.clippy.toml
.github
    workflows
        build_image.yml
        rust.yml
Cargo.toml
README.md
config
    default.json
    production.json
    staging.json
docker-compose.yml
src
    captcha.rs
    config.rs
    error.rs
    main.rs
    signer.rs
    utils.rs
    verification_provider.rs

# verification-oracle

User verification oracle for SBT issuer.

## Prerequisites

Installed `nginx` with valid certificates for `HTTPS` protocol

## Setup

Setup `nginx` to route https `POST` requests to locally bound ports.
Default ports for `production` env is 8080 and for `staging` env is 8081.
If not default ports required to be used, those should be updated in the configuration later.

## Configuration

All default configuration is available in `config/default.json` file.
To override these settings, create a `config/local.jsom` file.

### Credentials

Use `near generate-key i-am-human-credentials --networkId mainnet` to generate new credentials.
The above command will create a file `~/.near-credentials/mainnet/i-am-human-credentials.json` with required private key.

The `private_key` property from a resulting file could be either passed with environment variable `SIGNING_KEY` or set via configuration file as:

```
  "signer": {
    "credentials": {
      "signingKey": "{{PUT_PRIVATE_KEY_HERE}}"
    }
  }
```

The public key generated in a file `~/.near-credentials/mainnet/i-am-human-credentials.json` is in wrapped format.
If the ed25519 base64 encoded public key required (e.g. for i-am-human near contract), it could be obtained after service start from
an output (search for text `ED25519 public key (base64 encoded):`)

### Verification Provider Configuration

As a verification provider we use Fractal.id <https://fractal.id/>

Provider could be configured with JSON configuration below:

```
    "verificationProvider": {
      "requestTokenUrl": "https://{{PUT_PUT_AUTH_FRACTAL_HOST_HERE}}/oauth/token",
      "requestUserUrl": "https://{{PUT_PUT_RESOURCE_FRACTAL_HOST_HERE}}/users/me",
      "clientId": "{{PUT_FRACTAL_CLIENT_ID_HERE}}",
      "clientSecret": "{{PUT_FRACTAL_CLIENT_SECRET_HERE}}"
    }
```

Configuration keys explanation:

*   `requestTokenUrl` - Url used to acquire user token with provided `authorization_code`. Host should be set using the `AUTH_DOMAIN` placeholder from `Fractal.id` docs. See more <https://docs.developer.fractal.id/production-and-staging-urls>
*   `requestUserUrl` - Url used to acquire user information by an access token. Host should be set using the `RESOURCE_DOMAIN` placeholder from `Fractal.id` docs. See more <https://docs.developer.fractal.id/production-and-staging-urls>
*   `clientId` - Client id from API info acquired after create of integration at `Fractal.id` client dashboard. See more <https://docs.developer.fractal.id/client-dashboard>
*   `clientSecret` - Client secret from API info acquired after create of integration at `Fractal.id` client dashboard. See more <https://docs.developer.fractal.id/client-dashboard>

### Google re-CAPTCHA configuration

We use re-CAPTCHA Enterprise to verify that request came from a human

Captcha client could be configured with JSON configuration below:

```
    "captcha": {
      "action": "homepage",
      "threshold": 0.5,
      "secret": "{{PUT_GOOGLE_CAPTCHA_SECRET_HERE}}
    }
```

Configuration keys explanation:

*   `action` - The page alias we want to verify captcha at, requests with `action` different from configured value will be denied
*   `threshold` - Google user's score threshold minimum to accept requests from. Score below this value will mean that user is most-likely a bot
*   `secret` - Secret required by Google to verify captcha for third-party clients

Sample of `*-secrets.json` configuration file:
```
{
    "verificationProvider": {
      "clientId": "{{SOME_CLIENT_ID_VALUE_HERE}}",
      "clientSecret": "{{SOME_CLIENT_SECRET_VALUE_HERE}}"
    },
    "signer": {
      "credentials": {
        "signingKey": "{{SOME_ED25519_BASE64_ENCODED_PRIVATE_KEY_HERE}}"
      }
    },
    "captcha": {
      "secret": "{{PUT_GOOGLE_CAPTCHA_SECRET_HERE}}
    }
}
```

## Deploy (GitHub Registry)

### Build

Use `GitHub Actions` script `.github/workflows/build_image.yml` to build images for `main` and `develop` branches to
be used accordingly for `production` and `staging` services

### Run

Pull & run docker image using docker-compose
`docker-compose pull && docker-compose --compatibility up -d`

## Deploy (Local Registry)

### Prerequisites

Prepare registry to be used with docker-compose
`docker run -d -p 5000:5000 --restart=always --name registry registry:2`

### Build

Build docker image
`docker build -t verification-oracle . &`

Tag previously built docker image
`docker tag verification-oracle:latest localhost:5000/verification-oracle`

Push built tag to registry
`docker push localhost:5000/verification-oracle:latest`

Update `docker-compose.yml` with images from local registry

### Run

Pull & run docker image using docker-compose
`docker-compose pull && docker-compose --compatibility up -d`
