@ibgib/node-gib 0.0.15 → 0.0.17

package/src/serve-gib/handlers/api/identity/keystone-custodian-register-delegate.respec.mts

@@ -0,0 +1,112 @@
+import { existsSync, rmSync } from 'node:fs';
+
+import {
+    respecfully,
+    iReckon,
+    ifWe
+} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+
+import { KeystoneCustodianGenesisHandler } from './keystone-custodian-genesis.handler.mjs';
+import { KeystoneCustodianRegisterDelegateHandler } from './keystone-custodian-register-delegate.handler.mjs';
+import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { deriveLocalCustodianDelegateSecret } from '@ibgib/web-gib/dist/identity/custodian-delegate-helper.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
+
+const sir = `[${import.meta.url}]`;
+
+await respecfully(sir, 'KeystoneCustodianRegisterDelegateHandler', async () => {
+    const testDataDir = './test-data-custodian-register';
+
+    if (existsSync(testDataDir)) {
+        rmSync(testDataDir, { recursive: true, force: true });
+    }
+
+    const origDataDir = process.env.DATA_DIR;
+    process.env.DATA_DIR = testDataDir;
+
+    const genesisHandler = new KeystoneCustodianGenesisHandler();
+    const registerHandler = new KeystoneCustodianRegisterDelegateHandler();
+
+    await ifWe(sir, 'reject request with 400 if delegateKeystone or custodianReqs is missing', async () => {
+        const reqCtx: any = {
+            method: 'POST',
+            body: JSON.stringify({}),
+            dataDir: testDataDir
+        };
+
+        const res = await registerHandler.handleRoute(reqCtx);
+        iReckon(sir, res?.status).isGonnaBe(400);
+    });
+
+    await ifWe(sir, 'successfully register delegate keystone and evolve primary identity keystone', async () => {
+        // Step 1: Genesis via custodian genesis handler
+        const genesisReqCtx: any = {
+            method: 'POST',
+            body: JSON.stringify({ email: 'bob.custodian@example.com', username: 'bob' }),
+            dataDir: testDataDir
+        };
+
+        const genesisRes = await genesisHandler.handleRoute(genesisReqCtx);
+        iReckon(sir, genesisRes?.status).isGonnaBe(201);
+
+        const genesisBody = JSON.parse(genesisRes?.body || '{}');
+        const primaryTjpAddr = genesisBody.primaryTjpAddr;
+        const custodianReqs = genesisBody.custodianReqs;
+
+        iReckon(sir, primaryTjpAddr).not.isGonnaBeUndefined();
+        iReckon(sir, custodianReqs).not.isGonnaBeUndefined();
+
+        // Step 2: Build client delegate keystone containing custodianReqs
+        const delegateSecret = await deriveLocalCustodianDelegateSecret({ primaryTjpAddr });
+        const delegateBuilder = KeystoneProfileBuilder.buildKeystone('sync')
+            .withUsername('bob-sync-phone')
+            .withDescription('Sync Delegate for bob on phone')
+            .withDetails({
+                client: 'space-gib-web',
+                role: 'sync-delegate',
+                deviceTag: 'phone',
+                primaryTjpAddr,
+                custodianReqs,
+            });
+
+        const configs = await delegateBuilder.compileConfigs();
+        const metaspace = await bootstrapDomainMetaspace(primaryTjpAddr, testDataDir);
+        const space = await metaspace.getLocalUserSpace({ lock: false });
+
+        const keystoneService = new KeystoneService_V1();
+        const delegateKeystone = await keystoneService.genesis({
+            masterSecret: delegateSecret,
+            configs,
+            metaspace,
+            space: space!,
+            frameDetails: delegateBuilder.getFrameDetails(),
+            isPrimary: false
+        });
+
+        // Step 3: Register delegate keystone with server
+        const registerReqCtx: any = {
+            method: 'POST',
+            body: JSON.stringify({ delegateKeystone }),
+            dataDir: testDataDir
+        };
+
+        const registerRes = await registerHandler.handleRoute(registerReqCtx);
+        iReckon(sir, registerRes?.status).isGonnaBe(200);
+
+        const registerBody = JSON.parse(registerRes?.body || '{}');
+        iReckon(sir, registerBody.success).isGonnaBeTrue();
+        iReckon(sir, registerBody.primaryTjpAddr).isGonnaBe(primaryTjpAddr);
+        iReckon(sir, registerBody.evolvedPrimaryKeystone).not.isGonnaBeUndefined();
+
+        // Verify primary keystone frame n=1 has been evolved
+        const evolvedPrimary = registerBody.evolvedPrimaryKeystone;
+        iReckon(sir, evolvedPrimary.data?.n).isGonnaBe(1);
+    });
+
+    // Cleanup
+    process.env.DATA_DIR = origDataDir;
+    if (existsSync(testDataDir)) {
+        rmSync(testDataDir, { recursive: true, force: true });
+    }
+});

