@enbox/dwn-sdk-js 0.4.6 → 0.4.8

package/dist/esm/tests/protocols/encryption.spec.js

@@ -1,6 +1,6 @@
 import { TestDataGenerator } from '../utils/test-data-generator.js';
 import { describe, expect, it } from 'bun:test';
-import { ContentEncryptionAlgorithm, DwnErrorCode, DwnInterfaceName, DwnMethodName, Encoder, Encryption, EncryptionProtocol, Jws, KeyDerivationScheme, RecordsWrite, Time, } from '../../src/index.js';
+import { DwnConstant, DwnErrorCode, DwnInterfaceName, DwnMethodName, Encoder, Encryption, EncryptionProtocol, Jws, KeyAgreementAlgorithm, KeyDerivationScheme, RecordsWrite, Time, WRAPPED_GRANT_KEY_FORMAT, } from '../../src/index.js';
 describe('EncryptionProtocol', () => {
     it('should expose the encryption protocol uri and definition', () => {
         const encryptionProtocol = new EncryptionProtocol();
@@ -20,388 +20,175 @@ describe('EncryptionProtocol', () => {
             const encryptionProtocol = new EncryptionProtocol();
             await encryptionProtocol.preProcessWrite(alice.did, recordsWrite.message, createValidationStateReader({}));
         });
-        it('should accept audienceEpoch records for role paths with key agreement', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey);
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-            });
-            const encryptionProtocol = new EncryptionProtocol();
-            await encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({ protocolDefinition }));
-        });
-        it('should reject audienceEpoch records that are encrypted', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-            });
-            message.encryption = createTestEncryptionProperty();
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({}))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceEpochEncrypted);
-        });
-        it('should reject audienceEpoch records with missing required tags', async () => {
+        it('should accept grantKey records covered by an ancestor protocolPath read grant', async () => {
             const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const message = await createAudienceEpochMessage({
+            const bob = await TestDataGenerator.generatePersona();
+            const protocol = 'https://example.com/protocol';
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
+                protocolPath: 'message',
             });
-            delete message.descriptor.tags.contextId;
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({}))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceMissingRequiredTag);
-        });
-        it('should reject audienceEpoch records with malformed integer tags', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const message = await createAudienceEpochMessage({
+            const message = await createGrantKeyMessage({
+                grant,
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
+                protocolPath: 'message/reply',
+                recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
-            message.descriptor.tags.epoch = '1';
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({}))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceMissingRequiredTag);
+            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }));
         });
-        it('should reject audienceEpoch records with inconsistent role context', async () => {
+        it('should reject plaintext grantKey records whose data cannot be inline validated', async () => {
             const alice = await TestDataGenerator.generatePersona();
+            const bob = await TestDataGenerator.generatePersona();
             const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const message = await createAudienceEpochMessage({
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
                 protocol,
-                role: 'chat/member',
-                contextId: '',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-            });
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({}))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateRoleAudienceContextInvalid);
-        });
-        it('should accept same-coordinate audienceEpoch records with different keyIds', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const other = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey);
-            const conflictingEpoch = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: other.encryptionKeyPair.publicJwk,
-                signer: Jws.createSigner(other),
-            });
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-            });
-            const encryptionProtocol = new EncryptionProtocol();
-            await encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({
-                audienceEpochs: [conflictingEpoch],
-                protocolDefinition,
-            }));
-        });
-        it('should reject audienceEpoch records authored by DIDs that cannot create the role', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey, { memberActions: [] });
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
             });
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized);
-        });
-        it('should accept audienceEpoch records authored through an active local role', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey, {
-                memberActions: [{ can: ['create'], role: 'chat/admin' }],
-            });
-            const message = await createAudienceEpochMessage({
+            const message = await createGrantKeyMessage({
