@kubun/plugin-credential 0.13.0

package/LICENSE.md

@@ -0,0 +1,57 @@
+# The Prosperity Public License 3.0.0
+
+Contributor: Paul Le Cam
+
+Source Code: https://github.com/PaulLeCam/kubun
+
+## Purpose
+
+This license allows you to use and share this software for noncommercial purposes for free and to try this software for commercial purposes for thirty days.
+
+## Agreement
+
+In order to receive this license, you have to agree to its rules.  Those rules are both obligations under that agreement and conditions to your license.  Don't do anything with this software that triggers a rule you can't or won't follow.
+
+## Notices
+
+Make sure everyone who gets a copy of any part of this software from you, with or without changes, also gets the text of this license and the contributor and source code lines above.
+
+## Commercial Trial
+
+Limit your use of this software for commercial purposes to a thirty-day trial period.  If you use this software for work, your company gets one trial period for all personnel, not one trial per person.
+
+## Contributions Back
+
+Developing feedback, changes, or additions that you contribute back to the contributor on the terms of a standardized public software license such as [the Blue Oak Model License 1.0.0](https://blueoakcouncil.org/license/1.0.0), [the Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0.html), [the MIT license](https://spdx.org/licenses/MIT.html), or [the two-clause BSD license](https://spdx.org/licenses/BSD-2-Clause.html) doesn't count as use for a commercial purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, doesn't count as use for a commercial purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution doesn't count as use for a commercial purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Defense
+
+Don't make any legal claim against anyone accusing this software, with or without changes, alone or with other technology, of infringing any patent.
+
+## Copyright
+
+The contributor licenses you to do everything with this software that would otherwise infringe their copyright in it.
+
+## Patent
+
+The contributor licenses you to do everything with this software that would otherwise infringe any patents they can license or become able to license.
+
+## Reliability
+
+The contributor can't revoke this license.
+
+## Excuse
+
+You're excused for unknowingly breaking [Notices](#notices) if you take all practical steps to comply within thirty days of learning you broke the rule.
+
+## No Liability
+
+***As far as the law allows, this software comes as is, without any warranty or condition, and the contributor won't be liable to anyone for any damages related to this software or this license, under any kind of legal claim.***

package/lib/context.d.ts

@@ -0,0 +1,79 @@
+import { type CredentialAuthority } from '@kubun/credential';
+import { HLC } from '@kubun/hlc';
+import type { CredentialFactorDescriptor, CredentialStoreAPI } from '@kubun/store-credential';
+/**
+ * Row-level operations over credential material, gated on authorization.
+ *
+ * Nothing here decrypts. The client generated the content key, encrypted the
+ * entry and built every wrapping, so the server's whole job is to hold bytes it
+ * cannot read and hand them back to someone entitled to them. The one component
+ * that does decrypt server-side is the plugin's own `api`, which opens the
+ * engine identity's wrapping for a consumer like the connector sync engine.
+ */
+export type CredentialWrappingResult = {
+    wrappingID: string;
+    keyVersion: number;
+    factors: Array<CredentialFactorDescriptor>;
+    iv: string;
+    wrappedKey: string;
+    recipientDID: string | null;
+};
+export type CredentialKeyResult = {
+    keyID: string;
+    ownerDID: string;
+    suite: number;
+    version: number;
+    state: string;
+    wrappings: Array<CredentialWrappingResult>;
+};
+export type CredentialEntryResult = {
+    entryID: string;
+    keyID: string;
+    keyVersion: number;
+    iv: string;
+    ciphertext: string;
+    updatedAt: string | null;
+    writerDID: string | null;
+};
+export type PutCredentialWrappingInput = {
+    wrappingID: string;
+    keyVersion: number;
+    factors: Array<CredentialFactorDescriptor>;
+    iv: string;
+    wrappedKey: string;
+    recipientDID?: string | null;
+};
+export type PutCredentialKeyInput = {
+    keyID: string;
+    suite: number;
+    version: number;
+    wrappings: Array<PutCredentialWrappingInput>;
+};
+export type PutCredentialEntryInput = {
+    entryID: string;
+    keyID: string;
+    keyVersion: number;
+    iv: string;
+    ciphertext: string;
+};
+export type CredentialQueryContext = {
+    getKey(keyID: string): Promise<CredentialKeyResult>;
+    getEntry(entryID: string): Promise<CredentialEntryResult>;
+    listEntries(keyID: string): Promise<Array<string>>;
+    putKey(input: PutCredentialKeyInput): Promise<CredentialKeyResult>;
+    putEntry(input: PutCredentialEntryInput): Promise<CredentialEntryResult>;
+    deleteKey(keyID: string): Promise<boolean>;
+    deleteEntry(entryID: string): Promise<boolean>;
+};
+export declare function createCredentialQueryContext(params: {
+    getStore: () => Promise<CredentialStoreAPI>;
+    viewerDID: string;
+    /** The device's one clock — the same instance every other writer stamps from. */
+    hlc: HLC;
+    /**
+     * Required so no live caller falls back to device-DID equality: the engine
+     * assembles it per request from the viewer plus delegation tokens. Every gate
+     * below asks through it.
+     */
+    authority: CredentialAuthority;
+}): CredentialQueryContext;

