@atrib/verify 0.5.2 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +104 -1
- package/dist/authorization-evidence.d.ts +155 -0
- package/dist/authorization-evidence.d.ts.map +1 -0
- package/dist/authorization-evidence.js +423 -0
- package/dist/authorization-evidence.js.map +1 -0
- package/dist/dpop-replay-cache.d.ts +55 -0
- package/dist/dpop-replay-cache.d.ts.map +1 -0
- package/dist/dpop-replay-cache.js +95 -0
- package/dist/dpop-replay-cache.js.map +1 -0
- package/dist/index.d.ts +7 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -0
- package/dist/index.js.map +1 -1
- package/dist/oauth-introspection.d.ts +38 -0
- package/dist/oauth-introspection.d.ts.map +1 -0
- package/dist/oauth-introspection.js +118 -0
- package/dist/oauth-introspection.js.map +1 -0
- package/dist/types.d.ts +6 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/dist/verifier.d.ts +6 -0
- package/dist/verifier.d.ts.map +1 -1
- package/dist/verifier.js +55 -0
- package/dist/verifier.js.map +1 -1
- package/dist/verify-record.d.ts +38 -6
- package/dist/verify-record.d.ts.map +1 -1
- package/dist/verify-record.js +99 -21
- package/dist/verify-record.js.map +1 -1
- package/package.json +3 -3
package/dist/index.js
CHANGED
|
@@ -6,6 +6,10 @@ export { AtribVerifier } from './verifier.js';
|
|
|
6
6
|
// AtribVerifier.verify which operates on a settlement RecommendationDocument.
|
|
7
7
|
// Surfaces the implemented D044, D041, D045, D051, D052, and D094 annotations.
|
|
8
8
|
export { verifyRecord } from './verify-record.js';
|
|
9
|
+
// Generic external authorization evidence checks. Off the atrib record-validity path.
|
|
10
|
+
export { verifyAuthorizationEvidence, verifyOAuthAuthorizationEvidence, } from './authorization-evidence.js';
|
|
11
|
+
export { FetchDpopReplayCache, MemoryDpopReplayCache, createFetchDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
|
|
12
|
+
export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './oauth-introspection.js';
|
|
9
13
|
// Cross-agent handoff claim verification. Used when one agent receives a
|
|
10
14
|
// record_hash claim plus private body material from another agent and must
|
|
11
15
|
// decide whether to link its next record through informed_by.
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAQ/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
import type { OAuthAuthorizationEvidenceInput, OAuthTokenIntrospectionResponse } from './authorization-evidence.js';
|
|
2
|
+
export type OAuthIntrospectionClientAuthentication = {
|
|
3
|
+
method: 'none';
|
|
4
|
+
} | {
|
|
5
|
+
method: 'basic';
|
|
6
|
+
clientId: string;
|
|
7
|
+
clientSecret: string;
|
|
8
|
+
} | {
|
|
9
|
+
method: 'bearer';
|
|
10
|
+
token: string;
|
|
11
|
+
} | {
|
|
12
|
+
method: 'headers';
|
|
13
|
+
headers: Record<string, string>;
|
|
14
|
+
};
|
|
15
|
+
export interface OAuthIntrospectionOptions {
|
|
16
|
+
endpoint: string;
|
|
17
|
+
token: string;
|
|
18
|
+
tokenTypeHint?: string;
|
|
19
|
+
clientAuthentication?: OAuthIntrospectionClientAuthentication;
|
|
20
|
+
extraParams?: Record<string, string>;
|
|
21
|
+
expectedIssuer?: string;
|
|
22
|
+
expectedAudience?: string | string[];
|
|
23
|
+
expectedResource?: string;
|
|
24
|
+
timeoutMs?: number;
|
|
25
|
+
signal?: AbortSignal;
|
|
26
|
+
fetchImpl?: typeof fetch;
|
|
27
|
+
}
|
|
28
|
+
export interface OAuthIntrospectionResult {
|
|
29
|
+
ok: boolean;
|
|
30
|
+
endpoint: string;
|
|
31
|
+
introspection?: OAuthTokenIntrospectionResponse;
|
|
32
|
+
introspectionVerified: boolean;
|
|
33
|
+
errors: string[];
|
|
34
|
+
warnings: string[];
|
|
35
|
+
}
|
|
36
|
+
export declare function introspectOAuthToken(options: OAuthIntrospectionOptions): Promise<OAuthIntrospectionResult>;
|
|
37
|
+
export declare function oauthEvidenceFromIntrospectionResult(introspection: OAuthIntrospectionResult, base?: Omit<OAuthAuthorizationEvidenceInput, 'introspection' | 'introspectionVerified'>): OAuthAuthorizationEvidenceInput;
|
|
38
|
+
//# sourceMappingURL=oauth-introspection.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth-introspection.d.ts","sourceRoot":"","sources":["../src/oauth-introspection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,+BAA+B,EAC/B,+BAA+B,EAChC,MAAM,6BAA6B,CAAA;AAEpC,MAAM,MAAM,sCAAsC,GAC9C;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,sCAAsC,CAAA;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,+BAA+B,CAAA;IAC/C,qBAAqB,EAAE,OAAO,CAAA;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAiDnC;AAED,wBAAgB,oCAAoC,CAClD,aAAa,EAAE,wBAAwB,EACvC,IAAI,GAAE,IAAI,CAAC,+BAA+B,EAAE,eAAe,GAAG,uBAAuB,CAAM,GAC1F,+BAA+B,CASjC"}
