@abaxxtech/id 0.0.0

package/src/did/did.ts

@@ -0,0 +1,39 @@
+/**
+ * DID related operations.
+ */
+import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
+
+export class Did {
+  /**
+   * Gets the method specific ID segment of a DID. ie. did:<method-name>:<method-specific-id>
+   */
+  public static getMethodSpecificId(did: string): string {
+    const secondColonIndex = did.indexOf(':', 4); // start search for : from the method portion
+    const methodSpecificId = did.substring(secondColonIndex + 1);
+    return methodSpecificId;
+  }
+
+  /**
+   * @param did - the DID to validate
+   */
+  public static validate(did: unknown): void {
+    if (typeof did !== 'string') {
+      throw new DwnError(DwnErrorCode.DidNotString, `DID is not string: ${did}`);
+    }
+
+    // eslint-disable-next-line
+    const didRegex= /^did:([a-z0-9]+):((?:(?:[a-zA-Z0-9._-]|(?:%[0-9a-fA-F]{2}))*:)*((?:[a-zA-Z0-9._-]|(?:%[0-9a-fA-F]{2}))+))((;[a-zA-Z0-9_.:%-]+=[a-zA-Z0-9_.:%-]*)*)(\/[^#?]*)?([?][^#]*)?(#.*)?$/;
+    if (!didRegex.test(did)) {
+      throw new DwnError(DwnErrorCode.DidNotValid, `DID is not a valid DID: ${did}`);
+    }
+  }
+
+  /**
+   * Gets the method name from a DID. ie. did:<method-name>:<method-specific-id>
+   */
+  public static getMethodName(did: string): string {
+    const secondColonIndex = did.indexOf(':', 4); // start search for : from the method portion
+    const methodName = did.substring(4, secondColonIndex);
+    return methodName;
+  }
+}

