swap_pack.hpp

Go to the documentation of this file.

#pragma once

 
#include <pulp/runtime/crypto.hpp>
 
#include <choc/text/choc_JSON.h>
 
#include <cctype>
#include <cstdint>
#include <filesystem>
#include <fstream>
#include <optional>
#include <string>
#include <string_view>
#include <system_error>
#include <vector>
 
namespace pulp::format::reload {

enum class SwapPackKind { UiScript, DspGraph, NodePack, WasmDsp, Unknown };
 
inline SwapPackKind swap_pack_kind_from_string(std::string_view s) {
    if (s == "ui-script") return SwapPackKind::UiScript;
    if (s == "dsp-graph") return SwapPackKind::DspGraph;
    if (s == "node-pack") return SwapPackKind::NodePack;
    if (s == "wasm-dsp")  return SwapPackKind::WasmDsp;
    return SwapPackKind::Unknown;
}

inline const char* swap_pack_kind_to_string(SwapPackKind k) {
    switch (k) {
        case SwapPackKind::UiScript: return "ui-script";
        case SwapPackKind::DspGraph: return "dsp-graph";
        case SwapPackKind::NodePack: return "node-pack";
        case SwapPackKind::WasmDsp:  return "wasm-dsp";
        case SwapPackKind::Unknown:  break;
    }
    return "unknown";
}
 
struct SwapPackFile {
    std::string path;        
    std::string sha256_hex;  
    SwapPackKind kind = SwapPackKind::Unknown;
};
 
struct SwapPackManifest {
    std::string id;             
    std::string plugin_id;      
    int format_version = 1;
    std::vector<SwapPackFile> files;
    // Policy fields. These are covered by the signature (see swap_pack_signed_message)
    // so a CDN or installer cannot swap the declared capabilities, version, or kind
    // while keeping a valid signature — the manifest is the single sanctioned place
    // these are trusted from.
    std::uint64_t pack_version = 0;               
    SwapPackKind pack_type = SwapPackKind::Unknown; 
    std::vector<std::string> declared_capabilities; 
    std::string update_channel;                   
    int min_host_version = 0;                     
    std::vector<std::uint8_t> signer_public_key;  
    std::vector<std::uint8_t> signature;          
};
 
enum class SwapPackVerify {
    Ok = 0,
    ManifestParseError,   
    MissingFile,          
    ReadError,            
    HashMismatch,         
    UntrustedSigner,      
    BadSignature,         
};
 
struct SwapPackVerifyResult {
    SwapPackVerify status = SwapPackVerify::Ok;
    std::string detail;   
    bool ok() const { return status == SwapPackVerify::Ok; }
};

inline std::optional<std::vector<std::uint8_t>> swap_pack_hex_decode(std::string_view hex) {
    if (hex.size() % 2 != 0) return std::nullopt;
    auto nibble = [](char c) -> int {
        if (c >= '0' && c <= '9') return c - '0';
        if (c >= 'a' && c <= 'f') return c - 'a' + 10;
        if (c >= 'A' && c <= 'F') return c - 'A' + 10;
        return -1;
    };
    std::vector<std::uint8_t> out;
    out.reserve(hex.size() / 2);
    for (std::size_t i = 0; i < hex.size(); i += 2) {
        const int hi = nibble(hex[i]), lo = nibble(hex[i + 1]);
        if (hi < 0 || lo < 0) return std::nullopt;
        out.push_back(static_cast<std::uint8_t>((hi << 4) | lo));
    }
    return out;
}

