@docknetwork/wallet-sdk-core 1.7.6 → 1.9.0

package/lib/delegation/delegation-offer.d.ts

@@ -0,0 +1,84 @@
+type DelegationOffer = {
+    id: string;
+    messageId?: string;
+    issuerDID?: string;
+    status: 'sent' | 'requested' | 'accepted' | 'rejected';
+    expiresAt?: string;
+    [key: string]: any;
+};
+export type DelegationOfferPreview = {
+    id: string;
+    issuerDID: string;
+    issuerName?: string;
+    role: string;
+    createdAt: string;
+    expiresAt?: string;
+};
+export declare function createDelegationOffer({ wallet, issuerDID, delegationPolicy, delegationRole, credentialId, expiresInMs, }: {
+    wallet: any;
+    issuerDID: string;
+    delegationPolicy: any;
+    delegationRole: string;
+    credentialId?: string;
+    expiresInMs?: number;
+}): Promise<{
+    id: string;
+    credentialId: string;
+    issuerDID: string;
+    issuerName: any;
+    issuer: {
+        did: string;
+    };
+    to: any;
+    delegationPolicy: import("./delegation-types").DelegationPolicy;
+    delegationRole: string;
+    capabilities: any[];
+    attributes: any[];
+    delegationConstraints: {};
+    sentAt: string;
+    expiresAt: string;
+    updatedAt: any;
+    status: string;
+}>;
+export declare function createOOBInvitation(issuerDID: any, delegationOffer: any, { goal, issuerName }: {
+    goal: string;
+    issuerName?: string;
+}): string;
+export declare function decodeMessage(message: any): any;
+export declare function acceptDelegationOffer({ delegationOffer, wallet, messageProvider, }: {
+    delegationOffer: DelegationOffer;
+    wallet: any;
+    messageProvider: any;
+}): Promise<void>;
+export declare const INVITATION_HANDLER: {
+    check: (message: any) => boolean;
+    handle: (message: any, { wallet }: {
+        wallet: any;
+    }) => Promise<void>;
+};
+export declare const DELEGATION_REQUEST_HANDLER: {
+    check: (message: any) => boolean;
+    handle: (message: any, { wallet, messageProvider }: {
+        wallet: any;
+        messageProvider: any;
+    }) => Promise<void>;
+};
+export declare const ISSUE_CREDENTIAL_HANDLER: {
+    check: (message: any) => boolean;
+    handle: (message: any, { wallet, messageProvider }: {
+        wallet: any;
+        messageProvider: any;
+    }) => Promise<void>;
+};
+export declare const messageHandlers: {
+    check: (message: any) => boolean;
+    handle: (message: any, { wallet }: {
+        wallet: any;
+    }) => Promise<void>;
+}[];
+export declare function handleMessage(message: any, context: {
+    wallet: any;
+    messageProvider: any;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=delegation-offer.d.ts.map

package/lib/delegation/delegation-offer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-offer.d.ts","sourceRoot":"","sources":["../../src/delegation/delegation-offer.ts"],"names":[],"mappings":"AAwCA,KAAK,eAAe,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAIF,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,WAAyC,GAC1C,EAAE;IACD,MAAM,EAAE,GAAG,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,GAAG,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;;;;;;;;;;;;;;;;;;GA0DA;AAGD,wBAAgB,mBAAmB,CACjC,SAAS,KAAA,EACT,eAAe,KAAA,EACf,EAAC,IAAI,EAAE,UAAU,EAAC,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAC,UAsCxD;AAID,wBAAgB,aAAa,CAAC,OAAO,KAAA,OAkBpC;AAED,wBAAsB,qBAAqB,CAAC,EAC1C,eAAe,EACf,MAAM,EACN,eAAe,GAChB,EAAE;IACD,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,EAAE,GAAG,CAAC;IACZ,eAAe,EAAE,GAAG,CAAC;CACtB,iBA6BA;AAGD,eAAO,MAAM,kBAAkB;;;;;CA0B9B,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;CA0GtC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;CAiFpC,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;GAI3B,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,KAAA,EACP,OAAO,EAAE;IACP,MAAM,MAAC;IACP,eAAe,MAAC;CACjB,iBAiBF"}

package/lib/delegation/delegation-offer.js

@@ -0,0 +1,349 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.messageHandlers = exports.ISSUE_CREDENTIAL_HANDLER = exports.DELEGATION_REQUEST_HANDLER = exports.INVITATION_HANDLER = void 0;
+exports.createDelegationOffer = createDelegationOffer;
+exports.createOOBInvitation = createOOBInvitation;
+exports.decodeMessage = decodeMessage;
+exports.acceptDelegationOffer = acceptDelegationOffer;
+exports.handleMessage = handleMessage;
+const assert_1 = __importDefault(require("assert"));
+const uuid_1 = require("uuid");
+const logger_1 = require("@docknetwork/wallet-sdk-data-store/lib/logger");
+const did_provider_1 = require("../did-provider");
+const delegation_issuance_1 = require("./delegation-issuance");
+const delegation_chain_1 = require("./delegation-chain");
+const delegation_policy_1 = require("./delegation-policy");
+const delegation_utils_1 = require("./delegation-utils");
+const delegation_policy_validation_1 = require("./delegation-policy-validation");
+const GOAL_CODE = 'dock.offer-delegation';
+const OOB_INVITATION = 'https://didcomm.org/out-of-band/2.0/invitation';
+const REQUEST_CREDENTIAL = 'https://didcomm.org/issue-credential/3.0/request-credential';
+const ISSUE_CREDENTIAL = 'https://didcomm.org/issue-credential/3.0/issue-credential';
+const ACK = 'https://didcomm.org/issue-credential/3.0/ack';
+function base64urlEncode(input) {
+    return Buffer.from(input, 'utf8')
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+function base64urlDecode(input) {
