@learncard/network-brain-service 4.1.3 → 5.0.0

package/test/contract-requests.spec.ts

@@ -1,3 +1,4 @@
+import * as notificationTransport from '@helpers/notification-webhook-fetch.helpers';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { createServer } from 'node:http';
 import * as runtime from '@environment';
@@ -122,6 +123,46 @@ describe('generic contract requests and correlated events', () => {
         } as unknown as Awaited<ReturnType<typeof learnCardHelpers.getDidWebLearnCard>>);
     };
 
+    it('delivers required-update alert copy without exposing the owner’s private profile fields', async () => {
+        const uri = await create();
+        await accept(uri);
+        await neogma.queryRunner.run(
+            `MATCH (owner:Profile {profileId:$profileId})
+             SET owner.email = 'owner-private@example.com', owner.dob = '1990-01-01',
+                 owner.country = 'US', owner.notificationsWebhook = 'https://owner.example/private-hook'`,
+            { profileId: owner.profileId }
+        );
+        delivered = [];
+        const reason = 'We need transcripts to personalize your progress report.';
+        const result = await owner.clients.fullAuth.contracts.updateConsentFlowContract({
+            uri,
+            changes: {
+                contract: {
+                    read: {
+                        credentials: {
+                            categories: {
+                                ...normalContract.read.credentials.categories,
+                                Transcript: { required: true },
+                            },
+                        },
+                    },
+                },
+            },
+            reason,
+        });
+        await flush(uri);
+        const notice = delivered.find(
+            notification =>
+                notification.type === 'CONSENT_FLOW_CONTRACT_UPDATED' &&
+                notification.to.profileId === learner.profileId
+        );
+        expect(notice?.message).toEqual({ title: result.preview.headline, body: reason });
+        expect(notice?.from.profileId).toBe(owner.profileId);
+        for (const key of ['email', 'dob', 'country', 'notificationsWebhook']) {
+            expect(notice!.from).not.toHaveProperty(key);
+        }
+    });
+
     it.each(['owner', 'writer', 'recipient'] as const)(
         'allows %s requests without granting writer data access',
         async role => {
@@ -859,12 +900,17 @@ describe('generic contract requests and correlated events', () => {
         const history = await learner.clients.fullAuth.contracts.getTermsTransactionHistory({
             uri: termsUri,
         });
-        expect(history.records.filter(t => t.action === 'consent')).toHaveLength(2);
+        expect(
+            history.records.filter(transaction => transaction.action === 'consent')
+        ).toHaveLength(1);
+        expect(
+            history.records.filter(transaction => transaction.action === 'reconsent')
+        ).toHaveLength(1);
         expect(history.records.every(t => t.referral?.requestId === original.requestId)).toBe(true);
         expect(
             delivered.find(n => n.to.profileId === owner.profileId)?.data?.metadata
         ).toMatchObject({
-            event: 'consent_created',
+            event: 'consent_updated',
             requestId: original.requestId,
             externalReferenceId: original.externalReferenceId,
         });
@@ -939,8 +985,8 @@ describe('generic contract requests and correlated events', () => {
         expect((await getContractTermsByUri(termsUri))!.terms.referral).toBeUndefined();
         expect(await status(uri)).toMatchObject({ status: 'pending' });
         delivered.length = 0;
-        await learner.clients.fullAuth.contracts.updateConsentedContractTerms({
-            uri: termsUri,
+        await learner.clients.fullAuth.contracts.consentToContract({
+            contractUri: uri,
             terms: normalFullTerms,
             expiresAt: '',
             audienceVersion: 2,
@@ -1052,7 +1098,7 @@ describe('generic contract requests and correlated events', () => {
         const uri = await create([]);
         useDirectWebhook(webhook);
         const fetchSpy = vi
-            .spyOn(globalThis, 'fetch')
+            .spyOn(notificationTransport, 'fetchNotificationWebhook')
             .mockResolvedValue(new Response('{}', { status: httpStatus ?? 200 }));
         await expect(accept(uri)).resolves.toMatchObject({ termsUri: expect.any(String) });
         const row = (await eventRows(uri))[0]!;
@@ -1075,7 +1121,7 @@ describe('generic contract requests and correlated events', () => {
             const uri = await create([]);
             useDirectWebhook('https://synthetic.example/events');
             const fetchSpy = vi
-                .spyOn(globalThis, 'fetch')
+                .spyOn(notificationTransport, 'fetchNotificationWebhook')
                 .mockResolvedValue(new Response('{"success":false}', { status: httpStatus }));
             await accept(uri);
             const row = (await eventRows(uri))[0]!;
@@ -1104,7 +1150,7 @@ describe('generic contract requests and correlated events', () => {
         vi.mocked(learnCardHelpers.getDidWebLearnCard).mockRejectedValue(
             new Error('synthetic signing outage')
         );
-        const fetchSpy = vi.spyOn(globalThis, 'fetch');
+        const fetchSpy = vi.spyOn(notificationTransport, 'fetchNotificationWebhook');
         await accept(uri);
         const row = (await eventRows(uri))[0]!;
         expect(row.get('deliveries')[0].properties.state).toBe('pending');
@@ -1411,7 +1457,7 @@ describe('generic contract requests and correlated events', () => {
         const queued = structuredClone(delivered[0]!);
         useDirectWebhook('https://synthetic.example/events');
         const fetchSpy = vi
-            .spyOn(globalThis, 'fetch')
+            .spyOn(notificationTransport, 'fetchNotificationWebhook')
             .mockResolvedValue(new Response('{}', { status: 403 }));
         await expect(deliverQueuedNotification(JSON.stringify(queued))).resolves.toBeUndefined();
         await expect(notifications.sendNotification(structuredClone(queued))).resolves.toBe(false);
@@ -1544,7 +1590,7 @@ describe('generic contract requests and correlated events', () => {
             vi.spyOn(runtime, 'getNotificationRuntimeEnvironment').mockReturnValue({
                 ...runtime.getNotificationRuntimeEnvironment(),
                 NODE_ENV: 'development',
-                IS_OFFLINE: false,
+                IS_OFFLINE: true,
                 NOTIFICATIONS_QUEUE_URL: undefined,
                 IS_E2E_TEST: false,
                 NOTIFICATIONS_SERVICE_WEBHOOK_URL: `http://127.0.0.1:${address.port}/events`,