package/src/serve-gib/handlers/api/keystone/sso-login.handler.mts

@@ -1,17 +1,28 @@
-import { createHmac } from 'node:crypto';
-import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+/**
+ * @module serve-gib/handlers/api/keystone/sso-login.handler
+ *
+ * POST /api/identity/sso/login
+ *
+ * Handles OAuth2 SSO code exchange (Google, GitHub, etc.).
+ * Retrieves verified email, looks up or provisions the custodian primary identity keystone,
+ * generates a fresh single-turn `CustodianRequirements` payload, and returns it to the client.
+ */
+
+import { extractErrorMsg, hash, getUUID } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getTjpAddr } from '@ibgib/core-gib/dist/common/other/ibgib-helper.mjs';
+import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerBase } from '../../handler-base.mjs';
+import { API_PATH_REGEXES } from '../../../path-constants.mjs';
+import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
 import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
 import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
-import { KEYSTONE_VERB_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
-import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
 import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
-import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
-
-import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
-import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
-import { API_PATH_REGEXES } from '../../../path-constants.mjs';
-import { ParamsWithDomain, RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+import { generateCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT;
 
@@ -24,196 +35,163 @@ function getCustodian(): SsoCustodianService {
     return custodian;
 }
 
-function signSessionToken(payload: any, secret: string): string {
-    const header = { alg: 'HS256', typ: 'JWT' };
-    const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
-    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    const data = `${headerB64}.${payloadB64}`;
-    const signature = createHmac('sha256', secret).update(data).digest('base64url');
-    return `${data}.${signature}`;
-}
-
-interface LoginParams extends ParamsWithDomain {
-    parentTjpAddr?: string;
-}
-
-interface LoginBody {
+export interface SsoLoginBody {
     code: string;
     providerId: SsoProviderId;
-    parentTjpAddr?: string;
-    userNonce: string;
     redirectUri: string;
 }
 
+export interface SsoLoginResponseBody {
+    success: boolean;
+    isNewIdentity?: boolean;
+    primaryTjpAddr?: string;
+    primaryKeystone?: any;
+    custodianReqs?: any;
+    userInfo?: any;
+    message?: string;
+}
+
 /**
  * POST /api/identity/sso/login
- *
- * Exposes login endpoint for SSO authentication. Verifies provider identity, asserts
- * that the deterministic server-delegate keystone is registered in the parent keystone,
- * and yields a secure HttpOnly session token.
  */
-export class SsoLoginHandler extends ServeGibHandlerWithMetaspaceBase<LoginParams, any> {
+export class SsoLoginHandler extends ServeGibHandlerBase<undefined, undefined> {
     protected override lc: string = `[${SsoLoginHandler.name}]`;
     protected override method: ServeGibHttpMethod = 'POST';
     protected override regex = API_PATH_REGEXES.IDENTITY_SSO_LOGIN;
 
-    protected override async parseParamsImpl(reqCtx: RequestContext<LoginParams, any>): Promise<LoginParams | undefined> {
-        let parsed: any;
-        try {
-            parsed = JSON.parse(reqCtx.body);
-        } catch {
-            return { parentTjpAddr: undefined, domainInfo: undefined as any };
-        }
-        const parentTjpAddr = parsed?.parentTjpAddr;
-        return {
-            parentTjpAddr,
-            domainInfo: parentTjpAddr ? this.getDomainInfo({ domainAddr: parentTjpAddr }) : (undefined as any)
-        };
-    }
-
-    protected override async initConcreteContext(reqCtx: RequestContext<LoginParams, any>): Promise<void> {
-        if (reqCtx.params?.domainInfo) {
-            await this.initAndPopulateDomainContext(reqCtx);
-        }
+    protected override async parseParamsImpl(): Promise<undefined> {
+        return undefined;
     }
 
-    protected override async validateQueryParams({ queryParams }: { queryParams: any }): Promise<string[]> {
+    protected override async validateQueryParams(): Promise<string[]> {
         return [];
     }
 
