mooncred

moon add moonbitstack/mooncred

// The key is whatever signs. Here, HMAC over SHA-256.
let secret = b"a shared secret nobody else has"
let key = @jwt.mac(fn() {
  @hmac.Hmac::new(secret[:], fn() { @sha2.Hasher::new() })
})

let claims : Map[String, Json] = {
  "sub": "heke1228",
  "iss": "moonbitstack",
  "aud": "moonapi",
  "exp": 1793235600,
}
let token = @jwt.sign(claims, HS256, key)

// The instant the claims are judged at, in Unix seconds: data, not a clock.
let seconds = 1793232000L

// The algorithm is the caller's, not the token's.
let got = @jwt.verify(token[:], HS256, key, now=At(seconds),
                      issuer="moonbitstack", audience=["moonapi"])

#Packages

#The algorithm is not the token's to choose

• alg: none. A token with an empty signature that a verifier accepts because the token said not to check. There is no none in the Alg type, so there is nothing to accept.
• Algorithm confusion. A token signed with HMAC, keyed on the RSA public key that everybody has, offered to a verifier that reads alg from the header and obliges. Here the caller has already decided; the header must agree with it.

#Configuration precedence

@jwt.policy        <        the policy you pass        <        the arguments you pass

• wins turns the last two layers around. Base makes the policy authoritative and the arguments advisory.
• clash decides what happens when a setting is given twice: Ignore merges quietly, Panic refuses, and Handle(f) gives your function the base and the merged result and takes whichever it returns.

// A policy for the deployment, assembled once.
let ours = @jwt.Policy::new(issuer="moonbitstack", audience=["moonapi"])
// The same thing written as a record update.
let same : @jwt.Policy = { ..@jwt.policy, issuer: Some("moonbitstack"), audience: ["moonapi"] }

// Used as it is, and used with one thing changed for this call.
let a = @jwt.verify(token[:], HS256, key, now=At(seconds), policy=ours)
let b = @jwt.verify(token[:], HS256, key, now=At(seconds), policy=ours, leeway=60)

// Reading a token without asking whether it has expired.
let c = @jwt.verify(token[:], HS256, key, now=Ignored)

#A payload that is not a claim set

let signer = @jwt.mac(fn() {
  @hmac.Hmac::new(b"a shared secret nobody else has"[:], fn() { @sha2.Hasher::new() })
})

// b64: false, and the payload travels beside the token (RFC 7797 §4).
let detached = @jwt.sign_bytes(b"$.02", HS256, signer, b64=false, detached=true)
let octets = @jwt.verify_bytes(detached[:], HS256, signer, b64=false, payload=b"$.02")
assert_eq(octets, b"$.02")

// A payload that is not ASCII cannot travel in the compact form unencoded, so
// the compact form encodes it; the JSON serialisation can carry it either way.
let binary = @jwt.sign_bytes(b"\x00\x01\x02", HS256, signer)
assert_eq(@jwt.verify_bytes(binary[:], HS256, signer), b"\x00\x01\x02")

fn kid_of(kid : String) -> Map[String, Json] {
  let out : Map[String, Json] = Map([])
  out["kid"] = Json::string(kid)
  out
}

let message = @jwt.Message::new(b"{\"iss\":\"moonbitstack\"}")
  // The key's name travels unprotected; `alg` is always signed.
  .sign(HS256, signer, header=kid_of("2026-09"))
  // A second signature by the same key with no signed header at all
  // (RFC 7515 §A.5): the payload is authenticated and nothing about it is.
  .sign(HS256, signer, header=kid_of("2027-03"), bare=true)

let general = @json.dumps(message.json())
let flattened = @json.dumps(message.flattened())   // refused unless there is one
ignore(flattened)

// Each signature is offered with the algorithm and key that may open it, and
// nothing else is tried.
let checked = @jwt.verify_json(general[:], checks=[@jwt.Check::new(HS256, signer)])
assert_eq(checked.payload, b"{\"iss\":\"moonbitstack\"}")