+    const padded = input.replace(/-/g, '+').replace(/_/g, '/');
+    const padLen = (4 - (padded.length % 4)) % 4;
+    return Buffer.from(padded + '='.repeat(padLen), 'base64').toString('utf8');
+}
+function pickDID(value) {
+    if (!value)
+        return undefined;
+    return Array.isArray(value) ? value[0] : value;
+}
+const DEFAULT_OFFER_EXPIRATION_MS = 24 * 60 * 60 * 1000;
+async function createDelegationOffer({ wallet, issuerDID, delegationPolicy, delegationRole, credentialId, expiresInMs = DEFAULT_OFFER_EXPIRATION_MS, }) {
+    (0, delegation_policy_validation_1.validateDelegationPolicy)(delegationPolicy);
+    (0, assert_1.default)(delegationPolicy.ruleset.roles.some(r => r.roleId === delegationRole), `delegationRole "${delegationRole}" not found in delegationPolicy.ruleset.roles`);
+    if (credentialId) {
+        const parentCredential = await wallet.getDocumentById(credentialId);
+        if (parentCredential) {
+            (0, assert_1.default)((0, delegation_utils_1.isDelegatableCredential)(parentCredential), `Credential ${credentialId} is not delegatable`);
+            const parentDetails = await (0, delegation_policy_1.getDelegationDetails)(parentCredential, wallet);
+            if (parentDetails.delegationPolicy) {
+                (0, delegation_policy_validation_1.assertPolicyConformsToParent)(delegationPolicy, parentDetails.delegationPolicy, {
+                    delegationRole,
+                    remainingDepth: parentDetails.remainingDelegationDepth,
+                });
+            }
+        }
+    }
+    const dids = await (0, did_provider_1.getAllDIDs)({ wallet });
+    const issuer = dids.find(d => d.didDocument.id === issuerDID);
+    const issuerName = issuer?.name;
+    const offerId = (0, uuid_1.v4)();
+    const sentAt = new Date();
+    const delegationOffer = {
+        id: offerId,
+        credentialId: credentialId,
+        issuerDID,
+        issuerName,
+        issuer: {
+            did: issuerDID,
+        },
+        to: undefined,
+        delegationPolicy,
+        delegationRole,
+        capabilities: [],
+        attributes: [],
+        delegationConstraints: {},
+        sentAt: sentAt.toISOString(),
+        expiresAt: new Date(sentAt.getTime() + expiresInMs).toISOString(),
+        updatedAt: null,
+        status: 'sent',
+    };
+    // Persist on the issuer side so DELEGATION_REQUEST_HANDLER can look it up
+    // when the holder replies with a credential request.
+    await wallet.addDocument({
+        type: 'DelegationOffer',
+        ...delegationOffer,
+    });
+    return delegationOffer;
+}
+// OOB invitation (issuer → holder via QR/link)
+function createOOBInvitation(issuerDID, delegationOffer, { goal, issuerName }) {
+    (0, assert_1.default)(!!goal, 'goal is required');
+    const finalIssuerName = issuerName ?? delegationOffer.issuerName;
+    const preview = {
+        id: delegationOffer.id,
+        issuerDID: issuerDID,
+        issuerName: finalIssuerName,
+        role: delegationOffer.delegationRole,
+        createdAt: delegationOffer.sentAt,
+        expiresAt: delegationOffer.expiresAt,
+    };
+    const delegationOfferMessage = {
+        type: OOB_INVITATION,
+        id: delegationOffer.id,
+        from: issuerDID,
+        body: {
+            goal_code: GOAL_CODE,
+            goal,
+            offer_id: delegationOffer.id,
+        },
+        attachments: [
+            {
+                id: delegationOffer.id,
+                media_type: 'application/json',
+                data: { json: preview },
+            },
+        ],
+    };
+    const offerUrl = 'didcomm://?_oob=' +
+        base64urlEncode(JSON.stringify(delegationOfferMessage));
+    return offerUrl;
+}
+// Decode an OOB invitation URL into a DIDComm message object.
+// Returns the input unchanged if it's already an object.
+function decodeMessage(message) {
+    if (typeof message !== 'string') {
+        return message;
+    }
+    const oobPrefix = 'didcomm://?_oob=';
+    if (!message.startsWith(oobPrefix)) {
+        logger_1.logger.debug('decodeMessage: unrecognized URL scheme, skipping');
+        return null;
+    }
+    const encoded = message.slice(oobPrefix.length);
+    try {
+        return JSON.parse(base64urlDecode(encoded));
+    }
+    catch (err) {
+        logger_1.logger.error(`decodeMessage: failed to decode OOB payload: ${err}`);
+        return null;
+    }
+}
+async function acceptDelegationOffer({ delegationOffer, wallet, messageProvider, }) {
+    const issuerDID = delegationOffer.issuerDID;
+    const holderDID = await (0, did_provider_1.getDefaultDID)({ wallet });
+    const dids = await (0, did_provider_1.getAllDIDs)({ wallet });
+    const holderName = dids.find(d => d.didDocument.id === holderDID)?.name;
+    const requestCredentialMessage = {
+        type: REQUEST_CREDENTIAL,
+        pthid: delegationOffer.messageId, // parent thread = the OOB invitation
+        from: holderDID,
+        to: issuerDID,
+        body: {
+            goal_code: GOAL_CODE,
+            sender_profile: { name: holderName },
+            offer_id: delegationOffer.id,
+        },
+    };
+    await messageProvider.sendMessage(requestCredentialMessage);
+    // Mirror issuer-side bookkeeping: mark the holder's stored offer as accepted.
