@learncard/network-brain-service 3.19.0 → 4.0.0

package/src/routes/inbox.ts

@@ -768,8 +768,10 @@ export const inboxRouter = t.router({
                 claimed: z.number(),
                 errors: z.number(),
                 guardianPending: z.number(),
-                verifiableCredentials: z.array(VCValidator),
-                deliveries: z.array(z.object({ id: z.string(), credential: VCValidator })),
+                verifiableCredentials: z.array(VCValidator.or(JWEValidator)),
+                deliveries: z.array(
+                    z.object({ id: z.string(), credential: VCValidator.or(JWEValidator) })
+                ),
             })
         )
         .mutation(async ({ ctx }) => {

package/src/routes/index.ts

@@ -11,6 +11,7 @@ import jwtDecode from 'jwt-decode';
 import * as Sentry from '@sentry/serverless';
 import { ACT_AS_HEADER, AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX } from '@learncard/types';
 import { ContactMethodType } from '@learncard/types';
+import { MAX_SHARE_LINK_REQUEST_BYTES, utf8ByteLength } from '@learncard/types';
 
 import { RegExpTransformer } from '@learncard/helpers';
 import { resolveTenantFromRequest, type ResolvedTenant } from '@learncard/email-templates';
@@ -22,6 +23,7 @@ import {
 } from '@accesslayer/profile/relationships/read';
 import { getDidWeb } from '@helpers/did.helpers';
 import { getEmptyLearnCard, isServersDidWebDID } from '@helpers/learnCard.helpers';
+import { isServiceProfileExemptFromGuardianship } from '@helpers/profile.helpers';
 import { invalidateChallengeForDid, isChallengeValidForDid } from '@cache/challenges';
 import { ProfileType } from 'types/profile';
 import { getProfileManagerById } from '@accesslayer/profile-manager/read';
@@ -217,14 +219,93 @@ export const createContext = async (
     return { domain, tenant, _guardianApprovalToken, sourceIp, actAs };
 };
 
