at-container-registry/pkg/hold/pds/keymgr.go

package pds

import (
	"context"
	"fmt"

	"github.com/bluesky-social/indigo/atproto/atcrypto"
)

// HoldKeyManager implements repomgr.KeyManager for a single-user hold
// It wraps a single signing key and ignores the 'did' parameter since
// a hold only has one identity
type HoldKeyManager struct {
	signingKey *atcrypto.PrivateKeyK256
}

// NewHoldKeyManager creates a new KeyManager for the hold's signing key
func NewHoldKeyManager(signingKey *atcrypto.PrivateKeyK256) *HoldKeyManager {
	return &HoldKeyManager{
		signingKey: signingKey,
	}
}

// SignForUser signs data using the hold's signing key
// The 'did' parameter is ignored since holds are single-user
func (km *HoldKeyManager) SignForUser(ctx context.Context, did string, data []byte) ([]byte, error) {
	return km.signingKey.HashAndSign(data)
}

// VerifyUserSignature verifies a signature using the hold's public key
// The 'did' parameter is ignored since holds are single-user
func (km *HoldKeyManager) VerifyUserSignature(ctx context.Context, did string, data []byte, sig []byte) error {
	// Get public key from private key
	pubKey, err := km.signingKey.PublicKey()
	if err != nil {
		return fmt.Errorf("failed to get public key: %w", err)
	}

	// HashAndVerify returns an error if verification fails
	if err := pubKey.HashAndVerify(data, sig); err != nil {
		return fmt.Errorf("signature verification failed: %w", err)
	}
	return nil
}