@ibgib/core-gib 0.1.64 → 0.1.66

package/src/keystone/keystone-helpers.mts

@@ -20,6 +20,7 @@ import {
     DelegateKeystoneInfo,
     ClaimDetails,
     ClaimDetails_AddPool,
+    ClaimDetails_RemovePool,
     ClaimDetails_ReplacePool,
     ClaimDetails_ChangePassword
 } from "./keystone-types.mjs";
@@ -468,6 +469,13 @@ export async function solveAndReplenish({
 
         const strategy = KeystoneStrategyFactory.create({ config: pool.config });
         const poolSecret = await strategy.derivePoolSecret({ masterSecret });
+
+        // Verify secret correctness before solving
+        const isSecretCorrect = await verifyPoolSecret({ pool, signingSecret: masterSecret });
+        if (!isSecretCorrect) {
+            throw new Error(`Crypto Violation: Invalid signing secret for pool: ${pool.id} (E: 8a4c2b1d3e5f6a7b8c9d0e1f2a3b4c5f)`);
+        }
+
         const solutions: KeystoneSolution[] = [];
 
         // 1. Solve
@@ -877,6 +885,8 @@ export async function validateKeystoneTransition({
         }
 
         // Claim details verification (transition validation)
+        const signingPoolIds = new Set(currData.proofs.map(p => p.solutions?.[0]?.poolId).filter(Boolean));
+
         for (const proof of currData.proofs) {
             const claim = proof.claim;
             if (claim?.details) {
@@ -918,11 +928,12 @@ export async function validateKeystoneTransition({
                             errors.push(`Existing pool ${prevPool.id} was removed during add-pool transition. (E: 5fa2a8cb28c9b60e68994511a5825)`);
                             continue;
                         }
-                        // Verify configuration and challenges did not change
+                        // Verify configuration did not change
                         if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
                             errors.push(`Existing pool config ${prevPool.id} was mutated during add-pool transition. (E: 6fa2a8cb28c9b60e68994511a5825)`);
                         }
-                        if (JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                        // Verify challenges did not change, unless this was the signing pool used to authorize the transition
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
                             errors.push(`Existing pool challenges ${prevPool.id} were mutated during add-pool transition. (E: 7fa2a8cb28c9b60e68994511a5825)`);
                         }
                     }
@@ -959,10 +970,52 @@ export async function validateKeystoneTransition({
                         if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
                             errors.push(`Unrelated pool config ${prevPool.id} was mutated during replace-pool. (E: bfa2a8cb28c9b60e68994511a5825)`);
                         }
-                        if (JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
                             errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during replace-pool. (E: cfa2a8cb28c9b60e68994511a5825)`);
                         }
                     }
+                } else if (type === 'remove-pool') {
+                    const removeInfo = info as ClaimDetails_RemovePool;
+                    if (!removeInfo || !Array.isArray(removeInfo.remove) || removeInfo.remove.length === 0) {
+                        errors.push(`details type is '${type}' but payload is invalid. (E: b7a2a8cb28c9b60e68994511a5825)`);
+                        continue;
+                    }
+
+                    const removeSet = new Set(removeInfo.remove);
+
+                    // Verify that the set of pool IDs in current equals previous minus the removed pools
+                    const prevIds = new Set(prevData.challengePools.map(p => p.id));
+                    const currIds = new Set(currData.challengePools.map(p => p.id));
+
+                    for (const id of removeInfo.remove) {
+                        if (!prevIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is missing in the previous keystone. (E: c7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (currIds.has(id)) {
+                            errors.push(`ClaimDetails_RemovePool lists pool ${id} but it is still present in the evolved keystone. (E: d7a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
+
+                    // Verify size
+                    if (currData.challengePools.length !== prevData.challengePools.length - removeInfo.remove.length) {
+                        errors.push(`Structural mismatch: expected ${prevData.challengePools.length - removeInfo.remove.length} pools, found ${currData.challengePools.length}. (E: e7a2a8cb28c9b60e68994511a5825)`);
+                    }
+
+                    // Verify all remaining pools are unmodified
+                    for (const prevPool of prevData.challengePools) {
+                        if (removeSet.has(prevPool.id)) continue;
+                        const currPool = currData.challengePools.find(p => p.id === prevPool.id);
+                        if (!currPool) {
+                            errors.push(`Pool ${prevPool.id} was unexpectedly removed. (E: f7a2a8cb28c9b60e68994511a5825)`);
+                            continue;
+                        }
+                        if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
+                            errors.push(`Remaining pool config ${prevPool.id} was mutated during remove-pool. (E: 07a2a8cb28c9b60e68994511a5825)`);
+                        }
+                        if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            errors.push(`Remaining pool challenges ${prevPool.id} were mutated during remove-pool. (E: 17a2a8cb28c9b60e68994511a5825)`);
+                        }
+                    }
 
