@enbox/dwn-sdk-js 0.4.5 → 0.4.7

package/src/handlers/records-subscribe.ts

@@ -6,6 +6,7 @@ import type { RecordsQueryReplyEntry, RecordsSubscribeMessage, RecordsSubscribeR
 
 import { authenticate } from '../core/auth.js';
 import { DateSort } from '../types/records-types.js';
+import { EncryptionControl } from '../core/encryption-control.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
@@ -52,6 +53,7 @@ export class RecordsSubscribeHandler implements MethodHandler {
 
     let eventFilters: Filter[] = [];
     let queryFilters: Filter[] = [];
+    const requester = Message.getRequester(recordsSubscribe.message);
 
     // if this is an anonymous subscribe and the filter supports published records, subscribe to only published records
     if (Records.filterIncludesPublishedRecords(recordsSubscribe.message.descriptor.filter) && recordsSubscribe.author === undefined) {
@@ -82,6 +84,7 @@ export class RecordsSubscribeHandler implements MethodHandler {
     const { cursor: eventLogCursor } = recordsSubscribe.message.descriptor;
     const projectedSubscriptionHandler = RecordsSubscribeHandler.createRecordLimitOccupancyGuard({
       deps: this.deps,
+      eventFilters,
       recordsSubscribe,
       subscriptionHandler,
       tenant,
@@ -130,15 +133,14 @@ export class RecordsSubscribeHandler implements MethodHandler {
     try {
       const { dateSort, pagination } = recordsSubscribe.message.descriptor;
       const messageSort = RecordsSubscribeHandler.convertDateSort(dateSort);
-      const queryResult = await queryRecordsWithRecordLimitOccupancy({
-        messageStore          : this.deps.messageStore,
-        validationStateReader : this.deps.validationStateReader,
+      const queryResult = await this.queryRecordsWithVisibleControlFiltering(
         tenant,
-        filters               : queryFilters,
+        recordsSubscribe,
+        requester,
+        queryFilters,
         messageSort,
         pagination,
-        messageTimestamp      : recordsSubscribe.message.descriptor.messageTimestamp,
-      });
+      );
       entries = queryResult.messages;
       paginationCursor = queryResult.cursor;
 
@@ -194,11 +196,13 @@ export class RecordsSubscribeHandler implements MethodHandler {
 
   private static createRecordLimitOccupancyGuard(input: {
     deps: HandlerDependencies;
+    eventFilters: Filter[];
     recordsSubscribe: RecordsSubscribe;
     subscriptionHandler: SubscriptionListener;
     tenant: string;
   }): ProjectedRecordsSubscriptionHandler {
-    const { deps, recordsSubscribe, subscriptionHandler, tenant } = input;
+    const { deps, eventFilters, recordsSubscribe, subscriptionHandler, tenant } = input;
+    const requester = Message.getRequester(recordsSubscribe.message);
     let subscription: EventSubscription | undefined;
     let closeRequested = false;
     let terminalErrorEmitted = false;
@@ -230,6 +234,27 @@ export class RecordsSubscribeHandler implements MethodHandler {
     const deliverProjectedEvent = async (subscriptionEvent: SubscriptionEvent): Promise<void> => {
       const { message } = subscriptionEvent.event;
       if (Records.isRecordsWrite(message)) {
+        const visibleMessages = await EncryptionControl.filterVisibleControlRecords({
+          tenant,
+          incomingMessage       : recordsSubscribe.message,
+          requester,
+          recordsWriteMessages  : [message],
+          validationStateReader : deps.validationStateReader,
+        });
+        if (visibleMessages.length === 0) {
+          return;
+        }
+
+        const projectedMessages = await EncryptionControl.projectCurrentAudienceRecords({
+          messageStore         : deps.messageStore,
+          tenant,
+          recordsWriteMessages : [message],
+          bypassFilters        : eventFilters,
+        });
+        if (projectedMessages.length === 0) {
+          return;
+        }
+
         let isOccupant: boolean;
         try {
           isOccupant = await isRecordLimitOccupant({
@@ -315,6 +340,15 @@ export class RecordsSubscribeHandler implements MethodHandler {
     }
 