#Keys are contracts, not implementations

let published = @jwk.Jwk::parse(
  "{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"x\":\"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo\"}",
)
let verifier : &@spec.Verifier = match published.material() {
  Okp(x~, ..) => (@ed25519.PublicKey::new(x[:]) : &@spec.Verifier)
  _ => abort("not an Ed25519 key")
}

let material = @jwk.Jwk::parse(
  "{\"kty\":\"oct\",\"k\":\"aGVsbG8gdGhlcmUgdGhpcyBpcyBhIGtleQ\",\"alg\":\"HS256\"}",
)
assert_eq(material.alg(), Some("HS256"))
assert_eq(material.crt(), None)

#When a setting takes a bare value and when it takes Some

let rules = @jwt.Policy::new(issuer="https://issuer.example", leeway=30)
let checked = @jwt.verify(token[:], HS256, key, now=At(seconds), issuer="https://issuer.example")
ignore(rules)
ignore(checked)

let plain = @jwt.sign(claims, HS256, key)                      // typ: "JWT"
let access = @jwt.sign(claims, HS256, key, typ=Some("at+jwt"))  // typ: "at+jwt"
let bare = @jwt.sign(claims, HS256, key, typ=None)              // no typ header
ignore(plain)
ignore(access)
ignore(bare)

#Certificates

let seed = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
let issue_key : @x509.PrivateKey = MlDsa(@mldsa.PrivateKey::from_seed(kind=D65, seed))
let der = @x509.self_signed(
  key=issue_key,
  cn="example.com",
  serial=b"\x01",
  not_before=1793232000L,                  // seconds since the Unix epoch
  not_after=1824768000L,
  exts={ ..@x509.Exts::empty(), san: [Dns("example.com")] },
)
let chain : Array[Bytes] = [der]
let anchors = @x509.Roots::new(certs=chain[:])
let now = 1793232000L

// The peer's leaf first, then whatever intermediates it sent, in any order.
let path = @x509.verify(chain[:], anchors, now~, host="example.com")
// path: the leaf, the intermediates it runs through, the anchor

// Or one certificate on its own.
let cert = @x509.parse(der[:])
let serves = cert.matches("example.com")     // subjectAltName names and addresses
let signed = cert.signed_by(cert.spki)       // raises for an algorithm it does not check
let every_anchor = @roots.mozilla()          // the bundle, its own package
assert_true(serves)
assert_true(signed)
assert_eq(path.length(), 1)
assert_true(every_anchor.length() > 100)

let text = issue_key.pkcs8_pem()              // what a PRIVATE KEY file contains
let loaded = @x509.PrivateKey::pem(text)      // PRIVATE KEY, EC PRIVATE KEY, RSA PRIVATE KEY
let pairs = cert.spki.holds(loaded.public())  // whether the two belong together
assert_true(pairs)

#Requests, containers and revocation

// A request to be signed, and the same request read back.
let pem = @csr.self_signed_pem(issue_key, subject=@x509.common_name("csr.example.com"))
let request = @csr.Request::pem(pem)
let sound = request.verified()                   // the signature, over the octets that arrived
let mine = request.asks_for(issue_key.public())  // whether it asks for this key
assert_true(sound)
assert_true(mine)

// A key at rest, and the container that holds it.
let salt = b"0123456789abcdef"
let passphrase = "a passphrase for the container"
let locked = issue_key.encrypt(passphrase~, salt~, iv=salt[:], scheme=Aes256Cbc)
let back = @x509.PrivateKey::read_encrypted(locked[:], passphrase~)
let pfx = @pkcs12.build(
  certs=chain[:],
  key=Some(issue_key.pkcs8()),
  passphrase~,
  salt~,
  iv=salt[:],
  mac_salt=salt[:],
)
let inside = @pkcs12.parse(pfx[:]).contents(passphrase~)
assert_true(back.public() is MlDsa(_))
assert_true(inside.key is Some(_))

fn standing(crl_pem : String, cert : @x509.Cert, at : Int64) -> String raise {
  let list = @revoke.Crl::pem(crl_pem)
  if !list.fresh(at) {
    return "stale"
  }
  match list.status(cert) {
    Good => "good"
    Revoked(_) => "revoked"
    Unknown => "unknown"
  }
}