                 } else if (type === 'change-password') {
                     const changeInfo = info as ClaimDetails_ChangePassword;
@@ -1004,7 +1057,7 @@ export async function validateKeystoneTransition({
                             if (JSON.stringify(prevPool.config) !== JSON.stringify(currPool.config)) {
                                 errors.push(`Unrelated pool config ${prevPool.id} was mutated during change-password. (E: 02b2a8cb28c9b60e68994511a5825)`);
                             }
-                            if (JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
+                            if (!signingPoolIds.has(prevPool.id) && JSON.stringify(prevPool.challenges) !== JSON.stringify(currPool.challenges)) {
                                 errors.push(`Unrelated pool challenges ${prevPool.id} were mutated during change-password. (E: 03b2a8cb28c9b60e68994511a5825)`);
                             }
                         }
@@ -1488,4 +1541,36 @@ export async function rotatePoolChallenges({
         ...(prevPool.isForeign !== undefined ? { isForeign: prevPool.isForeign } : {}),
         ...(prevPool.metadata ? { metadata: prevPool.metadata } : {})
     };
+}
+
+/**
+ * Pure helper to verify if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+ * Does not mutate any state.
+ */
+export async function verifyPoolSecret({
+    pool,
+    signingSecret
+}: {
+    pool: KeystoneChallengePool;
+    signingSecret: string;
+}): Promise<boolean> {
+    const challengeIds = Object.keys(pool.challenges);
+    if (challengeIds.length === 0) return false;
+
+    try {
+        const firstId = challengeIds[0];
+        const challenge = pool.challenges[firstId];
+
+        const strategy = KeystoneStrategyFactory.create({ config: pool.config });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: signingSecret });
+        const solution = await strategy.generateSolution({
+            poolSecret,
+            poolId: pool.id,
+            challengeId: firstId
+        });
+
+        return await strategy.validateSolution({ solution, challenge });
+    } catch {
+        return false;
+    }
 }

package/src/keystone/keystone-service-v1.mts

@@ -8,7 +8,7 @@ import {
     KeystoneData_V1, KeystoneIbGib_V1, KeystonePoolConfig, KeystoneClaim,
     KeystoneChallengePool, KeystoneReplenishStrategy, KeystoneRevocationInfo,
     DelegateKeystoneStatus, KeystoneClaimType,
-    ClaimDetails_AddPool, ClaimDetails_ReplacePool, ClaimDetails_ChangePassword
+    ClaimDetails_AddPool, ClaimDetails_RemovePool, ClaimDetails_ReplacePool, ClaimDetails_ChangePassword
 } from './keystone-types.mjs';
 import { KeystoneStrategyFactory } from './strategy/keystone-strategy-factory.mjs';
 import { createStandardPoolConfig } from './keystone-config-builder.mjs';
@@ -24,13 +24,14 @@ import {
     generateOpaqueChallengeId, resolveTargetPool, selectChallengeIds,
     solveAndReplenish, validateKeystoneTransition,
     validateGenesisKeystone, validateKeystoneGraph,
-    generatePoolChallenges, rotatePoolChallenges
+    generatePoolChallenges, rotatePoolChallenges, verifyPoolSecret
 } from './keystone-helpers.mjs';
 import { getLatestAddrs } from '../witness/space/space-helper.mjs';
 import { IbGibSpaceAny } from '../witness/space/space-base-v1.mjs';
 import { MetaspaceService } from '../witness/space/metaspace/metaspace-types.mjs';
 import { FlatIbGibGraph } from '../common/other/graph-types.mjs';
 import { getTjpAddr } from '../common/other/ibgib-helper.mjs';
+import { deriveDelegateSecret } from './strategy/hash-reveal-v1/hash-reveal-v1.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT;
 
