@abaxxtech/id 0.0.0

package/dist/esm/src/core/message.js

@@ -0,0 +1,200 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Cid } from '../utils/cid.js';
+import { Encoder } from '../utils/encoder.js';
+import { GeneralJwsBuilder } from '../jose/jws/general/builder.js';
+import { Jws } from '../utils/jws.js';
+import { lexicographicalCompare } from '../utils/string.js';
+import { removeUndefinedProperties } from '../utils/object.js';
+import { validateJsonSchema } from '../schema-validator.js';
+import { DwnError, DwnErrorCode } from './dwn-error.js';
+/**
+ * A class containing utility methods for working with DWN messages.
+ */
+export class Message {
+    /**
+     * Validates the given message against the corresponding JSON schema.
+     * @throws {Error} if fails validation.
+     */
+    static validateJsonSchema(rawMessage) {
+        const dwnInterface = rawMessage.descriptor.interface;
+        const dwnMethod = rawMessage.descriptor.method;
+        const schemaLookupKey = dwnInterface + dwnMethod;
+        // throws an error if message is invalid
+        validateJsonSchema(schemaLookupKey, rawMessage);
+    }
+    ;
+    /**
+     * Gets the DID of the signer of the given message, returns `undefined` if message is not signed.
+     */
+    static getSigner(message) {
+        if (message.authorization === undefined) {
+            return undefined;
+        }
+        const signer = Jws.getSignerDid(message.authorization.signature.signatures[0]);
+        return signer;
+    }
+    /**
+     * Gets the CID of the given message.
+     */
+    static getCid(message) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // NOTE: we wrap the `computeCid()` here in case that
+            // the message will contain properties that should not be part of the CID computation
+            // and we need to strip them out (like `encodedData` that we historically had for a long time),
+            // but we can remove this method entirely if the code becomes stable and it is apparent that the wrapper is not needed
+            // ^--- seems like we might need to keep this around for now.
+            const rawMessage = Object.assign({}, message);
+            if (rawMessage.encodedData) {
+                delete rawMessage.encodedData;
+            }
+            const cid = yield Cid.computeCid(rawMessage);
+            return cid;
+        });
+    }
+    /**
+     * Compares message CID in lexicographical order according to the spec.
+     * @returns 1 if `a` is larger than `b`; -1 if `a` is smaller/older than `b`; 0 otherwise (same message)
+     */
+    static compareCid(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // the < and > operators compare strings in lexicographical order
+            const cidA = yield Message.getCid(a);
+            const cidB = yield Message.getCid(b);
+            return lexicographicalCompare(cidA, cidB);
+        });
+    }
+    /**
+     * Creates the `authorization` property to be included in a DWN message.
+     * @param signer Message signer.
+     * @returns {AuthorizationModel} used as an `authorization` property.
+     */
+    static createAuthorization(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { descriptor, signer, delegatedGrant, permissionsGrantId, protocolRole } = input;
+            let delegatedGrantId;
+            if (delegatedGrant !== undefined) {
+                delegatedGrantId = yield Message.getCid(delegatedGrant);
+            }
+            const signature = yield Message.createSignature(descriptor, signer, { delegatedGrantId, permissionsGrantId, protocolRole });
+            const authorization = {
+                signature
+            };
+            if (delegatedGrant !== undefined) {
+                authorization.authorDelegatedGrant = delegatedGrant;
+            }
+            return authorization;
+        });
+    }
+    /**
+     * Creates a generic signature from the given DWN message descriptor by including `descriptorCid` as the required property in the signature payload.
+     * NOTE: there is an opportunity to consolidate RecordsWrite.createSignerSignature() wth this method
+     */
+    static createSignature(descriptor, signer, additionalPayloadProperties) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const descriptorCid = yield Cid.computeCid(descriptor);
+            const signaturePayload = Object.assign({ descriptorCid }, additionalPayloadProperties);
+            removeUndefinedProperties(signaturePayload);
+            const signaturePayloadBytes = Encoder.objectToBytes(signaturePayload);
+            const builder = yield GeneralJwsBuilder.create(signaturePayloadBytes, [signer]);
+            const signature = builder.getJws();
+            return signature;
+        });
+    }
+    /**
+     * @returns newest message in the array. `undefined` if given array is empty.
