886 lines
31 KiB
Rust
886 lines
31 KiB
Rust
// NAC宪法层服务 (nac-constitution-service) v1.0.0
|
||
// Constitutional Layer HTTP Service
|
||
//
|
||
// 严格遵循 NAC 原生类型系统：
|
||
// - Address：32字节（256位）
|
||
// - Hash：48字节（SHA3-384，384位）
|
||
// - 支持8组二进制字符串转换
|
||
//
|
||
// 宪法层是 NAC 公链的核心基础层，所有交易和合约必须通过宪法验证
|
||
// Chain ID: 5132611
|
||
|
||
use actix_web::{web, App, HttpServer, HttpResponse};
|
||
use actix_web::dev::{ServiceRequest, ServiceResponse, Service, Transform};
|
||
use actix_web::Error;
|
||
use futures_util::future::{ok, Ready, LocalBoxFuture};
|
||
use serde::{Deserialize, Serialize};
|
||
use chrono::Utc;
|
||
use std::env;
|
||
use std::sync::Arc;
|
||
use parking_lot::RwLock;
|
||
use uuid::Uuid;
|
||
|
||
// 使用 NAC 原生类型
|
||
use nac_udm::primitives::{Address, Hash};
|
||
|
||
// ============================================================
|
||
// NAC 原生类型包装（用于 HTTP API 序列化）
|
||
// ============================================================
|
||
|
||
/// NAC Address 的 JSON 表示（32字节，hex 编码）
|
||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||
pub struct NacAddress {
|
||
/// 十六进制表示（64个字符，不含0x前缀）
|
||
pub hex: String,
|
||
/// 二进制字符串表示（256位，8组×32字节）
|
||
pub binary: String,
|
||
/// 字节长度（固定32）
|
||
pub byte_length: u8,
|
||
}
|
||
|
||
impl NacAddress {
|
||
/// 从 Address 创建
|
||
pub fn from_address(addr: &Address) -> Self {
|
||
Self {
|
||
hex: addr.to_hex().trim_start_matches("0x").to_string(),
|
||
binary: addr.to_binary_string(),
|
||
byte_length: 32,
|
||
}
|
||
}
|
||
|
||
/// 从 hex 字符串解析
|
||
pub fn from_hex(hex_str: &str) -> Result<Self, String> {
|
||
let addr = Address::from_hex(hex_str)?;
|
||
Ok(Self::from_address(&addr))
|
||
}
|
||
|
||
/// 从二进制字符串解析（8组×32字节×8位 = 256位）
|
||
pub fn from_binary(binary_str: &str) -> Result<Self, String> {
|
||
let addr = Address::from_binary_string(binary_str)?;
|
||
Ok(Self::from_address(&addr))
|
||
}
|
||
}
|
||
|
||
/// NAC Hash 的 JSON 表示（48字节，SHA3-384）
|
||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||
pub struct NacHash {
|
||
/// 十六进制表示（96个字符，不含0x前缀）
|
||
pub hex: String,
|
||
/// 二进制字符串表示（384位，8组×48字节）
|
||
pub binary: String,
|
||
/// 字节长度（固定48）
|
||
pub byte_length: u8,
|
||
/// 哈希算法
|
||
pub algorithm: String,
|
||
}
|
||
|
||
impl NacHash {
|
||
/// 从 Hash 创建
|
||
pub fn from_hash(hash: &Hash) -> Self {
|
||
Self {
|
||
hex: hash.to_hex().trim_start_matches("0x").to_string(),
|
||
binary: hash.to_binary_string(),
|
||
byte_length: 48,
|
||
algorithm: "SHA3-384".to_string(),
|
||
}
|
||
}
|
||
|
||
/// 计算数据的 SHA3-384 哈希
|
||
pub fn sha3_384(data: &[u8]) -> Self {
|
||
let hash = Hash::sha3_384(data);
|
||
Self::from_hash(&hash)
|
||
}
|
||
}
|
||
|
||
// ============================================================
|
||
// 宪法层核心数据结构
|
||
// ============================================================
|
||
|
||
/// 宪法状态
|
||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||
pub struct ConstitutionState {
|
||
/// 当前宪法版本
|
||
pub current_version: u64,
|
||
/// 宪法哈希（NAC Hash 48字节 SHA3-384）
|
||
pub constitution_hash: NacHash,
|
||
/// 当前纪元
|
||
pub current_epoch: u64,
|
||
/// 当前区块高度
|
||
pub current_height: u64,
|
||
/// 共识参数
|
||
pub gas_limit: u64,
|
||
/// 最小出块间隔（毫秒）
|
||
pub delta_t_min: u64,
|
||
/// 最大出块间隔（毫秒）
|
||
pub delta_t_max: u64,
|
