@enbox/dwn-sdk-js 0.4.6 → 0.4.7

package/src/core/replication-apply.ts

@@ -1,3 +1,4 @@
+import type { EncryptionControlPath } from './constants.js';
 import type { GenericMessage } from '../types/message-types.js';
 import type { ProgressToken } from '../types/subscriptions.js';
 import type { ProtocolDefinition } from '../types/protocols-types.js';
@@ -9,7 +10,8 @@ import { EncryptionProtocol } from '../protocols/encryption.js';
 import { Message } from './message.js';
 import { ROLE_AUDIENCE_DERIVATION_SCHEME } from '../utils/encryption.js';
 import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
-import { isCrossProtocolRef, parseCrossProtocolRef } from '../utils/protocols.js';
+import { ENCRYPTION_CONTROL_AUDIENCE_PATH, ENCRYPTION_CONTROL_DELIVERY_PATH } from './constants.js';
+import { getRoleAudienceContextId, getRoleContextPrefix, isCrossProtocolRef, parseCrossProtocolRef } from '../utils/protocols.js';
 
 export type ReplicationApplyOptions = {
   dataStream?: ReadableStream<Uint8Array>;
@@ -42,14 +44,6 @@ export type ReplicationApplyResultContext = {
   missingAncestorRecordIds?: string[];
 };
 
-type AudienceDependencyTags = {
-  protocol: string;
-  contextId: string;
-  role: string;
-  epoch: number;
-  keyId: string;
-};
-
 export type DependencyRef =
   | { type: 'Protocol'; protocol: string; messageCid?: string; terminal?: boolean }
   | { type: 'InitialWrite'; recordId: string; protocol?: string; messageCid?: string; terminal?: boolean }
@@ -59,7 +53,16 @@ export type DependencyRef =
   | { type: 'Grant'; permissionGrantId: string; messageCid?: string; terminal?: boolean }
   | {
       type: 'EncryptionProtocol';
-      protocolPath: 'audienceEpoch' | 'audienceKey' | 'grantKey';
+      protocolPath: 'grantKey';
+      tags?: Record<string, string | number>;
+      recipient?: string;
+      messageCid?: string;
+      terminal?: boolean;
+    }
+  | {
+      type: 'EncryptionControl';
+      protocol: string;
+      protocolPath: EncryptionControlPath;
       tags?: Record<string, string | number>;
       recipient?: string;
       messageCid?: string;
@@ -197,14 +200,13 @@ function dependencyRefsFromStatus(
   case DwnErrorCode.GrantAuthorizationGrantMissing:
     return toRefList(grantDependencyFromMessage(message));
   case DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound:
-  case DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized:
     return toRefList(roleDependencyFromMessage(message, context));
-  case DwnErrorCode.EncryptionProtocolValidateAudienceEpochMissing:
-    return toRefList(encryptionProtocolDependencyFromMessage(message, EncryptionProtocol.audienceEpochPath));
-  case DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEpochMissing:
-    return toRefList(encryptionProtocolDependencyFromRoleAudienceEntry(message, detail));
-  case DwnErrorCode.EncryptionProtocolValidateAudienceKeyRoleRecordMissing:
-    return toRefList(roleDependencyFromEncryptionAudienceRecipient(message));
+  case DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceMissing:
+    return encryptionAudienceDependenciesFromRoleAudienceEntries(message);
+  case DwnErrorCode.EncryptionControlValidateDeliveryAudienceMissing:
+    return toRefList(encryptionAudienceDependencyFromDelivery(message));
+  case DwnErrorCode.EncryptionControlValidateDeliveryRecipientRoleRecordMissing:
+    return toRefList(roleDependencyFromEncryptionControlDeliveryRecipient(message));
   case DwnErrorCode.RecordsWriteMissingDataInPrevious:
   case DwnErrorCode.RecordsWriteMissingEncodedDataInPrevious:
     return toRefList(recordDataDependencyFromMessage(message));
@@ -373,11 +375,6 @@ function recordDataDependencyFromMessage(message: GenericMessage): DependencyRef
 }
 
