Hummingbird marketplace, protobufs, CLI client, library functions

BUILD.bazel

@@ -170,6 +170,8 @@ pkg_tar(
         "//dispatcher/cmd/dispatcher",
         "//gateway/cmd/gateway",
         "//hbird/cmd/hummingbird",
+        "//marketplace/cmd/marketplace",
+        "//marketplace_client",
         "//router/cmd/router",
         "//scion-pki/cmd/scion-pki",
         "//scion/cmd/scion",

MODULE.bazel

@@ -60,9 +60,11 @@ use_repo(
     "com_github_go_chi_chi_v5",
     "com_github_go_chi_cors",
     "com_github_go_viper_mapstructure_v2",
+    "com_github_golang_jwt_jwt",
     "com_github_golang_mock",
     "com_github_google_go_cmp",
     "com_github_gopacket_gopacket",
+    "com_github_gorilla_sessions",
     "com_github_grpc_ecosystem_go_grpc_middleware",
     "com_github_grpc_ecosystem_go_grpc_prometheus",
     "com_github_grpc_ecosystem_grpc_opentracing",

go.mod

@@ -61,6 +61,8 @@ require (
 	zgo.at/zcache/v2 v2.1.0
 )
 
+require github.com/gorilla/securecookie v1.1.2 // indirect
+
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.9-20250912141014-52f32327d4b0.1 // indirect
 	buf.build/go/protovalidate v1.0.0 // indirect
@@ -79,9 +81,11 @@ require (
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/golang-jwt/jwt v3.2.2+incompatible
 	github.com/google/cel-go v0.26.1 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/sessions v1.4.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect

go.sum

@@ -97,6 +97,8 @@ github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlnd
 github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
 github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
+github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
@@ -137,6 +139,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopacket/gopacket v1.3.1 h1:ZppWyLrOJNZPe5XkdjLbtuTkfQoxQ0xyMJzQCqtqaPU=
 github.com/gopacket/gopacket v1.3.1/go.mod h1:3I13qcqSpB2R9fFQg866OOgzylYkZxLTmkvcXhvf6qg=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
+github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=

marketplace/BUILD.bazel

@@ -0,0 +1,50 @@
+load("@rules_go//go:def.bzl", "go_library")
+load("//tools:go.bzl", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "account.go",
+        "auth.go",
+        "config.go",
+        "redeem.go",
+        "redemption_service.go",
+        "service.go",
+        "trust_db_wrapper.go",
+    ],
+    importpath = "github.com/scionproto/scion/marketplace",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//marketplace/db:go_default_library",
+        "//marketplace/storage:go_default_library",
+        "//pkg/addr:go_default_library",
+        "//pkg/hummingbird/registration:go_default_library",
+        "//pkg/log:go_default_library",
+        "//pkg/private/serrors:go_default_library",
+        "//pkg/proto/hummingbird:go_default_library",
+        "//pkg/scrypto/cppki:go_default_library",
+        "//pkg/slayers/path/hummingbird:go_default_library",
+        "//private/config:go_default_library",
+        "//private/env:go_default_library",
+        "//private/storage:go_default_library",
+        "//private/storage/trust:go_default_library",
+        "//private/trust:go_default_library",
+        "@com_connectrpc_connect//:go_default_library",
+        "@com_github_golang_jwt_jwt//:go_default_library",
+        "@org_golang_google_protobuf//types/known/timestamppb:go_default_library",
+        "@org_golang_x_crypto//bcrypt:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "export_test.go",
+        "redemption_service_test.go",
+    ],
+    embed = [":go_default_library"],
+    deps = [
+        "//marketplace/db:go_default_library",
+        "@com_github_stretchr_testify//assert:go_default_library",
+    ],
+)

