@kubun/plugin-credential 0.13.0 → 0.15.0

package/lib/index.d.ts

@@ -3,6 +3,7 @@ export type { CredentialAuthority, CredentialAuthorityParams, CredentialAuthoriz
 export type { CredentialEntryResult, CredentialKeyResult, CredentialQueryContext, CredentialWrappingResult, PutCredentialEntryInput, PutCredentialKeyInput, PutCredentialWrappingInput, } from './context.js';
 export { createCredentialQueryContext } from './context.js';
 export { createCredentialSchemaExtension } from './schema.js';
+export { createCredentialServicePlugin } from './service.js';
 /**
  * No `api`, so nothing reaches this plugin through `engine.getAPI('credential')`.
  *

package/lib/index.js

@@ -3,6 +3,7 @@ import { createCredentialQueryContext } from './context.js';
 import { createCredentialSchemaExtension } from './schema.js';
 export { createCredentialQueryContext } from './context.js';
 export { createCredentialSchemaExtension } from './schema.js';
+export { createCredentialServicePlugin } from './service.js';
 /**
  * No `api`, so nothing reaches this plugin through `engine.getAPI('credential')`.
  *

package/lib/service.d.ts

@@ -0,0 +1,16 @@
+import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
+/**
+ * The credential service provider. Unlike {@link createCredentialPlugin}
+ * (graph-schema-only, for an engine that consumes credentials), this registers a
+ * `service` provider that hosts the vault: it builds the credential seam over
+ * this engine's own db/HLC/identity and exposes
+ * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
+ * holds the owner's controller log.
+ *
+ * Each handler rides the per-serve authorizer through its call context: reads
+ * return the empty result on denial (no existence oracle), writes throw the
+ * host's `KB07`. The transport access rules grant every procedure to any verified
+ * issuer, so the subject-authorizer — not the rule map — is the gate.
+ */
+export declare function createCredentialServicePlugin(): (params: PluginFactoryParams) => KubunPlugin;

