@codespar/sdk 0.16.10 → 0.16.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/__tests__/mandate-strict.test.d.ts +2 -0
- package/dist/__tests__/mandate-strict.test.d.ts.map +1 -0
- package/dist/__tests__/mandate-strict.test.js +234 -0
- package/dist/__tests__/mandate-strict.test.js.map +1 -0
- package/dist/__tests__/mandate.test.js +9 -3
- package/dist/__tests__/mandate.test.js.map +1 -1
- package/dist/mandate/index.d.ts +63 -24
- package/dist/mandate/index.d.ts.map +1 -1
- package/dist/mandate/index.js +104 -30
- package/dist/mandate/index.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"mandate-strict.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/mandate-strict.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,234 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* p2-identity#6 (codespar-core#123): what `verifyMandateToken` may call
|
|
3
|
+
* "verified".
|
|
4
|
+
*
|
|
5
|
+
* Three verdicts the verifier used to give and must not:
|
|
6
|
+
* - verified with the agent signature missing (only the platform signed);
|
|
7
|
+
* - verified by a key the token does not name (a retired key verified
|
|
8
|
+
* tokens that name the active one, forever);
|
|
9
|
+
* - verified after `expires_at`.
|
|
10
|
+
* And one format it could not read: V4, which signs `issued_at`.
|
|
11
|
+
*
|
|
12
|
+
* Every refusal below sits next to the closest legitimate token still
|
|
13
|
+
* verifying, so a verifier that refuses everything fails this file too.
|
|
14
|
+
*/
|
|
15
|
+
import { createPrivateKey, createPublicKey, randomBytes, sign } from "node:crypto";
|
|
16
|
+
import { readFileSync } from "node:fs";
|
|
17
|
+
import { dirname, join } from "node:path";
|
|
18
|
+
import { fileURLToPath } from "node:url";
|
|
19
|
+
import { describe, expect, it } from "vitest";
|
|
20
|
+
import { decodeMandateToken, reconstructSigningString, verifyMandateToken, } from "../mandate/index.js";
|
|
21
|
+
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
22
|
+
const load = (name) => JSON.parse(readFileSync(join(__dirname, "fixtures", name), "utf8"));
|
|
23
|
+
const v3 = load("canonical.v3.fixture.json");
|
|
24
|
+
const v4 = load("canonical.v4.fixture.json");
|
|
25
|
+
// The fixtures expire at 2025-01-01T00:00:00Z. BEFORE is inside the window;
|
|
26
|
+
// AFTER is one second past it.
|
|
27
|
+
const BEFORE = v3.input.expires_at - 12 * 3600;
|
|
28
|
+
const AFTER = v3.input.expires_at + 1;
|
|
29
|
+
function makeToken(fields, envelope) {
|
|
30
|
+
return Buffer.from(JSON.stringify({ ...fields, ...envelope }), "utf8").toString("base64url");
|
|
31
|
+
}
|
|
32
|
+
function fixtureToken(fx, drop = []) {
|
|
33
|
+
const envelope = {
|
|
34
|
+
signature: fx.hmac_sha256_hex,
|
|
35
|
+
agent_sig: fx.agent_sig_b64url,
|
|
36
|
+
issuer_sig: fx.issuer_sig_b64url,
|
|
37
|
+
kid: fx.input.agent_kid,
|
|
38
|
+
};
|
|
39
|
+
for (const k of drop)
|
|
40
|
+
delete envelope[k];
|
|
41
|
+
return makeToken(fx.input, envelope);
|
|
42
|
+
}
|
|
43
|
+
const PKCS8 = Buffer.from("302e020100300506032b657004220420", "hex");
|
|
44
|
+
function signWith(seedHex, message) {
|
|
45
|
+
const key = createPrivateKey({
|
|
46
|
+
key: Buffer.concat([PKCS8, Buffer.from(seedHex, "hex")]),
|
|
47
|
+
format: "der",
|
|
48
|
+
type: "pkcs8",
|
|
49
|
+
});
|
|
50
|
+
return sign(null, Buffer.from(message, "utf8"), key).toString("base64url");
|
|
51
|
+
}
|
|
52
|
+
function freshKey() {
|
|
53
|
+
const seed = randomBytes(32);
|
|
54
|
+
const priv = createPrivateKey({ key: Buffer.concat([PKCS8, seed]), format: "der", type: "pkcs8" });
|
|
55
|
+
const spki = createPublicKey(priv).export({ format: "der", type: "spki" });
|
|
56
|
+
return { seedHex: seed.toString("hex"), pubHex: spki.subarray(spki.length - 32).toString("hex") };
|
|
57
|
+
}
|
|
58
|
+
function didDoc(did, keys) {
|
|
59
|
+
return {
|
|
60
|
+
id: did,
|
|
61
|
+
verificationMethod: keys.map((k) => ({
|
|
62
|
+
id: k.kid,
|
|
63
|
+
type: "JsonWebKey2020",
|
|
64
|
+
controller: did,
|
|
65
|
+
publicKeyJwk: { kty: "OKP", crv: "Ed25519", x: Buffer.from(k.pubHex, "hex").toString("base64url") },
|
|
66
|
+
})),
|
|
67
|
+
};
|
|
68
|
+
}
|
|
69
|
+
const BOTH = { agentPublicKey: v3.agent_pubkey_hex, issuerPublicKey: v3.issuer_pubkey_hex };
|
|
70
|
+
describe("control: a legitimate token still verifies", () => {
|
|
71
|
+
it("V3 with both signatures, both keys, inside its window", () => {
|
|
72
|
+
const res = verifyMandateToken(fixtureToken(v3), { ...BOTH, now: BEFORE });
|
|
73
|
+
expect(res.verified).toBe(true);
|
|
74
|
+
expect(res.failures).toEqual([]);
|
|
75
|
+
expect(res.expired).toBe(false);
