@enbox/dwn-sdk-js 0.0.6 → 0.0.8

package/src/handlers/records-query.ts

@@ -1,9 +1,8 @@
-import type { DataStore } from '../types/data-store.js';
-import type { DidResolver } from '@enbox/dids';
+import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
 import type { Filter, PaginationCursor } from '../types/query-types.js';
 import type { GenericMessage, MessageSort } from '../types/message-types.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { RecordsQueryMessage, RecordsQueryReply, RecordsQueryReplyEntry } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -19,7 +18,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class RecordsQueryHandler implements MethodHandler {
 
-  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private dataStore: DataStore) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -42,9 +41,9 @@ export class RecordsQueryHandler implements MethodHandler {
     } else {
       // authentication and authorization
       try {
-        await authenticate(message.authorization!, this.didResolver);
+        await authenticate(message.authorization!, this.deps.didResolver);
 
-        await RecordsQueryHandler.authorizeRecordsQuery(tenant, recordsQuery, this.messageStore);
+        await RecordsQueryHandler.authorizeRecordsQuery(tenant, recordsQuery, this.deps.messageStore, this.deps.coreProtocols);
       } catch (e) {
         return messageReplyFromError(e, 401);
       }
@@ -63,7 +62,7 @@ export class RecordsQueryHandler implements MethodHandler {
     // attach initial write if returned RecordsWrite is not initial write
     for (const recordsWrite of recordsWrites) {
       if (!await RecordsWrite.isInitialWrite(recordsWrite)) {
-        const initialWriteQueryResult = await this.messageStore.query(
+        const initialWriteQueryResult = await this.deps.messageStore.query(
           tenant,
           [{ recordId: recordsWrite.recordId, isLatestBaseState: false, method: DwnMethodName.Write }]
         );
@@ -123,7 +122,7 @@ export class RecordsQueryHandler implements MethodHandler {
     };
 
     const messageSort = this.convertDateSort(dateSort);
-    return this.messageStore.query(tenant, [ queryFilter ], messageSort, pagination);
+    return this.deps.messageStore.query(tenant, [ queryFilter ], messageSort, pagination);
   }
 
   /**
@@ -169,7 +168,7 @@ export class RecordsQueryHandler implements MethodHandler {
     }
 
     const messageSort = this.convertDateSort(dateSort);
-    return this.messageStore.query(tenant, filters, messageSort, pagination );
+    return this.deps.messageStore.query(tenant, filters, messageSort, pagination );
   }
 
   /**
@@ -181,7 +180,7 @@ export class RecordsQueryHandler implements MethodHandler {
     const { dateSort, pagination } = recordsQuery.message.descriptor;
     const filter = RecordsQueryHandler.buildPublishedRecordsFilter(recordsQuery);
     const messageSort = this.convertDateSort(dateSort);
-    return this.messageStore.query(tenant, [ filter ], messageSort, pagination);
+    return this.deps.messageStore.query(tenant, [ filter ], messageSort, pagination);
   }
 
   private static buildPublishedRecordsFilter(recordsQuery: RecordsQuery): Filter {
@@ -249,7 +248,8 @@ export class RecordsQueryHandler implements MethodHandler {
   private static async authorizeRecordsQuery(
     tenant: string,
     recordsQuery: RecordsQuery,
-    messageStore: MessageStore
+    messageStore: MessageStore,
+    coreProtocols?: CoreProtocolRegistry,
   ): Promise<void> {
 
     if (Message.isSignedByAuthorDelegate(recordsQuery.message)) {
@@ -260,7 +260,7 @@ export class RecordsQueryHandler implements MethodHandler {
     // this is because we dynamically filter out records that the caller is not authorized to see.
     // Currently only run protocol authorization if message deliberately invokes a protocol role.
     if (Records.shouldProtocolAuthorize(recordsQuery.signaturePayload!)) {
-      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsQuery, messageStore);
+      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsQuery, messageStore, coreProtocols);
     }
   }
 }

package/src/handlers/records-read.ts

@@ -1,8 +1,7 @@
-import type { DataStore } from '../types/data-store.js';
-import type { DidResolver } from '@enbox/dids';
+import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { Filter } from '../types/query-types.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { RecordsDeleteMessage, RecordsQueryReplyEntry, RecordsReadMessage, RecordsReadReply } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -21,7 +20,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class RecordsReadHandler implements MethodHandler {
 
