@learncard/network-brain-service 3.18.0 → 3.19.1

package/src/routes/act-as.test.ts

@@ -0,0 +1,239 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { resolveTenantFromRequest } from '@learncard/email-templates';
+import { ACT_AS_HEADER, AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX } from '@learncard/types';
+import type { ProfileType } from 'types/profile';
+
+const mocks = vi.hoisted(() => ({
+    getProfileByDid: vi.fn(),
+    getProfileByProfileId: vi.fn(),
+    getProfilesThatManageAProfile: vi.fn(),
+    grant: vi.fn(),
+    verifyPresentation: vi.fn(),
+    isAuthGrantAssociatedWithProfile: vi.fn(),
+    getAuthGrantById: vi.fn(),
+    updateAuthGrant: vi.fn(),
+}));
+
+vi.mock('@accesslayer/profile/read', () => ({
+    getProfileByDid: mocks.getProfileByDid,
+    getProfileByProfileId: mocks.getProfileByProfileId,
+}));
+vi.mock('@accesslayer/profile/relationships/read', () => ({
+    getProfilesThatManageAProfile: mocks.getProfilesThatManageAProfile,
+}));
+vi.mock('@accesslayer/auth-grant/read', () => ({
+    isAuthGrantChallengeValidForDID: mocks.grant,
+    isAuthGrantAssociatedWithProfile: mocks.isAuthGrantAssociatedWithProfile,
+    getAuthGrantById: mocks.getAuthGrantById,
+}));
+vi.mock('@accesslayer/auth-grant/update', () => ({ updateAuthGrant: mocks.updateAuthGrant }));
+vi.mock('@helpers/learnCard.helpers', () => ({
+    getEmptyLearnCard: async () => ({ invoke: { verifyPresentation: mocks.verifyPresentation } }),
+}));
+
+import { createContext, didRoute, profileRoute, t, type Context } from './index';
+import { profilesRouter } from './profiles';
+import { authGrantsRouter } from './auth-grants';
+
+const domain = 'network.example.com';
+const manager: ProfileType = {
+    profileId: 'manager',
+    did: 'did:key:manager',
+    displayName: 'Manager',
+    shortBio: '',
+    bio: '',
+};
+const target: ProfileType = {
+    profileId: 'the-id',
+    did: `did:web:${domain}:users:the-id`,
+    displayName: 'District',
+    shortBio: '',
+    bio: '',
+};
+const inspectionRouter = t.router({
+    context: didRoute.query(({ ctx }) => ctx.user),
+    writeInbox: profileRoute.meta({ requiredScope: 'inbox:write' }).query(() => true),
+    writeBoost: profileRoute.meta({ requiredScope: 'boosts:write' }).query(() => true),
+});
+const context = (overrides: Partial<Context> = {}): Context => ({
+    domain,
+    tenant: resolveTenantFromRequest({}),
+    actAs: target.profileId,
+    user: { did: manager.did, isChallengeValid: true, scope: '*:*' },
+    ...overrides,
+});
+
+beforeEach(() => {
+    vi.resetAllMocks();
+    mocks.getProfileByDid.mockResolvedValue(manager);
+    mocks.getProfileByProfileId.mockImplementation(async (id: string) =>
+        id === target.profileId ? target : null
+    );
+    mocks.getProfilesThatManageAProfile.mockResolvedValue([manager]);
+    mocks.verifyPresentation.mockResolvedValue({ warnings: [], errors: [], checks: ['JWS'] });
+});
+
+describe('act as a managed profile', () => {
+    it.each([target.profileId, target.did])('accepts seed-auth delegation to %s', async actAs => {
+        const ctx = context({ actAs });
+        await expect(profilesRouter.createCaller(ctx).getProfile()).resolves.toMatchObject(target);
+        await expect(inspectionRouter.createCaller(ctx).context()).resolves.toMatchObject({
+            did: target.did,
+            profile: target,
+            onBehalfOf: manager.profileId,
+            scope: '*:*',
+        });
+        expect(ctx.user?.did).toBe(manager.did);
+        expect(mocks.getProfilesThatManageAProfile).toHaveBeenCalledWith(target.profileId);
+    });
+
+    it('rejects a profile the caller does not manage', async () => {
+        mocks.getProfilesThatManageAProfile.mockResolvedValue([]);
+        await expect(inspectionRouter.createCaller(context()).context()).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            message: 'You do not manage profile "the-id".',
+        });
+    });
+
+    it('rejects an unknown profile', async () => {
+        await expect(
+            inspectionRouter.createCaller(context({ actAs: 'missing' })).context()
+        ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+    });
+
+    it.each([
+        'did:key:other',
+        'did:web:elsewhere:users:the-id',
+        `did:web:${domain}:manager:the-id`,
+        `${target.did}:extra`,
+    ])('rejects an unsupported DID: %s', async actAs => {
+        await expect(
+            inspectionRouter.createCaller(context({ actAs })).context()
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    });
+
+    it.each([
+        [undefined, false],
+        ['', false],
+        ['*', true],
+        ['other-id', false],
+        ['the-id,other', true],
+        [' other, the-id ', true],
+    ] as const)('enforces token policy %s (allowed: %s)', async (actAs, allowed) => {
+        mocks.grant.mockResolvedValue({ isChallengeValid: true, scope: 'inbox:write', actAs });
