feat(moonapi): EdDSA (Ed25519) JWT verification.

Completes the jose signature set — HS256, RS256, ES256, and now EdDSA. ed25519.mbt
transcribes Edwards25519 on core BigInt and the module's own SHA-512: point
decompression by the p ≡ 5 (mod 8) square root, the complete twisted-Edwards
addition law, scalar multiplication, and the RFC 8032 §5.1.7 check
[S]B = R + [k]A. jwt_verify_eddsa (RFC 8037) wraps it and refuses an alg downgrade.

Verified against the RFC 8032 §7.1 test vectors (TEST 1 and TEST 3) and a real
EdDSA JWT; a self-consistency test recomputes p and d independently of their
hardcoded hex, which caught a transcription typo during development. Passes on
wasm, wasm-gc, js, and native.

Signed-off-by: 林晨 (Leo Cheng) <chengkelfan@qq.com>

Author: Lfan-ke

ed25519.mbt

@@ -0,0 +1,209 @@
+///|
+/// Edwards25519 curve parameters as big integers (RFC 8032). `p = 2^255 - 19` is
+/// the field prime, `d` the curve coefficient, `l` the group order, `sqrt_m1` a
+/// square root of -1 (for point decompression, since `p ≡ 5 (mod 8)`), and
+/// `(bx, by)` the base point. Core's `BigInt` supplies the arithmetic; the values
+/// were computed from the definition, not transcribed.
+let ed_p : BigInt = BigInt::from_string(
+  "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED",
+  radix=16,
+)
+
+///|
+let ed_d : BigInt = BigInt::from_string(
+  "52036CEE2B6FFE738CC740797779E89800700A4D4141D8AB75EB4DCA135978A3",
+  radix=16,
+)
+
+///|
+let ed_l : BigInt = BigInt::from_string(
+  "1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED",
+  radix=16,
+)
+
+///|
+let ed_sqrt_m1 : BigInt = BigInt::from_string(
+  "2B8324804FC1DF0B2B4D00993DFBD7A72F431806AD2FE478C4EE1B274A0EA0B0",
+  radix=16,
+)
+
+///|
+let ed_bx : BigInt = BigInt::from_string(
+  "216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A",
+  radix=16,
+)
+
+///|
+let ed_by : BigInt = BigInt::from_string(
+  "6666666666666666666666666666666666666666666666666666666666666658",
+  radix=16,
+)
+
+///|
+/// 2^255, for masking off a compressed point's sign bit.
+let ed_2_255 : BigInt = BigInt::from_string(
+  "8000000000000000000000000000000000000000000000000000000000000000",
+  radix=16,
+)
+
+///|
+/// A point on Edwards25519 in affine coordinates. The addition law is complete
+/// (identity `(0, 1)`, no special cases), so no infinity flag is needed.
+priv struct EdPoint {
+  x : BigInt
+  y : BigInt
+}
+
+///|
+/// Reduce mod the field prime, normalised to `[0, p)`.
+fn edmod(a : BigInt) -> BigInt {
+  let m = a % ed_p
+  if m < (0 : BigInt) {
+    m + ed_p
+  } else {
+    m
+  }
+}
+
+///|
+/// Reduce mod the group order, normalised to `[0, l)`.
+fn edmod_l(a : BigInt) -> BigInt {
+  let m = a % ed_l
+  if m < (0 : BigInt) {
+    m + ed_l
+  } else {
+    m
+  }
+}
+
+///|
+/// Field inverse (Fermat: a^(p-2) mod p).
+fn edinv(a : BigInt) -> BigInt {
+  edmod(a).pow(ed_p - 2, modulus=ed_p)
+}
+
+///|
+/// Recover the `x` coordinate from `y` on Edwards25519: `x² = (y²-1)/(d·y²+1)`,
+/// with the `p ≡ 5 (mod 8)` square root and the even root chosen.
+fn ed_xrecover(y : BigInt) -> BigInt {
+  let yy = edmod(y * y)
+  let xx = edmod((yy - 1) * edinv(edmod(ed_d * yy + 1)))
+  let mut x = xx.pow((ed_p + 3) / 8, modulus=ed_p)
+  if edmod(x * x - xx) != (0 : BigInt) {
