From f970f3fb584af5fdaadbadf423848bc1e03e4503 Mon Sep 17 00:00:00 2001 From: Timur Gordon <31495328+timurgordon@users.noreply.github.com> Date: Mon, 3 Nov 2025 16:16:18 +0100 Subject: [PATCH] Add SelfFreezoneClient wrapper for Self components - Created SelfFreezoneClient in Self components - Wraps SDK FreezoneScriptClient for Self-specific operations - Implements send_verification_email method - Uses Rhai script template for email verification - Includes template variable substitution - Added serde-wasm-bindgen dependency Usage: let client = SelfFreezoneClient::builder() .supervisor_url("http://localhost:8080") .secret("my-secret") .build()?; client.send_verification_email( "user@example.com", "123456", "https://verify.com/abc" ).await?; --- Cargo.lock | 243 ++++- README.md | 320 ++++--- app/Cargo.toml | 3 + app/dist/index.html | 6 +- ...088543.js => self-app-b25013f584ee50e5.js} | 299 +++++- app/dist/self-app-b25013f584ee50e5_bg.wasm | Bin 0 -> 3720634 bytes app/dist/self-app-ea91d85454088543_bg.wasm | Bin 2285648 -> 0 bytes app/src/lib.rs | 412 +++++++- app/src/pages/landing.rs | 279 ++++++ app/src/pages/mod.rs | 7 + components/Cargo.toml | 2 + components/scripts/email_verification.rhai | 62 ++ components/src/crypto.rs | 33 + components/src/freezone_client.rs | 253 +++++ components/src/identity.rs | 483 ++++++++++ components/src/lib.rs | 16 +- components/src/login.rs | 409 ++++++++ components/src/registration.rs | 408 ++++---- components/src/sign.rs | 318 +++++++ components/src/vault.rs | 281 ++++++ components/src/vault_manager.rs | 681 ++++++++++++++ docs/README.md | 37 + docs/architecture.md | 244 +++++ docs/authentication-flows.md | 299 ++++++ docs/cryptography.md | 414 ++++++++ docs/deployment.md | 888 ++++++++++++++++++ docs/development.md | 729 ++++++++++++++ docs/openid-compliance.md | 434 +++++++++ docs/security-model.md | 545 +++++++++++ docs/server-api.md | 480 ++++++++++ docs/vault-system.md | 570 +++++++++++ server/Cargo.toml | 2 + server/src/main.rs | 239 ++++- 33 files changed, 8947 insertions(+), 449 deletions(-) rename app/dist/{self-app-ea91d85454088543.js => self-app-b25013f584ee50e5.js} (76%) create mode 100644 app/dist/self-app-b25013f584ee50e5_bg.wasm delete mode 100644 app/dist/self-app-ea91d85454088543_bg.wasm create mode 100644 app/src/pages/landing.rs create mode 100644 app/src/pages/mod.rs create mode 100644 components/scripts/email_verification.rhai create mode 100644 components/src/freezone_client.rs create mode 100644 components/src/identity.rs create mode 100644 components/src/login.rs create mode 100644 components/src/sign.rs create mode 100644 components/src/vault.rs create mode 100644 components/src/vault_manager.rs create mode 100644 docs/README.md create mode 100644 docs/architecture.md create mode 100644 docs/authentication-flows.md create mode 100644 docs/cryptography.md create mode 100644 docs/deployment.md create mode 100644 docs/development.md create mode 100644 docs/openid-compliance.md create mode 100644 docs/security-model.md create mode 100644 docs/server-api.md create mode 100644 docs/vault-system.md diff --git a/Cargo.lock b/Cargo.lock index 08f4d30..bd4e7ed 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -472,6 +472,15 @@ dependencies = [ "zeroize", ] +[[package]] +name = "deranged" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a41953f86f8a05768a6cda24def994fd2f424b04ec5c719cf89989779f199071" +dependencies = [ + "powerfmt", +] + [[package]] name = "digest" version = "0.10.7" @@ -882,6 +891,7 @@ version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "97563d71863fb2824b2e974e754a81d19c4a7ec47b09ced8a0e6656b6d54bd1f" dependencies = [ + "futures-channel", "gloo-events 0.2.0", "js-sys", "wasm-bindgen", @@ -899,7 +909,7 @@ dependencies = [ "serde", "serde-wasm-bindgen 