||
/// 目标区块利用率
|
||
pub target_utilization: f64,
|
||
/// 宪法层状态
|
||
pub layer_status: String,
|
||
/// 验证器数量
|
||
pub validator_count: u64,
|
||
/// Chain ID
|
||
pub chain_id: u64,
|
||
/// 最后更新时间
|
||
pub last_updated: String,
|
||
}
|
||
|
||
/// 宪法验证请求
|
||
#[derive(Debug, Deserialize)]
|
||
pub struct ConstitutionValidationRequest {
|
||
/// 交易哈希（hex，48字节 SHA3-384）
|
||
pub tx_hash: Option<String>,
|
||
/// 发送方地址（hex，32字节）
|
||
pub sender: Option<String>,
|
||
/// 接收方地址（hex，32字节）
|
||
pub receiver: Option<String>,
|
||
/// 交易金额
|
||
pub amount: Option<u64>,
|
||
/// 合约字节码（hex）
|
||
pub contract_bytecode: Option<String>,
|
||
/// 验证类型：transaction / contract / governance / rwa_asset
|
||
pub validation_type: String,
|
||
/// 额外数据
|
||
pub extra_data: Option<serde_json::Value>,
|
||
}
|
||
|
||
/// 宪法原则检查结果
|
||
#[derive(Debug, Serialize)]
|
||
pub struct PrincipleCheckResult {
|
||
/// 原则编号（1-7）
|
||
pub principle_id: u8,
|
||
/// 原则名称
|
||
pub principle_name: String,
|
||
/// 是否通过
|
||
pub passed: bool,
|
||
/// 详情
|
||
pub detail: String,
|
||
}
|
||
|
||
/// 宪法验证结果
|
||
#[derive(Debug, Serialize)]
|
||
pub struct ConstitutionValidationResult {
|
||
/// 是否通过宪法验证
|
||
pub valid: bool,
|
||
/// 验证 ID（UUID）
|
||
pub validation_id: String,
|
||
/// 宪法原则检查结果（7条）
|
||
pub principles: Vec<PrincipleCheckResult>,
|
||
/// 违规详情
|
||
pub violations: Vec<String>,
|
||
/// 建议
|
||
pub recommendations: Vec<String>,
|
||
/// 验证耗时（毫秒）
|
||
pub elapsed_ms: u64,
|
||
/// 时间戳
|
||
pub timestamp: String,
|
||
}
|
||
|
||
/// 宪法收据（ConstitutionalReceipt）
|
||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||
pub struct ConstitutionalReceipt {
|
||
/// 收据 ID（格式：CR-{UUID}）
|
||
pub receipt_id: String,
|
||
/// 关联交易哈希（NAC Hash，48字节）
|
||
pub tx_hash: String,
|
||
/// 宪法版本
|
||
pub constitution_version: u64,
|
||
/// 宪法哈希（NAC Hash，48字节 SHA3-384）
|
||
pub constitution_hash: NacHash,
|
||
/// 验证结果
|
||
pub validation_passed: bool,
|
||
/// 通过的宪法原则编号
|
||
pub passed_principles: Vec<u8>,
|
||
/// 区块高度
|
||
pub block_height: u64,
|
||
/// 纪元
|
||
pub epoch: u64,
|
||
/// 生成时间戳（Unix 毫秒）
|
||
pub timestamp: u64,
|
||
/// 收据签名（NAC Hash，48字节 SHA3-384）
|
||
pub signature: NacHash,
|
||
/// 有效期（区块高度）
|
||
pub expiry_height: u64,
|
||
/// Chain ID
|
||
pub chain_id: u64,
|
||
}
|
||
|
||
/// 宪法收据生成请求
|
||
#[derive(Debug, Deserialize)]
|
||
pub struct ReceiptGenerationRequest {
|
||
/// 交易哈希（hex，48字节）
|
||
pub tx_hash: String,
|
||
/// 验证 ID（可选）
|
||
pub validation_id: Option<String>,
|
||
}
|
||
|
||
/// 二进制字符串转换请求
|
||
#[derive(Debug, Deserialize)]
|
||
pub struct BinaryConversionRequest {
|
||
/// 输入值（hex 或 binary）
|
||
pub value: String,
|
||
/// 输入格式：hex / binary
|
||
pub input_format: String,
|
||
/// 类型：address（32字节）/ hash（48字节）
|
||
pub data_type: String,
|
||
}
|
||
|
||
// ============================================================
|
||
// 宪法层全局状态
|
||
// ============================================================
|
||
|
||
#[derive(Debug)]
|
||
pub struct ConstitutionLayerState {
|
||
pub version: u64,
|
||
pub constitution_hash: Hash,
|
||
pub epoch: u64,
|
||
pub height: u64,
|
||
pub gas_limit: u64,
|
||
pub delta_t_min: u64,
|
||
pub delta_t_max: u64,
|
||
pub target_utilization: f64,
|
||
pub validator_count: u64,
|
||
