Verify signed node registration claims

product-source/guanghu-knowledge-base/server/domain-access-orchestrator.ts

@@ -9,19 +9,41 @@ import {
   TrustedSignerSnapshotLoader,
   type TrustedSignerSnapshotReceipt,
 } from './trusted-signer-snapshot.js';
+import {
+  resolveNodeRegistrationEndpoint,
+  verifyNodeRegistrationClaim,
+} from './node-registration.js';
+import {
+  assertLoadedNodeRegistrationSnapshot,
+  NodeRegistrationSnapshotLoader,
+  type NodeRegistrationSnapshotReceipt,
+} from './node-registration-snapshot.js';
 
 const IDENTIFIER_PATTERN = /^[A-Z0-9][A-Z0-9._:-]{1,159}$/;
 
 export interface DomainIdentityProjection {
+  accountId: string;
   accountVerified: boolean;
   nodeId: string;
-  nodeRegistrationVerified: boolean;
 }
 
 export interface DomainIdentitySource {
   read(domainId: string, nodeType: DomainNodeType): Promise<DomainIdentityProjection>;
 }
 
+export interface NodeRegistrationClaimRequest {
+  accountId: string;
+  domainId: string;
+  endpointId: string;
+  endpointUrl: string;
+  nodeId: string;
+  nodeType: DomainNodeType;
+}
+
+export interface NodeRegistrationClaimSource {
+  read(request: Readonly<NodeRegistrationClaimRequest>): Promise<unknown | null>;
+}
+
 export interface DomainRuntimeHandoffCandidate {
   handoff: unknown;
   signerLookup: {
@@ -40,6 +62,7 @@ export interface DomainAccessProjection {
   localWorkspaceAllowed: true;
   nodeId: string;
   nodeType: DomainNodeType;
+  nodeRegistrationSource: Readonly<NodeRegistrationSnapshotReceipt>;
   runtimeReady: boolean;
   stage: DomainAccessStatus['stage'];
   trustSource: Readonly<TrustedSignerSnapshotReceipt>;
@@ -47,42 +70,77 @@ export interface DomainAccessProjection {
 
 function safeIdentity(input: unknown): DomainIdentityProjection {
   if (typeof input !== 'object' || input === null || Array.isArray(input)) {
-    return { accountVerified: false, nodeId: '', nodeRegistrationVerified: false };
+    return { accountId: '', accountVerified: false, nodeId: '' };
   }
   const candidate = input as Record<string, unknown>;
+  const accountId = typeof candidate.accountId === 'string'
+    && /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(candidate.accountId)
+    ? candidate.accountId
+    : '';
   const nodeId = typeof candidate.nodeId === 'string' && IDENTIFIER_PATTERN.test(candidate.nodeId)
     ? candidate.nodeId
     : '';
   return {
-    accountVerified: candidate.accountVerified === true && Boolean(nodeId),
+    accountId,
+    accountVerified: candidate.accountVerified === true && Boolean(accountId) && Boolean(nodeId),
     nodeId,
-    nodeRegistrationVerified: candidate.nodeRegistrationVerified === true && Boolean(nodeId),
   };
 }
 
 export class DomainAccessOrchestrator {
   constructor(
     private readonly signerSnapshots: TrustedSignerSnapshotLoader,
+    private readonly nodeRegistrationSnapshots: NodeRegistrationSnapshotLoader,
     private readonly identities: DomainIdentitySource,
+    private readonly nodeRegistrations: NodeRegistrationClaimSource,
     private readonly handoffs: DomainRuntimeHandoffSource,
   ) {}
 
   async domainAccess(domainId: string, nodeType: DomainNodeType, now = Date.now()): Promise<Readonly<DomainAccessProjection>> {
     if (!IDENTIFIER_PATTERN.test(domainId)) throw new Error('domain_access_domain_invalid');
     if (nodeType !== 'local-terminal' && nodeType !== 'cloud-resident') throw new Error('domain_access_node_type_invalid');
-    const [snapshot, identity] = await Promise.all([
+    const [snapshot, nodeRegistrationSnapshot, identity] = await Promise.all([
       this.signerSnapshots.refresh(),
+      this.nodeRegistrationSnapshots.refresh(),
       this.identities.read(domainId, nodeType).then(safeIdentity, () => safeIdentity(null)),
     ]);
+    let nodeRegistrationVerified = false;
+    if (identity.accountVerified && nodeRegistrationSnapshot.receipt.status === 'CURRENT') {
+      try {
+        const loaded = assertLoadedNodeRegistrationSnapshot(nodeRegistrationSnapshot);
+        const endpoint = loaded.registry && resolveNodeRegistrationEndpoint(loaded.registry, { domainId, nodeType });
+        if (endpoint) {
+          const claim = await this.nodeRegistrations.read(Object.freeze({
+            accountId: identity.accountId,
+            domainId,
+            endpointId: endpoint.endpointId,
+            endpointUrl: endpoint.url,
+            nodeId: identity.nodeId,
+            nodeType,
+          }));
+          if (claim) {
+            verifyNodeRegistrationClaim(claim, {
+              accountId: identity.accountId,
+              domainId,
+              nodeId: identity.nodeId,
+              nodeType,
+            }, endpoint, now);
+            nodeRegistrationVerified = true;
+          }
+        }
+      } catch {
+        nodeRegistrationVerified = false;
+      }
+    }
     const evidence: DomainAccessEvidence = {
       accountVerified: identity.accountVerified,
       domainId,
       nodeId: identity.nodeId,
-      nodeRegistrationVerified: identity.nodeRegistrationVerified,
+      nodeRegistrationVerified,
       nodeType,
     };
 
-    if (identity.accountVerified && identity.nodeRegistrationVerified) {
+    if (identity.accountVerified && nodeRegistrationVerified) {
       let candidate: DomainRuntimeHandoffCandidate | null = null;
       try {
         candidate = await this.handoffs.read(domainId, identity.nodeId, nodeType);
@@ -111,6 +169,7 @@ export class DomainAccessOrchestrator {
     return Object.freeze({
       ...status,
       blockers: Object.freeze([...status.blockers]),
+      nodeRegistrationSource: nodeRegistrationSnapshot.receipt,
       trustSource: snapshot.receipt,
     });
   }