+    const storedOffer = await wallet.getDocumentById(delegationOffer.id);
+    if (storedOffer) {
+        await wallet.updateDocument({
+            ...storedOffer,
+            status: 'requested',
+            updatedAt: new Date().toISOString(),
+        });
+    }
+}
+// Delegation message handlers
+exports.INVITATION_HANDLER = {
+    check: function (message) {
+        return (message.type === OOB_INVITATION && message.body?.goal_code === GOAL_CODE);
+    },
+    handle: async function (message, { wallet }) {
+        const offerAttachment = message.attachments?.[0]?.data?.json ?? {};
+        const delegationOffer = {
+            ...offerAttachment,
+            id: message.body.offer_id,
+            messageId: message.id,
+            issuerDID: message.from,
+            status: 'sent',
+        };
+        await wallet.addDocument({
+            type: 'DelegationOffer',
+            ...delegationOffer,
+        });
+        logger_1.logger.debug(`INVITATION_HANDLER: emitting delegationOfferReceived for offer ${delegationOffer.id}`);
+        wallet.eventManager.emit('delegationOfferReceived', delegationOffer);
+    },
+};
+exports.DELEGATION_REQUEST_HANDLER = {
+    check: function (message) {
+        return (message.type === REQUEST_CREDENTIAL &&
+            message.body?.goal_code === GOAL_CODE);
+    },
+    handle: async function (message, { wallet, messageProvider }) {
+        const offerId = message.body.offer_id;
+        const delegationOffer = await wallet.getDocumentById(offerId);
+        if (!delegationOffer) {
+            logger_1.logger.debug(`DELEGATION_REQUEST_HANDLER: no matching delegation offer found for request ${offerId}`);
+            return;
+        }
+        // Authorization checks: only the targeted holder (if any) may accept,
+        // and the offer must still be in the 'sent' state to prevent replay.
+        if (delegationOffer.status !== 'sent') {
+            logger_1.logger.warn(`DELEGATION_REQUEST_HANDLER: rejecting request for offer ${offerId} — already ${delegationOffer.status}`);
+            return;
+        }
+        if (delegationOffer.to) {
+            const targets = Array.isArray(delegationOffer.to)
+                ? delegationOffer.to
+                : [delegationOffer.to];
+            if (!targets.includes(message.from)) {
+                logger_1.logger.warn(`DELEGATION_REQUEST_HANDLER: rejecting request for offer ${offerId} — sender does not match offer.to`);
+                return;
+            }
+        }
+        if (delegationOffer.expiresAt &&
+            new Date(delegationOffer.expiresAt) < new Date()) {
+            logger_1.logger.debug(`DELEGATION_REQUEST_HANDLER: rejecting expired offer ${offerId}`);
+            return;
+        }
+        const parentCredential = await wallet.getDocumentById(delegationOffer.credentialId);
+        try {
+            (0, delegation_policy_validation_1.validateDelegationPolicy)(delegationOffer.delegationPolicy);
+            if (parentCredential && (0, delegation_utils_1.isDelegatableCredential)(parentCredential)) {
+                const parentDetails = await (0, delegation_policy_1.getDelegationDetails)(parentCredential, wallet);
+                if (parentDetails.delegationPolicy) {
+                    (0, delegation_policy_validation_1.assertPolicyConformsToParent)(delegationOffer.delegationPolicy, parentDetails.delegationPolicy, {
+                        delegationRole: delegationOffer.delegationRole,
+                        remainingDepth: parentDetails.remainingDelegationDepth,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            logger_1.logger.warn(`DELEGATION_REQUEST_HANDLER: rejecting offer ${offerId} — policy validation failed: ${err.message}`);
+            return;
+        }
+        const holderDID = message.from;
+        delegationOffer.status = 'accepted';
+        delegationOffer.holderDID = holderDID;
+        delegationOffer.updatedAt = new Date().toISOString();
+        await wallet.updateDocument(delegationOffer);
+        const issuerDID = pickDID(message.to);
+        const delegatedCredential = await (0, delegation_issuance_1.delegateCredential)({
+            credential: parentCredential,
+            wallet,
+            delegationPolicy: delegationOffer.delegationPolicy,
+            roleId: delegationOffer.delegationRole,
+            delegatorDID: delegationOffer.issuerDID || issuerDID,
+        });
+        const delegationChain = await (0, delegation_chain_1.getDelegationChain)(parentCredential, wallet);
