feat(ra/tl): add web bot auth identity - #103
Draft
jhateley-godaddy wants to merge 6 commits into
Draft
Conversation
Recognize an https:// Signature-Agent URL as the new web-bot-auth identifier kind. InferIdentifierKind canonicalizes a bare origin to the well-known directory URL. It rejects any other path with WBA_URL_INVALID. It lowercases the host and bounds the URL to 2048 characters. proofMethodForKind maps the kind to web-bot-auth-sig. Implements SPEC T1 (invariant V1). Signed-off-by: James Hateley <jhateley@godaddy.com>
JWKThumbprint returns the base64url SHA-256 thumbprint over the canonical OKP/Ed25519 JWK members. web-bot-auth uses it as the JWS kid and to locate the endorsing key in the resolved directory. The function rejects non-OKP key types. Implements SPEC T2 (invariant V4). Signed-off-by: James Hateley <jhateley@godaddy.com>
Extract the SSRF-hardened HTTP transport from the did:web resolver into a shared securefetch package. The package holds the pinning dialer, the egress denylist, the registrable-domain helper, the capped-body reader, and the client builder. The did:web resolver now uses it. Its dialer and denylist unit tests moved to securefetch. did:web behavior does not change. Add the WebBotAuthDirectoryResolver port with noop and http adapters. The http adapter checks the content type, parses the JWKS with per-key nbf/exp windows, and returns coarse 503-class errors. The webbotauth.directory.type setting selects the adapter. Implements SPEC T8 (invariants V8, V15, V16). Service and command wiring land with the control verifier (T3). Signed-off-by: James Hateley <jhateley@godaddy.com>
The web-bot-auth controlVerifier proves that a Signature-Agent URL endorses the key its bot signs with. It fetches the HTTP Message Signatures directory at the canonical well-known URL. It finds each proven key in the JWKS by RFC 7638 thumbprint. It verifies the JWS possession proof against the directory key, not the self-asserted header jwk. The verifier seals the intersection of the possession-proven keys and the directory-endorsed keys. It drops a proof for a key that the directory no longer endorses, but at least one proof must match. web-bot-auth accepts Ed25519 only. It rejects any other algorithm or key type. The register-time directory fetch is advisory and tolerates failure. Wire the verifier into the identity service registry, the constructor, and the ans-ra command. Config selects a noop or http directory resolver. This completes the T8 command wiring. Implements SPEC T3, T5, T6, T9 (invariants V2, V3, V4, V5, V6, V7, V12, V13, V16, V17). Signed-off-by: James Hateley <jhateley@godaddy.com>
Document the web-bot-auth identifier kind on IdentityRegistrationRequest.identifier. Cover the https Signature-Agent URL form, its canonicalization to the well-known directory URL, and the verify-control proof shape. Add web-bot-auth to the kind enums. Add the WBA_URL_INVALID and WBA_DIRECTORY_UNAVAILABLE error codes. Add no new routes. Sync the embedded docsui copy. Implements SPEC T4 (invariant V1). Signed-off-by: James Hateley <jhateley@godaddy.com>
Signed-off-by: James Hateley <jhateley@godaddy.com>
jhateley-godaddy
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue
Fixes #102
Summary
This branch adds a fourth verified-identity kind to the ANS
Registration Authority (RA):
web-bot-auth. An agent operator can nowprove control of an
https://Signature-Agent URL and bind it to theagent identity, next to the
did:web,did:key, andleikinds.Web-bot-auth is the IETF HTTP Message Signatures profile for automated
HTTP clients (
draft-meunier-webbotauth-httpsig-protocol-02). A botsends a
Signature-Agentheader that names anhttps://URL. That URLserves a JWKS directory of the keys the bot signs its requests with.
The URL is the identity. The directory is the authoritative key source.
Lets an ANS agent register that same Signature-Agent URL as a
verified identity. A relying party can then tie the agent ANS name to
the automated traffic it sends.
Testing
internal/crypto/jwk_test.go— thumbprint vectors and rejection ofnon-Ed25519 / malformed keys.
internal/domain/identity_test.go— inference and canonicalization,including the reject paths.
internal/adapter/directory/webbotauth/webbotauth_test.go— theparse pipeline, content-type and size checks, key windows.
internal/adapter/securefetch/securefetch_test.go— the dialer andredirect guards.
internal/ra/service/webbotauthverifier_test.go— possession,endorsement, intersection, mid-rotation drop, alg confusion.
internal/ra/service/webbotauth_flow_test.go— the fullregister → verify → seal flow on the noop resolver, plus rotation.
e2e tests against noop verifier added in scripts/demo/identity-lifecycle.sh
AI assistance
Checklist
git commit -s) certifying the DCO