@brightchain/brightchain-api-lib 0.14.0 → 0.15.0

package/src/lib/controllers/identity/identityProofController.js

@@ -0,0 +1,454 @@
+"use strict";
+/**
+ * IdentityProofController — REST API for identity proof management.
+ *
+ * Routes:
+ *   POST /create              — Create a new identity proof
+ *   POST /verify              — Verify a proof's signature
+ *   POST /check-url           — Check if a proof URL contains the signed statement
+ *   POST /:id/revoke          — Revoke an identity proof
+ *   GET  /instructions/:platform — Get platform-specific posting instructions
+ *   GET  /list                — List proofs for a member
+ *
+ * Requirements: 4.1-4.10
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityProofController = void 0;
+const proofPlatform_1 = require("@brightchain/brightchain-lib/lib/enumerations/proofPlatform");
+const verificationStatus_1 = require("@brightchain/brightchain-lib/lib/enumerations/verificationStatus");
+const identity_1 = require("@brightchain/brightchain-lib/lib/services/identity");
+const node_express_suite_1 = require("@digitaldefiance/node-express-suite");
+const errorResponse_1 = require("../../utils/errorResponse");
+const base_1 = require("../base");
+// ─── In-memory proof store (per-controller instance) ────────────────────────
+/**
+ * Simple in-memory proof store for managing identity proofs.
+ * In production this would be backed by a persistent store.
+ */
+class ProofStore {
+    constructor() {
+        this.proofs = new Map();
+    }
+    add(proof) {
+        this.proofs.set(proof.id, proof);
+    }
+    get(id) {
+        return this.proofs.get(id);
+    }
+    listByMember(memberId) {
+        const results = [];
+        for (const proof of this.proofs.values()) {
+            if (proof.memberId === memberId) {
+                results.push(proof);
+            }
+        }
+        return results;
+    }
+    update(id, updates) {
+        const existing = this.proofs.get(id);
+        if (!existing)
+            return undefined;
+        const updated = { ...existing, ...updates };
+        this.proofs.set(id, updated);
+        return updated;
+    }
+}
+// ─── Controller ─────────────────────────────────────────────────────────────
+/**
+ * Controller for identity proof creation, verification, and management.
+ *
+ * Delegates to {@link IdentityProofService} in brightchain-lib for
+ * core cryptographic operations.
+ *
+ * @requirements 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10
+ */
+class IdentityProofController extends base_1.BaseController {
+    constructor(application) {
+        super(application);
+        this.eciesService = null;
+        this.memberResolver = null;
+        this.proofStore = new ProofStore();
+    }
+    /**
+     * Inject the ECIES service for cryptographic operations.
+     */
+    setEciesService(service) {
+        this.eciesService = service;
+    }
+    /**
+     * Inject a member resolver function that looks up a Member by ID.
+     * Required for the create endpoint which needs the member's private key.
+     */
+    setMemberResolver(resolver) {
+        this.memberResolver = resolver;
+    }
+    getEciesService() {
+        if (!this.eciesService) {
+            throw new Error('ECIESService not initialized');
+        }
+        return this.eciesService;
+    }
+    resolveMember(memberId) {
+        if (!this.memberResolver) {
+            throw new Error('Member resolver not initialized');
+        }
+        const member = this.memberResolver(memberId);
+        if (!member) {
+            throw new Error(`Member not found: ${memberId}`);
+        }
+        return member;
+    }
+    // ─── Route definitions ──────────────────────────────────────────────────
+    initRouteDefinitions() {
+        const noAuth = {
+            useAuthentication: false,
+            useCryptoAuthentication: false,
+        };
+        this.routeDefinitions = [
+            (0, node_express_suite_1.routeConfig)('post', '/create', {
+                ...noAuth,
+                handlerKey: 'createProof',
+                openapi: {
+                    summary: 'Create a new identity proof',
+                    description: 'Signs a statement linking a BrightChain member to an external platform account.',
+                    tags: ['Identity Proofs'],
+                    responses: {
+                        201: {
+                            schema: 'CreateProofResponse',
+                            description: 'Proof created successfully',
+                        },