 function roleDependencyFromMessage(message: GenericMessage, context: ReplicationApplyResultContext): DependencyRef | undefined {
-  const encryptionRoleDependency = roleDependencyFromEncryptionAudienceWriter(message, context);
-  if (encryptionRoleDependency !== undefined) {
-    return encryptionRoleDependency;
-  }
-
   const descriptor = message.descriptor as Record<string, unknown>;
   const filter = descriptor.filter as Record<string, unknown> | undefined;
   const protocol = descriptor.protocol ?? filter?.protocol;
@@ -405,10 +402,7 @@ function roleDependencyFromMessage(message: GenericMessage, context: Replication
   } else if (typeof filter?.contextId === 'string') {
     contextId = filter.contextId;
   }
-  const roleSegments = roleProtocolPath.split('/').length - 1;
-  const contextPrefix = roleSegments > 0 && contextId !== undefined
-    ? contextId.split('/').slice(0, roleSegments).join('/')
-    : undefined;
+  const contextPrefix = getRoleContextPrefix(roleProtocolPath, contextId);
 
   return {
     type         : 'Role',
@@ -419,20 +413,9 @@ function roleDependencyFromMessage(message: GenericMessage, context: Replication
   };
 }
 
-function encryptionProtocolDependencyFromMessage(
-  message: GenericMessage,
-  protocolPath: Extract<DependencyRef, { type: 'EncryptionProtocol' }>['protocolPath'],
-): DependencyRef | undefined {
-  const tags = encryptionAudienceTagsFromMessage(message);
-  return tags === undefined
-    ? undefined
-    : { type: 'EncryptionProtocol', protocolPath, tags };
-}
-
-function encryptionProtocolDependencyFromRoleAudienceEntry(
+function encryptionAudienceDependenciesFromRoleAudienceEntries(
   message: GenericMessage,
-  detail: string,
-): DependencyRef | undefined {
+): Extract<DependencyRef, { type: 'EncryptionControl' }>[] {
   const descriptor = message.descriptor as Record<string, unknown>;
   const messageContextId = (message as { contextId?: unknown }).contextId;
   const contextId = typeof messageContextId === 'string' ? messageContextId : descriptor.contextId;
@@ -442,113 +425,97 @@ function encryptionProtocolDependencyFromRoleAudienceEntry(
     };
   }).encryption?.keyEncryption;
   if (typeof contextId !== 'string' || !Array.isArray(keyEncryption)) {
-    return undefined;
+    return [];
   }
 
-  const missingRole = /role '([^']+)'/.exec(detail)?.[1];
-  const entry = keyEncryption.find((candidate): boolean =>
+  const refs: Extract<DependencyRef, { type: 'EncryptionControl' }>[] = [];
+  const sourceEntries = keyEncryption.filter((candidate): boolean =>
     candidate.derivationScheme === ROLE_AUDIENCE_DERIVATION_SCHEME &&
     typeof candidate.protocol === 'string' &&
-    typeof candidate.role === 'string' &&
-    (missingRole === undefined || candidate.role === missingRole) &&
-    typeof candidate.epoch === 'number' &&
+    typeof candidate.rolePath === 'string' &&
     typeof candidate.keyId === 'string'
   );
-  if (entry === undefined) {
-    return undefined;
-  }
+  for (const sourceEntry of sourceEntries) {
+    const rolePath = sourceEntry.rolePath as string;
+    const audienceContextId = getRoleAudienceContextId(rolePath, contextId);
+    if (audienceContextId === undefined) {
+      continue;
+    }
 
-  const role = entry.role as string;
-  const audienceContextId = roleAudienceContextId(role, contextId);
-  if (audienceContextId === undefined) {
-    return undefined;
+    refs.push({
+      type         : 'EncryptionControl',
+      protocol     : sourceEntry.protocol as string,
+      protocolPath : ENCRYPTION_CONTROL_AUDIENCE_PATH,
+      tags         : {
+        protocol  : sourceEntry.protocol as string,
+        rolePath,
+        contextId : audienceContextId,
+        keyId     : sourceEntry.keyId as string,
+      },
+    });
   }
 
-  return {
-    type         : 'EncryptionProtocol',
-    protocolPath : EncryptionProtocol.audienceEpochPath,
-    tags         : {
-      protocol  : entry.protocol as string,
-      contextId : audienceContextId,
-      role,
-      epoch     : entry.epoch as number,
-      keyId     : entry.keyId as string,
-    },
-  };
+  return refs;
 }
 
-function roleDependencyFromEncryptionAudienceRecipient(message: GenericMessage): DependencyRef | undefined {
-  const tags = encryptionAudienceTagsFromMessage(message);
-  const recipient = (message.descriptor as Record<string, unknown>).recipient;
-  if (tags === undefined || typeof recipient !== 'string') {
+function encryptionAudienceDependencyFromDelivery(
+  message: GenericMessage,
+): Extract<DependencyRef, { type: 'EncryptionControl' }> | undefined {
+  const descriptor = message.descriptor as Record<string, unknown>;
+  if (descriptor.protocolPath !== ENCRYPTION_CONTROL_DELIVERY_PATH) {
     return undefined;
   }
 