package/src/dwn.ts

@@ -0,0 +1,213 @@
+import type { DataStore } from './types/data-store.js';
+import type { EventLog } from './types/event-log.js';
+import type { GenericMessage } from './types/message-types.js';
+import type { MessageStore } from './types/message-store.js';
+import type { MethodHandler } from './types/method-handler.js';
+import type { Readable } from 'readable-stream';
+import type { RecordsWriteHandlerOptions } from './handlers/records-write.js';
+import type { TenantGate } from './core/tenant-gate.js';
+import type { EventsGetMessage, EventsGetReply } from './types/event-types.js';
+import type { GenericMessageReply, UnionMessageReply } from './core/message-reply.js';
+import type { MessagesGetMessage, MessagesGetReply } from './types/messages-types.js';
+import type { PermissionsGrantMessage, PermissionsRequestMessage, PermissionsRevokeMessage } from './types/permissions-types.js';
+import type { ProtocolsConfigureMessage, ProtocolsQueryMessage, ProtocolsQueryReply } from './types/protocols-types.js';
+
+import type { RecordsDeleteMessage, RecordsQueryMessage, RecordsQueryReply, RecordsReadMessage, RecordsReadReply, RecordsWriteMessage } from './types/records-types.js';
+
+import { AllowAllTenantGate } from './core/tenant-gate.js';
+import { DidResolver } from './did/did-resolver.js';
+import { EventsGetHandler } from './handlers/events-get.js';
+import { Message } from './core/message.js';
+import { messageReplyFromError } from './core/message-reply.js';
+import { MessagesGetHandler } from './handlers/messages-get.js';
+import { PermissionsGrantHandler } from './handlers/permissions-grant.js';
+import { PermissionsRequestHandler } from './handlers/permissions-request.js';
+import { PermissionsRevokeHandler } from './handlers/permissions-revoke.js';
+import { ProtocolsConfigureHandler } from './handlers/protocols-configure.js';
+import { ProtocolsQueryHandler } from './handlers/protocols-query.js';
+import { RecordsDeleteHandler } from './handlers/records-delete.js';
+import { RecordsQueryHandler } from './handlers/records-query.js';
+import { RecordsReadHandler } from './handlers/records-read.js';
+import { RecordsWriteHandler } from './handlers/records-write.js';
+import { DwnInterfaceName, DwnMethodName } from './enums/dwn-interface-method.js';
+
+export class Dwn {
+  private methodHandlers: { [key:string]: MethodHandler };
+  private didResolver: DidResolver;
+  private messageStore: MessageStore;
+  private dataStore: DataStore;
+  private eventLog: EventLog;
+  private tenantGate: TenantGate;
+
+  private constructor(config: DwnConfig) {
+    this.didResolver = config.didResolver!;
+    this.tenantGate = config.tenantGate!;
+    this.messageStore = config.messageStore;
+    this.dataStore = config.dataStore;
+    this.eventLog = config.eventLog;
+
+    this.methodHandlers = {
+      [DwnInterfaceName.Events + DwnMethodName.Get]        : new EventsGetHandler(this.didResolver, this.eventLog),
+      [DwnInterfaceName.Messages + DwnMethodName.Get]      : new MessagesGetHandler(this.didResolver, this.messageStore, this.dataStore),
+      [DwnInterfaceName.Permissions + DwnMethodName.Grant] : new PermissionsGrantHandler(
+        this.didResolver, this.messageStore, this.eventLog),
+      [DwnInterfaceName.Permissions + DwnMethodName.Request]: new PermissionsRequestHandler(
+        this.didResolver, this.messageStore, this.eventLog),
+      [DwnInterfaceName.Permissions + DwnMethodName.Revoke]: new PermissionsRevokeHandler(
+        this.didResolver, this.messageStore, this.eventLog),
+      [DwnInterfaceName.Protocols + DwnMethodName.Configure]: new ProtocolsConfigureHandler(
+        this.didResolver, this.messageStore, this.dataStore, this.eventLog),
+      [DwnInterfaceName.Protocols + DwnMethodName.Query] : new ProtocolsQueryHandler(this.didResolver, this.messageStore, this.dataStore),
+      [DwnInterfaceName.Records + DwnMethodName.Delete]  : new RecordsDeleteHandler(
+        this.didResolver, this.messageStore, this.dataStore, this.eventLog),
+      [DwnInterfaceName.Records + DwnMethodName.Query] : new RecordsQueryHandler(this.didResolver, this.messageStore, this.dataStore),
+      [DwnInterfaceName.Records + DwnMethodName.Read]  : new RecordsReadHandler(this.didResolver, this.messageStore, this.dataStore),
+      [DwnInterfaceName.Records + DwnMethodName.Write] : new RecordsWriteHandler(this.didResolver, this.messageStore, this.dataStore, this.eventLog),
+    };
+  }
+
+  /**
+   * Creates an instance of the DWN.
+   */
+  public static async create(config: DwnConfig): Promise<Dwn> {
+    config.didResolver ??= new DidResolver();
+    config.tenantGate ??= new AllowAllTenantGate();
+
+    const dwn = new Dwn(config);
+    await dwn.open();
+
+    return dwn;
+  }
+
+  private async open(): Promise<void> {
+    await this.messageStore.open();
+    await this.dataStore.open();
+    await this.eventLog.open();
+  }
+
+  public async close(): Promise<void> {
+    this.messageStore.close();
+    this.dataStore.close();
+    this.eventLog.close();
+  }
+
+  /**
+   * Processes the given DWN message and returns with a reply.
+   * @param tenant The tenant DID to route the given message to.
