@tsg-dsp/tsg-sdk 0.0.0-stage → 0.21.0

package/dist/vendor/common-dtos/abac.policy.js

@@ -0,0 +1,5 @@
+/** Principal kind; platform/provisioning authority is granted separately. */
+export const AUTHENTICATED_ACTOR_TYPES = ["human", "service"];
+export function isAuthenticatedActorType(value) {
+    return AUTHENTICATED_ACTOR_TYPES.some((type) => type === value);
+}

package/dist/vendor/common-dtos/audit.types.d.ts

@@ -0,0 +1,74 @@
+import { Action, Resource } from "./permissions.js";
+type AuditFilterValue<T> = T | T[];
+export declare enum AuditSeverity {
+    DEBUG = "debug",
+    INFO = "info",
+    WARNING = "warning",
+    ERROR = "error",
+    CRITICAL = "critical"
+}
+export interface AuditLogEntry {
+    tenantId?: string;
+    timestamp: Date;
+    severity: AuditSeverity;
+    correlationId?: string;
+    caller: {
+        sub: string;
+        type: "user" | "service" | "system";
+        serviceName?: string;
+        username?: string;
+        didId?: string;
+    };
+    onBehalfOf?: {
+        sub: string;
+        username?: string;
+        didId?: string;
+    };
+    delegationChain?: string[];
+    action: Action;
+    resource: {
+        type: Resource;
+        id?: string;
+    };
+    environment: {
+        ipAddress?: string;
+        userAgent?: string;
+        requestPath?: string;
+        requestMethod?: string;
+    };
+    result: {
+        allowed: boolean;
+        reason?: string;
+        matchedPermission?: string;
+        effectiveScope?: string;
+    };
+}
+export interface AuditLogConfig {
+    enabled: boolean;
+    minSeverity: AuditSeverity;
+    logDenied: boolean;
+    logDelegated: boolean;
+    logMutations: boolean;
+    logExecute: boolean;
+    logReads: boolean;
+    sensitiveResources?: Resource[];
+}
+export interface AuditLogQueryParams {
+    page?: number;
+    perPage?: number;
+    orderBy?: string;
+    order?: "ASC" | "DESC";
+    severity?: AuditFilterValue<AuditSeverity>;
+    callerSub?: string;
+    callerType?: "user" | "service" | "system";
+    action?: AuditFilterValue<Action>;
+    resourceType?: AuditFilterValue<Resource | string>;
+    resultAllowed?: boolean;
+    correlationId?: string;
+    ipAddress?: string;
+    requestPath?: string;
+    from?: string;
+    to?: string;
+    search?: string;
+}
+export {};

package/dist/vendor/common-dtos/audit.types.js

@@ -0,0 +1,8 @@
+export var AuditSeverity;
+(function (AuditSeverity) {
+    AuditSeverity["DEBUG"] = "debug";
+    AuditSeverity["INFO"] = "info";
+    AuditSeverity["WARNING"] = "warning";
+    AuditSeverity["ERROR"] = "error";
+    AuditSeverity["CRITICAL"] = "critical";
+})(AuditSeverity || (AuditSeverity = {}));

package/dist/vendor/common-dtos/credential-requirements.d.ts

@@ -0,0 +1,18 @@
+import type { CredentialRequirement, CredentialRequirementSet, CredentialRequirementSetCreate, RequirementEvaluation } from "./credential-requirements.dto.js";
+export type CredentialRecord = Record<string, unknown>;
+export interface CredentialMatchContext {
+    remoteParticipant?: string;
+    localParticipant?: string;
+    holder?: string;
+    now?: Date;
+}
+export interface CredentialMatchResult {
+    satisfied: boolean;
+    requirements: RequirementEvaluation[];
+    usableCredentialIds: string[];
+    missingRequirementIds: string[];
+}
+export declare function lintCredentialRequirementSet(requirementSet: CredentialRequirementSet | CredentialRequirementSetCreate): string[];
+export declare function credentialMismatch(requirement: CredentialRequirement, credential: CredentialRecord, context?: CredentialMatchContext): string | undefined;
+export declare function findCandidateCredentials(requirement: CredentialRequirement, credentials: CredentialRecord[], context?: CredentialMatchContext): CredentialRecord[];
+export declare function matchCredentialRequirements(requirementSet: Pick<CredentialRequirementSet, "logic" | "requirements">, credentials: CredentialRecord[], context?: CredentialMatchContext): CredentialMatchResult;