+        await messageProvider.sendMessage({
+            type: ISSUE_CREDENTIAL,
+            from: issuerDID,
+            to: holderDID,
+            message: {
+                goal_code: GOAL_CODE,
+                delegationOfferId: delegationOffer.id,
+                credentials: [delegatedCredential],
+                delegationChain,
+            },
+        });
+    },
+};
+exports.ISSUE_CREDENTIAL_HANDLER = {
+    check: function (message) {
+        return (message.type === ISSUE_CREDENTIAL &&
+            message.body?.goal_code === GOAL_CODE);
+    },
+    handle: async function (message, { wallet, messageProvider }) {
+        const offerId = message.body.delegationOfferId;
+        if (!offerId) {
+            logger_1.logger.debug('ISSUE_CREDENTIAL_HANDLER: missing delegationOfferId in message body');
+            return;
+        }
+        const storedOffer = await wallet.getDocumentById(offerId);
+        if (!storedOffer) {
+            logger_1.logger.debug(`ISSUE_CREDENTIAL_HANDLER: no stored offer found for ${offerId}`);
+            return;
+        }
+        // SECURITY: only accept credentials from the DID that originally made the offer
+        if (message.from !== storedOffer.issuerDID) {
+            logger_1.logger.debug(`ISSUE_CREDENTIAL_HANDLER: rejecting credential for offer ${offerId} — sender ${message.from} does not match stored issuerDID ${storedOffer.issuerDID}`);
+            return;
+        }
+        const credentials = message.body.credentials ?? [];
+        const delegationChain = message.body.delegationChain ?? [];
+        if (credentials.length === 0) {
+            logger_1.logger.debug(`ISSUE_CREDENTIAL_HANDLER: no credentials in message for offer ${offerId}`);
+            return;
+        }
+        for (const credential of credentials) {
+            await wallet.addDocument(credential);
+        }
+        for (const ancestor of delegationChain) {
+            const existing = await wallet.getDocumentById(ancestor.id);
+            if (!existing) {
+                await wallet.addDocument(ancestor);
+            }
+        }
+        await wallet.updateDocument({
+            ...storedOffer,
+            status: 'accepted',
+            updatedAt: new Date().toISOString(),
+        });
+        const holderDID = pickDID(message.to);
+        const issuerDID = message.from;
+        await messageProvider.sendMessage({
+            type: ACK,
+            from: holderDID,
+            to: issuerDID,
+            pthid: message.id,
+            body: {
+                goal_code: GOAL_CODE,
+                delegationOfferId: offerId,
+                status: 'OK',
+            },
+        });
+        wallet.eventManager.emit('delegatedCredentialReceived', {
+            delegationOfferId: offerId,
+            credentials,
+            delegationChain,
+        });
+    },
+};
+exports.messageHandlers = [
+    exports.INVITATION_HANDLER,
+    exports.DELEGATION_REQUEST_HANDLER,
+    exports.ISSUE_CREDENTIAL_HANDLER,
+];
+async function handleMessage(message, context) {
+    const decoded = decodeMessage(message);
+    if (!decoded) {
+        logger_1.logger.debug('handleMessage: message could not be decoded, skipping');
+        return;
+    }
+    const handler = exports.messageHandlers.find(h => h.check(decoded));
+    if (!handler) {
+        logger_1.logger.debug(`handleMessage: no handler matched message type ${decoded.type}`);
+        return;
+    }
+    return handler.handle(decoded, context);
+}
+//# sourceMappingURL=delegation-offer.js.map

package/lib/delegation/delegation-offer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-offer.js","sourceRoot":"","sources":["../../src/delegation/delegation-offer.ts"],"names":[],"mappings":";;;;;;AA4DA,sDAwEC;AAGD,kDAyCC;AAID,sCAkBC;AAED,sDAqCC;AAoOD,sCAsBC;AAveD,oDAA4B;AAC5B,+BAAgC;AAChC,0EAAqE;AACrE,kDAA0D;AAC1D,+DAAyD;AACzD,yDAAsD;AACtD,2DAAyD;AACzD,yDAA2D;AAC3D,iFAGwC;AAExC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,MAAM,cAAc,GAAG,gDAAgD,CAAC;AACxE,MAAM,kBAAkB,GACtB,6DAA6D,CAAC;AAChE,MAAM,gBAAgB,GACpB,2DAA2D,CAAC;AAC9D,MAAM,GAAG,GAAG,8CAA8C,CAAC;AAE3D,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;SAC9B,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,OAAO,CAAC,KAAoC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAoBD,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,KAAK,UAAU,qBAAqB,CAAC,EAC1C,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,WAAW,GAAG,2BAA2B,GAQ1C;IACC,IAAA,uDAAwB,EAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAA,gBAAM,EACJ,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,EACrE,mBAAmB,cAAc,+CAA+C,CACjF,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACpE,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAA,gBAAM,EACJ,IAAA,0CAAuB,EAAC,gBAAgB,CAAC,EACzC,cAAc,YAAY,qBAAqB,CAChD,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,IAAA,wCAAoB,EAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAC3E,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;gBACnC,IAAA,2DAA4B,EAAC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,EAAE;oBAC7E,cAAc;oBACd,cAAc,EAAE,aAAa,CAAC,wBAAwB;iBACvD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAA,yBAAU,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC;IAEhC,MAAM,OAAO,GAAG,IAAA,SAAI,GAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,MAAM,eAAe,GAAG;QACtB,EAAE,EAAE,OAAO;QACX,YAAY,EAAE,YAAY;QAC1B,SAAS;QACT,UAAU;QACV,MAAM,EAAE;YACN,GAAG,EAAE,SAAS;SACf;QACD,EAAE,EAAE,SAAS;QACb,gBAAgB;QAChB,cAAc;QACd,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE;QACd,qBAAqB,EAAE,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE;QACjE,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,MAAM,CAAC,WAAW,CAAC;QACvB,IAAI,EAAE,iBAAiB;QACvB,GAAG,eAAe;KACnB,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,+CAA+C;AAC/C,SAAgB,mBAAmB,CACjC,SAAS,EACT,eAAe,EACf,EAAC,IAAI,EAAE,UAAU,EAAsC;IAEvD,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAEnC,MAAM,eAAe,GAAG,UAAU,IAAI,eAAe,CAAC,UAAU,CAAC;IAEjE,MAAM,OAAO,GAA2B;QACtC,EAAE,EAAE,eAAe,CAAC,EAAE;QACtB,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,eAAe;QAC3B,IAAI,EAAE,eAAe,CAAC,cAAc;QACpC,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,SAAS,EAAE,eAAe,CAAC,SAAS;KACrC,CAAC;IAEF,MAAM,sBAAsB,GAAG;QAC7B,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,eAAe,CAAC,EAAE;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,SAAS,EAAE,SAAS;YACpB,IAAI;YACJ,QAAQ,EAAE,eAAe,CAAC,EAAE;SAC7B;QACD,WAAW,EAAE;YACX;gBACE,EAAE,EAAE,eAAe,CAAC,EAAE;gBACtB,UAAU,EAAE,kBAAkB;gBAC9B,IAAI,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC;aACtB;SACF;KACF,CAAC;IAEF,MAAM,QAAQ,GACZ,kBAAkB;QAClB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAE1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8DAA8D;AAC9D,yDAAyD;AACzD,SAAgB,aAAa,CAAC,OAAO;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,eAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,eAAM,CAAC,KAAK,CAAC,gDAAgD,GAAG,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAC,EAC1C,eAAe,EACf,MAAM,EACN,eAAe,GAKhB;IACC,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,IAAA,4BAAa,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,IAAA,yBAAU,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,IAAI,CAAC;IAExE,MAAM,wBAAwB,GAAG;QAC/B,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,eAAe,CAAC,SAAS,EAAE,qCAAqC;QACvE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,SAAS;QACb,IAAI,EAAE;YACJ,SAAS,EAAE,SAAS;YACpB,cAAc,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC;YAClC,QAAQ,EAAE,eAAe,CAAC,EAAE;SAC7B;KACF,CAAC;IAEF,MAAM,eAAe,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAE5D,8EAA8E;IAC9E,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,cAAc,CAAC;YAC1B,GAAG,WAAW;YACd,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8BAA8B;AACjB,QAAA,kBAAkB,GAAG;IAChC,KAAK,EAAE,UAAU,OAAO;QACtB,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,WAAW,OAAO,EAAE,EAAC,MAAM,EAAC;QACvC,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACnE,MAAM,eAAe,GAAoB;YACvC,GAAG,eAAe;YAClB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YACzB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,MAAM,EAAE,MAAM;SACf,CAAC;QAEF,MAAM,MAAM,CAAC,WAAW,CAAC;YACvB,IAAI,EAAE,iBAAiB;YACvB,GAAG,eAAe;SACnB,CAAC,CAAC;QAEH,eAAM,CAAC,KAAK,CACV,kEAAkE,eAAe,CAAC,EAAE,EAAE,CACvF,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;CACF,CAAC;AAEW,QAAA,0BAA0B,GAAG;IACxC,KAAK,EAAE,UAAU,OAAO;QACtB,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,kBAAkB;YACnC,OAAO,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,WAAW,OAAO,EAAE,EAAC,MAAM,EAAE,eAAe,EAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtC,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAM,CAAC,KAAK,CACV,8EAA8E,OAAO,EAAE,CACxF,CAAC;YACF,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,IAAI,eAAe,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtC,eAAM,CAAC,IAAI,CACT,2DAA2D,OAAO,cAAc,eAAe,CAAC,MAAM,EAAE,CACzG,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,CAAC,CAAC,eAAe,CAAC,EAAE;gBACpB,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,eAAM,CAAC,IAAI,CACT,2DAA2D,OAAO,