keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/app/{ipex-node-authentication.js → ipex/ipex-node-authentication.js}

@@ -1,9 +1,34 @@
 /** Node issuer authentication over public KEL/TEL evidence; no conversation or validity policy. */
 import { Diger, NumberPrimitive, Prefixer } from "cesr-ts";
-import { validateRip, validateUpdate, vetBinds } from "../acdc/regeventing.js";
-import { TransIdxSigGroup } from "../core/dispatch.js";
-import { DatabaseOperationError } from "../core/errors.js";
-import { verifyExchangeProofs } from "../core/exchange-proofing.js";
+import { validateRip, validateUpdate, vetBinds, vetBlind, vetBound, } from "../../acdc/regeventing.js";
+import { TransIdxSigGroup } from "../../core/dispatch.js";
+import { DatabaseOperationError } from "../../core/errors.js";
+import { verifyExchangeProofs } from "../../core/exchange/exchange-proofing.js";
+/** Protocol admission authenticates registry observations without imposing an application state vocabulary. */
+export function authenticatedNodeVerdict(authentication) {
+    switch (authentication.kind) {
+        case "authenticated":
+            return { kind: "valid" };
+        case "reject":
+            return { kind: "invalid" };
+        case "missing":
+            return { kind: "unknown", retryable: true, reason: authentication.reason, schemas: [] };
+    }
+}
+/** Classify every authenticated registered node for new-use policy, including the origin. */
+export function issuedNodeVerdict(authentication) {
+    if (authentication.kind !== "authenticated" || !authentication.registration) {
+        return authenticatedNodeVerdict(authentication);
+    }
+    switch (authentication.registration.state) {
+        case "issued":
+            return { kind: "valid" };
+        case "revoked":
+            return { kind: "invalid" };
+        default:
+            return { kind: "unknown", retryable: false, reason: "Unsupported registry state for new use.", schemas: [] };
+    }
+}
 /** Assemble accepted ordinals only; a missing head is retryable, contradictory durable rows are corrupt. */
 export function acceptedRegistryEvidence(store, regid) {
     const marker = store.head(regid);
@@ -41,7 +66,7 @@ export function acceptedRegistryEvidence(store, regid) {
     return { rip, updates };
 }
 /** A declared registry, then supplied anchors, take precedence over current signatures. */
-export function authenticateIpexNode(serder, envelope, db, registry) {
+export function authenticateIpexNode(serder, envelope, db, registry, historical = false) {
     if (serder.regid) {
         const proofs = [...envelope.bsqs, ...envelope.bsss];
         if (!proofs.length || !registry)
@@ -49,20 +74,72 @@ export function authenticateIpexNode(serder, envelope, db, registry) {
         const chain = acceptedRegistryEvidence(registry, serder.regid);
         if (!chain)
             return { kind: "missing", reason: `Missing local TEL evidence for ${serder.regid}.` };
+        // A RIP alone authenticates ownership, never a disclosed credential state.
+        if (!chain.updates.length)
+            return { kind: "reject" };
+        let at;
+        if (historical) {
+            if (!serder.verify() || serder.issuer !== chain.rip.issuer || serder.regid !== chain.rip.said) {
+                return { kind: "reject" };
+            }
+            // Authenticate all supplied bodies/duplicates and known bound contradictions
+            // before missing evidence wins, independently of attachment order.
+            if (proofs.some((proof) => !vetBlind(proof, proof.d.nonce))
+                || new Set(proofs.map((proof) => proof.d.nonce)).size !== proofs.length)
+                return { kind: "reject" };
+            let unresolved = false;
+            for (const proof of proofs) {
+                if (proof.td.nonce && proof.td.nonce !== serder.said)
+                    continue;
+                const bound = vetBound(proof, serder, db);
+                if (bound?.kind === "reject")
+                    return { kind: "reject" };
+                if (bound)
+                    unresolved = true;
+            }
+            const selected = [];
+            for (const proof of proofs) {
+                if (proof.td.nonce !== serder.said)
+                    continue;
+                const matches = chain.updates.filter((event) => event.sad.b === proof.d.nonce);
+                if (matches.length > 1)
+                    return { kind: "reject" };
+                if (matches.length)
+                    selected.push(matches[0]);
+                else
+                    unresolved = true;
+            }
+            if (unresolved)
+                return { kind: "missing", reason: `Missing retained issuer proof evidence for ${serder.said}.` };
+            if (!selected.length)
+                return { kind: "reject" };
+            const candidates = new Set(selected.map((event) => event.said));
+            // Accepted history is ascending. Vacuous and other-target openings cannot
+            // advance this issuer prefix; generic source locators never select it.
+            at = chain.updates.findLast((event) => candidates.has(event.said)).said;
+        }
         const result = vetBinds({
             ...chain,
             db,
             blinders: proofs,
             target: serder.said,
             acdc: serder,
+            at,
         });
-        if (result.kind === "missing") {
+        if (result.kind === "missing" && result.reason === "anchor") {
             return { kind: "missing", reason: `Missing issuer TEL anchor for ${serder.regid}.` };
         }
         return result.kind === "verified" && result.state.regid === serder.regid
             ? { kind: "authenticated", registration: result.state }
             : { kind: "reject" };
     }
+    // Disclosed inner rd without top-level rd is an unsupported hidden issuer registry.
+    // Compact aggregate entries expose no declaration and remain opaque here.
+    const aggregate = serder.sad.A;
+    const sections = [serder.sad.a, ...(Array.isArray(aggregate) ? aggregate.slice(1) : [aggregate])];
+    if (sections.some(section => section && typeof section === "object" && !Array.isArray(section)
+        && section.rd))
+        return { kind: "reject" };
     if (!serder.issuer)
         return { kind: "reject" };
     let issuer;