@enbox/dwn-sdk-js 0.4.4 → 0.4.5

package/dist/esm/tests/handlers/records-write.spec.js

@@ -31,9 +31,8 @@ import { TestEventLog } from '../test-event-stream.js';
 import { TestStores } from '../test-stores.js';
 import { TestStubGenerator } from '../utils/test-stub-generator.js';
 import { Time } from '../../src/utils/time.js';
-import { X25519 } from '@enbox/crypto';
-import { ContentEncryptionAlgorithm, Encryption } from '../../src/utils/encryption.js';
-import { CoreProtocolRegistry, DataStoreLevel, DwnConstant, DwnInterfaceName, DwnMethodName, KeyDerivationScheme, MessageStoreLevel, PermissionsProtocol, RecordsDelete, RecordsQuery } from '../../src/index.js';
+import { ContentEncryptionAlgorithm, Encryption, ROLE_AUDIENCE_DERIVATION_SCHEME } from '../../src/utils/encryption.js';
+import { CoreProtocolRegistry, DataStoreLevel, DwnConstant, DwnInterfaceName, DwnMethodName, EncryptionProtocol, KeyDerivationScheme, MessageStoreLevel, PermissionsProtocol, Protocols, RecordsDelete, RecordsQuery } from '../../src/index.js';
 import { defaultTestProtocolDefinition, TestDataGenerator } from '../utils/test-data-generator.js';
 import { DidKey, UniversalResolver } from '@enbox/dids';
 import { DwnError, DwnErrorCode } from '../../src/core/dwn-error.js';
@@ -2237,10 +2236,11 @@ export function testRecordsWriteHandler() {
                             secret: {}
                         }
                     };
+                    const encryptedProtocolDefinition = await Protocols.deriveAndInjectPublicEncryptionKeys(protocolDefinition, alice.keyId, alice.encryptionKeyPair.privateJwk);
                     // Alice installs the protocol
                     const protocolConfig = await TestDataGenerator.generateProtocolsConfigure({
                         author: alice,
-                        protocolDefinition: protocolDefinition,
+                        protocolDefinition: encryptedProtocolDefinition,
                     });
                     const configReply = await dwn.processMessage(alice.did, protocolConfig.message);
                     expect(configReply.status.code).toBe(202);
@@ -2272,25 +2272,24 @@ export function testRecordsWriteHandler() {
                             secret: {}
                         }
                     };
+                    const encryptedProtocolDefinition = await Protocols.deriveAndInjectPublicEncryptionKeys(protocolDefinition, alice.keyId, alice.encryptionKeyPair.privateJwk);
                     // Alice installs the protocol
                     const protocolConfig = await TestDataGenerator.generateProtocolsConfigure({
                         author: alice,
-                        protocolDefinition: protocolDefinition,
+                        protocolDefinition: encryptedProtocolDefinition,
                     });
                     const configReply = await dwn.processMessage(alice.did, protocolConfig.message);
                     expect(configReply.status.code).toBe(202);
-                    // Generate an X25519 key pair for encryption (did:key personas use Ed25519 for signing)
-                    const encryptionPrivateKey = await X25519.generateKey();
-                    const encryptionPublicKey = await X25519.getPublicKey({ key: encryptionPrivateKey });
                     const data = Encoder.stringToBytes('encrypted secret');
                     const dataEncryptionKey = TestDataGenerator.randomBytes(32);
-                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(12);
+                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(16);
+                    const encryptedData = await Encryption.encrypt(ContentEncryptionAlgorithm.A256CTR, dataEncryptionKey, dataEncryptionInitializationVector, data);
+                    const encryptionPublicKey = encryptedProtocolDefinition.structure.secret.$keyAgreement.publicKeyJwk;
                     const encryptionInput = {
                         initializationVector: dataEncryptionInitializationVector,
                         key: dataEncryptionKey,
-                        authenticationTag: TestDataGenerator.randomBytes(16),
                         keyEncryptionInputs: [{
-                                publicKeyId: alice.keyId,
+                                keyId: await Encryption.getKeyId(encryptionPublicKey),
                                 publicKey: encryptionPublicKey,
                                 derivationScheme: KeyDerivationScheme.ProtocolPath
                             }]
@@ -2300,7 +2299,176 @@ export function testRecordsWriteHandler() {
                         protocol: protocolDefinition.protocol,
                         protocolPath: 'secret',
                         schema: 'http://secret-schema',
-                        data,
+                        data: encryptedData,
+                        encryptionInput,
+                    });
+                    const writeReply = await dwn.processMessage(alice.did, recordsWrite.message, { dataStream: recordsWrite.dataStream });
