was-teaching-server 0.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +1432 -0
- package/LICENSE +661 -0
- package/README.md +305 -0
- package/common/css/materialize.1.0.0.min.css +13 -0
- package/dist/auth-header-hooks.d.ts +84 -0
- package/dist/auth-header-hooks.d.ts.map +1 -0
- package/dist/auth-header-hooks.js +136 -0
- package/dist/auth-header-hooks.js.map +1 -0
- package/dist/authorize.d.ts +45 -0
- package/dist/authorize.d.ts.map +1 -0
- package/dist/authorize.js +76 -0
- package/dist/authorize.js.map +1 -0
- package/dist/backends/filesystem.d.ts +1179 -0
- package/dist/backends/filesystem.d.ts.map +1 -0
- package/dist/backends/filesystem.js +2727 -0
- package/dist/backends/filesystem.js.map +1 -0
- package/dist/backends/postgres.d.ts +833 -0
- package/dist/backends/postgres.d.ts.map +1 -0
- package/dist/backends/postgres.js +2164 -0
- package/dist/backends/postgres.js.map +1 -0
- package/dist/backends/postgresSchema.d.ts +36 -0
- package/dist/backends/postgresSchema.d.ts.map +1 -0
- package/dist/backends/postgresSchema.js +203 -0
- package/dist/backends/postgresSchema.js.map +1 -0
- package/dist/config.default.d.ts +360 -0
- package/dist/config.default.d.ts.map +1 -0
- package/dist/config.default.js +493 -0
- package/dist/config.default.js.map +1 -0
- package/dist/corsProxy.d.ts +45 -0
- package/dist/corsProxy.d.ts.map +1 -0
- package/dist/corsProxy.js +278 -0
- package/dist/corsProxy.js.map +1 -0
- package/dist/digest.d.ts +45 -0
- package/dist/digest.d.ts.map +1 -0
- package/dist/digest.js +174 -0
- package/dist/digest.js.map +1 -0
- package/dist/errors.d.ts +654 -0
- package/dist/errors.d.ts.map +1 -0
- package/dist/errors.js +960 -0
- package/dist/errors.js.map +1 -0
- package/dist/index.d.ts +22 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +21 -0
- package/dist/index.js.map +1 -0
- package/dist/lib/atomicFile.d.ts +61 -0
- package/dist/lib/atomicFile.d.ts.map +1 -0
- package/dist/lib/atomicFile.js +150 -0
- package/dist/lib/atomicFile.js.map +1 -0
- package/dist/lib/backendRegistry.d.ts +59 -0
- package/dist/lib/backendRegistry.d.ts.map +1 -0
- package/dist/lib/backendRegistry.js +92 -0
- package/dist/lib/backendRegistry.js.map +1 -0
- package/dist/lib/backendUsage.d.ts +28 -0
- package/dist/lib/backendUsage.d.ts.map +1 -0
- package/dist/lib/backendUsage.js +55 -0
- package/dist/lib/backendUsage.js.map +1 -0
- package/dist/lib/backends.d.ts +142 -0
- package/dist/lib/backends.d.ts.map +1 -0
- package/dist/lib/backends.js +272 -0
- package/dist/lib/backends.js.map +1 -0
- package/dist/lib/blindedIndex.d.ts +156 -0
- package/dist/lib/blindedIndex.d.ts.map +1 -0
- package/dist/lib/blindedIndex.js +338 -0
- package/dist/lib/blindedIndex.js.map +1 -0
- package/dist/lib/collectionDescription.d.ts +33 -0
- package/dist/lib/collectionDescription.d.ts.map +1 -0
- package/dist/lib/collectionDescription.js +21 -0
- package/dist/lib/collectionDescription.js.map +1 -0
- package/dist/lib/cursor.d.ts +18 -0
- package/dist/lib/cursor.d.ts.map +1 -0
- package/dist/lib/cursor.js +50 -0
- package/dist/lib/cursor.js.map +1 -0
- package/dist/lib/edvEnvelope.d.ts +50 -0
- package/dist/lib/edvEnvelope.d.ts.map +1 -0
- package/dist/lib/edvEnvelope.js +106 -0
- package/dist/lib/edvEnvelope.js.map +1 -0
- package/dist/lib/encryption.d.ts +192 -0
- package/dist/lib/encryption.d.ts.map +1 -0
- package/dist/lib/encryption.js +383 -0
- package/dist/lib/encryption.js.map +1 -0
- package/dist/lib/etag.d.ts +33 -0
- package/dist/lib/etag.d.ts.map +1 -0
- package/dist/lib/etag.js +36 -0
- package/dist/lib/etag.js.map +1 -0
- package/dist/lib/exportManifest.d.ts +29 -0
- package/dist/lib/exportManifest.d.ts.map +1 -0
- package/dist/lib/exportManifest.js +77 -0
- package/dist/lib/exportManifest.js.map +1 -0
- package/dist/lib/importTar.d.ts +81 -0
- package/dist/lib/importTar.d.ts.map +1 -0
- package/dist/lib/importTar.js +301 -0
- package/dist/lib/importTar.js.map +1 -0
- package/dist/lib/isJson.d.ts +16 -0
