@enbox/dwn-sdk-js 0.4.2 → 0.4.3

package/dist/esm/src/core/grant-authorization.js

@@ -62,7 +62,8 @@ export class GrantAuthorization {
      * Verify that the `interface` and `method` grant scopes match the incoming message.
      *
      * For the Messages interface, a `Read` scope is treated as a unified scope that also authorizes
-     * `Query`, `Subscribe`, and `Sync` operations.
+     * `Query` and `Subscribe` operations. For Records, `Read` is likewise the canonical read-like
+     * scope and authorizes `Read`, `Query`, `Subscribe`, and `Count` operations.
      *
      * @throws {DwnError} if the `interface` and `method` of the incoming message do not match the scope of the permission grant.
      */
@@ -82,6 +83,18 @@ export class GrantAuthorization {
             }
             return;
         }
+        // Records.Read is the only valid read-like Records scope and covers Read, Query,
+        // Subscribe, and Count operations. Reject malformed Records Query/Subscribe/Count
+        // grants instead of treating them as compatible with the canonical Read scope.
+        if (dwnInterface === DwnInterfaceName.Records) {
+            const readLikeMethods = [DwnMethodName.Read, DwnMethodName.Query, DwnMethodName.Subscribe, DwnMethodName.Count];
+            if (readLikeMethods.includes(dwnMethod)) {
+                if (permissionGrant.scope.method !== DwnMethodName.Read) {
+                    throw new DwnError(DwnErrorCode.GrantAuthorizationMethodMismatch, `records read-like permission grant must have method 'Read', got '${permissionGrant.scope.method}' for grant ${permissionGrant.id}`);
+                }
+                return;
+            }
+        }
         if (dwnMethod !== permissionGrant.scope.method) {
             throw new DwnError(DwnErrorCode.GrantAuthorizationMethodMismatch, `DWN Method of incoming message is outside the scope of permission grant with ID ${permissionGrant.id}`);
         }

package/dist/esm/src/core/grant-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-authorization.js","sourceRoot":"","sources":["../../../../src/core/grant-authorization.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEnF,MAAM,OAAO,kBAAkB;IAE7B;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAMvC;QACD,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC;QAE5G,MAAM,yBAAyB,GAAG,eAAe,CAAC,UAAU,CAAC;QAE7D,kBAAkB,CAAC,+BAA+B,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;QAEtG,iEAAiE;QACjE,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,8EAA8E;QAClH,MAAM,kBAAkB,CAAC,iBAAiB,CACxC,UAAU,EACV,yBAAyB,CAAC,gBAAgB,EAC1C,eAAe,EACf,qBAAqB,CACtB,CAAC;QAEF,6CAA6C;QAC7C,MAAM,kBAAkB,CAAC,kCAAkC,CACzD,yBAAyB,CAAC,SAAS,EACnC,yBAAyB,CAAC,MAAM,EAChC,eAAe,CAChB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,+BAA+B,CAC5C,eAAuB,EACvB,eAAuB,EACvB,eAAgC;QAGhC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;QAC9C,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oCAAoC,EACjD,kCAAkC,aAAa,+BAA+B,eAAe,EAAE,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;QAC9C,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,qCAAqC,EAClD,kCAAkC,aAAa,+BAA+B,eAAe,EAAE,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACpC,UAAkB,EAClB,wBAAgC,EAChC,eAAgC,EAChC,qBAA4C;QAE5C,8DAA8D;QAC9D,IAAI,wBAAwB,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;YAC3D,0BAA0B;YAC1B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,mCAAmC,EAChD,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,wBAAwB,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC;YAC5D,oBAAoB;YACpB,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,8BAA8B,EAC3C,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,qBAAqB,CAAC,0BAA0B,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;QAEpH,IAAI,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,CAAC,UAAU,CAAC,gBAAgB,IAAI,wBAAwB,EAAE,CAAC;YACvH,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,8BAA8B,EAC3C,6BAA6B,eAAe,CAAC,EAAE,mBAAmB,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,KAAK,CAAC,kCAAkC,CACrD,YAAoB,EACpB,SAAiB,EACjB,eAAgC;QAGhC,IAAI,YAAY,KAAK,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,mCAAmC,EAChD,sFAAsF,eAAe,CAAC,EAAE,EAAE,CAC3G,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,kDAAkD;QAClD,IAAI,YAAY,KAAK,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gCAAgC,EAC7C,2DAA2D,eAAe,CAAC,KAAK,CAAC,MAAM,eAAe,eAAe,CAAC,EAAE,EAAE,CAC3H,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;YAC1F,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAA0B,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gCAAgC,EAC7C,mFAAmF,eAAe,CAAC,EAAE,EAAE,CACxG,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,SAAS,KAAK,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gCAAgC,EAC7C,mFAAmF,eAAe,CAAC,EAAE,EAAE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"grant-authorization.js","sourceRoot":"","sources":["../../../../src/core/grant-authorization.