pub receipts: Vec<ConstitutionalReceipt>,
|
||
}
|
||
|
||
impl Default for ConstitutionLayerState {
|
||
fn default() -> Self {
|
||
// 使用 NAC 原生 Hash::sha3_384 计算创世宪法哈希
|
||
let genesis_data = b"NAC Constitutional Layer v1.0 - NewAssetChain MainNet Genesis - Chain-ID-5132611 - CBPP-Constitutional-Block-Production-Protocol";
|
||
let constitution_hash = Hash::sha3_384(genesis_data);
|
||
|
||
Self {
|
||
version: 1,
|
||
constitution_hash,
|
||
epoch: 1,
|
||
height: 0,
|
||
gas_limit: 30_000_000,
|
||
delta_t_min: 100,
|
||
delta_t_max: 2000,
|
||
target_utilization: 0.75,
|
||
validator_count: 21,
|
||
receipts: Vec::new(),
|
||
}
|
||
}
|
||
}
|
||
|
||
type SharedState = Arc<RwLock<ConstitutionLayerState>>;
|
||
|
||
// ============================================================
|
||
// NAC 宪法七大原则验证
|
||
// ============================================================
|
||
|
||
fn check_constitutional_principles(req: &ConstitutionValidationRequest) -> Vec<PrincipleCheckResult> {
|
||
let mut results = Vec::new();
|
||
|
||
// 原则1：主权完整性原则 — 发送方地址必须是合法的 NAC Address（32字节）
|
||
let p1_passed = if let Some(sender) = &req.sender {
|
||
let hex = sender.trim_start_matches("0x");
|
||
// Address 32字节 = 64个十六进制字符
|
||
hex.len() == 64 && hex.chars().all(|c| c.is_ascii_hexdigit())
|
||
} else {
|
||
false
|
||
};
|
||
results.push(PrincipleCheckResult {
|
||
principle_id: 1,
|
||
principle_name: "主权完整性原则".to_string(),
|
||
passed: p1_passed,
|
||
detail: if p1_passed {
|
||
"发送方地址合法（NAC Address，32字节，256位）".to_string()
|
||
} else {
|
||
"发送方地址缺失或不合法（需要32字节/64位十六进制）".to_string()
|
||
},
|
||
});
|
||
|
||
// 原则2：资产真实性原则 — 金额必须为正数
|
||
let p2_passed = match req.validation_type.as_str() {
|
||
"transaction" => req.amount.map(|a| a > 0).unwrap_or(false),
|
||
_ => true,
|
||
};
|
||
results.push(PrincipleCheckResult {
|
||
principle_id: 2,
|
||
principle_name: "资产真实性原则".to_string(),
|
||
passed: p2_passed,
|
||
detail: if p2_passed {
|
||
"交易金额合法（大于零）".to_string()
|
||
} else {
|
||
"交易金额必须大于零".to_string()
|
||
},
|
||
});
|
||
|
||
// 原则3：合规验证原则 — 合约字节码不能为空
|
||
let p3_passed = match req.validation_type.as_str() {
|
||
"contract" => req.contract_bytecode.as_ref()
|
||
.map(|b| !b.is_empty() && b.len() >= 2)
|
||
.unwrap_or(false),
|
||
_ => true,
|
||
};
|
||
results.push(PrincipleCheckResult {
|
||
principle_id: 3,
|
||
principle_name: "合规验证原则".to_string(),
|
||
passed: p3_passed,
|
||
detail: if p3_passed {
|
||
"合约字节码格式合法".to_string()
|
||
} else {
|
||
"合约字节码不能为空".to_string()
|
||
},
|
||
});
|
||
|
||
// 原则4：区块序列原则 — 由 CBPP 节点保证
|
||
results.push(PrincipleCheckResult {
|
||
principle_id: 4,
|
||
principle_name: "区块序列原则（CBPP原则4）".to_string(),
|
||
passed: true,
|
||
detail: "由 CBPP 节点保证，节点序列 ≤ 最新区块高度".to_string(),
|
||
});
|
||
|
||
// 原则5：宪法不可绕过原则 — 本次验证即为强制检查
|
||
results.push(PrincipleCheckResult {
|
||
principle_id: 5,
|
||
principle_name: "宪法不可绕过原则".to_string(),
|
||
passed: true,
|
||
detail: "宪法层强制验证，不可绕过".to_string(),
|
||
});
|
||
|
||
// 原则6：去中心化治理原则 — 治理提案必须有合法类型
|
||
let p6_passed = match req.validation_type.as_str() {
|
||
"governance" => req.extra_data.as_ref()
|
||
.map(|d| d.get("proposal_type").is_some())
|
||
.unwrap_or(false),
|
||
_ => true,
|
||
};
|
||
results.push(PrincipleCheckResult {
|
||
principle_id: 6,
|
||
