@enbox/dwn-sdk-js 0.0.7 → 0.1.0

package/src/handlers/messages-sync.ts

@@ -1,7 +1,5 @@
-import type { DidResolver } from '@enbox/dids';
 import type { MessageStore } from '../types/message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
-import type { StateIndex } from '../types/state-index.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { MessagesSyncMessage, MessagesSyncReply } from '../types/messages-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -15,11 +13,7 @@ import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 
 export class MessagesSyncHandler implements MethodHandler {
 
-  constructor(
-    private didResolver: DidResolver,
-    private messageStore: MessageStore,
-    private stateIndex: StateIndex,
-  ) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -34,8 +28,8 @@ export class MessagesSyncHandler implements MethodHandler {
     }
 
     try {
-      await authenticate(message.authorization, this.didResolver);
-      await MessagesSyncHandler.authorizeMessagesSync(tenant, messagesSync, this.messageStore);
+      await authenticate(message.authorization, this.deps.didResolver);
+      await MessagesSyncHandler.authorizeMessagesSync(tenant, messagesSync, this.deps.messageStore);
     } catch (e) {
       return messageReplyFromError(e, 401);
     }
@@ -46,8 +40,8 @@ export class MessagesSyncHandler implements MethodHandler {
       switch (action) {
       case 'root': {
         const rootHash = protocol !== undefined
-          ? await this.stateIndex.getProtocolRoot(tenant, protocol)
-          : await this.stateIndex.getRoot(tenant);
+          ? await this.deps.stateIndex!.getProtocolRoot(tenant, protocol)
+          : await this.deps.stateIndex!.getRoot(tenant);
         return {
           status : { code: 200, detail: 'OK' },
           root   : hashToHex(rootHash),
@@ -57,8 +51,8 @@ export class MessagesSyncHandler implements MethodHandler {
       case 'subtree': {
         const bitPath = MessagesSyncHandler.parseBitPrefix(prefix!);
         const hash = protocol !== undefined
-          ? await this.stateIndex.getProtocolSubtreeHash(tenant, protocol, bitPath)
-          : await this.stateIndex.getSubtreeHash(tenant, bitPath);
+          ? await this.deps.stateIndex!.getProtocolSubtreeHash(tenant, protocol, bitPath)
+          : await this.deps.stateIndex!.getSubtreeHash(tenant, bitPath);
         return {
           status : { code: 200, detail: 'OK' },
           hash   : hashToHex(hash),
@@ -68,8 +62,8 @@ export class MessagesSyncHandler implements MethodHandler {
       case 'leaves': {
         const bitPath = MessagesSyncHandler.parseBitPrefix(prefix!);
         const leaves = protocol !== undefined
-          ? await this.stateIndex.getProtocolLeaves(tenant, protocol, bitPath)
-          : await this.stateIndex.getLeaves(tenant, bitPath);
+          ? await this.deps.stateIndex!.getProtocolLeaves(tenant, protocol, bitPath)
+          : await this.deps.stateIndex!.getLeaves(tenant, bitPath);
         return {
           status  : { code: 200, detail: 'OK' },
           entries : leaves,

package/src/handlers/protocols-configure.ts

@@ -1,9 +1,6 @@
-import type { DidResolver } from '@enbox/dids';
-import type { EventStream } from '../types/subscriptions.js';
 import type { GenericMessageReply } from '../types/message-types.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
-import type { StateIndex } from '../types/state-index.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { ProtocolDefinition, ProtocolRuleSet, ProtocolsConfigureMessage } from '../types/protocols-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -18,12 +15,7 @@ import { getRuleSetAtPath, parseCrossProtocolRef } from '../utils/protocols.js';
 
 export class ProtocolsConfigureHandler implements MethodHandler {
 
-  constructor(
-    private didResolver: DidResolver,
-    private messageStore: MessageStore,
-    private stateIndex: StateIndex,
-    private eventStream?: EventStream
-  ) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -38,8 +30,8 @@ export class ProtocolsConfigureHandler implements MethodHandler {
 
