add per-ticket API authentication scheme #514

itswisdomagain · 2019-09-04T17:22:21Z

Current API routes are mounted on /api/v1/* and /api/v2/*; and authentication is carried out by providing an API access token in the Authorization request header field in the format:
Authorization: Bearer <api key>.

This PR adds a new API authentication scheme (TicketAuth) as an alternative to the current Bearer auth scheme. The added TicketAuth scheme performs per-ticket authentication before executing requested actions on protected API endpoints such as /getpurchaseinfo. It's worth mentioning that the new auth scheme works as expected with all existing API endpoints and the changes introduced in this PR do not break backwards compatibility.

The new auth scheme uses the wallet built-in message signing capability and signs a msg which content is the current timestamp, allowing old msgs to be invalidated by the server so they are resistant to replay attacks.

The format for the TicketAuth scheme is:
Authorization: TicketAuth SignedTimestamp=1564531200, Signature=frJIUN8DYpKDtOLCwo, TicketHash=591b17ed03afc916f274669939924e12ed5ac90d8cc602172fb53237b8a20522

Where;

TicketAuth: is the name of the authentication scheme
SignedTimestamp: is the unix timestamp at the time of request, i.e. the message that is signed by the wallet
Signature (base64 string): the result of signing the timestamp above using the private key for the ticket reward address belonging to the user's wallet (see below)
TicketHash: the hash of the ticket for which the requested operation is to be performed

This authorization header format matches that defined in RFC2617. See this SO answer.

User's ticket reward address

A ticket purchased with voting rights shared with a vsp has 2 sstxcommitment outputs for receiving staking reward. One of these addresses belongs to the vsp wallet, while the other belongs to the ticket owner's wallet. This second address belonging to the ticket owner is what is used in preparing the Signature passed in the authentication header as described above.

Recovering redeem scripts for restored wallets

This ticket-level authentication makes recovering redeem scripts for restored wallets much easier. Instead of logging in to the vsp server to get the redeem script for a ticket or api key for an account, a client app can simply make an API request to /getpurchaseinfo using the TicketAuth scheme to retrieve the redeem script for a ticket - provided the ticket was purchased with the vsp.

Resolves #291. Part fix for #274 and decredcommunity/issues#100.

JoeGruffins

I don't really have an opinion on this, but it is the policy of dcrstakepool to use naked returns as little as possible. I've marked all the naked return I saw with "Naked."

I have a few questions about this idea in general, but I want to get through #515 before I say anything.

JoeGruffins · 2019-09-20T03:53:07Z

backend/stakepoold/rpc/rpcserver/context.go

@@ -16,6 +16,7 @@ import (
 	wallettypes "github.com/decred/dcrwallet/rpc/jsonrpc/types"

 	"github.com/decred/dcrd/rpcclient/v3"
+	"github.com/decred/dcrd/txscript"


I think this should be using txscript/v2

Using txscript/v2 will require using chaincfg/v2, especially for AppContext.Params (type *chaincfg.Params) which will cause issues in other existing usages of AppContext.Params.

try /v2 again; dcrd has updated since.

JoeGruffins · 2019-09-20T03:53:32Z

backend/stakepoold/rpc/api.proto

+	string MultiSigAddress = 1;
+	string VspFeeAddress = 2;
+	string OwnerFeeAddress = 3;
+}


We might want to start tracking txids in the db, as we want to become more self-sufficient. Although I am aware that you want to reduce the communication between the db and stakepoold, because it is on another machine. A centralized area to track tickets is needed, imo. What do you think? It should be discussed somewhere... I'll make an issue after a little more thought.

I'm not sure we can totally remove reliance on dcrwallet; unless that's possible and is something we're working towards, I'd prefer that where possible, we not store information that we can deduce by making 1 or 2 RPC calls. But you can open an issue for this and we can discuss it more and see what we can come up with.