package/lib/context.js

@@ -0,0 +1,191 @@
+import { entryProvenanceFields } from '@kubun/credential';
+import { HLC } from '@kubun/hlc';
+import { CredentialEntryID, CredentialKeyID } from '@kubun/id';
+import { fromB64, toB64 } from '@sozai/codec';
+import { GraphQLError } from 'graphql';
+function notFound(what, id) {
+    return new GraphQLError(`${what} not found: ${id}`, {
+        extensions: {
+            code: 'CREDENTIAL_NOT_FOUND'
+        }
+    });
+}
+/**
+ * Kept distinct from not-found rather than collapsed.
+ *
+ * Collapsing hides an operator-debuggable condition and buys close to no
+ * privacy: ids are digests, so anyone able to name one already obtained it
+ * somewhere.
+ */ function notYours(keyID) {
+    return new GraphQLError(`Credential key ${keyID} belongs to another owner`, {
+        extensions: {
+            code: 'CREDENTIAL_NOT_YOURS'
+        }
+    });
+}
+function invalidID(what, id, cause) {
+    return new GraphQLError(`Invalid ${what}: ${id}`, {
+        extensions: {
+            code: 'CREDENTIAL_ID_INVALID'
+        },
+        originalError: cause instanceof Error ? cause : undefined
+    });
+}
+function toWrappingResult(wrapping) {
+    return {
+        wrappingID: wrapping.wrapping_id,
+        keyVersion: wrapping.key_version,
+        factors: wrapping.factors,
+        iv: toB64(new Uint8Array(wrapping.iv)),
+        wrappedKey: toB64(new Uint8Array(wrapping.wrapped_key)),
+        recipientDID: wrapping.recipient_did
+    };
+}
+function toEntryResult(entry) {
+    return {
+        entryID: entry.entry_id,
+        keyID: entry.key_id,
+        keyVersion: entry.key_version,
+        iv: toB64(new Uint8Array(entry.iv)),
+        ciphertext: toB64(new Uint8Array(entry.ciphertext)),
+        ...entryProvenanceFields(entry)
+    };
+}
+export function createCredentialQueryContext(params) {
+    const { authority, getStore } = params;
+    async function requireAuthorized(store, key, keyID, authorization) {
+        if (key == null) {
+            throw notFound('Credential key', keyID);
+        }
+        if (!await authority.authorize(authorization, {
+            key,
+            store
+        })) {
+            throw notYours(keyID);
+        }
+        return key;
+    }
+    async function loadKey(store, keyID, authorization) {
+        return await requireAuthorized(store, await store.getKey(keyID), keyID, authorization);
+    }
+    async function keyResult(store, key) {
+        const wrappings = await store.listWrappings(key.key_id);
+        return {
+            keyID: key.key_id,
+            ownerDID: key.owner_did,
+            suite: key.suite,
+            version: key.version,
+            state: key.state,
+            // Every wrapping, not only the viewer's: a client picks its own by reading
+            // the descriptors, and a device holding two identities has two candidates.
+            wrappings: wrappings.map(toWrappingResult)
+        };
+    }
+    return {
+        async getKey (keyID) {
+            const store = await getStore();
+            return await keyResult(store, await loadKey(store, keyID, 'read'));
+        },
+        async getEntry (entryID) {
+            const store = await getStore();
+            const entry = await store.getEntryWithProvenance(entryID);
+            if (entry == null) {
+                throw notFound('Credential entry', entryID);
+            }
+            // An entry carries no authorization of its own. Its key does, and that is
+            // the only thing that decides who may read the ciphertext.
+            await loadKey(store, entry.key_id, 'read');
+            return toEntryResult(entry);
+        },
+        async listEntries (keyID) {
+            const store = await getStore();
+            await loadKey(store, keyID, 'read');
+            return (await store.listEntries(keyID)).map((entry)=>entry.entry_id);
+        },
+        async putKey (input) {
