@enbox/dwn-sdk-js 0.0.1

package/dist/esm/src/core/message.js

@@ -0,0 +1,233 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Cid } from '../utils/cid.js';
+import { Encoder } from '../utils/encoder.js';
+import { GeneralJwsBuilder } from '../jose/jws/general/builder.js';
+import { Jws } from '../utils/jws.js';
+import { lexicographicalCompare } from '../utils/string.js';
+import { removeUndefinedProperties } from '../utils/object.js';
+import { validateJsonSchema } from '../schema-validator.js';
+import { DwnError, DwnErrorCode } from './dwn-error.js';
+/**
+ * A class containing utility methods for working with DWN messages.
+ */
+export class Message {
+    /**
+     * Gets the DID of the author of the given message.
+     */
+    static getAuthor(message) {
+        if (message.authorization === undefined) {
+            return undefined;
+        }
+        let author;
+        if (message.authorization.authorDelegatedGrant !== undefined) {
+            author = Message.getSigner(message.authorization.authorDelegatedGrant);
+        }
+        else {
+            author = Message.getSigner(message);
+        }
+        return author;
+    }
+    /**
+     * Validates the given message against the corresponding JSON schema.
+     * @throws {Error} if fails validation.
+     */
+    static validateJsonSchema(rawMessage) {
+        const dwnInterface = rawMessage.descriptor.interface;
+        const dwnMethod = rawMessage.descriptor.method;
+        const schemaLookupKey = dwnInterface + dwnMethod;
+        // throws an error if message is invalid
+        validateJsonSchema(schemaLookupKey, rawMessage);
+    }
+    ;
+    /**
+     * Gets the DID of the signer of the given message, returns `undefined` if message is not signed.
+     */
+    static getSigner(message) {
+        if (message.authorization === undefined) {
+            return undefined;
+        }
+        const signer = Jws.getSignerDid(message.authorization.signature.signatures[0]);
+        return signer;
+    }
+    /**
+     * Gets the CID of the given message.
+     */
+    static getCid(message) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // NOTE: we wrap the `computeCid()` here in case that
+            // the message will contain properties that should not be part of the CID computation
+            // and we need to strip them out (like `encodedData` that we historically had for a long time),
+            // but we can remove this method entirely if the code becomes stable and it is apparent that the wrapper is not needed
+            // ^--- seems like we might need to keep this around for now.
+            const rawMessage = Object.assign({}, message);
+            if (rawMessage.encodedData) {
+                delete rawMessage.encodedData;
+            }
+            const cid = yield Cid.computeCid(rawMessage);
+            return cid;
+        });
+    }
+    /**
+     * Compares message CID in lexicographical order according to the spec.
+     * @returns 1 if `a` is larger than `b`; -1 if `a` is smaller/older than `b`; 0 otherwise (same message)
+     */
+    static compareCid(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // the < and > operators compare strings in lexicographical order
+            const cidA = yield Message.getCid(a);
+            const cidB = yield Message.getCid(b);
+            return lexicographicalCompare(cidA, cidB);
+        });
+    }
+    /**
+     * Creates the `authorization` property to be included in a DWN message.
+     * @param signer Message signer.
+     * @returns {AuthorizationModel} used as an `authorization` property.
+     */
+    static createAuthorization(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { descriptor, signer, delegatedGrant, permissionGrantId, protocolRole } = input;
+            let delegatedGrantId;
+            if (delegatedGrant !== undefined) {
+                delegatedGrantId = yield Message.getCid(delegatedGrant);
+            }
+            const signature = yield Message.createSignature(descriptor, signer, { delegatedGrantId, permissionGrantId, protocolRole });
+            const authorization = {
+                signature
+            };
+            if (delegatedGrant !== undefined) {
+                authorization.authorDelegatedGrant = delegatedGrant;
+            }
+            return authorization;
+        });
+    }
+    /**
+     * Creates a generic signature from the given DWN message descriptor by including `descriptorCid` as the required property in the signature payload.
+     * NOTE: there is an opportunity to consolidate RecordsWrite.createSignerSignature() wth this method
+     */
+    static createSignature(descriptor, signer, additionalPayloadProperties) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const descriptorCid = yield Cid.computeCid(descriptor);
+            const signaturePayload = Object.assign({ descriptorCid }, additionalPayloadProperties);
+            removeUndefinedProperties(signaturePayload);
+            const signaturePayloadBytes = Encoder.objectToBytes(signaturePayload);
+            const builder = yield GeneralJwsBuilder.create(signaturePayloadBytes, [signer]);
+            const signature = builder.getJws();
+            return signature;
+        });
+    }
+    /**
+     * @returns newest message in the array. `undefined` if given array is empty.
