Sign in with Veil

curl -fsS https://veil.rip/oidc/register -H 'Content-Type: application/json' -d '{
  "client_name": "Notes CLI",
  "redirect_uris": ["http://127.0.0.1/callback"],
  "token_endpoint_auth_method": "none",
  "grant_types": ["authorization_code", "refresh_token"],
  "application_type": "native"
}'

https://veil.rip/oidc/authorize?response_type=code
  &client_id=veil_app_62bab7367bb583e2157490ae2cb65d4d
  &redirect_uri=https%3A%2F%2Fnotes.example.org%2Fcallback
  &scope=openid%20profile%20veil
  &state=…&nonce=…
  &code_challenge=…&code_challenge_method=S256

{"iss": "https://veil.rip", "sub": "1", "aud": "veil_app_62bab7367bb583e2157490ae2cb65d4d", "azp": "veil_app_62bab7367bb583e2157490ae2cb65d4d",
 "name": "Elena Ferraro", "preferred_username": "u1", "profile": "https://veil.rip/u/1",
 "veil_version": 1, "veil_log": {"origin": "log.veil.rip/staging-1", "index": 0, "size": 10, "root": "JkW148VFq8g8MXHJArRQ/38q3ix5BrhSjAmHSAW8+P4="},
 "veil_good_standing": true, "veil_standing_reasons": [],
 "iat": 1793525884, "exp": 1793526484, "auth_time": 1793525884, "nonce": "ozFe35gs4K2fjVX7jcR81jTMf5X8CNR6X12cZSMuIi0",
 "amr": ["veil-key"], "sid": "l9",
 "veil_consent": {"text": "veil-rubrica:oidc-consent:v1\n{\"card\":1,\"challenge\":\"OpmVnrcB…\",…,\"v\":1}",
                  "signature": "ac8e0fb6…026a06", "key": "120a568ad456a6dfdc16d48d1ab91af826180545a13123a49134968446f57195", "alg": "ed25519"}}

// Sign in with Veil in a Node server: openid-client for the OpenID Connect flow, node:crypto for the Veil checks.
// npm install openid-client@6.8.8      node veil-signin.mjs
import * as oidc from "openid-client";
import { createHash, createPublicKey, verify, randomBytes } from "node:crypto";
import { createServer } from "node:http";

const ISSUER = new URL(process.env.VEIL_ISSUER ?? "https://veil.rip");
const CLIENT_ID = process.env.VEIL_CLIENT_ID;          // from /developers
const CLIENT_SECRET = process.env.VEIL_CLIENT_SECRET;  // shown once, keep it in your secret store
const REDIRECT = process.env.VEIL_REDIRECT ?? "http://localhost:3000/callback";
// A copy of the log's policy, kept with your app: the log's key and its witnesses (https://log.veil.rip/<log>/policy).
const POLICY = process.env.VEIL_POLICY_TEXT;

const sha256 = (b) => createHash("sha256").update(b).digest();
const ed25519 = (hex) => createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: Buffer.from(hex, "hex").toString("base64url") }, format: "jwk" });

// RFC 6962: the root an inclusion proof leads to, or null.
function rootFrom(leaf, index, size, path) {
  if (index >= size) return null;
  let fn = BigInt(index), sn = BigInt(size) - 1n, r = leaf;
  for (const p of path) {
    if (sn === 0n) return null;
    if ((fn & 1n) === 1n || fn === sn) {
      r = sha256(Buffer.concat([Buffer.from([1]), p, r]));
      if ((fn & 1n) === 0n) while ((fn & 1n) === 0n && fn !== 0n) { fn >>= 1n; sn >>= 1n; }
    } else r = sha256(Buffer.concat([Buffer.from([1]), r, p]));
    fn >>= 1n; sn >>= 1n;
  }
  return sn === 0n ? r : null;
}