|
|
76
|
+
});
|
|
77
|
+
it("a tampered V3 token still fails", () => {
|
|
78
|
+
const tampered = makeToken({ ...v3.input, amount: "9999" }, { signature: v3.hmac_sha256_hex, agent_sig: v3.agent_sig_b64url, issuer_sig: v3.issuer_sig_b64url, kid: v3.input.agent_kid });
|
|
79
|
+
const res = verifyMandateToken(tampered, { ...BOTH, now: BEFORE });
|
|
80
|
+
expect(res.verified).toBe(false);
|
|
81
|
+
expect(res.agent.status).toBe("failed");
|
|
82
|
+
expect(res.issuer.status).toBe("failed");
|
|
83
|
+
expect(res.failures).toEqual(expect.arrayContaining(["agent_sig_invalid", "issuer_sig_invalid"]));
|
|
84
|
+
});
|
|
85
|
+
});
|
|
86
|
+
describe("rule 1: a signature the token does not carry is a failure", () => {
|
|
87
|
+
it("agent_sig stripped: NOT verified, though the platform signature checks", () => {
|
|
88
|
+
const res = verifyMandateToken(fixtureToken(v3, ["agent_sig"]), { ...BOTH, now: BEFORE });
|
|
89
|
+
expect(res.verified).toBe(false);
|
|
90
|
+
expect(res.issuer.status).toBe("verified");
|
|
91
|
+
expect(res.agent.status).toBe("absent");
|
|
92
|
+
expect(res.failures).toEqual(["agent_sig_absent"]);
|
|
93
|
+
});
|
|
94
|
+
it("issuer_sig stripped: NOT verified either", () => {
|
|
95
|
+
const res = verifyMandateToken(fixtureToken(v3, ["issuer_sig"]), { ...BOTH, now: BEFORE });
|
|
96
|
+
expect(res.verified).toBe(false);
|
|
97
|
+
expect(res.agent.status).toBe("verified");
|
|
98
|
+
expect(res.failures).toEqual(["issuer_sig_absent"]);
|
|
99
|
+
});
|
|
100
|
+
it("a carried signature nobody checked is not verified (no key supplied)", () => {
|
|
101
|
+
const res = verifyMandateToken(fixtureToken(v3), { agentPublicKey: v3.agent_pubkey_hex, now: BEFORE });
|
|
102
|
+
expect(res.verified).toBe(false);
|
|
103
|
+
expect(res.agent.status).toBe("verified");
|
|
104
|
+
expect(res.issuer.status).toBe("skipped");
|
|
105
|
+
expect(res.failures).toEqual(["issuer_sig_unchecked"]);
|
|
106
|
+
});
|
|
107
|
+
});
|
|
108
|
+
describe("rule 2: only the key the token names", () => {
|
|
109
|
+
const agentDid = "did:web:id.codespar.dev:org_demo:a1";
|
|
110
|
+
const retiredKid = `${agentDid}#1`; // the fixture's agent key, retired by a rotation
|
|
111
|
+
const activeKid = `${agentDid}#2`;
|
|
112
|
+
const active = freshKey();
|
|
113
|
+
const document = didDoc(agentDid, [
|
|
114
|
+
{ kid: retiredKid, pubHex: v3.agent_pubkey_hex },
|
|
115
|
+
{ kid: activeKid, pubHex: active.pubHex },
|
|
116
|
+
]);
|
|
117
|
+
/** A V3 token naming `namedKid`, agent-signed with `agentSeed`, issuer-signed by the platform. */
|
|
118
|
+
function tokenNaming(namedKid, agentSeedHex) {
|
|
119
|
+
const fields = { ...v3.input, agent_kid: namedKid };
|
|
120
|
+
const s = reconstructSigningString(fields);
|
|
121
|
+
return makeToken(fields, {
|
|
122
|
+
signature: "00",
|
|
123
|
+
agent_sig: signWith(agentSeedHex, s),
|
|
124
|
+
issuer_sig: signWith(v3.issuer_seed_hex, s),
|
|
125
|
+
kid: namedKid,
|
|
126
|
+
});
|
|
127
|
+
}
|
|
128
|
+
it("the retired key does not verify a token that names the active key", () => {
|
|
129
|
+
const res = verifyMandateToken(tokenNaming(activeKid, v3.agent_seed_hex), {
|
|
130
|
+
agentDidDocument: document,
|
|
131
|
+
issuerPublicKey: v3.issuer_pubkey_hex,
|
|
132
|
+
now: BEFORE,
|
|
133
|
+
});
|
|
134
|
+
expect(res.verified).toBe(false);
|
|
135
|
+
expect(res.agent.status).toBe("failed");
|
|
136
|
+
expect(res.agent.kid).toBe(activeKid);
|
|
137
|
+
expect(res.failures).toEqual(["agent_sig_invalid"]);
|
|
138
|
+
});
|
|
139
|
+
it("control: the active key verifies the token that names it, from the same document", () => {
|
|
140
|
+
const res = verifyMandateToken(tokenNaming(activeKid, active.seedHex), {
|
|
141
|
+
agentDidDocument: document,
|
|
142
|
+
issuerPublicKey: v3.issuer_pubkey_hex,
|
|
143
|
+
now: BEFORE,
|
|
144
|
+
});
|
|
145
|
+
expect(res.verified).toBe(true);
|
|
146
|
+
expect(res.agent.kid).toBe(activeKid);
|
|
147
|
+
});
|
|
148
|
+
it("a kid the document does not publish fails, and no other key is tried", () => {
|
|
149
|
+
const res = verifyMandateToken(tokenNaming(`${agentDid}#9`, v3.agent_seed_hex), {
|
|
150
|
+
agentDidDocument: document,
|
|
151
|
+
issuerPublicKey: v3.issuer_pubkey_hex,
|
|
152
|
+
now: BEFORE,
|
|
153
|
+
});
|
|
154
|
+
expect(res.verified).toBe(false);
|
|
155
|
+
expect(res.agent.status).toBe("failed");
|
|
156
|
+
expect(res.failures).toEqual(["kid_not_in_document"]);
|
|
157
|
+
});
|
|
158
|
+
it("the unsigned envelope kid cannot rename the signed agent_kid", () => {
|
|
159
|
+
// Signed agent_kid is #1 (the fixture); the envelope claims #2.
