@ixo/ucan 1.0.0

package/dist/validator/validator.js

@@ -0,0 +1,179 @@
+import { ed25519 } from '@ucanto/principal';
+import { Delegation } from '@ucanto/core';
+import { claim } from '@ucanto/validator';
+import { InMemoryInvocationStore } from '../store/memory.js';
+export async function createUCANValidator(options) {
+    const invocationStore = options.invocationStore ?? new InMemoryInvocationStore();
+    let serverVerifier;
+    if (options.serverDid.startsWith('did:key:')) {
+        serverVerifier = ed25519.Verifier.parse(options.serverDid);
+    }
+    else {
+        if (!options.didResolver) {
+            throw new Error(`Cannot use ${options.serverDid} as server DID without a didResolver. ` +
+                `Provide a didResolver to resolve non-did:key DIDs, or use a did:key directly.`);
+        }
+        const resolved = await options.didResolver(options.serverDid);
+        if ('error' in resolved) {
+            throw new Error(`Failed to resolve server DID ${options.serverDid}: ${resolved.error.message}`);
+        }
+        if (!resolved.ok || resolved.ok.length === 0) {
+            throw new Error(`No keys found for server DID ${options.serverDid}. ` +
+                `The DID document must have at least one verification method.`);
+        }
+        const keyDid = resolved.ok[0];
+        if (!keyDid) {
+            throw new Error(`No valid key found for server DID ${options.serverDid}`);
+        }
+        serverVerifier = ed25519.Verifier.parse(keyDid);
+    }
+    const resolveDIDKey = async (did) => {
+        if (typeof did !== 'string') {
+            console.error('[resolveDIDKey] ERROR: did is not a string!', did);
+            return {
+                error: {
+                    name: 'DIDKeyResolutionError',
+                    did: String(did),
+                    message: `Expected DID string, got ${typeof did}`,
+                },
+            };
+        }
+        if (did.startsWith('did:key:')) {
+            return { ok: [did] };
+        }
+        if (options.didResolver) {
+            const result = await options.didResolver(did);
+            if ('ok' in result && result.ok.length > 0) {
+                return { ok: result.ok };
+            }
+            if ('error' in result) {
+                return {
+                    error: {
+                        name: 'DIDKeyResolutionError',
+                        did,
+                        message: result.error.message,
+                    },
+                };
+            }
+        }
+        return {
+            error: {
+                name: 'DIDKeyResolutionError',
+                did,
+                message: `Cannot resolve DID: ${did}`,
+            },
+        };
+    };
+    return {
+        serverDid: options.serverDid,
+        async validate(invocationBase64, capabilityDef, resource) {
+            try {
+                const carBytes = new Uint8Array(Buffer.from(invocationBase64, 'base64'));
+                const extracted = await Delegation.extract(carBytes);
+                if (extracted.error) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'INVALID_FORMAT',
+                            message: `Failed to decode: ${extracted.error?.message ?? 'unknown'}`,
+                        },
+                    };
+                }
+                const invocation = 'ok' in extracted ? extracted.ok : extracted;
+                if (!invocation?.issuer?.did || !invocation?.audience?.did) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'INVALID_FORMAT',
+                            message: 'Invocation missing issuer or audience',
+                        },
+                    };
+                }
+                const audienceDid = invocation.audience.did();
+                if (audienceDid !== options.serverDid) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'UNAUTHORIZED',
+                            message: `Invocation addressed to ${audienceDid}, not ${options.serverDid}`,
+                        },
+                    };
+                }
+                const invocationCid = invocation.cid?.toString();
+                if (invocationCid && (await invocationStore.has(invocationCid))) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'REPLAY',
+                            message: 'Invocation has already been used',
+                        },
+                    };
+                }
+                const claimResult = claim(capabilityDef, [invocation], {
+                    authority: serverVerifier,
+                    principal: ed25519.Verifier,
+                    resolveDIDKey: resolveDIDKey,
+                    canIssue: (cap, issuer) => {
+                        if (options.rootIssuers.includes(issuer))
+                            return true;
+                        if (typeof cap.with === 'string' && cap.with.includes(issuer))
+                            return true;
+                        return false;
+                    },
+                    validateAuthorization: () => ({ ok: {} }),
+                });
+                const accessResult = await claimResult;
+                if (accessResult.error) {
+                    const errorMsg = accessResult.error.message ?? 'Authorization failed';
+                    const isCaveatError = errorMsg.includes('limit') ||
+                        errorMsg.includes('caveat') ||
+                        errorMsg.includes('exceeds') ||
+                        errorMsg.includes('violates');
+                    return {
+                        ok: false,
+                        error: {
+                            code: isCaveatError ? 'CAVEAT_VIOLATION' : 'UNAUTHORIZED',
+                            message: errorMsg,
+                        },
+                    };
+                }
+                const validatedCap = invocation.capabilities?.[0];
+                if (validatedCap && validatedCap.with !== resource) {
+                    const capWith = validatedCap.with;
+                    const isWildcardMatch = (capWith.endsWith('/*') &&
+                        resource.startsWith(capWith.slice(0, -1))) ||
+                        (capWith.endsWith(':*') &&
+                            resource.startsWith(capWith.slice(0, -1)));
+                    if (!isWildcardMatch) {
+                        return {
+                            ok: false,
+                            error: {
+                                code: 'UNAUTHORIZED',
+                                message: `Resource ${validatedCap.with} does not match ${resource}`,
+                            },
+                        };
+                    }
+                }
+                if (invocationCid) {
+                    await invocationStore.add(invocationCid);
+                }
+                return {
+                    ok: true,
+                    invoker: invocation.issuer.did(),
+                    capability: validatedCap
+                        ? {
+                            can: validatedCap.can,
+                            with: validatedCap.with,
+                            nb: validatedCap.nb,
+                        }
+                        : undefined,
+                };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : 'Unknown error';
+                return { ok: false, error: { code: 'INVALID_FORMAT', message } };
+            }
+        },
+    };
+}
+//# sourceMappingURL=validator.js.map

