@kya-os/contracts 1.8.1 → 1.9.0

package/parity-vectors/scope-matching.json

@@ -0,0 +1,330 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "Scope matching test vectors",
+  "description": "Test vectors for delegation scope matching parity between TypeScript and Rust",
+  "version": "1.0.0",
+  "vectors": [
+    {
+      "id": "exact-match",
+      "description": "Exact scope match",
+      "input": {
+        "requested": "read:email",
+        "granted": ["read:email"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "exact",
+        "matchedBy": "read:email"
+      }
+    },
+    {
+      "id": "exact-no-match",
+      "description": "Exact scope does not match",
+      "input": {
+        "requested": "write:email",
+        "granted": ["read:email"]
+      },
+      "expected": {
+        "permitted": false,
+        "matchType": "none",
+        "matchedBy": null
+      }
+    },
+    {
+      "id": "full-access",
+      "description": "Full access wildcard matches anything",
+      "input": {
+        "requested": "any:thing:at:all",
+        "granted": ["*"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "fullAccess",
+        "matchedBy": "*"
+      }
+    },
+    {
+      "id": "wildcard-action",
+      "description": "Wildcard action matches any action in resource",
+      "input": {
+        "requested": "read:email",
+        "granted": ["read:*"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "wildcard",
+        "matchedBy": "read:*"
+      }
+    },
+    {
+      "id": "wildcard-resource",
+      "description": "Wildcard resource matches any resource for action",
+      "input": {
+        "requested": "read:email",
+        "granted": ["*:email"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "wildcard",
+        "matchedBy": "*:email"
+      }
+    },
+    {
+      "id": "wildcard-depth-mismatch",
+      "description": "Wildcard does not match different depth",
+      "input": {
+        "requested": "read:email:inbox",
+        "granted": ["read:*"]
+      },
+      "expected": {
+        "permitted": false,
+        "matchType": "none",
+        "matchedBy": null
+      }
+    },
+    {
+      "id": "prefix-match-three-segments",
+      "description": "Prefix match with trailing wildcard (3 segments)",
+      "input": {
+        "requested": "read:email:inbox",
+        "granted": ["read:email:*"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "prefix",
+        "matchedBy": "read:email:*"
+      }
+    },
+    {
+      "id": "prefix-match-four-segments",
+      "description": "Prefix match with trailing wildcard (4 segments)",
+      "input": {
+        "requested": "read:email:inbox:unread",
+        "granted": ["read:email:inbox:*"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "prefix",
+        "matchedBy": "read:email:inbox:*"
+      }
+    },
+    {
+      "id": "deep-prefix-one-level",
+      "description": "Deep prefix wildcard matches one level below",
+      "input": {
+        "requested": "read:email",
+        "granted": ["read:**"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "prefix",
+        "matchedBy": "read:**"
+      }
+    },
+    {
+      "id": "deep-prefix-two-levels",
+      "description": "Deep prefix wildcard matches two levels below",
+      "input": {
+        "requested": "read:email:inbox",
+        "granted": ["read:**"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "prefix",
+        "matchedBy": "read:**"
+      }
+    },
+    {
+      "id": "deep-prefix-many-levels",
+      "description": "Deep prefix wildcard matches many levels below",
+      "input": {
+        "requested": "read:email:inbox:unread:important",
+        "granted": ["read:**"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "prefix",
+        "matchedBy": "read:**"
+      }
+    },
+    {
+      "id": "deep-prefix-no-self-match",
+      "description": "Deep prefix wildcard does NOT match same level (strictly below)",
+      "input": {
+        "requested": "read",
+        "granted": ["read:**"]
+      },
+      "expected": {
+        "permitted": false,
+        "matchType": "none",
+        "matchedBy": null
+      }
+    },
+    {
+      "id": "deep-prefix-wrong-prefix",
+      "description": "Deep prefix wildcard does not match wrong prefix",
+      "input": {
+        "requested": "write:email",
+        "granted": ["read:**"]
+      },
+      "expected": {
+        "permitted": false,
+        "matchType": "none",
+        "matchedBy": null
+      }
+    },
+    {
+      "id": "multiple-scopes-first-match",
+      "description": "Multiple granted scopes, first match wins",
+      "input": {
+        "requested": "read:email",
+        "granted": ["write:calendar", "read:email"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "exact",
+        "matchedBy": "read:email"
+      }
+    },
+    {
+      "id": "multiple-scopes-full-access-wins",