+                        400: {
+                            schema: 'ApiErrorResponse',
+                            description: 'Invalid platform or missing fields',
+                        },
+                    },
+                },
+            }),
+            (0, node_express_suite_1.routeConfig)('post', '/verify', {
+                ...noAuth,
+                handlerKey: 'verifyProof',
+                openapi: {
+                    summary: 'Verify an identity proof signature',
+                    description: 'Verifies the ECDSA signature of an identity proof against a public key.',
+                    tags: ['Identity Proofs'],
+                    responses: {
+                        200: {
+                            schema: 'VerifyProofResponse',
+                            description: 'Verification result',
+                        },
+                        400: {
+                            schema: 'ApiErrorResponse',
+                            description: 'Missing proof or public key',
+                        },
+                    },
+                },
+            }),
+            (0, node_express_suite_1.routeConfig)('post', '/check-url', {
+                ...noAuth,
+                handlerKey: 'checkProofUrl',
+                openapi: {
+                    summary: 'Check a proof URL for the signed statement',
+                    description: 'Fetches the proof URL and checks that it contains the signed statement.',
+                    tags: ['Identity Proofs'],
+                    responses: {
+                        200: {
+                            schema: 'CheckProofUrlResponse',
+                            description: 'URL check result',
+                        },
+                        400: {
+                            schema: 'ApiErrorResponse',
+                            description: 'Missing proof data',
+                        },
+                    },
+                },
+            }),
+            (0, node_express_suite_1.routeConfig)('post', '/:id/revoke', {
+                ...noAuth,
+                handlerKey: 'revokeProof',
+                openapi: {
+                    summary: 'Revoke an identity proof',
+                    description: 'Marks an identity proof as revoked so it is no longer considered valid.',
+                    tags: ['Identity Proofs'],
+                    responses: {
+                        200: {
+                            schema: 'RevokeProofResponse',
+                            description: 'Proof revoked',
+                        },
+                        404: {
+                            schema: 'ApiErrorResponse',
+                            description: 'Proof not found',
+                        },
+                    },
+                },
+            }),
+            (0, node_express_suite_1.routeConfig)('get', '/instructions/:platform', {
+                ...noAuth,
+                handlerKey: 'getInstructions',
+                openapi: {
+                    summary: 'Get platform-specific posting instructions',
+                    description: 'Returns instructions for posting an identity proof on the specified platform.',
+                    tags: ['Identity Proofs'],
+                    responses: {
+                        200: {
+                            schema: 'GetInstructionsResponse',
+                            description: 'Platform instructions',
+                        },
+                    },
+                },
+            }),
+            (0, node_express_suite_1.routeConfig)('get', '/list', {
+                ...noAuth,
+                handlerKey: 'listProofs',
+                openapi: {
+                    summary: 'List identity proofs for a member',
+                    description: 'Returns all identity proofs associated with the specified member.',
+                    tags: ['Identity Proofs'],
+                    responses: {
+                        200: {
+                            schema: 'ListProofsResponse',
+                            description: 'List of proofs',
+                        },
+                    },
+                },
+            }),
+        ];
+        this.handlers = {
+            createProof: this.handleCreateProof.bind(this),
+            verifyProof: this.handleVerifyProof.bind(this),
+            checkProofUrl: this.handleCheckProofUrl.bind(this),
+            revokeProof: this.handleRevokeProof.bind(this),
+            getInstructions: this.handleGetInstructions.bind(this),