     // authentication & authorization
     try {
-      await authenticate(message.authorization, this.didResolver);
-      await ProtocolsConfigureHandler.authorizeProtocolsConfigure(tenant, protocolsConfigure, this.messageStore);
+      await authenticate(message.authorization, this.deps.didResolver);
+      await ProtocolsConfigureHandler.authorizeProtocolsConfigure(tenant, protocolsConfigure, this.deps.messageStore);
     } catch (e) {
       return messageReplyFromError(e, 401);
     }
@@ -48,7 +40,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     // `$ref` paths must exist in the referenced protocols, and cross-protocol roles must exist.
     try {
       await ProtocolsConfigureHandler.validateCompositionDependencies(
-        tenant, message.descriptor.definition, this.messageStore
+        tenant, message.descriptor.definition, this.deps.messageStore
       );
     } catch (e) {
       return messageReplyFromError(e, 400);
@@ -60,7 +52,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
       method    : DwnMethodName.Configure,
       protocol  : message.descriptor.definition.protocol
     };
-    const { messages: existingMessages } = await this.messageStore.query(tenant, [ query ]);
+    const { messages: existingMessages } = await this.deps.messageStore.query(tenant, [ query ]);
 
     // find newest message, and if the incoming message is the newest
     let newestMessage = await Message.getNewestMessage(existingMessages);
@@ -75,13 +67,13 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     if (incomingMessageIsNewest) {
       const indexes = ProtocolsConfigureHandler.constructIndexes(protocolsConfigure, true);
 
-      await this.messageStore.put(tenant, message, indexes);
+      await this.deps.messageStore.put(tenant, message, indexes);
       const messageCid = await Message.getCid(message);
-      await this.stateIndex.insert(tenant, messageCid, indexes);
+      await this.deps.stateIndex!.insert(tenant, messageCid, indexes);
 
-      // only emit if the event stream is set
-      if (this.eventStream !== undefined) {
-        this.eventStream.emit(tenant, { message }, indexes);
+      // only emit if the event log is set
+      if (this.deps.eventLog !== undefined) {
+        await this.deps.eventLog.emit(tenant, { message }, indexes);
       }
 
       messageReply = {
@@ -91,9 +83,9 @@ export class ProtocolsConfigureHandler implements MethodHandler {
       // incoming message is older — still store it as a historical version (not the latest)
       const indexes = ProtocolsConfigureHandler.constructIndexes(protocolsConfigure, false);
 
-      await this.messageStore.put(tenant, message, indexes);
+      await this.deps.messageStore.put(tenant, message, indexes);
       const messageCid = await Message.getCid(message);
-      await this.stateIndex.insert(tenant, messageCid, indexes);
+      await this.deps.stateIndex!.insert(tenant, messageCid, indexes);
 
       messageReply = {
         status: { code: 202, detail: 'Accepted' }
@@ -108,8 +100,8 @@ export class ProtocolsConfigureHandler implements MethodHandler {
         const updatedIndexes = ProtocolsConfigureHandler.constructIndexes(existingProtocolsConfigure, false);
         const existingCid = await Message.getCid(existingMessage);
 
-        await this.messageStore.delete(tenant, existingCid);
-        await this.messageStore.put(tenant, existingMessage, updatedIndexes);
+        await this.deps.messageStore.delete(tenant, existingCid);
+        await this.deps.messageStore.put(tenant, existingMessage, updatedIndexes);
       }
     }
 
@@ -230,7 +222,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
       const childRuleSet = ruleSet[key] as ProtocolRuleSet;
       const childProtocolPath = protocolPath === '' ? key : `${protocolPath}/${key}`;
 
-      // Validate $ref path exists in the referenced protocol
+      // Validate $ref path exists in the referenced protocol and does not traverse through another $ref
       if (childRuleSet.$ref !== undefined) {
         const parsed = parseCrossProtocolRef(childRuleSet.$ref);
         if (parsed !== undefined) {
@@ -244,13 +236,36 @@ export class ProtocolsConfigureHandler implements MethodHandler {
             );
           }
 