+   */
+  public async processMessage(tenant: string, rawMessage: EventsGetMessage): Promise<EventsGetReply>;
+  public async processMessage(tenant: string, rawMessage: MessagesGetMessage): Promise<MessagesGetReply>;
+  public async processMessage(tenant: string, rawMessage: ProtocolsConfigureMessage): Promise<GenericMessageReply>;
+  public async processMessage(tenant: string, rawMessage: ProtocolsQueryMessage): Promise<ProtocolsQueryReply>;
+  public async processMessage(tenant: string, rawMessage: PermissionsRequestMessage): Promise<GenericMessageReply>;
+  public async processMessage(tenant: string, rawMessage: PermissionsGrantMessage): Promise<GenericMessageReply>;
+  public async processMessage(tenant: string, rawMessage: PermissionsRevokeMessage): Promise<GenericMessageReply>;
+  public async processMessage(tenant: string, rawMessage: RecordsDeleteMessage): Promise<GenericMessageReply>;
+  public async processMessage(tenant: string, rawMessage: RecordsQueryMessage): Promise<RecordsQueryReply>;
+  public async processMessage(tenant: string, rawMessage: RecordsReadMessage): Promise<RecordsReadReply>;
+  public async processMessage(tenant: string, rawMessage: RecordsWriteMessage, dataStream?: Readable): Promise<GenericMessageReply>;
+  public async processMessage(tenant: string, rawMessage: unknown, dataStream?: Readable): Promise<UnionMessageReply>;
+  public async processMessage(tenant: string, rawMessage: GenericMessage, dataStream?: Readable): Promise<UnionMessageReply> {
+    const errorMessageReply = await this.validateTenant(tenant) ?? await this.validateMessageIntegrity(rawMessage);
+    if (errorMessageReply !== undefined) {
+      return errorMessageReply;
+    }
+
+    const handlerKey = rawMessage.descriptor.interface + rawMessage.descriptor.method;
+    const methodHandlerReply = await this.methodHandlers[handlerKey].handle({
+      tenant,
+      message: rawMessage as GenericMessage,
+      dataStream
+    });
+
+    return methodHandlerReply;
+  }
+
+  /**
+   * Privileged method for writing a pruned initial `RecordsWrite` to a DWN without needing to supply associated data.
+   */
+  public async synchronizePrunedInitialRecordsWrite(tenant: string, message: RecordsWriteMessage): Promise<GenericMessageReply> {
+    const errorMessageReply =
+      await this.validateTenant(tenant) ??
+      await this.validateMessageIntegrity(message, DwnInterfaceName.Records, DwnMethodName.Write);
+    if (errorMessageReply !== undefined) {
+      return errorMessageReply;
+    }
+
+    const options: RecordsWriteHandlerOptions = {
+      skipDataStorage: true,
+    };
+
+    const handler = new RecordsWriteHandler(this.didResolver, this.messageStore, this.dataStore, this.eventLog);
+    const methodHandlerReply = await handler.handle({ tenant, message, options });
+    return methodHandlerReply;
+  }
+
+  /**
+   * Checks tenant gate to see if tenant is allowed.
+   * @param tenant The tenant DID to route the given message to.
+   * @returns GenericMessageReply if the message has an integrity error, otherwise undefined.
+   */
+  public async validateTenant(tenant: string): Promise<GenericMessageReply | undefined> {
+    const isTenant = await this.tenantGate.isTenant(tenant);
+    if (!isTenant) {
+      return {
+        status: { code: 401, detail: `${tenant} is not a tenant` }
+      };
+    }
+  }
+
+  /**
+   * Validates structure of DWN message
+   * @param tenant The tenant DID to route the given message to.
+   * @param dwnMessageInterface The interface of DWN message.
+   * @param dwnMessageMethod The interface of DWN message.
+
+   * @returns GenericMessageReply if the message has an integrity error, otherwise undefined.
+   */
+  public async validateMessageIntegrity(
+    rawMessage: any,
+    expectedInterface?: DwnInterfaceName,
+    expectedMethod?: DwnMethodName,
+  ): Promise<GenericMessageReply | undefined> {
+    // Verify interface and method
+    const dwnInterface = rawMessage?.descriptor?.interface;
+    const dwnMethod = rawMessage?.descriptor?.method;
+    if (dwnInterface === undefined || dwnMethod === undefined) {
+      return {
+        status: { code: 400, detail: `Both interface and method must be present, interface: ${dwnInterface}, method: ${dwnMethod}` }
+      };
+    }
+
+    if (expectedInterface !== undefined && expectedInterface !== dwnInterface) {
+      return {
+        status: { code: 400, detail: `Expected interface ${expectedInterface}, received ${dwnInterface}` }
+      };
+    }
+    if (expectedMethod !== undefined && expectedMethod !== dwnMethod) {
+      return {
+        status: { code: 400, detail: `Expected method ${expectedInterface}${expectedMethod}, received ${dwnInterface}${dwnMethod}` }
+      };
+    }
+
+    // validate message structure
+    try {
+      // consider to push this down to individual handlers
+      Message.validateJsonSchema(rawMessage);
+    } catch (error) {
+      return messageReplyFromError(error, 400);
+    }
+  }
+};
+
+/**
+ * DWN configuration.
+ */
+export type DwnConfig = {
+  didResolver?: DidResolver,
+  tenantGate?: TenantGate;
+
+  messageStore: MessageStore;
+  dataStore: DataStore;
+  eventLog: EventLog
+};

