owner ext as service (#79)

owner ext as service

Author: vitiko

Makefile

@@ -1,7 +1,7 @@
 GOFLAGS ?= -mod=vendor
 
 PROTO_PACKAGES_GO := examples/cpaper_extended/schema state/schema examples/cpaper_asservice/schema
-PROTO_PACKAGES_CCGW := extensions/debug examples/cpaper_asservice/service
+PROTO_PACKAGES_CCGW := extensions/debug extensions/owner examples/cpaper_asservice/service
 
 test:
 	@echo "go test -mod vendor ./..."

examples/erc20/erc20_ops.go

@@ -62,12 +62,12 @@ func invokeTransfer(c r.Context) (interface{}, error) {
 	}
 
 	// Disallow to transfer token to same account
-	if invoker.GetMSPID() == toMspId && invoker.GetID() == toCertId {
+	if invoker.GetMSPIdentifier() == toMspId && invoker.GetID() == toCertId {
 		return nil, ErrForbiddenToTransferToSameAccount
 	}
 
 	// get information about invoker balance from state
-	invokerBalance, err := getBalance(c, invoker.GetMSPID(), invoker.GetID())
+	invokerBalance, err := getBalance(c, invoker.GetMSPIdentifier(), invoker.GetID())
 	if err != nil {
 		return nil, err
 	}
@@ -84,7 +84,7 @@ func invokeTransfer(c r.Context) (interface{}, error) {
 	}
 
 	// Update payer and recipient balance
-	if err = setBalance(c, invoker.GetMSPID(), invoker.GetID(), invokerBalance-amount); err != nil {
+	if err = setBalance(c, invoker.GetMSPIdentifier(), invoker.GetID(), invokerBalance-amount); err != nil {
 		return nil, err
 	}
 
@@ -95,7 +95,7 @@ func invokeTransfer(c r.Context) (interface{}, error) {
 	// Trigger event with name "transfer" and payload - serialized to json Transfer structure
 	if err = c.SetEvent(`transfer`, &Transfer{
 		From: identity.Id{
-			MSP:  invoker.GetMSPID(),
+			MSP:  invoker.GetMSPIdentifier(),
 			Cert: invoker.GetID(),
 		},
 		To: identity.Id{
@@ -128,13 +128,13 @@ func invokeApprove(c r.Context) (interface{}, error) {
 		return nil, err
 	}
 
-	if err = setAllowance(c, invoker.GetMSPID(), invoker.GetID(), spenderMspId, spenderCertId, amount); err != nil {
+	if err = setAllowance(c, invoker.GetMSPIdentifier(), invoker.GetID(), spenderMspId, spenderCertId, amount); err != nil {
 		return nil, err
 	}
 
 	if err = c.SetEvent(`approve`, &Approve{
 		From: identity.Id{
-			MSP:  invoker.GetMSPID(),
+			MSP:  invoker.GetMSPIdentifier(),
 			Cert: invoker.GetID(),
 		},
 		Spender: identity.Id{
@@ -166,7 +166,7 @@ func invokeTransferFrom(c r.Context) (interface{}, error) {
 	}
 
 	// check method invoker has allowances
-	allowance, err := getAllowance(c, fromMspId, fromCertId, invoker.GetMSPID(), invoker.GetID())
+	allowance, err := getAllowance(c, fromMspId, fromCertId, invoker.GetMSPIdentifier(), invoker.GetID())
 	if err != nil {
 		return nil, err
 	}
@@ -204,7 +204,7 @@ func invokeTransferFrom(c r.Context) (interface{}, error) {
 	}
 
 	// decrease invoker allowance
-	if err = setAllowance(c, fromMspId, fromCertId, invoker.GetMSPID(), invoker.GetID(), allowance-amount); err != nil {
+	if err = setAllowance(c, fromMspId, fromCertId, invoker.GetMSPIdentifier(), invoker.GetID(), allowance-amount); err != nil {
 		return nil, err
 	}
 

extensions/owner/README.md

@@ -1,11 +1,17 @@
 # Owner - access control hyperledger fabric chaincode extension
 
 In many cases during chaincode instantiating we need to define permissions for chaincode functions -
-"who is allowed to do this thing", incredibly important in the world of smart contracts, but in many examples access control 
-implemented at the application level but not at the blockchain layer. 
+"who is allowed to do this thing", incredibly important in the world of smart contracts, 
+but in many examples access control implemented at the application level but not at the blockchain layer. 
 
-The most common and basic form of access control is the concept of `ownership`: there's one account (combination
-of MSP  and certificate identifiers) that is the owner and can do administrative tasks on contracts. This 
+The most common and basic form of access control is the concept of `ownership`: there's one or more accounts
+(in case of Hyperledger Fabric chaincode model  - combination of MSP and certificate) that is the
+owners and can do administrative tasks on contracts. This 
 approach is perfectly reasonable for contracts that only have a single administrative user.
 
