Add BlindSignAuthOptions proto to BlindSignAuth constructor. This options proto will allow callers to configure BlindSignAuth with new features.
PiperOrigin-RevId: 562945128
diff --git a/build/source_list.bzl b/build/source_list.bzl
index 10d593d..16ab6f1 100644
--- a/build/source_list.bzl
+++ b/build/source_list.bzl
@@ -1624,6 +1624,7 @@
"blind_sign_auth/proto/any.proto",
"blind_sign_auth/proto/attestation.proto",
"blind_sign_auth/proto/auth_and_sign.proto",
+ "blind_sign_auth/proto/blind_sign_auth_options.proto",
"blind_sign_auth/proto/get_initial_data.proto",
"blind_sign_auth/proto/key_services.proto",
"blind_sign_auth/proto/public_metadata.proto",
diff --git a/build/source_list.gni b/build/source_list.gni
index 5060516..fe4b25e 100644
--- a/build/source_list.gni
+++ b/build/source_list.gni
@@ -1629,6 +1629,7 @@
"src/quiche/blind_sign_auth/proto/any.proto",
"src/quiche/blind_sign_auth/proto/attestation.proto",
"src/quiche/blind_sign_auth/proto/auth_and_sign.proto",
+ "src/quiche/blind_sign_auth/proto/blind_sign_auth_options.proto",
"src/quiche/blind_sign_auth/proto/get_initial_data.proto",
"src/quiche/blind_sign_auth/proto/key_services.proto",
"src/quiche/blind_sign_auth/proto/public_metadata.proto",
diff --git a/build/source_list.json b/build/source_list.json
index 3be1a6b..c3dd079 100644
--- a/build/source_list.json
+++ b/build/source_list.json
@@ -1628,6 +1628,7 @@
"quiche/blind_sign_auth/proto/any.proto",
"quiche/blind_sign_auth/proto/attestation.proto",
"quiche/blind_sign_auth/proto/auth_and_sign.proto",
+ "quiche/blind_sign_auth/proto/blind_sign_auth_options.proto",
"quiche/blind_sign_auth/proto/get_initial_data.proto",
"quiche/blind_sign_auth/proto/key_services.proto",
"quiche/blind_sign_auth/proto/public_metadata.proto",
diff --git a/quiche/blind_sign_auth/blind_sign_auth.cc b/quiche/blind_sign_auth/blind_sign_auth.cc
index f44df72..d321074 100644
--- a/quiche/blind_sign_auth/blind_sign_auth.cc
+++ b/quiche/blind_sign_auth/blind_sign_auth.cc
@@ -35,6 +35,12 @@
void BlindSignAuth::GetTokens(std::string oauth_token, int num_tokens,
SignedTokenCallback callback) {
+ // Check whether Privacy Pass crypto is enabled.
+ if (auth_options_.enable_privacy_pass()) {
+ std::move(callback)(
+ absl::UnimplementedError("Privacy Pass is not supported."));
+ return;
+ }
// Create GetInitialData RPC.
privacy::ppn::GetInitialDataRequest request;
request.set_use_attestation(false);
diff --git a/quiche/blind_sign_auth/blind_sign_auth.h b/quiche/blind_sign_auth/blind_sign_auth.h
index 0a617f7..87fbfeb 100644
--- a/quiche/blind_sign_auth/blind_sign_auth.h
+++ b/quiche/blind_sign_auth/blind_sign_auth.h
@@ -23,8 +23,9 @@
// BlindSignAuth provides signed, unblinded tokens to callers.
class QUICHE_EXPORT BlindSignAuth : public BlindSignAuthInterface {
public:
- explicit BlindSignAuth(BlindSignHttpInterface* http_fetcher)
- : http_fetcher_(http_fetcher) {}
+ explicit BlindSignAuth(BlindSignHttpInterface* http_fetcher,
+ privacy::ppn::BlindSignAuthOptions auth_options)
+ : http_fetcher_(http_fetcher), auth_options_(std::move(auth_options)) {}
// Returns signed unblinded tokens and their expiration time in a callback.