package/test/credential-refresh-allocation.spec.ts

@@ -7,7 +7,14 @@ import {
     UnsignedVC,
 } from '@learncard/types';
 
-import { Profile, Credential, Boost } from '@models';
+import {
+    Profile,
+    Credential,
+    Boost,
+    ConsentFlowContract,
+    ConsentFlowTerms,
+    ConsentFlowTransaction,
+} from '@models';
 import { neogma } from '@instance';
 
 import { getClient, getUser } from './helpers/getClient';
@@ -18,6 +25,12 @@ import { getCredentialByUri } from '@accesslayer/credential/read';
 import { getCredentialRefresh, getCredentialRefreshHead } from '@accesslayer/credential-refresh';
 import { getDidWeb } from '@helpers/did.helpers';
 import { testUnsignedBoost } from './helpers/send';
+import { normalContract, normalFullTerms } from './helpers/contract';
+import {
+    getContractDetailsByUri,
+    getContractTermsForProfile,
+} from '@accesslayer/consentflowcontract/relationships/read';
+import { sendRefreshableCredential } from '@helpers/credential-refresh.helpers';
 
 const noAuthClient = getClient();
 
@@ -107,6 +120,60 @@ const allocateAndSign = async (): Promise<{ allocation: AllocationResult; creden
 };
 
