@enbox/dwn-sdk-js 0.4.6 → 0.4.7

package/src/handlers/records-count.ts

@@ -3,13 +3,14 @@ import type { HandlerDependencies, MethodHandler } from '../types/method-handler
 import type { RecordsCountMessage, RecordsCountReply } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
-import { countRecordsWithRecordLimitOccupancy } from '../utils/record-limit-occupancy.js';
+import { EncryptionControl } from '../core/encryption-control.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
 import { Records } from '../utils/records.js';
 import { RecordsCount } from '../interfaces/records-count.js';
 import { RecordsGrantAuthorization } from '../core/records-grant-authorization.js';
+import { countRecordsWithRecordLimitOccupancy, queryRecordsWithRecordLimitOccupancy } from '../utils/record-limit-occupancy.js';
 import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 
 export class RecordsCountHandler implements MethodHandler {
@@ -28,10 +29,11 @@ export class RecordsCountHandler implements MethodHandler {
     }
 
     let count: number;
+    const requester = Message.getRequester(recordsCount.message);
 
     // if this is an anonymous count and the filter supports published records, count only published records
     if (Records.filterIncludesPublishedRecords(recordsCount.message.descriptor.filter) && recordsCount.author === undefined) {
-      count = await this.countPublishedRecords(tenant, recordsCount);
+      count = await this.countPublishedRecords(tenant, recordsCount, requester);
     } else {
       // authentication and authorization
       try {
@@ -42,10 +44,12 @@ export class RecordsCountHandler implements MethodHandler {
         return messageReplyFromError(e, 401);
       }
 
-      if (recordsCount.author === tenant) {
+      if (recordsCount.author === tenant && requester === tenant) {
         count = await this.countRecordsAsOwner(tenant, recordsCount);
+      } else if (recordsCount.author === tenant) {
+        count = await this.countRecordsAsOwnerDelegate(tenant, recordsCount, requester);
       } else {
-        count = await this.countRecordsAsNonOwner(tenant, recordsCount);
+        count = await this.countRecordsAsNonOwner(tenant, recordsCount, requester);
       }
     }
 
@@ -70,10 +74,30 @@ export class RecordsCountHandler implements MethodHandler {
     return this.countProjectedRecords(tenant, recordsCount, [countFilter]);
   }
 
+  private async countRecordsAsOwnerDelegate(
+    tenant: string,
+    recordsCount: RecordsCount,
+    requester: string | undefined,
+  ): Promise<number> {
+    const { filter } = recordsCount.message.descriptor;
+    const countFilter = {
+      ...Records.convertFilter(filter),
+      interface         : DwnInterfaceName.Records,
+      method            : DwnMethodName.Write,
+      isLatestBaseState : true
+    };
+
+    return this.countProjectedRecordsForRequester(tenant, recordsCount, requester, [countFilter]);
+  }
+
   /**
    * Counts records as a non-owner, applying the same filter logic as RecordsQuery.
    */
-  private async countRecordsAsNonOwner(tenant: string, recordsCount: RecordsCount): Promise<number> {
+  private async countRecordsAsNonOwner(
+    tenant: string,
+    recordsCount: RecordsCount,
+    requester: string | undefined,
+  ): Promise<number> {
     const { filter } = recordsCount.message.descriptor;
     const filters: Filter[] = [];
 
@@ -82,6 +106,10 @@ export class RecordsCountHandler implements MethodHandler {
     }
 
     if (Records.filterIncludesUnpublishedRecords(filter)) {
+      if (EncryptionControl.isExactAudienceFilter(filter)) {
+        filters.push(Records.buildUnpublishedControlRecordsFilter(filter));
+      }
+
       if (Records.shouldBuildUnpublishedAuthorFilter(filter, recordsCount.author!)) {
         filters.push(RecordsCountHandler.buildUnpublishedRecordsByCountAuthorFilter(recordsCount));
       }
@@ -99,25 +127,89 @@ export class RecordsCountHandler implements MethodHandler {
       }
     }
 
-    return this.countProjectedRecords(tenant, recordsCount, filters);
+    return this.countProjectedRecordsForRequester(tenant, recordsCount, requester, filters);
   }
 
