kamu-signing: IdentityConfig: use setty

Author: s373r

Cargo.lock

@@ -1294,26 +1294,22 @@ Supported algorithms: `ed25519`, `secp256k1`.
 <thead><tr><th>Field</th><th>Type</th><th>Default</th><th>Description</th></tr></thead>
 <tbody>
 <tr>
-<td><code>privateKey</code></td>
+<td><code>ed25519PrivateKey</code></td>
 <td><a href="#privatekey"><code>PrivateKey</code></a></td>
 <td><code class="language-json">null</code></td>
 <td>
 
-To generate, use:
+Root private key that corresponds to the `authority` and is used to sign
+responses.
 
+To generate, use:
 ```sh
-dd if=/dev/urandom bs=1 count=32 status=none |
-    base64 -w0 |
-    tr '+/' '-_' |
-    tr -d '=' |
-    (echo -n u && cat)
+od -vN 32 -An -tx1 /dev/urandom | tr -d ' \n' && echo
+```
+or
+```sh
+openssl rand -hex 32
 ```
-
-The command above:
-- Reads 32 random bytes
-- base64-encodes them
-- Converts default base64 encoding to base64url and removes padding
-- Prepends a multibase prefix
 
 </td>
 </tr>
@@ -1325,6 +1321,15 @@ The command above:
 
 Secp256k1 private key used to sign EIP-712 typed data.
 
+To generate, use:
+```sh
+od -vN 32 -An -tx1 /dev/urandom | tr -d ' \n' && echo
+```
+or
+```sh
+openssl rand -hex 32
+```
+or
 ```sh
 cast wallet new
 ```

resources/config-reference.md

@@ -856,7 +856,7 @@
       "additionalProperties": false,
       "description": "Private keys are used to sign API responses.\nSupported algorithms: `ed25519`, `secp256k1`.",
       "properties": {
-        "privateKey": {
+        "ed25519PrivateKey": {
           "anyOf": [
             {
               "$ref": "#/$defs/PrivateKey"
@@ -866,7 +866,7 @@
             }
           ],
           "combine": "replace",
-          "description": "To generate, use:\n\n```sh\ndd if=/dev/urandom bs=1 count=32 status=none |\n    base64 -w0 |\n    tr '+/' '-_' |\n    tr -d '=' |\n    (echo -n u && cat)\n```\n\nThe command above:\n- Reads 32 random bytes\n- base64-encodes them\n- Converts default base64 encoding to base64url and removes padding\n- Prepends a multibase prefix"
+          "description": "Root private key that corresponds to the `authority` and is used to sign\nresponses.\n\nTo generate, use:\n```sh\nod -vN 32 -An -tx1 /dev/urandom | tr -d ' \\n' && echo\n```\nor\n```sh\nopenssl rand -hex 32\n```"
         },
         "secp256k1PrivateKey": {
           "anyOf": [
@@ -878,7 +878,7 @@
             }
           ],
           "combine": "replace",
-          "description": "Secp256k1 private key used to sign EIP-712 typed data.\n\n```sh\ncast wallet new\n```"
+          "description": "Secp256k1 private key used to sign EIP-712 typed data.\n\nTo generate, use:\n```sh\nod -vN 32 -An -tx1 /dev/urandom | tr -d ' \\n' && echo\n```\nor\n```sh\nopenssl rand -hex 32\n```\nor\n```sh\ncast wallet new\n```"
         }
       },
       "type": "object"

resources/config-schema.json

@@ -269,6 +269,7 @@ class "GetDatasetUpstreamDependenciesUseCaseImpl"
 class "GithubAuthenticationConfig" <<singleton>>
 class "GqlConfig" <<singleton>>
 class "HttpSourceConfig" <<singleton>>
+class "IdentityConfig" <<singleton>>
 class "Interact" <<singleton>>
 class "IpfsClient" <<singleton>>
 class "IpfsGateway" <<singleton>>
@@ -1082,7 +1083,7 @@ class "WsSmartTransferProtocolClient"
 "SignEip712UseCaseImpl"  --> "DatasetActionAuthorizer"
 "SignEip712UseCaseImpl"  --> "CurrentAccountSubject"
 "SignEip712UseCaseImpl"  --> "DidSecretEncryptionConfig"
-"SignEip712UseCaseImpl" "?" --> "IdentityConfig"
+"SignEip712UseCaseImpl"  --> "IdentityConfig"
 "TaskEventStore" <|-- "SqliteTaskEventStore"
 "SqliteTaskEventStore"  --> "TransactionRefT"
 "WebhookDeliveryRepository" <|-- "SqliteWebhookDeliveryRepository"

resources/di.puml

@@ -179,6 +179,15 @@ pub async fn query_handler_impl(
 ) -> Result<Json<QueryResponse>, ApiError> {
     tracing::debug!(request = ?body, "Query");
 
+    let query_svc = catalog.get_one::<dyn QueryService>().unwrap();
+    let identity_config = catalog
+        .get_one::<kamu_signing::entities::IdentityConfig>()
+        .unwrap();
+
+    let Some(ed25519_private_key) = &identity_config.ed25519_private_key else {
+        return Err(ApiError::not_implemented(ResponseSigningNotConfigured));
+    };
+
     // Automatically add `Input` if proof is requested, as proof depends on input
     // for verifiability
     if body.include.contains(&Include::Proof) {
@@ -189,11 +198,6 @@ pub async fn query_handler_impl(
         body.include.insert(Include::Schema);
     }
 
