@verii/endpoints-organizations-registrar 1.0.0-pre.1752076816

package/src/entities/organizations/orchestrators/build-custodied-organization.js

@@ -0,0 +1,92 @@
+const { map } = require('lodash/fp');
+const {
+  generateKeyPair,
+  KeyPurposes,
+  KeyAlgorithms,
+} = require('@verii/crypto');
+const { createDidDoc } = require('@verii/did-doc');
+const { mapWithIndex } = require('@verii/common-functions');
+const { normalizeProfileName, buildCustodiedDidWeb } = require('../domains');
+const {
+  buildOrganizationServices,
+  loadCaoServiceRefs,
+  validateServices,
+} = require('../../organization-services');
+
+const buildCustodiedOrganization = async (
+  { profile, serviceEndpoints, invitation },
+  context
+) => {
+  const newServices = buildOrganizationServices(serviceEndpoints, invitation);
+
+  const caoServiceRefs = await loadCaoServiceRefs(serviceEndpoints, context);
+  validateServices(newServices, caoServiceRefs, context);
+  const newKeyPairs = map(() => generateKeyPair({ format: 'jwk' }), keySpecs);
+
+  const kmsKeyEntries = await Promise.all(
+    map(
+      (newKeyPair) =>
+        context.kms.importKey({
+          ...newKeyPair,
+          algorithm: 'ec',
+          curve: 'secp256k1',
+        }),
+      newKeyPairs
+    )
+  );
+
+  const newKeys = mapWithIndex(
+    (keySpec, i) => ({
+      ...keySpec,
+      kmsKeyId: kmsKeyEntries[i].id,
+      algorithm: KeyAlgorithms.SECP256K1,
+      custodied: true,
+      publicKey: newKeyPairs[i].publicKey,
+    }),
+    keySpecs
+  );
+
+  const did = buildCustodiedDidWeb(profile, context);
+
+  const { didDoc } = createDidDoc({
+    did,
+    services: newServices,
+    keys: newKeys,
+  });
+
+  return {
+    newOrganization: {
+      didDoc,
+      profile,
+      normalizedProfileName: normalizeProfileName(profile.name),
+      didNotCustodied: false,
+      services: newServices,
+      invitationId: invitation?._id,
+    },
+    newKeys,
+    newKeyPairs,
+    caoServiceRefs,
+  };
+};
+
+const keySpecs = [
+  {
+    id: '#vc-signing-key-1',
+    type: 'EcdsaSecp256k1VerificationKey2019',
+    purposes: [KeyPurposes.ISSUING_METADATA],
+  },
+  {
+    id: '#eth-account-key-1',
+    type: 'EcdsaSecp256k1VerificationKey2019',
+    purposes: [KeyPurposes.DLT_TRANSACTIONS],
+  },
+  {
+    id: '#exchange-key-1',
+    type: 'EcdsaSecp256k1VerificationKey2019',
+    purposes: [KeyPurposes.EXCHANGES],
+  },
+];
+
+module.exports = {
+  buildCustodiedOrganization,
+};

package/src/entities/organizations/orchestrators/build-non-custodied-organization.js