+     */
+    static getNewestMessage(messages) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let currentNewestMessage = undefined;
+            for (const message of messages) {
+                if (currentNewestMessage === undefined || (yield Message.isNewer(message, currentNewestMessage))) {
+                    currentNewestMessage = message;
+                }
+            }
+            return currentNewestMessage;
+        });
+    }
+    /**
+     * @returns oldest message in the array. `undefined` if given array is empty.
+     */
+    static getOldestMessage(messages) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let currentOldestMessage = undefined;
+            for (const message of messages) {
+                if (currentOldestMessage === undefined || (yield Message.isOlder(message, currentOldestMessage))) {
+                    currentOldestMessage = message;
+                }
+            }
+            return currentOldestMessage;
+        });
+    }
+    /**
+     * Checks if first message is newer than second message.
+     * @returns `true` if `a` is newer than `b`; `false` otherwise
+     */
+    static isNewer(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aIsNewer = ((yield Message.compareMessageTimestamp(a, b)) > 0);
+            return aIsNewer;
+        });
+    }
+    /**
+     * Checks if first message is older than second message.
+     * @returns `true` if `a` is older than `b`; `false` otherwise
+     */
+    static isOlder(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aIsOlder = ((yield Message.compareMessageTimestamp(a, b)) < 0);
+            return aIsOlder;
+        });
+    }
+    /**
+     * Compares the `messageTimestamp` of the given messages with a fallback to message CID according to the spec.
+     * @returns 1 if `a` is larger/newer than `b`; -1 if `a` is smaller/older than `b`; 0 otherwise (same age)
+     */
+    static compareMessageTimestamp(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (a.descriptor.messageTimestamp > b.descriptor.messageTimestamp) {
+                return 1;
+            }
+            else if (a.descriptor.messageTimestamp < b.descriptor.messageTimestamp) {
+                return -1;
+            }
+            // else `messageTimestamp` is the same between a and b
+            // compare the `dataCid` instead, the < and > operators compare strings in lexicographical order
+            return Message.compareCid(a, b);
+        });
+    }
+    /**
+     * Validates the structural integrity of the message signature given.
+     * NOTE: signature is not verified.
+     * @param payloadJsonSchemaKey The key to look up the JSON schema referenced in `compile-validators.js` and perform payload schema validation on.
+     * @returns the parsed JSON payload object if validation succeeds.
+     */
+    static validateMessageSignatureIntegrity(messageSignature_1, messageDescriptor_1) {
+        return __awaiter(this, arguments, void 0, function* (messageSignature, messageDescriptor, payloadJsonSchemaKey = 'GenericSignaturePayload') {
+            if (messageSignature.signatures.length !== 1) {
+                throw new DwnError(DwnErrorCode.AuthenticationMoreThanOneSignatureNotSupported, 'expected no more than 1 signature for authorization purpose');
+            }
+            // validate payload integrity
+            const payloadJson = Jws.decodePlainObjectPayload(messageSignature);
+            validateJsonSchema(payloadJsonSchemaKey, payloadJson);
+            // `descriptorCid` validation - ensure that the provided descriptorCid matches the CID of the actual message
+            const { descriptorCid } = payloadJson;
+            const expectedDescriptorCid = yield Cid.computeCid(messageDescriptor);
+            if (descriptorCid !== expectedDescriptorCid) {
+                throw new DwnError(DwnErrorCode.AuthenticateDescriptorCidMismatch, `provided descriptorCid ${descriptorCid} does not match expected CID ${expectedDescriptorCid}`);
+            }
+            return payloadJson;
+        });
+    }
+}
+//# sourceMappingURL=message.js.map

