feat(dataverse): support unverified credentials (tx signatures as proof)

ccamel · ccamel · commit 83c03057bc09 · 2024-12-10T21:47:00.000+01:00
diff --git a/contracts/axone-dataverse/src/contract.rs b/contracts/axone-dataverse/src/contract.rs
@@ -83,6 +83,7 @@ pub fn execute(
 
 pub mod execute {
     use super::*;
+    use crate::credential::error::VerificationError;
     use crate::credential::vc::VerifiableCredential;
     use crate::registrar::credential::DataverseCredential;
     use crate::registrar::registry::ClaimRegistrar;
@@ -101,7 +102,15 @@ pub mod execute {
         let rdf_quads = reader.read_all()?;
         let vc_dataset = Dataset::from(rdf_quads.as_slice());
         let vc = VerifiableCredential::try_from(&vc_dataset)?;
-        vc.verify(&deps)?;
+
+        // check proofs if any.
+        // accept unverified credentials if the issuer matches the sender, as the transaction's
+        // signature serves as proof.
+        if !vc.proof.is_empty() {
+            vc.verify(&deps)?;
+        } else if !vc.is_issued_by(&info.sender) {
+            Err(VerificationError::NoSuitableProof)?;
+        }
 
         let credential = DataverseCredential::try_from((env, info, &vc))?;
         let registrar = ClaimRegistrar::try_new(deps.storage)?;
@@ -444,6 +453,72 @@ _:b0 <https://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://example.org/exam
         ))
     }
 
+    #[test]
+    fn submit_unverified_claims_matching_sender() {
+        let mut deps = mock_dependencies();
+        deps.querier.update_wasm(|query| match query {
+            WasmQuery::Smart { contract_addr, msg } => {
+                if contract_addr != "my-dataverse-addr" {
+                    return SystemResult::Err(SystemError::NoSuchContract {
+                        addr: contract_addr.to_string(),
+                    });
+                }
+                let query_msg: StdResult<axone_cognitarium::msg::QueryMsg> = from_json(msg);
+                assert_eq!(
+                    query_msg,
+                    Ok(axone_cognitarium::msg::QueryMsg::Select {
+                        query: SelectQuery {
+                            prefixes: vec![],
+                            limit: Some(1u32),
+                            select: vec![SelectItem::Variable("p".to_string())],
+                            r#where: WhereClause::Bgp {
+                                patterns: vec![TriplePattern {
+                                    subject: VarOrNode::Node(Node::NamedNode(IRI::Full(
+                                        "https://example.edu/credentials/3732".to_string(),
+                                    ))),
+                                    predicate: VarOrNamedNode::Variable("p".to_string()),
+                                    object: VarOrNodeOrLiteral::Variable("o".to_string()),
+                                }]
+                            },
+                        }
+                    })
+                );
+
+                let select_resp = SelectResponse {
+                    results: Results { bindings: vec![] },
+                    head: Head { vars: vec![] },
+                };
+                SystemResult::Ok(ContractResult::Ok(to_json_binary(&select_resp).unwrap()))
+            }
+            _ => SystemResult::Err(SystemError::Unknown {}),
+        });
+
+        DATAVERSE
+            .save(
+                deps.as_mut().storage,
+                &Dataverse {
+                    name: "my-dataverse".to_string(),
+                    triplestore_address: Addr::unchecked("my-dataverse-addr"),
+                },
+            )
+            .unwrap();
+
+        let resp = execute(
+            deps.as_mut(),
+            mock_env(),
+            message_info(
+                &Addr::unchecked("axone178mjppxcf3n9q3q7utdwrajdal0tsqvymz0900"),
+                &[],
+            ),
+            ExecuteMsg::SubmitClaims {
+                claims: Binary::new(read_test_data("vc-eddsa-2020-ok-unsecured-trusted.nq")),
+                format: Some(RdfDatasetFormat::NQuads),
+            },
+        );
+
+        assert!(resp.is_ok());
+    }
+
     #[test]
     fn submit_unverified_claims() {
         let resp = execute(
diff --git a/contracts/axone-dataverse/src/credential/vc.rs b/contracts/axone-dataverse/src/credential/vc.rs
@@ -3,9 +3,12 @@ use crate::credential::proof::{Proof, ProofPurpose};
 use crate::credential::rdf_marker::*;
 use axone_rdf::dataset::QuadIterator;
 use axone_rdf::dataset::{Dataset, QuadPattern};
-use cosmwasm_std::DepsMut;
+use bech32::Bech32;
+use cosmwasm_std::{Addr, DepsMut};
 use itertools::Itertools;
 use rio_api::model::{BlankNode, Literal, NamedNode, Subject, Term};
+use ripemd::Ripemd160;
+use sha2::Digest;
 
