keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/app/ipex/ipex-node-authentication.js

@@ -0,0 +1,185 @@
+/** Node issuer authentication over public KEL/TEL evidence; no conversation or validity policy. */
+import { Diger, NumberPrimitive, Prefixer } from "cesr-ts";
+import { validateRip, validateUpdate, vetBinds, vetBlind, vetBound, } from "../../acdc/regeventing.js";
+import { TransIdxSigGroup } from "../../core/dispatch.js";
+import { DatabaseOperationError } from "../../core/errors.js";
+import { verifyExchangeProofs } from "../../core/exchange/exchange-proofing.js";
+/** Protocol admission authenticates registry observations without imposing an application state vocabulary. */
+export function authenticatedNodeVerdict(authentication) {
+    switch (authentication.kind) {
+        case "authenticated":
+            return { kind: "valid" };
+        case "reject":
+            return { kind: "invalid" };
+        case "missing":
+            return { kind: "unknown", retryable: true, reason: authentication.reason, schemas: [] };
+    }
+}
+/** Classify every authenticated registered node for new-use policy, including the origin. */
+export function issuedNodeVerdict(authentication) {
+    if (authentication.kind !== "authenticated" || !authentication.registration) {
+        return authenticatedNodeVerdict(authentication);
+    }
+    switch (authentication.registration.state) {
+        case "issued":
+            return { kind: "valid" };
+        case "revoked":
+            return { kind: "invalid" };
+        default:
+            return { kind: "unknown", retryable: false, reason: "Unsupported registry state for new use.", schemas: [] };
+    }
+}
+/** Assemble accepted ordinals only; a missing head is retryable, contradictory durable rows are corrupt. */
+export function acceptedRegistryEvidence(store, regid) {
+    const marker = store.head(regid);
+    if (!marker)
+        return null;
+    const rip = store.seqEvent(regid, 0), head = store.headEvent(regid);
+    if (!rip || !head || head.said !== marker.qb64 || typeof head.sad?.n !== "string"
+        || !/^[0-9a-f]+$/.test(head.sad.n)) {
+        throw new DatabaseOperationError("Accepted registry evidence has a missing or corrupt head/inception.");
+    }
+    const last = BigInt(`0x${head.sad.n}`);
+    if (last > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new DatabaseOperationError("Accepted registry ordinal exceeds exact storage representation.");
+    }
+    if (validateRip(rip).kind !== "valid" || rip.said !== regid || store.seqSaider(regid, 0)?.qb64 !== regid) {
+        throw new DatabaseOperationError("Accepted registry inception is inconsistent.");
+    }
+    const updates = [];
+    let prior = rip.said;
+    for (let sn = 1; sn <= Number(last); sn++) {
+        const item = store.seqEvent(regid, sn);
+        if (!item)
+            throw new DatabaseOperationError("Accepted registry evidence has a missing sequence entry.");
+        const checked = validateUpdate(item, regid);
+        if (checked.kind !== "valid" || checked.event.sn !== BigInt(sn) || checked.event.prior !== prior
+            || store.seqSaider(regid, sn)?.qb64 !== item.said) {
+            throw new DatabaseOperationError("Accepted registry sequence is inconsistent.");
+        }
+        updates.push(item);
+        prior = item.said;
+    }
+    if ((updates.at(-1) ?? rip).said !== marker.qb64) {
+        throw new DatabaseOperationError("Registry head and sequence disagree.");
+    }
+    return { rip, updates };
+}
+/** A declared registry, then supplied anchors, take precedence over current signatures. */
+export function authenticateIpexNode(serder, envelope, db, registry, historical = false) {
+    if (serder.regid) {
+        const proofs = [...envelope.bsqs, ...envelope.bsss];
+        if (!proofs.length || !registry)
+            return { kind: "reject" };
+        const chain = acceptedRegistryEvidence(registry, serder.regid);
+        if (!chain)
+            return { kind: "missing", reason: `Missing local TEL evidence for ${serder.regid}.` };
+        // A RIP alone authenticates ownership, never a disclosed credential state.
+        if (!chain.updates.length)
+            return { kind: "reject" };
+        let at;
+        if (historical) {
+            if (!serder.verify() || serder.issuer !== chain.rip.issuer || serder.regid !== chain.rip.said) {
+                return { kind: "reject" };
+            }
+            // Authenticate all supplied bodies/duplicates and known bound contradictions
+            // before missing evidence wins, independently of attachment order.