   /**
    * Counts only published records.
    */
-  private async countPublishedRecords(tenant: string, recordsCount: RecordsCount): Promise<number> {
+  private async countPublishedRecords(
+    tenant: string,
+    recordsCount: RecordsCount,
+    requester: string | undefined,
+  ): Promise<number> {
     const filter = RecordsCountHandler.buildPublishedRecordsFilter(recordsCount);
-    return this.countProjectedRecords(tenant, recordsCount, [filter]);
+    return this.countProjectedRecordsForRequester(tenant, recordsCount, requester, [filter]);
   }
 
   private async countProjectedRecords(tenant: string, recordsCount: RecordsCount, filters: Filter[]): Promise<number> {
-    return countRecordsWithRecordLimitOccupancy({
+    const totalCount = await countRecordsWithRecordLimitOccupancy({
       messageStore          : this.deps.messageStore,
       validationStateReader : this.deps.validationStateReader,
       tenant,
       filters,
       messageTimestamp      : recordsCount.message.descriptor.messageTimestamp,
     });
+
+    const audienceFilters = EncryptionControl.buildAudienceRecordFilters(filters);
+    if (audienceFilters.length === 0) {
+      return totalCount;
+    }
+
+    const storedAudienceCount = await this.deps.messageStore.count(tenant, audienceFilters);
+    if (storedAudienceCount === 0) {
+      return totalCount;
+    }
+
+    const { messages } = await this.deps.messageStore.query(tenant, audienceFilters);
+    const projectedAudienceMessages = await EncryptionControl.projectCurrentAudienceRecords({
+      messageStore         : this.deps.messageStore,
+      tenant,
+      recordsWriteMessages : messages.filter(Records.isRecordsWrite),
+      bypassFilters        : audienceFilters,
+    });
+
+    return totalCount - storedAudienceCount + projectedAudienceMessages.length;
+  }
+
+  private async countProjectedRecordsForRequester(
+    tenant: string,
+    recordsCount: RecordsCount,
+    requester: string | undefined,
+    filters: Filter[],
+  ): Promise<number> {
+    const controlFilters = Records.buildControlRecordsFilters(filters);
+    if (controlFilters.length === 0) {
+      return this.countProjectedRecords(tenant, recordsCount, filters);
+    }
+
+    const totalCount = await this.countProjectedRecords(tenant, recordsCount, filters);
+    const controlCount = await this.countProjectedRecords(tenant, recordsCount, controlFilters);
+    if (controlCount === 0) {
+      return totalCount;
+    }
+
+    const { messages } = await queryRecordsWithRecordLimitOccupancy({
+      messageStore          : this.deps.messageStore,
+      validationStateReader : this.deps.validationStateReader,
+      tenant,
+      filters               : controlFilters,
+      messageTimestamp      : recordsCount.message.descriptor.messageTimestamp,
+    });
+    const projectedMessages = await EncryptionControl.projectCurrentAudienceRecords({
+      messageStore         : this.deps.messageStore,
+      tenant,
+      recordsWriteMessages : messages,
+      bypassFilters        : controlFilters,
+    });
+    const visibleMessages = await EncryptionControl.filterVisibleControlRecords({
+      tenant,
+      incomingMessage       : recordsCount.message,
+      requester,
+      recordsWriteMessages  : projectedMessages,
+      validationStateReader : this.deps.validationStateReader,
+    });
+    return totalCount - controlCount + visibleMessages.length;
   }
 
   private static buildPublishedRecordsFilter(recordsCount: RecordsCount): Filter {
@@ -198,8 +290,16 @@ export class RecordsCountHandler implements MethodHandler {
     deps: HandlerDependencies,
   ): Promise<void> {
 
