@atrib/verify 0.5.2 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +80 -1
- package/dist/authorization-evidence.d.ts +155 -0
- package/dist/authorization-evidence.d.ts.map +1 -0
- package/dist/authorization-evidence.js +423 -0
- package/dist/authorization-evidence.js.map +1 -0
- package/dist/dpop-replay-cache.d.ts +35 -0
- package/dist/dpop-replay-cache.d.ts.map +1 -0
- package/dist/dpop-replay-cache.js +50 -0
- package/dist/dpop-replay-cache.js.map +1 -0
- package/dist/index.d.ts +7 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -0
- package/dist/index.js.map +1 -1
- package/dist/oauth-introspection.d.ts +38 -0
- package/dist/oauth-introspection.d.ts.map +1 -0
- package/dist/oauth-introspection.js +118 -0
- package/dist/oauth-introspection.js.map +1 -0
- package/dist/types.d.ts +6 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/dist/verifier.d.ts +6 -0
- package/dist/verifier.d.ts.map +1 -1
- package/dist/verifier.js +55 -0
- package/dist/verifier.js.map +1 -1
- package/dist/verify-record.d.ts +38 -6
- package/dist/verify-record.d.ts.map +1 -1
- package/dist/verify-record.js +99 -21
- package/dist/verify-record.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
+
export async function introspectOAuthToken(options) {
|
|
3
|
+
const errors = [];
|
|
4
|
+
const warnings = [];
|
|
5
|
+
const fetchImpl = options.fetchImpl ?? fetch;
|
|
6
|
+
const body = new URLSearchParams();
|
|
7
|
+
body.set('token', options.token);
|
|
8
|
+
if (options.tokenTypeHint)
|
|
9
|
+
body.set('token_type_hint', options.tokenTypeHint);
|
|
10
|
+
for (const [key, value] of Object.entries(options.extraParams ?? {})) {
|
|
11
|
+
if (key === 'token')
|
|
12
|
+
continue;
|
|
13
|
+
body.set(key, value);
|
|
14
|
+
}
|
|
15
|
+
const headers = {
|
|
16
|
+
accept: 'application/json',
|
|
17
|
+
'content-type': 'application/x-www-form-urlencoded',
|
|
18
|
+
};
|
|
19
|
+
applyClientAuthentication(headers, options.clientAuthentication);
|
|
20
|
+
const ctrl = options.signal ? undefined : new AbortController();
|
|
21
|
+
const timer = ctrl && options.timeoutMs !== undefined
|
|
22
|
+
? setTimeout(() => ctrl.abort(), options.timeoutMs)
|
|
23
|
+
: undefined;
|
|
24
|
+
try {
|
|
25
|
+
const requestInit = {
|
|
26
|
+
method: 'POST',
|
|
27
|
+
headers,
|
|
28
|
+
body,
|
|
29
|
+
...(options.signal || ctrl?.signal ? { signal: options.signal ?? ctrl?.signal ?? null } : {}),
|
|
30
|
+
};
|
|
31
|
+
const response = await fetchImpl(options.endpoint, requestInit);
|
|
32
|
+
if (!response.ok) {
|
|
33
|
+
errors.push(`introspection endpoint returned ${response.status}`);
|
|
34
|
+
return result(options.endpoint, undefined, errors, warnings);
|
|
35
|
+
}
|
|
36
|
+
const parsed = (await response.json());
|
|
37
|
+
if (!isIntrospectionResponse(parsed)) {
|
|
38
|
+
errors.push('introspection response missing boolean active field');
|
|
39
|
+
return result(options.endpoint, undefined, errors, warnings);
|
|
40
|
+
}
|
|
41
|
+
validateExpectedClaims(parsed, options, errors);
|
|
42
|
+
return result(options.endpoint, parsed, errors, warnings);
|
|
43
|
+
}
|
|
44
|
+
catch (err) {
|
|
45
|
+
errors.push(`introspection request failed: ${err instanceof Error ? err.message : String(err)}`);
|
|
46
|
+
return result(options.endpoint, undefined, errors, warnings);
|
|
47
|
+
}
|
|
48
|
+
finally {
|
|
49
|
+
if (timer !== undefined)
|
|
50
|
+
clearTimeout(timer);
|
|
51
|
+
}
|
|
52
|
+
}
|
|
53
|
+
export function oauthEvidenceFromIntrospectionResult(introspection, base = {}) {
|
|
54
|
+
if (!introspection.introspection) {
|
|
55
|
+
throw new Error('introspection result has no response body');
|
|
56
|
+
}
|
|
57
|
+
return {
|
|
58
|
+
...base,
|
|
59
|
+
introspection: introspection.introspection,
|
|
60
|
+
introspectionVerified: introspection.introspectionVerified,
|
|
61
|
+
};
|
|
62
|
+
}
|
|
63
|
+
function applyClientAuthentication(headers, authentication) {
|
|
64
|
+
if (!authentication || authentication.method === 'none')
|
|
65
|
+
return;
|
|
66
|
+
if (authentication.method === 'basic') {
|
|
67
|
+
headers.authorization = `Basic ${Buffer.from(`${authentication.clientId}:${authentication.clientSecret}`).toString('base64')}`;
|
|
68
|
+
return;
|
|
69
|
+
}
|
|
70
|
+
if (authentication.method === 'bearer') {
|
|
71
|
+
headers.authorization = `Bearer ${authentication.token}`;
|
|
72
|
+
return;
|
|
73
|
+
}
|
|
74
|
+
for (const [key, value] of Object.entries(authentication.headers)) {
|
|
75
|
+
headers[key.toLowerCase()] = value;
|
|
76
|
+
}
|
|
77
|
+
}
|
|
78
|
+
function validateExpectedClaims(response, options, errors) {
|
|
79
|
+
if (options.expectedIssuer && response.iss !== options.expectedIssuer) {
|
|
80
|
+
errors.push('introspection issuer mismatch');
|
|
81
|
+
}
|
|
82
|
+
const expectedAudience = asArray(options.expectedAudience);
|
|
83
|
+
if (expectedAudience.length > 0) {
|
|
84
|
+
