feat(identity): check app ID/secret matching

When generating an identity, we now check that the app secret and the
app ID matches, it avoids very hard to debug behavior.

Author: jerem

tankersdk_identity/__init__.py

@@ -6,12 +6,25 @@
 import tankersdk_identity.crypto
 
 
+APP_SECRET_SIZE = 64
+APP_PUBLIC_KEY_SIZE = 32
+AUTHOR_SIZE = 32
+APP_CREATION_NATURE = 1
+
+
 def _hash_user_id(app_id, user_id):
     user_id_buff = user_id.encode()
     to_hash = user_id_buff + app_id
     return tankersdk_identity.crypto.generichash(to_hash, size=BLOCK_HASH_SIZE)
 
 
+def _generate_app_id(app_secret):
+    public_key = app_secret[APP_SECRET_SIZE - APP_PUBLIC_KEY_SIZE:APP_SECRET_SIZE]
+    # A bit convoluted, to make it work with python 2.7
+    to_hash = bytes(bytearray([APP_CREATION_NATURE] + [0] * AUTHOR_SIZE)) + public_key
+    return tankersdk_identity.crypto.generichash(to_hash, size=BLOCK_HASH_SIZE)
+
+
 def _generate_preshare_keys():
     enc_pub_key, enc_priv_key = tankersdk_identity.crypto.box_keypair()
     encryption_keys = {
@@ -60,6 +73,10 @@ def create_identity(app_id, app_secret, user_id):
     secret_buf = base64.b64decode(app_secret)
     hashed_user_id = _hash_user_id(app_id_buf, user_id)
 
+    generated_app_id = _generate_app_id(secret_buf)
+    if generated_app_id != app_id_buf:
+        raise ValueError("App secret and app ID mismatch")
+
     e_public_key, e_secret_key = tankersdk_identity.crypto.sign_keypair()
     to_sign = e_public_key + hashed_user_id
     delegation_signature = tankersdk_identity.crypto.sign_detached(to_sign, secret_buf)

tankersdk_identity/test/test_identity.py

@@ -120,3 +120,14 @@ def test_get_public_from_bad_identity():
     fake_id = base64.b64encode(json.dumps({"target": "stuffs"}).encode()).decode()
     with pytest.raises(ValueError):
         tankersdk_identity.get_public_identity(fake_id)
+
+
+def test_mistmatch_app_id_and_secret(test_app):
+    user_id = "guido@tanker.io"
+    mismatching_app_id = "rB0/yEJWCUVYRtDZLtXaJqtneXQOsCSKrtmWw+V+ysc="
+    with pytest.raises(ValueError):
+        tankersdk_identity.create_identity(
+            mismatching_app_id,
+            test_app["secret"],
+            user_id
+        )