principle_name: "去中心化治理原则".to_string(),
|
||
passed: p6_passed,
|
||
detail: if p6_passed {
|
||
"治理提案格式合法".to_string()
|
||
} else {
|
||
"治理提案必须包含 proposal_type 字段".to_string()
|
||
},
|
||
});
|
||
|
||
// 原则7：RWA 资产合规原则 — RWA 资产必须有 GNACS 分类码
|
||
let p7_passed = match req.validation_type.as_str() {
|
||
"rwa_asset" => req.extra_data.as_ref()
|
||
.map(|d| d.get("gnacs_code").is_some())
|
||
.unwrap_or(false),
|
||
_ => true,
|
||
};
|
||
results.push(PrincipleCheckResult {
|
||
principle_id: 7,
|
||
principle_name: "RWA资产合规原则（GNACS分类）".to_string(),
|
||
passed: p7_passed,
|
||
detail: if p7_passed {
|
||
"RWA资产包含合法的 GNACS 分类码".to_string()
|
||
} else {
|
||
"RWA资产必须包含 gnacs_code 字段".to_string()
|
||
},
|
||
});
|
||
|
||
results
|
||
}
|
||
|
||
// ============================================================
|
||
// Token 认证中间件 (FIX-007)
|
||
// ============================================================
|
||
|
||
/// Token 认证中间件工厂
|
||
/// 所有 API 端点（除 /health 外）均需要 Bearer Token 认证
|
||
pub struct BearerAuth {
|
||
pub token: Arc<String>,
|
||
}
|
||
|
||
impl BearerAuth {
|
||
pub fn new(token: String) -> Self {
|
||
Self { token: Arc::new(token) }
|
||
}
|
||
}
|
||
|
||
impl<S, B> Transform<S, ServiceRequest> for BearerAuth
|
||
where
|
||
S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error> + 'static,
|
||
B: 'static,
|
||
{
|
||
type Response = ServiceResponse<B>;
|
||
type Error = Error;
|
||
type InitError = ();
|
||
type Transform = BearerAuthMiddleware<S>;
|
||
type Future = Ready<Result<Self::Transform, Self::InitError>>;
|
||
|
||
fn new_transform(&self, service: S) -> Self::Future {
|
||
ok(BearerAuthMiddleware {
|
||
service: Arc::new(service),
|
||
token: self.token.clone(),
|
||
})
|
||
}
|
||
}
|
||
|
||
/// Token 认证中间件实例
|
||
pub struct BearerAuthMiddleware<S> {
|
||
service: Arc<S>,
|
||
token: Arc<String>,
|
||
}
|
||
|
||
impl<S, B> Service<ServiceRequest> for BearerAuthMiddleware<S>
|
||
where
|
||
S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error> + 'static,
|
||
B: 'static,
|
||
{
|
||
type Response = ServiceResponse<B>;
|
||
type Error = Error;
|
||
type Future = LocalBoxFuture<'static, Result<Self::Response, Self::Error>>;
|
||
|
||
fn poll_ready(
|
||
&self,
|
||
cx: &mut std::task::Context<'_>,
|
||
) -> std::task::Poll<Result<(), Self::Error>> {
|
||
self.service.poll_ready(cx)
|
||
}
|
||
|
||
fn call(&self, req: ServiceRequest) -> Self::Future {
|
||
// /health 端点无需认证（供监控系统使用）
|
||
if req.path() == "/health" {
|
||
let svc = self.service.clone();
|
||
return Box::pin(async move { svc.call(req).await });
|
||
}
|
||
|
||
let token = self.token.clone();
|
||
let svc = self.service.clone();
|
||
|
||
Box::pin(async move {
|
||
// 提取 Authorization 头
|
||
let auth_header = req
|
||
.headers()
|
||
.get("Authorization")
|
||
.and_then(|v| v.to_str().ok())
|
||
.unwrap_or("");
|
||
|
||
// 验证 Bearer Token
|
||
let provided = auth_header.strip_prefix("Bearer ").unwrap_or("");
|
||
if provided != token.as_str() {
|
||
log::warn!(
|
||
"宪法层 API 认证失败: path={} remote={:?}",
|
||
req.path(),
|
||
req.peer_addr()
|
||
);
|
||
return Err(actix_web::error::ErrorUnauthorized(
|
||
serde_json::json!({
|
||
"success": false,
|
||
"error": "Unauthorized: valid Bearer token required",
|
||
"code": 401
|
||
