@kubun/plugin-credential 0.17.1 → 0.17.3

package/lib/service.d.ts

@@ -4,7 +4,7 @@ import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
  * (graph-schema-only, for an engine that consumes credentials), this registers a
  * `service` provider that hosts the vault: it builds the credential seam over
  * this engine's own db/HLC/identity and exposes
- * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * `credential/get|peek|create|refresh|delete|provenance` over a transport. The mint
  * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
  * holds the owner's controller log.
  *

package/lib/service.js

@@ -1,5 +1,5 @@
 import { isSigningIdentity, normalizeDID } from '@kokuin/token';
-import { createCredentialAPI, createCredentialManager } from '@kubun/credential';
+import { CredentialAliasAlreadyBound, CredentialBindNotAuthorized, CredentialEntryAlreadyAliased, CredentialInvalidEntry, CredentialKeyVersionMismatch, CredentialNotFound, CredentialSupersededBranch, createCredentialAPI, createCredentialManager } from '@kubun/credential';
 import { authorizeRead, authorizeWrite, ServiceAuthorizationError } from '@kubun/plugin-service-server';
 import { credentialStoreDefinition, getCredentialStore } from '@kubun/store-credential';
 // The spelling of a DID that can be encrypted to. A did:peer:4 identity carries a
@@ -9,12 +9,76 @@ function wrappableDID(identity) {
     const longForm = identity.longForm;
     return typeof longForm === 'string' ? longForm : identity.id;
 }
+// The service boundary has no CREDENTIAL_* → KB* mapping; toHandlerError forwards
+// a thrown error's `code` only when it is already a registered KubunErrorCode,
+// preserving `data`. This maps the known credential outcomes to an envelope code
+// plus a stable `data.reason`, so a remote caller can branch on it without seeing
+// the internal CREDENTIAL_* code or message. `ServiceAuthorizationError` (Gate A)
+// already carries KB07 on its own `code` getter and never reaches this function —
+// it throws before the try/catch below. An unmapped error stays opaque.
+function translateCredentialError(err) {
+    if (err instanceof CredentialBindNotAuthorized) {
+        return withCode(err, 'KB07', 'CREDENTIAL_NOT_AUTHORIZED');
+    }
+    if (err instanceof CredentialAliasAlreadyBound) {
+        return withCode(err, 'KB04', 'CREDENTIAL_ALIAS_ALREADY_BOUND');
+    }
+    if (err instanceof CredentialEntryAlreadyAliased) {
+        return withCode(err, 'KB04', 'CREDENTIAL_ENTRY_ALREADY_ALIASED');
+    }
+    if (err instanceof CredentialNotFound) {
+        return withCode(err, 'KB02', 'CREDENTIAL_NOT_FOUND');
+    }
+    if (err instanceof CredentialInvalidEntry) {
+        return withCode(err, 'KB01', 'CREDENTIAL_INVALID_ENTRY');
+    }
+    if (err instanceof CredentialSupersededBranch || err instanceof CredentialKeyVersionMismatch) {
+        return withCode(err, 'KB01', 'CREDENTIAL_INVALID_ENTRY');
+    }
+    return err;
+}
+function withCode(cause, code, reason) {
+    return {
+        code,
+        message: cause.message,
+        data: {
+            reason
+        },
+        cause
+    };
+}
+// The provider account captured in a stored credential's serialized body, or
+// null when it captured none (or the body is not a serialized credential).
+// The token-free part of a stored credential a peek discloses: its provider
+// account and the scopes it was granted.
+function readAccountPeek(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    } catch  {
+        return {
+            providerAccount: null
+        };
+    }
+    const account = parsed.providerAccount;
+    const providerAccount = typeof account?.iss === 'string' && typeof account.sub === 'string' ? {
+        iss: account.iss,
+        sub: account.sub
+    } : null;
+    const scopes = parsed.scopes;
+    return Array.isArray(scopes) && scopes.every((scope)=>typeof scope === 'string') ? {
+        providerAccount,
+        scopes: scopes
+    } : {
+        providerAccount
+    };
+}
 /**
  * The credential service provider. Unlike {@link createCredentialPlugin}
  * (graph-schema-only, for an engine that consumes credentials), this registers a
