lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

verify.rs (3083B)

      1 //! Explicit event identifier, signature, and contract verification stages.
      2 //!
      3 //! Each function consumes one typestate and returns the next. The API cannot
      4 //! silently skip identifier, signature, or contract validation.
      5 
      6 pub use radroots_event::admission::Error as VerificationError;
      7 pub use radroots_event::admission::{
      8     ContractValidatedEvent, IdVerifiedEvent, RawEvent, SignatureVerifiedEvent, SignatureVerifier,
      9 };
     10 
     11 // Preserve the mature verification profiles under the final verification
     12 // namespace while consumers move away from the superseded crate-root exports.
     13 pub use crate::verification::*;
     14 
     15 /// Deterministic BIP-340 verifier for canonical NIP-01 event envelopes.
     16 ///
     17 /// This capability performs cryptographic verification only. Contract
     18 /// validation, host admission, and visibility remain later explicit stages.
     19 #[derive(Clone, Copy, Debug, Default)]
     20 pub struct Nip01SignatureVerifier;
     21 
     22 impl SignatureVerifier for Nip01SignatureVerifier {
     23     fn verify_signature(
     24         &self,
     25         event: &radroots_event::envelope::EventEnvelope,
     26     ) -> Result<(), VerificationError> {
     27         let public_key = secp256k1::XOnlyPublicKey::from_slice(event.author().as_bytes())
     28             .map_err(|_| VerificationError::MalformedEnvelope)?;
     29         let signature = secp256k1::schnorr::Signature::from_slice(event.sig().as_bytes())
     30             .map_err(|_| VerificationError::MalformedEnvelope)?;
     31         let message = secp256k1::Message::from_digest(*event.id().as_bytes());
     32         secp256k1::Secp256k1::verification_only()
     33             .verify_schnorr(&signature, &message, &public_key)
     34             .map_err(|_| VerificationError::SignatureInvalid)
     35     }
     36 }
     37 
     38 /// Verifies that an event's declared identifier matches its canonical bytes.
     39 pub fn id(event: RawEvent) -> Result<IdVerifiedEvent, VerificationError> {
     40     event.verify_id()
     41 }
     42 
     43 /// Verifies an event signature using an explicit deterministic capability.
     44 ///
     45 /// ```no_run
     46 /// use radroots_event::admission::{Error, SignatureVerifier};
     47 /// use radroots_event::envelope::EventEnvelope;
     48 ///
     49 /// struct Verifier;
     50 ///
     51 /// impl SignatureVerifier for Verifier {
     52 ///     fn verify_signature(&self, _event: &EventEnvelope) -> Result<(), Error> {
     53 ///         Ok(())
     54 ///     }
     55 /// }
     56 ///
     57 /// # fn advance(
     58 /// #     event: radroots_event_codec::verify::IdVerifiedEvent,
     59 /// # ) -> Result<(), radroots_event_codec::VerificationError> {
     60 /// let signature_verified =
     61 ///     radroots_event_codec::verify::signature(event, &Verifier)?;
     62 /// let contract_validated =
     63 ///     radroots_event_codec::verify::contract(signature_verified)?;
     64 /// # let _ = contract_validated;
     65 /// # Ok(())
     66 /// # }
     67 /// ```
     68 pub fn signature<V>(
     69     event: IdVerifiedEvent,
     70     verifier: &V,
     71 ) -> Result<SignatureVerifiedEvent, VerificationError>
     72 where
     73     V: SignatureVerifier + ?Sized,
     74 {
     75     event.verify_signature(verifier)
     76 }
     77 
     78 /// Validates an already signature-verified event against the contract registry.
     79 pub fn contract(
     80     event: SignatureVerifiedEvent,
     81 ) -> Result<ContractValidatedEvent, VerificationError> {
     82     event.validate_contract()
     83 }