-export const openRoute = t.procedure
-    .use(t.middleware(Sentry.Handlers.trpcMiddleware({ attachRpcInput: true }) as any))
-    .use(({ ctx, next, path }) => {
-        Sentry.configureScope(scope => {
-            scope.setTransactionName(`trpc-${path}`);
-        });
-        return next({ ctx });
+const sentryTransactionNameMiddleware = t.middleware(({ ctx, next, path }) => {
+    Sentry.configureScope(scope => {
+        scope.setTransactionName(`trpc-${path}`);
     });
+    return next({ ctx });
+});
+
+// Sentry's tRPC middleware type predates this repo's generic context. Cast
+// through the tRPC builder's expected parameter type instead of `any`.
+type SentryTrpcMiddleware = Parameters<typeof t.middleware>[0];
+
+const sentryInputCaptureMiddleware = Sentry.Handlers.trpcMiddleware({
+    attachRpcInput: true,
+}) as unknown as SentryTrpcMiddleware;
+
+const sentryNoInputCaptureMiddleware = Sentry.Handlers.trpcMiddleware({
+    attachRpcInput: false,
+}) as unknown as SentryTrpcMiddleware;
+
+/**
+ * Complete-request byte bound for owner share-link routes, enforced on the RAW
+ * input before Zod parsing/stripping. Individual field validators cannot bound a
+ * request whose unknown or duplicate fields are stripped first, so this measures
+ * the whole serialized body (UTF-8) and fails closed over the shared 1 MiB cap.
+ *
+ * It is composed into the base so it runs before authentication and before any
+ * input parser, and can never be skipped by a malformed or unauthenticated call.
+ */
+const enforceShareLinkRequestByteBound = t.middleware(async ({ ctx, next, getRawInput }) => {
+    const raw = await getRawInput();
+
+    let bytes: number;
+    if (raw === undefined || raw === null) {
+        bytes = 0;
+    } else if (typeof raw === 'string') {
+        bytes = utf8ByteLength(raw);
+    } else {
+        let serialized: string;
+        try {
+            serialized = JSON.stringify(raw);
+        } catch {
+            throw new TRPCError({ code: 'BAD_REQUEST', message: 'invalid share-link request' });
+        }
+        bytes = utf8ByteLength(serialized);
+    }
+
+    if (bytes > MAX_SHARE_LINK_REQUEST_BYTES) {
+        throw new TRPCError({
+            code: 'PAYLOAD_TOO_LARGE',
+            message: 'share-link request exceeds the 1 MiB limit',
+        });
+    }
+
+    return next({ ctx });
+});
+
+export const openRoute = t.procedure
+    .use(t.middleware(sentryInputCaptureMiddleware))
+    .use(sentryTransactionNameMiddleware);
+
+/**
+ * LC-2187 public share-link paths must never be cached by an intermediary or a
+ * browser. tRPC has no per-procedure header API, so the actual HTTP adapters
+ * (Fastify and Lambda, both tRPC and OpenAPI) apply `Cache-Control` from the
+ * resolved procedure path through this single helper.
+ */
+export const PUBLIC_SHARE_LINK_ROUTE_PREFIX = 'publicShareLinks.';
+
+export const publicShareLinkCacheControlHeaders = (
+    paths: readonly string[] | undefined
+): Record<string, string> =>
+    (paths ?? []).some(path => path.startsWith(PUBLIC_SHARE_LINK_ROUTE_PREFIX))
+        ? { 'Cache-Control': 'private, no-store' }
+        : {};
+
+/**
+ * Route base for procedures whose input carries owner-private material (titles,
+ * notes, ciphertext envelopes, recovery JWEs) and whose error paths must not
+ * attach raw request bodies to Sentry. It runs the same Sentry error/transaction
+ * handling but with input attachment disabled, so no branch — malformed,
+ * unauthenticated or failing — can capture the payload, and it enforces the
+ * complete-request byte bound before input parsing.
+ */
+export const openRouteWithoutInputCapture = t.procedure
+    .use(t.middleware(sentryNoInputCaptureMiddleware))
+    .use(sentryTransactionNameMiddleware)
+    .use(enforceShareLinkRequestByteBound);
 
 export const resolveProfileFromContextDid = async (
     didFromContext: string | undefined,
@@ -316,27 +397,33 @@ const resolveActAs = async (
     return { ...user, profile: target, did: target.did, onBehalfOf: profile.profileId };
 };
 
-export const didRoute = openRoute.use(async ({ ctx, next }) => {
-    if (!ctx.user?.did) {
-        throw new TRPCError({ code: 'UNAUTHORIZED' });
-    }
+const withDid = (base: typeof openRoute) =>
+    base.use(async ({ ctx, next }) => {
+        if (!ctx.user?.did) {
+            throw new TRPCError({ code: 'UNAUTHORIZED' });
+        }
 
-    const profile = await resolveProfileFromContextDid(ctx.user.did, ctx.domain);
+        const profile = await resolveProfileFromContextDid(ctx.user.did, ctx.domain);
 
-    if (profile) Sentry.setUser({ id: profile.profileId, username: profile.displayName });
+        if (profile) Sentry.setUser({ id: profile.profileId, username: profile.displayName });
 
-    const user = ctx.user.isChallengeValid
-        ? await resolveActAs({ ...ctx.user, profile }, ctx.actAs, ctx.domain)
-        : { ...ctx.user, profile };
+        const user = ctx.user.isChallengeValid
+            ? await resolveActAs({ ...ctx.user, profile }, ctx.actAs, ctx.domain)
+            : { ...ctx.user, profile };
 
-    return next({ ctx: { ...ctx, user } });
-});
+        return next({ ctx: { ...ctx, user } });
+    });
 
