@enbox/dwn-sdk-js 0.4.6 → 0.4.7

package/dist/esm/tests/handlers/records-query.spec.js

@@ -10,19 +10,25 @@ import { DateSort } from '../../src/types/records-types.js';
 import { DwnConstant } from '../../src/core/dwn-constant.js';
 import { DwnErrorCode } from '../../src/core/dwn-error.js';
 import { Encoder } from '../../src/utils/encoder.js';
+import { Encryption } from '../../src/utils/encryption.js';
+import { EncryptionControlDeliveryRecipientAuthority } from '../../src/types/encryption-types.js';
 import { Jws } from '../../src/utils/jws.js';
 import { Message } from '../../src/core/message.js';
 import { PermissionsProtocol } from '../../src/protocols/permissions.js';
 import { RecordsQuery } from '../../src/interfaces/records-query.js';
 import { RecordsQueryHandler } from '../../src/handlers/records-query.js';
+import { RecordsRead } from '../../src/interfaces/records-read.js';
 import { RecordsWriteHandler } from '../../src/handlers/records-write.js';
 import { TestEventLog } from '../test-event-stream.js';
 import { TestStores } from '../test-stores.js';
 import { TestStubGenerator } from '../utils/test-stub-generator.js';
-import { CoreProtocolRegistry, DataStoreLevel, Dwn, MessageStoreLevel, ProtocolsConfigure, RecordsWrite, Time } from '../../src/index.js';
+import { CoreProtocolRegistry, Dwn, ProtocolsConfigure, RecordsWrite, Time } from '../../src/index.js';
+import { createAudienceControlWrite, createDeliveryControlWrite, installEncryptedProtocol, processControlWrite } from '../utils/encryption-control-test-utils.js';
+import { DataStoreLevel, MessageStoreLevel } from '../../src/store/level.js';
 import { defaultTestProtocolDefinition, TestDataGenerator } from '../utils/test-data-generator.js';
 import { DidKey, UniversalResolver } from '@enbox/dids';
 import { DwnInterfaceName, DwnMethodName } from '../../src/enums/dwn-interface-method.js';
+import { ENCRYPTION_CONTROL_AUDIENCE_PATH, ENCRYPTION_CONTROL_DELIVERY_PATH } from '../../src/core/constants.js';
 import { createTestValidationStateReader } from '../utils/test-validation-state-reader.js';
 export function testRecordsQueryHandler() {
     describe('RecordsQueryHandler.handle()', () => {
@@ -57,6 +63,64 @@ export function testRecordsQueryHandler() {
             afterAll(async () => {
                 await dwn.close();
             });
+            async function installAudienceProjectionProtocol(author, protocol) {
+                const protocolDefinition = {
+                    protocol,
+                    published: false,
+                    types: {
+                        member: { schema: 'http://member-schema', dataFormats: ['application/json'] },
+                    },
+                    structure: {
+                        member: {
+                            $role: true,
+                            $actions: [{ who: 'anyone', can: ['create'] }],
+                        },
+                    },
+                };
+                const encryptedDefinition = await installEncryptedProtocol(dwn, author, protocolDefinition);
+                return {
+                    protocolDefinition,
+                    encryptedDefinition,
+                    roleRuleSet: encryptedDefinition.structure.member,
+                };
+            }
+            async function createAudienceControlWriteWithFreshKey(input) {
+                const audienceKeyPersona = await TestDataGenerator.generateDidKeyPersona();
+                const publicKeyJwk = audienceKeyPersona.encryptionKeyPair.publicJwk;
+                const keyId = await Encryption.getKeyId(publicKeyJwk);
+                return createAudienceControlWrite({
+                    author: input.author,
+                    dateCreated: input.dateCreated,
+                    delegatedGrant: input.delegatedGrant,
+                    payloadOverrides: { keyId, publicKeyJwk },
+                    protocol: input.protocol,
+                    rolePath: 'member',
+                    roleRuleSet: input.roleRuleSet,
+                    signer: input.signer,
+                    tags: { keyId },
+                });
+            }
+            async function queryAudienceRecordIds(input) {
+                const tags = {
+                    protocol: input.protocol,
+                    rolePath: 'member',
+                    contextId: '',
+                };
+                if (input.keyId !== undefined) {
+                    tags.keyId = input.keyId;
+                }
+                const query = await RecordsQuery.create({
+                    filter: {
+                        protocol: input.protocol,
+                        protocolPath: ENCRYPTION_CONTROL_AUDIENCE_PATH,