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
+
export async function introspectOAuthToken(options) {
|
|
3
|
+
const errors = [];
|
|
4
|
+
const warnings = [];
|
|
5
|
+
const fetchImpl = options.fetchImpl ?? fetch;
|
|
6
|
+
const body = new URLSearchParams();
|
|
7
|
+
body.set('token', options.token);
|
|
8
|
+
if (options.tokenTypeHint)
|
|
9
|
+
body.set('token_type_hint', options.tokenTypeHint);
|
|
10
|
+
for (const [key, value] of Object.entries(options.extraParams ?? {})) {
|
|
11
|
+
if (key === 'token')
|
|
12
|
+
continue;
|
|
13
|
+
body.set(key, value);
|
|
14
|
+
}
|
|
15
|
+
const headers = {
|
|
16
|
+
accept: 'application/json',
|
|
17
|
+
'content-type': 'application/x-www-form-urlencoded',
|
|
18
|
+
};
|
|
19
|
+
applyClientAuthentication(headers, options.clientAuthentication);
|
|
20
|
+
const ctrl = options.signal ? undefined : new AbortController();
|
|
21
|
+
const timer = ctrl && options.timeoutMs !== undefined
|
|
22
|
+
? setTimeout(() => ctrl.abort(), options.timeoutMs)
|
|
23
|
+
: undefined;
|
|
24
|
+
try {
|
|
25
|
+
const requestInit = {
|
|
26
|
+
method: 'POST',
|
|
27
|
+
headers,
|
|
28
|
+
body,
|
|
29
|
+
...(options.signal || ctrl?.signal ? { signal: options.signal ?? ctrl?.signal ?? null } : {}),
|
|
30
|
+
};
|
|
31
|
+
const response = await fetchImpl(options.endpoint, requestInit);
|
|
32
|
+
if (!response.ok) {
|
|
33
|
+
errors.push(`introspection endpoint returned ${response.status}`);
|
|
34
|
+
return result(options.endpoint, undefined, errors, warnings);
|
|
35
|
+
}
|
|
36
|
+
const parsed = (await response.json());
|
|
37
|
+
if (!isIntrospectionResponse(parsed)) {
|
|
38
|
+
errors.push('introspection response missing boolean active field');
|
|
39
|
+
return result(options.endpoint, undefined, errors, warnings);
|
|
40
|
+
}
|
|
41
|
+
validateExpectedClaims(parsed, options, errors);
|
|
42
|
+
return result(options.endpoint, parsed, errors, warnings);
|
|
43
|
+
}
|
|
44
|
+
catch (err) {
|
|
45
|
+
errors.push(`introspection request failed: ${err instanceof Error ? err.message : String(err)}`);
|
|
46
|
+
return result(options.endpoint, undefined, errors, warnings);
|
|
47
|
+
}
|
|
48
|
+
finally {
|
|
49
|
+
if (timer !== undefined)
|
|
50
|
+
clearTimeout(timer);
|
|
51
|
+
}
|
|
52
|
+
}
|
|
53
|
+
export function oauthEvidenceFromIntrospectionResult(introspection, base = {}) {
|
|
54
|
+
if (!introspection.introspection) {
|
|
55
|
+
throw new Error('introspection result has no response body');
|
|
56
|
+
}
|
|
57
|
+
return {
|
|
58
|
+
...base,
|
|
59
|
+
introspection: introspection.introspection,
|
|
60
|
+
introspectionVerified: introspection.introspectionVerified,
|
|
61
|
+
};
|
|
62
|
+
}
|
|
63
|
+
function applyClientAuthentication(headers, authentication) {
|
|
64
|
+
if (!authentication || authentication.method === 'none')
|
|
65
|
+
return;
|
|
66
|
+
if (authentication.method === 'basic') {
|
|
67
|
+
headers.authorization = `Basic ${Buffer.from(`${authentication.clientId}:${authentication.clientSecret}`).toString('base64')}`;
|
|
68
|
+
return;
|
|
69
|
+
}
|
|
70
|
+
if (authentication.method === 'bearer') {
|
|
71
|
+
headers.authorization = `Bearer ${authentication.token}`;
|
|
72
|
+
return;
|
|
73
|
+
}
|
|
74
|
+
for (const [key, value] of Object.entries(authentication.headers)) {
|
|
75
|
+
headers[key.toLowerCase()] = value;
|
|
76
|
+
}
|
|
77
|
+
}
|
|
78
|
+
function validateExpectedClaims(response, options, errors) {
|
|
79
|
+
if (options.expectedIssuer && response.iss !== options.expectedIssuer) {
|
|
80
|
+
errors.push('introspection issuer mismatch');
|
|
81
|
+
}
|
|
82
|
+
const expectedAudience = asArray(options.expectedAudience);
|
|
83
|
+
if (expectedAudience.length > 0) {
|
|
84
|
+
const actualAudience = asArray(response.aud);
|
|
85
|
+
const missing = expectedAudience.filter((entry) => !actualAudience.includes(entry));
|
|
86
|
+
if (missing.length > 0)
|
|
87
|
+
errors.push(`introspection audience missing: ${missing.join(', ')}`);
|
|
88
|
+
}
|
|
89
|
+
if (options.expectedResource) {
|
|
90
|
+
