@ibgib/core-gib 0.1.61 → 0.1.62

package/src/keystone/keystone-service-v1.respec.mts

@@ -10,10 +10,11 @@ import { GLOBAL_LOG_A_LOT } from '../core-constants.mjs';
 import { KeystoneStrategyFactory } from './strategy/keystone-strategy-factory.mjs';
 import { KeystoneChallengePool, KeystoneClaim, KeystoneIbGib_V1, KeystonePoolConfig_HashV1 } from './keystone-types.mjs';
 import { createRevocationPoolConfig, createStandardPoolConfig } from './keystone-config-builder.mjs';
-import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE } from './keystone-constants.mjs';
-import { KeystoneService_V1 } from './keystone-service-v1.mjs';
-import { selectChallengeIds, validateChallengePool } from './keystone-helpers.mjs';
+import { POOL_ID_DEFAULT, POOL_ID_REVOKE, KEYSTONE_VERB_REVOKE, KEYSTONE_VERB_MANAGE, POOL_ID_MANAGE } from './keystone-constants.mjs';
+import { KeystoneService_V1, } from './keystone-service-v1.mjs';
+import { selectChallengeIds, validateChallengePool, validateKeystoneIb, validateKeystoneTransition, validateGenesisKeystone } from './keystone-helpers.mjs';
 import { KeystoneProfileBuilder } from './policy/keystone-profile-builder.mjs';
+import { getTjpAddr } from '../common/other/ibgib-helper.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT;
 
@@ -37,16 +38,55 @@ class MockIbGibSpace {
         return data ? JSON.parse(JSON.stringify(data)) : null;
     }
 
+    async argy({ argData, ibGibs }: { argData: any; ibGibs?: IbGib_V1[] }): Promise<any> {
+        return {
+            ib: 'arg^gib',
+            gib: 'arg_gib',
+            data: argData,
+            ibGibs,
+        };
+    }
+
     async witness(arg: any): Promise<any> {
         const cmd = arg.data?.cmd;
+        const cmdModifiers = arg.data?.cmdModifiers || [];
         if (cmd === 'get') {
             const addrs = arg.data.ibGibAddrs || [];
-            const ibGibs: IbGib_V1[] = [];
-            for (const addr of addrs) {
-                const x = await this.get({ addr });
-                if (x) { ibGibs.push(x); }
+            if (cmdModifiers.includes('latest') && cmdModifiers.includes('addrs')) {
+                const latestAddrsMap: { [addr: string]: string } = {};
+                for (const queryAddr of addrs) {
+                    const queryTjpGib = queryAddr.includes('.') ? queryAddr.split('.')[1] : queryAddr.split('^')[1];
+                    let latestAddr = queryAddr;
+                    let maxN = -1;
+                    for (const [addr, ibGib] of this.store.entries()) {
+                        const tjpGib = addr.includes('.') ? addr.split('.')[1] : addr.split('^')[1];
+                        if (tjpGib === queryTjpGib) {
+                            const n = ibGib.data?.n ?? 0;
+                            if (n > maxN) {
+                                maxN = n;
+                                latestAddr = addr;
+                            }
+                        }
+                    }
+                    latestAddrsMap[queryAddr] = latestAddr;
+                }
+                return {
+                    data: {
+                        success: true,
+                        latestAddrsMap,
+                    }
+                };
+            } else {
+                const ibGibs: IbGib_V1[] = [];
+                for (const addr of addrs) {
+                    const x = await this.get({ addr });
+                    if (x) { ibGibs.push(x); }
+                }
+                return {
+                    data: { success: true },
+                    ibGibs,
+                };
             }
-            return { ibGibs };
         }
         return undefined;
     }
@@ -81,6 +121,15 @@ class MockMetaspaceService {
         return target.put(args);
     }
 
+    async get(args: { addr: string, space?: any }): Promise<{ success: boolean, ibGibs?: IbGib_V1[] }> {
+        const target = args.space || this.space;
+        const x = await target.get({ addr: args.addr });
+        return {
+            success: !!x,
+            ibGibs: x ? [x] : [],
+        };
+    }
+
     /**
      * Tracks the latest version of an ibGib timeline.
      */
@@ -1160,4 +1209,330 @@ await respecfully(sir, 'Suite F: Deep Inspection', async () => {
         });
 