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEnF,MAAM,OAAO,kBAAkB;IAE7B;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAMvC;QACD,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC;QAE5G,MAAM,yBAAyB,GAAG,eAAe,CAAC,UAAU,CAAC;QAE7D,kBAAkB,CAAC,+BAA+B,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;QAEtG,iEAAiE;QACjE,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,8EAA8E;QAClH,MAAM,kBAAkB,CAAC,iBAAiB,CACxC,UAAU,EACV,yBAAyB,CAAC,gBAAgB,EAC1C,eAAe,EACf,qBAAqB,CACtB,CAAC;QAEF,6CAA6C;QAC7C,MAAM,kBAAkB,CAAC,kCAAkC,CACzD,yBAAyB,CAAC,SAAS,EACnC,yBAAyB,CAAC,MAAM,EAChC,eAAe,CAChB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,+BAA+B,CAC5C,eAAuB,EACvB,eAAuB,EACvB,eAAgC;QAGhC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;QAC9C,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oCAAoC,EACjD,kCAAkC,aAAa,+BAA+B,eAAe,EAAE,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;QAC9C,IAAI,eAAe,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,qCAAqC,EAClD,kCAAkC,aAAa,+BAA+B,eAAe,EAAE,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACpC,UAAkB,EAClB,wBAAgC,EAChC,eAAgC,EAChC,qBAA4C;QAE5C,8DAA8D;QAC9D,IAAI,wBAAwB,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;YAC3D,0BAA0B;YAC1B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,mCAAmC,EAChD,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,wBAAwB,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC;YAC5D,oBAAoB;YACpB,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,8BAA8B,EAC3C,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,qBAAqB,CAAC,0BAA0B,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;QAEpH,IAAI,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,CAAC,UAAU,CAAC,gBAAgB,IAAI,wBAAwB,EAAE,CAAC;YACvH,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,8BAA8B,EAC3C,6BAA6B,eAAe,CAAC,EAAE,mBAAmB,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,KAAK,CAAC,kCAAkC,CACrD,YAAoB,EACpB,SAAiB,EACjB,eAAgC;QAGhC,IAAI,YAAY,KAAK,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,mCAAmC,EAChD,sFAAsF,eAAe,CAAC,EAAE,EAAE,CAC3G,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,kDAAkD;QAClD,IAAI,YAAY,KAAK,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gCAAgC,EAC7C,2DAA2D,eAAe,CAAC,KAAK,CAAC,MAAM,eAAe,eAAe,CAAC,EAAE,EAAE,CAC3H,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;YAC1F,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAA0B,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gCAAgC,EAC7C,mFAAmF,eAAe,CAAC,EAAE,EAAE,CACxG,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,kFAAkF;QAClF,+EAA+E;QAC/E,IAAI,YAAY,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,eAAe,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;YAChH,IAAI,eAAe,CAAC,QAAQ,CAAC,SAA0B,CAAC,EAAE,CAAC;gBACzD,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;oBACxD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gCAAgC,EAC7C,oEAAoE,eAAe,CAAC,KAAK,CAAC,MAAM,eAAe,eAAe,CAAC,EAAE,EAAE,CACpI,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gCAAgC,EAC7C,mFAAmF,eAAe,CAAC,EAAE,EAAE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/esm/src/types/permission-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-types.js","sourceRoot":"","sources":["../../../../src/types/permission-types.ts"],"names":[],"mappings":"AAqHA,MAAM,CAAN,IAAY,8BAGX;AAHD,WAAY,8BAA8B;IACxC,uDAAqB,CAAA;IACrB,2DAAyB,CAAA;AAC3B,CAAC,EAHW,8BAA8B,KAA9B,8BAA8B,QAGzC"}
+{"version":3,"file":"permission-types.js","sourceRoot":"","sources":["../../../../src/types/permission-types.ts"],"names":[],"mappings":"AAwHA,MAAM,CAAN,IAAY,8BAGX;AAHD,WAAY,8BAA8B;IACxC,uDAAqB,CAAA;IACrB,2DAAyB,CAAA;AAC3B,CAAC,EAHW,8BAA8B,KAA9B,8BAA8B,QAGzC"}

package/dist/esm/tests/core/grant-authorization.spec.js

@@ -32,7 +32,59 @@ describe('GrantAuthorization', () => {
                 validationStateReader: validationStateReader,
             })).rejects.toThrow(DwnErrorCode.GrantAuthorizationMethodMismatch);
         });
-        it('should not treat Records Read grants as unified query grants', async () => {
+        it('allows Records Read grants to authorize read-like record methods', async () => {
+            const mockGrant = {
+                id: 'grant-records-read',
+                grantor: 'did:example:grantor',
+                grantee: 'did:example:grantee',
+                dateGranted: '2020-01-01T00:00:00.000Z',
+                dateExpires: '2040-01-01T00:00:00.000Z',
+                scope: { interface: 'Records', method: 'Read', protocol: 'https://proto.example' },
+            };
+            for (const method of ['Read', 'Query', 'Subscribe', 'Count']) {
+                const mockMessage = {
+                    descriptor: {
+                        interface: 'Records',
+                        method,
+                        messageTimestamp: '2025-01-01T00:00:00.000Z',
+                    },
+                };
+                await expect(GrantAuthorization.performBaseValidation({
+                    incomingMessage: mockMessage,
+                    expectedGrantor: 'did:example:grantor',