package/src/enums/dwn-interface-method.ts

@@ -0,0 +1,20 @@
+export enum DwnInterfaceName {
+  Events = 'Events',
+  Messages = 'Messages',
+  Permissions = 'Permissions',
+  Protocols = 'Protocols',
+  Records = 'Records'
+}
+
+export enum DwnMethodName {
+  Configure = 'Configure',
+  Create = 'Create',
+  Get = 'Get',
+  Grant = 'Grant',
+  Query = 'Query',
+  Read = 'Read',
+  Request = 'Request',
+  Revoke = 'Revoke',
+  Write = 'Write',
+  Delete = 'Delete'
+}

package/src/event-log/event-log-level.ts

@@ -0,0 +1,116 @@
+import type { LevelWrapperBatchOperation } from '../store/level-wrapper.js';
+import type { ULIDFactory } from 'ulidx';
+import type { Event, EventLog, GetEventsOptions } from '../types/event-log.js';
+
+import { monotonicFactory } from 'ulidx';
+import { createLevelDatabase, LevelWrapper } from '../store/level-wrapper.js';
+
+type EventLogLevelConfig = {
+ /**
+   * must be a directory path (relative or absolute) where
+   *  LevelDB will store its files, or in browsers, the name of the
+   * {@link https://developer.mozilla.org/en-US/docs/Web/API/IDBDatabase IDBDatabase} to be opened.
+  */
+  location?: string,
+  createLevelDatabase?: typeof createLevelDatabase,
+};
+
+const WATERMARKS_SUBLEVEL_NAME = 'watermarks';
+const CIDS_SUBLEVEL_NAME = 'cids';
+
+export class EventLogLevel implements EventLog {
+  config: EventLogLevelConfig;
+  db: LevelWrapper<string>;
+  ulidFactory: ULIDFactory;
+
+  constructor(config?: EventLogLevelConfig) {
+    this.config = {
+      location: 'data/EVENTLOG',
+      createLevelDatabase,
+      ...config,
+    };
+
+    this.db = new LevelWrapper<string>({
+      location            : this.config.location!,
+      createLevelDatabase : this.config.createLevelDatabase,
+      valueEncoding       : 'utf8',
+    });
+    this.ulidFactory = monotonicFactory();
+  }
+
+  async open(): Promise<void> {
+    return this.db.open();
+  }
+
+  async close(): Promise<void> {
+    return this.db.close();
+  }
+
+  async clear(): Promise<void> {
+    return this.db.clear();
+  }
+
+  async append(tenant: string, messageCid: string): Promise<string> {
+    const tenantEventLog = await this.db.partition(tenant);
+    const watermarkLog = await tenantEventLog.partition(WATERMARKS_SUBLEVEL_NAME);
+    const cidLog = await tenantEventLog.partition(CIDS_SUBLEVEL_NAME);
+
+    const watermark = this.ulidFactory();
+
+    await watermarkLog.put(watermark, messageCid);
+    await cidLog.put(messageCid, watermark);
+
+    return watermark;
+  }
+
+  async getEvents(tenant: string, options?: GetEventsOptions): Promise<Event[]> {
+    const tenantEventLog = await this.db.partition(tenant);
+    const watermarkLog = await tenantEventLog.partition(WATERMARKS_SUBLEVEL_NAME);
+    const events: Array<Event> = [];
+
+    for await (const [key, value] of watermarkLog.iterator(options)) {
+      const event = { watermark: key, messageCid: value };
+      events.push(event);
+    }
+
+    return events;
+  }
+
+  async deleteEventsByCid(tenant: string, cids: Array<string>): Promise<number> {
+    if (cids.length === 0) {
+      return 0;
+    }
+
+    const tenantEventLog = await this.db.partition(tenant);
+    const cidLog = await tenantEventLog.partition(CIDS_SUBLEVEL_NAME);
+
+    let ops: LevelWrapperBatchOperation<string>[] = [];
+    const promises: Array<Promise<string | undefined>> = [];
+
+    for (const cid of cids) {
+      ops.push({ type: 'del', key: cid });
+
+      const promise = cidLog.get(cid).catch(e => e);
+      promises.push(promise);
+    }
+
+    await cidLog.batch(ops);
+
+    ops = [];
+    let numEventsDeleted = 0;
+
+    const watermarks: Array<string | undefined> = await Promise.all(promises);
+    for (const watermark of watermarks) {
+      if (watermark) {
+        ops.push({ type: 'del', key: watermark });
+        numEventsDeleted += 1;
+      }
+    }
+
+    const watermarkLog = await tenantEventLog.partition('watermarks');
+    await watermarkLog.batch(ops);
+
+    return numEventsDeleted;
+  }
+
+}