- package/dist/lib/isJson.d.ts.map +1 -0
- package/dist/lib/isJson.js +17 -0
- package/dist/lib/isJson.js.map +1 -0
- package/dist/lib/keyEpoch.d.ts +38 -0
- package/dist/lib/keyEpoch.d.ts.map +1 -0
- package/dist/lib/keyEpoch.js +75 -0
- package/dist/lib/keyEpoch.js.map +1 -0
- package/dist/lib/keyedMutex.d.ts +28 -0
- package/dist/lib/keyedMutex.d.ts.map +1 -0
- package/dist/lib/keyedMutex.js +45 -0
- package/dist/lib/keyedMutex.js.map +1 -0
- package/dist/lib/kmsModule.d.ts +62 -0
- package/dist/lib/kmsModule.d.ts.map +1 -0
- package/dist/lib/kmsModule.js +327 -0
- package/dist/lib/kmsModule.js.map +1 -0
- package/dist/lib/kmsRecordCipher.d.ts +82 -0
- package/dist/lib/kmsRecordCipher.d.ts.map +1 -0
- package/dist/lib/kmsRecordCipher.js +226 -0
- package/dist/lib/kmsRecordCipher.js.map +1 -0
- package/dist/lib/pagination.d.ts +19 -0
- package/dist/lib/pagination.d.ts.map +1 -0
- package/dist/lib/pagination.js +21 -0
- package/dist/lib/pagination.js.map +1 -0
- package/dist/lib/paths.d.ts +273 -0
- package/dist/lib/paths.d.ts.map +1 -0
- package/dist/lib/paths.js +270 -0
- package/dist/lib/paths.js.map +1 -0
- package/dist/lib/preconditions.d.ts +65 -0
- package/dist/lib/preconditions.d.ts.map +1 -0
- package/dist/lib/preconditions.js +112 -0
- package/dist/lib/preconditions.js.map +1 -0
- package/dist/lib/resourceFileName.d.ts +41 -0
- package/dist/lib/resourceFileName.d.ts.map +1 -0
- package/dist/lib/resourceFileName.js +58 -0
- package/dist/lib/resourceFileName.js.map +1 -0
- package/dist/lib/revocations.d.ts +49 -0
- package/dist/lib/revocations.d.ts.map +1 -0
- package/dist/lib/revocations.js +86 -0
- package/dist/lib/revocations.js.map +1 -0
- package/dist/lib/validateDid.d.ts +19 -0
- package/dist/lib/validateDid.d.ts.map +1 -0
- package/dist/lib/validateDid.js +35 -0
- package/dist/lib/validateDid.js.map +1 -0
- package/dist/lib/validateId.d.ts +66 -0
- package/dist/lib/validateId.d.ts.map +1 -0
- package/dist/lib/validateId.js +126 -0
- package/dist/lib/validateId.js.map +1 -0
- package/dist/plugin.d.ts +115 -0
- package/dist/plugin.d.ts.map +1 -0
- package/dist/plugin.js +134 -0
- package/dist/plugin.js.map +1 -0
- package/dist/policy.d.ts +78 -0
- package/dist/policy.d.ts.map +1 -0
- package/dist/policy.js +115 -0
- package/dist/policy.js.map +1 -0
- package/dist/provisioning.d.ts +38 -0
- package/dist/provisioning.d.ts.map +1 -0
- package/dist/provisioning.js +72 -0
- package/dist/provisioning.js.map +1 -0
- package/dist/requests/BackendRequest.d.ts +61 -0
- package/dist/requests/BackendRequest.d.ts.map +1 -0
- package/dist/requests/BackendRequest.js +152 -0
- package/dist/requests/BackendRequest.js.map +1 -0
- package/dist/requests/CollectionRequest.d.ts +234 -0
- package/dist/requests/CollectionRequest.d.ts.map +1 -0
- package/dist/requests/CollectionRequest.js +705 -0
- package/dist/requests/CollectionRequest.js.map +1 -0
- package/dist/requests/KeyRequest.d.ts +115 -0
- package/dist/requests/KeyRequest.d.ts.map +1 -0
- package/dist/requests/KeyRequest.js +468 -0
- package/dist/requests/KeyRequest.js.map +1 -0
- package/dist/requests/KeystoreRequest.d.ts +99 -0
- package/dist/requests/KeystoreRequest.d.ts.map +1 -0
- package/dist/requests/KeystoreRequest.js +247 -0
- package/dist/requests/KeystoreRequest.js.map +1 -0
- package/dist/requests/PolicyRequest.d.ts +53 -0
- package/dist/requests/PolicyRequest.d.ts.map +1 -0
- package/dist/requests/PolicyRequest.js +124 -0
- package/dist/requests/PolicyRequest.js.map +1 -0
- package/dist/requests/ResourceRequest.d.ts +134 -0
- package/dist/requests/ResourceRequest.d.ts.map +1 -0
- package/dist/requests/ResourceRequest.js +548 -0
- package/dist/requests/ResourceRequest.js.map +1 -0
- package/dist/requests/RevocationRequest.d.ts +67 -0
- package/dist/requests/RevocationRequest.d.ts.map +1 -0
- package/dist/requests/RevocationRequest.js +187 -0
- package/dist/requests/RevocationRequest.js.map +1 -0
- package/dist/requests/SpaceRequest.d.ts +204 -0
