Joystream / Joystream/joystream

Argus: content access authentication scheme

Open
#4,415 2 comments 0 reactions 0 assignees View on GitHub
argus colossus
Dominant language
Rust
Stars
1.4k
Forks
116
PR merge metrics
No merged PRs in 30d

Description

For the infrastructure authentication scheme proposed in #4414 for accessing unlisted content, this issue describes the basic QN/Protobuf schemas,

```.graphql
# Infrastructure access (session) key for authenticating with Argus/Colossus
type InfrastructureAccessKey @entity {
"Unique ID"
id: ID!

"Access key address"
accessKeyAddress: String!

"Member owning the access key."
member: Membership!

"The block timestamp when the access key is about to expire (Optional)"
expiresAtBlock: BigInt

"The agent (App/Orion) storing the corresponding private key (if any)"
storedByApp: App

# Can be a concatenated string representation of "Browser-Version-OS-MachineName" etc ?
"The agent (Browser) storing the corresponding private key (if any)"
storedByBrowser: String
}

"Stored information about a registered user"
type Membership @entity {
"MemberId: runtime identifier for a user"
id: ID!

# ... (Other fields)

"All infrastructure (Argus/Colossus) access keys owned by this member"
infrastructureAccessKeys: [MembershipExternalResource] @derivedFrom(field: "member")
}
```
The `App` refers to a metaprotocol-based app entity described in #4307.
The `storedBy*` fields keep info about the agent storing the private component of infrastructure access KeyPair. This way, an actor(member) would have a complete view of all his/her access keys and where they are being stored, in case they want to remove/revoke the key from a specific browser/App.

Now the corresponding Protobuf message schemas for creating/revoking the access keys will be as follows;
```.proto
// Add session key to access unlisted content from Colossus/Argus
message AddInfrastructureAccessKey {
// Infrastructure access key address
required string address = 1;

// session key's expiration time (Optional)
optional string expiresAtBlock = 2;

// Agent (Browser/Orion) storing corresponding private key (Optional)
oneof stored_by {
string browser = 3;
string app = 4;
}
}

// Remove the session key
message RemoveInfrastructureAccessKey {
// Infrastructure access (session) key address
required string address = 1;
}

message MemberRemarked {
oneof member_remarked {
// ... (Other remark messages)

// add session key to access unlisted content from Colossus/Argus
AddInfrastructureAccessKey add_infrastructure_access_key = 7;

// remove access key
RemoveInfrastructureAccessKey remove_infrastructure_access_key = 8;
}
}

message MembershipMetadata {
// ... (Other membership metadata fields)

// add session key to access unlisted content from Colossus/Argus
AddInfrastructureAccessKey add_infrastructure_access_key = 7;

// remove access key
RemoveInfrastructureAccessKey remove_infrastructure_access_key = 8;
}
```
Based on the Protobuf schemas above, the act of creating/revoking access keys can be performed both with member creation/update and remark extrinsic.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.