-          const targetRuleSet = getRuleSetAtPath(parsed.protocolPath, refDefinition.structure);
-          if (targetRuleSet === undefined) {
-            throw new DwnError(
-              DwnErrorCode.ProtocolsConfigureInvalidRefProtocolPath,
-              `'$ref' at protocol path '${childProtocolPath}' references type path '${parsed.protocolPath}' ` +
-              `which does not exist in protocol '${refDefinition.protocol}'.`
-            );
+          // Walk the target path segment-by-segment and reject if any intermediate node has a $ref
+          const segments = parsed.protocolPath.split('/');
+          let currentLevel: { [key: string]: ProtocolRuleSet } = refDefinition.structure;
+
+          for (let i = 0; i < segments.length; i++) {
+            const segment = segments[i];
+            const node = currentLevel[segment] as ProtocolRuleSet | undefined;
+
+            if (node === undefined) {
+              throw new DwnError(
+                DwnErrorCode.ProtocolsConfigureInvalidRefProtocolPath,
+                `'$ref' at protocol path '${childProtocolPath}' references type path '${parsed.protocolPath}' ` +
+                `which does not exist in protocol '${refDefinition.protocol}'.`
+              );
+            }
+
+            // If any node along the target path (including the final target) has a $ref,
+            // it means the composition chain passes through another protocol boundary.
+            // Multi-level composition is not supported — reject at install time.
+            if (node.$ref !== undefined) {
+              const traversedPath = segments.slice(0, i + 1).join('/');
+              throw new DwnError(
+                DwnErrorCode.ProtocolsConfigureInvalidRefTargetThroughRef,
+                `'$ref' at protocol path '${childProtocolPath}' references type path '${parsed.protocolPath}' ` +
+                `in protocol '${refDefinition.protocol}', but the node '${traversedPath}' is itself ` +
+                `a '$ref' composition point. multi-level composition (chaining through '$ref' nodes) is not supported.`
+              );
+            }
+
+            currentLevel = node as { [key: string]: ProtocolRuleSet };
           }
         }
       }
@@ -312,4 +327,4 @@ export class ProtocolsConfigureHandler implements MethodHandler {
       ProtocolsConfigureHandler.validateRefsAndRolesRecursively(childRuleSet, childProtocolPath, referencedDefinitions);
     }
   }
-}
+}

package/src/handlers/protocols-query.ts

@@ -1,7 +1,4 @@
-import type { DataStore } from '../types/data-store.js';
-import type { DidResolver } from '@enbox/dids';
-import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { ProtocolsConfigureMessage, ProtocolsQueryMessage, ProtocolsQueryReply } from '../types/protocols-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -14,7 +11,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class ProtocolsQueryHandler implements MethodHandler {
 
-  constructor(private didResolver: DidResolver, private messageStore: MessageStore,private dataStore: DataStore) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -30,8 +27,8 @@ export class ProtocolsQueryHandler implements MethodHandler {
 
     // authentication & authorization
     try {
-      await authenticate(message.authorization, this.didResolver);
-      await protocolsQuery.authorize(tenant, this.messageStore);
+      await authenticate(message.authorization, this.deps.didResolver);
+      await protocolsQuery.authorize(tenant, this.deps.messageStore);
     } catch (error: any) {
 
       // return public ProtocolsConfigures if query fails with a certain authentication or authorization code
@@ -58,7 +55,7 @@ export class ProtocolsQueryHandler implements MethodHandler {
     };
     removeUndefinedProperties(query);
 
-    const { messages } = await this.messageStore.query(tenant, [ query ]);
+    const { messages } = await this.deps.messageStore.query(tenant, [ query ]);
 
     return {
       status  : { code: 200, detail: 'OK' },
@@ -78,7 +75,7 @@ export class ProtocolsQueryHandler implements MethodHandler {
       published         : true,
       isLatestBaseState : true,
     };
-    const { messages: publishedProtocolsConfigure } = await this.messageStore.query(tenant, [ filter ]);
+    const { messages: publishedProtocolsConfigure } = await this.deps.messageStore.query(tenant, [ filter ]);
     return publishedProtocolsConfigure as ProtocolsConfigureMessage[];
   }
 }

package/src/handlers/records-count.ts

@@ -1,7 +1,7 @@
-import type { DidResolver } from '@enbox/dids';
+import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { Filter } from '../types/query-types.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { RecordsCountMessage, RecordsCountReply } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -14,7 +14,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class RecordsCountHandler implements MethodHandler {
 
-  constructor(private didResolver: DidResolver, private messageStore: MessageStore) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -35,9 +35,9 @@ export class RecordsCountHandler implements MethodHandler {
     } else {
       // authentication and authorization
       try {
-        await authenticate(message.authorization!, this.didResolver);
+        await authenticate(message.authorization!, this.deps.didResolver);
 
