@docknetwork/wallet-sdk-core 1.7.7-alpha.0 → 1.9.0

package/src/delegation/delegation-policy-validation.test.ts

@@ -0,0 +1,237 @@
+import {DelegationPolicy} from './delegation-types';
+import {
+  delegationPolicyPharmacy,
+  delegationPolicyTravelAgent,
+} from './delegation-fixtures';
+import {
+  assertPolicyConformsToParent,
+  validateDelegationPolicy,
+} from './delegation-policy-validation';
+
+function clonePolicy(policy: any): DelegationPolicy {
+  return JSON.parse(JSON.stringify(policy));
+}
+
+describe('validateDelegationPolicy', () => {
+  it('accepts the travel-agent fixture', () => {
+    expect(() => validateDelegationPolicy(delegationPolicyTravelAgent)).not.toThrow();
+  });
+
+  it('accepts the pharmacy fixture', () => {
+    expect(() => validateDelegationPolicy(delegationPolicyPharmacy)).not.toThrow();
+  });
+
+  it('accepts a policy without a top-level `name`', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    delete (policy as any).name;
+    expect(() => validateDelegationPolicy(policy)).not.toThrow();
+  });
+
+  it('rejects a non-object', () => {
+    expect(() => validateDelegationPolicy(null)).toThrow(/must be an object/);
+    expect(() => validateDelegationPolicy('foo')).toThrow(/must be an object/);
+  });
+
+  it('rejects a wrong type field', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    (policy as any).type = 'NotAPolicy';
+    expect(() => validateDelegationPolicy(policy)).toThrow(/type must be/);
+  });
+
+  it('rejects an unsupported delegationTarget', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.delegationTarget = 'multi-credential' as any;
+    expect(() => validateDelegationPolicy(policy)).toThrow(/delegationTarget/);
+  });
+
+  it('rejects maxDelegationDepth out of range', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.overallConstraints.maxDelegationDepth = 99;
+    expect(() => validateDelegationPolicy(policy)).toThrow(/maxDelegationDepth/);
+  });
+
+  it('rejects an invalid lifetime unit', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.overallConstraints.delegatedCredentialLifetime.unit = 'weeks';
+    expect(() => validateDelegationPolicy(policy)).toThrow(/unit/);
+  });
+
+  it('rejects a non-positive lifetime value', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.overallConstraints.delegatedCredentialLifetime.value = 0;
+    expect(() => validateDelegationPolicy(policy)).toThrow(/value/);
+  });
+
+  it('rejects duplicate capability names', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.capabilities.push({...policy.ruleset.capabilities[0]});
+    expect(() => validateDelegationPolicy(policy)).toThrow(/duplicate capability/);
+  });
+
+  it('rejects an unsupported capability schema type', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    (policy.ruleset.capabilities[0].schema as any).type = 'object';
+    expect(() => validateDelegationPolicy(policy)).toThrow(/schema\.type/);
+  });
+
+  it('rejects duplicate roleIds', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.roles[1].roleId = policy.ruleset.roles[0].roleId;
+    expect(() => validateDelegationPolicy(policy)).toThrow(/duplicate roleId/);
+  });
+
+  it('rejects an orphan parentRoleId', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.roles[1].parentRoleId = 'does-not-exist';
+    expect(() => validateDelegationPolicy(policy)).toThrow(/unknown parentRoleId/);
+  });
+
+  it('rejects more than one root role', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.roles[1].parentRoleId = null;
+    expect(() => validateDelegationPolicy(policy)).toThrow(/exactly one root role/);
+  });
+
+  it('rejects a grant referencing an unknown capability', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.roles[0].capabilityGrants[0].capability = 'Phantom';
+    expect(() => validateDelegationPolicy(policy)).toThrow(/unknown capability/);
+  });
+
+  it('rejects a grant whose schema.type does not match the capability', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    (policy.ruleset.roles[0].capabilityGrants[0].schema as any).type = 'integer';
+    expect(() => validateDelegationPolicy(policy)).toThrow(/schema\.type/);
+  });
+
