@kya-os/mcp-i-cloudflare 1.5.1-canary.6 → 1.5.1

package/dist/services/consent.service.js

@@ -9,19 +9,174 @@
 import { ConsentConfigService } from "./consent-config.service";
 import { ConsentPageRenderer } from "./consent-page-renderer";
 import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, } from "../constants";
+import { STORAGE_KEYS } from "../constants/storage-keys";
+import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
+import { UserDidManager } from "@kya-os/mcp-i-core";
+import { WebCryptoProvider } from "../providers/crypto";
 export class ConsentService {
     configService;
     renderer;
     env;
     runtime;
+    userDidManager; // Cached instance for consistent DID generation
     constructor(env, runtime) {
         this.env = env;
         this.runtime = runtime;
         this.configService = new ConsentConfigService(env);
         this.renderer = new ConsentPageRenderer();
     }
+    /**
+     * Get or generate User DID for a session
+     *
+     * Phase 4 PR #1: Generates ephemeral DIDs for sessions
+     * Phase 4 PR #3: Checks OAuth mappings for persistent DIDs
+     *
+     * @param sessionId - Session ID
+     * @param oauthIdentity - Optional OAuth provider identity
+     * @returns User DID (did:key format)
+     */
+    async getUserDidForSession(sessionId, oauthIdentity) {
+        // If OAuth identity provided, check for existing mapping first
+        if (oauthIdentity && this.env.DELEGATION_STORAGE) {
+            try {
+                const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
+                const mappedUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
+                if (mappedUserDid) {
+                    console.log("[ConsentService] Found persistent User DID from OAuth mapping");
+                    return mappedUserDid;
+                }
+            }
+            catch (error) {
+                console.warn("[ConsentService] Failed to check OAuth mapping:", error);
+                // Continue with ephemeral DID generation
+            }
+        }
+        // Continue with existing ephemeral DID generation logic
+        if (!this.env.DELEGATION_STORAGE) {
+            // No storage - use cached UserDidManager instance for consistent DID generation
+            if (!this.userDidManager) {
+                this.userDidManager = new UserDidManager({
+                    crypto: new WebCryptoProvider(),
+                });
+            }
+            return await this.userDidManager.getOrCreateUserDid(sessionId);
+        }
+        const sessionKey = STORAGE_KEYS.session(sessionId);
+        // Try session cache first
+        try {
+            const sessionData = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
+            if (sessionData?.userDid) {
+                return sessionData.userDid;
+            }
+        }
+        catch (error) {
+            console.warn("[ConsentService] Failed to read session cache:", error);
+        }
+        // Generate ephemeral DID using cached UserDidManager instance
+        if (!this.userDidManager) {
+            this.userDidManager = new UserDidManager({
+                crypto: new WebCryptoProvider(),
+                storage: {
+                    get: async (key) => {
+                        try {
+                            const data = await this.env.DELEGATION_STORAGE.get(`userDid:${key}`, "text");
+                            return data || null;
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                    set: async (key, value, ttl) => {
+                        await this.env.DELEGATION_STORAGE.put(`userDid:${key}`, value, {
+                            expirationTtl: ttl || DEFAULT_SESSION_CACHE_TTL,
+                        });
+                    },
+                    delete: async (key) => {
+                        await this.env.DELEGATION_STORAGE.delete(`userDid:${key}`);
+                    },
+                },
+            });
+        }
+        const userDid = await this.userDidManager.getOrCreateUserDid(sessionId);
+        // Cache in session storage
+        try {
+            const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
+            await this.env.DELEGATION_STORAGE.put(sessionKey, JSON.stringify({
+                ...existingSession,
+                userDid,
+            }), { expirationTtl: DEFAULT_SESSION_CACHE_TTL });
+        }
+        catch (error) {
+            console.warn("[ConsentService] Failed to cache userDid in session:", error);
+            // Non-fatal - continue with generated DID
+        }
+        return userDid;
+    }
+    /**
+     * Link OAuth identity to User DID
+     *
+     * Maps OAuth provider identity (provider + subject) to a persistent User DID.