+                    expect(writeReply.status.code).toBe(202);
+                });
+                it('should reject an encrypted role-readable RecordsWrite without a roleAudience keyEncryption entry', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const protocolDefinition = {
+                        protocol: 'http://role-audience-entry-required.xyz',
+                        published: false,
+                        types: {
+                            thread: { schema: 'http://thread-schema', dataFormats: ['application/json'] },
+                            participant: { schema: 'http://participant-schema', dataFormats: ['application/json'] },
+                            chat: { schema: 'http://chat-schema', dataFormats: ['text/plain'], encryptionRequired: true },
+                        },
+                        structure: {
+                            thread: {
+                                participant: { $role: true },
+                                chat: {
+                                    $actions: [
+                                        { role: 'thread/participant', can: ['read'] },
+                                    ],
+                                },
+                            },
+                        },
+                    };
+                    const encryptedProtocolDefinition = await Protocols.deriveAndInjectPublicEncryptionKeys(protocolDefinition, alice.keyId, alice.encryptionKeyPair.privateJwk);
+                    const protocolConfig = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition: encryptedProtocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolConfig.message)).status.code).toBe(202);
+                    const thread = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: 'thread',
+                        schema: 'http://thread-schema',
+                        dataFormat: 'application/json',
+                        data: Encoder.stringToBytes('{"title":"secret"}'),
+                    });
+                    expect((await dwn.processMessage(alice.did, thread.message, { dataStream: thread.dataStream })).status.code).toBe(202);
+                    const data = Encoder.stringToBytes('encrypted chat');
+                    const dataEncryptionKey = TestDataGenerator.randomBytes(32);
+                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(16);
+                    const encryptedData = await Encryption.encrypt(ContentEncryptionAlgorithm.A256CTR, dataEncryptionKey, dataEncryptionInitializationVector, data);
+                    const threadRuleSet = encryptedProtocolDefinition.structure.thread;
+                    const chatRuleSet = threadRuleSet.chat;
+                    const protocolPathPublicKey = chatRuleSet.$keyAgreement.publicKeyJwk;
+                    const encryptionInput = {
+                        initializationVector: dataEncryptionInitializationVector,
+                        key: dataEncryptionKey,
+                        keyEncryptionInputs: [{
+                                keyId: await Encryption.getKeyId(protocolPathPublicKey),
+                                publicKey: protocolPathPublicKey,
+                                derivationScheme: KeyDerivationScheme.ProtocolPath,
+                            }],
+                    };
+                    const recordsWrite = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: 'thread/chat',
+                        parentContextId: thread.message.contextId,
+                        schema: 'http://chat-schema',
+                        dataFormat: 'text/plain',
+                        data: encryptedData,
+                        encryptionInput,
+                    });
+                    const writeReply = await dwn.processMessage(alice.did, recordsWrite.message, { dataStream: recordsWrite.dataStream });
+                    expect(writeReply.status.code).toBe(400);
+                    expect(writeReply.status.detail).toContain(DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEntryMissing);
+                });
+                it('should accept an encrypted role-readable RecordsWrite with a matching audienceEpoch', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const protocolDefinition = {
+                        protocol: 'http://role-audience-entry-accepted.xyz',
+                        published: false,
+                        types: {
+                            thread: { schema: 'http://thread-schema', dataFormats: ['application/json'] },
+                            participant: { schema: 'http://participant-schema', dataFormats: ['application/json'] },
+                            chat: { schema: 'http://chat-schema', dataFormats: ['text/plain'], encryptionRequired: true },
+                        },
+                        structure: {
+                            thread: {
+                                participant: { $role: true },