     if (Records.filterIncludesUnpublishedRecords(filter)) {
+      if (EncryptionControl.isExactAudienceFilter(filter)) {
+        filters.push({
+          ...Records.convertFilter(filter),
+          interface : DwnInterfaceName.Records,
+          method    : [DwnMethodName.Write, DwnMethodName.Delete],
+          published : false,
+        });
+      }
+
       if (Records.shouldBuildUnpublishedAuthorFilter(filter, recordsSubscribe.author!)) {
         filters.push({
           ...Records.convertFilter(filter),
@@ -397,6 +431,10 @@ export class RecordsSubscribeHandler implements MethodHandler {
     }
 
     if (Records.filterIncludesUnpublishedRecords(filter)) {
+      if (EncryptionControl.isExactAudienceFilter(filter)) {
+        filters.push(Records.buildUnpublishedControlRecordsFilter(filter, dateSort));
+      }
+
       if (Records.shouldBuildUnpublishedAuthorFilter(filter, recordsSubscribe.author!)) {
         filters.push({
           ...Records.convertFilter(filter, dateSort),
@@ -465,8 +503,16 @@ export class RecordsSubscribeHandler implements MethodHandler {
     deps: HandlerDependencies,
   ): Promise<void> {
 
-    if (Message.isSignedByAuthorDelegate(recordsSubscribe.message)) {
+    if (Message.isSignedByAuthorDelegate(recordsSubscribe.message) &&
+        !EncryptionControl.filterTargetsOnlyControlRecords(recordsSubscribe.message.descriptor.filter)) {
       await recordsSubscribe.authorizeDelegate(deps.validationStateReader);
+    } else if (EncryptionControl.filterTargetsOnlyControlRecords(recordsSubscribe.message.descriptor.filter)) {
+      await EncryptionControl.authorizeControlReadRequest({
+        tenant,
+        incomingMessage       : recordsSubscribe.message,
+        requester             : Message.getRequester(recordsSubscribe.message),
+        validationStateReader : deps.validationStateReader,
+      });
     }
 
     const permissionGrantId = Message.getPermissionGrantId(recordsSubscribe.signaturePayload!);
@@ -489,4 +535,108 @@ export class RecordsSubscribeHandler implements MethodHandler {
       await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsSubscribe, deps.validationStateReader);
     }
   }
+
+  private async filterControlRecordsForNonOwner(
+    tenant: string,
+    recordsSubscribe: RecordsSubscribe,
+    requester: string | undefined,
+    recordsWrites: RecordsQueryReplyEntry[],
+  ): Promise<RecordsQueryReplyEntry[]> {
+    return EncryptionControl.filterVisibleControlRecords({
+      tenant,
+      incomingMessage       : recordsSubscribe.message,
+      requester,
+      recordsWriteMessages  : recordsWrites,
+      validationStateReader : this.deps.validationStateReader,
+    });
+  }
+
+  private async queryRecordsWithVisibleControlFiltering(
+    tenant: string,
+    recordsSubscribe: RecordsSubscribe,
+    requester: string | undefined,
+    filters: Filter[],
+    messageSort: MessageSort,
+    pagination: { cursor?: PaginationCursor; limit?: number } | undefined,
+  ): Promise<{ messages: RecordsQueryReplyEntry[], cursor?: PaginationCursor }> {
+    const controlFilters = Records.buildControlRecordsFilters(filters);
+    const currentAudienceRecordIdCache = new Map<string, string | undefined>();
+    if (controlFilters.length === 0) {
+      const result = await queryRecordsWithRecordLimitOccupancy({
+        messageStore          : this.deps.messageStore,
+        validationStateReader : this.deps.validationStateReader,
+        tenant,
+        filters,
+        messageSort,
+        pagination,
+        messageTimestamp      : recordsSubscribe.message.descriptor.messageTimestamp,
+      });
+      return EncryptionControl.projectCurrentAudienceRecordPage({
+        messageStore: this.deps.messageStore,
+        tenant,
+        filters,
+        currentAudienceRecordIdCache,
+        result,
+      });
+    }
+
+    if (pagination?.limit === undefined || pagination.limit <= 0) {
+      const result = await queryRecordsWithRecordLimitOccupancy({
+        messageStore          : this.deps.messageStore,
+        validationStateReader : this.deps.validationStateReader,
+        tenant,
+        filters,
+        messageSort,
+        pagination,
+        messageTimestamp      : recordsSubscribe.message.descriptor.messageTimestamp,
+      });
+      const projectedResult = await EncryptionControl.projectCurrentAudienceRecordPage({
+        messageStore: this.deps.messageStore,
+        tenant,
+        filters,
+        currentAudienceRecordIdCache,
+        result,
+      });
+      return {
+        messages : await this.filterControlRecordsForNonOwner(tenant, recordsSubscribe, requester, projectedResult.messages),
+        cursor   : projectedResult.cursor,
+      };
+    }
+
+    const visibleMessages: RecordsQueryReplyEntry[] = [];
+    let cursor = pagination.cursor;
+    let nextCursor: PaginationCursor | undefined;
+    // Keeps visible-page pagination stable until #1100 moves control visibility into indexed store filters.
+    do {
+      const remainingLimit = pagination.limit - visibleMessages.length;
+      const result = await queryRecordsWithRecordLimitOccupancy({
+        messageStore          : this.deps.messageStore,
+        validationStateReader : this.deps.validationStateReader,
+        tenant,
+        filters,
+        messageSort,
+        pagination            : { ...pagination, cursor, limit: remainingLimit },
+        messageTimestamp      : recordsSubscribe.message.descriptor.messageTimestamp,
+      });
+      const projectedResult = await EncryptionControl.projectCurrentAudienceRecordPage({
+        messageStore: this.deps.messageStore,
+        tenant,
+        filters,
+        currentAudienceRecordIdCache,
+        result,
+      });
+      const filteredMessages = await this.filterControlRecordsForNonOwner(
+        tenant,
+        recordsSubscribe,
+        requester,
+        projectedResult.messages,
+      );
+      visibleMessages.push(...filteredMessages);
+      nextCursor = projectedResult.cursor;
+      cursor = projectedResult.cursor;
+    } while (visibleMessages.length < pagination.limit && cursor !== undefined);
+
+    return { messages: visibleMessages, cursor: nextCursor };
+  }
+
 }