+     * If an ephemeral DID exists for the session, it becomes persistent.
+     *
+     * Phase 4 PR #3: OAuth Identity Linking
+     *
+     * @param oauthIdentity - OAuth provider identity
+     * @param sessionId - Current session ID (for ephemeral DID lookup)
+     * @returns Persistent User DID
+     */
+    async linkOAuthToUserDid(oauthIdentity, sessionId) {
+        if (!this.env.DELEGATION_STORAGE) {
+            // No storage - can't persist mapping, return ephemeral DID
+            console.warn("[ConsentService] No storage available for OAuth linking");
+            return await this.getUserDidForSession(sessionId);
+        }
+        const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
+        // Check if OAuth identity already mapped
+        try {
+            const existingUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
+            if (existingUserDid) {
+                console.log("[ConsentService] OAuth identity already mapped:", {
+                    provider: oauthIdentity.provider,
+                    subject: oauthIdentity.subject.substring(0, 20) + "...",
+                    userDid: existingUserDid.substring(0, 20) + "...",
+                });
+                return existingUserDid;
+            }
+        }
+        catch (error) {
+            console.warn("[ConsentService] Failed to check OAuth mapping:", error);
+            // Continue to create new mapping
+        }
+        // Get/create User DID for session (may be ephemeral)
+        const userDid = await this.getUserDidForSession(sessionId);
+        // Store OAuth identity mapping (persistent - 90 days)
+        try {
+            await this.env.DELEGATION_STORAGE.put(oauthKey, userDid, {
+                expirationTtl: 90 * 24 * 60 * 60, // 90 days
+            });
+            // Also store full OAuth identity info for reference
+            const oauthIdentityKey = STORAGE_KEYS.userDid(oauthIdentity.provider, oauthIdentity.subject);
+            await this.env.DELEGATION_STORAGE.put(oauthIdentityKey, JSON.stringify(oauthIdentity), {
+                expirationTtl: 90 * 24 * 60 * 60, // 90 days
+            });
+            console.log("[ConsentService] OAuth identity linked to User DID:", {
+                provider: oauthIdentity.provider,
+                subject: oauthIdentity.subject.substring(0, 20) + "...",
+                userDid: userDid.substring(0, 20) + "...",
+            });
+        }
+        catch (error) {
+            console.error("[ConsentService] Failed to store OAuth mapping:", error);
+            // Non-fatal - continue with User DID
+        }
+        // Note: Ephemeral → persistent migration happens automatically
+        // The ephemeral DID becomes persistent when linked to OAuth identity
+        // Existing delegations with ephemeral DID will continue to work
+        // New delegations will use the persistent DID
+        return userDid;
+    }
     /**
      * Handle consent requests
      *
@@ -135,8 +290,40 @@ export class ConsentService {
                 customFields: consentConfig.customFields,
                 autoClose: consentConfig.ui?.autoClose,
             };
-            // Render page
-            const html = this.renderer.render(pageConfig);
+            // Phase 4 PR #4: Extract OAuth identity from cookie (server-side)
+            let oauthIdentity = undefined;
+            try {
+                const cookieHeader = request.headers.get("Cookie");
+                if (cookieHeader) {
+                    const cookies = cookieHeader.split("; ").map((c) => c.trim());
+                    const oauthCookie = cookies.find((c) => c.startsWith("oauth_identity="));
+                    if (oauthCookie) {
+                        // Extract cookie value correctly - handle values that may contain '=' characters
+                        // Use indexOf to find first '=' and take everything after it
+                        const equalsIndex = oauthCookie.indexOf("=");
+                        const cookieValue = equalsIndex >= 0
+                            ? oauthCookie.substring(equalsIndex + 1)
+                            : "";
+                        // Validate it's valid JSON before passing to client
+                        try {