}).to_string()
|
||
));
|
||
}
|
||
|
||
svc.call(req).await
|
||
})
|
||
}
|
||
}
|
||
|
||
// ============================================================
|
||
// HTTP 处理器
|
||
// ============================================================
|
||
|
||
/// 健康检查
|
||
async fn health(state: web::Data<SharedState>) -> HttpResponse {
|
||
let s = state.read();
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"status": "running",
|
||
"service": "nac-constitution-service",
|
||
"version": "1.0.0",
|
||
"layer": "Constitutional Layer",
|
||
"protocol": "CBPP",
|
||
"chain_id": 5132611u64,
|
||
"type_system": {
|
||
"address": "32 bytes (256-bit)",
|
||
"hash": "48 bytes (SHA3-384, 384-bit)",
|
||
"binary_groups": 8
|
||
},
|
||
"constitution_version": s.version,
|
||
"constitution_hash_hex": s.constitution_hash.to_hex(),
|
||
"constitution_hash_binary_length": s.constitution_hash.to_binary_string().replace(" ", "").len(),
|
||
"current_epoch": s.epoch,
|
||
"timestamp": Utc::now().to_rfc3339()
|
||
}))
|
||
}
|
||
|
||
/// 获取宪法状态
|
||
async fn get_constitution_state(state: web::Data<SharedState>) -> HttpResponse {
|
||
let s = state.read();
|
||
HttpResponse::Ok().json(ConstitutionState {
|
||
current_version: s.version,
|
||
constitution_hash: NacHash::from_hash(&s.constitution_hash),
|
||
current_epoch: s.epoch,
|
||
current_height: s.height,
|
||
gas_limit: s.gas_limit,
|
||
delta_t_min: s.delta_t_min,
|
||
delta_t_max: s.delta_t_max,
|
||
target_utilization: s.target_utilization,
|
||
layer_status: "active".to_string(),
|
||
validator_count: s.validator_count,
|
||
chain_id: 5132611,
|
||
last_updated: Utc::now().to_rfc3339(),
|
||
})
|
||
}
|
||
|
||
/// 宪法合规验证
|
||
async fn validate(
|
||
req: web::Json<ConstitutionValidationRequest>,
|
||
) -> HttpResponse {
|
||
let start = std::time::Instant::now();
|
||
let validation_id = Uuid::new_v4().to_string();
|
||
|
||
log::info!("宪法验证请求 | 类型: {} | ID: {}", req.validation_type, validation_id);
|
||
|
||
let principles = check_constitutional_principles(&req);
|
||
let violations: Vec<String> = principles.iter()
|
||
.filter(|p| !p.passed)
|
||
.map(|p| format!("原则{}: {} — {}", p.principle_id, p.principle_name, p.detail))
|
||
.collect();
|
||
|
||
let valid = violations.is_empty();
|
||
let elapsed = start.elapsed().as_millis() as u64;
|
||
|
||
let recommendations = if !valid {
|
||
violations.iter().map(|v| format!("请修正: {}", v)).collect()
|
||
} else {
|
||
vec!["全部7条宪法原则验证通过，可生成宪法收据".to_string()]
|
||
};
|
||
|
||
if valid {
|
||
log::info!("宪法验证通过 | ID: {} | 耗时: {}ms", validation_id, elapsed);
|
||
} else {
|
||
log::warn!("宪法验证失败 | ID: {} | 违规数: {}", validation_id, violations.len());
|
||
}
|
||
|
||
HttpResponse::Ok().json(ConstitutionValidationResult {
|
||
valid,
|
||
validation_id,
|
||
principles,
|
||
violations,
|
||
recommendations,
|
||
elapsed_ms: elapsed,
|
||
timestamp: Utc::now().to_rfc3339(),
|
||
})
|
||
}
|
||
|
||
/// 生成宪法收据
|
||
async fn generate_receipt(
|
||
req: web::Json<ReceiptGenerationRequest>,
|
||
state: web::Data<SharedState>,
|
||
) -> HttpResponse {
|
||
let s = state.read();
|
||
|
||
let receipt_id = format!("CR-{}", Uuid::new_v4().to_string().replace("-", "").to_uppercase());
|
||
|
||
// 使用 NAC 原生 Hash::sha3_384 生成收据签名
|
||
let mut sig_data = Vec::new();