-    if (Message.isSignedByAuthorDelegate(recordsCount.message)) {
+    if (Message.isSignedByAuthorDelegate(recordsCount.message) &&
+        !EncryptionControl.filterTargetsOnlyControlRecords(recordsCount.message.descriptor.filter)) {
       await recordsCount.authorizeDelegate(deps.validationStateReader);
+    } else if (EncryptionControl.filterTargetsOnlyControlRecords(recordsCount.message.descriptor.filter)) {
+      await EncryptionControl.authorizeControlReadRequest({
+        tenant,
+        incomingMessage       : recordsCount.message,
+        requester             : Message.getRequester(recordsCount.message),
+        validationStateReader : deps.validationStateReader,
+      });
     }
 
     const permissionGrantId = Message.getPermissionGrantId(recordsCount.signaturePayload!);
@@ -222,4 +322,5 @@ export class RecordsCountHandler implements MethodHandler {
       await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsCount, deps.validationStateReader);
     }
   }
+
 }

package/src/handlers/records-delete.ts

@@ -6,6 +6,7 @@ import type { HandlerDependencies, MethodHandler } from '../types/method-handler
 
 import { authenticate } from '../core/auth.js';
 import { DwnInterfaceName } from '../enums/dwn-interface-method.js';
+import { EncryptionControl } from '../core/encryption-control.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
@@ -13,6 +14,7 @@ import { Records } from '../utils/records.js';
 import { RecordsDelete } from '../interfaces/records-delete.js';
 import { RecordsGrantAuthorization } from '../core/records-grant-authorization.js';
 import { ResumableTaskName } from '../core/resumable-task-manager.js';
+import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 
 export class RecordsDeleteHandler implements MethodHandler {
 
@@ -71,6 +73,12 @@ export class RecordsDeleteHandler implements MethodHandler {
       // but if the latest record state is a RecordsDelete (ie. when we are pruning a non-prune delete),
       // we'd need to use the initial write because RecordsDelete does not contain the immutable properties needed for processing.
       const initialWrite = await this.deps.validationStateReader.fetchInitialRecordsWrite(tenant, message.descriptor.recordId);
+      if (EncryptionControl.isControlMessage(initialWrite!.message)) {
+        throw new DwnError(
+          DwnErrorCode.EncryptionControlValidateUnexpectedRecord,
+          'encryption control records cannot be deleted.'
+        );
+      }
 
       await this.authorizeRecordsDelete(
         tenant,
@@ -79,6 +87,13 @@ export class RecordsDeleteHandler implements MethodHandler {
       );
 
     } catch (e) {
+      if (e instanceof DwnError) {
+        const statusCode = EncryptionControl.mapErrorToStatusCode(e.code);
+        if (statusCode !== undefined) {
+          return messageReplyFromError(e, statusCode);
+        }
+      }
+
       return messageReplyFromError(e, 401);
     }
 

package/src/handlers/records-query.ts

@@ -5,6 +5,7 @@ import type { RecordsQueryMessage, RecordsQueryReply, RecordsQueryReplyEntry } f
 
 import { authenticate } from '../core/auth.js';
 import { DateSort } from '../types/records-types.js';
+import { EncryptionControl } from '../core/encryption-control.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
@@ -33,9 +34,10 @@ export class RecordsQueryHandler implements MethodHandler {
 
     let recordsWrites: RecordsQueryReplyEntry[];
     let cursor: PaginationCursor | undefined;
+    const requester = Message.getRequester(recordsQuery.message);
     // if this is an anonymous query and the filter supports published records, query only published records
     if (Records.filterIncludesPublishedRecords(recordsQuery.message.descriptor.filter) && recordsQuery.author === undefined) {
-      const results = await this.fetchPublishedRecords(tenant, recordsQuery);
+      const results = await this.fetchPublishedRecords(tenant, recordsQuery, requester);
       recordsWrites = results.messages as RecordsQueryReplyEntry[];
       cursor = results.cursor;
     } else {
@@ -49,11 +51,13 @@ export class RecordsQueryHandler implements MethodHandler {
       }
 
       if (recordsQuery.author === tenant) {
-        const results = await this.fetchRecordsAsOwner(tenant, recordsQuery);
+        const results = requester === tenant
+          ? await this.fetchRecordsAsOwner(tenant, recordsQuery)
+          : await this.fetchRecordsAsOwnerDelegate(tenant, recordsQuery, requester);
         recordsWrites = results.messages as RecordsQueryReplyEntry[];
         cursor = results.cursor;
       } else {
-        const results = await this.fetchRecordsAsNonOwner(tenant, recordsQuery);
+        const results = await this.fetchRecordsAsNonOwner(tenant, recordsQuery, requester);
         recordsWrites = results.messages as RecordsQueryReplyEntry[];
         cursor = results.cursor;
       }
@@ -122,14 +126,37 @@ export class RecordsQueryHandler implements MethodHandler {
     };
 
