@learncard/network-brain-service 3.17.0 → 3.19.0

package/src/routes/contracts.ts

@@ -24,8 +24,6 @@ import {
     VCValidator,
     JWEValidator,
     UnsignedVC,
-    VC,
-    JWE,
     AutoBoostConfigValidator,
     LCNNotificationTypeEnumValidator,
     LCNProfileValidator,
@@ -45,6 +43,7 @@ import {
     getContractTermsForProfile,
     getTransactionsForTerms,
     hasProfileConsentedToContract,
+    hasGuardianApprovalHistory,
     isProfileConsentFlowContractAdmin,
     getWritersForContract,
 } from '@accesslayer/consentflowcontract/relationships/read';
@@ -89,6 +88,7 @@ import { getCredentialUri } from '@helpers/credential.helpers';
 import { getSigningAuthorityForUserByName } from '@accesslayer/signing-authority/relationships/read';
 import { getDidWeb } from '@helpers/did.helpers';
 import { issueCredentialWithSigningAuthority } from '@helpers/signingAuthority.helpers';
+import type { IssuedCredential } from '../types/credential';
 import { getProfilesByProfileIds } from '@accesslayer/profile/read';
 import { getProfilesThatManageAProfile } from '@accesslayer/profile/relationships/read';
 import { resolveAndValidateDeniedWriters } from '@helpers/consentflow.helpers';
@@ -854,7 +854,7 @@ export const contractsRouter = t.router({
             }
 
             // Issue VC with signing authority
-            let credential: VC | JWE;
+            let credential: IssuedCredential;
             try {
                 credential = await issueCredentialWithSigningAuthority(
                     { type: 'profile', profile },
@@ -907,7 +907,7 @@ export const contractsRouter = t.router({
         .output(z.object({ termsUri: z.string(), redirectUrl: z.string().optional() }))
         .mutation(async ({ input, ctx }) => {
             const { profile } = ctx.user;
-            const { isChildAccount, hasGuardianApproval } = ctx;
+            const { isChildAccount, hasGuardianApproval, guardianIdentity } = ctx;
 
             if (isChildAccount && !hasGuardianApproval) {
                 throw new TRPCError({
@@ -938,6 +938,19 @@ export const contractsRouter = t.router({
                 });
             }
 
+            if (!guardianIdentity) {
+                const previousTerms = await getContractTermsForProfile(
+                    profile,
+                    contractDetails.contract
+                );
+                if (previousTerms && (await hasGuardianApprovalHistory(previousTerms))) {
+                    throw new TRPCError({
+                        code: 'FORBIDDEN',
+                        message: 'This consent requires approval from a current guardian',
+                    });
+                }
+            }
+
             if (!areTermsValid(terms, contractDetails.contract.contract)) {
                 throw new TRPCError({ code: 'BAD_REQUEST', message: 'Invalid Terms for Contract' });
             }
@@ -1077,7 +1090,19 @@ export const contractsRouter = t.router({
             await consentToContract(
                 profile,
                 contractDetails,
-                { terms, expiresAt, oneTime },
+                {
+                    terms,
+                    expiresAt,
+                    oneTime,
+                    guardianApproval: guardianIdentity
+                        ? {
+                              guardianProfileId: guardianIdentity.profileId,
+                              guardianDid: guardianIdentity.did,
+                              approvedAt: new Date().toISOString(),
+                              contractUpdatedAt: contractDetails.contract.updatedAt,
+                          }
+                        : undefined,
+                },
                 ctx.domain
             );
 
@@ -1196,7 +1221,7 @@ export const contractsRouter = t.router({
         .output(z.boolean())
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
-            const { isChildAccount, hasGuardianApproval } = ctx;
+            const { isChildAccount, hasGuardianApproval, guardianIdentity } = ctx;
 
             if (isChildAccount && !hasGuardianApproval) {
                 throw new TRPCError({
@@ -1225,6 +1250,13 @@ export const contractsRouter = t.router({
                 });
             }
 
