atproto-plc / wasm / plc-audit.js

#!/usr/bin/env node

/**
 * PLC Directory Audit Log Validator (WASM version)
 *
 * This is a JavaScript port of the Rust plc-audit binary that uses WASM
 * for cryptographic operations. It fetches DID audit logs from plc.directory
 * and validates each operation cryptographically.
 */

import { WasmDid, WasmOperation, WasmVerifyingKey } from './pkg/atproto_plc.js';
import { parseArgs } from 'node:util';

// Parse command-line arguments
const { values, positionals } = parseArgs({
  options: {
    verbose: {
      type: 'boolean',
      short: 'v',
      default: false,
    },
    quiet: {
      type: 'boolean',
      short: 'q',
      default: false,
    },
    'plc-url': {
      type: 'string',
      default: 'https://plc.directory',
    },
  },
  allowPositionals: true,
});

const args = {
  did: positionals[0],
  verbose: values.verbose,
  quiet: values.quiet,
  plcUrl: values['plc-url'],
};

// Validate arguments
if (!args.did) {
  console.error('Usage: node plc-audit.js [OPTIONS] <DID>');
  console.error('');
  console.error('Arguments:');
  console.error('  <DID>  The DID to audit (e.g., did:plc:ewvi7nxzyoun6zhxrhs64oiz)');
  console.error('');
  console.error('Options:');
  console.error('  -v, --verbose         Show verbose output including all operations');
  console.error('  -q, --quiet           Only show summary (no operation details)');
  console.error('  --plc-url <URL>       Custom PLC directory URL (default: https://plc.directory)');
  process.exit(1);
}

/**
 * Fetch audit log from plc.directory
 */
async function fetchAuditLog(plcUrl, did) {
  const url = `${plcUrl}/${did}/log/audit`;

  try {
    const response = await fetch(url, {
      headers: {
        'User-Agent': 'atproto-plc-audit-wasm/0.1.0',
      },
    });

    if (!response.ok) {
      const text = await response.text();
      throw new Error(`HTTP error: ${response.status} - ${text}`);
    }

    return await response.json();
  } catch (error) {
    throw new Error(`Failed to fetch audit log: ${error.message}`);
  }
}

/**
 * Main validation logic
 */
async function main() {
  try {
    // Parse and validate the DID
    let did;
    try {
      did = new WasmDid(args.did);
    } catch (error) {
      console.error('❌ Error: Invalid DID format:', error.message);
      console.error('   Expected format: did:plc:<24 lowercase base32 characters>');
      process.exit(1);
    }

    if (!args.quiet) {
      console.log('🔍 Fetching audit log for:', did.did);
      console.log('   Source:', args.plcUrl);
      console.log();
    }

    // Fetch the audit log
    let auditLog;
    try {
      auditLog = await fetchAuditLog(args.plcUrl, did.did);
    } catch (error) {
      console.error('❌ Error:', error.message);
      process.exit(1);
    }

    if (!auditLog || auditLog.length === 0) {
      console.error('❌ Error: No operations found in audit log');
      process.exit(1);
    }

    // Parse operations
    const operations = auditLog.map(entry => {
      const op = WasmOperation.fromJson(JSON.stringify(entry.operation));
      return {
        did: entry.did,
        operation: op,
        cid: entry.cid,
        createdAt: entry.createdAt,
        nullified: entry.nullified || false,
      };
    });

    if (!args.quiet) {
      console.log('📊 Audit Log Summary:');
      console.log('   Total operations:', auditLog.length);
      console.log('   Genesis operation:', operations[0].cid);
      console.log('   Latest operation:', operations[operations.length - 1].cid);
      console.log();
    }

    // Display operations if verbose
    if (args.verbose) {
      console.log('📋 Operations:');
      for (let i = 0; i < operations.length; i++) {
        const entry = operations[i];
        const status = entry.nullified ? '❌ NULLIFIED' : '✅';
        console.log(`   [${i}] ${status} ${entry.cid} - ${entry.createdAt}`);

        if (entry.operation.isGenesis()) {
          console.log('       Type: Genesis (creates the DID)');
        } else {
          console.log('       Type: Update');
        }

        const prev = entry.operation.prev();
        if (prev) {
          console.log('       Previous:', prev);
        }
      }
      console.log();
    }

    // Validate the operation chain
    if (!args.quiet) {
      console.log('🔐 Validating operation chain...');
      console.log();
    }

    // Step 1: Validate chain linkage (prev references)
    if (args.verbose) {
      console.log('Step 1: Chain Linkage Validation');
      console.log('================================');
    }

    for (let i = 1; i < operations.length; i++) {
      if (operations[i].nullified) {
        if (args.verbose) {
          console.log(`  [${i}] ⊘ Skipped (nullified)`);
        }
        continue;
      }

      const prevCid = operations[i - 1].cid;
      const expectedPrev = operations[i].operation.prev();

      if (args.verbose) {
        console.log(`  [${i}] Checking prev reference...`);
        console.log('      Expected:', prevCid);
      }

      if (expectedPrev) {
        if (args.verbose) {
          console.log('      Actual:  ', expectedPrev);
        }

        if (expectedPrev !== prevCid) {
          console.error();
          console.error(`❌ Validation failed: Chain linkage broken at operation ${i}`);
          console.error('   Expected prev:', prevCid);
          console.error('   Actual prev:', expectedPrev);
          process.exit(1);
        }

        if (args.verbose) {
          console.log('      ✅ Match - chain link valid');
        }
      } else if (i > 0) {
        console.error();
        console.error(`❌ Validation failed: Non-genesis operation ${i} missing prev field`);
        process.exit(1);
      }
    }

    if (args.verbose) {
      console.log();
      console.log('✅ Chain linkage validation complete');
      console.log();
    }

