mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
82bd565201
Adds the topology contract that lets a fund run mpcd as its own private
cluster — no Lux primary network registration, no shared M-Chain audit
ledger — using the same code path and the same operator surface.
Mode flag at cmd/mpcd/main.go:
--network=primary|private # registration target
--audit-store=mchain|local-worm|... # audit log destination
--registrar-url, --registrar-auth # primary-mode announcement
--audit-worm-path, --audit-mchain-url # backend selectors
pkg/audit:
- Append-only Merkle hash chain. Tampering with any historical event
invalidates every subsequent hash. Canonical bytes use fixed-order
concatenation (json.Marshal map ordering is non-deterministic).
- WORMDispatcher: NDJSON append, replay-on-start, fsync per Append.
- MChainDispatcher: batched POST of (batchHash, fromSeq, toSeq) to a
configurable anchor RPC.
- compositeDispatcher: fan-out to multiple legs with per-leg sealing.
- S3 Glacier Vault / Azure Immutable / GCS Object Lock dispatchers
fail closed — wired into the flag surface but gated behind the
cloud-audit build tag, no silent fallback.
pkg/identity/bootstrap.go: identity creation + (primary-mode only)
registrar announcement. Same on-disk format as the previous
loadOrGenerateIdentity (which is now removed); private mode is silent.
deployments/k8s-private: fund-only Kustomize overlay. Standalone
namespace, NetworkPolicy that blocks egress to anything outside the
fund's VPC, hardware-WORM PVC for the audit log, KMS-driven secret
template.
deployments/k8s-primary: env-var patch overlay on the existing lux-mpc
base. composite(local-worm,mchain) by default.
deployments/terraform/{aws,gcp,azure}: VPC + audit storage modules.
terraform validate passes; EKS/GKE/AKS + HSM modules are stubbed and
not yet plan-tested.
deployments/onprem/README.md: WORM storage + PKCS#11 HSM checklist.
Tests (14 total, all passing):
pkg/audit: 6/6 (chain, WORM replay, MChain batching, composite,
cloud stubs fail loud, double-seal rejected)
pkg/identity: 4/4 (private no-call, primary call, primary empty
URL no-op, primary registrar 503 surfaces)
internal/privatemode: 4/4 (no registrar traffic, restart, tamper-detect,
cloud stubs fail loud)
Companion runbook in lux/papers/lux-private-mpc-deployment/
(LaTeX, 5 pages, tectonic-clean).
161 lines
4.3 KiB
Go
161 lines
4.3 KiB
Go
package approval
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// withDevEnv ensures local-dev provider is permitted during this test.
|
|
// Restores prior env on cleanup.
|
|
func withDevEnv(t *testing.T) {
|
|
t.Helper()
|
|
prevEnv := os.Getenv("MPC_ENV")
|
|
prevFlag := os.Getenv("MPC_LOCAL_APPROVAL")
|
|
t.Cleanup(func() {
|
|
os.Setenv("MPC_ENV", prevEnv)
|
|
os.Setenv("MPC_LOCAL_APPROVAL", prevFlag)
|
|
})
|
|
os.Setenv("MPC_ENV", "test")
|
|
os.Setenv("MPC_LOCAL_APPROVAL", "true")
|
|
}
|
|
|
|
func TestLocalDev_ProviderName(t *testing.T) {
|
|
withDevEnv(t)
|
|
p, err := NewLocalDev(nil)
|
|
if err != nil {
|
|
t.Fatalf("NewLocalDev: %v", err)
|
|
}
|
|
if got, want := p.Provider(), "local-dev"; got != want {
|
|
t.Fatalf("Provider() = %q, want %q", got, want)
|
|
}
|
|
}
|
|
|
|
func TestLocalDev_Identity_Roundtrip(t *testing.T) {
|
|
withDevEnv(t)
|
|
p, err := NewLocalDev(nil)
|
|
if err != nil {
|
|
t.Fatalf("NewLocalDev: %v", err)
|
|
}
|
|
id, err := p.GetPublicIdentity(context.Background(), "alice")
|
|
if err != nil {
|
|
t.Fatalf("GetPublicIdentity: %v", err)
|
|
}
|
|
if id.ApproverID != "alice" {
|
|