+            if (!guardianIdentity && (await hasGuardianApprovalHistory(relationship.terms))) {
+                throw new TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'This consent requires approval from a current guardian',
+                });
+            }
+
             if (!areTermsValid(terms, relationship.contract.contract)) {
                 throw new TRPCError({
                     code: 'BAD_REQUEST',
@@ -1242,7 +1274,23 @@ export const contractsRouter = t.router({
             }
 
             await Promise.all([
-                updateTerms(relationship, { terms, expiresAt, oneTime }, ctx.domain),
+                updateTerms(
+                    relationship,
+                    {
+                        terms,
+                        expiresAt,
+                        oneTime,
+                        guardianApproval: guardianIdentity
+                            ? {
+                                  guardianProfileId: guardianIdentity.profileId,
+                                  guardianDid: guardianIdentity.did,
+                                  approvedAt: new Date().toISOString(),
+                                  contractUpdatedAt: relationship.contract.updatedAt,
+                              }
+                            : undefined,
+                    },
+                    ctx.domain
+                ),
                 deleteStorageForUri(uri),
             ]);
 

package/src/routes/credential-refreshes.test.ts

@@ -116,7 +116,10 @@ describe('credential refresh issuer route gating', () => {
                 markConstraintsReady = resolve;
             })
         );
-        mocks.sendRefreshableCredential.mockResolvedValue('lc:network:credential:root');
+        mocks.sendRefreshableCredential.mockResolvedValue({
+            uri: 'lc:network:credential:root',
+            receipt: { refreshId: 'opaque-refresh-id' },
+        });
 
         const caller = credentialRefreshesRouter.createCaller({
             domain: 'network.example.com',
@@ -174,7 +177,10 @@ describe('credential refresh issuer route gating', () => {
 
     it('forwards initial notification suppression to managed delivery', async () => {
         process.env.CREDENTIAL_REFRESH_ENABLED = 'true';
-        mocks.sendRefreshableCredential.mockResolvedValue('lc:network:credential:root');
+        mocks.sendRefreshableCredential.mockResolvedValue({
+            uri: 'lc:network:credential:root',
+            receipt: { refreshId: 'opaque-refresh-id' },
+        });
 
         const caller = credentialRefreshesRouter.createCaller({
             domain: 'network.example.com',

package/src/routes/credential-refreshes.ts

@@ -124,7 +124,7 @@ export const credentialRefreshesRouter = t.router({
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
 
-            return sendRefreshableCredential({
+            const { uri } = await sendRefreshableCredential({
                 issuerProfile: profile,
                 refreshId: input.refreshId,
                 credential: input.credential,
@@ -132,6 +132,8 @@ export const credentialRefreshesRouter = t.router({
                 skipNotification: input.skipNotification,
                 domain: ctx.domain,
             });
+
+            return uri;
         }),
 
     publishCredentialRefresh: credentialRefreshRoute
@@ -156,6 +158,7 @@ export const credentialRefreshesRouter = t.router({
                 issuerProfile: profile,
                 input: input as PublishCredentialRefreshInput,
                 domain: ctx.domain,
+                branding: ctx.tenant?.emailBranding,
             });
         }),
 

package/src/routes/credentials.ts

@@ -71,6 +71,7 @@ export const credentialsRouter = t.router({
             // Log credential activity FIRST to get activityId
             const activityId = await logCredentialSent({
                 actorProfileId: profile.profileId,
+                onBehalfOf: ctx.user.onBehalfOf,
                 recipientType: 'profile',
                 recipientIdentifier: targetProfile.profileId,
                 recipientProfileId: targetProfile.profileId,
@@ -118,7 +119,7 @@ export const credentialsRouter = t.router({
             const { profile } = ctx.user;
             const { uri } = input;
 