-  return {
-    type         : 'Role',
-    protocol     : tags.protocol,
-    protocolPath : tags.role,
-    recipient,
-    ...(tags.contextId === '' ? {} : { contextPrefix: tags.contextId }),
-  };
-}
-
-function roleDependencyFromEncryptionAudienceWriter(
-  message: GenericMessage,
-  context: ReplicationApplyResultContext,
-): DependencyRef | undefined {
-  const tags = encryptionAudienceTagsFromMessage(message);
-  const protocolRole = getSignaturePayload(message)?.protocolRole;
-  const recipient = Message.getAuthor(message);
-  if (tags === undefined || typeof protocolRole !== 'string' || recipient === undefined) {
+  const tags = descriptor.tags;
+  if (!isRecordObject(tags)) {
     return undefined;
   }
 
-  let roleProtocol = tags.protocol;
-  let roleProtocolPath = protocolRole;
-  if (isCrossProtocolRef(protocolRole)) {
-    const parsed = parseCrossProtocolRef(protocolRole);
-    const referencedProtocol = parsed === undefined ? undefined : context.protocolDefinition?.uses?.[parsed.alias];
-    if (parsed === undefined || referencedProtocol === undefined) {
-      return undefined;
-    }
-
-    roleProtocol = referencedProtocol;
-    roleProtocolPath = parsed.protocolPath;
+  const { protocol, rolePath, contextId, keyId } = tags;
+  if (
+    typeof protocol !== 'string' ||
+    typeof rolePath !== 'string' ||
+    typeof contextId !== 'string' ||
+    typeof keyId !== 'string'
+  ) {
+    return undefined;
   }
 
-  const contextPrefix = roleContextPrefix(roleProtocolPath, tags.contextId);
   return {
-    type         : 'Role',
-    protocol     : roleProtocol,
-    protocolPath : roleProtocolPath,
-    recipient,
-    ...(contextPrefix === undefined ? {} : { contextPrefix }),
+    type         : 'EncryptionControl',
+    protocol,
+    protocolPath : ENCRYPTION_CONTROL_AUDIENCE_PATH,
+    tags         : { protocol, rolePath, contextId, keyId },
   };
 }
 
-function encryptionAudienceTagsFromMessage(message: GenericMessage): AudienceDependencyTags | undefined {
-  if (!isEncryptionProtocolMessage(message)) {
+function roleDependencyFromEncryptionControlDeliveryRecipient(message: GenericMessage): DependencyRef | undefined {
+  const descriptor = message.descriptor as Record<string, unknown>;
+  if (descriptor.protocolPath !== ENCRYPTION_CONTROL_DELIVERY_PATH || typeof descriptor.recipient !== 'string') {
     return undefined;
   }
 
-  const tags = (message.descriptor as Record<string, unknown>).tags;
+  const tags = descriptor.tags;
   if (!isRecordObject(tags)) {
     return undefined;
   }
 
-  const { protocol, contextId, role, epoch, keyId } = tags;
+  const { protocol, rolePath, contextId } = tags;
   if (
     typeof protocol !== 'string' ||
-    typeof contextId !== 'string' ||
-    typeof role !== 'string' ||
-    typeof epoch !== 'number' ||
-    typeof keyId !== 'string'
+    typeof rolePath !== 'string' ||
+    typeof contextId !== 'string'
   ) {
     return undefined;
   }
 
-  return { protocol, contextId, role, epoch, keyId };
+  return {
+    type         : 'Role',
+    protocol,
+    protocolPath : rolePath,
+    recipient    : descriptor.recipient,
+    ...(contextId === '' ? {} : { contextPrefix: contextId }),
+  };
 }
 
 function dependencyProtocolFromMessage(message: GenericMessage): string | undefined {
@@ -570,29 +537,6 @@ function isEncryptionProtocolMessage(message: GenericMessage): boolean {
     descriptor.protocol === EncryptionProtocol.uri;
 }
 