-  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private dataStore: DataStore) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -38,7 +37,7 @@ export class RecordsReadHandler implements MethodHandler {
     // authentication
     try {
       if (recordsRead.author !== undefined) {
-        await authenticate(message.authorization!, this.didResolver);
+        await authenticate(message.authorization!, this.deps.didResolver);
       }
     } catch (e) {
       return messageReplyFromError(e, 401);
@@ -52,7 +51,7 @@ export class RecordsReadHandler implements MethodHandler {
       ...Records.convertFilter(message.descriptor.filter)
     };
     const messageSort = Records.convertDateSort(message.descriptor.dateSort);
-    const { messages: existingMessages } = await this.messageStore.query(tenant, [ query ], messageSort, { limit: 1 });
+    const { messages: existingMessages } = await this.deps.messageStore.query(tenant, [ query ], messageSort, { limit: 1 });
     if (existingMessages.length === 0) {
       return {
         status: { code: 404, detail: 'Not Found' }
@@ -61,24 +60,35 @@ export class RecordsReadHandler implements MethodHandler {
 
     const matchedMessage = existingMessages[0];
 
-    // if the matched message is a RecordsDelete, we mark the record as not-found and return both the RecordsDelete and the initial RecordsWrite
-    // TODO: https://github.com/enboxorg/enbox/issues/819:
-    // Consider performing authorization checks like when records exists before returning RecordsDelete and initial RecordsWrite of a deleted record
+    // If the matched message is a RecordsDelete, authorize against the newest RecordsWrite
+    // (for parity with the live-record path which authorizes against the latest write),
+    // then return 404 with both the RecordsDelete and the initial RecordsWrite.
     if (matchedMessage.descriptor.method === DwnMethodName.Delete) {
       const recordsDeleteMessage = matchedMessage as RecordsDeleteMessage;
-      const initialWrite = await RecordsWrite.fetchInitialRecordsWriteMessage(this.messageStore, tenant, recordsDeleteMessage.descriptor.recordId);
+      const recordId = recordsDeleteMessage.descriptor.recordId;
 
+      const initialWrite = await RecordsWrite.fetchInitialRecordsWriteMessage(this.deps.messageStore, tenant, recordId);
       if (initialWrite === undefined) {
         return messageReplyFromError(new DwnError(
           DwnErrorCode.RecordsReadInitialWriteNotFound,
-          'Initial write for deleted record not found'
+          'initial write for deleted record not found'
         ), 400);
       }
 
-      // Perform authorization before returning the delete and initial write messages
-      const parsedInitialWrite = await RecordsWrite.parse(initialWrite);
+      // Authorize against the newest RecordsWrite so that mutable properties like `published`
+      // reflect the record's state at the time of deletion, not just the initial write.
+      let newestWrite;
       try {
-        await RecordsReadHandler.authorizeRecordsRead(tenant, recordsRead, parsedInitialWrite, this.messageStore);
+        newestWrite = await RecordsWrite.fetchNewestRecordsWrite(this.deps.messageStore, tenant, recordId);
+      } catch {
+        // If newest write is not found (should not happen since initial write exists),
+        // fall back to the initial write for authorization.
+        newestWrite = initialWrite;
+      }
+      const parsedNewestWrite = await RecordsWrite.parse(newestWrite);
+
+      try {
+        await RecordsReadHandler.authorizeRecordsRead(tenant, recordsRead, parsedNewestWrite, this.deps.messageStore, this.deps.coreProtocols);
       } catch (error) {
         return messageReplyFromError(error, 401);
       }
@@ -87,7 +97,7 @@ export class RecordsReadHandler implements MethodHandler {
         status : { code: 404, detail: 'Not Found' },
         entry  : {
           recordsDelete: recordsDeleteMessage,
-          initialWrite
+          initialWrite,
         }
       };
     }
@@ -96,7 +106,10 @@ export class RecordsReadHandler implements MethodHandler {
     const matchedRecordsWrite = matchedMessage as RecordsQueryReplyEntry;
 