package/dist/validator/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/validator/validator.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AA8I7D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA+B;IAE/B,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,IAAI,uBAAuB,EAAE,CAAC;IAI3D,IAAI,cAAwB,CAAC;IAE7B,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAE7C,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QAEN,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,SAAS,wCAAwC;gBACrE,+EAA+E,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CACxC,OAAO,CAAC,SAAsC,CAC/C,CAAC;QAEF,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,CAAC,SAAS,IAAI;gBACnD,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAGD,MAAM,aAAa,GAAG,KAAK,EAAE,GAA8B,EAAE,EAAE;QAE7D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO;gBACL,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAgC;oBACtC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;oBAChB,OAAO,EAAE,4BAA4B,OAAO,GAAG,EAAE;iBAClD;aACF,CAAC;QACJ,CAAC;QAGD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,CAAC;QAGD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CACtC,GAAgC,CACjC,CAAC;YACF,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAE3C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,KAAK,EAAE;wBACL,IAAI,EAAE,uBAAgC;wBACtC,GAAG;wBACH,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;qBAC9B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,uBAAgC;gBACtC,GAAG;gBACH,OAAO,EAAE,uBAAuB,GAAG,EAAE;aACtC;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAE5B,KAAK,CAAC,QAAQ,CACZ,gBAAgB,EAChB,aAAa,EACb,QAAQ;YAER,IAAI,CAAC;gBAEH,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAGzE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrD,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,qBAAqB,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,EAAE;yBACtE;qBACF,CAAC;gBACJ,CAAC;gBAED,MAAM,UAAU,GAAG,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAGhE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;oBAC3D,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,uCAAuC;yBACjD;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC9C,IAAI,WAAW,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,2BAA2B,WAAW,SAAS,OAAO,CAAC,SAAS,EAAE;yBAC5E;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;gBACjD,IAAI,aAAa,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,OAAO,EAAE,kCAAkC;yBAC5C;qBACF,CAAC;gBACJ,CAAC;gBAID,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE;oBACrD,SAAS,EAAE,cAAc;oBACzB,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAC3B,aAAa,EAAE,aAAoB;oBACnC,QAAQ,EAAE,CAAC,GAAQ,EAAE,MAAc,EAAE,EAAE;wBAErC,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAAE,OAAO,IAAI,CAAC;wBAEtD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAC3D,OAAO,IAAI,CAAC;wBACd,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;iBAC1C,CAAC,CAAC;gBAEH,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;gBAEvC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;oBAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,IAAI,sBAAsB,CAAC;oBACtE,MAAM,aAAa,GACjB,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAC1B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC3B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC5B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBAEhC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc;4BACzD,OAAO,EAAE,QAAQ;yBAClB;qBACF,CAAC;gBACJ,CAAC;gBAGD,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClD,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAEnD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAc,CAAC;oBAC5C,MAAM,eAAe,GACnB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACrB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC5C,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;4BACrB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE/C,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE;gCACL,IAAI,EAAE,cAAc;gCACpB,OAAO,EAAE,YAAY,YAAY,CAAC,IAAI,mBAAmB,QAAQ,EAAE;6BACpE;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAGD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC3C,CAAC;gBAED,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE;oBAChC,UAAU,EAAE,YAAY;wBACtB,CAAC,CAAC;4BACE,GAAG,EAAE,YAAY,CAAC,GAAG;4BACrB,IAAI,EAAE,YAAY,CAAC,IAAc;4BACjC,EAAE,EAAE,YAAY,CAAC,EAAyC;yBAC3D;wBACH,CAAC,CAAC,SAAS;iBACd,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/jest.config.js