// A C2SP note key "name+hash+base64(type || key)": type 0x01 for the log, 0x04 for a witness.
function noteKey(vkey) {
  const i = vkey.indexOf("+"), j = vkey.indexOf("+", i + 1);
  const name = vkey.slice(0, i), raw = Buffer.from(vkey.slice(j + 1), "base64");
  const id = sha256(Buffer.concat([Buffer.from(name + "\n"), raw])).subarray(0, 4);
  if (id.toString("hex") !== vkey.slice(i + 1, j)) throw new Error(`bad vkey ${name}`);
  return { name, id, key: ed25519(raw.subarray(1).toString("hex")) };
}

// The checkpoint's log signature, and how many witnesses of the policy's quorum group cosigned it.
function checkCheckpoint(note, policyText) {
  const text = note.slice(0, note.indexOf("\n\n") + 1);
  const sigs = note.slice(text.length + 1).split("\n").filter((l) => l.startsWith("— ")).map((l) => l.slice(2).split(" "));
  const lines = policyText.split("\n").map((l) => l.trim().split(/\s+/)).filter((f) => f[0] && !f[0].startsWith("#"));
  const log = noteKey(lines.find((f) => f[0] === "log")[1]);
  const witnesses = new Map(lines.filter((f) => f[0] === "witness").map((f) => [f[1], noteKey(f[2])]));
  const group = lines.find((f) => f[0] === "group" && f[1] === lines.find((q) => q[0] === "quorum")[1]);
  const members = group.slice(3);
  const needed = group[2] === "all" ? members.length : group[2] === "any" ? 1 : Number(group[2]);
  let logSigned = false; const cosigned = new Set();
  for (const [name, b64] of sigs) {
    const blob = Buffer.from(b64, "base64");
    if (name === log.name && blob.subarray(0, 4).equals(log.id)) logSigned ||= verify(null, Buffer.from(text), log.key, blob.subarray(4));
    for (const [id, w] of witnesses) {
      if (name !== w.name || blob.length !== 76 || !blob.subarray(0, 4).equals(w.id)) continue;
      const msg = `cosignature/v1\ntime ${blob.readBigUInt64BE(4)}\n${text}`;
      if (verify(null, Buffer.from(msg), w.key, blob.subarray(12))) cosigned.add(id);
    }
  }
  const [origin, size, root] = text.split("\n");
  return { logSigned, quorum: members.filter((m) => cosigned.has(m)).length >= needed, origin, size: Number(size), root };
}