+                    expectedGrantee: 'did:example:grantee',
+                    permissionGrant: mockGrant,
+                    validationStateReader: validationStateReader,
+                })).resolves.toBeUndefined();
+            }
+        });
+        it('rejects Records Write grants for read-like record methods', async () => {
+            const mockGrant = {
+                id: 'grant-records-write',
+                grantor: 'did:example:grantor',
+                grantee: 'did:example:grantee',
+                dateGranted: '2020-01-01T00:00:00.000Z',
+                dateExpires: '2040-01-01T00:00:00.000Z',
+                scope: { interface: 'Records', method: 'Write', protocol: 'https://proto.example' },
+            };
+            for (const method of ['Read', 'Query', 'Subscribe', 'Count']) {
+                const mockMessage = {
+                    descriptor: {
+                        interface: 'Records',
+                        method,
+                        messageTimestamp: '2025-01-01T00:00:00.000Z',
+                    },
+                };
+                await expect(GrantAuthorization.performBaseValidation({
+                    incomingMessage: mockMessage,
+                    expectedGrantor: 'did:example:grantor',
+                    expectedGrantee: 'did:example:grantee',
+                    permissionGrant: mockGrant,
+                    validationStateReader: validationStateReader,
+                })).rejects.toThrow(DwnErrorCode.GrantAuthorizationMethodMismatch);
+            }
+        });
+        it('rejects grants scoped to a different DWN interface', async () => {
             const mockGrant = {
                 id: 'grant-records-read',
                 grantor: 'did:example:grantor',
@@ -43,8 +95,8 @@ describe('GrantAuthorization', () => {
             };
             const mockMessage = {
                 descriptor: {
-                    interface: 'Records',
-                    method: 'Query',
+                    interface: 'Messages',
+                    method: 'Read',
                     messageTimestamp: '2025-01-01T00:00:00.000Z',
                 },
             };
@@ -54,7 +106,33 @@ describe('GrantAuthorization', () => {
                 expectedGrantee: 'did:example:grantee',
                 permissionGrant: mockGrant,
                 validationStateReader: validationStateReader,
-            })).rejects.toThrow(DwnErrorCode.GrantAuthorizationMethodMismatch);
+            })).rejects.toThrow(DwnErrorCode.GrantAuthorizationInterfaceMismatch);
+        });
+        it('rejects read-like Records grants that do not use method Read', async () => {
+            for (const method of ['Query', 'Subscribe', 'Count']) {
+                const mockGrant = {
+                    id: `grant-records-${method.toLowerCase()}`,
+                    grantor: 'did:example:grantor',
+                    grantee: 'did:example:grantee',
+                    dateGranted: '2020-01-01T00:00:00.000Z',
+                    dateExpires: '2040-01-01T00:00:00.000Z',
+                    scope: { interface: 'Records', method, protocol: 'https://proto.example' },
+                };
+                const mockMessage = {
+                    descriptor: {
+                        interface: 'Records',
+                        method,
+                        messageTimestamp: '2025-01-01T00:00:00.000Z',
+                    },
+                };
+                await expect(GrantAuthorization.performBaseValidation({
+                    incomingMessage: mockMessage,
+                    expectedGrantor: 'did:example:grantor',
+                    expectedGrantee: 'did:example:grantee',
+                    permissionGrant: mockGrant,
+                    validationStateReader: validationStateReader,
+                })).rejects.toThrow(DwnErrorCode.GrantAuthorizationMethodMismatch);
+            }
         });
     });
 });

package/dist/esm/tests/core/grant-authorization.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-authorization.spec.js","sourceRoot":"","sources":["../../../../tests/core/grant-authorization.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,MAAM,qBAAqB,GAAG;YAC5B,0BAA0B,EAAE,KAAK,IAAkB,EAAE,CAAC,SAAS;SAChE,CAAC;QAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,SAAS,GAAG;gBAChB,EAAE,EAAY,iBAAiB;gBAC/B,OAAO,EAAO,qBAAqB;gBACnC,OAAO,EAAO,qBAAqB;gBACnC,WAAW,EAAG,0BAA0B;gBACxC,WAAW,EAAG,0BAA0B;gBACxC,KAAK,EAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC3F,CAAC;YAEF,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE;oBACV,SAAS,EAAU,UAAU;oBAC7B,MAAM,EAAa,MAAM;oBACzB,gBAAgB,EAAG,0BAA0B;iBAC9C;aACF,CAAC;YAEF,MAAM,MAAM,CACV,kBAAkB,CAAC,qBAAqB,CAAC;gBACvC,eAAe,EAAS,WAAkB;gBAC1C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,SAAgB;gBACxC,qBAAqB,EAAG,qBAA4B;aACrD,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,SAAS,GAAG;gBAChB,EAAE,EAAY,oBAAoB;gBAClC,OAAO,EAAO,qBAAqB;gBACnC,OAAO,EAAO,qBAAqB;gBACnC,WAAW,EAAG,0BAA0B;gBACxC,WAAW,EAAG,0BAA0B;gBACxC,KAAK,EAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC1F,CAAC;YAEF,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE;oBACV,SAAS,EAAU,SAAS;oBAC5B,MAAM,EAAa,OAAO;oBAC1B,gBAAgB,EAAG,0BAA0B;iBAC9C;aACF,CAAC;YAEF,MAAM,MAAM,CACV,kBAAkB,CAAC,qBAAqB,CAAC;gBACvC,eAAe,EAAS,WAAkB;gBAC1C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,SAAgB;gBACxC,qBAAqB,EAAG,qBAA4B;aACrD,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"grant-authorization.spec.js","sourceRoot":"","sources":["../../../../tests/core/grant-authorization.