add cryptosign authentication

Author: muzzammilshahid

cmd/deskconn-router/main.go

@@ -14,7 +14,12 @@ import (
 const (
 	realm = "io.xconn.deskconn"
 
-	ProcedureCRAVerify = "io.xconn.deskconn.account.cra.verify"
+	procedureCRAVerify        = "io.xconn.deskconn.account.cra.verify"
+	procedureCryptosignVerify = "io.xconn.deskconn.account.cryptosign.verify"
+
+	accountServiceAuthRole  = "xconn:deskconn:cloud:service:account"
+	accountServiceAuthID    = "deskconn-account-service"
+	accountServicePublicKey = "c98fb454dfda50be26b74818d3c20caf6810970b9de4a01fe5cd6282603400f1"
 )
 
 type Authenticator struct {
@@ -28,15 +33,13 @@ func NewAuthenticator(session *xconn.Session) *Authenticator {
 }
 
 func (a *Authenticator) Methods() []auth.Method {
-	return []auth.Method{auth.MethodAnonymous, auth.MethodCRA}
+	return []auth.Method{auth.MethodCRA, auth.MethodCryptoSign}
 }
 
 func (a *Authenticator) Authenticate(request auth.Request) (auth.Response, error) {
 	switch request.AuthMethod() {
-	case auth.Anonymous:
-		return auth.NewResponse(request.AuthID(), "anonymous", 0)
 	case auth.MethodCRA:
-		callResp := a.session.Call(ProcedureCRAVerify).Arg(request.AuthID()).Do()
+		callResp := a.session.Call(procedureCRAVerify).Arg(request.AuthID()).Do()
 		if callResp.Err != nil {
 			return nil, callResp.Err
 		}
@@ -62,6 +65,36 @@ func (a *Authenticator) Authenticate(request auth.Request) (auth.Response, error
 		keyLength := dict.Int64Or("key_length", 32)
 		return auth.NewCRAResponseSalted(request.AuthID(), authrole, secret, salt, int(iteration), int(keyLength), 0), nil
 
+	case auth.MethodCryptoSign:
+		cryptosignRequest, ok := request.(*auth.RequestCryptoSign)
+		if !ok {
+			return nil, fmt.Errorf("invalid request")
+		}
+		if cryptosignRequest.PublicKey() == accountServicePublicKey && cryptosignRequest.AuthID() == accountServiceAuthID {
+			return auth.NewResponse(cryptosignRequest.AuthID(), accountServiceAuthRole, 0)
+		}
+
+		callResp := a.session.Call(procedureCryptosignVerify).Args(request.AuthID(), cryptosignRequest.PublicKey()).Do()
+		if callResp.Err != nil {
+			return nil, callResp.Err
+		}
+
+		dict, err := callResp.ArgDict(0)
+		if err != nil {
+			return nil, err
+		}
+
+		authid, err := dict.String("authid")
+		if err != nil {
+			return nil, fmt.Errorf("failed to get authid for user(%s): %w", request.AuthID(), err)
+		}
+
+		authrole, err := dict.String("authrole")
+		if err != nil {
+			return nil, fmt.Errorf("failed to get authrole for user(%s): %w", request.AuthID(), err)
+		}
+
+		return auth.NewResponse(authid, authrole, 0)
 	default:
 		return nil, fmt.Errorf("unsupported authentication method: %v", request.AuthMethod())
 	}
@@ -77,12 +110,11 @@ func main() {
 		AutoDiscloseCaller: true,
 		Roles: []xconn.RealmRole{
 			{
-				Name: "anonymous",
+				Name: accountServiceAuthRole,
 				Permissions: []xconn.Permission{
 					{
-						URI:           "io.xconn.",
+						URI:           "io.xconn.deskconn.",
 						MatchPolicy:   "prefix",
-						AllowCall:     true,
 						AllowRegister: true,
 					},
 				},
@@ -91,7 +123,7 @@ func main() {
 				Name: "user",
 				Permissions: []xconn.Permission{
 					{
-						URI:           "io.xconn.deskconn.account.",
+						URI:           "io.xconn.deskconn.",
 						MatchPolicy:   "prefix",
 						AllowCall:     true,
 						AllowRegister: true,