!(crate::identity::NodeIdentity::load_existing(&missing)
.await
.is_err());
assert_eq!(
tokio::fs::read(missing.join("node_key")).await.unwrap(),
b"damaged"
);
}
#[test]
fn catalog_invoice_and_bytes_visibility_share_the_same_rules() {
use crate::content_server::{visible_to, AccessControl, Availability, ContentItem};
let mut item = ContentItem {
id: "id".into(),
filename: "file".into(),
mime_type: "video/mp4".into(),
size_bytes: 1,
description: String::new(),
access: AccessControl::Paid {
price_sats: 1,
accepted: vec![],
},
availability: Availability::Specific {
peers: vec!["verified-peer".into()],
},
added_at: String::new(),
};
assert!(!visible_to(&item, None, false, false));
assert!(!visible_to(&item, Some("other-peer"), true, false));
assert!(visible_to(&item, Some("verified-peer"), true, false));
assert!(visible_to(&item, None, false, true));
item.availability = Availability::AllPeers;
item.access = AccessControl::PeersOnly;
assert!(!visible_to(&item, None, false, false));
assert!(!visible_to(&item, Some("not-connected"), false, false));
assert!(visible_to(&item, Some("verified-peer"), true, false));
item.access = AccessControl::Free;
assert!(visible_to(&item, None, false, false));
item.availability = Availability::Nobody;
assert!(!visible_to(&item, None, false, true));
assert!(!visible_to(&item, Some("verified-peer"), true, false));
}
#[test]
fn plain_claimed_did_never_becomes_an_authenticated_peer() {
let mut headers = hyper::HeaderMap::new();
headers.insert("x-federation-did", "did:key:claimed".parse().unwrap());
assert!(incoming(&headers, "recipient", "/content/file", 1000)
.unwrap()
.is_none());
for invalid in ["bad".to_string(), "A".repeat(4097)] {
headers.insert(HEADER, invalid.parse().unwrap());
assert!(incoming(&headers, "recipient", "/content/file", 1000).is_err());
}
}
}
core/archipelago/src/content_server.rs
+31 -19
View File
@@ -1,7 +1,7 @@
//! Tor-based content serving with access control.
//! Peer content serving with access control.
//!
//! Serves only explicitly shared content items to authenticated peers.
//! Content items can be free or ecash-gated (gating implemented later).
//! Content items can be public, peer-restricted, or gated by verified payment.
use anyhow::{Context, Result};
use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ pub enum Availability {
/// All connected peers can access.
#[default]
AllPeers,
/// Only specific peers (by onion address).
/// Only specific peers (by verified node DID).
Specific { peers: Vec<String> },
}
@@ -256,6 +256,28 @@ pub enum ServeResult {
RangeNotSatisfiable(u64),
}
/// Shared metadata/payment/bytes visibility gate. `peer_did` must already have
/// a verified request signature; a header claim alone must never reach here.
pub fn visible_to(
item: &ContentItem,
peer_did: Option<&str>,
known_peer: bool,
owner: bool,
) -> bool {
if matches!(item.availability, Availability::Nobody) {
return false;
}
if owner {
return true;
}
if let Availability::Specific { peers } = &item.availability {
if !peer_did.is_some_and(|did| peers.iter().any(|allowed| allowed == did)) {
return false;
}
}
!matches!(item.access, AccessControl::PeersOnly) || known_peer
}
/// Serve a content item by ID with access control and optional range request.
/// If the content is paid, checks for a valid payment token in the header.
/// `peer_did` is the DID from the X-Federation-DID header (if present).
@@ -335,22 +357,12 @@ where
false
};
// Check availability
if !owner_session {
match &item.availability {
Availability::Nobody => return Ok(ServeResult::NotFound),
Availability::Specific { peers } => {
if let Some(did) = peer_did {
if !peers.iter().any(|p| p == did) {
debug!("Content '{}' not available to peer {}", id, did);
return Ok(ServeResult::Forbidden);
}
} else {
return Ok(ServeResult::Forbidden);
}
}
Availability::AllPeers => {}
}
if !visible_to(item, peer_did, is_known_peer, owner_session) {
return Ok(if matches!(item.availability, Availability::Nobody) {
ServeResult::NotFound
} else {
ServeResult::Forbidden
});
}
let file_path = content_file_path(data_dir, item);
core/archipelago/src/fips/dial.rs
+23
View File
@@ -479,6 +479,29 @@ impl<'a> PeerRequest<'a> {
self
}
/// Authenticate peer content without granting trust to a caller-supplied DID.
/// Call after setting Range, since the exact range is signed too.
pub async fn authenticate_content(mut self, data_dir: &std::path::Path) -> Result<Self> {
anyhow::ensure!(
self.path == "/content" || self.path.starts_with("/content/"),
"Not a content route"
);
let range = self
.headers
.iter()
.find(|(name, _)| name.eq_ignore_ascii_case("range"))
.map(|(_, value)| value.as_str())
.unwrap_or("");
if let Some(proof) =
crate::content_auth::outgoing(data_dir, self.onion_host, self.path, range).await?
{
self.headers
.retain(|(name, _)| !name.eq_ignore_ascii_case(crate::content_auth::HEADER));
self.headers.push((crate::content_auth::HEADER, proof));
}
Ok(self)
}
pub fn header(mut self, name: &'a str, value: impl Into<String>) -> Self {
self.headers.push((name, value.into()));
self
core/archipelago/src/identity.rs
+15
View File
@@ -72,6 +72,21 @@ impl NodeIdentity {
})
}
/// Load an existing identity for outbound requests. Never create or repair a
/// key as a side effect of accessing another node.
pub async fn load_existing(identity_dir: &Path) -> Result<Self> {
let bytes = fs::read(identity_dir.join(NODE_KEY_FILE))
.await
.context("Existing node identity unavailable")?;
let key: [u8; 32] = bytes
.try_into()
.map_err(|_| anyhow::anyhow!("Invalid node key length"))?;
Ok(Self {
signing_key: SigningKey::from_bytes(&key),
_identity_dir: identity_dir.to_owned(),
})
}
/// Create node identity from a BIP-39 master seed (deterministic derivation).
/// Writes derived key to disk in the same format as load_or_create.
/// Also derives and persists the FIPS mesh transport key so the
core/archipelago/src/main.rs
+1
View File
@@ -40,6 +40,7 @@ mod ceremony;
mod config;
mod constants;
mod container;
mod content_auth;
mod content_hash;
mod content_indeehub;
mod content_invoice;