@@ -0,0 +1,83 @@
+const newError = require('http-errors');
+const { map, omit } = require('lodash/fp');
+const { resolveDidWeb } = require('@verii/did-web');
+const {
+  buildOrganizationServices,
+  loadCaoServiceRefs,
+  validateByoDidDocService,
+  validateServices,
+} = require('../../organization-services');
+const {
+  extractVerificationMethodFromByoDID,
+} = require('../../organization-keys');
+const { validateByoDidKeys, normalizeProfileName } = require('../domains');
+
+const buildNonCustodiedOrganization = async (
+  { byoDid, byoKeys, serviceEndpoints, profile, invitation },
+  context
+) => {
+  const { repos } = context;
+
+  // ensure did isn't already locally registered
+  const orgDb = await repos.organizations.findOne({
+    filter: { 'didDoc.id': byoDid },
+  });
+  if (orgDb) {
+    throw newError(400, 'Organization already exists', {
+      errorCode: 'organization_already_exists',
+    });
+  }
+  const didDocument = await resolveDidWeb(byoDid);
+
+  // load keys from remote did document
+  validateByoDidKeys(byoKeys);
+  const newKeys = await Promise.all(
+    map(
+      (byoKey) => ({
+        ...byoKey,
+        verificationMethod: extractVerificationMethodFromByoDID({
+          didDocument,
+          kidFragment: byoKey.kidFragment,
+        }),
+      }),
+      byoKeys
+    )
+  );
+
+  const preparedServices = map((serviceEndpoint) => {
+    const byoDidDocService = validateByoDidDocService(
+      didDocument,
+      serviceEndpoint.id,
+      newKeys
+    );
+    return {
+      ...omit(['id'], serviceEndpoint),
+      ...byoDidDocService,
+    };
+  }, serviceEndpoints);
+
+  const newServices = buildOrganizationServices(preparedServices, invitation);
+
+  const caoServiceRefs = await loadCaoServiceRefs(preparedServices, context);
+  validateServices(newServices, caoServiceRefs, context);
+
+  return {
+    newOrganization: {
+      didDoc: {
+        id: byoDid,
+      },
+      profile,
+      normalizedProfileName: normalizeProfileName(profile.name),
+      didNotCustodied: true,
+      services: newServices,
+      invitationId: invitation?._id,
+    },
+    newKeys,
+    newKeyPairs: map(() => null, newKeys),
+    caoServiceRefs,
+  };
+};
+
+module.exports = {
+  buildNonCustodiedOrganization,
+};

package/src/entities/organizations/orchestrators/index.js

@@ -0,0 +1,6 @@
+module.exports = {
+  ...require('./init-create-organization'),
+  ...require('./add-primary-permissions'),
+  ...require('./init-provision-group'),
+  ...require('./verify-profile-website-unique'),
+};