const actualResources = asArray(response.resource);
|
|
91
|
+
if (!actualResources.includes(options.expectedResource)) {
|
|
92
|
+
errors.push('introspection resource mismatch');
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
function result(endpoint, introspection, errors, warnings) {
|
|
97
|
+
return {
|
|
98
|
+
ok: introspection !== undefined && errors.length === 0,
|
|
99
|
+
endpoint,
|
|
100
|
+
...(introspection ? { introspection } : {}),
|
|
101
|
+
introspectionVerified: introspection !== undefined && errors.length === 0,
|
|
102
|
+
errors,
|
|
103
|
+
warnings,
|
|
104
|
+
};
|
|
105
|
+
}
|
|
106
|
+
function isIntrospectionResponse(value) {
|
|
107
|
+
return value !== null && typeof value === 'object' && !Array.isArray(value) && 'active' in value
|
|
108
|
+
? typeof value.active === 'boolean'
|
|
109
|
+
: false;
|
|
110
|
+
}
|
|
111
|
+
function asArray(value) {
|
|
112
|
+
if (typeof value === 'string')
|
|
113
|
+
return [value];
|
|
114
|
+
if (Array.isArray(value))
|
|
115
|
+
return value.filter((entry) => typeof entry === 'string');
|
|
116
|
+
return [];
|
|
117
|
+
}
|
|
118
|
+
//# sourceMappingURL=oauth-introspection.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth-introspection.js","sourceRoot":"","sources":["../src/oauth-introspection.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAoCtC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAkC;IAElC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,OAAO,CAAC,aAAa;QAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,GAAG,KAAK,OAAO;YAAE,SAAQ;QAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACtB,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,cAAc,EAAE,mCAAmC;KACpD,CAAA;IACD,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAA;IAC/D,MAAM,KAAK,GACT,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,SAAS,CAAA;IAEf,IAAI,CAAC;QACH,MAAM,WAAW,GAAgB;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;YACJ,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YACjE,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;QACjD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;YAClE,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QACD,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChG,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC9D,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,aAAuC,EACvC,OAAyF,EAAE;IAE3F,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;KAC3D,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA+B,EAC/B,cAAkE;IAElE,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,MAAM;QAAE,OAAM;IAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAC1C,GAAG,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,YAAY,EAAE,CAC5D,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QACtB,OAAM;IACR,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,aAAa,GAAG,UAAU,cAAc,CAAC,KAAK,EAAE,CAAA;QACxD,OAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAA;IACpC,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAyC,EACzC,OAAkC,EAClC,MAAgB;IAEhB,IAAI,OAAO,CAAC,cAAc,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC1D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACnF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,QAAgB,EAChB,aAA0D,EAC1D,MAAgB,EAChB,QAAkB;IAElB,OAAO;QACL,EAAE,EAAE,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACtD,QAAQ;QACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,qBAAqB,EAAE,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACzE,MAAM;QACN,QAAQ;KACT,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,IAAI,KAAK;QAC9F,CAAC,CAAC,OAAQ,KAA8B,CAAC,MAAM,KAAK,SAAS;QAC7D,CAAC,CAAC,KAAK,CAAA;AACX,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;IAC5E,OAAO,EAAE,CAAA;AACX,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -5,6 +5,7 @@
|
|
|
5
5
|
* Mirrors §3.5 (graph response schema) and §4.7 (recommendation document).
|
|
6
6
|
*/
|
|
7
7
|
import type { Ap2ViEvidenceVerification } from './ap2-vi-evidence.js';
|
|
8
|
+
import type { EvidenceVerificationBlock } from './authorization-evidence.js';
|
|
8
9
|
/**
|
|
9
10
|
* Graph-layer event_type. Short labels for the three primitives the v1
|
|
10
11
|
* graph + calculation algorithm operate on, plus the catch-all `extension`
|
|
@@ -251,5 +252,10 @@ export interface VerificationResult {
|
|
|
251
252
|
* settlement recommendation signature or calculation checks.