+      "description": "Full access wins when present",
+      "input": {
+        "requested": "read:email",
+        "granted": ["write:calendar", "*"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "fullAccess",
+        "matchedBy": "*"
+      }
+    },
+    {
+      "id": "empty-scope-error",
+      "description": "Empty scope should error",
+      "input": {
+        "requested": "",
+        "granted": ["read:email"]
+      },
+      "expected": {
+        "permitted": false,
+        "error": true,
+        "errorType": "EmptyScope"
+      }
+    },
+    {
+      "id": "wildcard-middle-segment",
+      "description": "Wildcard in middle segment",
+      "input": {
+        "requested": "read:email:inbox",
+        "granted": ["read:*:inbox"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "wildcard",
+        "matchedBy": "read:*:inbox"
+      }
+    },
+    {
+      "id": "wildcard-first-segment",
+      "description": "Wildcard in first segment",
+      "input": {
+        "requested": "read:email:inbox",
+        "granted": ["*:email:inbox"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "wildcard",
+        "matchedBy": "*:email:inbox"
+      }
+    },
+    {
+      "id": "empty-granted-no-match",
+      "description": "No granted scopes means no match",
+      "input": {
+        "requested": "read:email",
+        "granted": []
+      },
+      "expected": {
+        "permitted": false,
+        "matchType": "none",
+        "matchedBy": null
+      }
+    },
+    {
+      "id": "single-segment-scope",
+      "description": "Single segment scope exact match",
+      "input": {
+        "requested": "admin",
+        "granted": ["admin"]
+      },
+      "expected": {
+        "permitted": true,
+        "matchType": "exact",
+        "matchedBy": "admin"
+      }
+    }
+  ],
+  "timeBoundaryVectors": [
+    {
+      "id": "valid-time-window",
+      "description": "Current time within valid window",
+      "input": {
+        "requested": "read:email",
+        "granted": ["read:email"],
+        "notBefore": 1704067200,
+        "notAfter": 1767225600,
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "permitted": true
+      }
+    },
+    {
+      "id": "expired-delegation",
+      "description": "Current time after notAfter",
+      "input": {
+        "requested": "read:email",
+        "granted": ["read:email"],
+        "notBefore": null,
+        "notAfter": 1704067200,
+        "currentTime": 1735689600
+      },
+      "expected": {
+        "permitted": false,
+        "error": true,
+        "errorType": "Expired"
+      }
+    },
+    {
+      "id": "not-yet-valid",
+      "description": "Current time before notBefore",
+      "input": {
+        "requested": "read:email",
+        "granted": ["read:email"],
+        "notBefore": 1735689600,
+        "notAfter": null,
+        "currentTime": 1704067200
+      },
+      "expected": {
+        "permitted": false,
+        "error": true,
+        "errorType": "NotYetValid"
+      }
+    },
+    {
+      "id": "skip-time-check",
+      "description": "Time check skipped when currentTime is 0",
+      "input": {
+        "requested": "read:email",
+        "granted": ["read:email"],
+        "notBefore": 9999999999,
+        "notAfter": 1,
+        "currentTime": 0
+      },
+      "expected": {
+        "permitted": true
+      }
+    }
+  ]
+}

package/parity-vectors/vc-jwt.json

@@ -0,0 +1,210 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "VC-JWT verification test vectors",
+  "description": "Test vectors for VC-JWT parsing and verification parity between TypeScript and Rust",
+  "version": "1.0.0",
+  "vectors": [
+    {
+      "id": "valid-jwt-parse",
+      "description": "Parse a valid JWT structure",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3Bibm5FR3RhMmRvSyIsInN1YiI6ImRpZDprZXk6ejZNa2hhWGdCWkR2b3REa0w1MjU3ZmFpenRpR2lDMlF0S0xHcGJubkVHdGEyZG9LIiwiYXVkIjoidGVzdC1hdWRpZW5jZSIsImlhdCI6MTcwNDA2NzIwMH0.signature-placeholder"
+      },
+      "expected": {
+        "success": true,
+        "header": {
+          "alg": "EdDSA",
+          "typ": "JWT"
+        },
+        "payload": {
+          "iss": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+          "sub": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
+          "aud": "test-audience"
+        }
+      }
+    },
+    {
+      "id": "valid-jwt-no-typ",
+      "description": "Parse JWT without typ header (allowed)",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3Bibm5FR3RhMmRvSyJ9.signature"
+      },
+      "expected": {
+        "success": true,
+        "header": {
+          "alg": "EdDSA",
+          "typ": null
+        }
+      }
+    },
+    {
+      "id": "valid-jwt-typ-lowercase",
+      "description": "Parse JWT with lowercase typ (allowed)",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSIsInR5cCI6Imp3dCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3Bibm5FR3RhMmRvSyJ9.signature"