// Tokens are single-use.
@@ -55,6 +56,7 @@
absl::StatusCode HttpCodeToStatusCode(int http_code);
BlindSignHttpInterface* http_fetcher_ = nullptr;
+ privacy::ppn::BlindSignAuthOptions auth_options_;
};
} // namespace quiche
diff --git a/quiche/blind_sign_auth/blind_sign_auth_protos.h b/quiche/blind_sign_auth/blind_sign_auth_protos.h
index 8d6ff8d..8927731 100644
--- a/quiche/blind_sign_auth/blind_sign_auth_protos.h
+++ b/quiche/blind_sign_auth/blind_sign_auth_protos.h
@@ -3,6 +3,7 @@
#include "quiche/blind_sign_auth/proto/timestamp.pb.h" // IWYU pragma: export
#include "quiche/blind_sign_auth/proto/auth_and_sign.pb.h" // IWYU pragma: export
+#include "quiche/blind_sign_auth/proto/blind_sign_auth_options.pb.h" // IWYU pragma: export
#include "quiche/blind_sign_auth/proto/get_initial_data.pb.h" // IWYU pragma: export
#include "quiche/blind_sign_auth/proto/key_services.pb.h" // IWYU pragma: export
#include "quiche/blind_sign_auth/proto/public_metadata.pb.h" // IWYU pragma: export
diff --git a/quiche/blind_sign_auth/blind_sign_auth_test.cc b/quiche/blind_sign_auth/blind_sign_auth_test.cc
index 6330d35..fc90bee 100644
--- a/quiche/blind_sign_auth/blind_sign_auth_test.cc
+++ b/quiche/blind_sign_auth/blind_sign_auth_test.cc
@@ -76,7 +76,12 @@
public_metadata_info_;
fake_get_initial_data_response_ = fake_get_initial_data_response;
- blind_sign_auth_ = std::make_unique<BlindSignAuth>(&mock_http_interface_);
+ // Create BlindSignAuthOptions.
+ privacy::ppn::BlindSignAuthOptions options;
+ options.set_enable_privacy_pass(false);
+
+ blind_sign_auth_ =
+ std::make_unique<BlindSignAuth>(&mock_http_interface_, options);
}
void TearDown() override {
@@ -290,6 +295,23 @@
done.WaitForNotification();
}
+TEST_F(BlindSignAuthTest, TestGetTokensFailedPrivacyPass) {
+ privacy::ppn::BlindSignAuthOptions options;
+ options.set_enable_privacy_pass(true);
+ blind_sign_auth_ =
+ std::make_unique<BlindSignAuth>(&mock_http_interface_, options);
+
+ int num_tokens = 1;
+ QuicheNotification done;
+ SignedTokenCallback callback =
+ [&done](absl::StatusOr<absl::Span<BlindSignToken>> tokens) {
+ EXPECT_THAT(tokens.status().code(), absl::StatusCode::kUnimplemented);
+ done.Notify();
+ };
+ blind_sign_auth_->GetTokens(oauth_token_, num_tokens, std::move(callback));
+ done.WaitForNotification();
+}
+
} // namespace
} // namespace test
} // namespace quiche
diff --git a/quiche/blind_sign_auth/proto/blind_sign_auth_options.proto b/quiche/blind_sign_auth/proto/blind_sign_auth_options.proto
new file mode 100644
index 0000000..794a925
--- /dev/null
+++ b/quiche/blind_sign_auth/proto/blind_sign_auth_options.proto
@@ -0,0 +1,22 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS-IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package privacy.ppn;
+
+message BlindSignAuthOptions {
+ // Use Privacy Pass crypto library and token formats instead of RSA BSSA.
+ bool enable_privacy_pass = 1;
+}
