@kubun/plugin-credential 0.17.3 → 0.17.5

package/lib/service.js

@@ -1,14 +1,7 @@
 import { isSigningIdentity, normalizeDID } from '@kokuin/token';
-import { CredentialAliasAlreadyBound, CredentialBindNotAuthorized, CredentialEntryAlreadyAliased, CredentialInvalidEntry, CredentialKeyVersionMismatch, CredentialNotFound, CredentialSupersededBranch, createCredentialAPI, createCredentialManager } from '@kubun/credential';
+import { CredentialAliasAlreadyBound, CredentialBindNotAuthorized, CredentialEntryAlreadyAliased, CredentialInvalidEntry, CredentialKeyVersionMismatch, CredentialNotFound, CredentialSupersededBranch, createCredentialAPI, createCredentialManager, wrappableDID } from '@kubun/credential';
 import { authorizeRead, authorizeWrite, ServiceAuthorizationError } from '@kubun/plugin-service-server';
 import { credentialStoreDefinition, getCredentialStore } from '@kubun/store-credential';
-// The spelling of a DID that can be encrypted to. A did:peer:4 identity carries a
-// longForm that resolves the agreement key; its short id resolves none. For
-// did:key the two forms are identical.
-function wrappableDID(identity) {
-    const longForm = identity.longForm;
-    return typeof longForm === 'string' ? longForm : identity.id;
-}
 // The service boundary has no CREDENTIAL_* → KB* mapping; toHandlerError forwards
 // a thrown error's `code` only when it is already a registered KubunErrorCode,
 // preserving `data`. This maps the known credential outcomes to an envelope code
@@ -158,6 +151,15 @@ function readAccountPeek(raw) {
                     proceed: ()=>readSeam.getCredential(param.providerName, param.ownerDID)
                 });
             },
+            'credential/get-ref': (context)=>{
+                const param = context.param;
+                return authorizeRead({
+                    context,
+                    subject: param.ownerDID,
+                    emptyResult: null,
+                    proceed: ()=>readSeam.getCredentialRef(param.providerName, param.ownerDID)
+                });
+            },
             // The same vault read as `credential/get` — the DB credential API, which
             // never refreshes a token — narrowed to the provider account and the
             // granted scopes: no token material leaves the vault on a peek.
@@ -218,6 +220,19 @@ function readAccountPeek(raw) {
                 await writeInTx((seam)=>seam.setCredential(param.providerName, param.ownerDID, param.credential));
                 return null;
             },
+            'credential/refresh-entry': async (context)=>{
+                const param = context.param;
+                await authorizeWrite({
+                    context,
+                    subject: param.ownerDID
+                });
+                return writeInTx(async (seam)=>{
+                    // The authorized alias must still name the entry being refreshed.
+                    const ref = await seam.getCredentialRef(param.providerName, param.ownerDID);
+                    if (ref?.entryID !== param.entryID) return 'absent';
+                    return seam.setCredentialForEntry(param);
+                });
+            },
             'credential/delete': async (context)=>{
                 const param = context.param;
                 await authorizeWrite({
@@ -248,6 +263,9 @@ function readAccountPeek(raw) {
                 'credential/get': {
                     allow: true
                 },
+                'credential/get-ref': {
+                    allow: true
+                },
                 'credential/peek': {
                     allow: true
                 },
@@ -260,6 +278,9 @@ function readAccountPeek(raw) {
                 'credential/refresh': {
                     allow: true
                 },
+                'credential/refresh-entry': {
+                    allow: true
+                },
                 'credential/delete': {
                     allow: true
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-credential",
-  "version": "0.17.3",
+  "version": "0.17.5",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -15,15 +15,15 @@
   ],
   "dependencies": {
     "@kokuin/token": "^0.5.0",
-    "@kubun/credential": "^0.17.3",
+    "@kubun/credential": "^0.17.4",
     "@kubun/db": "^0.17.0",
-    "@kubun/engine": "^0.17.2",
+    "@kubun/engine": "^0.17.3",
     "@kubun/graphql": "^0.17.2",
     "@kubun/hlc": "^0.17.0",
     "@kubun/id": "^0.17.0",
     "@kubun/plugin-service-api": "^0.17.1",
     "@kubun/plugin-service-server": "^0.17.1",
-    "@kubun/protocol": "^0.17.1",
+    "@kubun/protocol": "^0.17.2",
     "@kubun/store-credential": "^0.17.4",
     "@sozai/codec": "^0.4.0",
     "@sozai/runtime": "^0.1.0",
@@ -35,7 +35,7 @@
     "@kokuin/capability": "^0.3.0",
     "@kokuin/controller": "^0.1.0",
     "@kubun/db-better-sqlite": "^0.17.0",
-    "@kubun/service-credential-api": "^0.17.2",
+    "@kubun/service-credential-api": "^0.17.3",
     "@kubun/store-controller": "^0.17.0",
     "@kubun/store-graph": "^0.17.1",
     "@kubun/test-utils": "^0.0.0"