@kubun/plugin-credential 0.17.2 → 0.17.3

package/lib/service.d.ts

@@ -4,7 +4,7 @@ import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
  * (graph-schema-only, for an engine that consumes credentials), this registers a
  * `service` provider that hosts the vault: it builds the credential seam over
  * this engine's own db/HLC/identity and exposes
- * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * `credential/get|peek|create|refresh|delete|provenance` over a transport. The mint
  * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
  * holds the owner's controller log.
  *

package/lib/service.js

@@ -47,12 +47,38 @@ function withCode(cause, code, reason) {
         cause
     };
 }
+// The provider account captured in a stored credential's serialized body, or
+// null when it captured none (or the body is not a serialized credential).
+// The token-free part of a stored credential a peek discloses: its provider
+// account and the scopes it was granted.
+function readAccountPeek(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    } catch  {
+        return {
+            providerAccount: null
+        };
+    }
+    const account = parsed.providerAccount;
+    const providerAccount = typeof account?.iss === 'string' && typeof account.sub === 'string' ? {
+        iss: account.iss,
+        sub: account.sub
+    } : null;
+    const scopes = parsed.scopes;
+    return Array.isArray(scopes) && scopes.every((scope)=>typeof scope === 'string') ? {
+        providerAccount,
+        scopes: scopes
+    } : {
+        providerAccount
+    };
+}
 /**
  * The credential service provider. Unlike {@link createCredentialPlugin}
  * (graph-schema-only, for an engine that consumes credentials), this registers a
  * `service` provider that hosts the vault: it builds the credential seam over
  * this engine's own db/HLC/identity and exposes
- * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * `credential/get|peek|create|refresh|delete|provenance` over a transport. The mint
  * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
  * holds the owner's controller log.
  *
@@ -132,6 +158,22 @@ function withCode(cause, code, reason) {
                     proceed: ()=>readSeam.getCredential(param.providerName, param.ownerDID)
                 });
             },
+            // The same vault read as `credential/get` — the DB credential API, which
+            // never refreshes a token — narrowed to the provider account and the
+            // granted scopes: no token material leaves the vault on a peek.
+            'credential/peek': (context)=>{
+                const param = context.param;
+                return authorizeRead({
+                    context,
+                    subject: param.ownerDID,
+                    emptyResult: null,
+                    proceed: async ()=>{
+                        const raw = await readSeam.getCredential(param.providerName, param.ownerDID);
+                        if (raw == null) return null;
+                        return readAccountPeek(raw);
+                    }
+                });
+            },
             'credential/provenance': (context)=>{
                 const param = context.param;
                 return authorizeRead({
@@ -206,6 +248,9 @@ function withCode(cause, code, reason) {
                 'credential/get': {
                     allow: true
                 },
+                'credential/peek': {
+                    allow: true
+                },
                 'credential/provenance': {
                     allow: true
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-credential",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -15,16 +15,16 @@
   ],
   "dependencies": {
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential": "^0.17.1",
+    "@kubun/credential": "^0.17.3",
     "@kubun/db": "^0.17.0",
-    "@kubun/engine": "^0.17.1",
-    "@kubun/graphql": "^0.17.1",
+    "@kubun/engine": "^0.17.2",
+    "@kubun/graphql": "^0.17.2",
     "@kubun/hlc": "^0.17.0",
     "@kubun/id": "^0.17.0",
-    "@kubun/plugin-service-api": "^0.17.0",
-    "@kubun/plugin-service-server": "^0.17.0",
-    "@kubun/protocol": "^0.17.0",
-    "@kubun/store-credential": "^0.17.3",
+    "@kubun/plugin-service-api": "^0.17.1",
+    "@kubun/plugin-service-server": "^0.17.1",
+    "@kubun/protocol": "^0.17.1",
+    "@kubun/store-credential": "^0.17.4",
     "@sozai/codec": "^0.4.0",
     "@sozai/runtime": "^0.1.0",
     "graphql": "^17.0.2"
@@ -35,9 +35,9 @@
     "@kokuin/capability": "^0.3.0",
     "@kokuin/controller": "^0.1.0",
     "@kubun/db-better-sqlite": "^0.17.0",
-    "@kubun/service-credential-api": "^0.17.1",
+    "@kubun/service-credential-api": "^0.17.2",
     "@kubun/store-controller": "^0.17.0",
-    "@kubun/store-graph": "^0.17.0",
+    "@kubun/store-graph": "^0.17.1",
     "@kubun/test-utils": "^0.0.0"
   },
   "publishConfig": {