package/src/handlers/records-write.ts

@@ -8,6 +8,7 @@ import { Cid } from '../utils/cid.js';
 import { DataStream } from '../utils/data-stream.js';
 import { DwnConstant } from '../core/dwn-constant.js';
 import { Encoder } from '../utils/encoder.js';
+import { EncryptionControl } from '../core/encryption-control.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
@@ -135,6 +136,15 @@ export class RecordsWriteHandler implements MethodHandler {
       if (coreProtocol?.preProcessWrite !== undefined) {
         await coreProtocol.preProcessWrite(tenant, message, this.deps.validationStateReader);
       }
+      if (EncryptionControl.isControlMessage(message)) {
+        await EncryptionControl.preProcessWrite(tenant, message, this.deps.validationStateReader);
+        if (dataStream === undefined) {
+          throw new DwnError(
+            DwnErrorCode.EncryptionControlValidateUnexpectedRecord,
+            'encryption control records require data.'
+          );
+        }
+      }
 
       // NOTE: We allow isLatestBaseState to be true ONLY if the incoming message comes with data, or if the incoming message is NOT an initial write
       // This would allow an initial write to be written to the DB without data, but having it not queryable,
@@ -170,6 +180,7 @@ export class RecordsWriteHandler implements MethodHandler {
           error.code === DwnErrorCode.RecordsWriteDataCidMismatch ||
           error.code === DwnErrorCode.RecordsWriteDataSizeMismatch ||
           error.code.startsWith('SchemaValidator') ||
+          EncryptionControl.mapErrorToStatusCode(error.code) !== undefined ||
           this.deps.coreProtocols?.mapErrorToStatusCode(error.code) !== undefined) {
           return messageReplyFromError(error, 400);
         }
@@ -246,6 +257,9 @@ export class RecordsWriteHandler implements MethodHandler {
       if (coreProtocol?.validateRecord !== undefined) {
         await coreProtocol.validateRecord(message, dataBytes);
       }
+      if (EncryptionControl.isControlMessage(message)) {
+        await EncryptionControl.validateRecord({ tenant, message, dataBytes, validationStateReader: this.deps.validationStateReader });
+      }
 
       messageWithOptionalEncodedData = await this.cloneAndAddEncodedData(message, dataBytes);
     } else {
@@ -414,6 +428,11 @@ export class RecordsWriteHandler implements MethodHandler {
       );
     }
 