+                encrypted: false,
+                grant,
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
+                recipient: bob.did,
                 signer: Jws.createSigner(alice),
-                protocolRole: 'chat/admin',
             });
-            const encryptionProtocol = new EncryptionProtocol();
-            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({
-                hasMatchingRoleRecord: (input) => {
-                    return input.protocol === protocol &&
-                        input.protocolPath === 'chat/admin' &&
-                        input.recipient === alice.did &&
-                        input.contextIdPrefix === 'chat1';
+            const largePlaintextMessage = {
+                ...message,
+                descriptor: {
+                    ...message.descriptor,
+                    dataSize: DwnConstant.maxDataSizeAllowedToBeEncoded + 1,
                 },
-                protocolDefinition,
-            }));
-        });
-        it('should reject audienceEpoch records when the invoked role does not match the create rule', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey, {
-                memberActions: [{ can: ['create'], role: 'chat/admin' }],
-            });
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-                protocolRole: 'chat/moderator',
-            });
+            };
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized);
+            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', largePlaintextMessage, createValidationStateReader({ grant }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateEncryptedDeliveryMissingEncryption);
         });
-        it('should accept audienceEpoch records authored through an active cross-protocol role', async () => {
+        it('should accept read-grant grantKey records for referenced role paths outside the read subtree', async () => {
             const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const roleProtocol = 'https://example.com/protocol/roles';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey, {
-                memberActions: [{ can: ['create'], role: 'roles:admin' }],
-                uses: { roles: roleProtocol },
-            });
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-                protocolRole: 'roles:admin',
-            });
-            const encryptionProtocol = new EncryptionProtocol();
-            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({
-                hasMatchingRoleRecord: (input) => {
-                    return input.protocol === roleProtocol &&
-                        input.protocolPath === 'admin' &&
-                        input.recipient === alice.did &&
-                        input.contextIdPrefix === undefined;
-                },
-                protocolDefinition,
-            }));
-        });
-        it('should reject audienceEpoch records that invoke a cross-protocol role with an unknown alias', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey, {
-                memberActions: [{ can: ['create'], role: 'roles:admin' }],
-            });
-            const message = await createAudienceEpochMessage({
+            const bob = await TestDataGenerator.generatePersona();
+            const rolePublicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
+            const protocol = 'https://example.com/protocol';
+            const protocolDefinition = createGrantKeyCoverageProtocolDefinition(protocol, rolePublicKey);
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-                protocolRole: 'roles:admin',
+                protocolPath: 'chat/message',
             });
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized);
-        });
-        it('should reject audienceKey records without a matching audienceEpoch', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const bob = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey);
-            const message = await createAudienceKeyMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
+            const message = await createGrantKeyMessage({
+                grant,
+                protocol,
+                protocolPath: 'chat/member',
                 recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({
-                audienceEpochs: [],
-                hasMatchingRole: true,
-                protocolDefinition,
-            }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceEpochMissing);
-        });
-        it('should reject audienceEpoch records for role paths without key agreement', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey, { keyAgreement: false });
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
-            });
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({ protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateRoleAudienceInvalid);
+            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant, protocolDefinition }));
         });
-        it('should accept audienceKey records for active role holders', async () => {
+        it('should reject read-grant grantKey records for unreferenced role paths outside the read subtree', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey);
-            const audienceEpoch = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
+            const rolePublicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
+            const protocol = 'https://example.com/protocol';