marketplace/account.go

@@ -0,0 +1,198 @@
+// Copyright 2026 ETH Zurich
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package marketplace
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"connectrpc.com/connect"
+	"github.com/golang-jwt/jwt"
+	"github.com/scionproto/scion/marketplace/db"
+	"github.com/scionproto/scion/pkg/addr"
+	"github.com/scionproto/scion/pkg/hummingbird/registration"
+	"github.com/scionproto/scion/pkg/private/serrors"
+	"github.com/scionproto/scion/pkg/proto/hummingbird"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func AccountManagerInterceptor(verifier *TokenVerifier) connect.UnaryInterceptorFunc {
+	return func(next connect.UnaryFunc) connect.UnaryFunc {
+		return func(ctx context.Context, req connect.AnyRequest) (connect.AnyResponse, error) {
+			authority := req.Header().Get(":authority")
+			if authority == "" {
+				authority = req.Header().Get("host")
+			}
+
+			ctx = context.WithValue(ctx, "authority", authority)
+			authHeader := req.Header().Get("Authorization")
+			method := req.Spec().Procedure
+			fmt.Printf("AccountManagerInterceptor Interceptor for %s\n", method)
+			requiredScope, found := methodScopes[method]
+			if !found {
+				//no rules apply
+				fmt.Println("no rules apply for", method)
+				return next(ctx, req)
+			}
+			if strings.HasPrefix(authHeader, "Bearer ") {
+				tokenStr := strings.TrimPrefix(authHeader, "Bearer ")
+				if tokenStr != "" {
+					var err error
+					ctx, err = verifier.contextFromJwt(ctx, tokenStr, requiredScope)
+					if err != nil {
+						return nil, err
+					}
+				}
+			}
+			return next(ctx, req)
+		}
+	}
+}
+
+func (s *Service) CreateChallenge(ctx context.Context, req *connect.Request[hummingbird.CreateChallengeRequest]) (*connect.Response[hummingbird.CreateChallengeResponse], error) {
+	if s.registrationService == nil {
+		return nil, connect.NewError(connect.CodeUnimplemented, serrors.New("Registration not configured"))
+	}
+	challenge, err := s.registrationService.CreateChallenge(ctx, addr.IA(req.Msg.Ia))
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, err)
+	}
+	return &connect.Response[hummingbird.CreateChallengeResponse]{
+		Msg: challenge,
+	}, nil
+}
+
+func (s *Service) RegisterAS(ctx context.Context, req *connect.Request[hummingbird.RegisterASRequest]) (*connect.Response[hummingbird.RegisterASResponse], error) {
+	if s.registrationService == nil {
+		return nil, connect.NewError(connect.CodeUnimplemented, serrors.New("Registration not configured"))
+	}
+	authority, ok := ctx.Value("authority").(string)
+	if !ok || authority == "" {
+		return nil, connect.NewError(connect.CodeInvalidArgument, serrors.New("Request must provide HTTP Host or HTTP2 :authority header"))
+	}
+	fmt.Println("Register AS", "Authority", authority)
+	ia, err := s.registrationService.RegisterAS(ctx, req.Msg.Id, req.Msg.SignedChallenge, authority)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, err)
+	}
+	dbUser, err := s.store.GetASUser(ctx, ia)
+	if err != nil {
+		fmt.Println(err)
+
+		return nil, connect.NewError(connect.CodeInternal, err)
+	}
+	if dbUser == nil {
+		dbUser = &db.DBASUser{
+			IA:           ia,
+			TokenVersion: 0,
+		}
+		_, err = s.store.CreateASUser(ctx, dbUser)
+		if err != nil {
+			fmt.Println(err)
+			return nil, connect.NewError(connect.CodeInvalidArgument, err)
+		}
+	}
+	now := time.Now()
+	publisherToken, err := s.signer.GenerateToken(jwt.MapClaims{
+		"sub":   ia.String(),
+		"scope": registration.ScopeAssetPublisher,
+		"exp":   now.Add(time.Hour * 24 * 7).Unix(),
+		"iat":   now.Unix(),
+		"ver":   dbUser.TokenVersion,
+	})
+	if err != nil {
+		fmt.Println(err)
+		return nil, connect.NewError(connect.CodeInvalidArgument, err)
+	}
+	redemptionToken, err := s.signer.GenerateToken(jwt.MapClaims{
+		"sub":   ia.String(),
+		"scope": registration.ScopeRedemptionService,
+		"exp":   now.Add(time.Hour * 24 * 7).Unix(),
+		"iat":   now.Unix(),
+		"ver":   dbUser.TokenVersion,
+	})
+	if err != nil {
+		fmt.Println(err)
+		return nil, connect.NewError(connect.CodeInvalidArgument, err)
+	}
+	return &connect.Response[hummingbird.RegisterASResponse]{
+		Msg: &hummingbird.RegisterASResponse{
+			JwtPublisher:  publisherToken,
+			JwtRedemption: redemptionToken,
+		},
+	}, nil
+}
+
+func (s *Service) ResetJWT(ctx context.Context, req *connect.Request[hummingbird.JWTResetRequest]) (*connect.Response[hummingbird.JWTResetResponse], error) {
+	ver, ok := ctx.Value("ver").(int64)
+	if !ok {
+		return nil, connect.NewError(connect.CodeUnauthenticated, serrors.New("invalid token"))
+	}
+	v := ctx.Value("user")
+	switch x := v.(type) {
+	case nil:
+		return nil, connect.NewError(connect.CodeUnauthenticated, serrors.New("invalid token"))
+	case int64:
+		_, err := s.store.IncrementUserJWTVersion(ctx, x, ver)
+		if err != nil {
+			return nil, connect.NewError(connect.CodeFailedPrecondition, err)
+		}
+	case addr.IA:
+		_, err := s.store.IncrementASJWTVersion(ctx, x, ver)
+		if err != nil {
+			return nil, connect.NewError(connect.CodeFailedPrecondition, err)
+		}
+		kickRedemptionService := func() {
+			s.mtx.Lock()
+			defer s.mtx.Unlock()
+			peer, found := s.redemptionServerPeers[x]
+			if !found {
+				return
+			}
+			peer.mtx.Lock()
+			defer peer.mtx.Unlock()
+			if peer.cancelOldConnection != nil {
+				peer.cancelOldConnection()
+			}
+		}
+		kickRedemptionService()
+	default:
+		return nil, connect.NewError(connect.CodeInvalidArgument, serrors.New("invalid token"))
+	}
+	return &connect.Response[hummingbird.JWTResetResponse]{Msg: &hummingbird.JWTResetResponse{}}, nil
+}
+
+func (s *Service) SetPassword(ctx context.Context, req *connect.Request[hummingbird.SetPasswordRequest]) (*connect.Response[hummingbird.SetPasswordResponse], error) {
+	ia, ok := ctx.Value("user").(addr.IA)
+	if !ok {
+		return nil, connect.NewError(connect.CodeUnauthenticated, serrors.New("invalid token"))
+	}
+	hash, err := bcrypt.GenerateFromPassword(
+		[]byte(req.Msg.Password),
+		12,
+	)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, serrors.New("invalid token"))
+	}
+	_, err = s.store.SetASAuthenticationToken(ctx, ia, string(hash))
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, err)
+	}
+	return &connect.Response[hummingbird.SetPasswordResponse]{
+		Msg: &hummingbird.SetPasswordResponse{},
+	}, nil
+}