+    if (EncryptionControl.isControlMessage(recordsWrite.message)) {
+      await EncryptionControl.authorizeWrite(tenant, recordsWrite, this.deps.validationStateReader);
+      return;
+    }
+
     if (recordsWrite.isSignedByAuthorDelegate) {
       await recordsWrite.authorizeAuthorDelegate(this.deps.validationStateReader);
     }

package/src/index.ts

@@ -16,7 +16,20 @@ export type { DataEncodedRecordsWriteMessage, RecordsCountDescriptor, RecordsCou
 export type { GeneralJws, SignatureEntry } from './types/jws-types.js';
 export { authenticate } from './core/auth.js';
 export { CoreProtocolRegistry } from './core/core-protocol.js';
-export { PERMISSIONS_REVOCATION_PATH } from './core/constants.js';
+export { EncryptionControl } from './core/encryption-control.js';
+export {
+  ENCRYPTION_CONTROL_AUDIENCE_PATH,
+  ENCRYPTION_CONTROL_AUDIENCE_SCHEMA_URI,
+  ENCRYPTION_CONTROL_DELIVERY_PATH,
+  ENCRYPTION_CONTROL_DELIVERY_SCHEMA_URI,
+  ENCRYPTION_CONTROL_PATHS,
+  ENCRYPTION_CONTROL_ROOT_PATH,
+  ENCRYPTION_PROTOCOL_URI,
+  EncryptionControlRecordType,
+  PERMISSIONS_REVOCATION_PATH,
+  isEncryptionControlPath,
+} from './core/constants.js';
+export type { EncryptionControlPath } from './core/constants.js';
 export type { CoreProtocol, CoreProtocolStores } from './core/core-protocol.js';
 export { AllowAllTenantGate } from './core/tenant-gate.js';
 export type { ActiveTenantCheckResult, TenantGate } from './core/tenant-gate.js';
@@ -28,6 +41,8 @@ export type { RecordsQueryOptions } from './interfaces/records-query.js';
 export type { DataStore, DataStorePutResult, DataStoreGetResult } from './types/data-store.js';
 export type { ResumableTaskStore, ManagedResumableTask } from './types/resumable-task-store.js';
 export { DataStream } from './utils/data-stream.js';
+export { getGrantKeyDeliveryScopes, grantKeyScopeCoversDeliveredScope, isGrantKeyEligibleRecordsScope, isGrantKeyRecordsScope } from './utils/grant-key-coverage.js';
+export type { GrantKeyEligibleRecordsScope, GrantKeyProtocolPathScope, GrantKeyReadRecordsScope, GrantKeyRecordsScope, GrantKeyWriteRecordsScope } from './utils/grant-key-coverage.js';
 export { HdKey, KeyDerivationScheme } from './utils/hd-key.js';
 export type { DerivedPrivateJwk } from './utils/hd-key.js';
 export { Dwn } from './dwn.js';
@@ -38,16 +53,21 @@ export { DwnInterfaceName, DwnMethodName } from './enums/dwn-interface-method.js
 export { Encoder } from './utils/encoder.js';
 export { MessagesSubscribe } from './interfaces/messages-subscribe.js';
 export type { MessagesSubscribeOptions } from './interfaces/messages-subscribe.js';
-export { Encryption, ContentEncryptionAlgorithm, KeyAgreementAlgorithm, ROLE_AUDIENCE_DERIVATION_SCHEME } from './utils/encryption.js';
+export { Encryption, ContentEncryptionAlgorithm, KeyAgreementAlgorithm, ROLE_AUDIENCE_DERIVATION_SCHEME, SEAL_DERIVATION_SCHEME } from './utils/encryption.js';
 export type {
   DwnEncryption,
-  KeyEncryption,
-  KeyEncryptionInput,
   KeyUnwrapPayload,
   ProtocolPathKeyEncryption,
   ProtocolPathKeyEncryptionInput,
-  RoleAudienceKeyEncryption,
-  RoleAudienceKeyEncryptionInput,
+  SealKeyWrap,
+  SealKeyWrapInput,
+  SealUnwrapInput,
+  SealWrapInput,
+  SourceRoleAudienceKeyEncryption,
+  SourceRoleAudienceKeyEncryptionInput,
+  X25519KeyEncryption,
+  X25519KeyEncryptionInput,
+  X25519KeyWrapInput,
 } from './utils/encryption.js';
 export { RecordsWrite } from './interfaces/records-write.js';
 export type { EncryptionInput, RecordsWriteOptions, CreateFromOptions } from './interfaces/records-write.js';
@@ -72,7 +92,14 @@ export { PermissionScopeMatcher } from './utils/permission-scope.js';
 export type { ProtocolScope } from './utils/permission-scope.js';
 export { PrivateKeySigner } from './utils/private-key-signer.js';
 export type { PrivateKeySignerOptions } from './utils/private-key-signer.js';
-export { Protocols, parseCrossProtocolRef, isCrossProtocolRef, getRuleSetAtPath } from './utils/protocols.js';
+export {
+  Protocols,
+  getRoleAudienceContextId,
+  getRoleContextPrefix,
+  getRuleSetAtPath,
+  isCrossProtocolRef,
+  parseCrossProtocolRef,
+} from './utils/protocols.js';
 export type { CrossProtocolRef } from './utils/protocols.js';
 export { ProtocolsConfigure } from './interfaces/protocols-configure.js';
 export type { ProtocolsConfigureOptions } from './interfaces/protocols-configure.js';
@@ -90,24 +117,24 @@ export { Secp256r1 } from './utils/secp256r1.js';
 export type { SupportedCurve } from './jose/algorithms/signing/signature-algorithms.js';
 export type { MessageSigner } from './types/signer.js';
 export { SortDirection } from './types/query-types.js';
-export type { EncryptionKeyDeriver, KeyDecrypter, KeyDecrypterDerivationScheme } from './types/encryption-types.js';
+export type {
+  EncryptionControlAudiencePayload,
+  EncryptionControlDeliveryPayload,
+  EncryptionControlDeliveryTags,
+  EncryptionControlSeal,
+  EncryptionKeyDeriver,
+  KeyDecrypter,
+  KeyDecrypterDerivationScheme,
+  RoleAudienceKeyId,
+  RoleAudienceKeyMaterial,
+  RoleAudienceTuple,
+} from './types/encryption-types.js';
+export { EncryptionControlDeliveryRecipientAuthority } from './types/encryption-types.js';
 export { Time } from './utils/time.js';
 export * from './types/permission-types.js';
 export * from './types/records-types.js';
 