-export const didAndChallengeRoute = didRoute.use(({ ctx, next }) => {
-    if (!ctx.user?.isChallengeValid) throw new TRPCError({ code: 'UNAUTHORIZED' });
+export const didRoute = withDid(openRoute);
 
-    return next({ ctx: { ...ctx, user: ctx.user } });
-});
+const withChallenge = (base: typeof didRoute) =>
+    base.use(({ ctx, next }) => {
+        if (!ctx.user?.isChallengeValid) throw new TRPCError({ code: 'UNAUTHORIZED' });
+
+        return next({ ctx: { ...ctx, user: ctx.user } });
+    });
+
+export const didAndChallengeRoute = withChallenge(didRoute);
 
 export const scopedRoute = didAndChallengeRoute.use(({ ctx, next, meta }) => {
     if (!meta?.requiredScope) {
@@ -370,33 +457,41 @@ export const openProfileRoute = didRoute.use(async ({ ctx, next }) => {
     return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
 });
 
-export const profileRoute = didAndChallengeRoute.use(async ({ ctx, next, meta }) => {
-    const { profile } = ctx.user;
+const withProfile = (base: typeof didAndChallengeRoute) =>
+    base.use(async ({ ctx, next, meta }) => {
+        const { profile } = ctx.user;
 
-    if (!profile) {
-        throw new TRPCError({
-            code: 'NOT_FOUND',
-            message: 'Profile not found. Please make a profile!',
-        });
-    }
+        if (!profile) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: 'Profile not found. Please make a profile!',
+            });
+        }
 
-    if (!meta?.requiredScope) {
-        return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
-    }
+        if (!meta?.requiredScope) {
+            return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
+        }
 
-    const userScope = ctx.user?.scope || AUTH_GRANT_NO_ACCESS_SCOPE;
+        const userScope = ctx.user?.scope || AUTH_GRANT_NO_ACCESS_SCOPE;
 
-    const hasRequiredScope = userHasRequiredScopes(userScope, meta.requiredScope);
+        const hasRequiredScope = userHasRequiredScopes(userScope, meta.requiredScope);
 
-    if (!hasRequiredScope) {
-        throw new TRPCError({
-            code: 'UNAUTHORIZED',
-            message: `This operation requires ${meta.requiredScope} scope`,
-        });
-    }
+        if (!hasRequiredScope) {
+            throw new TRPCError({
+                code: 'UNAUTHORIZED',
+                message: `This operation requires ${meta.requiredScope} scope`,
+            });
+        }
 
-    return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
-});
+        return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
+    });
+
+export const profileRoute = withProfile(didAndChallengeRoute);
+
+/** Same auth chain, composed on a base that never attaches private RPC input to Sentry. */
+export const didRouteWithoutInputCapture = withDid(openRouteWithoutInputCapture);
+export const didAndChallengeRouteWithoutInputCapture = withChallenge(didRouteWithoutInputCapture);
+export const profileRouteWithoutInputCapture = withProfile(didAndChallengeRouteWithoutInputCapture);
 
 export const openProfileManagerRoute = openRoute.use(async ({ ctx, next }) => {
     if (!ctx.user?.did) throw new TRPCError({ code: 'UNAUTHORIZED' });
@@ -460,7 +555,10 @@ const GUARDIAN_APPROVAL_CLOCK_SKEW_SECONDS = 60;
 export const guardianGatedRoute = profileRoute.use(async ({ ctx, next }) => {
     const { profile } = ctx.user;
     const guardianApprovalToken = ctx._guardianApprovalToken;
-    const isChildAccount = await isProfileManaged(profile.profileId);
+    // Service profiles (orgs) are managed for admin purposes, not guardianship.
+    const isChildAccount =
+        !isServiceProfileExemptFromGuardianship(profile.isServiceProfile, profile.type) &&
+        (await isProfileManaged(profile.profileId));
     let guardianIdentity: { profileId: string; did: string } | undefined;
 