+     */
+    static getNewestMessage(messages) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let currentNewestMessage = undefined;
+            for (const message of messages) {
+                if (currentNewestMessage === undefined || (yield Message.isNewer(message, currentNewestMessage))) {
+                    currentNewestMessage = message;
+                }
+            }
+            return currentNewestMessage;
+        });
+    }
+    /**
+     * @returns oldest message in the array. `undefined` if given array is empty.
+     */
+    static getOldestMessage(messages) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let currentOldestMessage = undefined;
+            for (const message of messages) {
+                if (currentOldestMessage === undefined || (yield Message.isOlder(message, currentOldestMessage))) {
+                    currentOldestMessage = message;
+                }
+            }
+            return currentOldestMessage;
+        });
+    }
+    /**
+     * Checks if first message is newer than second message.
+     * @returns `true` if `a` is newer than `b`; `false` otherwise
+     */
+    static isNewer(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aIsNewer = ((yield Message.compareMessageTimestamp(a, b)) > 0);
+            return aIsNewer;
+        });
+    }
+    /**
+     * Checks if first message is older than second message.
+     * @returns `true` if `a` is older than `b`; `false` otherwise
+     */
+    static isOlder(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aIsOlder = ((yield Message.compareMessageTimestamp(a, b)) < 0);
+            return aIsOlder;
+        });
+    }
+    /**
+     * See if the given message is signed by an author-delegate.
+     */
+    static isSignedByAuthorDelegate(message) {
+        var _a;
+        return ((_a = message.authorization) === null || _a === void 0 ? void 0 : _a.authorDelegatedGrant) !== undefined;
+    }
+    /**
+     * See if the given message is signed by an owner-delegate.
+     */
+    static isSignedByOwnerDelegate(message) {
+        var _a;
+        return ((_a = message.authorization) === null || _a === void 0 ? void 0 : _a.ownerDelegatedGrant) !== undefined;
+    }
+    /**
+     * Compares the `messageTimestamp` of the given messages with a fallback to message CID according to the spec.
+     * @returns 1 if `a` is larger/newer than `b`; -1 if `a` is smaller/older than `b`; 0 otherwise (same age)
+     */
+    static compareMessageTimestamp(a, b) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (a.descriptor.messageTimestamp > b.descriptor.messageTimestamp) {
+                return 1;
+            }
+            else if (a.descriptor.messageTimestamp < b.descriptor.messageTimestamp) {
+                return -1;
+            }
+            // else `messageTimestamp` is the same between a and b
+            // compare the `dataCid` instead, the < and > operators compare strings in lexicographical order
+            return Message.compareCid(a, b);
+        });
+    }
+    /**
+     * Validates the structural integrity of the message signature given:
+     * 1. The message signature must contain exactly 1 signature
+     * 2. Passes JSON schema validation
+     * 3. The `descriptorCid` property matches the CID of the message descriptor
+     * NOTE: signature is NOT verified.
+     * @param payloadJsonSchemaKey The key to look up the JSON schema referenced in `compile-validators.js` and perform payload schema validation on.
+     * @returns the parsed JSON payload object if validation succeeds.