+                                chat: {
+                                    $actions: [
+                                        { role: 'thread/participant', can: ['read'] },
+                                    ],
+                                },
+                            },
+                        },
+                    };
+                    const encryptedProtocolDefinition = await Protocols.deriveAndInjectPublicEncryptionKeys(protocolDefinition, alice.keyId, alice.encryptionKeyPair.privateJwk);
+                    const protocolConfig = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition: encryptedProtocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolConfig.message)).status.code).toBe(202);
+                    const thread = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: 'thread',
+                        schema: 'http://thread-schema',
+                        dataFormat: 'application/json',
+                        data: Encoder.stringToBytes('{"title":"secret"}'),
+                    });
+                    expect((await dwn.processMessage(alice.did, thread.message, { dataStream: thread.dataStream })).status.code).toBe(202);
+                    const role = 'thread/participant';
+                    const threadRuleSet = encryptedProtocolDefinition.structure.thread;
+                    const participantRuleSet = threadRuleSet.participant;
+                    const rolePublicKey = participantRuleSet.$keyAgreement.publicKeyJwk;
+                    const roleKeyId = await Encryption.getKeyId(rolePublicKey);
+                    const audienceEpochData = Encoder.objectToBytes({
+                        protocol: protocolDefinition.protocol,
+                        contextId: thread.message.contextId,
+                        role,
+                        epoch: 1,
+                        keyId: roleKeyId,
+                        publicKeyJwk: rolePublicKey,
+                    });
+                    const audienceEpoch = await RecordsWrite.create({
+                        data: audienceEpochData,
+                        dataFormat: 'application/json',
+                        protocol: EncryptionProtocol.uri,
+                        protocolPath: EncryptionProtocol.audienceEpochPath,
+                        schema: EncryptionProtocol.definition.types.audienceEpoch.schema,
+                        signer: Jws.createSigner(alice),
+                        tags: {
+                            protocol: protocolDefinition.protocol,
+                            contextId: thread.message.contextId,
+                            role,
+                            epoch: 1,
+                            keyId: roleKeyId,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, audienceEpoch.message, { dataStream: DataStream.fromBytes(audienceEpochData) })).status.code).toBe(202);
+                    const data = Encoder.stringToBytes('encrypted chat');
+                    const dataEncryptionKey = TestDataGenerator.randomBytes(32);
+                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(16);
+                    const encryptedData = await Encryption.encrypt(ContentEncryptionAlgorithm.A256CTR, dataEncryptionKey, dataEncryptionInitializationVector, data);
+                    const chatRuleSet = threadRuleSet.chat;
+                    const protocolPathPublicKey = chatRuleSet.$keyAgreement.publicKeyJwk;
+                    const encryptionInput = {
+                        initializationVector: dataEncryptionInitializationVector,
+                        key: dataEncryptionKey,
+                        keyEncryptionInputs: [
+                            {
+                                keyId: await Encryption.getKeyId(protocolPathPublicKey),
+                                publicKey: protocolPathPublicKey,
+                                derivationScheme: KeyDerivationScheme.ProtocolPath,
+                            },
+                            {
+                                keyId: roleKeyId,
+                                publicKey: rolePublicKey,
+                                derivationScheme: ROLE_AUDIENCE_DERIVATION_SCHEME,
+                                protocol: protocolDefinition.protocol,
+                                role,
+                                epoch: 1,
+                            },
+                        ],
+                    };
+                    const recordsWrite = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: 'thread/chat',
+                        parentContextId: thread.message.contextId,
+                        schema: 'http://chat-schema',
+                        dataFormat: 'text/plain',
+                        data: encryptedData,
                         encryptionInput,
                     });
                     const writeReply = await dwn.processMessage(alice.did, recordsWrite.message, { dataStream: recordsWrite.dataStream });