package/dist/esm/src/core/message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.js","sourceRoot":"","sources":["../../../../src/core/message.ts"],"names":[],"mappings":";;;;;;;;;AAKA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExD;;GAEG;AACH,MAAM,OAAO,OAAO;IAClB;;;OAGG;IACI,MAAM,CAAC,kBAAkB,CAAC,UAAe;QAC9C,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC/C,MAAM,eAAe,GAAG,YAAY,GAAG,SAAS,CAAC;QAEjD,wCAAwC;QACxC,kBAAkB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAAA,CAAC;IAEF;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,OAAuB;QAC7C,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAO,MAAM,CAAC,OAAuB;;YAChD,qDAAqD;YACrD,qFAAqF;YACrF,+FAA+F;YAC/F,sHAAsH;YAEtH,6DAA6D;YAC7D,MAAM,UAAU,GAAG,kBAAK,OAAO,CAAS,CAAC;YACzC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC3B,OAAO,UAAU,CAAC,WAAW,CAAC;YAChC,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,UAA4B,CAAC,CAAC;YAC/D,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,UAAU,CAAC,CAAiB,EAAE,CAAiB;;YACjE,iEAAiE;YACjE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;KAAA;IAED;;;;OAIG;IACI,MAAM,CAAO,mBAAmB,CAAC,KAMvC;;YACC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;YAEvF,IAAI,gBAAgB,CAAC;YACrB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC;YAE5H,MAAM,aAAa,GAAuB;gBACxC,SAAS;aACV,CAAC;YAEF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,aAAa,CAAC,oBAAoB,GAAG,cAAc,CAAC;YACtD,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,eAAe,CACjC,UAAsB,EACtB,MAAc,EACd,2BAA+G;;YAE/G,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEvD,MAAM,gBAAgB,mBAA8B,aAAa,IAAK,2BAA2B,CAAE,CAAC;YACpG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;YAE5C,MAAM,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;YAEtE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAEnC,OAAO,SAAS,CAAC;QACnB,CAAC;KAAA;IAED;;OAEG;IACI,MAAM,CAAO,gBAAgB,CAAC,QAA0B;;YAC7D,IAAI,oBAAoB,GAA+B,SAAS,CAAC;YACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,oBAAoB,KAAK,SAAS,KAAI,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA,EAAE,CAAC;oBAC/F,oBAAoB,GAAG,OAAO,CAAC;gBACjC,CAAC;YACH,CAAC;YAED,OAAO,oBAAoB,CAAC;QAC9B,CAAC;KAAA;IAED;;OAEG;IACI,MAAM,CAAO,gBAAgB,CAAC,QAA0B;;YAC7D,IAAI,oBAAoB,GAA+B,SAAS,CAAC;YACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,oBAAoB,KAAK,SAAS,KAAI,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA,EAAE,CAAC;oBAC/F,oBAAoB,GAAG,OAAO,CAAC;gBACjC,CAAC;YACH,CAAC;YAED,OAAO,oBAAoB,CAAC;QAC9B,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,OAAO,CAAC,CAAiB,EAAE,CAAiB;;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAA,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAG,CAAC,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,OAAO,CAAC,CAAiB,EAAE,CAAiB;;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAA,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAG,CAAC,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,uBAAuB,CAAC,CAAiB,EAAE,CAAiB;;YAC9E,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,GAAG,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC;YACX,CAAC;iBAAM,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,GAAG,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACzE,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC;YAED,sDAAsD;YACtD,gGAAgG;YAChG,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;KAAA;IAGD;;;;;OAKG;IACI,MAAM,CAAO,iCAAiC;6DACnD,gBAA4B,EAC5B,iBAA6B,EAC7B,uBAA+B,yBAAyB;YAGxD,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,8CAA8C,EAAE,6DAA6D,CAAC,CAAC;YACjJ,CAAC;YAED,6BAA6B;YAC7B,MAAM,WAAW,GAAG,GAAG,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;YAEnE,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAEtD,4GAA4G;YAC5G,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC;YACtC,MAAM,qBAAqB,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,aAAa,KAAK,qBAAqB,EAAE,CAAC;gBAC5C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,iCAAiC,EAC9C,0BAA0B,aAAa,gCAAgC,qBAAqB,EAAE,CAC/F,CAAC;YACJ,CAAC;YAED,OAAO,WAAW,CAAC;QACrB,CAAC;KAAA;CACF"}

package/dist/esm/src/core/protocol-authorization.js

@@ -0,0 +1,449 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { RecordsWrite } from '../interfaces/records-write.js';
+import { DwnError, DwnErrorCode } from './dwn-error.js';
+import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
+import { ProtocolAction, ProtocolActor } from '../types/protocols-types.js';
+export class ProtocolAuthorization {
+    /**
+     * Performs validation on the structure of RecordsWrite messages that use a protocol.
