Tudisco d0db6f00f1 Initial implementation of KEZ — protocol, two impls, and storage server
KEZ is a portable, decentralized identity graph: a person signs claims
linking their many accounts, publishes those claims in places only the
claimed account can publish to, and anyone can verify the connections
without trusting a central server.

Layout
------
- SPEC.md            Language-agnostic protocol spec (v0.2)
- rust/              Rust implementation: kez-core, kez-channels, kez-cli
- nodejs/            TypeScript port at full parity
- rust-sig-server/   Optional axum + SQLite storage server for sigchains
- crosstest.sh       Cross-implementation interop harness

Capabilities (both implementations, byte-compatible)
----------------------------------------------------
- Two primary-key algorithms: nostr/secp256k1 Schnorr (BIP-340) and
  Ed25519 (RFC 8032). Identifiers: nostr:npub1... and ed25519:<hex>.
- JCS (RFC 8785) canonicalization for everything signed.
- Four proof encodings: JSON envelope, compact (kez:z1:<base64url(zstd(json))>),
  Markdown fence, DNS TXT.
- Five channel plugins (no API keys, no auth needed for any of them):
    dns:        system resolver, _kez.<domain> TXT records
    github:     public gist scan + <user>/<user> profile README fallback
    nostr:      kind-30078 events from default relays
    bluesky:    public AppView author feed
    ap:         WebFinger + actor JSON (alias mastodon:)
- Identical CLI surface:
    kez identity new [--key-type nostr|ed25519]
    kez claim create <subject> (--nsec | --ed25519-seed) [--format ...] [--out ...]
    kez claim dns <domain>     (--nsec | --ed25519-seed)
    kez verify file <path>
    kez verify id <identifier>
    kez sigchain add|revoke|show|export|publish
- Sigchains: append-only signed log per primary, hash-chained per spec §6,
  stored locally at ~/.kez/sigchains/, exportable as JSONL or kez:zc1: bundle.
- Sigchain publish destinations: chain server, web (file dump), DNS (zone
  record print), nostr (kind-30078 wrapping event).

kez-sig-server
--------------
Optional storage tier. Axum + SQLite, single binary, no external deps.

- No auth — the cryptography is the access control. The server validates
  every signature, every seq, every prev hash before storing.
- REST API: POST /v1/sigchains/{scheme}/{id}/events (append signed event,
  201 with new head hash or 4xx); GET /{scheme}/{id} (full chain as JSONL);
  GET /head; GET /healthz.
- Designed for one central instance for now; the design doesn't preclude
  running more later (clients gain a configurable list, verifiers
  reconcile per spec §6.2).
- Channel-based publishing remains the always-available fallback if the
  server is unavailable.

Tests
-----
- rust/                 99 tests
- rust-sig-server/      10 integration tests (real HTTP, real SQLite)
- nodejs/               91 tests (vitest)
- crosstest.sh          19 cross-impl scenarios — proves JCS bytes,
                        Schnorr + Ed25519 sigs, all four claim encodings,
                        and the sigchain JSONL bundle are byte-compatible
                        between Rust and Node in both directions.

What's not done yet
-------------------
- verify id consulting the sigchain for revocations (data path exists,
  just not wired into the verifier output).
- rotate and add_device sigchain ops (types reserved).
- expires_at enforcement during claim verification.
- Typed VerificationStatus.status reflecting the five failure modes.
- Auth-required publishers (GitHub gist, Bluesky, ActivityPub).
2026-05-24 14:41:00 -06:00

112 lines
3.7 KiB
TypeScript

import { describe, expect, it } from "vitest";
import {
Identity,
NostrSecret,
newClaimPayload,
signClaim,
toCompact,
toMarkdown,
} from "@kez/core";
import {
BlueskyChannel,
authorFeedUrl,
extractPostTexts,
} from "../src/bluesky.js";
function sign(subject: string) {
const secret = NostrSecret.generate();
return signClaim(
newClaimPayload(Identity.parse(subject), secret.identity(), new Date()),
secret,
);
}
function fakeFetch(url: string, body: unknown, status = 200): typeof fetch {
return (async (input: string | URL) => {
if (input.toString() === url) {
return new Response(typeof body === "string" ? body : JSON.stringify(body), { status });
}
return new Response("", { status: 404 });
}) as unknown as typeof fetch;
}
const APPVIEW = "https://appview.test";
const FEED_URL = `${APPVIEW}/xrpc/app.bsky.feed.getAuthorFeed?actor=jason.bsky.social&limit=100`;
describe("BlueskyChannel", () => {
it("verifies compact proof in post text", async () => {
const signed = sign("bluesky:jason.bsky.social");
const fetch = fakeFetch(FEED_URL, {
feed: [
{ post: { record: { text: "good morning" } } },
{ post: { record: { text: toCompact(signed) } } },
],
});
const channel = new BlueskyChannel({ appviewBase: APPVIEW, fetch });
const hit = await channel.fetchAndVerify(Identity.parse("bluesky:jason.bsky.social"));
expect(hit.proof).toEqual(signed);
});
it("verifies markdown-fenced proof in post", async () => {
const signed = sign("bluesky:jason.bsky.social");
const fetch = fakeFetch(FEED_URL, {
feed: [{ post: { record: { text: toMarkdown(signed) } } }],
});
const channel = new BlueskyChannel({ appviewBase: APPVIEW, fetch });
const hit = await channel.fetchAndVerify(Identity.parse("bluesky:jason.bsky.social"));
expect(hit.proof).toEqual(signed);
});
it("rejects proof for wrong handle", async () => {
const signed = sign("bluesky:mallory.bsky.social");
const fetch = fakeFetch(FEED_URL, {
feed: [{ post: { record: { text: toCompact(signed) } } }],
});
const channel = new BlueskyChannel({ appviewBase: APPVIEW, fetch });
await expect(
channel.fetchAndVerify(Identity.parse("bluesky:jason.bsky.social")),
).rejects.toMatchObject({ kind: "SubjectMismatch" });
});
it("empty feed yields NotFound", async () => {
const fetch = fakeFetch(FEED_URL, { feed: [] });
const channel = new BlueskyChannel({ appviewBase: APPVIEW, fetch });
await expect(
channel.fetchAndVerify(Identity.parse("bluesky:jason.bsky.social")),
).rejects.toMatchObject({ kind: "NotFound" });
});
it("AppView 503 is Unreachable", async () => {
const fetch = fakeFetch(FEED_URL, "boom", 503);
const channel = new BlueskyChannel({ appviewBase: APPVIEW, fetch });
await expect(
channel.fetchAndVerify(Identity.parse("bluesky:jason.bsky.social")),
).rejects.toMatchObject({ kind: "Unreachable" });
});
});
describe("bluesky pure helpers", () => {
it("authorFeedUrl matches AppView contract", () => {
expect(authorFeedUrl("https://public.api.bsky.app", "jason.bsky.social")).toBe(
"https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed?actor=jason.bsky.social&limit=100",
);
});
it("extractPostTexts pulls text out of feed items", () => {
const body = {
feed: [
{ post: { record: { text: "hello" } } },
{ post: { record: { text: "kez:z1:abc" } } },
{ post: { record: {} } },
{ no_post: true },
],
};
expect(extractPostTexts(body)).toEqual(["hello", "kez:z1:abc"]);
});
it("extractPostTexts handles missing feed", () => {
expect(extractPostTexts({})).toEqual([]);
expect(extractPostTexts({ feed: "no" })).toEqual([]);
});
});