package/dist/vendor/common-dtos/credential-requirements.dto.d.ts

@@ -0,0 +1,46 @@
+import { PresentationDefinition } from "./presentationdefinition.dto.js";
+export declare class ProfileRef {
+    id: string;
+    version: string;
+    digest?: string;
+}
+export declare class VersionedRef {
+    id: string;
+    revision: number;
+    digest: string;
+}
+export declare class CredentialClaimConstraint {
+    path: string[];
+    operator: "eq" | "in" | "exists";
+    value?: string | number | boolean | Array<string | number | boolean>;
+}
+export declare class CredentialRequirement {
+    id: string;
+    credentialTypes: string[];
+    acceptedIssuers?: string[];
+    holderBinding?: "required" | "not-required";
+    subjectBinding?: "remoteParticipant" | "localParticipant" | "none";
+    claimConstraints?: CredentialClaimConstraint[];
+    status?: "valid";
+}
+export declare class CredentialRequirementSetCreate {
+    id: string;
+    profile: ProfileRef;
+    logic: "all" | "any";
+    requirements: CredentialRequirement[];
+}
+export declare class CredentialRequirementSet extends CredentialRequirementSetCreate {
+    revision: number;
+    presentationDefinition: PresentationDefinition;
+    digest: string;
+}
+export declare class CredentialRequirementSetPage {
+    data: CredentialRequirementSet[];
+    total: number;
+}
+export declare class RequirementEvaluation {
+    id: string;
+    satisfied: boolean;
+    matchedCredentialIds: string[];
+    reason?: string;
+}