/**
 * Veil's own checks on the claims of a verified ID token (scope "veil"): the person's device key signed this very login
 * (your PKCE challenge, your nonce, your client id), and the public log, not the server, says the key is on the card: the
 * version that added it, every version after it up to the card's current one (none revokes it), and the version the login
 * was checked against, each one this card's entry, in one chain, under a checkpoint the log signed and a quorum of witnesses
 * cosigned.
 */
export async function verifyVeil(claims, { verifier, nonce, state, clientId, issuer, policyText }) {
  const c = claims.veil_consent;
  if (!c || c.alg !== "ed25519" || !c.text.startsWith("veil-rubrica:oidc-consent:v1\n")) throw new Error("no signed consent");
  if (!verify(null, Buffer.from(c.text, "utf8"), ed25519(c.key), Buffer.from(c.signature, "hex"))) throw new Error("consent signature");
  const s = JSON.parse(c.text.slice(c.text.indexOf("\n") + 1));
  if (s.challenge !== sha256(verifier).toString("base64url")) throw new Error("not your PKCE challenge");
  if (s.client !== clientId || s.nonce !== nonce || s.iss !== issuer || s.key !== c.key || String(s.card) !== claims.sub) throw new Error("not your login");
  if (s.state !== sha256(state).toString("hex")) throw new Error("not your state");
  const get = async (path) => { const r = await fetch(issuer + path); if (!r.ok) throw new Error(`${path}: ${r.status}`); return r.json(); };
  // The server says where to look: the version that added the key, the card's id in the log (its token), its current version.
  const key = await get(`/v1/keys/${c.key}`);
  const card = await get(`/v1/identities/${claims.sub}`);
  if (String(key.identity?.n) !== claims.sub || key.role !== "device") throw new Error("key not on the card");
  if (!(key.addedIn <= claims.veil_version && claims.veil_version <= card.version)) throw new Error("the login's version is not one where the key was on the card");
  // The log says the rest.
  let prev = null;
  for (let v = key.addedIn; v <= card.version; v++) {
    const proof = await get(`/v1/identities/${claims.sub}/versions/${v}/proof`);
    const label = JSON.parse(JSON.parse(proof.entry).label);
    if (label.identity !== card.token || label.n !== v || (prev !== null && label.prev !== prev)) throw new Error(`the log's entry is not version ${v} of this card`);
    const leaf = sha256(Buffer.concat([Buffer.from([0]), Buffer.from(proof.entry, "utf8")]));
    const root = rootFrom(leaf, proof.logIndex, proof.checkpoint.size, proof.inclusion.map((h) => Buffer.from(h, "hex")));
    if (!root || root.toString("base64") !== proof.checkpoint.root) throw new Error("inclusion proof");
    const cp = checkCheckpoint(proof.checkpoint.note, policyText);
    if (!cp.logSigned || !cp.quorum || cp.origin !== claims.veil_log.origin || cp.root !== proof.checkpoint.root || cp.size !== proof.checkpoint.size) throw new Error("checkpoint");
    if (cp.size < claims.veil_log.size) throw new Error("an older checkpoint than the login's");
    const auth = label.auth ?? [];
    if (v === key.addedIn && !auth.some((op) => op.op === "addKey" && op.key === c.key && op.role === "device")) throw new Error("the log does not add this key here");
    if (v > key.addedIn && auth.some((op) => op.op === "revokeKey" && op.key === c.key)) throw new Error("the log revokes this key");
    if (v === claims.veil_version && proof.logIndex !== claims.veil_log.index) throw new Error("another log entry");
    prev = proof.labelHash;
  }
  return { card: Number(claims.sub), version: claims.veil_version, goodStanding: claims.veil_good_standing };
}

// The flow, with the PKCE verifier, state and nonce kept server-side per browser (a cookie names the session).
if (import.meta.url === `file://${process.argv[1]}`) {
  // enableNonRepudiationChecks: without it openid-client does not check the ID token's signature (TLS stands in for it).
  const config = await oidc.discovery(ISSUER, CLIENT_ID, { id_token_signed_response_alg: "EdDSA" }, oidc.ClientSecretBasic(CLIENT_SECRET),
    { execute: [oidc.enableNonRepudiationChecks] });
  const sessions = new Map();
  createServer(async (req, res) => {
    const url = new URL(req.url, REDIRECT);
    const sid = /sid=([A-Za-z0-9_-]+)/.exec(req.headers.cookie ?? "")?.[1];
    if (url.pathname === "/login") {
      const s = { verifier: oidc.randomPKCECodeVerifier(), state: oidc.randomState(), nonce: oidc.randomNonce() };
      const id = randomBytes(16).toString("base64url");
      sessions.set(id, s);
      const to = oidc.buildAuthorizationUrl(config, { redirect_uri: REDIRECT, scope: "openid profile veil veil:accounts", state: s.state, nonce: s.nonce,
        code_challenge: await oidc.calculatePKCECodeChallenge(s.verifier), code_challenge_method: "S256" });
      res.writeHead(302, { Location: to.href, "Set-Cookie": `sid=${id}; HttpOnly; Secure; SameSite=Lax; Path=/` }).end();
    } else if (url.pathname === "/callback" && sessions.has(sid)) {
      const s = sessions.get(sid); sessions.delete(sid);
      try {
        // state, iss (RFC 9207), PKCE, the ID token's signature (with enableNonRepudiationChecks), iss, aud, exp and nonce.
        const tokens = await oidc.authorizationCodeGrant(config, url, { pkceCodeVerifier: s.verifier, expectedState: s.state, expectedNonce: s.nonce });
        const claims = tokens.claims();
        const veil = await verifyVeil(claims, { ...s, clientId: CLIENT_ID, issuer: config.serverMetadata().issuer, policyText: POLICY });
        res.writeHead(200, { "Content-Type": "text/plain" }).end(`Signed in as card ${veil.card} (${claims.name}), checked against the log\n`);
      } catch (e) { res.writeHead(400, { "Content-Type": "text/plain" }).end(`Sign-in refused: ${e.message}\n`); }
    } else res.writeHead(404).end();
  }).listen(3000);
}

"""Sign in with Veil from Python: the standard library for HTTP, JSON and hashes, and pyca/cryptography for the two
signature schemes (Ed25519, ECDSA P-256), which the standard library does not have.   pip install cryptography"""
import base64, hashlib, json, secrets, time, urllib.parse, urllib.request
from cryptography.exceptions import InvalidSignature
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature

ISSUER = "https://veil.rip"


def b64url(data: str) -> bytes:
    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))


def get_json(url: str, data: bytes | None = None, headers: dict | None = None):
    req = urllib.request.Request(url, data=data, headers={"Accept": "application/json", **(headers or {})})
    with urllib.request.urlopen(req, timeout=15) as r:
        return json.load(r)


def ed25519_ok(key: bytes, sig: bytes, msg: bytes) -> bool:
    try:
        Ed25519PublicKey.from_public_bytes(key).verify(sig, msg)
        return True
    except (InvalidSignature, ValueError):
        return False


# ---------- the flow ----------

def start_login(discovery: dict, client_id: str, redirect_uri: str) -> tuple[str, dict]:
    """The authorization URL, and what to keep server-side for the callback (never in the URL or a readable cookie)."""
    session = {"verifier": secrets.token_urlsafe(48), "state": secrets.token_urlsafe(24), "nonce": secrets.token_urlsafe(24)}
    challenge = base64.urlsafe_b64encode(hashlib.sha256(session["verifier"].encode()).digest()).rstrip(b"=").decode()
    query = urllib.parse.urlencode({"response_type": "code", "client_id": client_id, "redirect_uri": redirect_uri,
                                    "scope": "openid profile veil veil:accounts", "state": session["state"], "nonce": session["nonce"],
                                    "code_challenge": challenge, "code_challenge_method": "S256"})
    return f"{discovery['authorization_endpoint']}?{query}", session


def finish_login(discovery: dict, client_id: str, secret: str, redirect_uri: str, callback_query: str, session: dict) -> dict:
    """The callback: state and iss first (RFC 9207), then the code for tokens, then the ID token's checks."""
    q = dict(urllib.parse.parse_qsl(callback_query))
    if q.get("state") != session["state"] or q.get("iss") != discovery["issuer"]:
        raise ValueError("state or iss is not this sign-in's")
    if "error" in q:
        raise ValueError(f"the sign-in did not happen: {q['error']}")
    form = urllib.parse.urlencode({"grant_type": "authorization_code", "code": q["code"], "redirect_uri": redirect_uri,
                                   "code_verifier": session["verifier"]}).encode()
    basic = base64.b64encode(f"{urllib.parse.quote(client_id, safe='')}:{urllib.parse.quote(secret, safe='')}".encode()).decode()
    tokens = get_json(discovery["token_endpoint"], form, {"Authorization": f"Basic {basic}", "Content-Type": "application/x-www-form-urlencoded"})
    return verify_id_token(discovery, tokens["id_token"], client_id, session["nonce"])