const actualAudience = asArray(response.aud);
|
|
85
|
+
const missing = expectedAudience.filter((entry) => !actualAudience.includes(entry));
|
|
86
|
+
if (missing.length > 0)
|
|
87
|
+
errors.push(`introspection audience missing: ${missing.join(', ')}`);
|
|
88
|
+
}
|
|
89
|
+
if (options.expectedResource) {
|
|
90
|
+
const actualResources = asArray(response.resource);
|
|
91
|
+
if (!actualResources.includes(options.expectedResource)) {
|
|
92
|
+
errors.push('introspection resource mismatch');
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
function result(endpoint, introspection, errors, warnings) {
|
|
97
|
+
return {
|
|
98
|
+
ok: introspection !== undefined && errors.length === 0,
|
|
99
|
+
endpoint,
|
|
100
|
+
...(introspection ? { introspection } : {}),
|
|
101
|
+
introspectionVerified: introspection !== undefined && errors.length === 0,
|
|
102
|
+
errors,
|
|
103
|
+
warnings,
|
|
104
|
+
};
|
|
105
|
+
}
|
|
106
|
+
function isIntrospectionResponse(value) {
|
|
107
|
+
return value !== null && typeof value === 'object' && !Array.isArray(value) && 'active' in value
|
|
108
|
+
? typeof value.active === 'boolean'
|
|
109
|
+
: false;
|
|
110
|
+
}
|
|
111
|
+
function asArray(value) {
|
|
112
|
+
if (typeof value === 'string')
|
|
113
|
+
return [value];
|
|
114
|
+
if (Array.isArray(value))
|
|
115
|
+
return value.filter((entry) => typeof entry === 'string');
|
|
116
|
+
return [];
|
|
117
|
+
}
|
|
118
|
+
//# sourceMappingURL=oauth-introspection.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth-introspection.js","sourceRoot":"","sources":["../src/oauth-introspection.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAoCtC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAkC;IAElC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,OAAO,CAAC,aAAa;QAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,GAAG,KAAK,OAAO;YAAE,SAAQ;QAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACtB,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,cAAc,EAAE,mCAAmC;KACpD,CAAA;IACD,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAA;IAC/D,MAAM,KAAK,GACT,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,SAAS,CAAA;IAEf,IAAI,CAAC;QACH,MAAM,WAAW,GAAgB;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;YACJ,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YACjE,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;QACjD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;YAClE,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QACD,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChG,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC9D,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,aAAuC,EACvC,OAAyF,EAAE;IAE3F,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;KAC3D,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA+B,EAC/B,cAAkE;IAElE,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,MAAM;QAAE,OAAM;IAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAC1C,GAAG,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,YAAY,EAAE,CAC5D,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QACtB,OAAM;IACR,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,aAAa,GAAG,UAAU,cAAc,CAAC,KAAK,EAAE,CAAA;QACxD,OAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAA;IACpC,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAyC,EACzC,OAAkC,EAClC,MAAgB;IAEhB,IAAI,OAAO,CAAC,cAAc,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC1D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACnF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,QAAgB,EAChB,aAA0D,EAC1D,MAAgB,EAChB,QAAkB;IAElB,OAAO;QACL,EAAE,EAAE,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACtD,QAAQ;QACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,qBAAqB,EAAE,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACzE,MAAM;QACN,QAAQ;KACT,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,IAAI,KAAK;QAC9F,CAAC,CAAC,OAAQ,KAA8B,CAAC,MAAM,KAAK,SAAS;QAC7D,CAAC,CAAC,KAAK,CAAA;AACX,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;IAC5E,OAAO,EAAE,CAAA;AACX,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -5,6 +5,7 @@
|
|
|
5
5
|
* Mirrors §3.5 (graph response schema) and §4.7 (recommendation document).
|
|
6
6
|
*/
|
|
7
7
|
import type { Ap2ViEvidenceVerification } from './ap2-vi-evidence.js';
|
|
8
|
+
import type { EvidenceVerificationBlock } from './authorization-evidence.js';
|
|
8
9
|
/**
|
|
9
10
|
* Graph-layer event_type. Short labels for the three primitives the v1
|
|
10
11
|
* graph + calculation algorithm operate on, plus the catch-all `extension`
|
|
@@ -251,5 +252,10 @@ export interface VerificationResult {
|
|
|
251
252
|
* settlement recommendation signature or calculation checks.
|
|
252
253
|
*/
|
|
253
254
|
ap2_vi_evidence?: Ap2ViEvidenceVerification;
|
|
255
|
+
/**
|
|
256
|
+
* Generic tiered external evidence blocks. These do not alter
|
|
257
|
+
* recommendation signature or calculation checks.
