feat(truapi-server): add platform runtime and host bridge

Cargo.toml

@@ -1,7 +1,6 @@
 [workspace]
 resolver = "2"
 members = ["rust/crates/*"]
-exclude = ["rust/crates/truapi-server"]
 
 [workspace.package]
 edition = "2024"

rust/crates/truapi-codegen/tests/golden/host-callbacks.ts

@@ -74,6 +74,9 @@ export type AuthState =
 /**
  * Core-owned host-private storage slots. Products never address these slots;
  * the host chooses the backing store for each slot.
+ *
+ * Storage is host-local; `storage.md` records the current status quo:
+ * <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/storage.md?plain=1#L1-L7>
  */
 export type CoreStorageKey =
   /**
@@ -102,6 +105,16 @@ export type CreateTransactionReview =
    */
   | { tag: "LegacyAccount"; value: LegacyAccountTxPayload };
 
+/**
+ * Review shown before a product learns the user's primary identity.
+ */
+export interface IdentityDisclosureReview {
+  /**
+   * Product currently handling the request.
+   */
+  productId: string;
+}
+
 /**
  * Permission request whose authorization status can be inspected or updated
  * by host administration UI.
@@ -114,7 +127,11 @@ export type PermissionAuthorizationRequest =
   /**
    * Remote/product-scoped permission such as chain submit or HTTP access.
    */
-  | { tag: "Remote"; value: RemotePermissionRequest };
+  | { tag: "Remote"; value: RemotePermissionRequest }
+  /**
+   * Product-scoped permission to disclose the user's primary identity.
+   */
+  | { tag: "IdentityDisclosure"; value?: undefined };
 
 /**
  * Authorization status for a permission request.
@@ -206,6 +223,10 @@ export type UserConfirmationReview =
    * Allow a product to request another product account alias.
    */
   | { tag: "AccountAlias"; value: AccountAliasReview }
+  /**
+   * Allow a product to learn the user's primary identity.
+   */
+  | { tag: "IdentityDisclosure"; value: IdentityDisclosureReview }
   /**
    * Allocate resources for the requesting product.
    */
@@ -223,6 +244,9 @@ export const AccountAliasReview: S.Codec<AccountAliasReview> = S.lazy((): S.Code
 /**
  * Core-owned host-private storage slots. Products never address these slots;
  * the host chooses the backing store for each slot.
+ *
+ * Storage is host-local; `storage.md` records the current status quo:
+ * <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/storage.md?plain=1#L1-L7>
  */
 export const CoreStorageKey: S.Codec<CoreStorageKey> = S.lazy((): S.Codec<CoreStorageKey> => S.TaggedUnion({AuthSession: S._void, PairingDeviceIdentity: S._void, PermissionAuthorization: S.Struct({productId: S.str, request: PermissionAuthorizationRequest}) as S.Codec<{ productId: string; request: PermissionAuthorizationRequest }>}));
 
@@ -231,11 +255,16 @@ export const CoreStorageKey: S.Codec<CoreStorageKey> = S.lazy((): S.Codec<CoreSt
  */
 export const CreateTransactionReview: S.Codec<CreateTransactionReview> = S.lazy((): S.Codec<CreateTransactionReview> => S.TaggedUnion({Product: ProductAccountTxPayload, LegacyAccount: LegacyAccountTxPayload}));
 
+/**
+ * Review shown before a product learns the user's primary identity.
+ */
+export const IdentityDisclosureReview: S.Codec<IdentityDisclosureReview> = S.lazy((): S.Codec<IdentityDisclosureReview> => S.Struct({productId: S.str}) as S.Codec<IdentityDisclosureReview>);
+
 /**
  * Permission request whose authorization status can be inspected or updated
  * by host administration UI.
  */
-export const PermissionAuthorizationRequest: S.Codec<PermissionAuthorizationRequest> = S.lazy((): S.Codec<PermissionAuthorizationRequest> => S.TaggedUnion({Device: HostDevicePermissionRequest, Remote: RemotePermissionRequest}));
+export const PermissionAuthorizationRequest: S.Codec<PermissionAuthorizationRequest> = S.lazy((): S.Codec<PermissionAuthorizationRequest> => S.TaggedUnion({Device: HostDevicePermissionRequest, Remote: RemotePermissionRequest, IdentityDisclosure: S._void}));
 
