Paths

Table of Contentst

-
services/
-
backup/
-
docker-base/
-
Dockerfile
-
contents/
-
install_aws_sdk.sh
-
install_folly.sh
-
docker-server/
-
Dockerfile
-
base-image/
-
Dockerfile
-
contents/
-
install_aws_sdk.sh
-
install_folly.sh
-
install_grpc.sh
-
blob/
-
docker-base/
-
Dockerfile
-
contents/
-
install_aws_sdk.sh
-
install_folly.sh
-
docker-server/
-
Dockerfile
-
docker-compose.yml
-
tunnelbroker/
-
Dockerfile

[services] Move as much content as possible to the parent base image
ClosedPublic
Actions

Authored by • karol on Feb 23 2022, 8:47 AM.

Details

Reviewers

tomek
• max
varun
• jim
ashoat

Commits

rCOMM15911abd9dee: [services] Move as much content as possible to the parent base image

Summary

https://linear.app/comm/issue/ENG-804/fix-services-images

Moved as much as possible to the parent base image, bumped images' versions.

Depends on D3198

Test Plan

cd services
yarn build-backup-base
yarn build-tunnelbroker-base
yarn build-blob-base
yarn build-backup-base

yarn test-blob-service
yarn test-backup-service
yarn run-tunnelbroker-service

Diff Detail

Repository

rCOMM Comm

Lint

No Lint Coverage

Unit

No Test Coverage

Event Timeline

• karol created this revision.Feb 23 2022, 8:47 AM

Herald added subscribers: atul, • adrian, tomek, ashoat. · View Herald TranscriptFeb 23 2022, 8:47 AM

Harbormaster returned this revision to the author for changes because remote builds failed.Feb 23 2022, 9:20 AM

Harbormaster failed remote builds in B6976: Diff 9840!

• karol edited the summary of this revision. (Show Details)Feb 24 2022, 2:44 AM

• karol edited the test plan for this revision. (Show Details)

• karol added reviewers: tomek, • max, varun, • jim.

• karol added a parent revision: D3198: [services] Move folly from Blob to Backup base.

remove failing COPY instructions

• karol added a child revision: D3200: [services] Backup - dev mode.Feb 24 2022, 2:56 AM

Harbormaster completed remote builds in B7011: Diff 9889.Feb 24 2022, 2:59 AM

• karol requested review of this revision.Feb 24 2022, 2:59 AM

tomek accepted this revision.Feb 25 2022, 3:59 AM

This revision is now accepted and ready to land.Feb 25 2022, 3:59 AM

Herald added a reviewer: ashoat. · View Herald TranscriptFeb 25 2022, 3:59 AM

Herald added a subscriber: • benschac. · View Herald Transcript

This revision now requires review to proceed.Feb 25 2022, 3:59 AM

Can you be more precise about what is being "fixed"? I thought that we had some strange situation where either blob depending on backup, or backup depended on blob... but looking at the "before" state here, I can't seem to find where that dependency is...

This revision is now accepted and ready to land.Feb 25 2022, 12:45 PM

rebase

• karol retitled this revision from [services] fix images to [services] Move as much content as possible to the parent base image.Mar 2 2022, 4:50 AM

In D3268#88515, @ashoat wrote:

Can you be more precise about what is being "fixed"? I thought that we had some strange situation where either blob depending on backup, or backup depended on blob... but looking at the "before" state here, I can't seem to find where that dependency is...

This is done in D3198, here we

Moved as much as possible to the parent base image

I edited the revision's title.

Harbormaster completed remote builds in B7102: Diff 10012.Mar 2 2022, 5:43 AM

Good idea. There are a couple other improvements possible now, in particular building gRPC with the -DgRPC_SSL_PROVIDER=package and -DgRPC_ZLIB_PROVIDER=package flags to avoid building BoringSSL and rebuilding zlib and instead use the system libs installed in the base image.

services/backup/docker-base/Dockerfile
7 ↗	(On Diff #10012)	Moving this into a separate RUN command defeats the whole point, which is to avoid having a layer with the whole apt cache. See https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#apt-get "In addition, when you clean up the apt cache by removing /var/lib/apt/lists it reduces the image size, since the apt cache is not stored in a layer."

This is done in D3198, here we

Huh? It's confusing to read this. In D3198 you clearly indicate that the confusing dependency is not addressed – in fact, in that diff you created a Linear task to track that issue (on my request).

But now you seem to be indicating that that diff solves the confusing dependency?

Honestly, I think the reason for my continued confusion is that you responded to my request to be "more precise" with a total of 12 words. Can you please try again, and this time explain in detail an answer to my question?

Here's the question again:

I thought that we had some strange situation where either blob depending on backup, or backup depended on blob... but looking at the "before" state here, I can't seem to find where that dependency is...

Where is the dependency? Does it still exist?

Requesting changes for @jimpo's comment. @karol-bisztyga, I'm pretty sure that the issues around build caching in Docker and the reasoning for merging these RUN commands has been discussed before in diffs that you have been on. See my comment here – it's concerning to me that you missed that whole discussion, and then made this change without doing the appropriate research

This revision now requires changes to proceed.Mar 2 2022, 10:46 PM

Here I said:

I'm going to push here some changes that get rid of it and an additional diff that follows the DRY rule.

And by "it" I meant this confusing dependency, this was said in D3198. So, once again:

in D3198 I get rid of the confusing dependency
here I get rid of repeated stuff in the Dockerfiles

I see now that the description in this task was probably misleading so I updated it.

I hope it's now all clear, I'm not sure what else I can say to put yet more light on this, it looks pretty straightforward to me.

Requesting changes for @jimpo's comment. @karol-bisztyga, I'm pretty sure that the issues around build caching in Docker and the reasoning for merging these RUN commands has been discussed before in diffs that you have been on. See my comment here – it's concerning to me that you missed that whole discussion, and then made this change without doing the appropriate research

Yes, this is an oversight on my end, sorry, I'm going to fix this. @jimpo thanks for clarifying and catching this!

In D3268#89281, @jimpo wrote:

Good idea. There are a couple other improvements possible now, in particular building gRPC with the -DgRPC_SSL_PROVIDER=package and -DgRPC_ZLIB_PROVIDER=package flags to avoid building BoringSSL and rebuilding zlib and instead use the system libs installed in the base image.

Is there a task for this?

update

Harbormaster completed remote builds in B7128: Diff 10039.Mar 3 2022, 3:49 AM

In D3268#89591, @karol-bisztyga wrote:

Is there a task for this?

Just made one https://linear.app/comm/issue/ENG-824/dont-build-redundant-dependencies-for-grpc

In D3268#89586, @karol-bisztyga wrote:

Here I said:

I'm going to push here some changes that get rid of it and an additional diff that follows the DRY rule.

