@enbox/dwn-sdk-js 0.4.7 → 0.4.8

package/dist/types/src/protocols/encryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../../../src/protocols/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AASjF,qBAAa,kBAAmB,YAAW,YAAY;IACrD,gBAAuB,GAAG,0DAA2B;IACrD,gBAAuB,YAAY,cAAc;IAEjD,gBAAuB,UAAU,EAAE,kBAAkB,CA0BnD;IAEF,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED,IAAW,UAAU,IAAI,kBAAkB,CAE1C;IAEY,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,mBAAmB,EAC5B,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAAC,IAAI,CAAC;IAMH,cAAc,CAAC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;mBAY3E,kBAAkB;IA0BvC,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAStC,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAYnC,OAAO,CAAC,MAAM,CAAC,oBAAoB;mBAgBd,iBAAiB;IA8BtC,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAWnC,OAAO,CAAC,MAAM,CAAC,uBAAuB;mBAWjB,mBAAmB;IA0DjC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO3D,gCAAgC,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS;CAoBpF"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../../../src/protocols/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAYlG,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,wBAAwB,CAAC;IACxC,aAAa,EAAE,uBAAuB,CAAC;IACvC,iBAAiB,EAAE;QACjB,SAAS,EAAE,OAAO,0BAA0B,CAAC,OAAO,CAAC;QACrD,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,uBAAuB,CAU5G;AAED,qBAAa,kBAAmB,YAAW,YAAY;IACrD,gBAAuB,GAAG,0DAA2B;IACrD,gBAAuB,YAAY,cAAc;IAEjD,gBAAuB,UAAU,EAAE,kBAAkB,CA0BnD;IAEF,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED,IAAW,UAAU,IAAI,kBAAkB,CAE1C;IAEY,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,mBAAmB,EAC5B,qBAAqB,EAAE,qBAAqB,GAC3C,OAAO,CAAC,IAAI,CAAC;IAMH,cAAc,CAAC,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;mBAY1E,kBAAkB;IA0BvC,OAAO,CAAC,MAAM,CAAC,mCAAmC;IAalD,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAqBrC,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAYnC,OAAO,CAAC,MAAM,CAAC,oBAAoB;mBAgBd,iBAAiB;IA8BtC,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAWnC,OAAO,CAAC,MAAM,CAAC,uBAAuB;mBAWjB,mBAAmB;IA0DjC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAO3D,gCAAgC,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS;CAoBpF"}

package/dist/types/tests/validation/json-schemas/encryption/wrapped-grant-key-envelope.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=wrapped-grant-key-envelope.spec.d.ts.map

package/dist/types/tests/validation/json-schemas/encryption/wrapped-grant-key-envelope.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapped-grant-key-envelope.spec.d.ts","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/wrapped-grant-key-envelope.spec.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enbox/dwn-sdk-js",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "A reference implementation of https://identity.foundation/decentralized-web-node/spec/",
   "repository": {
     "type": "git",

package/src/core/dwn-error.ts

@@ -40,6 +40,7 @@ export enum DwnErrorCode {
   EncryptionProtocolValidateGrantKeyGrantScopeMismatch = 'EncryptionProtocolValidateGrantKeyGrantScopeMismatch',
   EncryptionProtocolValidateGrantKeyMissingRequiredTag = 'EncryptionProtocolValidateGrantKeyMissingRequiredTag',
   EncryptionProtocolValidateGrantKeyRecipientMismatch = 'EncryptionProtocolValidateGrantKeyRecipientMismatch',
+  EncryptionProtocolValidateGrantKeyWrappedDeliveryInvalid = 'EncryptionProtocolValidateGrantKeyWrappedDeliveryInvalid',
   EncryptionProtocolValidateSchemaUnexpectedRecord = 'EncryptionProtocolValidateSchemaUnexpectedRecord',
   EventLogNotOpenError = 'EventLogNotOpenError',
   EventLogProgressGap = 'EventLogProgressGap',

package/src/index.ts

@@ -86,7 +86,8 @@ export type { MessageInterface } from './types/message-interface.js';
 export { PermissionGrant } from './protocols/permission-grant.js';
 export { PermissionRequest } from './protocols/permission-request.js';
 export { PermissionsProtocol } from './protocols/permissions.js';
-export { EncryptionProtocol } from './protocols/encryption.js';
+export { EncryptionProtocol, WRAPPED_GRANT_KEY_FORMAT, assertWrappedGrantKeyEnvelope } from './protocols/encryption.js';
+export type { WrappedGrantKeyEnvelope } from './protocols/encryption.js';
 export type { PermissionGrantCreateOptions, PermissionRequestCreateOptions, PermissionRevocationCreateOptions } from './protocols/permissions.js';
 export { PermissionScopeMatcher } from './utils/permission-scope.js';
 export type { ProtocolScope } from './utils/permission-scope.js';

package/src/protocols/encryption.ts

@@ -6,14 +6,42 @@ import type { PermissionScope } from '../types/permission-types.js';
 import type { ProtocolDefinition } from '../types/protocols-types.js';
 import type { RecordsWriteMessage } from '../types/records-types.js';
 import type { ValidationStateReader } from '../types/validation-state-reader.js';
+import type { ContentEncryptionAlgorithm, X25519KeyEncryptionBase } from '../utils/encryption.js';
 