- package/dist/requests/SpaceRequest.d.ts.map +1 -0
- package/dist/requests/SpaceRequest.js +520 -0
- package/dist/requests/SpaceRequest.js.map +1 -0
- package/dist/requests/SpacesRepositoryRequest.d.ts +50 -0
- package/dist/requests/SpacesRepositoryRequest.d.ts.map +1 -0
- package/dist/requests/SpacesRepositoryRequest.js +159 -0
- package/dist/requests/SpacesRepositoryRequest.js.map +1 -0
- package/dist/requests/collectionContext.d.ts +21 -0
- package/dist/requests/collectionContext.d.ts.map +1 -0
- package/dist/requests/collectionContext.js +30 -0
- package/dist/requests/collectionContext.js.map +1 -0
- package/dist/requests/controllerConsent.d.ts +58 -0
- package/dist/requests/controllerConsent.d.ts.map +1 -0
- package/dist/requests/controllerConsent.js +73 -0
- package/dist/requests/controllerConsent.js.map +1 -0
- package/dist/requests/keystoreContext.d.ts +68 -0
- package/dist/requests/keystoreContext.d.ts.map +1 -0
- package/dist/requests/keystoreContext.js +87 -0
- package/dist/requests/keystoreContext.js.map +1 -0
- package/dist/requests/resourceInput.d.ts +19 -0
- package/dist/requests/resourceInput.d.ts.map +1 -0
- package/dist/requests/resourceInput.js +102 -0
- package/dist/requests/resourceInput.js.map +1 -0
- package/dist/requests/spaceContext.d.ts +127 -0
- package/dist/requests/spaceContext.d.ts.map +1 -0
- package/dist/requests/spaceContext.js +201 -0
- package/dist/requests/spaceContext.js.map +1 -0
- package/dist/routes.d.ts +55 -0
- package/dist/routes.d.ts.map +1 -0
- package/dist/routes.js +306 -0
- package/dist/routes.js.map +1 -0
- package/dist/server.d.ts +20 -0
- package/dist/server.d.ts.map +1 -0
- package/dist/server.js +60 -0
- package/dist/server.js.map +1 -0
- package/dist/start.d.ts +7 -0
- package/dist/start.d.ts.map +1 -0
- package/dist/start.js +61 -0
- package/dist/start.js.map +1 -0
- package/dist/storage.d.ts +29 -0
- package/dist/storage.d.ts.map +1 -0
- package/dist/storage.js +47 -0
- package/dist/storage.js.map +1 -0
- package/dist/types.d.ts +915 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +2 -0
- package/dist/types.js.map +1 -0
- package/dist/views/home.hbs +9 -0
- package/dist/views/templates/main.hbs +12 -0
- package/dist/zcap.d.ts +267 -0
- package/dist/zcap.d.ts.map +1 -0
- package/dist/zcap.js +478 -0
- package/dist/zcap.js.map +1 -0
- package/package.json +109 -0
- package/src/auth-header-hooks.ts +163 -0
- package/src/authorize.ts +117 -0
- package/src/backends/filesystem.ts +3626 -0
- package/src/backends/postgres.ts +3073 -0
- package/src/backends/postgresSchema.ts +231 -0
- package/src/config.default.ts +657 -0
- package/src/corsProxy.ts +326 -0
- package/src/declarations.d.ts +28 -0
- package/src/digest.ts +223 -0
- package/src/errors.ts +1122 -0
- package/src/index.ts +21 -0
- package/src/lib/atomicFile.ts +176 -0
- package/src/lib/backendRegistry.ts +139 -0
- package/src/lib/backendUsage.ts +79 -0
- package/src/lib/backends.ts +351 -0
- package/src/lib/blindedIndex.ts +466 -0
- package/src/lib/collectionDescription.ts +43 -0
- package/src/lib/cursor.ts +52 -0
- package/src/lib/edvEnvelope.ts +120 -0
- package/src/lib/encryption.ts +472 -0
- package/src/lib/etag.ts +40 -0
- package/src/lib/exportManifest.ts +115 -0
- package/src/lib/importTar.ts +381 -0
- package/src/lib/isJson.ts +18 -0
- package/src/lib/keyEpoch.ts +89 -0
- package/src/lib/keyedMutex.ts +45 -0
- package/src/lib/kmsModule.ts +451 -0
- package/src/lib/kmsRecordCipher.ts +292 -0
- package/src/lib/pagination.ts +22 -0
- package/src/lib/paths.ts +382 -0
- package/src/lib/preconditions.ts +145 -0
- package/src/lib/resourceFileName.ts +69 -0
- package/src/lib/revocations.ts +116 -0
- package/src/lib/validateDid.ts +41 -0
- package/src/lib/validateId.ts +148 -0
- package/src/plugin.ts +288 -0
- package/src/policy.ts +176 -0
- package/src/provisioning.ts +98 -0
- package/src/requests/BackendRequest.ts +219 -0
- package/src/requests/CollectionRequest.ts +899 -0
- package/src/requests/KeyRequest.ts +617 -0
