rpc_auth.go

package waved

import (
	"fmt"

	"github.com/lightninglabs/wavelength/rpc/swapclientrpc"
	"github.com/lightninglabs/wavelength/rpc/wavewalletrpc"
	"github.com/lightninglabs/wavelength/waverpc"
	"google.golang.org/grpc"
	"gopkg.in/macaroon-bakery.v2/bakery"
)

// wavedMacaroonLocation is the "Location" field stamped into every macaroon
// the daemon bakes. It identifies the issuing daemon, not a permission scope.
const wavedMacaroonLocation = "waved"

// Macaroon entities slice the daemon's RPC surface into logical domains. Each
// method requires one or more (entity, action) pairs, so operators can mint
// least-privilege macaroons scoped to a single domain — read-only fee data, a
// swap-only token — instead of the all-or-nothing token a single entity would
// force. Modeled on lnd's per-entity permission map.
const (
	// entityInfo covers daemon and wallet status plus the seed/unlock
	// lifecycle.
	entityInfo = "info"

	// entityVTXO covers VTXO inventory, in-round sends, refreshes, and
	// forfeit signing.
	entityVTXO = "vtxo"

	// entityAddress covers receive scripts, addresses, and receive-auth
	// key material.
	entityAddress = "address"

	// entityOnChain covers boarding, on-chain sends, sweeps, and
	// unilateral exit.
	entityOnChain = "onchain"

	// entityOOR covers out-of-round send sessions.
	entityOOR = "oor"

	// entityRound covers round participation and round queries.
	entityRound = "round"

	// entitySwap covers the swap subsystem.
	entitySwap = "swap"

	// entityRecovery covers vHTLC on-chain recovery jobs.
	entityRecovery = "recovery"

	// entityFees covers operator fee estimation and history.
	entityFees = "fees"

	// entityActivity covers the unified ledger, transaction history, and
	// activity inspection.
	entityActivity = "activity"
)

// wavedEntities is the full set of logical macaroon entities. The read-only
// macaroon grants read on each of them, and every method's required ops must
// name one of these entities.
var wavedEntities = []string{
	entityInfo,
	entityVTXO,
	entityAddress,
	entityOnChain,
	entityOOR,
	entityRound,
	entitySwap,
	entityRecovery,
	entityFees,
	entityActivity,
}

var wavedRPCPermissions = newWavedRPCPermissions()

// newWavedRPCPermissions returns the local daemon's explicit macaroon policy.
// Methods are grouped by logical entity and action so the taxonomy — which
// domain each call belongs to — is legible at a glance.
func newWavedRPCPermissions() map[string][]bakery.Op {
	permissions := make(map[string][]bakery.Op)

	// grant records that every listed method of service requires the given
	// action on entity. Each method gets its own fresh op slice so callers
	// never alias a shared backing array.
	grant := func(service, entity, action string, methods ...string) {
		for _, method := range methods {
			fullMethod := "/" + service + "/" + method
			permissions[fullMethod] = []bakery.Op{{
				Entity: entity,
				Action: action,
			}}
		}
	}

	daemon := waverpc.DaemonService_ServiceDesc.ServiceName
	grant(daemon, entityInfo, "read",
		"GetInfo", "GetBalance",
	)
	grant(
		daemon, entityInfo, "write", "GenSeed", "InitWallet",
		"UnlockWallet",
	)
	grant(
		daemon, entityVTXO, "read", "ListVTXOs",
		"GetIndexedVTXOByPkScript", "GetVTXOExpiryInfo",
		"ListPendingForfeitParticipantSignatureRequests",
	)
	grant(
		daemon, entityVTXO, "write", "SendVTXO", "SignVTXOForfeit",
		"RefreshVTXOs", "RefreshCustomVTXOs",
		"SubmitForfeitParticipantSignatures", "LeaveVTXOs",
	)
	grant(
		daemon, entityAddress, "write", "NewAddress",
		"NewReceiveScript", "ReceiveAuthKey", "SignReceiveAuthMessage",
		"SignReceiveAuthMessageCompact", "ReceiveAuthECDH",
	)
	grant(
		daemon, entitySwap, "write", "SignOutSwapHtlcAck",
		"SignCreditAccountAuthorization",
	)
	grant(
		daemon, entityOOR, "read", "GetIndexedOORSessionByTxid",
		"ListOORSessions", "GetOORSession",
	)
	grant(
		daemon, entityOOR, "write", "SendOOR", "PrepareOOR",
		"SignOORCustomInput",
	)
	grant(
		daemon, entityOnChain, "read", "ListBoardingSweeps",
		"GetUnrollStatus",
	)
	grant(
		daemon, entityOnChain, "write", "SendOnChain", "Board",
		"SweepBoardingUTXOs", "Unroll",
	)
	grant(
		daemon, entityRound, "read", "ListRounds", "GetRound",
		"WatchRounds",
	)
	grant(daemon, entityRound, "write",
		"JoinNextRound",
	)
	grant(daemon, entityFees, "read",
		"EstimateFee", "GetFeeHistory",
	)
	grant(daemon, entityActivity, "read",
		"ListTransactions",
	)
	grant(
		daemon, entityRecovery, "read", "GetVHTLCRecoveryStatus",
		"ListVHTLCRecoveries",
	)
	grant(
		daemon, entityRecovery, "write", "ArmVHTLCRecovery",
		"EscalateVHTLCRecovery", "CancelVHTLCRecovery",
	)