+  it('rejects a child role granting a capability the ancestor does not', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.roles[0].capabilityGrants = policy.ruleset.roles[0].capabilityGrants.filter(
+      g => g.capability !== 'Reserve Hotels',
+    );
+    expect(() => validateDelegationPolicy(policy)).toThrow(
+      /grants "Reserve Hotels" but ancestor/,
+    );
+  });
+
+  it('rejects a child integer maximum exceeding the ancestor maximum', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    const hotel = policy.ruleset.roles.find(r => r.label === 'Hotel Sub-agent')!;
+    const purchase = hotel.capabilityGrants.find(g => g.capability === 'Purchase')!;
+    (purchase.schema as any).maximum = 200;
+    expect(() => validateDelegationPolicy(policy)).toThrow(/maximum exceeds parent/);
+  });
+
+  it('rejects a child array enum that is not a subset of the ancestor enum', () => {
+    const policy = clonePolicy(delegationPolicyPharmacy);
+    const pharmacy = policy.ruleset.roles.find(r => r.label === 'Pharmacy')!;
+    const claims = pharmacy.capabilityGrants.find(g => g.capability === 'Allowed Claims')!;
+    (claims.schema as any).items.enum = ['Refund'];
+    expect(() => validateDelegationPolicy(policy)).toThrow(/items\.enum is not a subset/);
+  });
+
+  it('rejects child explicit attributes when not a subset of an ancestor explicit list', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.roles[0].attributes = ['subject.firstName'];
+    const child = policy.ruleset.roles.find(r => r.label === 'Corporate Account Manager')!;
+    child.attributes = ['subject.lastName'];
+    expect(() => validateDelegationPolicy(policy)).toThrow(/attributes are not a subset/);
+  });
+
+  it('allows a child wildcard under a narrowed ancestor', () => {
+    const policy = clonePolicy(delegationPolicyTravelAgent);
+    policy.ruleset.roles[0].attributes = ['subject.firstName'];
+    expect(() => validateDelegationPolicy(policy)).not.toThrow();
+  });
+});
+
+describe('assertPolicyConformsToParent', () => {
+  const PARENT_ROLE = 'e79c0d16-8739-4e54-94d7-53d9f1c97c71';
+  const baseOpts = {delegationRole: PARENT_ROLE, remainingDepth: 3};
+
+  it('accepts a policy identical to the parent', () => {
+    expect(() =>
+      assertPolicyConformsToParent(
+        clonePolicy(delegationPolicyTravelAgent),
+        delegationPolicyTravelAgent,
+        baseOpts,
+      ),
+    ).not.toThrow();
+  });
+
+  it('rejects when remaining delegation depth is zero', () => {
+    expect(() =>
+      assertPolicyConformsToParent(
+        clonePolicy(delegationPolicyTravelAgent),
+        delegationPolicyTravelAgent,
+        {delegationRole: PARENT_ROLE, remainingDepth: 0},
+      ),
+    ).toThrow(/no remaining delegation depth/);
+  });
+
+  it('rejects when child maxDelegationDepth exceeds parent', () => {
+    const child = clonePolicy(delegationPolicyTravelAgent);
+    child.ruleset.overallConstraints.maxDelegationDepth = 9;
+    const parent = clonePolicy(delegationPolicyTravelAgent);
+    parent.ruleset.overallConstraints.maxDelegationDepth = 2;
+    expect(() => assertPolicyConformsToParent(child, parent, baseOpts)).toThrow(
+      /maxDelegationDepth/,
+    );
+  });
+
+  it('rejects when child lifetime exceeds parent lifetime (cross-unit)', () => {
+    const child = clonePolicy(delegationPolicyTravelAgent);
+    child.ruleset.overallConstraints.delegatedCredentialLifetime = {value: 400, unit: 'days'};
+    const parent = clonePolicy(delegationPolicyTravelAgent);
+    parent.ruleset.overallConstraints.delegatedCredentialLifetime = {value: 1, unit: 'years'};
+    expect(() => assertPolicyConformsToParent(child, parent, baseOpts)).toThrow(
+      /delegatedCredentialLifetime/,
+    );
+  });
+
+  it('rejects when the delegationRole is missing from the policy', () => {
+    expect(() =>
+      assertPolicyConformsToParent(
+        clonePolicy(delegationPolicyTravelAgent),
+        delegationPolicyTravelAgent,
+        {delegationRole: 'missing-role', remainingDepth: 3},
+      ),
+    ).toThrow(/not found in delegationPolicy/);
+  });
+
+  it('rejects when the child grants a capability the parent does not', () => {
+    const child = clonePolicy(delegationPolicyTravelAgent);
