fixup! Add jwt- and signature-based headers

pem file handling
appropriate headers for vss store unit test
add sig-based headers

Author: enigbe

.github/workflows/vss-integration.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        authorizer: [noop, sigs, jwt]
+        authorizer: [noop, sig, jwt]
 
     services:
       postgres:
@@ -45,18 +45,7 @@ jobs:
           if [ "${{ matrix.authorizer }}" == "noop" ]; then
             RUSTFLAGS="--cfg noop_authorizer" cargo run --release --no-default-features server/vss-server-config.toml &
           elif [ "${{ matrix.authorizer }}" == "jwt" ]; then
-            export VSS_JWT_RSA_PEM=$(cat <<'EOF'
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAriGCSdXczZrnLX84/luB
-HiV4nPwOoJByTkuzB6gKjqjIOPWmXzo+suJJoVN/32peTnHCeNvfaIUpyazCsFqC
-+WB2A9WO+NhM/7a6YxE01egsI4S6LwlbVm2a44r1J2G9XxHhqEPKfgjjisjDN7P4
-kFZYc6qPOpGfX3GhhYs68pHEYpkgzrjd1fwFnAd33Crny0u+s+srDU8Iil/8JwVB
-LaHwCyFdYva3MhabpkRov/ZaPNHlXAtUxK8QNwuSBMCUNfFwmrTNh39sYuA9+SQy
-vNP9DGN7u0yYGKxaWk4bind5Z0kj8edXpyVBGjYF7lDb03SpBRJ9QEkYuSzWzSyo
-VwIDAQAB
------END PUBLIC KEY-----
-EOF
-            )
+            export VSS_JWT_RSA_PEM=$(cat ../../ldk-node/tests/fixtures/vss_jwt_rsa_pub.pem)
             cargo run --release server/vss-server-config.toml &
           else
             cargo run --release server/vss-server-config.toml &
@@ -66,6 +55,6 @@ EOF
         run: |
           cd ldk-node
           export TEST_VSS_BASE_URL="http://localhost:8080/vss"
-          RUSTFLAGS="--cfg vss_test --cfg ${{ matrix.authorizer }}_auth_test" cargo test io::vss_store
+          RUSTFLAGS="--cfg vss_test --cfg ${{ matrix.authorizer }}_auth_test" cargo test --features test_utils io::vss_store
           RUSTFLAGS="--cfg vss_test --cfg cycle_tests --cfg ${{ matrix.authorizer }}_auth_test" cargo test \
           --features test_utils --test integration_tests_vss

Cargo.toml

@@ -25,7 +25,7 @@ panic = 'abort'     # Abort on panic
 
 [features]
 default = []
-test_utils = ["jsonwebtoken"]
+test_utils = ["jsonwebtoken", "secp256k1/global-context", "lightning/_test_utils"]
 
 [dependencies]
 #lightning = { version = "0.2.0", features = ["std"] }
@@ -81,6 +81,7 @@ prost = { version = "0.11.6", default-features = false}
 #bitcoin-payment-instructions = { version = "0.6" }
 bitcoin-payment-instructions = { git = "https://github.com/tnull/bitcoin-payment-instructions", rev = "e4d519b95b26916dc6efa22f8f1cc11a818ce7a7" }
 jsonwebtoken = { version = "9.3.0", optional = true, default-features = false, features = ["use_pem"] }
+secp256k1 = { version = "0.31", optional = true, default-features = false, features = [ "global-context" ] }
 
 [target.'cfg(windows)'.dependencies]
 winapi = { version = "0.3", features = ["winbase"] }
@@ -106,7 +107,6 @@ clightningrpc = { version = "0.3.0-beta.8", default-features = false }
 lnd_grpc_rust = { version = "2.10.0", default-features = false }
 tokio = { version = "1.37", features = ["fs"] }
 
-
 [build-dependencies]
 uniffi = { version = "0.28.3", features = ["build"], optional = true }
 

src/io/test_utils.rs

@@ -12,10 +12,18 @@ use std::future::Future;
 use std::panic::RefUnwindSafe;
 use std::path::PathBuf;
 use std::sync::Mutex;
+
+#[cfg(any(all(jwt_auth_test, feature = "test_utils"), sig_auth_test))]
 use std::time::SystemTime;
 