And by "it" I meant this confusing dependency, this was said in D3198. So, once again:

in D3198 I get rid of the confusing dependency

here I get rid of repeated stuff in the Dockerfiles

I see now that the description in this task was probably misleading so I updated it.

I hope it's now all clear, I'm not sure what else I can say to put yet more light on this, it looks pretty straightforward to me.

Thanks for this explanation – I understand now!!

services/base-image/contents/install_grpc.sh
7–11 ↗	(On Diff #10039)	Let's make the semicolons match here too. Whenever a reviewer leaves a comment, it's always good to see if it applies anywhere else in your currently open diff(s)

This revision is now accepted and ready to land.Mar 3 2022, 10:16 PM

ashoat mentioned this in D3198: [services] Move folly from Blob to Backup base.Mar 3 2022, 10:20 PM

fix if then

In D3268#89659, @jimpo wrote:

In D3268#89591, @karol-bisztyga wrote:

Is there a task for this?

Just made one https://linear.app/comm/issue/ENG-824/dont-build-redundant-dependencies-for-grpc

thanks

rebase

Harbormaster completed remote builds in B7140: Diff 10051.Mar 4 2022, 4:10 AM

Harbormaster completed remote builds in B7142: Diff 10053.Mar 4 2022, 4:35 AM

• jim accepted this revision.Mar 4 2022, 12:09 PM

rebase

Harbormaster failed remote builds in B7321: Diff 10322!Mar 14 2022, 6:38 AM

fix CI

Harbormaster completed remote builds in B7330: Diff 10331.Mar 14 2022, 8:37 AM

ashoat added inline comments.Mar 14 2022, 9:08 PM

services/base-image/contents/install_grpc.sh
9	Semicolon is still here

semicolon

Harbormaster completed remote builds in B7367: Diff 10371.Mar 15 2022, 2:56 AM

Closed by commit rCOMM15911abd9dee: [services] Move as much content as possible to the parent base image (authored by • karol). · Explain WhyMar 15 2022, 3:20 AM

This revision was automatically updated to reflect the committed changes.

• karol added a commit: rCOMM15911abd9dee: [services] Move as much content as possible to the parent base image.

• karol mentioned this in D3439: [services] Tunnelbroker - bump base image version.Mar 16 2022, 2:00 AM

atul mentioned this in rCOMM8e2d04051bf9: [services] Tunnelbroker - bump base image version.Mar 17 2022, 11:40 AM

• jim added inline comments.Mar 17 2022, 3:02 PM

services/tunnelbroker/Dockerfile
5 ↗	(On Diff #10374)	This should have been removed as well

• jim mentioned this in D3457: [tunnelbroker] Remove repeated Dockerfile instructions.Mar 17 2022, 3:57 PM

• jim mentioned this in rCOMMc6c122495d64: [tunnelbroker] Remove repeated Dockerfile instructions.Mar 18 2022, 5:56 AM

Revision Contents
Changeset List

Path

Size

services/

backup/

docker-base/

Dockerfile

17 lines

contents/

install_aws_sdk.sh

install_folly.sh

docker-server/

Dockerfile

2 lines

base-image/

Dockerfile

7 lines

contents/

install_grpc.sh

4 lines

	base-image/		contents/
	backup/	docker-base/	contents/

install_aws_sdk.sh

4 lines

install_folly.sh

11 lines

blob/

docker-base/

Dockerfile

15 lines

contents/

docker-server/

2 lines

4 lines

tunnelbroker/

Dockerfile

6 lines

Diff 10331

View Options

services/backup/docker-base/Dockerfile

This file was copied to native/cpp/CommonCpp/grpc/grpc_client/src/identity_client.rs.

	use lazy_static::lazy_static;			use lazy_static::lazy_static;
	use opaque_ke::{
	ClientLogin, ClientLoginFinishParameters, ClientLoginStartParameters,
	ClientLoginStartResult, ClientRegistration,
	ClientRegistrationFinishParameters, CredentialFinalization,
	CredentialResponse, RegistrationResponse, RegistrationUpload,
	};
	use rand::{rngs::OsRng, CryptoRng, Rng};
	use std::sync::Arc;			use std::sync::Arc;
	use tokio::runtime::{Builder, Runtime};			use tokio::runtime::{Builder, Runtime};
	use tokio::sync::mpsc;
	use tokio_stream::wrappers::ReceiverStream;
	use tonic::{transport::Channel, Request, Status};
	use tracing::{error, instrument};

				pub mod identity_client;
	mod opaque;			mod opaque;
	use opaque::Cipher;

	use crate::identity::{
	identity_service_client::IdentityServiceClient,
	login_request::Data::PakeLoginRequest,
	login_request::Data::WalletLoginRequest,
	login_response::Data::PakeLoginResponse as LoginPakeLoginResponse,
	login_response::Data::WalletLoginResponse,
	pake_login_request::Data::PakeCredentialFinalization as LoginPakeCredentialFinalization,
	pake_login_request::Data::PakeCredentialRequestAndUserId,
	pake_login_response::Data::AccessToken,
	pake_login_response::Data::PakeCredentialResponse,
	registration_request::Data::PakeCredentialFinalization as RegistrationPakeCredentialFinalization,
	registration_request::Data::PakeRegistrationRequestAndUserId,
	registration_request::Data::PakeRegistrationUploadAndCredentialRequest,
	registration_response::Data::PakeLoginResponse as RegistrationPakeLoginResponse,
	registration_response::Data::PakeRegistrationResponse, GetUserIdRequest,
	LoginRequest, LoginResponse,
	PakeCredentialRequestAndUserId as PakeCredentialRequestAndUserIdStruct,
	PakeLoginRequest as PakeLoginRequestStruct,
	PakeLoginResponse as PakeLoginResponseStruct,
	PakeRegistrationRequestAndUserId as PakeRegistrationRequestAndUserIdStruct,
	PakeRegistrationUploadAndCredentialRequest as PakeRegistrationUploadAndCredentialRequestStruct,
	RegistrationRequest, RegistrationResponse as RegistrationResponseMessage,
	VerifyUserTokenRequest, WalletLoginRequest as WalletLoginRequestStruct,
	WalletLoginResponse as WalletLoginResponseStruct,
	};
	pub mod identity {			pub mod identity {
	tonic::include_proto!("identity");			tonic::include_proto!("identity");
	}			}

	const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";			const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";

	lazy_static! {			lazy_static! {
	pub static ref RUNTIME: Arc<Runtime> = Arc::new(			pub static ref RUNTIME: Arc<Runtime> = Arc::new(
	Builder::new_multi_thread()			Builder::new_multi_thread()
	.worker_threads(1)			.worker_threads(1)
	.max_blocking_threads(1)			.max_blocking_threads(1)
	.enable_all()			.enable_all()
	.build()			.build()
	.unwrap()			.unwrap()
	);			);
	}			}

