Argus: content access authentication scheme

[zeeshanakram3]

For the infrastructure authentication scheme proposed in #4414 for accessing unlisted content, this issue describes the basic QN/Protobuf schemas,

# Infrastructure access (session) key for authenticating with Argus/Colossus
type InfrastructureAccessKey @entity {
  "Unique ID"
  id: ID!

  "Access key address"
  accessKeyAddress: String!

  "Member owning the access key."
  member: Membership!

  "The block timestamp when the access key is about to expire (Optional)"
  expiresAtBlock: BigInt

  "The agent (App/Orion) storing the corresponding private key (if any)"
  storedByApp: App

  # Can be a concatenated string representation of "Browser-Version-OS-MachineName" etc ?
  "The agent (Browser) storing the corresponding private key (if any)"
  storedByBrowser: String
} 

"Stored information about a registered user"
type Membership @entity {
  "MemberId: runtime identifier for a user"
  id: ID!
  
  # ... (Other fields)
  
  "All infrastructure (Argus/Colossus) access keys owned by this member"
  infrastructureAccessKeys: [MembershipExternalResource] @derivedFrom(field: "member")
}

The App refers to a metaprotocol-based app entity described in #4307.
The storedBy* fields keep info about the agent storing the private component of infrastructure access KeyPair. This way, an actor(member) would have a complete view of all his/her access keys and where they are being stored, in case they want to remove/revoke the key from a specific browser/App.

Now the corresponding Protobuf message schemas for creating/revoking the access keys will be as follows;

// Add session key to access unlisted content from Colossus/Argus
message AddInfrastructureAccessKey {
    // Infrastructure access key address
    required string address = 1;

    // session key's expiration time (Optional) 
    optional string expiresAtBlock = 2;
    
    // Agent (Browser/Orion) storing corresponding private key (Optional)
    oneof stored_by {
        string browser = 3;
        string app = 4;
    }
}

// Remove the session key 
message RemoveInfrastructureAccessKey {
    // Infrastructure access (session) key address
    required string address = 1;
}

message MemberRemarked {
    oneof member_remarked {
        // ... (Other remark messages)
        
        // add session key to access unlisted content from Colossus/Argus
        AddInfrastructureAccessKey add_infrastructure_access_key = 7;

        // remove access key
        RemoveInfrastructureAccessKey remove_infrastructure_access_key = 8;
    }
}

message MembershipMetadata {
    // ... (Other membership metadata fields)
    
    // add session key to access unlisted content from Colossus/Argus
    AddInfrastructureAccessKey add_infrastructure_access_key = 7;
    
    // remove access key
    RemoveInfrastructureAccessKey remove_infrastructure_access_key = 8;
}

Based on the Protobuf schemas above, the act of creating/revoking access keys can be performed both with member creation/update and remark extrinsic.

[bedeho]

storedByApp: App

I don't think this is needed.

storedByBrowser: String

Same here, leaks private data, and what is utility?

[zeeshanakram3]

Same here, leaks private data, and what is utility?

Yeah, they are not strictly needed that's why I haven't marked them as required; I just added it for the convenience of key-owning members, say they already have a number of access keys generated across different browsers, and now they want to revoke the key from a specific browser. This way, they can simply search for keys associated with any specific Browser/App and then act accordingly ?

But as you mentioned, due to data security concerns, I will remove it.