Merge branch 'feature/client-verify' into develop

Author: jagottsicher

client/verify/fetch.go

@@ -0,0 +1,89 @@
+// SPDX-FileCopyrightText: 2026 OpenWaymark contributors
+// SPDX-License-Identifier: Apache-2.0
+
+package verify
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+// Fetcher retrieves the body of a GET request.
+//
+// The same interface runs three ways with three different implementations:
+// HTTPFetcher (net/http, this file) for ordinary Go code and tests,
+// a fetch()-backed one in the WASM build, and a fake one in this package's
+// own tests. VerifySubject and httpTrustSource know nothing about how a byte
+// arrives, only that it did — the trusted-local-data/remote-claim split
+// gossip.Client already draws elsewhere in this project (OWM-9 A11).
+type Fetcher interface {
+	// Fetch retrieves url and returns the response body for a 2xx status.
+	// A non-2xx status is returned as *APIError, decoded from the node's own
+	// error body shape ({"error": "...", "detail": "..."}) where possible.
+	Fetch(ctx context.Context, url string) ([]byte, error)
+}
+
+// APIError reports a non-2xx response from a node's public API.
+type APIError struct {
+	StatusCode int
+	Code       string // the node's own machine-readable error code, e.g. "erased", "not_found"
+	Detail     string
+}
+
+func (e *APIError) Error() string {
+	if e.Detail != "" {
+		return fmt.Sprintf("owm/client/verify: %s (%d): %s", e.Code, e.StatusCode, e.Detail)
+	}
+	return fmt.Sprintf("owm/client/verify: %s (%d)", e.Code, e.StatusCode)
+}
+
+// Erased reports whether this error is the node reporting that an entry's
+// payload was lawfully erased under Art. 17 GDPR (HTTP 410, code "erased") —
+// the one non-2xx response callers are expected to handle specially rather
+// than treat as a failure.
+func (e *APIError) Erased() bool { return e.Code == "erased" }
+
+// HTTPFetcher is the default Fetcher, for ordinary (non-WASM) Go code: a CLI
+// verifier, tests, or any other caller that has a real net/http.Client.
+type HTTPFetcher struct {
+	Client *http.Client // nil means http.DefaultClient
+}
+
+func (f HTTPFetcher) httpClient() *http.Client {
+	if f.Client != nil {
+		return f.Client
+	}
+	return http.DefaultClient
+}
+
+func (f HTTPFetcher) Fetch(ctx context.Context, u string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
+	if err != nil {
+		return nil, fmt.Errorf("owm/client/verify: build request: %w", err)
+	}
+	resp, err := f.httpClient().Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("owm/client/verify: %s: %w", u, err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
+	if err != nil {
+		return nil, fmt.Errorf("owm/client/verify: %s: read body: %w", u, err)
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		ae := &APIError{StatusCode: resp.StatusCode}
+		var eb struct {
+			Error  string `json:"error"`
+			Detail string `json:"detail"`
+		}
+		if json.Unmarshal(body, &eb) == nil {
+			ae.Code, ae.Detail = eb.Error, eb.Detail
+		}
+		return nil, ae
+	}
+	return body, nil
+}

client/verify/trust.go

@@ -0,0 +1,113 @@
+// SPDX-FileCopyrightText: 2026 OpenWaymark contributors
+// SPDX-License-Identifier: Apache-2.0
+
+package verify
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"openwaymark.org/owm/core"
+	owmlog "openwaymark.org/owm/log"
+	"openwaymark.org/owm/trust"
+)
+
+// httpTrustSource implements trust.Source over the public API, mirroring
+// node/attestation.go's own logSource — same-issuer-only revocation
+// matching (OWM-6 §6), one history fetch per key — but fetching over HTTP
+// instead of reading the local log directly.
+//
+// Known scope limit, stated plainly rather than silently assumed away: every
+// fetch in a chain walk goes to the same base URL the top-level VerifySubject
+// call was given. An attestation chain that crosses node boundaries (an
+// accreditation body attesting an entity from a different node's log) is not
+// followed — the chain simply stops there, which trust.Compute treats as "no
+// further contribution," the same as a chain with no attestation at all.
+// Extending this to follow Options.LogURLs the way VerifySubject itself does
+// for parent references is future work, not solved here.
+//
+// Also unlike VerifySubject's own top-level entries, an attestation's own
+// signature and inclusion proof are not re-verified here — only its
+// commitment against its fetched payload. Re-verifying every hop of a trust
+// chain in full would mean fetching and checking an STH and inclusion proof
+// per attestation, not just per top-level entry; the commitment check alone
+// already rules out a payload that does not match what was actually
+// committed to, which is the failure mode a dishonest *node* (as opposed to
+// a dishonest attestation issuer, already covered by the signature check
+// baked into commitment-independent trust) could otherwise exploit.
+type httpTrustSource struct {
+	c *client
+}
+
+func (s *httpTrustSource) AttestationsOf(ctx context.Context, subject core.KeyID) ([]trust.Attestation, error) {
+	hist, err := s.c.fetchHistory(ctx, core.SubjectID(subject))
+	if err != nil {
+		return nil, err
+	}
+
+	type revocation struct {
+		target core.Digest
+		issuer core.KeyID
+	}
+	revoked := map[revocation]bool{}
+	type parsed struct {
+		id core.Digest
+		e  *core.Entry
+	}
+	var attestations []parsed
+	for _, lv := range hist.Entries {
+		leaf, err := owmlog.ParseLeaf(lv.Leaf)
+		if err != nil {
+			return nil, fmt.Errorf("owm/client/verify: trust source: parse leaf: %w", err)
+		}
+		se, err := leaf.SignedEntry()
+		if err != nil {
+			return nil, fmt.Errorf("owm/client/verify: trust source: parse entry: %w", err)
+		}
+		e, err := se.Entry()
+		if err != nil {
+			return nil, fmt.Errorf("owm/client/verify: trust source: decode entry: %w", err)
+		}
+		switch e.Type {
+		case core.EntryTypeAttestation:
+			attestations = append(attestations, parsed{id: leaf.EntryID(), e: e})
+		case core.EntryTypeRevocation:
+			if e.Target != nil {
+				revoked[revocation{target: e.Target.Entry, issuer: e.Issuer}] = true
+			}
+		}
+	}
+
+	out := make([]trust.Attestation, 0, len(attestations))
+	for _, a := range attestations {
+		salt, payload, err := s.c.fetchPayload(ctx, a.id)
+		if err != nil {
+			var ae *APIError
+			if errors.As(err, &ae) && ae.Erased() {
+				// The evidentiary basis is gone under Art. 17 GDPR; nothing
+				// left to recompute a level from — no contribution, the
+				// same as an attestation nobody issued (mirrors
+				// node/attestation.go's logSource exactly).
+				continue
+			}
+			return nil, err
+		}
+		if !core.VerifyCommitment(a.e.Commitment, salt, payload) {
+			return nil, fmt.Errorf("owm/client/verify: trust source: attestation %s: payload does not match its commitment", a.id)
+		}
+		p, err := trust.ParsePayload(payload)
+		if err != nil {
+			// A malformed payload cannot happen for an entry a compliant
+			// node accepted (checkAttestationPayload runs at Submit time),
+			// but this source must not assume every node is compliant.
+			continue
+		}
+		out = append(out, trust.Attestation{
+			Entry:   *a.e,
+			Payload: p,
+			Revoked: revoked[revocation{target: a.id, issuer: a.e.Issuer}],
+		})
+	}
+	return out, nil
+}