+      },
+      "expected": {
+        "success": true,
+        "header": {
+          "alg": "EdDSA",
+          "typ": "jwt"
+        }
+      }
+    },
+    {
+      "id": "invalid-wrong-algorithm",
+      "description": "Reject JWT with wrong algorithm",
+      "input": {
+        "jwt": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWsiLCJzdWIiOiJ0ZXN0In0.signature"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "WrongAlgorithm",
+        "errorMessage": "Expected EdDSA, got RS256"
+      }
+    },
+    {
+      "id": "invalid-wrong-type",
+      "description": "Reject JWT with wrong type",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXRSJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWsiLCJzdWIiOiJ0ZXN0In0.signature"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "WrongType",
+        "errorMessage": "Expected JWT, got JWE"
+      }
+    },
+    {
+      "id": "invalid-malformed-not-three-parts",
+      "description": "Reject malformed JWT (not 3 parts)",
+      "input": {
+        "jwt": "header.payload"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidFormat",
+        "errorMessage": "JWT must have 3 parts"
+      }
+    },
+    {
+      "id": "invalid-malformed-empty",
+      "description": "Reject empty JWT",
+      "input": {
+        "jwt": ""
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidFormat"
+      }
+    },
+    {
+      "id": "invalid-malformed-too-many-parts",
+      "description": "Reject JWT with too many parts",
+      "input": {
+        "jwt": "a.b.c.d"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidFormat",
+        "errorMessage": "JWT must have 3 parts"
+      }
+    },
+    {
+      "id": "invalid-bad-base64-header",
+      "description": "Reject JWT with invalid base64 in header",
+      "input": {
+        "jwt": "not-valid-base64!!!.eyJpc3MiOiJ0ZXN0In0.signature"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidBase64"
+      }
+    },
+    {
+      "id": "invalid-bad-json-header",
+      "description": "Reject JWT with invalid JSON in header",
+      "input": {
+        "jwt": "bm90LWpzb24.eyJpc3MiOiJ0ZXN0In0.signature"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "InvalidJson"
+      }
+    },
+    {
+      "id": "valid-extract-issuer-string",
+      "description": "Extract issuer from JWT payload (string format)",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3Bibm5FR3RhMmRvSyJ9.sig"
+      },
+      "expected": {
+        "success": true,
+        "issuer": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
+      }
+    },
+    {
+      "id": "valid-extract-issuer-object",
+      "description": "Extract issuer from JWT payload (object format with id)",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSJ9.eyJpc3MiOnsiaWQiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3Bibm5FR3RhMmRvSyJ9fQ.sig"
+      },
+      "expected": {
+        "success": true,
+        "issuer": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
+      }
+    },
+    {
+      "id": "invalid-missing-issuer",
+      "description": "Reject JWT without issuer",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ0ZXN0In0.signature"
+      },
+      "expected": {
+        "success": false,
+        "errorType": "MissingIssuer"
+      }
+    }
+  ],
+  "signatureVerificationVectors": [
+    {
+      "id": "verify-valid-signature",
+      "description": "Verify a JWT with valid Ed25519 signature",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWtoYVhnQlpEdm90RGtMNTI1N2ZhaXp0aUdpQzJRdEtMR3Bibm5FR3RhMmRvSyIsInN1YiI6InRlc3QiLCJpYXQiOjE3MDQwNjcyMDB9.ACTUAL_SIGNATURE_NEEDED",
+        "publicKeyHex": "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a"
+      },
+      "expected": {
+        "success": true,
+        "verified": true
+      },
+      "note": "This vector requires generating a real signature for end-to-end testing"
+    },
+    {
+      "id": "verify-invalid-signature",
+      "description": "Reject JWT with invalid signature",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWsiLCJzdWIiOiJ0ZXN0In0.aW52YWxpZC1zaWduYXR1cmU",
+        "publicKeyHex": "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a"
+      },
+      "expected": {
+        "success": false,
+        "verified": false,
+        "errorType": "InvalidSignature"
+      }
+    },
+    {
+      "id": "verify-wrong-public-key",
+      "description": "Reject JWT verified with wrong public key",
+      "input": {
+        "jwt": "eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJkaWQ6a2V5Ono2TWsiLCJzdWIiOiJ0ZXN0In0.some-signature",
+        "publicKeyHex": "0000000000000000000000000000000000000000000000000000000000000000"
+      },
+      "expected": {
+        "success": false,
+        "verified": false,
+        "errorType": "InvalidSignature"
+      }
+    }
+  ]
+}