Merge pull request #130 from iExecBlockchainComputing/release/8.4.0

Release/8.4.0

Author: mcornaton

CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to this project will be documented in this file.
 
+## [[8.4.0]](https://github.com/iExecBlockchainComputing/iexec-result-proxy/releases/tag/v8.4.0) 2024-02-29
+
+### Deprecation Notices
+
+- Deprecate `/results/challenge` and `/results/login` endpoints. They will be removed in **v10**. (#119)
+- Deprecate `/` endpoint. Use `/v1/results` instead. The `/` endpoint will be removed in **v10**. (#119 #120)
+
+### New Features
+
+- Add `AuthorizationService` to enable `WorkerpoolAuthorization` validation. (#116)
+- Label REST API with `v1` version. (#120)
+- Add an endpoint to retrieve a JWT against a valid `WorkerpoolAuthorization`. (#123 #124)
+- Verify TEE tasks `enclaveSignature` before accepting IPFS upload. (#125 #126)
+- Persist `WorkerpoolAuthorization` instances to MongoDB. (#127)
+
+### Bug Fixes
+
+- Persist JWT signing key in dedicated `/data` folder by default. (#128)
+
+### Quality
+
+- Remove results download endpoints which are never used. (#117)
+- Add tests and javadoc on `ProxyController` class. (#118)
+- Remove `AbstractResultStorage` class. (#121)
+- Rework `ProxyService` class methods to use `ResultModel` as a parameter. (#122)
+
+### Dependency Upgrades
+
+- Upgrade to `iexec-common` 8.4.0. (#129)
+
 ## [[8.3.0]](https://github.com/iExecBlockchainComputing/iexec-result-proxy/releases/tag/v8.3.0) 2024-01-10
 
 ### New Features

Dockerfile

@@ -13,7 +13,8 @@ RUN groupadd --system appuser \
 
 WORKDIR /app
 COPY $jar iexec-result-proxy.jar
-RUN chown -R appuser:appuser /app
+RUN mkdir /data
+RUN chown -R appuser:appuser /app /data
 
 USER appuser
 ENTRYPOINT [ "java", "-Djava.security.egd=file:/dev/./urandom", "-jar", "iexec-result-proxy.jar" ]

build.gradle

@@ -11,6 +11,7 @@ plugins {
 ext {
     springCloudVersion = '2021.0.8'
     jjwtVersion = '0.11.5'
+    testContainersVersion = '1.19.3'
 }
 
 if (!project.hasProperty('gitBranch')) {
@@ -77,6 +78,10 @@ dependencies {
     // test
     testImplementation 'org.springframework.boot:spring-boot-starter-test'
     testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+
+    // mongo
+    testImplementation "org.testcontainers:junit-jupiter:$testContainersVersion"
+    testImplementation "org.testcontainers:mongodb:$testContainersVersion"
 }
 
 dependencyManagement {
@@ -98,6 +103,7 @@ tasks.named("bootJar") {
 
 test {
     useJUnitPlatform()
+    systemProperty "mongo.image", "mongo:4.4.28-focal"
 }
 
 tasks.register('itest') {

gradle.properties

@@ -1,5 +1,5 @@
-version=8.3.0
-iexecCommonVersion=8.3.1
+version=8.4.0
+iexecCommonVersion=8.4.0
 iexecCommonsPocoVersion=3.2.0
 
 nexusUser

iexec-result-proxy-library/src/main/java/com/iexec/resultproxy/api/ResultProxyClient.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2022 IEXEC BLOCKCHAIN TECH
+ * Copyright 2022-2024 IEXEC BLOCKCHAIN TECH
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,49 +17,54 @@
 package com.iexec.resultproxy.api;
 
 import com.iexec.common.result.ResultModel;
+import com.iexec.commons.poco.chain.WorkerpoolAuthorization;
 import com.iexec.commons.poco.eip712.entity.EIP712Challenge;
 import feign.Headers;
 import feign.Param;
 import feign.RequestLine;
-import feign.Response;
 
 /**
  * Interface allowing to instantiate a Feign client targeting Result Proxy REST endpoints.
  * <p>
  * To create the client, see the related builder.
+ *
  * @see ResultProxyClientBuilder
  */
 public interface ResultProxyClient {
 
+    /**
+     * @deprecated Will be replaced with new flow and removed in v10
+     */
+    @Deprecated(forRemoval = true)
     @RequestLine("GET /results/challenge?chainId={chainId}")
     EIP712Challenge getChallenge(@Param("chainId") int chainId);
 