     const messageSort = this.convertDateSort(dateSort);
-    return queryRecordsWithRecordLimitOccupancy({
-      messageStore          : this.deps.messageStore,
-      validationStateReader : this.deps.validationStateReader,
+    return this.queryRecordsWithVisibleControlFiltering({
       tenant,
-      filters               : [queryFilter],
+      recordsQuery,
+      requester : tenant,
+      filters   : [queryFilter],
+      messageSort,
+      pagination,
+    });
+  }
+
+  private async fetchRecordsAsOwnerDelegate(
+    tenant: string,
+    recordsQuery: RecordsQuery,
+    requester: string | undefined,
+  ): Promise<{ messages: GenericMessage[], cursor?: PaginationCursor }> {
+    const { dateSort, filter, pagination } = recordsQuery.message.descriptor;
+    const queryFilter = {
+      ...Records.convertFilter(filter, dateSort),
+      interface         : DwnInterfaceName.Records,
+      method            : DwnMethodName.Write,
+      isLatestBaseState : true
+    };
+
+    const messageSort = this.convertDateSort(dateSort);
+    return this.queryRecordsWithVisibleControlFiltering({
+      tenant,
+      recordsQuery,
+      requester,
+      filters: [queryFilter],
       messageSort,
       pagination,
-      messageTimestamp      : recordsQuery.message.descriptor.messageTimestamp,
     });
   }
 
@@ -153,7 +180,9 @@ export class RecordsQueryHandler implements MethodHandler {
    *
    */
   private async fetchRecordsAsNonOwner(
-    tenant: string, recordsQuery: RecordsQuery
+    tenant: string,
+    recordsQuery: RecordsQuery,
+    requester: string | undefined,
   ): Promise<{ messages: GenericMessage[], cursor?: PaginationCursor }> {
     const { dateSort, pagination, filter } = recordsQuery.message.descriptor;
     const filters = [];
@@ -162,6 +191,10 @@ export class RecordsQueryHandler implements MethodHandler {
     }
 
     if (Records.filterIncludesUnpublishedRecords(filter)) {
+      if (EncryptionControl.isExactAudienceFilter(filter)) {
+        filters.push(Records.buildUnpublishedControlRecordsFilter(filter, dateSort));
+      }
+
       if (Records.shouldBuildUnpublishedAuthorFilter(filter, recordsQuery.author!)) {
         filters.push(RecordsQueryHandler.buildUnpublishedRecordsByQueryAuthorFilter(recordsQuery));
       }
@@ -180,14 +213,13 @@ export class RecordsQueryHandler implements MethodHandler {
     }
 
     const messageSort = this.convertDateSort(dateSort);
-    return queryRecordsWithRecordLimitOccupancy({
-      messageStore          : this.deps.messageStore,
-      validationStateReader : this.deps.validationStateReader,
+    return this.queryRecordsWithVisibleControlFiltering({
       tenant,
+      recordsQuery,
+      requester,
       filters,
       messageSort,
       pagination,
-      messageTimestamp      : recordsQuery.message.descriptor.messageTimestamp,
     });
   }
 
@@ -195,22 +227,123 @@ export class RecordsQueryHandler implements MethodHandler {
    * Fetches only published records.
    */
   private async fetchPublishedRecords(
-    tenant: string, recordsQuery: RecordsQuery
+    tenant: string,
+    recordsQuery: RecordsQuery,
+    requester: string | undefined,
   ): Promise<{ messages: GenericMessage[], cursor?: PaginationCursor }> {
     const { dateSort, pagination } = recordsQuery.message.descriptor;
     const filter = RecordsQueryHandler.buildPublishedRecordsFilter(recordsQuery);
     const messageSort = this.convertDateSort(dateSort);
-    return queryRecordsWithRecordLimitOccupancy({
-      messageStore          : this.deps.messageStore,
-      validationStateReader : this.deps.validationStateReader,
+    return this.queryRecordsWithVisibleControlFiltering({
       tenant,
-      filters               : [filter],
+      recordsQuery,
+      requester,
+      filters: [filter],
       messageSort,
       pagination,
-      messageTimestamp      : recordsQuery.message.descriptor.messageTimestamp,
     });
   }
 