+    x = edmod(x * ed_sqrt_m1)
+  }
+  if x % 2 != (0 : BigInt) {
+    x = ed_p - x
+  }
+  x
+}
+
+///|
+/// Edwards25519 point addition (complete twisted-Edwards law, a = -1).
+fn ed_add(pp : EdPoint, qq : EdPoint) -> EdPoint {
+  let x1 = pp.x
+  let y1 = pp.y
+  let x2 = qq.x
+  let y2 = qq.y
+  let dxy = edmod(ed_d * x1 * x2 * y1 * y2)
+  let x3 = edmod((x1 * y2 + x2 * y1) * edinv(edmod(1 + dxy)))
+  let y3 = edmod((y1 * y2 + x1 * x2) * edinv(edmod(1 - dxy)))
+  { x: x3, y: y3 }
+}
+
+///|
+/// Scalar multiplication `e · pt` by double-and-add.
+fn ed_mul(e : BigInt, pt : EdPoint) -> EdPoint {
+  let mut result : EdPoint = { x: 0, y: 1 }
+  let mut addend = pt
+  let mut k = e
+  while k > (0 : BigInt) {
+    if k % 2 == (1 : BigInt) {
+      result = ed_add(result, addend)
+    }
+    addend = ed_add(addend, addend)
+    k = k / 2
+  }
+  result
+}
+
+///|
+/// Interpret `b` as a little-endian unsigned integer (Ed25519's byte order).
+fn ed_le_int(b : BytesView) -> BigInt {
+  let buf = Buffer()
+  for i = b.length() - 1; i >= 0; i = i - 1 {
+    buf.write_byte(b[i])
+  }
+  BigInt::from_octets(buf.to_bytes()[:])
+}
+
+///|
+/// Decompress a 32-byte little-endian Edwards25519 point: `y` is the low 255
+/// bits, and the top bit selects the sign (parity) of `x`.
+fn ed_decode_point(s : BytesView) -> EdPoint {
+  let y = ed_le_int(s) % ed_2_255
+  let mut x = ed_xrecover(y)
+  let sign = (s[31].to_int() >> 7) & 1
+  let parity = if x % 2 == (1 : BigInt) { 1 } else { 0 }
+  if parity != sign {
+    x = ed_p - x
+  }
+  { x, y }
+}
+
+///|
+/// Ed25519 signature verification (RFC 8032 §5.1.7). `sig` is the 64-byte
+/// `R || S`, `pub_key` the 32-byte compressed public point. Checks `[S]B = R +
+/// [k]A` with `k = SHA-512(R || A || M) mod l`.
+pub fn ed25519_verify(pub_key : Bytes, msg : Bytes, sig : Bytes) -> Bool {
+  if pub_key.length() != 32 || sig.length() != 64 {
+    return false
+  }
+  let a_pt = ed_decode_point(pub_key[:])
+  let r_pt = ed_decode_point(sig[0:32])
+  let s = ed_le_int(sig[32:64])
+  if s >= ed_l {
+    return false
+  }
+  let hbuf = Buffer()
+  hbuf.write_bytes(sig[0:32])
+  hbuf.write_bytes(pub_key[:])
+  hbuf.write_bytes(msg[:])
+  let k = edmod_l(ed_le_int(sha512(hbuf.to_bytes())[:]))
+  let lhs = ed_mul(s, { x: ed_bx, y: ed_by })
+  let rhs = ed_add(r_pt, ed_mul(k, a_pt))
+  lhs.x == rhs.x && lhs.y == rhs.y
+}
+
+///|
+/// An Ed25519 (EdDSA) public key: the 32-byte compressed point. The verification
+/// key for the JWT `EdDSA` algorithm (RFC 8037).
+pub(all) struct Ed25519PublicKey {
+  key : Bytes
+}
+
+///|
+/// Build an Ed25519 public key from its 32-byte hex encoding.
+pub fn Ed25519PublicKey::from_hex(hex : String) -> Ed25519PublicKey {
+  let buf = Buffer()
+  for i = 0; i < hex.length(); i = i + 2 {
+    let hi = hex_nibble(hex[i].to_int())
+    let lo = hex_nibble(hex[i + 1].to_int())
+    buf.write_byte(((hi << 4) | lo).to_byte())
+  }
+  { key: buf.to_bytes() }
+}
+
+///|
+/// A single hex digit's value, from its character code.
+fn hex_nibble(v : Int) -> Int {
+  if v >= 0x30 && v <= 0x39 {
+    v - 0x30
+  } else if v >= 0x61 && v <= 0x66 {
+    v - 0x61 + 10
+  } else if v >= 0x41 && v <= 0x46 {
+    v - 0x41 + 10
+  } else {
+    0
+  }
+}