     });
+});
+
+
+// ===========================================================================
+// SUITE E: DELEGATION (Register/Unregister)
+// ===========================================================================
+
+await respecfully(sir, 'Suite E: Delegation (Register/Unregister)', async () => {
+
+    const service = new KeystoneService_V1();
+    const parentSecret = "ParentMasterSecret_123";
+    const delegateSecret = "DelegateMasterSecret_456";
+
+    let mockSpace: MockIbGibSpace;
+    let mockMetaspace: any;
+
+    let parentKeystone: KeystoneIbGib_V1;
+    let delegateKeystone: KeystoneIbGib_V1;
+
+    firstOfEach(sir, async () => {
+        mockSpace = new MockIbGibSpace();
+        mockMetaspace = new MockMetaspaceService(mockSpace);
+
+        const salt = (await getUUID()).substring(0, 16);
+        const defaultConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt });
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: salt + "_manage" });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE];
+
+        // 1. Create Parent Keystone (with manage pool)
+        parentKeystone = await service.genesis({
+            masterSecret: parentSecret,
+            configs: [defaultConfig, manageConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        // 2. Create Delegate Keystone
+        const delegateConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: salt + "_delegate" });
+        delegateKeystone = await service.genesis({
+            masterSecret: delegateSecret,
+            configs: [delegateConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+    });
+
+    await ifWeMight(sir, 'registers a delegate keystone and evolves parent using manage pool', async () => {
+        // Register the delegate
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        iReckon(sir, evolvedParent).asTo('evolved parent exists').isGonnaBeTruthy();
+        iReckon(sir, evolvedParent.data?.delegates).asTo('delegates map exists').isGonnaBeTruthy();
+
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) { throw new Error(`(UNEXPECTED) delegateTjpAddr falsy? (E: 312e986ce4b2ed6c084c03e8f45fa826)`); }
+        const delegateInfo = evolvedParent.data?.delegates?.[delegateTjpAddr];
+        iReckon(sir, delegateInfo).asTo('delegate info registered').isGonnaBeTruthy();
+        iReckon(sir, delegateInfo?.delegateTjpAddr).asTo('delegate tjp matches').willEqual(delegateTjpAddr);
+    });
+
+    await ifWeMight(sir, 'gets correct delegate status via parent TJP address', async () => {
+        const parentTjpAddr = getTjpAddr({ ibGib: parentKeystone });
+        if (!parentTjpAddr) { throw new Error(`(UNEXPECTED) parentTjpAddr falsy? (E: b7ce2835ccd951d8c99257328be3b826)`); }
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) { throw new Error(`(UNEXPECTED) delegateTjpAddr falsy? (E: 3e4878ea19dd8034e827466a8bf09526)`); }
+
+        // Before registration
+        const statusBefore = await service.getDelegateStatus({
+            parentTjpAddr: parentTjpAddr,
+            delegateTjpAddr: delegateTjpAddr,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+        iReckon(sir, statusBefore.registered).asTo('initially unregistered').isGonnaBeFalse();
+
+        // Register
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        // After registration
+        const statusAfter = await service.getDelegateStatus({
+            parentTjpAddr: parentTjpAddr,
+            delegateTjpAddr: delegateTjpAddr,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+        iReckon(sir, statusAfter.registered).asTo('registered status').isGonnaBeTrue();
+        iReckon(sir, statusAfter.delegateInfo?.delegateTjpAddr).asTo('status tjp matches').willEqual(delegateTjpAddr);
+    });
+
+    await ifWeMight(sir, 'unregisters a registered delegate keystone', async () => {
+        // Register first
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) { throw new Error(`(UNEXPECTED) delegateTjpAddr falsy? (E: 486b486a8c984a52b8d2b22418c20d26)`); }
+
+        // Unregister
+        const finalParent = await service.unregisterDelegate({
+            parentKeystone: evolvedParent,
+            delegateTjpAddr,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        iReckon(sir, finalParent).asTo('final evolved parent exists').isGonnaBeTruthy();
+        const info = finalParent.data?.delegates?.[delegateTjpAddr];
+        iReckon(sir, info).asTo('delegate info removed').isGonnaBeUndefined();
+    });
+
+    await ifWeMight(sir, 'throws if parent does not have a manage pool', async () => {
+        // Create a parent WITHOUT a manage pool
+        const salt = (await getUUID()).substring(0, 16);
+        const defaultConfig = createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt });
+        const restrictedParent = await service.genesis({
+            masterSecret: parentSecret,
+            configs: [defaultConfig],
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        let errorCaught = false;
+        try {
+            await service.registerDelegate({
+                parentKeystone: restrictedParent,
+                delegateKeystone,
+                masterSecret: parentSecret,
+                metaspace: mockMetaspace,
+                space: mockSpace as any,
+            });
+        } catch (e: any) {
+            errorCaught = true;
+            iReckon(sir, e.message).includes('Manage pool is required');
+        }
