add ECDSA validating

rarimo · Feb 14, 2024 · ac1cae1 · ac1cae1
1 parent 0c21108
commit ac1cae1
Show file tree

Hide file tree

Showing 17 changed files with 248 additions and 87 deletions.
diff --git a/.github/workflows/actions.yaml b/.github/workflows/actions.yaml
@@ -35,4 +35,4 @@ jobs:
       - name: Run Build
         run: |
           . $(werf ci-env github --as-file)
-          werf export service --tag ghcr.io/rarimovoting/identity-provider-service:$GITHUB_SHA
+          werf export service --tag ghcr.io/rarimo/passport-identity-provider:$GITHUB_SHA
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
@@ -3,6 +3,8 @@ on:
   push:
     tags:
       - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-rc[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+'
 
 env:
   CI_JOB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -34,4 +36,4 @@ jobs:
       - name: Run Build
         run: |
           . $(werf ci-env github --as-file)
-          werf export service --tag ghcr.io/rarimovoting/identity-provider-service:$GITHUB_REF_NAME
+          werf export service --tag ghcr.io/rarimo/passport-identity-provider:$GITHUB_REF_NAME
diff --git a/Dockerfile b/Dockerfile
@@ -2,11 +2,11 @@ FROM golang:1.21.6-alpine as buildbase
 
 RUN apk add git build-base
 
-WORKDIR /go/src/github.com/RarimoVoting/identity-provider-service
+WORKDIR /go/src/github.com/rarimo/passport-identity-provider
 COPY vendor .
 COPY . .
 
-RUN GOOS=linux go build  -o /usr/local/bin/identity-provider-service /go/src/github.com/RarimoVoting/identity-provider-service
+RUN GOOS=linux go build  -o /usr/local/bin/identity-provider-service /go/src/github.com/rarimo/passport-identity-provider
 
 
 FROM alpine:3.9

diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Zero Block Global Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -4,10 +4,95 @@
 
 This service is responsible for verifying a user-provided ZKP, real-world identity certificate and issuing voting permission claim.
 
+## Endpoints
+
+### create_identity
+
+`create_identity` verifies a user-provided ZKP that proves the real-world identity ownership, validates this real-world identity certificate and issues a PollsCredential claim.<br><br>
+Path: `POST /integrations/identity-provider-service/v1/create-identity`<br>
+Payload example (proof is provided as an example and actually does not prove anything):
+```json
+{
+  "data": {
+    "id": "did:iden3:readonly:tJWarsbwqiUxHm8BPi4aYSnnj54AbuR4D2RrhkykQ",
+    "document_sod": {
+      "signed_attributes": "hex_string",
+      "algorithm": "SHA256withRSA",
+      "signature": "hex_string",
+      "pem_file": "-----BEGIN CERTIFICATE-----\n{...}\n-----END CERTIFICATE-----",
+      "encapsulated_content": "hex_string"
+    },
+    "zkproof": {
+      "proof": {
+        "pi_a": [
+          "4486400337619062702179111506341517111494111681111222111137338836157671763417",
+          "4486400337619062702179111506341517111494111681111222111137338836157671763417",
+          "1"
+        ],
+        "pi_b": [
+          [
+            "4486400337619062702179111506341517111494111681111222111137338836157671763417",
+            "4486400337619062702179111506341517111494111681111222111137338836157671763417"
+          ],
+          [
+            "4486400337619062702179111506341517111494111681111222111137338836157671763417",
+            "4486400337619062702179111506341517111494111681111222111137338836157671763417"
+          ],
+          [
+            "1",
+            "0"
+          ]
+        ],
+        "pi_c": [
+          "44864003376190627021791115063415171114941116811112221111373388361576717634171",
+          "4486400337619062702179111506341517111494111681111222111137338836157671763417",
+          "1"
+        ],
+        "protocol": "groth16",
+        "curve": "bn128"
+      },
+      "pub_signals": [
+        "311829949927574718572524671081106490489",
+        "311829949927574718572524671081106490489",
+        "4903111",
+        "24",
+        "1",
+        "25",
+        "25",
+        "1",
+        "25",
+        "18"
+      ]
+    }
+  }
+}
+```
+
+## Issuer Node Integration
+
+The only Issuer Node that is used is CreateCredential that issues claim. This claim is always stored in the issuer's Claims Tree (considering that the CreateCredential payload field `mtProof` is always `true`) that is automatically transited on-chain.<br><br>
+`CreateCredential` payload example:
+```json
+{
+  "credentialSchema": "https://bafybeif5xytac5352no62kalpdin3vbwp3pknijmzwd5dqgsi72jnnss6y.ipfs.w3s.link/PollsCredential.json",
+  "credentialSubject": {
+    "id": "did:iden3:readonly:tMF5BykcV7fiDSRi3HQSH8VHjTR24fqz2BhJHHzuY",
+    "isAdult": true,
+    "issuingAuthority": 4903594,
+    "documentNullifier": "18586133768512220936620570745912940619677854269274689475585506675881198879027",
+    "credentialHash": "8645981980787649023086883978738420856660271013038108762834452721572614684349"
+  },
+  "type": "PollsCredential",
+  "mtProof": true,
+  "signatureProof": true,
+  "expiration": "2023-10-26T10:59:08Z"
+}
+```
+
 ## Install
 