 describe('Credential Refresh Allocation', () => {
+    it('returns a content-free receipt to the pending holder, never issuer or outsider', async () => {
+        const { allocation, credential } = await allocateAndSign();
+        const uri = await issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+            refreshId: allocation.refreshId,
+            credential,
+        });
+        expect((await getCredentialRefresh(allocation.refreshId))?.state).toBe('awaiting_claim');
+        const receipt = await holder.clients.fullAuth.credentialRefresh.getReceipt({ uri });
+        expect(receipt).toEqual({
+            refreshId: allocation.refreshId,
+            credentialId: credential.id,
+            issuerDid: issuer.learnCard.id.did(),
+            holderDid: holder.learnCard.id.did(),
+            refreshService: allocation.refreshService,
+            encryptionMode: 'network',
+        });
+        await expect(
+            issuer.clients.fullAuth.credentialRefresh.getReceipt({ uri })
+        ).rejects.toThrow();
+        await expect(
+            outsider.clients.fullAuth.credentialRefresh.getReceipt({ uri })
+        ).rejects.toThrow();
+        await expect(noAuthClient.credentialRefresh.getReceipt({ uri })).rejects.toThrow();
+        await expect(
+            holder.clients.fullAuth.credentialRefresh.getReceipt({
+                uri: uri.replace('localhost%3A3000', 'foreign.example'),
+            })
+        ).rejects.toThrow();
+    });
+
+    it('does not authorize a receipt after the pending delivery edge is removed', async () => {
+        const { allocation, credential } = await allocateAndSign();
+        const uri = await issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+            refreshId: allocation.refreshId,
+            credential,
+        });
+        await runQuery('MATCH ()-[sent:CREDENTIAL_SENT]->() DELETE sent');
+        await expect(
+            holder.clients.fullAuth.credentialRefresh.getReceipt({ uri })
+        ).rejects.toThrow();
+    });
+
+    it('fails closed when a legacy delivery lacks its exact public status binding', async () => {
+        const { allocation, credential } = await allocateAndSign();
+        const uri = await issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+            refreshId: allocation.refreshId,
+            credential,
+        });
+        await runQuery('MATCH (r:CredentialRefresh) REMOVE r.credentialStatusBinding');
+        await expect(holder.clients.fullAuth.credentialRefresh.getReceipt({ uri })).rejects.toThrow(
+            'Delivery binding unavailable'
+        );
+    });
+
     beforeAll(async () => {
         process.env.CREDENTIAL_REFRESH_ENABLED = 'true';
 
@@ -136,6 +203,9 @@ describe('Credential Refresh Allocation', () => {
     });
 
     beforeEach(async () => {
+        await ConsentFlowTransaction.delete({ detach: true, where: {} });
+        await ConsentFlowTerms.delete({ detach: true, where: {} });
+        await ConsentFlowContract.delete({ detach: true, where: {} });
         await runQuery('MATCH (r:CredentialRefresh) DETACH DELETE r');
         await runQuery('MATCH (c:Credential) DETACH DELETE c');
         await Boost.delete({ detach: true, where: {} });
@@ -342,6 +412,67 @@ describe('Credential Refresh Allocation', () => {
             expect(await countCredentialNodes()).toEqual(0);
             expect(await countSentRelationships()).toEqual(0);
         });
+        it('rejects a captured consent snapshot when the contract becomes pending before root binding', async () => {
+            const contractUri = await issuer.clients.fullAuth.contracts.createConsentFlowContract({
+                contract: normalContract,
+                name: 'Refresh consent contract',
+            });
+            await holder.clients.fullAuth.contracts.consentToContract({
+                contractUri,
+                terms: normalFullTerms,
+            });
+            const holderProfile = await holder.clients.fullAuth.profile.getProfile();
+            const issuerProfile = await issuer.clients.fullAuth.profile.getProfile();
+            const contract = await getContractDetailsByUri(contractUri);
+            const capturedTerms = await getContractTermsForProfile(
+                holderProfile!,
+                contract!.contract
+            );
+            expect(capturedTerms).toBeDefined();
+
+            const { allocation, credential } = await allocateAndSign();
+            const changedContract = {
+                ...normalContract,
+                read: {
+                    ...normalContract.read,
+                    credentials: {
+                        ...normalContract.read.credentials,
+                        categories: {
+                            ...normalContract.read.credentials.categories,
+                            Transcript: { required: true },
+                        },
+                    },
+                },
+            };
+            await issuer.clients.fullAuth.contracts.updateConsentFlowContract({
+                uri: contractUri,
+                changes: { contract: changedContract },
+                reason: 'We need transcripts to personalize your progress report.',
+            });
+
+            await expect(
+                sendRefreshableCredential({
+                    issuerProfile: { ...issuerProfile!, did: issuer.learnCard.id.did() },
+                    refreshId: allocation.refreshId,
+                    credential,
+                    contractTerms: capturedTerms!,
+                    domain: DOMAIN,
+                })
+            ).rejects.toMatchObject({
+                code: 'FORBIDDEN',
+                message: 'User has not yet approved the latest version of this contract',
+            });
+            expect(await countCredentialNodes()).toBe(0);
+            expect(await countSentRelationships()).toBe(0);
+            expect(
+                (
+                    await holder.clients.fullAuth.contracts.getConsentStatus({
+                        uri: contractUri,
+                        profileId: HOLDER_PROFILE_ID,
+                    })
+                ).status
+            ).toBe('needs_reconsent');
+        });
 