 /**
  * Authorization status for a permission request.
@@ -263,7 +292,7 @@ export const SignRawReview: S.Codec<SignRawReview> = S.lazy((): S.Codec<SignRawR
 /**
  * Review shown before a user-confirmed core action continues.
  */
-export const UserConfirmationReview: S.Codec<UserConfirmationReview> = S.lazy((): S.Codec<UserConfirmationReview> => S.TaggedUnion({SignPayload: SignPayloadReview, SignRaw: SignRawReview, CreateTransaction: CreateTransactionReview, AccountAlias: AccountAliasReview, ResourceAllocation: HostRequestResourceAllocationRequest, PreimageSubmit: PreimageSubmitReview}));
+export const UserConfirmationReview: S.Codec<UserConfirmationReview> = S.lazy((): S.Codec<UserConfirmationReview> => S.TaggedUnion({SignPayload: SignPayloadReview, SignRaw: SignRawReview, CreateTransaction: CreateTransactionReview, AccountAlias: AccountAliasReview, IdentityDisclosure: IdentityDisclosureReview, ResourceAllocation: HostRequestResourceAllocationRequest, PreimageSubmit: PreimageSubmitReview}));
 
 /**
  * Host auth UI driven by core-owned `AuthState` transitions.
@@ -282,6 +311,9 @@ export interface AuthPresenter {
  *
  * The platform provides a way to get a JSON-RPC connection for a given chain.
  * The server runtime manages the chainHead v1 state machine on top of this.
+ * Host-spec N.6 requires products to access chains through host-mediated
+ * providers:
+ * <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/spec/N-shared-infrastructure.md?plain=1#L91-L102>
  */
 export interface ChainProvider {
   /**
@@ -491,11 +523,11 @@ export interface ThemeHost {
 }
 
 /**
- * Local user confirmation UI for session-channel operations.
+ * Local user confirmation UI for sensitive core-owned operations.
  */
 export interface UserConfirmation {
   /**
-   * Confirm a reviewed action before the core asks the SSO peer.
+   * Confirm a reviewed action before the core continues.
    */
   confirmUserAction(review: UserConfirmationReview): Promise<boolean>;
 }

rust/crates/truapi-codegen/tests/golden_rust_emit.rs

@@ -32,11 +32,8 @@ fn quoted_strings_in_const_array(src: &str, const_name: &str) -> Vec<String> {
 }
 
 fn wasm_optional_callback_names(workspace: &Path) -> Vec<String> {
-    let wasm_rs = workspace.join("rust/crates/truapi-server/src/wasm.rs");
-    if !wasm_rs.exists() {
-        return Vec::new();
-    }
-    let src = fs::read_to_string(wasm_rs).expect("read wasm.rs");
+    let src = fs::read_to_string(workspace.join("rust/crates/truapi-server/src/wasm.rs"))
+        .expect("read wasm.rs");
     let mut names = src
         .lines()
         .filter_map(|line| {

rust/crates/truapi-platform/src/lib.rs

@@ -42,10 +42,17 @@ pub struct HostRuntimeConfig {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct PairingHostConfig {
     /// Host identity shown to the signing host during pairing.
+    ///
+    /// Host-spec B.1.3 defines the host metadata consumed by the signing host:
+    /// <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/spec/B-inter-host.md?plain=1#L48-L60>
     pub host: HostRuntimeConfig,
     /// People-chain genesis hash used for statement-store SSO.
     pub people_chain_genesis_hash: [u8; 32],
     /// Deeplink URI scheme used in pairing QR payloads, without `://`.
+    ///
+    /// Host-spec L.2-L.3 define the `polkadotapp://pair` route and construction
+    /// rules:
+    /// <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/spec/L-url-schemes.md?plain=1#L17-L33>
     pub pairing_deeplink_scheme: String,
 }
 
@@ -70,6 +77,9 @@ pub struct SigningHostConfig {
 pub struct ProductContext {
     /// Product identifier used for account derivation and product-scoped
     /// storage/permission namespaces.
+    ///
+    /// Host-spec C.7 defines accepted product id forms:
+    /// <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/spec/C-account-derivation.md?plain=1#L109-L128>
     pub product_id: String,
 }
 