     if (isChildAccount && guardianApprovalToken) {

package/src/routes/presentations.ts

@@ -16,6 +16,10 @@ import { getPresentationOwner } from '@accesslayer/presentation/relationships/re
 import { deletePresentation } from '@accesslayer/presentation/delete';
 import { isRelationshipBlocked } from '@helpers/connection.helpers';
 import { getProfileIdFromString } from '@helpers/did.helpers';
+import {
+    assertPresentationMetadataRecipient,
+    PresentationMetadataValidator,
+} from '@helpers/presentation-metadata';
 
 export const presentationsRouter = t.router({
     sendPresentation: profileRoute
@@ -31,11 +35,17 @@ export const presentationsRouter = t.router({
             },
             requiredScope: 'presentations:write',
         })
-        .input(z.object({ profileId: z.string(), presentation: VPValidator.or(JWEValidator) }))
+        .input(
+            z.object({
+                profileId: z.string(),
+                presentation: VPValidator.or(JWEValidator),
+                metadata: PresentationMetadataValidator.optional(),
+            })
+        )
         .output(z.string())
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
-            const { profileId, presentation } = input;
+            const { profileId, presentation, metadata } = input;
 
             const resolvedProfileId = await getProfileIdFromString(profileId, ctx.domain);
             if (!resolvedProfileId) {
@@ -52,7 +62,13 @@ export const presentationsRouter = t.router({
                 });
             }
 
-            return sendPresentation(profile, targetProfile, presentation, ctx.domain);
+            assertPresentationMetadataRecipient(
+                metadata,
+                profile.profileId,
+                targetProfile.profileId
+            );
+
+            return sendPresentation(profile, targetProfile, presentation, ctx.domain, metadata);
         }),
 
     acceptPresentation: profileRoute

package/src/routes/profile-manager.ts

@@ -18,13 +18,18 @@ import { checkIfProfileExists } from '@accesslayer/profile/read';
 import { ProfileManagerType, ProfileManagerValidator } from 'types/profile-manager';
 import { getLearnCard } from '@helpers/learnCard.helpers';
 import { createProfile } from '@accesslayer/profile/create';
+import { PublicProfileIdValidator } from '@helpers/profile.helpers';
 import { createManagesRelationship } from '@accesslayer/profile-manager/relationships/create';
 import { deleteManagesRelationship } from '@accesslayer/profile-manager/relationships/delete';
 import { getBoostByUri } from '@accesslayer/boost/read';
-import { getManagedProfiles, getProfilesManagedByProfile } from '@accesslayer/profile-manager/relationships/read';
+import {
+    getManagedProfiles,
+    getProfilesManagedByProfile,
+} from '@accesslayer/profile-manager/relationships/read';
 import { getProfilesThatManageAProfile } from '@accesslayer/profile/relationships/read';
 import { updateProfileManager } from '@accesslayer/profile-manager/update';
 import { getProfileManagerById } from '@accesslayer/profile-manager/read';
+import { ProfileManager } from '@models';
 
 export const profileManagersRouter = t.router({
     createProfileManager: profileRoute
@@ -115,9 +120,31 @@ export const profileManagersRouter = t.router({
             },
             requiredScope: 'profileManagers:write',
         })
-        .input(LCNProfileValidator.omit({ did: true }))
+        .input(
+            LCNProfileValidator.omit({ did: true }).extend({
+                profileId: PublicProfileIdValidator,
+            })
+        )
         .output(z.string())
         .mutation(async ({ input, ctx }) => {
+            // Org onboarding also uses this API. Only the persisted Family parent
+            // (or an explicit child type), not a client service flag, defines a child path.
+            if (input.isServiceProfile) {
+                const parents = await ProfileManager.findRelationships({
+                    alias: 'childOf',
+                    where: { source: { id: ctx.user.manager.id } },
+                });
+                if (
+                    input.type === 'child' ||
+                    parents.some(({ target }) => target.category === 'Family')
+                ) {
+                    throw new TRPCError({
+                        code: 'BAD_REQUEST',
+                        message: 'Child profiles cannot be service profiles.',
+                    });
+                }
+            }
+
             const profileExists = await checkIfProfileExists(input);
 
