@cubist-labs/cubesigner-sdk 0.4.280 → 0.4.284

package/package.json

@@ -5,7 +5,7 @@
     "url": "git+https://github.com/cubist-labs/CubeSigner-TypeScript-SDK.git",
     "directory": "packages/sdk"
   },
-  "version": "0.4.280",
+  "version": "0.4.284",
   "type": "module",
   "description": "CubeSigner TypeScript SDK",
   "license": "MIT OR Apache-2.0",

package/src/key.ts

@@ -32,8 +32,10 @@ import type {
   KeyPropertiesPatch,
   Eip7702SignRequest,
   SignResponse,
+  Scope,
 } from "./schema_types.ts";
 import type {
+  Ace,
   ApiClient,
   AvaChain,
   BabylonRegistrationRequest,
@@ -59,6 +61,18 @@ import { encodeToHex, encodeToBase64 } from "./util.ts";
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 import type { KeyAttestationClaims } from "./schema_types.ts";
 
+/**
+ * Key access-control entry.
+ *
+ * This type allows specifying any valid {@link Scope} as an action, but CubeSigner
+ * denies setting invalid / unsupported actions.
+ */
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export type KeyAce = Ace<Scope, {}>;
+
+/** Key ACL type. */
+export type KeyAcl = KeyAce[];
+
 /** Secp256k1 key type */
 export enum Secp256k1 {
   Evm = "SecpEthAddr",
@@ -252,6 +266,17 @@ export class Key {
     await this.update({ policy }, mfaReceipt);
   }
 
+  /**
+   * Set new ACL (overwriting any existing ACL previously set for this key)
+   *
+   * @param acl The new ACL to set, or `null` to clear the ACL.
+   * @param mfaReceipt Optional MFA receipt(s)
+   * @throws if MFA is required and no receipts are provided
+   */
+  async setAcl(acl: KeyAcl | null, mfaReceipt?: MfaReceipts) {
+    await this.update({ acl }, mfaReceipt);
+  }
+
   /**
    * Set new edit policy (overwriting any edit policies previously set for this key)
    *
@@ -412,6 +437,31 @@ export class Key {
     return (data.policy ?? []) as unknown as KeyPolicy;
   }
 
+  /**
+   * Append to existing key ACL. This append is not atomic -- it uses {@link acl}
+   * to fetch the current ACL and then {@link setAcl} to set the ACL -- and
+   * should not be used across concurrent sessions.
+   *
+   * @param acl The ACL to append to the existing one.
+   * @param mfaReceipt Optional MFA receipt(s)
+   * @throws If MFA is required and no MFA receipts are provided
+   */
+  async appendAcl(acl: KeyAcl, mfaReceipt?: MfaReceipts) {
+    const existing = await this.acl();
+    const newAcl: KeyAcl = [...(existing ?? []), ...acl];
+    await this.update({ acl: newAcl, version: this.cached.version }, mfaReceipt);
+  }
+
+  /**
+   * Get the key ACL.
+   *
+   * @returns The key ACL, or `undefined` if it is not set.
+   */
+  async acl(): Promise<KeyAcl | undefined> {
+    const data = await this.fetch();
+    return data.acl as unknown as KeyAcl | undefined;
+  }
+
   /**
    * Get the edit policy for the key.
    *