@@ -0,0 +1,3 @@
+import config from '@ixo/jest-config/nest.js';
+
+export default config;

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@ixo/ucan",
+  "description": "UCAN authorization for any service - built on ucanto",
+  "version": "1.0.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./validator": {
+      "import": "./dist/validator/validator.js",
+      "types": "./dist/validator/validator.d.ts"
+    },
+    "./client": {
+      "import": "./dist/client/create-client.js",
+      "types": "./dist/client/create-client.d.ts"
+    },
+    "./capabilities": {
+      "import": "./dist/capabilities/capability.js",
+      "types": "./dist/capabilities/capability.d.ts"
+    },
+    "./did": {
+      "import": "./dist/did/ixo-resolver.js",
+      "types": "./dist/did/ixo-resolver.d.ts"
+    },
+    "./store": {
+      "import": "./dist/store/memory.js",
+      "types": "./dist/store/memory.d.ts"
+    }
+  },
+  "devDependencies": {
+    "@cosmjs/crypto": "0.32.4",
+    "@cosmjs/encoding": "0.32.4",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^22.10.5",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.2.5",
+    "tsx": "^4.7.0",
+    "typescript": "^5.5.4",
+    "@ixo/eslint-config": "0.0.0",
+    "@ixo/jest-config": "0.0.0",
+    "@ixo/typescript-config": "0.0.0"
+  },
+  "dependencies": {
+    "@ucanto/client": "9.0.2",
+    "@ucanto/core": "10.4.6",
+    "@ucanto/interface": "11.0.1",
+    "@ucanto/principal": "9.0.3",
+    "@ucanto/server": "11.0.3",
+    "@ucanto/transport": "9.2.1",
+    "@ucanto/validator": "10.0.1"
+  },
+  "peerDependencies": {
+    "@cosmjs/crypto": ">=0.32.0",
+    "@cosmjs/encoding": ">=0.32.0",
+    "typescript": ">=5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@cosmjs/crypto": {
+      "optional": true
+    },
+    "@cosmjs/encoding": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "jest",
+    "test:ucan": "tsx scripts/test-ucan.ts"
+  }
+}