|
|
252
253
|
*/
|
|
253
254
|
ap2_vi_evidence?: Ap2ViEvidenceVerification;
|
|
255
|
+
/**
|
|
256
|
+
* Generic tiered external evidence blocks. These do not alter
|
|
257
|
+
* recommendation signature or calculation checks.
|
|
258
|
+
*/
|
|
259
|
+
evidence?: EvidenceVerificationBlock[];
|
|
254
260
|
}
|
|
255
261
|
//# sourceMappingURL=types.d.ts.map
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAM5E;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GACjB,WAAW,GACX,aAAa,GACb,aAAa,GACb,kBAAkB,GAClB,YAAY,GACZ,UAAU,GACV,UAAU,GACV,eAAe,GACf,WAAW,CAAA;AAEf;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAiBjE;AAED,0FAA0F;AAC1F,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,KAAK,CAAA;CACd;AAED,MAAM,MAAM,QAAQ,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,aAAa,GACb,eAAe,GACf,WAAW,GACX,SAAS,CAAA;AAEb,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,iBAAiB,GACjB,eAAe,GACf,WAAW;AACb;;;;;;;GAOG;GACD,0BAA0B,CAAA;AAE9B,MAAM,MAAM,eAAe;AACzB;;;GAGG;AACD,UAAU;AACZ;;;GAGG;GACD,SAAS;AACX;;;;GAIG;GACD,YAAY,CAAA;AAEhB,gDAAgD;AAChD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,SAAS,CAAA;IACrB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,UAAU,EAAE,OAAO,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAA;IAClC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IACvC,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,iDAAiD;AACjD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,eAAe,CAAA;IAClC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IACvC,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,WAAW,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,KAAK,EAAE,SAAS,EAAE,CAAA;CACnB;AAMD,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,OAAO,GAAG,UAAU,CAAA;AAEtE,MAAM,WAAW,WAAW;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAA;AAE5C,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,WAAW,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;IACzC,YAAY,CAAC,EAAE,WAAW,CAAA;IAC1B,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,WAAW,CAAC,EAAE,iBAAiB,CAAA;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE;QACZ,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,YAAY,GAAG,cAAc,GAAG,oBAAoB,GAAG,WAAW,CAAA;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAA;CAC3C;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,WAAW,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,kBAAkB,EAAE,CAAA;IACtC,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACvC,CAAA;IACD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAMD,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEjD,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,WAAW,CAAA;IACzB,aAAa,EAAE,2BAA2B,CAAA;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;IACxB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,YAAY,CAAA;IAC1B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAA;IAC3C;;;OAGG;IACH,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAA;CACvC"}
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAwCtC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,sCAAsC;YACzC,OAAO,WAAW,CAAA;QACpB,KAAK,wCAAwC;YAC3C,OAAO,aAAa,CAAA;QACtB,KAAK,wCAAwC;YAC3C,OAAO,aAAa,CAAA;QACtB,KAAK,6CAA6C;YAChD,OAAO,kBAAkB,CAAA;QAC3B,KAAK,uCAAuC;YAC1C,OAAO,YAAY,CAAA;QACrB,KAAK,qCAAqC;YACxC,OAAO,UAAU,CAAA;QACnB;YACE,OAAO,WAAW,CAAA;IACtB,CAAC;AACH,CAAC"}
|
package/dist/verifier.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { Ap2ViEvidenceBundle, VerifyAp2ViEvidenceOptions } from './ap2-vi-evidence.js';
|
|
2
|
+
import type { AuthorizationEvidenceInput } from './authorization-evidence.js';
|
|
2
3
|
import type { PolicyDocument, RecommendationDocument, VerificationResult } from './types.js';
|
|
3
4
|
/** Init options for AtribVerifier (§5.5.1). */
|
|
4
5
|
export interface AtribVerifierOptions {
|
|
@@ -29,6 +30,11 @@ export interface VerifyRecommendationOptions {
|
|
|
29
30
|
ap2ViEvidence?: Ap2ViEvidenceBundle;
|
|
30
31
|
/** Options passed through to `verifyAp2ViEvidenceAsync()`. */
|
|
31
32
|
ap2ViEvidenceOptions?: VerifyAp2ViEvidenceOptions;
|
|
33
|
+
/**
|
|
34
|
+
* Generic external authorization evidence. Each block is tiered and does
|
|
35
|
+
* not change recommendation validity.
