@enbox/agent 0.1.6 → 0.1.7

package/src/dwn-api.ts

@@ -237,7 +237,7 @@ export class AgentDwnApi {
     ) {
       const writeParams = request.messageParams as DwnMessageParams[DwnInterface.RecordsWrite];
       // Skip key-delivery protocol writes to avoid infinite recursion (contextKey records are themselves encrypted)
-      if (writeParams?.protocol && writeParams.protocolPath && writeParams.protocol !== KeyDeliveryProtocolDefinition.protocol) {
+      if (writeParams.protocol !== KeyDeliveryProtocolDefinition.protocol) {
         try {
           const protocolDefinition = await this.getProtocolDefinition(
             request.target, writeParams.protocol,

package/src/permissions-api.ts

@@ -76,7 +76,8 @@ export class AgentPermissionsApi implements PermissionsApi {
     grantee,
     grantor,
     protocol,
-    remote = false
+    remote = false,
+    checkRevoked = true,
   }: FetchPermissionsParams): Promise<PermissionGrantEntry[]> {
 
     // filter by a protocol using tags if provided
@@ -102,9 +103,17 @@ export class AgentPermissionsApi implements PermissionsApi {
       throw new Error(`PermissionsApi: Failed to fetch grants: ${reply.status.detail}`);
     }
 
+    // Build a set of revoked grant IDs so that revoked grants can be filtered out.
+    // Uses a single batch query for all revocations rather than N individual reads.
+    const revokedGrantIds = checkRevoked
+      ? await this.fetchRevokedGrantIds({ author, target, grantor, remote, tags })
+      : new Set<string>();
+
     const grants:PermissionGrantEntry[] = [];
     for (const entry of reply.entries! as DwnDataEncodedRecordsWriteMessage[]) {
-      // TODO: Check for revocation status based on a request parameter and filter out revoked grants
+      if (revokedGrantIds.has(entry.recordId)) {
+        continue;
+      }
       const grant = await DwnPermissionGrant.parse(entry);
       grants.push({ grant, message: entry });
     }
@@ -112,6 +121,49 @@ export class AgentPermissionsApi implements PermissionsApi {
     return grants;
   }
 
+  /**
+   * Fetch all revocation record IDs for grants, returned as a Set of parent grant record IDs.
+   * Issues a single RecordsQuery for all revocation records, optionally scoped to a grantor and protocol.
+   */
+  private async fetchRevokedGrantIds({ author, target, grantor, remote, tags }: {
+    author: string;
+    target: string;
+    grantor?: string;
+    remote: boolean;
+    tags?: { protocol: string };
+  }): Promise<Set<string>> {
+    const revocationParams: ProcessDwnRequest<DwnInterface.RecordsQuery> = {
+      author,
+      target,
+      messageType   : DwnInterface.RecordsQuery,
+      messageParams : {
+        filter: {
+          author       : grantor, // revocations are authored by the same grantor
+          protocol     : PermissionsProtocol.uri,
+          protocolPath : PermissionsProtocol.revocationPath,
+          tags,
+        }
+      }
+    };
+
+    const { reply: revocationReply } = remote
+      ? await this.agent.sendDwnRequest(revocationParams)
+      : await this.agent.processDwnRequest(revocationParams);
+
+    if (revocationReply.status.code !== 200) {
+      throw new Error(`PermissionsApi: Failed to fetch revocations: ${revocationReply.status.detail}`);
+    }
+
+    const revokedGrantIds = new Set<string>();
+    for (const entry of revocationReply.entries! as DwnDataEncodedRecordsWriteMessage[]) {
+      if (entry.descriptor.parentId !== undefined) {
+        revokedGrantIds.add(entry.descriptor.parentId);
+      }
+    }
+
+    return revokedGrantIds;
+  }
+
   async fetchRequests({
     author,
     target,

package/src/store-data.ts

@@ -89,9 +89,12 @@ export class DwnDataStore<TStoreObject extends Record<string, any> = Jwk> implem
 
   /**
    * Properties to use when writing and querying records with the DWN store.
+   * Subclasses MUST override this to include `protocol` and `protocolPath`.
    */
-  protected _recordProperties = {
-    dataFormat: 'application/json',
+  protected _recordProperties: { dataFormat: string; protocol: string; protocolPath: string; schema?: string } = {
+    dataFormat   : 'application/json',
+    protocol     : '', // overridden by subclass
+    protocolPath : '', // overridden by subclass
   };
 
   public async delete({ id, agent, tenant }: DataStoreDeleteParams): Promise<boolean> {

package/src/sync-engine-level.ts

@@ -187,7 +187,7 @@ export class SyncEngineLevel implements SyncEngine {
             }
           }
         } catch (error: any) {
-          // If the remote DWN is unreachable, skip this target and continue.
+          // Skip this DWN endpoint for remaining targets and log the real cause.
           errored.add(dwnUrl);
           console.error(`SyncEngineLevel: Error syncing ${did} with ${dwnUrl}`, error);
         }

package/src/sync-messages.ts

@@ -149,7 +149,8 @@ export async function fetchRemoteMessages({ did, dwnUrl, delegateDid, protocol,
           targetDid : did,
           message   : messagesRead.message,
         }) as MessagesReadReply;
-      } catch {
+      } catch (error: any) {
+        console.error(`SyncEngineLevel: pull - failed to read ${messageCid} from ${dwnUrl}:`, error.message ?? error);
         return undefined;
       }
 
@@ -217,9 +218,10 @@ export async function pushMessages({ did, dwnUrl, delegateDid, protocol, message
         const cid = await getMessageCid(entry.message);
         console.error(`SyncEngineLevel: push failed for ${cid}: ${reply.status.code} ${reply.status.detail}`);
       }
-    } catch {
-      // Remote unreachable — stop pushing to this endpoint.
-      throw new Error(`SyncEngineLevel: Remote DWN at ${dwnUrl} is unreachable.`);
+    } catch (error: any) {
+      // Preserve the original error so callers can diagnose the root cause.
+      const detail = error.message ?? error;
+      throw new Error(`SyncEngineLevel: push to ${dwnUrl} failed: ${detail}`);
     }
   }
 }

package/src/types/permissions.ts

@@ -7,6 +7,8 @@ export type FetchPermissionsParams = {
   grantor?: string;
   protocol?: string;
   remote?: boolean;
+  /** Whether to filter out revoked grants. Defaults to `true`. */
+  checkRevoked?: boolean;
 };
 
 export type FetchPermissionRequestParams = {