+     * @throws {Error} if validation fails.
+     */
+    static validateReferentialIntegrity(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, messageStore);
+            // verify declared protocol type exists in protocol and that it conforms to type specification
+            ProtocolAuthorization.verifyType(incomingMessage.message, protocolDefinition.types);
+            // validate `protocolPath`
+            yield ProtocolAuthorization.verifyProtocolPath(tenant, incomingMessage, messageStore);
+            // get the rule set for the inbound message
+            const inboundMessageRuleSet = ProtocolAuthorization.getRuleSet(incomingMessage.message.descriptor.protocolPath, protocolDefinition);
+            // If the incoming message is writing a $globalRole record, validate that the recipient is unique
+            yield ProtocolAuthorization.verifyUniqueRoleRecipient(tenant, incomingMessage, inboundMessageRuleSet, messageStore);
+        });
+    }
+    /**
+     * Performs protocol-based authorization against the incoming RecordsWrite message.
+     * @throws {Error} if authorization fails.
+     */
+    static authorizeWrite(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch ancestor message chain
+            const ancestorMessageChain = yield ProtocolAuthorization.constructAncestorMessageChain(tenant, incomingMessage, incomingMessage, messageStore);
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, messageStore);
+            // get the rule set for the inbound message
+            const inboundMessageRuleSet = ProtocolAuthorization.getRuleSet(incomingMessage.message.descriptor.protocolPath, protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, incomingMessage.message.descriptor.protocol, incomingMessage.message.contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions
+            yield ProtocolAuthorization.verifyAllowedActions(tenant, incomingMessage, inboundMessageRuleSet, ancestorMessageChain, messageStore);
+        });
+    }
+    /**
+     * Performs protocol-based authorization against the incoming RecordsRead  message.
+     * @param newestRecordsWrite Either the incomingMessage itself if the incoming is a RecordsWrite,
+     *                     or the latest RecordsWrite associated with the recordId being read.
+     * @throws {Error} if authorization fails.
+     */
+    static authorizeRead(tenant, incomingMessage, newestRecordsWrite, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch ancestor message chain
+            const ancestorMessageChain = yield ProtocolAuthorization.constructAncestorMessageChain(tenant, incomingMessage, newestRecordsWrite, messageStore);
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, newestRecordsWrite.message.descriptor.protocol, messageStore);
+            // get the rule set for the inbound message
+            const inboundMessageRuleSet = ProtocolAuthorization.getRuleSet(newestRecordsWrite.message.descriptor.protocolPath, protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, newestRecordsWrite.message.descriptor.protocol, newestRecordsWrite.message.contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions
+            yield ProtocolAuthorization.verifyAllowedActions(tenant, incomingMessage, inboundMessageRuleSet, ancestorMessageChain, messageStore);
+        });
+    }
+    /**
+     * Performs protocol-based authorization against the incoming RecordsQuery message.
+     * @throws {Error} if authorization fails.
+     */
+    static authorizeQuery(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // validate that required properties exist in query filter
+            const { protocol, protocolPath, contextId } = incomingMessage.message.descriptor.filter;
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, protocol, // authorizeQuery` is only called if `protocol` is present
+            messageStore);
+            // get the rule set for the inbound message
+            const inboundMessageRuleSet = ProtocolAuthorization.getRuleSet(protocolPath, // presence of `protocolPath` is verified in `parse()`
+            protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, protocol, contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions
+            yield ProtocolAuthorization.verifyAllowedActions(tenant, incomingMessage, inboundMessageRuleSet, [], // ancestor chain is not relevant to queries
+            messageStore);
+        });
+    }
+    static authorizeDelete(tenant, incomingMessage, newestRecordsWrite, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch ancestor message chain
+            const ancestorMessageChain = yield ProtocolAuthorization.constructAncestorMessageChain(tenant, incomingMessage, newestRecordsWrite, messageStore);
+            // fetch the protocol definition
+            const protocolDefinition = yield ProtocolAuthorization.fetchProtocolDefinition(tenant, newestRecordsWrite.message.descriptor.protocol, messageStore);
+            // get the rule set for the inbound message
+            const inboundMessageRuleSet = ProtocolAuthorization.getRuleSet(newestRecordsWrite.message.descriptor.protocolPath, protocolDefinition);
+            // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
+            yield ProtocolAuthorization.verifyInvokedRole(tenant, incomingMessage, newestRecordsWrite.message.descriptor.protocol, newestRecordsWrite.message.contextId, protocolDefinition, messageStore);
+            // verify method invoked against the allowed actions
+            yield ProtocolAuthorization.verifyAllowedActions(tenant, incomingMessage, inboundMessageRuleSet, ancestorMessageChain, messageStore);
+        });
+    }
+    /**
+     * Fetches the protocol definition based on the protocol specified in the given message.
