feat: add ucanto aggregation api service

package.json

@@ -12,7 +12,8 @@
     "deploy": "sst deploy",
     "remove": "sst remove",
     "console": "sst console",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf node_modules pnpm-lock.yml packages/*/{pnpm-lock.yml,.next,out,coverage,.nyc_output,worker,dist,node_modules}"
   },
   "devDependencies": {
     "@sentry/serverless": "^7.52.1",

packages/core/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@spade-proxy/core",
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "test": "sst bind vitest",
+    "typecheck": "tsc -noEmit"
+  },
+  "dependencies": {
+    "@ipld/dag-ucan": "3.3.2",
+    "@ucanto/interface": "7.1.0",
+    "@ucanto/principal": "^7.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^18.16.3",
+    "vitest": "^0.31.0",
+    "sst": "^2.8.3",
+    "typescript": "^5.0.4"
+  }
+}

packages/core/service.ts

@@ -0,0 +1,30 @@
+import * as ed25519 from '@ucanto/principal/ed25519'
+import * as DID from '@ipld/dag-ucan/did'
+import { Signer } from '@ucanto/interface'
+
+export const createUcantoServer = (servicePrincipal: Signer, context: UcantoServerCtx) => {
+
+}
+
+/**
+ * Given a config, return a ucanto Signer object representing the service
+ */
+ export function getServiceSigner(config: ServiceSignerCtx) {
+  const signer = ed25519.parse(config.PRIVATE_KEY)
+  if (config.SPADE_PROXY_DID) {
+    const did = DID.parse(config.SPADE_PROXY_DID).did()
+    return signer.withDID(did)
+  }
+  return signer
+}
+
+export interface UcantoServerCtx {
+
+}
+
+export type ServiceSignerCtx = {
+  // multiformats private key of primary signing key
+  PRIVATE_KEY: string
+  // public DID for the upload service (did:key:... derived from PRIVATE_KEY if not set)
+  SPADE_PROXY_DID: string
+}

packages/core/tsconfig.json

@@ -0,0 +1,6 @@
+{
+  "extends": "@tsconfig/node16/tsconfig.json",
+  "compilerOptions": {
+    "module": "esnext"
+  }
+}

packages/functions/package.json

@@ -6,6 +6,9 @@
     "test": "sst bind vitest",
     "typecheck": "tsc -noEmit"
   },
+  "dependencies": {
+    "@spade-proxy/core": "*"
+  },
   "devDependencies": {
     "@sentry/serverless": "7.52.1",
     "@types/aws-lambda": "^8.10.115",

packages/functions/src/api/ucan-invocation-router.ts

@@ -0,0 +1,47 @@
+import { Config } from 'sst/node/config'
+import { APIGatewayProxyHandlerV2, APIGatewayProxyEventV2 } from 'aws-lambda'
+
+import {
+  createUcantoServer,
+  getServiceSigner
+} from '@spade-proxy/core/service'
+// TODO: sentry
+
+async function ucanInvocationRouter(request: APIGatewayProxyEventV2) {
+  const {
+    OFFER_BUCKET_NAME: offerBucketName = '',
+    SPADE_PROXY_DID
+  } = process.env
+
+  if (!SPADE_PROXY_DID) {
+    return {
+      statusCode: 500,
+    }
+  } else if (request.body === undefined) {
+    return {
+      statusCode: 400,
+    }
+  }
+
+  const { PRIVATE_KEY } = Config
+  const serviceSigner = getServiceSigner({ SPADE_PROXY_DID, PRIVATE_KEY })
+  const server = await createUcantoServer(serviceSigner, {})
+
+  return {
+    statusCode: 200,
+    // TODO
+  }
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  return ucanInvocationRouter(event)
+}
+
+// would be generated by sst, but requires `sst build` to be run, which calls out to aws; not great for CI
+declare module 'sst/node/config' {
+  export interface SecretResources {
+    PRIVATE_KEY: {
+      value: string
+    }
+  }
+}

packages/functions/sst-env.d.ts

@@ -0,0 +1 @@
+/// <reference path="../../.sst/types/index.ts" />

sst.config.ts

@@ -1,6 +1,7 @@
 import { Tags } from 'aws-cdk-lib';
 import { SSTConfig } from 'sst';
 import { ApiStack } from './stacks/ApiStack';
+import { DataStack } from './stacks/DataStack';
 
 export default {
   config(_input) {
@@ -20,6 +21,7 @@ export default {
         sourcemap: true
       }
     })
+    app.stack(DataStack);
     app.stack(ApiStack);
 
     // tags let us discover all the aws resource costs incurred by this app

stacks/ApiStack.ts

@@ -1,8 +1,11 @@
 import {
   Api,
+  Config,
   StackContext,
+  use
 } from 'sst/constructs';
 
+import { DataStack } from './DataStack';
 import {
   getApiPackageJson,
   getCustomDomain,
@@ -11,27 +14,38 @@ import {
 } from './config';
 
 export function ApiStack({ app, stack }: StackContext) {
+  const { offerBucket } = use(DataStack)
+
   // Setup app monitoring with Sentry
   setupSentry(app, stack)
 
   // Setup API
   const customDomain = getCustomDomain(stack.stage, process.env.HOSTED_ZONE)
   const pkg = getApiPackageJson()
   const git = getGitInfo()
+  const privateKey = new Config.Secret(stack, 'PRIVATE_KEY')
 
   const api = new Api(stack, 'api', {
     customDomain,
     defaults: {
       function: {
+        permissions: [
+          offerBucket
+        ],
         environment: {
+          OFFER_BUCKET_NAME: offerBucket.bucketName,
           NAME: pkg.name,
           VERSION: pkg.version,
           COMMIT: git.commmit,
           STAGE: stack.stage,
-        }
+        },
+        bind: [
+          privateKey
+        ]
       }
     },
     routes: {
+      'POST /':       'packages/functions/src/api/ucan-invocation-router.handler',
       'GET /version': 'packages/functions/src/api/version.handler',
       'GET /error': 'packages/functions/src/api/error.handler',
     }

stacks/DataStack.ts

@@ -0,0 +1,17 @@
+import { Bucket, StackContext } from 'sst/constructs';
+
+import { getBucketConfig } from './config';
+
+export function DataStack({ stack }: StackContext) {
+  const bucket = getBucketConfig('offer-store', stack.stage)
+  const offerBucket = new Bucket(stack, bucket.bucketName, {
+    cors: true,
+    cdk: {
+      bucket
+    }
+  })
+
+  return {
+    offerBucket
+  }
+}