@kubun/plugin-connector 0.13.0 → 0.13.1

package/lib/api.d.ts

@@ -65,6 +65,14 @@ export type ConnectorAPI = {
     createPendingAuth: (record: PendingAuthRecord) => Promise<void>;
     consumePendingAuth: (state: string) => Promise<PendingAuthRecord | null>;
     deleteExpiredPendingAuth: (cutoffMs: number) => Promise<void>;
+    /**
+     * The controller resolvers for this API's (request-scoped) transaction
+     * provider — the exact `methods` the credential mint passes to `createKey`.
+     * Exposed so the OAuth pre-flight can ask `canWrapTo` with the same resolver
+     * the mint uses, rather than failing closed on a `did:kokuin:` owner whose
+     * agreement key is resolvable only through the controller resolver.
+     */
+    getControllerMethods: () => MethodRegistry;
 };
 export type CreateConnectorAPIParams = {
     stores: StoreProvider;

package/lib/api.js

@@ -189,6 +189,9 @@ export function createConnectorAPI(params) {
         async deleteExpiredPendingAuth (cutoffMs) {
             const store = await getStore();
             await store.deleteExpiredPendingAuth(cutoffMs);
+        },
+        getControllerMethods () {
+            return params.getControllerMethods(params.stores);
         }
     };
 }

package/lib/oauth.js

@@ -39,7 +39,13 @@ export class OAuthService {
         // then the pending row is consumed and the authorization code is spent, so
         // the provider has issued a real token pair that the failure discards and
         // the user has to run the whole dance again.
-        if (!await canWrapTo(ownerWrappableDID)) {
+        //
+        // Resolved with the same controller `methods` the mint's `createKey` uses,
+        // so the guard cannot be stricter than the operation it guards: a
+        // `did:kokuin:` owner's agreement key resolves only through the controller
+        // resolver, and asking without it would fail closed and block a flow the
+        // mint would have completed.
+        if (!await canWrapTo(ownerWrappableDID, api.getControllerMethods())) {
             throw new Error(`Cannot start OAuth for "${args.provider}": nothing can be encrypted to "${ownerWrappableDID}", so the credential's owner could never read it. Pass \`viewerWrappableDID\` — for a did:peer:4 viewer that is the long form, which carries the agreement key.`);
         }
         // Carried to the mint like the owner's wrappable DID; it becomes a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-connector",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -26,34 +26,34 @@
     "graphql": "^16.14.2",
     "graphql-scalars": "^2.0.0",
     "kysely": "^0.29.5",
-    "@kubun/credential": "^0.13.0",
-    "@kubun/engine": "^0.13.0",
+    "@kubun/connector": "^0.13.1",
+    "@kubun/hlc": "^0.13.0",
     "@kubun/db": "^0.13.0",
-    "@kubun/graphql": "^0.13.0",
+    "@kubun/engine": "^0.13.1",
     "@kubun/logger": "^0.13.0",
-    "@kubun/id": "^0.13.0",
-    "@kubun/protocol": "^0.13.0",
-    "@kubun/store-credential": "^0.13.0",
-    "@kubun/hlc": "^0.13.0",
-    "@kubun/store-graph": "^0.13.0",
+    "@kubun/graphql": "^0.13.1",
+    "@kubun/credential": "^0.13.0",
     "@kubun/store-connector": "^0.13.0",
-    "@kubun/connector": "^0.13.0",
-    "@kubun/store-delegation": "^0.13.0"
+    "@kubun/store-credential": "^0.13.0",
+    "@kubun/id": "^0.13.0",
+    "@kubun/store-graph": "^0.13.2",
+    "@kubun/store-delegation": "^0.13.0",
+    "@kubun/protocol": "^0.13.1"
   },
   "devDependencies": {
     "@kokuin/controller": "^0.1.0",
     "@testcontainers/postgresql": "^12.1.0",
     "get-port": "^7.2.0",
-    "@kubun/db-postgres": "^0.13.0",
     "@kubun/blob-backend": "^0.13.0",
+    "@kubun/db-postgres": "^0.13.0",
     "@kubun/connector-google-mail": "^0.13.0",
+    "@kubun/models": "^0.13.0",
     "@kubun/plugin-blob": "^0.13.0",
     "@kubun/plugin-workflow": "^0.13.0",
+    "@kubun/store-controller": "^0.13.0",
     "@kubun/store-blob": "^0.13.0",
-    "@kubun/models": "^0.13.0",
     "@kubun/store-workflow": "^0.13.0",
-    "@kubun/test-utils": "^0.13.0",
-    "@kubun/store-controller": "^0.13.0"
+    "@kubun/test-utils": "^0.13.0"
   },
   "publishConfig": {
     "access": "public"