@@ -796,6 +797,128 @@ export class KeystoneService_V1 {
         }
     }
 
+    /**
+     * Structural evolution: Removes challenge pools from the keystone.
+     *
+     * Use Case: Unlinking a custodian or delegate SSO pool.
+     *
+     * Requires the Master Secret to authorize the change via a pool containing
+     * the 'manage' verb (the administrative manage pool).
+     */
+    async removePools({
+        latestKeystone,
+        masterSecret,
+        poolIds,
+        metaspace,
+        space,
+    }: {
+        latestKeystone: KeystoneIbGib_V1;
+        /**
+         * Alice's Master Secret.
+         * Required to solve challenges from the Admin/Manage pool to authorize this change.
+         */
+        masterSecret: string;
+        /**
+         * The IDs of the pools to remove.
+         */
+        poolIds: string[];
+        metaspace: MetaspaceService;
+        space: IbGibSpaceAny;
+    }): Promise<KeystoneIbGib_V1> {
+        const lc = `${this.lc}[${this.removePools.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting...`); }
+
+            if (!latestKeystone.data) { throw new Error(`(UNEXPECTED) latestKeystone.data falsy? (E: 8334c8faed128166a999d428c7805b25)`); }
+            const prevData = latestKeystone.data;
+
+            if (prevData.revocationInfo) { throw new Error(`Keystone has been revoked. Cannot remove pools. (E: 9599f8f51c78d722252ddb2894fdbe25)`); }
+
+            if (poolIds.length === 0) { throw new Error(`No pool IDs provided to remove. (E: 7599f8f51c78d722252ddb2894fdbe25)`); }
+
+            // 1. Identify Authority (Resolve Admin Pool)
+            const adminPool = resolveTargetPool({
+                pools: prevData.challengePools,
+                verb: KEYSTONE_VERB_MANAGE,
+            });
+
+            if (logalot) { console.log(`${lc} Authorized via pool: ${adminPool.id}`); }
+
+            // 2. Construct the Management Claim with typed details
+            const target = getIbGibAddr({ ibGib: latestKeystone });
+            const claim: Partial<KeystoneClaim> = {
+                verb: KEYSTONE_VERB_MANAGE,
+                target,
+                details: {
+                    type: KeystoneClaimType.remove_pool,
+                    info: { remove: poolIds } as ClaimDetails_RemovePool
+                }
+            };
+
+            // 3. Calculate Costs
+            const idsToSolve = await selectChallengeIds({
+                pool: adminPool,
+                targetAddr: target
+            });
+
+            // 4. Pay the Cost (Solve & Replenish)
+            const { proof, nextPools: replenishedExistingPools } = await solveAndReplenish({
+                targetPoolId: adminPool.id,
+                prevPools: prevData.challengePools,
+                masterSecret,
+                challengeIds: idsToSolve,
+                claim,
+            });
+
+            // 5. Mutate Structure (Remove the pools)
+            const removeSet = new Set(poolIds);
+            const finalPools = replenishedExistingPools.filter(p => !removeSet.has(p.id));
+
+            // Verify that we actually removed the expected count of pools
+            if (finalPools.length !== replenishedExistingPools.length - poolIds.length) {
+                const missingIds = poolIds.filter(id => !replenishedExistingPools.some(p => p.id === id));
+                throw new Error(`Cannot remove pool. Pool IDs not found in keystone: ${missingIds.join(', ')} (E: 8a4c2b1d3e5f6a7b8c9d0e1f2a3b4c5e)`);
+            }
+
+            // 6. Construct New Data
+            const n = (prevData.n ?? 0) + 1;
+            let checkpointDetails: any | undefined;
+            if (n % KEYSTONE_CHECKPOINT_FREQUENCY === 0) {
+                const currentFrameView: KeystoneIbGib_V1 = {
+                    ...latestKeystone,
+                    data: { ...prevData, challengePools: finalPools }
+                };
+                checkpointDetails = await this.getAggregateDetails({
+                    latestKeystone: currentFrameView,
+                    metaspace,
+                    space
+                });
+            }
+
+            const newData: KeystoneData_V1 = {
+                challengePools: finalPools,
+                proofs: [proof],