+                        tags,
+                    },
+                    signer: Jws.createSigner(input.requester),
+                });
+                const reply = await dwn.processMessage(input.tenant, query.message);
+                expect(reply.status.code).toBe(200);
+                return reply.entries?.map(entry => entry.recordId) ?? [];
+            }
             it('should reject when published is set to false with a dateSort set to sorting by `PublishedAscending` or `PublishedDescending`', async () => {
                 const alice = await TestDataGenerator.generatePersona();
                 TestStubGenerator.stubDidResolver(didResolver, [alice]);
@@ -129,6 +193,503 @@ export function testRecordsQueryHandler() {
                 expect(reply2.status.code).toBe(200);
                 expect(reply2.entries?.length).toBe(1); // only 1 entry should match the query
             });
+            it('should allow exact-tuple audience control queries without broad enumeration', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const protocolDefinition = {
+                    protocol: 'http://encryption-control-query-audience.xyz',
+                    published: false,
+                    types: {
+                        member: { schema: 'http://member-schema', dataFormats: ['application/json'] },
+                    },
+                    structure: {
+                        member: { $role: true },
+                    },
+                };
+                const encryptedDefinition = await installEncryptedProtocol(dwn, alice, protocolDefinition);
+                const audience = await createAudienceControlWrite({
+                    author: alice,
+                    protocol: protocolDefinition.protocol,
+                    rolePath: 'member',
+                    roleRuleSet: encryptedDefinition.structure.member,
+                });
+                await processControlWrite(dwn, alice.did, audience);
+                const exactQuery = await RecordsQuery.create({
+                    filter: {
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: ENCRYPTION_CONTROL_AUDIENCE_PATH,
+                        tags: {
+                            protocol: protocolDefinition.protocol,
+                            rolePath: 'member',
+                            contextId: '',
+                        },
+                    },
+                    signer: Jws.createSigner(bob),
+                });
+                const exactReply = await dwn.processMessage(alice.did, exactQuery.message);
+                expect(exactReply.status.code).toBe(200);
+                expect(exactReply.entries?.map(entry => entry.recordId)).toEqual([audience.recordsWrite.message.recordId]);
+                const broadQuery = await RecordsQuery.create({
+                    filter: { protocol: protocolDefinition.protocol },
+                    signer: Jws.createSigner(bob),
+                });
+                const broadReply = await dwn.processMessage(alice.did, broadQuery.message);
+                expect(broadReply.status.code).toBe(200);
+                expect(broadReply.entries?.map(entry => entry.recordId)).not.toContain(audience.recordsWrite.message.recordId);
+            });
+            it('should allow grant-backed audience control enumeration', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const protocolDefinition = {
+                    protocol: 'http://encryption-control-query-grant-enumeration.xyz',
+                    published: false,
+                    types: {
+                        member: { schema: 'http://member-schema', dataFormats: ['application/json'] },
+                    },
+                    structure: {
+                        member: { $role: true },
+                    },
+                };
+                const encryptedDefinition = await installEncryptedProtocol(dwn, alice, protocolDefinition);
+                const audience = await createAudienceControlWrite({
+                    author: alice,
+                    protocol: protocolDefinition.protocol,
+                    rolePath: 'member',
+                    roleRuleSet: encryptedDefinition.structure.member,
+                });
+                await processControlWrite(dwn, alice.did, audience);
+                const grant = await TestDataGenerator.generateGrantCreate({
+                    author: alice,
+                    grantedTo: bob,
+                    scope: {
+                        interface: DwnInterfaceName.Records,
+                        method: DwnMethodName.Read,
+                        protocol: protocolDefinition.protocol,