- package/src/requests/KeystoreRequest.ts +325 -0
- package/src/requests/PolicyRequest.ts +169 -0
- package/src/requests/ResourceRequest.ts +649 -0
- package/src/requests/RevocationRequest.ts +267 -0
- package/src/requests/SpaceRequest.ts +686 -0
- package/src/requests/SpacesRepositoryRequest.ts +194 -0
- package/src/requests/collectionContext.ts +41 -0
- package/src/requests/controllerConsent.ts +108 -0
- package/src/requests/keystoreContext.ts +124 -0
- package/src/requests/resourceInput.ts +118 -0
- package/src/requests/spaceContext.ts +311 -0
- package/src/routes.ts +420 -0
- package/src/server.ts +69 -0
- package/src/start.ts +71 -0
- package/src/storage.ts +60 -0
- package/src/types.ts +1016 -0
- package/src/views/home.hbs +9 -0
- package/src/views/templates/main.hbs +12 -0
- package/src/zcap.ts +657 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,KAAK,EACV,IAAI,EACJ,mBAAmB,EACnB,eAAe,EACf,KAAK,EACL,SAAS,EACT,cAAc,EACd,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAChB,MAAM,qCAAqC,CAAA;AAE5C,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,uBAAuB,CAAA;AAM9B,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,WAAW,EACX,cAAc,EACf,MAAM,uBAAuB,CAAA;AAI9B,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAA;AAGxD,YAAY,EACV,IAAI,EACJ,mBAAmB,EACnB,eAAe,EACf,KAAK,EACL,SAAS,EACT,cAAc,EACd,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,eAAe,EAChB,CAAA;AAGD,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,MAAM,EACN,WAAW,EACX,OAAO,EACP,YAAY,EACb,MAAM,uBAAuB,CAAA;AAE9B,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,QAAQ,CAAA;IACxB,gDAAgD;IAChD,kBAAkB,EAAE,MAAM,CAAA;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACpD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,QAAQ,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAEL;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAA;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG;IACpD,SAAS,EAAE,UAAU,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,sBAAsB,CAAA;CACnC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,2FAA2F;IAC3F,EAAE,EAAE,MAAM,CAAA;IACV,6EAA6E;IAC7E,UAAU,EAAE,IAAI,CAAA;IAChB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iEAAiE;IACjE,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAA;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,GAAG,EAAE;QACH,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,KAAK,CAAC;YAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAChC,aAAa,EAAE,MAAM,CAAA;SACtB,CAAC,CAAA;QACF,EAAE,EAAE,MAAM,CAAA;QACV,UAAU,EAAE,MAAM,CAAA;QAClB,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;IACD,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,GAAG,EAAE,YAAY,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,IAAI,CAAA;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IACpE,IAAI,EAAE;QACJ,0EAA0E;QAC1E,SAAS,EAAE,MAAM,CAAA;QACjB;;;WAGG;QACH,UAAU,EAAE,MAAM,CAAA;QAClB,mDAAmD;QACnD,OAAO,EAAE,MAAM,CAAA;QACf,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,KACnC,cAAc,CAAA;AAEnB,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAE1B;;;;;OAKG;IACH,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtB;;;;OAIG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;OAIG;IACH,QAAQ,IAAI,iBAAiB,CAAA;IAE7B;;;;;;;;;OASG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,MAAM,CAAA;QACf,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAC7B,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAEzB;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAEzB;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,OAAO,EAAE,MAAM,CAAA;QACf,gBAAgB,EAAE,gBAAgB,CAAA;QAClC,sEAAsE;QACtE,SAAS,CAAC,EAAE,IAAI,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,mBAAmB,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;IACzC,WAAW,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACzC,eAAe,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC3E;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5D;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