@ixo/ucan 1.0.0 → 1.1.0

package/src/validator/validator.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-console */
 /**
  * @fileoverview Framework-agnostic UCAN validator
  *
@@ -14,13 +15,13 @@
 import { ed25519 } from '@ucanto/principal';
 import { Delegation } from '@ucanto/core';
 import { claim } from '@ucanto/validator';
-import { capability } from '@ucanto/validator';
+import { type capability } from '@ucanto/validator';
 import type { DIDKeyResolver, InvocationStore } from '../types.js';
 import { InMemoryInvocationStore } from '../store/memory.js';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 type CapabilityParser = ReturnType<typeof capability<any, any, any>>;
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
+
 type Verifier = ReturnType<typeof ed25519.Verifier.parse>;
 
 /**
@@ -76,6 +77,21 @@ export interface ValidateResult {
     nb?: Record<string, unknown>;
   };
 
+  /**
+   * Effective expiration as Unix timestamp (seconds).
+   * This is the earliest expiration across the entire delegation chain,
+   * i.e. when the authorization effectively expires.
+   * Undefined if no expiration is set (never expires).
+   */
+  expiration?: number;
+
+  /**
+   * The delegation chain from root issuer to invoker.
+   * e.g. ["did:key:root", "did:key:alice", "did:key:bob"]
+   * For a direct root invocation (no delegation), this is just ["did:key:root"].
+   */
+  proofChain?: string[];
+
   /** Error details (if invalid) */
   error?: {
     code:
@@ -227,9 +243,7 @@ export async function createUCANValidator(
 
     // Try custom resolver for other DID methods (e.g., did:ixo)
     if (options.didResolver) {
-      const result = await options.didResolver(
-        did as `did:${string}:${string}`,
-      );
+      const result = await options.didResolver(did);
       if ('ok' in result && result.ok.length > 0) {
         // Return the array of did:key strings (ucanto will parse them)
         return { ok: result.ok };
@@ -254,6 +268,43 @@ export async function createUCANValidator(
     };
   };
 
+  /**
+   * Build the delegation chain as an array of DIDs from root to invoker.
+   * Recursively traverses the first proof of each delegation.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- delegation type from Delegation.extract() is complex
+  function buildProofChain(delegation: any): string[] {
+    if (!delegation?.proofs || delegation.proofs.length === 0) {
+      return [delegation.issuer.did()];
+    }
+    const parentChain = buildProofChain(delegation.proofs[0]);
+    return [...parentChain, delegation.issuer.did()];
+  }
+
+  /**
+   * Compute the effective (earliest) expiration across the entire delegation chain.
+   * Returns undefined if no expiration is set anywhere in the chain.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  function computeEffectiveExpiration(delegation: any): number | undefined {
+    const exp =
+      typeof delegation?.expiration === 'number' &&
+      isFinite(delegation.expiration)
+        ? delegation.expiration
+        : undefined;
+
+    if (!delegation?.proofs || delegation.proofs.length === 0) {
+      return exp;
+    }
+
+    const parentExp = computeEffectiveExpiration(delegation.proofs[0]);
+
+    if (exp !== undefined && parentExp !== undefined) {
+      return Math.min(exp, parentExp);
+    }
+    return exp ?? parentExp;
+  }
+
   return {
     serverDid: options.serverDid,
 
@@ -264,7 +315,9 @@ export async function createUCANValidator(
     ): Promise<ValidateResult> {
       try {
         // 1. Decode the invocation from base64 CAR
-        const carBytes = new Uint8Array(Buffer.from(invocationBase64, 'base64'));
+        const carBytes = new Uint8Array(
+          Buffer.from(invocationBase64, 'base64'),
+        );
 
         // 2. Extract the invocation from CAR
         const extracted = await Delegation.extract(carBytes);
@@ -320,8 +373,9 @@ export async function createUCANValidator(
         const claimResult = claim(capabilityDef, [invocation], {
           authority: serverVerifier,
           principal: ed25519.Verifier,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ucanto claim() expects a specific DID resolver signature incompatible with our async resolver
           resolveDIDKey: resolveDIDKey as any,
-          canIssue: (cap: any, issuer: string) => {
+          canIssue: (cap: { with: string }, issuer: string) => {
             // Root issuers can issue any capability
             if (options.rootIssuers.includes(issuer)) return true;
             // Allow self-issued capabilities where resource contains issuer DID
@@ -379,6 +433,10 @@ export async function createUCANValidator(
           await invocationStore.add(invocationCid);
         }
 
+        // 9. Build proof chain and compute effective expiration
+        const proofChain = buildProofChain(invocation);
+        const expiration = computeEffectiveExpiration(invocation);
+
         return {
           ok: true,
           invoker: invocation.issuer.did(),
@@ -389,6 +447,8 @@ export async function createUCANValidator(
                 nb: validatedCap.nb as Record<string, unknown> | undefined,
               }
             : undefined,
+          expiration,
+          proofChain,
         };
       } catch (err) {
         const message = err instanceof Error ? err.message : 'Unknown error';

package/tsconfig.json

@@ -14,5 +14,5 @@
     "skipLibCheck": true
   },
   "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
+  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/*.spec.ts"]
 }

package/vitest.config.ts

@@ -0,0 +1,2 @@
+import config from '@ixo/vitest-config/nest';
+export default config;

package/.eslintrc.js

@@ -1,9 +0,0 @@
-/** @type {import("eslint").Linter.Config} */
-module.exports = {
-  extends: ['@ixo/eslint-config/nest.js'],
-  parserOptions: {
-    project: 'tsconfig.json',
-    tsconfigRootDir: __dirname,
-    sourceType: 'module',
-  },
-};

package/.prettierignore

@@ -1,3 +0,0 @@
-pnpm-lock.yaml
-
-node_modules

package/.prettierrc.js

@@ -1,4 +0,0 @@
-/** @type {import("prettier").Config} */
-module.exports = {
-  ...require('@ixo/eslint-config/prettier-base'),
-};

package/jest.config.js

@@ -1,3 +0,0 @@
-import config from '@ixo/jest-config/nest.js';
-
-export default config;