goat: basic account PLC key commands (#959)

eg:

```sh
goat key generate

goat account login -u $HANDLE -p $PASSWORD

goat account plc current

goat account plc request-token

goat account plc add-rotation-key --token $PLCTOKEN $PUBKEY

goat account plc current
```

cmd/goat/account_plc.go

···
 	"encoding/json"
 	"fmt"
 	"os"
+	"slices"
 
 	"github.com/bluesky-social/indigo/api/agnostic"
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/syntax"
 
 	"github.com/urfave/cli/v2"
 )
···
 var cmdAccountPlc = &cli.Command{
 	Name:  "plc",
 	Usage: "sub-commands for managing PLC DID via PDS host",
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "plc-host",
+			Usage:   "method, hostname, and port of PLC registry",
+			Value:   "https://plc.directory",
+			EnvVars: []string{"ATP_PLC_HOST"},
+		},
+	},
 	Subcommands: []*cli.Command{
 		&cli.Command{
 			Name:   "recommended",
···
 			Flags: []cli.Flag{
 				&cli.StringFlag{
 					Name:  "token",
-					Usage: "2FA token for signing request",
+					Usage: "2FA token for PLC operation signing request",
 				},
 			},
 		},
···
 			Usage:     "submit a PLC operation (via PDS)",
 			ArgsUsage: `<json-file>`,
 			Action:    runAccountPlcSubmit,
+		},
+		&cli.Command{
+			Name:   "current",
+			Usage:  "print current PLC data for account (fetched from directory)",
+			Action: runAccountPlcCurrent,
+		},
+		&cli.Command{
+			Name:      "add-rotation-key",
+			Usage:     "add a new rotation key to PLC identity (via PDS)",
+			ArgsUsage: `<pubkey>`,
+			Action:    runAccountPlcAddRotationKey,
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name:  "token",
+					Usage: "2FA token for PLC operation signing request",
+				},
+				&cli.BoolFlag{
+					Name:  "first",
+					Usage: "inserts key at the top of key list (highest priority)",
+				},
+			},
 		},
 	},
 }
···
 
 	return nil
 }
+
+func runAccountPlcCurrent(cctx *cli.Context) error {
+	ctx := context.Background()
+
+	xrpcc, err := loadAuthClient(ctx)
+	if err == ErrNoAuthSession || xrpcc.Auth == nil {
+		return fmt.Errorf("auth required, but not logged in")
+	} else if err != nil {
+		return err
+	}
+
+	did, err := syntax.ParseDID(xrpcc.Auth.Did)
+	if err != nil {
+		return err
+	}
+
+	plcData, err := fetchPLCData(ctx, cctx.String("plc-host"), did)
+	if err != nil {
+		return err
+	}
+
+	b, err := json.MarshalIndent(plcData, "", "  ")
+	if err != nil {
+		return err
+	}
+	fmt.Println(string(b))
+	return nil
+}
+
+func runAccountPlcAddRotationKey(cctx *cli.Context) error {
+	ctx := context.Background()
+
+	newKeyStr := cctx.Args().First()
+	if newKeyStr == "" {
+		return fmt.Errorf("need to provide public key argument (as did:key)")
+	}
+
+	// check that it is a valid pubkey
+	_, err := crypto.ParsePublicDIDKey(newKeyStr)
+	if err != nil {
+		return err
+	}
+
+	xrpcc, err := loadAuthClient(ctx)
+	if err == ErrNoAuthSession {
+		return fmt.Errorf("auth required, but not logged in")
+	} else if err != nil {
+		return err
+	}
+
+	did, err := syntax.ParseDID(xrpcc.Auth.Did)
+	if err != nil {
+		return err
+	}
+
+	// 1. fetch current PLC op: plc.directory/{did}/data
+	plcData, err := fetchPLCData(ctx, cctx.String("plc-host"), did)
+	if err != nil {
+		return err
+	}
+
+	if len(plcData.RotationKeys) >= 5 {
+		fmt.Println("WARNGING: already have 5 rotation keys, which is the maximum")
+	}
+
+	for _, k := range plcData.RotationKeys {
+		if k == newKeyStr {
+			return fmt.Errorf("key already registered as a rotation key")
+		}
+	}
+
+	// 2. update data
+	if cctx.Bool("first") {
+		plcData.RotationKeys = slices.Insert(plcData.RotationKeys, 0, newKeyStr)
+	} else {
+		plcData.RotationKeys = append(plcData.RotationKeys, newKeyStr)
+	}
+
+	// 3. get data signed (using token)
+	opBytes, err := json.Marshal(&plcData)
+	if err != nil {
+		return err
+	}
+	var body agnostic.IdentitySignPlcOperation_Input
+	if err = json.Unmarshal(opBytes, &body); err != nil {
+		return fmt.Errorf("failed decoding PLC op JSON: %w", err)
+	}
+
+	token := cctx.String("token")
+	if token != "" {
+		body.Token = &token
+	}
+
+	resp, err := agnostic.IdentitySignPlcOperation(ctx, xrpcc, &body)
+	if err != nil {
+		return err
+	}
+
+	// 4. submit signed op
+	err = agnostic.IdentitySubmitPlcOperation(ctx, xrpcc, &agnostic.IdentitySubmitPlcOperation_Input{
+		Operation: resp.Operation,
+	})
+	if err != nil {
+		return fmt.Errorf("failed submitting PLC op via PDS: %w", err)
+	}
+
+	fmt.Println("Success!")
+	return nil
+}

