Signature Verification

import requests
import hashlib
import json
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.backends import default_backend

class SignatureVerifier:
    def __init__(self, api_key):
        self.api_key = api_key
        self.base_url = "https://api.redpill.ai/v1"

    def make_request(self, model, messages):
        """Make API request and return response with ID"""
        response = requests.post(
            f"{self.base_url}/chat/completions",
            headers={
                "Authorization": f"Bearer {self.api_key}",
                "Content-Type": "application/json"
            },
            json={
                "model": model,
                "messages": messages
            }
        )
        return response.json()

    def get_signature(self, request_id, model):
        """Fetch signature for a request"""
        response = requests.get(
            f"{self.base_url}/signature/{request_id}",
            params={"model": model, "signing_algo": "ecdsa"},
            headers={"Authorization": f"Bearer {self.api_key}"}
        )
        return response.json()

    def hash_content(self, content):
        """Hash content with SHA-256"""
        if isinstance(content, dict) or isinstance(content, list):
            content = json.dumps(content, sort_keys=True)
        return hashlib.sha256(content.encode()).hexdigest()

    def verify_signature(self, original_request, original_response, signature_data):
        """Verify complete signature"""
        # 1. Hash original request and response
        request_hash = self.hash_content(original_request["messages"])
        response_hash = self.hash_content(original_response["choices"][0]["message"]["content"])

        # 2. Verify hashes match signature payload
        if request_hash != signature_data["payload"]["request_hash"]:
            raise ValueError("Request hash mismatch")
        if response_hash != signature_data["payload"]["response_hash"]:
            raise ValueError("Response hash mismatch")

        # 3. Reconstruct signed message
        message = (
            f"{signature_data['payload']['request_hash']}|"
            f"{signature_data['payload']['response_hash']}|"
            f"{signature_data['payload']['timestamp']}|"
            f"{signature_data['payload']['model']}"
        )
        message_hash = hashlib.sha256(message.encode()).digest()

        # 4. Load public key
        public_key_bytes = bytes.fromhex(signature_data["signature"]["public_key"])
        public_key = ec.EllipticCurvePublicKey.from_encoded_point(
            ec.SECP256K1(),
            public_key_bytes
        )

        # 5. Verify ECDSA signature
        signature_bytes = bytes.fromhex(signature_data["signature"]["value"])
        try:
            public_key.verify(
                signature_bytes,
                message_hash,
                ec.ECDSA(hashes.SHA256())
            )
            return True
        except Exception as e:
            raise ValueError(f"Signature verification failed: {e}")

# Usage Example
verifier = SignatureVerifier("YOUR_API_KEY")

# 1. Make request
request_data = {
    "model": "phala/qwen-2.5-7b-instruct",
    "messages": [{"role": "user", "content": "What is 2+2?"}]
}
response = verifier.make_request(
    request_data["model"],
    request_data["messages"]
)

print(f"Response: {response['choices'][0]['message']['content']}")

# 2. Get signature
signature = verifier.get_signature(
    response["id"],
    request_data["model"]
)

# 3. Verify signature
try:
    verifier.verify_signature(request_data, response, signature)
    print("✅ Signature verified! Response is authentic.")
except ValueError as e:
    print(f"❌ Verification failed: {e}")