	#[cxx::bridge(namespace = "identity")]
	mod ffi {
	extern "Rust" {
	type Client;
	fn initialize_client() -> Box<Client>;
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String>;
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool>;
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String>;
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String>;
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String>;
	}
	}

	#[derive(Debug)]
	struct Client {
	identity_client: IdentityServiceClient<Channel>,
	}

	fn initialize_client() -> Box<Client> {
	Box::new(Client {
	identity_client: RUNTIME
	.block_on(IdentityServiceClient::connect(IDENTITY_SERVICE_SOCKET_ADDR))
	.unwrap(),
	})
	}

	async fn get_user_id(
	mut client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	Ok(
	client
	.identity_client
	.get_user_id(GetUserIdRequest {
	auth_type,
	user_info,
	})
	.await?
	.into_inner()
	.user_id,
	)
	}

	#[instrument]
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(get_user_id(client, auth_type, user_info))
	}

	async fn verify_user_token(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	Ok(
	client
	.identity_client
	.verify_user_token(VerifyUserTokenRequest {
	user_id,
	device_id,
	access_token,
	})
	.await?
	.into_inner()
	.token_valid,
	)
	}

	#[instrument]
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	RUNTIME.block_on(verify_user_token(client, user_id, device_id, access_token))
	}

	async fn register_user(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a RegistrationRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.register_user(request)
	.await?
	.into_inner();

	// Start PAKE registration on client and send initial registration request
	// to Identity service
	let mut client_rng = OsRng;
	let (registration_request, client_registration) = pake_registration_start(
	&mut client_rng,
	user_id,
	&password,
	device_id,
	username,
	user_public_key,
	)?;
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE registration and begin PAKE login; send the final
	// registration request and initial login request together to reduce the
	// number of trips
	let message = response.message().await?;
	let client_login = handle_registration_response(
	message,
	&mut client_rng,
	client_registration,
	&password,
	tx.clone(),
	)
	.await?;

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_registration_credential_response(message, client_login, tx).await?;

	// Return access token
	let message = response.message().await?;
	handle_registration_token_response(message)
	}

	#[instrument]
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(register_user(
	client,
	user_id,
	device_id,
	username,
	password,
	user_public_key,
	))
	}

	async fn login_user_pake(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start PAKE login on client and send initial login request to Identity
	// service
	let mut client_rng = OsRng;
	let client_login_start_result = pake_login_start(&mut client_rng, &password)?;
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(PakeCredentialRequestAndUserId(
	PakeCredentialRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_login_credential_response(
	message,
	client_login_start_result.state,
	tx,
	)
	.await?;

	// Return access token
	let message = response.message().await?;
	handle_login_token_response(message)
	}

	#[instrument]
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_pake(client, user_id, device_id, password))
	}

	async fn login_user_wallet(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start wallet login on client and send initial login request to Identity
	// service
	let login_request = LoginRequest {
	data: Some(WalletLoginRequest(WalletLoginRequestStruct {
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Return access token
	let message = response.message().await?;
	handle_wallet_login_response(message)
	}

	#[instrument]
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_wallet(
	client,
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	))
	}

	fn pake_registration_start(
	rng: &mut (impl Rng + CryptoRng),
	user_id: String,
	password: &str,
	device_id: String,
	username: String,
	user_public_key: String,
	) -> Result<(RegistrationRequest, ClientRegistration<Cipher>), Status> {
	let client_registration_start_result =
	ClientRegistration::<Cipher>::start(rng, password.as_bytes()).map_err(
	\|e\| {
	error!("Failed to start PAKE registration: {}", e);
	Status::failed_precondition("PAKE failure")
	},
	)?;
	let pake_registration_request =
	client_registration_start_result.message.serialize();
	Ok((
	RegistrationRequest {
	data: Some(PakeRegistrationRequestAndUserId(
	PakeRegistrationRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_registration_request,
	username,
	user_public_key,
	},
	)),
	},
	client_registration_start_result.state,
	))
	}

	fn pake_registration_finish(
	rng: &mut (impl Rng + CryptoRng),
	registration_response_bytes: &[u8],
	client_registration: ClientRegistration<Cipher>,
	) -> Result<RegistrationUpload<Cipher>, Status> {
	client_registration
	.finish(
	rng,
	RegistrationResponse::deserialize(registration_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize registration response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientRegistrationFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE registration: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn pake_login_start(
	rng: &mut (impl Rng + CryptoRng),
	password: &str,
	) -> Result<ClientLoginStartResult<Cipher>, Status> {
	ClientLogin::<Cipher>::start(
	rng,
	password.as_bytes(),
	ClientLoginStartParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to start PAKE login: {}", e);
	Status::failed_precondition("PAKE failure")
	})
	}

	fn pake_login_finish(
	credential_response_bytes: &[u8],
	client_login: ClientLogin<Cipher>,
	) -> Result<CredentialFinalization<Cipher>, Status> {
	client_login
	.finish(
	CredentialResponse::deserialize(credential_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize credential response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientLoginFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE login: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn handle_unexpected_response<T: std::fmt::Debug>(
	message: Option<T>,
	) -> Status {
	error!("Received an unexpected message: {:?}", message);
	Status::invalid_argument("Invalid response data")
	}

	async fn handle_registration_response(
	message: Option<RegistrationResponseMessage>,
	client_rng: &mut (impl Rng + CryptoRng),
	client_registration: ClientRegistration<Cipher>,
	password: &str,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<ClientLogin<Cipher>, Status> {
	if let Some(RegistrationResponseMessage {
	data: Some(PakeRegistrationResponse(registration_response_bytes)),
	..
	}) = message
	{
	let pake_registration_upload = pake_registration_finish(
	client_rng,
	&registration_response_bytes,
	client_registration,
	)?
	.serialize();
	let client_login_start_result = pake_login_start(client_rng, password)?;

	// `registration_request` is a gRPC message containing serialized bytes to
	// complete PAKE registration and begin PAKE login
	let registration_request = RegistrationRequest {
	data: Some(PakeRegistrationUploadAndCredentialRequest(
	PakeRegistrationUploadAndCredentialRequestStruct {
	pake_registration_upload,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	};
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(client_login_start_result.state)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_registration_credential_response(
	message: Option<RegistrationResponseMessage>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<(), Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let registration_request = RegistrationRequest {
	data: Some(RegistrationPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	};
	send_to_mpsc(tx, registration_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_login_credential_response(
	message: Option<LoginResponse>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<LoginRequest>,
	) -> Result<(), Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(LoginPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	})),
	};
	send_to_mpsc(tx, login_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_registration_token_response(
	message: Option<RegistrationResponseMessage>,
	) -> Result<String, Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_login_token_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_wallet_login_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data: Some(WalletLoginResponse(WalletLoginResponseStruct { access_token })),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn send_to_mpsc<T>(
	tx: mpsc::Sender<T>,
	request: T,
	) -> Result<(), Status> {
	if let Err(e) = tx.send(request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(())
	}

