-- | The root filetype
module Hackage.Security.TUF.Root (
    -- * Datatypes
    Root(..)
  , RootRoles(..)
  , RoleSpec(..)
  ) where

import MyPrelude
import Hackage.Security.JSON
import Hackage.Security.Key
import Hackage.Security.Key.Env (KeyEnv)
import Hackage.Security.TUF.Common
import Hackage.Security.TUF.Header
import Hackage.Security.TUF.Mirrors
import Hackage.Security.TUF.Signed
import Hackage.Security.TUF.Snapshot
import Hackage.Security.TUF.Targets
import Hackage.Security.TUF.Timestamp
import Hackage.Security.Util.Some

{-------------------------------------------------------------------------------
  Datatypes
-------------------------------------------------------------------------------}

-- | The root metadata
--
-- NOTE: We must have the invariant that ALL keys (apart from delegation keys)
-- must be listed in 'rootKeys'. (Delegation keys satisfy a similar invariant,
-- see Targets.)
data Root = Root {
    Root -> FileVersion
rootVersion :: FileVersion
  , Root -> FileExpires
rootExpires :: FileExpires
  , Root -> KeyEnv
rootKeys    :: KeyEnv
  , Root -> RootRoles
rootRoles   :: RootRoles
  }

data RootRoles = RootRoles {
    RootRoles -> RoleSpec Root
rootRolesRoot      :: RoleSpec Root
  , RootRoles -> RoleSpec Snapshot
rootRolesSnapshot  :: RoleSpec Snapshot
  , RootRoles -> RoleSpec Targets
rootRolesTargets   :: RoleSpec Targets
  , RootRoles -> RoleSpec Timestamp
rootRolesTimestamp :: RoleSpec Timestamp
  , RootRoles -> RoleSpec Mirrors
rootRolesMirrors   :: RoleSpec Mirrors
  }

-- | Role specification
--
-- The phantom type indicates what kind of type this role is meant to verify.
data RoleSpec a = RoleSpec {
    RoleSpec a -> [Some PublicKey]
roleSpecKeys      :: [Some PublicKey]
  , RoleSpec a -> KeyThreshold
roleSpecThreshold :: KeyThreshold
  }
  deriving (Int -> RoleSpec a -> ShowS
[RoleSpec a] -> ShowS
RoleSpec a -> String
(Int -> RoleSpec a -> ShowS)
-> (RoleSpec a -> String)
-> ([RoleSpec a] -> ShowS)
-> Show (RoleSpec a)
forall a. Int -> RoleSpec a -> ShowS
forall a. [RoleSpec a] -> ShowS
forall a. RoleSpec a -> String
forall a.
(Int -> a -> ShowS) -> (a -> String) -> ([a] -> ShowS) -> Show a
showList :: [RoleSpec a] -> ShowS
$cshowList :: forall a. [RoleSpec a] -> ShowS
show :: RoleSpec a -> String
$cshow :: forall a. RoleSpec a -> String
showsPrec :: Int -> RoleSpec a -> ShowS
$cshowsPrec :: forall a. Int -> RoleSpec a -> ShowS
Show)

instance HasHeader Root where
  fileVersion :: LensLike f Root Root FileVersion FileVersion
fileVersion FileVersion -> f FileVersion
f Root
x = (\FileVersion
y -> Root
x { rootVersion :: FileVersion
rootVersion = FileVersion
y }) (FileVersion -> Root) -> f FileVersion -> f Root
forall (f :: * -> *) a b. Functor f => (a -> b) -> f a -> f b
<$> FileVersion -> f FileVersion
f (Root -> FileVersion
rootVersion Root
x)
  fileExpires :: LensLike f Root Root FileExpires FileExpires
fileExpires FileExpires -> f FileExpires
f Root
x = (\FileExpires
y -> Root
x { rootExpires :: FileExpires
rootExpires = FileExpires
y }) (FileExpires -> Root) -> f FileExpires -> f Root
forall (f :: * -> *) a b. Functor f => (a -> b) -> f a -> f b
<$> FileExpires -> f FileExpires
f (Root -> FileExpires
rootExpires Root
x)

{-------------------------------------------------------------------------------
  JSON encoding
-------------------------------------------------------------------------------}