As I later commented below, this may be a good idea after all. I can proceed to implement in this PR if that's agreed.

backend/stakepoold/rpc/rpcserver/context.go

system/ticketchallengescache.go

backend/stakepoold/rpc/api.proto

dajohi

rebase needed.

dajohi · 2019-10-09T22:55:43Z

backend/stakepoold/rpc/rpcserver/context.go

+		log.Errorf("GetTicketInfo: MsgTxFromHex failed for %v: %v", res.Hex, err)
+		return nil, err
+	}
+


missing check to verify tx is a vote.

dajohi · 2019-10-09T23:00:43Z

backend/stakepoold/rpc/rpcserver/context.go

@@ -16,6 +16,7 @@ import (
 	wallettypes "github.com/decred/dcrwallet/rpc/jsonrpc/types"

 	"github.com/decred/dcrd/rpcclient/v3"
+	"github.com/decred/dcrd/txscript"


try /v2 again; dcrd has updated since.

dajohi · 2019-10-09T23:02:44Z

system/api-auth.go

+	"time"
+
+	"github.com/decred/dcrd/dcrutil"
+	"github.com/decred/dcrwallet/wallet"


try /v3 again, since its already used. post compile errors here or ask on matrix.

JoeGruffins

Good to see you back at this! Left some comments.