View Options

services/backup/docker-base/contents/install_aws_sdk.sh

This file was copied to native/cpp/CommonCpp/grpc/grpc_client/src/identity_client.rs.

	use lazy_static::lazy_static;			use lazy_static::lazy_static;
	use opaque_ke::{
	ClientLogin, ClientLoginFinishParameters, ClientLoginStartParameters,
	ClientLoginStartResult, ClientRegistration,
	ClientRegistrationFinishParameters, CredentialFinalization,
	CredentialResponse, RegistrationResponse, RegistrationUpload,
	};
	use rand::{rngs::OsRng, CryptoRng, Rng};
	use std::sync::Arc;			use std::sync::Arc;
	use tokio::runtime::{Builder, Runtime};			use tokio::runtime::{Builder, Runtime};
	use tokio::sync::mpsc;
	use tokio_stream::wrappers::ReceiverStream;
	use tonic::{transport::Channel, Request, Status};
	use tracing::{error, instrument};

				pub mod identity_client;
	mod opaque;			mod opaque;
	use opaque::Cipher;

	use crate::identity::{
	identity_service_client::IdentityServiceClient,
	login_request::Data::PakeLoginRequest,
	login_request::Data::WalletLoginRequest,
	login_response::Data::PakeLoginResponse as LoginPakeLoginResponse,
	login_response::Data::WalletLoginResponse,
	pake_login_request::Data::PakeCredentialFinalization as LoginPakeCredentialFinalization,
	pake_login_request::Data::PakeCredentialRequestAndUserId,
	pake_login_response::Data::AccessToken,
	pake_login_response::Data::PakeCredentialResponse,
	registration_request::Data::PakeCredentialFinalization as RegistrationPakeCredentialFinalization,
	registration_request::Data::PakeRegistrationRequestAndUserId,
	registration_request::Data::PakeRegistrationUploadAndCredentialRequest,
	registration_response::Data::PakeLoginResponse as RegistrationPakeLoginResponse,
	registration_response::Data::PakeRegistrationResponse, GetUserIdRequest,
	LoginRequest, LoginResponse,
	PakeCredentialRequestAndUserId as PakeCredentialRequestAndUserIdStruct,
	PakeLoginRequest as PakeLoginRequestStruct,
	PakeLoginResponse as PakeLoginResponseStruct,
	PakeRegistrationRequestAndUserId as PakeRegistrationRequestAndUserIdStruct,
	PakeRegistrationUploadAndCredentialRequest as PakeRegistrationUploadAndCredentialRequestStruct,
	RegistrationRequest, RegistrationResponse as RegistrationResponseMessage,
	VerifyUserTokenRequest, WalletLoginRequest as WalletLoginRequestStruct,
	WalletLoginResponse as WalletLoginResponseStruct,
	};
	pub mod identity {			pub mod identity {
	tonic::include_proto!("identity");			tonic::include_proto!("identity");
	}			}

	const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";			const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";

	lazy_static! {			lazy_static! {
	pub static ref RUNTIME: Arc<Runtime> = Arc::new(			pub static ref RUNTIME: Arc<Runtime> = Arc::new(
	Builder::new_multi_thread()			Builder::new_multi_thread()
	.worker_threads(1)			.worker_threads(1)
	.max_blocking_threads(1)			.max_blocking_threads(1)
	.enable_all()			.enable_all()
	.build()			.build()
	.unwrap()			.unwrap()
	);			);
	}			}

	#[cxx::bridge(namespace = "identity")]
	mod ffi {
	extern "Rust" {
	type Client;
	fn initialize_client() -> Box<Client>;
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String>;
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool>;
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String>;
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String>;
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String>;
	}
	}

	#[derive(Debug)]
	struct Client {
	identity_client: IdentityServiceClient<Channel>,
	}

	fn initialize_client() -> Box<Client> {
	Box::new(Client {
	identity_client: RUNTIME
	.block_on(IdentityServiceClient::connect(IDENTITY_SERVICE_SOCKET_ADDR))
	.unwrap(),
	})
	}

	async fn get_user_id(
	mut client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	Ok(
	client
	.identity_client
	.get_user_id(GetUserIdRequest {
	auth_type,
	user_info,
	})
	.await?
	.into_inner()
	.user_id,
	)
	}

	#[instrument]
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(get_user_id(client, auth_type, user_info))
	}

	async fn verify_user_token(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	Ok(
	client
	.identity_client
	.verify_user_token(VerifyUserTokenRequest {
	user_id,
	device_id,
	access_token,
	})
	.await?
	.into_inner()
	.token_valid,
	)
	}

	#[instrument]
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	RUNTIME.block_on(verify_user_token(client, user_id, device_id, access_token))
	}

	async fn register_user(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a RegistrationRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.register_user(request)
	.await?
	.into_inner();

	// Start PAKE registration on client and send initial registration request
	// to Identity service
	let mut client_rng = OsRng;
	let (registration_request, client_registration) = pake_registration_start(
	&mut client_rng,
	user_id,
	&password,
	device_id,
	username,
	user_public_key,
	)?;
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE registration and begin PAKE login; send the final
	// registration request and initial login request together to reduce the
	// number of trips
	let message = response.message().await?;
	let client_login = handle_registration_response(
	message,
	&mut client_rng,
	client_registration,
	&password,
	tx.clone(),
	)
	.await?;

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_registration_credential_response(message, client_login, tx).await?;

	// Return access token
	let message = response.message().await?;
	handle_registration_token_response(message)
	}

	#[instrument]
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(register_user(
	client,
	user_id,
	device_id,
	username,
	password,
	user_public_key,
	))
	}

	async fn login_user_pake(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start PAKE login on client and send initial login request to Identity
	// service
	let mut client_rng = OsRng;
	let client_login_start_result = pake_login_start(&mut client_rng, &password)?;
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(PakeCredentialRequestAndUserId(
	PakeCredentialRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_login_credential_response(
	message,
	client_login_start_result.state,
	tx,
	)
	.await?;

	// Return access token
	let message = response.message().await?;
	handle_login_token_response(message)
	}

	#[instrument]
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_pake(client, user_id, device_id, password))
	}

	async fn login_user_wallet(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start wallet login on client and send initial login request to Identity
	// service
	let login_request = LoginRequest {
	data: Some(WalletLoginRequest(WalletLoginRequestStruct {
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Return access token
	let message = response.message().await?;
	handle_wallet_login_response(message)
	}