+            try {
+                CredentialKeyID.fromString(input.keyID);
+            } catch (cause) {
+                throw invalidID('CredentialKeyID', input.keyID, cause);
+            }
+            if (input.wrappings.length === 0) {
+                throw new GraphQLError('A credential key needs at least one wrapping', {
+                    extensions: {
+                        code: 'CREDENTIAL_FACTORS_INVALID'
+                    }
+                });
+            }
+            const store = await getStore();
+            const existing = await store.getKey(input.keyID);
+            if (existing != null) {
+                // Re-put is an update, and an update to someone else's key is a takeover.
+                await requireAuthorized(store, existing, input.keyID, 'administer');
+            }
+            // No op, stated rather than omitted. This context holds a VIEWER's DID and
+            // no signing key, and signing a viewer's write with the device key would
+            // attribute the change to the wrong principal.
+            await store.putKey({
+                keyID: input.keyID,
+                // Never the input, so a client cannot mint a key under another DID and
+                // then be refused access to what it wrote; and never re-resolved on an
+                // update, so an administrator cannot walk an existing key's owner.
+                ownerDID: existing?.owner_did ?? await authority.ownerForNewKey(),
+                suite: input.suite,
+                version: input.version,
+                state: 'active'
+            }, null);
+            for (const wrapping of input.wrappings){
+                await store.putWrapping({
+                    wrappingID: wrapping.wrappingID,
+                    keyID: input.keyID,
+                    keyVersion: wrapping.keyVersion,
+                    factors: wrapping.factors,
+                    iv: fromB64(wrapping.iv),
+                    wrappedKey: fromB64(wrapping.wrappedKey),
+                    recipientDID: wrapping.recipientDID ?? null
+                }, null);
+            }
+            return await keyResult(store, await loadKey(store, input.keyID, 'administer'));
+        },
+        async putEntry (input) {
+            try {
+                CredentialEntryID.fromString(input.entryID);
+            } catch (cause) {
+                throw invalidID('CredentialEntryID', input.entryID, cause);
+            }
+            const store = await getStore();
+            // Administrative, not read: a recipient can decrypt this key's entries,
+            // which is not a reason to let it write into someone else's vault.
+            await loadKey(store, input.keyID, 'administer');
+            await store.putEntry({
+                entryID: input.entryID,
+                keyID: input.keyID,
+                keyVersion: input.keyVersion,
+                iv: fromB64(input.iv),
+                ciphertext: fromB64(input.ciphertext),
+                hlc: HLC.serialize(params.hlc.now())
+            }, null);
+            const written = await store.getEntryWithProvenance(input.entryID);
+            if (written == null) {
+                throw notFound('Credential entry', input.entryID);
+            }
+            return toEntryResult(written);
+        },
+        async deleteKey (keyID) {
+            const store = await getStore();
+            await loadKey(store, keyID, 'administer');
+            await store.deleteKey(keyID, null);
+            return true;
+        },
+        async deleteEntry (entryID) {
+            const store = await getStore();
+            const entry = await store.getEntry(entryID);
+            if (entry == null) {
+                throw notFound('Credential entry', entryID);
+            }
+            await loadKey(store, entry.key_id, 'administer');
+            await store.deleteEntry(entryID, null);
+            return true;
+        }
+    };
+}