package/src/handlers/events-get.ts

@@ -0,0 +1,46 @@
+import type { DidResolver } from '../did/did-resolver.js';
+import type { EventLog } from '../types/event-log.js';
+import type { GetEventsOptions } from '../types/event-log.js';
+import type { MethodHandler } from '../types/method-handler.js';
+import type { EventsGetMessage, EventsGetReply } from '../types/event-types.js';
+
+import { EventsGet } from '../interfaces/events-get.js';
+import { messageReplyFromError } from '../core/message-reply.js';
+import { authenticate, authorize } from '../core/auth.js';
+
+type HandleArgs = {tenant: string, message: EventsGetMessage};
+
+export class EventsGetHandler implements MethodHandler {
+  constructor(private didResolver: DidResolver, private eventLog: EventLog) {}
+
+  public async handle({ tenant, message }: HandleArgs): Promise<EventsGetReply> {
+    let eventsGet: EventsGet;
+
+    try {
+      eventsGet = await EventsGet.parse(message);
+    } catch (e) {
+      return messageReplyFromError(e, 400);
+    }
+
+    try {
+      await authenticate(message.authorization, this.didResolver);
+      await authorize(tenant, eventsGet);
+    } catch (e) {
+      return messageReplyFromError(e, 401);
+    }
+
+    // if watermark was provided in message, get all events _after_ the watermark.
+    // Otherwise, get all events.
+    let options: GetEventsOptions | undefined;
+    if (message.descriptor.watermark) {
+      options = { gt: message.descriptor.watermark };
+    }
+
+    const events = await this.eventLog.getEvents(tenant, options);
+
+    return {
+      status: { code: 200, detail: 'OK' },
+      events
+    };
+  }
+}

package/src/handlers/messages-get.ts

@@ -0,0 +1,80 @@
+import type { DataStore } from '../types/data-store.js';
+import type { DidResolver } from '../did/did-resolver.js';
+import type { MessageStore } from '../types/message-store.js';
+import type { MethodHandler } from '../types/method-handler.js';
+import type { RecordsWriteMessageWithOptionalEncodedData } from '../types/records-types.js';
+import type { MessagesGetMessage, MessagesGetReply, MessagesGetReplyEntry } from '../types/messages-types.js';
+
+import { messageReplyFromError } from '../core/message-reply.js';
+import { MessagesGet } from '../interfaces/messages-get.js';
+import { authenticate, authorize } from '../core/auth.js';
+import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
+
+type HandleArgs = { tenant: string, message: MessagesGetMessage };
+
+export class MessagesGetHandler implements MethodHandler {
+  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private dataStore: DataStore) {}
+
+  public async handle({ tenant, message }: HandleArgs): Promise<MessagesGetReply> {
+    let messagesGet: MessagesGet;
+
+    try {
+      messagesGet = await MessagesGet.parse(message);
+    } catch (e) {
+      return messageReplyFromError(e, 400);
+    }
+
+    try {
+      await authenticate(message.authorization, this.didResolver);
+      await authorize(tenant, messagesGet);
+    } catch (e) {
+      return messageReplyFromError(e, 401);
+    }
+
+    const promises: Promise<MessagesGetReplyEntry>[] = [];
+    const messageCids = new Set(message.descriptor.messageCids);
+
+    for (const messageCid of messageCids) {
+      const promise = this.messageStore.get(tenant, messageCid)
+        .then(message => {
+          return { messageCid, message };
+        })
+        .catch(_ => {
+          return { messageCid, message: undefined, error: `Failed to get message ${messageCid}` };
+        });
+
+      promises.push(promise);
+    }
+
+    const messages = await Promise.all(promises);
+
+    // for every message, include associated data as `encodedData` IF:
+    //  * its a RecordsWrite
+    //  * the data size is equal or smaller than the size threshold
+    for (const entry of messages) {
+      const { message } = entry;
+
+      if (!message) {
+        continue;
+      }
+
+      const { interface: messageInterface, method } = message.descriptor;
+      if (messageInterface !== DwnInterfaceName.Records || method !== DwnMethodName.Write) {
+        continue;
+      }
+
+      // RecordsWrite specific handling, if MessageStore has embedded `encodedData` return it with the entry.
+      // we store `encodedData` along with the message if the data is below a certain threshold.
+      const recordsWrite = message as RecordsWriteMessageWithOptionalEncodedData;
+      if (recordsWrite.encodedData !== undefined) {
+        entry.encodedData = recordsWrite.encodedData;
+        delete recordsWrite.encodedData;
+      }
+    }
+
+    return {
+      status: { code: 200, detail: 'OK' },
+      messages
+    };
+  }
+}

