@verii/server-credentialing-hub 2.0.0

package/src/entities/tenants/adapters/load-tenant-did-doc.js

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { resolveDid } = require('@verii/common-fetchers');
+const newError = require('http-errors');
+const { isEmpty } = require('lodash/fp');
+const { TenantErrors } = require('../domain/tenant-errors');
+
+const loadTenantDidDoc = async (did, context) => {
+  const didDoc = await resolveDidWithErrorHandling(
+    did,
+    TenantErrors.DID_DOCUMENT_NOT_FOUND,
+    context,
+  );
+  if (isEmpty(didDoc)) {
+    context.log.error('Tenant DID Document is null or {}');
+    throw newError(400, TenantErrors.DID_DOCUMENT_NOT_FOUND, {
+      errorCode: TenantErrors.DID_DOCUMENT_NOT_FOUND,
+    });
+  }
+  return didDoc;
+};
+
+const resolveDidWithErrorHandling = async (did, errorCode, context) => {
+  try {
+    return await resolveDid(did, context);
+  } catch (error) {
+    context.log.error(error, 'Error retrieving DID Document');
+    throw newError(400, errorCode, { errorCode });
+  }
+};
+
+module.exports = { loadTenantDidDoc };

package/src/entities/tenants/adapters/load-tenant-profile.js

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { getOrganizationVerifiedProfile } = require('@verii/common-fetchers');
+const newError = require('http-errors');
+const { TenantErrors } = require('../domain/tenant-errors');
+
+const loadTenantProfile = async (did, context) => {
+  const orgProfile = await resolveOrgVcWithErrorHandling(
+    did,
+    TenantErrors.ORG_PROFILE_NOT_FOUND,
+    context,
+  );
+  return orgProfile.credentialSubject;
+};
+
+const resolveOrgVcWithErrorHandling = async (did, errorCode, context) => {
+  try {
+    return await getOrganizationVerifiedProfile(did, context);
+  } catch (error) {
+    context.log.error(error, 'Error retrieving organization profile');
+    throw newError(400, errorCode, { errorCode });
+  }
+};
+
+module.exports = { loadTenantProfile };

package/src/entities/tenants/domain/index.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./tenant-errors'),
+  ...require('./validate-new-tenant'),
+};

package/src/entities/tenants/domain/tenant-errors.js

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const TenantErrors = {
+  DID_DOCUMENT_NOT_FOUND: 'did_document_not_found',
+  ORG_PROFILE_NOT_FOUND: 'org_profile_not_found',
+  KEY_PURPOSES_MUST_BE_UNIQUE: 'key_purposes_must_be_unique',
+  KEY_KID_FRAGMENT_NOT_FOUND: 'key_kidFragment_not_found',
+  TENANTS_MUST_BE_UNIQUE: 'tenant_must_be_unique',
+  CAO_DID_REQUIRED: 'cao_did_required',
+  RELATED_SERVICE_UNDELETED: 'related_service_undeleted',
+  NAME_MUST_MATCH_PROFILE: 'name_must_match_profile',
+  LOGO_MUST_MATCH_PROFILE: 'logo_must_match_profile',
+};
+module.exports = { TenantErrors };

package/src/entities/tenants/domain/validate-new-tenant.js

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const newError = require('http-errors');
+const { find } = require('lodash/fp');
+const { TenantErrors } = require('./tenant-errors');
+
+const validateNewTenant = (newTenant, orgProfile, context) => {
+  if (newTenant.caoDid == null && context.config.defaultCaoDid == null) {
+    throw newError(400, TenantErrors.CAO_DID_REQUIRED, {
+      errorCode: TenantErrors.CAO_DID_REQUIRED,
+    });
+  }
+  validateNameAndLogo(newTenant, orgProfile);
+};
+
+const validateNameAndLogo = (newTenant, orgProfile) => {
+  if (
+    newTenant.name !== orgProfile.name &&
+    !find({ name: newTenant.name }, orgProfile.commercialEntities)
+  ) {
+    throw newError(400, TenantErrors.NAME_MUST_MATCH_PROFILE, {
+      errorCode: TenantErrors.NAME_MUST_MATCH_PROFILE,
+    });
+  }
+  if (
+    newTenant.logo !== orgProfile.logo &&
+    !find({ logo: newTenant.logo }, orgProfile.commercialEntities)
+  ) {
+    throw newError(400, TenantErrors.LOGO_MUST_MATCH_PROFILE, {
+      errorCode: TenantErrors.LOGO_MUST_MATCH_PROFILE,
+    });
+  }
+};
+
+module.exports = { validateNewTenant };

package/src/entities/tenants/factories/index.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module.exports = {
+  ...require('./tenant-factory'),
+};