backend/stakepoold/stakepool/stakepool.go

system/api-auth.go

system/ticketchallengescache.go

system/core.go

system/ticketchallengescache.go

JoeGruffins · 2020-03-15T02:26:31Z

I get a panic after this runs for a bit

panic

2020/03/15 02:14:10 [dcrstakedinner/yfhOMEWsD7-000001] panic: runtime error: invalid memory address or nil pointer dereference
goroutine 51 [running]:
runtime/debug.Stack(0x80, 0xc000113208, 0x1)
        /usr/lib/go/src/runtime/debug/stack.go:24 +0x9d
runtime/debug.PrintStack()
        /usr/lib/go/src/runtime/debug/stack.go:16 +0x22
github.com/zenazn/goji/web/middleware.Recoverer.func1.1(0xc0001b03a0, 0x20, 0x7fd39c5596c8, 0xc000079d00)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware/recoverer.go:24 +0x6f
panic(0xb3a860, 0x13715f0)
        /usr/lib/go/src/runtime/panic.go:679 +0x1b2
github.com/decred/dcrstakepool/system.(*Application).ApplyAPI.func1(0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /home/joe/git/dcrstakepool/system/middleware.go:74 +0x355
net/http.HandlerFunc.ServeHTTP(0xc000238d20, 0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web.(*cStack).ServeHTTPC(...)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:50
github.com/zenazn/goji/web.(*Mux).ServeHTTPC(0xc000496310, 0xc000238bd0, 0xc000238c90, 0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/mux.go:73 +0x88
github.com/zenazn/goji/web.(*router).route(0xc0004962d8, 0xc000238c00, 0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/router.go:114 +0x5b0
github.com/zenazn/goji/web.(*mStack).newStack.func1(0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:88 +0x56
net/http.HandlerFunc.ServeHTTP(0xc00051c520, 0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/decred/dcrstakepool/system.(*Application).ApplyDbMap.func1(0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /home/joe/git/dcrstakepool/system/middleware.go:42 +0xd2
net/http.HandlerFunc.ServeHTTP(0xc000238c30, 0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web/middleware.Recoverer.func1(0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware/recoverer.go:29 +0xe1
net/http.HandlerFunc.ServeHTTP(0xc00051c680, 0x7fd39c5596c8, 0xc000079d00, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/decred/dcrstakepool/system.Logger.func1.1(0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /home/joe/git/dcrstakepool/system/middleware.go:134 +0x476
net/http.HandlerFunc.ServeHTTP(0xc000238c60, 0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web/middleware.RequestID.func1(0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware/request_id.go:68 +0x1d7
net/http.HandlerFunc.ServeHTTP(0xc00051c6a0, 0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web.(*cStack).ServeHTTPC(...)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:50
github.com/zenazn/goji/web.(*Mux).ServeHTTPC(0xc0004962a0, 0xc000238bd0, 0x0, 0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/mux.go:73 +0x88
github.com/zenazn/goji/web.(*router).route(0xc000496d58, 0xc000238a80, 0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/router.go:114 +0x5b0
github.com/zenazn/goji/web.(*mStack).newStack.func1(0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:88 +0x56
net/http.HandlerFunc.ServeHTTP(0xc00051c080, 0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web.(*cStack).ServeHTTP(...)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:46
github.com/zenazn/goji/web.(*Mux).ServeHTTP(0xc000496d20, 0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/mux.go:65 +0x7d
net/http.serverHandler.ServeHTTP(0xc0004a0620, 0xe7cbe0, 0xc0004a0540, 0xc00010a200)
        /usr/lib/go/src/net/http/server.go:2802 +0xa4
net/http.(*conn).serve(0xc000506fa0, 0xe7ec20, 0xc000079540)
        /usr/lib/go/src/net/http/server.go:1890 +0x875
created by net/http.(*Server).Serve
        /usr/lib/go/src/net/http/server.go:2927 +0x38e
2020/03/15 02:14:10 [dcrstakedinner/yfhOMEWsD7-000002] panic: runtime error: invalid memory address or nil pointer dereference
goroutine 53 [running]:
runtime/debug.Stack(0x80, 0xc000113208, 0x1)
        /usr/lib/go/src/runtime/debug/stack.go:24 +0x9d
runtime/debug.PrintStack()
        /usr/lib/go/src/runtime/debug/stack.go:16 +0x22
github.com/zenazn/goji/web/middleware.Recoverer.func1.1(0xc0001b0440, 0x20, 0x7fd39c5596c8, 0xc00016e300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware/recoverer.go:24 +0x6f
panic(0xb3a860, 0x13715f0)
        /usr/lib/go/src/runtime/panic.go:679 +0x1b2
github.com/decred/dcrstakepool/system.(*Application).ApplyAPI.func1(0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /home/joe/git/dcrstakepool/system/middleware.go:74 +0x355
net/http.HandlerFunc.ServeHTTP(0xc000238ff0, 0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web.(*cStack).ServeHTTPC(...)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:50
github.com/zenazn/goji/web.(*Mux).ServeHTTPC(0xc000496310, 0xc000238f30, 0xc000238f60, 0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/mux.go:73 +0x88
github.com/zenazn/goji/web.(*router).route(0xc0004962d8, 0xc000238c00, 0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/router.go:114 +0x5b0
github.com/zenazn/goji/web.(*mStack).newStack.func1(0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:88 +0x56
net/http.HandlerFunc.ServeHTTP(0xc00051c520, 0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/decred/dcrstakepool/system.(*Application).ApplyDbMap.func1(0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /home/joe/git/dcrstakepool/system/middleware.go:42 +0xd2
net/http.HandlerFunc.ServeHTTP(0xc000238c30, 0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web/middleware.Recoverer.func1(0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware/recoverer.go:29 +0xe1
net/http.HandlerFunc.ServeHTTP(0xc00051c680, 0x7fd39c5596c8, 0xc00016e300, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/decred/dcrstakepool/system.Logger.func1.1(0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /home/joe/git/dcrstakepool/system/middleware.go:134 +0x476
net/http.HandlerFunc.ServeHTTP(0xc000238c60, 0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web/middleware.RequestID.func1(0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware/request_id.go:68 +0x1d7
net/http.HandlerFunc.ServeHTTP(0xc00051c6a0, 0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web.(*cStack).ServeHTTPC(...)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:50
github.com/zenazn/goji/web.(*Mux).ServeHTTPC(0xc0004962a0, 0xc000238f30, 0x0, 0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/mux.go:73 +0x88
github.com/zenazn/goji/web.(*router).route(0xc000496d58, 0xc000238a80, 0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/router.go:114 +0x5b0
github.com/zenazn/goji/web.(*mStack).newStack.func1(0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:88 +0x56
net/http.HandlerFunc.ServeHTTP(0xc00051c080, 0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2007 +0x44
github.com/zenazn/goji/web.(*cStack).ServeHTTP(...)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/middleware.go:46
github.com/zenazn/goji/web.(*Mux).ServeHTTP(0xc000496d20, 0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /home/joe/go/pkg/mod/github.com/zenazn/[email protected]/web/mux.go:65 +0x7d
net/http.serverHandler.ServeHTTP(0xc0004a0620, 0xe7cbe0, 0xc0004a0700, 0xc00010a300)
        /usr/lib/go/src/net/http/server.go:2802 +0xa4
net/http.(*conn).serve(0xc000507040, 0xe7ec20, 0xc000079d40)
        /usr/lib/go/src/net/http/server.go:1890 +0x875
created by net/http.(*Server).Serve
        /usr/lib/go/src/net/http/server.go:2927 +0x38e