|
|
258
|
+
*/
|
|
259
|
+
evidence?: EvidenceVerificationBlock[];
|
|
254
260
|
}
|
|
255
261
|
//# sourceMappingURL=types.d.ts.map
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAM5E;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GACjB,WAAW,GACX,aAAa,GACb,aAAa,GACb,kBAAkB,GAClB,YAAY,GACZ,UAAU,GACV,UAAU,GACV,eAAe,GACf,WAAW,CAAA;AAEf;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAiBjE;AAED,0FAA0F;AAC1F,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,KAAK,CAAA;CACd;AAED,MAAM,MAAM,QAAQ,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,aAAa,GACb,eAAe,GACf,WAAW,GACX,SAAS,CAAA;AAEb,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,iBAAiB,GACjB,eAAe,GACf,WAAW;AACb;;;;;;;GAOG;GACD,0BAA0B,CAAA;AAE9B,MAAM,MAAM,eAAe;AACzB;;;GAGG;AACD,UAAU;AACZ;;;GAGG;GACD,SAAS;AACX;;;;GAIG;GACD,YAAY,CAAA;AAEhB,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,SAAS,CAAA;IACrB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,UAAU,EAAE,OAAO,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAA;IAClC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IACvC,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,iDAAiD;AACjD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAA;IAClC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IACvC,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,WAAW,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,KAAK,EAAE,SAAS,EAAE,CAAA;CACnB;AAMD,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,OAAO,GAAG,UAAU,CAAA;AAEtE,MAAM,WAAW,WAAW;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAA;AAE5C,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,WAAW,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;IACzC,YAAY,CAAC,EAAE,WAAW,CAAA;IAC1B,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,WAAW,CAAC,EAAE,iBAAiB,CAAA;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE;QACZ,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,YAAY,GAAG,cAAc,GAAG,oBAAoB,GAAG,WAAW,CAAA;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAA;CAC3C;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,WAAW,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,kBAAkB,EAAE,CAAA;IACtC,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACvC,CAAA;IACD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAMD,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEjD,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,WAAW,CAAA;IACzB,aAAa,EAAE,2BAA2B,CAAA;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;IACxB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,YAAY,CAAA;IAC1B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAA;IAC3C;;;OAGG;IACH,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAA;CACvC"}
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAwCtC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,sCAAsC;YACzC,OAAO,WAAW,CAAA;QACpB,KAAK,wCAAwC;YAC3C,OAAO,aAAa,CAAA;QACtB,KAAK,wCAAwC;YAC3C,OAAO,aAAa,CAAA;QACtB,KAAK,6CAA6C;YAChD,OAAO,kBAAkB,CAAA;QAC3B,KAAK,uCAAuC;YAC1C,OAAO,YAAY,CAAA;QACrB,KAAK,qCAAqC;YACxC,OAAO,UAAU,CAAA;QACnB;YACE,OAAO,WAAW,CAAA;IACtB,CAAC;AACH,CAAC"}
|
package/dist/verifier.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { Ap2ViEvidenceBundle, VerifyAp2ViEvidenceOptions } from './ap2-vi-evidence.js';
|
|
2
|
+
import type { AuthorizationEvidenceInput } from './authorization-evidence.js';
|
|
2
3
|
import type { PolicyDocument, RecommendationDocument, VerificationResult } from './types.js';
|
|
3
4
|
/** Init options for AtribVerifier (§5.5.1). */
|
|
4
5
|
export interface AtribVerifierOptions {
|
|
@@ -29,6 +30,11 @@ export interface VerifyRecommendationOptions {
|
|
|
29
30
|
ap2ViEvidence?: Ap2ViEvidenceBundle;
|
|
30
31
|
/** Options passed through to `verifyAp2ViEvidenceAsync()`. */
|
|
31
32
|
ap2ViEvidenceOptions?: VerifyAp2ViEvidenceOptions;
|
|
33
|
+
/**
|
|
34
|
+
* Generic external authorization evidence. Each block is tiered and does
|
|
35
|
+
* not change recommendation validity.
|
|
36
|
+
*/
|
|
37
|
+
authorizationEvidence?: AuthorizationEvidenceInput[];
|
|
32
38
|
}
|
|
33
39
|
export declare class AtribVerifier {
|
|
34
40
|
private readonly logEndpoint;
|
package/dist/verifier.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,mBAAmB,EAEnB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EACV,0BAA0B,EAG3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EAEtB,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAMnB,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,MAAM,EAAE,cAAc,GAAG,SAAS,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,UAAU,CAAA;IACrB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,mEAAmE;AACnE,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,EAAE,CAAA;CACrD;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAmB;gBAE1C,OAAO,GAAE,oBAAyB;IAsB9C;;;;;;;;;;OAUG;IACG,MAAM,CACV,GAAG,EAAE,sBAAsB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,kBAAkB,CAAC;IA2F9B;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2D3E;;;;;;OAMG;YACW,4BAA4B;CAuB3C"}
|
package/dist/verifier.js
CHANGED
|
@@ -13,6 +13,7 @@ import { calculate, DEFAULT_POLICY } from './calculate.js';
|
|
|
13
13
|
import { fetchGraph, fetchSessionPolicyRecord, fetchPolicyDocument } from './graph-fetch.js';
|
|
14
14
|
import { signRecommendation, verifyRecommendationSignature, distributionsMatch, } from './recommendation.js';
|
|
15
15
|
import { verifyAp2ViEvidenceAsync } from './ap2-vi-evidence.js';
|
|
16
|
+
import { verifyAuthorizationEvidence } from './authorization-evidence.js';
|
|
16
17
|
const DEFAULT_LOG_ENDPOINT = 'https://log.atrib.dev/v1';
|
|
17
18
|
const DEFAULT_GRAPH_ENDPOINT = 'https://graph.atrib.dev/v1';