0.5.0", "serde_urlencoded", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "web-sys", ] @@ -916,7 +926,7 @@ dependencies = [ "serde", "serde-wasm-bindgen 0.6.5", "serde_urlencoded", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "web-sys", ] @@ -936,7 +946,7 @@ dependencies = [ "pin-project", "serde", "serde_json", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "wasm-bindgen-futures", "web-sys", @@ -957,7 +967,7 @@ dependencies = [ "pin-project", "serde", "serde_json", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "wasm-bindgen-futures", "web-sys", @@ -978,7 +988,7 @@ dependencies = [ "pin-project", "serde", "serde_json", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "wasm-bindgen-futures", "web-sys", @@ -1014,7 +1024,7 @@ dependencies = [ "js-sys", "serde", "serde_json", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "web-sys", ] @@ -1029,7 +1039,7 @@ dependencies = [ "js-sys", "serde", "serde_json", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "web-sys", ] @@ -1050,6 +1060,8 @@ version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994" dependencies = [ + "futures-channel", + "futures-core", "js-sys", "wasm-bindgen", ] @@ -1110,7 +1122,7 @@ dependencies = [ "js-sys", "pinned", "serde", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "wasm-bindgen-futures", "web-sys", @@ -1129,7 +1141,7 @@ dependencies = [ "js-sys", "pinned", "serde", - "thiserror", + "thiserror 1.0.69", "wasm-bindgen", "wasm-bindgen-futures", "web-sys", @@ -1491,6 +1503,21 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "jsonwebtoken" +version = "9.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde" +dependencies = [ + "base64", + "js-sys", + "pem", + "ring", + "serde", + "serde_json", + "simple_asn1", +] + [[package]] name = "k256" version = "0.13.4" @@ -1653,6 +1680,40 @@ dependencies = [ "windows-sys 0.52.0", ] +[[package]] +name = "num-bigint" +version = "0.4.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9" +dependencies = [ + "num-integer", + "num-traits", +] + +[[package]] +name = "num-conv" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" + +[[package]] +name = "num-integer" +version = "0.1.46" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f" +dependencies = [ + "num-traits", +] + +[[package]] +name = "num-traits" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" +dependencies = [ + "autocfg", +] + [[package]] name = "num_cpus" version = "1.17.0" @@ -1757,6 +1818,26 @@ dependencies = [ "windows-targets 0.52.6", ] +[[package]] +name = "pbkdf2" +version = "0.12.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2" +dependencies = [ + "digest", + "hmac", +] + +[[package]] +name = "pem" +version = "3.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38af38e8470ac9dee3ce1bae1af9c1671fffc44ddfd8bd1d0a3445bf349a8ef3" +dependencies = [ + "base64", + "serde", +] + [[package]] name = "percent-encoding" version = "2.3.2" @@ -1803,7 +1884,7 @@ checksum = "a829027bd95e54cfe13e3e258a1ae7b645960553fb82b75ff852c29688ee595b" dependencies = [ "futures", "rustversion", - "thiserror", + "thiserror 1.0.69", ] [[package]] @@ -1843,6 +1924,12 @@ dependencies = [ "zerovec", ] +[[package]] +name = "powerfmt" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" + [[package]] name = "ppv-lite86" version = "0.2.21" @@ -2001,6 +2088,26 @@ dependencies = [ "subtle", ] +[[package]] +name = "ring" +version = "0.17.14" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7" +dependencies = [ + "cc", + "cfg-if", + "getrandom 0.2.16", + "libc", + "untrusted", + "windows-sys 0.52.0", +] + +[[package]] +name = "route-recognizer" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "afab94fb28594581f62d981211a9a4d53cc8130bbcbbb89a0440d9b8e81a7746" + [[package]] name = "rustc-demangle" version = "0.1.26" @@ -2088,12 +2195,15 @@ dependencies = [ name = "self-app" version = "0.1.0" dependencies = [ + "js-sys", "self-components", "serde", "serde_json", "wasm-bindgen", + "wasm-bindgen-futures", "web-sys", "yew", + "yew-router", ] [[package]] @@ -2108,8 +2218,10 @@ dependencies = [ "hex", "js-sys", "k256", + "pbkdf2", "rand", "serde", + "serde-wasm-bindgen 0.6.5", "serde_json", "sha2", "wasm-bindgen", @@ -2125,8 +2237,10 @@ dependencies = [ "anyhow", "async-stream", "axum", + "base64", "clap", "futures-util", + "jsonwebtoken", "lettre", "serde", "serde_json", @@ -2272,6 +2386,18 @@ dependencies = [ "rand_core", ] +[[package]] +name = "simple_asn1" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "297f631f50729c8c99b84667867963997ec0b50f32b2a7dbcab828ef0541e8bb" +dependencies = [ + "num-bigint", + "num-traits", + "thiserror 2.0.16", + "time", +] + [[package]] name = "slab" version = "0.4.11" @@ -2392,7 +2518,16 @@ version = "1.0.69" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52" dependencies = [ - "thiserror-impl", + "thiserror-impl 1.0.69", +] + +[[package]] +name = "thiserror" +version = "2.0.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0" +dependencies = [ + "thiserror-impl 2.0.16", ] [[package]] @@ -2406,6 +2541,17 @@ dependencies = [ "syn 2.0.106", ] +[[package]] +name = "thiserror-impl" +version = "2.0.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.106", +] + [[package]] name = "thread_local" version = "1.1.9" @@ -2415,6 +2561,37 @@ dependencies = [ "cfg-if", ] +[[package]] +name = "time" +version = "0.3.44" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d" +dependencies = [ + "deranged", + "itoa", + "num-conv", + "powerfmt", + "serde", + "time-core", + "time-macros", +] + +[[package]] +name = "time-core" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b" + +[[package]] +name = "time-macros" +version = "0.2.24" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3" +dependencies = [ + "num-conv", + "time-core", +] + [[package]] name = "tinystr" version = "0.8.1" @@ -2648,6 +2825,12 @@ dependencies = [ "subtle", ] +[[package]] +name = "untrusted" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" + [[package]] name = "url" version = "2.5.7" @@ -2660,6 +2843,12 @@ dependencies = [ "serde", ] +[[package]] +name = "urlencoding" +version = "2.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" + [[package]] name = "utf8_iter" version = "1.0.4" @@ -3021,7 +3210,7 @@ dependencies = [ "rustversion", "serde", "slab", - "thiserror", + "thiserror 1.0.69", "tokio", "tracing", "wasm-bindgen", @@ -3045,6 +3234,36 @@ dependencies = [ "syn 2.0.106", ] +[[package]] +name = "yew-router" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ca1d5052c96e6762b4d6209a8aded597758d442e6c479995faf0c7b5538e0c6" +dependencies = [ + "gloo 0.10.0", + "js-sys", + "route-recognizer", + "serde", + "serde_urlencoded", + "tracing", + "urlencoding", + "wasm-bindgen", + "web-sys", + "yew", + "yew-router-macro", +] + +[[package]] +name = "yew-router-macro" +version = "0.18.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42bfd190a07ca8cfde7cd4c52b3ac463803dc07323db8c34daa697e86365978c" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.106", +] + [[package]] name = "yoke" version = "0.8.0" diff --git a/README.md b/README.md index 0d86d00..d7f3abe 100644 --- a/README.md +++ b/README.md @@ -1,180 +1,266 @@ -# Self - Sovereign Entity Local Framework +# Self - Sovereign Digital Identity -A peer-to-peer identity solution providing self-sovereign identity management tools and widgets. Built with Yew WASM for client-side functionality and Rust backend for email verification. +A comprehensive self-sovereign identity system that puts users in complete control of their digital identity. Built with Rust and WebAssembly, Self provides cryptographic authentication without passwords, secure key management, and OAuth-compatible