v3 : socle Rust (moteur pur, accès trustinWallet, serveur) ; maquette Nuxt rangée dans maquette/

- crates/ld-engine : formule inertielle (parité avec la maquette, garde C), coquille / changement de fond, assistant d'édition à règles, composition d'un document sous vote permanent (adoptions, aperçus, rivales). - crates/trustin-access : qui voit, qui ouvre, qui gère les accès. - crates/ld-server : API axum + SQLite, connexion Ğ1 (client OAuth2 de connect.monnaie-libre.fr), invitations, entrée en vigueur automatique, signalements de contradiction, traductions éditoriales, publication git, taille de la toile lue sur la chaîne. - seeds/acte-engagement-certification.json : 33 articles, fr + en + es ; en vigueur : préambule, E1, E2 (seed a minima). - maquette/ : frontend, backend et docker v2 déplacés tels quels. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-21 02:04:42 +02:00
parent 4b1732916d
commit 67ddee28b2
275 changed files with 8979 additions and 0 deletions
@@ -0,0 +1,256 @@
+"""Auth router: Ed25519 challenge-response authentication for Duniter V2 identities."""
+
+from __future__ import annotations
+
+import secrets
+from datetime import datetime, timedelta, timezone
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
+from sqlalchemy import or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database import get_db
+from app.models.user import DuniterIdentity
+from app.schemas.auth import (
+    ChallengeRequest,
+    ChallengeResponse,
+    IdentityOut,
+    TokenResponse,
+    VerifyRequest,
+)
+from app.services.auth_service import (
+    create_session,
+    get_current_identity,
+    get_or_create_identity,
+    invalidate_session,
+)
+
+router = APIRouter()
+
+# ── Dev profiles (only available when ENVIRONMENT == "development") ─────────
+DEV_PROFILES = [
+    {
+        "address": "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY",
+        "display_name": "Alice (Membre WoT)",
+        "wot_status": "member",
+        "is_smith": False,
+        "is_techcomm": False,
+    },
+    {
+        "address": "5FHneW46xGXgs5mUiveU4sbTyGBzmstUspZC92UhjJM694ty",
+        "display_name": "Bob (Forgeron)",
+        "wot_status": "member",
+        "is_smith": True,
+        "is_techcomm": False,
+    },
+    {
+        "address": "5FLSigC9HGRKVhB9FiEo4Y3koPsNmBmkP7j4bJa3zN7d8tY",
+        "display_name": "Charlie (Référent structure)",
+        "wot_status": "member",
+        "is_smith": True,
+        "is_techcomm": True,
+    },
+    {
+        "address": "5DAAnrj7VHTznn2AWBemMuyBwZWs6FNFjdyVXUeYum3PTXFy",
+        "display_name": "Dave (Auteur)",
+        "wot_status": "member",
+        "is_smith": False,
+        "is_techcomm": False,
+    },
+]
+
+# ── In-memory challenge store (short-lived, no persistence needed) ──────────
+# Structure: { address: { "challenge": str, "expires_at": datetime } }
+_pending_challenges: dict[str, dict] = {}
+
+
+def _cleanup_expired_challenges() -> None:
+    """Remove expired challenges from the in-memory store."""
+    now = datetime.now(timezone.utc)
+    expired = [addr for addr, data in _pending_challenges.items() if data["expires_at"] < now]
+    for addr in expired:
+        del _pending_challenges[addr]
+
+
+# ── Routes ──────────────────────────────────────────────────────────────────
+
+
+@router.post("/challenge", response_model=ChallengeResponse)
+async def request_challenge(payload: ChallengeRequest) -> ChallengeResponse:
+    """Generate a random Ed25519 challenge for the given Duniter address.
+
+    The client must sign this challenge with the private key corresponding
+    to the address, then submit it via POST /verify.
+    """
+    _cleanup_expired_challenges()
+
+    challenge = secrets.token_hex(32)
+    expires_at = datetime.now(timezone.utc) + timedelta(seconds=settings.CHALLENGE_EXPIRE_SECONDS)
+
+    _pending_challenges[payload.address] = {
+        "challenge": challenge,
+        "expires_at": expires_at,
+    }
+
+    return ChallengeResponse(challenge=challenge, expires_at=expires_at)
+
+
+@router.post("/verify", response_model=TokenResponse)
+async def verify_challenge(
+    payload: VerifyRequest,
+    db: AsyncSession = Depends(get_db),
+) -> TokenResponse:
+    """Verify the Ed25519 signature of a challenge and return a session token.
+
+    Steps:
+    1. Check that a pending challenge exists for the address.
+    2. Verify the challenge string matches.
+    3. Verify the Ed25519 signature against the address public key.
+    4. Create or retrieve the DuniterIdentity.
+    5. Create a session and return the bearer token.