+  private async queryRecordsWithVisibleControlFiltering(input: {
+    tenant: string;
+    recordsQuery: RecordsQuery;
+    requester: string | undefined;
+    filters: Filter[];
+    messageSort: MessageSort;
+    pagination?: { cursor?: PaginationCursor; limit?: number };
+  }): Promise<{ messages: RecordsQueryReplyEntry[], cursor?: PaginationCursor }> {
+    const {
+      tenant, recordsQuery, requester, filters, messageSort, pagination
+    } = input;
+    const controlFilters = Records.buildControlRecordsFilters(filters);
+    const currentAudienceRecordIdCache = new Map<string, string | undefined>();
+    if (controlFilters.length === 0) {
+      const result = await queryRecordsWithRecordLimitOccupancy({
+        messageStore          : this.deps.messageStore,
+        validationStateReader : this.deps.validationStateReader,
+        tenant,
+        filters,
+        messageSort,
+        pagination,
+        messageTimestamp      : recordsQuery.message.descriptor.messageTimestamp,
+      });
+      return EncryptionControl.projectCurrentAudienceRecordPage({
+        messageStore : this.deps.messageStore,
+        tenant,
+        filters,
+        currentAudienceRecordIdCache,
+        result       : {
+          messages : result.messages as RecordsQueryReplyEntry[],
+          cursor   : result.cursor,
+        },
+      });
+    }
+
+    if (pagination?.limit === undefined || pagination.limit <= 0) {
+      const result = await queryRecordsWithRecordLimitOccupancy({
+        messageStore          : this.deps.messageStore,
+        validationStateReader : this.deps.validationStateReader,
+        tenant,
+        filters,
+        messageSort,
+        pagination,
+        messageTimestamp      : recordsQuery.message.descriptor.messageTimestamp,
+      });
+      const projectedResult = await EncryptionControl.projectCurrentAudienceRecordPage({
+        messageStore : this.deps.messageStore,
+        tenant,
+        filters,
+        currentAudienceRecordIdCache,
+        result       : {
+          messages : result.messages as RecordsQueryReplyEntry[],
+          cursor   : result.cursor,
+        },
+      });
+      return {
+        messages : await this.filterControlRecordsForRequester(tenant, recordsQuery, requester, projectedResult.messages),
+        cursor   : projectedResult.cursor,
+      };
+    }
+
+    const visibleMessages: RecordsQueryReplyEntry[] = [];
+    let cursor = pagination.cursor;
+    let nextCursor: PaginationCursor | undefined;
+    // Keeps visible-page pagination stable until #1100 moves control visibility into indexed store filters.
+    do {
+      const remainingLimit = pagination.limit - visibleMessages.length;
+      const result = await queryRecordsWithRecordLimitOccupancy({
+        messageStore          : this.deps.messageStore,
+        validationStateReader : this.deps.validationStateReader,
+        tenant,
+        filters,
+        messageSort,
+        pagination            : { ...pagination, cursor, limit: remainingLimit },
+        messageTimestamp      : recordsQuery.message.descriptor.messageTimestamp,
+      });
+      const projectedResult = await EncryptionControl.projectCurrentAudienceRecordPage({
+        messageStore : this.deps.messageStore,
+        tenant,
+        filters,
+        currentAudienceRecordIdCache,
+        result       : {
+          messages : result.messages as RecordsQueryReplyEntry[],
+          cursor   : result.cursor,
+        },
+      });
+      const filteredMessages = await this.filterControlRecordsForRequester(
+        tenant,
+        recordsQuery,
+        requester,
+        projectedResult.messages,
+      );
+      visibleMessages.push(...filteredMessages);
+      nextCursor = projectedResult.cursor;
+      cursor = projectedResult.cursor;
+    } while (visibleMessages.length < pagination.limit && cursor !== undefined);
+
+    return { messages: visibleMessages, cursor: nextCursor };
+  }
+
   private static buildPublishedRecordsFilter(recordsQuery: RecordsQuery): Filter {
     const { dateSort, filter } = recordsQuery.message.descriptor;
     // fetch all published records matching the query
@@ -293,8 +426,16 @@ export class RecordsQueryHandler implements MethodHandler {
     deps: HandlerDependencies,
   ): Promise<void> {
 