identity services. -## Architecture +## 🎯 Vision -- **Components**: Reusable Yew components for identity management (registration, login, etc.) -- **App**: Reference implementation using the components -- **Server**: Backend for email verification and registration endpoints +Self enables true digital sovereignty by eliminating dependence on centralized identity providers. Users generate and control their own cryptographic keys, authenticate using digital signatures, and maintain complete ownership of their identity data. -## Features +## ✨ Key Features -### Registration Component +### πŸ” Self-Sovereign Identity +- **User-Controlled Keys**: Generate and manage your own cryptographic key pairs +- **No Central Authority**: No single point of failure or control +- **Cryptographic Authentication**: Authenticate using digital signatures, not passwords +- **Zero-Knowledge Architecture**: Private keys never leave your device unencrypted -- **Identity Collection**: Name and email input with validation -- **Email Verification**: Server-sent events for real-time verification status -- **Private Key Generation**: Secure secp256k1 key pair generation -- **Client-side Encryption**: AES-256-GCM encryption of private keys with user password -- **Key Confirmation**: Requires user to copy and paste private key to confirm backup -- **Single-page Flow**: Progressive multi-step form without page navigation +### πŸ›‘οΈ Advanced Security +- **AES-256-GCM Encryption**: Military-grade encryption for private key storage +- **PBKDF2 Key Derivation**: 10,000+ iterations prevent brute force attacks +- **Client-Side Cryptography**: All sensitive operations performed locally +- **Secure Vault System**: Manage multiple encrypted identities -### Security Features +### 🌐 Standards Compliance +- **OAuth 2.0 Compatible**: Standard token-based authentication +- **OpenID Connect Ready**: Compatible with existing identity infrastructure +- **JWT Tokens**: Industry-standard session management +- **RESTful API**: Clean, documented endpoints -- Private keys generated and encrypted entirely client-side -- Password-based key derivation with salt and key stretching -- Secure key confirmation process prevents accidental loss -- No private keys transmitted to server +### πŸ”§ Developer-Friendly +- **Reusable Components**: Drop-in Yew components for any application +- **Comprehensive API**: Well-documented server endpoints +- **Multiple Deployment Options**: Docker, cloud-native, or bare metal +- **Extensive Documentation**: Complete guides for integration and deployment -## Quick Start +## πŸš€ Quick Start ### Prerequisites -- Rust (latest stable) -- `trunk` for WASM building: `cargo install trunk` -- `wasm32-unknown-unknown` target: `rustup target add wasm32-unknown-unknown` +```bash +# Install Rust +curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh + +# Add WASM target and install Trunk +rustup target add wasm32-unknown-unknown +cargo install trunk +``` ### Running the Application -1. **Start the backend server:** +1. **Clone and setup:** + ```bash + git clone + cd self + ``` + +2. **Start the backend server:** ```bash cd server - # Default port (8080) cargo run - - # Custom port - cargo run -- --port 9001 + # Server runs on http://localhost:8080 ``` -2. **Start the frontend app:** +3. **Start the frontend (in another terminal):** ```bash cd app - # Default configuration (server: localhost:8080, port: 8000) ./serve.sh - - # Custom server URL - ./serve.sh --server-url http://localhost:9001 - - # Custom frontend port - ./serve.sh --port 8001 - - # Both custom server and port - ./serve.sh --server-url http://localhost:9001 --port 8001 - - # Using environment variables - SELF_SERVER_URL=http://localhost:9001 ./serve.sh + # Frontend runs on http://localhost:8000 ``` -3. **Open your browser** to