inline std::optional<SwapPackManifest> parse_swap_pack_manifest(std::string_view json,
                                                                std::string& error) {
    SwapPackManifest m;
    try {
        auto v = choc::json::parse(std::string(json));
        if (!v.isObject()) { error = "manifest is not a JSON object"; return std::nullopt; }
        if (!v.hasObjectMember("id") || !v["id"].isString()) {
            error = "missing/invalid string 'id'"; return std::nullopt;
        }
        if (!v.hasObjectMember("plugin_id") || !v["plugin_id"].isString()) {
            error = "missing/invalid string 'plugin_id'"; return std::nullopt;
        }
        m.id = v["id"].getString();
        m.plugin_id = v["plugin_id"].getString();
        if (v.hasObjectMember("format_version") && v["format_version"].isInt())
            m.format_version = static_cast<int>(v["format_version"].getInt64());
        if (!v.hasObjectMember("files") || !v["files"].isArray()) {
            error = "missing/invalid array 'files'"; return std::nullopt;
        }
        const auto& files = v["files"];
        for (uint32_t i = 0; i < files.size(); ++i) {
            const auto& f = files[i];
            if (!f.isObject() || !f.hasObjectMember("path") || !f["path"].isString() ||
                !f.hasObjectMember("sha256") || !f["sha256"].isString()) {
                error = "files[" + std::to_string(i) + "] missing string 'path'/'sha256'";
                return std::nullopt;
            }
            SwapPackFile pf;
            pf.path = f["path"].getString();
            pf.sha256_hex = f["sha256"].getString();
            pf.kind = f.hasObjectMember("kind") && f["kind"].isString()
                          ? swap_pack_kind_from_string(f["kind"].getString())
                          : SwapPackKind::Unknown;
            m.files.push_back(std::move(pf));
        }
        // Policy fields. All optional with safe defaults so an older manifest still
        // parses; whatever is present is bound into the signed message below.
        if (v.hasObjectMember("pack_version") && v["pack_version"].isInt())
            m.pack_version = static_cast<std::uint64_t>(v["pack_version"].getInt64());
        if (v.hasObjectMember("pack_type") && v["pack_type"].isString())
            m.pack_type = swap_pack_kind_from_string(v["pack_type"].getString());
        if (v.hasObjectMember("update_channel") && v["update_channel"].isString())
            m.update_channel = v["update_channel"].getString();
        if (v.hasObjectMember("min_host_version") && v["min_host_version"].isInt())
            m.min_host_version = static_cast<int>(v["min_host_version"].getInt64());
        if (v.hasObjectMember("capabilities") && v["capabilities"].isArray()) {
            const auto& caps = v["capabilities"];
            for (uint32_t i = 0; i < caps.size(); ++i)
                if (caps[i].isString()) m.declared_capabilities.emplace_back(caps[i].getString());
        }
        // Optional signature fields (hex). Absent → unsigned manifest (empty
        // vectors); a malformed hex string is left empty so verification fails
        // closed rather than parsing to garbage bytes.
        if (v.hasObjectMember("signer") && v["signer"].isString()) {
            if (auto k = swap_pack_hex_decode(v["signer"].getString())) m.signer_public_key = std::move(*k);
        }
        if (v.hasObjectMember("signature") && v["signature"].isString()) {
            if (auto s = swap_pack_hex_decode(v["signature"].getString())) m.signature = std::move(*s);
        }
    } catch (const std::exception& e) {
        error = std::string("manifest JSON parse failed: ") + e.what();
        return std::nullopt;
    }
    return m;
}

inline SwapPackVerifyResult verify_swap_pack_integrity(const std::filesystem::path& root,
                                                       const SwapPackManifest& manifest) {
    auto to_lower = [](std::string s) {
        for (auto& c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
        return s;
    };
    for (const auto& f : manifest.files) {
        const auto full = root / f.path;
        std::error_code ec;
        if (!std::filesystem::exists(full, ec) || ec) {
            return {SwapPackVerify::MissingFile, f.path};
        }
        std::ifstream in(full, std::ios::binary);
        if (!in) return {SwapPackVerify::ReadError, f.path};
        std::vector<std::uint8_t> bytes((std::istreambuf_iterator<char>(in)),
                                        std::istreambuf_iterator<char>());
        if (in.bad()) return {SwapPackVerify::ReadError, f.path};
        const std::string actual = runtime::sha256_hex(bytes.data(), bytes.size());
        if (to_lower(actual) != to_lower(f.sha256_hex)) {
            return {SwapPackVerify::HashMismatch, f.path};
        }
    }
    return {SwapPackVerify::Ok, ""};
}

inline std::vector<std::uint8_t> swap_pack_signed_message(const SwapPackManifest& m) {
    std::vector<std::uint8_t> out;
    auto put_u32 = [&out](std::uint32_t n) {
        out.push_back(static_cast<std::uint8_t>(n & 0xFF));
        out.push_back(static_cast<std::uint8_t>((n >> 8) & 0xFF));
        out.push_back(static_cast<std::uint8_t>((n >> 16) & 0xFF));
        out.push_back(static_cast<std::uint8_t>((n >> 24) & 0xFF));
    };
    auto put_field = [&](std::string_view s) {
        put_u32(static_cast<std::uint32_t>(s.size()));
        out.insert(out.end(), s.begin(), s.end());
    };
    auto put_u64 = [&out](std::uint64_t n) {
        for (int i = 0; i < 8; ++i) out.push_back(static_cast<std::uint8_t>((n >> (8 * i)) & 0xFF));
    };
    // v2 binds the policy fields (version, kind, capabilities, channel, min-host)
    // into the signature so a CDN/installer cannot alter them while keeping a valid
    // signature. The tag bump also means a v1 signature can never verify as v2.
    put_field("pulp-swap-pack-v2");
    put_field(m.id);
    put_field(m.plugin_id);
    put_u32(static_cast<std::uint32_t>(m.format_version));
    put_u64(m.pack_version);
    put_field(swap_pack_kind_to_string(m.pack_type));
    put_field(m.update_channel);
    put_u32(static_cast<std::uint32_t>(m.min_host_version));
    put_u32(static_cast<std::uint32_t>(m.declared_capabilities.size()));  // bind the count
    for (const auto& c : m.declared_capabilities) put_field(c);
    put_u32(static_cast<std::uint32_t>(m.files.size()));   // bind the file count
    for (const auto& f : m.files) {
        put_field(f.path);
        put_field(f.sha256_hex);
        put_field(swap_pack_kind_to_string(f.kind));
    }
    return out;
}