@@ -2320,10 +2488,11 @@ export function testRecordsWriteHandler() {
                             secret: {},
                         }
                     };
+                    const encryptedProtocolDefinition = await Protocols.deriveAndInjectPublicEncryptionKeys(protocolDefinition, alice.keyId, alice.encryptionKeyPair.privateJwk);
                     // Alice installs the protocol
                     const protocolConfig = await TestDataGenerator.generateProtocolsConfigure({
                         author: alice,
-                        protocolDefinition: protocolDefinition,
+                        protocolDefinition: encryptedProtocolDefinition,
                     });
                     const configReply = await dwn.processMessage(alice.did, protocolConfig.message);
                     expect(configReply.status.code).toBe(202);
@@ -2570,15 +2739,14 @@ export function testRecordsWriteHandler() {
                     const protocolsConfigureReply = await dwn.processMessage(alice.did, protocolsConfig.message);
                     expect(protocolsConfigureReply.status.code).toBe(202);
                     const bobMessageBytes = Encoder.stringToBytes('message from bob');
-                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(12);
+                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(16);
                     const dataEncryptionKey = TestDataGenerator.randomBytes(32);
-                    const { ciphertext: bobMessageEncryptedBytes, tag: authenticationTag } = await Encryption.aeadEncrypt(ContentEncryptionAlgorithm.A256GCM, dataEncryptionKey, dataEncryptionInitializationVector, bobMessageBytes);
+                    const bobMessageEncryptedBytes = await Encryption.encrypt(ContentEncryptionAlgorithm.A256CTR, dataEncryptionKey, dataEncryptionInitializationVector, bobMessageBytes);
                     const encryptionInput = {
                         initializationVector: dataEncryptionInitializationVector,
                         key: dataEncryptionKey,
-                        authenticationTag,
                         keyEncryptionInputs: [{
-                                publicKeyId: alice.keyId, // reusing signing key for encryption purely as a convenience
+                                keyId: await Encryption.getKeyId(alice.encryptionKeyPair.publicJwk),
                                 publicKey: alice.encryptionKeyPair.publicJwk,
                                 derivationScheme: KeyDerivationScheme.ProtocolPath
                             }]
@@ -2591,8 +2759,8 @@ export function testRecordsWriteHandler() {
                         data: bobMessageEncryptedBytes,
                         encryptionInput
                     });
-                    // replace valid `encryption` property with a mismatching one — mutate the iv to cause CID mismatch
-                    message.encryption.iv = Encoder.stringToBase64Url('any value which will result in a different CID');
+                    // Replace valid `encryption` property with a mismatching one while keeping the envelope schema-valid.
+                    message.encryption.initializationVector = Encoder.bytesToBase64Url(TestDataGenerator.randomBytes(16));
                     const recordsWriteHandler = new RecordsWriteHandler({
                         didResolver, messageStore, dataStore, coreProtocols: new CoreProtocolRegistry(), eventLog,
                         validationStateReader: createTestValidationStateReader({ messageStore, dataStore }),
@@ -2601,6 +2769,98 @@ export function testRecordsWriteHandler() {
                     expect(writeReply.status.code).toBe(400);
                     expect(writeReply.status.detail).toContain(DwnErrorCode.RecordsWriteValidateIntegrityEncryptionCidMismatch);
                 });
+                it('should 400 if `encryption` is present without a signed encryptionCid', async () => {
+                    const alice = await TestDataGenerator.generatePersona();
+                    TestStubGenerator.stubDidResolver(didResolver, [alice]);
+                    const protocolDefinition = emailProtocolDefinition;
+                    const protocol = protocolDefinition.protocol;
+                    const protocolsConfig = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition
+                    });
+                    const protocolsConfigureReply = await dwn.processMessage(alice.did, protocolsConfig.message);
+                    expect(protocolsConfigureReply.status.code).toBe(202);
+                    const messageBytes = Encoder.stringToBytes('encrypted message');
+                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(16);
+                    const dataEncryptionKey = TestDataGenerator.randomBytes(32);
+                    const encryptedBytes = await Encryption.encrypt(ContentEncryptionAlgorithm.A256CTR, dataEncryptionKey, dataEncryptionInitializationVector, messageBytes);
+                    const encryptionInput = {
