mithril_aggregator/tools/

single_signature_authenticator.rs

use slog::{Logger, debug};
use std::sync::Arc;

use mithril_common::StdResult;
use mithril_common::entities::{SingleSignature, SingleSignatureAuthenticationStatus};
use mithril_common::logging::LoggerExtensions;

use crate::MultiSigner;

/// Authenticates single signatures against a signed message.
pub struct SingleSignatureAuthenticator {
    multi_signer: Arc<dyn MultiSigner>,
    logger: Logger,
}

impl SingleSignatureAuthenticator {
    /// Creates a new `SingleSignatureAuthenticator`.
    pub fn new(multi_signer: Arc<dyn MultiSigner>, logger: Logger) -> Self {
        Self {
            multi_signer,
            logger: logger.new_with_component_name::<Self>(),
        }
    }

    /// Authenticates a single signature against a signed message.
    pub async fn authenticate(
        &self,
        single_signature: &mut SingleSignature,
        signed_message: &str,
    ) -> StdResult<()> {
        let is_authenticated = match self
            .multi_signer
            .verify_single_signature(signed_message, single_signature)
            .await
        {
            Ok(()) => {
                debug!(
                    self.logger, "Single signature party authenticated for current stake distribution";
                    "party_id" => &single_signature.party_id,
                );
                true
            }
            Err(current_stake_distribution_error) => {
                // Signers may detect epoch changes before the aggregator and send
                // new signatures using the next epoch stake distribution
                match self
                    .multi_signer
                    .verify_single_signature_for_next_stake_distribution(
                        signed_message,
                        single_signature,
                    )
                    .await
                {
                    Ok(_) => {
                        debug!(
                            self.logger, "Single signature party authenticated for next stake distribution";
                            "party_id" => &single_signature.party_id,
                        );
                        true
                    }
                    Err(next_stake_distribution_error) => {
                        debug!(
                            self.logger, "Single signature party not authenticated";
                            "party_id" => &single_signature.party_id,
                            "current_stake_distribution_error" => ?current_stake_distribution_error,
                            "next_stake_distribution_error" => ?next_stake_distribution_error,
                        );
                        false
                    }
                }
            }
        };

        single_signature.authentication_status = if is_authenticated {
            SingleSignatureAuthenticationStatus::Authenticated
        } else {
            SingleSignatureAuthenticationStatus::Unauthenticated
        };

        Ok(())
    }
}

#[cfg(test)]
impl SingleSignatureAuthenticator {
    pub(crate) fn new_that_authenticate_everything() -> Self {
        let mut multi_signer = crate::multi_signer::MockMultiSigner::new();
        multi_signer.expect_verify_single_signature().returning(|_, _| Ok(()));
        multi_signer
            .expect_verify_single_signature_for_next_stake_distribution()
            .returning(|_, _| Ok(()));

        Self {
            multi_signer: Arc::new(multi_signer),
            logger: crate::test::TestLogger::stdout(),
        }
    }

    pub(crate) fn new_that_reject_everything() -> Self {
        let mut multi_signer = crate::multi_signer::MockMultiSigner::new();
        multi_signer
            .expect_verify_single_signature()
            .returning(|_, _| Err(anyhow::anyhow!("error")));
        multi_signer
            .expect_verify_single_signature_for_next_stake_distribution()
            .returning(|_, _| Err(anyhow::anyhow!("error")));

        Self {
            multi_signer: Arc::new(multi_signer),
            logger: crate::test::TestLogger::stdout(),
        }
    }
}

#[cfg(test)]
mod tests {
    use anyhow::anyhow;

    use mithril_common::test::entities_extensions::SingleSignatureTestExtension;

    use crate::multi_signer::MockMultiSigner;
    use crate::test::TestLogger;

    use super::*;

    fn mock_multi_signer(
        multi_signer_mock_config: impl FnOnce(&mut MockMultiSigner),
    ) -> Arc<MockMultiSigner> {
        let mut multi_signer = MockMultiSigner::new();
        multi_signer_mock_config(&mut multi_signer);
        Arc::new(multi_signer)
    }