|
|
18
19
|
const DEFAULT_RESOLVE_ENDPOINT = 'https://resolve.atrib.dev/v1';
|
|
@@ -60,6 +61,7 @@ export class AtribVerifier {
|
|
|
60
61
|
let localDistribution = doc.distribution;
|
|
61
62
|
let nodeCount = 0;
|
|
62
63
|
let ap2ViEvidence;
|
|
64
|
+
const evidence = [];
|
|
63
65
|
// Step 1: signature
|
|
64
66
|
try {
|
|
65
67
|
const pubKey = await this.resolveCalculatedByPublicKey(doc.calculated_by);
|
|
@@ -113,6 +115,17 @@ export class AtribVerifier {
|
|
|
113
115
|
catch (err) {
|
|
114
116
|
ap2ViEvidence = ap2ViEvidenceErrorResult(err);
|
|
115
117
|
}
|
|
118
|
+
evidence.push(ap2ViEvidenceToBlock(ap2ViEvidence));
|
|
119
|
+
}
|
|
120
|
+
if (options.authorizationEvidence) {
|
|
121
|
+
for (const item of options.authorizationEvidence) {
|
|
122
|
+
try {
|
|
123
|
+
evidence.push(await verifyAuthorizationEvidence(item));
|
|
124
|
+
}
|
|
125
|
+
catch (err) {
|
|
126
|
+
evidence.push(authorizationEvidenceErrorResult(err));
|
|
127
|
+
}
|
|
128
|
+
}
|
|
116
129
|
}
|
|
117
130
|
return {
|
|
118
131
|
valid: signatureOk && calcMatch,
|
|
@@ -122,6 +135,7 @@ export class AtribVerifier {
|
|
|
122
135
|
warnings,
|
|
123
136
|
graph_node_count: nodeCount,
|
|
124
137
|
...(ap2ViEvidence ? { ap2_vi_evidence: ap2ViEvidence } : {}),
|
|
138
|
+
...(evidence.length > 0 ? { evidence } : {}),
|
|
125
139
|
};
|
|
126
140
|
}
|
|
127
141
|
/**
|
|
@@ -238,4 +252,45 @@ function ap2ViEvidenceErrorResult(err) {
|
|
|
238
252
|
warnings: [],
|
|
239
253
|
};
|
|
240
254
|
}
|
|
255
|
+
function ap2ViEvidenceToBlock(result) {
|
|
256
|
+
return {
|
|
257
|
+
protocol: 'ap2_vi',
|
|
258
|
+
valid: result.valid,
|
|
259
|
+
issuer: null,
|
|
260
|
+
subject: null,
|
|
261
|
+
scope: [],
|
|
262
|
+
attenuation_ok: result.vi.constraints.status === 'passed' ? true : null,
|
|
263
|
+
delegation_ok: result.vi.delegationOk,
|
|
264
|
+
constraints: result.vi.constraints.checks.map((constraint) => {
|
|
265
|
+
const status = constraint.status === 'passed'
|
|
266
|
+
? 'passed'
|
|
267
|
+
: constraint.status === 'failed'
|
|
268
|
+
? 'failed'
|
|
269
|
+
: constraint.status === 'unresolved'
|
|
270
|
+
? 'unresolved'
|
|
271
|
+
: 'not_checked';
|
|
272
|
+
return constraint.reason
|
|
273
|
+
? { type: constraint.type, status, reason: constraint.reason }
|
|
274
|
+
: { type: constraint.type, status };
|
|
275
|
+
}),
|
|
276
|
+
errors: result.errors,
|
|
277
|
+
warnings: result.warnings,
|
|
278
|
+
details: result,
|
|
279
|
+
};
|
|
280
|
+
}
|
|
281
|
+
function authorizationEvidenceErrorResult(err) {
|
|
282
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
283
|
+
return {
|
|
284
|
+
protocol: 'authorization',
|
|
285
|
+
valid: false,
|
|
286
|
+
issuer: null,
|
|
287
|
+
subject: null,
|
|
288
|
+
scope: [],
|
|
289
|
+
attenuation_ok: null,
|
|
290
|
+
delegation_ok: null,
|
|
291
|
+
constraints: [],
|
|
292
|
+
errors: [`authorization_evidence verification error: ${message}`],
|
|
293
|
+
warnings: [],
|
|
294
|
+
};
|
|
295
|
+
}
|
|
241
296
|
//# sourceMappingURL=verifier.js.map
|
package/dist/verifier.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAkBzE,MAAM,oBAAoB,GAAG,0BAA0B,CAAA;AACvD,MAAM,sBAAsB,GAAG,4BAA4B,CAAA;AAC3D,MAAM,wBAAwB,GAAG,8BAA8B,CAAA;AAwC/D,MAAM,OAAO,aAAa;IACP,WAAW,CAAQ;IACnB,aAAa,CAAQ;IACrB,kBAAkB,CAAmB;IAEtD,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAA;QAC9D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAA;QACpE,yDAAyD;QACzD,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC,CAAA;QAE1D,IAAI,GAAG,GAAsB,IAAI,CAAA;QACjC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACpD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBAC1B,GAAG,GAAG,OAAO,CAAA;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;gBACvF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAA;IAC/B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CACV,GAA2B,EAC3B,UAAuC,EAAE;QAEzC,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,IAAI,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAA;QACxC,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,IAAI,aAAoD,CAAA;QACxD,MAAM,QAAQ,GAAgC,EAAE,CAAA;QAEhD,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,aAAa,EAAE,CAAC,CAAA;YACvF,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBAC9D,IAAI,CAAC,WAAW;oBAAE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,CAAA;YACvF,SAAS,GAAG,KAAK,CAAC,UAAU,CAAA;YAE5B,IAAI,YAAY,GAA+B,IAAI,CAAA;YACnD,IAAI,MAAM,GAAmB,cAAc,CAAA;YAC3C,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAA;oBACvF,IAAI,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;wBAC3E,IAAI,CAAC;4BACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;wBAChE,CAAC;wBAAC,MAAM,CAAC;4BACP,QAAQ,CAAC,IAAI,CACX,iCAAiC,YAAY,CAAC,aAAa,2BAA2B,CACvF,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,CAAC,IAAI,CACX,yCAAyC,GAAG,CAAC,gBAAgB,2BAA2B,CACzF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,iBAAiB,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;YAC1D,SAAS,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAC3E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,qCAAsC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,wBAAwB,CAC5C,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,oBAAoB,CAC7B,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;YAC/C,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAA;gBACxD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,IAAI,SAAS;YAC/B,WAAW;YACX,SAAS;YACT,YAAY,EAAE,iBAAiB;YAC/B,QAAQ;YACR,gBAAgB,EAAE,SAAS;YAC3B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,MAAM,MAAM,GAAmB,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