cmd/goat/crypto.go cmd/goat/key.go

···
 	"github.com/urfave/cli/v2"
 )
 
-var cmdCrypto = &cli.Command{
-	Name:  "crypto",
+var cmdKey = &cli.Command{
+	Name:  "key",
 	Usage: "sub-commands for cryptographic keys",
 	Subcommands: []*cli.Command{
 		&cli.Command{
···
 					Aliases: []string{"t"},
 					Usage:   "indicate curve type (P-256 is default)",
 				},
+				&cli.BoolFlag{
+					Name:  "terse",
+					Usage: "print just the secret key, in multikey format",
+				},
 			},
-			Action: runCryptoGenerate,
+			Action: runKeyGenerate,
 		},
 		&cli.Command{
-			Name:   "inspect",
-			Usage:  "parses and outputs metadata about a public or secret key",
-			Action: runCryptoInspect,
+			Name:      "inspect",
+			Usage:     "parses and outputs metadata about a public or secret key",
+			ArgsUsage: `<key>`,
+			Action:    runKeyInspect,
 		},
 	},
 }
 
-func runCryptoGenerate(cctx *cli.Context) error {
+func runKeyGenerate(cctx *cli.Context) error {
+	var priv crypto.PrivateKey
+	var privMultibase string
 	switch cctx.String("type") {
 	case "", "P-256", "p256", "ES256", "secp256r1":
-		priv, err := crypto.GeneratePrivateKeyP256()
+		sec, err := crypto.GeneratePrivateKeyP256()
 		if err != nil {
 			return err
 		}
-		fmt.Println(priv.Multibase())
+		privMultibase = sec.Multibase()
+		priv = sec
 	case "K-256", "k256", "ES256K", "secp256k1":
-		priv, err := crypto.GeneratePrivateKeyK256()
+		sec, err := crypto.GeneratePrivateKeyK256()
 		if err != nil {
 			return err
 		}
-		fmt.Println(priv.Multibase())
+		privMultibase = sec.Multibase()
+		priv = sec
 	default:
 		return fmt.Errorf("unknown key type: %s", cctx.String("type"))
 	}
+	if cctx.Bool("terse") {
+		fmt.Println(privMultibase)
+		return nil
+	}
+	pub, err := priv.PublicKey()
+	if err != nil {
+		return err
+	}
+	fmt.Printf("Key Type: %s\n", descKeyType(priv))
+	fmt.Printf("Secret Key (Multibase Syntax): save this securely (eg, add to password manager)\n\t%s\n", privMultibase)
+	fmt.Printf("Public Key (DID Key Syntax): share or publish this (eg, in DID document)\n\t%s\n", pub.DIDKey())
 	return nil
 }
 
···
 	}
 }
 
-func runCryptoInspect(cctx *cli.Context) error {
+func runKeyInspect(cctx *cli.Context) error {
 	s := cctx.Args().First()
 	if s == "" {
 		return fmt.Errorf("need to provide key as an argument")

cmd/goat/main.go

···
 		cmdBsky,
 		cmdRecord,
 		cmdSyntax,
-		cmdCrypto,
+		cmdKey,
 		cmdPds,
 	}
 	return app.Run(args)

cmd/goat/plc.go

···
 	Usage: "sub-commands for DID PLCs",
 	Flags: []cli.Flag{
 		&cli.StringFlag{
-			Name:  "plc-directory",
-			Value: "https://plc.directory",
+			Name:    "plc-host",
+			Usage:   "method, hostname, and port of PLC registry",
+			Value:   "https://plc.directory",
+			EnvVars: []string{"ATP_PLC_HOST"},
 		},
 	},
 	Subcommands: []*cli.Command{
-		cmdPLCHistory,
-		cmdPLCDump,
+		&cli.Command{
+			Name:      "history",
+			Usage:     "fetch operation log for individual DID",
+			ArgsUsage: `<at-identifier>`,
+			Flags:     []cli.Flag{},
+			Action:    runPLCHistory,
+		},
+		&cli.Command{
+			Name:      "data",
+			Usage:     "fetch current data (op) for individual DID",
+			ArgsUsage: `<at-identifier>`,
+			Flags:     []cli.Flag{},
+			Action:    runPLCData,
+		},
+		&cli.Command{
+			Name:  "dump",
+			Usage: "output full operation log, as JSON lines",
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name: "cursor",
+				},
+				&cli.BoolFlag{
+					Name: "tail",
+				},
+			},
+			Action: runPLCDump,
+		},
 	},
 }
 