-            return acceptCredential(profile, uri, input?.options ?? {});
+            return acceptCredential(profile, uri, input?.options ?? {}, ctx.tenant?.emailBranding);
         }),
 
     receivedCredentials: profileRoute

package/src/routes/inbox.ts

@@ -1,3 +1,12 @@
+import { trace } from '@tracing';
+import { submitInboxBatch, getInboxBatch } from '@helpers/inbox-queue.helpers';
+import {
+    assertInboxRefreshEnabled,
+    inboxRefreshRequestDigest,
+    getInboxRefreshReplay,
+    getInboxRefreshReceipt,
+    resumeInboxRefreshDelivery,
+} from '@helpers/inbox-refresh.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { TRPCError } from '@trpc/server';
 import { z } from 'zod';
@@ -6,6 +15,9 @@ import { t, profileRoute, openRoute, verifiedContactRoute, scopedRoute } from '@
 import {
     PaginationOptionsValidator,
     IssueInboxCredentialValidator,
+    IssueInboxCredentialBatchValidator,
+    InboxBatchReceiptValidator,
+    InboxBatchStatusValidator,
     IssueInboxCredentialResponseValidator,
     InboxCredentialValidator,
     PaginatedInboxCredentialsValidator,
@@ -18,15 +30,14 @@ import {
     JWEValidator,
 } from '@learncard/types';
 import { getInboxCredentialMeta } from '@helpers/credential-meta.helpers';
-import { claimIntoInbox, issueToInbox } from '@helpers/inbox.helpers';
-import { prepareCredentialFromBoost, getBoostUri } from '@helpers/boost.helpers';
+import { claimIntoInbox, issueToInbox, resolveInboxCredentialInput } from '@helpers/inbox.helpers';
 import {
     hasMustacheVariables,
     renderBoostTemplate,
     parseRenderedTemplate,
 } from '@helpers/template.helpers';
 import { getProfileByVerifiedContactMethod } from '@accesslayer/contact-method/relationships/read';
-import { getBoostByUri, getBoostsForProfile } from '@accesslayer/boost/read';
+import { getBoostsForProfile } from '@accesslayer/boost/read';
 import {
     generateGuardianApprovalToken,
     generateGuardianApprovalUrl,
@@ -447,55 +458,36 @@ export const inboxRouter = t.router({
         .output(IssueInboxCredentialResponseValidator)
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
-            const { recipient, credential: inputCredential, templateUri, configuration } = input;
-
-            // Resolve credential from templateUri if provided
-            let credential = inputCredential;
-            let resolvedBoostUri: string | undefined;
-
-            if (templateUri && !credential) {
-                const boostInstance = await getBoostByUri(templateUri);
-
-                if (!boostInstance) {
-                    throw new TRPCError({
-                        code: 'NOT_FOUND',
-                        message: `Boost not found: ${templateUri}`,
-                    });
-                }
-
-                if (!boostInstance.dataValues.boost) {
-                    throw new TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Boost does not contain a credential template: ${templateUri}`,
-                    });
-                }
+            const { recipient, configuration } = input;
 
-                try {
-                    // Use shared helper to prepare credential with templateData rendering,
-                    // issuance date, boostId injection, and OBv3 alignments
-                    resolvedBoostUri = getBoostUri(boostInstance.id, ctx.domain);
-
-                    credential = await prepareCredentialFromBoost(
-                        boostInstance,
-                        resolvedBoostUri,
-                        ctx.domain,
-                        { templateData: configuration?.templateData as Record<string, unknown> }
+            const refreshDigest = input.refresh ? inboxRefreshRequestDigest(input) : undefined;
+            if (input.refresh) {
+                await assertInboxRefreshEnabled(ctx.user.scope);
+                const replay = await getInboxRefreshReplay(
+                    profile.profileId,
+                    input.idempotencyKey,
+                    refreshDigest!
+                );
+                if (replay && (replay.claimUrl || replay.inbox.currentStatus !== 'PENDING')) {
+                    await resumeInboxRefreshDelivery(replay.inbox.refreshId!, ctx.domain);
+                    const receipt = await getInboxRefreshReceipt(
+                        replay.inbox.refreshId!,
+                        ctx.domain
                     );
-                } catch (e) {
-                    console.error('Failed to prepare boost credential', e);
-                    throw new TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Failed to prepare boost credential template: ${templateUri}`,
-                    });
+                    return {
+                        issuanceId: replay.inbox.id,
+                        status: replay.inbox.currentStatus,
+                        recipient,
+                        claimUrl: replay.claimUrl,
+                        refresh: receipt,
+                        ...(replay.inbox.currentStatus === 'ISSUED'
+                            ? { recipientDid: receipt.holderDid }
+                            : {}),
+                    };
                 }
             }
 