+                    },
+                });
+                expect((await dwn.processMessage(alice.did, grant.message, { dataStream: grant.dataStream })).status.code).toBe(202);
+                const query = await RecordsQuery.create({
+                    filter: { protocol: protocolDefinition.protocol },
+                    permissionGrantId: grant.message.recordId,
+                    signer: Jws.createSigner(bob),
+                });
+                const reply = await dwn.processMessage(alice.did, query.message);
+                expect(reply.status.code).toBe(200);
+                expect(reply.entries?.map(entry => entry.recordId)).toContain(audience.recordsWrite.message.recordId);
+            });
+            it('should hide stale audience control records from delegated broad queries', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const protocolDefinition = {
+                    protocol: 'http://encryption-control-query-stale-audience.xyz',
+                    published: false,
+                    types: {
+                        member: { schema: 'http://member-schema', dataFormats: ['application/json'] },
+                    },
+                    structure: {
+                        member: { $role: true },
+                    },
+                };
+                const encryptedDefinition = await installEncryptedProtocol(dwn, alice, protocolDefinition);
+                const audience = await createAudienceControlWrite({
+                    author: alice,
+                    protocol: protocolDefinition.protocol,
+                    rolePath: 'member',
+                    roleRuleSet: encryptedDefinition.structure.member,
+                });
+                await processControlWrite(dwn, alice.did, audience);
+                await installEncryptedProtocol(dwn, alice, {
+                    ...protocolDefinition,
+                    structure: {
+                        member: {},
+                    },
+                });
+                const grant = await TestDataGenerator.generateGrantCreate({
+                    author: alice,
+                    grantedTo: bob,
+                    delegated: true,
+                    scope: {
+                        interface: DwnInterfaceName.Records,
+                        method: DwnMethodName.Read,
+                        protocol: protocolDefinition.protocol,
+                    },
+                });
+                expect((await dwn.processMessage(alice.did, grant.message, { dataStream: grant.dataStream })).status.code).toBe(202);
+                const query = await RecordsQuery.create({
+                    delegatedGrant: grant.dataEncodedMessage,
+                    filter: { protocol: protocolDefinition.protocol },
+                    signer: Jws.createSigner(bob),
+                });
+                const reply = await dwn.processMessage(alice.did, query.message);
+                expect(reply.status.code).toBe(200);
+                expect(reply.entries?.map(entry => entry.recordId)).not.toContain(audience.recordsWrite.message.recordId);
+            });
+            it('should project current audience records deterministically across ingestion order', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const carol = await TestDataGenerator.generateDidKeyPersona();
+                const { protocolDefinition, roleRuleSet } = await installAudienceProjectionProtocol(alice, 'http://encryption-control-query-current-deterministic.xyz');
+                const dateCreated = Time.createOffsetTimestamp({ seconds: 1 });
+                const firstAudience = await createAudienceControlWriteWithFreshKey({
+                    author: bob,
+                    dateCreated,
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                const secondAudience = await createAudienceControlWriteWithFreshKey({
+                    author: carol,
+                    dateCreated,
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                const expectedRecordId = [firstAudience.recordsWrite.message.recordId, secondAudience.recordsWrite.message.recordId].sort()[0];
+                await processControlWrite(dwn, alice.did, firstAudience);
+                await processControlWrite(dwn, alice.did, secondAudience);
+                const firstOrderRecordIds = await queryAudienceRecordIds({
+                    tenant: alice.did,
+                    requester: alice,
+                    protocol: protocolDefinition.protocol,
+                });
+                await messageStore.clear();
+                await dataStore.clear();
+                await resumableTaskStore.clear();
