@metalabel/dfos-web-relay 0.8.1 → 0.9.0

package/README.md

@@ -49,14 +49,14 @@ serve({ port: 4444 });
 | `GET`  | `/countersignatures/:cid`                | Get countersignatures for an operation                           |
 | `GET`  | `/operations/:cid/countersignatures`     | Same as above (alias)                                            |
 | `PUT`  | `/content/:contentId/blob/:operationCID` | Upload blob (auth required)                                      |
-| `GET`  | `/content/:contentId/blob`               | Download blob at head (auth + credential)                        |
+| `GET`  | `/content/:contentId/blob`               | Download blob at head (standing auth, or auth + credential)      |
 | `GET`  | `/content/:contentId/blob/:ref`          | Download blob at specific operation ref                          |
 
 ## Blob Authorization
 
 **Upload**: Auth token required. Caller must be the chain creator or the signer of the referenced operation (enables delegated upload).
 
-**Download**: Auth token required. Chain creator can download directly. Other identities must present a DFOS read credential (issued by the creator) in the `X-Credential` header.
+**Download**: If a public credential (`aud: *`) exists as a standing authorization, the blob is served without authentication. Otherwise, auth token required — chain creator can download directly, other identities must present a DFOS read credential (issued by the creator) in the `X-Credential` header.
 