instance Monad m => ToJSON m RootRoles where
  toJSON :: RootRoles -> m JSValue
toJSON RootRoles{RoleSpec Mirrors
RoleSpec Timestamp
RoleSpec Targets
RoleSpec Snapshot
RoleSpec Root
rootRolesMirrors :: RoleSpec Mirrors
rootRolesTimestamp :: RoleSpec Timestamp
rootRolesTargets :: RoleSpec Targets
rootRolesSnapshot :: RoleSpec Snapshot
rootRolesRoot :: RoleSpec Root
rootRolesMirrors :: RootRoles -> RoleSpec Mirrors
rootRolesTimestamp :: RootRoles -> RoleSpec Timestamp
rootRolesTargets :: RootRoles -> RoleSpec Targets
rootRolesSnapshot :: RootRoles -> RoleSpec Snapshot
rootRolesRoot :: RootRoles -> RoleSpec Root
..} = [(String, m JSValue)] -> m JSValue
forall (m :: * -> *). Monad m => [(String, m JSValue)] -> m JSValue
mkObject [
      (String
"root"      , RoleSpec Root -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON RoleSpec Root
rootRolesRoot)
    , (String
"snapshot"  , RoleSpec Snapshot -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON RoleSpec Snapshot
rootRolesSnapshot)
    , (String
"targets"   , RoleSpec Targets -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON RoleSpec Targets
rootRolesTargets)
    , (String
"timestamp" , RoleSpec Timestamp -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON RoleSpec Timestamp
rootRolesTimestamp)
    , (String
"mirrors"   , RoleSpec Mirrors -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON RoleSpec Mirrors
rootRolesMirrors)
    ]

instance MonadKeys m => FromJSON m RootRoles where
  fromJSON :: JSValue -> m RootRoles
fromJSON JSValue
enc = do
    RoleSpec Root
rootRolesRoot      <- JSValue -> String -> m (RoleSpec Root)
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"root"
    RoleSpec Snapshot
rootRolesSnapshot  <- JSValue -> String -> m (RoleSpec Snapshot)
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"snapshot"
    RoleSpec Targets
rootRolesTargets   <- JSValue -> String -> m (RoleSpec Targets)
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"targets"
    RoleSpec Timestamp
rootRolesTimestamp <- JSValue -> String -> m (RoleSpec Timestamp)
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"timestamp"
    RoleSpec Mirrors
rootRolesMirrors   <- JSValue -> String -> m (RoleSpec Mirrors)
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"mirrors"
    RootRoles -> m RootRoles
forall (m :: * -> *) a. Monad m => a -> m a
return RootRoles :: RoleSpec Root
-> RoleSpec Snapshot
-> RoleSpec Targets
-> RoleSpec Timestamp
-> RoleSpec Mirrors
-> RootRoles
RootRoles{RoleSpec Mirrors
RoleSpec Timestamp
RoleSpec Targets
RoleSpec Snapshot
RoleSpec Root
rootRolesMirrors :: RoleSpec Mirrors
rootRolesTimestamp :: RoleSpec Timestamp
rootRolesTargets :: RoleSpec Targets
rootRolesSnapshot :: RoleSpec Snapshot
rootRolesRoot :: RoleSpec Root
rootRolesMirrors :: RoleSpec Mirrors
rootRolesTimestamp :: RoleSpec Timestamp
rootRolesTargets :: RoleSpec Targets
rootRolesSnapshot :: RoleSpec Snapshot
rootRolesRoot :: RoleSpec Root
..}

instance Monad m => ToJSON m Root where
  toJSON :: Root -> m JSValue
toJSON Root{KeyEnv
FileExpires
FileVersion
RootRoles
rootRoles :: RootRoles
rootKeys :: KeyEnv
rootExpires :: FileExpires
rootVersion :: FileVersion
rootRoles :: Root -> RootRoles
rootKeys :: Root -> KeyEnv
rootExpires :: Root -> FileExpires
rootVersion :: Root -> FileVersion
..} = [(String, m JSValue)] -> m JSValue
forall (m :: * -> *). Monad m => [(String, m JSValue)] -> m JSValue
mkObject [
         (String
"_type"   , JSValue -> m JSValue
forall (m :: * -> *) a. Monad m => a -> m a
return (JSValue -> m JSValue) -> JSValue -> m JSValue
forall a b. (a -> b) -> a -> b
$ String -> JSValue
JSString String
"Root")
       , (String
"version" , FileVersion -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON FileVersion
rootVersion)
       , (String
"expires" , FileExpires -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON FileExpires
rootExpires)
       , (String
"keys"    , KeyEnv -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON KeyEnv
rootKeys)
       , (String
"roles"   , RootRoles -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON RootRoles
rootRoles)
       ]

instance Monad m => ToJSON m (RoleSpec a) where
  toJSON :: RoleSpec a -> m JSValue
toJSON RoleSpec{[Some PublicKey]
KeyThreshold
roleSpecThreshold :: KeyThreshold
roleSpecKeys :: [Some PublicKey]
roleSpecThreshold :: forall a. RoleSpec a -> KeyThreshold
roleSpecKeys :: forall a. RoleSpec a -> [Some PublicKey]
..} = [(String, m JSValue)] -> m JSValue
forall (m :: * -> *). Monad m => [(String, m JSValue)] -> m JSValue
mkObject [
        (String
"keyids"    , JSValue -> m JSValue
forall (m :: * -> *) a. Monad m => a -> m a
return (JSValue -> m JSValue)
-> ([Some PublicKey] -> JSValue) -> [Some PublicKey] -> m JSValue
forall b c a. (b -> c) -> (a -> b) -> a -> c
. [JSValue] -> JSValue
JSArray ([JSValue] -> JSValue)
-> ([Some PublicKey] -> [JSValue]) -> [Some PublicKey] -> JSValue
forall b c a. (b -> c) -> (a -> b) -> a -> c
. (Some PublicKey -> JSValue) -> [Some PublicKey] -> [JSValue]
forall a b. (a -> b) -> [a] -> [b]
map Some PublicKey -> JSValue
writeKeyAsId ([Some PublicKey] -> m JSValue) -> [Some PublicKey] -> m JSValue
forall a b. (a -> b) -> a -> b
$ [Some PublicKey]
roleSpecKeys)
      , (String
"threshold" , KeyThreshold -> m JSValue
forall (m :: * -> *) a. ToJSON m a => a -> m JSValue
toJSON KeyThreshold
roleSpecThreshold)
      ]