;QAE7F,yEAAyE;QACzE,4EAA4E;QAC5E,oEAAoE;QACpE,2DAA2D;QAC3D,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAA;QACxC,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAA;QACpC,IAAI,YAAY,GAA2B,EAAE,CAAA;QAC7C,IAAI,aAAa,GAAG,EAAE,CAAA;QACtB,IAAI,aAAa,GAAkB,IAAI,CAAA;QAEvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;YACxF,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAA,CAAC,4EAA4E;YAC7G,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,aAAa,CAAC,CAAA;YACtE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;YAC5E,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,MAAM,CAAC,EAAE,CAAA;YAC3B,CAAC;YACD,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YAC7C,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,mBAAmB,IAAI,IAAI,CAAA;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,qCAAsC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,QAAQ,GAA8C;YAC1D,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,2BAA2B;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,aAAa;YAC7B,gBAAgB,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5F,gBAAgB,EAAE,eAAe;YACjC,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;YACzB,aAAa,EAAE,OAAO;YACtB,YAAY;YACZ,mBAAmB,EAAE,aAAa;YAClC,QAAQ;SACT,CAAA;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAA;gBAC7D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YACvC,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAA;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC1D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YACvC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,4BAA4B,CAAC,YAAoB;QAC7D,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,qEAAqE;YACrE,qEAAqE;YACrE,4CAA4C;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QACD,yDAAyD;QACzD,oEAAoE;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;YACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBAC5E,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAA;YACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAChE,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,mBAAmB,EAAE,KAAK;QAC1B,GAAG,EAAE,EAAE;QACP,EAAE,EAAE;YACF,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,IAAI;YAClB,wBAAwB,EAAE,IAAI;YAC9B,WAAW,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;SACnD;QACD,MAAM,EAAE,CAAC,uCAAuC,OAAO,EAAE,CAAC;QAC1D,QAAQ,EAAE,EAAE;KACb,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAiC;IAC7D,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACvE,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,YAAY;QACrC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;YAC3D,MAAM,MAAM,GACV,UAAU,CAAC,MAAM,KAAK,QAAQ;gBAC5B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ;oBAC9B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,YAAY;wBAClC,CAAC,CAAC,YAAY;wBACd,CAAC,CAAC,aAAa,CAAA;YACvB,OAAO,UAAU,CAAC,MAAM;gBACtB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;gBAC9D,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;QACvC,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM;KAChB,CAAA;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;IACpD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAChE,OAAO;QACL,QAAQ,EAAE,eAAe;QACzB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,CAAC,8CAA8C,OAAO,EAAE,CAAC;QACjE,QAAQ,EAAE,EAAE;KACb,CAAA;AACH,CAAC"}
|
package/dist/verify-record.d.ts
CHANGED
|
@@ -12,6 +12,7 @@
|
|
|
12
12
|
* - posture: { timestamp_granularity, timestamp_consistent, ...} (D045 / §8.2 / §8.3 / §8.4)
|
|
13
13
|
* - capability_check: { envelope, in_envelope, mismatches, unresolvable } (D051 / §6.7)
|
|
14
14
|
* - cross_attestation: { signers_count, signers_valid, missing } (D052 / §1.7.6)
|
|
15
|
+
* - evidence: Generic tiered external authorization evidence blocks (D109 / §5.5.6)
|
|
15
16
|
* - ap2_vi_evidence: AP2 receipt + Verifiable Intent evidence result (D094 / §5.5.4)
|
|
16
17
|
*
|
|
17
18
|
* Pending annotations (tracked in DECISIONS.md P005):
|
|
@@ -26,6 +27,7 @@
|
|
|
26
27
|
*/
|
|
27
28
|
import { base64urlDecode, type AtribRecord } from '@atrib/mcp';
|
|
28
29
|
import type { Ap2ViEvidenceBundle, Ap2ViEvidenceVerification, VerifyAp2ViEvidenceOptions } from './ap2-vi-evidence.js';
|
|
30
|
+
import type { AuthorizationEvidenceInput, EvidenceVerificationBlock } from './authorization-evidence.js';
|
|
29
31
|
/**
|
|
30
32
|
* Provenance surfacing for a record carrying `provenance_token` (D044 /
|
|
31
33
|
* spec §1.2.6).
|
|
@@ -101,6 +103,21 @@ export interface CapabilityCheckAnnotation {
|
|
|
101
103
|
*/
|
|
102
104
|
unresolvable: boolean;
|
|
103
105
|
}
|
|
106
|
+
export interface ResolvedCapabilityFacts {
|
|
107
|
+
/**
|
|
108
|
+
* Resolved tool name for a tool_call record. This may come from an
|
|
109
|
+
* attributed record's optional §8.2 `tool_name` field, a caller's local
|
|
110
|
+
* mirror body, or an upstream protocol event that the record commits to.
|
|
111
|
+
*/
|
|
112
|
+
tool_name?: string;
|
|
113
|
+
/** Resolved transaction amount from the committed payment-protocol event. */
|
|
114
|
+
transaction_amount?: {
|
|
115
|
+
currency: string;
|
|
116
|
+
value: number;
|
|
117
|
+
};
|
|
118
|
+
/** Resolved transaction counterparty from the committed payment-protocol event. */
|
|
119
|
+
transaction_counterparty?: string;
|
|
120
|
+
}
|
|
104
121
|
/**
|
|
105
122
|
* Cross-attestation surfacing for a transaction record per spec §1.7.6
|
|
106
123
|
* (D052). atrib's normative minimum is two verified signers per
|
|
@@ -244,6 +261,11 @@ export interface RecordVerificationResult {
|
|
|
244
261
|
* `ap2_vi_evidence.valid` to decide AP2 / VI authorization posture.