JoeGruffins · 2020-03-17T06:14:25Z

I created a consumer for this api here: decred/tinydecred#121

system/middleware.go

JoeGruffins

Looks good to me!

Works great. Is versatile and clients can choose to use it or not. I can't find any holes in the model.

If you could just up the stakepoold api version major to 10, I will approve.

itswisdomagain · 2020-03-20T20:04:58Z

Looks good to me!

Thanks for the review, mate.

If you could just up the stakepoold api version major to 10, I will approve.

Thinking a minor version bump will suffice? Since there are no backwards-incompatible changes introduced, just new functionality that is backward-compatible.

JoeGruffins · 2020-03-21T01:56:41Z

Thinking a minor version bump will suffice? Since there are no backwards-incompatible changes introduced, just new functionality that is backward-compatible.

Yeah? well ok. It does add a function to stakepoold that will cause dcrstakepoold to fail if it can't get a response, but if it's not something anyone is using yet, I suppose minor is fine. The more times I read the semver suggested usage the more I doubt myself.

Minor is fine with me.

itswisdomagain · 2020-03-21T11:32:51Z

It does add a function to stakepoold that will cause dcrstakepoold to fail if it can't get a response

Yeah... will also bump the dcrstakepool requiredStakepooldAPI version to match, so a user is unable to run dcrstakepool with an incompatible stakepoold version.

itswisdomagain · 2020-05-10T00:25:30Z

Closed in favour of #625

itswisdomagain force-pushed the upstream-ticket-auth branch from 80af5c3 to d3f119e Compare September 4, 2019 17:44

itswisdomagain mentioned this pull request Sep 4, 2019

add /purchaseticket API endpoint for accountless ticket purchase #515

Closed

dajohi added this to the v1.3.0 milestone Sep 13, 2019

itswisdomagain force-pushed the upstream-ticket-auth branch from 38e6e8e to 145d222 Compare September 19, 2019 06:55

JoeGruffins requested changes Sep 20, 2019

View reviewed changes

JoeGruffins reviewed Sep 20, 2019

View reviewed changes

backend/stakepoold/rpc/api.proto Outdated Show resolved Hide resolved

itswisdomagain force-pushed the upstream-ticket-auth branch from 5cf2dba to ff84b02 Compare September 26, 2019 22:11

dajohi requested changes Oct 9, 2019

View reviewed changes

itswisdomagain force-pushed the upstream-ticket-auth branch 4 times, most recently from a166eef to 0975667 Compare November 7, 2019 13:11

itswisdomagain mentioned this pull request Nov 14, 2019

Transition from account-based to ticket-based system #568

Closed

JoeGruffins mentioned this pull request Nov 18, 2019

Add accountless ticket verification scheme decred/tinydecred#17

Open

itswisdomagain force-pushed the upstream-ticket-auth branch 2 times, most recently from f07943e to 8672b4f Compare March 11, 2020 20:05