+        iReckon(sir, errorCaught).asTo('delegation rejected').isGonnaBeTrue();
+    });
+});
+
+await respecfully(sir, 'Suite G: Delegate & IB Validation', async () => {
+    const service = new KeystoneService_V1();
+    const parentSecret = "ParentMasterSecret_SuiteG";
+    const delegateSecret = "DelegateMasterSecret_SuiteG";
+
+    let mockSpace: MockIbGibSpace;
+    let mockMetaspace: any;
+
+    let parentKeystone: KeystoneIbGib_V1;
+    let delegateKeystone: KeystoneIbGib_V1;
+
+    firstOfEach(sir, async () => {
+        mockSpace = new MockIbGibSpace();
+        mockMetaspace = new MockMetaspaceService(mockSpace);
+
+        const salt1 = (await getUUID()).substring(0, 16);
+        const salt2 = (await getUUID()).substring(0, 16);
+
+        const manageConfig = createStandardPoolConfig({ id: POOL_ID_MANAGE, salt: salt2 });
+        manageConfig.allowedVerbs = [KEYSTONE_VERB_MANAGE];
+
+        const configs = [
+            createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: salt1 }),
+            manageConfig
+        ];
+
+        parentKeystone = await service.genesis({
+            masterSecret: parentSecret,
+            configs,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        delegateKeystone = await service.genesis({
+            masterSecret: delegateSecret,
+            configs: [createStandardPoolConfig({ id: POOL_ID_DEFAULT, salt: salt1 })],
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+    });
+
+    await ifWeMight(sir, 'validateKeystoneIb returns true for valid keystone ib and false for others', async () => {
+        iReckon(sir, await validateKeystoneIb({ ib: 'keystone' })).isGonnaBeTrue();
+        iReckon(sir, await validateKeystoneIb({ ib: 'keystone user info' })).isGonnaBeTrue();
+        iReckon(sir, await validateKeystoneIb({ ib: 'invalidAtom' })).isGonnaBeFalse();
+        iReckon(sir, await validateKeystoneIb({ ib: 'not_keystone sub_atom' })).isGonnaBeFalse();
+    });
+
+    await ifWeMight(sir, 'validateGenesisKeystone fails validation if ib is invalid', async () => {
+        const invalidGenesis = {
+            ...parentKeystone,
+            ib: 'not_a_keystone^' + parentKeystone.gib,
+        };
+        const errors = await validateGenesisKeystone({ keystoneIbGib: invalidGenesis });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors[0]).includes('invalid keystone ib');
+    });
+
+    await ifWeMight(sir, 'validateKeystoneTransition passes for valid delegate registration', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        const errors = await validateKeystoneTransition({
+            currentIbGib: evolvedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length).willEqual(0);
+    });
+
+    await ifWeMight(sir, 'validateKeystoneTransition fails if delegates map is mutated without manage proof', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent)) as KeystoneIbGib_V1;
+        
+        // Remove the manage verb proof by converting it to sign
+        for (const proof of tamperedParent.data.proofs) {
+            if (proof.claim) {
+                proof.claim.verb = 'sign';
+            }
+        }
+
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('Policy Violation: Delegates map was mutated'))).isGonnaBeTrue();
+    });
+
+    await ifWeMight(sir, 'validateKeystoneTransition fails if delegate key does not match delegateTjpAddr', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent)) as KeystoneIbGib_V1;
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) { throw new Error(`delegateTjpAddr falsy?`); }
+        
+        const info = tamperedParent.data.delegates![delegateTjpAddr];
+        delete tamperedParent.data.delegates![delegateTjpAddr];
+        tamperedParent.data.delegates!['mismatched_key'] = info;
+
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('does not match delegateTjpAddr'))).isGonnaBeTrue();
+    });
+
+    await ifWeMight(sir, 'validateKeystoneTransition fails if delegate addresses have invalid keystone ib', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent)) as KeystoneIbGib_V1;
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) { throw new Error(`delegateTjpAddr falsy?`); }
+
+        tamperedParent.data.delegates![delegateTjpAddr].delegateAddr = 'invalid_ib^12345';
+
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('not a valid keystone address'))).isGonnaBeTrue();
+    });
+
+    await ifWeMight(sir, 'validateKeystoneTransition fails if thisAddr is not in the parent timeline history', async () => {
+        const evolvedParent = await service.registerDelegate({
+            parentKeystone,
+            delegateKeystone,
+            masterSecret: parentSecret,
+            metaspace: mockMetaspace,
+            space: mockSpace as any,
+        });
+
+        const tamperedParent = JSON.parse(JSON.stringify(evolvedParent)) as KeystoneIbGib_V1;
+        const delegateTjpAddr = getTjpAddr({ ibGib: delegateKeystone });
+        if (!delegateTjpAddr) { throw new Error(`delegateTjpAddr falsy?`); }
+
+        tamperedParent.data.delegates![delegateTjpAddr].thisAddr = 'keystone^randomgib';
+
+        const errors = await validateKeystoneTransition({
+            currentIbGib: tamperedParent,
+            prevIbGib: parentKeystone,
+        });
+        iReckon(sir, errors.length > 0).isGonnaBeTrue();
+        iReckon(sir, errors.some(e => e.includes('not a valid historical address in the parent keystone timeline'))).isGonnaBeTrue();
+    });
 });