     try {
-      await RecordsReadHandler.authorizeRecordsRead(tenant, recordsRead, await RecordsWrite.parse(matchedRecordsWrite), this.messageStore);
+      const parsedWrite = await RecordsWrite.parse(matchedRecordsWrite);
+      await RecordsReadHandler.authorizeRecordsRead(
+        tenant, recordsRead, parsedWrite, this.deps.messageStore, this.deps.coreProtocols,
+      );
     } catch (error) {
       return messageReplyFromError(error, 401);
     }
@@ -107,7 +120,7 @@ export class RecordsReadHandler implements MethodHandler {
       data = DataStream.fromBytes(dataBytes);
       delete matchedRecordsWrite.encodedData;
     } else {
-      const result = await this.dataStore.get(tenant, matchedRecordsWrite.recordId, matchedRecordsWrite.descriptor.dataCid);
+      const result = await this.deps.dataStore!.get(tenant, matchedRecordsWrite.recordId, matchedRecordsWrite.descriptor.dataCid);
       if (result?.dataStream === undefined) {
         return {
           status: { code: 404, detail: 'Not Found' }
@@ -126,7 +139,7 @@ export class RecordsReadHandler implements MethodHandler {
 
     // attach initial write if latest RecordsWrite is not initial write
     if (!await RecordsWrite.isInitialWrite(matchedRecordsWrite)) {
-      const initialWriteQueryResult = await this.messageStore.query(
+      const initialWriteQueryResult = await this.deps.messageStore.query(
         tenant,
         [{ recordId: matchedRecordsWrite.recordId, isLatestBaseState: false, method: DwnMethodName.Write }]
       );
@@ -145,7 +158,8 @@ export class RecordsReadHandler implements MethodHandler {
     tenant: string,
     recordsRead: RecordsRead,
     matchedRecordsWrite: RecordsWrite,
-    messageStore: MessageStore
+    messageStore: MessageStore,
+    coreProtocols?: CoreProtocolRegistry,
   ): Promise<void> {
     if (Message.isSignedByAuthorDelegate(recordsRead.message)) {
       await recordsRead.authorizeDelegate(matchedRecordsWrite.message, messageStore);
@@ -174,10 +188,8 @@ export class RecordsReadHandler implements MethodHandler {
         permissionGrant,
         messageStore
       });
-    } else if (descriptor.protocol !== undefined) {
-      await ProtocolAuthorization.authorizeRead(tenant, recordsRead, matchedRecordsWrite, messageStore);
     } else {
-      throw new DwnError(DwnErrorCode.RecordsReadAuthorizationFailed, 'message failed authorization');
+      await ProtocolAuthorization.authorizeRead(tenant, recordsRead, matchedRecordsWrite, messageStore, coreProtocols);
     }
   }
 }

package/src/handlers/records-subscribe.ts

@@ -1,14 +1,13 @@
-import type { DidResolver } from '@enbox/dids';
+import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { MessageSort } from '../types/message-types.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
-import type { EventListener, EventStream } from '../types/subscriptions.js';
+import type { SubscriptionListener } from '../types/subscriptions.js';
 import type { Filter, PaginationCursor } from '../types/query-types.js';
-import type { RecordEvent, RecordsQueryReplyEntry, RecordsSubscribeMessage, RecordsSubscribeReply, RecordSubscriptionHandler } from '../types/records-types.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
+import type { RecordsQueryReplyEntry, RecordsSubscribeMessage, RecordsSubscribeReply } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
 import { DateSort } from '../types/records-types.js';
-import { FilterUtility } from '../utils/filter.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
@@ -21,7 +20,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class RecordsSubscribeHandler implements MethodHandler {
 