   ```
-  git clone github.com/RarimoVoting/identity-provider-service
+  git clone github.com/rarimo/passport-identity-provider
   cd identity-provider-service
   go build main.go
   export KV_VIPER_FILE=./config.yaml
@@ -41,8 +126,8 @@ Make sure that docker installed.
 use `docker run ` with `-p 8080:80` to expose port 80 to 8080
 
   ```
-  docker build -t github.com/RarimoVoting/identity-provider-service .
-  docker run -e KV_VIPER_FILE=/config.yaml github.com/RarimoVoting/identity-provider-service
+  docker build -t github.com/rarimo/passport-identity-provider .
+  docker run -e KV_VIPER_FILE=/config.yaml github.com/rarimo/passport-identity-provider
   ```
 
 ## Running from Source

diff --git a/go.mod b/go.mod
@@ -1,4 +1,4 @@
-module github.com/RarimoVoting/identity-provider-service
+module github.com/rarimo/passport-identity-provider
 
 go 1.21.6
 
@@ -7,9 +7,11 @@ require (
 	github.com/alecthomas/kingpin v2.2.6+incompatible
 	github.com/fatih/structs v1.1.0
 	github.com/go-chi/chi v4.1.2+incompatible
+	github.com/iden3/go-iden3-crypto v0.0.15
 	github.com/iden3/go-rapidsnark/types v0.0.3
 	github.com/iden3/go-rapidsnark/verifier v0.0.5
 	github.com/imroc/req/v3 v3.42.3
+	github.com/rarimo/certificate-transparency-go v0.0.0-20240213155651-cc6feffbd155
 	github.com/rubenv/sql-migrate v1.6.1
 	gitlab.com/distributed_lab/ape v1.7.1
 	gitlab.com/distributed_lab/figure v2.1.0+incompatible
@@ -39,16 +41,15 @@ require (
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/google/jsonapi v0.0.0-20200226002910-c8283f632fb7 // indirect
 	github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42 // indirect
-	github.com/gorilla/websocket v1.4.2 // indirect
+	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/iden3/go-iden3-crypto v0.0.15 // indirect
 	github.com/jmoiron/sqlx v1.2.0 // indirect
 	github.com/klauspost/compress v1.17.4 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
-	github.com/lib/pq v1.10.7 // indirect
+	github.com/lib/pq v1.10.9 // indirect
 	github.com/magiconair/properties v1.8.0 // indirect
 	github.com/mitchellh/mapstructure v1.4.1 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
@@ -60,22 +61,22 @@ require (
 	github.com/quic-go/quic-go v0.40.1 // indirect
 	github.com/refraction-networking/utls v1.6.0 // indirect
 	github.com/shirou/gopsutil v3.21.4-0.20210419000835-c7a38de76ee5+incompatible // indirect
-	github.com/sirupsen/logrus v1.9.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/afero v1.1.2 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.0.0 // indirect
-	github.com/spf13/pflag v1.0.3 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.3.2 // indirect
 	github.com/tklauser/go-sysconf v0.3.5 // indirect
 	github.com/tklauser/numcpus v0.2.2 // indirect
 	gitlab.com/distributed_lab/lorem v0.2.0 // indirect
 	gitlab.com/distributed_lab/running v0.0.0-20200706131153-4af0e83eb96c // indirect
 	go.uber.org/mock v0.4.0 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
+	golang.org/x/crypto v0.19.0 // indirect
 	golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc // indirect
 	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
-	golang.org/x/sys v0.16.0 // indirect
+	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/sys v0.17.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/tools v0.16.1 // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect