nwaku/tests/test_waku_keystore.nim

{.used.}

import
  std/[os, json],
  chronos,
  testutils/unittests
import
  ../../waku/waku_keystore,
  ./testlib/common

from  ../../waku/waku_noise/noise_utils import randomSeqByte

procSuite "Credentials test suite":

  let testAppInfo = AppInfo(application: "test", appIdentifier: "1234", version: "0.1")

  test "Create keystore":

    let filepath = "./testAppKeystore.txt"
    defer: removeFile(filepath)

    let keystoreRes = createAppKeystore(path = filepath,
                                        appInfo = testAppInfo)

    check:
      keystoreRes.isOk()

  test "Load keystore":

    let filepath = "./testAppKeystore.txt"
    defer: removeFile(filepath)

    # If no keystore exists at filepath, a new one is created for appInfo and empty credentials
    let keystoreRes = loadAppKeystore(path = filepath,
                                      appInfo = testAppInfo)

    check:
      keystoreRes.isOk()

    let keystore = keystoreRes.get()

    check:
      keystore.hasKeys(["application", "appIdentifier", "version", "credentials"])
      keystore["application"].getStr() == testAppInfo.application
      keystore["appIdentifier"].getStr() == testAppInfo.appIdentifier
      keystore["version"].getStr() == testAppInfo.version
      # We assume the loaded keystore to not have credentials set (previous tests delete the keystore at filepath)
      keystore["credentials"].len() == 0

  test "Add credentials to keystore":

    let filepath = "./testAppKeystore.txt"
    defer: removeFile(filepath)

    # We generate a random identity credential (inter-value constrains are not enforced, otherwise we need to load e.g. zerokit RLN keygen)
    var
      idTrapdoor = randomSeqByte(rng[], 32)
      idNullifier =  randomSeqByte(rng[], 32)
      idSecretHash = randomSeqByte(rng[], 32)
      idCommitment = randomSeqByte(rng[], 32)

    var idCredential = IdentityCredential(idTrapdoor: idTrapdoor, idNullifier: idNullifier, idSecretHash: idSecretHash, idCommitment: idCommitment)

    var contract = MembershipContract(chainId: "5", address: "0x0123456789012345678901234567890123456789")
    var index = MembershipIndex(1)

    let membershipCredential = KeystoreMembership(membershipContract: contract,
                                          treeIndex: index,
                                          identityCredential: idCredential)
    let password = "%m0um0ucoW%"

    let keystoreRes = addMembershipCredentials(path = filepath,
                                               membership = membershipCredential,
                                               password = password,
                                               appInfo = testAppInfo)

    check:
      keystoreRes.isOk()

  test "Add/retrieve credentials in keystore":

    let filepath = "./testAppKeystore.txt"
    defer: removeFile(filepath)

    # We generate two random identity credentials (inter-value constrains are not enforced, otherwise we need to load e.g. zerokit RLN keygen)
    var
      idTrapdoor = randomSeqByte(rng[], 32)
      idNullifier =  randomSeqByte(rng[], 32)
      idSecretHash = randomSeqByte(rng[], 32)
      idCommitment = randomSeqByte(rng[], 32)
      idCredential = IdentityCredential(idTrapdoor: idTrapdoor, idNullifier: idNullifier, idSecretHash: idSecretHash, idCommitment: idCommitment)

    # We generate two distinct membership groups
    var contract = MembershipContract(chainId: "5", address: "0x0123456789012345678901234567890123456789")
    var index = MembershipIndex(1)
    var membershipCredential = KeystoreMembership(membershipContract: contract,
                                          treeIndex: index,
                                          identityCredential: idCredential)


    let password = "%m0um0ucoW%"

    # We add credentials to the keystore. Note that only 3 credentials should be effectively added, since rlnMembershipCredentials3 is equal to membershipCredentials2
    let keystoreRes = addMembershipCredentials(path = filepath,
                                               membership = membershipCredential,
                                               password = password,
                                               appInfo = testAppInfo)

    check:
      keystoreRes.isOk()

    # We test retrieval of credentials.
    var expectedMembership = membershipCredential
    let membershipQuery = KeystoreMembership(membershipContract: contract,
                                             treeIndex: index)

    var recoveredCredentialsRes = getMembershipCredentials(path = filepath,
                                                           password = password,
                                                           query = membershipQuery,
                                                           appInfo = testAppInfo)

    check:
      recoveredCredentialsRes.isOk()
      recoveredCredentialsRes.get() == expectedMembership

  test "if the keystore contains only one credential, fetch that irrespective of treeIndex":

    let filepath = "./testAppKeystore.txt"
    defer: removeFile(filepath)

    # We generate random identity credentials (inter-value constrains are not enforced, otherwise we need to load e.g. zerokit RLN keygen)
    let
      idTrapdoor = randomSeqByte(rng[], 32)
      idNullifier =  randomSeqByte(rng[], 32)
      idSecretHash = randomSeqByte(rng[], 32)
      idCommitment = randomSeqByte(rng[], 32)
      idCredential = IdentityCredential(idTrapdoor: idTrapdoor, idNullifier: idNullifier, idSecretHash: idSecretHash, idCommitment: idCommitment)

    let contract = MembershipContract(chainId: "5", address: "0x0123456789012345678901234567890123456789")
    let index = MembershipIndex(1)
    let membershipCredential = KeystoreMembership(membershipContract: contract,
                                                  treeIndex: index,
                                                  identityCredential: idCredential)

    let password = "%m0um0ucoW%"

    let keystoreRes = addMembershipCredentials(path = filepath,
                                               membership = membershipCredential,
                                               password = password,
                                               appInfo = testAppInfo)

    assert(keystoreRes.isOk(), $keystoreRes.error)

    # We test retrieval of credentials.
    let expectedMembership = membershipCredential
    let membershipQuery = KeystoreMembership(membershipContract: contract)

    let recoveredCredentialsRes = getMembershipCredentials(path = filepath,
                                                           password = password,
                                                           query = membershipQuery,
                                                           appInfo = testAppInfo)

    assert(recoveredCredentialsRes.isOk(), $recoveredCredentialsRes.error)
    check: recoveredCredentialsRes.get() == expectedMembership

  test "if the keystore contains multiple credentials, then error out if treeIndex has not been passed in":
    let filepath = "./testAppKeystore.txt"
    defer: removeFile(filepath)

    # We generate random identity credentials (inter-value constrains are not enforced, otherwise we need to load e.g. zerokit RLN keygen)
    let
      idTrapdoor = randomSeqByte(rng[], 32)
      idNullifier =  randomSeqByte(rng[], 32)
      idSecretHash = randomSeqByte(rng[], 32)
      idCommitment = randomSeqByte(rng[], 32)
      idCredential = IdentityCredential(idTrapdoor: idTrapdoor, idNullifier: idNullifier, idSecretHash: idSecretHash, idCommitment: idCommitment)

    # We generate two distinct membership groups
    let contract = MembershipContract(chainId: "5", address: "0x0123456789012345678901234567890123456789")
    let index = MembershipIndex(1)
    var membershipCredential = KeystoreMembership(membershipContract: contract,
                                                  treeIndex: index,
                                                  identityCredential: idCredential)

    let password = "%m0um0ucoW%"

    let keystoreRes = addMembershipCredentials(path = filepath,
                                                membership = membershipCredential,
                                                password = password,
                                                appInfo = testAppInfo)

    assert(keystoreRes.isOk(), $keystoreRes.error)

    membershipCredential.treeIndex = MembershipIndex(2)
    let keystoreRes2 = addMembershipCredentials(path = filepath,
                                                membership = membershipCredential,
                                                password = password,
                                                appInfo = testAppInfo)
    assert(keystoreRes2.isOk(), $keystoreRes2.error)

    # We test retrieval of credentials.
    let membershipQuery = KeystoreMembership(membershipContract: contract)

    let recoveredCredentialsRes = getMembershipCredentials(path = filepath,
                                                           password = password,
                                                           query = membershipQuery,
                                                           appInfo = testAppInfo)

    check:
      recoveredCredentialsRes.isErr()
      recoveredCredentialsRes.error.kind == KeystoreCredentialNotFoundError