             if (profileExists) {

package/src/routes/profiles.ts

@@ -67,7 +67,7 @@ import { ProfileType, SigningAuthorityForUserValidator } from 'types/profile';
 
 import { t, openRoute, didAndChallengeRoute, profileRoute, didRoute } from '@routes';
 
-import { transformProfileId } from '@helpers/profile.helpers';
+import { PublicProfileIdValidator, transformProfileId } from '@helpers/profile.helpers';
 import { deleteDidDocForProfile } from '@cache/did-docs';
 import {
     isInviteAlreadySetForProfile,
@@ -102,7 +102,7 @@ import { createProfileContactMethodRelationship } from '@accesslayer/contact-met
 import { deleteAllProfileContactMethodRelationshipsExceptForProfileId } from '@accesslayer/contact-method/relationships/delete';
 
 const UpdateProfileInputValidator = z.object({
-    profileId: z.string().optional(),
+    profileId: PublicProfileIdValidator.optional(),
     displayName: z.string().optional(),
     shortBio: z.string().optional(),
     bio: z.string().optional(),
@@ -154,7 +154,10 @@ export const profilesRouter = t.router({
             LCNProfileValidator.omit({
                 did: true,
                 isServiceProfile: true,
-            }).extend({ authToken: z.string().optional() })
+            }).extend({
+                profileId: PublicProfileIdValidator,
+                authToken: z.string().optional(),
+            })
         )
         .output(z.string())
         .mutation(async ({ input, ctx }) => {
@@ -243,7 +246,11 @@ export const profilesRouter = t.router({
             },
             requiredScope: 'profiles:write',
         })
-        .input(LCNProfileValidator.omit({ did: true, isServiceProfile: true }))
+        .input(
+            LCNProfileValidator.omit({ did: true, isServiceProfile: true }).extend({
+                profileId: PublicProfileIdValidator,
+            })
+        )
         .output(z.string())
         .mutation(async ({ input, ctx }) => {
             const profileExists = await checkIfProfileExists({ ...input, did: ctx.user.did });
@@ -281,7 +288,11 @@ export const profilesRouter = t.router({
             },
             requiredScope: 'profiles:write',
         })
-        .input(LCNProfileValidator.omit({ did: true, isServiceProfile: true }))
+        .input(
+            LCNProfileValidator.omit({ did: true, isServiceProfile: true }).extend({
+                profileId: PublicProfileIdValidator,
+            })
+        )
         .output(z.string())
         .mutation(async ({ input, ctx }) => {
             const { profileId } = input;
@@ -498,7 +509,7 @@ export const profilesRouter = t.router({
             } = input;
 
             const _selfProfile = ctx.user?.did ? await getProfileByDid(ctx.user.did) : null;
-            const selfProfile = includeSelf ? null : _selfProfile ?? null;
+            const selfProfile = includeSelf ? null : (_selfProfile ?? null);
 
             const blacklist =
                 (_selfProfile && (await getBlockedAndBlockedByIds(_selfProfile))) || [];
@@ -563,6 +574,18 @@ export const profilesRouter = t.router({
         .output(z.boolean())
         .mutation(async ({ input, ctx }) => {
             const { profile } = ctx.user;
+            if (
+                profile.isServiceProfile === true &&
+                profile.type === 'child' &&
+                typeof input.type === 'string' &&
+                input.type !== 'child'
+            ) {
+                throw new TRPCError({
+                    code: 'BAD_REQUEST',
+                    message:
+                        'A service profile explicitly typed as a child cannot change profile type.',
+                });
+            }
 
             const {
                 profileId,