+        const payload = Buffer.from(
+            JSON.stringify({
+                vp: { holder: manager.did },
+                nonce: `${AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX}test`,
+            })
+        ).toString('base64url');
+        const ctx = await createContext({
+            req: {
+                headers: new Map([
+                    ['authorization', `Bearer e30.${payload}.signature`],
+                    [ACT_AS_HEADER, target.profileId],
+                ]),
+            },
+        });
+        const caller = inspectionRouter.createCaller(ctx);
+        if (!allowed) {
+            await expect(caller.context()).rejects.toMatchObject({
+                code: 'FORBIDDEN',
+                message: 'This API token may not act as "the-id". Grant actAs on the token.',
+            });
+            return;
+        }
+        await expect(caller.context()).resolves.toMatchObject({
+            profile: target,
+            did: target.did,
+            onBehalfOf: manager.profileId,
+            scope: 'inbox:write',
+            isAuthGrant: true,
+            actAsPolicy: actAs,
+        });
+        await expect(caller.writeInbox()).resolves.toBe(true);
+        await expect(caller.writeBoost()).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+    });
+
+    it('leaves the authenticated identity unchanged without a header', async () => {
+        const result = await inspectionRouter.createCaller(context({ actAs: undefined })).context();
+        expect(result).toMatchObject({ profile: manager, did: manager.did, scope: '*:*' });
+        expect(result.onBehalfOf).toBeUndefined();
+    });
+
+    it.each([ACT_AS_HEADER, ACT_AS_HEADER.toLowerCase(), ACT_AS_HEADER.toUpperCase()])(
+        'reads header %s without resolving a profile in createContext',
+        async name => {
+            const ctx = await createContext({ req: { headers: new Map([[name, target.did]]) } });
+            expect(ctx.actAs).toBe(target.did);
+            expect(mocks.getProfileByProfileId).not.toHaveBeenCalled();
+        }
+    );
+});
+
+describe('act-as ordering', () => {
+    it('does not resolve the target when the challenge is not verified', async () => {
+        const ctx = context({ user: { did: manager.did, isChallengeValid: false, scope: '*:*' } });
+        await expect(inspectionRouter.createCaller(ctx).context()).resolves.toMatchObject({
+            did: manager.did,
+        });
+        expect(mocks.getProfileByProfileId).not.toHaveBeenCalled();
+        expect(mocks.getProfilesThatManageAProfile).not.toHaveBeenCalled();
+    });
+
+    it('treats a blank header as no delegation', async () => {
+        const ctx = context({ actAs: '   ' });
+        await expect(inspectionRouter.createCaller(ctx).context()).resolves.toMatchObject({
+            did: manager.did,
+        });
+        expect(mocks.getProfileByProfileId).not.toHaveBeenCalled();
+    });
+});
+
+describe('auth grant actAs is immutable', () => {
+    const grant = {
+        id: 'grant-1',
+        name: 'svc',
+        challenge: `${AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX}test`,
+        status: 'active',
+        scope: 'inbox:write',
+        createdAt: '2026-01-01T00:00:00.000Z',
+        actAs: '*',
+    };
+
+    beforeEach(() => {
+        mocks.isAuthGrantAssociatedWithProfile.mockResolvedValue(true);
+        mocks.getAuthGrantById.mockResolvedValue(grant);
+        mocks.updateAuthGrant.mockResolvedValue(true);
+    });
+
+    it.each([{ actAs: 'the-id' }, { actAs: '*' }, { scope: '*:*' }, { status: 'revoked' }])(
+        'rejects %j with BAD_REQUEST instead of silently dropping it',
+        async updates => {
+            const caller = authGrantsRouter.createCaller(context({ actAs: undefined }));
+            await expect(
+                caller.updateAuthGrant({ id: grant.id, updates: updates as never })
+            ).rejects.toMatchObject({
+                code: 'BAD_REQUEST',
+                message: expect.stringContaining('Cannot update id, scope, actAs'),
+            });
+            expect(mocks.updateAuthGrant).not.toHaveBeenCalled();
+        }
+    );
+
+    it('rejects unknown keys', async () => {
+        const caller = authGrantsRouter.createCaller(context({ actAs: undefined }));
+        await expect(
+            caller.updateAuthGrant({ id: grant.id, updates: { bogus: true } as never })
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        expect(mocks.updateAuthGrant).not.toHaveBeenCalled();
+    });
+
+    it('still allows mutable fields', async () => {
+        const caller = authGrantsRouter.createCaller(context({ actAs: undefined }));
+        await expect(
+            caller.updateAuthGrant({ id: grant.id, updates: { description: 'renamed' } })
+        ).resolves.toBe(true);
+        expect(mocks.updateAuthGrant).toHaveBeenCalledWith(grant, { description: 'renamed' });
+    });
+});