+            listProofs: this.handleListProofs.bind(this),
+        };
+    }
+    // ─── Handlers ─────────────────────────────────────────────────────────
+    /**
+     * POST /create — Create a new identity proof.
+     *
+     * @requirements 4.1, 4.2, 4.3, 4.8
+     */
+    async handleCreateProof(req) {
+        try {
+            const { memberId, platform, username } = req.body;
+            if (!memberId || typeof memberId !== 'string') {
+                return (0, errorResponse_1.validationError)('Missing required field: memberId');
+            }
+            if (!platform || typeof platform !== 'string') {
+                return (0, errorResponse_1.validationError)('Missing required field: platform');
+            }
+            if (!Object.values(proofPlatform_1.ProofPlatform).includes(platform)) {
+                return (0, errorResponse_1.validationError)(`Invalid platform: ${platform} (expected one of ${Object.values(proofPlatform_1.ProofPlatform).join(', ')})`);
+            }
+            if (!username || typeof username !== 'string') {
+                return (0, errorResponse_1.validationError)('Missing required field: username');
+            }
+            const member = this.resolveMember(memberId);
+            const proof = identity_1.IdentityProofService.create(member, platform, username);
+            // Store the proof
+            this.proofStore.add(proof);
+            const instructions = identity_1.IdentityProofService.getInstructions(platform);
+            return {
+                statusCode: 201,
+                response: {
+                    status: 'success',
+                    data: { proof, instructions },
+                    message: 'Identity proof created successfully',
+                },
+            };
+        }
+        catch (error) {
+            return this.mapProofError(error);
+        }
+    }
+    /**
+     * POST /verify — Verify an identity proof's signature.
+     *
+     * @requirements 4.4
+     */
+    async handleVerifyProof(req) {
+        try {
+            const { proof, publicKeyHex } = req.body;
+            if (!proof || typeof proof !== 'object') {
+                return (0, errorResponse_1.validationError)('Missing required field: proof');
+            }
+            if (!publicKeyHex || typeof publicKeyHex !== 'string') {
+                return (0, errorResponse_1.validationError)('Missing required field: publicKeyHex');
+            }
+            const eciesService = this.getEciesService();
+            const publicKeyBytes = Buffer.from(publicKeyHex, 'hex');
+            const verified = identity_1.IdentityProofService.verify(proof, publicKeyBytes, eciesService);
+            return {
+                statusCode: 200,
+                response: {
+                    status: 'success',
+                    data: { verified, proofId: proof.id },
+                    message: verified
+                        ? 'Proof signature is valid'
+                        : 'Proof signature is invalid',
+                },
+            };
+        }
+        catch (error) {
+            return (0, errorResponse_1.handleError)(error);
+        }
+    }
+    /**
+     * POST /check-url — Check if a proof URL contains the signed statement.
+     *
+     * @requirements 4.6, 4.10
+     */
+    async handleCheckProofUrl(req) {
+        try {
+            const { proof } = req.body;
+            if (!proof || typeof proof !== 'object') {
+                return (0, errorResponse_1.validationError)('Missing required field: proof');
+            }
+            if (!proof.proofUrl || typeof proof.proofUrl !== 'string') {
+                return (0, errorResponse_1.validationError)('Proof must have a non-empty proofUrl');
+            }
+            const valid = await identity_1.IdentityProofService.checkProofUrl(proof);
+            // Update stored proof verification status if we have it
+            if (this.proofStore.get(proof.id)) {
+                this.proofStore.update(proof.id, {
+                    verificationStatus: valid
+                        ? verificationStatus_1.VerificationStatus.VERIFIED
+                        : verificationStatus_1.VerificationStatus.FAILED,
+                    verifiedAt: valid ? new Date() : undefined,
+                    lastCheckedAt: new Date(),
+                });
+            }
+            return {
+                statusCode: 200,
+                response: {
+                    status: 'success',