+    const childRoot = child.ruleset.roles.find(r => r.roleId === PARENT_ROLE)!;
+    childRoot.capabilityGrants.push({
+      capability: 'Phantom',
+      schema: {type: 'boolean', const: true},
+    } as any);
+    expect(() =>
+      assertPolicyConformsToParent(child, delegationPolicyTravelAgent, baseOpts),
+    ).toThrow(/parent does not/);
+  });
+
+  it('rejects when child integer maximum exceeds parent', () => {
+    const child = clonePolicy(delegationPolicyTravelAgent);
+    const childRoot = child.ruleset.roles.find(r => r.roleId === PARENT_ROLE)!;
+    const purchase = childRoot.capabilityGrants.find(g => g.capability === 'Purchase')!;
+    (purchase.schema as any).maximum = 999;
+    expect(() =>
+      assertPolicyConformsToParent(child, delegationPolicyTravelAgent, baseOpts),
+    ).toThrow(/maximum exceeds parent/);
+  });
+
+  it('rejects when child enum is not a subset of parent enum', () => {
+    const PHARMACY_ROOT = '6ed167b3-90be-4f9a-a8d2-542d2f212d79';
+    const child = clonePolicy(delegationPolicyPharmacy);
+    const childRoot = child.ruleset.roles.find(r => r.roleId === PHARMACY_ROOT)!;
+    const claims = childRoot.capabilityGrants.find(g => g.capability === 'Allowed Claims')!;
+    (claims.schema as any).items.enum = ['Refund'];
+    expect(() =>
+      assertPolicyConformsToParent(child, delegationPolicyPharmacy as DelegationPolicy, {
+        delegationRole: PHARMACY_ROOT,
+        remainingDepth: 3,
+      }),
+    ).toThrow(/items\.enum is not a subset/);
+  });
+});

package/src/delegation/delegation-policy-validation.ts

@@ -0,0 +1,281 @@
+import assert from 'assert';
+import {
+  CapabilityGrant,
+  DelegationPolicy,
+  Role,
+} from './delegation-types';
+
+export const MAX_DELEGATION_DEPTH = 9;
+export const ALLOWED_LIFETIME_UNITS = ['days', 'months', 'years'] as const;
+export const ALLOWED_GRANT_TYPES = ['boolean', 'array', 'integer'] as const;
+export const ALLOWED_DELEGATION_TARGETS = ['single-credential'] as const;
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+export function lifetimeToDays(lifetime: {value: number; unit: string}): number {
+  const numeric = Number(lifetime?.value);
+  if (!Number.isFinite(numeric)) return 0;
+  if (lifetime.unit === 'months') return numeric * 30;
+  if (lifetime.unit === 'years') return numeric * 365;
+  return numeric;
+}
+
+function getGrantsByCapability(role: Role): Record<string, CapabilityGrant> {
+  const out: Record<string, CapabilityGrant> = {};
+  for (const grant of role.capabilityGrants || []) {
+    out[grant.capability] = grant;
+  }
+  return out;
+}
+
+function getAncestorChain(role: Role, rolesById: Record<string, Role>): Role[] {
+  const chain: Role[] = [];
+  let cursor = role.parentRoleId ? rolesById[role.parentRoleId] : null;
+  const visited = new Set<string>();
+  while (cursor && !visited.has(cursor.roleId)) {
+    visited.add(cursor.roleId);
+    chain.push(cursor);
+    cursor = cursor.parentRoleId ? rolesById[cursor.parentRoleId] : null;
+  }
+  return chain;
+}
+
+function isSubset<T>(child: T[], parent: T[]): boolean {
+  const set = new Set(parent);
+  return child.every(v => set.has(v));
+}
+
+function getEnum(schema: any): string[] | null {
+  if (schema?.type === 'array' && Array.isArray(schema?.items?.enum)) {
+    return schema.items.enum;
+  }
+  return null;
+}
+
+function isWildcardAttrs(attrs: string[]): boolean {
+  return attrs.length === 1 && attrs[0] === '*';
+}
+
+function assertGrantNarrows(
+  childSchema: any,
+  parentSchema: any,
+  describe: (suffix: string) => string,
+) {
+  if (childSchema.type === 'integer' && parentSchema.maximum !== undefined) {
+    assert(
+      childSchema.maximum !== undefined && childSchema.maximum <= parentSchema.maximum,
+      describe(`maximum exceeds parent ${parentSchema.maximum}`),
+    );
+  }
+
+  if (childSchema.type === 'array') {
+    const parentEnum = getEnum(parentSchema);
+    if (parentEnum) {
+      const childEnum = getEnum(childSchema);
+      assert(
+        childEnum && isSubset(childEnum, parentEnum),
+        describe('items.enum is not a subset of parent'),
+      );
+    }
+  }
+}
+
+/**
+ * Validate the structural integrity of a delegation policy.