    // Step 2: Validate cryptographic signatures
    if (args.verbose) {
      console.log('Step 2: Cryptographic Signature Validation');
      console.log('==========================================');
    }

    let currentRotationKeys = [];

    for (let i = 0; i < operations.length; i++) {
      const entry = operations[i];

      if (entry.nullified) {
        if (args.verbose) {
          console.log(`  [${i}] ⊘ Skipped (nullified)`);
        }
        continue;
      }

      // For genesis operation, extract rotation keys
      if (i === 0) {
        if (args.verbose) {
          console.log(`  [${i}] Genesis operation - extracting rotation keys`);
        }

        const rotationKeys = entry.operation.rotationKeys();
        if (rotationKeys) {
          currentRotationKeys = rotationKeys;

          if (args.verbose) {
            console.log('      Rotation keys:', rotationKeys.length);
            for (let j = 0; j < rotationKeys.length; j++) {
              console.log(`        [${j}] ${rotationKeys[j]}`);
            }
            console.log('      ⚠️  Genesis signature cannot be verified (bootstrapping trust)');
          }
        }
        continue;
      }

      if (args.verbose) {
        console.log(`  [${i}] Validating signature...`);
        console.log('      CID:', entry.cid);
        console.log('      Signature:', entry.operation.signature());
      }

      // Validate signature using current rotation keys
      if (currentRotationKeys.length > 0) {
        if (args.verbose) {
          console.log('      Available rotation keys:', currentRotationKeys.length);
          for (let j = 0; j < currentRotationKeys.length; j++) {
            console.log(`        [${j}] ${currentRotationKeys[j]}`);
          }
        }

        // Parse verifying keys
        const verifyingKeys = [];
        for (const keyStr of currentRotationKeys) {
          try {
            verifyingKeys.push(WasmVerifyingKey.fromDidKey(keyStr));
          } catch (error) {
            console.error(`Warning: Failed to parse rotation key: ${keyStr}`);
          }
        }

        if (args.verbose) {
          console.log(`      Parsed verifying keys: ${verifyingKeys.length}/${currentRotationKeys.length}`);
        }

        // Try to verify with each key and track which one worked
        try {
          const keyIndex = entry.operation.verifyWithKeyIndex(verifyingKeys);

          if (args.verbose) {
            console.log(`      ✅ Signature verified with rotation key [${keyIndex}]`);
            console.log(`         ${currentRotationKeys[keyIndex]}`);
          }
        } catch (error) {
          console.error();
          console.error(`❌ Validation failed: Invalid signature at operation ${i}`);
          console.error('   Error:', error.message);
          console.error('   CID:', entry.cid);
          console.error(`   Tried ${verifyingKeys.length} rotation keys, none verified the signature`);
          process.exit(1);
        }
      }

      // Update rotation keys if this operation changes them
      const newRotationKeys = entry.operation.rotationKeys();
      if (newRotationKeys) {
        const keysChanged = JSON.stringify(newRotationKeys) !== JSON.stringify(currentRotationKeys);

        if (keysChanged) {
          if (args.verbose) {
            console.log('      🔄 Rotation keys updated by this operation');
            console.log('         Old keys:', currentRotationKeys.length);
            console.log('         New keys:', newRotationKeys.length);
            for (let j = 0; j < newRotationKeys.length; j++) {
              console.log(`           [${j}] ${newRotationKeys[j]}`);
            }
          }
          currentRotationKeys = newRotationKeys;
        }
      }
    }

    if (args.verbose) {
      console.log();
      console.log('✅ Cryptographic signature validation complete');
      console.log();
    }

    // Build final state
    const finalEntry = operations.filter(e => !e.nullified).pop();
    const finalRotationKeys = finalEntry.operation.rotationKeys();

    if (finalRotationKeys) {
      if (args.quiet) {
        console.log('✅ VALID');
      } else {
        console.log('✅ Validation successful!');
        console.log();
        console.log('📄 Final DID State:');
        console.log('   Rotation keys:', finalRotationKeys.length);
        for (let i = 0; i < finalRotationKeys.length; i++) {
          console.log(`     [${i}] ${finalRotationKeys[i]}`);
        }
      }
    } else {
      console.error('❌ Error: Could not extract final state');
      process.exit(1);
    }

  } catch (error) {
    console.error('❌ Fatal error:', error.message);
    if (args.verbose) {
      console.error(error.stack);
    }
    process.exit(1);
  }
}

// Run the main function
main().catch(error => {
  console.error('❌ Unhandled error:', error);
  process.exit(1);
});