package/src/entities/organizations/orchestrators/init-create-organization.js

@@ -0,0 +1,221 @@
+const { createFineractClient } = require('@verii/fineract-client');
+const { map, some, filter, includes, isEmpty } = require('lodash/fp');
+const {
+  KeyPurposes,
+  generateKeyPair,
+  KeyAlgorithms,
+} = require('@verii/crypto');
+const { toRelativeKeyId } = require('@verii/did-doc');
+const { toEthereumAddress } = require('@verii/blockchain-functions');
+const { ObjectId } = require('mongodb');
+const { publish } = require('@spencejs/spence-events');
+const { acceptInvitation } = require('../../invitations');
+const {
+  buildOrganizationKey,
+  addOperatorKeys,
+} = require('../../organization-keys');
+const {
+  activateServices,
+  isNodeOperator,
+  initProvisionAuth0Clients,
+  updateBlockchainPermissionsFromPermittedServices,
+} = require('../../organization-services');
+const { initAuth0Provisioner } = require('../../oauth');
+const {
+  initBuildOrganizationModificationsOnServiceChange,
+} = require('../domains');
+const {
+  buildCustodiedOrganization,
+} = require('./build-custodied-organization');
+const {
+  buildNonCustodiedOrganization,
+} = require('./build-non-custodied-organization');
+const { initProvisionGroup } = require('./init-provision-group');
+const { addPrimaryPermissions } = require('./add-primary-permissions');
+const {
+  getServiceConsentType,
+} = require('../../organization-services/domains/get-service-consent-type');
+
+const initCreateOrganization = (fastify) => {
+  const buildOrganizationModificationsOnServiceChange =
+    initBuildOrganizationModificationsOnServiceChange(fastify);
+
+  const provisionGroup = initProvisionGroup(fastify);
+  const auth0Provisioner = initAuth0Provisioner(fastify.config);
+  const provisionAuth0Clients = initProvisionAuth0Clients(auth0Provisioner);
+
+  return async (
+    { byoDid, byoKeys, serviceEndpoints, profile, invitationCode },
+    context
+  ) => {
+    const { repos, kms, user } = context;
+
+    const invitation = await acceptInvitation(invitationCode, context);
+    const buildOrganization =
+      byoDid == null
+        ? buildCustodiedOrganization
+        : buildNonCustodiedOrganization;
+    const { newOrganization, newKeys, newKeyPairs, caoServiceRefs } =
+      await buildOrganization(
+        {
+          byoDid,
+          byoKeys,
+          serviceEndpoints,
+          profile,
+          invitation,
+        },
+        context
+      );
+
+    const organization = await repos.organizations.insert(newOrganization);
+    await provisionGroup(organization, context);
+
+    const activatedServiceIds = activateServices(
+      organization,
+      organization.services,
+      context
+    );
+
+    if (!isEmpty(organization.services)) {
+      const consents = map((service) => {
+        return {
+          userId: user.sub,
+          organizationId: organization._id,
+          type: getServiceConsentType(service),
+          version: 1,
+          serviceId: service.id,
+        };
+      }, organization.services);
+      await repos.registrarConsents.registerConsents(consents);
+    }
+    const authClients = await provisionAuth0Clients(
+      organization,
+      organization.services,
+      activatedServiceIds,
+      context
+    );
+
+    const primaryKeyPair = generateKeyPair({ format: 'jwk' });
+    const primaryAccount = toEthereumAddress(primaryKeyPair.publicKey);
+    const fineractIds = await createFineractClient(
+      organization,
+      some(isNodeOperator, organization.services),
+      context
+    );
+
+    const organizationModifications =
+      await buildOrganizationModificationsOnServiceChange({
+        organization,
+        activatedServiceIds,
+        newOrganizationIds: {
+          did: organization.didDoc.id,
+          mongoId: organization._id,
+          ethereumAccount: primaryAccount,
+          brokerClientId: new ObjectId(),
+          ...fineractIds,
+        },
+        authClients,
+      });
+    const finalOrganization = await repos.organizations.update(
+      organization._id,
+      organizationModifications
+    );
+
+    const permissioningKeyPair = generateKeyPair({ format: 'jwk' });
+    const permissioningKeyEntry = await kms.importKey({
+      ...permissioningKeyPair,
+      algorithm: 'ec',
+      curve: 'secp256k1',
+    });
+    const rotationKeyPair = generateKeyPair({ format: 'jwk' });
+    const rotationKeyEntry = await kms.importKey({
+      ...rotationKeyPair,
+      algorithm: 'ec',
+      curve: 'secp256k1',
+    });
+    await addPrimaryPermissions(
+      {
+        primaryAccount,
+        rotationKeyPair,
+        permissioningKeyPair,
+        newKeys,
+      },
+      context
+    );
+
+    const keySpecs = [
+      ...newKeys,
+      {
+        id: toRelativeKeyId(`#vnf-permissioning-${Date.now()}`),
+        kmsKeyId: permissioningKeyEntry.id,
+        publicKey: permissioningKeyPair.publicKey,
+        custodied: true,
+        purposes: [KeyPurposes.PERMISSIONING],
+        algorithm: KeyAlgorithms.SECP256K1,
+      },
+      {
+        id: toRelativeKeyId(`#vnf-rotation-${Date.now()}`),
+        kmsKeyId: rotationKeyEntry.id,
+        publicKey: rotationKeyPair.publicKey,
+        custodied: true,
+        purposes: [KeyPurposes.ROTATION],
+        algorithm: KeyAlgorithms.SECP256K1,
+      },
+    ];
+
+    const keys = map(
+      (spec) =>
+        buildOrganizationKey(
+          finalOrganization._id,
+          finalOrganization.didDoc.id,
+          spec
+        ),
+      keySpecs
+    );
+
+    await repos.organizationKeys.insertMany(keys);
+
+    const dltKeys = filter(
+      ({ purposes }) => includes(KeyPurposes.DLT_TRANSACTIONS, purposes),
+      keys
+    );
+    await addOperatorKeys(
+      {
+        organization,
+        primaryAccount,
+        permissioningKeyId: permissioningKeyEntry._id,
+        dltKeys,
+      },
+      context
+    );
+
+    await updateBlockchainPermissionsFromPermittedServices(
+      { organization: finalOrganization },
+      context
+    );
+
+    await repos.images.activate(finalOrganization.profile.logo);
+
+    await publish(
+      'organizations',
+      'created',
+      {
+        organization: finalOrganization,
+        invitation,
+        addedServices: finalOrganization.services,
+        activatedServiceIds,
+        caoServiceRefs,
+      },
+      context
+    );
+
+    return {
+      organization: finalOrganization,
+      keys,
+      keyPairs: [...newKeyPairs, permissioningKeyPair, rotationKeyPair],
+      authClients,
+    };
+  };
+};
+
+module.exports = { initCreateOrganization };