+                            const parsed = JSON.parse(decodeURIComponent(cookieValue));
+                            // Basic validation - ensure it has required fields
+                            if (parsed && parsed.provider && parsed.subject) {
+                                oauthIdentity = parsed;
+                            }
+                        }
+                        catch (parseError) {
+                            console.warn("[ConsentService] Invalid OAuth cookie format:", parseError);
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                console.warn("[ConsentService] Failed to extract OAuth cookie:", error);
+                // Non-fatal - continue without OAuth identity
+            }
+            // Render page with OAuth identity (if available)
+            const html = this.renderer.render(pageConfig, oauthIdentity);
             return new Response(html, {
                 status: 200,
                 headers: {
@@ -250,78 +437,41 @@ export class ConsentService {
             };
         }
         try {
-            // Create delegation request per AgentShield API schema
-            // Schema: https://github.com/modelcontextprotocol-identity/mcp-i/blob/main/packages/contracts/src/agentshield-api/schemas.ts
-            // AgentShield implementation: apps/web/lib/bouncer/validators/schemas.ts
-            //
-            // Required fields:
-            // - agent_did: string (DID format)
-            // - scopes: string[] (at least one scope)
-            //
-            // Optional fields:
-            // - expires_in_days: number (1-365, defaults to project default if not provided)
-            // - expires_at: string (ISO 8601 date string, alternative to expires_in_days)
-            //   NOTE: expires_in_days and expires_at are mutually exclusive - use one or the other
-            // - session_id: string (optional session identifier)
-            // - project_id: string (optional project identifier, also comes from API key context)
-            // - user_id: string (optional user identifier)
-            // - user_identifier: string (optional user identifier)
-            // - agent_name: string (optional agent name)
-            // - constraints: object (optional constraints)
-            // - custom_fields: object (optional custom fields)
-            // - metadata: object (optional metadata)
-            const expiresInDays = 7; // Default to 7 days
-            const delegationRequest = {
-                agent_did: request.agent_did,
-                scopes: request.scopes,
-                expires_in_days: expiresInDays,
-                // NOTE: expires_at and expires_in_days are mutually exclusive.
-                // We use expires_in_days for simplicity. Do not include both fields.
-            };
-            // Include session_id if provided
-            if (request.session_id) {
-                delegationRequest.session_id = request.session_id;
-            }
-            // Include project_id if provided
-            if (request.project_id) {
-                delegationRequest.project_id = request.project_id;
-            }
-            // Include custom_fields if provided (send as custom_fields, not metadata)
-            if (request.customFields &&
-                Object.keys(request.customFields).length > 0) {
-                delegationRequest.custom_fields = request.customFields;
+            // Load Day0 configuration to determine field name and API capabilities
+            await loadDay0Config(this.env.DELEGATION_STORAGE);
+            const fieldName = await getDelegationFieldName(this.env.DELEGATION_STORAGE);
+            // Get userDID from session or generate new ephemeral DID
+            // Phase 4 PR #3: Use OAuth identity if provided in approval request
+            let userDid;
+            if (this.env.DELEGATION_STORAGE && request.session_id) {
+                try {
+                    // Pass OAuth identity if available in approval request
+                    userDid = await this.getUserDidForSession(request.session_id, request.oauth_identity);
+                }
+                catch (error) {
+                    console.warn("[ConsentService] Failed to get/generate userDid:", error);
+                    // Continue without userDid - delegation will use ephemeral placeholder