def verify_id_token(discovery: dict, token: str, client_id: str, nonce: str) -> dict:
    """The JWS checked with the key its kid names, with that key's one algorithm (never the header's choice), then the claims."""
    head_b64, body_b64, sig_b64 = token.split(".")
    header, claims, sig = json.loads(b64url(head_b64)), json.loads(b64url(body_b64)), b64url(sig_b64)
    jwk = next(k for k in get_json(discovery["jwks_uri"])["keys"] if k["kid"] == header["kid"])
    signed = f"{head_b64}.{body_b64}".encode()
    if header["alg"] != jwk["alg"]:
        raise ValueError("the token's alg is not its key's")
    if jwk["alg"] == "EdDSA":
        ok = ed25519_ok(b64url(jwk["x"]), sig, signed)
    elif jwk["alg"] == "ES256":
        key = ec.EllipticCurvePublicNumbers(int.from_bytes(b64url(jwk["x"])), int.from_bytes(b64url(jwk["y"])), ec.SECP256R1()).public_key()
        try:
            key.verify(encode_dss_signature(int.from_bytes(sig[:32]), int.from_bytes(sig[32:])), signed, ec.ECDSA(hashes.SHA256()))
            ok = True
        except InvalidSignature:
            ok = False
    else:
        ok = False
    now = time.time()
    if not ok or claims["iss"] != discovery["issuer"] or claims["aud"] != client_id or claims.get("azp", client_id) != client_id:
        raise ValueError("ID token signature, issuer or audience")
    if claims["exp"] < now - 30 or claims["iat"] > now + 30 or claims.get("nonce") != nonce:
        raise ValueError("ID token expired, from the future, or not this sign-in's nonce")
    return claims


# ---------- Veil's own checks ----------

def root_from(leaf: bytes, index: int, size: int, path: list[bytes]) -> bytes | None:
    """RFC 6962: the root an inclusion proof leads to."""
    if index >= size:
        return None
    fn, sn, r = index, size - 1, leaf
    for p in path:
        if sn == 0:
            return None
        if fn & 1 or fn == sn:
            r = hashlib.sha256(b"\x01" + p + r).digest()
            while not fn & 1 and fn != 0:
                fn, sn = fn >> 1, sn >> 1
        else:
            r = hashlib.sha256(b"\x01" + r + p).digest()
        fn, sn = fn >> 1, sn >> 1
    return r if sn == 0 else None


def note_key(vkey: str) -> tuple[str, bytes, bytes]:
    name, digest, b64 = vkey.split("+", 2)
    raw = base64.b64decode(b64)
    key_id = hashlib.sha256(name.encode() + b"\n" + raw).digest()[:4]
    if key_id.hex() != digest:
        raise ValueError(f"bad vkey {name}")
    return name, key_id, raw[1:]


def check_checkpoint(note: str, policy_text: str) -> dict:
    """The log's signature on the checkpoint, and whether the policy's quorum of witnesses cosigned it."""
    text = note[: note.index("\n\n") + 1]
    sigs = [line[2:].split(" ") for line in note[len(text) + 1:].split("\n") if line.startswith("— ")]
    lines = [line.split() for line in policy_text.splitlines() if line.strip() and not line.startswith("#")]
    log_name, log_id, log_key = note_key(next(f for f in lines if f[0] == "log")[1])
    witnesses = {f[1]: note_key(f[2]) for f in lines if f[0] == "witness"}
    quorum_group = next(f for f in lines if f[0] == "quorum")[1]
    group = next(f for f in lines if f[0] == "group" and f[1] == quorum_group)
    members, rule = group[3:], group[2]
    needed = len(members) if rule == "all" else 1 if rule == "any" else int(rule)
    log_signed, cosigned = False, set()
    for name, sig_b64 in sigs:
        blob = base64.b64decode(sig_b64)
        if name == log_name and blob[:4] == log_id and ed25519_ok(log_key, blob[4:], text.encode()):
            log_signed = True
        for wid, (wname, wkey_id, wkey) in witnesses.items():
            if name == wname and len(blob) == 76 and blob[:4] == wkey_id:
                msg = f"cosignature/v1\ntime {int.from_bytes(blob[4:12])}\n{text}".encode()
                if ed25519_ok(wkey, blob[12:], msg):
                    cosigned.add(wid)
    origin, size, root = text.split("\n")[:3]
    return {"log_signed": log_signed, "quorum": len(cosigned & set(members)) >= needed, "origin": origin, "size": int(size), "root": root}