+                checkpointDetails,
+                ...(prevData.delegates ? { delegates: prevData.delegates } : {}),
+            };
+
+            // 7. Commit
+            const newKeystone = await evolvePersistAndRegisterKeystone({
+                prevIbGib: latestKeystone,
+                newData,
+                metaspace,
+                space
+            });
+
+            return newKeystone;
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    }
+
     /**
      * Consolidates the state of a Keystone identity across its history.
      * Walks back until it hits a checkpoint or genesis.
@@ -938,19 +1061,19 @@ export class KeystoneService_V1 {
     /**
      * Replaces a challenge pool (such as manage or custodian-manage) with a new pool,
      * authorizing the transition via the specified signing pool.
-     * 
+     *
      * @param latestKeystone The current tip frame of the keystone timeline.
      *   - Visibility: Public (Public Merkle frame, safe for logs/ledger).
      *   - Generator: Client/Server (Constructed locally and synced).
-     * 
+     *
      * @param newPool The fully constructed new pool to place in the next frame.
      *   - Visibility: Public (Public configuration and public challenges, safe for ledger).
      *   - Generator: Client/Server (Generated dynamically by the party proposing the update).
-     * 
+     *
      * @param signingSecret The master secret or derived KDF secret of the pool authorizing the change.
      *   - Visibility: Private (Confidential secret credential. Must never go over the wire).
      *   - Generator: Client/Server (Known only to the signing party).
-     * 
+     *
      * @param signingPoolId The ID of the pool used to authorize the transition (defaults to 'manage').
      *   - Visibility: Public (Non-sensitive configuration string).
      *   - Generator: Client/Server (From pool configuration).
@@ -1064,28 +1187,17 @@ export class KeystoneService_V1 {
     /**
      * Evolve the keystone by rotating the primary user manage pool (`manage`) to a new master secret (passphrase).
      * This creates a new frame signed by the specified `signingPoolId` using `signingSecret`.
-     * 
-     * Supports recovery (signing via `custodian-manage` using the custodian secret) and normal rotation 
-     * (signing via `manage` using the old password).
-     * 
-     * @param latestKeystone The current tip frame of the keystone.
-     *   - Visibility: Public (Public Merkle frame, safe for ledger).
-     *   - Generator: Client/Server (Constructed locally and synced).
-     * 
-     * @param newMasterSecret The new passphrase/master secret to set for the user's primary pools.
-     *   - Visibility: Private (Confidential secret credential. Must never go over the wire).
-     *   - Generator: Client (From user input in settings).
-     * 
-     * @param signingSecret The secret of the pool authorizing this change (either old passphrase or derived custodian secret).
-     *   - Visibility: Private (Confidential secret. Must never go over the wire).
-     *   - Generator: Client/Server (Known only to the signing party).
-     * 
-     * @param signingPoolId The ID of the pool used to authorize the rotation (defaults to 'manage').
-     *   - Visibility: Public (Non-sensitive ID string).
-     *   - Generator: Client/Server (From pool configuration).
+     *
+     * Supports recovery (signing via `custodian-manage` using the custodian secret) and normal rotation
+     * (signing via `manage` using the old password). **I DONT THINK THIS IS POSSIBLE. WE WOULD NEED CUSTODIAN MANAGE POOLS ON ALL THE DELEGATES AS WELL**
+     *
+     * @param signingSecret
+     *
+     * @param signingPoolId
      */
     async changePassword({
-        latestKeystone,
+        keystoneIbGib,
+        keystoneAddr,
         newMasterSecret,
         signingSecret,
         signingPoolId = POOL_ID_MANAGE,
@@ -1094,21 +1206,82 @@ export class KeystoneService_V1 {
         metaspace,
         space,
     }: {
-        latestKeystone: KeystoneIbGib_V1;
+        /**
+         * The keystone IBGIB whose password we are changing. Does NOT have to
+         * be the tip, as we will get the latest keystone in the implementation