+                    data: { valid, proofId: proof.id },
+                    message: valid
+                        ? 'Proof URL contains the signed statement'
+                        : 'Proof URL does not contain the signed statement',
+                },
+            };
+        }
+        catch (error) {
+            return (0, errorResponse_1.handleError)(error);
+        }
+    }
+    /**
+     * POST /:id/revoke — Revoke an identity proof.
+     *
+     * @requirements 4.7
+     */
+    async handleRevokeProof(req) {
+        try {
+            const { id } = req.params;
+            if (!id) {
+                return (0, errorResponse_1.validationError)('Missing required parameter: id');
+            }
+            const proof = this.proofStore.get(id);
+            if (!proof) {
+                return (0, errorResponse_1.notFoundError)('IdentityProof', id);
+            }
+            if (proof.verificationStatus === verificationStatus_1.VerificationStatus.REVOKED) {
+                return (0, errorResponse_1.validationError)('Proof is already revoked');
+            }
+            const revokedAt = new Date();
+            this.proofStore.update(id, {
+                verificationStatus: verificationStatus_1.VerificationStatus.REVOKED,
+                revokedAt,
+            });
+            return {
+                statusCode: 200,
+                response: {
+                    status: 'success',
+                    data: { revoked: true, revokedAt: revokedAt.toISOString() },
+                    message: 'Identity proof revoked',
+                },
+            };
+        }
+        catch (error) {
+            return (0, errorResponse_1.handleError)(error);
+        }
+    }
+    /**
+     * GET /instructions/:platform — Get platform-specific posting instructions.
+     *
+     * @requirements 4.9
+     */
+    async handleGetInstructions(req) {
+        try {
+            const { platform } = req.params;
+            if (!platform) {
+                return (0, errorResponse_1.validationError)('Missing required parameter: platform');
+            }
+            const instructions = identity_1.IdentityProofService.getInstructions(platform);
+            return {
+                statusCode: 200,
+                response: {
+                    status: 'success',
+                    data: { platform, instructions },
+                    message: 'Instructions retrieved',
+                },
+            };
+        }
+        catch (error) {
+            return (0, errorResponse_1.handleError)(error);
+        }
+    }
+    /**
+     * GET /list — List identity proofs for a member.
+     *
+     * @requirements 4.5
+     */
+    async handleListProofs(req) {
+        try {
+            const { memberId } = req.query;
+            if (!memberId || typeof memberId !== 'string') {
+                return (0, errorResponse_1.validationError)('Missing required query parameter: memberId');
+            }
+            const proofs = this.proofStore.listByMember(memberId);
+            return {
+                statusCode: 200,
+                response: {
+                    status: 'success',
+                    data: proofs,
+                    message: `Found ${proofs.length} proof(s)`,
+                },
+            };
+        }
+        catch (error) {
+            return (0, errorResponse_1.handleError)(error);
+        }
+    }
+    // ─── Error mapping ──────────────────────────────────────────────────
+    mapProofError(error) {
+        if (error instanceof identity_1.UnsupportedPlatformError) {
+            return {
+                statusCode: 400,
+                response: {
+                    message: error.message,
+                    error: 'UNSUPPORTED_PLATFORM',
+                },
+            };
+        }
+        if (error instanceof identity_1.ProofCreationError) {
+            return {
+                statusCode: 400,
+                response: {
+                    message: error.message,
+                    error: 'PROOF_CREATION_FAILED',
+                },
+            };
+        }
+        if (error instanceof identity_1.ProofUrlError) {
+            return {
+                statusCode: 400,
+                response: {
+                    message: error.message,
+                    error: 'PROOF_URL_ERROR',
+                },
+            };
+        }
+        return (0, errorResponse_1.handleError)(error);
+    }
+}
+exports.IdentityProofController = IdentityProofController;
+//# sourceMappingURL=identityProofController.js.map