def verify_veil(claims: dict, session: dict, client_id: str, issuer: str, policy_text: str) -> dict:
    """The person's device key signed this very login, and the public log, not the server, says the key is on the card: the
    version that added it, every version after it up to the card's current one (none revokes it), the login's version."""
    c = claims["veil_consent"]
    if c.get("alg") != "ed25519" or not c["text"].startswith("veil-rubrica:oidc-consent:v1\n"):
        raise ValueError("not a consent")
    if not ed25519_ok(bytes.fromhex(c["key"]), bytes.fromhex(c["signature"]), c["text"].encode()):
        raise ValueError("consent signature")
    s = json.loads(c["text"].split("\n", 1)[1])
    challenge = base64.urlsafe_b64encode(hashlib.sha256(session["verifier"].encode()).digest()).rstrip(b"=").decode()
    if s["challenge"] != challenge or s["nonce"] != session["nonce"] or s["client"] != client_id or s["iss"] != issuer \
            or s["key"] != c["key"] or str(s["card"]) != claims["sub"]:
        raise ValueError("this consent is not for this login")
    if s["state"] != hashlib.sha256(session["state"].encode()).hexdigest():
        raise ValueError("not this login's state")
    # The server says where to look: the version that added the key, the card's id in the log (its token), its current version.
    key = get_json(f"{issuer}/v1/keys/{c['key']}")
    card = get_json(f"{issuer}/v1/identities/{claims['sub']}")
    if str(key["identity"]["n"]) != claims["sub"] or key["role"] != "device":
        raise ValueError("the key is not on the card")
    if not key["addedIn"] <= claims["veil_version"] <= card["version"]:
        raise ValueError("the login's version is not one where the key was on the card")
    # The log says the rest.
    prev = None
    for v in range(key["addedIn"], card["version"] + 1):
        proof = get_json(f"{issuer}/v1/identities/{claims['sub']}/versions/{v}/proof")
        label = json.loads(json.loads(proof["entry"])["label"])
        if label["identity"] != card["token"] or label["n"] != v or (prev is not None and label["prev"] != prev):
            raise ValueError(f"the log's entry is not version {v} of this card")
        leaf = hashlib.sha256(b"\x00" + proof["entry"].encode()).digest()
        root = root_from(leaf, proof["logIndex"], proof["checkpoint"]["size"], [bytes.fromhex(h) for h in proof["inclusion"]])
        if root is None or base64.b64encode(root).decode() != proof["checkpoint"]["root"]:
            raise ValueError("inclusion proof")
        cp = check_checkpoint(proof["checkpoint"]["note"], policy_text)
        if not (cp["log_signed"] and cp["quorum"] and cp["origin"] == claims["veil_log"]["origin"] and cp["root"] == proof["checkpoint"]["root"]):
            raise ValueError("checkpoint signatures")
        if cp["size"] < claims["veil_log"]["size"]:
            raise ValueError("an older checkpoint than the login's")
        auth = label.get("auth", [])
        if v == key["addedIn"] and not any(op.get("op") == "addKey" and op.get("key") == c["key"] and op.get("role") == "device" for op in auth):
            raise ValueError("the log does not add this key here")
        if v > key["addedIn"] and any(op.get("op") == "revokeKey" and op.get("key") == c["key"] for op in auth):
            raise ValueError("the log revokes this key")
        if v == claims["veil_version"] and proof["logIndex"] != claims["veil_log"]["index"]:
            raise ValueError("another log entry")
        prev = proof["labelHash"]
    return {"card": int(claims["sub"]), "version": claims["veil_version"], "good_standing": claims["veil_good_standing"]}