-CCKit provides `owner` extension for implementing ownership and access control in Hyperledger Fabric chaincodes.
+CCKit provides `owner` extension for implementing ownership and access control in Hyperledger Fabric chaincodes.
+
+Owner extension implemented in two version:
+
+1. As chaincode [handlers](handler.go)
+2. As [service](chaincode_owner.proto), that can be embedded in chaincode, using [chaincode-as-service mode](../../gateway)

extensions/owner/chaincode_owner.go

@@ -0,0 +1,264 @@
+package owner
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"github.com/golang/protobuf/ptypes/empty"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/s7techlab/cckit/identity"
+	"github.com/s7techlab/cckit/router"
+)
+
+var (
+	ErrTxInvokerIsNotOwner         = errors.New(`tx invoker is not owner`)
+	ErrDeleteLastOwnerIsNotAllowed = errors.New(`delete last owner is not allowed`)
+	ErrNewCertSameAsOldCert        = errors.New(`new cert same as old cert`)
+)
+
+func (x *ChaincodeOwner) GetMSPIdentifier() string {
+	return x.MspId
+}
+
+func NewService() *ChaincodeOwnerService {
+	return &ChaincodeOwnerService{}
+}
+
+type ChaincodeOwnerService struct {
+}
+
+// IsTxCreator - wrapper for TxCreatorIsOwner for local calls
+func (c *ChaincodeOwnerService) IsTxCreator(ctx router.Context) (*ChaincodeOwner, error) {
+	return c.TxCreatorIsOwner(ctx, &empty.Empty{})
+}
+
+// RegisterTxCreator Wrapper for OwnerRegisterTxCreator
+func (c *ChaincodeOwnerService) RegisterTxCreator(ctx router.Context) (*ChaincodeOwner, error) {
+	return c.OwnerRegisterTxCreator(ctx, &empty.Empty{})
+}
+
+func (c *ChaincodeOwnerService) TxCreatorIsOwner(ctx router.Context, _ *empty.Empty) (*ChaincodeOwner, error) {
+	txCreator, err := identity.FromStub(ctx.Stub())
+	if err != nil {
+		return nil, err
+	}
+
+	owner, err := c.OwnerGet(ctx, &OwnerId{
+		MspId:   txCreator.GetMSPIdentifier(),
+		Subject: txCreator.GetSubject(),
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf(`find owner by tx creator's msp_id and cert subject: %w`, err)
+	}
+
+	if err := identity.Equal(txCreator, owner); err != nil {
+		return nil, fmt.Errorf(`owner with tx creator's' msp_id and cert subject found, but: %w`, err)
+	}
+
+	return owner, nil
+}
+
+func (c *ChaincodeOwnerService) OwnersList(ctx router.Context, _ *empty.Empty) (*ChaincodeOwners, error) {
+	if res, err := State(ctx).List(&ChaincodeOwner{}); err != nil {
+		return nil, err
+	} else {
+		return res.(*ChaincodeOwners), nil
+	}
+}
+
+func (c *ChaincodeOwnerService) OwnerGet(ctx router.Context, id *OwnerId) (*ChaincodeOwner, error) {
+	if err := router.ValidateRequest(id); err != nil {
+		return nil, err
+	}
+
+	if res, err := State(ctx).Get(id, &ChaincodeOwner{}); err != nil {
+		return nil, err
+	} else {
+		return res.(*ChaincodeOwner), nil
+	}
+}
+
+func (c *ChaincodeOwnerService) allowToModifyBy(ctx router.Context, invoker identity.Identity) error {
+	currentOwners, err := c.OwnersList(ctx, &empty.Empty{})
+	if err != nil {
+		return err
+	}
+
+	// no owners, allow to register
+	if len(currentOwners.Items) == 0 {
+		return nil
+	}
+
+	for _, owner := range currentOwners.Items {
+		if err = identity.Equal(owner, invoker); err == nil {
+			return nil
+		}
+	}
+
+	return ErrTxInvokerIsNotOwner
+}
+
+func (c *ChaincodeOwnerService) txCreatorAllowedToModify(ctx router.Context) (identity.Identity, error) {
+	txCreator, err := identity.FromStub(ctx.Stub())
+	if err != nil {
+		return nil, err
+	}
+
+	return txCreator, c.allowToModifyBy(ctx, txCreator)
+}
+
+func (c *ChaincodeOwnerService) OwnerRegisterTxCreator(ctx router.Context, _ *empty.Empty) (*ChaincodeOwner, error) {
+	txCreator, err := identity.FromStub(ctx.Stub())
+	if err != nil {
+		return nil, err
+	}
+