|
|
36
|
+
*/
|
|
37
|
+
authorizationEvidence?: AuthorizationEvidenceInput[];
|
|
32
38
|
}
|
|
33
39
|
export declare class AtribVerifier {
|
|
34
40
|
private readonly logEndpoint;
|
package/dist/verifier.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,mBAAmB,EAEnB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EACV,0BAA0B,EAG3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EAEtB,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAMnB,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,MAAM,EAAE,cAAc,GAAG,SAAS,CAAA;IAClC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,UAAU,CAAA;IACrB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,mEAAmE;AACnE,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,EAAE,CAAA;CACrD;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAmB;gBAE1C,OAAO,GAAE,oBAAyB;IAsB9C;;;;;;;;;;OAUG;IACG,MAAM,CACV,GAAG,EAAE,sBAAsB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,kBAAkB,CAAC;IA2F9B;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2D3E;;;;;;OAMG;YACW,4BAA4B;CAuB3C"}
|
package/dist/verifier.js
CHANGED
|
@@ -13,6 +13,7 @@ import { calculate, DEFAULT_POLICY } from './calculate.js';
|
|
|
13
13
|
import { fetchGraph, fetchSessionPolicyRecord, fetchPolicyDocument } from './graph-fetch.js';
|
|
14
14
|
import { signRecommendation, verifyRecommendationSignature, distributionsMatch, } from './recommendation.js';
|
|
15
15
|
import { verifyAp2ViEvidenceAsync } from './ap2-vi-evidence.js';
|
|
16
|
+
import { verifyAuthorizationEvidence } from './authorization-evidence.js';
|
|
16
17
|
const DEFAULT_LOG_ENDPOINT = 'https://log.atrib.dev/v1';
|
|
17
18
|
const DEFAULT_GRAPH_ENDPOINT = 'https://graph.atrib.dev/v1';
|
|
18
19
|
const DEFAULT_RESOLVE_ENDPOINT = 'https://resolve.atrib.dev/v1';
|
|
@@ -60,6 +61,7 @@ export class AtribVerifier {
|
|
|
60
61
|
let localDistribution = doc.distribution;
|
|
61
62
|
let nodeCount = 0;
|
|
62
63
|
let ap2ViEvidence;
|
|
64
|
+
const evidence = [];
|
|
63
65
|
// Step 1: signature
|
|
64
66
|
try {
|
|
65
67
|
const pubKey = await this.resolveCalculatedByPublicKey(doc.calculated_by);
|
|
@@ -113,6 +115,17 @@ export class AtribVerifier {
|
|
|
113
115
|
catch (err) {
|
|
114
116
|
ap2ViEvidence = ap2ViEvidenceErrorResult(err);
|
|
115
117
|
}
|
|
118
|
+
evidence.push(ap2ViEvidenceToBlock(ap2ViEvidence));
|
|
119
|
+
}
|
|
120
|
+
if (options.authorizationEvidence) {
|
|
121
|
+
for (const item of options.authorizationEvidence) {
|
|
122
|
+
try {
|
|
123
|
+
evidence.push(await verifyAuthorizationEvidence(item));
|
|
124
|
+
}
|
|
125
|
+
catch (err) {
|
|
126
|
+
evidence.push(authorizationEvidenceErrorResult(err));
|
|
127
|
+
}
|
|
128
|
+
}
|
|
116
129
|
}
|
|
117
130
|
return {
|
|
118
131
|
valid: signatureOk && calcMatch,
|
|
@@ -122,6 +135,7 @@ export class AtribVerifier {
|
|
|
122
135
|
warnings,
|
|
123
136
|
graph_node_count: nodeCount,
|
|
124
137
|
...(ap2ViEvidence ? { ap2_vi_evidence: ap2ViEvidence } : {}),
|
|
138
|
+
...(evidence.length > 0 ? { evidence } : {}),
|
|
125
139
|
};
|
|
126
140
|
}
|
|
127
141
|
/**
|
|
@@ -238,4 +252,45 @@ function ap2ViEvidenceErrorResult(err) {
|
|
|
238
252
|
warnings: [],
|
|
239
253
|
};
|
|
240
254
|
}
|
|
255
|
+
function ap2ViEvidenceToBlock(result) {
|
|
256
|
+
return {
|
|
257
|
+
protocol: 'ap2_vi',
|
|
258
|
+
valid: result.valid,
|
|
259
|
+
issuer: null,
|
|
260
|
+
subject: null,
|
|
261
|
+
scope: [],
|
|
262
|
+
attenuation_ok: result.vi.constraints.status === 'passed' ? true : null,
|
|
263
|
+
delegation_ok: result.vi.delegationOk,
|
|
264
|
+
constraints: result.vi.constraints.checks.map((constraint) => {
|
|
265
|
+
const status = constraint.status === 'passed'
|
|
266
|
+
? 'passed'
|
|
267
|
+
: constraint.status === 'failed'
|
|
268
|
+
? 'failed'
|
|
269
|
+
: constraint.status === 'unresolved'
|
|
270
|
+
? 'unresolved'
|
|
271
|
+
: 'not_checked';
|
|
272
|
+
return constraint.reason
|
|
273
|
+
? { type: constraint.type, status, reason: constraint.reason }
|
|
274
|
+
: { type: constraint.type, status };
|
|
275
|
+
}),
|
|
276
|
+
errors: result.errors,
|
|
277
|
+
warnings: result.warnings,
|
|
278
|
+
details: result,
|
|
279
|
+
};
|
|
280
|
+
}
|
|
281
|
+
function authorizationEvidenceErrorResult(err) {
|
|
282
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
283
|
+
return {
|
|
284
|
+
protocol: 'authorization',
|
|
285
|
+
valid: false,
|
|
286
|
+
issuer: null,
|
|
287
|
+
subject: null,
|
|
288
|
+
scope: [],