 #[derive(Debug, PartialEq)]
 pub struct VerifiableCredential<'a> {
@@ -87,6 +90,46 @@ impl<'a> VerifiableCredential<'a> {
         )
     }
 
+    // Tells if the credential was issued by the given address.
+    pub fn is_issued_by(&self, addr: &Addr) -> bool {
+        const SECP256K1PUB_MULTICODEC_PREFIX: [u8; 2] = [0xe7, 0x01];
+        const ED25519PUB_MULTICODEC_PREFIX: [u8; 2] = [0xed, 0x01];
+        const PREFIX: &str = "did:key:";
+
+        if !self.issuer.starts_with(PREFIX) {
+            return false;
+        }
+
+        let encoded = &self.issuer[PREFIX.len()..];
+        let decoded = match multibase::decode(encoded) {
+            Ok((_, bytes)) => bytes,
+            Err(_) => return false,
+        };
+
+        let (prefix, pubkey) = decoded.split_at(2);
+        if prefix != SECP256K1PUB_MULTICODEC_PREFIX && prefix != ED25519PUB_MULTICODEC_PREFIX {
+            return false;
+        }
+
+        let (hrp, _) = match bech32::decode(addr.as_str()) {
+            Ok(decoded) => decoded,
+            Err(_) => return false,
+        };
+
+        let pubkey_hash = {
+            let hash = sha2::Sha256::digest(pubkey);
+
+            Ripemd160::digest(hash)
+        };
+
+        let bech32_addr = match bech32::encode::<Bech32>(hrp, &pubkey_hash) {
+            Ok(addr) => addr,
+            Err(_) => return false,
+        };
+
+        bech32_addr == addr.as_str()
+    }
+
     fn extract_identifier(
         dataset: &'a Dataset<'a>,
     ) -> Result<NamedNode<'a>, InvalidCredentialError> {
diff --git a/contracts/axone-dataverse/src/msg.rs b/contracts/axone-dataverse/src/msg.rs
@@ -41,7 +41,9 @@ pub enum ExecuteMsg {
     ///
     ///   2. **Unique Identifier Mandate**: Each Verifiable Credential within the dataverse must possess a unique identifier.
     ///
-    ///   3. **Issuer Signature**: Claims must bear the issuer's signature. This signature must be verifiable, ensuring authenticity and credibility.
+    ///   3. **Issuer Verification**: Claims are accepted if they either:
+    ///      - Bear a verifiable issuer's signature to ensure authenticity.
+    ///      - Originate from the transaction sender, in which case the transaction signature serves as proof of authenticity.
     ///
     ///   4. **Content**: The actual implementation supports the submission of a single Verifiable Credential, containing a single claim.
     ///
diff --git a/contracts/axone-dataverse/testdata/vc-eddsa-2020-ok-unsecured-trusted.nq b/contracts/axone-dataverse/testdata/vc-eddsa-2020-ok-unsecured-trusted.nq
@@ -0,0 +1,9 @@
+<did:key:zDnaeUm3QkcyZWZTPttxB711jgqRDhkwvhF485SFw1bDZ9AQw> <https://example.org/examples#degree> _:b2 .
+<https://example.edu/credentials/3732> <https://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://example.org/examples#UniversityDegreeCredential> .
+<https://example.edu/credentials/3732> <https://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://www.w3.org/2018/credentials#VerifiableCredential> .
+<https://example.edu/credentials/3732> <https://www.w3.org/2018/credentials#credentialSubject> <did:key:zDnaeUm3QkcyZWZTPttxB711jgqRDhkwvhF485SFw1bDZ9AQw> .
+<https://example.edu/credentials/3732> <https://www.w3.org/2018/credentials#expirationDate> "2026-02-16T00:00:00Z"^^<https://www.w3.org/2001/XMLSchema#dateTime> .
+<https://example.edu/credentials/3732> <https://www.w3.org/2018/credentials#issuanceDate> "2024-02-16T00:00:00Z"^^<https://www.w3.org/2001/XMLSchema#dateTime> .
+<https://example.edu/credentials/3732> <https://www.w3.org/2018/credentials#issuer> <did:key:zQ3shsoarhrw7SoyUyoCbwv8k2BRRLeqkjRkffGqx7WNpMQgw> .
+_:b2 <https://schema.org/name> "Bachelor of Science and Arts"^^<https://www.w3.org/1999/02/22-rdf-syntax-ns#HTML> .
+_:b2 <https://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://example.org/examples#BachelorDegree> .