-- | We give an instance for Signed Root rather than Root because the key
-- environment from the root data is necessary to resolve the explicit sharing
-- in the signatures.
instance MonadKeys m => FromJSON m (Signed Root) where
  fromJSON :: JSValue -> m (Signed Root)
fromJSON JSValue
envelope = do
    JSValue
enc      <- JSValue -> String -> m JSValue
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
envelope String
"signed"
    KeyEnv
rootKeys <- JSValue -> String -> m KeyEnv
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc      String
"keys"
    KeyEnv -> m (Signed Root) -> m (Signed Root)
forall (m :: * -> *) a. MonadKeys m => KeyEnv -> m a -> m a
withKeys KeyEnv
rootKeys (m (Signed Root) -> m (Signed Root))
-> m (Signed Root) -> m (Signed Root)
forall a b. (a -> b) -> a -> b
$ do
      JSValue -> String -> m ()
forall (m :: * -> *).
(ReportSchemaErrors m, MonadError DeserializationError m) =>
JSValue -> String -> m ()
verifyType JSValue
enc String
"Root"
      FileVersion
rootVersion <- JSValue -> String -> m FileVersion
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"version"
      FileExpires
rootExpires <- JSValue -> String -> m FileExpires
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"expires"
      RootRoles
rootRoles   <- JSValue -> String -> m RootRoles
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"roles"
      let signed :: Root
signed = Root :: FileVersion -> FileExpires -> KeyEnv -> RootRoles -> Root
Root{KeyEnv
FileExpires
FileVersion
RootRoles
rootRoles :: RootRoles
rootExpires :: FileExpires
rootVersion :: FileVersion
rootKeys :: KeyEnv
rootRoles :: RootRoles
rootKeys :: KeyEnv
rootExpires :: FileExpires
rootVersion :: FileVersion
..}

      Signatures
signatures <- JSValue -> String -> m Signatures
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
envelope String
"signatures"
      String -> Bool -> m ()
forall (m :: * -> *).
MonadError DeserializationError m =>
String -> Bool -> m ()
validate String
"signatures" (Bool -> m ()) -> Bool -> m ()
forall a b. (a -> b) -> a -> b
$ JSValue -> Signatures -> Bool
verifySignatures JSValue
enc Signatures
signatures
      Signed Root -> m (Signed Root)
forall (m :: * -> *) a. Monad m => a -> m a
return Signed :: forall a. a -> Signatures -> Signed a
Signed{Signatures
Root
signatures :: Signatures
signed :: Root
signatures :: Signatures
signed :: Root
..}

instance MonadKeys m => FromJSON m (RoleSpec a) where
  fromJSON :: JSValue -> m (RoleSpec a)
fromJSON JSValue
enc = do
    [Some PublicKey]
roleSpecKeys      <- (JSValue -> m (Some PublicKey)) -> [JSValue] -> m [Some PublicKey]
forall (t :: * -> *) (m :: * -> *) a b.
(Traversable t, Monad m) =>
(a -> m b) -> t a -> m (t b)
mapM JSValue -> m (Some PublicKey)
forall (m :: * -> *). MonadKeys m => JSValue -> m (Some PublicKey)
readKeyAsId ([JSValue] -> m [Some PublicKey])
-> m [JSValue] -> m [Some PublicKey]
forall (m :: * -> *) a b. Monad m => (a -> m b) -> m a -> m b
=<< JSValue -> String -> m [JSValue]
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"keyids"
    KeyThreshold
roleSpecThreshold <- JSValue -> String -> m KeyThreshold
forall (m :: * -> *) a.
(ReportSchemaErrors m, FromJSON m a) =>
JSValue -> String -> m a
fromJSField JSValue
enc String
"threshold"
    RoleSpec a -> m (RoleSpec a)
forall (m :: * -> *) a. Monad m => a -> m a
return RoleSpec :: forall a. [Some PublicKey] -> KeyThreshold -> RoleSpec a
RoleSpec{[Some PublicKey]
KeyThreshold
roleSpecThreshold :: KeyThreshold
roleSpecKeys :: [Some PublicKey]
roleSpecThreshold :: KeyThreshold
roleSpecKeys :: [Some PublicKey]
..}