|
|
289
|
+
attenuation_ok: null,
|
|
290
|
+
delegation_ok: null,
|
|
291
|
+
constraints: [],
|
|
292
|
+
errors: [`authorization_evidence verification error: ${message}`],
|
|
293
|
+
warnings: [],
|
|
294
|
+
};
|
|
295
|
+
}
|
|
241
296
|
//# sourceMappingURL=verifier.js.map
|
package/dist/verifier.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAkBzE,MAAM,oBAAoB,GAAG,0BAA0B,CAAA;AACvD,MAAM,sBAAsB,GAAG,4BAA4B,CAAA;AAC3D,MAAM,wBAAwB,GAAG,8BAA8B,CAAA;AAwC/D,MAAM,OAAO,aAAa;IACP,WAAW,CAAQ;IACnB,aAAa,CAAQ;IACrB,kBAAkB,CAAmB;IAEtD,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAA;QAC9D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAA;QACpE,yDAAyD;QACzD,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC,CAAA;QAE1D,IAAI,GAAG,GAAsB,IAAI,CAAA;QACjC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBACpD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBAC1B,GAAG,GAAG,OAAO,CAAA;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;gBACvF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAA;IAC/B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CACV,GAA2B,EAC3B,UAAuC,EAAE;QAEzC,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,IAAI,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAA;QACxC,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,IAAI,aAAoD,CAAA;QACxD,MAAM,QAAQ,GAAgC,EAAE,CAAA;QAEhD,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,aAAa,EAAE,CAAC,CAAA;YACvF,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBAC9D,IAAI,CAAC,WAAW;oBAAE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,CAAA;YACvF,SAAS,GAAG,KAAK,CAAC,UAAU,CAAA;YAE5B,IAAI,YAAY,GAA+B,IAAI,CAAA;YACnD,IAAI,MAAM,GAAmB,cAAc,CAAA;YAC3C,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAA;oBACvF,IAAI,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;wBAC3E,IAAI,CAAC;4BACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAA;wBAChE,CAAC;wBAAC,MAAM,CAAC;4BACP,QAAQ,CAAC,IAAI,CACX,iCAAiC,YAAY,CAAC,aAAa,2BAA2B,CACvF,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,CAAC,IAAI,CACX,yCAAyC,GAAG,CAAC,gBAAgB,2BAA2B,CACzF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,iBAAiB,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;YAC1D,SAAS,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAC3E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,qCAAsC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,wBAAwB,CAC5C,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,oBAAoB,CAC7B,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;YAC/C,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAA;gBACxD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,IAAI,SAAS;YAC/B,WAAW;YACX,SAAS;YACT,YAAY,EAAE,iBAAiB;YAC/B,QAAQ;YACR,gBAAgB,EAAE,SAAS;YAC3B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,MAAM,MAAM,GAAmB,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;QAE7F,yEAAyE;QACzE,4EAA4E;QAC5E,oEAAoE;QACpE,2DAA2D;QAC3D,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAA;QACxC,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAA;QACpC,IAAI,YAAY,GAA2B,EAAE,CAAA;QAC7C,IAAI,aAAa,GAAG,EAAE,CAAA;QACtB,IAAI,aAAa,GAAkB,IAAI,CAAA;QAEvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;YACxF,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAA,CAAC,4EAA4E;YAC7G,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,aAAa,CAAC,CAAA;YACtE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;YAC5E,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,MAAM,CAAC,EAAE,CAAA;YAC3B,CAAC;YACD,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YAC7C,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,mBAAmB,IAAI,IAAI,CAAA;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,qCAAsC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,QAAQ,GAA8C;YAC1D,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,2BAA2B;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,aAAa;YAC7B,gBAAgB,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5F,gBAAgB,EAAE,eAAe;YACjC,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;YACzB,aAAa,EAAE,OAAO;YACtB,YAAY;YACZ,mBAAmB,EAAE,aAAa;YAClC,QAAQ;SACT,CAAA;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAA;gBAC7D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YACvC,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAA;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC1D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;YACvC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,4BAA4B,CAAC,YAAoB;QAC7D,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