fortro-engine/
├── src/
│   ├── main.rs                 # Axum bootstrap & middleware
│   ├── api/
│   │   ├── auth.rs            # Authentication routes
│   │   ├── wallet.rs          # Wallet + presentation flows
│   │   ├── issuer.rs          # Issuance routes
│   │   ├── verifier.rs        # Verification routes
│   │   ├── qr.rs              # QR + short URL generation
│   │   ├── presentation_request.rs
│   │   ├── credential_request.rs
│   │   └── consent.rs
│   ├── blockchain/            # Smart-contract client & ABI helpers
│   ├── middleware/            # DID extraction, auth guards
│   ├── models.rs              # Domain structs & enums
│   ├── services/              # Business logic (credential, issuer, wallet)
│   ├── utils/                 # Crypto, DID compatibility, helpers
│   ├── db.rs                  # Mongo connection + repository helpers
│   ├── config.rs              # Environment configuration loader
│   └── error.rs               # Unified error type (AppError)
├── Cargo.toml                 # Dependencies
└── README.md / docs           # Developer notes

pub async fn login(
    State(state): State<AppState>,
    Json(payload): Json<LoginRequest>,
) -> Result<Json<LoginResponse>, AppError> {
    let public_key = utils::did::extract_public_key(&payload.did)?;
    utils::crypto::verify_signature(
        payload.challenge.as_bytes(),
        &payload.signature,
        &public_key,
    )?;

    let token = state.auth_service().issue_jwt(&payload.did)?;

    Ok(Json(LoginResponse {
        token,
        did: payload.did,
    }))
}

pub async fn issue_credential(
    State(state): State<AppState>,
    Json(request): Json<IssueCredentialRequest>,
) -> Result<Json<IssueCredentialResponse>, AppError> {
    let issuer_service = state.issuer_service();
    let credential_service = state.credential_service();

    let (credential, ipfs_hash, tx_hash) = credential_service
        .issue_from_request(&request)
        .await?;

    issuer_service
        .record_issuance(&credential, &ipfs_hash, tx_hash.as_ref())
        .await?;

    Ok(Json(IssueCredentialResponse {
        credential,
        ipfs_hash,
        blockchain_tx_hash: tx_hash,
    }))
}

pub async fn verify_presentation(
    req: web::Json<VerifyRequest>,
    blockchain: web::Data<BlockchainClient>
) -> Result<HttpResponse, AppError> {
    let presentation = &req.presentation;
    
    // 1. Verify holder signature
    verify_holder_signature(presentation)?;
    
    // 2. Verify each credential
    for credential in &presentation.verifiable_credentials {
        // Verify issuer signature
        verify_issuer_signature(credential)?;
        
        // Check blockchain anchor
        let is_anchored = blockchain
            .verify_anchor(&credential.ipfs_hash)
            .await?;
        
        // Check revocation status
        let is_revoked = blockchain
            .is_revoked(&credential.id)
            .await?;
        
        if !is_anchored || is_revoked {
            return Err(AppError::InvalidCredential);
        }
    }
    
    Ok(HttpResponse::Ok().json(VerificationResult {
        valid: true,
        verified_claims: extract_claims(presentation)
    }))
}

use pqcrypto_dilithium::dilithium2;
use pqcrypto_kyber::kyber768;

// Key generation
pub fn generate_pq_keypair() -> (PublicKey, SecretKey) {
    dilithium2::keypair()
}

// Signing
pub fn sign_with_dilithium(
    message: &[u8],
    secret_key: &SecretKey
) -> Signature {
    dilithium2::sign(message, secret_key)
}

// Verification
pub fn verify_dilithium(
    message: &[u8],
    signature: &Signature,
    public_key: &PublicKey
) -> bool {
    dilithium2::verify(signature, message, public_key).is_ok()
}

pub fn create_did_from_public_key(public_key: &[u8]) -> String {
    let encoded = base64::encode(public_key);
    format!("did:alyra:{}", encoded)
}

pub fn extract_public_key_from_did(did: &str) -> Result<Vec<u8>> {
    let parts: Vec<&str> = did.split(':').collect();
    if parts.len() != 3 || parts[0] != "did" || parts[1] != "alyra" {
        return Err(AppError::InvalidDID);
    }
    base64::decode(parts[2])
        .map_err(|_| AppError::InvalidDID)
}

use ipfs_api::IpfsClient;

pub async fn upload_to_ipfs(
    credential: &VerifiableCredential
) -> Result<String> {
    let client = IpfsClient::default();
    let data = serde_json::to_vec(credential)?;
    
    let response = client
        .add(Cursor::new(data))
        .await?;
    
    Ok(response.hash)
}

pub async fn get_from_ipfs(hash: &str) -> Result<VerifiableCredential> {
    let client = IpfsClient::default();
    let data = client
        .cat(hash)
        .map_ok(|chunk| chunk.to_vec())
        .try_concat()
        .await?;
    
    serde_json::from_slice(&data)
        .map_err(|e| AppError::IpfsError(e.to_string()))
}

use ethers::prelude::*;

pub async fn anchor_credential(
    ipfs_hash: &str,
    credential_id: &str
) -> Result<TransactionReceipt> {
    let contract = get_contract().await?;
    
    let tx = contract
        .anchor_credential(
            ipfs_hash.as_bytes().into(),
            credential_id.as_bytes().into()
        )
        .send()
        .await?
        .await?;
    