    #[tokio::test]
    async fn single_signature_against_valid_signed_message_for_current_stake_distribution_is_authenticated()
     {
        let signed_message = "signed_message".to_string();
        let mut single_signature = SingleSignature {
            authentication_status: SingleSignatureAuthenticationStatus::Unauthenticated,
            ..SingleSignature::fake("party_id", &signed_message)
        };

        let authenticator = SingleSignatureAuthenticator::new(
            mock_multi_signer(|mock_config| {
                mock_config.expect_verify_single_signature().returning(|_, _| Ok(()));
            }),
            TestLogger::stdout(),
        );

        authenticator
            .authenticate(&mut single_signature, &signed_message)
            .await
            .unwrap();

        assert_eq!(
            single_signature.authentication_status,
            SingleSignatureAuthenticationStatus::Authenticated
        );
    }

    #[tokio::test]
    async fn single_signature_against_valid_signed_message_for_next_stake_distribution_is_authenticated()
     {
        let signed_message = "signed_message".to_string();
        let mut single_signature = SingleSignature {
            authentication_status: SingleSignatureAuthenticationStatus::Unauthenticated,
            ..SingleSignature::fake("party_id", &signed_message)
        };

        let authenticator = SingleSignatureAuthenticator::new(
            mock_multi_signer(|mock_config| {
                mock_config
                    .expect_verify_single_signature()
                    .returning(|_, _| Err(anyhow!("error")));
                mock_config
                    .expect_verify_single_signature_for_next_stake_distribution()
                    .returning(|_, _| Ok(()));
            }),
            TestLogger::stdout(),
        );

        authenticator
            .authenticate(&mut single_signature, &signed_message)
            .await
            .unwrap();

        assert_eq!(
            single_signature.authentication_status,
            SingleSignatureAuthenticationStatus::Authenticated
        );
    }

    #[tokio::test]
    async fn single_signature_against_invalid_signed_message_for_current_and_next_stake_distribution_is_not_authenticated()
     {
        let signed_message = "signed_message".to_string();
        let mut single_signature = SingleSignature {
            authentication_status: SingleSignatureAuthenticationStatus::Unauthenticated,
            ..SingleSignature::fake("party_id", &signed_message)
        };

        let authenticator = SingleSignatureAuthenticator::new(
            mock_multi_signer(|mock_config| {
                mock_config
                    .expect_verify_single_signature()
                    .returning(|_, _| Err(anyhow!("verify_single_signature error")));
                mock_config
                    .expect_verify_single_signature_for_next_stake_distribution()
                    .returning(|_, _| {
                        Err(anyhow!(
                            "verify_single_signature_for_next_stake_distribution error"
                        ))
                    });
            }),
            TestLogger::stdout(),
        );

        authenticator
            .authenticate(&mut single_signature, &signed_message)
            .await
            .unwrap();

        assert_eq!(
            single_signature.authentication_status,
            SingleSignatureAuthenticationStatus::Unauthenticated
        );
    }

    #[tokio::test]
    async fn single_signature_previously_authenticated_but_fail_new_authentication_is_now_unauthenticated()
     {
        let signed_message = "signed_message".to_string();
        let mut single_signature = SingleSignature {
            authentication_status: SingleSignatureAuthenticationStatus::Authenticated,
            ..SingleSignature::fake("party_id", &signed_message)
        };

        let authenticator = SingleSignatureAuthenticator::new(
            mock_multi_signer(|mock_config| {
                mock_config
                    .expect_verify_single_signature()
                    .returning(|_, _| Err(anyhow!("verify_single_signature error")));
                mock_config
                    .expect_verify_single_signature_for_next_stake_distribution()
                    .returning(|_, _| {
                        Err(anyhow!(
                            "verify_single_signature_for_next_stake_distribution error"
                        ))
                    });
            }),
            TestLogger::stdout(),
        );

        authenticator
            .authenticate(&mut single_signature, &signed_message)
            .await
            .unwrap();

        assert_eq!(
            single_signature.authentication_status,
            SingleSignatureAuthenticationStatus::Unauthenticated
        );
    }
}