+     */
+    static validateSignatureStructure(messageSignature_1, messageDescriptor_1) {
+        return __awaiter(this, arguments, void 0, function* (messageSignature, messageDescriptor, payloadJsonSchemaKey = 'GenericSignaturePayload') {
+            if (messageSignature.signatures.length !== 1) {
+                throw new DwnError(DwnErrorCode.AuthenticationMoreThanOneSignatureNotSupported, 'expected no more than 1 signature for authorization purpose');
+            }
+            // validate payload integrity
+            const payloadJson = Jws.decodePlainObjectPayload(messageSignature);
+            validateJsonSchema(payloadJsonSchemaKey, payloadJson);
+            // `descriptorCid` validation - ensure that the provided descriptorCid matches the CID of the actual message
+            const { descriptorCid } = payloadJson;
+            const expectedDescriptorCid = yield Cid.computeCid(messageDescriptor);
+            if (descriptorCid !== expectedDescriptorCid) {
+                throw new DwnError(DwnErrorCode.AuthenticateDescriptorCidMismatch, `provided descriptorCid ${descriptorCid} does not match expected CID ${expectedDescriptorCid}`);
+            }
+            return payloadJson;
+        });
+    }
+}
+//# sourceMappingURL=message.js.map

package/dist/esm/src/core/message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.js","sourceRoot":"","sources":["../../../../src/core/message.ts"],"names":[],"mappings":";;;;;;;;;AAKA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExD;;GAEG;AACH,MAAM,OAAO,OAAO;IAElB;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,OAAuB;QAC7C,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,OAAO,CAAC,aAAa,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,kBAAkB,CAAC,UAAe;QAC9C,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC/C,MAAM,eAAe,GAAG,YAAY,GAAG,SAAS,CAAC;QAEjD,wCAAwC;QACxC,kBAAkB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAAA,CAAC;IAEF;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,OAAuB;QAC7C,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAO,MAAM,CAAC,OAAuB;;YAChD,qDAAqD;YACrD,qFAAqF;YACrF,+FAA+F;YAC/F,sHAAsH;YAEtH,6DAA6D;YAC7D,MAAM,UAAU,GAAG,kBAAK,OAAO,CAAS,CAAC;YACzC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC3B,OAAO,UAAU,CAAC,WAAW,CAAC;YAChC,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,UAA4B,CAAC,CAAC;YAC/D,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,UAAU,CAAC,CAAiB,EAAE,CAAiB;;YACjE,iEAAiE;YACjE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;KAAA;IAED;;;;OAIG;IACI,MAAM,CAAO,mBAAmB,CAAC,KAMvC;;YACC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;YAEtF,IAAI,gBAAgB,CAAC;YACrB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,CAAC;YAE3H,MAAM,aAAa,GAAuB;gBACxC,SAAS;aACV,CAAC;YAEF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,aAAa,CAAC,oBAAoB,GAAG,cAAc,CAAC;YACtD,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,eAAe,CACjC,UAAsB,EACtB,MAAc,EACd,2BAA8G;;YAE9G,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEvD,MAAM,gBAAgB,mBAA8B,aAAa,IAAK,2BAA2B,CAAE,CAAC;YACpG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;YAE5C,MAAM,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;YAEtE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAEnC,OAAO,SAAS,CAAC;QACnB,CAAC;KAAA;IAED;;OAEG;IACI,MAAM,CAAO,gBAAgB,CAAC,QAA0B;;YAC7D,IAAI,oBAAoB,GAA+B,SAAS,CAAC;YACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,oBAAoB,KAAK,SAAS,KAAI,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA,EAAE,CAAC;oBAC/F,oBAAoB,GAAG,OAAO,CAAC;gBACjC,CAAC;YACH,CAAC;YAED,OAAO,oBAAoB,CAAC;QAC9B,CAAC;KAAA;IAED;;OAEG;IACI,MAAM,CAAO,gBAAgB,CAAC,QAA0B;;YAC7D,IAAI,oBAAoB,GAA+B,SAAS,CAAC;YACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,oBAAoB,KAAK,SAAS,KAAI,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA,EAAE,CAAC;oBAC/F,oBAAoB,GAAG,OAAO,CAAC;gBACjC,CAAC;YACH,CAAC;YAED,OAAO,oBAAoB,CAAC;QAC9B,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,OAAO,CAAC,CAAiB,EAAE,CAAiB;;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAA,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAG,CAAC,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,OAAO,CAAC,CAAiB,EAAE,CAAiB;;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAA,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAG,CAAC,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED;;OAEG;IACI,MAAM,CAAC,wBAAwB,CAAC,OAAuB;;QAC5D,OAAO,CAAA,MAAA,OAAO,CAAC,aAAa,0CAAE,oBAAoB,MAAK,SAAS,CAAC;IACnE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,uBAAuB,CAAC,OAAuB;;QAC3D,OAAO,CAAA,MAAA,OAAO,CAAC,aAAa,0CAAE,mBAAmB,MAAK,SAAS,CAAC;IAClE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAO,uBAAuB,CAAC,CAAiB,EAAE,CAAiB;;YAC9E,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,GAAG,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC;YACX,CAAC;iBAAM,IAAI,CAAC,CAAC,UAAU,CAAC,gBAAgB,GAAG,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACzE,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC;YAED,sDAAsD;YACtD,gGAAgG;YAChG,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;KAAA;IAED;;;;;;;;OAQG;IACI,MAAM,CAAO,0BAA0B;6DAC5C,gBAA4B,EAC5B,iBAA6B,EAC7B,uBAA+B,yBAAyB;YAGxD,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,8CAA8C,EAAE,6DAA6D,CAAC,CAAC;YACjJ,CAAC;YAED,6BAA6B;YAC7B,MAAM,WAAW,GAAG,GAAG,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;YAEnE,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAEtD,4GAA4G;YAC5G,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC;YACtC,MAAM,qBAAqB,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,aAAa,KAAK,qBAAqB,EAAE,CAAC;gBAC5C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,iCAAiC,EAC9C,0BAA0B,aAAa,gCAAgC,qBAAqB,EAAE,CAC/F,CAAC;YACJ,CAAC;YAED,OAAO,WAAW,CAAC;QACrB,CAAC;KAAA;CACF"}

package/dist/esm/src/core/messages-grant-authorization.js

@@ -0,0 +1,101 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { DwnInterfaceName } from '../enums/dwn-interface-method.js';
+import { GrantAuthorization } from './grant-authorization.js';
+import { PermissionsProtocol } from '../protocols/permissions.js';
+import { Records } from '../utils/records.js';
+import { RecordsWrite } from '../interfaces/records-write.js';
+import { DwnError, DwnErrorCode } from './dwn-error.js';
+export class MessagesGrantAuthorization {
+    /**
+     * Authorizes a MessagesReadMessage using the given permission grant.
+     * @param messageStore Used to check if the given grant has been revoked; and to fetch related RecordsWrites if needed.
+     */
+    static authorizeMessagesRead(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { messagesReadMessage, messageToRead, expectedGrantor, expectedGrantee, permissionGrant, messageStore } = input;
+            yield GrantAuthorization.performBaseValidation({
+                incomingMessage: messagesReadMessage,
+                expectedGrantor,
+                expectedGrantee,
+                permissionGrant,
+                messageStore
+            });
+            const scope = permissionGrant.scope;
+            yield MessagesGrantAuthorization.verifyScope(expectedGrantor, messageToRead, scope, messageStore);
+        });
+    }
+    /**
+     * Authorizes the scope of a permission grant for MessagesQuery or MessagesSubscribe.
+     * @param messageStore Used to check if the grant has been revoked.
+     */
+    static authorizeQueryOrSubscribe(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { incomingMessage, expectedGrantor, expectedGrantee, permissionGrant, messageStore } = input;
+            yield GrantAuthorization.performBaseValidation({
+                incomingMessage,
+                expectedGrantor,
+                expectedGrantee,
+                permissionGrant,
+                messageStore
+            });
+            // if the grant is scoped to a specific protocol, ensure that all of the query filters must include that protocol
+            if (PermissionsProtocol.hasProtocolScope(permissionGrant.scope)) {
+                const scopedProtocol = permissionGrant.scope.protocol;
+                for (const filter of incomingMessage.descriptor.filters) {
+                    if (filter.protocol !== scopedProtocol) {
+                        throw new DwnError(DwnErrorCode.MessagesGrantAuthorizationMismatchedProtocol, `The protocol ${filter.protocol} does not match the scoped protocol ${scopedProtocol}`);
+                    }
+                }
+            }
+        });
+    }
+    /**
+     * Verifies the given record against the scope of the given grant.
