@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.1

package/src/config.ts

@@ -0,0 +1,309 @@
+/**
+ * Provider-based Runtime Configuration
+ *
+ * Core configuration for MCP-I runtime using the provider pattern.
+ * This is the foundation for all platform-specific implementations.
+ *
+ * @module @kya-os/mcp-i-core/config
+ */
+
+import type {
+  MCPIBaseConfig,
+  RuntimeIdentityConfig,
+  ProofingConfig,
+  DelegationConfig,
+  ToolProtectionSourceConfig
+} from '@kya-os/contracts/config';
+
+import type {
+  CryptoProvider,
+  ClockProvider,
+  FetchProvider,
+  StorageProvider,
+  NonceCacheProvider,
+  IdentityProvider
+} from './providers/base';
+
+import type { ToolProtectionService } from './services/tool-protection.service';
+
+/**
+ * Provider-based runtime configuration
+ *
+ * This configuration is used internally by MCPIRuntimeBase and provides
+ * the foundation for all platform-specific implementations. It uses the
+ * provider pattern for platform abstraction, allowing different implementations
+ * for Node.js, Cloudflare Workers, and other environments.
+ */
+export interface ProviderRuntimeConfig extends MCPIBaseConfig {
+  /**
+   * Cryptographic operations provider
+   * Handles signing, verification, and key generation
+   */
+  cryptoProvider: CryptoProvider;
+
+  /**
+   * Time operations provider
+   * Provides current time and timestamp generation
+   */
+  clockProvider: ClockProvider;
+
+  /**
+   * HTTP fetch operations provider
+   * Handles external API calls
+   */
+  fetchProvider: FetchProvider;
+
+  /**
+   * Storage operations provider
+   * Handles persistent data storage
+   */
+  storageProvider: StorageProvider;
+
+  /**
+   * Nonce cache provider
+   * Handles replay prevention
+   */
+  nonceCacheProvider: NonceCacheProvider;
+
+  /**
+   * Identity management provider
+   * Handles agent identity and DID operations
+   */
+  identityProvider: IdentityProvider;
+
+  /**
+   * Session configuration
+   * Controls session handling and timeouts
+   */
+  session?: {
+    /**
+     * Allowed timestamp skew in seconds
+     * @default 120
+     */
+    timestampSkewSeconds?: number;
+
+    /**
+     * Session TTL in minutes
+     * @default 30
+     */
+    ttlMinutes?: number;
+  };
+
+  /**
+   * Identity configuration (optional)
+   * When provided, enables identity features
+   */
+  identity?: RuntimeIdentityConfig;
+
+  /**
+   * Proofing configuration (optional)
+   * When provided, enables proof generation
+   */
+  proofing?: ProofingConfig;
+
+  /**
+   * Delegation configuration (optional)
+   * When provided, enables delegation verification
+   */
+  delegation?: DelegationConfig;
+
+  /**
+   * Tool protection service (optional)
+   * When provided, enables runtime tool protection
+   * Note: This is different from tool registry which is compile-time
+   */
+  toolProtectionService?: ToolProtectionService;
+
+  /**
+   * Tool protection source configuration (optional)
+   * Alternative to toolProtectionService for configuration-based setup
+   */
+  toolProtection?: ToolProtectionSourceConfig;
+}
+
+/**
+ * Builder for provider runtime configuration
+ * Helps create valid configurations with proper defaults
+ */
+export class ProviderRuntimeConfigBuilder {
+  private config: Partial<ProviderRuntimeConfig> = {
+    environment: 'development'
+  };
+
+  /**
+   * Set the providers (required)
+   */
+  withProviders(providers: {
+    cryptoProvider: CryptoProvider;
+    clockProvider: ClockProvider;
+    fetchProvider: FetchProvider;
+    storageProvider: StorageProvider;
+    nonceCacheProvider: NonceCacheProvider;
+    identityProvider: IdentityProvider;
+  }): this {
+    Object.assign(this.config, providers);
+    return this;
+  }
+
+  /**
+   * Set the environment
+   */
+  withEnvironment(env: 'development' | 'production'): this {
+    this.config.environment = env;
+    return this;
+  }
+
+  /**
+   * Configure session handling
+   */
+  withSession(session: {
+    timestampSkewSeconds?: number;
+    ttlMinutes?: number;
+  }): this {
+    this.config.session = session;
+    return this;
+  }
+
+  /**
+   * Enable identity features
+   */
+  withIdentity(identity: RuntimeIdentityConfig): this {
+    this.config.identity = identity;
+    return this;
+  }
+
+  /**
+   * Enable proofing features
+   */
+  withProofing(proofing: ProofingConfig): this {
+    this.config.proofing = proofing;
+    return this;
+  }
+
+  /**
+   * Enable delegation features
+   */
+  withDelegation(delegation: DelegationConfig): this {
+    this.config.delegation = delegation;
+    return this;
+  }
+
+  /**
+   * Set tool protection service
+   */
+  withToolProtectionService(service: ToolProtectionService): this {
+    this.config.toolProtectionService = service;
+    return this;
+  }
+
+  /**
+   * Set tool protection configuration
+   */
+  withToolProtection(config: ToolProtectionSourceConfig): this {
+    this.config.toolProtection = config;
+    return this;
+  }
+
+  /**
+   * Enable audit features
+   */
+  withAudit(audit: {
+    enabled: boolean;
+    includeProofHashes?: boolean;
+  }): this {
+    this.config.audit = audit;
+    return this;
+  }
+
+  /**
+   * Enable well-known endpoints
+   */
+  withWellKnown(wellKnown: {
+    enabled: boolean;
+    serviceName?: string;
+  }): this {
+    this.config.wellKnown = wellKnown;
+    return this;
+  }
+
+  /**
+   * Build the configuration
+   * Validates that all required providers are set
+   */
+  build(): ProviderRuntimeConfig {
+    const required = [
+      'cryptoProvider',
+      'clockProvider',
+      'fetchProvider',
+      'storageProvider',
+      'nonceCacheProvider',
+      'identityProvider'
+    ];
+
+    for (const field of required) {
+      if (!(field in this.config)) {
+        throw new Error(`Missing required provider: ${field}`);
+      }
+    }
+
+    // Apply defaults
+    return {
+      environment: 'development',
+      session: {
+        timestampSkewSeconds: 120,
+        ttlMinutes: 30
+      },
+      ...this.config
+    } as ProviderRuntimeConfig;
+  }
+}
+
+/**
+ * Re-export base types for convenience
+ */
+export type {
+  MCPIBaseConfig,
+  RuntimeIdentityConfig as BaseIdentityConfig,
+  ProofingConfig,
+  DelegationConfig,
+  ToolProtectionSourceConfig
+} from '@kya-os/contracts/config';
+
+/**
+ * Re-export remote config utilities
+ */
+export {
+  fetchRemoteConfig,
+  type RemoteConfigOptions,
+  type RemoteConfigCache
+} from './config/remote-config';
+
+/**
+ * Create a provider runtime configuration
+ * Convenience function for creating configurations
+ */
+export function createProviderRuntimeConfig(
+  providers: {
+    cryptoProvider: CryptoProvider;
+    clockProvider: ClockProvider;
+    fetchProvider: FetchProvider;
+    storageProvider: StorageProvider;
+    nonceCacheProvider: NonceCacheProvider;
+    identityProvider: IdentityProvider;
+  },
+  options?: Partial<Omit<ProviderRuntimeConfig, keyof typeof providers>>
+): ProviderRuntimeConfig {
+  return new ProviderRuntimeConfigBuilder()
+    .withProviders(providers)
+    .withEnvironment(options?.environment || 'development')
+    .withSession(options?.session || {})
+    .withIdentity(options?.identity || { enabled: false, environment: 'development' })
+    .withProofing(options?.proofing || { enabled: false })
+    .withDelegation(options?.delegation || {
+      enabled: false,
+      verifier: { type: 'memory' }
+    })
+    .withAudit(options?.audit || { enabled: false })
+    .withWellKnown(options?.wellKnown || { enabled: true })
+    .build();
+}