+#[cfg(all(sig_auth_test, feature = "test_utils"))]
+use secp256k1::SecretKey;
+
 #[cfg(all(jwt_auth_test, feature = "test_utils"))]
 use jsonwebtoken::{encode, Algorithm, EncodingKey, Header};
+#[cfg(all(jwt_auth_test, feature = "test_utils"))]
+use serde::{Deserialize, Serialize};
+
 use lightning::events::ClosureReason;
 use lightning::ln::functional_test_utils::{
 	check_added_monitors, check_closed_event, connect_block, create_announced_chan_between_nodes,
@@ -29,7 +37,6 @@ use lightning::util::test_utils;
 use lightning::{check_closed_broadcast, io};
 use rand::distr::Alphanumeric;
 use rand::{rng, Rng};
-use serde::{Deserialize, Serialize};
 
 type TestMonitorUpdatePersister<'a, K> = MonitorUpdatingPersister<
 	&'a K,
@@ -41,8 +48,8 @@ type TestMonitorUpdatePersister<'a, K> = MonitorUpdatingPersister<
 >;
 
 const EXPECTED_UPDATES_PER_PAYMENT: u64 = 5;
-#[cfg(jwt_auth_test)]
-pub const VSS_PRIVATE_PEM: &str = r#"
+#[cfg(all(jwt_auth_test, feature = "test_utils"))]
+const VSS_PRIVATE_PEM: &str = r#"
 -----BEGIN PRIVATE KEY-----
 MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCuIYJJ1dzNmuct
 fzj+W4EeJXic/A6gkHJOS7MHqAqOqMg49aZfOj6y4kmhU3/fal5OccJ4299ohSnJ
@@ -73,6 +80,10 @@ xrhmGsrdBu3nBkwwpCBps6KZ
 -----END PRIVATE KEY-----
 "#;
 
+#[cfg(sig_auth_test)]
+const SIGNING_CONSTANT: &'static [u8] =
+	b"VSS Signature Authorizer Signing Salt Constant..................";
+
 pub struct InMemoryStore {
 	persisted_bytes: Mutex<HashMap<String, HashMap<String, Vec<u8>>>>,
 }
@@ -388,7 +399,7 @@ pub(crate) fn do_test_store<K: KVStoreSync + Sync>(store_0: &K, store_1: &K) {
 	check_persisted_data!(persister_0_max_pending_updates * 2 * EXPECTED_UPDATES_PER_PAYMENT + 1);
 }
 
-#[cfg(jwt_auth_test)]
+#[cfg(all(jwt_auth_test, feature = "test_utils"))]
 #[derive(Serialize, Deserialize)]
 struct TestClaims {
 	sub: String,
@@ -397,7 +408,7 @@ struct TestClaims {
 	exp: i64,
 }
 
-#[cfg(jwt_auth_test)]
+#[cfg(all(jwt_auth_test, feature = "test_utils"))]
 pub fn generate_test_jwt(private_pem: &str, user_id: &str) -> String {
 	let now = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH).unwrap().as_secs() as i64;
 
@@ -410,13 +421,38 @@ pub fn generate_test_jwt(private_pem: &str, user_id: &str) -> String {
 	encode(&Header::new(Algorithm::RS256), &claims, &encoding_key).unwrap()
 }
 
-/// Returns a hashmap of fixed headers.
+#[cfg(all(sig_auth_test, feature = "test_utils"))]
+fn build_auth_token(secret_key: &SecretKey) -> String {
+	use bitcoin::hashes::sha256::Hash;
+	use bitcoin::hashes::Hash as _;
+	use std::time::UNIX_EPOCH;
+
+	use crate::hex_utils;
+
+	let secp = secp256k1::Secp256k1::new();
+	let pubkey = secret_key.public_key(&secp);
+	let now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs();
+
+	let mut bytes_to_sign = Vec::new();
+	bytes_to_sign.extend_from_slice(SIGNING_CONSTANT);
+	bytes_to_sign.extend_from_slice(&pubkey.serialize());
+	bytes_to_sign.extend_from_slice(format!("{now}").as_bytes());
+
+	let hash = Hash::hash(&bytes_to_sign);
+	let sig = secret_key.sign_ecdsa(secp256k1::Message::from_digest(hash.to_byte_array()));
+
+	format!("{pubkey:x}{}{now}", hex_utils::to_string(&sig.serialize_compact()))
+}
+
+/// Returns a hashmap of fixed headers, where, depending on configuration,
+/// corresponds to valid headers for no-op, signature-based, or jwt-based
+/// authorizers on vss-server.
 pub fn get_fixed_headers() -> HashMap<String, String> {
 	#[cfg(noop_auth_test)]
 	{
 		return HashMap::new();
 	}
-	#[cfg(jwt_auth_test)]
+	#[cfg(all(jwt_auth_test, feature = "test_utils"))]
 	{
 		let token = generate_test_jwt(VSS_PRIVATE_PEM, "test");
 		let mut headers = HashMap::new();
@@ -426,9 +462,13 @@ pub fn get_fixed_headers() -> HashMap<String, String> {
 