-            if (!credential) {
-                throw new TRPCError({
-                    code: 'BAD_REQUEST',
-                    message: 'Either credential or templateUri must be provided',
-                });
-            }
+            const { credential, resolvedBoostUri } = await resolveInboxCredentialInput(input, ctx);
 
             // Normalize signing authority name if provided
             const normalizedConfiguration = configuration?.signingAuthority
@@ -513,11 +505,18 @@ export const inboxRouter = t.router({
                     profile,
                     recipient,
                     credential,
-                    normalizedConfiguration,
+                    {
+                        ...normalizedConfiguration,
+                        boostUri: resolvedBoostUri,
+                        refresh: input.refresh,
+                        idempotencyKey: input.idempotencyKey,
+                        refreshRequestDigest: refreshDigest,
+                    },
                     ctx
                 );
 
                 return {
+                    refresh: result.refresh,
                     issuanceId: result.inboxCredential.id,
                     status: result.status,
                     recipient,
@@ -536,6 +535,42 @@ export const inboxRouter = t.router({
             }
         }),
 
+    issueBatch: profileRoute
+        .meta({
+            openapi: {
+                protect: true,
+                method: 'POST',
+                path: '/inbox/issue-batch',
+                tags: ['Universal Inbox'],
+                summary: 'Issue Credentials to Universal Inbox (Batch)',
+                description:
+                    'Queue 1–100 credentials for background issuance. Returns a durable batch ID; poll GET /inbox/batches/{batchId} for ordered results. Request and item idempotency keys are issuer-scoped for 24 hours. Maximum JSON payload: 4 MiB.',
+            },
+            requiredScope: 'inbox:write',
+        })
+        .input(IssueInboxCredentialBatchValidator)
+        .output(InboxBatchReceiptValidator)
+        .mutation(({ ctx, input }) =>
+            trace('route', 'issueBatch', () => submitInboxBatch(ctx.user.profile, input, ctx), {
+                itemCount: input.items.length,
+            })
+        ),
+
+    getBatch: profileRoute
+        .meta({
+            openapi: {
+                protect: true,
+                method: 'GET',
+                path: '/inbox/batches/{batchId}',
+                tags: ['Universal Inbox'],
+                summary: 'Get Inbox Batch Progress',
+            },
+            requiredScope: 'inbox:read',
+        })
+        .input(z.object({ batchId: z.string() }))
+        .output(InboxBatchStatusValidator)
+        .query(({ ctx, input }) => getInboxBatch(ctx.user.profile.profileId, input.batchId)),
+
     claim: verifiedContactRoute
         .meta({
             openapi: {
@@ -682,6 +717,7 @@ export const inboxRouter = t.router({
             // Log initial activity so embed claims appear in the dashboard
             const activityId = await logCredentialSent({
                 actorProfileId: issuerProfile.profileId,
+                onBehalfOf: ctx.user?.onBehalfOf,
                 recipientType: contactMethod.type as 'email' | 'phone',
                 recipientIdentifier: contactMethod.value,
                 integrationId: integration.id,
@@ -825,7 +861,17 @@ export const inboxRouter = t.router({
                 });
             }
 
-            return inboxCredential;
+            return {
+                ...inboxCredential,
+                ...(inboxCredential.refreshId
+                    ? {
+                          refresh: await getInboxRefreshReceipt(
+                              inboxCredential.refreshId,
+                              ctx.domain
+                          ),
+                      }
+                    : {}),
+            };
         }),
 
     // ─── Guardian Credential Approval Routes ─────────────────────────────────────