-    protected async handleRouteImpl(reqCtx: RequestContext<LoginParams>): Promise<ResponseResult | undefined> {
+    protected async handleRouteImpl(
+        reqCtx: RequestContext<undefined, undefined>
+    ): Promise<ResponseResult | undefined> {
         const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
         try {
             if (logalot) { console.log(`${lc} starting... (I: 9b5d2a3c4e5f67890a1b2c3d4e5f6789)`); }
 
-            let parsed: LoginBody;
+            if (reqCtx.method !== 'POST') {
+                return this.error(405, 'Method Not Allowed');
+            }
+
+            if (!reqCtx.body) {
+                return this.error(400, 'Request body is empty (E: 0a1b2c3d4e5f67890a1b2c3d4e5f6789)');
+            }
+
+            let parsed: SsoLoginBody;
             try {
                 parsed = JSON.parse(reqCtx.body);
             } catch {
-                return this.error(400, 'Request body must be valid JSON (E: 0a1b2c3d4e5f67890a1b2c3d4e5f6789)');
+                return this.error(400, 'Request body must be valid JSON (E: 1a1b2c3d4e5f67890a1b2c3d4e5f6789)');
             }
 
-            const { code, providerId, userNonce, redirectUri } = parsed;
-            let parentTjpAddr = parsed?.parentTjpAddr;
-            if (!code || !providerId || !userNonce || !redirectUri) {
-                return this.error(400, 'Body missing required parameters (code, providerId, userNonce, redirectUri) (E: 1b2c3d4e5f678901b2c3d4e5f6789012)');
+            const { code, providerId, redirectUri } = parsed;
+            if (!code || !providerId || !redirectUri) {
+                return this.error(400, 'Body missing required parameters (code, providerId, redirectUri) (E: 2b2c3d4e5f678901b2c3d4e5f6789012)');
             }
 
-            // 1. Authenticate with provider and retrieve user info
+            // 1. Authenticate code with provider and retrieve normalized user info
             const service = getCustodian();
             const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
 
-            let resolvedParentTjpAddr = parentTjpAddr;
-            if (!resolvedParentTjpAddr) {
-                if (!userInfo.email) {
-                    return this.error(404, 'No email returned from SSO provider to perform identity lookup. (E: 2c3d4e5f67890123c4d5e6f789012345)');
-                }
-                const lookup = await getIdentityIndexService().lookupIdentityByEmail({
-                    email: userInfo.email,
-                });
-                if (!lookup || !lookup.primaryTjpAddr) {
-                    return this.error(404, `No identity found linked to email ${userInfo.email} (E: 3d4e5f6789012345d6e7f89012345678)`);
-                }
-                resolvedParentTjpAddr = lookup.primaryTjpAddr;
-            }
-
-            // Ensure metaspace is initialized with resolvedParentTjpAddr
-            if (!reqCtx.metaspace) {
-                reqCtx.metaspace = await bootstrapDomainMetaspace(resolvedParentTjpAddr, reqCtx.dataDir);
-            }
-
-            const space = await reqCtx.metaspace.getLocalUserSpace({ lock: false });
-            if (!space) {
-                return this.error(500, 'No local user space found in domain metaspace (E: 4e5f678901234567e8f9012345678901)');
-            }
-
-            // 2. Derive custodian secret using providerKey and userNonce
-            const custodianSecret = await service.deriveServerDelegateSecret(userInfo.providerKey, userNonce);
-
-            // 3. Fetch latest parent keystone from metaspace
-            const latestParentAddr = await reqCtx.metaspace.getLatestAddr({ addr: resolvedParentTjpAddr, space });
-            if (!latestParentAddr) {
-                return this.error(404, `Parent identity keystone not found for address: ${resolvedParentTjpAddr} (E: 5f67890123456789f0a1b23456789012)`);
+            if (!userInfo || !userInfo.email) {
+                return this.error(400, `No email address returned from SSO provider ${providerId} (E: 3c3d4e5f67890123c4d5e6f789012345)`);
             }
 