-    if (Message.isSignedByAuthorDelegate(recordsQuery.message)) {
+    if (Message.isSignedByAuthorDelegate(recordsQuery.message) &&
+        !EncryptionControl.filterTargetsOnlyControlRecords(recordsQuery.message.descriptor.filter)) {
       await recordsQuery.authorizeDelegate(deps.validationStateReader);
+    } else if (EncryptionControl.filterTargetsOnlyControlRecords(recordsQuery.message.descriptor.filter)) {
+      await EncryptionControl.authorizeControlReadRequest({
+        tenant,
+        incomingMessage       : recordsQuery.message,
+        requester             : Message.getRequester(recordsQuery.message),
+        validationStateReader : deps.validationStateReader,
+      });
     }
 
     const permissionGrantId = Message.getPermissionGrantId(recordsQuery.signaturePayload!);
@@ -317,4 +458,19 @@ export class RecordsQueryHandler implements MethodHandler {
       await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsQuery, deps.validationStateReader);
     }
   }
+
+  private async filterControlRecordsForRequester(
+    tenant: string,
+    recordsQuery: RecordsQuery,
+    requester: string | undefined,
+    recordsWrites: RecordsQueryReplyEntry[],
+  ): Promise<RecordsQueryReplyEntry[]> {
+    return EncryptionControl.filterVisibleControlRecords({
+      tenant,
+      incomingMessage       : recordsQuery.message,
+      requester,
+      recordsWriteMessages  : recordsWrites,
+      validationStateReader : this.deps.validationStateReader,
+    });
+  }
 }

package/src/handlers/records-read.ts

@@ -5,6 +5,7 @@ import type { RecordsDeleteMessage, RecordsQueryReplyEntry, RecordsReadMessage,
 import { authenticate } from '../core/auth.js';
 import { DataStream } from '../utils/data-stream.js';
 import { Encoder } from '../utils/encoder.js';
+import { EncryptionControl } from '../core/encryption-control.js';
 import { isRecordLimitOccupant } from '../utils/record-limit-occupancy.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
@@ -178,14 +179,26 @@ export class RecordsReadHandler implements MethodHandler {
     matchedRecordsWrite: RecordsWrite,
     deps: HandlerDependencies,
   ): Promise<void> {
-    if (Message.isSignedByAuthorDelegate(recordsRead.message)) {
-      await recordsRead.authorizeDelegate(matchedRecordsWrite.message, deps.validationStateReader);
-    }
-
     const { descriptor } = matchedRecordsWrite.message;
 
-    // if author is the same as the target tenant, we can directly grant access
-    if (recordsRead.author === tenant) {
+    if (EncryptionControl.isControlMessage(matchedRecordsWrite.message)) {
+      await EncryptionControl.authorizeControlReadRequest({
+        tenant,
+        incomingMessage       : recordsRead.message,
+        requester             : Message.getRequester(recordsRead.message),
+        validationStateReader : deps.validationStateReader,
+      });
+      await EncryptionControl.authorizeRead({
+        tenant,
+        incomingMessage       : recordsRead.message,
+        requester             : Message.getRequester(recordsRead.message),
+        recordsWriteMessage   : matchedRecordsWrite.message,
+        validationStateReader : deps.validationStateReader,
+      });
+    } else if (Message.isSignedByAuthorDelegate(recordsRead.message)) {
+      await recordsRead.authorizeDelegate(matchedRecordsWrite.message, deps.validationStateReader);
+    } else if (recordsRead.author === tenant) {
+      // if author is the same as the target tenant, we can directly grant access
       return;
     } else if (descriptor.published === true) {
       // authentication is not required for published data