package/src/entities/tenants/factories/tenant-factory.js

@@ -0,0 +1,41 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { register } = require('@spencejs/spence-factories');
+const { tenantRepoPlugin } = require('../repo');
+
+const initTenantFactory = (app) =>
+  register(
+    'tenant',
+    tenantRepoPlugin(app)({ config: app.config }),
+    (overrides) => {
+      const didSuffix = Array(40)
+        .fill(0)
+        .map(() => Math.random().toString(36).charAt(2))
+        .join('');
+      return {
+        did: `did:test:${didSuffix}`,
+        primaryAccount: `0x${didSuffix}`,
+        caoDid: 'did:test:e89fYWr0Lkfd_pa18fdk',
+        hostUrl: 'https://localhost.test',
+        name: 'fooName',
+        logo: 'https://localhost.test/logo.png',
+        ...overrides(),
+      };
+    },
+  );
+
+module.exports = { initTenantFactory };

package/src/entities/tenants/index.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./adapters'),
+  ...require('./domain'),
+  ...require('./factories'),
+  ...require('./orchestrators'),
+  ...require('./plugins'),
+  ...require('./repo'),
+};

package/src/entities/tenants/orchestrators/create-tenant.js

@@ -0,0 +1,116 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { KeyPurposes, KeyEncodings } = require('@verii/crypto');
+const { flatMap, flow, fromPairs, map, pick } = require('lodash/fp');
+const { ObjectId } = require('mongodb');
+const { nanoid } = require('nanoid');
+const {
+  loadPrimaryAccount,
+  normalizeTenantKey,
+  validateTenantKeys,
+  getKeyWithPurpose,
+  CihKeyPurposes,
+} = require('../../keys');
+const { loadTenantDidDoc, loadTenantProfile } = require('../adapters');
+const { validateNewTenant } = require('../domain');
+
+const createTenant = async (newTenant, tenantKeys, context) => {
+  const { repos, kms } = context;
+
+  const [didDoc, orgProfile] = await Promise.all([
+    loadTenantDidDoc(newTenant.did, context),
+    loadTenantProfile(newTenant.did, context),
+  ]);
+
+  validateNewTenant(newTenant, orgProfile, context);
+
+  validateTenantKeys(tenantKeys, didDoc);
+  const normalizedKeys = [
+    generateAccessTokenSecret(CihKeyPurposes.HOLDER_ACCESS_TOKENS),
+  ].concat(map(normalizeTenantKey, tenantKeys));
+  const primaryAccount = await resolvePrimaryAccount(
+    newTenant,
+    normalizedKeys,
+    context,
+  );
+
+  const preparedTenant = await prepareTenant(
+    newTenant,
+    normalizedKeys,
+    primaryAccount,
+    context,
+  );
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.tenant = preparedTenant;
+  const keys = await Promise.all(
+    map((normalizedKey) => kms.importKey(normalizedKey), normalizedKeys),
+  );
+
+  const tenant = await repos.tenants.insertTenant(preparedTenant);
+
+  return {
+    tenant,
+    keyMetadatas: keys.slice(1),
+  };
+};
+
+const resolvePrimaryAccount = async (newTenant, keys, context) => {
+  if (newTenant.primaryAccount != null) {
+    return newTenant.primaryAccount;
+  }
+  const dltKey = getKeyWithPurpose(KeyPurposes.DLT_TRANSACTIONS, keys);
+  return loadPrimaryAccount(dltKey, context);
+};
+
+/* eslint-disable better-mutation/no-mutation */
+const prepareTenant = async (
+  newTenant,
+  normalizedKeys,
+  primaryAccount,
+  context,
+) => {
+  newTenant._id = new ObjectId();
+  newTenant.primaryAccount = primaryAccount;
+  if (newTenant.hostUrl == null) {
+    newTenant.hostUrl = context.config.hostUrl;
+  }
+  if (newTenant.caoDid == null) {
+    newTenant.caoDid = context.config.defaultCaoDid;
+  }
+  newTenant.keysByPurpose = flow(
+    flatMap((key) => {
+      const keyMetadata = pick(
+        ['_id', 'kidFragment', 'algorithm', 'encoding', 'publicJwk'],
+        key,
+      );
+      return map((purpose) => [purpose, keyMetadata], key.purposes);
+    }),
+    fromPairs,
+  )(normalizedKeys);
+  return newTenant;
+};
+/* eslint-enable */
+
+const generateAccessTokenSecret = (purpose) => ({
+  _id: new ObjectId(),
+  purposes: [purpose],
+  encoding: KeyEncodings.BASE64URL,
+  secret: nanoid(16),
+});
+
+module.exports = { createTenant };

