@digitalbazaar/ezcap-express 4.4.0 → 4.5.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @digitalbazaar/ezcap-express Changelog
 
+## 4.5.0 - 2021-12-17
+
+### Fixed
+- Add `_createGetRevocationRootController` wrapper around
+  `_getRevocationRootController` and pass `getRootController` to it.
+
+### Added
+- Add tests for `authorizeZcapRevocation`.
+
 ## 4.4.0 - 2021-12-15
 
 ### Added

package/lib/revoke.js

@@ -53,7 +53,9 @@ export function authorizeZcapRevocation({
       onError
     }),
     authorizeZcapInvocationAfterParse({
-      documentLoader, getRootController: _getRevocationRootController,
+      documentLoader,
+      getRootController: _createGetRevocationRootController(
+        {getRootController}),
       suiteFactory, allowTargetAttenuation, inspectCapabilityChain, onError
     })
   ];
@@ -131,41 +133,39 @@ async function _verifyDelegation({
   return results;
 }
 
-async function _getRevocationRootController({
-  req, rootCapabilityId, rootInvocationTarget, getRootController,
-  revocationsSubPath = '/revocations/'
+function _createGetRevocationRootController({
+  getRootController, revocationsSubPath = '/revocations/'
 }) {
-  // if `revocations` is not in the root invocation target, then defer to
-  // `getRootController` to try and provide the root controller
-  if(!rootInvocationTarget.includes(revocationsSubPath)) {
-    return getRootController({req, rootCapabilityId, rootInvocationTarget});
-  }
-
-  /* Note: If the invocation target is a zcap-specific revocation endpoint,
-  we use all zcap controllers from the submitted zcap's chain as the root
-  controller value for the target.
-
-  This approach allows any party that has delegated a zcap or received one
-  to be able to send it for revocation. Subsequent code (in the revocation
-  route handler) will confirm that the delegation is proper and the zcap from
-  which it was delegated has not itself been revoked.
-
-  To be clear, if the delegation chain is:
-
-  root -> A -> B
-
-  Any zcap controller in the chain of B may invoke a root zcap with a
-  `target` of `<baseUrl>/revocations/<ID of B>` (and an ID of
-  `urn:zcap:root:encodeURIComponent(<baseUrl>/revocations/<ID of B>)`). This
-  means that `root`, `A`, or `B` may revoke `B`.
-
-  As long no other zcap in the chain of `B` (e.g., `A`) has already been
-  revoked, then `B` will be revoked and stored as a revocation until `B`
-  expires. */
+  return async function _getRevocationRootController({
+    req, rootCapabilityId, rootInvocationTarget
+  }) {
+    // if `revocations` is not in the root invocation target, then defer to
+    // `getRootController` to try and provide the root controller
+    if(!rootInvocationTarget.includes(revocationsSubPath)) {
+      return getRootController({req, rootCapabilityId, rootInvocationTarget});
+    }
 
-  // use all `chainControllers`
-  // presumes `verifyCapabilityDelegation` middleware already called
-  return req.zcapRevocation.chainControllers;
+    /* Note: If the invocation target is a zcap-specific revocation endpoint,
+      we use all zcap controllers from the submitted zcap's chain as the root
+      controller value for the target.
+      This approach allows any party that has delegated a zcap or received one
+      to be able to send it for revocation. Subsequent code (in the revocation
+      route handler) will confirm that the delegation is proper and the zcap
+      from which it was delegated has not itself been revoked.
+      To be clear, if the delegation chain is:
+      root -> A -> B
+      Any zcap controller in the chain of B may invoke a root zcap with a
+      `target` of `<baseUrl>/revocations/<ID of B>` (and an ID of
+      `urn:zcap:root:encodeURIComponent(<baseUrl>/revocations/<ID of B>)`). This
+      means that `root`, `A`, or `B` may revoke `B`.
+      As long no other zcap in the chain of `B` (e.g., `A`) has already been
+      revoked, then `B` will be revoked and stored as a revocation until `B`
+      expires. */
+
+    // use all `chainControllers`
+    // presumes `verifyCapabilityDelegation` middleware already called
+    return req.zcapRevocation.chainControllers;
+  };
 }
 
 function _captureChainControllers({inspectCapabilityChain, chainControllers}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitalbazaar/ezcap-express",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "main": "lib",
   "module": "main.js",
   "repository": {