|
|
160
|
+
const t = makeToken(v3.input, {
|
|
161
|
+
signature: v3.hmac_sha256_hex,
|
|
162
|
+
agent_sig: v3.agent_sig_b64url,
|
|
163
|
+
issuer_sig: v3.issuer_sig_b64url,
|
|
164
|
+
kid: activeKid,
|
|
165
|
+
});
|
|
166
|
+
const res = verifyMandateToken(t, { ...BOTH, now: BEFORE });
|
|
167
|
+
expect(res.verified).toBe(false);
|
|
168
|
+
expect(res.kid).toBe(v3.input.agent_kid);
|
|
169
|
+
expect(res.agent.status).toBe("failed");
|
|
170
|
+
expect(res.failures).toEqual(["kid_mismatch"]);
|
|
171
|
+
});
|
|
172
|
+
it("agentPublicKey and agentDidDocument together are refused", () => {
|
|
173
|
+
expect(() => verifyMandateToken(fixtureToken(v3), {
|
|
174
|
+
agentPublicKey: v3.agent_pubkey_hex,
|
|
175
|
+
agentDidDocument: document,
|
|
176
|
+
now: BEFORE,
|
|
177
|
+
})).toThrow(/not both/);
|
|
178
|
+
});
|
|
179
|
+
});
|
|
180
|
+
describe("rule 3: an expired token is not verified", () => {
|
|
181
|
+
it("one second past expires_at: NOT verified, and says why", () => {
|
|
182
|
+
const res = verifyMandateToken(fixtureToken(v3), { ...BOTH, now: AFTER });
|
|
183
|
+
expect(res.verified).toBe(false);
|
|
184
|
+
expect(res.agent.status).toBe("verified");
|
|
185
|
+
expect(res.issuer.status).toBe("verified");
|
|
186
|
+
expect(res.expired).toBe(true);
|
|
187
|
+
expect(res.failures).toEqual(["expired"]);
|
|
188
|
+
});
|
|
189
|
+
it("with no clock given, the verifier reads the real one (the fixtures expired in 2025)", () => {
|
|
190
|
+
const res = verifyMandateToken(fixtureToken(v3), BOTH);
|
|
191
|
+
expect(res.verified).toBe(false);
|
|
192
|
+
expect(res.expired).toBe(true);
|
|
193
|
+
});
|
|
194
|
+
it("at expires_at exactly it is still valid (the API refuses only after it)", () => {
|
|
195
|
+
const res = verifyMandateToken(fixtureToken(v3), { ...BOTH, now: v3.input.expires_at });
|
|
196
|
+
expect(res.verified).toBe(true);
|
|
197
|
+
});
|
|
198
|
+
});
|
|
199
|
+
describe("V4 (issued_at signed)", () => {
|
|
200
|
+
it("reconstructs the frozen 15-field V4 canonical string byte-for-byte", () => {
|
|
201
|
+
expect(reconstructSigningString(v4.input)).toBe(v4.canonical_string);
|
|
202
|
+
});
|
|
203
|
+
it("a V4 token verifies and exposes issued_at", () => {
|
|
204
|
+
const res = verifyMandateToken(fixtureToken(v4), {
|
|
205
|
+
agentPublicKey: v4.agent_pubkey_hex,
|
|
206
|
+
issuerPublicKey: v4.issuer_pubkey_hex,
|
|
207
|
+
now: BEFORE,
|
|
208
|
+
});
|
|
209
|
+
expect(res.verified).toBe(true);
|
|
210
|
+
expect(res.issuedAt).toBe(v4.input.issued_at);
|
|
211
|
+
expect(res.mandate.format_version).toBe(4);
|
|
212
|
+
});
|
|
213
|
+
it("a one-second change to issued_at breaks both signatures", () => {
|
|
214
|
+
const t = makeToken({ ...v4.input, issued_at: (v4.input.issued_at ?? 0) + 1 }, { signature: v4.hmac_sha256_hex, agent_sig: v4.agent_sig_b64url, issuer_sig: v4.issuer_sig_b64url, kid: v4.input.agent_kid });
|
|
215
|
+
const res = verifyMandateToken(t, {
|
|
216
|
+
agentPublicKey: v4.agent_pubkey_hex,
|
|
217
|
+
issuerPublicKey: v4.issuer_pubkey_hex,
|
|
218
|
+
now: BEFORE,
|
|
219
|
+
});
|
|
220
|
+
expect(res.verified).toBe(false);
|
|
221
|
+
expect(res.failures).toEqual(["agent_sig_invalid", "issuer_sig_invalid"]);
|
|
222
|
+
});
|
|
223
|
+
it("a V4 payload without issued_at is malformed", () => {
|
|
224
|
+
const { issued_at, ...rest } = v4.input;
|
|
225
|
+
void issued_at;
|
|
226
|
+
const res = decodeMandateToken(makeToken(rest, { signature: "00" }));
|
|
227
|
+
expect(res).toEqual({ ok: false, error: "invalid_payload" });
|
|
228
|
+
});
|
|
229
|
+
it("a format this verifier does not know is unsupported, not reconstructed as V3", () => {
|
|
230
|
+
const res = decodeMandateToken(makeToken({ ...v4.input, format_version: 5 }, { signature: "00" }));
|
|
231
|
+
expect(res).toEqual({ ok: false, error: "mandate_format_unsupported" });
|
|
232
|
+
});
|
|
233
|
+
});
|
|
234
|
+
//# sourceMappingURL=mandate-strict.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"mandate-strict.test.js","sourceRoot":"","sources":["../../src/__tests__/mandate-strict.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAc1D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;AACjF,MAAM,EAAE,GAAG,IAAI,CAAC,2BAA2B,CAAC,CAAC;AAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,2BAA2B,CAAC,CAAC;AAE7C,4EAA4E;AAC5E,+BAA+B;AAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;AAEtC,SAAS,SAAS,CAAC,MAA+B,EAAE,QAAiC;IACnF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,YAAY,CAAC,EAAW,EAAE,OAAiB,EAAE;IACpD,MAAM,QAAQ,GAA4B;QACxC,SAAS,EAAE,EAAE,CAAC,eAAe;QAC7B,SAAS,EAAE,EAAE,CAAC,gBAAgB;QAC9B,UAAU,EAAE,EAAE,CAAC,iBAAiB;QAChC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS;KACxB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACrE,SAAS,QAAQ,CAAC,OAAe,EAAE,OAAe;IAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,QAAQ;IACf,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAW,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuC;IAClE,OAAO;QACL,EAAE,EAAE,GAAG;QACP,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,CAAC,CAAC,GAAG;YACT,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,YAAY,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;SACpG,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC;AAE5F,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,QAAQ,GAAG,SAAS,CACxB,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAC/B,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,CAC7H,CAAC;QACF,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,MAAM,QAAQ,GAAG,qCAAqC,CAAC;IACvD,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,iDAAiD;IACrF,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE;QAChC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,gBAAgB,EAAE;QAChD,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KAC1C,CAAC,CAAC;IAEH,kGAAkG;IAClG,SAAS,WAAW,CAAC,QAAgB,EAAE,YAAoB;QACzD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC,MAAM,EAAE;YACvB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;YACpC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;YAC3C,