+    """
+    # 1. Retrieve pending challenge
+    pending = _pending_challenges.get(payload.address)
+    if pending is None:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Aucun challenge en attente pour cette adresse",
+        )
+
+    # 2. Check expiry
+    if pending["expires_at"] < datetime.now(timezone.utc):
+        del _pending_challenges[payload.address]
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Challenge expire, veuillez en demander un nouveau",
+        )
+
+    # 3. Verify challenge string matches
+    if pending["challenge"] != payload.challenge:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Challenge invalide",
+        )
+
+    # 4. Verify signature
+    # TODO: trustWallet — déléguer la vérification au protocole trustWallet (librodrome)
+    # Quand trustWallet sera disponible : remplacer le bloc ci-dessous par une vérification
+    # du token signé fourni par trustWallet (JWT ou preuve Ed25519 via iframe postMessage).
+    # Le bypass DEMO_MODE sera alors supprimé.
+    _demo_addresses = {p["address"] for p in DEV_PROFILES}
+    is_demo_bypass = (settings.DEMO_MODE or settings.ENVIRONMENT == "development") and payload.address in _demo_addresses
+
+    if not is_demo_bypass:
+        # polkadot.js / Cesium2 signRaw(type='bytes') wraps: <Bytes>{challenge}</Bytes>
+        message = f"<Bytes>{payload.challenge}</Bytes>".encode("utf-8")
+        sig_hex = payload.signature.removeprefix("0x")
+        try:
+            sig_bytes = bytes.fromhex(sig_hex)
+        except ValueError:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Format de signature invalide (hex attendu)",
+            )
+
+        from substrateinterface import Keypair, KeypairType
+
+        verified = False
+        # Try Sr25519 first (default Substrate/Cesium2), then Ed25519 (Duniter v1 migration)
+        for key_type in [KeypairType.SR25519, KeypairType.ED25519]:
+            try:
+                kp = Keypair(ss58_address=payload.address, crypto_type=key_type)
+                if kp.verify(message, sig_bytes):
+                    verified = True
+                    break
+            except Exception:
+                continue
+
+        if not verified:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Signature invalide",
+            )
+
+    # 5. Consume the challenge
+    del _pending_challenges[payload.address]
+
+    # 6. Get or create identity (apply dev profile if available)
+    dev_profile = None
+    if settings.ENVIRONMENT == "development" or settings.DEMO_MODE:
+        dev_profile = next((p for p in DEV_PROFILES if p["address"] == payload.address), None)
+    identity = await get_or_create_identity(db, payload.address, dev_profile=dev_profile)
+
+    # 7. Create session token
+    token = await create_session(db, identity)
+
+    return TokenResponse(
+        token=token,
+        identity=IdentityOut.model_validate(identity),
+    )
+
+
+@router.get("/dev/profiles")
+async def list_dev_profiles():
+    """List available demo profiles for quick login. Available in development or demo mode."""
+    if settings.ENVIRONMENT != "development" and not settings.DEMO_MODE:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not available")
+    return DEV_PROFILES
+
+
+@router.get("/me", response_model=IdentityOut)
+async def get_me(
+    identity: DuniterIdentity = Depends(get_current_identity),
+) -> IdentityOut:
+    """Return the currently authenticated identity."""
+    return IdentityOut.model_validate(identity)
+
+
+@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT, response_class=Response, response_model=None)
+async def logout(
+    db: AsyncSession = Depends(get_db),
+    identity: DuniterIdentity = Depends(get_current_identity),
+):
+    """Invalidate the current session token.
+
+    Note: get_current_identity already validated the token, so we know it exists.
+    We re-extract it from the Authorization header to invalidate it.
+    """
+    # We need the raw token to invalidate -- re-extract from the dependency chain.
+    # Since get_current_identity already validated, we know the request has a valid Bearer token.
+    # We use a slightly different approach: delete all sessions for this identity
+    # that match. For a cleaner approach, we accept the token via a dedicated dependency.
+    from fastapi import Request
+
+    # This is handled by getting the token from the auth service
+    # For simplicity, we delete all sessions for the identity
+    from sqlalchemy import select
+
+    from app.models.user import Session
+
+    result = await db.execute(select(Session).where(Session.identity_id == identity.id))
+    sessions = result.scalars().all()
+    for session in sessions:
+        await db.delete(session)
+    await db.commit()
+
+
+@router.get("/identities", response_model=list[IdentityOut])
+async def search_identities(
+    q: str = Query(..., min_length=1, description="Recherche par adresse ou nom"),
+    limit: int = Query(default=10, ge=1, le=50),
+    db: AsyncSession = Depends(get_db),
+) -> list[IdentityOut]:
+    """Search Duniter identities by address prefix or display_name."""
+    result = await db.execute(
+        select(DuniterIdentity)
+        .where(
+            or_(
+                DuniterIdentity.address.ilike(f"{q}%"),
+                DuniterIdentity.display_name.ilike(f"%{q}%"),
+            )
+        )
+        .order_by(DuniterIdentity.display_name)
+        .limit(limit)
+    )
+    return [IdentityOut.model_validate(i) for i in result.scalars().all()]