package/lib/index.d.ts

@@ -0,0 +1,17 @@
+import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
+export type { CredentialAuthority, CredentialAuthorityParams, CredentialAuthorization, } from '@kubun/credential';
+export type { CredentialEntryResult, CredentialKeyResult, CredentialQueryContext, CredentialWrappingResult, PutCredentialEntryInput, PutCredentialKeyInput, PutCredentialWrappingInput, } from './context.js';
+export { createCredentialQueryContext } from './context.js';
+export { createCredentialSchemaExtension } from './schema.js';
+/**
+ * No `api`, so nothing reaches this plugin through `engine.getAPI('credential')`.
+ *
+ * It once carried a `readEntry` verb, justified by a connector that would call
+ * it. The connector does not: a plugin that needs to decrypt takes
+ * `@kubun/credential` directly, which is what the three-package split is for,
+ * and which is also the only way to bind a manager to the request's
+ * `StoreProvider` — a manager built here is bound to the root one and would put
+ * a write outside the transaction meant to contain it. Phases 5 and 6 do the
+ * same, so the verb was removed rather than left waiting for a caller.
+ */
+export declare function createCredentialPlugin(): (params: PluginFactoryParams) => KubunPlugin;

package/lib/index.js

@@ -0,0 +1,40 @@
+import { credentialStoreDefinition, getCredentialStore } from '@kubun/store-credential';
+import { createCredentialQueryContext } from './context.js';
+import { createCredentialSchemaExtension } from './schema.js';
+export { createCredentialQueryContext } from './context.js';
+export { createCredentialSchemaExtension } from './schema.js';
+/**
+ * No `api`, so nothing reaches this plugin through `engine.getAPI('credential')`.
+ *
+ * It once carried a `readEntry` verb, justified by a connector that would call
+ * it. The connector does not: a plugin that needs to decrypt takes
+ * `@kubun/credential` directly, which is what the three-package split is for,
+ * and which is also the only way to bind a manager to the request's
+ * `StoreProvider` — a manager built here is bound to the root one and would put
+ * a write outside the transaction meant to contain it. Phases 5 and 6 do the
+ * same, so the verb was removed rather than left waiting for a caller.
+ */ export function createCredentialPlugin() {
+    return (params)=>{
+        params.db.register(credentialStoreDefinition);
+        return {
+            name: 'credential',
+            schemaExtension: ()=>createCredentialSchemaExtension(),
+            createContextFactory: ()=>{
+                // Returned bare: the engine nests each plugin's context under its own
+                // `name`, so wrapping it here would produce `ctx.credential.credential`.
+                return (ctx, stores)=>createCredentialQueryContext({
+                        // Bound to the request's stores, which during a mutation IS the
+                        // transaction. Reaching for the root provider here would put a write
+                        // outside the transaction that is supposed to contain it.
+                        getStore: ()=>getCredentialStore(stores),
+                        viewerDID: ctx.viewerDID,
+                        hlc: params.hlc,
+                        // Assembled by the engine per request from the viewer plus the
+                        // request's delegation tokens, so the vault honors a controller's
+                        // `credential/administer` delegation instead of only owner equality.
+                        authority: ctx.credentialAuthority
+                    });
+            }
+        };
+    };
+}

package/lib/schema.d.ts

@@ -0,0 +1,18 @@
+import type { SchemaExtension } from '@kubun/engine';
+import type { CredentialQueryContext } from './context.js';
+declare module '@kubun/graphql' {
+    interface PluginContextMap {
+        credential: CredentialQueryContext;
+    }
+}
+/**
+ * No rotate, revoke, unlock, lock or status field, and their absence is load
+ * bearing rather than pending.
+ *
+ * Rotate and revoke are not part of this surface. The lock lifecycle belongs to
+ * whichever process decrypts, which under this design is the client — a `status`
+ * field would have
+ * to report on a cache the server does not hold, and an `unlock` field would put
+ * a user's PIN in a GraphQL variable for no gain.
+ */
+export declare function createCredentialSchemaExtension(): SchemaExtension;