-function roleContextPrefix(rolePath: string, contextId: string): string | undefined {
-  const roleSegments = rolePath.split('/').length - 1;
-  if (roleSegments === 0 || contextId === '') {
-    return undefined;
-  }
-
-  return contextId.split('/').slice(0, roleSegments).join('/');
-}
-
-function roleAudienceContextId(rolePath: string, contextId: string): string | undefined {
-  const roleSegments = rolePath.split('/').length - 1;
-  if (roleSegments === 0) {
-    return '';
-  }
-
-  const contextSegments = contextId.split('/');
-  if (contextSegments.length < roleSegments) {
-    return undefined;
-  }
-
-  return contextSegments.slice(0, roleSegments).join('/');
-}
-
 function isRecordObject(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null;
 }

package/src/core/validation-state-reader.ts

@@ -7,7 +7,7 @@ import type { ValidationStateReader } from '../types/validation-state-reader.js'
 import type { DataEncodedRecordsWriteMessage, RecordsWriteMessage } from '../types/records-types.js';
 import type { ProtocolDefinition, ProtocolsConfigureMessage } from '../types/protocols-types.js';
 
-import { ENCRYPTION_PROTOCOL_URI } from './constants.js';
+import { ENCRYPTION_CONTROL_AUDIENCE_PATH } from './constants.js';
 import { FilterUtility } from '../utils/filter.js';
 import { PermissionGrant } from '../protocols/permission-grant.js';
 import { PermissionsProtocol } from '../protocols/permissions.js';
@@ -167,24 +167,22 @@ export class StoreValidationStateReader implements ValidationStateReader {
   }
 
   /** @inheritdoc */
-  public async queryAudienceEpochs(input: {
+  public async queryAudienceRecords(input: {
     tenant: string;
     protocol: string;
+    rolePath: string;
     contextId: string;
-    role: string;
-    epoch: number;
     keyId?: string;
   }): Promise<RecordsWriteMessage[]> {
     const filter: Filter = {
       interface         : DwnInterfaceName.Records,
       method            : DwnMethodName.Write,
       isLatestBaseState : true,
-      protocol          : ENCRYPTION_PROTOCOL_URI,
-      protocolPath      : 'audienceEpoch',
+      protocol          : input.protocol,
+      protocolPath      : ENCRYPTION_CONTROL_AUDIENCE_PATH,
       'tag.protocol'    : input.protocol,
+      'tag.rolePath'    : input.rolePath,
       'tag.contextId'   : input.contextId,
-      'tag.role'        : input.role,
-      'tag.epoch'       : input.epoch,
     };
 
     if (input.keyId !== undefined) {

package/src/dwn.ts

@@ -495,8 +495,7 @@ export class Dwn {
   ): Promise<ProtocolDefinition | undefined> {
     const detail = reply.status.detail ?? '';
     if (
-      !detail.startsWith(`${DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound}:`) &&
-      !detail.startsWith(`${DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized}:`)
+      !detail.startsWith(`${DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound}:`)
     ) {
       return undefined;
     }

package/src/event-stream/event-emitter-wake-publisher.ts

@@ -1,11 +1,5 @@
 import type { Wake, WakePublisher } from '../types/subscriptions.js';
 
-import mitt from 'mitt';
-
-const WAKE_CHANNEL = 'wake';
-
-type WakeEvents = Record<string, Wake>;
-
 export type WakeListener = (wake: Wake) => void;
 
 /**
@@ -13,22 +7,24 @@ export type WakeListener = (wake: Wake) => void;
  * failures must not affect the write path that already committed the row.
  */
 export class EventEmitterWakePublisher implements WakePublisher {
-  private readonly emitter = mitt<WakeEvents>();
+  private readonly listeners = new Set<WakeListener>();
 
   public publish(wake: Wake): void {
-    try {
-      this.emitter.emit(WAKE_CHANNEL, wake);
-    } catch {
-      // Best-effort by contract.
+    for (const listener of Array.from(this.listeners)) {
+      try {
+        listener(wake);
+      } catch {
+        // Best-effort by contract.
+      }
     }
   }
 
   public subscribe(listener: WakeListener): () => void {
-    this.emitter.on(WAKE_CHANNEL, listener);
-    return (): void => { this.emitter.off(WAKE_CHANNEL, listener); };
+    this.listeners.add(listener);
+    return (): void => { this.listeners.delete(listener); };
   }
 
   public clear(): void {
-    this.emitter.all.clear();
+    this.listeners.clear();
   }
 }