 	#[cfg(sig_auth_test)]
 	{
-		todo!()
+		let secret_key = SecretKey::from_byte_array([42; 32]).unwrap();
+		let token = build_auth_token(&secret_key);
+		let mut headers = HashMap::new();
+		headers.insert("Authorization".to_string(), token);
+		return headers;
 	}
 
-	#[cfg(not(any(noop_auth_test, jwt_auth_test, sig_auth_test)))]
+	#[cfg(not(any(noop_auth_test, all(jwt_auth_test, feature = "test_utils"), sig_auth_test)))]
 	HashMap::new()
 }

src/io/vss_store.rs

@@ -969,7 +969,7 @@ mod tests {
 	use vss_client::headers::FixedHeaders;
 
 	use super::*;
-	use crate::io::test_utils::{do_read_write_remove_list_persist, get_header_provider};
+	use crate::io::test_utils::{do_read_write_remove_list_persist, get_fixed_headers};
 
 	#[test]
 	fn vss_read_write_remove_list_persist() {
@@ -978,9 +978,14 @@ mod tests {
 		let rand_store_id: String = (0..7).map(|_| rng.sample(Alphanumeric) as char).collect();
 		let mut vss_seed = [0u8; 32];
 		rng.fill_bytes(&mut vss_seed);
-		let header_provider = get_header_provider();
-		let vss_store =
-			VssStore::new(vss_base_url, rand_store_id, vss_seed, header_provider).unwrap();
+		let header_provider = get_fixed_headers();
+		let vss_store = VssStore::new(
+			vss_base_url,
+			rand_store_id,
+			vss_seed,
+			Arc::new(FixedHeaders::new(header_provider)),
+		)
+		.unwrap();
 		do_read_write_remove_list_persist(&vss_store);
 	}
 
@@ -991,9 +996,14 @@ mod tests {
 		let rand_store_id: String = (0..7).map(|_| rng.sample(Alphanumeric) as char).collect();
 		let mut vss_seed = [0u8; 32];
 		rng.fill_bytes(&mut vss_seed);
-		let header_provider = get_header_provider();
-		let vss_store =
-			VssStore::new(vss_base_url, rand_store_id, vss_seed, header_provider).unwrap();
+		let header_provider = get_fixed_headers();
+		let vss_store = VssStore::new(
+			vss_base_url,
+			rand_store_id,
+			vss_seed,
+			Arc::new(FixedHeaders::new(header_provider)),
+		)
+		.unwrap();
 
 		do_read_write_remove_list_persist(&vss_store);
 		drop(vss_store)

tests/fixtures/vss_jwt_rsa_pub.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAriGCSdXczZrnLX84/luB
+HiV4nPwOoJByTkuzB6gKjqjIOPWmXzo+suJJoVN/32peTnHCeNvfaIUpyazCsFqC
++WB2A9WO+NhM/7a6YxE01egsI4S6LwlbVm2a44r1J2G9XxHhqEPKfgjjisjDN7P4
+kFZYc6qPOpGfX3GhhYs68pHEYpkgzrjd1fwFnAd33Crny0u+s+srDU8Iil/8JwVB
+LaHwCyFdYva3MhabpkRov/ZaPNHlXAtUxK8QNwuSBMCUNfFwmrTNh39sYuA9+SQy
+vNP9DGN7u0yYGKxaWk4bind5Z0kj8edXpyVBGjYF7lDb03SpBRJ9QEkYuSzWzSyo
+VwIDAQAB
+-----END PUBLIC KEY-----

tests/integration_tests_vss.rs

@@ -5,7 +5,7 @@
 // http://opensource.org/licenses/MIT>, at your option. You may not use this file except in
 // accordance with one or both of these licenses.
 
-#![cfg(all(vss_test))]
+#![cfg(all(vss_test, feature = "test_utils"))]
 
 mod common;