inline SwapPackVerifyResult verify_swap_pack_signature(
    const SwapPackManifest& manifest,
    const std::vector<std::uint8_t>& trusted_public_key) {
    // Trust root: the signer key must be exactly the trusted key. (Key
    // distribution / a multi-key trust store is an owner-steer decision — see the
    // Phase-3 scoping note; this takes a single trusted key by value.)
    if (manifest.signer_public_key.size() != runtime::ed25519_public_key_size ||
        trusted_public_key.size() != runtime::ed25519_public_key_size ||
        manifest.signer_public_key != trusted_public_key) {
        return {SwapPackVerify::UntrustedSigner, "signer key is not the trusted key"};
    }
    if (manifest.signature.size() != runtime::ed25519_signature_size) {
        return {SwapPackVerify::BadSignature, "signature size invalid"};
    }
    const auto message = swap_pack_signed_message(manifest);
    if (!runtime::ed25519_verify(manifest.signer_public_key.data(),
                                 manifest.signer_public_key.size(),
                                 manifest.signature.data(), manifest.signature.size(),
                                 message.data(), message.size())) {
        return {SwapPackVerify::BadSignature, "Ed25519 verification failed"};
    }
    return {SwapPackVerify::Ok, ""};
}

inline SwapPackVerifyResult verify_swap_pack(
    const std::filesystem::path& root, const SwapPackManifest& manifest,
    const std::vector<std::uint8_t>& trusted_public_key) {
    auto sig = verify_swap_pack_signature(manifest, trusted_public_key);
    if (!sig.ok()) return sig;
    return verify_swap_pack_integrity(root, manifest);
}

inline std::string swap_pack_hex_encode(const std::vector<std::uint8_t>& bytes) {
    return runtime::hex_encode(bytes);
}

inline std::string swap_pack_json_escape(std::string_view s) {
    std::string out;
    out.reserve(s.size() + 2);
    for (char c : s) {
        switch (c) {
            case '"':  out += "\\\""; break;
            case '\\': out += "\\\\"; break;
            case '\n': out += "\\n";  break;
            case '\r': out += "\\r";  break;
            case '\t': out += "\\t";  break;
            default:
                if (static_cast<unsigned char>(c) < 0x20) {
                    static const char* d = "0123456789abcdef";
                    out += "\\u00";
                    out.push_back(d[(c >> 4) & 0xF]);
                    out.push_back(d[c & 0xF]);
                } else {
                    out.push_back(c);
                }
        }
    }
    return out;
}

inline std::string serialize_swap_pack_manifest(const SwapPackManifest& m) {
    auto q = [](std::string_view s) { return "\"" + swap_pack_json_escape(s) + "\""; };
    std::string j = "{\n";
    j += "  \"id\": " + q(m.id) + ",\n";
    j += "  \"plugin_id\": " + q(m.plugin_id) + ",\n";
    j += "  \"format_version\": " + std::to_string(m.format_version) + ",\n";
    j += "  \"pack_version\": " + std::to_string(m.pack_version) + ",\n";
    j += "  \"pack_type\": " + q(swap_pack_kind_to_string(m.pack_type)) + ",\n";
    j += "  \"update_channel\": " + q(m.update_channel) + ",\n";
    j += "  \"min_host_version\": " + std::to_string(m.min_host_version) + ",\n";
    j += "  \"capabilities\": [";
    for (std::size_t i = 0; i < m.declared_capabilities.size(); ++i)
        j += (i ? ", " : "") + q(m.declared_capabilities[i]);
    j += "],\n";
    j += "  \"files\": [\n";
    for (std::size_t i = 0; i < m.files.size(); ++i) {
        const auto& f = m.files[i];
        j += "    {\"path\": " + q(f.path) + ", \"sha256\": " + q(f.sha256_hex) +
             ", \"kind\": " + q(swap_pack_kind_to_string(f.kind)) + "}";
        j += (i + 1 < m.files.size()) ? ",\n" : "\n";
    }
    j += "  ]";
    if (!m.signer_public_key.empty())
        j += ",\n  \"signer\": " + q(swap_pack_hex_encode(m.signer_public_key));
    if (!m.signature.empty())
        j += ",\n  \"signature\": " + q(swap_pack_hex_encode(m.signature));
    j += "\n}\n";
    return j;
}
 
}  // namespace pulp::format::reload