@@ -305,6 +315,8 @@ pub enum PermissionAuthorizationRequest {
     Device(HostDevicePermissionRequest),
     /// Remote/product-scoped permission such as chain submit or HTTP access.
     Remote(RemotePermissionRequest),
+    /// Product-scoped permission to disclose the user's primary identity.
+    IdentityDisclosure,
 }
 
 /// Authorization status for a permission request.
@@ -382,6 +394,9 @@ pub trait Features: Send + Sync {
 ///
 /// The platform provides a way to get a JSON-RPC connection for a given chain.
 /// The server runtime manages the chainHead v1 state machine on top of this.
+/// Host-spec N.6 requires products to access chains through host-mediated
+/// providers:
+/// <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/spec/N-shared-infrastructure.md?plain=1#L91-L102>
 #[async_trait]
 pub trait ChainProvider: Send + Sync {
     /// Open a JSON-RPC connection for the chain identified by `genesis_hash`.
@@ -409,6 +424,9 @@ pub trait JsonRpcConnection: Send + Sync {
 
 /// Core-owned host-private storage slots. Products never address these slots;
 /// the host chooses the backing store for each slot.
+///
+/// Storage is host-local; `storage.md` records the current status quo:
+/// <https://github.com/paritytech/host-spec/blob/adb3989208ae1c2107dbf0159611353e6989422c/storage.md?plain=1#L1-L7>
 #[derive(Debug, Clone, PartialEq, Eq, Encode, Decode)]
 pub enum CoreStorageKey {
     /// Opaque SSO/auth session blob.
@@ -526,6 +544,13 @@ pub struct AccountAliasReview {
     pub target_product_id: String,
 }
 
+/// Review shown before a product learns the user's primary identity.
+#[derive(Debug, Clone, PartialEq, Eq, Encode, Decode)]
+pub struct IdentityDisclosureReview {
+    /// Product currently handling the request.
+    pub product_id: String,
+}
+
 /// Review shown before a preimage is submitted.
 #[derive(Debug, Clone, PartialEq, Eq, Encode, Decode)]
 pub struct PreimageSubmitReview {
@@ -545,16 +570,18 @@ pub enum UserConfirmationReview {
     CreateTransaction(CreateTransactionReview),
     /// Allow a product to request another product account alias.
     AccountAlias(AccountAliasReview),
+    /// Allow a product to learn the user's primary identity.
+    IdentityDisclosure(IdentityDisclosureReview),
     /// Allocate resources for the requesting product.
     ResourceAllocation(HostRequestResourceAllocationRequest),
     /// Submit a preimage to the host-selected backend.
     PreimageSubmit(PreimageSubmitReview),
 }
 
-/// Local user confirmation UI for session-channel operations.
+/// Local user confirmation UI for sensitive core-owned operations.
 #[async_trait]
 pub trait UserConfirmation: Send + Sync {
-    /// Confirm a reviewed action before the core asks the SSO peer.
+    /// Confirm a reviewed action before the core continues.
     async fn confirm_user_action(
         &self,
         review: UserConfirmationReview,

rust/crates/truapi-server/Cargo.toml

@@ -11,6 +11,9 @@ crate-type = ["rlib", "cdylib"]
 [features]
 default = []
 
+[lints.rust]
+unsafe_code = "forbid"
+
 [dependencies]
 truapi = { path = "../truapi" }
 truapi-platform = { path = "../truapi-platform" }
@@ -31,6 +34,7 @@ sp-crypto-hashing = { version = "0.1", default-features = false }
 bs58 = { version = "0.5", default-features = false, features = ["alloc"] }
 schnorrkel = { version = "0.11.5", default-features = false, features = ["alloc", "getrandom"] }
 substrate-bip39 = { version = "0.6", default-features = false }
+zeroize = { version = "1", default-features = false, features = ["alloc"] }
 getrandom = { version = "0.2", features = ["js"] }
 p256 = { version = "0.13", default-features = false, features = ["ecdh"] }
 hkdf = "0.12"