|
||
sig_data.extend_from_slice(receipt_id.as_bytes());
|
||
sig_data.extend_from_slice(req.tx_hash.as_bytes());
|
||
sig_data.extend_from_slice(s.constitution_hash.as_bytes());
|
||
sig_data.extend_from_slice(&s.epoch.to_le_bytes());
|
||
sig_data.extend_from_slice(&s.height.to_le_bytes());
|
||
let signature_hash = Hash::sha3_384(&sig_data);
|
||
|
||
let now_ts = Utc::now().timestamp_millis() as u64;
|
||
let expiry_height = s.height + 1000;
|
||
|
||
let receipt = ConstitutionalReceipt {
|
||
receipt_id: receipt_id.clone(),
|
||
tx_hash: req.tx_hash.clone(),
|
||
constitution_version: s.version,
|
||
constitution_hash: NacHash::from_hash(&s.constitution_hash),
|
||
validation_passed: true,
|
||
passed_principles: vec![1, 2, 3, 4, 5, 6, 7],
|
||
block_height: s.height,
|
||
epoch: s.epoch,
|
||
timestamp: now_ts,
|
||
signature: NacHash::from_hash(&signature_hash),
|
||
expiry_height,
|
||
chain_id: 5132611,
|
||
};
|
||
|
||
drop(s);
|
||
state.write().receipts.push(receipt.clone());
|
||
|
||
log::info!("宪法收据已生成 | ID: {} | 交易: {} | 有效期至区块: {}", receipt_id, req.tx_hash, expiry_height);
|
||
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"success": true,
|
||
"receipt": receipt,
|
||
"message": format!("宪法收据已生成，有效期至区块高度 {}", expiry_height)
|
||
}))
|
||
}
|
||
|
||
/// 查询宪法收据
|
||
async fn get_receipt(
|
||
path: web::Path<String>,
|
||
state: web::Data<SharedState>,
|
||
) -> HttpResponse {
|
||
let receipt_id = path.into_inner();
|
||
let s = state.read();
|
||
|
||
match s.receipts.iter().find(|r| r.receipt_id == receipt_id) {
|
||
Some(receipt) => {
|
||
let expired = receipt.expiry_height < s.height;
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"found": true,
|
||
"receipt": receipt,
|
||
"expired": expired,
|
||
"current_height": s.height
|
||
}))
|
||
}
|
||
None => HttpResponse::NotFound().json(serde_json::json!({
|
||
"found": false,
|
||
"receipt_id": receipt_id,
|
||
"message": "宪法收据不存在"
|
||
}))
|
||
}
|
||
}
|
||
|
||
/// 获取宪法参数
|
||
async fn get_params(state: web::Data<SharedState>) -> HttpResponse {
|
||
let s = state.read();
|
||
let hash = NacHash::from_hash(&s.constitution_hash);
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"constitution_version": s.version,
|
||
"constitution_hash": hash,
|
||
"epoch": s.epoch,
|
||
"gas_limit": s.gas_limit,
|
||
"gas_limit_min": 1_000_000u64,
|
||
"gas_limit_max": 100_000_000u64,
|
||
"delta_t_min_ms": s.delta_t_min,
|
||
"delta_t_max_ms": s.delta_t_max,
|
||
"target_utilization": s.target_utilization,
|
||
"adjust_factor": 0.125,
|
||
"validator_count": s.validator_count,
|
||
"type_system": {
|
||
"address_bytes": 32,
|
||
"hash_bytes": 48,
|
||
"hash_algorithm": "SHA3-384",
|
||
"binary_groups": 8,
|
||
"address_bits": 256,
|
||
"hash_bits": 384
|
||
},
|
||
"cbpp_principles": [
|
||
{"id": 1, "name": "主权完整性原则"},
|
||
{"id": 2, "name": "资产真实性原则"},
|
||
{"id": 3, "name": "合规验证原则"},
|
||
{"id": 4, "name": "区块序列原则"},
|
||
{"id": 5, "name": "宪法不可绕过原则"},
|
||
{"id": 6, "name": "去中心化治理原则"},
|
||
{"id": 7, "name": "RWA资产合规原则"}
|
||
],
|
||
"timestamp": Utc::now().to_rfc3339()
|
||
}))
|
||
}
|
||
|
||
/// NAC 类型系统二进制字符串转换工具
|
||
async fn convert_binary(req: web::Json<BinaryConversionRequest>) -> HttpResponse {
|
||
match req.data_type.as_str() {