+         * of this function.
+         * - Visibility: Public (Public Merkle frame, safe for ledger).
+         * - Generator: Client/Server (Constructed locally and synced).
+         *
+         * NOTE: You can provide {@link keystoneIbGib} or {@link keystoneAddr},
+         * but either way the latest keystone ibgib will be gotten first.
+         */
+        keystoneIbGib?: KeystoneIbGib_V1;
+        /**
+         * The keystone ADDRESS whose password we are changing. Does NOT have to
+         * be the tip, as we will get the latest keystone in the implementation
+         * of this function.
+         * - Visibility: Public (Public Merkle frame, safe for ledger).
+         * - Generator: Client/Server (Constructed locally and synced).
+         *
+         * NOTE: You can provide {@link keystoneIbGib} or {@link keystoneAddr},
+         * but either way the latest keystone ibgib will be gotten first.
+         */
+        keystoneAddr?: IbGibAddr;
+        /**
+         * The new passphrase/master secret to set for the user's primary pools.
+         * - Visibility: Private (Confidential secret credential. Must never go
+         *   over the wire).
+         * - Generator: Client (From user input in settings).
+         */
         newMasterSecret: string;
+        /**
+         * The secret of the pool authorizing this change (either old passphrase
+         * or derived custodian secret).
+         * - Visibility: Private (Confidential secret. Never over the wire).
+         * - Generator: Client/Server (Known only to the signing party).
+         */
         signingSecret: string;
+        /**
+         * The ID of the pool used to authorize the rotation. Defaults to
+         * "manage" for user password changes, or if rotating custodian, should
+         * be the custodian's corresponding manage pool.
+         * - Visibility: Public (Non-sensitive ID string).
+         * - Generator: Client/Server (From pool configuration).
+         */
         signingPoolId?: string;
+        /**
+         * If provided, password will only be changed for these pools.
+         * NOTE: **delegate passwords will NOT be changed if poolIds are
+         *       explicitly provided.**
+         */
         poolIds?: string[];
         frameDetails?: any;
         metaspace: MetaspaceService;
         space: IbGibSpaceAny;
-    }): Promise<KeystoneIbGib_V1> {
+    }): Promise<{ newKeystone: KeystoneIbGib_V1, newDelegates?: KeystoneIbGib_V1[] }> {
         const lc = `${this.lc}[${this.changePassword.name}]`;
         try {
-            if (logalot) { console.log(`${lc} starting...`); }
-            
-            if (!latestKeystone.data) { throw new Error(`latestKeystone.data falsy`); }
-            if (latestKeystone.data.revocationInfo) { throw new Error(`Keystone has been revoked. Cannot change password. (E: 8599f8f51c78d722252ddb2894fdbe25)`); }
+            if (logalot) { console.log(`${lc} starting... (I: 9e3ff83ebd74511f9dad784a1020d926)`); }
+
+            if (!keystoneIbGib && !keystoneAddr) { throw new Error(`Either keystoneIbGib or keystoneAddr required. (E: d1b8c8cb75f2c022284e69b8c30af826)`); }
+            if (keystoneIbGib && keystoneAddr) {
+                // double check addr matches ibgib
+                const checkAddr = getIbGibAddr({ ibGib: keystoneIbGib });
+                if (checkAddr !== keystoneAddr) { throw new Error(`(UNEXPECTED) both keystoneIbGib (addr: ${checkAddr}) and keystoneAddr (${keystoneAddr}) provided, but the addrs are unequal? Note that only one is required for this function, but if both are provided the addrs must match exactly. (E: c5574f7e353a48b0bba94a1862af4e26)`); }
+            }
+
+            keystoneAddr ??= getIbGibAddr({ ibGib: keystoneIbGib });
+
+            const latestKeystone = await this.getLatestKeystone({
+                addr: keystoneAddr,
+                metaspace,
+                space,
+            });
+
+            if (!latestKeystone.data) { throw new Error(`latestKeystone.data falsy (E: 22e498eb8308a33e68b812d8d3905826)`); }
+            if (latestKeystone.data.revocationInfo) { throw new Error(`Keystone has been revoked. Cannot change password. (E: 726298617e8508b3c83b5e985a03e826)`); }
+
 