package/src/handlers/messages-query.ts

@@ -79,28 +79,12 @@ export class MessagesQueryHandler implements MethodHandler {
     tenant: string,
     messagesQuery: MessagesQuery,
   ): Promise<void> {
-    if (messagesQuery.author === tenant) {
-      return;
-    }
-
-    const permissionGrantIds = Message.getPermissionGrantIds(messagesQuery.signaturePayload!);
-    if (messagesQuery.author !== undefined && permissionGrantIds.length > 0) {
-      const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(
-        tenant,
-        this.deps.validationStateReader,
-        permissionGrantIds
-      );
-      await MessagesGrantAuthorization.authorizeQueryOrSubscribe({
-        incomingMessage       : messagesQuery.message,
-        expectedGrantor       : tenant,
-        expectedGrantee       : messagesQuery.author,
-        permissionGrants,
-        validationStateReader : this.deps.validationStateReader
-      });
-      return;
-    }
-
-    throw new DwnError(DwnErrorCode.MessagesQueryAuthorizationFailed, 'message failed authorization');
+    await MessagesGrantAuthorization.authorizeQueryOrSubscribeInvocation({
+      tenant                : tenant,
+      incomingMessage       : messagesQuery.message,
+      validationStateReader : this.deps.validationStateReader,
+      failureCode           : DwnErrorCode.MessagesQueryAuthorizationFailed,
+    });
   }
 
   private static asReplicationFeedReader(candidate: unknown): ReplicationFeedReader | undefined {

package/src/handlers/messages-read.ts

@@ -80,19 +80,20 @@ export class MessagesReadHandler implements MethodHandler {
     deps: HandlerDependencies
   ): Promise<void> {
 
-    if (messagesRead.author === tenant) {
+    const requester = Message.getRequester(messagesRead.message);
+    if (messagesRead.author === tenant && requester === tenant) {
       // If the author is the tenant, no further authorization is needed
       return;
     }
 
     const permissionGrantIds = Message.getPermissionGrantIds(messagesRead.signaturePayload!);
-    if (messagesRead.author !== undefined && permissionGrantIds.length > 0) {
+    if (requester !== undefined && permissionGrantIds.length > 0) {
       const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(tenant, deps.validationStateReader, permissionGrantIds);
       await MessagesGrantAuthorization.authorizeMessagesRead({
         messagesReadMessage   : messagesRead.message,
         messageToRead         : matchedMessage,
         expectedGrantor       : tenant,
-        expectedGrantee       : messagesRead.author,
+        expectedGrantee       : requester,
         permissionGrants,
         validationStateReader : deps.validationStateReader
       });

package/src/handlers/messages-subscribe.ts

@@ -63,8 +63,8 @@ export class MessagesSubscribeHandler implements MethodHandler {
 
     const guardedHandler = MessagesSubscribeHandler.createAuthorizationGuard({
       authorization,
+      deps: this.deps,
       messagesSubscribe,
-      validationStateReader: this.deps.validationStateReader,
       subscriptionHandler,
     });
 
@@ -100,39 +100,31 @@ export class MessagesSubscribeHandler implements MethodHandler {
     messagesSubscribe: MessagesSubscribe,
     deps: HandlerDependencies
   ): Promise<MessagesSubscribeAuthorization> {
-    // if `MessagesSubscribe` author is the same as the target tenant, we can directly grant access
-    if (messagesSubscribe.author === tenant) {
+    const grantSet = await MessagesGrantAuthorization.authorizeQueryOrSubscribeInvocation({
+      tenant                : tenant,
+      incomingMessage       : messagesSubscribe.message,
+      validationStateReader : deps.validationStateReader,
+      failureCode           : DwnErrorCode.MessagesSubscribeAuthorizationFailed,
+    });
+    if (grantSet === undefined) {
       return { kind: 'owner' };
     }
 
-    const permissionGrantIds = Message.getPermissionGrantIds(messagesSubscribe.signaturePayload!);
-    if (messagesSubscribe.author !== undefined && permissionGrantIds.length > 0) {
-      const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(tenant, deps.validationStateReader, permissionGrantIds);
-      await MessagesGrantAuthorization.authorizeQueryOrSubscribe({
-        incomingMessage       : messagesSubscribe.message,
-        expectedGrantor       : tenant,
-        expectedGrantee       : messagesSubscribe.author,
-        permissionGrants,
-        validationStateReader : deps.validationStateReader
-      });
-      return {
-        kind            : 'delegate',
-        expectedGrantor : tenant,
-        expectedGrantee : messagesSubscribe.author,
-        permissionGrants,
-      };
-    } else {
-      throw new DwnError(DwnErrorCode.MessagesSubscribeAuthorizationFailed, 'message failed authorization');
-    }
+    return {
+      kind             : 'delegate',
+      expectedGrantor  : tenant,
+      expectedGrantee  : grantSet.requester,
+      permissionGrants : grantSet.permissionGrants,
+    };
   }
 