package/src/lib/controllers/identity/identityProofController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityProofController.js","sourceRoot":"","sources":["../../../../../../brightchain-api-lib/src/lib/controllers/identity/identityProofController.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,+FAA4F;AAC5F,yGAAsG;AAUtG,iFAK4D;AAG5D,4EAK6C;AAG7C,6DAImC;AACnC,kCAAyC;AA6DzC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU;IAAhB;QACmB,WAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IA8B9D,CAAC;IA5BC,GAAG,CAAC,KAAqB;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CACJ,EAAU,EACV,OAAgC;QAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAa,uBAEX,SAAQ,qBAKT;IAOC,YAAY,WAAyC;QACnD,KAAK,CAAC,WAAW,CAAC,CAAC;QAPb,iBAAY,GAA6B,IAAI,CAAC;QAC9C,mBAAc,GAEX,IAAI,CAAC;QACC,eAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAI/C,CAAC;IAED;;OAEG;IACI,eAAe,CAAC,OAA0B;QAC/C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACI,iBAAiB,CACtB,QAAuD;QAEvD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,aAAa,CAAC,QAAgB;QACpC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAEjE,oBAAoB;QAC5B,MAAM,MAAM,GAAG;YACb,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,KAAK;SAC/B,CAAC;QAEF,IAAI,CAAC,gBAAgB,GAAG;YACtB,IAAA,gCAAW,EAAC,MAAM,EAAE,SAAS,EAAE;gBAC7B,GAAG,MAAM;gBACT,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE;oBACP,OAAO,EAAE,6BAA6B;oBACtC,WAAW,EACT,iFAAiF;oBACnF,IAAI,EAAE,CAAC,iBAAiB,CAAC;oBACzB,SAAS,EAAE;wBACT,GAAG,EAAE;4BACH,MAAM,EAAE,qBAAqB;4BAC7B,WAAW,EAAE,4BAA4B;yBAC1C;wBACD,GAAG,EAAE;4BACH,MAAM,EAAE,kBAAkB;4BAC1B,WAAW,EAAE,oCAAoC;yBAClD;qBACF;iBACF;aACF,CAAC;YACF,IAAA,gCAAW,EAAC,MAAM,EAAE,SAAS,EAAE;gBAC7B,GAAG,MAAM;gBACT,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE;oBACP,OAAO,EAAE,oCAAoC;oBAC7C,WAAW,EACT,yEAAyE;oBAC3E,IAAI,EAAE,CAAC,iBAAiB,CAAC;oBACzB,SAAS,EAAE;wBACT,GAAG,EAAE;4BACH,MAAM,EAAE,qBAAqB;4BAC7B,WAAW,EAAE,qBAAqB;yBACnC;wBACD,GAAG,EAAE;4BACH,MAAM,EAAE,kBAAkB;4BAC1B,WAAW,EAAE,6BAA6B;yBAC3C;qBACF;iBACF;aACF,CAAC;YACF,IAAA,gCAAW,EAAC,MAAM,EAAE,YAAY,EAAE;gBAChC,GAAG,MAAM;gBACT,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE;oBACP,OAAO,EAAE,4CAA4C;oBACrD,WAAW,EACT,yEAAyE;oBAC3E,IAAI,EAAE,CAAC,iBAAiB,CAAC;oBACzB,SAAS,EAAE;wBACT,GAAG,EAAE;4BACH,MAAM,EAAE,uBAAuB;4BAC/B,WAAW,EAAE,kBAAkB;yBAChC;wBACD,GAAG,EAAE;4BACH,MAAM,EAAE,kBAAkB;4BAC1B,WAAW,EAAE,oBAAoB;yBAClC;qBACF;iBACF;aACF,CAAC;YACF,IAAA,gCAAW,EAAC,MAAM,EAAE,aAAa,EAAE;gBACjC,GAAG,MAAM;gBACT,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE;oBACP,OAAO,EAAE,0BAA0B;oBACnC,WAAW,EACT,yEAAyE;oBAC3E,IAAI,EAAE,CAAC,iBAAiB,CAAC;oBACzB,SAAS,EAAE;wBACT,GAAG,EAAE;4BACH,MAAM,EAAE,qBAAqB;4BAC7B,WAAW,EAAE,eAAe;yBAC7B;wBACD,GAAG,EAAE;4BACH,MAAM,EAAE,kBAAkB;4BAC1B,WAAW,EAAE,iBAAiB;yBAC/B;qBACF;iBACF;aACF,CAAC;YACF,IAAA,gCAAW,EAAC,KAAK,EAAE,yBAAyB,EAAE;gBAC5C,GAAG,MAAM;gBACT,UAAU,EAAE,iBAAiB;gBAC7B,OAAO,EAAE;oBACP,OAAO,EAAE,4CAA4C;oBACrD,WAAW,EACT,+EAA+E;oBACjF,IAAI,EAAE,CAAC,iBAAiB,CAAC;oBACzB,SAAS,EAAE;wBACT,GAAG,EAAE;4BACH,MAAM,EAAE,yBAAyB;4BACjC,WAAW,EAAE,uBAAuB;yBACrC;qBACF;iBACF;aACF,CAAC;YACF,IAAA,gCAAW,EAAC,KAAK,EAAE,OAAO,EAAE;gBAC1B,GAAG,MAAM;gBACT,UAAU,EAAE,YAAY;gBACxB,OAAO,EAAE;oBACP,OAAO,EAAE,mCAAmC;oBAC5C,WAAW,EACT,mEAAmE;oBACrE,IAAI,EAAE,CAAC,iBAAiB,CAAC;oBACzB,SAAS,EAAE;wBACT,GAAG,EAAE;4BACH,MAAM,EAAE,oBAAoB;4BAC5B,WAAW,EAAE,gBAAgB;yBAC9B;qBACF;iBACF;aACF,CAAC;SACH,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG;YACd,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAClD,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,eAAe,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,yEAAyE;IAEzE;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY;QAI1C,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAI,GAAuB,CAAC,IAAI,CAAC;YAEvE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,OAAO,IAAA,+BAAe,EAAC,kCAAkC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,OAAO,IAAA,+BAAe,EAAC,kCAAkC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,CAAC,QAAQ,CAAC,QAAyB,CAAC,EAAE,CAAC;gBACtE,OAAO,IAAA,+BAAe,EACpB,qBAAqB,QAAQ,qBAAqB,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,OAAO,IAAA,+BAAe,EAAC,kCAAkC,