package/dist/vendor/common-dtos/credential-requirements.dto.js

@@ -0,0 +1,250 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import { Type } from "class-transformer";
+import { ArrayMinSize, IsArray, IsBoolean, IsIn, IsInt, IsOptional, IsString, Matches, Min, MinLength, ValidateNested } from "class-validator";
+import { PresentationDefinition } from "./presentationdefinition.dto.js";
+export class ProfileRef {
+    id;
+    version;
+    digest;
+}
+__decorate([
+    ApiProperty(),
+    IsString(),
+    MinLength(1),
+    __metadata("design:type", String)
+], ProfileRef.prototype, "id", void 0);
+__decorate([
+    ApiProperty(),
+    IsString(),
+    MinLength(1),
+    __metadata("design:type", String)
+], ProfileRef.prototype, "version", void 0);
+__decorate([
+    ApiPropertyOptional(),
+    IsOptional(),
+    IsString(),
+    __metadata("design:type", String)
+], ProfileRef.prototype, "digest", void 0);
+export class VersionedRef {
+    id;
+    revision;
+    digest;
+}
+__decorate([
+    ApiProperty(),
+    IsString(),
+    MinLength(1),
+    __metadata("design:type", String)
+], VersionedRef.prototype, "id", void 0);
+__decorate([
+    ApiProperty({ minimum: 1 }),
+    IsInt(),
+    Min(1),
+    __metadata("design:type", Number)
+], VersionedRef.prototype, "revision", void 0);
+__decorate([
+    ApiProperty(),
+    IsString(),
+    MinLength(1),
+    __metadata("design:type", String)
+], VersionedRef.prototype, "digest", void 0);
+export class CredentialClaimConstraint {
+    path;
+    operator;
+    value;
+}
+__decorate([
+    ApiProperty({ type: [String] }),
+    IsArray(),
+    ArrayMinSize(1),
+    IsString({ each: true }),
+    __metadata("design:type", Array)
+], CredentialClaimConstraint.prototype, "path", void 0);
+__decorate([
+    ApiProperty({ enum: ["eq", "in", "exists"] }),
+    IsIn(["eq", "in", "exists"]),
+    __metadata("design:type", String)
+], CredentialClaimConstraint.prototype, "operator", void 0);
+__decorate([
+    ApiPropertyOptional({
+        oneOf: [
+            { type: "string" },
+            { type: "number" },
+            { type: "boolean" },
+            {
+                type: "array",
+                items: {
+                    oneOf: [{ type: "string" }, { type: "number" }, { type: "boolean" }]
+                }
+            }
+        ]
+    }),
+    IsOptional(),
+    __metadata("design:type", Object)
+], CredentialClaimConstraint.prototype, "value", void 0);
+export class CredentialRequirement {
+    id;
+    credentialTypes;
+    acceptedIssuers;
+    holderBinding;
+    subjectBinding;
+    claimConstraints;
+    status;
+}
+__decorate([
+    ApiProperty(),
+    IsString(),
+    MinLength(1),
+    __metadata("design:type", String)
+], CredentialRequirement.prototype, "id", void 0);
+__decorate([
+    ApiProperty({ type: [String] }),
+    IsArray(),
+    ArrayMinSize(1),
+    IsString({ each: true }),
+    __metadata("design:type", Array)
+], CredentialRequirement.prototype, "credentialTypes", void 0);
+__decorate([
+    ApiPropertyOptional({ type: [String] }),
+    IsOptional(),
+    IsArray(),
+    IsString({ each: true }),
+    __metadata("design:type", Array)
+], CredentialRequirement.prototype, "acceptedIssuers", void 0);
+__decorate([
+    ApiPropertyOptional({ enum: ["required", "not-required"] }),
+    IsOptional(),
+    IsIn(["required", "not-required"]),
+    __metadata("design:type", String)
+], CredentialRequirement.prototype, "holderBinding", void 0);
+__decorate([
+    ApiPropertyOptional({
+        enum: ["remoteParticipant", "localParticipant", "none"]
+    }),
+    IsOptional(),
+    IsIn(["remoteParticipant", "localParticipant", "none"]),
+    __metadata("design:type", String)
+], CredentialRequirement.prototype, "subjectBinding", void 0);
+__decorate([
+    ApiPropertyOptional({ type: () => [CredentialClaimConstraint] }),
+    IsOptional(),
+    ValidateNested({ each: true }),
+    Type(() => CredentialClaimConstraint),
+    __metadata("design:type", Array)
+], CredentialRequirement.prototype, "claimConstraints", void 0);
+__decorate([
+    ApiPropertyOptional({ enum: ["valid"] }),
+    IsOptional(),
+    IsIn(["valid"]),
+    __metadata("design:type", String)
+], CredentialRequirement.prototype, "status", void 0);
+export class CredentialRequirementSetCreate {
+    id;
+    profile;
+    logic;
+    requirements;
+}
+__decorate([
+    ApiProperty(),
+    IsString(),
+    MinLength(1),
+    Matches(/^[A-Za-z0-9._-]+$/, {
+        message: "id may only contain letters, numbers, dots, underscores, and hyphens"
+    }),
+    __metadata("design:type", String)
+], CredentialRequirementSetCreate.prototype, "id", void 0);
+__decorate([
+    ApiProperty({ type: () => ProfileRef }),
+    ValidateNested(),
+    Type(() => ProfileRef),
+    __metadata("design:type", ProfileRef)
+], CredentialRequirementSetCreate.prototype, "profile", void 0);
+__decorate([
+    ApiProperty({ enum: ["all", "any"] }),
+    IsIn(["all", "any"]),
+    __metadata("design:type", String)
+], CredentialRequirementSetCreate.prototype, "logic", void 0);
+__decorate([
+    ApiProperty({ type: () => [CredentialRequirement] }),
+    IsArray(),
+    ArrayMinSize(1),
+    ValidateNested({ each: true }),
+    Type(() => CredentialRequirement),
+    __metadata("design:type", Array)
+], CredentialRequirementSetCreate.prototype, "requirements", void 0);
+export class CredentialRequirementSet extends CredentialRequirementSetCreate {
+    revision;
+    presentationDefinition;
+    digest;
+}
+__decorate([
+    ApiProperty({ minimum: 1 }),
+    IsInt(),
+    Min(1),
+    __metadata("design:type", Number)
+], CredentialRequirementSet.prototype, "revision", void 0);
+__decorate([
+    ApiProperty({ type: () => PresentationDefinition }),
+    ValidateNested(),
+    Type(() => PresentationDefinition),
+    __metadata("design:type", PresentationDefinition)
+], CredentialRequirementSet.prototype, "presentationDefinition", void 0);
+__decorate([
+    ApiProperty(),
+    IsString(),
+    __metadata("design:type", String)
+], CredentialRequirementSet.prototype, "digest", void 0);
+export class CredentialRequirementSetPage {
+    data;
+    total;
+}
+__decorate([
+    ApiProperty({ type: () => [CredentialRequirementSet] }),
+    IsArray(),
+    ValidateNested({ each: true }),
+    Type(() => CredentialRequirementSet),
+    __metadata("design:type", Array)
+], CredentialRequirementSetPage.prototype, "data", void 0);
+__decorate([
+    ApiProperty({ minimum: 0 }),
+    IsInt(),
+    Min(0),
+    __metadata("design:type", Number)
+], CredentialRequirementSetPage.prototype, "total", void 0);
+export class RequirementEvaluation {
+    id;
+    satisfied;
+    matchedCredentialIds;
+    reason;
+}
+__decorate([
+    ApiProperty(),
+    IsString(),
+    __metadata("design:type", String)
+], RequirementEvaluation.prototype, "id", void 0);
+__decorate([
+    ApiProperty(),
+    IsBoolean(),
+    __metadata("design:type", Boolean)
+], RequirementEvaluation.prototype, "satisfied", void 0);
+__decorate([
+    ApiProperty({ type: [String] }),
+    IsArray(),
+    IsString({ each: true }),
+    __metadata("design:type", Array)
+], RequirementEvaluation.prototype, "matchedCredentialIds", void 0);
+__decorate([
+    ApiPropertyOptional(),
+    IsOptional(),
+    IsString(),
+    __metadata("design:type", String)
+], RequirementEvaluation.prototype, "reason", void 0);