	#[instrument]
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_wallet(
	client,
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	))
	}

	fn pake_registration_start(
	rng: &mut (impl Rng + CryptoRng),
	user_id: String,
	password: &str,
	device_id: String,
	username: String,
	user_public_key: String,
	) -> Result<(RegistrationRequest, ClientRegistration<Cipher>), Status> {
	let client_registration_start_result =
	ClientRegistration::<Cipher>::start(rng, password.as_bytes()).map_err(
	\|e\| {
	error!("Failed to start PAKE registration: {}", e);
	Status::failed_precondition("PAKE failure")
	},
	)?;
	let pake_registration_request =
	client_registration_start_result.message.serialize();
	Ok((
	RegistrationRequest {
	data: Some(PakeRegistrationRequestAndUserId(
	PakeRegistrationRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_registration_request,
	username,
	user_public_key,
	},
	)),
	},
	client_registration_start_result.state,
	))
	}

	fn pake_registration_finish(
	rng: &mut (impl Rng + CryptoRng),
	registration_response_bytes: &[u8],
	client_registration: ClientRegistration<Cipher>,
	) -> Result<RegistrationUpload<Cipher>, Status> {
	client_registration
	.finish(
	rng,
	RegistrationResponse::deserialize(registration_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize registration response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientRegistrationFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE registration: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn pake_login_start(
	rng: &mut (impl Rng + CryptoRng),
	password: &str,
	) -> Result<ClientLoginStartResult<Cipher>, Status> {
	ClientLogin::<Cipher>::start(
	rng,
	password.as_bytes(),
	ClientLoginStartParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to start PAKE login: {}", e);
	Status::failed_precondition("PAKE failure")
	})
	}

	fn pake_login_finish(
	credential_response_bytes: &[u8],
	client_login: ClientLogin<Cipher>,
	) -> Result<CredentialFinalization<Cipher>, Status> {
	client_login
	.finish(
	CredentialResponse::deserialize(credential_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize credential response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientLoginFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE login: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn handle_unexpected_response<T: std::fmt::Debug>(
	message: Option<T>,
	) -> Status {
	error!("Received an unexpected message: {:?}", message);
	Status::invalid_argument("Invalid response data")
	}

	async fn handle_registration_response(
	message: Option<RegistrationResponseMessage>,
	client_rng: &mut (impl Rng + CryptoRng),
	client_registration: ClientRegistration<Cipher>,
	password: &str,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<ClientLogin<Cipher>, Status> {
	if let Some(RegistrationResponseMessage {
	data: Some(PakeRegistrationResponse(registration_response_bytes)),
	..
	}) = message
	{
	let pake_registration_upload = pake_registration_finish(
	client_rng,
	&registration_response_bytes,
	client_registration,
	)?
	.serialize();
	let client_login_start_result = pake_login_start(client_rng, password)?;

	// `registration_request` is a gRPC message containing serialized bytes to
	// complete PAKE registration and begin PAKE login
	let registration_request = RegistrationRequest {
	data: Some(PakeRegistrationUploadAndCredentialRequest(
	PakeRegistrationUploadAndCredentialRequestStruct {
	pake_registration_upload,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	};
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(client_login_start_result.state)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_registration_credential_response(
	message: Option<RegistrationResponseMessage>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<(), Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let registration_request = RegistrationRequest {
	data: Some(RegistrationPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	};
	send_to_mpsc(tx, registration_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_login_credential_response(
	message: Option<LoginResponse>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<LoginRequest>,
	) -> Result<(), Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(LoginPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	})),
	};
	send_to_mpsc(tx, login_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_registration_token_response(
	message: Option<RegistrationResponseMessage>,
	) -> Result<String, Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_login_token_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_wallet_login_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data: Some(WalletLoginResponse(WalletLoginResponseStruct { access_token })),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn send_to_mpsc<T>(
	tx: mpsc::Sender<T>,
	request: T,
	) -> Result<(), Status> {
	if let Err(e) = tx.send(request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(())
	}

View Options

services/backup/docker-base/contents/install_folly.sh

This file was copied to native/cpp/CommonCpp/grpc/grpc_client/src/identity_client.rs.

	use lazy_static::lazy_static;			use lazy_static::lazy_static;
	use opaque_ke::{
	ClientLogin, ClientLoginFinishParameters, ClientLoginStartParameters,
	ClientLoginStartResult, ClientRegistration,
	ClientRegistrationFinishParameters, CredentialFinalization,
	CredentialResponse, RegistrationResponse, RegistrationUpload,
	};
	use rand::{rngs::OsRng, CryptoRng, Rng};
	use std::sync::Arc;			use std::sync::Arc;
	use tokio::runtime::{Builder, Runtime};			use tokio::runtime::{Builder, Runtime};
	use tokio::sync::mpsc;
	use tokio_stream::wrappers::ReceiverStream;
	use tonic::{transport::Channel, Request, Status};
	use tracing::{error, instrument};

				pub mod identity_client;
	mod opaque;			mod opaque;
	use opaque::Cipher;

	use crate::identity::{
	identity_service_client::IdentityServiceClient,
	login_request::Data::PakeLoginRequest,
	login_request::Data::WalletLoginRequest,
	login_response::Data::PakeLoginResponse as LoginPakeLoginResponse,
	login_response::Data::WalletLoginResponse,
	pake_login_request::Data::PakeCredentialFinalization as LoginPakeCredentialFinalization,
	pake_login_request::Data::PakeCredentialRequestAndUserId,
	pake_login_response::Data::AccessToken,
	pake_login_response::Data::PakeCredentialResponse,
	registration_request::Data::PakeCredentialFinalization as RegistrationPakeCredentialFinalization,
	registration_request::Data::PakeRegistrationRequestAndUserId,
	registration_request::Data::PakeRegistrationUploadAndCredentialRequest,
	registration_response::Data::PakeLoginResponse as RegistrationPakeLoginResponse,
	registration_response::Data::PakeRegistrationResponse, GetUserIdRequest,
	LoginRequest, LoginResponse,
	PakeCredentialRequestAndUserId as PakeCredentialRequestAndUserIdStruct,
	PakeLoginRequest as PakeLoginRequestStruct,
	PakeLoginResponse as PakeLoginResponseStruct,
	PakeRegistrationRequestAndUserId as PakeRegistrationRequestAndUserIdStruct,
	PakeRegistrationUploadAndCredentialRequest as PakeRegistrationUploadAndCredentialRequestStruct,
	RegistrationRequest, RegistrationResponse as RegistrationResponseMessage,
	VerifyUserTokenRequest, WalletLoginRequest as WalletLoginRequestStruct,
	WalletLoginResponse as WalletLoginResponseStruct,
	};
	pub mod identity {			pub mod identity {
	tonic::include_proto!("identity");			tonic::include_proto!("identity");
	}			}

	const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";			const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";

	lazy_static! {			lazy_static! {
	pub static ref RUNTIME: Arc<Runtime> = Arc::new(			pub static ref RUNTIME: Arc<Runtime> = Arc::new(
	Builder::new_multi_thread()			Builder::new_multi_thread()
	.worker_threads(1)			.worker_threads(1)
	.max_blocking_threads(1)			.max_blocking_threads(1)
	.enable_all()			.enable_all()
	.build()			.build()
	.unwrap()			.unwrap()
	);			);
	}			}