-            const resGet = await reqCtx.metaspace.get({ addr: latestParentAddr, space });
-            const parentKeystone = resGet.ibGibs?.[0];
-            if (!parentKeystone) {
-                return this.error(404, `Parent identity keystone not found in space for address: ${latestParentAddr} (E: 6078901234567890a1b2c34567890123)`);
-            }
+            const email = userInfo.email.trim().toLowerCase();
+            const username = userInfo.name || email.split('@')[0];
+
+            // 2. Check if primary identity exists for this email
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const primarySecret = await hash({ s: `${serverSecret}_custodian_${email}` });
+
+            const indexService = getIdentityIndexService();
+            const existingLookup = await indexService.lookupIdentityByEmail({ email });
+
+            let primaryTjpAddr: string;
+            let primaryKeystone: any;
+            let isNewIdentity = false;
+
+            if (existingLookup && existingLookup.primaryTjpAddr) {
+                // Existing identity
+                primaryTjpAddr = existingLookup.primaryTjpAddr;
+                const domainMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const space = await domainMetaspace.getLocalUserSpace({ lock: false });
+
+                const latestPrimaryAddr = await domainMetaspace.getLatestAddr({ addr: primaryTjpAddr, space: space! }) ?? primaryTjpAddr;
+                const getRes = await domainMetaspace.get({ addrs: [latestPrimaryAddr], space: space! });
+                primaryKeystone = getRes.ibGibs?.[0];
+            } else {
+                // First-time custodian identity creation
+                isNewIdentity = true;
+                const tempId = await getUUID();
+                const tempDomainMetaspace = await bootstrapDomainMetaspace(`temp^${tempId}`, reqCtx.dataDir);
+                const tempSpace = await tempDomainMetaspace.getLocalUserSpace({ lock: false });
+
+                const primaryBuilder = KeystoneProfileBuilder.buildKeystone('domain')
+                    .withUsername(username)
+                    .withEmails([email])
+                    .withDetails({
+                        client: 'space-gib-server',
+                        role: 'custodian-primary',
+                        custodianProvider: providerId,
+                    });
+
+                const configs = await primaryBuilder.compileConfigs();
+                const keystoneService = new KeystoneService_V1();
+                primaryKeystone = await keystoneService.genesis({
+                    masterSecret: primarySecret,
+                    emails: [email],
+                    frameDetails: primaryBuilder.getFrameDetails(),
+                    configs,
+                    metaspace: tempDomainMetaspace,
+                    space: tempSpace!,
+                    isPrimary: true
+                });
 
-            // 4. Resolve the custodian pool from the parent keystone using dynamic poolId
-            const targetPoolId = `custodian-manage-${providerId}`;
-            const custodianPool = parentKeystone.data?.challengePools?.find((p: any) => p.id === targetPoolId);
-            if (!custodianPool) {
-                return this.error(401, `Unauthorized: Custodian pool '${targetPoolId}' is not registered in the parent identity keystone. (E: 7189012345678901b2c3d45678901234)`);
-            }
+                primaryTjpAddr = getTjpAddr({ ibGib: primaryKeystone, defaultIfNone: 'incomingAddr' })!;
 
-            // 5. Assert allowed verbs contain KEYSTONE_VERB_MANAGE
-            const allowedVerbs = custodianPool.config.allowedVerbs || [];
-            if (!allowedVerbs.includes(KEYSTONE_VERB_MANAGE)) {
-                return this.error(401, `Unauthorized: Custodian pool does not have the required manage permission. (E: 8290123456789012c3d4e56789012345)`);
-            }
+                // Persist into permanent domain space & register index
+                const permanentMetaspace = await bootstrapDomainMetaspace(primaryTjpAddr, reqCtx.dataDir);
+                const permanentSpace = await permanentMetaspace.getLocalUserSpace({ lock: false });
 
-            // 6. Cryptographically verify the custodian secret against the pool's challenges
-            const strategy = KeystoneStrategyFactory.create({ config: custodianPool.config });
-            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+                await permanentMetaspace.put({ ibGibs: [primaryKeystone], space: permanentSpace! });
+                await permanentMetaspace.registerNewIbGib({ ibGib: primaryKeystone, space: permanentSpace! });
 
-            for (const [id, challenge] of Object.entries(custodianPool.challenges)) {
-                const solution = await strategy.generateSolution({
-                    poolSecret,
-                    poolId: custodianPool.id,
-                    challengeId: id
+                await indexService.registerEmailIndex({
+                    email,
+                    primaryTjpAddr
                 });
-                const hashValue = await strategy.generateChallenge({ solution });
-                if (hashValue.hash !== (challenge as any).hash) {
-                    return this.error(401, 'Unauthorized: Cryptographic verification of custodian pool challenges failed. (E: 9301234567890123d4e5f67890123456)');
-                }
             }
 