-// concrete implementations of stores and event log
-export { BlockstoreLevel } from './store/blockstore-level.js';
-export type { BlockstoreLevelConfig } from './store/blockstore-level.js';
-export { DataStoreLevel } from './store/data-store-level.js';
-export type { DataStoreLevelConfig } from './store/data-store-level.js';
-export { IndexLevel } from './store/index-level.js';
-export type { CompoundIndexDefinition, IndexLevelConfig, IndexedItem, IndexLevelOptions } from './store/index-level.js';
-export { createLevelDatabase, LevelWrapper } from './store/level-wrapper.js';
-export type { CreateLevelDatabaseOptions, LevelDatabase, LevelWrapperConfig, LevelWrapperBatchOperation, LevelWrapperOptions, LevelWrapperIteratorOptions } from './store/level-wrapper.js';
-export { MessageStoreLevel } from './store/message-store-level.js';
-export type { MessageStoreLevelConfig } from './store/message-store-level.js';
-export { ResumableTaskStoreLevel } from './store/resumable-task-store-level.js';
-export type { ResumableTaskStoreLevelConfig } from './store/resumable-task-store-level.js';
+// concrete event log implementations
 export { EventEmitterWakePublisher } from './event-stream/event-emitter-wake-publisher.js';
 export { DurableEventLog } from './event-stream/durable-event-log.js';
 export type { DurableEventLogConfig, DurableEventLogStore } from './event-stream/durable-event-log.js';