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,MAAM,qBAAqB,GAAG;YAC5B,0BAA0B,EAAE,KAAK,IAAkB,EAAE,CAAC,SAAS;SAChE,CAAC;QAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,SAAS,GAAG;gBAChB,EAAE,EAAY,iBAAiB;gBAC/B,OAAO,EAAO,qBAAqB;gBACnC,OAAO,EAAO,qBAAqB;gBACnC,WAAW,EAAG,0BAA0B;gBACxC,WAAW,EAAG,0BAA0B;gBACxC,KAAK,EAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC3F,CAAC;YAEF,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE;oBACV,SAAS,EAAU,UAAU;oBAC7B,MAAM,EAAa,MAAM;oBACzB,gBAAgB,EAAG,0BAA0B;iBAC9C;aACF,CAAC;YAEF,MAAM,MAAM,CACV,kBAAkB,CAAC,qBAAqB,CAAC;gBACvC,eAAe,EAAS,WAAkB;gBAC1C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,SAAgB;gBACxC,qBAAqB,EAAG,qBAA4B;aACrD,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,SAAS,GAAG;gBAChB,EAAE,EAAY,oBAAoB;gBAClC,OAAO,EAAO,qBAAqB;gBACnC,OAAO,EAAO,qBAAqB;gBACnC,WAAW,EAAG,0BAA0B;gBACxC,WAAW,EAAG,0BAA0B;gBACxC,KAAK,EAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC1F,CAAC;YAEF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC7D,MAAM,WAAW,GAAG;oBAClB,UAAU,EAAE;wBACV,SAAS,EAAU,SAAS;wBAC5B,MAAM;wBACN,gBAAgB,EAAG,0BAA0B;qBAC9C;iBACF,CAAC;gBAEF,MAAM,MAAM,CACV,kBAAkB,CAAC,qBAAqB,CAAC;oBACvC,eAAe,EAAS,WAAkB;oBAC1C,eAAe,EAAS,qBAAqB;oBAC7C,eAAe,EAAS,qBAAqB;oBAC7C,eAAe,EAAS,SAAgB;oBACxC,qBAAqB,EAAG,qBAA4B;iBACrD,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,SAAS,GAAG;gBAChB,EAAE,EAAY,qBAAqB;gBACnC,OAAO,EAAO,qBAAqB;gBACnC,OAAO,EAAO,qBAAqB;gBACnC,WAAW,EAAG,0BAA0B;gBACxC,WAAW,EAAG,0BAA0B;gBACxC,KAAK,EAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC3F,CAAC;YAEF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC7D,MAAM,WAAW,GAAG;oBAClB,UAAU,EAAE;wBACV,SAAS,EAAU,SAAS;wBAC5B,MAAM;wBACN,gBAAgB,EAAG,0BAA0B;qBAC9C;iBACF,CAAC;gBAEF,MAAM,MAAM,CACV,kBAAkB,CAAC,qBAAqB,CAAC;oBACvC,eAAe,EAAS,WAAkB;oBAC1C,eAAe,EAAS,qBAAqB;oBAC7C,eAAe,EAAS,qBAAqB;oBAC7C,eAAe,EAAS,SAAgB;oBACxC,qBAAqB,EAAG,qBAA4B;iBACrD,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,SAAS,GAAG;gBAChB,EAAE,EAAY,oBAAoB;gBAClC,OAAO,EAAO,qBAAqB;gBACnC,OAAO,EAAO,qBAAqB;gBACnC,WAAW,EAAG,0BAA0B;gBACxC,WAAW,EAAG,0BAA0B;gBACxC,KAAK,EAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC1F,CAAC;YAEF,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE;oBACV,SAAS,EAAU,UAAU;oBAC7B,MAAM,EAAa,MAAM;oBACzB,gBAAgB,EAAG,0BAA0B;iBAC9C;aACF,CAAC;YAEF,MAAM,MAAM,CACV,kBAAkB,CAAC,qBAAqB,CAAC;gBACvC,eAAe,EAAS,WAAkB;gBAC1C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,qBAAqB;gBAC7C,eAAe,EAAS,SAAgB;gBACxC,qBAAqB,EAAG,qBAA4B;aACrD,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,mCAAmC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG;oBAChB,EAAE,EAAY,iBAAiB,MAAM,CAAC,WAAW,EAAE,EAAE;oBACrD,OAAO,EAAO,qBAAqB;oBACnC,OAAO,EAAO,qBAAqB;oBACnC,WAAW,EAAG,0BAA0B;oBACxC,WAAW,EAAG,0BAA0B;oBACxC,KAAK,EAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;iBAClF,CAAC;gBAEF,MAAM,WAAW,GAAG;oBAClB,UAAU,EAAE;wBACV,SAAS,EAAU,SAAS;wBAC5B,MAAM;wBACN,gBAAgB,EAAG,0BAA0B;qBAC9C;iBACF,CAAC;gBAEF,MAAM,MAAM,CACV,kBAAkB,CAAC,qBAAqB,CAAC;oBACvC,eAAe,EAAS,WAAkB;oBAC1C,eAAe,EAAS,qBAAqB;oBAC7C,eAAe,EAAS,qBAAqB;oBAC7C,eAAe,EAAS,SAAgB;oBACxC,qBAAqB,EAAG,qBAA4B;iBACrD,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/tests/core/records-grant-authorization.spec.js

@@ -57,7 +57,7 @@ describe('RecordsGrantAuthorization', () => {
             incomingMessage: makeIncomingMessage(method, filter),
             expectedGrantor: grantor,
             expectedGrantee: grantee,
-            permissionGrant: makePermissionGrant(method, grantScope),
+            permissionGrant: makePermissionGrant(DwnMethodName.Read, grantScope),
             validationStateReader,
         })).rejects.toThrow(DwnErrorCode.RecordsGrantAuthorizationQueryOrSubscribeProtocolScopeMismatch);
     }
@@ -90,7 +90,7 @@ describe('RecordsGrantAuthorization', () => {
                 }),
                 expectedGrantor: grantor,
                 expectedGrantee: grantee,
-                permissionGrant: makePermissionGrant(DwnMethodName.Query, {
+                permissionGrant: makePermissionGrant(DwnMethodName.Read, {
                     protocol,
                     protocolPath: 'thread/message',
                 }),
@@ -101,17 +101,34 @@ describe('RecordsGrantAuthorization', () => {
             await expectQueryOrSubscribeScopeMismatch(DwnMethodName.Query, { protocol, protocolPath: 'thread/message' }, { protocol, protocolPath: 'thread/reaction' });