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,+BAAoB,CAAC,MAAM,CACvC,MAAM,EACN,QAAyB,EACzB,QAAQ,CACT,CAAC;YAEF,kBAAkB;YAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAE3B,MAAM,YAAY,GAAG,+BAAoB,CAAC,eAAe,CACvD,QAAyB,CAC1B,CAAC;YAEF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;oBAC7B,OAAO,EAAE,qCAAqC;iBAChB;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY;QAI1C,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAI,GAAuB,CAAC,IAAI,CAAC;YAE9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,OAAO,IAAA,+BAAe,EAAC,+BAA+B,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACtD,OAAO,IAAA,+BAAe,EAAC,sCAAsC,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,+BAAoB,CAAC,MAAM,CAC1C,KAAK,EACL,cAAc,EACd,YAAY,CACb,CAAC;YAEF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE;oBACrC,OAAO,EAAE,QAAQ;wBACf,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,4BAA4B;iBACF;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAA,2BAAW,EAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAY;QAI5C,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAI,GAAyB,CAAC,IAAI,CAAC;YAElD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,OAAO,IAAA,+BAAe,EAAC,+BAA+B,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1D,OAAO,IAAA,+BAAe,EAAC,sCAAsC,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,+BAAoB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAE9D,wDAAwD;YACxD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;oBAC/B,kBAAkB,EAAE,KAAK;wBACvB,CAAC,CAAC,uCAAkB,CAAC,QAAQ;wBAC7B,CAAC,CAAC,uCAAkB,CAAC,MAAM;oBAC7B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;oBAC1C,aAAa,EAAE,IAAI,IAAI,EAAE;iBAC1B,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE;oBAClC,OAAO,EAAE,KAAK;wBACZ,CAAC,CAAC,yCAAyC;wBAC3C,CAAC,CAAC,iDAAiD;iBACrB;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAA,2BAAW,EAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY;QAI1C,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAI,GAAqB,CAAC,MAAM,CAAC;YAC7C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,IAAA,+BAAe,EAAC,gCAAgC,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAA,6BAAa,EAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,OAAO,EAAE,CAAC;gBAC5D,OAAO,IAAA,+BAAe,EAAC,0BAA0B,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE;gBACzB,kBAAkB,EAAE,uCAAkB,CAAC,OAAO;gBAC9C,SAAS;aACV,CAAC,CAAC;YAEH,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE;oBAC3D,OAAO,EAAE,wBAAwB;iBACH;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAA,2BAAW,EAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY;QAI9C,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAI,GAAsB,CAAC,MAAM,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAA,+BAAe,EAAC,sCAAsC,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,YAAY,GAAG,+BAAoB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAEpE,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;oBAChC,OAAO,EAAE,wBAAwB;iBACC;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAA,2BAAW,EAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAY;QAIzC,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAI,GAAuB,CAAC,KAAK,CAAC;YACpD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,OAAO,IAAA,+BAAe,EAAC,4CAA4C,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEtD,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,SAAS,MAAM,CAAC,MAAM,WAAW;iBACb;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAA,2BAAW,EAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,uEAAuE;IAE/D,aAAa,CAAC,KAAc;QAIlC,IAAI,KAAK,YAAY,mCAAwB,EAAE,CAAC;YAC9C,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,sBAAsB;iBAC9B;aACF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,6BAAkB,EAAE,CAAC;YACxC,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,uBAAuB;iBAC/B;aACF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,wBAAa,EAAE,CAAC;YACnC,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE;oBACR,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,iBAAiB;iBACzB;aACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,2BAAW,EAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AArdD,0DAqdC"}