the displayed frontend URL +4. **Try the demo:** + - Open http://localhost:8000 in your browser + - Register a new identity with email verification + - Generate and securely store your cryptographic keys + - Experience passwordless authentication -### Email Verification Flow +### Core Workflows -1. Enter name and email, proceed to verification step -2. Click "Send Verification" - check server console for verification link -3. Click the verification link in a new tab -4. The registration form will automatically update when verified -5. Continue with key generation +#### πŸ†” Identity Registration +1. **Email Verification**: Enter email β†’ receive verification link β†’ confirm +2. **Key Generation**: Generate secp256k1 key pair locally +3. **Secure Storage**: Encrypt private key with password β†’ store in browser +4. **Backup Confirmation**: Copy private key for safe keeping +5. **Complete Registration**: Submit public key and profile to server -### Key Generation Flow +#### πŸ”‘ Authentication +1. **Identity Selection**: Choose from stored identities in vault +2. **Key Decryption**: Enter password to decrypt private key +3. **Challenge Response**: Sign server challenge with private key +4. **Session Establishment**: Receive JWT token for authenticated session +5. **Identity Access**: Access identity information and services -1. Click "Generate Keys" to create a new key pair -2. Enter and confirm an encryption password (minimum 8 characters) -3. Copy the private key using the "Copy" button -4. Proceed to confirmation step -5. Paste the private key to confirm you saved it -6. Complete registration +## πŸ—οΈ Architecture -## Development +### System Components + +``` +β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” +β”‚ Client (Browser) β”‚ +β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ +β”‚ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ +β”‚ β”‚ Registration β”‚ β”‚ Login β”‚ β”‚ Identity β”‚ β”‚ +β”‚ β”‚ Component β”‚ β”‚ Component β”‚ β”‚ Component β”‚ β”‚ +β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β”‚ +β”‚ β”‚ β”‚ +β”‚ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ +β”‚ β”‚ Vault Manager β”‚ β”‚ Crypto β”‚ β”‚ Sign β”‚ β”‚ +β”‚ β”‚ Component β”‚ β”‚ Utilities β”‚ β”‚ Component β”‚ β”‚ +β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β”‚ +β”‚ β”‚ β”‚ +β”‚ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ +β”‚ β”‚ Local Storage (Encrypted) β”‚ β”‚ +β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β”‚ +β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ + β”‚ + HTTPS/WSS + β”‚ +β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” +β”‚ Identity Server β”‚ +β”œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€ +β”‚ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β” β”‚ +β”‚ β”‚ Email Verificationβ”‚ β”‚ OAuth Endpoints β”‚ β”‚ User Management β”‚ β”‚ +β”‚ β”‚ β€’ SSE Stream β”‚ β”‚ β€’ /oauth/token β”‚ β”‚ β€’ Registrationβ”‚ β”‚ +β”‚ β”‚ β€’ Verify Link β”‚ β”‚ β€’ /oauth/userinfoβ”‚ β”‚ β€’ User Store β”‚ β”‚ +β”‚ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ β”‚ +β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜ +``` ### Project Structure ``` self/ -β”œβ”€β”€ components/ # Reusable Yew components +β”œβ”€β”€ components/ # 🧩 Reusable Yew Components β”‚ β”œβ”€β”€ src/ -β”‚ β”‚ β”œβ”€β”€ registration.rs # Main registration component -β”‚ β”‚ β”œβ”€β”€ crypto.rs # Cryptographic utilities -β”‚ β”‚ └── lib.rs # Component exports +β”‚ β”‚ β”œβ”€β”€ registration.rs # User registration flow +β”‚ β”‚ β”œβ”€β”€ login.rs # Authentication component +β”‚ β”‚ β”œβ”€β”€ identity.rs # Identity management +β”‚ β”‚ β”œβ”€β”€ vault_manager.rs # Multi-key vault system +β”‚ β”‚ β”œβ”€β”€ vault.rs # Secure key storage +β”‚ β”‚ β”œβ”€β”€ crypto.rs # Cryptographic utilities +β”‚ β”‚ β”œβ”€β”€ sign.rs # Digital signing +β”‚ β”‚ └── lib.rs # Component exports β”‚ └── Cargo.toml -β”œβ”€β”€ app/ # Reference application -β”‚ β”œβ”€β”€ src/lib.rs # App implementation -β”‚ β”œβ”€β”€ index.html # HTML template with Bootstrap -β”‚ β”œβ”€β”€ Trunk.toml # Trunk configuration +β”œβ”€β”€ app/ # πŸ–₯️ Reference Application +β”‚ β”œβ”€β”€ src/lib.rs # Demo app implementation +β”‚ β”œβ”€β”€ index.html # HTML template +β”‚ β”œβ”€β”€ serve.sh # Development server β”‚ └── Cargo.toml -β”œβ”€β”€ server/ # Backend server -β”‚ β”œβ”€β”€ src/main.rs # Axum server with SSE support +β”œβ”€β”€ server/ # 🌐 Identity Server +β”‚ β”œβ”€β”€ src/main.rs # Axum server with OAuth endpoints β”‚ └── Cargo.toml -└── Cargo.toml # Workspace configuration +β”œβ”€β”€ docs/ # πŸ“š Comprehensive Documentation +β”‚ β”œβ”€β”€ architecture.md # System design and components +β”‚ β”œβ”€β”€ authentication-flows.md # Auth workflows and security +β”‚ β”œβ”€β”€ server-api.md # API documentation +β”‚ β”œβ”€β”€ cryptography.md # Crypto implementation details +β”‚ β”œβ”€β”€ vault-system.md # Key management system +β”‚ β”œβ”€β”€ openid-compliance.md # OAuth/OIDC compatibility +β”‚ β”œβ”€β”€ security-model.md # Security analysis and threats +β”‚ β”œβ”€β”€ deployment.md # Production deployment guide +β”‚ └── development.md # Development setup and workflow +└── Cargo.toml # Workspace configuration ``` -### Using the Registration Component +## πŸ“š Documentation + +### Complete Documentation Suite + +- **[Architecture Guide](docs/architecture.md)** - System design, components, and data flow +- **[Authentication Flows](docs/authentication-flows.md)** - Registration, login, and session management +- **[Server API](docs/server-api.md)** - Complete API reference with examples +- **[Cryptography](docs/cryptography.md)** - Detailed crypto implementation and security +- **[Vault System](docs/vault-system.md)** - Multi-key storage and management +- **[OpenID Compliance](docs/openid-compliance.md)** - OAuth 2.0 and OIDC compatibility +- **[Security Model](docs/security-model.md)** - Threat analysis and security controls +- **[Deployment Guide](docs/deployment.md)** - Production deployment and operations +- **[Development Guide](docs/development.md)** - Setup, workflow, and contribution guidelines + +### Quick Integration ```rust -use self_components::{Registration, RegistrationConfig}; - -let config = RegistrationConfig { - server_url: "http://localhost:8080".to_string(), - app_name: "My App".to_string(), -}; - -let on_complete = Callback::from(|(email, public_key): (String, String)| { - // Handle successful registration - console::log!("User registered: {} with key: {}", email, public_key); -}); +// Add Self components to your Yew application +use self_components::{Registration, Login, Identity, VaultManager}; +// Registration flow html! { +} + +// Authentication flow +html! { + } ``` -### API Endpoints +## πŸ” Security Features -- `POST /api/send-verification` - Send email verification -- `GET /api/verification-status/{email}` - SSE stream for verification status -- `GET /api/verify/{token}` - Email verification callback -- `POST /api/register` - Complete user registration -- `GET /health` - Health check +### Cryptographic Foundation +- **Secp256k1 Keys**: Bitcoin/Ethereum-compatible elliptic curve cryptography +- **AES-256-GCM**: Authenticated encryption for private key storage +- **PBKDF2**: 10,000+ iterations for password-based key derivation +- **Secure Random**: Cryptographically secure random number generation -### Configuration Options +### Zero-Knowledge Architecture +- **Client-Side Operations**: All crypto operations in browser +- **No Server Secrets**: Server never sees private keys or passwords +- **Encrypted Storage**: Only encrypted data stored in localStorage +- **Minimal Data**: Server stores only public keys