+     */
+    static fetchProtocolDefinition(tenant, protocolUri, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // fetch the corresponding protocol definition
+            const query = {
+                interface: DwnInterfaceName.Protocols,
+                method: DwnMethodName.Configure,
+                protocol: protocolUri
+            };
+            const { messages: protocols } = yield messageStore.query(tenant, [query]);
+            if (protocols.length === 0) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationProtocolNotFound, `unable to find protocol definition for ${protocolUri}`);
+            }
+            const protocolMessage = protocols[0];
+            return protocolMessage.descriptor.definition;
+        });
+    }
+    /**
+     * Constructs a chain of ancestor messages
+     * @param newestRecordsWrite The newest RecordsWrite associated with the recordId being written.
+     *                           This will be the incoming RecordsWrite itself if the incoming message is a RecordsWrite.
+     * @returns the ancestor chain of messages where the first element is the root of the chain; returns empty array if no parent is specified.
+     */
+    static constructAncestorMessageChain(tenant, incomingMessage, newestRecordsWrite, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const ancestorMessageChain = [];
+            if (incomingMessage.message.descriptor.method !== DwnMethodName.Write) {
+                // Unless inboundMessage is a Write, recordsWrite is also an ancestor message
+                ancestorMessageChain.push(newestRecordsWrite.message);
+            }
+            const protocol = newestRecordsWrite.message.descriptor.protocol;
+            const contextId = newestRecordsWrite.message.contextId;
+            // keep walking up the chain from the inbound message's parent, until there is no more parent
+            let currentParentId = newestRecordsWrite.message.descriptor.parentId;
+            while (currentParentId !== undefined) {
+                // fetch parent
+                const query = {
+                    interface: DwnInterfaceName.Records,
+                    method: DwnMethodName.Write,
+                    protocol,
+                    contextId,
+                    recordId: currentParentId
+                };
+                const { messages: parentMessages } = yield messageStore.query(tenant, [query]);
+                // We already check the immediate parent in `verifyProtocolPath`, so if it triggers,
+                // it means a bug that caused an invalid message to be saved to the DWN.
+                if (parentMessages.length === 0) {
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationParentNotFound, `no parent found with ID ${currentParentId}`);
+                }
+                const parent = parentMessages[0];
+                ancestorMessageChain.push(parent);
+                currentParentId = parent.descriptor.parentId;
+            }
+            return ancestorMessageChain.reverse(); // root ancestor first
+        });
+    }
+    /**
+     * Gets the rule set corresponding to the given message chain.
+     */
+    static getRuleSet(protocolPath, protocolDefinition) {
+        const ruleSet = ProtocolAuthorization.getRuleSetAtProtocolPath(protocolPath, protocolDefinition);
+        if (ruleSet === undefined) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationMissingRuleSet, `No rule set defined for protocolPath ${protocolPath}`);
+        }
+        return ruleSet;
+    }
+    /**
+     * Verifies the `protocolPath` declared in the given message (if it is a RecordsWrite) matches the path of actual ancestor chain.
+     * @throws {DwnError} if fails verification.