+                await installEncryptedProtocol(dwn, alice, {
+                    ...protocolDefinition,
+                    structure: {
+                        member: {
+                            $role: true,
+                            $actions: [{ who: 'anyone', can: ['create'] }],
+                        },
+                    },
+                });
+                await processControlWrite(dwn, alice.did, secondAudience);
+                await processControlWrite(dwn, alice.did, firstAudience);
+                const secondOrderRecordIds = await queryAudienceRecordIds({
+                    tenant: alice.did,
+                    requester: alice,
+                    protocol: protocolDefinition.protocol,
+                });
+                expect(firstOrderRecordIds).toEqual([expectedRecordId]);
+                expect(secondOrderRecordIds).toEqual([expectedRecordId]);
+            });
+            it('should prefer tenant-signed audience records and treat author-delegated mints as non-tenant', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const carol = await TestDataGenerator.generateDidKeyPersona();
+                const { protocolDefinition, roleRuleSet } = await installAudienceProjectionProtocol(alice, 'http://encryption-control-query-current-tenant-precedence.xyz');
+                const nonTenantAudience = await createAudienceControlWriteWithFreshKey({
+                    author: bob,
+                    dateCreated: Time.createOffsetTimestamp({ seconds: 1 }),
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, nonTenantAudience);
+                const grant = await TestDataGenerator.generateGrantCreate({
+                    author: alice,
+                    grantedTo: carol,
+                    delegated: true,
+                    scope: {
+                        interface: DwnInterfaceName.Records,
+                        method: DwnMethodName.Write,
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: 'member',
+                    },
+                });
+                expect((await dwn.processMessage(alice.did, grant.message, { dataStream: grant.dataStream })).status.code).toBe(202);
+                const delegatedAudience = await createAudienceControlWriteWithFreshKey({
+                    author: alice,
+                    dateCreated: Time.createOffsetTimestamp({ seconds: 2 }),
+                    delegatedGrant: grant.dataEncodedMessage,
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                    signer: carol,
+                });
+                await processControlWrite(dwn, alice.did, delegatedAudience);
+                expect(await queryAudienceRecordIds({
+                    tenant: alice.did,
+                    requester: alice,
+                    protocol: protocolDefinition.protocol,
+                })).toEqual([nonTenantAudience.recordsWrite.message.recordId]);
+                const tenantAudience = await createAudienceControlWriteWithFreshKey({
+                    author: alice,
+                    dateCreated: Time.createOffsetTimestamp({ seconds: 3 }),
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, tenantAudience);
+                expect(await queryAudienceRecordIds({
+                    tenant: alice.did,
+                    requester: alice,
+                    protocol: protocolDefinition.protocol,
+                })).toEqual([tenantAudience.recordsWrite.message.recordId]);
+                const pagedQuery = await RecordsQuery.create({
+                    filter: {
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: ENCRYPTION_CONTROL_AUDIENCE_PATH,
+                        tags: {
+                            protocol: protocolDefinition.protocol,
+                            rolePath: 'member',
+                            contextId: '',
+                        },
+                    },
+                    pagination: { limit: 1 },
+                    signer: Jws.createSigner(alice),
+                });
+                const pagedReply = await dwn.processMessage(alice.did, pagedQuery.message);
+                expect(pagedReply.status.code).toBe(200);
+                expect(pagedReply.entries?.map(entry => entry.recordId)).toEqual([tenantAudience.recordsWrite.message.recordId]);
+            });
+            it('should use oldest dateCreated for non-tenant audience projection and make later floods inert', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const { protocolDefinition, roleRuleSet } = await installAudienceProjectionProtocol(alice, 'http://encryption-control-query-current-date-order.xyz');
+                const oldestAuthor = await TestDataGenerator.generateDidKeyPersona();