 ## Peering
 

package/dist/index.js

@@ -912,6 +912,33 @@ var authenticateRequest = async (authHeader, relayDID, store) => {
     return null;
   }
 };
+var hasPublicStandingAuth = async (contentId, action, store) => {
+  const resource = `chain:${contentId}`;
+  const publicCreds = await store.getPublicCredentials(resource);
+  if (publicCreds.length === 0) return false;
+  const chain = await store.getContentChain(contentId);
+  if (!chain) return false;
+  const resolveIdentity = createHistoricalIdentityResolver(store);
+  const isRevoked = async (issuerDID, credentialCID) => store.isCredentialRevoked(issuerDID, credentialCID);
+  for (const credJws of publicCreds) {
+    try {
+      const cred = await verifyDFOSCredential2(credJws, { resolveIdentity });
+      const leafRevoked = await isRevoked(cred.iss, cred.credentialCID);
+      if (leafRevoked) continue;
+      const covers = await matchesResource(cred.att, resource, action);
+      if (!covers) continue;
+      await verifyDelegationChain(cred, {
+        resolveIdentity,
+        rootDID: chain.state.creatorDID,
+        isRevoked
+      });
+      return true;
+    } catch {
+      continue;
+    }
+  }
+  return false;
+};
 var verifyContentAccess = async (options) => {
   const { credentialJWS, requestedResource, action, store, creatorDID, requesterDID } = options;
   if (requesterDID && requesterDID === creatorDID) {
@@ -919,33 +946,13 @@ var verifyContentAccess = async (options) => {
   }
   const resolveIdentity = createHistoricalIdentityResolver(store);
   const isRevoked = async (issuerDID, credentialCID) => store.isCredentialRevoked(issuerDID, credentialCID);
-  const manifestLookup = async (manifestContentId) => {
-    const chain = await store.getContentChain(manifestContentId);
-    if (!chain) return [];
-    const docCID = chain.state.currentDocumentCID;
-    if (!docCID) return [];
-    const blob = await store.getBlob({ creatorDID: chain.state.creatorDID, documentCID: docCID });
-    if (!blob) return [];
-    try {
-      const doc = JSON.parse(new TextDecoder().decode(blob));
-      const entries = doc["entries"];
-      if (!entries || typeof entries !== "object") return [];
-      return Object.values(entries).filter(
-        (v) => typeof v === "string" && !v.startsWith("did:") && !v.startsWith("bafyrei")
-      );
-    } catch {
-      return [];
-    }
-  };
   const publicCreds = await store.getPublicCredentials(requestedResource);
   for (const credJws of publicCreds) {
     try {
       const cred = await verifyDFOSCredential2(credJws, { resolveIdentity });
       const leafRevoked = await isRevoked(cred.iss, cred.credentialCID);
       if (leafRevoked) continue;
-      const covers = await matchesResource(cred.att, requestedResource, action, {
-        manifestLookup
-      });
+      const covers = await matchesResource(cred.att, requestedResource, action);
       if (!covers) continue;
       await verifyDelegationChain(cred, { resolveIdentity, rootDID: creatorDID, isRevoked });
       return { granted: true, source: "public-credential", credential: cred };
@@ -966,9 +973,7 @@ var verifyContentAccess = async (options) => {
           return { granted: false, source: "none" };
         }
       }
-      const covers = await matchesResource(cred.att, requestedResource, action, {
-        manifestLookup
-      });
+      const covers = await matchesResource(cred.att, requestedResource, action);
       if (!covers) {
         return { granted: false, source: "none" };
       }
@@ -1188,18 +1193,21 @@ var createRelay = async (options) => {
   app.get("/content/:contentId/documents", async (c) => {
     if (!contentEnabled) return c.json({ error: "content plane not available" }, 501);
     const contentId = c.req.param("contentId");
-    const auth = await authenticateRequest(c.req.header("authorization"), relayDID, store);
-    if (!auth) return c.json({ error: "authentication required" }, 401);
     const chain = await store.getContentChain(contentId);
     if (!chain) return c.json({ error: "not found" }, 404);
-    const accessError = await verifyReadAccess(
-      auth,
-      chain,
-      contentId,
-      c.req.header("x-credential"),
-      store
-    );
-    if (accessError) return accessError;
+    const publicAccess = await hasPublicStandingAuth(contentId, "read", store);
+    if (!publicAccess) {
+      const auth = await authenticateRequest(c.req.header("authorization"), relayDID, store);
+      if (!auth) return c.json({ error: "authentication required" }, 401);
+      const accessError = await verifyReadAccess(
+        auth,
+        chain,
+        contentId,
+        c.req.header("x-credential"),
+        store
+      );
+      if (accessError) return accessError;
+    }
     const after = c.req.query("after");
     const limit = Math.min(Number(c.req.query("limit") || 100), 1e3);
     const result = await store.getDocuments(contentId, {
@@ -1362,12 +1370,15 @@ var jsonResponse = (body, status = 200) => new Response(JSON.stringify(body), {
 });
 var readBlob = async (params) => {
   const { contentId, ref, authHeader, credHeader, relayDID, store } = params;
-  const auth = await authenticateRequest(authHeader, relayDID, store);
-  if (!auth) return jsonResponse({ error: "authentication required" }, 401);
   const chain = await store.getContentChain(contentId);
   if (!chain) return jsonResponse({ error: "content chain not found" }, 404);
-  const credError = await verifyReadAccess(auth, chain, contentId, credHeader, store);
-  if (credError) return credError;
+  const publicAccess = await hasPublicStandingAuth(contentId, "read", store);
+  if (!publicAccess) {
+    const auth = await authenticateRequest(authHeader, relayDID, store);
+    if (!auth) return jsonResponse({ error: "authentication required" }, 401);
+    const credError = await verifyReadAccess(auth, chain, contentId, credHeader, store);
+    if (credError) return credError;
+  }
   let documentCID = null;
   let operationFound = ref === "head";
   if (ref === "head") {
@@ -1504,10 +1515,6 @@ var MemoryRelayStore = class {
           tokens.push(cred.jwsToken);
           break;
         }
-        if (isChainRequest && att.resource.startsWith("manifest:")) {
-          tokens.push(cred.jwsToken);
-          break;
-        }
       }
     }
     return tokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metalabel/dfos-web-relay",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "type": "module",
   "description": "DFOS Web Relay — verifying HTTP relay for identity chains, content chains, beacons, and content blobs",
   "license": "MIT",
@@ -52,7 +52,7 @@
     "tsup": "^8.5.1",
     "tsx": "^4.20.3",
     "vitest": "^4.1.2",
-    "@metalabel/dfos-protocol": "0.8.1"
+    "@metalabel/dfos-protocol": "0.9.0"
   },
   "scripts": {
     "build": "tsup",