+     */
+    static verifyProtocolPath(tenant, inboundMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const declaredProtocolPath = inboundMessage.message.descriptor.protocolPath;
+            const declaredTypeName = ProtocolAuthorization.getTypeName(declaredProtocolPath);
+            const parentId = inboundMessage.message.descriptor.parentId;
+            if (parentId === undefined) {
+                if (declaredProtocolPath !== declaredTypeName) {
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationParentlessIncorrectProtocolPath, `Declared protocol path '${declaredProtocolPath}' is not valid for records with no parentId'.`);
+                }
+            }
+            else {
+                const protocol = inboundMessage.message.descriptor.protocol;
+                const contextId = inboundMessage.message.contextId;
+                const query = {
+                    interface: DwnInterfaceName.Records,
+                    method: DwnMethodName.Write,
+                    protocol,
+                    contextId,
+                    recordId: parentId
+                };
+                const { messages: parentMessages } = yield messageStore.query(tenant, [query]);
+                const parentProtocolPath = (_b = (_a = parentMessages[0]) === null || _a === void 0 ? void 0 : _a.descriptor) === null || _b === void 0 ? void 0 : _b.protocolPath;
+                const actualProtocolPath = `${parentProtocolPath}/${declaredTypeName}`;
+                if (parentProtocolPath === undefined || actualProtocolPath !== declaredProtocolPath) {
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectProtocolPath, `Could not find matching parent record to verify declared protocol path '${declaredProtocolPath}'.`);
+                }
+            }
+        });
+    }
+    /**
+     * Verifies the `dataFormat` and `schema` declared in the given message (if it is a RecordsWrite) matches dataFormat
+     * and schema of the type in the given protocol.
+     * @throws {DwnError} if fails verification.
+     */
+    static verifyType(inboundMessage, protocolTypes) {
+        const typeNames = Object.keys(protocolTypes);
+        const declaredProtocolPath = inboundMessage.descriptor.protocolPath;
+        const declaredTypeName = ProtocolAuthorization.getTypeName(declaredProtocolPath);
+        if (!typeNames.includes(declaredTypeName)) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationInvalidType, `record with type ${declaredTypeName} not allowed in protocol`);
+        }
+        const protocolPath = inboundMessage.descriptor.protocolPath;
+        // existence of `protocolType` has already been verified
+        const typeName = ProtocolAuthorization.getTypeName(protocolPath);
+        const protocolType = protocolTypes[typeName];
+        // no `schema` specified in protocol definition means that any schema is allowed
+        const { schema } = inboundMessage.descriptor;
+        if (protocolType.schema !== undefined && protocolType.schema !== schema) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationInvalidSchema, `type '${typeName}' must have schema '${protocolType.schema}', \
+        instead has '${schema}'`);
+        }
+        // no `dataFormats` specified in protocol definition means that all dataFormats are allowed
+        const { dataFormat } = inboundMessage.descriptor;
+        if (protocolType.dataFormats !== undefined && !protocolType.dataFormats.includes(dataFormat)) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationIncorrectDataFormat, `type '${typeName}' must have data format in (${protocolType.dataFormats}), \
+        instead has '${dataFormat}'`);
+        }
+    }
+    /**
+     * Check if the incoming message is invoking a role. If so, validate the invoked role.
+     */
+    static verifyInvokedRole(tenant, incomingMessage, protocolUri, contextId, protocolDefinition, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const protocolRole = (_a = incomingMessage.signaturePayload) === null || _a === void 0 ? void 0 : _a.protocolRole;
+            // Only verify role if there is a role being invoked
+            if (protocolRole === undefined) {
+                return;
+            }
+            const roleRuleSet = ProtocolAuthorization.getRuleSetAtProtocolPath(protocolRole, protocolDefinition);
+            if (roleRuleSet === undefined || (!roleRuleSet.$globalRole && !roleRuleSet.$contextRole)) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationNotARole, `Protocol path ${protocolRole} is not a valid protocolRole`);
+            }
+            const roleRecordFilter = {
+                interface: DwnInterfaceName.Records,
+                method: DwnMethodName.Write,
+                protocol: protocolUri,
+                protocolPath: protocolRole,
+                recipient: incomingMessage.author,
+                isLatestBaseState: true,
+            };
+            if (roleRuleSet.$contextRole) {
+                if (contextId === undefined) {
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationMissingContextId, 'Could not verify $contextRole because contextId is missing');
+                }
+                roleRecordFilter.contextId = contextId;
+            }
+            const { messages: matchingMessages } = yield messageStore.query(tenant, [roleRecordFilter]);
+            if (matchingMessages.length === 0) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationMissingRole, `No matching role found for protocol path ${protocolRole}`);
+            }
+        });
+    }
+    /**
+     * Returns a list of ProtocolAction(s) based on the incoming message, one of which must be allowed for the message to be authorized.