package/src/entities/organizations/orchestrators/init-provision-group.js

@@ -0,0 +1,48 @@
+const {
+  VNF_GROUP_ID_CLAIM,
+  initAuth0Provisioner,
+  hasAdminOrganizationScope,
+} = require('../../oauth');
+
+const initProvisionGroup = (fastify) => {
+  const auth0Provisioner = initAuth0Provisioner(fastify.config);
+
+  return async (organization, context) => {
+    const { sendError } = fastify;
+    const { repos, user, log } = context;
+    const { didDoc, profile } = organization;
+
+    try {
+      if (
+        isUserGroupIdClaimSet(user) ||
+        (await isUserHasGroup(user, context))
+      ) {
+        await repos.groups.addDidToGroupOfUser(
+          user.sub,
+          organization.didDoc.id
+        );
+      } else if (hasAdminOrganizationScope(user)) {
+        await repos.groups.createGroup(organization.didDoc.id);
+      } else {
+        await Promise.all([
+          repos.groups.createGroup(organization.didDoc.id, user.sub),
+          auth0Provisioner.setAuth0UserGroupId(organization.didDoc.id, context),
+        ]);
+      }
+    } catch (error) {
+      const message = 'Error Provisioning Auth0 Apps';
+      log.error({ err: error, didDoc, profile }, message);
+      sendError(error, { message, didDoc, profile });
+    }
+  };
+};
+
+const isUserGroupIdClaimSet = (user) => user[VNF_GROUP_ID_CLAIM] != null;
+
+const isUserHasGroup = async (user, context) => {
+  const { repos } = context;
+  const groupByProfile = await repos.groups.findGroupByUserId(user.sub);
+  return !!groupByProfile;
+};
+
+module.exports = { initProvisionGroup };

package/src/entities/organizations/orchestrators/verify-profile-website-unique.js

@@ -0,0 +1,15 @@
+const newError = require('http-errors');
+
+const verifyProfileWebsiteUnique = async ({ profile }, context) => {
+  const count = await context.repos.organizations.count({
+    filter: { 'profile.website': profile.website },
+  });
+
+  if (count > 0) {
+    throw newError(400, 'Website already exists', {
+      errorCode: 'website_already_exists',
+    });
+  }
+};
+
+module.exports = { verifyProfileWebsiteUnique };

package/src/entities/organizations/repos/find-caos-extension.js

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { isEmpty, flow, map, uniq } = require('lodash/fp');
+const { stripFragmentFromDidUrl } = require('@verii/did-doc');
+
+const findCaosExtension = (parent) => ({
+  findCaos: (caoServiceIds, projection) => {
+    if (isEmpty(caoServiceIds)) {
+      return [];
+    }
+    const caoDids = flow(map(stripFragmentFromDidUrl), uniq)(caoServiceIds);
+    return parent.find({
+      filter: {
+        $or: [
+          {
+            'didDoc.id': {
+              $in: caoDids,
+            },
+          },
+          {
+            'didDoc.alsoKnownAs': {
+              $elemMatch: {
+                $in: caoDids,
+              },
+            },
+          },
+        ],
+        '@ignoreScope': true,
+      },
+      projection,
+    });
+  },
+});
+
+module.exports = { findCaosExtension };

package/src/entities/organizations/repos/index.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = { ...require('./transform-organization-filter') };