-        await RecordsCountHandler.authorizeRecordsCount(tenant, recordsCount, this.messageStore);
+        await RecordsCountHandler.authorizeRecordsCount(tenant, recordsCount, this.deps.messageStore, this.deps.coreProtocols);
       } catch (e) {
         return messageReplyFromError(e, 401);
       }
@@ -67,7 +67,7 @@ export class RecordsCountHandler implements MethodHandler {
       isLatestBaseState : true
     };
 
-    return this.messageStore.count(tenant, [countFilter]);
+    return this.deps.messageStore.count(tenant, [countFilter]);
   }
 
   /**
@@ -95,7 +95,7 @@ export class RecordsCountHandler implements MethodHandler {
       }
     }
 
-    return this.messageStore.count(tenant, filters);
+    return this.deps.messageStore.count(tenant, filters);
   }
 
   /**
@@ -103,7 +103,7 @@ export class RecordsCountHandler implements MethodHandler {
    */
   private async countPublishedRecords(tenant: string, recordsCount: RecordsCount): Promise<number> {
     const filter = RecordsCountHandler.buildPublishedRecordsFilter(recordsCount);
-    return this.messageStore.count(tenant, [filter]);
+    return this.deps.messageStore.count(tenant, [filter]);
   }
 
   private static buildPublishedRecordsFilter(recordsCount: RecordsCount): Filter {
@@ -167,7 +167,8 @@ export class RecordsCountHandler implements MethodHandler {
   private static async authorizeRecordsCount(
     tenant: string,
     recordsCount: RecordsCount,
-    messageStore: MessageStore
+    messageStore: MessageStore,
+    coreProtocols?: CoreProtocolRegistry,
   ): Promise<void> {
 
     if (Message.isSignedByAuthorDelegate(recordsCount.message)) {
@@ -178,7 +179,7 @@ export class RecordsCountHandler implements MethodHandler {
     // this is because we dynamically filter out records that the caller is not authorized to see.
     // Currently only run protocol authorization if message deliberately invokes a protocol role.
     if (Records.shouldProtocolAuthorize(recordsCount.signaturePayload!)) {
-      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsCount, messageStore);
+      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsCount, messageStore, coreProtocols);
     }
   }
 }

package/src/handlers/records-delete.ts

@@ -1,9 +1,8 @@
-import type { DidResolver } from '@enbox/dids';
+import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { GenericMessageReply } from '../types/message-types.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
 import type { RecordsDeleteMessage } from '../types/records-types.js';
-import type { ResumableTaskManager } from '../core/resumable-task-manager.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 
 import { authenticate } from '../core/auth.js';
 import { DwnInterfaceName } from '../enums/dwn-interface-method.js';
@@ -16,15 +15,10 @@ import { RecordsDelete } from '../interfaces/records-delete.js';
 import { RecordsGrantAuthorization } from '../core/records-grant-authorization.js';
 import { RecordsWrite } from '../interfaces/records-write.js';
 import { ResumableTaskName } from '../core/resumable-task-manager.js';
-import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 
 export class RecordsDeleteHandler implements MethodHandler {
 
-  constructor(
-    private didResolver: DidResolver,
-    private messageStore: MessageStore,
-    private resumableTaskManager: ResumableTaskManager,
-  ) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -39,7 +33,7 @@ export class RecordsDeleteHandler implements MethodHandler {
 
     // authentication
     try {
-      await authenticate(message.authorization, this.didResolver);
+      await authenticate(message.authorization, this.deps.didResolver);
     } catch (e) {
       return messageReplyFromError(e, 401);
     }
@@ -49,7 +43,7 @@ export class RecordsDeleteHandler implements MethodHandler {
       interface : DwnInterfaceName.Records,
       recordId  : message.descriptor.recordId
     };
-    const { messages: existingMessages } = await this.messageStore.query(tenant, [ query ]);
+    const { messages: existingMessages } = await this.deps.messageStore.query(tenant, [ query ]);
 
     // find which message is the newest, and if the incoming message is the newest
     const newestExistingMessage = await Message.getNewestMessage(existingMessages);
@@ -73,19 +67,20 @@ export class RecordsDeleteHandler implements MethodHandler {
       // NOTE: We need a RecordsWrite (doesn't have to be initial) to access the immutable properties for delete processing,
       // but if the latest record state is a RecordsDelete (ie. when we are pruning a non-prune delete),
       // we'd need to use the initial write because RecordsDelete does not contain the immutable properties needed for processing.
-      const initialWrite = await RecordsWrite.fetchInitialRecordsWrite(this.messageStore, tenant, message.descriptor.recordId);
+      const initialWrite = await RecordsWrite.fetchInitialRecordsWrite(this.deps.messageStore, tenant, message.descriptor.recordId);
 
       await RecordsDeleteHandler.authorizeRecordsDelete(
         tenant,
         recordsDelete,
         initialWrite!,
-        this.messageStore
+        this.deps.messageStore,
+        this.deps.coreProtocols,
       );
     } catch (e) {
       return messageReplyFromError(e, 401);
     }
 