+ *
+ * Throws on the first failure. Only checks invariants that downstream code
+ * relies on or that have security implications — fields like display labels
+ * and metadata strings are left to the type contract.
+ */
+export function validateDelegationPolicy(policy: any): asserts policy is DelegationPolicy {
+  assert(isPlainObject(policy), 'delegationPolicy must be an object');
+  assert(
+    policy.type === 'DelegationPolicy',
+    `delegationPolicy.type must be 'DelegationPolicy'`,
+  );
+  assert(
+    policy.name === undefined || typeof policy.name === 'string',
+    'delegationPolicy.name must be a string when present',
+  );
+  assert(isPlainObject(policy.ruleset), 'delegationPolicy.ruleset must be an object');
+
+  const ruleset = policy.ruleset;
+  assert(
+    Array.isArray(ruleset.roles) && ruleset.roles.length > 0,
+    'delegationPolicy.ruleset.roles must be a non-empty array',
+  );
+  assert(
+    Array.isArray(ruleset.capabilities),
+    'delegationPolicy.ruleset.capabilities must be an array',
+  );
+  assert(
+    (ALLOWED_DELEGATION_TARGETS as readonly string[]).includes(ruleset.delegationTarget as string),
+    `delegationPolicy.ruleset.delegationTarget must be one of: ${ALLOWED_DELEGATION_TARGETS.join(', ')}`,
+  );
+
+  assert(isPlainObject(ruleset.overallConstraints), 'overallConstraints must be an object');
+  const constraints: any = ruleset.overallConstraints;
+  assert(
+    Number.isInteger(constraints.maxDelegationDepth) &&
+      constraints.maxDelegationDepth >= 0 &&
+      constraints.maxDelegationDepth <= MAX_DELEGATION_DEPTH,
+    `maxDelegationDepth must be an integer in [0, ${MAX_DELEGATION_DEPTH}]`,
+  );
+  assert(
+    isPlainObject(constraints.delegatedCredentialLifetime),
+    'delegatedCredentialLifetime must be an object',
+  );
+  const lifetime: any = constraints.delegatedCredentialLifetime;
+  assert(
+    Number.isInteger(lifetime.value) && lifetime.value > 0,
+    'delegatedCredentialLifetime.value must be a positive integer',
+  );
+  assert(
+    (ALLOWED_LIFETIME_UNITS as readonly string[]).includes(lifetime.unit),
+    `delegatedCredentialLifetime.unit must be one of: ${ALLOWED_LIFETIME_UNITS.join(', ')}`,
+  );
+
+  const capabilitiesByName: Record<string, any> = {};
+  for (const cap of ruleset.capabilities) {
+    assert(
+      !capabilitiesByName[cap.name],
+      `duplicate capability name: ${cap.name}`,
+    );
+    assert(
+      (ALLOWED_GRANT_TYPES as readonly string[]).includes(cap.schema?.type),
+      `capability "${cap.name}" schema.type must be one of: ${ALLOWED_GRANT_TYPES.join(', ')}`,
+    );
+    capabilitiesByName[cap.name] = cap;
+  }
+
+  const rolesById: Record<string, Role> = {};
+  let rootCount = 0;
+  for (const role of ruleset.roles) {
+    assert(!rolesById[role.roleId], `duplicate roleId: ${role.roleId}`);
+    rolesById[role.roleId] = role;
+    if (role.parentRoleId === null) rootCount++;
+  }
+  assert(rootCount === 1, `ruleset must have exactly one root role, found ${rootCount}`);
+
+  for (const role of ruleset.roles) {
+    if (role.parentRoleId !== null) {
+      assert(
+        rolesById[role.parentRoleId],
+        `role ${role.roleId} references unknown parentRoleId ${role.parentRoleId}`,
+      );
+    }
+  }
+
+  for (const role of ruleset.roles) {
+    for (const grant of role.capabilityGrants) {
+      const cap = capabilitiesByName[grant.capability];
+      assert(
+        cap,