         it('stores only the holder-encrypted JWE and binds version 1', async () => {
             const { allocation, credential } = await allocateAndSign();
@@ -642,24 +773,91 @@ describe('Credential Refresh Allocation', () => {
             expect(associations.records[0]?.get('boostIds')).toHaveLength(1);
         });
 
-        it('removes the losing encrypted node from concurrent identical initial sends', async () => {
+        const synchronizeInitialRootReads = () => {
+            const originalRun = neogma.queryRunner.run.bind(neogma.queryRunner);
+            let arrivals = 0;
+            let release!: () => void;
+            const bothReadsReady = new Promise<void>(resolve => {
+                release = resolve;
+            });
+
+            return vi.spyOn(neogma.queryRunner, 'run').mockImplementation(async (query, params) => {
+                const isInitialRootRead =
+                    params !== undefined &&
+                    Object.keys(params).length === 1 &&
+                    'refreshId' in params;
+                const result = await originalRun(query, params);
+
+                if (isInitialRootRead && result.records.length === 0 && arrivals < 2) {
+                    arrivals += 1;
+                    if (arrivals === 2) release();
+                    await bothReadsReady;
+                }
+
+                return result;
+            });
+        };
+
+        it('returns the shared result for concurrent identical initial sends', async () => {
             const { allocation, credential } = await allocateAndSign();
+            const queryRunnerSpy = synchronizeInitialRootReads();
 
-            const uris = await Promise.all([
-                issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
-                    refreshId: allocation.refreshId,
-                    credential,
-                }),
-                issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
-                    refreshId: allocation.refreshId,
-                    credential,
-                }),
+            try {
+                const results = await Promise.all([
+                    issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+                        refreshId: allocation.refreshId,
+                        credential,
+                    }),
+                    issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+                        refreshId: allocation.refreshId,
+                        credential,
+                    }),
+                ]);
+
+                expect(results[0]).toEqual(results[1]);
+                expect(await countCredentialNodes()).toEqual(1);
+                expect(await countSentRelationships()).toEqual(1);
+                expect(addNotificationToQueueSpy).toHaveBeenCalledTimes(1);
+            } finally {
+                queryRunnerSpy.mockRestore();
+            }
+        });
+
+        it('rejects concurrent initial sends with different credential material', async () => {
+            const allocation = await allocate();
+            const [credential, differentCredential] = await Promise.all([
+                signAs(issuer, buildUnsignedCredential(allocation)),
+                signAs(
+                    issuer,
+                    buildUnsignedCredential(allocation, { name: 'Different Transcript' })
+                ),
             ]);
+            const queryRunnerSpy = synchronizeInitialRootReads();
 