+import { DwnConstant } from '../core/dwn-constant.js';
+import { Encoder } from '../utils/encoder.js';
 import { ENCRYPTION_PROTOCOL_URI } from '../core/constants.js';
 import { FilterUtility } from '../utils/filter.js';
 import { Message } from '../core/message.js';
 import { Records } from '../utils/records.js';
+import { validateJsonSchema } from '../schema-validator.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 import { grantKeyScopeCoversDeliveredScope, isGrantKeyEligibleRecordsScope, isGrantKeyRecordsScope } from '../utils/grant-key-coverage.js';
 
+export const WRAPPED_GRANT_KEY_FORMAT = 'enbox/wrapped-grant-key@1';
+
+export type WrappedGrantKeyEnvelope = {
+  format: typeof WRAPPED_GRANT_KEY_FORMAT;
+  keyEncryption: X25519KeyEncryptionBase;
+  contentEncryption: {
+    algorithm: typeof ContentEncryptionAlgorithm.A256CTR;
+    initializationVector: string;
+  };
+  ciphertext: string;
+};
+
+export function assertWrappedGrantKeyEnvelope(envelope: unknown): asserts envelope is WrappedGrantKeyEnvelope {
+  try {
+    validateJsonSchema('WrappedGrantKeyEnvelope', envelope);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new DwnError(
+      DwnErrorCode.EncryptionProtocolValidateGrantKeyWrappedDeliveryInvalid,
+      `wrapped grantKey envelope is invalid: ${detail}`
+    );
+  }
+}
+
 export class EncryptionProtocol implements CoreProtocol {
   public static readonly uri = ENCRYPTION_PROTOCOL_URI;
   public static readonly grantKeyPath = 'grantKey';
@@ -64,9 +92,9 @@ export class EncryptionProtocol implements CoreProtocol {
     }
   }
 
-  public async validateRecord(message: RecordsWriteMessage, _dataBytes: Uint8Array): Promise<void> {
+  public async validateRecord(message: RecordsWriteMessage, dataBytes: Uint8Array): Promise<void> {
     if (message.descriptor.protocolPath === EncryptionProtocol.grantKeyPath) {
-      EncryptionProtocol.verifyEncryptedDelivery(message);
+      EncryptionProtocol.verifyGrantKeyDelivery(message, dataBytes);
       return;
     }
 
@@ -81,7 +109,7 @@ export class EncryptionProtocol implements CoreProtocol {
     message: RecordsWriteMessage,
     validationStateReader: ValidationStateReader,
   ): Promise<void> {
-    EncryptionProtocol.verifyEncryptedDelivery(message);
+    EncryptionProtocol.verifyInlineWrappedGrantKeyDelivery(message);
 
     const grantId = EncryptionProtocol.getRequiredStringTag(message, 'grantId');
     const protocol = EncryptionProtocol.getRequiredStringTag(message, 'protocol');
@@ -102,11 +130,36 @@ export class EncryptionProtocol implements CoreProtocol {
     });
   }
 
-  private static verifyEncryptedDelivery(message: RecordsWriteMessage): void {
-    if (message.encryption === undefined) {
+  private static verifyInlineWrappedGrantKeyDelivery(message: RecordsWriteMessage): void {
+    if (message.encryption !== undefined) {
+      return;
+    }
+
+    if (message.descriptor.dataSize > DwnConstant.maxDataSizeAllowedToBeEncoded) {
+      throw new DwnError(
+        DwnErrorCode.EncryptionProtocolValidateEncryptedDeliveryMissingEncryption,
+        'plaintext grantKey records must carry an inline wrapped grantKey envelope.'
+      );
+    }
+  }
+
+  private static verifyGrantKeyDelivery(message: RecordsWriteMessage, dataBytes: Uint8Array): void {
+    if (message.encryption !== undefined) {
+      return;
+    }
+
+    try {
+      const envelope = Encoder.bytesToObject(dataBytes);
+      assertWrappedGrantKeyEnvelope(envelope);
+    } catch (error) {
+      if (error instanceof DwnError) {
+        throw error;
+      }
+
+      const detail = error instanceof Error ? error.message : String(error);
       throw new DwnError(
         DwnErrorCode.EncryptionProtocolValidateEncryptedDeliveryMissingEncryption,
-        `${message.descriptor.protocolPath} records must be encrypted.`
+        `${message.descriptor.protocolPath} records must be encrypted or carry a valid wrapped grantKey envelope: ${detail}`
       );
     }
   }