package/src/delegation/__tests__/audience-validator.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Tests for Delegation Audience Validation
+ *
+ * @package @kya-os/mcp-i-core/delegation/__tests__
+ */
+
+import { describe, it, expect } from "vitest";
+import { verifyDelegationAudience } from "../audience-validator";
+import type { DelegationRecord } from "@kya-os/contracts/delegation";
+
+describe("verifyDelegationAudience", () => {
+  const serverDid = "did:web:server.example.com";
+
+  it("should return true when delegation has no audience", () => {
+    const delegation: DelegationRecord = {
+      id: "del_001",
+      issuerDid: "did:web:user.com",
+      subjectDid: "did:key:zagent123",
+      controller: "user_alice",
+      vcId: "vc_001",
+      constraints: {
+        scopes: ["tool:execute"],
+        // No audience field
+      },
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 3600000,
+    };
+
+    expect(verifyDelegationAudience(delegation, serverDid)).toBe(true);
+  });
+
+  it("should return true when delegation audience matches server DID", () => {
+    const delegation: DelegationRecord = {
+      id: "del_002",
+      issuerDid: "did:web:user.com",
+      subjectDid: "did:key:zagent123",
+      controller: "user_bob",
+      vcId: "vc_002",
+      constraints: {
+        scopes: ["tool:execute"],
+        audience: serverDid, // Matches server DID
+      },
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 3600000,
+    };
+
+    expect(verifyDelegationAudience(delegation, serverDid)).toBe(true);
+  });
+
+  it("should return false when delegation audience does not match server DID", () => {
+    const delegation: DelegationRecord = {
+      id: "del_003",
+      issuerDid: "did:web:user.com",
+      subjectDid: "did:key:zagent123",
+      controller: "user_charlie",
+      vcId: "vc_003",
+      constraints: {
+        scopes: ["tool:execute"],
+        audience: "did:web:other-server.com", // Different server
+      },
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 3600000,
+    };
+
+    expect(verifyDelegationAudience(delegation, serverDid)).toBe(false);
+  });
+
+  it("should return true when server DID is in audience array", () => {
+    const delegation: DelegationRecord = {
+      id: "del_004",
+      issuerDid: "did:web:user.com",
+      subjectDid: "did:key:zagent123",
+      controller: "user_dave",
+      vcId: "vc_004",
+      constraints: {
+        scopes: ["tool:execute"],
+        audience: [
+          "did:web:server1.com",
+          serverDid, // Server DID is in array
+          "did:web:server3.com",
+        ],
+      },
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 3600000,
+    };
+
+    expect(verifyDelegationAudience(delegation, serverDid)).toBe(true);
+  });
+
+  it("should return false when server DID is not in audience array", () => {
+    const delegation: DelegationRecord = {
+      id: "del_005",
+      issuerDid: "did:web:user.com",
+      subjectDid: "did:key:zagent123",
+      controller: "user_eve",
+      vcId: "vc_005",
+      constraints: {
+        scopes: ["tool:execute"],
+        audience: [
+          "did:web:server1.com",
+          "did:web:server2.com",
+          // serverDid not in array
+        ],
+      },
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 3600000,
+    };
+
+    expect(verifyDelegationAudience(delegation, serverDid)).toBe(false);
+  });
+});
+