mCAAmC,CACtG,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;QAED,IACE,eAAe,CAAC,SAAS;YACzB,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAChD,CAAC;YACD,eAAM,CAAC,KAAK,CACV,uDAAuD,OAAO,EAAE,CACjE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,eAAe,CACnD,eAAe,CAAC,YAAY,CAC7B,CAAC;QAEF,IAAI,CAAC;YACH,IAAA,uDAAwB,EAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;YAC3D,IAAI,gBAAgB,IAAI,IAAA,0CAAuB,EAAC,gBAAgB,CAAC,EAAE,CAAC;gBAClE,MAAM,aAAa,GAAG,MAAM,IAAA,wCAAoB,EAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;gBAC3E,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;oBACnC,IAAA,2DAA4B,EAC1B,eAAe,CAAC,gBAAgB,EAChC,aAAa,CAAC,gBAAgB,EAC9B;wBACE,cAAc,EAAE,eAAe,CAAC,cAAc;wBAC9C,cAAc,EAAE,aAAa,CAAC,wBAAwB;qBACvD,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,eAAM,CAAC,IAAI,CACT,+CAA+C,OAAO,gCAAgC,GAAG,CAAC,OAAO,EAAE,CACpG,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;QAE/B,eAAe,CAAC,MAAM,GAAG,UAAU,CAAC;QACpC,eAAe,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,eAAe,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErD,MAAM,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEtC,MAAM,mBAAmB,GAAG,MAAM,IAAA,wCAAkB,EAAC;YACnD,UAAU,EAAE,gBAAgB;YAC5B,MAAM;YACN,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;YAClD,MAAM,EAAE,eAAe,CAAC,cAAc;YACtC,YAAY,EAAE,eAAe,CAAC,SAAS,IAAI,SAAS;SACrD,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,MAAM,IAAA,qCAAkB,EAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,eAAe,CAAC,WAAW,CAAC;YAChC,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,SAAS;YACb,OAAO,EAAE;gBACP,SAAS,EAAE,SAAS;gBACpB,iBAAiB,EAAE,eAAe,CAAC,EAAE;gBACrC,WAAW,EAAE,CAAC,mBAAmB,CAAC;gBAClC,eAAe;aAChB;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEW,QAAA,wBAAwB,GAAG;IACtC,KAAK,EAAE,UAAU,OAAO;QACtB,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,gBAAgB;YACjC,OAAO,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,WAAW,OAAO,EAAE,EAAC,MAAM,EAAE,eAAe,EAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CACV,qEAAqE,CACtE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,eAAM,CAAC,KAAK,CACV,uDAAuD,OAAO,EAAE,CACjE,CAAC;YACF,OAAO;QACT,CAAC;QAED,gFAAgF;QAChF,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;YAC3C,eAAM,CAAC,KAAK,CACV,4DAA4D,OAAO,aAAa,OAAO,CAAC,IAAI,oCAAoC,WAAW,CAAC,SAAS,EAAE,CACxJ,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QACnD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;QAE3D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,eAAM,CAAC,KAAK,CACV,iEAAiE,OAAO,EAAE,CAC3E,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,MAAM,CAAC,cAAc,CAAC;YAC1B,GAAG,WAAW;YACd,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;QAE/B,MAAM,eAAe,CAAC,WAAW,CAAC;YAChC,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,OAAO,CAAC,EAAE;YACjB,IAAI,EAAE;gBACJ,SAAS,EAAE,SAAS;gBACpB,iBAAiB,EAAE,OAAO;gBAC1B,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,6BAA6B,EAAE;YACtD,iBAAiB,EAAE,OAAO;YAC1B,WAAW;YACX,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEW,QAAA,eAAe,GAAG;IAC7B,0BAAkB;IAClB,kCAA0B;IAC1B,gCAAwB;CACzB,CAAC;AAEK,KAAK,UAAU,aAAa,CACjC,OAAO,EACP,OAGC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,eAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,uBAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,eAAM,CAAC,KAAK,CACV,kDAAkD,OAAO,CAAC,IAAI,EAAE,CACjE,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC"}

package/lib/delegation/delegation-policy-validation.d.ts

@@ -0,0 +1,28 @@
+import { DelegationPolicy } from './delegation-types';
+export declare const MAX_DELEGATION_DEPTH = 9;
+export declare const ALLOWED_LIFETIME_UNITS: readonly ["days", "months", "years"];
+export declare const ALLOWED_GRANT_TYPES: readonly ["boolean", "array", "integer"];
+export declare const ALLOWED_DELEGATION_TARGETS: readonly ["single-credential"];
+export declare function lifetimeToDays(lifetime: {
+    value: number;
+    unit: string;
+}): number;
+/**
+ * Validate the structural integrity of a delegation policy.
+ *
+ * Throws on the first failure. Only checks invariants that downstream code
+ * relies on or that have security implications — fields like display labels
+ * and metadata strings are left to the type contract.
+ */
+export declare function validateDelegationPolicy(policy: any): asserts policy is DelegationPolicy;
+/**
+ * Assert that a delegation policy is a valid narrowing of a parent policy.
+ *
+ * Run after `validateDelegationPolicy(policy)` succeeds. The parent policy is
+ * trusted to already be valid (it came from a credential we issued or accepted).