-            // Fetch domain graph to return in response
-            const domainGraph = await reqCtx.metaspace.getDependencyGraph({
-                ibGibAddr: latestParentAddr,
-                live: false,
-                space,
+            // 3. Generate single-turn custodian requirements payload
+            const custodianReqs = await generateCustodianRequirements({
+                primaryTjpAddr,
+                serverSecret
             });
 
-            // 7. Issue secure HttpOnly session cookie
-            const sessionPayload = {
-                parentTjpAddr: resolvedParentTjpAddr,
-                providerKey: userInfo.providerKey,
-                exp: Math.floor(Date.now() / 1000) + 24 * 3600 // 24-hour expiration
-            };
-
-            const config = loadSsoServerConfig();
-            const sessionToken = signSessionToken(sessionPayload, config.sessionSecret);
-
-            const headers = {
-                'Set-Cookie': `space_gib_session=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`
-            };
-
-            console.log(`${lc} login successful for parent: ${resolvedParentTjpAddr}, custodian providerKey: ${userInfo.providerKey} (I: 0412345678901234e5f6a78901234567)`);
-
-            return {
-                status: 200,
-                headers,
-                body: {
-                    success: true,
-                    parentTjpAddr: resolvedParentTjpAddr,
-                    domainGraph,
-                    token: sessionToken,
-                    custodianPoolId: custodianPool.id
-                },
-                isJson: true
+            const responseBody: SsoLoginResponseBody = {
+                success: true,
+                isNewIdentity,
+                primaryTjpAddr,
+                primaryKeystone,
+                custodianReqs,
+                userInfo,
+                message: isNewIdentity ? 'Created new custodian identity via SSO' : 'Looked up existing custodian identity via SSO'
             };
 
+            return this.ok(responseBody, 200);
         } catch (error) {
             const emsg = extractErrorMsg(error);
-            console.error(`${lc} Login failed: ${emsg} (E: 1523456789012345f6a7b89012345678)`);
-            return this.error(500, `Login failed: ${emsg} (E: 2634567890123456a7b8c90123456789)`);
+            console.error(`${lc} SSO login failed: ${emsg} (E: 4d5e6f7890123456e7f8901234567890)`);
+            return this.error(500, `SSO login failed: ${emsg}`);
         } finally {
-            if (logalot) { console.log(`${lc} complete. (I: 3745678901234567b8c9d01234567890)`); }
+            if (logalot) { console.log(`${lc} complete.`); }
         }
     }
 }
-

package/src/serve-gib/index.mts

@@ -34,6 +34,8 @@ export * from './handlers/api/keystone/keystone-check-email.handler.mjs';
 export * from './handlers/api/keystone/sso-config.handler.mjs';
 export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';
@@ -56,6 +58,8 @@ import { KeystoneCheckEmailHandler } from './handlers/api/keystone/keystone-chec
 import { SsoLinkHandler } from './handlers/api/keystone/sso-link.handler.mjs';
 import { SsoLoginHandler } from './handlers/api/keystone/sso-login.handler.mjs';
 import { SsoConfigHandler } from './handlers/api/keystone/sso-config.handler.mjs';
+import { KeystoneCustodianGenesisHandler } from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
+import { KeystoneCustodianRegisterDelegateHandler } from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
 import { EmailInboundHandler } from './handlers/api/email/email-inbound.handler.mjs';
 import { EmailOutboundHandler } from './handlers/api/email/email-outbound.handler.mjs';
 import { EmailVerificationCodeHandler } from './handlers/api/email/email-verification-code.handler.mjs';
@@ -83,6 +87,8 @@ export function getStandardServeGibHandlers(opts: StandardHandlersOptions = {}):
         new SsoLinkHandler(),
         new SsoLoginHandler(),
         new SsoConfigHandler(),
+        new KeystoneCustodianGenesisHandler(),
+        new KeystoneCustodianRegisterDelegateHandler(),
         new EmailInboundHandler(),
         new EmailOutboundHandler(),
         new EmailVerificationCodeHandler(),

package/src/serve-gib/path-constants.mts

@@ -124,6 +124,16 @@ export const API_PATH_REGEXES = {
      */
     EMAIL_VERIFY: /^\/api\/email\/verify\/?$/,
     EMAIL_VERIFY_CODE: /^\/api\/email\/verify-code\/?$/,
+
+    /**
+     * /api/identity/custodian/genesis
+     */
+    KEYSTONE_CUSTODIAN_GENESIS: /^\/api\/identity\/custodian\/genesis\/?$/i,
+
+    /**
+     * /api/identity/custodian/register-delegate
+     */
+    KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: /^\/api\/identity\/custodian\/register-delegate\/?$/i,
 };
 