-  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private eventStream?: EventStream) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -30,11 +29,11 @@ export class RecordsSubscribeHandler implements MethodHandler {
   }: {
     tenant: string,
     message: RecordsSubscribeMessage,
-    subscriptionHandler: RecordSubscriptionHandler,
+    subscriptionHandler: SubscriptionListener,
   }): Promise<RecordsSubscribeReply> {
-    if (this.eventStream === undefined) {
+    if (this.deps.eventLog === undefined) {
       return messageReplyFromError(new DwnError(
-        DwnErrorCode.RecordsSubscribeEventStreamUnimplemented,
+        DwnErrorCode.RecordsSubscribeEventLogUnimplemented,
         'Subscriptions are not supported'
       ), 501);
     }
@@ -59,8 +58,8 @@ export class RecordsSubscribeHandler implements MethodHandler {
     } else {
       // authentication and authorization
       try {
-        await authenticate(message.authorization!, this.didResolver);
-        await RecordsSubscribeHandler.authorizeRecordsSubscribe(tenant, recordsSubscribe, this.messageStore);
+        await authenticate(message.authorization!, this.deps.didResolver);
+        await RecordsSubscribeHandler.authorizeRecordsSubscribe(tenant, recordsSubscribe, this.deps.messageStore, this.deps.coreProtocols);
       } catch (error) {
         return messageReplyFromError(error, 401);
       }
@@ -74,30 +73,51 @@ export class RecordsSubscribeHandler implements MethodHandler {
       }
     }
 
-    // Step 1: Register event listener FIRST to ensure no events are missed between query and subscribe
-    const listener: EventListener = (eventTenant, event, eventIndexes):void => {
-      if (tenant === eventTenant && FilterUtility.matchAnyFilter(eventIndexes, eventFilters)) {
-        subscriptionHandler(event as RecordEvent);
+    const messageCid = await Message.getCid(message);
+    const { cursor: eventLogCursor } = recordsSubscribe.message.descriptor;
+
+    if (eventLogCursor !== undefined) {
+      // ---- Cursor mode: catch-up from EventLog + EOSE + live ----
+      // All catch-up, buffering, dedup, and EOSE delivery are handled by the
+      // EventLog implementation. The handler just passes the cursor and filters.
+      // The subscriptionHandler receives SubscriptionMessage (event + EOSE) directly.
+
+      try {
+        const subscription = await this.deps.eventLog!.subscribe(tenant, messageCid, subscriptionHandler, {
+          cursor  : eventLogCursor,
+          filters : eventFilters,
+        });
+
+        return {
+          status: { code: 200, detail: 'OK' },
+          subscription,
+        };
+      } catch (error) {
+        return messageReplyFromError(error, 500);
       }
-    };
+    }
 
-    const messageCid = await Message.getCid(message);
-    const subscription = await this.eventStream.subscribe(tenant, messageCid, listener);
+    // ---- No cursor: existing behavior (initial snapshot from MessageStore) ----
+
+    // Step 1: Register event listener FIRST to ensure no events are missed between query and subscribe
+    const subscription = await this.deps.eventLog!.subscribe(tenant, messageCid, subscriptionHandler, {
+      filters: eventFilters,
+    });
 
     // Step 2: Query for initial snapshot of matching records
     let entries: RecordsQueryReplyEntry[];
-    let cursor: PaginationCursor | undefined;
+    let paginationCursor: PaginationCursor | undefined;
     try {
       const { dateSort, pagination } = recordsSubscribe.message.descriptor;
       const messageSort = RecordsSubscribeHandler.convertDateSort(dateSort);
-      const queryResult = await this.messageStore.query(tenant, queryFilters, messageSort, pagination);
+      const queryResult = await this.deps.messageStore.query(tenant, queryFilters, messageSort, pagination);
       entries = queryResult.messages as RecordsQueryReplyEntry[];
-      cursor = queryResult.cursor;
+      paginationCursor = queryResult.cursor;
 
       // attach initialWrite for non-initial writes
       for (const entry of entries) {
         if (!await RecordsWrite.isInitialWrite(entry)) {
-          const initialWriteResult = await this.messageStore.query(
+          const initialWriteResult = await this.deps.messageStore.query(
             tenant,
             [{ recordId: entry.recordId, isLatestBaseState: false, method: DwnMethodName.Write }]
           );
@@ -114,10 +134,10 @@ export class RecordsSubscribeHandler implements MethodHandler {
 