	swap := swapclientrpc.SwapClientService_ServiceDesc.ServiceName
	grant(
		swap, entitySwap, "read", "QuotePay", "ListSwaps", "GetSwap",
		"SubscribeSwaps", "ListCredits",
	)
	grant(
		swap, entitySwap, "write", "StartPay", "StartReceive",
		"ResumeSwap", "CreateCredit", "RedeemCredit",
	)

	wavewalletdk := wavewalletrpc.WalletService_ServiceDesc.ServiceName
	grant(
		wavewalletdk, entityInfo, "read", "Balance", "Status",
		"SubscribeWallet",
	)
	grant(wavewalletdk, entityInfo, "write",
		"Create", "Unlock",
	)
	grant(wavewalletdk, entityActivity, "read",
		"List",
	)
	grant(wavewalletdk, entityAddress, "write",
		"Recv",
	)
	grant(
		wavewalletdk, entityOnChain, "read", "GetExitPlan",
		"ExitStatus", "ExitSummary",
	)
	grant(
		wavewalletdk, entityOnChain, "write", "PrepareSend", "Send",
		"Deposit", "SweepWallet", "Exit",
	)

	inspect := wavewalletrpc.WalletInspectionService_ServiceDesc.ServiceName
	grant(inspect, entityActivity, "read",
		"InspectActivity",
	)

	grant("walletrpc.VersionService", entityInfo, "read",
		"Version",
	)
	grant(
		"walletrpc.WalletService", entityInfo, "read", "Ping",
		"Network",
	)
	grant(
		"walletrpc.WalletService", entityInfo, "write",
		"ChangePassphrase",
	)
	grant(
		"walletrpc.WalletService", entityActivity, "read",
		"GetTransactions", "TransactionNotifications",
	)
	grant(
		"walletrpc.WalletService", entityAddress, "write",
		"NextAddress",
	)
	grant(
		"walletrpc.WalletService", entityOnChain, "read",
		"AccountNumber", "Accounts", "Balance",
		"SpentnessNotifications", "AccountNotifications",
	)
	grant(
		"walletrpc.WalletService", entityOnChain, "write",
		"RenameAccount", "NextAccount", "ImportPrivateKey",
		"FundTransaction", "SignTransaction", "PublishTransaction",
	)

	return permissions
}

// wavedReadOnlyPermissions returns the read op for every logical entity. A
// macaroon baked with these ops can invoke every read method across the daemon
// surface but no mutating method — the daemon's equivalent of lnd's
// readonly.macaroon.
func wavedReadOnlyPermissions() []bakery.Op {
	ops := make([]bakery.Op, 0, len(wavedEntities))
	for _, entity := range wavedEntities {
		ops = append(ops, bakery.Op{
			Entity: entity,
			Action: "read",
		})
	}

	return ops
}

// registeredRPCPermissions maps every registered gRPC method to the macaroon
// permission it requires.
func registeredRPCPermissions(grpcServer *grpc.Server) (map[string][]bakery.Op,
	error) {

	info := grpcServer.GetServiceInfo()
	permissions := make(map[string][]bakery.Op)

	for serviceName, serviceInfo := range info {
		for _, method := range serviceInfo.Methods {
			fullMethod := "/" + serviceName + "/" + method.Name
			ops, ok := wavedRPCPermissions[fullMethod]
			if !ok {
				return nil, fmt.Errorf("no macaroon "+
					"permission registered for %s",
					fullMethod)
			}

			permissions[fullMethod] = append(
				[]bakery.Op(nil), ops...,
			)
		}
	}

	return permissions, nil
}