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE;YACxE,gBAAgB,EAAE,QAAQ;YAC1B,eAAe,EAAE,EAAE,CAAC,iBAAiB;YACrC,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;YACrE,gBAAgB,EAAE,QAAQ;YAC1B,eAAe,EAAE,EAAE,CAAC,iBAAiB;YACrC,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE;YAC9E,gBAAgB,EAAE,QAAQ;YAC1B,eAAe,EAAE,EAAE,CAAC,iBAAiB;YACrC,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,gEAAgE;QAChE,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;YAC5B,SAAS,EAAE,EAAE,CAAC,eAAe;YAC7B,SAAS,EAAE,EAAE,CAAC,gBAAgB;YAC9B,UAAU,EAAE,EAAE,CAAC,iBAAiB;YAChC,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,EAAE,CACV,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE;YACnC,cAAc,EAAE,EAAE,CAAC,gBAAgB;YACnC,gBAAgB,EAAE,QAAQ;YAC1B,GAAG,EAAE,MAAM;SACZ,CAAC,CACH,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE;YAC/C,cAAc,EAAE,EAAE,CAAC,gBAAgB;YACnC,eAAe,EAAE,EAAE,CAAC,iBAAiB;YACrC,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,GAAG,SAAS,CACjB,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EACzD,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,CAC7H,CAAC;QACF,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,EAAE;YAChC,cAAc,EAAE,EAAE,CAAC,gBAAgB;YACnC,eAAe,EAAE,EAAE,CAAC,iBAAiB;YACrC,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC;QACxC,KAAK,SAAS,CAAC;QACf,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
@@ -6,6 +6,9 @@ import { agentDidFromKid, decodeMandateToken, reconstructSigningString, verifyEd
|
|
|
6
6
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
7
7
|
const FIXTURE_PATH = join(__dirname, "fixtures/canonical.v3.fixture.json");
|
|
8
8
|
const fx = JSON.parse(readFileSync(FIXTURE_PATH, "utf8"));
|
|
9
|
+
// The fixture expires 2025-01-01T00:00:00Z; verdicts that expect a pass read
|
|
10
|
+
// the clock inside its window (expiry itself: mandate-strict.test.ts).
|
|
11
|
+
const NOW = fx.input.expires_at - 3600;
|
|
9
12
|
/** Reproduce the enterprise `computeToken` envelope so we have a real token. */
|
|
10
13
|
function makeToken(fields, envelope) {
|
|
11
14
|
return Buffer.from(JSON.stringify({ ...fields, ...envelope }), "utf8").toString("base64url");
|
|
@@ -80,6 +83,7 @@ describe("@codespar/sdk/mandate — verifyMandateToken (high-level)", () => {
|
|
|
80
83
|
const res = verifyMandateToken(TOKEN, {
|
|
81
84
|
agentPublicKey: fx.agent_pubkey_hex,
|
|
82
85
|
issuerPublicKey: fx.issuer_pubkey_hex,
|
|
86
|
+
now: NOW,
|
|
83
87
|
});
|
|
84
88
|
expect(res.verified).toBe(true);
|
|
85
89
|
expect(res.agent.status).toBe("verified");
|
|
@@ -94,14 +98,16 @@ describe("@codespar/sdk/mandate — verifyMandateToken (high-level)", () => {
|
|
|
94
98
|
const res = verifyMandateToken(TOKEN, {
|
|
95
99
|
agentPublicKey: Buffer.from(fx.agent_pubkey_hex, "hex"),
|
|
96
100
|
issuerPublicKey: Buffer.from(fx.issuer_pubkey_hex, "hex"),
|
|
101
|
+
now: NOW,
|
|
97
102
|
});
|
|
98
103
|
expect(res.verified).toBe(true);
|
|
99
104
|
});
|
|
100
|
-
it("skips a signature when its key is not supplied
|
|
101
|
-
const res = verifyMandateToken(TOKEN, { agentPublicKey: fx.agent_pubkey_hex });
|
|
105
|
+
it("skips a signature when its key is not supplied, and is then NOT verified", () => {
|
|
106
|
+
const res = verifyMandateToken(TOKEN, { agentPublicKey: fx.agent_pubkey_hex, now: NOW });
|
|
102
107
|
expect(res.agent.status).toBe("verified");
|
|
103
108
|
expect(res.issuer.status).toBe("skipped");
|
|
104
|
-
expect(res.verified).toBe(
|
|
109
|
+
expect(res.verified).toBe(false);
|
|
110
|
+
expect(res.failures).toEqual(["issuer_sig_unchecked"]);
|
|
105
111
|
});
|
|
106
112
|
it("reports NOT verified when a supplied key fails", () => {
|
|
107
113
|
// Issuer key given for the agent slot → agent signature fails.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mandate.test.js","sourceRoot":"","sources":["../../src/__tests__/mandate.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACb,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;AAa3E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"mandate.test.js","sourceRoot":"","sources":["../../src/__tests__/mandate.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACb,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;AAa3E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAc,CAAC;AACvE,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;AAEvC,gFAAgF;AAChF,SAAS,SAAS,CAChB,MAA+B,EAC/B,QAAsF;IAEtF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,KAA2C,EAAE;IACtE,SAAS,EAAE,EAAE,CAAC,eAAe;IAC7B,SAAS,EAAE,EAAE,CAAC,gBAAgB;IAC9B,UAAU,EAAE,EAAE,CAAC,iBAAiB;IAChC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS;CACxB,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,OAA6C,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAA2C,CAAC,CAAC,CAAC,IAAI,CACnF,EAAE,CAAC,gBAAgB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CACJ,wBAAwB,CAAC;YACvB,GAAG,EAAE,CAAC,KAAK;YACX,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;SACM,CAAC,CACzC,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAEjE,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,CAAC,KAAK;YACX,MAAM,EAAE,MAAM;SACuB,CAAC,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE;YACpC,cAAc,EAAE,EAAE,CAAC,gBAAgB;YACnC,eAAe,EAAE,EAAE,CAAC,iBAAiB;YACrC,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE;YACpC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,CAAC;YACvD,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;YACzD,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,QAAQ,GAAG,SAAS,CACxB,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAC/B;YACE,SAAS,EAAE,EAAE,CAAC,eAAe;YAC7B,SAAS,EAAE,EAAE,CAAC,gBAAgB;YAC9B,UAAU,EAAE,EAAE,CAAC,iBAAiB;YAChC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS;SACxB,CACF,CAAC;QACF,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE;YACvC,cAAc,EAAE,EAAE,CAAC,gBAAgB;YACnC,eAAe,EAAE,EAAE,CAAC,iBAAiB;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,eAAe,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CACnE,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/dist/mandate/index.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* The signed mandate fields.