+            const protocolDefinition = createGrantKeyCoverageProtocolDefinition(protocol, rolePublicKey);
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
+                protocol,
+                protocolPath: 'chat/message',
             });
-            const message = await createAudienceKeyMessage({
+            const message = await createGrantKeyMessage({
+                grant,
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
+                protocolPath: 'chat/admin',
                 recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({
-                audienceEpochs: [audienceEpoch],
-                hasMatchingRole: true,
-                protocolDefinition,
-            }));
+            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant, protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
         });
-        it('should reject audienceKey records that are not encrypted', async () => {
+        it('should reject read-grant grantKey records for cross-protocol role references', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const message = await createAudienceKeyMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                recipient: bob.did,
-                signer: Jws.createSigner(alice),
-                encrypted: false,
+            const rolePublicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
+            const protocol = 'https://example.com/protocol';
+            const protocolDefinition = createGrantKeyCoverageProtocolDefinition(protocol, rolePublicKey, {
+                messageRole: 'contacts:member',
+                uses: { contacts: 'https://example.com/contacts' },
             });
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({}))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateEncryptedDeliveryMissingEncryption);
-        });
-        it('should reject audienceKey records without a recipient', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey);
-            const audienceEpoch = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
+                protocol,
+                protocolPath: 'chat/message',
             });
-            const message = await createAudienceKeyMessage({
+            const message = await createGrantKeyMessage({
+                grant,
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
+                protocolPath: 'chat/member',
+                recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({
-                audienceEpochs: [audienceEpoch],
-                protocolDefinition,
-            }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceKeyRecipientMissing);
+            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant, protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
         });
-        it('should reject audienceKey records for recipients without the referenced role', async () => {
+        it('should accept write-grant grantKey records for covered role paths', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const rolePublicKey = alice.encryptionKeyPair.publicJwk;
-            const protocolDefinition = createRoleProtocolDefinition(protocol, rolePublicKey);
-            const audienceEpoch = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
-                signer: Jws.createSigner(alice),
+            const rolePublicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
+            const protocol = 'https://example.com/protocol';
+            const protocolDefinition = createGrantKeyCoverageProtocolDefinition(protocol, rolePublicKey);
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
+                method: DwnMethodName.Write,
+                protocol,
+                protocolPath: 'chat',
             });
-            const message = await createAudienceKeyMessage({
+            const message = await createGrantKeyMessage({
+                grant,
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: rolePublicKey,
+                protocolPath: 'chat/member',
                 recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite(alice.did, message, createValidationStateReader({
-                audienceEpochs: [audienceEpoch],
-                hasMatchingRole: false,
-                protocolDefinition,
-            }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceKeyRoleRecordMissing);
+            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant, protocolDefinition }));
         });
-        it('should accept grantKey records covered by an ancestor protocolPath read grant', async () => {
+        it('should reject write-grant grantKey records for covered non-role paths', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
+            const rolePublicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
             const protocol = 'https://example.com/protocol';
+            const protocolDefinition = createGrantKeyCoverageProtocolDefinition(protocol, rolePublicKey);
             const grant = createGrant({
                 grantor: alice.did,
                 grantee: bob.did,
                 id: 'grant1',
+                method: DwnMethodName.Write,
                 protocol,
-                protocolPath: 'message',
+                protocolPath: 'chat',
             });
             const message = await createGrantKeyMessage({
                 grant,
                 protocol,
-                protocolPath: 'message/reply',
+                protocolPath: 'chat/message',
                 recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }));