+                const oldestAudience = await createAudienceControlWriteWithFreshKey({
+                    author: oldestAuthor,
+                    dateCreated: Time.createOffsetTimestamp({ seconds: 1 }),
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, oldestAudience);
+                for (let i = 0; i < 8; i++) {
+                    const floodAuthor = await TestDataGenerator.generateDidKeyPersona();
+                    const floodAudience = await createAudienceControlWriteWithFreshKey({
+                        author: floodAuthor,
+                        dateCreated: Time.createOffsetTimestamp({ seconds: i + 2 }),
+                        protocol: protocolDefinition.protocol,
+                        roleRuleSet,
+                    });
+                    await processControlWrite(dwn, alice.did, floodAudience);
+                }
+                expect(await queryAudienceRecordIds({
+                    tenant: alice.did,
+                    requester: alice,
+                    protocol: protocolDefinition.protocol,
+                })).toEqual([oldestAudience.recordsWrite.message.recordId]);
+            });
+            it('should bypass current-key projection for exact keyId queries and RecordsRead by recordId', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const { protocolDefinition, roleRuleSet } = await installAudienceProjectionProtocol(alice, 'http://encryption-control-query-current-exact-bypass.xyz');
+                const loserAudience = await createAudienceControlWriteWithFreshKey({
+                    author: bob,
+                    dateCreated: Time.createOffsetTimestamp({ seconds: 1 }),
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, loserAudience);
+                const tenantAudience = await createAudienceControlWriteWithFreshKey({
+                    author: alice,
+                    dateCreated: Time.createOffsetTimestamp({ seconds: 2 }),
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, tenantAudience);
+                expect(await queryAudienceRecordIds({
+                    tenant: alice.did,
+                    requester: alice,
+                    protocol: protocolDefinition.protocol,
+                    keyId: loserAudience.keyId,
+                })).toEqual([loserAudience.recordsWrite.message.recordId]);
+                const recordsRead = await RecordsRead.create({
+                    filter: { recordId: loserAudience.recordsWrite.message.recordId },
+                    signer: Jws.createSigner(alice),
+                });
+                const readReply = await dwn.processMessage(alice.did, recordsRead.message);
+                expect(readReply.status.code).toBe(200);
+                expect(readReply.entry?.recordsWrite?.recordId).toBe(loserAudience.recordsWrite.message.recordId);
+            });
+            it('should not inject a current audience record that does not match an enumeration filter', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const { protocolDefinition, roleRuleSet } = await installAudienceProjectionProtocol(alice, 'http://encryption-control-query-current-range-filter.xyz');
+                const currentDateCreated = Time.createOffsetTimestamp({ seconds: 1 });
+                const loserDateCreated = Time.createOffsetTimestamp({ seconds: 2 });
+                const currentAudience = await createAudienceControlWriteWithFreshKey({
+                    author: alice,
+                    dateCreated: currentDateCreated,
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, currentAudience);
+                const loserAudience = await createAudienceControlWriteWithFreshKey({
+                    author: bob,
+                    dateCreated: loserDateCreated,
+                    protocol: protocolDefinition.protocol,
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, loserAudience);
+                const rangeFilter = {
+                    protocol: protocolDefinition.protocol,
+                    protocolPath: ENCRYPTION_CONTROL_AUDIENCE_PATH,
+                    dateCreated: { from: loserDateCreated },
+                    tags: {
+                        protocol: protocolDefinition.protocol,
+                        rolePath: 'member',
+                        contextId: '',
+                    },
+                };
+                const rangeQuery = await RecordsQuery.create({
+                    filter: rangeFilter,
+                    signer: Jws.createSigner(alice),
+                });
+                const rangeReply = await dwn.processMessage(alice.did, rangeQuery.message);
+                expect(rangeReply.status.code).toBe(200);