|
|
245
262
|
*/
|
|
246
263
|
ap2_vi_evidence?: Ap2ViEvidenceVerification;
|
|
264
|
+
/**
|
|
265
|
+
* Generic tiered external evidence blocks. These do not alter `valid` or
|
|
266
|
+
* `signatureOk`; each block carries its own `valid` bit and findings.
|
|
267
|
+
*/
|
|
268
|
+
evidence?: EvidenceVerificationBlock[];
|
|
247
269
|
warnings: string[];
|
|
248
270
|
}
|
|
249
271
|
/**
|
|
@@ -288,6 +310,18 @@ export interface VerifyRecordOptions {
|
|
|
288
310
|
* NOT depend on @atrib/directory.
|
|
289
311
|
*/
|
|
290
312
|
identityClaim?: ResolvedIdentityClaim;
|
|
313
|
+
/**
|
|
314
|
+
* Caller-supplied facts resolved from the record body or the external
|
|
315
|
+
* protocol event the record commits to. These let capability_check evaluate
|
|
316
|
+
* constraints that are intentionally not present in the compact signed
|
|
317
|
+
* record body, instead of marking them unresolvable.
|
|
318
|
+
*/
|
|
319
|
+
resolvedFacts?: ResolvedCapabilityFacts;
|
|
320
|
+
/**
|
|
321
|
+
* Caller-supplied external authorization evidence. Each block is verified
|
|
322
|
+
* off the atrib record-validity path and attaches to `result.evidence`.
|
|
323
|
+
*/
|
|
324
|
+
authorizationEvidence?: AuthorizationEvidenceInput[];
|
|
291
325
|
/**
|
|
292
326
|
* Caller-supplied AP2 / Verifiable Intent evidence for transaction
|
|
293
327
|
* records. The signed atrib record commits to transaction payload hashes,
|
|
@@ -323,13 +357,11 @@ declare function resolveInformedBy(entries: string[], candidates: AtribRecord[],
|
|
|
323
357
|
* mismatches into `warnings` (which would set `valid: false`); they go
|
|
324
358
|
* into the structured `mismatches[]` field for consumer policy to weigh.
|
|
325
359
|
*
|
|
326
|
-
* For
|
|
327
|
-
*
|
|
328
|
-
*
|
|
329
|
-
* need to provide the resolved amount + counterparty out-of-band, which
|
|
330
|
-
* is a future-API extension if a real consumer needs it.
|
|
360
|
+
* For constraints whose underlying facts are not present in the compact
|
|
361
|
+
* signed record, callers can pass `resolvedFacts`. Missing facts are
|
|
362
|
+
* flagged as `unresolvable` rather than silently passed.
|
|
331
363
|
*/
|
|
332
|
-
declare function resolveCapabilityCheck(record: AtribRecord, claim: ResolvedIdentityClaim, _warnings: string[]): CapabilityCheckAnnotation;
|
|
364
|
+
declare function resolveCapabilityCheck(record: AtribRecord, claim: ResolvedIdentityClaim, facts: ResolvedCapabilityFacts | undefined, _warnings: string[]): CapabilityCheckAnnotation;
|
|
333
365
|
/**
|
|
334
366
|
* Cross-attestation derivation per spec §1.7.6 (D052).
|
|
335
367
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-record.d.ts","sourceRoot":"","sources":["../src/verify-record.ts"],"names":[],"mappings":"AAEA
|
|
1
|
+
{"version":3,"file":"verify-record.d.ts","sourceRoot":"","sources":["../src/verify-record.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,eAAe,EAOf,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAA;AAInB,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,6BAA6B,CAAA;AAUpC;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnC;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAA;IACpB;;;;OAIG;IACH,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD,mFAAmF;IACnF,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAClC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,EAAE,IAAI,GAAG,GAAG,GAAG,KAAK,GAAG,GAAG,GAAG,GAAG,CAAA;IACrD;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,8BAA8B,EAAE,OAAO,CAAA;IACvC;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,GAAG,eAAe,CAAA;IACtD;;;OAGG;IACH,sBAAsB,EAAE,cAAc,GAAG,eAAe,CAAA;IACxD;;;;;;OAMG;IACH,cAAc,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAA;CAC1C;AAUD,MAAM,WAAW,wBAAwB;IACvC,kDAAkD;IAClD,KAAK,EAAE,OAAO,CAAA;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAA;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,oBAAoB,CAAA;IAC7C;;;;OAIG;IACH,OAAO,EAAE,iBAAiB,CAAA;IAC1B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IAC5C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,0BAA0B,CAAA;IAC9C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAA;IAC3C;;;OAGG;IACH,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAA;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAA;IAC/B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAA;IACpC;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAA;IACvC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,EAAE,CAAA;IACpD;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAwGnC;AAqED,iBAAS,iBAAiB,CACxB,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,WAAW,GAAG,SAAS,GACzC,oBAAoB,CAetB;AAED,iBAAS,iBAAiB,CACxB,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,WAAW,EAAE,EACzB,QAAQ,EAAE,MAAM,EAAE,GACjB,oBAAoB,CAuBtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,iBAAS,sBAAsB,CAC7B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAC1C,SAAS,EAAE,MAAM,EAAE,GAClB,yBAAyB,CA+E3B;AAED;;;;;;;;;;;;;;GAcG;AACH,iBAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAuC/F;AAqBD,iBAAS,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAuCjF;AAID,eAAO,MAAM,aAAa;;;;;;;;;;CAUzB,CAAA"}
|
package/dist/verify-record.js
CHANGED
|
@@ -13,6 +13,7 @@
|
|
|
13
13
|
* - posture: { timestamp_granularity, timestamp_consistent, ...} (D045 / §8.2 / §8.3 / §8.4)
|
|
14
14
|
* - capability_check: { envelope, in_envelope, mismatches, unresolvable } (D051 / §6.7)
|
|
15
15
|
* - cross_attestation: { signers_count, signers_valid, missing } (D052 / §1.7.6)
|
|
16
|
+
* - evidence: Generic tiered external authorization evidence blocks (D109 / §5.5.6)
|
|
16
17
|
* - ap2_vi_evidence: AP2 receipt + Verifiable Intent evidence result (D094 / §5.5.4)
|
|
17
18
|
*
|
|
18
19
|
* Pending annotations (tracked in DECISIONS.md P005):
|
|
@@ -28,6 +29,7 @@
|
|
|
28
29
|
import { base64urlDecode, base64urlEncode, canonicalCrossAttestationInput, canonicalRecord, hexEncode, sha256, verifyRecord as verifyRecordSignature, } from '@atrib/mcp';
|
|
29
30
|
import * as ed from '@noble/ed25519';
|
|
30
31
|
import { verifyAp2ViEvidenceAsync } from './ap2-vi-evidence.js';
|
|
32
|
+
import { verifyAuthorizationEvidence } from './authorization-evidence.js';
|
|
31
33
|
const PROVENANCE_TOKEN_PATTERN = /^[A-Za-z0-9_-]{22}$/;
|
|
32
34
|
const SHA256_REF_PATTERN = /^sha256:[0-9a-f]{64}$/;
|
|
33
35
|
// §8.2 hashed tool_name form per D061. The verbatim and opaque-label forms
|
|
@@ -105,7 +107,7 @@ export async function verifyRecord(record, options = {}) {
|
|
|
105
107
|
// resolved identity claim. We do not look up the claim ourselves to
|
|
106
108
|
// avoid coupling @atrib/verify to @atrib/directory's WASM bridge.