-            expect(new Set(uris).size).toEqual(1);
-            expect(await countCredentialNodes()).toEqual(1);
+            try {
+                const results = await Promise.allSettled([
+                    issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+                        refreshId: allocation.refreshId,
+                        credential,
+                    }),
+                    issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+                        refreshId: allocation.refreshId,
+                        credential: differentCredential,
+                    }),
+                ]);
+
+                expect(results.filter(result => result.status === 'fulfilled')).toHaveLength(1);
+                expect(results.filter(result => result.status === 'rejected')).toHaveLength(1);
+                expect(results.find(result => result.status === 'rejected')).toMatchObject({
+                    reason: { code: 'CONFLICT' },
+                });
+                expect(await countCredentialNodes()).toEqual(1);
+                expect(await countSentRelationships()).toEqual(1);
+                expect(addNotificationToQueueSpy).toHaveBeenCalledTimes(1);
+            } finally {
+                queryRunnerSpy.mockRestore();
+            }
         });
-
         it('rejects an initial-send retry whose credential material differs', async () => {
             const { allocation, credential } = await allocateAndSign();
 

package/test/credential-refresh-email.spec.ts

@@ -251,7 +251,7 @@ describe('credential refresh update emails', () => {
         expect(emailDeliveries()[0].contactMethod.value).toBe(HOLDER_VERIFIED_EMAIL);
     });
 
-    it('emails the holder verified email with only issuer name and title', async () => {
+    it('emails the holder verified email without credential-derived titles', async () => {
         await addEmail(HOLDER_PROFILE_ID, HOLDER_VERIFIED_EMAIL, { primary: true });
         await addEmail(HOLDER_PROFILE_ID, HOLDER_UNVERIFIED_EMAIL, { verified: false });
 
@@ -298,12 +298,12 @@ describe('credential refresh update emails', () => {
         expect(delivery.templateId).toEqual('credential-updated');
         expect(delivery.templateModel).toEqual({
             issuer: { name: expect.any(String) },
-            credential: { name: SECRET_TITLE },
         });
 
         // No grades, description/body content, or issuer summary may reach the template.
         const serialized = JSON.stringify(delivery);
         expect(serialized).not.toContain(SECRET_GRADE_MARKER);
+        expect(serialized).not.toContain(SECRET_TITLE);
         expect(serialized).not.toContain(SECRET_SUBJECT_MARKER);
         expect(serialized).not.toContain(SECRET_SUMMARY_MARKER);
         expect(serialized).not.toContain(HOLDER_UNVERIFIED_EMAIL);
@@ -382,9 +382,7 @@ describe('credential refresh update emails', () => {
         });
 
         expect(emailDeliveries()).toHaveLength(1);
-        expect(emailDeliveries()[0]!.templateModel).toMatchObject({
-            credential: { name: SECRET_TITLE },
-        });
+        expect(emailDeliveries()[0]!.templateModel).not.toHaveProperty('credential');
 
         // A replayed accept does not email twice.
         await holder.clients.fullAuth.credential.acceptCredential({ uri });
@@ -616,9 +614,7 @@ describe('credential refresh update emails', () => {
         expect(JSON.stringify(refreshEvents[0])).not.toContain(SECRET_TITLE);
 
         // Email still carries the title.
-        expect(emailDeliveries()[0]!.templateModel).toMatchObject({
-            credential: { name: SECRET_TITLE },
-        });
+        expect(emailDeliveries()[0]!.templateModel).toMatchObject({});
     });
 
     it('renders generic copy and persists no title when the publication has none', async () => {
@@ -657,7 +653,7 @@ describe('credential refresh update emails', () => {
         const aggregate = await getCredentialRefresh(allocation.refreshId);
         const head = await getCredentialRefreshHead(allocation.refreshId);
 
-        expect(aggregate?.credentialDisplayName).toEqual(SECRET_TITLE);
-        expect(head?.credentialDisplayName).toEqual(SECRET_TITLE);
+        expect(aggregate?.credentialDisplayName).toBeUndefined();
+        expect(head?.credentialDisplayName).toBeUndefined();
     });
 });

package/test/credential-refresh-endpoint.spec.ts

@@ -588,18 +588,21 @@ describe('Credential Refresh Endpoint', () => {
             const first = await preAuthSourceLimitedApp.inject({
                 method: 'GET',
                 url: '/refresh/rate-limited-source-a',
+                remoteAddress: '192.0.2.234',
             });
             expect(first.statusCode).toBe(401);
 
             const second = await preAuthSourceLimitedApp.inject({
                 method: 'GET',
                 url: '/refresh/rate-limited-source-b',
+                remoteAddress: '192.0.2.234',
             });
             expect(second.statusCode).toBe(401);
 