+            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant, protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
         });
-        it('should accept grantKey records covered by a Messages read grant', async () => {
+        it('should reject grantKey records covered only by a Messages read grant', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
             const protocol = 'https://example.com/protocol';
@@ -419,12 +206,14 @@ describe('EncryptionProtocol', () => {
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }));
+            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
         });
         it('should reject protocol-scoped grantKey records for protocolPath-scoped read grants', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
+            const rolePublicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
             const protocol = 'https://example.com/protocol';
+            const protocolDefinition = createGrantKeyCoverageProtocolDefinition(protocol, rolePublicKey);
             const grant = createGrant({
                 grantor: alice.did,
                 grantee: bob.did,
@@ -439,7 +228,7 @@ describe('EncryptionProtocol', () => {
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
+            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant, protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
         });
         it('should reject grantKey records outside the grant protocol', async () => {
             const alice = await TestDataGenerator.generatePersona();
@@ -462,7 +251,9 @@ describe('EncryptionProtocol', () => {
         it('should reject grantKey records outside the grant protocolPath subtree', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
+            const rolePublicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
             const protocol = 'https://example.com/protocol';
+            const protocolDefinition = createGrantKeyCoverageProtocolDefinition(protocol, rolePublicKey);
             const grant = createGrant({
                 grantor: alice.did,
                 grantee: bob.did,
@@ -478,7 +269,7 @@ describe('EncryptionProtocol', () => {
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
+            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant, protocolDefinition }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch);
         });
         it('should reject grantKey records whose recipient is not the grant grantee', async () => {
             const alice = await TestDataGenerator.generatePersona();
@@ -606,7 +397,7 @@ describe('EncryptionProtocol', () => {
                 },
             }))).rejects.toThrow(DwnErrorCode.GrantAuthorizationGrantRevoked);
         });
-        it('should reject grantKey records that are not encrypted', async () => {
+        it('should accept grantKey metadata before wrapped envelope data validation', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
             const protocol = 'https://example.com/protocol';
@@ -624,17 +415,17 @@ describe('EncryptionProtocol', () => {
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateEncryptedDeliveryMissingEncryption);
+            await encryptionProtocol.preProcessWrite('did:example:tenant', message, createValidationStateReader({ grant }));
         });
-        it('should reject grantKey records for non-read permission grants', async () => {
+        it('should reject grantKey records for context-scoped permission grants', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
             const protocol = 'https://example.com/protocol';
             const grant = createGrant({
+                contextId: 'context1',
                 grantor: alice.did,
                 grantee: bob.did,
                 id: 'grant1',
-                method: DwnMethodName.Write,
                 protocol,
             });
             const message = await createGrantKeyMessage({
@@ -660,83 +451,75 @@ describe('EncryptionProtocol', () => {
             const encryptionProtocol = new EncryptionProtocol();
             await expect(encryptionProtocol.validateRecord(recordsWrite.message, TestDataGenerator.randomBytes(32))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateSchemaUnexpectedRecord);
         });
-        it('should reject audienceEpoch records whose keyId does not match the public key', async () => {
+        it('should reject unencrypted grantKey records', async () => {
             const alice = await TestDataGenerator.generatePersona();
-            const other = await TestDataGenerator.generatePersona();
+            const bob = await TestDataGenerator.generatePersona();
             const protocol = 'https://example.com/protocol/chat';
-            const message = await createAudienceEpochMessage({
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: alice.encryptionKeyPair.publicJwk,
-                keyId: await Encryption.getKeyId(other.encryptionKeyPair.publicJwk),
+            });
+            const message = await createGrantKeyMessage({
+                encrypted: false,
+                grant,
+                protocol,
+                recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.validateRecord(message, Encoder.base64UrlToBytes(message.encodedData))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceEpochKeyIdMismatch);
+            await expect(encryptionProtocol.validateRecord(message, TestDataGenerator.randomBytes(32))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateEncryptedDeliveryMissingEncryption);
         });