+                expect(rangeReply.entries?.map(entry => entry.recordId)).toEqual([]);
+                const exactLoserQuery = await RecordsQuery.create({
+                    filter: {
+                        ...rangeFilter,
+                        tags: {
+                            ...rangeFilter.tags,
+                            keyId: loserAudience.keyId,
+                        },
+                    },
+                    signer: Jws.createSigner(alice),
+                });
+                const exactLoserReply = await dwn.processMessage(alice.did, exactLoserQuery.message);
+                expect(exactLoserReply.status.code).toBe(200);
+                expect(exactLoserReply.entries?.map(entry => entry.recordId)).toEqual([loserAudience.recordsWrite.message.recordId]);
+            });
+            it('should return delivery control records only to the recipient', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const carol = await TestDataGenerator.generateDidKeyPersona();
+                const bobDelegate = await TestDataGenerator.generateDidKeyPersona();
+                const protocolDefinition = {
+                    protocol: 'http://encryption-control-query-delivery.xyz',
+                    published: false,
+                    types: {
+                        member: { schema: 'http://member-schema', dataFormats: ['application/json'] },
+                        message: { schema: 'http://message-schema', dataFormats: ['application/json'] },
+                    },
+                    structure: {
+                        member: { $role: true },
+                        message: {
+                            $actions: [{ role: 'member', can: ['read'] }],
+                        },
+                    },
+                };
+                const encryptedDefinition = await installEncryptedProtocol(dwn, alice, protocolDefinition);
+                const roleRuleSet = encryptedDefinition.structure.member;
+                const audience = await createAudienceControlWrite({
+                    author: alice,
+                    protocol: protocolDefinition.protocol,
+                    rolePath: 'member',
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, audience);
+                const roleRecord = await TestDataGenerator.generateRecordsWrite({
+                    author: alice,
+                    data: Encoder.stringToBytes('bob is a member'),
+                    dataFormat: 'application/json',
+                    protocol: protocolDefinition.protocol,
+                    protocolPath: 'member',
+                    recipient: bob.did,
+                    schema: 'http://member-schema',
+                });
+                expect((await dwn.processMessage(alice.did, roleRecord.message, { dataStream: roleRecord.dataStream })).status.code).toBe(202);
+                const delivery = await createDeliveryControlWrite({
+                    author: alice,
+                    keyId: audience.keyId,
+                    protocol: protocolDefinition.protocol,
+                    recipient: bob.did,
+                    recipientAuthority: EncryptionControlDeliveryRecipientAuthority.RoleHolder,
+                    rolePath: 'member',
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, delivery);
+                const bobQuery = await RecordsQuery.create({
+                    filter: { protocol: protocolDefinition.protocol, protocolPath: ENCRYPTION_CONTROL_DELIVERY_PATH },
+                    signer: Jws.createSigner(bob),
+                });
+                const bobReply = await dwn.processMessage(alice.did, bobQuery.message);
+                expect(bobReply.status.code).toBe(200);
+                expect(bobReply.entries?.map(entry => entry.recordId)).toContain(delivery.recordsWrite.message.recordId);
+                const carolQuery = await RecordsQuery.create({
+                    filter: { protocol: protocolDefinition.protocol, protocolPath: ENCRYPTION_CONTROL_DELIVERY_PATH },
+                    signer: Jws.createSigner(carol),
+                });
+                const carolReply = await dwn.processMessage(alice.did, carolQuery.message);
+                expect(carolReply.status.code).toBe(200);
+                expect(carolReply.entries?.map(entry => entry.recordId)).not.toContain(delivery.recordsWrite.message.recordId);
+                const carolGrant = await TestDataGenerator.generateGrantCreate({
+                    author: alice,
+                    grantedTo: carol,
+                    delegated: true,
+                    scope: {
+                        interface: DwnInterfaceName.Records,
+                        method: DwnMethodName.Read,
