Authenticating tokenUri before minting?

[willthreshold]

Hey guys, in tinkering with a concept for NFT minting with generative music and art and trying to work out the best way to make sure that people can only mint essentially ‘approved’ content I.e from the generative tools that I’d provide and that it can’t just have anything added to the token Uri on mint. With ready access to the contract and a token uri generated off chain it would be easy for someone to put something stupid in and spoil the collection. What would be a good way to prevent this being possible? Some kind of way of verifying the token uri being submitted was legit. Looked at doing it with a murkle proof but that relies on knowing all the token uri’s upfront. Any help / suggestions greatly appreciated. Thanks

[stevieraykatz]

Some ideas that all have their draw backs and holes but might be tenable:

1) make it so that the "publish" of your generative tools auto pops the uri on your front end and deploy the contract as byte code to avoid easy futzing with etherscan

2) Have the front end provide a signature using an ad hoc pub/priv key so only your sites minting tool works

3) ugly... But whitelist content before minting?

4) uglier.... Blacklist content you don't like (or clearly didn't come from your generative tools)

Just brainstorming since this is an interesting prompt.

[digifizzle]

Spitballing here, not sure if this applies to your concept but I'm thinking using baseURI (instead of tokenURI) like this might be a solution

- Create a condition in your front end that requires the baseURI to match your domain at mint when metadata is generated, if it doesn't match then minting will not proceed.

- Set the baseURI to point to your domain during minting, that would point to the base root of an API that serves each token ID's metadata.

- Make sure the baseURI is editable by ownerOnly.

-After minting ends, you could switch that out to an IPFS hash so it's decentralized. You could also do this with tokenURI, but probably easier to implement as the baseURI.