  * `service` provider that hosts the vault: it builds the credential seam over
  * this engine's own db/HLC/identity and exposes
- * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * `credential/get|peek|create|refresh|delete|provenance` over a transport. The mint
  * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
  * holds the owner's controller log.
  *
@@ -94,6 +158,22 @@ function wrappableDID(identity) {
                     proceed: ()=>readSeam.getCredential(param.providerName, param.ownerDID)
                 });
             },
+            // The same vault read as `credential/get` — the DB credential API, which
+            // never refreshes a token — narrowed to the provider account and the
+            // granted scopes: no token material leaves the vault on a peek.
+            'credential/peek': (context)=>{
+                const param = context.param;
+                return authorizeRead({
+                    context,
+                    subject: param.ownerDID,
+                    emptyResult: null,
+                    proceed: async ()=>{
+                        const raw = await readSeam.getCredential(param.providerName, param.ownerDID);
+                        if (raw == null) return null;
+                        return readAccountPeek(raw);
+                    }
+                });
+            },
             'credential/provenance': (context)=>{
                 const param = context.param;
                 return authorizeRead({
@@ -146,6 +226,19 @@ function wrappableDID(identity) {
                 });
                 await writeInTx((seam)=>seam.deleteCredential(param.providerName, param.ownerDID));
                 return null;
+            },
+            'credential/bind-alias': async (context)=>{
+                const param = context.param;
+                await authorizeWrite({
+                    context,
+                    subject: param.ownerDID
+                }); // Gate A
+                try {
+                    await writeInTx((seam)=>seam.bindAlias(param.providerName, param.ownerDID, param.entryID));
+                } catch (err) {
+                    throw translateCredentialError(err);
+                }
+                return null;
             }
         };
         params.registerProvider('service', {
@@ -155,6 +248,9 @@ function wrappableDID(identity) {
                 'credential/get': {
                     allow: true
                 },
+                'credential/peek': {
+                    allow: true
+                },
                 'credential/provenance': {
                     allow: true
                 },
@@ -166,6 +262,9 @@ function wrappableDID(identity) {
                 },
                 'credential/delete': {
                     allow: true
+                },
+                'credential/bind-alias': {
+                    allow: true
                 }
             }
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-credential",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -15,15 +15,16 @@
   ],
   "dependencies": {
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential": "^0.17.0",
+    "@kubun/credential": "^0.17.3",
     "@kubun/db": "^0.17.0",
-    "@kubun/engine": "^0.17.1",
-    "@kubun/graphql": "^0.17.1",
+    "@kubun/engine": "^0.17.2",
+    "@kubun/graphql": "^0.17.2",
     "@kubun/hlc": "^0.17.0",
     "@kubun/id": "^0.17.0",
-    "@kubun/plugin-service-api": "^0.17.0",
-    "@kubun/plugin-service-server": "^0.17.0",
-    "@kubun/store-credential": "^0.17.1",
+    "@kubun/plugin-service-api": "^0.17.1",
+    "@kubun/plugin-service-server": "^0.17.1",
+    "@kubun/protocol": "^0.17.1",
+    "@kubun/store-credential": "^0.17.4",
     "@sozai/codec": "^0.4.0",
     "@sozai/runtime": "^0.1.0",
     "graphql": "^17.0.2"
@@ -34,9 +35,9 @@
     "@kokuin/capability": "^0.3.0",
     "@kokuin/controller": "^0.1.0",
     "@kubun/db-better-sqlite": "^0.17.0",
-    "@kubun/service-credential-api": "^0.17.0",
+    "@kubun/service-credential-api": "^0.17.2",
     "@kubun/store-controller": "^0.17.0",
-    "@kubun/store-graph": "^0.17.0",
+    "@kubun/store-graph": "^0.17.1",
     "@kubun/test-utils": "^0.0.0"
   },
   "publishConfig": {