-    await this.resumableTaskManager.run({
+    await this.deps.resumableTaskManager!.run({
       name : ResumableTaskName.RecordsDelete,
       data : { tenant, message }
     });
@@ -105,7 +100,8 @@ export class RecordsDeleteHandler implements MethodHandler {
     tenant: string,
     recordsDelete: RecordsDelete,
     recordsWrite: RecordsWrite,
-    messageStore: MessageStore
+    messageStore: MessageStore,
+    coreProtocols?: CoreProtocolRegistry,
   ): Promise<void> {
 
     if (Message.isSignedByAuthorDelegate(recordsDelete.message)) {
@@ -124,13 +120,8 @@ export class RecordsDeleteHandler implements MethodHandler {
         permissionGrant,
         messageStore,
       });
-    } else if (recordsWrite.message.descriptor.protocol !== undefined) {
-      await ProtocolAuthorization.authorizeDelete(tenant, recordsDelete, recordsWrite, messageStore);
     } else {
-      throw new DwnError(
-        DwnErrorCode.RecordsDeleteAuthorizationFailed,
-        'RecordsDelete message failed authorization'
-      );
+      await ProtocolAuthorization.authorizeDelete(tenant, recordsDelete, recordsWrite, messageStore, coreProtocols);
     }
   }
 };

package/src/handlers/records-query.ts

@@ -1,9 +1,8 @@
-import type { DataStore } from '../types/data-store.js';
-import type { DidResolver } from '@enbox/dids';
+import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
 import type { Filter, PaginationCursor } from '../types/query-types.js';
 import type { GenericMessage, MessageSort } from '../types/message-types.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { RecordsQueryMessage, RecordsQueryReply, RecordsQueryReplyEntry } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -19,7 +18,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class RecordsQueryHandler implements MethodHandler {
 
-  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private dataStore: DataStore) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -42,9 +41,9 @@ export class RecordsQueryHandler implements MethodHandler {
     } else {
       // authentication and authorization
       try {
-        await authenticate(message.authorization!, this.didResolver);
+        await authenticate(message.authorization!, this.deps.didResolver);
 
-        await RecordsQueryHandler.authorizeRecordsQuery(tenant, recordsQuery, this.messageStore);
+        await RecordsQueryHandler.authorizeRecordsQuery(tenant, recordsQuery, this.deps.messageStore, this.deps.coreProtocols);
       } catch (e) {
         return messageReplyFromError(e, 401);
       }
@@ -63,7 +62,7 @@ export class RecordsQueryHandler implements MethodHandler {
     // attach initial write if returned RecordsWrite is not initial write
     for (const recordsWrite of recordsWrites) {
       if (!await RecordsWrite.isInitialWrite(recordsWrite)) {
-        const initialWriteQueryResult = await this.messageStore.query(
+        const initialWriteQueryResult = await this.deps.messageStore.query(
           tenant,
           [{ recordId: recordsWrite.recordId, isLatestBaseState: false, method: DwnMethodName.Write }]
         );
@@ -123,7 +122,7 @@ export class RecordsQueryHandler implements MethodHandler {
     };
 
     const messageSort = this.convertDateSort(dateSort);
-    return this.messageStore.query(tenant, [ queryFilter ], messageSort, pagination);
+    return this.deps.messageStore.query(tenant, [ queryFilter ], messageSort, pagination);
   }
 
   /**
@@ -169,7 +168,7 @@ export class RecordsQueryHandler implements MethodHandler {
     }
 
     const messageSort = this.convertDateSort(dateSort);
-    return this.messageStore.query(tenant, filters, messageSort, pagination );
+    return this.deps.messageStore.query(tenant, filters, messageSort, pagination );
   }
 