+ */
+export declare function assertPolicyConformsToParent(policy: DelegationPolicy, parentPolicy: DelegationPolicy, { delegationRole, remainingDepth, }: {
+    delegationRole: string;
+    remainingDepth: number;
+}): void;
+//# sourceMappingURL=delegation-policy-validation.d.ts.map

package/lib/delegation/delegation-policy-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-policy-validation.d.ts","sourceRoot":"","sources":["../../src/delegation/delegation-policy-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,gBAAgB,EAEjB,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,sBAAsB,sCAAuC,CAAC;AAC3E,eAAO,MAAM,mBAAmB,0CAA2C,CAAC;AAC5E,eAAO,MAAM,0BAA0B,gCAAiC,CAAC;AAMzE,wBAAgB,cAAc,CAAC,QAAQ,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAG,MAAM,CAM9E;AA8DD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CA0HxF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,gBAAgB,EACxB,YAAY,EAAE,gBAAgB,EAC9B,EACE,cAAc,EACd,cAAc,GACf,EAAE;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,QAqDpD"}

package/lib/delegation/delegation-policy-validation.js

@@ -0,0 +1,170 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOWED_DELEGATION_TARGETS = exports.ALLOWED_GRANT_TYPES = exports.ALLOWED_LIFETIME_UNITS = exports.MAX_DELEGATION_DEPTH = void 0;
+exports.lifetimeToDays = lifetimeToDays;
+exports.validateDelegationPolicy = validateDelegationPolicy;
+exports.assertPolicyConformsToParent = assertPolicyConformsToParent;
+const assert_1 = __importDefault(require("assert"));
+exports.MAX_DELEGATION_DEPTH = 9;
+exports.ALLOWED_LIFETIME_UNITS = ['days', 'months', 'years'];
+exports.ALLOWED_GRANT_TYPES = ['boolean', 'array', 'integer'];
+exports.ALLOWED_DELEGATION_TARGETS = ['single-credential'];
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function lifetimeToDays(lifetime) {
+    const numeric = Number(lifetime?.value);
+    if (!Number.isFinite(numeric))
+        return 0;
+    if (lifetime.unit === 'months')
+        return numeric * 30;
+    if (lifetime.unit === 'years')
+        return numeric * 365;
+    return numeric;
+}
+function getGrantsByCapability(role) {
+    const out = {};
+    for (const grant of role.capabilityGrants || []) {
+        out[grant.capability] = grant;
+    }
+    return out;
+}
+function getAncestorChain(role, rolesById) {
+    const chain = [];
+    let cursor = role.parentRoleId ? rolesById[role.parentRoleId] : null;
+    const visited = new Set();
+    while (cursor && !visited.has(cursor.roleId)) {
+        visited.add(cursor.roleId);
+        chain.push(cursor);
+        cursor = cursor.parentRoleId ? rolesById[cursor.parentRoleId] : null;
+    }
+    return chain;
+}
+function isSubset(child, parent) {
+    const set = new Set(parent);
+    return child.every(v => set.has(v));
+}
+function getEnum(schema) {
+    if (schema?.type === 'array' && Array.isArray(schema?.items?.enum)) {
+        return schema.items.enum;
+    }
+    return null;
+}
+function isWildcardAttrs(attrs) {
+    return attrs.length === 1 && attrs[0] === '*';
+}
+function assertGrantNarrows(childSchema, parentSchema, describe) {
+    if (childSchema.type === 'integer' && parentSchema.maximum !== undefined) {
+        (0, assert_1.default)(childSchema.maximum !== undefined && childSchema.maximum <= parentSchema.maximum, describe(`maximum exceeds parent ${parentSchema.maximum}`));
+    }
+    if (childSchema.type === 'array') {
+        const parentEnum = getEnum(parentSchema);
+        if (parentEnum) {
+            const childEnum = getEnum(childSchema);
+            (0, assert_1.default)(childEnum && isSubset(childEnum, parentEnum), describe('items.enum is not a subset of parent'));
+        }
+    }
+}
+/**
+ * Validate the structural integrity of a delegation policy.
+ *
+ * Throws on the first failure. Only checks invariants that downstream code
+ * relies on or that have security implications — fields like display labels
+ * and metadata strings are left to the type contract.
+ */
+function validateDelegationPolicy(policy) {
+    (0, assert_1.default)(isPlainObject(policy), 'delegationPolicy must be an object');
+    (0, assert_1.default)(policy.type === 'DelegationPolicy', `delegationPolicy.type must be 'DelegationPolicy'`);
+    (0, assert_1.default)(policy.name === undefined || typeof policy.name === 'string', 'delegationPolicy.name must be a string when present');
+    (0, assert_1.default)(isPlainObject(policy.ruleset), 'delegationPolicy.ruleset must be an object');
+    const ruleset = policy.ruleset;
+    (0, assert_1.default)(Array.isArray(ruleset.roles) && ruleset.roles.length > 0, 'delegationPolicy.ruleset.roles must be a non-empty array');
+    (0, assert_1.default)(Array.isArray(ruleset.capabilities), 'delegationPolicy.ruleset.capabilities must be an array');
+    (0, assert_1.default)(exports.ALLOWED_DELEGATION_TARGETS.includes(ruleset.delegationTarget), `delegationPolicy.ruleset.delegationTarget must be one of: ${exports.ALLOWED_DELEGATION_TARGETS.join(', ')}`);
+    (0, assert_1.default)(isPlainObject(ruleset.overallConstraints), 'overallConstraints must be an object');
+    const constraints = ruleset.overallConstraints;
+    (0, assert_1.default)(Number.isInteger(constraints.maxDelegationDepth) &&
+        constraints.maxDelegationDepth >= 0 &&
+        constraints.maxDelegationDepth <= exports.MAX_DELEGATION_DEPTH, `maxDelegationDepth must be an integer in [0, ${exports.MAX_DELEGATION_DEPTH}]`);