-var cmdPLCHistory = &cli.Command{
-	Name:      "history",
-	Usage:     "fetch operation log for individual DID",
-	ArgsUsage: `<at-identifier>`,
-	Flags:     []cli.Flag{},
-	Action:    runPLCHistory,
-}
-
 func runPLCHistory(cctx *cli.Context) error {
 	ctx := context.Background()
-	plcURL := cctx.String("plc-directory")
+	plcHost := cctx.String("plc-host")
 	s := cctx.Args().First()
 	if s == "" {
 		return fmt.Errorf("need to provide account identifier as an argument")
 	}
 
 	dir := identity.BaseDirectory{
-		PLCURL: plcURL,
+		PLCURL: plcHost,
 	}
 
 	id, err := syntax.ParseAtIdentifier(s)
···
 		return fmt.Errorf("non-PLC DID method: %s", did.Method())
 	}
 
-	url := fmt.Sprintf("%s/%s/log", plcURL, did)
+	url := fmt.Sprintf("%s/%s/log", plcHost, did)
 	resp, err := http.Get(url)
 	if err != nil {
 		return err
 	}
+	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("PLC HTTP request failed")
 	}
···
 	return nil
 }
 
-var cmdPLCDump = &cli.Command{
-	Name:  "dump",
-	Usage: "output full operation log, as JSON lines",
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name: "cursor",
-		},
-		&cli.BoolFlag{
-			Name: "tail",
-		},
-	},
-	Action: runPLCDump,
+func runPLCData(cctx *cli.Context) error {
+	ctx := context.Background()
+	plcHost := cctx.String("plc-host")
+	s := cctx.Args().First()
+	if s == "" {
+		return fmt.Errorf("need to provide account identifier as an argument")
+	}
+
+	dir := identity.BaseDirectory{
+		PLCURL: plcHost,
+	}
+
+	id, err := syntax.ParseAtIdentifier(s)
+	if err != nil {
+		return err
+	}
+	var did syntax.DID
+	if id.IsDID() {
+		did, err = id.AsDID()
+		if err != nil {
+			return err
+		}
+	} else {
+		hdl, err := id.AsHandle()
+		if err != nil {
+			return err
+		}
+		did, err = dir.ResolveHandle(ctx, hdl)
+		if err != nil {
+			return err
+		}
+	}
+
+	if did.Method() != "plc" {
+		return fmt.Errorf("non-PLC DID method: %s", did.Method())
+	}
+
+	plcData, err := fetchPLCData(ctx, plcHost, did)
+	if err != nil {
+		return err
+	}
+
+	b, err := json.MarshalIndent(plcData, "", "  ")
+	if err != nil {
+		return err
+	}
+	fmt.Println(string(b))
+	return nil
 }
 
 func runPLCDump(cctx *cli.Context) error {
 	ctx := context.Background()
-	plcURL := cctx.String("plc-directory")
+	plcHost := cctx.String("plc-host")
 	client := http.DefaultClient
 	tailMode := cctx.Bool("tail")
 
···
 	}
 	var lastCursor string
 
-	req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("%s/export", plcURL), nil)
+	req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("%s/export", plcHost), nil)
 	if err != nil {
 		return err
 	}
···
 
 	return nil
 }
+
+type PLCService struct {
+	Type     string `json:"type"`
+	Endpoint string `json:"endpoint"`
+}
+
+type PLCData struct {
+	DID                 string                `json:"did"`
+	VerificationMethods map[string]string     `json:"verificationMethods"`
+	RotationKeys        []string              `json:"rotationKeys"`
+	AlsoKnownAs         []string              `json:"alsoKnownAs"`
+	Services            map[string]PLCService `json:"services"`
+}
+
+func fetchPLCData(ctx context.Context, plcHost string, did syntax.DID) (*PLCData, error) {
+
+	if plcHost == "" {
+		return nil, fmt.Errorf("PLC host not configured")
+	}
+
+	url := fmt.Sprintf("%s/%s/data", plcHost, did)
+	resp, err := http.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("PLC HTTP request failed")
+	}
+	respBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	var d PLCData
+	err = json.Unmarshal(respBytes, &d)
+	if err != nil {
+		return nil, err
+	}
+	return &d, nil
+}