   /**
@@ -181,7 +180,7 @@ export class RecordsQueryHandler implements MethodHandler {
     const { dateSort, pagination } = recordsQuery.message.descriptor;
     const filter = RecordsQueryHandler.buildPublishedRecordsFilter(recordsQuery);
     const messageSort = this.convertDateSort(dateSort);
-    return this.messageStore.query(tenant, [ filter ], messageSort, pagination);
+    return this.deps.messageStore.query(tenant, [ filter ], messageSort, pagination);
   }
 
   private static buildPublishedRecordsFilter(recordsQuery: RecordsQuery): Filter {
@@ -249,7 +248,8 @@ export class RecordsQueryHandler implements MethodHandler {
   private static async authorizeRecordsQuery(
     tenant: string,
     recordsQuery: RecordsQuery,
-    messageStore: MessageStore
+    messageStore: MessageStore,
+    coreProtocols?: CoreProtocolRegistry,
   ): Promise<void> {
 
     if (Message.isSignedByAuthorDelegate(recordsQuery.message)) {
@@ -260,7 +260,7 @@ export class RecordsQueryHandler implements MethodHandler {
     // this is because we dynamically filter out records that the caller is not authorized to see.
     // Currently only run protocol authorization if message deliberately invokes a protocol role.
     if (Records.shouldProtocolAuthorize(recordsQuery.signaturePayload!)) {
-      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsQuery, messageStore);
+      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsQuery, messageStore, coreProtocols);
     }
   }
 }

package/src/handlers/records-read.ts

@@ -1,8 +1,7 @@
-import type { DataStore } from '../types/data-store.js';
-import type { DidResolver } from '@enbox/dids';
+import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { Filter } from '../types/query-types.js';
 import type { MessageStore } from '../types//message-store.js';
-import type { MethodHandler } from '../types/method-handler.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { RecordsDeleteMessage, RecordsQueryReplyEntry, RecordsReadMessage, RecordsReadReply } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
@@ -21,7 +20,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class RecordsReadHandler implements MethodHandler {
 
-  constructor(private didResolver: DidResolver, private messageStore: MessageStore, private dataStore: DataStore) { }
+  constructor(private deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -38,7 +37,7 @@ export class RecordsReadHandler implements MethodHandler {
     // authentication
     try {
       if (recordsRead.author !== undefined) {
-        await authenticate(message.authorization!, this.didResolver);
+        await authenticate(message.authorization!, this.deps.didResolver);
       }
     } catch (e) {
       return messageReplyFromError(e, 401);
@@ -52,7 +51,7 @@ export class RecordsReadHandler implements MethodHandler {
       ...Records.convertFilter(message.descriptor.filter)
     };
     const messageSort = Records.convertDateSort(message.descriptor.dateSort);
-    const { messages: existingMessages } = await this.messageStore.query(tenant, [ query ], messageSort, { limit: 1 });
+    const { messages: existingMessages } = await this.deps.messageStore.query(tenant, [ query ], messageSort, { limit: 1 });
     if (existingMessages.length === 0) {
       return {
         status: { code: 404, detail: 'Not Found' }
@@ -61,24 +60,35 @@ export class RecordsReadHandler implements MethodHandler {
 
     const matchedMessage = existingMessages[0];
 
-    // if the matched message is a RecordsDelete, we mark the record as not-found and return both the RecordsDelete and the initial RecordsWrite
-    // TODO: https://github.com/enboxorg/enbox/issues/222
-    // Consider performing authorization checks like when records exists before returning RecordsDelete and initial RecordsWrite of a deleted record
+    // If the matched message is a RecordsDelete, authorize against the newest RecordsWrite
+    // (for parity with the live-record path which authorizes against the latest write),
+    // then return 404 with both the RecordsDelete and the initial RecordsWrite.
     if (matchedMessage.descriptor.method === DwnMethodName.Delete) {
       const recordsDeleteMessage = matchedMessage as RecordsDeleteMessage;
-      const initialWrite = await RecordsWrite.fetchInitialRecordsWriteMessage(this.messageStore, tenant, recordsDeleteMessage.descriptor.recordId);
+      const recordId = recordsDeleteMessage.descriptor.recordId;
 
+      const initialWrite = await RecordsWrite.fetchInitialRecordsWriteMessage(this.deps.messageStore, tenant, recordId);
       if (initialWrite === undefined) {
         return messageReplyFromError(new DwnError(
           DwnErrorCode.RecordsReadInitialWriteNotFound,
-          'Initial write for deleted record not found'
+          'initial write for deleted record not found'
         ), 400);
       }
 
