KEZ is a portable, decentralized identity graph: a person signs claims
linking their many accounts, publishes those claims in places only the
claimed account can publish to, and anyone can verify the connections
without trusting a central server.
Layout
------
- SPEC.md Language-agnostic protocol spec (v0.2)
- rust/ Rust implementation: kez-core, kez-channels, kez-cli
- nodejs/ TypeScript port at full parity
- rust-sig-server/ Optional axum + SQLite storage server for sigchains
- crosstest.sh Cross-implementation interop harness
Capabilities (both implementations, byte-compatible)
----------------------------------------------------
- Two primary-key algorithms: nostr/secp256k1 Schnorr (BIP-340) and
Ed25519 (RFC 8032). Identifiers: nostr:npub1... and ed25519:<hex>.
- JCS (RFC 8785) canonicalization for everything signed.
- Four proof encodings: JSON envelope, compact (kez:z1:<base64url(zstd(json))>),
Markdown fence, DNS TXT.
- Five channel plugins (no API keys, no auth needed for any of them):
dns: system resolver, _kez.<domain> TXT records
github: public gist scan + <user>/<user> profile README fallback
nostr: kind-30078 events from default relays
bluesky: public AppView author feed
ap: WebFinger + actor JSON (alias mastodon:)
- Identical CLI surface:
kez identity new [--key-type nostr|ed25519]
kez claim create <subject> (--nsec | --ed25519-seed) [--format ...] [--out ...]
kez claim dns <domain> (--nsec | --ed25519-seed)
kez verify file <path>
kez verify id <identifier>
kez sigchain add|revoke|show|export|publish
- Sigchains: append-only signed log per primary, hash-chained per spec §6,
stored locally at ~/.kez/sigchains/, exportable as JSONL or kez:zc1: bundle.
- Sigchain publish destinations: chain server, web (file dump), DNS (zone
record print), nostr (kind-30078 wrapping event).
kez-sig-server
--------------
Optional storage tier. Axum + SQLite, single binary, no external deps.
- No auth — the cryptography is the access control. The server validates
every signature, every seq, every prev hash before storing.
- REST API: POST /v1/sigchains/{scheme}/{id}/events (append signed event,
201 with new head hash or 4xx); GET /{scheme}/{id} (full chain as JSONL);
GET /head; GET /healthz.
- Designed for one central instance for now; the design doesn't preclude
running more later (clients gain a configurable list, verifiers
reconcile per spec §6.2).
- Channel-based publishing remains the always-available fallback if the
server is unavailable.
Tests
-----
- rust/ 99 tests
- rust-sig-server/ 10 integration tests (real HTTP, real SQLite)
- nodejs/ 91 tests (vitest)
- crosstest.sh 19 cross-impl scenarios — proves JCS bytes,
Schnorr + Ed25519 sigs, all four claim encodings,
and the sigchain JSONL bundle are byte-compatible
between Rust and Node in both directions.
What's not done yet
-------------------
- verify id consulting the sigchain for revocations (data path exists,
just not wired into the verifier output).
- rotate and add_device sigchain ops (types reserved).
- expires_at enforcement during claim verification.
- Typed VerificationStatus.status reflecting the five failure modes.
- Auth-required publishers (GitHub gist, Bluesky, ActivityPub).
123 lines
4.4 KiB
Rust
123 lines
4.4 KiB
Rust
//! Integration tests for the Bluesky channel using `wiremock` as a stand-in
|
|
//! for `public.api.bsky.app`.