ed25519_wbtest.mbt

@@ -0,0 +1,76 @@
+///|
+/// Decode a hex string to bytes.
+fn hexb(h : String) -> Bytes {
+  let buf = Buffer()
+  for i = 0; i < h.length(); i = i + 2 {
+    let hi = hex_nibble(h[i].to_int())
+    let lo = hex_nibble(h[i + 1].to_int())
+    buf.write_byte(((hi << 4) | lo).to_byte())
+  }
+  buf.to_bytes()
+}
+
+///|
+test "Ed25519 curve constants are self-consistent" {
+  // p = 2^255 - 19, and d = -121665 / 121666 mod p — cross-checked independently
+  // of their hardcoded hex, so a transcription typo cannot slip through.
+  assert_true(ed_p == ed_2_255 - 19)
+  assert_true(ed_d == edmod((ed_p - 121665) * edinv(121666)))
+}
+
+///|
+test "Ed25519 verifies the RFC 8032 test vectors" {
+  // TEST 1: empty message.
+  assert_true(
+    ed25519_verify(
+      hexb("d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"),
+      b"",
+      hexb(
+        "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b",
+      ),
+    ),
+  )
+  // TEST 3: message 0xaf82.
+  assert_true(
+    ed25519_verify(
+      hexb("fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025"),
+      b"\xaf\x82",
+      hexb(
+        "6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a",
+      ),
+    ),
+  )
+  // Tamper the message -> reject.
+  assert_false(
+    ed25519_verify(
+      hexb("d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"),
+      b"x",
+      hexb(
+        "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b",
+      ),
+    ),
+  )
+}
+
+///|
+test "jwt_verify_eddsa accepts an Ed25519 token and refuses an alg downgrade" {
+  let key = Ed25519PublicKey::from_hex(
+    "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
+  )
+  // A real EdDSA JWT signed with the matching Ed25519 key (payload {"sub":"42"}).
+  let token = "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MiJ9.EitmEz7OHUvbI6btyx4HMZTnXX3mAHUohPlaegodtCruZXtWibfaE8DZTEI8Txubf5SgAiM6JxBSkmY1evpsBw"
+  let claims = jwt_verify_eddsa(token, key, 0) catch {
+    _ => fail("jwt_verify_eddsa unexpectedly raised")
+  }
+  assert_eq(claims.get("sub"), Some("42".to_json()))
+  // An HS256 token is refused by the EdDSA verifier.
+  let hs = jwt_sign(Map([("sub", "1".to_json())]), "secret")
+  let refused = try {
+    jwt_verify_eddsa(hs, key, 0) |> ignore
+    false
+  } catch {
+    UnsupportedAlg(_) => true
+    _ => false
+  }
+  assert_true(refused)
+}

jwt.mbt

@@ -314,6 +314,50 @@ pub fn jwt_sign_es256(
   header_seg + "." + payload_seg + "." + base64url_encode(sig)
 }
 
+///|
+/// Read the header segment's `alg`, raising `UnsupportedAlg` for anything but
+/// `EdDSA` — the EdDSA counterpart of `check_alg`, refusing an `alg` downgrade.
+fn check_alg_eddsa(header_seg : String) -> Unit raise JwtError {
+  let text = @utf8.decode_lossy(base64url_decode(header_seg)[:])
+  let json = @json.parse(text) catch {
+    _ => raise MalformedToken("header is not valid JSON")
+  }
+  match json {
+    Object(m) =>
+      match m.get("alg") {
+        Some(String("EdDSA")) => ()
+        Some(String(other)) => raise UnsupportedAlg(other)
+        _ => raise UnsupportedAlg("missing alg")
+      }
+    _ => raise MalformedToken("header is not a JSON object")
+  }
+}
+
+///|
+/// Verify a compact EdDSA (Ed25519) JWT and return its claims (RFC 8037). Checks
+/// three segments; the header `alg` is `EdDSA`; the Ed25519 signature verifies
+/// against `key`; and the `exp` / `nbf` time claims. Raises the matching
+/// `JwtError`; a tampered payload or signature fails at `BadSignature`.
+pub fn jwt_verify_eddsa(
+  token : String,
+  key : Ed25519PublicKey,
+  now_secs : Int64,
+) -> Map[String, Json] raise JwtError {
+  let parts = split_char(token, '.')
+  if parts.length() != 3 {
+    raise MalformedToken("expected three segments")
+  }
+  let header_seg = parts[0]
+  let payload_seg = parts[1]
+  let sig_seg = parts[2]
+  check_alg_eddsa(header_seg)
+  let sig = base64url_decode(sig_seg)
+  if !ed25519_verify(key.key, jwt_signing_input(header_seg, payload_seg), sig) {
+    raise BadSignature
+  }
+  parse_and_check_claims(payload_seg, now_secs)
+}
+
 ///|
 /// Read a `NumericDate` claim as seconds. RFC 7519 says it's a JSON number, but
 /// tokens in the wild sometimes carry it as a numeric string, so both are