|
|
3
|
-
* `
|
|
2
|
+
* The signed mandate fields. `principal_kyc_ref` and `agent_kid` are absent on
|
|
3
|
+
* V2 and required from V3 on; `issued_at` is required on V4 and absent before.
|
|
4
4
|
*/
|
|
5
5
|
export interface MandateFields {
|
|
6
6
|
format_version: number;
|
|
@@ -18,10 +18,12 @@ export interface MandateFields {
|
|
|
18
18
|
parent_id?: string | null;
|
|
19
19
|
denomination?: string | null;
|
|
20
20
|
secret_version: number;
|
|
21
|
-
/** V3
|
|
21
|
+
/** V3+. Reference to the proofed CPF/CNPJ (Celcoin KYC) the agent acts for. */
|
|
22
22
|
principal_kyc_ref?: string | null;
|
|
23
|
-
/** V3
|
|
23
|
+
/** V3+. The agent key id (`<agent_did>#<n>`) that signed this mandate. */
|
|
24
24
|
agent_kid?: string | null;
|
|
25
|
+
/** V4-only. Issuance time, UNIX seconds. Signed, so it cannot be moved. */
|
|
26
|
+
issued_at?: number;
|
|
25
27
|
}
|
|
26
28
|
/** A decoded presentation token: the signed fields plus the signature envelope. */
|
|
27
29
|
export interface DecodedMandateToken {
|
|
@@ -53,13 +55,13 @@ export declare function decodeMandateToken(token: string): MandateDecodeResult;
|
|
|
53
55
|
/**
|
|
54
56
|
* Reconstruct the canonical signing string the Ed25519 signatures cover.
|
|
55
57
|
*
|
|
56
|
-
* Field order
|
|
57
|
-
* V3
|
|
58
|
-
*
|
|
59
|
-
*
|
|
60
|
-
*
|
|
61
|
-
*
|
|
62
|
-
*
|
|
58
|
+
* Field order: V2 = 12 fields; V3 = V2 + principal_kyc_ref + agent_kid (14);
|
|
59
|
+
* V4 = V3 with issued_at inserted before agent_kid (15), so agent_kid stays the
|
|
60
|
+
* last field. Absent optionals render empty so the separator count is
|
|
61
|
+
* invariant. `purposes` is comma-joined after a lexicographic sort with
|
|
62
|
+
* escaping (`\` → `\\` first, then `,` → `\,`). Colons inside `agent_kid` (from
|
|
63
|
+
* `did:web`) are emitted verbatim — the string is a one-way serialization,
|
|
64
|
+
* never re-split.
|
|
63
65
|
*/
|
|
64
66
|
export declare function reconstructSigningString(f: Record<string, unknown>): string;
|
|
65
67
|
/**
|
|
@@ -69,7 +71,10 @@ export declare function reconstructSigningString(f: Record<string, unknown>): st
|
|
|
69
71
|
export declare function verifyEd25519(signingString: string, signatureB64url: string, pub: Buffer): boolean;
|
|
70
72
|
/** Strip the `#<fragment>` from an agent key id to recover the bare agent DID. */
|
|
71
73
|
export declare function agentDidFromKid(kid: string): string;
|
|
72
|
-
/**
|
|
74
|
+
/**
|
|
75
|
+
* Per-signature outcome. `skipped` = carried but no key supplied to check it;
|
|
76
|
+
* `absent` = the token does not carry it. Neither is a pass.
|
|
77
|
+
*/
|
|
73
78
|
export type SignatureStatus = "verified" | "failed" | "skipped" | "absent";
|
|
74
79
|
export interface SignatureCheck {
|
|
75
80
|
present: boolean;
|
|
@@ -77,35 +82,69 @@ export interface SignatureCheck {
|
|
|
77
82
|
/** The key id associated with the signature (agent kid; issuer has none). */
|
|
78
83
|
kid?: string;
|
|
79
84
|
}
|
|
85
|
+
/**
|
|
86
|
+
* Why a token is not verified. Stable machine codes, in this order:
|
|
87
|
+
* - `kid_mismatch`: the envelope `kid` differs from the signed `agent_kid`;
|
|
88
|
+
* - `kid_not_in_document`: the agent DID document has no Ed25519 key under
|
|
89
|
+
* the kid the token names (no other key is tried);
|
|
90
|
+
* - `agent_sig_absent` / `issuer_sig_absent`: the token does not carry it;
|
|
91
|
+
* - `agent_sig_unchecked` / `issuer_sig_unchecked`: carried, no key given;
|
|
92
|
+
* - `agent_sig_invalid` / `issuer_sig_invalid`: checked and did not verify;
|
|
93
|
+
* - `expired`: the clock is past `expires_at`.
|
|
94
|
+
*/
|
|
95
|
+
export type MandateVerificationFailure = "kid_mismatch" | "kid_not_in_document" | "agent_sig_absent" | "agent_sig_unchecked" | "agent_sig_invalid" | "issuer_sig_absent" | "issuer_sig_unchecked" | "issuer_sig_invalid" | "expired";
|
|
80
96
|
export interface VerifyMandateOptions {
|
|
81
|
-
/**
|
|
97
|
+
/**
|
|
98
|
+
* Raw 32-byte Ed25519 agent public key — hex string or bytes. Passing a raw
|
|
99
|
+
* key asserts it is the key published under the token's `agent_kid`; to have
|
|
100
|
+
* the verifier pick it, pass `agentDidDocument` instead.
|
|
101
|
+
*/
|
|
82
102
|
agentPublicKey?: string | Uint8Array;
|
|
103
|
+
/**
|
|
104
|
+
* The agent's did:web document (parsed JSON). Only the `verificationMethod`
|
|
105
|
+
* whose `id` equals the token's signed `agent_kid` is used: a retired key
|
|
106
|
+
* listed beside it does not verify a token that names another kid.
|
|
107
|
+
* Mutually exclusive with `agentPublicKey`.
|
|
108
|
+
*/
|
|
109
|
+
agentDidDocument?: unknown;
|
|
83
110
|
/** Raw 32-byte Ed25519 issuer (platform) public key — hex string or bytes. */
|
|
84
111
|
issuerPublicKey?: string | Uint8Array;
|
|
112
|
+
/** The clock for the expiry check, in UNIX seconds. Default: now. */
|
|
113
|
+
now?: number;
|
|
85
114
|
}
|
|
86
115
|
export interface MandateVerification {
|
|
87
|
-
/**
|
|
116
|
+
/**
|
|
117
|
+
* True iff BOTH Ed25519 signatures are carried and verify, under the key the
|
|
118
|
+
* token names, and the token is not expired. Nothing unchecked counts.