package/lib/schema.js

@@ -0,0 +1,111 @@
+import { GraphQLError } from 'graphql';
+/**
+ * Ids are `String` rather than the `CredentialEntryID` scalar.
+ *
+ * The scalar's job is a *document field* that references an entry, where it stops
+ * a document id being stored as a credential reference. A plugin argument has no
+ * such schema to be registered against, so the resolver path validates by
+ * decoding instead — same check, different place.
+ */ const SDL = `
+type CredentialWrapping {
+  wrappingID: String!
+  keyVersion: Int!
+  factors: JSON!
+  iv: String!
+  wrappedKey: String!
+  recipientDID: String
+}
+
+type CredentialKey {
+  keyID: String!
+  ownerDID: String!
+  suite: Int!
+  version: Int!
+  state: String!
+  wrappings: [CredentialWrapping!]!
+}
+
+type CredentialEntry {
+  entryID: String!
+  keyID: String!
+  keyVersion: Int!
+  iv: String!
+  ciphertext: String!
+  updatedAt: String
+  writerDID: String
+}
+
+input CredentialWrappingInput {
+  wrappingID: String!
+  keyVersion: Int!
+  factors: JSON!
+  iv: String!
+  wrappedKey: String!
+  recipientDID: String
+}
+
+input CredentialKeyInput {
+  keyID: String!
+  suite: Int!
+  version: Int!
+  wrappings: [CredentialWrappingInput!]!
+}
+
+input CredentialEntryInput {
+  entryID: String!
+  keyID: String!
+  keyVersion: Int!
+  iv: String!
+  ciphertext: String!
+}
+
+extend type Query {
+  credentialKey(keyID: String!): CredentialKey!
+  credentialEntry(entryID: String!): CredentialEntry!
+  credentialEntries(keyID: String!): [String!]!
+}
+
+extend type Mutation {
+  putCredentialKey(input: CredentialKeyInput!): CredentialKey!
+  putCredentialEntry(input: CredentialEntryInput!): CredentialEntry!
+  deleteCredentialKey(keyID: String!): Boolean!
+  deleteCredentialEntry(entryID: String!): Boolean!
+}
+`;
+function requireCredential(ctx) {
+    if (ctx.credential == null) {
+        throw new GraphQLError('credential plugin is not wired into this context', {
+            extensions: {
+                code: 'CREDENTIAL_PLUGIN_MISSING'
+            }
+        });
+    }
+    return ctx.credential;
+}
+/**
+ * No rotate, revoke, unlock, lock or status field, and their absence is load
+ * bearing rather than pending.
+ *
+ * Rotate and revoke are not part of this surface. The lock lifecycle belongs to
+ * whichever process decrypts, which under this design is the client — a `status`
+ * field would have
+ * to report on a cache the server does not hold, and an `unlock` field would put
+ * a user's PIN in a GraphQL variable for no gain.
+ */ export function createCredentialSchemaExtension() {
+    return {
+        sdl: SDL,
+        resolvers: {
+            queryFields: {
+                credentialKey: (_source, args, context)=>requireCredential(context).getKey(args.keyID),
+                credentialEntry: (_source, args, context)=>requireCredential(context).getEntry(args.entryID),
+                credentialEntries: (_source, args, context)=>requireCredential(context).listEntries(args.keyID)
+            },
+            mutationFields: {
+                putCredentialKey: (_source, args, context)=>requireCredential(context).putKey(args.input),
+                putCredentialEntry: (_source, args, context)=>requireCredential(context).putEntry(args.input),
+                deleteCredentialKey: (_source, args, context)=>requireCredential(context).deleteKey(args.keyID),
+                deleteCredentialEntry: (_source, args, context)=>requireCredential(context).deleteEntry(args.entryID)
+            }
+        }
+    };
+}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@kubun/plugin-credential",
+  "version": "0.13.0",
+  "license": "see LICENSE.md",
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib/*",
+    "LICENSE.md"
+  ],
+  "dependencies": {
+    "@kokuin/token": "^0.5.0",
+    "@sozai/codec": "^0.4.0",
+    "@sozai/runtime": "^0.1.0",
+    "graphql": "^16.14.2",
+    "@kubun/credential": "^0.13.0",
+    "@kubun/hlc": "^0.13.0",
+    "@kubun/db": "^0.13.0",
+    "@kubun/graphql": "^0.13.0",
+    "@kubun/id": "^0.13.0",
+    "@kubun/store-credential": "^0.13.0",
+    "@kubun/engine": "^0.13.0"
+  },
+  "devDependencies": {
+    "@kokuin/capability": "^0.3.0",
+    "@kokuin/controller": "^0.1.0",
+    "@kubun/db-better-sqlite": "^0.13.0",
+    "@kubun/test-utils": "^0.13.0",
+    "@kubun/store-controller": "^0.13.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "build:clean": "del lib",
+    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "test": "pnpm run test:types && pnpm run test:unit",
+    "test:types": "tsc --noEmit -p tsconfig.test.json",
+    "test:unit": "vitest run"
+  }
+}