,qEAAqE;YACrE,qEAAqE;YACrE,4CAA4C;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QACD,yDAAyD;QACzD,oEAAoE;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;YACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBAC5E,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAA;YACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAChE,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,mBAAmB,EAAE,KAAK;QAC1B,GAAG,EAAE,EAAE;QACP,EAAE,EAAE;YACF,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,IAAI;YAClB,wBAAwB,EAAE,IAAI;YAC9B,WAAW,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;SACnD;QACD,MAAM,EAAE,CAAC,uCAAuC,OAAO,EAAE,CAAC;QAC1D,QAAQ,EAAE,EAAE;KACb,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAiC;IAC7D,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACvE,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,YAAY;QACrC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;YAC3D,MAAM,MAAM,GACV,UAAU,CAAC,MAAM,KAAK,QAAQ;gBAC5B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ;oBAC9B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,YAAY;wBAClC,CAAC,CAAC,YAAY;wBACd,CAAC,CAAC,aAAa,CAAA;YACvB,OAAO,UAAU,CAAC,MAAM;gBACtB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;gBAC9D,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;QACvC,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM;KAChB,CAAA;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;IACpD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAChE,OAAO;QACL,QAAQ,EAAE,eAAe;QACzB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,CAAC,8CAA8C,OAAO,EAAE,CAAC;QACjE,QAAQ,EAAE,EAAE;KACb,CAAA;AACH,CAAC"}
|
package/dist/verify-record.d.ts
CHANGED
|
@@ -12,6 +12,7 @@
|
|
|
12
12
|
* - posture: { timestamp_granularity, timestamp_consistent, ...} (D045 / §8.2 / §8.3 / §8.4)
|
|
13
13
|
* - capability_check: { envelope, in_envelope, mismatches, unresolvable } (D051 / §6.7)
|
|
14
14
|
* - cross_attestation: { signers_count, signers_valid, missing } (D052 / §1.7.6)
|
|
15
|
+
* - evidence: Generic tiered external authorization evidence blocks (D109 / §5.5.6)
|
|
15
16
|
* - ap2_vi_evidence: AP2 receipt + Verifiable Intent evidence result (D094 / §5.5.4)
|
|
16
17
|
*
|
|
17
18
|
* Pending annotations (tracked in DECISIONS.md P005):
|
|
@@ -26,6 +27,7 @@
|
|
|
26
27
|
*/
|
|
27
28
|
import { base64urlDecode, type AtribRecord } from '@atrib/mcp';
|
|
28
29
|
import type { Ap2ViEvidenceBundle, Ap2ViEvidenceVerification, VerifyAp2ViEvidenceOptions } from './ap2-vi-evidence.js';
|
|
30
|
+
import type { AuthorizationEvidenceInput, EvidenceVerificationBlock } from './authorization-evidence.js';
|
|
29
31
|
/**
|
|
30
32
|
* Provenance surfacing for a record carrying `provenance_token` (D044 /
|
|
31
33
|
* spec §1.2.6).
|
|
@@ -101,6 +103,21 @@ export interface CapabilityCheckAnnotation {
|
|
|
101
103
|
*/
|
|
102
104
|
unresolvable: boolean;
|
|
103
105
|
}
|
|
106
|
+
export interface ResolvedCapabilityFacts {
|
|
107
|
+
/**
|
|
108
|
+
* Resolved tool name for a tool_call record. This may come from an
|
|
109
|
+
* attributed record's optional §8.2 `tool_name` field, a caller's local
|
|
110
|
+
* mirror body, or an upstream protocol event that the record commits to.
|
|
111
|
+
*/
|
|
112
|
+
tool_name?: string;
|
|
113
|
+
/** Resolved transaction amount from the committed payment-protocol event. */
|
|
114
|
+
transaction_amount?: {
|
|
115
|
+
currency: string;
|
|
116
|
+
value: number;
|
|
117
|
+
};
|
|
118
|
+
/** Resolved transaction counterparty from the committed payment-protocol event. */
|
|
119
|
+
transaction_counterparty?: string;
|
|
120
|
+
}
|
|
104
121
|
/**
|
|
105
122
|
* Cross-attestation surfacing for a transaction record per spec §1.7.6
|
|
106
123
|
* (D052). atrib's normative minimum is two verified signers per
|
|
@@ -244,6 +261,11 @@ export interface RecordVerificationResult {
|
|
|
244
261
|
* `ap2_vi_evidence.valid` to decide AP2 / VI authorization posture.
|
|
245
262
|
*/
|
|
246
263
|
ap2_vi_evidence?: Ap2ViEvidenceVerification;
|
|
264
|
+
/**
|
|
265
|
+
* Generic tiered external evidence blocks. These do not alter `valid` or
|
|
266
|
+
* `signatureOk`; each block carries its own `valid` bit and findings.
|
|
267
|
+
*/
|
|
268
|
+
evidence?: EvidenceVerificationBlock[];
|
|
247
269
|
warnings: string[];
|
|
248
270
|
}
|
|
249
271
|
/**
|
|
@@ -288,6 +310,18 @@ export interface VerifyRecordOptions {
|
|
|
288
310
|
* NOT depend on @atrib/directory.