+    (0, assert_1.default)(isPlainObject(constraints.delegatedCredentialLifetime), 'delegatedCredentialLifetime must be an object');
+    const lifetime = constraints.delegatedCredentialLifetime;
+    (0, assert_1.default)(Number.isInteger(lifetime.value) && lifetime.value > 0, 'delegatedCredentialLifetime.value must be a positive integer');
+    (0, assert_1.default)(exports.ALLOWED_LIFETIME_UNITS.includes(lifetime.unit), `delegatedCredentialLifetime.unit must be one of: ${exports.ALLOWED_LIFETIME_UNITS.join(', ')}`);
+    const capabilitiesByName = {};
+    for (const cap of ruleset.capabilities) {
+        (0, assert_1.default)(!capabilitiesByName[cap.name], `duplicate capability name: ${cap.name}`);
+        (0, assert_1.default)(exports.ALLOWED_GRANT_TYPES.includes(cap.schema?.type), `capability "${cap.name}" schema.type must be one of: ${exports.ALLOWED_GRANT_TYPES.join(', ')}`);
+        capabilitiesByName[cap.name] = cap;
+    }
+    const rolesById = {};
+    let rootCount = 0;
+    for (const role of ruleset.roles) {
+        (0, assert_1.default)(!rolesById[role.roleId], `duplicate roleId: ${role.roleId}`);
+        rolesById[role.roleId] = role;
+        if (role.parentRoleId === null)
+            rootCount++;
+    }
+    (0, assert_1.default)(rootCount === 1, `ruleset must have exactly one root role, found ${rootCount}`);
+    for (const role of ruleset.roles) {
+        if (role.parentRoleId !== null) {
+            (0, assert_1.default)(rolesById[role.parentRoleId], `role ${role.roleId} references unknown parentRoleId ${role.parentRoleId}`);
+        }
+    }
+    for (const role of ruleset.roles) {
+        for (const grant of role.capabilityGrants) {
+            const cap = capabilitiesByName[grant.capability];
+            (0, assert_1.default)(cap, `role ${role.roleId} grants unknown capability "${grant.capability}"`);
+            (0, assert_1.default)(grant.schema?.type === cap.schema.type, `role ${role.roleId} grant "${grant.capability}" schema.type must be "${cap.schema.type}"`);
+        }
+    }
+    for (const role of ruleset.roles) {
+        const ancestors = getAncestorChain(role, rolesById);
+        if (ancestors.length === 0)
+            continue;
+        const childGrants = getGrantsByCapability(role);
+        for (const ancestor of ancestors) {
+            const ancestorGrants = getGrantsByCapability(ancestor);
+            for (const capName of Object.keys(childGrants)) {
+                (0, assert_1.default)(ancestorGrants[capName], `role ${role.roleId} grants "${capName}" but ancestor ${ancestor.roleId} does not`);
+                assertGrantNarrows(childGrants[capName].schema, ancestorGrants[capName].schema, suffix => `role ${role.roleId} grant "${capName}" ${suffix}`);
+            }
+            if (!isWildcardAttrs(ancestor.attributes) && !isWildcardAttrs(role.attributes)) {
+                (0, assert_1.default)(isSubset(role.attributes, ancestor.attributes), `role ${role.roleId} attributes are not a subset of ancestor ${ancestor.roleId} attributes`);
+            }
+        }
+    }
+}
+/**
+ * Assert that a delegation policy is a valid narrowing of a parent policy.
+ *
+ * Run after `validateDelegationPolicy(policy)` succeeds. The parent policy is
+ * trusted to already be valid (it came from a credential we issued or accepted).
+ */
+function assertPolicyConformsToParent(policy, parentPolicy, { delegationRole, remainingDepth, }) {
+    (0, assert_1.default)(remainingDepth > 0, 'parent credential has no remaining delegation depth');
+    const childConstraints = policy.ruleset.overallConstraints;
+    const parentConstraints = parentPolicy.ruleset.overallConstraints;
+    (0, assert_1.default)(childConstraints.maxDelegationDepth <= parentConstraints.maxDelegationDepth, `maxDelegationDepth ${childConstraints.maxDelegationDepth} exceeds parent ${parentConstraints.maxDelegationDepth}`);
+    const parentDays = lifetimeToDays(parentConstraints.delegatedCredentialLifetime);
+    const childDays = lifetimeToDays(childConstraints.delegatedCredentialLifetime);
+    if (parentDays > 0) {
+        (0, assert_1.default)(childDays <= parentDays, `delegatedCredentialLifetime exceeds parent (${parentConstraints.delegatedCredentialLifetime.value} ${parentConstraints.delegatedCredentialLifetime.unit})`);
+    }
+    const childRole = policy.ruleset.roles.find(r => r.roleId === delegationRole);
+    (0, assert_1.default)(childRole, `delegationRole "${delegationRole}" not found in delegationPolicy.ruleset.roles`);
+    const parentRole = parentPolicy.ruleset.roles.find(r => r.roleId === delegationRole);
+    (0, assert_1.default)(parentRole, `delegationRole "${delegationRole}" not found in parent credential's policy`);
+    if (!isWildcardAttrs(parentRole.attributes) && !isWildcardAttrs(childRole.attributes)) {
+        (0, assert_1.default)(isSubset(childRole.attributes, parentRole.attributes), `delegationRole "${delegationRole}" attributes are not a subset of parent's attributes`);
+    }
+    const parentGrants = getGrantsByCapability(parentRole);
+    for (const grant of childRole.capabilityGrants) {
+        const parentGrant = parentGrants[grant.capability];
+        (0, assert_1.default)(parentGrant, `delegationRole "${delegationRole}" grants "${grant.capability}" which the parent does not`);
+        assertGrantNarrows(grant.schema, parentGrant.schema, suffix => `delegationRole "${delegationRole}" grant "${grant.capability}" ${suffix}`);
+    }
+}
+//# sourceMappingURL=delegation-policy-validation.js.map