+                }
             }
+            const expiresInDays = 7; // Default to 7 days
+            // Build delegation request with error-based format detection
+            // Try full format first, fallback to simplified format on error
+            const delegationRequest = await this.buildDelegationRequest(request, userDid, expiresInDays, fieldName);
             console.log("[ConsentService] Creating delegation:", {
                 url: `${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`,
                 agentDid: request.agent_did.substring(0, 20) + "...",
                 scopes: request.scopes,
                 expiresInDays,
                 hasApiKey: !!apiKey,
-                // Note: project_id comes from API key, not request body
-            });
-            const response = await fetch(`${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`, {
-                method: "POST",
-                headers: {
-                    Authorization: `Bearer ${apiKey}`,
-                    "Content-Type": "application/json",
-                },
-                body: JSON.stringify(delegationRequest),
+                fieldName,
+                hasUserDid: !!userDid,
             });
-            if (!response.ok) {
-                const errorText = await response.text();
-                console.error("[ConsentService] Delegation creation failed:", {
-                    status: response.status,
-                    statusText: response.statusText,
-                    error: errorText,
-                    requestBody: JSON.stringify(delegationRequest, null, 2),
-                });
-                return {
-                    success: false,
-                    error: `API error: ${response.status}`,
-                    error_code: "api_error",
-                };
+            // Error-based format detection: try request format, fallback on error
+            const response = await this.tryAPICall(agentShieldUrl, apiKey, delegationRequest);
+            if (!response.success) {
+                return response;
             }
-            const responseData = (await response.json());
+            const responseData = response.data;
             // Canonical format per @kya-os/contracts/agentshield-api:
             // Wrapped: { success: true, data: { delegation_id: string, agent_did: string, ... } }
             // Unwrapped: { delegation_id: string, agent_did: string, ... }
@@ -415,38 +565,16 @@ export class ConsentService {
         try {
             // Default TTL: 7 days (same as delegation expiration)
             const ttl = 7 * 24 * 60 * 60; // 7 days in seconds
-            // TODO: Store tokens with userDID when available for proper multi-user support
-            // Currently, we store tokens with agent-scoped keys which can cause conflicts
-            // when multiple users delegate to the same agent. The ideal key structure should be:
-            // - `user:${userDid}:agent:${agentDid}:delegation` (user+agent scoped - preferred)
-            // - `agent:${agentDid}:delegation` (agent-scoped fallback for single-user agents)
-            //
-            // To implement this properly:
-            // 1. Capture userDID from consent approval request (from OAuth callback or session)
-            // 2. Store tokens with userDID in the key: `user:${userDid}:agent:${agentDid}:delegation`
-            // 3. Also store with agent-scoped key for backward compatibility
-            //
-            // Note: The consent approval request currently doesn't include userDID, so we need to:
-            // - Extract userDID from OAuth callback (if using OAuth flow)
-            // - Or extract userDID from session (if session has userDID)
-            // - Or add userDID to ConsentApprovalRequest interface
-            const userDid = undefined; // TODO: Get userDID from approval request or OAuth callback
-            // Store using agent DID (primary, survives session changes)
-            // WARNING: This is shared across all users - if multiple users delegate to the same
-            // agent, each delegation will overwrite the previous one. This is acceptable for
-            // single-user agents, but multi-user agents should use user+agent scoped keys.