|
|
119
|
+
*/
|
|
88
120
|
verified: boolean;
|
|
121
|
+
/** Why `verified` is false; empty exactly when it is true. */
|
|
122
|
+
failures: MandateVerificationFailure[];
|
|
123
|
+
/** The clock was past `expires_at`. */
|
|
124
|
+
expired: boolean;
|
|
89
125
|
mandate: MandateFields;
|
|
90
126
|
/** The bare agent DID (kid without its `#fragment`), when present. */
|
|
91
127
|
agentDid?: string;
|
|
92
|
-
/** The agent key id
|
|
128
|
+
/** The agent key id the token names: the signed `agent_kid` (V3+), else the envelope `kid`. */
|
|
93
129
|
kid?: string;
|
|
130
|
+
/** V4: the signed issuance time, UNIX seconds. */
|
|
131
|
+
issuedAt?: number;
|
|
94
132
|
agent: SignatureCheck;
|
|
95
133
|
issuer: SignatureCheck;
|
|
96
134
|
}
|
|
97
135
|
/**
|
|
98
|
-
* Offline-verify a V3 mandate presentation token against supplied
|
|
136
|
+
* Offline-verify a V3 or V4 mandate presentation token against supplied keys.
|
|
99
137
|
*
|
|
100
|
-
* Pure and network-free: you pass the
|
|
101
|
-
*
|
|
102
|
-
*
|
|
103
|
-
*
|
|
104
|
-
*
|
|
105
|
-
*
|
|
138
|
+
* Pure and network-free: you pass the issuer public key and the agent's public
|
|
139
|
+
* key (or its DID document) and it checks both signatures. `verified` is true
|
|
140
|
+
* only when both signatures are carried and verify, the agent signature under
|
|
141
|
+
* the key the token names, and the token has not expired. A V2 token carries
|
|
142
|
+
* no Ed25519 signature and is never verified here (its only proof is the org
|
|
143
|
+
* HMAC, which needs the org secret).
|
|
106
144
|
*
|
|
107
|
-
* Throws
|
|
108
|
-
* malformed token from a well-formed but unverified one)
|
|
145
|
+
* Throws on a token that cannot be decoded (so a caller can distinguish a
|
|
146
|
+
* malformed token from a well-formed but unverified one), and when both
|
|
147
|
+
* `agentPublicKey` and `agentDidDocument` are given.
|
|
109
148
|
*/
|
|
110
149
|
export declare function verifyMandateToken(token: string, opts?: VerifyMandateOptions): MandateVerification;
|
|
111
150
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mandate/index.ts"],"names":[],"mappings":"AAwBA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IAChD,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oBAAoB;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mandate/index.ts"],"names":[],"mappings":"AAwBA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IAChD,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oBAAoB;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB;wEACoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,iBAAiB,GAAG,4BAA4B,CAAA;CAAE,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAsCrE;AAwBD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CA0B3E;AAiBD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM,GACV,OAAO,CAWT;AAcD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,0BAA0B,GAClC,cAAc,GACd,qBAAqB,GACrB,kBAAkB,GAClB,qBAAqB,GACrB,mBAAmB,GACnB,mBAAmB,GACnB,sBAAsB,GACtB,oBAAoB,GACpB,SAAS,CAAC;AAEd,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,oBAAyB,GAC9B,mBAAmB,CA4DrB"}
|
package/dist/mandate/index.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* `@codespar/sdk/mandate` — offline V3 mandate verification.
|
|
2
|
+
* `@codespar/sdk/mandate` — offline V3/V4 mandate verification.
|
|
3
3
|
*
|
|
4
4
|
* A third party holding only a presentation token and a raw Ed25519 public key
|
|
5
5
|
* (from the agent's did:web document) can reconstruct the exact signing string
|
|
@@ -15,9 +15,9 @@
|
|
|
15
15
|
* if (!res.verified) throw new Error("mandate signature invalid");
|
|
16
16
|
* ```
|
|
17
17
|
*
|
|
18
|
-
* The byte format is frozen by the shared `canonical.v3.fixture.json`
|
|
19
|
-
*
|
|
20
|
-
* step. `node:crypto` is a Node builtin, not an npm dependency — the SDK's
|
|
18
|
+
* The byte format is frozen by the shared `canonical.v3.fixture.json` and
|
|
19
|
+
* `canonical.v4.fixture.json` (the same freezes the enterprise codec and the CLI
|
|
20
|
+
* pin), so all three impls stay in lock step. `node:crypto` is a Node builtin, not an npm dependency — the SDK's
|
|
21
21
|
* zero-runtime-dependency guarantee is intact.
|
|
22
22
|
*/
|
|
23
23
|
import { createPublicKey, verify as nodeVerify } from "node:crypto";
|
|
@@ -40,7 +40,10 @@ export function decodeMandateToken(token) {
|
|
|
40
40
|
}
|
|
41
41
|
const r = raw;
|
|
42
42
|
const version = r["format_version"];
|
|
43
|
-
|
|
43
|
+
// Only the formats whose signing string this module knows. A later format
|
|
44
|
+
// reconstructed with an older tail would fail as "tampered", which is the
|
|
45
|
+
// wrong answer: it is unreadable here, not forged.
|
|
46
|
+
if (typeof version !== "number" || !SUPPORTED_FORMATS.includes(version)) {
|
|
44
47
|
return { ok: false, error: "mandate_format_unsupported" };
|
|
45
48
|
}
|
|
46
49
|
if (!isValidMandateFields(r)) {
|
|
@@ -59,6 +62,7 @@ export function decodeMandateToken(token) {
|
|
|
59
62
|
decoded.kid = kid;
|
|
60
63
|
return { ok: true, token: decoded };
|
|
61
64
|
}
|
|
65
|
+
const SUPPORTED_FORMATS = [2, 3, 4];
|
|
62
66
|
function isValidMandateFields(r) {
|
|
63
67
|
if (typeof r["format_version"] !== "number")
|
|
64
68
|
return false;
|
|
@@ -78,24 +82,28 @@ function isValidMandateFields(r) {
|
|
|
78
82
|
return false;
|
|
79
83
|
if (typeof r["secret_version"] !== "number")
|
|
80
84
|
return false;
|
|
81
|
-
if (r["format_version"] === 3) {
|
|
85
|
+
if (r["format_version"] === 3 || r["format_version"] === 4) {
|
|
82
86
|
if (typeof r["principal_kyc_ref"] !== "string")
|
|
83
87
|
return false;
|
|
84
88
|
if (typeof r["agent_kid"] !== "string")
|
|
85
89
|
return false;
|
|
86
90
|
}
|
|
91
|
+
if (r["format_version"] === 4) {
|
|
92
|
+
if (typeof r["issued_at"] !== "number" || !Number.isInteger(r["issued_at"]))
|
|
93
|
+
return false;
|
|
94
|
+
}
|
|
87
95
|
return true;
|
|
88
96
|
}
|
|
89
97
|
/**
|
|
90
98
|
* Reconstruct the canonical signing string the Ed25519 signatures cover.