package/lib/service.js

@@ -0,0 +1,176 @@
+import { isSigningIdentity, normalizeDID } from '@kokuin/token';
+import { createCredentialAPI, createCredentialManager } from '@kubun/credential';
+import { authorizeRead, authorizeWrite, ServiceAuthorizationError } from '@kubun/plugin-service-server';
+import { credentialStoreDefinition, getCredentialStore } from '@kubun/store-credential';
+// The spelling of a DID that can be encrypted to. A did:peer:4 identity carries a
+// longForm that resolves the agreement key; its short id resolves none. For
+// did:key the two forms are identical.
+function wrappableDID(identity) {
+    const longForm = identity.longForm;
+    return typeof longForm === 'string' ? longForm : identity.id;
+}
+/**
+ * The credential service provider. Unlike {@link createCredentialPlugin}
+ * (graph-schema-only, for an engine that consumes credentials), this registers a
+ * `service` provider that hosts the vault: it builds the credential seam over
+ * this engine's own db/HLC/identity and exposes
+ * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
+ * holds the owner's controller log.
+ *
+ * Each handler rides the per-serve authorizer through its call context: reads
+ * return the empty result on denial (no existence oracle), writes throw the
+ * host's `KB07`. The transport access rules grant every procedure to any verified
+ * issuer, so the subject-authorizer — not the rule map — is the gate.
+ */ export function createCredentialServicePlugin() {
+    return (params)=>{
+        params.db.register(credentialStoreDefinition);
+        // Refused at construction, not at the first mint: every credential row this
+        // service writes carries an op signed by this identity, so a non-signing
+        // engine identity would fail on the first create instead of at install.
+        if (!isSigningIdentity(params.identity)) {
+            throw new Error('The credential service plugin requires a SigningIdentity');
+        }
+        const identity = params.identity;
+        const logger = params.getLogger('credential-service');
+        const getCredentialManager = async (stores)=>createCredentialManager({
+                store: await getCredentialStore(stores),
+                identity,
+                runtime: params.runtime,
+                hlc: params.hlc
+            });
+        // The mint folds inside its own write tx (`writeInTx`), so its resolver is
+        // local-only: a recipient miss must fail closed, never pull a controller log
+        // through `consultProviders` while the write lock is held. The pre-warm below
+        // resolves first-time recipients with the pull-capable default before the tx.
+        const getControllerMethods = (stores)=>[
+                params.controllerResolverFor(stores, {
+                    localOnly: true
+                })
+            ];
+        // The seam is bound to whatever provider it is built over: reads run against
+        // the root, writes against a transaction (below). A manager, alias store and
+        // controller resolver all read from that same provider.
+        const makeSeam = (stores)=>createCredentialAPI({
+                stores,
+                logger,
+                getCredentialManager,
+                serverWrappableDID: wrappableDID(params.identity),
+                getControllerMethods
+            });
+        const readSeam = makeSeam(params.db);
+        // A mint/refresh/delete is multi-statement (key + wrappings + entry + alias
+        // pointer). Outside a graph mutation there is no ambient transaction, so run
+        // each write in its own: a mid-mint failure would otherwise leave an
+        // orphan key with no alias pointer in the vault.
+        const writeInTx = (fn)=>params.db.withTransaction((tx)=>fn(makeSeam(tx)));
+        // A first-time `did:kokuin:` owner (or recovery controller) may hold no log in
+        // this engine's controller store yet. Resolve it through the pull-allowed ROOT
+        // resolver before the mint tx opens: on a store miss this pulls via the
+        // `controller-log-source` providers and write-throughs the folded log, so the
+        // in-tx mint's `loadLog` then reads it locally without pulling inside the tx.
+        // `did:key` / `did:peer:4` recipients carry their own agreement key and never
+        // reach the controller resolver, so they are skipped. A genuinely unresolvable
+        // recipient throws here, before any write — the mint tx never opens.
+        const prewarmWrappingRecipients = async (recipients)=>{
+            const resolver = params.controllerResolverFor(params.db);
+            const prefix = `did:${resolver.method}:`;
+            for (const recipient of recipients){
+                if (recipient?.startsWith(prefix)) {
+                    await resolver.resolve(recipient, {});
+                }
+            }
+        };
+        // `ownerDID` is the authorization subject (see the protocol contract), NOT the
+        // Enkaku message `sub`. Reads pass it to authorizeRead (empty on denial);
+        // writes to authorizeWrite (KB07 on denial).
+        const handlers = {
+            'credential/get': (context)=>{
+                const param = context.param;
+                return authorizeRead({
+                    context,
+                    subject: param.ownerDID,
+                    emptyResult: null,
+                    proceed: ()=>readSeam.getCredential(param.providerName, param.ownerDID)
+                });
+            },
+            'credential/provenance': (context)=>{
+                const param = context.param;
+                return authorizeRead({
+                    context,
+                    subject: param.ownerDID,
+                    emptyResult: null,
+                    proceed: ()=>readSeam.getCredentialProvenance(param.providerName, param.ownerDID)
+                });
+            },
+            'credential/create': async (context)=>{
+                const param = context.param;
+                await authorizeWrite({
+                    context,
+                    subject: param.ownerDID
+                });
+                // `ownerWrappableDID` is the wrappable spelling of the SAME identity the
+                // authorizer just cleared (`ownerDID`). Nothing downstream re-checks that,
+                // so without this a caller authorized for the owner could wrap the token to
+                // an unrelated recipient. Same denial path as the authorizer (KB07).
+                if (normalizeDID(param.ownerWrappableDID) !== normalizeDID(param.ownerDID)) {
+                    throw new ServiceAuthorizationError('ownerWrappableDID is not the owner identity');
+                }
+                await prewarmWrappingRecipients([
+                    param.ownerWrappableDID,
+                    param.controllerWrappableDID
+                ]);
+                await writeInTx((seam)=>seam.createCredential({
+                        providerName: param.providerName,
+                        ownerDID: param.ownerDID,
+                        ownerWrappableDID: param.ownerWrappableDID,
+                        controllerWrappableDID: param.controllerWrappableDID,
+                        credential: param.credential
+                    }));
+                return null;
+            },
+            'credential/refresh': async (context)=>{
+                const param = context.param;
+                await authorizeWrite({
+                    context,
+                    subject: param.ownerDID
+                });
+                await writeInTx((seam)=>seam.setCredential(param.providerName, param.ownerDID, param.credential));
+                return null;
+            },
+            'credential/delete': async (context)=>{
+                const param = context.param;
+                await authorizeWrite({
+                    context,
+                    subject: param.ownerDID
+                });
+                await writeInTx((seam)=>seam.deleteCredential(param.providerName, param.ownerDID));
+                return null;
+            }
+        };
+        params.registerProvider('service', {
+            name: 'credential',
+            handlers,
+            accessRules: {
+                'credential/get': {
+                    allow: true
+                },
+                'credential/provenance': {
+                    allow: true
+                },
+                'credential/create': {
+                    allow: true
+                },
+                'credential/refresh': {
+                    allow: true
+                },
+                'credential/delete': {
+                    allow: true
+                }
+            }
+        });
+        return {
+            name: 'credential-service'
+        };
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-credential",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -15,23 +15,29 @@
   ],
   "dependencies": {
     "@kokuin/token": "^0.5.0",
+    "@kubun/credential": "^0.15.0",
+    "@kubun/db": "^0.15.0",
+    "@kubun/engine": "^0.15.0",
+    "@kubun/graphql": "^0.15.0",
+    "@kubun/hlc": "^0.15.0",
+    "@kubun/id": "^0.15.0",
+    "@kubun/plugin-service-api": "^0.15.0",
+    "@kubun/plugin-service-server": "^0.15.0",
+    "@kubun/store-credential": "^0.15.0",
     "@sozai/codec": "^0.4.0",
     "@sozai/runtime": "^0.1.0",
-    "graphql": "^16.14.2",
-    "@kubun/credential": "^0.13.0",
-    "@kubun/hlc": "^0.13.0",
-    "@kubun/db": "^0.13.0",
-    "@kubun/graphql": "^0.13.0",
-    "@kubun/id": "^0.13.0",
-    "@kubun/store-credential": "^0.13.0",
-    "@kubun/engine": "^0.13.0"
+    "graphql": "^16.14.2"
   },
   "devDependencies": {
+    "@enkaku/client": "^0.21.1",
+    "@enkaku/transport": "^0.21.0",
     "@kokuin/capability": "^0.3.0",
     "@kokuin/controller": "^0.1.0",
-    "@kubun/db-better-sqlite": "^0.13.0",
-    "@kubun/test-utils": "^0.13.0",
-    "@kubun/store-controller": "^0.13.0"
+    "@kubun/db-better-sqlite": "^0.15.0",
+    "@kubun/service-credential-api": "^0.15.0",
+    "@kubun/store-controller": "^0.15.0",
+    "@kubun/store-graph": "^0.15.0",
+    "@kubun/test-utils": "^0.13.0"
   },
   "publishConfig": {
     "access": "public"