+                        initializationVector: dataEncryptionInitializationVector,
+                        key: dataEncryptionKey,
+                        keyEncryptionInputs: [{
+                                derivationScheme: KeyDerivationScheme.ProtocolPath,
+                                keyId: await Encryption.getKeyId(alice.encryptionKeyPair.publicJwk),
+                                publicKey: alice.encryptionKeyPair.publicJwk,
+                            }],
+                    };
+                    const { message, dataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        data: encryptedBytes,
+                        encryptionInput,
+                        protocol,
+                        protocolPath: 'email',
+                        schema: 'email',
+                    });
+                    const signaturePayload = Jws.decodePlainObjectPayload(message.authorization.signature);
+                    delete signaturePayload.encryptionCid;
+                    message.authorization.signature.payload = Encoder.stringToBase64Url(JSON.stringify(signaturePayload));
+                    const recordsWriteHandler = new RecordsWriteHandler({
+                        coreProtocols: new CoreProtocolRegistry(),
+                        dataStore,
+                        didResolver,
+                        eventLog,
+                        messageStore,
+                        validationStateReader: createTestValidationStateReader({ messageStore, dataStore }),
+                    });
+                    const writeReply = await recordsWriteHandler.handle({ tenant: alice.did, message, dataStream: dataStream });
+                    expect(writeReply.status.code).toBe(400);
+                    expect(writeReply.status.detail).toContain(DwnErrorCode.RecordsWriteValidateIntegrityEncryptionCidMissing);
+                });
+                it('should 400 if a signed encryptionCid is present without `encryption`', async () => {
+                    const alice = await TestDataGenerator.generatePersona();
+                    TestStubGenerator.stubDidResolver(didResolver, [alice]);
+                    const protocolDefinition = emailProtocolDefinition;
+                    const protocol = protocolDefinition.protocol;
+                    const protocolsConfig = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition
+                    });
+                    const protocolsConfigureReply = await dwn.processMessage(alice.did, protocolsConfig.message);
+                    expect(protocolsConfigureReply.status.code).toBe(202);
+                    const messageBytes = Encoder.stringToBytes('encrypted message');
+                    const dataEncryptionInitializationVector = TestDataGenerator.randomBytes(16);
+                    const dataEncryptionKey = TestDataGenerator.randomBytes(32);
+                    const encryptedBytes = await Encryption.encrypt(ContentEncryptionAlgorithm.A256CTR, dataEncryptionKey, dataEncryptionInitializationVector, messageBytes);
+                    const encryptionInput = {
+                        initializationVector: dataEncryptionInitializationVector,
+                        key: dataEncryptionKey,
+                        keyEncryptionInputs: [{
+                                derivationScheme: KeyDerivationScheme.ProtocolPath,
+                                keyId: await Encryption.getKeyId(alice.encryptionKeyPair.publicJwk),
+                                publicKey: alice.encryptionKeyPair.publicJwk,
+                            }],
+                    };
+                    const { message, dataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        data: encryptedBytes,
+                        encryptionInput,
+                        protocol,
+                        protocolPath: 'email',
+                        schema: 'email',
+                    });
+                    delete message.encryption;
+                    const recordsWriteHandler = new RecordsWriteHandler({
+                        coreProtocols: new CoreProtocolRegistry(),
+                        dataStore,
+                        didResolver,
+                        eventLog,
+                        messageStore,
+                        validationStateReader: createTestValidationStateReader({ messageStore, dataStore }),
+                    });
+                    const writeReply = await recordsWriteHandler.handle({ tenant: alice.did, message, dataStream: dataStream });
+                    expect(writeReply.status.code).toBe(400);
+                    expect(writeReply.status.detail).toContain(DwnErrorCode.RecordsWriteValidateIntegrityEncryptionCidMissing);
+                });
                 it('should return 400 if protocol is not normalized', async () => {
                     const alice = await TestDataGenerator.generateDidKeyPersona();
                     const protocolDefinition = emailProtocolDefinition;