+     * NOTE: the reason why there could be multiple actions is because in case of an "update" RecordsWrite by the original record author,
+     * the RecordsWrite can either be authorized by a `write` or `update` allow rule. It is important to recognize that the `write` access that allowed
+     * the original record author to create the record maybe revoked (e.g. by role revocation) by the time an "update" by the same author is attempted.
+     */
+    static getActionsSeekingARuleMatch(tenant, incomingMessage, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            switch (incomingMessage.message.descriptor.method) {
+                case DwnMethodName.Delete:
+                    return [ProtocolAction.Delete];
+                case DwnMethodName.Query:
+                    return [ProtocolAction.Query];
+                case DwnMethodName.Read:
+                    return [ProtocolAction.Read];
+                case DwnMethodName.Write:
+                    const incomingRecordsWrite = incomingMessage;
+                    if (yield incomingRecordsWrite.isInitialWrite()) {
+                        // only 'write' allows initial RecordsWrites; 'update' only applies to subsequent RecordsWrites
+                        return [ProtocolAction.Write];
+                    }
+                    else if (yield incomingRecordsWrite.isAuthoredByInitialRecordAuthor(tenant, messageStore)) {
+                        // Both 'update' and 'write' authorize the incoming message
+                        return [ProtocolAction.Write, ProtocolAction.Update];
+                    }
+                    else {
+                        // Actors other than the initial record author must be authorized to 'update' the message
+                        return [ProtocolAction.Update];
+                    }
+                // default:
+                // not reachable in typescript
+            }
+        });
+    }
+    /**
+     * Verifies the action (e.g. read/write) specified in the given message matches the allowed actions in the rule set.
+     * @throws {Error} if action not allowed.
+     */
+    static verifyAllowedActions(tenant, incomingMessage, inboundMessageRuleSet, ancestorMessageChain, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const incomingMessageMethod = incomingMessage.message.descriptor.method;
+            const inboundMessageActions = yield ProtocolAuthorization.getActionsSeekingARuleMatch(tenant, incomingMessage, messageStore);
+            const author = incomingMessage.author;
+            const actionRules = inboundMessageRuleSet.$actions;
+            // We have already checked that the message is not from tenant, owner, or permissionsGrant
+            if (actionRules === undefined) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationActionRulesNotFound, `no action rule defined for ${incomingMessageMethod}, ${author} is unauthorized`);
+            }
+            const invokedRole = (_a = incomingMessage.signaturePayload) === null || _a === void 0 ? void 0 : _a.protocolRole;
+            for (const actionRule of actionRules) {
+                if (!inboundMessageActions.includes(actionRule.can)) {
+                    continue;
+                }
+                if (invokedRole !== undefined) {
+                    // When a protocol role is being invoked, we require that there is a matching `role` rule.
+                    if (actionRule.role === invokedRole) {
+                        // role is successfully invoked
+                        return;
+                    }
+                    else {
+                        continue;
+                    }
+                }
+                else if (actionRule.who === ProtocolActor.Recipient && actionRule.of === undefined && author !== undefined) {
+                    // Author must be recipient of the record being accessed
+                    let recordsWriteMessage;
+                    if (incomingMessage.message.descriptor.method === DwnMethodName.Write) {
+                        recordsWriteMessage = incomingMessage.message;
+                    }
+                    else {
+                        // else the incoming message must be a RecordsDelete because only `update` and `delete` are allowed recipient actions
+                        recordsWriteMessage = ancestorMessageChain[ancestorMessageChain.length - 1];
+                    }
+                    if (recordsWriteMessage.descriptor.recipient === author) {
+                        return;
+                    }
+                }
+                else if (actionRule.who === ProtocolActor.Anyone) {
+                    return;
+                }
+                else if (author === undefined) {
+                    continue;
+                }
+                const ancestorRuleSuccess = yield ProtocolAuthorization.checkActor(author, actionRule, ancestorMessageChain);
+                if (ancestorRuleSuccess) {
+                    return;
+                }
+            }
+            // No action rules were satisfied, author is not authorized
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationActionNotAllowed, `inbound message action not allowed for author`);
+        });
+    }
+    /**
+     * Verifies that writes to a $globalRole or $contextRole record do not have the same recipient as an existing RecordsWrite
+     * to the same $globalRole or the same $contextRole in the same context.