+            if (proofs.some((proof) => !vetBlind(proof, proof.d.nonce))
+                || new Set(proofs.map((proof) => proof.d.nonce)).size !== proofs.length)
+                return { kind: "reject" };
+            let unresolved = false;
+            for (const proof of proofs) {
+                if (proof.td.nonce && proof.td.nonce !== serder.said)
+                    continue;
+                const bound = vetBound(proof, serder, db);
+                if (bound?.kind === "reject")
+                    return { kind: "reject" };
+                if (bound)
+                    unresolved = true;
+            }
+            const selected = [];
+            for (const proof of proofs) {
+                if (proof.td.nonce !== serder.said)
+                    continue;
+                const matches = chain.updates.filter((event) => event.sad.b === proof.d.nonce);
+                if (matches.length > 1)
+                    return { kind: "reject" };
+                if (matches.length)
+                    selected.push(matches[0]);
+                else
+                    unresolved = true;
+            }
+            if (unresolved)
+                return { kind: "missing", reason: `Missing retained issuer proof evidence for ${serder.said}.` };
+            if (!selected.length)
+                return { kind: "reject" };
+            const candidates = new Set(selected.map((event) => event.said));
+            // Accepted history is ascending. Vacuous and other-target openings cannot
+            // advance this issuer prefix; generic source locators never select it.
+            at = chain.updates.findLast((event) => candidates.has(event.said)).said;
+        }
+        const result = vetBinds({
+            ...chain,
+            db,
+            blinders: proofs,
+            target: serder.said,
+            acdc: serder,
+            at,
+        });
+        if (result.kind === "missing" && result.reason === "anchor") {
+            return { kind: "missing", reason: `Missing issuer TEL anchor for ${serder.regid}.` };
+        }
+        return result.kind === "verified" && result.state.regid === serder.regid
+            ? { kind: "authenticated", registration: result.state }
+            : { kind: "reject" };
+    }
+    // Disclosed inner rd without top-level rd is an unsupported hidden issuer registry.
+    // Compact aggregate entries expose no declaration and remain opaque here.
+    const aggregate = serder.sad.A;
+    const sections = [serder.sad.a, ...(Array.isArray(aggregate) ? aggregate.slice(1) : [aggregate])];
+    if (sections.some(section => section && typeof section === "object" && !Array.isArray(section)
+        && section.rd))
+        return { kind: "reject" };
+    if (!serder.issuer)
+        return { kind: "reject" };
+    let issuer;
+    try {
+        issuer = new Prefixer({ qb64: serder.issuer });
+    }
+    catch {
+        return { kind: "reject" };
+    }
+    const sourceSeals = [
+        ...envelope.sscs.map((seal) => ({ i: issuer, ...seal })),
+        ...envelope.ssts.filter((seal) => seal.i.qb64 === issuer.qb64),
+    ];
+    if (sourceSeals.length) {
+        const result = verifyExchangeProofs(db, serder, { sourceSeals });
+        return result.missing.length
+            ? { kind: "missing", reason: `Missing issuer KEL anchor for ${serder.said}.` }
+            : result.sourceSeals.length > 0
+                ? { kind: "authenticated", registration: null }
+                : { kind: "reject" };
+    }
+    const explicit = envelope.tsgs.filter((group) => group.pre === issuer.qb64);
+    const last = envelope.ssgs.filter((group) => group.pre === issuer.qb64);
+    const tsgs = [];
+    if (issuer.transferable && (envelope.sigers.length || explicit.length || last.length)) {
+        const kever = db.getKever(issuer.qb64);
+        if (!kever)
+            return { kind: "missing", reason: `Missing current issuer key state for ${serder.said}.` };
+        const number = NumberPrimitive.fromNum(BigInt(kever.lastEst.s));
+        const diger = new Diger({ qb64: kever.lastEst.d });
+        if (envelope.sigers.length)
+            tsgs.push(new TransIdxSigGroup(issuer, number, diger, [...envelope.sigers]));
+        tsgs.push(...explicit.filter((group) => group.sn === number.num && group.said === diger.qb64));
+        tsgs.push(...last.map((group) => new TransIdxSigGroup(issuer, number, diger, [...group.sigers])));
+    }
+    const cigars = envelope.cigars.filter((cigar) => cigar.verfer?.qb64 === issuer.qb64);
+    const result = verifyExchangeProofs(db, serder, { tsgs, cigars });
+    return result.missing.length
+        ? { kind: "missing", reason: `Missing current issuer KEL evidence for ${serder.said}.` }
+        : result.tsgs.length + result.cigars.length > 0
+            ? { kind: "authenticated", registration: null }
+            : { kind: "reject" };
+}