package/src/interfaces/protocols-configure.ts

@@ -1,3 +1,4 @@
+import type { CrossProtocolRef } from '../utils/protocols.js';
 import type { DataEncodedRecordsWriteMessage } from '../types/records-types.js';
 import type { MessageSigner } from '../types/signer.js';
 import type { ValidationStateReader } from '../types/validation-state-reader.js';
@@ -15,7 +16,7 @@ import { Time } from '../utils/time.js';
 import { validateProtocolTagSchemaDefinition } from '../utils/protocol-tags.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
-import { getRuleSetAtPath, isCrossProtocolRef, parseCrossProtocolRef } from '../utils/protocols.js';
+import { getRoleAudienceContextId, getRuleSetAtPath, isCrossProtocolRef, parseCrossProtocolRef } from '../utils/protocols.js';
 import { normalizeProtocolUrl, normalizeSchemaUrl, validateProtocolUrlNormalized, validateSchemaUrlNormalized } from '../utils/url.js';
 import { ProtocolAction, ProtocolActor, ProtocolRecordLimitStrategy } from '../types/protocols-types.js';
 
@@ -31,7 +32,10 @@ export type ProtocolsConfigureOptions = {
 };
 
 export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessage> {
+  private static readonly maxRecordNestingDepth = 10;
+
   public static async parse(message: ProtocolsConfigureMessage): Promise<ProtocolsConfigure> {
+    ProtocolsConfigure.validateReservedEncryptionControlPath(message.descriptor?.definition);
     Message.validateJsonSchema(message);
     ProtocolsConfigure.validateProtocolDefinition(message.descriptor.definition);
     await Message.validateSignatureStructure(message.authorization.signature, message.descriptor);
@@ -53,6 +57,8 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
       ...permissionGrantInvocation,
     };
 
+    ProtocolsConfigure.validateReservedEncryptionControlPath(descriptor.definition);
+
     const authorization = await Message.createAuthorization({
       descriptor,
       signer         : options.signer,
@@ -109,6 +115,59 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
     ProtocolsConfigure.validateStructure(definition);
   }
 
+  /**
+   * Validates the reserved encryption-control namespace before JSON Schema validation.
+   */
+  private static validateReservedEncryptionControlPath(definition: unknown): void {
+    if (!ProtocolsConfigure.isRecord(definition)) {
+      return;
+    }
+
+    if (ProtocolsConfigure.isRecord(definition.types) && Object.hasOwn(definition.types, '$encryption')) {
+      throw new DwnError(
+        DwnErrorCode.ProtocolsConfigureReservedEncryptionControlPath,
+        `protocol type '$encryption' is reserved for DWN encryption control records.`
+      );
+    }
+
+    ProtocolsConfigure.validateReservedEncryptionControlStructure(definition.structure, '', 0);
+  }
+
+  private static validateReservedEncryptionControlStructure(ruleSet: unknown, protocolPath: string, depth: number): void {
+    if (!ProtocolsConfigure.isRecord(ruleSet)) {
+      return;
+    }
+
+    for (const recordType in ruleSet) {
+      const childDepth = depth + 1;
+      const childPath = protocolPath === '' ? recordType : `${protocolPath}/${recordType}`;
+
+      if (recordType === '$encryption') {
+        throw new DwnError(
+          DwnErrorCode.ProtocolsConfigureReservedEncryptionControlPath,
+          `protocol structure path '${childPath}' is reserved for DWN encryption control records.`
+        );
+      }
+
+      if (recordType.startsWith('$')) {
+        continue;
+      }
+
+      if (childDepth > ProtocolsConfigure.maxRecordNestingDepth) {
+        throw new DwnError(
+          DwnErrorCode.ProtocolsConfigureRecordNestingDepthExceeded,
+          `record nesting depth exceeded ${ProtocolsConfigure.maxRecordNestingDepth} levels.`
+        );
+      }
+
+      ProtocolsConfigure.validateReservedEncryptionControlStructure(ruleSet[recordType], childPath, childDepth);
+    }
+  }
+
+  private static isRecord(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+  }
+
   /**
    * Validates the `uses` map: alias names must match `^[a-zA-Z][a-zA-Z0-9_-]*$`,
    * values must be normalized protocol URLs, and no alias may reference the protocol itself.
@@ -175,15 +234,8 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
 