#A signed string for a cookie

let keys = @token.Keys::new(b"the key that signs session cookies")
let text = @token.sign(b"user=heke1228", keys~, salt="session", at=seconds)
let value = @token.verify(text[:], keys~, salt="session", max_age=86400L, now=seconds)
assert_eq(value, b"user=heke1228")

#JWE: one payload, keys chosen per recipient

let shared = b"a 16-octet key"
let content = b"0001020304050607"
let iv = b"twelve bytes"

// dir: the shared key is the content key.
let direct = @jwe.encrypt(
  b"card ending 4242",
  key=Shared(shared),
  alg=Dir,
  enc=A128Gcm,
  iv~,
)
assert_eq(@jwe.decrypt(direct[:], key=Shared(shared), alg=Dir, enc=A128Gcm), b"card ending 4242")

// A key wrapped under a password: the salt and the count are the caller's,
// and the key is derived rather than held.
let sealed = @jwe.encrypt(
  b"card ending 4242",
  key=Password(b"a passphrase for the auditor"),
  alg=Pbes2Hs256A128Kw,
  enc=A128Gcm,
  cek=content,
  iv~,
  salt=b"sixteen byte sal",
  count=4096,
)
let opened = @jwe.decrypt(
  sealed[:],
  key=Password(b"a passphrase for the auditor"),
  alg=Pbes2Hs256A128Kw,
  enc=A128Gcm,
)
assert_eq(opened, b"card ending 4242")

// Every algorithm is accepted by default.
assert_eq(@jwe.policy.rsa1_5, true)
assert_eq(@jwe.policy.rsa_oaep, true)

// A deployment that will not answer for the two says so once, and both
// directions obey it.
let only_modern = @jwe.strict
assert_eq(only_modern.rsa1_5, false)

// Or one at a time.
let no_rsa1_5 = @jwe.Policy::new(rsa1_5=false)
assert_eq(no_rsa1_5.rsa_oaep, true)

let content = b"0001020304050607"
let message = @jwe.seal(
  b"card ending 4242",
  enc=A128Gcm,
  recipients=[
    {
      ..@jwe.Recipient::new(A128Kw, Shared(b"sixteen byte key")),
      cek: Some(content),
      header: kid_of("ops"),
    },
    {
      ..@jwe.Recipient::new(
        Pbes2Hs256A128Kw,
        Password(b"a passphrase for the auditor"),
      ),
      cek: Some(content),
      salt: Some(b"sixteen byte sal"),
      count: Some(4096),
      header: kid_of("audit"),
    },
  ],
  iv=b"twelve bytes",
  aad=b"tenant=42",
)
let document = @json.dumps(message)
let opened = @jwe.open(
  document[:],
  enc=A128Gcm,
  unseal=[@jwe.Unseal::new(A128Kw, Shared(b"sixteen byte key"))],
)
assert_eq(opened.index, 0)                      // which recipient opened it
assert_eq(opened.aad, b"tenant=42")             // authenticated, not carried
assert_eq(opened.plain, b"card ending 4242")

#COSE

let signature_key = @ed25519.PrivateKey::new(seed)
let message = @cose.sign1(b"payload", alg=EdDSA, signature_key, kid=b"2026-09")
let opened = @cose.verify1(message[:], alg=EdDSA, signature_key.public())
assert_eq(opened, b"payload")

let claims : @cose.Claims = { ..@cose.Claims::new(), iss: Some("moonbitstack"), exp: Some(4102444800L) }
let cwt = @cose.signed(claims, alg=EdDSA, signature_key)
let checked = @cose.verified(cwt[:], alg=EdDSA, signature_key.public(), now=At(seconds))
assert_eq(checked.iss, Some("moonbitstack"))

#Policy, when a chain has to be valid for a purpose

let certificates = []
for one in path {
  certificates.push(@policy.read(one.raw))
}
let held = @policy.policies(certificates, initial=["2.23.140.1.2.1"])
assert_eq(held.length(), 0)   // this certificate carries no policy of that name

#What is checked

#Conformance

#What is not here yet

#Licence