     // Step 3: Return subscription + initial entries + cursor
     return {
-      status: { code: 200, detail: 'OK' },
+      status : { code: 200, detail: 'OK' },
       subscription,
       entries,
-      cursor
+      cursor : paginationCursor,
     };
   }
 
@@ -300,7 +320,8 @@ export class RecordsSubscribeHandler implements MethodHandler {
   public static async authorizeRecordsSubscribe(
     tenant: string,
     recordsSubscribe: RecordsSubscribe,
-    messageStore: MessageStore
+    messageStore: MessageStore,
+    coreProtocols?: CoreProtocolRegistry,
   ): Promise<void> {
 
     if (Message.isSignedByAuthorDelegate(recordsSubscribe.message)) {
@@ -311,7 +332,7 @@ export class RecordsSubscribeHandler implements MethodHandler {
     // this is because we dynamically filter out records that the caller is not authorized to see.
     // Currently only run protocol authorization if message deliberately invokes a protocol role.
     if (Records.shouldProtocolAuthorize(recordsSubscribe.signaturePayload!)) {
-      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsSubscribe, messageStore);
+      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsSubscribe, messageStore, coreProtocols);
     }
   }
 }

package/src/handlers/records-write.ts

@@ -1,10 +1,6 @@
-import type { DataStore } from '../types/data-store.js';
-import type { DidResolver } from '@enbox/dids';
-import type { EventStream } from '../types/subscriptions.js';
 import type { GenericMessageReply } from '../types/message-types.js';
 import type { MessageStore } from '../types/message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
-import type { StateIndex } from '../types/state-index.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { RecordsQueryReplyEntry, RecordsWriteMessage } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -26,13 +22,7 @@ type HandlerArgs = { tenant: string, message: RecordsWriteMessage, dataStream?:
 
 export class RecordsWriteHandler implements MethodHandler {
 
-  constructor(
-    private didResolver: DidResolver,
-    private messageStore: MessageStore,
-    private dataStore: DataStore,
-    private stateIndex: StateIndex,
-    private eventStream?: EventStream
-  ) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -43,18 +33,15 @@ export class RecordsWriteHandler implements MethodHandler {
     try {
       recordsWrite = await RecordsWrite.parse(message);
 
-      // Protocol-authorized record specific validation
-      if (message.descriptor.protocol !== undefined) {
-        await ProtocolAuthorization.validateReferentialIntegrity(tenant, recordsWrite, this.messageStore);
-      }
+      await ProtocolAuthorization.validateReferentialIntegrity(tenant, recordsWrite, this.deps.messageStore, this.deps.coreProtocols);
     } catch (e) {
       return messageReplyFromError(e, 400);
     }
 
     // authentication & authorization
     try {
-      await authenticate(message.authorization, this.didResolver, message.attestation);
-      await RecordsWriteHandler.authorizeRecordsWrite(tenant, recordsWrite, this.messageStore);
+      await authenticate(message.authorization, this.deps.didResolver, message.attestation);
+      await this.authorizeRecordsWrite(tenant, recordsWrite, this.deps.messageStore);
     } catch (e) {
       return messageReplyFromError(e, 401);
     }
@@ -64,7 +51,7 @@ export class RecordsWriteHandler implements MethodHandler {
       interface : DwnInterfaceName.Records,
       recordId  : message.recordId
     };
-    const { messages: existingMessages } = await this.messageStore.query(tenant, [ query ]);
+    const { messages: existingMessages } = await this.deps.messageStore.query(tenant, [ query ]);
 
     // if the incoming write is not the initial write, then it must not modify any immutable properties defined by the initial write
     const newMessageIsInitialWrite = await recordsWrite.isInitialWrite();
@@ -95,6 +82,12 @@ export class RecordsWriteHandler implements MethodHandler {
       };
     }
 