             const prevPools = latestKeystone.data.challengePools;
             const signingPool = prevPools.find(p => p.id === signingPoolId);
@@ -1198,19 +1371,74 @@ export class KeystoneService_V1 {
                 proofs: [proof],
                 frameDetails,
                 checkpointDetails,
-                ...(latestKeystone.data.delegates ? { delegates: latestKeystone.data.delegates } : {}),
+                ...(latestKeystone.data.delegates ? { delegates: latestKeystone.data.delegates } : undefined),
             };
 
             // 8. Commit
-            return await evolvePersistAndRegisterKeystone({
+            const newKeystoneIbGib = await evolvePersistAndRegisterKeystone({
                 prevIbGib: latestKeystone,
                 newData,
                 metaspace,
                 space
             });
+
+            // update delegates' passwords also, **BUT ONLY IF NOT DOING
+            // SPECIFIC POOLS**.
+            const newDelegates: KeystoneIbGib_V1[] = [];
+            if ((poolIds ?? []).length === 0) {
+                const delegateSigningSecret = await deriveDelegateSecret({ masterSecret: signingSecret });
+                const delegateNewMasterSecret = await deriveDelegateSecret({ masterSecret: newMasterSecret });
+                const delegateTjpAddrs = Object.keys(latestKeystone.data.delegates ?? {});
+                for (const delegateTjpAddr of delegateTjpAddrs) {
+                    const { newKeystone: newDelegate, newDelegates: newDelegatesSecondOrder } = await this.changePassword({
+                        keystoneAddr: delegateTjpAddr,
+                        metaspace,
+                        space,
+                        newMasterSecret: delegateNewMasterSecret,
+                        signingSecret: delegateSigningSecret,
+                        signingPoolId,
+                        poolIds: undefined,
+                        frameDetails,
+                    });
+                    if (newDelegatesSecondOrder && newDelegatesSecondOrder.length > 0) {
+                        throw new Error(`(UNEXPECTED) Delegate keystone has its own delegate(s)? ATOW (07/20/2026) second order delegates are not supported. (E: de45a7b7d9b8f61f6e58158269acba26)`);
+                    }
+                    newDelegates.push(newDelegate);
+                }
+            }
+
+            return { newKeystone: newKeystoneIbGib, newDelegates: newDelegates.length > 0 ? newDelegates : undefined };
         } catch (error) {
             console.error(`${lc} ${extractErrorMsg(error)}`);
             throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    }
+
+    /**
+     * Verifies if a candidate signing secret (passphrase) is correct for a specific challenge pool.
+     * Does not mutate any state.
+     */
+    async verifySigningSecret({
+        keystoneIbGib,
+        signingSecret,
+        poolId
+    }: {
+        keystoneIbGib: KeystoneIbGib_V1;
+        signingSecret: string;
+        poolId: string;
+    }): Promise<boolean> {
+        const lc = `${this.lc}[${this.verifySigningSecret.name}]`;
+        try {
+            if (!keystoneIbGib.data) return false;
+            const pool = keystoneIbGib.data.challengePools.find(p => p.id === poolId);
+            if (!pool) return false;
+
+            return await verifyPoolSecret({ pool, signingSecret });
+        } catch (error) {
+            console.warn(`${lc} Exception during verification: ${extractErrorMsg(error)}`);
+            return false;
         }
     }
 }