API 鉴权

PRS 提供两种鉴权方式，验证 Token和验证用户签名，都是通过 HTTP header 进行。

通过验证 Token 鉴权

HTTP header 里加 Authorization：

Authorization: Bearer ${token}

• token: 用户授权之后获取到的 access token。

Example：

假设 DApp 经过授权之后，获取到对应的 token。

token	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MzYsImp0aSI6IjhkNWNjYzFmLWRmYjEtNDZjMC04MDc2LWNkMGE1ZDVmNWQ5MSIsImRhdGEiOnsiYXV0aEFkZHJlc3MiOiIyMTQ1ZWZkZDA0ZjJiZmIyNjhmZjIxNDY0MjE4NDE4MTYzZWJkNjBkIn0sInByb3ZpZGVyIjoiZGFwcCIsImV4cCI6MTU1MTQ1NTEzNn0.-z9atlcBRsB5Z7M7joOMLvD5UaNhy-15hycLpV0XpUw

调用获取指定签名文件 API 为：

curl -X GET https://${host}/api/v2/files/a23b19df1264d406ac81094af463d6fc03caafb997d8d8f64759340752dd21ad \
  -H "Accept: application/json" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MzYsImp0aSI6IjhkNWNjYzFmLWRmYjEtNDZjMC04MDc2LWNkMGE1ZDVmNWQ5MSIsImRhdGEiOnsiYXV0aEFkZHJlc3MiOiIyMTQ1ZWZkZDA0ZjJiZmIyNjhmZjIxNDY0MjE4NDE4MTYzZWJkNjBkIn0sInByb3ZpZGVyIjoiZGFwcCIsImV4cCI6MTU1MTQ1NTEzNn0.-z9atlcBRsB5Z7M7joOMLvD5UaNhy-15hycLpV0XpUw"

通过验证签名鉴权

HTTP header 里加 X-Po-Auth-Address、X-Po-Auth-Msghash、X-Po-Auth-Sig。

Key	Value
X-Po-Auth-Address	当前用户的 Address
X-Po-Auth-Msghash	请求消息体的 hash 值
X-Po-Auth-Sig	使用私钥对消息体 hash 进行椭圆加密值得到的数字签名

Example：

POST /api/v2/apps/${address}/authenticate

我们用换取 token 的接口来举例，假设 DApp 创建成功之后，获取到 DApp 的私钥以及地址。用户经过 Web 授权返回了 code。

address	6b16c956d963e2c38e07d49af37b66a1de490a97
privateKey	8f8aa65494a9880130842fcec4208ce9ae6667d38422c36e832564408bc1fad5
code	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MTUsImp0aSI6Ijg5M2NiMjAwLTNiNTQtNDYzNC1hODNlLWU3ZmJmNzQ3YjVjNiIsImRhdGEiOnsidXNlckFkZHJlc3MiOiJjYjdiNzUxMDNjNzMzY2M1NzQzYTM5MGZhZjdiZGVkYzYxNzg2ZTI5IiwiYXBwQWRkcmVzcyI6IjZiMTZjOTU2ZDk2M2UyYzM4ZTA3ZDQ5YWYzN2I2NmExZGU0OTBhOTciLCJ0eXBlIjoicGhvbmUifSwicHJvdmlkZXIiOiJwcmVzc29uZSIsImV4cCI6MTU1MTQ1NTExNX0.KQeimVWpEnTs-8FyvDYh-mppG1_kMKiPGZOf8mY3pfA

接下来我们来调用这个接口

1. 根据 path 与 payload 计算出 msghash。

• path: 是 Api 的路径，这里是 '/apps/${address}/authenticate'
• payload: 是请求 body。

{
  "payload":{
    "code": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MTUsImp0aSI6Ijg5M2NiMjAwLTNiNTQtNDYzNC1hODNlLWU3ZmJmNzQ3YjVjNiIsImRhdGEiOnsidXNlckFkZHJlc3MiOiJjYjdiNzUxMDNjNzMzY2M1NzQzYTM5MGZhZjdiZGVkYzYxNzg2ZTI5IiwiYXBwQWRkcmVzcyI6IjZiMTZjOTU2ZDk2M2UyYzM4ZTA3ZDQ5YWYzN2I2NmExZGU0OTBhOTciLCJ0eXBlIjoicGhvbmUifSwicHJvdmlkZXIiOiJwcmVzc29uZSIsImV4cCI6MTU1MTQ1NTExNX0.KQeimVWpEnTs-8FyvDYh-mppG1_kMKiPGZOf8mY3pfA"
  }
}

calcRequestHash(path, payload) 
= 7b61f7ee90d333017e4fc822adf196030ef8ae457c6f8d7b2f6b8776a6a50c6e

2. 使用私钥对 msghash 签名。

const { signature } = signByMsghash(hash, privateKey) => {
  return signByMsghash(hash, privateKey);
};

signByMsghash(hash, privateKey)
= signByMsghash('7b61f7ee90d333017e4fc822adf196030ef8ae457c6f8d7b2f6b8776a6a50c6e', '8f8aa65494a9880130842fcec4208ce9ae6667d38422c36e832564408bc1fad5')
= 7a405ca5a2f8d925e70be5346b7b3974a8f9b172c755555ba149cca8cc9c737e6c3e7d35e17893ea5893fb0515d0c5019f3ddd5ce716e813506a4f146eeefd9a1

3. 将 address、msghash、signature 添加到 HTTP header 中即可。

curl -X POST https://beta.press.one/api/v2/apps/6b16c956d963e2c38e07d49af37b66a1de490a97/authenticate \
  -H "Content-Type: application/json" \
  -H "X-Po-Auth-Address: 6b16c956d963e2c38e07d49af37b66a1de490a97" \
  -H "X-Po-Auth-Msghash: 7b61f7ee90d333017e4fc822adf196030ef8ae457c6f8d7b2f6b8776a6a50c6e" \
  -H "X-Po-Auth-Sig: 7a405ca5a2f8d925e70be5346b7b3974a8f9b172c755555ba149cca8cc9c737e6c3e7d35e17893ea5893fb0515d0c5019f3ddd5ce716e813506a4f146eeefd9a1" \
  -d '{ "payload": { "code": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MTUsImp0aSI6Ijg5M2NiMjAwLTNiNTQtNDYzNC1hODNlLWU3ZmJmNzQ3YjVjNiIsImRhdGEiOnsidXNlckFkZHJlc3MiOiJjYjdiNzUxMDNjNzMzY2M1NzQzYTM5MGZhZjdiZGVkYzYxNzg2ZTI5IiwiYXBwQWRkcmVzcyI6IjZiMTZjOTU2ZDk2M2UyYzM4ZTA3ZDQ5YWYzN2I2NmExZGU0OTBhOTciLCJ0eXBlIjoicGhvbmUifSwicHJvdmlkZXIiOiJwcmVzc29uZSIsImV4cCI6MTU1MTQ1NTExNX0.KQeimVWpEnTs-8FyvDYh-mppG1_kMKiPGZOf8mY3pfA" } }'

hash、加密算法的具体实现请参考数字签名。