	#[cxx::bridge(namespace = "identity")]
	mod ffi {
	extern "Rust" {
	type Client;
	fn initialize_client() -> Box<Client>;
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String>;
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool>;
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String>;
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String>;
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String>;
	}
	}

	#[derive(Debug)]
	struct Client {
	identity_client: IdentityServiceClient<Channel>,
	}

	fn initialize_client() -> Box<Client> {
	Box::new(Client {
	identity_client: RUNTIME
	.block_on(IdentityServiceClient::connect(IDENTITY_SERVICE_SOCKET_ADDR))
	.unwrap(),
	})
	}

	async fn get_user_id(
	mut client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	Ok(
	client
	.identity_client
	.get_user_id(GetUserIdRequest {
	auth_type,
	user_info,
	})
	.await?
	.into_inner()
	.user_id,
	)
	}

	#[instrument]
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(get_user_id(client, auth_type, user_info))
	}

	async fn verify_user_token(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	Ok(
	client
	.identity_client
	.verify_user_token(VerifyUserTokenRequest {
	user_id,
	device_id,
	access_token,
	})
	.await?
	.into_inner()
	.token_valid,
	)
	}

	#[instrument]
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	RUNTIME.block_on(verify_user_token(client, user_id, device_id, access_token))
	}

	async fn register_user(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a RegistrationRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.register_user(request)
	.await?
	.into_inner();

	// Start PAKE registration on client and send initial registration request
	// to Identity service
	let mut client_rng = OsRng;
	let (registration_request, client_registration) = pake_registration_start(
	&mut client_rng,
	user_id,
	&password,
	device_id,
	username,
	user_public_key,
	)?;
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE registration and begin PAKE login; send the final
	// registration request and initial login request together to reduce the
	// number of trips
	let message = response.message().await?;
	let client_login = handle_registration_response(
	message,
	&mut client_rng,
	client_registration,
	&password,
	tx.clone(),
	)
	.await?;

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_registration_credential_response(message, client_login, tx).await?;

	// Return access token
	let message = response.message().await?;
	handle_registration_token_response(message)
	}

	#[instrument]
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(register_user(
	client,
	user_id,
	device_id,
	username,
	password,
	user_public_key,
	))
	}

	async fn login_user_pake(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start PAKE login on client and send initial login request to Identity
	// service
	let mut client_rng = OsRng;
	let client_login_start_result = pake_login_start(&mut client_rng, &password)?;
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(PakeCredentialRequestAndUserId(
	PakeCredentialRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_login_credential_response(
	message,
	client_login_start_result.state,
	tx,
	)
	.await?;

	// Return access token
	let message = response.message().await?;
	handle_login_token_response(message)
	}

	#[instrument]
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_pake(client, user_id, device_id, password))
	}

	async fn login_user_wallet(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start wallet login on client and send initial login request to Identity
	// service
	let login_request = LoginRequest {
	data: Some(WalletLoginRequest(WalletLoginRequestStruct {
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Return access token
	let message = response.message().await?;
	handle_wallet_login_response(message)
	}

	#[instrument]
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_wallet(
	client,
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	))
	}

	fn pake_registration_start(
	rng: &mut (impl Rng + CryptoRng),
	user_id: String,
	password: &str,
	device_id: String,
	username: String,
	user_public_key: String,
	) -> Result<(RegistrationRequest, ClientRegistration<Cipher>), Status> {
	let client_registration_start_result =
	ClientRegistration::<Cipher>::start(rng, password.as_bytes()).map_err(
	\|e\| {
	error!("Failed to start PAKE registration: {}", e);
	Status::failed_precondition("PAKE failure")
	},
	)?;
	let pake_registration_request =
	client_registration_start_result.message.serialize();
	Ok((
	RegistrationRequest {
	data: Some(PakeRegistrationRequestAndUserId(
	PakeRegistrationRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_registration_request,
	username,
	user_public_key,
	},
	)),
	},
	client_registration_start_result.state,
	))
	}

	fn pake_registration_finish(
	rng: &mut (impl Rng + CryptoRng),
	registration_response_bytes: &[u8],
	client_registration: ClientRegistration<Cipher>,
	) -> Result<RegistrationUpload<Cipher>, Status> {
	client_registration
	.finish(
	rng,
	RegistrationResponse::deserialize(registration_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize registration response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientRegistrationFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE registration: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn pake_login_start(
	rng: &mut (impl Rng + CryptoRng),
	password: &str,
	) -> Result<ClientLoginStartResult<Cipher>, Status> {
	ClientLogin::<Cipher>::start(
	rng,
	password.as_bytes(),
	ClientLoginStartParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to start PAKE login: {}", e);
	Status::failed_precondition("PAKE failure")
	})
	}

	fn pake_login_finish(
	credential_response_bytes: &[u8],
	client_login: ClientLogin<Cipher>,
	) -> Result<CredentialFinalization<Cipher>, Status> {
	client_login
	.finish(
	CredentialResponse::deserialize(credential_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize credential response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientLoginFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE login: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn handle_unexpected_response<T: std::fmt::Debug>(
	message: Option<T>,
	) -> Status {
	error!("Received an unexpected message: {:?}", message);
	Status::invalid_argument("Invalid response data")
	}

	async fn handle_registration_response(
	message: Option<RegistrationResponseMessage>,
	client_rng: &mut (impl Rng + CryptoRng),
	client_registration: ClientRegistration<Cipher>,
	password: &str,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<ClientLogin<Cipher>, Status> {
	if let Some(RegistrationResponseMessage {
	data: Some(PakeRegistrationResponse(registration_response_bytes)),
	..
	}) = message
	{
	let pake_registration_upload = pake_registration_finish(
	client_rng,
	&registration_response_bytes,
	client_registration,
	)?
	.serialize();
	let client_login_start_result = pake_login_start(client_rng, password)?;

	// `registration_request` is a gRPC message containing serialized bytes to
	// complete PAKE registration and begin PAKE login
	let registration_request = RegistrationRequest {
	data: Some(PakeRegistrationUploadAndCredentialRequest(
	PakeRegistrationUploadAndCredentialRequestStruct {
	pake_registration_upload,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	};
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(client_login_start_result.state)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_registration_credential_response(
	message: Option<RegistrationResponseMessage>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<(), Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let registration_request = RegistrationRequest {
	data: Some(RegistrationPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	};
	send_to_mpsc(tx, registration_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_login_credential_response(
	message: Option<LoginResponse>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<LoginRequest>,
	) -> Result<(), Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(LoginPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	})),
	};
	send_to_mpsc(tx, login_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_registration_token_response(
	message: Option<RegistrationResponseMessage>,
	) -> Result<String, Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_login_token_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_wallet_login_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data: Some(WalletLoginResponse(WalletLoginResponseStruct { access_token })),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn send_to_mpsc<T>(
	tx: mpsc::Sender<T>,
	request: T,
	) -> Result<(), Status> {
	if let Err(e) = tx.send(request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(())
	}