package/src/entities/tenants/orchestrators/delete-tenant.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { ObjectId } = require('mongodb');
+const { isEmpty, map } = require('lodash/fp');
+const newError = require('http-errors');
+const { TenantErrors } = require('../domain');
+
+const deleteTenant = async (tenantId, { repos }) => {
+  const filter = { tenantId: new ObjectId(tenantId) };
+  const issuerServices = await repos.issuerServices.find({ filter });
+
+  if (!isEmpty(issuerServices)) {
+    throw newError(
+      400,
+      `Issuer Service(s) ${map('_id')(
+        issuerServices,
+      )} must be deleted before deleting tenant`,
+      {
+        errorCode: TenantErrors.RELATED_SERVICE_UNDELETED,
+      },
+    );
+  }
+  return Promise.all([
+    repos.keys.delUsingFilter({
+      filter: { tenantId: new ObjectId(tenantId) },
+    }),
+    repos.tenants.del(tenantId),
+  ]);
+};
+
+module.exports = { deleteTenant };

package/src/entities/tenants/orchestrators/find-tenants.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const findTenants = (tenantIds, { repos }) => {
+  const filter = tenantIds == null ? {} : { _id: { $in: tenantIds } };
+  return repos.tenants.find({ filter });
+};
+
+module.exports = { findTenants };

package/src/entities/tenants/orchestrators/index.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./create-tenant'),
+  ...require('./delete-tenant'),
+  ...require('./find-tenants'),
+};

package/src/entities/tenants/plugins/index.js

@@ -0,0 +1,3 @@
+module.exports = {
+  ...require('./tenant-loader-plugin'),
+};

package/src/entities/tenants/plugins/tenant-loader-plugin.js

@@ -0,0 +1,64 @@
+/**
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const fp = require('fastify-plugin');
+const newError = require('http-errors');
+
+const extractTenantId = (req) => {
+  if (req.params.tenantId != null) {
+    return req.params.tenantId;
+  }
+  if (req.query.tenantId != null) {
+    return req.query.tenantId;
+  }
+  if (req.body.tenantId != null) {
+    return req.body.tenantId;
+  }
+  return null;
+};
+
+const loadTenant = async (options, req) => {
+  const tenantId = extractTenantId(req);
+  if (tenantId == null) {
+    throwTenantNotFound(options);
+  }
+
+  const filter = options.useDID ? { did: tenantId } : { _id: tenantId };
+  const tenant = await req.repos.tenants.findOne({ filter });
+  if (tenant == null) {
+    throwTenantNotFound(options);
+  }
+  return tenant;
+};
+
+const tenantLoaderPlugin = async (fastify, options = { useDID: false }) => {
+  fastify.decorateRequest('tenant', null);
+  fastify.addHook('preHandler', async (req) => {
+    req.tenant = await loadTenant(options, req);
+  });
+};
+
+const throwTenantNotFound = ({ notFoundStatusCode = 404 }) => {
+  throw newError(notFoundStatusCode, 'Tenant not found', {
+    errorCode: 'tenant_not_found',
+  });
+};
+
+module.exports = {
+  tenantLoaderPlugin: fp(tenantLoaderPlugin, {
+    name: 'tenant-loader-plugin',
+  }),
+};

package/src/entities/tenants/repo/index.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module.exports = {
+  tenantRepoPlugin: require('./repo'),
+};

package/src/entities/tenants/repo/insert-tenant-extension.js

@@ -0,0 +1,36 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const newError = require('http-errors');
+const { TenantErrors } = require('../domain/tenant-errors');
+
+const insertTenantExtension = (parent) => ({
+  insertTenant: async (newTenant) => {
+    try {
+      return await parent.insert(newTenant);
+    } catch (e) {
+      if (e.name === 'MongoServerError' && e.code === 11000) {
+        throw newError(400, TenantErrors.TENANTS_MUST_BE_UNIQUE, {
+          errorCode: TenantErrors.TENANTS_MUST_BE_UNIQUE,
+        });
+      }
+      throw e;
+    }
+  },
+  extensions: parent.extensions.concat(['insertTenantExtension']),
+});
+
+module.exports = { insertTenantExtension };

package/src/entities/tenants/repo/repo.js

@@ -0,0 +1,51 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const {
+  repoFactory,
+  autoboxIdsExtension,
+  mongoDb,
+} = require('@spencejs/spence-mongo-repos');
+const { insertTenantExtension } = require('./insert-tenant-extension');
+
+module.exports = (app, options, next = () => {}) => {
+  app.ready(async () => {
+    await mongoDb()
+      .collection('tenants')
+      .createIndex({ did: 1 }, { unique: true });
+  });
+  next();
+  return repoFactory(
+    {
+      name: 'tenants',
+      entityName: 'tenant',
+      defaultProjection: {
+        _id: 1,
+        did: 1,
+        primaryAccount: 1,
+        keysByPurpose: 1,
+        hostUrl: 1,
+        caoDid: 1,
+        name: 1,
+        logo: 1,
+        createdAt: 1,
+        updatedAt: 1,
+      },
+      extensions: [autoboxIdsExtension, insertTenantExtension],
+    },
+    app,
+  );
+};