|
||
"address" => {
|
||
match req.input_format.as_str() {
|
||
"hex" => {
|
||
match NacAddress::from_hex(&req.value) {
|
||
Ok(addr) => HttpResponse::Ok().json(serde_json::json!({
|
||
"success": true,
|
||
"data_type": "address",
|
||
"byte_length": 32,
|
||
"bit_length": 256,
|
||
"hex": addr.hex,
|
||
"binary": addr.binary,
|
||
"binary_length": addr.binary.replace(" ", "").len()
|
||
})),
|
||
Err(e) => HttpResponse::BadRequest().json(serde_json::json!({
|
||
"success": false,
|
||
"error": e
|
||
}))
|
||
}
|
||
}
|
||
"binary" => {
|
||
match NacAddress::from_binary(&req.value) {
|
||
Ok(addr) => HttpResponse::Ok().json(serde_json::json!({
|
||
"success": true,
|
||
"data_type": "address",
|
||
"byte_length": 32,
|
||
"bit_length": 256,
|
||
"hex": addr.hex,
|
||
"binary": addr.binary
|
||
})),
|
||
Err(e) => HttpResponse::BadRequest().json(serde_json::json!({
|
||
"success": false,
|
||
"error": e
|
||
}))
|
||
}
|
||
}
|
||
_ => HttpResponse::BadRequest().json(serde_json::json!({
|
||
"success": false,
|
||
"error": "input_format 必须为 hex 或 binary"
|
||
}))
|
||
}
|
||
}
|
||
"hash" => {
|
||
match req.input_format.as_str() {
|
||
"hex" => {
|
||
match Hash::from_hex(&req.value) {
|
||
Ok(hash) => {
|
||
let nac_hash = NacHash::from_hash(&hash);
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"success": true,
|
||
"data_type": "hash",
|
||
"algorithm": "SHA3-384",
|
||
"byte_length": 48,
|
||
"bit_length": 384,
|
||
"hex": nac_hash.hex,
|
||
"binary": nac_hash.binary,
|
||
"binary_length": nac_hash.binary.replace(" ", "").len()
|
||
}))
|
||
}
|
||
Err(e) => HttpResponse::BadRequest().json(serde_json::json!({
|
||
"success": false,
|
||
"error": e
|
||
}))
|
||
}
|
||
}
|
||
"binary" => {
|
||
match Hash::from_binary_string(&req.value) {
|
||
Ok(hash) => {
|
||
let nac_hash = NacHash::from_hash(&hash);
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"success": true,
|
||
"data_type": "hash",
|
||
"algorithm": "SHA3-384",
|
||
"byte_length": 48,
|
||
"bit_length": 384,
|
||
"hex": nac_hash.hex,
|
||
"binary": nac_hash.binary
|
||
}))
|
||
}
|
||
Err(e) => HttpResponse::BadRequest().json(serde_json::json!({
|
||
"success": false,
|
||
"error": e
|
||
}))
|
||
}
|
||
}
|
||
"data" => {
|
||
// 直接计算任意数据的 SHA3-384 哈希
|
||
let nac_hash = NacHash::sha3_384(req.value.as_bytes());
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"success": true,
|
||
"data_type": "hash",
|
||
"algorithm": "SHA3-384",
|
||
"byte_length": 48,
|
||
"bit_length": 384,
|
||
"input": req.value,
|
||
"hex": nac_hash.hex,
|
||
"binary": nac_hash.binary,
|
||
"binary_length": nac_hash.binary.replace(" ", "").len()
|
||
}))
|
||
}
|
||
_ => HttpResponse::BadRequest().json(serde_json::json!({
|
||
"success": false,
|
||
"error": "input_format 必须为 hex、binary 或 data"
|
||
}))
|
||
}
|
||
}
|
||
_ => HttpResponse::BadRequest().json(serde_json::json!({
|
||
"success": false,
|
||
"error": "data_type 必须为 address 或 hash"
|
||
}))
|
||
}
|
||
}
|
||
|
||
/// 宪法层统计信息
|
||
async fn get_stats(state: web::Data<SharedState>) -> HttpResponse {
|
||
let s = state.read();
|
||
HttpResponse::Ok().json(serde_json::json!({
|
||
"service": "nac-constitution-service",
|
||
"layer": "Constitutional Layer",
|
||
"chain_id": 5132611u64,
|
||
"constitution_version": s.version,
