mirror of
https://github.com/luxfi/node.git
synced 2026-07-27 03:39:39 +00:00
Hanzo AI
c3b398bc7b
External (HTTP / JSON-RPC) is the only place JSON is legitimate. Every
existing encoding/json import in node/ moves to github.com/go-json-experiment/json
(v2 root, not the v1 sub-package). NewEncoder/NewDecoder rewrite to
MarshalWrite/UnmarshalRead. MarshalIndent rewrites to Marshal with
jsontext.WithIndent. json.RawMessage rewrites to jsontext.Value.
*json.SyntaxError rewrites to *jsontext.SyntacticError.
81 files migrated. LLM.md captures the rule + v1->v2 delta table.
Known v2 semantic deltas surfaced by existing tests (followups, not regressions):
- [N]byte fields with no MarshalJSON now marshal as base64 string (v1 marshalled
as JSON array of byte numbers). Affects vms/platformvm/txs/*_test.go fixtures
with embedded BLS proofOfPossession.
- time.Duration has no v2 default representation; configs that wire-format
Duration as nanoseconds (vms/{xvm,platformvm}/config, config/spec) need to
switch to string-form Duration or carry an explicit option. v2 root does not
re-export FormatDurationAsNano.
- v2 enforces strict UTF-8 (vms/chainadapter/messaging fixture has non-UTF-8).
- json.MarshalWrite does not append a trailing '\n' (v1 NewEncoder.Encode did);
service/auth/auth_test.go expectation updated.
- nil []byte round-trips to empty (not nil); config_test deep-equal fixtures
surface this.
All affected sites are at the API boundary; ZAP wire envelope already covers
the internal data paths (state, P2P, consensus, MPC, threshold). Internal
JSON sites that should move to ZAP next (separate work):
- vms/da/store.go (DA blob/cert storage as JSON)
- vms/platformvm/airdrop (airdrop claims as JSON in db)
- vms/chainadapter/appchain (SQLite materializer schema/data blobs)
- vms/chainadapter/messaging (conversation codec)
- staking/kms.go (KMS HTTP client — external technically, leave)
- utils/{bimap,ips} (small marshaler shims — low priority)
94 lines
2.6 KiB
Go
94 lines
2.6 KiB
Go
// Copyright (C) 2019-2025, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
package staking
|
|
|
|
import (
|
|
"github.com/go-json-experiment/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
// KMSConfig for staking key retrieval
|
|
type KMSConfig struct {
|
|
Endpoint string // KMS API endpoint (e.g., https://kms.dev.lux.network)
|
|
SecretPath string // Path to the staking secret (e.g., /staking/liquid-devnet/node-0)
|
|
AuthToken string // Bearer token for KMS auth
|
|
}
|
|
|
|
// KMSStakingKeys holds the staking key material from KMS
|
|
type KMSStakingKeys struct {
|
|
TLSKey string `json:"tls_key"` // PEM-encoded TLS private key
|
|
TLSCert string `json:"tls_cert"` // PEM-encoded TLS certificate
|
|
SignerKey string `json:"signer_key"` // BLS signer key (hex-encoded)
|
|
}
|
|
|
|
// FetchFromKMS retrieves staking keys from a KMS endpoint.
|
|
func FetchFromKMS(cfg KMSConfig) (*KMSStakingKeys, error) {
|
|
if cfg.Endpoint == "" {
|
|
return nil, fmt.Errorf("KMS endpoint must not be empty")
|
|
}
|
|
if cfg.SecretPath == "" {
|
|
return nil, fmt.Errorf("KMS secret path must not be empty")
|
|
}
|
|
|
|
url := fmt.Sprintf("%s/api/v1/secrets%s", cfg.Endpoint, cfg.SecretPath)
|
|
|
|
client := &http.Client{Timeout: 30 * time.Second}
|
|
req, err := http.NewRequest("GET", url, nil)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("creating KMS request: %w", err)
|
|
}
|
|
|
|
if cfg.AuthToken != "" {
|
|
req.Header.Set("Authorization", "Bearer "+cfg.AuthToken)
|
|
}
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("KMS request failed: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
body, _ := io.ReadAll(resp.Body)
|
|
return nil, fmt.Errorf("KMS returned %d: %s", resp.StatusCode, string(body))
|
|
}
|
|
|
|
var result struct {
|
|
Secret struct {
|
|
Value string `json:"secretValue"`
|
|
} `json:"secret"`
|
|
}
|
|
if err := json.UnmarshalRead(resp.Body, &result); err != nil {
|
|
return nil, fmt.Errorf("decoding KMS response: %w", err)
|
|
}
|
|
|
|
var keys KMSStakingKeys
|
|
if err := json.Unmarshal([]byte(result.Secret.Value), &keys); err != nil {
|
|
return nil, fmt.Errorf("parsing staking keys from KMS: %w", err)
|
|
}
|
|
|
|
return &keys, nil
|
|
}
|
|
|
|
// FetchFromKMSEnv reads KMS config from environment variables and fetches staking keys.
|
|
func FetchFromKMSEnv() (*KMSStakingKeys, error) {
|
|
endpoint := os.Getenv("KMS_ENDPOINT")
|
|
secretPath := os.Getenv("KMS_STAKING_PATH")
|
|
authToken := os.Getenv("KMS_TOKEN")
|
|
|
|
if endpoint == "" || secretPath == "" {
|
|
return nil, fmt.Errorf("KMS_ENDPOINT and KMS_STAKING_PATH must be set")
|
|
}
|
|
|
|
return FetchFromKMS(KMSConfig{
|
|
Endpoint: endpoint,
|
|
SecretPath: secretPath,
|
|
AuthToken: authToken,
|
|
})
|
|
}
|