             const limited = await preAuthSourceLimitedApp.inject({
                 method: 'GET',
                 url: '/refresh/rate-limited-source-c',
+                remoteAddress: '192.0.2.234',
             });
             expect(limited.statusCode).toBe(429);
             expect(limited.json().jwe).toBeUndefined();

package/test/credential-refresh-publication.spec.ts

@@ -16,6 +16,7 @@ import { getClient, getUser } from './helpers/getClient';
 import { addNotificationToQueueSpy } from './helpers/spies';
 import * as Notifications from '@helpers/notifications.helpers';
 import { getLearnCard, SeedLearnCard } from '@helpers/learnCard.helpers';
+import { computeCredentialMaterialDigest } from '@helpers/credential-refresh-materiality.helpers';
 import {
     getCredentialRefresh,
     getCredentialRefreshHead,
@@ -634,6 +635,45 @@ describe('Credential Refresh Publication', () => {
             expect(await countCredentialNodes()).toEqual(1);
         });
 
+        it('retries initial binding and suppresses unchanged publication after digest key rotation', async () => {
+            try {
+                vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_SECRET', 'old-publication-test-key');
+                vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_KEY_VERSION', 'v1');
+                vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS', '{}');
+                const { allocation, credential } = await sendOriginal();
+                await setCredentialRefreshState(allocation.refreshId, 'active');
+
+                vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_SECRET', 'new-publication-test-key');
+                vi.stubEnv('CREDENTIAL_REFRESH_DIGEST_KEY_VERSION', 'v2');
+                vi.stubEnv(
+                    'CREDENTIAL_REFRESH_DIGEST_PREVIOUS_KEYS',
+                    JSON.stringify({
+                        v1: 'old-publication-test-key',
+                    })
+                );
+                await issuer.clients.fullAuth.credentialRefresh.sendRefreshableCredential({
+                    refreshId: allocation.refreshId,
+                    credential,
+                });
+                expect(await countCredentialNodes()).toEqual(1);
+
+                const timestampOnly = await signAs(
+                    issuer,
+                    buildUnsignedCredential(allocation, { validFrom: '2026-02-01T00:00:00Z' })
+                );
+                addNotificationToQueueSpy.mockClear();
+                const result = await publishIssuerSigned(allocation.refreshId, timestampOnly);
+                expect(result.version).toEqual(2);
+                expect(result.notification).toEqual('suppressed');
+                expect(addNotificationToQueueSpy).not.toHaveBeenCalled();
+                expect((await getCredentialRefresh(allocation.refreshId))?.materialDigest).toBe(
+                    computeCredentialMaterialDigest(timestampOnly as Record<string, unknown>)
+                );
+            } finally {
+                vi.unstubAllEnvs();
+            }
+        });
+
         it('suppresses the first update when only non-material timestamps changed', async () => {
             const { allocation } = await sendOriginal();
             await setCredentialRefreshState(allocation.refreshId, 'active');
@@ -649,13 +689,11 @@ describe('Credential Refresh Publication', () => {
         });
 
         it('rejects removal or replacement of the original credentialStatus descriptor', async () => {
-            const credentialStatus = {
-                id: 'https://status.example.com/lists/42#7',
-                type: 'BitstringStatusListEntry',
-                statusPurpose: 'revocation',
-                statusListIndex: '7',
-                statusListCredential: 'https://status.example.com/lists/42',
-            };
+            const [credentialStatus] = await issuer.clients.fullAuth.boost.allocateCredentialStatus(
+                {
+                    statusPurposes: ['revocation'],
+                }
+            );
             const { allocation } = await sendOriginal({ credentialStatus });
 
             const removed = await signAs(
@@ -984,13 +1022,12 @@ describe('Credential Refresh Publication', () => {
         });
 
         it('preserves an existing credentialStatus and allocates no new status-list entry', async () => {
-            const credentialStatus = {
-                id: 'https://status.example.com/lists/42#7',
-                type: 'BitstringStatusListEntry',
-                statusPurpose: 'revocation',
-                statusListIndex: '7',
-                statusListCredential: 'https://status.example.com/lists/42',
-            };
+            const [credentialStatus] = await issuer.clients.fullAuth.boost.allocateCredentialStatus(
+                {
+                    statusPurposes: ['revocation'],
+                }
+            );
+            const initialListCount = await countStatusLists();
             const { allocation } = await sendOriginal({ credentialStatus });
             await registerIssuerSigningAuthority();
 