-            const agentKey = `agent:${agentDid}:delegation`;
-            await delegationStorage.put(agentKey, token, {
-                expirationTtl: ttl,
-            });
-            console.log("[ConsentService] ✅ Token stored with agent DID:", {
-                key: agentKey,
-                ttl,
-                delegationId,
-            });
-            // Store using user+agent DID if userDID is available (preferred for multi-user scenarios)
+            // Get userDID from approval request or session (Phase 4)
+            // For now, try to extract from request or session cache
+            let userDid;
+            // Try to get userDID from session cache
+            const sessionKey = STORAGE_KEYS.session(sessionId);
+            const sessionData = (await delegationStorage.get(sessionKey, "json"));
+            userDid = sessionData?.userDid;
+            // Primary: User+Agent scoped (no conflicts) - Phase 4
             if (userDid) {
-                const userAgentKey = `user:${userDid}:agent:${agentDid}:delegation`;
+                const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
                 await delegationStorage.put(userAgentKey, token, {
                     expirationTtl: ttl,
                 });
@@ -456,15 +584,31 @@ export class ConsentService {
                     delegationId,
                 });
             }
-            // Store using session ID (secondary cache, shorter TTL for performance)
-            const sessionKey = `session:${sessionId}`;
-            await delegationStorage.put(sessionKey, token, {
+            // Backward compatibility: Agent-only key (24 hour TTL)
+            const legacyKey = STORAGE_KEYS.legacyDelegation(agentDid);
+            await delegationStorage.put(legacyKey, token, {
+                expirationTtl: 24 * 60 * 60, // 24 hours only
+            });
+            console.log("[ConsentService] ✅ Token stored with legacy agent key:", {
+                key: legacyKey,
+                ttl: 24 * 60 * 60,
+                delegationId,
+            });
+            // Session cache for fast lookup (shorter TTL for performance)
+            const sessionDataToStore = {
+                userDid,
+                agentDid,
+                delegationToken: token,
+                cachedAt: Date.now(),
+            };
+            await delegationStorage.put(sessionKey, JSON.stringify(sessionDataToStore), {
                 expirationTtl: Math.min(ttl, DEFAULT_SESSION_CACHE_TTL),
             });
             console.log("[ConsentService] ✅ Token cached for session:", {
                 key: sessionKey,
                 ttl: Math.min(ttl, DEFAULT_SESSION_CACHE_TTL),
                 sessionId,
+                userDid,
             });
         }
         catch (error) {
@@ -506,5 +650,213 @@ export class ConsentService {
             },
         });
     }
+    /**
+     * Build delegation request with error-based format detection
+     *
+     * Uses Day0 config to determine field name and includes issuerDid when available.
+     */
+    async buildDelegationRequest(request, userDid, expiresInDays, fieldName) {
+        const baseRequest = {
+            agent_did: request.agent_did,
+            scopes: request.scopes,
+            expires_in_days: expiresInDays,
+        };
+        // Include session_id if provided
+        if (request.session_id) {
+            baseRequest.session_id = request.session_id;
+        }
+        // Include project_id if provided
+        if (request.project_id) {
+            baseRequest.project_id = request.project_id;
+        }
+        // Check cached format preference
+        const cacheKey = STORAGE_KEYS.formatPreference();
+        let cachedFormat = null;
+        if (this.env.DELEGATION_STORAGE) {
+            try {
+                const cached = (await this.env.DELEGATION_STORAGE.get(cacheKey, "json"));
+                if (cached &&
+                    cached.timestamp &&
+                    Date.now() - cached.timestamp < 3600000) {
+                    cachedFormat = cached.format;
+                }
+            }
+            catch {
+                // Ignore cache errors
+            }
+        }
+        // If we have a cached preference, use it directly
+        if (cachedFormat === "full") {
+            return this.buildFullFormatRequest(request, userDid, expiresInDays);
+        }
+        else if (cachedFormat === "simplified") {
+            return this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName);
+        }
+        // No cache - return request that will be tried with error-based detection
+        return {
+            _tryFormats: true,
+            fullFormat: await this.buildFullFormatRequest(request, userDid, expiresInDays),
+            simplifiedFormat: this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName),
+        };
+    }
+    /**
+     * Build full DelegationRecord format request (future format)
+     */
+    async buildFullFormatRequest(request, userDid, expiresInDays) {
+        const notAfter = Date.now() + expiresInDays * 24 * 60 * 60 * 1000;
+        return {
+            delegation: {
+                id: crypto.randomUUID(),
+                issuerDid: userDid || "did:key:z6MkEphemeral", // Use ephemeral if no userDid
+                subjectDid: request.agent_did,
+                constraints: {
+                    scopes: request.scopes,
+                    notAfter,
+                    notBefore: Date.now(),