View Options

services/backup/docker-server/Dockerfile

This file was copied to native/cpp/CommonCpp/grpc/grpc_client/src/identity_client.rs.

	use lazy_static::lazy_static;			use lazy_static::lazy_static;
	use opaque_ke::{
	ClientLogin, ClientLoginFinishParameters, ClientLoginStartParameters,
	ClientLoginStartResult, ClientRegistration,
	ClientRegistrationFinishParameters, CredentialFinalization,
	CredentialResponse, RegistrationResponse, RegistrationUpload,
	};
	use rand::{rngs::OsRng, CryptoRng, Rng};
	use std::sync::Arc;			use std::sync::Arc;
	use tokio::runtime::{Builder, Runtime};			use tokio::runtime::{Builder, Runtime};
	use tokio::sync::mpsc;
	use tokio_stream::wrappers::ReceiverStream;
	use tonic::{transport::Channel, Request, Status};
	use tracing::{error, instrument};

				pub mod identity_client;
	mod opaque;			mod opaque;
	use opaque::Cipher;

	use crate::identity::{
	identity_service_client::IdentityServiceClient,
	login_request::Data::PakeLoginRequest,
	login_request::Data::WalletLoginRequest,
	login_response::Data::PakeLoginResponse as LoginPakeLoginResponse,
	login_response::Data::WalletLoginResponse,
	pake_login_request::Data::PakeCredentialFinalization as LoginPakeCredentialFinalization,
	pake_login_request::Data::PakeCredentialRequestAndUserId,
	pake_login_response::Data::AccessToken,
	pake_login_response::Data::PakeCredentialResponse,
	registration_request::Data::PakeCredentialFinalization as RegistrationPakeCredentialFinalization,
	registration_request::Data::PakeRegistrationRequestAndUserId,
	registration_request::Data::PakeRegistrationUploadAndCredentialRequest,
	registration_response::Data::PakeLoginResponse as RegistrationPakeLoginResponse,
	registration_response::Data::PakeRegistrationResponse, GetUserIdRequest,
	LoginRequest, LoginResponse,
	PakeCredentialRequestAndUserId as PakeCredentialRequestAndUserIdStruct,
	PakeLoginRequest as PakeLoginRequestStruct,
	PakeLoginResponse as PakeLoginResponseStruct,
	PakeRegistrationRequestAndUserId as PakeRegistrationRequestAndUserIdStruct,
	PakeRegistrationUploadAndCredentialRequest as PakeRegistrationUploadAndCredentialRequestStruct,
	RegistrationRequest, RegistrationResponse as RegistrationResponseMessage,
	VerifyUserTokenRequest, WalletLoginRequest as WalletLoginRequestStruct,
	WalletLoginResponse as WalletLoginResponseStruct,
	};
	pub mod identity {			pub mod identity {
	tonic::include_proto!("identity");			tonic::include_proto!("identity");
	}			}

	const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";			const IDENTITY_SERVICE_SOCKET_ADDR: &str = "https://[::1]:50051";

	lazy_static! {			lazy_static! {
	pub static ref RUNTIME: Arc<Runtime> = Arc::new(			pub static ref RUNTIME: Arc<Runtime> = Arc::new(
	Builder::new_multi_thread()			Builder::new_multi_thread()
	.worker_threads(1)			.worker_threads(1)
	.max_blocking_threads(1)			.max_blocking_threads(1)
	.enable_all()			.enable_all()
	.build()			.build()
	.unwrap()			.unwrap()
	);			);
	}			}

	#[cxx::bridge(namespace = "identity")]
	mod ffi {
	extern "Rust" {
	type Client;
	fn initialize_client() -> Box<Client>;
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String>;
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool>;
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String>;
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String>;
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String>;
	}
	}

	#[derive(Debug)]
	struct Client {
	identity_client: IdentityServiceClient<Channel>,
	}

	fn initialize_client() -> Box<Client> {
	Box::new(Client {
	identity_client: RUNTIME
	.block_on(IdentityServiceClient::connect(IDENTITY_SERVICE_SOCKET_ADDR))
	.unwrap(),
	})
	}

	async fn get_user_id(
	mut client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	Ok(
	client
	.identity_client
	.get_user_id(GetUserIdRequest {
	auth_type,
	user_info,
	})
	.await?
	.into_inner()
	.user_id,
	)
	}

	#[instrument]
	fn get_user_id_blocking(
	client: Box<Client>,
	auth_type: i32,
	user_info: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(get_user_id(client, auth_type, user_info))
	}

	async fn verify_user_token(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	Ok(
	client
	.identity_client
	.verify_user_token(VerifyUserTokenRequest {
	user_id,
	device_id,
	access_token,
	})
	.await?
	.into_inner()
	.token_valid,
	)
	}

	#[instrument]
	fn verify_user_token_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	access_token: String,
	) -> Result<bool, Status> {
	RUNTIME.block_on(verify_user_token(client, user_id, device_id, access_token))
	}

	async fn register_user(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a RegistrationRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.register_user(request)
	.await?
	.into_inner();

	// Start PAKE registration on client and send initial registration request
	// to Identity service
	let mut client_rng = OsRng;
	let (registration_request, client_registration) = pake_registration_start(
	&mut client_rng,
	user_id,
	&password,
	device_id,
	username,
	user_public_key,
	)?;
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE registration and begin PAKE login; send the final
	// registration request and initial login request together to reduce the
	// number of trips
	let message = response.message().await?;
	let client_login = handle_registration_response(
	message,
	&mut client_rng,
	client_registration,
	&password,
	tx.clone(),
	)
	.await?;

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_registration_credential_response(message, client_login, tx).await?;

	// Return access token
	let message = response.message().await?;
	handle_registration_token_response(message)
	}

	#[instrument]
	fn register_user_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	username: String,
	password: String,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(register_user(
	client,
	user_id,
	device_id,
	username,
	password,
	user_public_key,
	))
	}

	async fn login_user_pake(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start PAKE login on client and send initial login request to Identity
	// service
	let mut client_rng = OsRng;
	let client_login_start_result = pake_login_start(&mut client_rng, &password)?;
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(PakeCredentialRequestAndUserId(
	PakeCredentialRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Handle responses from Identity service sequentially, making sure we get
	// messages in the correct order

	// Finish PAKE login; send final login request to Identity service
	let message = response.message().await?;
	handle_login_credential_response(
	message,
	client_login_start_result.state,
	tx,
	)
	.await?;

	// Return access token
	let message = response.message().await?;
	handle_login_token_response(message)
	}