package/dist/vendor/common-dtos/credential-requirements.js

@@ -0,0 +1,180 @@
+export function lintCredentialRequirementSet(requirementSet) {
+    const errors = [];
+    if (!requirementSet.id.trim())
+        errors.push("Requirement set id is required");
+    else if (!/^[A-Za-z0-9._-]+$/.test(requirementSet.id)) {
+        errors.push("Requirement set id may only contain letters, numbers, dots, underscores, and hyphens");
+    }
+    if (!requirementSet.profile.id.trim() ||
+        !requirementSet.profile.version.trim()) {
+        errors.push("A pinned profile id and version are required");
+    }
+    if (requirementSet.requirements.length === 0) {
+        errors.push("At least one credential requirement is required");
+    }
+    const ids = requirementSet.requirements.map((requirement) => requirement.id);
+    if (new Set(ids).size !== ids.length) {
+        errors.push("Credential requirement ids must be unique");
+    }
+    for (const requirement of requirementSet.requirements) {
+        if (!requirement.id.trim())
+            errors.push("Credential requirement id is required");
+        if (requirement.credentialTypes.length === 0) {
+            errors.push(`${requirement.id}: at least one credential type is required`);
+        }
+        for (const constraint of requirement.claimConstraints ?? []) {
+            if (constraint.path.length === 0) {
+                errors.push(`${requirement.id}: claim path must not be empty`);
+            }
+            if (constraint.operator === "in" &&
+                (!Array.isArray(constraint.value) || constraint.value.length === 0)) {
+                errors.push(`${requirement.id}: in comparison requires a non-empty array value`);
+            }
+            else if (constraint.operator !== "exists" &&
+                constraint.value === undefined) {
+                errors.push(`${requirement.id}: claim comparison requires a value`);
+            }
+        }
+    }
+    return errors;
+}
+export function credentialMismatch(requirement, credential, context = {}) {
+    const subjects = credentialSubjects(credential);
+    const types = strings(credential.type).concat(subjects.flatMap((subject) => strings(subject.type ?? subject["@type"])));
+    if (!requirement.credentialTypes.some((type) => types.includes(type))) {
+        return `Credential type does not satisfy ${requirement.id}`;
+    }
+    const issuer = typeof credential.issuer === "string"
+        ? credential.issuer
+        : record(credential.issuer)?.id;
+    if (requirement.acceptedIssuers?.length &&
+        (typeof issuer !== "string" ||
+            !requirement.acceptedIssuers.includes(issuer))) {
+        return `Credential issuer is not accepted for ${requirement.id}`;
+    }
+    const now = (context.now ?? new Date()).getTime();
+    const validFrom = credential.validFrom ?? credential.issuanceDate;
+    const validUntil = credential.validUntil ?? credential.expirationDate;
+    const validFromTime = date(validFrom);
+    const validUntilTime = date(validUntil);
+    if (typeof validFrom === "string" && validFromTime === undefined) {
+        return "Credential has an invalid valid-from date";
+    }
+    if (typeof validUntil === "string" && validUntilTime === undefined) {
+        return "Credential has an invalid expiry date";
+    }
+    if (validFromTime !== undefined && validFromTime > now) {
+        return "Credential is not valid yet";
+    }
+    if (validUntilTime !== undefined && validUntilTime <= now) {
+        return "Credential is expired";
+    }
+    if (requirement.status === "valid" && isRevoked(credential)) {
+        return "Credential status is revoked or suspended";
+    }
+    const subjectIds = subjects
+        .map((subject) => subject.id)
+        .filter((id) => typeof id === "string");
+    const expectedSubject = requirement.subjectBinding === "remoteParticipant"
+        ? context.remoteParticipant
+        : requirement.subjectBinding === "localParticipant"
+            ? context.localParticipant
+            : undefined;
+    if (requirement.subjectBinding && requirement.subjectBinding !== "none") {
+        if (!expectedSubject) {
+            return `${requirement.subjectBinding} binding context is required`;
+        }
+        if (!subjectIds.includes(expectedSubject)) {
+            return `Credential subject is not bound to ${expectedSubject}`;
+        }
+    }
+    if (requirement.holderBinding === "required") {
+        if (!context.holder)
+            return "Holder binding context is required";
+        if (!subjectIds.includes(context.holder)) {