|
||
"current_epoch": s.epoch,
|
||
"current_height": s.height,
|
||
"total_receipts_generated": s.receipts.len(),
|
||
"active_receipts": s.receipts.iter().filter(|r| r.expiry_height >= s.height).count(),
|
||
"expired_receipts": s.receipts.iter().filter(|r| r.expiry_height < s.height).count(),
|
||
"validator_count": s.validator_count,
|
||
"type_system": {
|
||
"address_bytes": 32,
|
||
"hash_bytes": 48,
|
||
"hash_algorithm": "SHA3-384",
|
||
"binary_groups": 8
|
||
},
|
||
"timestamp": Utc::now().to_rfc3339()
|
||
}))
|
||
}
|
||
|
||
// ============================================================
|
||
// 主入口
|
||
// ============================================================
|
||
|
||
#[actix_web::main]
|
||
async fn main() -> std::io::Result<()> {
|
||
env_logger::init_from_env(env_logger::Env::default().default_filter_or("info"));
|
||
|
||
let host = env::var("CONSTITUTION_HOST").unwrap_or_else(|_| "0.0.0.0".to_string());
|
||
let port: u16 = env::var("CONSTITUTION_PORT")
|
||
.unwrap_or_else(|_| "9548".to_string())
|
||
.parse()
|
||
.unwrap_or(9548);
|
||
|
||
log::info!("╔══════════════════════════════════════════════════════╗");
|
||
log::info!("║ NAC 宪法层服务 (Constitutional Layer) ║");
|
||
log::info!("║ nac-constitution-service v1.0.0 ║");
|
||
log::info!("║ NAC 公链 Chain ID: 5132611 ║");
|
||
log::info!("║ 类型系统: Address 32B / Hash 48B (SHA3-384) ║");
|
||
log::info!("╚══════════════════════════════════════════════════════╝");
|
||
log::info!("监听地址: {}:{}", host, port);
|
||
|
||
let state: SharedState = Arc::new(RwLock::new(ConstitutionLayerState::default()));
|
||
{
|
||
let s = state.read();
|
||
log::info!("宪法层初始化完成");
|
||
log::info!("创世宪法哈希 (SHA3-384, 48B): {}", s.constitution_hash.to_hex());
|
||
log::info!("二进制长度: {} 位", s.constitution_hash.to_binary_string().replace(" ", "").len());
|
||
}
|
||
|
||
let state_data = web::Data::new(state);
|
||
|
||
// FIX-007: 读取 API Token（从环境变量 CONSTITUTION_API_TOKEN）
|
||
let api_token = env::var("CONSTITUTION_API_TOKEN").unwrap_or_else(|_| {
|
||
// 若未设置，生成随机 token 并打印到日志（主网运维必须配置此变量）
|
||
let random_token = format!("nac-const-{}", Uuid::new_v4().to_string().replace("-", ""));
|
||
log::warn!("CONSTITUTION_API_TOKEN 未设置，已生成临时 Token: {}", random_token);
|
||
log::warn!("主网运维：请在 systemd 服务中设置 CONSTITUTION_API_TOKEN 环境变量！");
|
||
random_token
|
||
});
|
||
log::info!("宪法层 API Token 认证已启用 (FIX-007)");
|
||
let api_token = Arc::new(api_token);
|
||
|
||
HttpServer::new(move || {
|
||
let token = api_token.as_ref().clone();
|
||
App::new()
|
||
.app_data(state_data.clone())
|
||
.wrap(BearerAuth::new(token))
|
||
// 健康检查
|
||
.route("/health", web::get().to(health))
|
||
// 宪法状态
|
||
.route("/state", web::get().to(get_constitution_state))
|
||
// 宪法验证（七大原则）
|
||
.route("/validate", web::post().to(validate))
|
||
// 宪法收据
|
||
.route("/receipt/generate", web::post().to(generate_receipt))
|
||
.route("/receipt/{receipt_id}", web::get().to(get_receipt))
|
||
// 宪法参数
|
||
.route("/params", web::get().to(get_params))
|
||
// NAC 类型系统工具（Address 32B / Hash 48B 二进制转换）
|
||
.route("/types/convert", web::post().to(convert_binary))
|
||
// 统计信息
|
||
.route("/stats", web::get().to(get_stats))
|
||
})
|
||
.bind(format!("{}:{}", host, port))?
|
||
.run()
|
||
.await
|
||
}
|