package/src/entities/organizations/repos/repo.js

@@ -0,0 +1,156 @@
+const { isEmpty, map, omit } = require('lodash/fp');
+const newError = require('http-errors');
+const {
+  repoFactory,
+  autoboxIdsExtension,
+} = require('@spencejs/spence-mongo-repos');
+const { deletedExtension } = require('@verii/spencer-mongo-extensions');
+const {
+  searchByAggregationExtension,
+} = require('./search-by-aggregation-extension');
+const { OrganizationErrorMessages } = require('../domains');
+const { transformDidFilter } = require('./transform-did-filter');
+const { findCaosExtension } = require('./find-caos-extension');
+
+const defaultProjection = {
+  _id: 1,
+  didDoc: 1,
+  profile: 1,
+  services: 1,
+  activatedServiceIds: 1,
+  verifiableCredentialJwt: 1,
+  adminEmail: 1,
+  normalizedProfileName: 1,
+  didNotCustodied: 1,
+  invitationId: 1,
+  ids: 1,
+  updatedAt: 1,
+  createdAt: 1,
+};
+
+module.exports = (app, options, next = () => {}) => {
+  next();
+  return repoFactory(
+    {
+      name: 'organizations',
+      entityName: 'organization',
+      defaultProjection,
+      extensions: [
+        autoboxIdsExtension,
+        scopeFilterExtension,
+        findersExtension,
+        servicesExtensions,
+        deletedExtension(),
+        searchByAggregationExtension,
+        findCaosExtension,
+      ],
+    },
+    app
+  );
+};
+const servicesExtensions = (parent) => ({
+  prepModification: (organization, kind) => {
+    if (kind !== 'insert') {
+      return parent.prepModification(organization, kind);
+    }
+    const now = new Date();
+    const services = map((service) => {
+      return {
+        ...service,
+        createdAt: now,
+        updatedAt: now,
+      };
+    }, organization.services);
+
+    return parent.prepModification({ ...organization, services }, kind);
+  },
+  addService: async (organizationId, service) => {
+    const addedService = {
+      ...service,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+    await parent.collection().updateOne(
+      { _id: organizationId },
+      {
+        $push: {
+          services: addedService,
+        },
+      }
+    );
+    return addedService;
+  },
+  updateService: async (organizationId, service) => {
+    const updatedService = {
+      ...service,
+      updatedAt: new Date(),
+    };
+    await parent.collection().updateOne(
+      { _id: organizationId, 'services.id': service.id },
+      {
+        $set: {
+          'services.$': updatedService,
+          updatedAt: updatedService.updatedAt, // bubble up the updatedAt timestamp to the root object
+        },
+      }
+    );
+
+    return updatedService;
+  },
+});
+
+const findersExtension = (parent) => ({
+  findByDids: async (dids, ...options) =>
+    parent.find(
+      {
+        filter: transformDidFilter({
+          'didDoc.id': {
+            $in: dids,
+          },
+        }),
+      },
+      ...options
+    ),
+  findOneByDid: async (did, ...options) => {
+    const organization = await parent.findOne(
+      {
+        filter: transformDidFilter({
+          'didDoc.id': did,
+        }),
+      },
+      ...options
+    );
+    if (isEmpty(organization)) {
+      throw newError(404, OrganizationErrorMessages.ORGANIZATION_NOT_FOUND, {
+        errorCode: 'organization_not_found',
+      });
+    }
+    return organization;
+  },
+  extensions: parent.extensions.concat(['findersExtension']),
+});
+
+const scopeFilterExtension = (parent, context) => {
+  return {
+    prepFilter: (filter) => {
+      if (filter['@ignoreScope']) {
+        return parent.prepFilter(omit(['@ignoreScope'], filter));
+      }
+
+      if (
+        context.scope?.dids == null ||
+        (context.scope.dids.length === 1 && context.scope.dids[0] === 'new')
+      ) {
+        return parent.prepFilter(filter);
+      }
+
+      return parent.prepFilter(
+        transformDidFilter({
+          ...filter,
+          'didDoc.id': { $in: context.scope.dids },
+        })
+      );
+    },
+    extensions: parent.extensions.concat(['scopeFilterExtension']),
+  };
+};