ProofedMesh/services/approval-service/internal/canonical/canonical.go

// Package canonical implements the stable JSON serialisation the
// approval-service uses to compute H_content. It MUST stay byte-for-byte
// compatible with services/signing-service/internal/canonical/canonical.go
// and services/admin-api/internal/attest/hash.go, otherwise the signing
// service's content_hash of the Statement would not match the H_content we
// bound into the WebAuthn challenge.
//
// Not a full RFC 8785 implementation: all inputs we hash are strings,
// nulls, bools, numbers (as float64 after a json.Unmarshal round-trip), and
// nested arrays/maps of those. encoding/json emits stable output for the
// leaves; we only force deterministic object key ordering.
package canonical

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"sort"
)

// SHA256Hex returns the hex-encoded SHA-256 of b.
func SHA256Hex(b []byte) string {
	sum := sha256.Sum256(b)
	return hex.EncodeToString(sum[:])
}

// Marshal returns the canonical JSON encoding of v (sorted object keys).
func Marshal(v any) ([]byte, error) {
	first, err := json.Marshal(v)
	if err != nil {
		return nil, err
	}
	var any_ any
	if err := json.Unmarshal(first, &any_); err != nil {
		return nil, err
	}
	var buf bytes.Buffer
	if err := writeSorted(&buf, any_); err != nil {
		return nil, err
	}
	return buf.Bytes(), nil
}

// Hash returns the sha256:<hex> content hash of v's canonical JSON.
func Hash(v any) (string, []byte, error) {
	raw, err := Marshal(v)
	if err != nil {
		return "", nil, err
	}
	return "sha256:" + SHA256Hex(raw), raw, nil
}

func writeSorted(buf *bytes.Buffer, v any) error {
	switch x := v.(type) {
	case nil:
		buf.WriteString("null")
	case bool:
		if x {
			buf.WriteString("true")
		} else {
			buf.WriteString("false")
		}
	case float64:
		b, _ := json.Marshal(x)
		buf.Write(b)
	case string:
		b, _ := json.Marshal(x)
		buf.Write(b)
	case []any:
		buf.WriteByte('[')
		for i, el := range x {
			if i > 0 {
				buf.WriteByte(',')
			}
			if err := writeSorted(buf, el); err != nil {
				return err
			}
		}
		buf.WriteByte(']')
	case map[string]any:
		keys := make([]string, 0, len(x))
		for k := range x {
			keys = append(keys, k)
		}
		sort.Strings(keys)
		buf.WriteByte('{')
		for i, k := range keys {
			if i > 0 {
				buf.WriteByte(',')
			}
			kb, _ := json.Marshal(k)
			buf.Write(kb)
			buf.WriteByte(':')
			if err := writeSorted(buf, x[k]); err != nil {
				return err
			}
		}
		buf.WriteByte('}')
	default:
		return fmt.Errorf("canonical.writeSorted: unsupported type %T", v)
	}
	return nil
}