JoeGruffins reviewed Mar 12, 2020

View reviewed changes

dajohi modified the milestones: v1.3.0, v1.6.0 Mar 12, 2020

JoeGruffins mentioned this pull request Mar 18, 2020

[WIP] stakepoold: add VerifyMessage rpc #615

Closed

JoeGruffins reviewed Mar 18, 2020

View reviewed changes

system/middleware.go Outdated Show resolved Hide resolved

itswisdomagain added 7 commits March 19, 2020 08:40

setup ticket ownership validation/authentication middleware

4c6992b

implement v3 auth middleware

ae81af2

add v3 api support

cf0f138

use ticket validity age from config

3769865

track timestamp usage in ticket auth routine

375f20e

cache ticket auth signature instead of timestamp

f4c9c26

return more descriptive error messages on ticket auth failure

136e908

itswisdomagain added 17 commits March 19, 2020 08:41

support new ticketauth api auth scheme on /v1 and /v2 api endpoints

3fc6f04

allow timestamps value 5mins into future

2940a31

allow access to some /api routes without valid auth header

14fce14

remove maxticketchallengeage config option, use constant value

9b529a6

return proper error for invalid ticket signature cases

1970e45

ctx.WalletConnection -> ctx.WalletConnection.RPCClient()

4b0145c

Joe's review

8a7cf8f

rename OwnerRewardAddress to UserRewardAddress

5ccd341

gitignore vendor

4ac97e5

use dcrutil/v2, wallet/v3 and txscript/v2

a892cf7

bump dcrwallet/wallet mod version

64558ac

go fmt

b8db13e

post rebase fixes and cleanup

a9cf03c

refactor application.Init

2f0c03d

unexport some types and properties, fix panics

10e8b82

validate tx hash supplied for ticket ownership validation

dcd59fc

fix panic on api request without acceptable auth header

be5e840

itswisdomagain force-pushed the upstream-ticket-auth branch from 1b6bd32 to ae0e4ce Compare March 19, 2020 07:48

use passed context for GetTicketInfo stakepoold rpc call

f5bbac5

itswisdomagain force-pushed the upstream-ticket-auth branch from ae0e4ce to f5bbac5 Compare March 19, 2020 07:54

JoeGruffins reviewed Mar 20, 2020

View reviewed changes

bump stakepoold minor version

8384d53

JoeGruffins approved these changes Mar 21, 2020

View reviewed changes

itswisdomagain closed this May 10, 2020

itswisdomagain mentioned this pull request May 15, 2020

[WIP] APIv3 #625

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add per-ticket API authentication scheme #514

add per-ticket API authentication scheme #514

itswisdomagain commented Sep 4, 2019 •

edited

Loading

JoeGruffins left a comment •

edited

Loading

JoeGruffins Sep 20, 2019

itswisdomagain Sep 21, 2019

dajohi Oct 9, 2019

JoeGruffins Sep 20, 2019

itswisdomagain Sep 21, 2019

itswisdomagain Sep 21, 2019 •

edited

Loading

dajohi left a comment

dajohi Oct 9, 2019

dajohi Oct 9, 2019

dajohi Oct 9, 2019

JoeGruffins left a comment

JoeGruffins commented Mar 15, 2020 •

edited

Loading

JoeGruffins commented Mar 17, 2020

JoeGruffins left a comment

itswisdomagain commented Mar 20, 2020

JoeGruffins commented Mar 21, 2020

itswisdomagain commented Mar 21, 2020

itswisdomagain commented May 10, 2020 •

edited

Loading

add per-ticket API authentication scheme #514

add per-ticket API authentication scheme #514

Conversation

itswisdomagain commented Sep 4, 2019 • edited Loading

User's ticket reward address

Recovering redeem scripts for restored wallets

JoeGruffins left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

itswisdomagain Sep 21, 2019 • edited Loading

Choose a reason for hiding this comment

dajohi left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JoeGruffins left a comment

Choose a reason for hiding this comment

JoeGruffins commented Mar 15, 2020 • edited Loading

JoeGruffins commented Mar 17, 2020

JoeGruffins left a comment

Choose a reason for hiding this comment

itswisdomagain commented Mar 20, 2020

JoeGruffins commented Mar 21, 2020

itswisdomagain commented Mar 21, 2020

itswisdomagain commented May 10, 2020 • edited Loading

itswisdomagain commented Sep 4, 2019 •

edited

Loading

JoeGruffins left a comment •

edited

Loading

itswisdomagain Sep 21, 2019 •

edited

Loading

JoeGruffins commented Mar 15, 2020 •

edited

Loading

itswisdomagain commented May 10, 2020 •

edited

Loading