@kubun/plugin-credential 0.17.2 → 0.17.4

package/lib/service.d.ts

@@ -4,7 +4,7 @@ import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
  * (graph-schema-only, for an engine that consumes credentials), this registers a
  * `service` provider that hosts the vault: it builds the credential seam over
  * this engine's own db/HLC/identity and exposes
- * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * `credential/get|peek|create|refresh|delete|provenance` over a transport. The mint
  * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
  * holds the owner's controller log.
  *

package/lib/service.js

@@ -1,14 +1,7 @@
 import { isSigningIdentity, normalizeDID } from '@kokuin/token';
-import { CredentialAliasAlreadyBound, CredentialBindNotAuthorized, CredentialEntryAlreadyAliased, CredentialInvalidEntry, CredentialKeyVersionMismatch, CredentialNotFound, CredentialSupersededBranch, createCredentialAPI, createCredentialManager } from '@kubun/credential';
+import { CredentialAliasAlreadyBound, CredentialBindNotAuthorized, CredentialEntryAlreadyAliased, CredentialInvalidEntry, CredentialKeyVersionMismatch, CredentialNotFound, CredentialSupersededBranch, createCredentialAPI, createCredentialManager, wrappableDID } from '@kubun/credential';
 import { authorizeRead, authorizeWrite, ServiceAuthorizationError } from '@kubun/plugin-service-server';
 import { credentialStoreDefinition, getCredentialStore } from '@kubun/store-credential';
-// The spelling of a DID that can be encrypted to. A did:peer:4 identity carries a
-// longForm that resolves the agreement key; its short id resolves none. For
-// did:key the two forms are identical.
-function wrappableDID(identity) {
-    const longForm = identity.longForm;
-    return typeof longForm === 'string' ? longForm : identity.id;
-}
 // The service boundary has no CREDENTIAL_* → KB* mapping; toHandlerError forwards
 // a thrown error's `code` only when it is already a registered KubunErrorCode,
 // preserving `data`. This maps the known credential outcomes to an envelope code
@@ -47,12 +40,38 @@ function withCode(cause, code, reason) {
         cause
     };
 }
+// The provider account captured in a stored credential's serialized body, or
+// null when it captured none (or the body is not a serialized credential).
+// The token-free part of a stored credential a peek discloses: its provider
+// account and the scopes it was granted.
+function readAccountPeek(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    } catch  {
+        return {
+            providerAccount: null
+        };
+    }
+    const account = parsed.providerAccount;
+    const providerAccount = typeof account?.iss === 'string' && typeof account.sub === 'string' ? {
+        iss: account.iss,
+        sub: account.sub
+    } : null;
+    const scopes = parsed.scopes;
+    return Array.isArray(scopes) && scopes.every((scope)=>typeof scope === 'string') ? {
+        providerAccount,
+        scopes: scopes
+    } : {
+        providerAccount
+    };
+}
 /**
  * The credential service provider. Unlike {@link createCredentialPlugin}
  * (graph-schema-only, for an engine that consumes credentials), this registers a
  * `service` provider that hosts the vault: it builds the credential seam over
  * this engine's own db/HLC/identity and exposes
- * `credential/get|create|refresh|delete|provenance` over a transport. The mint
+ * `credential/get|peek|create|refresh|delete|provenance` over a transport. The mint
  * runs here, resolving a `did:kokuin:` owner-wrapping locally because this engine
  * holds the owner's controller log.
  *
@@ -132,6 +151,22 @@ function withCode(cause, code, reason) {
                     proceed: ()=>readSeam.getCredential(param.providerName, param.ownerDID)
                 });
             },
+            // The same vault read as `credential/get` — the DB credential API, which
+            // never refreshes a token — narrowed to the provider account and the
+            // granted scopes: no token material leaves the vault on a peek.
+            'credential/peek': (context)=>{
+                const param = context.param;
+                return authorizeRead({
+                    context,
+                    subject: param.ownerDID,
+                    emptyResult: null,
+                    proceed: async ()=>{
+                        const raw = await readSeam.getCredential(param.providerName, param.ownerDID);
+                        if (raw == null) return null;
+                        return readAccountPeek(raw);
+                    }
+                });
+            },
             'credential/provenance': (context)=>{
                 const param = context.param;
                 return authorizeRead({
@@ -206,6 +241,9 @@ function withCode(cause, code, reason) {
                 'credential/get': {
                     allow: true
                 },
+                'credential/peek': {
+                    allow: true
+                },
                 'credential/provenance': {
                     allow: true
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-credential",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -15,16 +15,16 @@
   ],
   "dependencies": {
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential": "^0.17.1",
+    "@kubun/credential": "^0.17.4",
     "@kubun/db": "^0.17.0",
-    "@kubun/engine": "^0.17.1",
-    "@kubun/graphql": "^0.17.1",
+    "@kubun/engine": "^0.17.2",
+    "@kubun/graphql": "^0.17.2",
     "@kubun/hlc": "^0.17.0",
     "@kubun/id": "^0.17.0",
-    "@kubun/plugin-service-api": "^0.17.0",
-    "@kubun/plugin-service-server": "^0.17.0",
-    "@kubun/protocol": "^0.17.0",
-    "@kubun/store-credential": "^0.17.3",
+    "@kubun/plugin-service-api": "^0.17.1",
+    "@kubun/plugin-service-server": "^0.17.1",
+    "@kubun/protocol": "^0.17.2",
+    "@kubun/store-credential": "^0.17.4",
     "@sozai/codec": "^0.4.0",
     "@sozai/runtime": "^0.1.0",
     "graphql": "^17.0.2"
@@ -35,9 +35,9 @@
     "@kokuin/capability": "^0.3.0",
     "@kokuin/controller": "^0.1.0",
     "@kubun/db-better-sqlite": "^0.17.0",
-    "@kubun/service-credential-api": "^0.17.1",
+    "@kubun/service-credential-api": "^0.17.2",
     "@kubun/store-controller": "^0.17.0",
-    "@kubun/store-graph": "^0.17.0",
+    "@kubun/store-graph": "^0.17.1",
     "@kubun/test-utils": "^0.0.0"
   },
   "publishConfig": {