             await expectQueryOrSubscribeScopeMismatch(DwnMethodName.Subscribe, { protocol, contextId: 'root' }, { protocol, contextId: 'rootEVIL' });
         });
-        it('allows protocol-scoped query and count filters', async () => {
-            for (const method of [DwnMethodName.Query, DwnMethodName.Count]) {
+        it('allows protocol-scoped query, subscribe, and count filters with a Records.Read grant', async () => {
+            for (const method of [DwnMethodName.Query, DwnMethodName.Subscribe, DwnMethodName.Count]) {
                 await expect(RecordsGrantAuthorization.authorizeQueryOrSubscribe({
                     incomingMessage: makeIncomingMessage(method, { protocol }),
                     expectedGrantor: grantor,
                     expectedGrantee: grantee,
-                    permissionGrant: makePermissionGrant(method, { protocol }),
+                    permissionGrant: makePermissionGrant(DwnMethodName.Read, { protocol }),
                     validationStateReader,
                 })).resolves.toBeUndefined();
             }
         });
+        it('rejects read-like Records grants that do not use method Read', async () => {
+            const cases = [
+                [DwnMethodName.Query, DwnMethodName.Query],
+                [DwnMethodName.Subscribe, DwnMethodName.Subscribe],
+                [DwnMethodName.Count, DwnMethodName.Count],
+                [DwnMethodName.Write, DwnMethodName.Query],
+            ];
+            for (const [grantMethod, incomingMethod] of cases) {
+                await expect(RecordsGrantAuthorization.authorizeQueryOrSubscribe({
+                    incomingMessage: makeIncomingMessage(incomingMethod, { protocol }),
+                    expectedGrantor: grantor,
+                    expectedGrantee: grantee,
+                    permissionGrant: makePermissionGrant(grantMethod, { protocol }),
+                    validationStateReader,
+                })).rejects.toThrow(DwnErrorCode.GrantAuthorizationMethodMismatch);
+            }
+        });
     });
 });
 //# sourceMappingURL=records-grant-authorization.spec.js.map

package/dist/esm/tests/core/records-grant-authorization.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"records-grant-authorization.spec.js","sourceRoot":"","sources":["../../../../tests/core/records-grant-authorization.spec.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAE1F,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC;IACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC;IAClC,MAAM,QAAQ,GAAG,8BAA8B,CAAC;IAChD,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAChD,MAAM,qBAAqB,GAAG;QAC5B,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;KACd,CAAC;IAEtC,SAAS,gBAAgB,CAAC,SAAiB;QACzC,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAK,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,SAAS;YACzE,SAAS;YACT,UAAU,EAAG;gBACX,SAAS,EAAU,gBAAgB,CAAC,OAAO;gBAC3C,MAAM,EAAa,aAAa,CAAC,KAAK;gBACtC,QAAQ,EAAW,8BAA8B;gBACjD,YAAY,EAAO,gBAAgB;gBACnC,UAAU,EAAS,kBAAkB;gBACrC,OAAO,EAAY,mBAAmB;gBACtC,QAAQ,EAAW,CAAC;gBACpB,WAAW,EAAQ,6BAA6B;gBAChD,gBAAgB,EAAG,6BAA6B;aACjD;SACqB,CAAC;IAC3B,CAAC;IAED,SAAS,mBAAmB,CAC1B,MAAwC,EACxC,KAAqH;QAErH,OAAO;YACL,EAAE,EAAY,iBAAiB;YAC/B,OAAO;YACP,OAAO;YACP,WAAW,EAAG,6BAA6B;YAC3C,WAAW,EAAG,6BAA6B;YAC3C,KAAK,EAAS;gBACZ,SAAS,EAAE,gBAAgB,CAAC,OAAO;gBACnC,MAAM;gBACN,GAAG,KAAK;aACT;SACiB,CAAC;IACvB,CAAC;IAED,SAAS,mBAAmB,CAC1B,MAA2E,EAC3E,MAAqB;QAErB,OAAO;YACL,UAAU,EAAE;gBACV,SAAS,EAAU,gBAAgB,CAAC,OAAO;gBAC3C,MAAM;gBACN,gBAAgB,EAAG,SAAS;gBAC5B,MAAM;aACP;SACqE,CAAC;IAC3E,CAAC;IAED,KAAK,UAAU,mCAAmC,CAChD,MAA2E,EAC3E,UAA0H,EAC1H,MAAqB;QAErB,MAAM,MAAM,CAAC,yBAAyB,CAAC,yBAAyB,CAAC;YAC/D,eAAe,EAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC;YACrD,eAAe,EAAG,OAAO;YACzB,eAAe,EAAG,OAAO;YACzB,eAAe,EAAG,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC;YACzD,qBAAqB;SACtB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,8DAA8D,CAAC,CAAC;IACnG,CAAC;IAED,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAA2B;YACpC,SAAS,EAAG,gBAAgB,CAAC,OAAO;YACpC,MAAM,EAAM,aAAa,CAAC,IAAI;YAC9B,QAAQ,EAAI,8BAA8B;YAC1C,SAAS,EAAG,MAAM;SACnB,CAAC;QAEF,MAAM,CAAC,GAAG,EAAE;YACT,yBAAiC,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,EAAE;YACT,yBAAiC,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,EAAE;YACT,yBAAiC,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAC3C,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,mCAAmC,CACvC,aAAa,CAAC,KAAK,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAC5C,EAAE,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,CAAC,yBAAyB,CAAC,yBAAyB,CAAC;gBAC/D,eAAe,EAAE,mBAAmB,CAAC,aAAa,CAAC,KAAK,EAAE;oBACxD,QAAQ;oBACR,YAAY,EAAE,gBAAgB;iBAC/B,CAAC;gBACF,eAAe,EAAG,OAAO;gBACzB,eAAe,EAAG,OAAO;gBACzB,eAAe,EAAG,mBAAmB,CAAC,aAAa,CAAC,KAAK,EAAE;oBACzD,QAAQ;oBACR,YAAY,EAAE,gBAAgB;iBAC/B,CAAC;gBACF,qBAAqB;aACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,mCAAmC,CACvC,aAAa,CAAC,KAAK,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAC5C,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAC9C,CAAC;YAEF,MAAM,mCAAmC,CACvC,aAAa,CAAC,SAAS,EACvB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAC/B,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,KAAK,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAU,EAAE,CAAC;gBACzE,MAAM,MAAM,CAAC,yBAAyB,CAAC,yBAAyB,CAAC;oBAC/D,eAAe,EAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;oBAC3D,eAAe,EAAG,OAAO;oBACzB,eAAe,EAAG,OAAO;oBACzB,eAAe,EAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;oBAC3D,qBAAqB;iBACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"records-grant-authorization.spec.js","sourceRoot":"","sources":["../../../../tests/core/records-grant-authorization.spec.