+        `role ${role.roleId} grants unknown capability "${grant.capability}"`,
+      );
+      assert(
+        (grant.schema as any)?.type === cap.schema.type,
+        `role ${role.roleId} grant "${grant.capability}" schema.type must be "${cap.schema.type}"`,
+      );
+    }
+  }
+
+  for (const role of ruleset.roles) {
+    const ancestors = getAncestorChain(role, rolesById);
+    if (ancestors.length === 0) continue;
+
+    const childGrants = getGrantsByCapability(role);
+
+    for (const ancestor of ancestors) {
+      const ancestorGrants = getGrantsByCapability(ancestor);
+
+      for (const capName of Object.keys(childGrants)) {
+        assert(
+          ancestorGrants[capName],
+          `role ${role.roleId} grants "${capName}" but ancestor ${ancestor.roleId} does not`,
+        );
+        assertGrantNarrows(
+          childGrants[capName].schema,
+          ancestorGrants[capName].schema,
+          suffix => `role ${role.roleId} grant "${capName}" ${suffix}`,
+        );
+      }
+
+      if (!isWildcardAttrs(ancestor.attributes) && !isWildcardAttrs(role.attributes)) {
+        assert(
+          isSubset(role.attributes, ancestor.attributes),
+          `role ${role.roleId} attributes are not a subset of ancestor ${ancestor.roleId} attributes`,
+        );
+      }
+    }
+  }
+}
+
+/**
+ * Assert that a delegation policy is a valid narrowing of a parent policy.
+ *
+ * Run after `validateDelegationPolicy(policy)` succeeds. The parent policy is
+ * trusted to already be valid (it came from a credential we issued or accepted).
+ */
+export function assertPolicyConformsToParent(
+  policy: DelegationPolicy,
+  parentPolicy: DelegationPolicy,
+  {
+    delegationRole,
+    remainingDepth,
+  }: {delegationRole: string; remainingDepth: number},
+) {
+  assert(remainingDepth > 0, 'parent credential has no remaining delegation depth');
+
+  const childConstraints = policy.ruleset.overallConstraints;
+  const parentConstraints = parentPolicy.ruleset.overallConstraints;
+
+  assert(
+    childConstraints.maxDelegationDepth <= parentConstraints.maxDelegationDepth,
+    `maxDelegationDepth ${childConstraints.maxDelegationDepth} exceeds parent ${parentConstraints.maxDelegationDepth}`,
+  );
+
+  const parentDays = lifetimeToDays(parentConstraints.delegatedCredentialLifetime);
+  const childDays = lifetimeToDays(childConstraints.delegatedCredentialLifetime);
+  if (parentDays > 0) {
+    assert(
+      childDays <= parentDays,
+      `delegatedCredentialLifetime exceeds parent (${parentConstraints.delegatedCredentialLifetime.value} ${parentConstraints.delegatedCredentialLifetime.unit})`,
+    );
+  }
+
+  const childRole = policy.ruleset.roles.find(r => r.roleId === delegationRole);
+  assert(
+    childRole,
+    `delegationRole "${delegationRole}" not found in delegationPolicy.ruleset.roles`,
+  );
+
+  const parentRole = parentPolicy.ruleset.roles.find(r => r.roleId === delegationRole);
+  assert(
+    parentRole,
+    `delegationRole "${delegationRole}" not found in parent credential's policy`,
+  );
+
+  if (!isWildcardAttrs(parentRole.attributes) && !isWildcardAttrs(childRole.attributes)) {
+    assert(
+      isSubset(childRole.attributes, parentRole.attributes),
+      `delegationRole "${delegationRole}" attributes are not a subset of parent's attributes`,
+    );
+  }
+
+  const parentGrants = getGrantsByCapability(parentRole);
+  for (const grant of childRole.capabilityGrants) {