package/src/lib/controllers/identity/index.d.ts

@@ -0,0 +1,4 @@
+export * from './deviceController';
+export * from './directoryController';
+export * from './identityProofController';
+//# sourceMappingURL=index.d.ts.map

package/src/lib/controllers/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../brightchain-api-lib/src/lib/controllers/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC"}

package/src/lib/controllers/identity/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./deviceController"), exports);
+tslib_1.__exportStar(require("./directoryController"), exports);
+tslib_1.__exportStar(require("./identityProofController"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/controllers/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../brightchain-api-lib/src/lib/controllers/identity/index.ts"],"names":[],"mappings":";;;AAAA,6DAAmC;AACnC,gEAAsC;AACtC,oEAA0C"}

package/src/lib/controllers/index.d.ts

@@ -1,3 +1,5 @@
 export * from './api';
 export * from './base';
+export * from './crypto';
+export * from './identity';
 //# sourceMappingURL=index.d.ts.map

package/src/lib/controllers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC"}

package/src/lib/controllers/index.js

@@ -3,4 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./api"), exports);
 tslib_1.__exportStar(require("./base"), exports);
+tslib_1.__exportStar(require("./crypto"), exports);
+tslib_1.__exportStar(require("./identity"), exports);
 //# sourceMappingURL=index.js.map

package/src/lib/controllers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/controllers/index.ts"],"names":[],"mappings":";;;AAAA,gDAAsB;AACtB,iDAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/controllers/index.ts"],"names":[],"mappings":";;;AAAA,gDAAsB;AACtB,iDAAuB;AACvB,mDAAyB;AACzB,qDAA2B"}