+    /**
+     * @deprecated Will be replaced with new flow and removed in v10
+     */
+    @Deprecated(forRemoval = true)
     @RequestLine("POST /results/login?chainId={chainId}")
     String login(@Param("chainId") int chainId, String token);
 
-    @RequestLine("POST /")
+    @RequestLine("POST /v1/results/token")
+    @Headers("Authorization: {authorization}")
+    String getJwt(@Param("authorization") String authorization, WorkerpoolAuthorization workerpoolAuthorization);
+
+    @RequestLine("POST /v1/results")
     @Headers("Authorization: {authorization}")
     String addResult(
             @Param("authorization") String authorization,
             ResultModel model
     );
 
-    @RequestLine("HEAD /results/{chainTaskId}")
+    @RequestLine("HEAD /v1/results/{chainTaskId}")
     @Headers("Authorization: {authorization}")
     String isResultUploaded(
             @Param("authorization") String authorization,
             @Param("chainTaskId") String chainTaskId
     );
 
-    @RequestLine("GET /results/{chainTaskId}?chainId={chainId}")
-    @Headers({"Accept: application/zip", "Authorization: {authorization}"})
-    Response getResult(
-            @Param("chainTaskId") String chainTaskId,
-            @Param("authorization") String token,
-            @Param("chainId") int chainId
-    );
-
-    @RequestLine("GET /results/{chainTaskId}/ipfshash")
+    @RequestLine("GET /v1/results/{chainTaskId}/ipfshash")
     String getIpfsHashForTask(@Param("chainTaskId") String chainTaskId);
 
 }

iexec-result-proxy-library/src/test/java/com/iexec/resultproxy/api/ResultProxyClientTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2022 IEXEC BLOCKCHAIN TECH
+ * Copyright 2022-2024 IEXEC BLOCKCHAIN TECH
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 
-public class ResultProxyClientTest {
+class ResultProxyClientTest {
 
     @Test
     void instantiationTest() {

src/main/java/com/iexec/resultproxy/authorization/Authorization.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2020-2024 IEXEC BLOCKCHAIN TECH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.iexec.resultproxy.authorization;
+
+import com.iexec.commons.poco.chain.WorkerpoolAuthorization;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import org.springframework.data.annotation.Id;
+import org.springframework.data.annotation.Version;
+import org.springframework.data.mongodb.core.index.CompoundIndex;
+import org.springframework.data.mongodb.core.mapping.Document;
+
+@Document
+@CompoundIndex(name = "workerpool_authorization", def = "{'chainTaskId': 1, 'workerWallet': 1}", unique = true)
+@Getter
+@NoArgsConstructor
+public class Authorization {
+    @Id
+    private String id;
+
+    @Version
+    private Long version;
+
+    private String chainTaskId;
+    private String workerWallet;
+    private String enclaveChallenge;
+
+    public Authorization(WorkerpoolAuthorization workerpoolAuthorization) {
+        this.chainTaskId = workerpoolAuthorization.getChainTaskId();
+        this.workerWallet = workerpoolAuthorization.getWorkerWallet();
+        this.enclaveChallenge = workerpoolAuthorization.getEnclaveChallenge();
+    }
+
+}

src/main/java/com/iexec/resultproxy/authorization/AuthorizationError.java

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2024-2024 IEXEC BLOCKCHAIN TECH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.iexec.resultproxy.authorization;
+
+public enum AuthorizationError {
+    EMPTY_PARAMS_UNAUTHORIZED,
+    NO_MATCH_ONCHAIN_TYPE,
+    GET_CHAIN_TASK_FAILED,
+    TASK_NOT_ACTIVE,
+    GET_CHAIN_DEAL_FAILED,
+    INVALID_SIGNATURE;
+}

src/main/java/com/iexec/resultproxy/authorization/AuthorizationRepository.java

@@ -0,0 +1,25 @@
+/*
+ * Copyright 2024-2024 IEXEC BLOCKCHAIN TECH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.iexec.resultproxy.authorization;
+
+import org.springframework.data.mongodb.repository.MongoRepository;
+
+import java.util.Optional;
+
+public interface AuthorizationRepository extends MongoRepository<Authorization, String> {
+    Optional<Authorization> findByChainTaskIdAndWorkerWallet(String chainTaskId, String workerWallet);
+}