+                },
+                status: "active",
+                createdAt: Date.now(),
+            },
+        };
+    }
+    /**
+     * Build simplified format request with proper field name
+     */
+    buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName) {
+        const simplifiedRequest = {
+            agent_did: request.agent_did,
+            scopes: request.scopes,
+            expires_in_days: expiresInDays,
+        };
+        if (request.session_id) {
+            simplifiedRequest.session_id = request.session_id;
+        }
+        if (request.project_id) {
+            simplifiedRequest.project_id = request.project_id;
+        }
+        // Use the correct field name (metadata or custom_fields) from Day0 config
+        if (userDid) {
+            simplifiedRequest[fieldName] = {
+                issuer_did: userDid,
+                subject_did: request.agent_did,
+                format_version: "simplified_v1",
+            };
+        }
+        // Include custom_fields from request if provided
+        if (request.customFields && Object.keys(request.customFields).length > 0) {
+            simplifiedRequest.custom_fields = {
+                ...(simplifiedRequest.custom_fields || {}),
+                ...request.customFields,
+            };
+        }
+        return simplifiedRequest;
+    }
+    /**
+     * Try API call with error-based format detection
+     */
+    async tryAPICall(agentShieldUrl, apiKey, request) {
+        // Handle format detection
+        if (request._tryFormats && request.fullFormat && request.simplifiedFormat) {
+            // Try full format first
+            const fullResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.fullFormat);
+            if (fullResponse.success ||
+                fullResponse.error_code !== "validation_error") {
+                // Full format worked or failed for non-format reasons
+                await this.cacheFormatPreference("full");
+                return fullResponse;
+            }
+            // Full format failed with validation error, try simplified
+            console.log("[ConsentService] Full format failed, trying simplified format...");
+            const simplifiedResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.simplifiedFormat);
+            if (simplifiedResponse.success) {
+                await this.cacheFormatPreference("simplified");
+            }
+            return simplifiedResponse;
+        }
+        // Direct call (format already determined)
+        return this.makeAPICall(agentShieldUrl, apiKey, request);
+    }
+    /**
+     * Make API call and parse response
+     */
+    async makeAPICall(agentShieldUrl, apiKey, requestBody) {
+        try {
+            const response = await fetch(`${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${apiKey}`,
+                    "Content-Type": "application/json",
+                    "X-Request-ID": crypto.randomUUID(),
+                },
+                body: JSON.stringify(requestBody),
+            });
+            const responseText = await response.text();
+            let responseData;
+            try {
+                responseData = JSON.parse(responseText);
+            }
+            catch {
+                responseData = responseText;
+            }
+            // Check for validation error specifically
+            if (response.status === 400) {
+                const errorMessage = responseData
+                    ?.error?.message ||
+                    responseData?.message ||
+                    "Validation failed";
+                if (errorMessage.includes("format") ||
+                    errorMessage.includes("schema") ||
+                    errorMessage.includes("invalid")) {
+                    return {
+                        success: false,
+                        error: errorMessage,
+                        error_code: "validation_error",
+                    };
+                }
+            }
+            if (!response.ok) {
+                const errorData = responseData;
+                return {
+                    success: false,
+                    error: errorData.error?.message ||
+                        errorData.message ||
+                        "API request failed",
+                    error_code: errorData.error?.code || "api_error",
+                };
+            }
+            return {
+                success: true,
+                data: responseData,
+            };
+        }
+        catch (error) {
+            console.error("[ConsentService] API call failed:", error);
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : "Network request failed",
+                error_code: "network_error",
+            };
+        }
+    }
+    /**
+     * Cache successful format preference
+     */
+    async cacheFormatPreference(format) {
+        if (!this.env.DELEGATION_STORAGE)
+            return;
+        const cacheKey = STORAGE_KEYS.formatPreference();
+        try {
+            await this.env.DELEGATION_STORAGE.put(cacheKey, JSON.stringify({
+                format,
+                timestamp: Date.now(),
+            }), {
+                expirationTtl: 3600, // 1 hour
+            });
+            console.log(`[ConsentService] Cached format preference: ${format}`);
+        }
+        catch (error) {
+            console.warn("[ConsentService] Failed to cache format preference:", error);
+        }
+    }
 }
 //# sourceMappingURL=consent.service.js.map