   /**
    * Parses the given rule set hierarchy to get all the role protocol paths.
-   * @throws DwnError if the hierarchy depth goes beyond 10 levels.
    */
   private static fetchAllRolePathsRecursively(ruleSetProtocolPath: string, ruleSet: ProtocolRuleSet, roles: string[]): string[] {
-    // Limit the depth of the record hierarchy to 10 levels
-    // There is opportunity to optimize here to avoid repeated string splitting
-    if (ruleSetProtocolPath.split('/').length > 10) {
-      throw new DwnError(DwnErrorCode.ProtocolsConfigureRecordNestingDepthExceeded, 'Record nesting depth exceeded 10 levels.');
-    }
-
     for (const recordType in ruleSet) {
       // ignore non-nested-record properties
       if (recordType.startsWith('$')) {
@@ -300,7 +352,8 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
       if (actionRule.role !== undefined) {
         if (isCrossProtocolRef(actionRule.role)) {
           // Cross-protocol role reference: validate alias exists in `uses`
-          ProtocolsConfigure.validateCrossProtocolAlias(actionRule.role, uses, ruleSetProtocolPath, 'role');
+          const parsedRole = ProtocolsConfigure.validateCrossProtocolAlias(actionRule.role, uses, ruleSetProtocolPath, 'role');
+          ProtocolsConfigure.validateRoleParentContextDepth(parsedRole.protocolPath, ruleSetProtocolPath, actionRule);
         } else {
           // Local role: make sure the role contains a valid protocol path to a role record
           if (!roles.includes(actionRule.role)) {
@@ -309,6 +362,8 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
               `Role in action ${JSON.stringify(actionRule)} for rule set ${ruleSetProtocolPath} does not exist.`
             );
           }
+
+          ProtocolsConfigure.validateRoleParentContextDepth(actionRule.role, ruleSetProtocolPath, actionRule);
         }
       }
 
@@ -443,10 +498,17 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
         }
 
         for (const actionRule of actionRules) {
-          if (actionRule.role === undefined || !actionRule.can.includes(ProtocolAction.Read) || isCrossProtocolRef(actionRule.role)) {
+          if (actionRule.role === undefined || !actionRule.can.includes(ProtocolAction.Read)) {
             continue;
           }
 
+          if (isCrossProtocolRef(actionRule.role)) {
+            throw new DwnError(
+              DwnErrorCode.ProtocolsConfigureInvalidEncryptedCrossProtocolRole,
+              `Encrypted protocol path '${ruleSetProtocolPath}' references cross-protocol read role '${actionRule.role}'.`
+            );
+          }
+
           const roleRuleSet = getRuleSetAtPath(actionRule.role, rootStructure);
           if (roleRuleSet?.$keyAgreement === undefined) {
             throw new DwnError(
@@ -558,6 +620,33 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
     }
   }
 
+  /**
+   * Validates that a role rule only references a role whose parent context can be found
+   * from records at the rule set's protocol path.
+   */
+  private static validateRoleParentContextDepth(rolePath: string, ruleSetProtocolPath: string, actionRule: ProtocolActionRule): void {
+    const syntheticContextId = ProtocolsConfigure.getSyntheticContextIdForProtocolPath(ruleSetProtocolPath);
+
+    if (getRoleAudienceContextId(rolePath, syntheticContextId) === undefined) {
+      throw new DwnError(
+        DwnErrorCode.ProtocolsConfigureRoleParentContextDepthExceeded,
+        `role '${rolePath}' in action ${JSON.stringify(actionRule)} at protocol path '${ruleSetProtocolPath}' ` +
+        `requires a context that records at the rule path cannot provide.`
+      );
+    }
+  }
+
+  private static getSyntheticContextIdForProtocolPath(protocolPath: string): string | undefined {
+    if (protocolPath === '') {
+      return undefined;
+    }
+
+    return protocolPath
+      .split('/')
+      .map((_segment, index): string => `context-${index}`)
+      .join('/');
+  }
+
   /**
    * Validates that a cross-protocol reference (in `alias:path` format) has a valid alias
    * that exists in the `uses` map.
@@ -568,7 +657,7 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
    */
   private static validateCrossProtocolAlias(
     ref: string, uses: ProtocolUses | undefined, ruleSetProtocolPath: string, fieldName: string
-  ): void {
+  ): CrossProtocolRef {
     const parsed = parseCrossProtocolRef(ref);
 
     if (parsed === undefined) {
@@ -595,6 +684,8 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
         `does not exist in the 'uses' map.`
       );
     }
+
+    return parsed;
   }
 
   private static normalizeDefinition(definition: ProtocolDefinition): ProtocolDefinition {