@@ -1005,7 +1042,7 @@ describe('Credential Refresh Publication', () => {
             );
 
             // No status list was created or allocated for the refresh version.
-            expect(await countStatusLists()).toEqual(0);
+            expect(await countStatusLists()).toEqual(initialListCount);
         });
 
         it('does not add a credentialStatus when the body has none', async () => {

package/test/credential-storage.neo4j.spec.ts

@@ -43,16 +43,17 @@ describe('credential status storage in Neo4j', () => {
             credentialStatus: entry,
         });
         const jwe = await issuer.learnCard.invoke.createDagJwe(signed, [issuer.learnCard.id.did()]);
-        const stored = await storeCredential({
-            kind: 'issued-credential',
-            credential: jwe,
-            statusEntries: [entry],
-        });
+        const stored = await storeCredential(
+            { kind: 'issued-credential', credential: jwe, statusEntries: [entry] },
+            undefined,
+            'storage-issuer'
+        );
         credentialIds.push(stored.id);
 
         const row = await getCredentialById(stored.id);
         expect(row?.credential).toBe(JSON.stringify(jwe));
         expect(JSON.parse(row?.statusEntries ?? 'null')).toEqual([entry]);
+        expect(row?.statusOwnerProfileId).toBe('storage-issuer');
         expect(await isStatusBitSet(entry)).toBe(false);
         expect(await setCredentialBitstringStatus(stored.id, 'revocation', true)).toBe(true);
         expect(await isStatusBitSet(entry)).toBe(true);
@@ -94,12 +95,18 @@ describe('credential status storage in Neo4j', () => {
             credentialStatus: entry,
         });
         const jwe = await issuer.learnCard.invoke.createDagJwe(signed, [issuer.learnCard.id.did()]);
-        const wire = { ...jwe, kind: 'issued-credential', statusEntries: [entry] };
+        const wire = {
+            ...jwe,
+            kind: 'issued-credential',
+            statusEntries: [entry],
+            statusOwnerProfileId: 'storage-issuer',
+        };
         const stored = await storeCredential(wire);
         credentialIds.push(stored.id);
         const row = await getCredentialById(stored.id);
         expect(row?.credential).toBe(JSON.stringify(wire));
         expect(row?.statusEntries).toBeUndefined();
+        expect(row?.statusOwnerProfileId).toBeUndefined();
         expect(await setCredentialBitstringStatus(stored.id, 'revocation', true)).toBe(false);
         expect(await isStatusBitSet(entry)).toBe(false);
     });
@@ -119,4 +126,24 @@ describe('credential status storage in Neo4j', () => {
         expect(row?.statusEntries).toBeUndefined();
         expect(await setCredentialBitstringStatus(stored.id, 'revocation', true)).toBe(false);
     });
+
+    it('rejects a trusted descriptor when the supplied owner does not own its list', async () => {
+        const [entry] = await issuer.clients.fullAuth.boost.allocateCredentialStatus({
+            statusPurposes: ['revocation'],
+        });
+        if (!entry) throw new Error('Expected allocated revocation entry');
+        const signed = await issuer.learnCard.invoke.issueCredential({
+            ...(await issuer.learnCard.invoke.getTestVc()),
+            credentialStatus: entry,
+        });
+        const jwe = await issuer.learnCard.invoke.createDagJwe(signed, [issuer.learnCard.id.did()]);
+        await expect(
+            storeCredential(
+                { kind: 'issued-credential', credential: jwe, statusEntries: [entry] },
+                undefined,
+                'another-issuer'
+            )
+        ).rejects.toThrow('Invalid local credential status coordinates');
+        expect(await isStatusBitSet(entry)).toBe(false);
+    });
 });