+    const parentGrant = parentGrants[grant.capability];
+    assert(
+      parentGrant,
+      `delegationRole "${delegationRole}" grants "${grant.capability}" which the parent does not`,
+    );
+    assertGrantNarrows(
+      grant.schema,
+      parentGrant.schema,
+      suffix => `delegationRole "${delegationRole}" grant "${grant.capability}" ${suffix}`,
+    );
+  }
+}

package/src/delegation/delegation-policy.ts

@@ -0,0 +1,100 @@
+import assert from 'assert';
+import {
+  DelegationDetails,
+  DelegationPolicy,
+  Role,
+  RoleNode,
+} from './delegation-types';
+import {delegationService} from '@docknetwork/wallet-sdk-wasm/src/services/delegation';
+import {getDelegationChain} from './delegation-chain';
+import {
+  buildDelegationRoleTree,
+  getRemainingDelegationDepth,
+  getRoleNodeById,
+} from './delegation-tree';
+
+/**
+ * Fetch the delegation policy for a given credential
+ * @param credential - The credential containing the delegation policy ID
+ * @returns A promise that resolves to the delegation policy for the given schema ID
+ */
+export async function fetchDelegationPolicyJson(
+  credential,
+): Promise<DelegationPolicy> {
+  assert(
+    credential.delegationPolicyId,
+    'Credential does not contain a delegation policy ID',
+  );
+  return delegationService.fetchDelegationPolicyJson(
+    credential.delegationPolicyId,
+  );
+}
+
+/**
+ * Build delegation policy attributes
+ * This is needed when issuing a delegatable credential, so that we can include the delegation policy ID and digest in the credential attributes
+ * @param delegationPolicy
+ * @returns An object containing the delegation policy ID and digest to be included in the credential attributes
+ */
+export async function buildDelegationPolicyAttributes(
+  delegationPolicy: DelegationPolicy | DelegationPolicy[],
+) {
+  return {
+    delegationPolicyId: `data:application/json,${encodeURIComponent(
+      JSON.stringify(delegationPolicy),
+    )}`,
+    delegationPolicyDigest: await delegationService.computePolicyDigestHex(
+      delegationPolicy,
+    ),
+  };
+}
+
+export function getRole(
+  roleId: string,
+  delegationPolicy: DelegationPolicy,
+): Role {
+  if (!delegationPolicy) return null;
+
+  return delegationPolicy.ruleset.roles.find(r => r.roleId === roleId);
+}
+
+export function getDelegationOptions(roleTree: RoleNode): RoleNode[] {
+  const roles: RoleNode[] = [];
+  const traverse = (node: RoleNode) => {
+    roles.push(node);
+    node.children?.forEach(traverse);
+  };
+
+  roleTree.children?.forEach(traverse);
+
+  return roles;
+}
+
+export async function getDelegationDetails(
+  credential,
+  wallet,
+): Promise<DelegationDetails> {
+  const delegationChain = await getDelegationChain(credential, wallet);
+  const policy = await fetchDelegationPolicyJson(credential);
+  const roleTree = buildDelegationRoleTree(policy);
+  const role = getRoleNodeById(roleTree.roleId, roleTree);
+  const delegationOptions = getDelegationOptions(roleTree);
+  const remainingDelegationDepth = getRemainingDelegationDepth(role, policy);
+
+  return {
+    delegationPolicy: policy,
+    roleTree,
+    role,
+    remainingDelegationDepth,
+    delegationChain,
+    delegatedBy: {
+      role:
+        delegationChain?.length > 0
+          ? getRole(delegationChain[0]?.roleId, policy)
+          : null,
+      issuerName: credential?.issuer?.name,
+      issuerDid: credential?.issuer?.id,
+    },
+    delegationOptions,
+  };
+}