+            return `Credential is not bound to holder ${context.holder}`;
+        }
+    }
+    for (const constraint of requirement.claimConstraints ?? []) {
+        if (!subjects.some((subject) => claimMatches(subject, constraint))) {
+            return `Claim ${constraint.path.join(".")} does not satisfy ${constraint.operator}`;
+        }
+    }
+    return undefined;
+}
+export function findCandidateCredentials(requirement, credentials, context = {}) {
+    return credentials.filter((credential) => credentialMismatch(requirement, credential, context) === undefined);
+}
+export function matchCredentialRequirements(requirementSet, credentials, context = {}) {
+    const requirements = requirementSet.requirements.map((requirement) => {
+        const matches = credentials
+            .map((credential, index) => ({ credential, index }))
+            .filter(({ credential }) => credentialMismatch(requirement, credential, context) === undefined);
+        return {
+            id: requirement.id,
+            satisfied: matches.length > 0,
+            matchedCredentialIds: matches.map(({ credential, index }) => typeof credential.id === "string"
+                ? credential.id
+                : `credential-${index + 1}`),
+            reason: matches.length > 0
+                ? undefined
+                : `No valid credential satisfies ${requirement.id}`
+        };
+    });
+    const satisfied = requirementSet.logic === "all"
+        ? requirements.every((requirement) => requirement.satisfied)
+        : requirements.some((requirement) => requirement.satisfied);
+    return {
+        satisfied,
+        requirements,
+        usableCredentialIds: [
+            ...new Set(requirements.flatMap((requirement) => requirement.matchedCredentialIds))
+        ],
+        missingRequirementIds: requirements
+            .filter((requirement) => !requirement.satisfied)
+            .map((requirement) => requirement.id)
+    };
+}
+function claimMatches(subject, constraint) {
+    let current = subject;
+    for (const segment of constraint.path)
+        current = record(current)?.[segment];
+    if (constraint.operator === "exists")
+        return current !== undefined;
+    if (constraint.operator === "eq")
+        return Object.is(current, constraint.value);
+    return (Array.isArray(constraint.value) &&
+        constraint.value.some((value) => Object.is(value, current)));
+}
+function isRevoked(credential) {
+    const statuses = Array.isArray(credential.credentialStatus)
+        ? credential.credentialStatus
+        : [credential.credentialStatus];
+    return (credential.revoked === true ||
+        statuses.some((status) => {
+            const value = record(status);
+            return ["revoked", "suspended", "invalid"].includes(String(value?.status ?? value?.state ?? "").toLowerCase());
+        }));
+}
+function credentialSubjects(credential) {
+    const subjects = Array.isArray(credential.credentialSubject)
+        ? credential.credentialSubject
+        : [credential.credentialSubject];
+    return subjects
+        .map(record)
+        .filter((subject) => subject !== undefined);
+}
+function strings(value) {
+    return (Array.isArray(value) ? value : [value]).filter((entry) => typeof entry === "string");
+}
+function record(value) {
+    return value !== null && typeof value === "object"
+        ? value
+        : undefined;
+}
+function date(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const parsed = Date.parse(value);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}

package/dist/vendor/common-dtos/dataplane.dto.d.ts

@@ -0,0 +1,5 @@
+import { DataPlaneDetailsDto } from "@tsg-dsp/common-dsp";
+export declare class DataPlaneStateDto {
+    id: string;
+    details: DataPlaneDetailsDto;
+}

package/dist/vendor/common-dtos/dataplane.dto.js

@@ -0,0 +1,28 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ApiProperty } from "@nestjs/swagger";
+import { DataPlaneDetailsDto } from "@tsg-dsp/common-dsp";
+import { Type } from "class-transformer";
+import { IsString, ValidateNested } from "class-validator";
+export class DataPlaneStateDto {
+    id;
+    details;
+}
+__decorate([
+    ApiProperty({ example: "44d1f3d6-f65d-4a7c-84db-f92ba826305e" }),
+    IsString(),
+    __metadata("design:type", String)
+], DataPlaneStateDto.prototype, "id", void 0);
+__decorate([
+    ApiProperty({ type: () => DataPlaneDetailsDto }),
+    ValidateNested(),
+    Type(() => DataPlaneDetailsDto),
+    __metadata("design:type", DataPlaneDetailsDto)
+], DataPlaneStateDto.prototype, "details", void 0);