@tinycloud/sdk-core 2.10.0 → 2.11.0-beta.1

package/dist/delegations/index.cjs

@@ -4742,6 +4742,33 @@ function createError2(code3, message, cause, meta) {
     meta
   };
 }
+function rootDelegationSigningError(err) {
+  const cause = err instanceof Error ? err : void 0;
+  const code3 = err && typeof err === "object" && "code" in err ? String(err.code ?? "") : "";
+  const name2 = err instanceof Error ? err.name : "";
+  const message = err instanceof Error ? err.message : String(err ?? "");
+  const aborted = code3 === DelegationErrorCodes.ABORTED || name2 === "AbortError" || /\bcancell?ed\b|\brejected\b|user denied/i.test(message);
+  if (aborted) {
+    return createError2(
+      DelegationErrorCodes.ABORTED,
+      "The signature that authorizes this sharing link was cancelled. Approve the signing prompt to finish creating the link.",
+      cause
+    );
+  }
+  const timedOut = code3 === DelegationErrorCodes.TIMEOUT || name2 === "TimeoutError" || /timed out|timeout/i.test(message);
+  if (timedOut) {
+    return createError2(
+      DelegationErrorCodes.TIMEOUT,
+      "Timed out waiting for the signature that authorizes this sharing link. Creating a long-lived link re-opens the signing prompt after sign-in; if you did not see one, check for a blocked popup or a hidden signing frame, then try again.",
+      cause
+    );
+  }
+  return createError2(
+    DelegationErrorCodes.PERMISSION_DENIED,
+    "The active session ReCap does not authorize this sharing delegation.",
+    cause
+  );
+}
 function base64UrlEncode(data) {
   let base642;
   if (typeof btoa !== "undefined") {
@@ -4960,14 +4987,7 @@ var SharingService = class {
           };
         }
       } catch (err) {
-        return {
-          ok: false,
-          error: createError2(
-            DelegationErrorCodes.PERMISSION_DENIED,
-            "The active session ReCap does not authorize this sharing delegation.",
-            err instanceof Error ? err : void 0
-          )
-        };
+        return { ok: false, error: rootDelegationSigningError(err) };
       }
     } else {
       return {
@@ -6171,6 +6191,10 @@ async function createPolicyEnforcementDelegation(input) {
     spaceId: input.spaceId,
     path: input.path,
     actions: [...input.actions],
+    ...input.decryption === void 0 ? {} : {
+      decryptionNetworkId: input.decryption.networkId,
+      decryptionAction: input.decryption.action
+    },
     contentSourceDigest: input.contentSourceDigest,
     expiresAt: input.expiresAt
   };
@@ -6190,7 +6214,9 @@ function computeOwnerShareRegistrationCid(registration) {
 function validateOwnerSharePolicyRegistration(value, expected) {
   if (cid(expected.policy.bytes) !== expected.policy.cid) throw new Error("submitted owner-share policy bytes do not match its CID");
   const root = assertObject(value, ["registration", "proof"], "owner-share registration response");
-  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
+  const rawRegistration = root.registration;
+  const hasDecryption = typeof rawRegistration === "object" && rawRegistration !== null && Object.prototype.hasOwnProperty.call(rawRegistration, "decryption");
+  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", ...hasDecryption ? ["decryption"] : [], "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
   const proof = assertObject(root.proof, ["alg", "kid", "signature"], "owner-share registration proof");
   if (registration.policyCid !== expected.policy.cid || registration.ownerDelegationCid !== expected.ownerDelegation.delegationCid || registration.enforcementDelegationCid !== expected.enforcementDelegation.cid || registration.contentSourceDigest !== expected.contentSourceDigest) throw new Error("owner-share registration is not bound to the submitted chain");
   let policyValue;
@@ -6206,7 +6232,9 @@ function validateOwnerSharePolicyRegistration(value, expected) {
   const registrationTarget = registration.target;
   const registrationResource = registration.resource;
   const enforcementFacts = expected.enforcementDelegation.facts;
-  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalizeSignedObjectUnsigned(policy.recipientMatcher) !== canonicalizeSignedObjectUnsigned(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(policy.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || canonicalizeSignedObjectUnsigned(policy.contentSource) !== canonicalizeSignedObjectUnsigned(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(enforcementFacts.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
+  const decryption = policy.decryption;
+  const decryptionMatches = decryption === void 0 ? registration.decryption === void 0 : registration.decryption !== void 0 && canonicalizeSignedObjectUnsigned(decryption) === canonicalizeSignedObjectUnsigned(registration.decryption);
+  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalizeSignedObjectUnsigned(policy.recipientMatcher) !== canonicalizeSignedObjectUnsigned(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(policy.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || !decryptionMatches || canonicalizeSignedObjectUnsigned(policy.contentSource) !== canonicalizeSignedObjectUnsigned(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(enforcementFacts.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || enforcementFacts.decryptionNetworkId !== decryption?.networkId || enforcementFacts.decryptionAction !== decryption?.action || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
   if (typeof registration.registrationCid !== "string" || typeof registration.expiresAt !== "string" || typeof registration.registeredAt !== "string") throw new Error("owner-share registration timestamps are invalid");
   if (new Date(registration.expiresAt).toISOString() !== registration.expiresAt || Date.parse(registration.expiresAt) <= Date.now()) throw new Error("owner-share registration is expired or non-canonical");
   const { registrationCid: _registrationCid, ...registrationCore } = registration;