package/src/keystone/keystone-types.mts

@@ -314,6 +314,50 @@ export interface KeystoneRevocationInfo {
     proof: KeystoneProof;
 }
 
+/**
+ * Shape of info we collect about delegated keystones. We can check 
+ * against this info later when validating any identity delegation requests.
+ */
+export interface DelegateKeystoneInfo {
+    /**
+     * The Timeline Junction Point (TJP) address of the delegate keystone.
+     * Serves as its immutable, unique identifier.
+     */
+    delegateTjpAddr: IbGibAddr;
+    /**
+     * concrete addr of **DELEGATE** keystone **at the time when the 
+     * delegate was added.**
+     *
+     * So if we have a delegate keystone at D3, then this value would be the
+     * addr of that D3 keystone. This will have both a `punctiliarHash` and a
+     * `tjpGib` in its `GibInfo`.
+     */
+    delegateAddr: IbGibAddr;
+    /**
+     * concrete keystone addr of **THIS** parent keystone **at the time 
+     * when the delegate was added.**
+     *
+     * So if we have a delegate keystone at D3, then this value would be the
+     * addr of that D3 keystone. This will have both a `punctiliarHash` and a
+     * `tjpGib` in its `GibInfo`.
+     */
+    thisAddr: IbGibAddr;
+}
+
+/**
+ * Status response when checking if a delegate keystone is registered.
+ */
+export interface DelegateKeystoneStatus {
+    /**
+     * True if the delegate is currently registered on the parent.
+     */
+    registered: boolean;
+    /**
+     * Truthy only if registered is true.
+     */
+    delegateInfo?: DelegateKeystoneInfo;
+}
+
 // ===========================================================================
 // TOP LEVEL IBGIB DATA
 // ===========================================================================
@@ -351,6 +395,12 @@ export interface KeystoneData_V1 extends IbGibData_V1 {
      * Acts as a snapshot to avoid walking the entire timeline.
      */
     checkpointDetails?: any;
+
+    /**
+     * Map of delegated keystones soft-linked to this parent keystone.
+     * Keyed by the delegate keystone's tjp address.
+     */
+    delegates?: { [delegateTjpAddr: IbGibAddr]: DelegateKeystoneInfo };
 }
 
 export interface KeystoneRel8ns_V1 extends IbGibRel8ns_V1 {