package/src/handlers/permissions-grant.ts

@@ -0,0 +1,52 @@
+import type { DidResolver } from '../did/did-resolver.js';
+import type { EventLog } from '../types//event-log.js';
+import type { GenericMessageReply } from '../core/message-reply.js';
+import type { MessageStore } from '../types//message-store.js';
+import type { MethodHandler } from '../types/method-handler.js';
+import type { PermissionsGrantMessage } from '../types/permissions-types.js';
+
+import { authenticate } from '../core/auth.js';
+import { Message } from '../core/message.js';
+import { messageReplyFromError } from '../core/message-reply.js';
+import { PermissionsGrant } from '../interfaces/permissions-grant.js';
+
+export class PermissionsGrantHandler implements MethodHandler {
+  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private eventLog: EventLog) { }
+
+  public async handle({
+    tenant,
+    message
+  }: { tenant: string, message: PermissionsGrantMessage }): Promise<GenericMessageReply> {
+    let permissionsGrant: PermissionsGrant;
+    try {
+      permissionsGrant = await PermissionsGrant.parse(message);
+    } catch (e) {
+      return messageReplyFromError(e, 400);
+    }
+
+    try {
+      await authenticate(message.authorization, this.didResolver);
+      await permissionsGrant.authorize();
+    } catch (e) {
+      return messageReplyFromError(e, 401);
+    }
+
+    const { scope, conditions, ...propertiesToIndex } = message.descriptor;
+    const indexes: { [key: string]: string | boolean } = {
+      author: permissionsGrant.author!,
+      ...propertiesToIndex,
+    };
+
+    // If we have not seen this message before, store it
+    const messageCid = await Message.getCid(message);
+    const existingMessage = await this.messageStore.get(tenant, messageCid);
+    if (existingMessage === undefined) {
+      await this.messageStore.put(tenant, message, indexes);
+      await this.eventLog.append(tenant, messageCid);
+    }
+
+    return {
+      status: { code: 202, detail: 'Accepted' }
+    };
+  }
+}

package/src/handlers/permissions-request.ts

@@ -0,0 +1,54 @@
+import type { DidResolver } from '../did/did-resolver.js';
+import type { EventLog } from '../types//event-log.js';
+import type { GenericMessageReply } from '../core/message-reply.js';
+import type { MessageStore } from '../types//message-store.js';
+import type { MethodHandler } from '../types/method-handler.js';
+import type { PermissionsRequestMessage } from '../types/permissions-types.js';
+
+import { authenticate } from '../core/auth.js';
+import { Message } from '../core/message.js';
+import { messageReplyFromError } from '../core/message-reply.js';
+import { PermissionsRequest } from '../interfaces/permissions-request.js';
+
+export class PermissionsRequestHandler implements MethodHandler {
+
+  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private eventLog: EventLog) { }
+
+  public async handle({
+    tenant,
+    message
+  }: { tenant: string, message: PermissionsRequestMessage }): Promise<GenericMessageReply> {
+    let permissionsRequest: PermissionsRequest;
+    try {
+      permissionsRequest = await PermissionsRequest.parse(message);
+    } catch (e) {
+      return messageReplyFromError(e, 400);
+    }
+
+    // authentication
+    try {
+      await authenticate(message.authorization, this.didResolver);
+    } catch (e) {
+      return messageReplyFromError(e, 401);
+    }
+
+    // store message
+    const { scope, conditions, ...propertiesToIndex } = message.descriptor;
+    const indexes: { [key: string]: string } = {
+      ...propertiesToIndex,
+      author: permissionsRequest.author!,
+    };
+
+    // If we have not seen this message before, store it
+    const messageCid = await Message.getCid(message);
+    const existingMessage = await this.messageStore.get(tenant, messageCid);
+    if (existingMessage === undefined) {
+      await this.messageStore.put(tenant, message, indexes);
+      await this.eventLog.append(tenant, messageCid);
+    }
+
+    return {
+      status: { code: 202, detail: 'Accepted' }
+    };
+  }
+}