package/src/lib/encryption/encryptedMetadataService.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Encrypted Metadata Service — handles metadata encryption/decryption
+ * for CBL Index entries in encrypted pools.
+ *
+ * Controls which metadata fields remain searchable (unencrypted) based
+ * on pool configuration, encrypts the rest, and enforces query restrictions
+ * on encrypted fields.
+ *
+ * @see Requirements 16.1, 16.2, 16.3, 16.4, 16.5
+ */
+import type { ICBLIndexEntry, IPoolEncryptionConfig } from '@brightchain/brightchain-lib';
+import { PoolEncryptionService } from './poolEncryptionService';
+export declare class EncryptedMetadataService {
+    private readonly encryptionService;
+    private readonly config;
+    constructor(encryptionService: PoolEncryptionService, config: IPoolEncryptionConfig);
+    /**
+     * Encrypt non-searchable metadata fields on a CBL index entry.
+     *
+     * Fields listed in ALWAYS_UNENCRYPTED_FIELDS are never encrypted.
+     * Fields listed in ENCRYPTABLE_FIELDS are encrypted unless they appear
+     * in the pool config's searchableMetadataFields.
+     *
+     * Encrypted values are stored as base64 strings in the entry's
+     * `encryptedFields` map, and the original fields are set to undefined.
+     *
+     * @param entry - The CBL index entry to encrypt
+     * @param poolKey - The 32-byte symmetric pool key for AES-256-GCM encryption
+     * @returns A new entry with non-searchable fields encrypted
+     * @see Requirements 16.1, 16.3
+     */
+    encryptMetadata(entry: ICBLIndexEntry, poolKey: Uint8Array): Promise<ICBLIndexEntry>;
+    /**
+     * Decrypt encrypted metadata fields on a CBL index entry,
+     * restoring original field values from the `encryptedFields` map.
+     *
+     * @param entry - The CBL index entry with encrypted fields
+     * @param poolKey - The 32-byte symmetric pool key for AES-256-GCM decryption
+     * @returns A new entry with all fields decrypted and restored
+     */
+    decryptMetadata(entry: ICBLIndexEntry, poolKey: Uint8Array): Promise<ICBLIndexEntry>;
+    /**
+     * Validate that queried fields are searchable (not encrypted).
+     * Throws EncryptedFieldError if any queried field is encrypted.
+     *
+     * @param queryFields - Field names being queried
+     * @throws EncryptedFieldError if a queried field is encrypted
+     * @see Requirement 16.5
+     */
+    validateQuery(queryFields: string[]): void;
+    /**
+     * Returns false if the pool has any encryption mode other than None.
+     * Content-based indexing and CBL address extraction are not possible
+     * on encrypted blocks because the block content is opaque.
+     *
+     * @returns Whether content-based indexing is allowed
+     * @see Requirement 16.4
+     */
+    isContentIndexingAllowed(): boolean;
+    /**
+     * Returns the list of always-unencrypted fields plus the configured
+     * searchable metadata fields.
+     *
+     * @returns All searchable (unencrypted) field names
+     * @see Requirement 16.1
+     */
+    getSearchableFields(): string[];
+    /**
+     * Check if a field path is searchable (always unencrypted or in config).
+     */
+    private isSearchable;
+    /**
+     * Get a field value from an entry by dot-notation path.
+     */
+    private getFieldValue;
+    /**
+     * Clear a field value on an entry by dot-notation path (set to undefined).
+     */
+    private clearFieldValue;
+    /**
+     * Set a field value on an entry by dot-notation path.
+     */
+    private setFieldValue;
+    private uint8ArrayToBase64;
+    private base64ToUint8Array;
+}
+//# sourceMappingURL=encryptedMetadataService.d.ts.map

package/src/lib/encryption/encryptedMetadataService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptedMetadataService.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/encryptedMetadataService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAsChE,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAwB;IAC1D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAG7C,iBAAiB,EAAE,qBAAqB,EACxC,MAAM,EAAE,qBAAqB;IAM/B;;;;;;;;;;;;;;OAcG;IACG,eAAe,CACnB,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,cAAc,CAAC;IAsC1B;;;;;;;OAOG;IACG,eAAe,CACnB,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,cAAc,CAAC;IAgC1B;;;;;;;OAOG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI;IAS1C;;;;;;;OAOG;IACH,wBAAwB,IAAI,OAAO;IAInC;;;;;;OAMG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAS/B;;OAEG;IACH,OAAO,CAAC,YAAY;IAOpB;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACH,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,kBAAkB;CAG3B"}