soatok / canis-server

Server-side component to Project Canis

Canis Server

canis-server's Issues

API: Add Public Key

Needed:

• Account ID (needed for auth.)
• Vendor ID
• Public Key

Depends on #4

API: Package Release

Needed info:

• Vendor Name
• Package Name
• One or more of the following:
  • Update file contents
  • URL pointing to direct file download location
• Public Key ID for file signature
• Signature of file contents

API: Revoke Public Key

Needed info:

• Account ID
• Public Key ID
• Sign-Off Key ID
• Reason (text)
• Signature of reason

The Revocation API will allow an account to say "this public key has been compromised" in an irrevocable, public way. Revoked public keys will be distrusted from that point in time forward.

User Registration, Authentication, and MFA

• Register new account from website
• Send verification email
• Verify token sent to inbox
• Login with username / password
• If no device token (regardless of password correctness) for the given username, prompt for TOTP code
• Logout (with CSRF protection)
• Same-Site, HTTP-Only, and Secure cookie flags

Append-Only Cryptographic Ledger

• Trillian: https://github.com/google/trillian
• Chronicle: https://github.com/paragonie/chronicle

To do:

1. Decide which is more appropriate for our use case
2. Build Transparent PKI based on verifiable data structures with decentralized verification

API: Create New Package

Needed info:

• Active account ID (required for authentication)
• Vendor (accounts have a many-to-many relationship with vendors)
• Package name
• Platform
  • RPG Maker XP
  • RPG Maker VX
  • RPG Maker MV
  • Game Maker 1
  • Game Maker 2
  • etc.
• Type
  • Available types are entirely platform-dependent