+    // Look up the core protocol (if any) for the incoming message so that lifecycle hooks
+    // can be dispatched generically rather than checking for specific protocol URIs.
+    const coreProtocol = message.descriptor.protocol !== undefined
+      ? this.deps.coreProtocols?.get(message.descriptor.protocol)
+      : undefined;
+
     try {
       if (newestExistingMessage?.descriptor.method === DwnMethodName.Delete) {
         throw new DwnError(
@@ -103,11 +96,12 @@ export class RecordsWriteHandler implements MethodHandler {
         );
       }
 
-      // NOTE: We want to perform additional validation before storing the RecordsWrite.
-      // This is necessary for core DWN RecordsWrite that needs additional processing and allows us to fail before the storing and post processing.
-      //
-      // Example: Ensures that the protocol tag of a permission revocation RecordsWrite and the parent grant's scoped protocol match.
-      await this.preProcessingForCoreRecordsWrite(tenant, message);
+      // Dispatch pre-processing hooks to the core protocol, if applicable.
+      // This allows core protocols to perform cross-record validation before storage
+      // (e.g. ensuring revocation tag consistency with the parent grant's scoped protocol).
+      if (coreProtocol?.preProcessWrite !== undefined) {
+        await coreProtocol.preProcessWrite(tenant, message, this.deps.messageStore);
+      }
 
       // NOTE: We allow isLatestBaseState to be true ONLY if the incoming message comes with data, or if the incoming message is NOT an initial write
       // This would allow an initial write to be written to the DB without data, but having it not queryable,
@@ -133,14 +127,14 @@ export class RecordsWriteHandler implements MethodHandler {
       }
 
       const indexes = await recordsWrite.constructIndexes(isLatestBaseState);
-      await this.messageStore.put(tenant, messageWithOptionalEncodedData, indexes);
-      await this.stateIndex.insert(tenant, await Message.getCid(message), indexes);
+      await this.deps.messageStore.put(tenant, messageWithOptionalEncodedData, indexes);
+      await this.deps.stateIndex!.insert(tenant, await Message.getCid(message), indexes);
 
       // NOTE: We only emit a `RecordsWrite` when the message is the latest base state.
       // Because we allow a `RecordsWrite` which is not the latest state to be written, but not queried, we shouldn't emit it either.
       // It will be emitted as a part of a subsequent next write, if it is the latest base state.
-      if (this.eventStream !== undefined && isLatestBaseState) {
-        this.eventStream.emit(tenant, { message, initialWrite }, indexes);
+      if (this.deps.eventLog !== undefined && isLatestBaseState) {
+        await this.deps.eventLog.emit(tenant, { message, initialWrite }, indexes);
       }
     } catch (error) {
       if (error instanceof DwnError) {
@@ -149,8 +143,8 @@ export class RecordsWriteHandler implements MethodHandler {
           error.code === DwnErrorCode.RecordsWriteNotAllowedAfterDelete ||
           error.code === DwnErrorCode.RecordsWriteDataCidMismatch ||
           error.code === DwnErrorCode.RecordsWriteDataSizeMismatch ||
-          error.code.startsWith('PermissionsProtocolValidate') ||
-          error.code.startsWith('SchemaValidator')) {
+          error.code.startsWith('SchemaValidator') ||
+          this.deps.coreProtocols?.mapErrorToStatusCode(error.code) !== undefined) {
           return messageReplyFromError(error, 400);
         }
       }
@@ -170,78 +164,23 @@ export class RecordsWriteHandler implements MethodHandler {
 
     // delete all existing messages of the same record that are not newest, except for the initial write
     await StorageController.deleteAllOlderMessagesButKeepInitialWrite(
-      tenant, existingMessages, newestMessage, this.messageStore, this.dataStore, this.stateIndex
+      tenant, existingMessages, newestMessage, this.deps.messageStore, this.deps.dataStore!, this.deps.stateIndex!
     );
 