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAE1F,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC;IACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC;IAClC,MAAM,QAAQ,GAAG,8BAA8B,CAAC;IAChD,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAChD,MAAM,qBAAqB,GAAG;QAC5B,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;KACd,CAAC;IAEtC,SAAS,gBAAgB,CAAC,SAAiB;QACzC,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAK,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,SAAS;YACzE,SAAS;YACT,UAAU,EAAG;gBACX,SAAS,EAAU,gBAAgB,CAAC,OAAO;gBAC3C,MAAM,EAAa,aAAa,CAAC,KAAK;gBACtC,QAAQ,EAAW,8BAA8B;gBACjD,YAAY,EAAO,gBAAgB;gBACnC,UAAU,EAAS,kBAAkB;gBACrC,OAAO,EAAY,mBAAmB;gBACtC,QAAQ,EAAW,CAAC;gBACpB,WAAW,EAAQ,6BAA6B;gBAChD,gBAAgB,EAAG,6BAA6B;aACjD;SACqB,CAAC;IAC3B,CAAC;IAED,SAAS,mBAAmB,CAC1B,MAAqB,EACrB,KAAqH;QAErH,OAAO;YACL,EAAE,EAAY,iBAAiB;YAC/B,OAAO;YACP,OAAO;YACP,WAAW,EAAG,6BAA6B;YAC3C,WAAW,EAAG,6BAA6B;YAC3C,KAAK,EAAS;gBACZ,SAAS,EAAE,gBAAgB,CAAC,OAAO;gBACnC,MAAM;gBACN,GAAG,KAAK;aACT;SACiB,CAAC;IACvB,CAAC;IAED,SAAS,mBAAmB,CAC1B,MAA2E,EAC3E,MAAqB;QAErB,OAAO;YACL,UAAU,EAAE;gBACV,SAAS,EAAU,gBAAgB,CAAC,OAAO;gBAC3C,MAAM;gBACN,gBAAgB,EAAG,SAAS;gBAC5B,MAAM;aACP;SACqE,CAAC;IAC3E,CAAC;IAED,KAAK,UAAU,mCAAmC,CAChD,MAA2E,EAC3E,UAA0H,EAC1H,MAAqB;QAErB,MAAM,MAAM,CAAC,yBAAyB,CAAC,yBAAyB,CAAC;YAC/D,eAAe,EAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC;YACrD,eAAe,EAAG,OAAO;YACzB,eAAe,EAAG,OAAO;YACzB,eAAe,EAAG,mBAAmB,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;YACrE,qBAAqB;SACtB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,8DAA8D,CAAC,CAAC;IACnG,CAAC;IAED,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAA2B;YACpC,SAAS,EAAG,gBAAgB,CAAC,OAAO;YACpC,MAAM,EAAM,aAAa,CAAC,IAAI;YAC9B,QAAQ,EAAI,8BAA8B;YAC1C,SAAS,EAAG,MAAM;SACnB,CAAC;QAEF,MAAM,CAAC,GAAG,EAAE;YACT,yBAAiC,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,EAAE;YACT,yBAAiC,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,EAAE;YACT,yBAAiC,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAC3C,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,mCAAmC,CACvC,aAAa,CAAC,KAAK,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAC5C,EAAE,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,CAAC,yBAAyB,CAAC,yBAAyB,CAAC;gBAC/D,eAAe,EAAE,mBAAmB,CAAC,aAAa,CAAC,KAAK,EAAE;oBACxD,QAAQ;oBACR,YAAY,EAAE,gBAAgB;iBAC/B,CAAC;gBACF,eAAe,EAAG,OAAO;gBACzB,eAAe,EAAG,OAAO;gBACzB,eAAe,EAAG,mBAAmB,CAAC,aAAa,CAAC,IAAI,EAAE;oBACxD,QAAQ;oBACR,YAAY,EAAE,gBAAgB;iBAC/B,CAAC;gBACF,qBAAqB;aACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,mCAAmC,CACvC,aAAa,CAAC,KAAK,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAC5C,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAC9C,CAAC;YAEF,MAAM,mCAAmC,CACvC,aAAa,CAAC,SAAS,EACvB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAC/B,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;YACpG,KAAK,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAU,EAAE,CAAC;gBAClG,MAAM,MAAM,CAAC,yBAAyB,CAAC,yBAAyB,CAAC;oBAC/D,eAAe,EAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;oBAC3D,eAAe,EAAG,OAAO;oBACzB,eAAe,EAAG,OAAO;oBACzB,eAAe,EAAG,mBAAmB,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;oBACvE,qBAAqB;iBACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,KAAK,GAAG;gBACZ,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC1C,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;gBAClD,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC1C,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;aAClC,CAAC;YAEX,KAAK,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,KAAK,EAAE,CAAC;gBAClD,MAAM,MAAM,CAAC,yBAAyB,CAAC,yBAAyB,CAAC;oBAC/D,eAAe,EAAG,mBAAmB,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC;oBACnE,eAAe,EAAG,OAAO;oBACzB,eAAe,EAAG,OAAO;oBACzB,eAAe,EAAG,mBAAmB,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;oBAChE,qBAAqB;iBACtB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/tests/features/author-delegated-grant.spec.js

@@ -356,14 +356,14 @@ export function testAuthorDelegatedGrant() {
             });
             const chatRecordReply = await dwn.processMessage(bob.did, chatRecord.message, { dataStream: chatRecord.dataStream });
             expect(chatRecordReply.status.code).toBe(202);
-            // Alice creates a delegated query grant for device X to act as Alice.