   private static createAuthorizationGuard(input: {
     authorization: MessagesSubscribeAuthorization;
+    deps: HandlerDependencies;
     messagesSubscribe: MessagesSubscribe;
-    validationStateReader: HandlerDependencies['validationStateReader'];
     subscriptionHandler: SubscriptionListener;
   }): GuardedSubscriptionHandler {
-    const { authorization, messagesSubscribe, validationStateReader, subscriptionHandler } = input;
+    const { authorization, deps, messagesSubscribe, subscriptionHandler } = input;
     if (authorization.kind === 'owner') {
       return {
         listener        : subscriptionHandler,
@@ -153,7 +145,7 @@ export class MessagesSubscribeHandler implements MethodHandler {
       Promise.resolve(subscription?.close()).catch(() => {});
     };
 
-    const emitTerminalAuthorizationError = (cursor: SubscriptionEvent['cursor']): void => {
+    const emitTerminalDeliveryError = (cursor: SubscriptionEvent['cursor'], code: DwnErrorCode, detail: string): void => {
       if (terminalErrorEmitted) {
         return;
       }
@@ -162,8 +154,8 @@ export class MessagesSubscribeHandler implements MethodHandler {
         type  : 'error',
         cursor,
         error : {
-          code   : DwnErrorCode.MessagesSubscribeDeliveryAuthorizationFailed,
-          detail : 'subscription authorization failed during delivery',
+          code,
+          detail,
         },
       });
     };
@@ -181,11 +173,23 @@ export class MessagesSubscribeHandler implements MethodHandler {
           expectedGrantor          : authorization.expectedGrantor,
           expectedGrantee          : authorization.expectedGrantee,
           permissionGrants         : authorization.permissionGrants,
-          validationStateReader,
+          validationStateReader    : deps.validationStateReader,
           deliveryTimestamp        : Time.getCurrentTimestamp(),
         });
-      } catch {
-        emitTerminalAuthorizationError(subMessage.cursor);
+      } catch (error) {
+        if (error instanceof DwnError) {
+          emitTerminalDeliveryError(
+            subMessage.cursor,
+            DwnErrorCode.MessagesSubscribeDeliveryAuthorizationFailed,
+            'subscription authorization failed during delivery',
+          );
+        } else {
+          emitTerminalDeliveryError(
+            subMessage.cursor,
+            DwnErrorCode.MessagesSubscribeDeliveryFailed,
+            'subscription delivery failed',
+          );
+        }
         closeSubscription();
         return;
       }

package/src/handlers/protocols-configure.ts

@@ -126,8 +126,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     // re-index previously-latest messages as no longer the latest base state.
     for (const existingMessage of existingMessages) {
       if (existingMessage !== newestMessage) {
-        const existingProtocolsConfigure = await ProtocolsConfigure.parse(existingMessage as ProtocolsConfigureMessage);
-        const updatedIndexes = ProtocolsConfigureHandler.constructIndexes(existingProtocolsConfigure, false);
+        const updatedIndexes = ProtocolsConfigureHandler.constructIndexesFromMessage(existingMessage as ProtocolsConfigureMessage, false);
         const existingCid = await Message.getCid(existingMessage);
 
         await this.deps.messageStore.updateIndexes(tenant, existingCid, updatedIndexes);
@@ -140,9 +139,13 @@ export class ProtocolsConfigureHandler implements MethodHandler {
   };
 
   static constructIndexes(protocolsConfigure: ProtocolsConfigure, isLatestBaseState: boolean): { [key: string]: string | boolean } {
+    return ProtocolsConfigureHandler.constructIndexesFromMessage(protocolsConfigure.message, isLatestBaseState);
+  }
+
+  private static constructIndexesFromMessage(message: ProtocolsConfigureMessage, isLatestBaseState: boolean): { [key: string]: string | boolean } {
     // strip out `definition` as it is not indexable
-    const { definition, ...propertiesToIndex } = protocolsConfigure.message.descriptor;
-    const { author } = protocolsConfigure;
+    const { definition, ...propertiesToIndex } = message.descriptor;
+    const author = Message.getAuthor(message);
 
     const indexes: { [key: string]: string | boolean } = {
       ...propertiesToIndex,