+                        protocol: protocolDefinition.protocol,
+                    },
+                });
+                expect((await dwn.processMessage(alice.did, carolGrant.message, { dataStream: carolGrant.dataStream })).status.code).toBe(202);
+                const delegatedCarolQuery = await RecordsQuery.create({
+                    delegatedGrant: carolGrant.dataEncodedMessage,
+                    filter: { protocol: protocolDefinition.protocol, protocolPath: ENCRYPTION_CONTROL_DELIVERY_PATH },
+                    signer: Jws.createSigner(carol),
+                });
+                const delegatedCarolReply = await dwn.processMessage(alice.did, delegatedCarolQuery.message);
+                expect(delegatedCarolReply.status.code).toBe(200);
+                expect(delegatedCarolReply.entries?.map(entry => entry.recordId)).not.toContain(delivery.recordsWrite.message.recordId);
+                const bobDelegateGrant = await TestDataGenerator.generateGrantCreate({
+                    author: bob,
+                    grantedTo: bobDelegate,
+                    delegated: true,
+                    scope: {
+                        interface: DwnInterfaceName.Records,
+                        method: DwnMethodName.Read,
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: 'message',
+                    },
+                });
+                const delegatedBobQuery = await RecordsQuery.create({
+                    delegatedGrant: bobDelegateGrant.dataEncodedMessage,
+                    filter: {
+                        recipient: bob.did,
+                        protocol: protocolDefinition.protocol,
+                        protocolPath: ENCRYPTION_CONTROL_DELIVERY_PATH,
+                        tags: {
+                            protocol: protocolDefinition.protocol,
+                            rolePath: 'member',
+                            contextId: '',
+                            keyId: audience.keyId,
+                        },
+                    },
+                    signer: Jws.createSigner(bobDelegate),
+                });
+                const delegatedBobReply = await dwn.processMessage(alice.did, delegatedBobQuery.message);
+                expect(delegatedBobReply.status.code).toBe(200);
+                expect(delegatedBobReply.entries?.map(entry => entry.recordId)).toContain(delivery.recordsWrite.message.recordId);
+                const carolRoleRecord = await TestDataGenerator.generateRecordsWrite({
+                    author: alice,
+                    data: Encoder.stringToBytes('carol is a member'),
+                    dataFormat: 'application/json',
+                    protocol: protocolDefinition.protocol,
+                    protocolPath: 'member',
+                    recipient: carol.did,
+                    schema: 'http://member-schema',
+                });
+                expect((await dwn.processMessage(alice.did, carolRoleRecord.message, { dataStream: carolRoleRecord.dataStream })).status.code).toBe(202);
+                const carolDelivery = await createDeliveryControlWrite({
+                    author: alice,
+                    keyId: audience.keyId,
+                    protocol: protocolDefinition.protocol,
+                    recipient: carol.did,
+                    recipientAuthority: EncryptionControlDeliveryRecipientAuthority.RoleHolder,
+                    rolePath: 'member',
+                    roleRuleSet,
+                });
+                await processControlWrite(dwn, alice.did, carolDelivery);
+                const pagedDelegatedCarolQuery = await RecordsQuery.create({
+                    dateSort: DateSort.CreatedAscending,
+                    delegatedGrant: carolGrant.dataEncodedMessage,
+                    filter: { protocol: protocolDefinition.protocol, protocolPath: ENCRYPTION_CONTROL_DELIVERY_PATH },
+                    pagination: { limit: 1 },
+                    signer: Jws.createSigner(carol),
+                });
+                const pagedDelegatedCarolReply = await dwn.processMessage(alice.did, pagedDelegatedCarolQuery.message);
+                expect(pagedDelegatedCarolReply.status.code).toBe(200);
+                expect(pagedDelegatedCarolReply.entries?.map(entry => entry.recordId)).toEqual([carolDelivery.recordsWrite.message.recordId]);
+            });
             it('should return `encodedData` if data size is within the spec threshold', async () => {
                 const data = TestDataGenerator.randomBytes(DwnConstant.maxDataSizeAllowedToBeEncoded); // within/on threshold
                 const alice = await TestDataGenerator.generateDidKeyPersona();