+            // Alice creates a delegated read grant for device X to perform read-like operations as Alice.
             const queryGrantForDeviceX = await PermissionsProtocol.createGrant({
                 delegated: true, // this is a delegated grant
                 dateExpires: Time.createOffsetTimestamp({ seconds: 100 }),
                 grantedTo: deviceX.did,
                 scope: {
                     interface: DwnInterfaceName.Records,
-                    method: DwnMethodName.Query,
+                    method: DwnMethodName.Read,
                     protocol
                 },
                 signer: Jws.createSigner(alice)
@@ -454,6 +454,130 @@ export function testAuthorDelegatedGrant() {
             expect(recordsReadByCarolReply.status.code).toBe(400);
             expect(recordsQueryByCarolReply.status.detail).toContain(DwnErrorCode.RecordsAuthorDelegatedGrantGrantedToAndOwnerSignatureMismatch);
         });
+        it('should scope author-delegated read-like grants to the matching context subtree', async () => {
+            const alice = await TestDataGenerator.generateDidKeyPersona();
+            const deviceX = await TestDataGenerator.generateDidKeyPersona();
+            const bob = await TestDataGenerator.generateDidKeyPersona();
+            const protocolDefinition = threadRoleProtocolDefinition;
+            const protocol = threadRoleProtocolDefinition.protocol;
+            const protocolsConfig = await TestDataGenerator.generateProtocolsConfigure({
+                author: bob,
+                protocolDefinition
+            });
+            const protocolsConfigureReply = await dwn.processMessage(bob.did, protocolsConfig.message);
+            expect(protocolsConfigureReply.status.code).toBe(202);
+            const threadRecord = await TestDataGenerator.generateRecordsWrite({
+                author: bob,
+                protocol: protocolDefinition.protocol,
+                protocolPath: 'thread',
+            });
+            const threadRoleReply = await dwn.processMessage(bob.did, threadRecord.message, { dataStream: threadRecord.dataStream });
+            expect(threadRoleReply.status.code).toBe(202);
+            const participantRoleRecord = await TestDataGenerator.generateRecordsWrite({
+                author: bob,
+                recipient: alice.did,
+                protocol: protocolDefinition.protocol,
+                protocolPath: 'thread/participant',
+                parentContextId: threadRecord.message.contextId,
+                data: new TextEncoder().encode('Alice is my friend'),
+            });
+            const participantRoleReply = await dwn.processMessage(bob.did, participantRoleRecord.message, { dataStream: participantRoleRecord.dataStream });
+            expect(participantRoleReply.status.code).toBe(202);
+            const chatRecord = await TestDataGenerator.generateRecordsWrite({
+                author: bob,
+                protocol: protocolDefinition.protocol,
+                protocolPath: 'thread/chat',
+                parentContextId: threadRecord.message.contextId,
+            });
+            const chatRecordReply = await dwn.processMessage(bob.did, chatRecord.message, { dataStream: chatRecord.dataStream });
+            expect(chatRecordReply.status.code).toBe(202);
+            const contextScopedReadGrant = await PermissionsProtocol.createGrant({
+                delegated: true,
+                dateExpires: Time.createOffsetTimestamp({ seconds: 100 }),
+                grantedTo: deviceX.did,
+                scope: {
+                    interface: DwnInterfaceName.Records,
+                    method: DwnMethodName.Read,
+                    protocol,
+                    contextId: threadRecord.message.contextId,
+                },
+                signer: Jws.createSigner(alice)
+            });
+            const matchingQuery = await RecordsQuery.create({
+                signer: Jws.createSigner(deviceX),
+                delegatedGrant: contextScopedReadGrant.dataEncodedMessage,
+                protocolRole: 'thread/participant',
+                filter: {
+                    protocol,
+                    contextId: threadRecord.message.contextId,
+                    protocolPath: 'thread/chat'
+                }
+            });
+            const matchingQueryReply = await dwn.processMessage(bob.did, matchingQuery.message);
+            expect(matchingQueryReply.status.code).toBe(200);
+            expect(matchingQueryReply.entries?.map(entry => entry.recordId)).toEqual([chatRecord.message.recordId]);
+            const mismatchingContextId = `${threadRecord.message.contextId}EVIL`;
+            const mismatchingQuery = await RecordsQuery.create({
+                signer: Jws.createSigner(deviceX),
+                delegatedGrant: contextScopedReadGrant.dataEncodedMessage,
+                protocolRole: 'thread/participant',
+                filter: {
+                    protocol,
+                    contextId: mismatchingContextId,
+                    protocolPath: 'thread/chat'
+                }
+            });
+            const mismatchingQueryReply = await dwn.processMessage(bob.did, mismatchingQuery.message);
+            expect(mismatchingQueryReply.status.code).toBe(401);
+            expect(mismatchingQueryReply.status.detail).toContain(DwnErrorCode.RecordsGrantAuthorizationQueryOrSubscribeProtocolScopeMismatch);
+            const mismatchingSubscribe = await RecordsSubscribe.create({
+                signer: Jws.createSigner(deviceX),
+                delegatedGrant: contextScopedReadGrant.dataEncodedMessage,
+                protocolRole: 'thread/participant',
+                filter: {
+                    protocol,
+                    contextId: mismatchingContextId,
+                    protocolPath: 'thread/chat'
+                }
+            });
+            const mismatchingSubscribeReply = await dwn.processMessage(bob.did, mismatchingSubscribe.message);
+            expect(mismatchingSubscribeReply.status.code).toBe(401);
+            expect(mismatchingSubscribeReply.status.detail).toContain(DwnErrorCode.RecordsGrantAuthorizationQueryOrSubscribeProtocolScopeMismatch);
+            const subscriptionChatRecords = new Set();