|
|
107
109
|
if (options.identityClaim) {
|
|
108
|
-
result.capability_check = resolveCapabilityCheck(record, options.identityClaim, warnings);
|
|
110
|
+
result.capability_check = resolveCapabilityCheck(record, options.identityClaim, options.resolvedFacts, warnings);
|
|
109
111
|
}
|
|
110
112
|
// cross_attestation (D052 / §1.7.6), surface only on transaction records.
|
|
111
113
|
// Other event types continue to use the standard single-signer path.
|
|
@@ -116,15 +118,27 @@ export async function verifyRecord(record, options = {}) {
|
|
|
116
118
|
if (record.event_type === 'https://atrib.dev/v1/types/transaction') {
|
|
117
119
|
try {
|
|
118
120
|
result.ap2_vi_evidence = await verifyAp2ViEvidenceAsync(options.ap2ViEvidence, options.ap2ViEvidenceOptions);
|
|
121
|
+
pushEvidence(result, ap2ViEvidenceToBlock(result.ap2_vi_evidence));
|
|
119
122
|
}
|
|
120
123
|
catch (err) {
|
|
121
124
|
result.ap2_vi_evidence = ap2ViEvidenceErrorResult(err);
|
|
125
|
+
pushEvidence(result, ap2ViEvidenceToBlock(result.ap2_vi_evidence));
|
|
122
126
|
}
|
|
123
127
|
}
|
|
124
128
|
else {
|
|
125
129
|
warnings.push('ap2_vi_evidence supplied for non-transaction record');
|
|
126
130
|
}
|
|
127
131
|
}
|
|
132
|
+
if (options.authorizationEvidence) {
|
|
133
|
+
for (const evidence of options.authorizationEvidence) {
|
|
134
|
+
try {
|
|
135
|
+
pushEvidence(result, await verifyAuthorizationEvidence(evidence));
|
|
136
|
+
}
|
|
137
|
+
catch (err) {
|
|
138
|
+
pushEvidence(result, authorizationEvidenceErrorResult(err));
|
|
139
|
+
}
|
|
140
|
+
}
|
|
141
|
+
}
|
|
128
142
|
result.valid = signatureOk && warnings.length === 0;
|
|
129
143
|
return result;
|
|
130
144
|
}
|
|
@@ -145,6 +159,52 @@ function ap2ViEvidenceErrorResult(err) {
|
|
|
145
159
|
warnings: [],
|
|
146
160
|
};
|
|
147
161
|
}
|
|
162
|
+
function pushEvidence(result, block) {
|
|
163
|
+
if (!result.evidence)
|
|
164
|
+
result.evidence = [];
|
|
165
|
+
result.evidence.push(block);
|
|
166
|
+
}
|
|
167
|
+
function ap2ViEvidenceToBlock(result) {
|
|
168
|
+
return {
|
|
169
|
+
protocol: 'ap2_vi',
|
|
170
|
+
valid: result.valid,
|
|
171
|
+
issuer: null,
|
|
172
|
+
subject: null,
|
|
173
|
+
scope: [],
|
|
174
|
+
attenuation_ok: result.vi.constraints.status === 'passed' ? true : null,
|
|
175
|
+
delegation_ok: result.vi.delegationOk,
|
|
176
|
+
constraints: result.vi.constraints.checks.map((constraint) => {
|
|
177
|
+
const status = constraint.status === 'passed'
|
|
178
|
+
? 'passed'
|
|
179
|
+
: constraint.status === 'failed'
|
|
180
|
+
? 'failed'
|
|
181
|
+
: constraint.status === 'unresolved'
|
|
182
|
+
? 'unresolved'
|
|
183
|
+
: 'not_checked';
|
|
184
|
+
return constraint.reason
|
|
185
|
+
? { type: constraint.type, status, reason: constraint.reason }
|
|
186
|
+
: { type: constraint.type, status };
|
|
187
|
+
}),
|
|
188
|
+
errors: result.errors,
|
|
189
|
+
warnings: result.warnings,
|
|
190
|
+
details: result,
|
|
191
|
+
};
|
|
192
|
+
}
|
|
193
|
+
function authorizationEvidenceErrorResult(err) {
|
|
194
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
195
|
+
return {
|
|
196
|
+
protocol: 'authorization',
|
|
197
|
+
valid: false,
|
|
198
|
+
issuer: null,
|
|
199
|
+
subject: null,
|
|
200
|
+
scope: [],
|
|
201
|
+
attenuation_ok: null,
|
|
202
|
+
delegation_ok: null,
|
|
203
|
+
constraints: [],
|
|
204
|
+
errors: [`authorization_evidence verification error: ${message}`],
|
|
205
|
+
warnings: [],
|
|
206
|
+
};
|
|
207
|
+
}
|
|
148
208
|
function resolveProvenance(token, upstreamCandidate) {
|
|
149
209
|
if (!upstreamCandidate) {
|
|
150
210
|
return { token, upstream_record_hash: null, upstream_resolved: false };
|
|
@@ -194,13 +254,11 @@ function resolveInformedBy(entries, candidates, warnings) {
|
|
|
194
254
|
* mismatches into `warnings` (which would set `valid: false`); they go
|
|
195
255
|
* into the structured `mismatches[]` field for consumer policy to weigh.