|
|
91
99
|
*
|
|
92
|
-
* Field order
|
|
93
|
-
* V3
|
|
94
|
-
*
|
|
95
|
-
*
|
|
96
|
-
*
|
|
97
|
-
*
|
|
98
|
-
*
|
|
100
|
+
* Field order: V2 = 12 fields; V3 = V2 + principal_kyc_ref + agent_kid (14);
|
|
101
|
+
* V4 = V3 with issued_at inserted before agent_kid (15), so agent_kid stays the
|
|
102
|
+
* last field. Absent optionals render empty so the separator count is
|
|
103
|
+
* invariant. `purposes` is comma-joined after a lexicographic sort with
|
|
104
|
+
* escaping (`\` → `\\` first, then `,` → `\,`). Colons inside `agent_kid` (from
|
|
105
|
+
* `did:web`) are emitted verbatim — the string is a one-way serialization,
|
|
106
|
+
* never re-split.
|
|
99
107
|
*/
|
|
100
108
|
export function reconstructSigningString(f) {
|
|
101
109
|
const esc = (s) => s.replace(/\\/g, "\\\\").replace(/,/g, "\\,");
|
|
@@ -119,9 +127,12 @@ export function reconstructSigningString(f) {
|
|
|
119
127
|
f["denomination"] ?? "",
|
|
120
128
|
String(f["secret_version"]),
|
|
121
129
|
];
|
|
122
|
-
if (version >= 3)
|
|
123
|
-
parts.push(f["principal_kyc_ref"] ?? ""
|
|
124
|
-
|
|
130
|
+
if (version >= 3)
|
|
131
|
+
parts.push(f["principal_kyc_ref"] ?? "");
|
|
132
|
+
if (version >= 4)
|
|
133
|
+
parts.push(f["issued_at"] == null ? "" : String(f["issued_at"]));
|
|
134
|
+
if (version >= 3)
|
|
135
|
+
parts.push(f["agent_kid"] ?? "");
|
|
125
136
|
return parts.join(":");
|
|
126
137
|
}
|
|
127
138
|
// A raw Ed25519 public key becomes an SPKI KeyObject by prefixing the fixed
|
|
@@ -168,19 +179,23 @@ export function agentDidFromKid(kid) {
|
|
|
168
179
|
return hash === -1 ? kid : kid.slice(0, hash);
|
|
169
180
|
}
|
|
170
181
|
/**
|
|
171
|
-
* Offline-verify a V3 mandate presentation token against supplied
|
|
182
|
+
* Offline-verify a V3 or V4 mandate presentation token against supplied keys.
|
|
172
183
|
*
|
|
173
|
-
* Pure and network-free: you pass the
|
|
174
|
-
*
|
|
175
|
-
*
|
|
176
|
-
*
|
|
177
|
-
*
|
|
178
|
-
*
|
|
184
|
+
* Pure and network-free: you pass the issuer public key and the agent's public
|
|
185
|
+
* key (or its DID document) and it checks both signatures. `verified` is true
|
|
186
|
+
* only when both signatures are carried and verify, the agent signature under
|
|
187
|
+
* the key the token names, and the token has not expired. A V2 token carries
|
|
188
|
+
* no Ed25519 signature and is never verified here (its only proof is the org
|
|
189
|
+
* HMAC, which needs the org secret).
|
|
179
190
|
*
|
|
180
|
-
* Throws
|
|
181
|
-
* malformed token from a well-formed but unverified one)
|
|
191
|
+
* Throws on a token that cannot be decoded (so a caller can distinguish a
|
|
192
|
+
* malformed token from a well-formed but unverified one), and when both
|
|
193
|
+
* `agentPublicKey` and `agentDidDocument` are given.
|
|
182
194
|
*/
|
|
183
195
|
export function verifyMandateToken(token, opts = {}) {
|
|
196
|
+
if (opts.agentPublicKey !== undefined && opts.agentDidDocument !== undefined) {
|
|
197
|
+
throw new TypeError("pass agentPublicKey or agentDidDocument, not both");
|
|
198
|
+
}
|
|
184
199
|
const decoded = decodeMandateToken(token);
|
|
185
200
|
if (!decoded.ok) {
|
|
186
201
|
throw new Error(`cannot decode mandate token: ${decoded.error}`);
|
|
@@ -188,14 +203,48 @@ export function verifyMandateToken(token, opts = {}) {
|
|
|
188
203
|
const t = decoded.token;
|
|
189
204
|
const m = t.mandate;
|
|
190
205
|
const signingString = reconstructSigningString(m);
|
|
191
|
-
const
|
|
206
|
+
const failures = [];
|
|
207
|
+
// The signed agent_kid names the key; the envelope kid is an unsigned copy
|
|
208
|
+
// and may not rename it.