+            const captureChatRecords = async (msg) => {
+                if (msg.type !== 'event') {
+                    return;
+                }
+                const recordId = msg.event.message.recordId;
+                subscriptionChatRecords.add(recordId);
+            };
+            const matchingSubscribe = await RecordsSubscribe.create({
+                signer: Jws.createSigner(deviceX),
+                delegatedGrant: contextScopedReadGrant.dataEncodedMessage,
+                protocolRole: 'thread/participant',
+                filter: {
+                    protocol,
+                    contextId: threadRecord.message.contextId,
+                    protocolPath: 'thread/chat'
+                }
+            });
+            const matchingSubscribeReply = await dwn.processMessage(bob.did, matchingSubscribe.message, {
+                subscriptionHandler: captureChatRecords
+            });
+            expect(matchingSubscribeReply.status.code).toBe(200);
+            const subscribedChatRecord = await TestDataGenerator.generateRecordsWrite({
+                author: bob,
+                protocol: protocolDefinition.protocol,
+                protocolPath: 'thread/chat',
+                parentContextId: threadRecord.message.contextId,
+            });
+            const subscribedChatRecordReply = await dwn.processMessage(bob.did, subscribedChatRecord.message, { dataStream: subscribedChatRecord.dataStream });
+            expect(subscribedChatRecordReply.status.code).toBe(202);
+            await Poller.pollUntilSuccessOrTimeout(async () => {
+                expect(subscriptionChatRecords.has(subscribedChatRecord.message.recordId)).toBe(true);
+            });
+            await matchingSubscribeReply.subscription?.close();
+        });
         it('should only allow correct entity invoking an author-delegated grant to subscribe', async () => {
             // scenario:
             // 1. Bob installs a chat protocol and creates a thread, adding Alice as a participant.
@@ -496,14 +620,14 @@ export function testAuthorDelegatedGrant() {
             });
             const participantRoleReply = await dwn.processMessage(bob.did, participantRoleRecord.message, { dataStream: participantRoleRecord.dataStream });
             expect(participantRoleReply.status.code).toBe(202);
-            // Alice creates a delegated subscribe grant for device X to act as Alice.
+            // Alice creates a delegated read grant for device X to subscribe as Alice.
             const subscribeGrantForDeviceX = await PermissionsProtocol.createGrant({
                 delegated: true, // this is a delegated grant
                 dateExpires: Time.createOffsetTimestamp({ seconds: 100 }),
                 grantedTo: deviceX.did,
                 scope: {
                     interface: DwnInterfaceName.Records,
-                    method: DwnMethodName.Subscribe,
+                    method: DwnMethodName.Read,
                     protocol
                 },
                 signer: Jws.createSigner(alice)
@@ -803,7 +927,7 @@ export function testAuthorDelegatedGrant() {
         it('should not allow entity using a non-delegated grant as an author-delegated grant to invoke query', async () => {
             // scenario:
             // 1. Bob has the message protocol installed
-            // 2. Alice creates a non-delegated query grant for device X
+            // 2. Alice creates a non-delegated read grant for device X
             // 3. Verify that device X cannot query Bob's DWN as Alice using the non-delegated grant
             const alice = await TestDataGenerator.generateDidKeyPersona();
             const bob = await TestDataGenerator.generateDidKeyPersona();
@@ -824,7 +948,7 @@ export function testAuthorDelegatedGrant() {
                 grantedTo: deviceX.did,
                 scope: {
                     interface: DwnInterfaceName.Records,
-                    method: DwnMethodName.Query,
+                    method: DwnMethodName.Read,
                     protocol
                 },
                 signer: Jws.createSigner(alice)
@@ -995,14 +1119,14 @@ export function testAuthorDelegatedGrant() {
             const chatRecordReply = await dwn.processMessage(bob.did, chatRecord.message, { dataStream: chatRecord.dataStream });
             expect(chatRecordReply.status.code).toBe(202);
             // 2. Alice creates a delegated grant for device X to act as her for a protocol that is NOT chat protocol
-            // Alice creates a delegated query grant for device X to act as Alice but not for chat protocol
+            // Alice creates a delegated read grant for device X to query as Alice but not for chat protocol
             const queryGrantForDeviceX = await PermissionsProtocol.createGrant({
                 delegated: true, // this is a delegated grant
                 dateExpires: Time.createOffsetTimestamp({ seconds: 100 }),
                 grantedTo: deviceX.did,
                 scope: {
                     interface: DwnInterfaceName.Records,
-                    method: DwnMethodName.Query,
+                    method: DwnMethodName.Read,
                     protocol: 'some-other-protocol'
                 },
                 signer: Jws.createSigner(alice)
@@ -1019,14 +1143,14 @@ export function testAuthorDelegatedGrant() {
                 },
                 signer: Jws.createSigner(alice)
             });
-            // Alice creates a delegated subscribe grant for device X to act as Alice but not for chat protocol
+            // Alice creates a delegated read grant for device X to subscribe as Alice but not for chat protocol
             const subscribeGrantForDeviceX = await PermissionsProtocol.createGrant({
                 delegated: true, // this is a delegated grant
                 dateExpires: Time.createOffsetTimestamp({ seconds: 100 }),
                 grantedTo: deviceX.did,
                 scope: {
                     interface: DwnInterfaceName.Records,
-                    method: DwnMethodName.Subscribe,
+                    method: DwnMethodName.Read,
                     protocol: 'some-other-protocol'
                 },
                 signer: Jws.createSigner(alice)