-        it('should reject audienceEpoch records whose payload does not match tags', async () => {
+        it('should accept wrapped grantKey envelope records without Records encryption', async () => {
             const alice = await TestDataGenerator.generatePersona();
+            const bob = await TestDataGenerator.generatePersona();
             const protocol = 'https://example.com/protocol/chat';
-            const keyId = await Encryption.getKeyId(alice.encryptionKeyPair.publicJwk);
-            const message = await createAudienceEpochMessage({
-                protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: alice.encryptionKeyPair.publicJwk,
-                keyId,
-                signer: Jws.createSigner(alice),
-            });
-            const mismatchingPayload = Encoder.objectToBytes({
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
                 protocol,
-                contextId: 'chat2',
-                role: 'chat/member',
-                epoch: 1,
-                keyId,
-                publicKeyJwk: alice.encryptionKeyPair.publicJwk,
             });
-            const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.validateRecord(message, mismatchingPayload)).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceTagsMismatch);
-        });
-        it('should reject encrypted audienceEpoch records', async () => {
-            const alice = await TestDataGenerator.generatePersona();
-            const protocol = 'https://example.com/protocol/chat';
-            const message = await createAudienceEpochMessage({
+            const message = await createGrantKeyMessage({
+                encrypted: false,
+                grant,
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: alice.encryptionKeyPair.publicJwk,
+                recipient: bob.did,
                 signer: Jws.createSigner(alice),
             });
-            message.encryption = createTestEncryptionProperty();
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.validateRecord(message, Encoder.base64UrlToBytes(message.encodedData))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateAudienceEpochEncrypted);
+            const keyId = message.descriptor.tags.keyId;
+            expect(typeof keyId).toBe('string');
+            await encryptionProtocol.validateRecord(message, createWrappedGrantKeyEnvelopeBytes(keyId));
         });
-        it('should reject unencrypted delivery records', async () => {
+        it('should reject malformed wrapped grantKey envelopes', async () => {
             const alice = await TestDataGenerator.generatePersona();
             const bob = await TestDataGenerator.generatePersona();
             const protocol = 'https://example.com/protocol/chat';
-            const message = await createAudienceKeyMessage({
+            const grant = createGrant({
+                grantor: alice.did,
+                grantee: bob.did,
+                id: 'grant1',
+                protocol,
+            });
+            const message = await createGrantKeyMessage({
+                encrypted: false,
+                grant,
                 protocol,
-                role: 'chat/member',
-                contextId: 'chat1',
-                epoch: 1,
-                publicKeyJwk: alice.encryptionKeyPair.publicJwk,
                 recipient: bob.did,
                 signer: Jws.createSigner(alice),
-                encrypted: false,
             });
+            const envelope = Encoder.bytesToObject(createWrappedGrantKeyEnvelopeBytes(message.descriptor.tags.keyId));
+            envelope.keyEncryption.ephemeralPublicKey.x = '';
             const encryptionProtocol = new EncryptionProtocol();
-            await expect(encryptionProtocol.validateRecord(message, TestDataGenerator.randomBytes(32))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateEncryptedDeliveryMissingEncryption);
+            await expect(encryptionProtocol.validateRecord(message, Encoder.objectToBytes(envelope))).rejects.toThrow(DwnErrorCode.EncryptionProtocolValidateGrantKeyWrappedDeliveryInvalid);
         });
     });
     describe('mapErrorToStatusCode()', () => {
         it('should map encryption validation errors to bad request', () => {
             const encryptionProtocol = new EncryptionProtocol();
-            expect(encryptionProtocol.mapErrorToStatusCode(DwnErrorCode.EncryptionProtocolValidateAudienceEpochMissing)).toBe(400);
+            expect(encryptionProtocol.mapErrorToStatusCode(DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch)).toBe(400);
             expect(encryptionProtocol.mapErrorToStatusCode(DwnErrorCode.GrantAuthorizationGrantExpired)).toBeUndefined();
         });
     });
@@ -770,6 +553,7 @@ function createGrant(input) {
             interface: input.interface ?? DwnInterfaceName.Records,
             method: input.method ?? DwnMethodName.Read,
             protocol: input.protocol,
+            contextId: input.contextId,
             protocolPath: input.protocolPath,
         },
     };
@@ -780,25 +564,29 @@ function createValidationStateReader(input) {
         fetchGrant: async () => input.grant,
         fetchOldestGrantRevocation: async () => input.revocation,
         fetchProtocolDefinition: async () => input.protocolDefinition,
-        hasMatchingRoleRecord: async (roleInput) => {
-            return input.hasMatchingRoleRecord?.(roleInput) ?? input.hasMatchingRole ?? true;
-        },
-        queryAudienceEpochs: async () => input.audienceEpochs ?? [],
     };
 }