|
|
|
|
use chrono::Utc;
|
|
use kez_channels::bluesky::BlueskyChannel;
|
|
use kez_channels::{Channel, ChannelError};
|
|
use kez_core::{ClaimPayload, Identity, NostrSecret, SignedClaim};
|
|
use reqwest::Client;
|
|
use serde_json::json;
|
|
use wiremock::matchers::{method, path, query_param};
|
|
use wiremock::{Mock, MockServer, ResponseTemplate};
|
|
|
|
fn sign(subject: &str) -> SignedClaim {
|
|
let secret = NostrSecret::generate();
|
|
let primary = Identity::parse(format!("nostr:{}", secret.npub())).unwrap();
|
|
let subject = Identity::parse(subject).unwrap();
|
|
SignedClaim::sign(ClaimPayload::new(subject, primary, Utc::now()), &secret).unwrap()
|
|
}
|
|
|
|
fn channel_pointing_at(server: &MockServer) -> BlueskyChannel {
|
|
let client = Client::builder()
|
|
.user_agent("kez-channels-test/0.1")
|
|
.build()
|
|
.unwrap();
|
|
BlueskyChannel::with_base(client, server.uri())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn verifies_compact_proof_in_post_text() {
|
|
let server = MockServer::start().await;
|
|
let signed = sign("bluesky:jason.bsky.social");
|
|
let compact = signed.to_compact().unwrap();
|
|
|
|
Mock::given(method("GET"))
|
|
.and(path("/xrpc/app.bsky.feed.getAuthorFeed"))
|
|
.and(query_param("actor", "jason.bsky.social"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({
|
|
"feed": [
|
|
{ "post": { "record": { "text": "good morning" } } },
|
|
{ "post": { "record": { "text": compact } } }
|
|
]
|
|
})))
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let channel = channel_pointing_at(&server);
|
|
let identity = Identity::parse("bluesky:jason.bsky.social").unwrap();
|
|
let hit = channel.fetch_and_verify(&identity).await.unwrap();
|
|
assert_eq!(hit.proof, signed);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn verifies_markdown_fenced_proof_in_post() {
|
|
let server = MockServer::start().await;
|
|
let signed = sign("bluesky:jason.bsky.social");
|
|
let markdown = signed.to_markdown_proof().unwrap();
|
|
|
|
Mock::given(method("GET"))
|
|
.and(path("/xrpc/app.bsky.feed.getAuthorFeed"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({
|
|
"feed": [{ "post": { "record": { "text": markdown } } }]
|
|
})))
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let channel = channel_pointing_at(&server);
|
|
let identity = Identity::parse("bluesky:jason.bsky.social").unwrap();
|
|
let hit = channel.fetch_and_verify(&identity).await.unwrap();
|
|
assert_eq!(hit.proof, signed);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn rejects_proof_for_wrong_handle() {
|
|
let server = MockServer::start().await;
|
|
// Signed for mallory but posted on jason's feed.
|
|
let signed = sign("bluesky:mallory.bsky.social");
|
|
let compact = signed.to_compact().unwrap();
|
|
|
|
Mock::given(method("GET"))
|
|
.and(path("/xrpc/app.bsky.feed.getAuthorFeed"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({
|
|
"feed": [{ "post": { "record": { "text": compact } } }]
|
|
})))
|
|
.mount(&server)
|
|
.await;
|
|
|
|
let channel = channel_pointing_at(&server);
|
|
let identity = Identity::parse("bluesky:jason.bsky.social").unwrap();
|
|
let err = channel.fetch_and_verify(&identity).await.unwrap_err();
|
|
assert!(
|
|
matches!(err, ChannelError::SubjectMismatch { .. }),
|
|
"expected SubjectMismatch, got {err:?}"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn empty_feed_yields_not_found() {
|
|
let server = MockServer::start().await;
|
|
Mock::given(method("GET"))
|
|
.and(path("/xrpc/app.bsky.feed.getAuthorFeed"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({ "feed": [] })))
|
|
.mount(&server)
|
|
.await;
|
|
let channel = channel_pointing_at(&server);
|
|
let identity = Identity::parse("bluesky:jason.bsky.social").unwrap();
|
|
let err = channel.fetch_and_verify(&identity).await.unwrap_err();
|
|
assert!(matches!(err, ChannelError::NotFound(_)));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn appview_error_status_is_unreachable() {
|
|
let server = MockServer::start().await;
|
|
Mock::given(method("GET"))
|
|
.and(path("/xrpc/app.bsky.feed.getAuthorFeed"))
|
|
.respond_with(ResponseTemplate::new(503))
|
|
.mount(&server)
|
|
.await;
|
|
let channel = channel_pointing_at(&server);
|
|
let identity = Identity::parse("bluesky:jason.bsky.social").unwrap();
|
|
let err = channel.fetch_and_verify(&identity).await.unwrap_err();
|
|
assert!(matches!(err, ChannelError::Unreachable(_)));
|
|
}
|