package/src/routes/app-store.ts

@@ -104,6 +104,7 @@ import {
     isDraftBoost,
     appendTemplateEvidenceToCredential,
 } from '@helpers/boost.helpers';
+import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { createBoostForListing } from '@accesslayer/boost/create';
 import { setBoostAsParent } from '@accesslayer/boost/relationships/create';
 import { issueCredentialWithSigningAuthority } from '@helpers/signingAuthority.helpers';
@@ -692,17 +693,7 @@ export const handleSendCredentialEvent = async (
 
         const targetDid = getDidWeb(ctx.domain, target.profileId);
 
-        if (Array.isArray(unsignedVc.credentialSubject)) {
-            unsignedVc.credentialSubject = unsignedVc.credentialSubject.map(subject => ({
-                ...subject,
-                id: targetDid,
-            }));
-        } else {
-            unsignedVc.credentialSubject = {
-                ...unsignedVc.credentialSubject,
-                id: targetDid,
-            };
-        }
+        setCredentialSubjectIds(unsignedVc, targetDid);
 
         if (unsignedVc?.type?.includes('BoostCredential')) {
             unsignedVc.boostId = boostUri;
@@ -1671,7 +1662,7 @@ const handleSendNotificationEvent = async (
         // tRPC does not support HTTP 429 natively, so we cast to BAD_REQUEST
         // while keeping the semantic code in the message for clients.
         throw new TRPCError({
-            code: 'TOO_MANY_REQUESTS' as 'BAD_REQUEST',
+            code: 'TOO_MANY_REQUESTS',
             message: 'Rate limit exceeded: max 10 notifications per user per app per hour',
         });
     }
@@ -2718,7 +2709,7 @@ export const appStoreRouter = t.router({
                 // tRPC does not support HTTP 429 natively, so we cast to BAD_REQUEST
                 // while keeping the semantic code in the message for clients.
                 throw new TRPCError({
-                    code: 'TOO_MANY_REQUESTS' as 'BAD_REQUEST',
+                    code: 'TOO_MANY_REQUESTS',
                     message: 'Rate limit exceeded: max 60 notifications per app per hour',
                 });
             }

package/src/routes/auth-grants.ts

@@ -139,14 +139,9 @@ export const authGrantsRouter = t.router({
         .input(
             z.object({
                 id: z.string(),
-                updates: AuthGrantValidator.partial().omit({
-                    id: true,
-                    scope: true,
-                    status: true,
-                    createdAt: true,
-                    expiresAt: true,
-                    challenge: true,
-                }),
+                // Immutable fields stay in the schema so the guard below can reject them
+                // explicitly; omitting them would strip the key and silently no-op instead.
+                updates: AuthGrantValidator.partial().strict(),
             })
         )
         .output(z.boolean())
@@ -158,13 +153,20 @@ export const authGrantsRouter = t.router({
                 });
             }
 
-            // Extra check to reject sensitive, invalid updates
-            const invalidUpdates = ['id', 'scope', 'status', 'createdAt', 'expiresAt', 'challenge'];
+            const invalidUpdates = [
+                'id',
+                'scope',
+                'actAs',
+                'status',
+                'createdAt',
+                'expiresAt',
+                'challenge',
+            ];
             if (invalidUpdates.some(key => input.updates.hasOwnProperty(key))) {
                 throw new TRPCError({
                     code: 'BAD_REQUEST',
                     message:
-                        'Cannot update id, scope, status, createdAt, expiresAt, or challenge of an AuthGrant',
+                        'Cannot update id, scope, actAs, status, createdAt, expiresAt, or challenge of an AuthGrant',
                 });
             }