WIP ir/container: Support Neo N3 auth scheme

Signed-off-by: Leonard Lyubich <leonard@morphbits.io>

pkg/innerring/processors/container/common.go

@@ -4,7 +4,11 @@ import (
 	"crypto/ecdsa"
 	"errors"
 	"fmt"
+	"slices"
 
+	"github.com/nspcc-dev/neo-go/pkg/io"
+	"github.com/nspcc-dev/neo-go/pkg/rpcclient/unwrap"
+	"github.com/nspcc-dev/neo-go/pkg/vm/emit"
 	"github.com/nspcc-dev/neofs-node/pkg/morph/client/neofsid"
 	cid "github.com/nspcc-dev/neofs-sdk-go/container/id"
 	neofscrypto "github.com/nspcc-dev/neofs-sdk-go/crypto"
@@ -88,6 +92,42 @@ func (cp *Processor) verifySignature(v signatureVerificationData) error {
 			if user.NewFromECDSAPublicKey(ecdsa.PublicKey(signerPub)) != v.ownerContainer {
 				return errors.New("session token is not signed by the container owner")
 			}
+		case 3: // TODO: use const after SDK upgrade
+			// call contract func Verify(height uint32, dataHash interop.Hash256, sig []byte, other ...any) bool
+			height, err := cp.cnrClient.Morph().BlockCount()
+			if err != nil {
+				return fmt.Errorf("get current FS chain height: %w", err)
+			}
+
+			// sys:
+			w := io.NewBufBinWriter()
+			emit.Int(w.BinWriter, int64(height))
+			emit.Bytes(w.BinWriter, tok.SignedData())
+
+			// user:
+			//
+			// invocation script:
+			// emit.Bytes(w.BinWriter, sig)
+			//
+			// verification script
+			// emit.Any(w, arg1)
+			// ...
+			// emit.Any(w, argN)
+			// emit.Opcodes(w, 3+N)
+			// emit.AppCallNoArgs(w, contract, method, callflag.ReadStates)
+
+			// FIXME: user scripts must be verified:
+			//  - they must have expected format
+			//  - verification one must call allowed contract and its method
+			//  Now any dummy contract always returning 'true' allows to bypass authorization
+			script := slices.Concat(w.Bytes(), v.signature, v.binPublicKey)
+			ok, err := unwrap.Bool(cp.cnrClient.Morph().InvokeScript(script, nil)) // TODO: need signers?
+			if err != nil {
+				return fmt.Errorf("run contract auth script: %w", err)
+			}
+			if !ok {
+				return errors.New("contract auth script returned false")
+			}
 		}
 
 		if keyProvided && !tok.AssertAuthKey(&key) {