t.Fatalf("ApproverID = %q, want alice", id.ApproverID)
|
|
}
|
|
if id.Algorithm != AlgorithmEd25519 {
|
|
t.Fatalf("Algorithm = %q, want %q", id.Algorithm, AlgorithmEd25519)
|
|
}
|
|
if len(id.PublicKey) != ed25519.PublicKeySize {
|
|
t.Fatalf("public key size = %d, want %d", len(id.PublicKey), ed25519.PublicKeySize)
|
|
}
|
|
}
|
|
|
|
func TestLocalDev_ApproveAndVerify(t *testing.T) {
|
|
withDevEnv(t)
|
|
p, err := NewLocalDev(nil)
|
|
if err != nil {
|
|
t.Fatalf("NewLocalDev: %v", err)
|
|
}
|
|
intent := newTestIntent("transfer 10 LUX to alice")
|
|
sig, err := p.ApproveIntent(context.Background(), "alice", intent)
|
|
if err != nil {
|
|
t.Fatalf("ApproveIntent: %v", err)
|
|
}
|
|
if sig.ApproverID != "alice" {
|
|
t.Fatalf("ApproverID = %q, want alice", sig.ApproverID)
|
|
}
|
|
if sig.IntentDigest != intent.Digest() {
|
|
t.Fatal("IntentDigest mismatch")
|
|
}
|
|
if sig.Provider != "local-dev" {
|
|
t.Fatalf("Provider = %q, want local-dev", sig.Provider)
|
|
}
|
|
if sig.Algorithm != AlgorithmEd25519 {
|
|
t.Fatalf("Algorithm = %q, want %q", sig.Algorithm, AlgorithmEd25519)
|
|
}
|
|
|
|
ok, err := p.VerifyApproval(context.Background(), intent, sig)
|
|
if err != nil {
|
|
t.Fatalf("VerifyApproval: %v", err)
|
|
}
|
|
if !ok {
|
|
t.Fatal("VerifyApproval = false, want true")
|
|
}
|
|
|
|
// Tamper with the intent — verification must fail.
|
|
tampered := newTestIntent("transfer 1000000 LUX to attacker")
|
|
ok, err = p.VerifyApproval(context.Background(), tampered, sig)
|
|
if err != nil {
|
|
t.Fatalf("VerifyApproval (tampered): %v", err)
|
|
}
|
|
if ok {
|
|
t.Fatal("VerifyApproval(tampered) = true, want false")
|
|
}
|
|
}
|
|
|
|
func TestLocalDev_RefusesProduction(t *testing.T) {
|
|
prevEnv := os.Getenv("MPC_ENV")
|
|
prevFlag := os.Getenv("MPC_LOCAL_APPROVAL")
|
|
t.Cleanup(func() {
|
|
os.Setenv("MPC_ENV", prevEnv)
|
|
os.Setenv("MPC_LOCAL_APPROVAL", prevFlag)
|
|
})
|
|
os.Setenv("MPC_ENV", "production")
|
|
os.Setenv("MPC_LOCAL_APPROVAL", "")
|
|
|
|
if _, err := NewProvider("local-dev", nil); err == nil {
|
|
t.Fatal("NewProvider(local-dev) in production: want error, got nil")
|
|
} else if !strings.Contains(err.Error(), "forbidden in production") {
|
|
t.Fatalf("error %q does not mention forbidden in production", err)
|
|
}
|
|
}
|
|
|
|
func TestLocalDev_Enroll_DeterministicKey(t *testing.T) {
|
|
withDevEnv(t)
|
|
provider, err := NewLocalDev(nil)
|
|
if err != nil {
|
|
t.Fatalf("NewLocalDev: %v", err)
|
|
}
|
|
dev := provider.(*LocalDevProvider)
|
|
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
dev.Enroll("alice", priv)
|
|
id, err := dev.GetPublicIdentity(context.Background(), "alice")
|
|
if err != nil {
|
|
t.Fatalf("GetPublicIdentity: %v", err)
|
|
}
|
|
if string(id.PublicKey) != string(pub) {
|
|
t.Fatal("enrolled public key did not round-trip")
|
|
}
|
|
}
|
|
|
|
func TestLocalDev_CrossProviderIsolation(t *testing.T) {
|
|
// A signature claiming provider=mldsa must NOT verify against local-dev.
|
|
withDevEnv(t)
|
|
p, err := NewLocalDev(nil)
|
|
if err != nil {
|
|
t.Fatalf("NewLocalDev: %v", err)
|
|
}
|
|
intent := newTestIntent("cross-provider check")
|
|
sig, err := p.ApproveIntent(context.Background(), "alice", intent)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Mutate provider claim
|
|
sig.Provider = "mldsa"
|
|
ok, err := p.VerifyApproval(context.Background(), intent, sig)
|
|
if err != nil {
|
|
t.Fatalf("VerifyApproval: %v", err)
|
|
}
|
|
if ok {
|
|
t.Fatal("VerifyApproval accepted signature with wrong provider claim")
|
|
}
|
|
}
|