-    let identity = catalog
-        .get_one::<kamu_signing::entities::IdentityConfig>()
-        .ok();
-    let query_svc = catalog.get_one::<dyn QueryService>().unwrap();
-
     let res = query_svc
         .sql_statement(&body.query, body.to_options())
         .await
@@ -257,7 +261,7 @@ pub async fn query_handler_impl(
             commitment: None,
             proof: None,
         }
-    } else if let Some(identity) = identity {
+    } else {
         use odf::metadata::ed25519::Signer;
 
         let sub_queries = Vec::new();
@@ -273,9 +277,7 @@ pub async fn query_handler_impl(
             )),
         };
 
-        let signature = identity
-            .ed25519_private_key
-            .sign(&to_canonical_json(&commitment));
+        let signature = ed25519_private_key.sign(&to_canonical_json(&commitment));
 
         QueryResponse {
             input,
@@ -284,12 +286,10 @@ pub async fn query_handler_impl(
             commitment: Some(commitment),
             proof: Some(Proof {
                 r#type: kamu_signing::common::ProofType::Ed25519Signature2020,
-                verification_method: identity.ed25519_private_key.verifying_key(),
+                verification_method: ed25519_private_key.verifying_key(),
                 proof_value: signature.into(),
             }),
         }
-    } else {
-        Err(ApiError::not_implemented(ResponseSigningNotConfigured))?
     };
 
     Ok(Json(response))

src/adapter/http/src/data/query_handler.rs

@@ -42,11 +42,10 @@ impl Harness {
 
         let ed25519_private_key = odf::metadata::PrivateKey::from_bytes(&[123; _]);
         let identity_config = kamu_signing::entities::IdentityConfig {
-            ed25519_private_key: ed25519_private_key.clone(),
-            secp256k1_private_key: kamu_signing::utils::Secp256k1Signer::from_bytes(
-                &[124; _].into(),
-            )
-            .unwrap(),
+            ed25519_private_key: Some(ed25519_private_key.clone()),
+            secp256k1_private_key: Some(
+                kamu_signing::utils::Secp256k1Signer::from_bytes(&[124; _].into()).unwrap(),
+            ),
         };
 
         let catalog = dill::CatalogBuilder::new()

src/adapter/http/tests/tests/test_data_query.rs

@@ -132,7 +132,7 @@ kamu-auth-web3-services = { workspace = true }
 kamu-auth-web3-sqlite = { workspace = true }
 
 kamu-signing = { workspace = true, default-features = false, features = [
-    "schemars"
+    "schemars",
 ] }
 kamu-signing-services = { workspace = true }
 

src/app/cli/Cargo.toml

@@ -830,10 +830,7 @@ pub fn register_config_in_catalog(
     catalog_builder.add_value(config.source.ethereum.to_infra_cfg());
 
     // Identity configuration
-    if let Some(identity_config) = config.identity.to_infra_cfg() {
-        catalog_builder.add_value(identity_config);
-    }
-    //
+    catalog_builder.add_value(config.identity.clone());
 
     // IPFS configuration
     catalog_builder.add_value(odf::dataset::IpfsGateway {

src/app/cli/src/app.rs

@@ -47,7 +47,7 @@ pub struct CLIConfig {
 
     /// UNSTABLE: Identity configuration
     #[config(default)]
-    pub identity: IdentityConfig,
+    pub identity: kamu_signing::entities::IdentityConfig,
 
     /// Messaging outbox agent configuration
     #[config(default)]
@@ -555,56 +555,6 @@ pub struct AwsSecretDatabasePasswordPolicyConfig {
     pub secret_name: String,
 }
 
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
-// Identity
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
-
-/// Private keys are used to sign API responses.
-/// Supported algorithms: `ed25519`, `secp256k1`.
-#[derive(setty::Config, setty::Default)]
-pub struct IdentityConfig {
-    /// To generate, use:
-    ///
-    /// ```sh
-    /// dd if=/dev/urandom bs=1 count=32 status=none |
-    ///     base64 -w0 |
-    ///     tr '+/' '-_' |
-    ///     tr -d '=' |
-    ///     (echo -n u && cat)
-    /// ```
-    ///
-    /// The command above:
-    /// - Reads 32 random bytes
-    /// - base64-encodes them
-    /// - Converts default base64 encoding to base64url and removes padding
-    /// - Prepends a multibase prefix
-    #[config(combine(replace))]
-    pub private_key: Option<odf::metadata::PrivateKey>,
-
-    /// Secp256k1 private key used to sign EIP-712 typed data.
-    ///
-    /// ```sh
-    /// cast wallet new
-    /// ```
-    #[config(combine(replace))]
-    pub secp256k1_private_key: Option<kamu_signing::utils::Secp256k1Signer>,
-}
-
-impl IdentityConfig {
-    pub fn to_infra_cfg(&self) -> Option<kamu_signing::entities::IdentityConfig> {
-        if let Some(ed25519_private_key) = &self.private_key
-            && let Some(secp256k1_private_key) = &self.secp256k1_private_key
-        {
-            Some(kamu_signing::entities::IdentityConfig {
-                ed25519_private_key: ed25519_private_key.clone(),
-                secp256k1_private_key: secp256k1_private_key.clone(),
-            })
-        } else {
-            None
-        }
-    }
-}
-
 ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 // Search
 ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

src/app/cli/src/services/config/models.rs

@@ -37,6 +37,7 @@ odf = { workspace = true }
 async-trait = { version = "0.1", default-features = false }
 bon = { version = "3", default-features = false }
 serde = { version = "1", features = ["derive"], default-features = false }
+setty = { version = "1.0", default-features = false }
 thiserror = { version = "2", default-features = false }
 
 # Optional