-function createRoleProtocolDefinition(protocol, publicKeyJwk, options = {}) {
-    const adminRuleSet = {
-        $actions: [{ can: ['create'], who: 'anyone' }],
-        $role: true,
-    };
-    const memberRuleSet = {
-        $actions: options.memberActions ?? [{ can: ['create'], who: 'anyone' }],
-        $role: true,
-    };
-    if (options.keyAgreement !== false) {
-        adminRuleSet.$keyAgreement = { publicKeyJwk };
-        memberRuleSet.$keyAgreement = { publicKeyJwk };
-    }
+function createWrappedGrantKeyEnvelopeBytes(keyId) {
+    return Encoder.objectToBytes({
+        format: WRAPPED_GRANT_KEY_FORMAT,
+        keyEncryption: {
+            algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw,
+            encryptedKey: Encoder.bytesToBase64Url(TestDataGenerator.randomBytes(40)),
+            ephemeralPublicKey: {
+                crv: 'X25519',
+                kty: 'OKP',
+                x: Encoder.bytesToBase64Url(TestDataGenerator.randomBytes(32)),
+            },
+            keyId,
+        },
+        contentEncryption: {
+            algorithm: 'A256CTR',
+            initializationVector: Encoder.bytesToBase64Url(TestDataGenerator.randomBytes(16)),
+        },
+        ciphertext: Encoder.bytesToBase64Url(TestDataGenerator.randomBytes(32)),
+    });
+}
+function createGrantKeyCoverageProtocolDefinition(protocol, publicKeyJwk, options = {}) {
     return {
         published: true,
         protocol,
@@ -807,73 +595,26 @@ function createRoleProtocolDefinition(protocol, publicKeyJwk, options = {}) {
             admin: { dataFormats: ['application/json'] },
             chat: { dataFormats: ['application/json'] },
             member: { dataFormats: ['application/json'] },
+            message: { dataFormats: ['application/json'], encryptionRequired: true },
         },
         structure: {
             chat: {
-                admin: adminRuleSet,
-                member: memberRuleSet,
+                admin: {
+                    $keyAgreement: { publicKeyJwk },
+                    $role: true,
+                },
+                member: {
+                    $keyAgreement: { publicKeyJwk },
+                    $role: true,
+                },
+                message: {
+                    $actions: [{ can: ['read'], role: options.messageRole ?? 'chat/member' }],
+                    $keyAgreement: { publicKeyJwk },
+                },
             },
         },
     };
 }
-async function createAudienceEpochMessage(input) {
-    const keyId = input.keyId ?? await Encryption.getKeyId(input.publicKeyJwk);
-    const data = Encoder.objectToBytes({
-        protocol: input.protocol,
-        contextId: input.contextId,
-        role: input.role,
-        epoch: input.epoch,
-        keyId,
-        publicKeyJwk: input.publicKeyJwk,
-    });
-    const recordsWrite = await RecordsWrite.create({
-        data,
-        dataFormat: 'application/json',
-        protocol: EncryptionProtocol.uri,
-        protocolPath: EncryptionProtocol.audienceEpochPath,
-        protocolRole: input.protocolRole,
-        signer: input.signer,
-        tags: {
-            protocol: input.protocol,
-            contextId: input.contextId,
-            role: input.role,
-            epoch: input.epoch,
-            keyId,
-        },
-    });
-    return {
-        ...recordsWrite.message,
-        encodedData: Encoder.bytesToBase64Url(data),
-    };
-}
-async function createAudienceKeyMessage(input) {
-    const keyId = await Encryption.getKeyId(input.publicKeyJwk);
-    const recordsWrite = await RecordsWrite.create({
-        data: TestDataGenerator.randomBytes(32),
-        dataFormat: 'application/json',
-        encryptionInput: input.encrypted === false ? undefined : {
-            initializationVector: TestDataGenerator.randomBytes(16),
-            key: TestDataGenerator.randomBytes(32),
-            keyEncryptionInputs: [{
-                    derivationScheme: KeyDerivationScheme.ProtocolPath,
-                    keyId,
-                    publicKey: input.publicKeyJwk,
-                }],
-        },
-        protocol: EncryptionProtocol.uri,
-        protocolPath: EncryptionProtocol.audienceKeyPath,
-        recipient: input.recipient,
-        signer: input.signer,
-        tags: {
-            protocol: input.protocol,
-            contextId: input.contextId,
-            role: input.role,
-            epoch: input.epoch,
-            keyId,
-        },
-    });
-    return recordsWrite.message;
-}
 async function createGrantKeyMessage(input) {
     const publicKey = (await TestDataGenerator.generatePersona()).encryptionKeyPair.publicJwk;
     const tags = {
@@ -891,6 +632,7 @@ async function createGrantKeyMessage(input) {
             initializationVector: TestDataGenerator.randomBytes(16),
             key: TestDataGenerator.randomBytes(32),
             keyEncryptionInputs: [{
+                    algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw,
                     derivationScheme: KeyDerivationScheme.ProtocolPath,
                     keyId: await Encryption.getKeyId(publicKey),
                     publicKey,
@@ -904,11 +646,4 @@ async function createGrantKeyMessage(input) {
     });
     return recordsWrite.message;
 }
-function createTestEncryptionProperty() {
-    return {
-        algorithm: ContentEncryptionAlgorithm.A256CTR,
-        initializationVector: Encoder.bytesToBase64Url(TestDataGenerator.randomBytes(16)),
-        keyEncryption: [],
-    };
-}
 //# sourceMappingURL=encryption.spec.js.map