 export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/gib/bootstrap.json

@@ -1 +0,0 @@
-{"ib":"bootstrap","gib":"gib","data":{"defaultSpaceId":"d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851","spaceIds":["d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851"]},"rel8ns":{"d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851":["witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^E29F9D7079B2CA126101C4BA66263131AF05A5CFA898BC1225E932194BE48658.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C"]}}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/0507.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^FCC2DB0507B5A0A34481C2C9A18F663A6C204A5CBAEE393AF694DA4CBAA83984.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "vrnsq2.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/0886.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^1F3F1B08864857C79387DFA89E9447BD531268C741265A5097139C637BCF7958.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "aa6mm4.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/0AC8.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^FF9C8C0AC894603DE8110E3A5E7783A9DFA7F4EFA2FACC38B3E6E07F2FBEC918.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "898a74.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/0FC6.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^3A2B350FC6F2C4E3EAE282CF7F7F2D93367B4062C4C8F61753B45295ED3FAD83.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "4t03hq.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/1002.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^8D3B02100245AADB505FD767A50353352F6D13668619CFF9E25953F5040850E2.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "yfwzwv.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/1ABE.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^3926D61ABE09BEEAC165C26188906E319F396A947567CBCD8B85E0A7AEC4F424.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "ky09mr.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/2417.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^EA384B241734FB939061C360A32CCE4C86902020CFF567BD97A0AE7332EBC5E5.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "0w7pf0.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/2642.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^2F06F02642589450D7B966D42D7340AF86C543CB5590983ADCEF8AA5B127526B.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "g2b6xo.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/31D3.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^3A993F31D371B7F3866BA50D0D915F403D2D51D9269D540758532FBAFBDFBA6C.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "5r5v3u.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/33F6.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^7BEB1F33F6ACDEF93BE0729F61E182C4F3689D4CFDA1D555BA2BADF71313DD32.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "2k3g35.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/407F.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^32065D407F1B8504CEA41AEB8984E079F921588F2BD8FC42F345464E37171ECD.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "itji0r.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/4625.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^2D24B7462509E1A15C292CB49FA149F6A5B6FC96ADDA2B0DA64871267FA14FD6.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "jo8wn6.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/494F.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^EAAAB5494F50F400231EC22404877A93E5C55068E7C4812A7CB1E5C6299D5C25.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "cqpilh.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/4D3F.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^715D154D3F2B407B44545EEC59EA3A3ED8863BC67AA7A69DABE2FF77096D09DD.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "ft3m48.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/517A.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^560894517A7F0DB581BCCD362FCC2A381F7C02E6CDE5BA62D5AA5DC9A06FFF0F.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "s4nh4j.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/55FF.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^4D95DE55FF0AF5FC3BA39ABBB67207FB8F620F000E9B904A879337C95202D9CD.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "dkkzj6.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/576C.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^5A6937576CD0F92F8B6437775637FB75896CDCDC279392CCD423A57E23292FF5.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "8iimfa.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/60C5.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^7F2D4760C54A95DDAA8B7626EFE08E071CAA6EB936CE91E98FA7B46259615BEB.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "p6fhex.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/6C55.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^DD2A586C55C9BE7A92523DAD7E52E2085879A1A19C7D29B55BC15E911E3B5338.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "wbsvkc.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/6DFC.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^E4AF9C6DFC7009E73653DF257C63D4CE4EF3AF5FDB172CDAFA2F765E3972611D.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "sawtsp.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/6E48.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^A254986E484713703287BF6291DA2A87201F6310E1F363964CBEEEFFADC727BD.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "u1hs1z.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/7079.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^E29F9D7079B2CA126101C4BA66263131AF05A5CFA898BC1225E932194BE48658.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "gp5ugp.json"
-}

package/test-data-magic-link/domains/gi/b_/gib_multi/ibgib/000_zerospace/ibgibs/1B5/1AD/.idx/7382.map

@@ -1,3 +0,0 @@
-{
-  "witness space NodeIndexedFilesystemSpace_V1 default d56338cad0e5e806a85d335cabdef47c99cc6096cabb1dcb458c96f5a3b27851 undefined undefined^0DE55B738274FE82D3476E94D43C914A3A750C6A83D9D6DA6DBAB9FB9D4DAA1C.1B51ADAB8764A8919127DBFA77A86F5F350921EB61CCDA9F64B99A098A3E629C": "lq4ijg.json"
-}