|
|
209
|
+
const signedKid = typeof m.agent_kid === "string" ? m.agent_kid : undefined;
|
|
210
|
+
const kid = signedKid ?? t.kid;
|
|
211
|
+
const kidMismatch = signedKid !== undefined && t.kid !== undefined && t.kid !== signedKid;
|
|
192
212
|
const agentDid = kid ? agentDidFromKid(kid) : undefined;
|
|
193
|
-
|
|
213
|
+
let agentKey;
|
|
214
|
+
let kidMissing = false;
|
|
215
|
+
if (opts.agentDidDocument !== undefined) {
|
|
216
|
+
agentKey = kid ? keyForKid(opts.agentDidDocument, kid) : null;
|
|
217
|
+
kidMissing = agentKey === null;
|
|
218
|
+
}
|
|
219
|
+
else {
|
|
220
|
+
agentKey = toPubkey(opts.agentPublicKey);
|
|
221
|
+
}
|
|
222
|
+
let agent;
|
|
223
|
+
if (kidMismatch) {
|
|
224
|
+
failures.push("kid_mismatch");
|
|
225
|
+
agent = { present: Boolean(t.agent_sig), status: "failed", ...(kid ? { kid } : {}) };
|
|
226
|
+
}
|
|
227
|
+
else if (kidMissing && t.agent_sig) {
|
|
228
|
+
failures.push("kid_not_in_document");
|
|
229
|
+
agent = { present: true, status: "failed", ...(kid ? { kid } : {}) };
|
|
230
|
+
}
|
|
231
|
+
else {
|
|
232
|
+
agent = checkSignature(signingString, t.agent_sig, agentKey, kid);
|
|
233
|
+
if (agent.status !== "verified")
|
|
234
|
+
failures.push(failureFor("agent", agent.status));
|
|
235
|
+
}
|
|
194
236
|
const issuer = checkSignature(signingString, t.issuer_sig, toPubkey(opts.issuerPublicKey), undefined);
|
|
195
|
-
|
|
196
|
-
|
|
237
|
+
if (issuer.status !== "verified")
|
|
238
|
+
failures.push(failureFor("issuer", issuer.status));
|
|
239
|
+
const now = opts.now ?? Date.now() / 1000;
|
|
240
|
+
// The API refuses a mandate only once the clock is past expires_at.
|
|
241
|
+
const expired = now > m.expires_at;
|
|
242
|
+
if (expired)
|
|
243
|
+
failures.push("expired");
|
|
197
244
|
const result = {
|
|
198
|
-
verified:
|
|
245
|
+
verified: failures.length === 0,
|
|
246
|
+
failures,
|
|
247
|
+
expired,
|
|
199
248
|
mandate: m,
|
|
200
249
|
agent,
|
|
201
250
|
issuer,
|
|
@@ -204,8 +253,33 @@ export function verifyMandateToken(token, opts = {}) {
|
|
|
204
253
|
result.agentDid = agentDid;
|
|
205
254
|
if (kid)
|
|
206
255
|
result.kid = kid;
|
|
256
|
+
if (typeof m.issued_at === "number")
|
|
257
|
+
result.issuedAt = m.issued_at;
|
|
207
258
|
return result;
|
|
208
259
|
}
|
|
260
|
+
function failureFor(who, status) {
|
|
261
|
+
const suffix = status === "absent" ? "absent" : status === "skipped" ? "unchecked" : "invalid";
|
|
262
|
+
return `${who}_sig_${suffix}`;
|
|
263
|
+
}
|
|
264
|
+
/** The raw Ed25519 key a DID document publishes under exactly `kid`, or null. */
|
|
265
|
+
function keyForKid(doc, kid) {
|
|
266
|
+
if (!doc || typeof doc !== "object")
|
|
267
|
+
return null;
|
|
268
|
+
const methods = doc.verificationMethod;
|
|
269
|
+
if (!Array.isArray(methods))
|
|
270
|
+
return null;
|
|
271
|
+
for (const vm of methods) {
|
|
272
|
+
if (!vm || vm["id"] !== kid)
|
|
273
|
+
continue;
|
|
274
|
+
const jwk = vm["publicKeyJwk"];
|
|
275
|
+
if (!jwk || jwk["kty"] !== "OKP" || jwk["crv"] !== "Ed25519" || typeof jwk["x"] !== "string") {
|
|
276
|
+
return null;
|
|
277
|
+
}
|
|
278
|
+
const pub = Buffer.from(jwk["x"], "base64url");
|
|
279
|
+
return pub.length === 32 ? pub : null;
|
|
280
|
+
}
|
|
281
|
+
return null;
|
|
282
|
+
}
|
|
209
283
|
function checkSignature(signingString, sig, pub, kid) {
|
|
210
284
|
if (!sig)
|
|
211
285
|
return { present: false, status: "absent", ...(kid ? { kid } : {}) };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mandate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAkB,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mandate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAkB,MAAM,aAAa,CAAC;AAgDpF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpC,0EAA0E;IAC1E,0EAA0E;IAC1E,mDAAmD;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,CAK5D,CAAC;IACF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,OAAO,EAAE,MAAuB,EAAE,SAAS,EAAE,CAAC;IACrF,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IACjE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,iBAAiB,GAAsB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEvD,SAAS,oBAAoB,CAAC,CAA0B;IACtD,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAA0B;IACjE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,CAAE,CAAC,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC;SACjD,KAAK,EAAE;SACP,IAAI,EAAE;SACN,GAAG,CAAC,GAAG,CAAC;SACR,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAc;QACvB,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC;QACP,CAAC,CAAC,UAAU,CAAC;QACb,CAAC,CAAC,MAAM,CAAC;QACT,CAAC,CAAC,QAAQ,CAAC;QACX,CAAC,CAAC,UAAU,CAAC;QACb,QAAQ;QACR,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACvB,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE;QACrB,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;QACpB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE;QACvB,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;KAC5B,CAAC;IACF,IAAI,OAAO,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,eAAuB,EACvB,GAAW;IAEX,IAAI,CAAC;QACH,OAAO,UAAU,CACf,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAClC,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAAoC;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AA6ED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,OAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,MAAM,aAAa,GAAG,wBAAwB,CAAC,CAAuC,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAElD,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,GAAG,GAAG,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC;IAC/B,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IAC1F,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExD,IAAI,QAAuB,CAAC;IAC5B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,UAAU,GAAG,QAAQ,KAAK,IAAI,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,KAAqB,CAAC;IAC1B,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9B,KAAK,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvF,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;IACtG,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC1C,oEAAoE;IACpE,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC;IACnC,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAwB;QAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,QAAQ;QACR,OAAO;QACP,OAAO,EAAE,CAAC;QACV,KAAK;QACL,MAAM;KACP,CAAC;IACF,IAAI,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzC,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CACjB,GAAuB,EACvB,MAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,OAAO,GAAG,GAAG,QAAQ,MAAM,EAAgC,CAAC;AAC9D,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,GAAY,EAAE,GAAW;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAI,GAAwC,CAAC,kBAAkB,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,OAAgD,EAAE,CAAC;QAClE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,EAAE,CAAC,cAAc,CAAwC,CAAC;QACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,aAAqB,EACrB,GAAuB,EACvB,GAAkB,EAClB,GAAuB;IAEvB,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,EAAE,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxF,CAAC"}
|
package/package.json
CHANGED