introduce dns authentication

ndn/app/app.go

@@ -146,6 +146,17 @@ func (a *App) JsApi() js.Value {
 			})
 		}),
 
+		// ndncert_dns(domain: string, confirm: (recordName: string, recordValue: string, status: string) => Promise<string>): Promise<void>;
+		"ndncert_dns": jsutil.AsyncFunc(func(this js.Value, p []js.Value) (any, error) {
+			return nil, a.NdncertDns(p[0].String(), func(recordName, expectedValue, status string) string {
+				confirmation, err := jsutil.Await(p[1].Invoke(recordName, expectedValue, status))
+				if err != nil {
+					return ""
+				}
+				return confirmation.String()
+			})
+		}),
+
 		// join_workspace(wksp: string, create: boolean): Promise<string>;
 		"join_workspace": jsutil.AsyncFunc(func(this js.Value, p []js.Value) (any, error) {
 			return a.JoinWorkspace(p[0].String(), p[1].Bool())

ndn/app/ndncert.go

@@ -7,9 +7,13 @@ import (
 	"os"
 	"time"
 
+	"crypto/elliptic"
+
 	enc "github.com/named-data/ndnd/std/encoding"
+	"github.com/named-data/ndnd/std/security"
 	"github.com/named-data/ndnd/std/security/ndncert"
 	spec_ndncert "github.com/named-data/ndnd/std/security/ndncert/tlv"
+	sig "github.com/named-data/ndnd/std/security/signer"
 )
 
 func (a *App) NdncertEmail(email string, CodeCb func(status string) string) (err error) {
@@ -70,3 +74,77 @@ func (a *App) NdncertEmail(email string, CodeCb func(status string) string) (err
 
 	return nil
 }
+
+func (a *App) NdncertDns(domain string, ConfirmCb func(recordName, expectedValue, status string) string) (err error) {
+	if err := a.WaitForConnectivity(time.Second * 5); err != nil {
+		return err
+	}
+
+	certClient, err := ndncert.NewClient(a.engine, testbedRootCert)
+	if err != nil {
+		return err
+	}
+
+	caPrefix := certClient.CaPrefix()
+	if len(caPrefix) == 0 {
+		return fmt.Errorf("ca prefix unavailable")
+	}
+
+	identity := caPrefix.Append(enc.NewGenericComponent(domain))
+	keyName := security.MakeKeyName(identity)
+	signer, err := sig.KeygenEcc(keyName, elliptic.P256())
+	if err != nil {
+		return fmt.Errorf("failed to generate dns challenge key: %w", err)
+	}
+	certClient.SetSigner(signer)
+	certRes, err := certClient.RequestCert(ndncert.RequestCertArgs{
+		Challenge: &ndncert.ChallengeDns{
+			DomainCallback: func(status string) string {
+				return domain
+			},
+			ConfirmationCallback: func(recordName, expectedValue, status string) string {
+				if ConfirmCb == nil {
+					return ""
+				}
+				return ConfirmCb(recordName, expectedValue, status)
+			},
+		},
+		DisableProbe: true,
+		OnProfile: func(profile *spec_ndncert.CaProfile) error {
+			return nil
+		},
+		OnProbeParam: func(key string) ([]byte, error) {
+			switch key {
+			case ndncert.KwDomain:
+				return []byte(domain), nil
+			case ndncert.KwEmail:
+				return nil, nil
+			default:
+				return nil, nil
+			}
+		},
+		OnChooseKey: func(suggestions []enc.Name) int {
+			return 0
+		},
+		OnKeyChosen: func(keyName enc.Name) error {
+			fmt.Fprintf(os.Stderr, "Certifying key: %s\n", keyName)
+			return nil
+		},
+	})
+	if err != nil {
+		return err
+	}
+
+	if _, err = a.verifyTestbedCert(certRes.CertWire, true); err != nil {
+		return fmt.Errorf("failed to verify issued certificate: %w", err)
+	}
+
+	if err = a.keychain.InsertKey(certRes.Signer); err != nil {
+		return err
+	}
+	if err = a.keychain.InsertCert(certRes.CertWire.Join()); err != nil {
+		return err
+	}
+
+	return nil
+}

ndn/go.mod

@@ -2,7 +2,10 @@ module github.com/pulsejet/ownly/ndn
 
 go 1.23.4
 
-require github.com/named-data/ndnd v1.5.3-0.20250712020000-ed6bc2901834
+require (
+	github.com/named-data/ndnd v1.5.3-0.20250924035808-d75b7ee75bde
+	golang.org/x/crypto v0.37.0
+)
 
 require (
 	github.com/cespare/xxhash v1.1.0 // indirect
@@ -20,7 +23,6 @@ require (
 	go.opentelemetry.io/otel v1.35.0 // indirect
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
 	golang.org/x/net v0.39.0 // indirect
 	golang.org/x/sys v0.32.0 // indirect

ndn/go.sum

@@ -29,8 +29,8 @@ github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aN
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/named-data/ndnd v1.5.3-0.20250712020000-ed6bc2901834 h1:345yvIm+37SFexV6ees8XK3T+3z3ubAK5z7TWVt5zB4=
-github.com/named-data/ndnd v1.5.3-0.20250712020000-ed6bc2901834/go.mod h1:UAaa210BjVOroqFs/9tDmXYfegVQQvj6yueqO27e68c=
+github.com/named-data/ndnd v1.5.3-0.20250924035808-d75b7ee75bde h1:hTKDwaKF2rnrVsPUjICMu/jbmuBb43gPT0hTKT7dDYY=
+github.com/named-data/ndnd v1.5.3-0.20250924035808-d75b7ee75bde/go.mod h1:UAaa210BjVOroqFs/9tDmXYfegVQQvj6yueqO27e68c=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72 h1:qLC7fQah7D6K1B0ujays3HV9gkFtllcxhzImRR7ArPQ=