+     */
+    static verifyUniqueRoleRecipient(tenant, incomingMessage, inboundMessageRuleSet, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const incomingRecordsWrite = incomingMessage;
+            if (!inboundMessageRuleSet.$globalRole && !inboundMessageRuleSet.$contextRole) {
+                return;
+            }
+            const recipient = incomingRecordsWrite.message.descriptor.recipient;
+            if (recipient === undefined) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationRoleMissingRecipient, 'Role records must have a recipient');
+            }
+            const protocolPath = incomingRecordsWrite.message.descriptor.protocolPath;
+            const filter = {
+                interface: DwnInterfaceName.Records,
+                method: DwnMethodName.Write,
+                isLatestBaseState: true,
+                protocol: incomingRecordsWrite.message.descriptor.protocol,
+                protocolPath,
+                recipient,
+            };
+            if (inboundMessageRuleSet.$contextRole) {
+                filter.contextId = incomingRecordsWrite.message.contextId;
+            }
+            const { messages: matchingMessages } = yield messageStore.query(tenant, [filter]);
+            const matchingRecords = matchingMessages;
+            const matchingRecordsExceptIncomingRecordId = matchingRecords.filter((recordsWriteMessage) => recordsWriteMessage.recordId !== incomingRecordsWrite.message.recordId);
+            if (matchingRecordsExceptIncomingRecordId.length > 0) {
+                if (inboundMessageRuleSet.$globalRole) {
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationDuplicateGlobalRoleRecipient, `DID '${recipient}' is already recipient of a $globalRole record at protocol path '${protocolPath}`);
+                }
+                else {
+                    // $contextRole
+                    throw new DwnError(DwnErrorCode.ProtocolAuthorizationDuplicateContextRoleRecipient, `DID '${recipient}' is already recipient of a $contextRole record at protocol path '${protocolPath} in the same context`);
+                }
+            }
+        });
+    }
+    static getRuleSetAtProtocolPath(protocolPath, protocolDefinition) {
+        const protocolPathArray = protocolPath.split('/');
+        let currentRuleSet = protocolDefinition.structure;
+        let i = 0;
+        while (i < protocolPathArray.length) {
+            const currentTypeName = protocolPathArray[i];
+            const nextRuleSet = currentRuleSet[currentTypeName];
+            if (nextRuleSet === undefined) {
+                return undefined;
+            }
+            currentRuleSet = nextRuleSet;
+            i++;
+        }
+        return currentRuleSet;
+    }
+    /**
+     * Checks if there is a record in the ancestor chain matching the `who: 'author' | 'recipient'` action rule.
+     * @returns true if the action rule is satisfied. false otherwise
+     */
+    static checkActor(author, actionRule, ancestorMessageChain) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Iterate up the ancestor chain to find a message with matching protocolPath
+            const ancestorRecordsWrite = ancestorMessageChain.find((recordsWriteMessage) => recordsWriteMessage.descriptor.protocolPath === actionRule.of);
+            // If this is reached, there is likely an issue with the protocol definition.
+            // The protocolPath to the actionRule should start with actionRule.of
+            // consider moving this check to ProtocolsConfigure message ingestion
+            if (ancestorRecordsWrite === undefined) {
+                return false;
+            }
+            if (actionRule.who === ProtocolActor.Recipient) {
+                // Recipient of ancestor message must be the author of the incoming message
+                return author === ancestorRecordsWrite.descriptor.recipient;
+            }
+            else { // actionRule.who === ProtocolActor.Author
+                // Author of ancestor message must be the author of the incoming message
+                const ancestorAuthor = (yield RecordsWrite.parse(ancestorRecordsWrite)).author;
+                return author === ancestorAuthor;
+            }
+        });
+    }
+    static getTypeName(protocolPath) {
+        return protocolPath.split('/').slice(-1)[0];
+    }
+}
+//# sourceMappingURL=protocol-authorization.js.map