+	return c.OwnerRegister(ctx, &OwnerRegisterRequest{
+		MspId: txCreator.GetMSPIdentifier(),
+		Cert:  txCreator.GetPEM(),
+	})
+}
+
+func (c *ChaincodeOwnerService) OwnerRegister(ctx router.Context, registerRequest *OwnerRegisterRequest) (*ChaincodeOwner, error) {
+	if err := router.ValidateRequest(registerRequest); err != nil {
+		return nil, err
+	}
+
+	txCreator, err := c.txCreatorAllowedToModify(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	id, err := identity.New(registerRequest.MspId, registerRequest.Cert)
+	if err != nil {
+		return nil, fmt.Errorf(`parse certificate: %w`, err)
+	}
+
+	txTimestamp, _ := ctx.Stub().GetTxTimestamp()
+	chaincodeOwner := &ChaincodeOwner{
+		MspId:   id.GetMSPIdentifier(),
+		Subject: id.GetSubject(),
+
+		Issuer:         id.GetIssuer(),
+		ExpiresAt:      timestamppb.New(id.ExpiresAt()),
+		Cert:           registerRequest.Cert,
+		UpdatedByMspId: txCreator.GetMSPIdentifier(),
+		UpdatedByCert:  txCreator.GetPEM(),
+		UpdatedAt:      txTimestamp,
+	}
+
+	if err = State(ctx).Insert(chaincodeOwner); err != nil {
+		return nil, err
+	}
+
+	if err = Event(ctx).Set(&ChaincodeOwnerRegistered{
+		MspId:     chaincodeOwner.MspId,
+		Subject:   chaincodeOwner.Subject,
+		Issuer:    chaincodeOwner.Issuer,
+		ExpiresAt: chaincodeOwner.ExpiresAt,
+	}); err != nil {
+		return nil, err
+	}
+
+	return chaincodeOwner, nil
+}
+
+func (c ChaincodeOwnerService) OwnerUpdate(ctx router.Context, updateRequest *OwnerUpdateRequest) (*ChaincodeOwner, error) {
+	if err := router.ValidateRequest(updateRequest); err != nil {
+		return nil, err
+	}
+
+	txCreator, err := c.txCreatorAllowedToModify(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	id, err := identity.New(updateRequest.MspId, updateRequest.Cert)
+	if err != nil {
+		return nil, fmt.Errorf(`parse certificate: %w`, err)
+	}
+
+	curOwner, err := c.OwnerGet(ctx, &OwnerId{
+		MspId:   id.GetMSPIdentifier(),
+		Subject: id.GetSubject(),
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf(`current owner with equal msp_id and cert_subject: %w`, err)
+	}
+
+	if bytes.Equal(curOwner.Cert, updateRequest.Cert) {
+		return nil, ErrNewCertSameAsOldCert
+	}
+
+	if err = identity.Equal(curOwner, id); err != nil {
+		return nil, err
+	}
+
+	txTimestamp, _ := ctx.Stub().GetTxTimestamp()
+	chaincodeOwner := &ChaincodeOwner{
+		MspId:   id.GetMSPIdentifier(),
+		Subject: id.GetSubject(),
+
+		Issuer:         id.GetIssuer(),
+		ExpiresAt:      timestamppb.New(id.ExpiresAt()),
+		Cert:           updateRequest.Cert,
+		UpdatedByMspId: txCreator.GetMSPIdentifier(),
+		UpdatedByCert:  txCreator.GetPEM(),
+		UpdatedAt:      txTimestamp,
+	}
+
+	if err = State(ctx).Put(chaincodeOwner); err != nil {
+		return nil, err
+	}
+
+	if err = Event(ctx).Set(&ChaincodeOwnerUpdated{
+		MspId:     chaincodeOwner.MspId,
+		Subject:   chaincodeOwner.Subject,
+		ExpiresAt: chaincodeOwner.ExpiresAt,
+	}); err != nil {
+		return nil, err
+	}
+
+	return chaincodeOwner, nil
+}
+
+func (c ChaincodeOwnerService) OwnerDelete(ctx router.Context, id *OwnerId) (*ChaincodeOwner, error) {
+	if err := router.ValidateRequest(id); err != nil {
+		return nil, err
+	}
+
+	if _, err := c.txCreatorAllowedToModify(ctx); err != nil {
+		return nil, err
+	}
+
+	deletedOwner, err := c.OwnerGet(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+
+	currentOwners, err := c.OwnersList(ctx, &empty.Empty{})
+	if err != nil {
+		return nil, err
+	}
+
+	if len(currentOwners.Items) == 1 {
+		return nil, ErrDeleteLastOwnerIsNotAllowed
+	}
+
+	if err := State(ctx).Delete(id); err != nil {
+		return nil, err
+	}
+
+	if err := Event(ctx).Set(&ChaincodeOwnerDeleted{
+		MspId:   id.MspId,
+		Subject: id.Subject,
+	}); err != nil {
+		return nil, err
+	}
+
+	return deletedOwner, nil
+}