|
|
289
311
|
*/
|
|
290
312
|
identityClaim?: ResolvedIdentityClaim;
|
|
313
|
+
/**
|
|
314
|
+
* Caller-supplied facts resolved from the record body or the external
|
|
315
|
+
* protocol event the record commits to. These let capability_check evaluate
|
|
316
|
+
* constraints that are intentionally not present in the compact signed
|
|
317
|
+
* record body, instead of marking them unresolvable.
|
|
318
|
+
*/
|
|
319
|
+
resolvedFacts?: ResolvedCapabilityFacts;
|
|
320
|
+
/**
|
|
321
|
+
* Caller-supplied external authorization evidence. Each block is verified
|
|
322
|
+
* off the atrib record-validity path and attaches to `result.evidence`.
|
|
323
|
+
*/
|
|
324
|
+
authorizationEvidence?: AuthorizationEvidenceInput[];
|
|
291
325
|
/**
|
|
292
326
|
* Caller-supplied AP2 / Verifiable Intent evidence for transaction
|
|
293
327
|
* records. The signed atrib record commits to transaction payload hashes,
|
|
@@ -323,13 +357,11 @@ declare function resolveInformedBy(entries: string[], candidates: AtribRecord[],
|
|
|
323
357
|
* mismatches into `warnings` (which would set `valid: false`); they go
|
|
324
358
|
* into the structured `mismatches[]` field for consumer policy to weigh.
|
|
325
359
|
*
|
|
326
|
-
* For
|
|
327
|
-
*
|
|
328
|
-
*
|
|
329
|
-
* need to provide the resolved amount + counterparty out-of-band, which
|
|
330
|
-
* is a future-API extension if a real consumer needs it.
|
|
360
|
+
* For constraints whose underlying facts are not present in the compact
|
|
361
|
+
* signed record, callers can pass `resolvedFacts`. Missing facts are
|
|
362
|
+
* flagged as `unresolvable` rather than silently passed.
|
|
331
363
|
*/
|
|
332
|
-
declare function resolveCapabilityCheck(record: AtribRecord, claim: ResolvedIdentityClaim, _warnings: string[]): CapabilityCheckAnnotation;
|
|
364
|
+
declare function resolveCapabilityCheck(record: AtribRecord, claim: ResolvedIdentityClaim, facts: ResolvedCapabilityFacts | undefined, _warnings: string[]): CapabilityCheckAnnotation;
|
|
333
365
|
/**
|
|
334
366
|
* Cross-attestation derivation per spec §1.7.6 (D052).
|
|
335
367
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-record.d.ts","sourceRoot":"","sources":["../src/verify-record.ts"],"names":[],"mappings":"AAEA
|
|
1
|
+
{"version":3,"file":"verify-record.d.ts","sourceRoot":"","sources":["../src/verify-record.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,eAAe,EAOf,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAA;AAInB,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,6BAA6B,CAAA;AAUpC;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnC;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAA;IACpB;;;;OAIG;IACH,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACxD,mFAAmF;IACnF,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAClC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,EAAE,IAAI,GAAG,GAAG,GAAG,KAAK,GAAG,GAAG,GAAG,GAAG,CAAA;IACrD;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,8BAA8B,EAAE,OAAO,CAAA;IACvC;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,GAAG,eAAe,CAAA;IACtD;;;OAGG;IACH,sBAAsB,EAAE,cAAc,GAAG,eAAe,CAAA;IACxD;;;;;;OAMG;IACH,cAAc,EAAE,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAA;CAC1C;AAUD,MAAM,WAAW,wBAAwB;IACvC,kDAAkD;IAClD,KAAK,EAAE,OAAO,CAAA;IACd,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAA;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,oBAAoB,CAAA;IAC7C;;;;OAIG;IACH,OAAO,EAAE,iBAAiB,CAAA;IAC1B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IAC5C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,0BAA0B,CAAA;IAC9C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,yBAAyB,CAAA;IAC3C;;;OAGG;IACH,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAA;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAA;IAC/B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAA;IACpC;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAA;IACvC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,EAAE,CAAA;IACpD;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAwGnC;AAqED,iBAAS,iBAAiB,CACxB,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,WAAW,GAAG,SAAS,GACzC,oBAAoB,CAetB;AAED,iBAAS,iBAAiB,CACxB,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,WAAW,EAAE,EACzB,QAAQ,EAAE,MAAM,EAAE,GACjB,oBAAoB,CAuBtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,iBAAS,sBAAsB,CAC7B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,uBAAuB,GAAG,SAAS,EAC1C,SAAS,EAAE,MAAM,EAAE,GAClB,yBAAyB,CA+E3B;AAED;;;;;;;;;;;;;;GAcG;AACH,iBAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAuC/F;AAqBD,iBAAS,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAuCjF;AAID,eAAO,MAAM,aAAa;;;;;;;;;;CAUzB,CAAA"}
|