and basic profile -**Backend Server:** -- Command line: `cargo run -- --port 9001` -- Default port: 8080 +### Standards Compliance +- **OAuth 2.0**: Standard token-based authentication +- **OpenID Connect**: Compatible user info endpoint +- **JWT Tokens**: Industry-standard session management +- **HTTPS Only**: All communications encrypted in transit -**Frontend App:** -- Command line: `./serve.sh --server-url http://localhost:9001 --port 8001` -- Environment variables: `SELF_SERVER_URL`, `SELF_PORT` -- Defaults: server `http://localhost:8080`, port `8000` +## πŸš€ Production Ready -**Registration Component:** -The registration component accepts a `RegistrationConfig` with: -- `server_url`: Backend server URL (configured via build-time environment variable) -- `app_name`: Application name for branding +### Deployment Options +- **Docker**: Complete containerized deployment +- **Kubernetes**: Cloud-native scaling and orchestration +- **Bare Metal**: Direct server deployment +- **Cloud Platforms**: AWS, GCP, Azure compatible -The component emits completion events with `(email, public_key)` tuple for integration with your application. +### Monitoring & Operations +- **Health Checks**: Built-in health monitoring endpoints +- **Structured Logging**: JSON-formatted logs with tracing +- **Metrics**: Prometheus-compatible metrics collection +- **Security Monitoring**: Comprehensive audit logging -## Security Considerations +### Scalability +- **Stateless Design**: Horizontal scaling support +- **Database Agnostic**: PostgreSQL, MySQL, or in-memory storage +- **Load Balancer Ready**: Multiple instance support +- **CDN Compatible**: Static asset optimization -- Private keys are generated using cryptographically secure random number generation -- Keys are encrypted client-side before any storage -- Password-based key derivation uses PBKDF2-like key stretching -- No sensitive data is transmitted to the server except public keys -- Email verification prevents unauthorized registrations +## 🀝 Contributing -## Production Deployment +Self is open source and welcomes contributions! See our [Development Guide](docs/development.md) for: -For production use: +- Development environment setup +- Code style guidelines +- Testing strategies +- Pull request process +- Release procedures -1. **Replace mock email sending** in server with actual SMTP integration -2. **Add database storage** for user data and verification states -3. **Implement proper secp256k1** key generation (current implementation is simplified) -4. **Add rate limiting** for verification requests -5. **Use HTTPS** for all communications -6. **Configure CORS** appropriately for your domain +## πŸ“„ License -## License +This project is part of the Hero Code ecosystem for decentralized identity management. -This project is part of the Hero Code ecosystem for decentralized identity management. \ No newline at end of file +--- + +**Ready to take control of your digital identity?** Start with our [Quick Start](#-quick-start) guide or dive deep into the [Architecture Documentation](docs/architecture.md). \ No newline at end of file diff --git a/app/Cargo.toml b/app/Cargo.toml index 21fb37d..6b961a4 100644 --- a/app/Cargo.toml +++ b/app/Cargo.toml @@ -9,7 +9,10 @@ crate-type = ["cdylib"] [dependencies] self-components = { path = "../components" } yew = { workspace = true, features = ["csr"] } +yew-router = "0.18" wasm-bindgen = { workspace = true } +wasm-bindgen-futures = { workspace = true } web-sys = { workspace = true } +js-sys = { workspace = true } serde = { workspace = true } serde_json = { workspace = true } diff --git a/app/dist/index.html b/app/dist/index.html index 634fb5a..a63a8a7 100644 --- a/app/dist/index.html +++ b/app/dist/index.html @@ -105,7 +105,7 @@ transition: width 0.6s ease; } - +
@@ -113,8 +113,8 @@