chadtmiller.com/knotless

Switch repository

Loading…

What changes

The second of the pulls moving knotless onto the atproto crate, after knotless takes its keys, JWTs, base32 and TIDs from the atproto crate. This one covers the parts that group-host shares or that decide who is asking. It leaves out the DRISL, CID, CAR and MST code, whose formats are settled.

Service auth. auth::verify reads, checks and verifies a service token with service_auth::{parts, check, verify}, and loopback tokens are checked the same way. signed_by takes the check to run, and tries the cached signing key first and then the freshly read one, as before.

Delegation tokens. auth::verify_delegation parses and verifies with space_auth as a Kind::Delegation token, so it now also requires the kid, jti and exp the alpha requires. Its own Delegation struct is gone: it returns the crate's Token, and viewer.rs reads iss and sub. A token for another space's authority is still refused before any DID document is fetched.

DID documents and handles. identity::{service, signing_key, kem_key, method_key, valid_handle} are gone. Their callers use atproto::did::{service, pds, signing_key, kem_key, handle} and atproto::syntax::is_handle. is_handle accepts exactly what valid_handle did: a last label may not start with a digit or -. verified_handle now takes the first at:// entry in alsoKnownAs, where it used to take whatever came first.

Space sync. space_sync's SetHash, DHKEM and HMAC derivation, commit MAC, MAC header parsing and STAR reader are gone. In their place are LtHash, element, encapsulate, Commit::mac, parse_mac_header and read_star. A commit sent in an oplog page is converted to the crate's Commit, which must be version 1 with a 32-byte digest. What stays in knotless is how a write moves the hash (apply, which now parses each CID), the check that the commit is the requested repo's in the requested space, and setting unreadable records aside.

Space requests. space::signed signs with space_auth::sign_request, and want_mac_from writes its header with want_mac_header. RECORD_MAC and COMMIT_MAC come from the crate. P256Key::keypair hands the crate the key.

Dependencies. bs58, blake3 and hmac are dropped from the workspace. k256 and p256 are now dev-dependencies of knotless, and knotless-serve depends on atproto directly.

Why

These were copies of what the crate already has, checked there against @atproto/space's and atproto's vectors. The spaces alpha is the part that still changes: its October build broke knotless's pushes and reads. With group-host on the same crate, the next change is made once.

How it was checked

The unit tests that only re-checked the crate's own behaviour (key lookup, handle syntax, the known DHKEM secret and MAC, STAR framing errors) are gone. The tests that stayed check what knotless itself does:

• writes moving the set hash;
• a commit from an oplog page being converted and vouched for the requested repo and space;
• unreadable records in a STAR archive being set aside;
• space request signatures verifying with space_auth::verify_request against the bound key and not against another;
• the delegation token's authority being checked before any lookup.

Nothing was built here; the compile, the tests and the spaces alpha runs are left to CI.

Shortcomings

• aturi::SpaceRef is still knotless's own. It is tied into AtUri with Hash and Ord, which the crate's SpaceRef lacks.
• Delegation tokens are now held to the crate's parse rules: they need a kid of #atproto, a jti and an exp. The alpha's PDS writes these, but a PDS that leaves one out would now be refused.
• read_star copies each record out of the archive rather than borrowing it. That happens only when a whole repo is read, which already decodes every record to JSON.

Changeset: none

This moves service auth, DID document lookups, handle syntax and the space-sync primitives (set hash, DHKEM, MACs, STAR) onto the atproto crate. It also drops the dependencies that went with them. I read all 20 files and found no logic fault in the swap.

• Delegation check: the authority check still runs before any DID lookup.
• Unsigned commit conversion: Sent::commit refuses a commit that isn't version 1 or whose data isn't 32 bytes.
• Vouching: is_vouched still checks the repo and space as well as the MAC.
• Set hash: apply now rejects an unparseable CID instead of hashing it.

The pull does not build yet. check fails on crates/knotless/src/auth.rs and test fails to compile knotless (lib test). a_delegation_token_names_its_type_and_the_spaces_authority still calls unsigned(...), which the diff deleted. Its base64::Engine, URL_SAFE_NO_PAD and Value imports are now unused too. The checks enforce both, so I'm not holding the pull for them. Restore the helper (or inline it) and drop the dead imports, then push so the seven checks can run.

One small note: the first assertion in that test is now only is_err(), so it no longer shows that a non-delegation typ is the reason for the refusal. That is minor, since the crate's parse checks it.

The one change since my approval restores the unsigned test helper in auth.rs. That fixes the compile error and the unused imports I raised last round. I found nothing else in it. The check, test and e2e runs were still going when I looked, so the build is unconfirmed until they finish. The small note about the first assertion being only is_err() still applies, but it is minor.