-      // Perform authorization before returning the delete and initial write messages
-      const parsedInitialWrite = await RecordsWrite.parse(initialWrite);
+      // Authorize against the newest RecordsWrite so that mutable properties like `published`
+      // reflect the record's state at the time of deletion, not just the initial write.
+      let newestWrite;
       try {
-        await RecordsReadHandler.authorizeRecordsRead(tenant, recordsRead, parsedInitialWrite, this.messageStore);
+        newestWrite = await RecordsWrite.fetchNewestRecordsWrite(this.deps.messageStore, tenant, recordId);
+      } catch {
+        // If newest write is not found (should not happen since initial write exists),
+        // fall back to the initial write for authorization.
+        newestWrite = initialWrite;
+      }
+      const parsedNewestWrite = await RecordsWrite.parse(newestWrite);
+
+      try {
+        await RecordsReadHandler.authorizeRecordsRead(tenant, recordsRead, parsedNewestWrite, this.deps.messageStore, this.deps.coreProtocols);
       } catch (error) {
         return messageReplyFromError(error, 401);
       }
@@ -87,7 +97,7 @@ export class RecordsReadHandler implements MethodHandler {
         status : { code: 404, detail: 'Not Found' },
         entry  : {
           recordsDelete: recordsDeleteMessage,
-          initialWrite
+          initialWrite,
         }
       };
     }
@@ -96,7 +106,10 @@ export class RecordsReadHandler implements MethodHandler {
     const matchedRecordsWrite = matchedMessage as RecordsQueryReplyEntry;
 
     try {
-      await RecordsReadHandler.authorizeRecordsRead(tenant, recordsRead, await RecordsWrite.parse(matchedRecordsWrite), this.messageStore);
+      const parsedWrite = await RecordsWrite.parse(matchedRecordsWrite);
+      await RecordsReadHandler.authorizeRecordsRead(
+        tenant, recordsRead, parsedWrite, this.deps.messageStore, this.deps.coreProtocols,
+      );
     } catch (error) {
       return messageReplyFromError(error, 401);
     }
@@ -107,7 +120,7 @@ export class RecordsReadHandler implements MethodHandler {
       data = DataStream.fromBytes(dataBytes);
       delete matchedRecordsWrite.encodedData;
     } else {
-      const result = await this.dataStore.get(tenant, matchedRecordsWrite.recordId, matchedRecordsWrite.descriptor.dataCid);
+      const result = await this.deps.dataStore!.get(tenant, matchedRecordsWrite.recordId, matchedRecordsWrite.descriptor.dataCid);
       if (result?.dataStream === undefined) {
         return {
           status: { code: 404, detail: 'Not Found' }
@@ -126,7 +139,7 @@ export class RecordsReadHandler implements MethodHandler {
 
     // attach initial write if latest RecordsWrite is not initial write
     if (!await RecordsWrite.isInitialWrite(matchedRecordsWrite)) {
-      const initialWriteQueryResult = await this.messageStore.query(
+      const initialWriteQueryResult = await this.deps.messageStore.query(
         tenant,
         [{ recordId: matchedRecordsWrite.recordId, isLatestBaseState: false, method: DwnMethodName.Write }]
       );
@@ -145,7 +158,8 @@ export class RecordsReadHandler implements MethodHandler {
     tenant: string,
     recordsRead: RecordsRead,
     matchedRecordsWrite: RecordsWrite,
-    messageStore: MessageStore
+    messageStore: MessageStore,
+    coreProtocols?: CoreProtocolRegistry,
   ): Promise<void> {
     if (Message.isSignedByAuthorDelegate(recordsRead.message)) {
       await recordsRead.authorizeDelegate(matchedRecordsWrite.message, messageStore);
@@ -174,10 +188,8 @@ export class RecordsReadHandler implements MethodHandler {
         permissionGrant,
         messageStore
       });
-    } else if (descriptor.protocol !== undefined) {
-      await ProtocolAuthorization.authorizeRead(tenant, recordsRead, matchedRecordsWrite, messageStore);
     } else {
-      throw new DwnError(DwnErrorCode.RecordsReadAuthorizationFailed, 'message failed authorization');
+      await ProtocolAuthorization.authorizeRead(tenant, recordsRead, matchedRecordsWrite, messageStore, coreProtocols);
     }
   }
 }