feat(didjs): skip asset certification in Candid UI canister (#571)

* feat(didjs): asset certification in Candid UI canister

* skip certification

tools/ui/src/didjs/Cargo.toml

@@ -8,9 +8,13 @@ path = "lib.rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-ic-cdk = "0.13"
+base64 = "0.22.1"
 candid = "0.10"
 candid_parser = "0.1"
+ic-cdk = "0.13"
+ic-certification = { git = "https://github.com/dfinity/response-verification", rev = "da70db93832f88ecc556ae082612aedec47d3816" }
+ic-http-certification = { git = "https://github.com/dfinity/response-verification", rev = "da70db93832f88ecc556ae082612aedec47d3816" }
+ic-representation-independent-hash = { git = "https://github.com/dfinity/response-verification", rev = "da70db93832f88ecc556ae082612aedec47d3816" }
 serde = "1.0"
 serde_bytes = "0.11"
-
+serde_cbor = "0.11.2"

tools/ui/src/didjs/lib.rs

@@ -1,5 +1,13 @@
+use base64::engine::general_purpose::STANDARD as BASE64;
+use base64::Engine;
 use candid::types::{subtype, Type, TypeInner};
 use candid_parser::{check_prog, CandidType, Deserialize, IDLProg, TypeEnv};
+use ic_cdk::api::{data_certificate, set_certified_data};
+use ic_cdk::{init, post_upgrade};
+use ic_certification::{labeled, leaf, HashTree};
+use ic_http_certification::DefaultCelBuilder;
+use ic_representation_independent_hash::hash;
+use serde::Serialize;
 
 #[derive(CandidType, Deserialize)]
 pub struct HeaderField(pub String, pub String);
@@ -97,7 +105,7 @@ fn get_path(url: &str) -> Option<&str> {
 fn http_request(request: HttpRequest) -> HttpResponse {
     //TODO add /canister_id/ as endpoint when ICQC is available.
     let path = get_path(request.url.as_str()).unwrap_or("/");
-    if let Some((content_type, bytes)) = retrieve(path) {
+    let mut response = if let Some((content_type, bytes)) = retrieve(path) {
         HttpResponse {
             status_code: 200,
             headers: vec![
@@ -113,7 +121,69 @@ fn http_request(request: HttpRequest) -> HttpResponse {
             headers: Vec::new(),
             body: path.as_bytes().to_vec(),
         }
-    }
+    };
+    add_certification_headers(&mut response);
+    response
+}
+
+// Certify that frontend asset certification is skipped for this canister.
+
+const IC_CERTIFICATE_HEADER: &str = "IC-Certificate";
+const IC_CERTIFICATE_EXPRESSION_HEADER: &str = "IC-CertificateExpression";
+
+fn skip_certification_cel_expr() -> String {
+    DefaultCelBuilder::skip_certification().to_string()
+}
+
+fn skip_certification_asset_tree() -> HashTree {
+    let cel_expr_hash = hash(skip_certification_cel_expr().as_bytes());
+    labeled(
+        "http_expr",
+        labeled("<*>", labeled(cel_expr_hash, leaf(vec![]))),
+    )
+}
+
+fn add_certification_headers(response: &mut HttpResponse) {
+    let certified_data = data_certificate().expect("No data certificate available");
+    let witness = cbor_encode(&skip_certification_asset_tree());
+    let expr_path = ["http_expr", "<*>"];
+    let expr_path = cbor_encode(&expr_path);
+
+    response.headers.push(HeaderField(
+        IC_CERTIFICATE_EXPRESSION_HEADER.to_string(),
+        skip_certification_cel_expr(),
+    ));
+    response.headers.push(HeaderField(
+        IC_CERTIFICATE_HEADER.to_string(),
+        format!(
+            "certificate=:{}:, tree=:{}:, expr_path=:{}:, version=2",
+            BASE64.encode(certified_data),
+            BASE64.encode(witness),
+            BASE64.encode(expr_path)
+        ),
+    ));
+}
+
+// Encoding
+fn cbor_encode(value: &impl Serialize) -> Vec<u8> {
+    let mut serializer = serde_cbor::Serializer::new(Vec::new());
+    serializer
+        .self_describe()
+        .expect("Failed to self describe CBOR");
+    value
+        .serialize(&mut serializer)
+        .expect("Failed to serialize value");
+    serializer.into_inner()
+}
+
+#[init]
+fn init() {
+    set_certified_data(&skip_certification_asset_tree().digest());
+}
+
+#[post_upgrade]
+fn post_upgrade() {
+    init();
 }
 
 ic_cdk::export_candid!();