+     */
+    static verifyScope(tenant, messageToGet, incomingScope, messageStore) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (incomingScope.protocol === undefined) {
+                // if no protocol is specified in the scope, then the grant is for all records
+                return;
+            }
+            if (messageToGet.descriptor.interface === DwnInterfaceName.Records) {
+                // if the message is a Records interface message, get the RecordsWrite message associated with the record
+                const recordsMessage = messageToGet;
+                const recordsWriteMessage = Records.isRecordsWrite(recordsMessage) ? recordsMessage :
+                    yield RecordsWrite.fetchNewestRecordsWrite(messageStore, tenant, recordsMessage.descriptor.recordId);
+                if (recordsWriteMessage.descriptor.protocol === incomingScope.protocol) {
+                    // the record protocol matches the incoming scope protocol
+                    return;
+                }
+                // we check if the protocol is the internal PermissionsProtocol for further validation
+                if (recordsWriteMessage.descriptor.protocol === PermissionsProtocol.uri) {
+                    // get the permission scope from the permission message
+                    const permissionScope = yield PermissionsProtocol.getScopeFromPermissionRecord(tenant, messageStore, recordsWriteMessage);
+                    if (PermissionsProtocol.hasProtocolScope(permissionScope) && permissionScope.protocol === incomingScope.protocol) {
+                        // the permissions record scoped protocol matches the incoming scope protocol
+                        return;
+                    }
+                }
+            }
+            else if (messageToGet.descriptor.interface === DwnInterfaceName.Protocols) {
+                // if the message is a protocol message, it must be a `ProtocolConfigure` message
+                const protocolsConfigureMessage = messageToGet;
+                const configureProtocol = protocolsConfigureMessage.descriptor.definition.protocol;
+                if (configureProtocol === incomingScope.protocol) {
+                    // the configured protocol matches the incoming scope protocol
+                    return;
+                }
+            }
+            throw new DwnError(DwnErrorCode.MessagesReadVerifyScopeFailed, 'record message failed scope authorization');
+        });
+    }
+}
+//# sourceMappingURL=messages-grant-authorization.js.map

package/dist/esm/src/core/messages-grant-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages-grant-authorization.js","sourceRoot":"","sources":["../../../../src/core/messages-grant-authorization.ts"],"names":[],"mappings":";;;;;;;;;AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,OAAO,0BAA0B;IAErC;;;OAGG;IACI,MAAM,CAAO,qBAAqB,CAAC,KAOzC;;YACC,MAAM,EACJ,mBAAmB,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EACpG,GAAG,KAAK,CAAC;YAEV,MAAM,kBAAkB,CAAC,qBAAqB,CAAC;gBAC7C,eAAe,EAAE,mBAAmB;gBACpC,eAAe;gBACf,eAAe;gBACf,eAAe;gBACf,YAAY;aACb,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,eAAe,CAAC,KAAgC,CAAC;YAC/D,MAAM,0BAA0B,CAAC,WAAW,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACpG,CAAC;KAAA;IAED;;;OAGG;IACI,MAAM,CAAO,yBAAyB,CAAC,KAM7C;;YACC,MAAM,EACJ,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EACjF,GAAG,KAAK,CAAC;YAEV,MAAM,kBAAkB,CAAC,qBAAqB,CAAC;gBAC7C,eAAe;gBACf,eAAe;gBACf,eAAe;gBACf,eAAe;gBACf,YAAY;aACb,CAAC,CAAC;YAEH,iHAAiH;YACjH,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACtD,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;wBACvC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,4CAA4C,EACzD,gBAAgB,MAAM,CAAC,QAAQ,uCAAuC,cAAc,EAAE,CACvF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;KAAA;IAED;;OAEG;IACK,MAAM,CAAO,WAAW,CAC9B,MAAc,EACd,YAA4B,EAC5B,aAAsC,EACtC,YAA0B;;YAE1B,IAAI,aAAa,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzC,8EAA8E;gBAC9E,OAAO;YACT,CAAC;YAED,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBACnE,yGAAyG;gBACzG,MAAM,cAAc,GAAG,YAA0D,CAAC;gBAClF,MAAM,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;oBACnF,MAAM,YAAY,CAAC,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAEvG,IAAI,mBAAmB,CAAC,UAAU,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;oBACvE,0DAA0D;oBAC1D,OAAO;gBACT,CAAC;gBAED,sFAAsF;gBACtF,IAAI,mBAAmB,CAAC,UAAU,CAAC,QAAQ,KAAK,mBAAmB,CAAC,GAAG,EAAE,CAAC;oBACxE,uDAAuD;oBACvD,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,4BAA4B,CAC5E,MAAM,EACN,YAAY,EACZ,mBAAqD,CACtD,CAAC;oBAEF,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;wBACjH,6EAA6E;wBAC7E,OAAO;oBACT,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,KAAK,gBAAgB,CAAC,SAAS,EAAE,CAAC;gBAC5E,iFAAiF;gBACjF,MAAM,yBAAyB,GAAG,YAAyC,CAAC;gBAC5E,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACnF,IAAI,iBAAiB,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;oBACjD,8DAA8D;oBAC9D,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,6BAA6B,EAAE,2CAA2C,CAAC,CAAC;QAC9G,CAAC;KAAA;CACF"}