    Ok(tx.unwrap())
}

pub async fn verify_anchor(ipfs_hash: &str) -> Result<bool> {
    let contract = get_contract().await?;
    
    let exists: bool = contract
        .verify_anchor(ipfs_hash.as_bytes().into())
        .call()
        .await?;
    
    Ok(exists)
}

pub async fn revoke_credential(credential_id: &str) -> Result<()> {
    let contract = get_contract().await?;
    
    contract
        .revoke_credential(credential_id.as_bytes().into())
        .send()
        .await?
        .await?;
    
    Ok(())
}

#[derive(Debug)]
pub enum AppError {
    DatabaseError(mongodb::error::Error),
    InvalidDID,
    InvalidSignature,
    UnauthorizedError,
    CredentialNotFound,
    IpfsError(String),
    BlockchainError(String),
    ValidationError(String),
}

impl ResponseError for AppError {
    fn error_response(&self) -> HttpResponse {
        match self {
            AppError::UnauthorizedError => {
                HttpResponse::Unauthorized().json(json!({
                    "error": "Unauthorized"
                }))
            }
            AppError::CredentialNotFound => {
                HttpResponse::NotFound().json(json!({
                    "error": "Credential not found"
                }))
            }
            _ => {
                HttpResponse::InternalServerError().json(json!({
                    "error": "Internal server error"
                }))
            }
        }
    }
}

# Core server
PORT=3000
HOST=0.0.0.0
JWT_SECRET=your-secret-key
JWT_EXPIRATION=86400

# Database
MONGODB_URI=mongodb://mongo:27017/fortro_db
DATABASE_NAME=fortro_db

# IPFS
IPFS_API_URL=http://ipfs:5001
IPFS_GATEWAY=https://gateway.sphyre.tech

# Blockchain
ETHEREUM_RPC_URL=https://sepolia.base.org
BLOCKCHAIN_RPC_URL=https://sepolia.base.org
BLOCKCHAIN_CHAIN_ID=84532
BLOCKCHAIN_DEPLOYER_PRIVATE_KEY=0x...
SSI_REGISTRY_ADDRESS=0x...
MINIMAL_FORWARDER_ADDRESS=0x...
SSI_FACTORY_ADDRESS=0x...

# Issuer identity
ISSUER_DID=did:alyra:...
ISSUER_PRIVATE_KEY=0x...

# CORS
CORS_ALLOWED_ORIGINS=https://app.sphyre.tech,https://verifier.sphyre.tech,https://issuers.sphyre.tech,https://sphyre.tech

FROM rust:1.74 as builder
WORKDIR /app
COPY . .
RUN cargo build --release

FROM debian:bookworm-slim
COPY --from=builder /app/target/release/fortro-engine /usr/local/bin/
ENV RUST_LOG=info
EXPOSE 3000
CMD ["fortro-engine"]

version: '3.8'
services:
  fortro-engine:
    build: .
    ports:
      - "3000:3000"
    environment:
      MONGODB_URI: mongodb://mongo:27017/fortro_db
      IPFS_API_URL: http://ipfs:5001
      CORS_ALLOWED_ORIGINS: https://app.sphyre.tech,https://verifier.sphyre.tech
    depends_on:
      - mongo
      - ipfs
  
  mongo:
    image: mongo:6
    volumes:
      - mongo-data:/data/db
  
  ipfs:
    image: ipfs/kubo:latest
    ports:
      - "5001:5001"
    volumes:
      - ipfs-data:/data/ipfs

volumes:
  mongo-data:
  ipfs-data:

#[cfg(test)]
mod tests {
    use super::*;
    
    #[test]
    fn test_did_generation() {
        let public_key = vec![1, 2, 3, 4];
        let did = create_did_from_public_key(&public_key);
        assert!(did.starts_with("did:alyra:"));
    }
    
    #[tokio::test]
    async fn test_wallet_service_merges_holder_data() {
        let state = TestHarness::new().await;
        let request = mock_credential_request();
        let response = state
            .wallet_service()
            .merge_holder_inputs(&request)
            .await
            .unwrap();

        assert!(response.credential_preview.is_object());
    }
}

use tracing::{info, warn};
use tower_http::trace::TraceLayer;

#[tokio::main(flavor = "current_thread")]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    tracing_subscriber::fmt::init();

    let state = build_app_state().await?;

    let app = Router::new()
        .nest("/api", api::routes())
        .layer(TraceLayer::new_for_http())
        .layer(axum_middleware::from_fn_with_state(
            state.clone(),
            middleware::extract_user_did,
        ))
        .with_state(state);

    info!("Starting Fortro Engine on port 3000");

    axum::serve(
        TcpListener::bind("0.0.0.0:3000").await?,
        app.into_make_service(),
    )
    .await?;

    Ok(())
}