-    await this.postProcessingForCoreRecordsWrite(tenant, recordsWrite);
+    // Dispatch post-processing hooks to the core protocol, if applicable.
+    // This allows core protocols to perform cascading side effects after a successful write
+    // (e.g. deleting messages authorized by a revoked grant).
+    if (coreProtocol?.postProcessWrite !== undefined) {
+      await coreProtocol.postProcessWrite(tenant, recordsWrite, {
+        messageStore : this.deps.messageStore,
+        dataStore    : this.deps.dataStore!,
+        stateIndex   : this.deps.stateIndex!,
+      });
+    }
 
     return messageReply;
   };
 
-  /**
-   * Performs additional necessary validation before storing the RecordsWrite if it is a core DWN RecordsWrite that needs additional processing.
-   * For instance: a Permission revocation RecordsWrite.
-   */
-  private async preProcessingForCoreRecordsWrite(tenant: string, recordsWriteMessage: RecordsWriteMessage): Promise<void> {
-
-    // we validate the protocol tag of the revocation message against the grant's scoped protocol
-    // to do this we will fetch the grant, and compare the the scoped protocol value to the protocol tag of the revocation message
-    if (recordsWriteMessage.descriptor.protocol === PermissionsProtocol.uri &&
-      recordsWriteMessage.descriptor.protocolPath === PermissionsProtocol.revocationPath) {
-
-      // get the parentId of the revocation message, which is the permissionGrantId
-      // fetch the grant in order to get the grant's protocol
-      const permissionGrantId = recordsWriteMessage.descriptor.parentId!;
-      const grant = await PermissionsProtocol.fetchGrant(tenant, this.messageStore, permissionGrantId);
-
-      // get the protocol values of the revocation message from the protocol tag and the protocol from the grant scope if they are defined
-      // compare the two values ensuring they must match
-      const revokeTagProtocol = recordsWriteMessage.descriptor.tags?.protocol;
-      const grantProtocol = 'protocol' in grant.scope ? grant.scope.protocol : undefined;
-      if (grantProtocol !== revokeTagProtocol) {
-        throw new DwnError(
-          DwnErrorCode.PermissionsProtocolValidateRevocationProtocolTagMismatch,
-          `Revocation protocol ${revokeTagProtocol} does not match grant protocol ${grantProtocol}`
-        );
-      }
-    }
-  }
-
-  private static validateSchemaForCoreRecordsWrite(recordsWriteMessage: RecordsWriteMessage, dataBytes: Uint8Array): void {
-    if (recordsWriteMessage.descriptor.protocol === PermissionsProtocol.uri) {
-      PermissionsProtocol.validateSchema(recordsWriteMessage, dataBytes);
-    }
-  }
-
-  /**
-   * Performs additional necessary tasks if the RecordsWrite handled is a core DWN RecordsWrite that need additional processing.
-   * For instance: a Permission revocation RecordsWrite.
-   */
-  private async postProcessingForCoreRecordsWrite(tenant: string, recordsWrite: RecordsWrite): Promise<void> {
-    // If this message is a Permission revocation, we need to delete all grant-authorized messages with timestamp after revocation
-    // TODO: https://github.com/enboxorg/enbox/issues/716
-    // This code is a direct copy and paste from the original PermissionsRevokeHandler (no longer exists),
-    // but it appears that there was no test for it and it does not look like the code worked:
-    // - not seeing `permissionGrantId` being an index
-    // - not seeing `this.dataStore` being called to delete actual data
-    // - test coverage is missing for the main delete logic
-    if (recordsWrite.message.descriptor.protocol === PermissionsProtocol.uri &&
-      recordsWrite.message.descriptor.protocolPath === PermissionsProtocol.revocationPath) {
-      const permissionGrantId = recordsWrite.message.descriptor.parentId!;
-      const grantAuthorizedMessagesQuery = {
-        permissionGrantId,
-        dateCreated: { gte: recordsWrite.message.descriptor.messageTimestamp },
-      };
-      const { messages: grantAuthorizedMessagesAfterRevoke } = await this.messageStore.query(tenant, [ grantAuthorizedMessagesQuery ]);
-      const grantAuthorizedMessageCidsAfterRevoke: string[] = [];
-      for (const grantAuthorizedMessage of grantAuthorizedMessagesAfterRevoke) {
-        const messageCid = await Message.getCid(grantAuthorizedMessage);
-        await this.messageStore.delete(tenant, messageCid);
-      }
-      this.stateIndex.delete(tenant, grantAuthorizedMessageCidsAfterRevoke);
-    }
-  }
-
   /**
    * Returns a `RecordsQueryReplyEntry` with a copy of the incoming message and the incoming data encoded to `Base64URL`.
    */
@@ -265,7 +204,13 @@ export class RecordsWriteHandler implements MethodHandler {
       const dataCid = await Cid.computeDagPbCidFromBytes(dataBytes);
       RecordsWriteHandler.validateDataIntegrity(message.descriptor.dataCid, message.descriptor.dataSize, dataCid, dataBytes.length);
 