|
|
196
256
|
*
|
|
197
|
-
* For
|
|
198
|
-
*
|
|
199
|
-
*
|
|
200
|
-
* need to provide the resolved amount + counterparty out-of-band, which
|
|
201
|
-
* is a future-API extension if a real consumer needs it.
|
|
257
|
+
* For constraints whose underlying facts are not present in the compact
|
|
258
|
+
* signed record, callers can pass `resolvedFacts`. Missing facts are
|
|
259
|
+
* flagged as `unresolvable` rather than silently passed.
|
|
202
260
|
*/
|
|
203
|
-
function resolveCapabilityCheck(record, claim, _warnings) {
|
|
261
|
+
function resolveCapabilityCheck(record, claim, facts, _warnings) {
|
|
204
262
|
const envelope = claim.capabilities ?? null;
|
|
205
263
|
// Empty envelope or absent capabilities field: no constraint declared.
|
|
206
264
|
// Per §6.7.1: "A claim with `capabilities: {}` declares no scope."
|
|
@@ -223,25 +281,45 @@ function resolveCapabilityCheck(record, claim, _warnings) {
|
|
|
223
281
|
}
|
|
224
282
|
}
|
|
225
283
|
// tool_names: per §6.7.2 step 2, only applies to tool_call records and
|
|
226
|
-
// requires
|
|
227
|
-
//
|
|
228
|
-
// present, which is a hash of serverUrl + toolName). Without tool_name
|
|
229
|
-
// we can't check this constraint. Mark unresolvable.
|
|
284
|
+
// requires a resolved tool_name. The field may be present on the record
|
|
285
|
+
// under §8.2 or supplied by the caller from local body material.
|
|
230
286
|
if (Array.isArray(envelope.tool_names) && envelope.tool_names.length > 0) {
|
|
231
287
|
if (record.event_type === 'https://atrib.dev/v1/types/tool_call') {
|
|
232
|
-
|
|
288
|
+
const toolName = facts?.tool_name ?? record.tool_name;
|
|
289
|
+
if (typeof toolName === 'string' && toolName.length > 0) {
|
|
290
|
+
if (!envelope.tool_names.includes(toolName)) {
|
|
291
|
+
mismatches.push(`tool_name '${toolName}' not in allowlist`);
|
|
292
|
+
}
|
|
293
|
+
}
|
|
294
|
+
else {
|
|
295
|
+
unresolvable = true;
|
|
296
|
+
}
|
|
233
297
|
}
|
|
234
298
|
}
|
|
235
|
-
// max_amount + counterparties: per §6.7.2 the verifier
|
|
236
|
-
//
|
|
237
|
-
//
|
|
238
|
-
// have access to the payment-protocol event; flag as unresolvable.
|
|
239
|
-
// Future API extension: accept resolved amount + counterparty as
|
|
240
|
-
// VerifyRecordOptions inputs if a real consumer needs it.
|
|
299
|
+
// max_amount + counterparties: per §6.7.2 the verifier uses the
|
|
300
|
+
// protocol-specific transaction event the record commits to. The caller
|
|
301
|
+
// supplies those resolved facts when available.
|
|
241
302
|
if (record.event_type === 'https://atrib.dev/v1/types/transaction') {
|
|
242
|
-
if (envelope.max_amount
|
|
243
|
-
|
|
244
|
-
|
|
303
|
+
if (envelope.max_amount) {
|
|
304
|
+
const amount = facts?.transaction_amount;
|
|
305
|
+
if (!amount) {
|
|
306
|
+
unresolvable = true;
|
|
307
|
+
}
|
|
308
|
+
else if (amount.currency !== envelope.max_amount.currency) {
|
|
309
|
+
mismatches.push(`transaction currency '${amount.currency}' does not match envelope currency '${envelope.max_amount.currency}'`);
|
|
310
|
+
}
|
|
311
|
+
else if (amount.value > envelope.max_amount.value) {
|
|
312
|
+
mismatches.push(`transaction amount ${amount.value} exceeds envelope max ${envelope.max_amount.value}`);
|
|
313
|
+
}
|
|
314
|
+
}
|
|
315
|
+
if (Array.isArray(envelope.counterparties) && envelope.counterparties.length > 0) {
|
|
316
|
+
const counterparty = facts?.transaction_counterparty;
|
|
317
|
+
if (!counterparty) {
|
|
318
|
+
unresolvable = true;
|
|
319
|
+
}
|
|
320
|
+
else if (!envelope.counterparties.includes(counterparty)) {
|
|
321
|
+
mismatches.push(`counterparty '${counterparty}' not in allowlist`);
|
|
322
|
+
}
|
|
245
323
|
}
|
|
246
324
|
}
|
|
247
325
|
return {
|