	#[instrument]
	fn login_user_pake_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	password: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_pake(client, user_id, device_id, password))
	}

	async fn login_user_wallet(
	mut client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	// Create a LoginRequest channel and use ReceiverStream to turn the
	// MPSC receiver into a Stream for outbound messages
	let (tx, rx) = mpsc::channel(1);
	let stream = ReceiverStream::new(rx);
	let request = Request::new(stream);

	// `response` is the Stream for inbound messages
	let mut response = client
	.identity_client
	.login_user(request)
	.await?
	.into_inner();

	// Start wallet login on client and send initial login request to Identity
	// service
	let login_request = LoginRequest {
	data: Some(WalletLoginRequest(WalletLoginRequestStruct {
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	})),
	};
	if let Err(e) = tx.send(login_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}

	// Return access token
	let message = response.message().await?;
	handle_wallet_login_response(message)
	}

	#[instrument]
	fn login_user_wallet_blocking(
	client: Box<Client>,
	user_id: String,
	device_id: String,
	siwe_message: String,
	siwe_signature: Vec<u8>,
	user_public_key: String,
	) -> Result<String, Status> {
	RUNTIME.block_on(login_user_wallet(
	client,
	user_id,
	device_id,
	siwe_message,
	siwe_signature,
	user_public_key,
	))
	}

	fn pake_registration_start(
	rng: &mut (impl Rng + CryptoRng),
	user_id: String,
	password: &str,
	device_id: String,
	username: String,
	user_public_key: String,
	) -> Result<(RegistrationRequest, ClientRegistration<Cipher>), Status> {
	let client_registration_start_result =
	ClientRegistration::<Cipher>::start(rng, password.as_bytes()).map_err(
	\|e\| {
	error!("Failed to start PAKE registration: {}", e);
	Status::failed_precondition("PAKE failure")
	},
	)?;
	let pake_registration_request =
	client_registration_start_result.message.serialize();
	Ok((
	RegistrationRequest {
	data: Some(PakeRegistrationRequestAndUserId(
	PakeRegistrationRequestAndUserIdStruct {
	user_id,
	device_id,
	pake_registration_request,
	username,
	user_public_key,
	},
	)),
	},
	client_registration_start_result.state,
	))
	}

	fn pake_registration_finish(
	rng: &mut (impl Rng + CryptoRng),
	registration_response_bytes: &[u8],
	client_registration: ClientRegistration<Cipher>,
	) -> Result<RegistrationUpload<Cipher>, Status> {
	client_registration
	.finish(
	rng,
	RegistrationResponse::deserialize(registration_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize registration response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientRegistrationFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE registration: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn pake_login_start(
	rng: &mut (impl Rng + CryptoRng),
	password: &str,
	) -> Result<ClientLoginStartResult<Cipher>, Status> {
	ClientLogin::<Cipher>::start(
	rng,
	password.as_bytes(),
	ClientLoginStartParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to start PAKE login: {}", e);
	Status::failed_precondition("PAKE failure")
	})
	}

	fn pake_login_finish(
	credential_response_bytes: &[u8],
	client_login: ClientLogin<Cipher>,
	) -> Result<CredentialFinalization<Cipher>, Status> {
	client_login
	.finish(
	CredentialResponse::deserialize(credential_response_bytes).map_err(
	\|e\| {
	error!("Could not deserialize credential response bytes: {}", e);
	Status::aborted("Invalid response bytes")
	},
	)?,
	ClientLoginFinishParameters::default(),
	)
	.map_err(\|e\| {
	error!("Failed to finish PAKE login: {}", e);
	Status::aborted("PAKE failure")
	})
	.map(\|res\| res.message)
	}

	fn handle_unexpected_response<T: std::fmt::Debug>(
	message: Option<T>,
	) -> Status {
	error!("Received an unexpected message: {:?}", message);
	Status::invalid_argument("Invalid response data")
	}

	async fn handle_registration_response(
	message: Option<RegistrationResponseMessage>,
	client_rng: &mut (impl Rng + CryptoRng),
	client_registration: ClientRegistration<Cipher>,
	password: &str,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<ClientLogin<Cipher>, Status> {
	if let Some(RegistrationResponseMessage {
	data: Some(PakeRegistrationResponse(registration_response_bytes)),
	..
	}) = message
	{
	let pake_registration_upload = pake_registration_finish(
	client_rng,
	&registration_response_bytes,
	client_registration,
	)?
	.serialize();
	let client_login_start_result = pake_login_start(client_rng, password)?;

	// `registration_request` is a gRPC message containing serialized bytes to
	// complete PAKE registration and begin PAKE login
	let registration_request = RegistrationRequest {
	data: Some(PakeRegistrationUploadAndCredentialRequest(
	PakeRegistrationUploadAndCredentialRequestStruct {
	pake_registration_upload,
	pake_credential_request: client_login_start_result
	.message
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	},
	)),
	};
	if let Err(e) = tx.send(registration_request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(client_login_start_result.state)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_registration_credential_response(
	message: Option<RegistrationResponseMessage>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<RegistrationRequest>,
	) -> Result<(), Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let registration_request = RegistrationRequest {
	data: Some(RegistrationPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	};
	send_to_mpsc(tx, registration_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn handle_login_credential_response(
	message: Option<LoginResponse>,
	client_login: ClientLogin<Cipher>,
	tx: mpsc::Sender<LoginRequest>,
	) -> Result<(), Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(PakeCredentialResponse(credential_response_bytes)),
	})),
	}) = message
	{
	let login_request = LoginRequest {
	data: Some(PakeLoginRequest(PakeLoginRequestStruct {
	data: Some(LoginPakeCredentialFinalization(
	pake_login_finish(&credential_response_bytes, client_login)?
	.serialize()
	.map_err(\|e\| {
	error!("Could not serialize credential request: {}", e);
	Status::failed_precondition("PAKE failure")
	})?,
	)),
	})),
	};
	send_to_mpsc(tx, login_request).await
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_registration_token_response(
	message: Option<RegistrationResponseMessage>,
	) -> Result<String, Status> {
	if let Some(RegistrationResponseMessage {
	data:
	Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_login_token_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data:
	Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
	data: Some(AccessToken(access_token)),
	})),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	fn handle_wallet_login_response(
	message: Option<LoginResponse>,
	) -> Result<String, Status> {
	if let Some(LoginResponse {
	data: Some(WalletLoginResponse(WalletLoginResponseStruct { access_token })),
	}) = message
	{
	Ok(access_token)
	} else {
	Err(handle_unexpected_response(message))
	}
	}

	async fn send_to_mpsc<T>(
	tx: mpsc::Sender<T>,
	request: T,
	) -> Result<(), Status> {
	if let Err(e) = tx.send(request).await {
	error!("Response was dropped: {}", e);
	return Err(Status::aborted("Dropped response"));
	}
	Ok(())
	}