@kubun/store-delegation 0.12.1 → 0.14.0

package/lib/revocation-checker.d.ts

@@ -1,4 +1,5 @@
 import { type VerifyTokenHook } from '@kokuin/capability';
+import { type MethodRegistry } from '@kokuin/token';
 import type { DelegationStoreAPI } from './api.js';
 export type RevocationClaims = {
     jti: string;
@@ -17,5 +18,10 @@ export type RevocationClaims = {
  * kokuin's checker still re-verifies the record's signature and re-compares the
  * issuer, so a row this device could not cross-check against a locally held
  * grant is safe to hand over.
+ *
+ * `methods` resolves the record's issuer: a revocation whose `iss` is a
+ * `did:kokuin:` controller DID cannot verify from the identifier alone, so
+ * without the registry it fails to resolve, is dropped, and the revoked
+ * capability passes (fail-open). Optional so non-controller callers stay 1-arg.
  */
-export declare function createDelegationRevocationChecker(api: DelegationStoreAPI): VerifyTokenHook;
+export declare function createDelegationRevocationChecker(api: DelegationStoreAPI, methods?: MethodRegistry): VerifyTokenHook;

package/lib/revocation-checker.js

@@ -11,7 +11,12 @@ import { verifyToken } from '@kokuin/token';
  * kokuin's checker still re-verifies the record's signature and re-compares the
  * issuer, so a row this device could not cross-check against a locally held
  * grant is safe to hand over.
- */ export function createDelegationRevocationChecker(api) {
+ *
+ * `methods` resolves the record's issuer: a revocation whose `iss` is a
+ * `did:kokuin:` controller DID cannot verify from the identifier alone, so
+ * without the registry it fails to resolve, is dropped, and the revoked
+ * capability passes (fail-open). Optional so non-controller callers stay 1-arg.
+ */ export function createDelegationRevocationChecker(api, methods) {
     // The backend is per-token: its `get` closes over the issuer of the
     // capability being checked, which is only known once the hook is called.
     return async (token, raw)=>{
@@ -30,7 +35,11 @@ import { verifyToken } from '@kokuin/token';
                     return undefined;
                 }
                 try {
-                    return await verifyToken(row.revocation_token);
+                    // Carries `methods` so a controller-issued (`did:kokuin:`) record can
+                    // resolve; must match the checker's own verify below or the two drift.
+                    return await verifyToken(row.revocation_token, {
+                        methods
+                    });
                 } catch  {
                     // A stored record that no longer verifies revokes nothing. The checker
                     // re-verifies too, but failing here keeps a corrupt row from surfacing.
@@ -38,6 +47,8 @@ import { verifyToken } from '@kokuin/token';
                 }
             }
         };
-        await createRevocationChecker(backend)(token, raw);
+        await createRevocationChecker(backend, {
+            methods
+        })(token, raw);
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/store-delegation",
-  "version": "0.12.1",
+  "version": "0.14.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -15,17 +15,17 @@
     "LICENSE.md"
   ],
   "dependencies": {
-    "@kokuin/capability": "^0.2.2",
-    "@kokuin/token": "^0.4.0",
-    "kysely": "^0.29.5",
-    "@kubun/db": "^0.12.1",
-    "@kubun/logger": "^0.12.0",
-    "@kubun/db-adapter": "^0.13.0"
+    "@kokuin/capability": "^0.3.0",
+    "@kokuin/token": "^0.5.0",
+    "@kubun/db": "^0.14.0",
+    "@kubun/db-adapter": "^0.14.0",
+    "@kubun/logger": "^0.14.0",
+    "kysely": "^0.29.5"
   },
   "devDependencies": {
-    "@testcontainers/postgresql": "^12.1.0",
-    "@kubun/db-postgres": "^0.12.1",
-    "@kubun/db-better-sqlite": "^0.12.1"
+    "@kubun/db-better-sqlite": "^0.14.0",
+    "@kubun/db-postgres": "^0.14.0",
+    "@testcontainers/postgresql": "^12.1.0"
   },
   "publishConfig": {
     "access": "public"