-      RecordsWriteHandler.validateSchemaForCoreRecordsWrite(message, dataBytes);
+      // Dispatch schema validation to the core protocol, if applicable.
+      const coreProtocol = message.descriptor.protocol !== undefined
+        ? this.deps.coreProtocols?.get(message.descriptor.protocol)
+        : undefined;
+      if (coreProtocol?.validateRecord !== undefined) {
+        coreProtocol.validateRecord(message, dataBytes);
+      }
 
       messageWithOptionalEncodedData = await this.cloneAndAddEncodedData(message, dataBytes);
     } else {
@@ -276,13 +221,13 @@ export class RecordsWriteHandler implements MethodHandler {
         // perform storage and CID computation in parallel
         const [dataCid, DataStorePutResult] = await Promise.all([
           Cid.computeDagPbCidFromStream(dataStreamCopy1),
-          this.dataStore.put(tenant, message.recordId, message.descriptor.dataCid, dataStreamCopy2)
+          this.deps.dataStore!.put(tenant, message.recordId, message.descriptor.dataCid, dataStreamCopy2)
         ]);
 
         RecordsWriteHandler.validateDataIntegrity(message.descriptor.dataCid, message.descriptor.dataSize, dataCid, DataStorePutResult.dataSize);
       } catch (error) {
         // unwind/delete data if we have issue with storage or the data failed integrity validation
-        await this.dataStore.delete(tenant, message.recordId, message.descriptor.dataCid);
+        await this.deps.dataStore!.delete(tenant, message.recordId, message.descriptor.dataCid);
 
         throw error;
       }
@@ -319,7 +264,7 @@ export class RecordsWriteHandler implements MethodHandler {
       // else just make sure the data is in the data store
 
       // attempt to retrieve the data from the previous message
-      const DataStoreGetResult = await this.dataStore.get(tenant, newestExistingWrite.recordId, message.descriptor.dataCid);
+      const DataStoreGetResult = await this.deps.dataStore!.get(tenant, newestExistingWrite.recordId, message.descriptor.dataCid);
 
       if (DataStoreGetResult === undefined) {
         throw new DwnError(
@@ -361,7 +306,7 @@ export class RecordsWriteHandler implements MethodHandler {
     }
   }
 
-  private static async authorizeRecordsWrite(tenant: string, recordsWrite: RecordsWrite, messageStore: MessageStore): Promise<void> {
+  private async authorizeRecordsWrite(tenant: string, recordsWrite: RecordsWrite, messageStore: MessageStore): Promise<void> {
     // if owner signature is given (`owner` is not `undefined`), it must be the same as the tenant DID
     if (recordsWrite.owner !== undefined && recordsWrite.owner !== tenant) {
       throw new DwnError(
@@ -394,10 +339,8 @@ export class RecordsWriteHandler implements MethodHandler {
         permissionGrant,
         messageStore
       });
-    } else if (recordsWrite.message.descriptor.protocol !== undefined) {
-      await ProtocolAuthorization.authorizeWrite(tenant, recordsWrite, messageStore);
     } else {
-      throw new DwnError(DwnErrorCode.RecordsWriteAuthorizationFailed, 'message failed authorization');
+      await ProtocolAuthorization.authorizeWrite(tenant, recordsWrite, messageStore, this.deps.coreProtocols);
     }
   }
 }