,QAAQ,CAAA;KACpB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAExB;;;;;;;;;;OAUG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,qBAAqB,EAAE,qBAAqB,CAAA;QAC5C,sEAAsE;QACtE,SAAS,CAAC,EAAE,IAAI,CAAA;QAChB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;;;;WAOG;QACH,gBAAgB,CAAC,EAAE,CACjB,KAAK,CAAC,EAAE,qBAAqB,GAAG;YAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;SAAE,KAC5D,IAAI,CAAA;KACV,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC;;;;;OAKG;IACH,wBAAwB,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CACT,CAAC,qBAAqB,GAAG;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CACtE,CAAA;IACD,gBAAgB,CAAC,OAAO,EAAE;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;KAC9C,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAEpC;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,OAAO,EAAE;QACrB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,KAAK,EAAE,aAAa,CAAA;QACpB;;;;;;;WAOG;QACH,SAAS,CAAC,EAAE,IAAI,CAAA;QAChB;;;;;;WAMG;QACH,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,8EAA8E;QAC9E,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC3B;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CACT,CAAC,gBAAgB,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAC5E,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACxD;;;;;WAKG;QACH,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,YAAY,CAAC,CAAC,OAAO,EAAE;QACrB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;QAC9C,KAAK,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC;QACV,SAAS,EAAE,KAAK,CAAC;YACf,UAAU,EAAE,MAAM,CAAA;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,WAAW,CAAC,EAAE,MAAM,CAAA;YACpB,SAAS,CAAC,EAAE,IAAI,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;YACjB,OAAO,EAAE,OAAO,CAAA;YAChB,IAAI,CAAC,EAAE,OAAO,CAAA;YAGd,MAAM,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YACzD;;;;eAIG;YACH,KAAK,CAAC,EAAE,MAAM,CAAA;SACf,CAAC,CAAA;QACF,UAAU,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KACrD,CAAC,CAAA;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,CAAC,OAAO,EAAE;QAC5B,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,KAAK,EAAE,iBAAiB,CAAA;QACxB,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,qBAAqB,CAAC,CAAA;IAEtD;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACvC,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,cAAc,CAAA;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;OAOG;IACH,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,mBAAmB,CAAA;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,kFAAkF;IAClF,UAAU,CAAC,OAAO,EAAE;QAClB,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,CAAA;KAClB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAA;IAC5C,4EAA4E;IAC5E,YAAY,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACxE,sDAAsD;IACtD,aAAa,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE7E;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAO,EAAE;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,cAAc,CAAA;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,WAAW,CAAC,OAAO,EAAE;QACnB,UAAU,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACvC;;;;;;OAMG;IACH,cAAc,CAAC,OAAO,EAAE;QACtB,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,cAAc,CAAA;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB;;;;OAIG;IACH,yBAAyB,CAAC,OAAO,EAAE;QACjC,UAAU,EAAE,IAAI,CAAA;KACjB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;IAE7B;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,OAAO,EAAE;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,EAAE,YAAY,CAAA;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,MAAM,CAAC,OAAO,EAAE;QACd,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE;QAChB,UAAU,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC,CAAA;IAE7D;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CAAC,OAAO,EAAE;QACxB,KAAK,EAAE,eAAe,CAAA;QACtB,MAAM,EAAE,gBAAgB,CAAA;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE;QACjB,KAAK,EAAE,eAAe,CAAA;QACtB,YAAY,EAAE,iBAAiB,EAAE,CAAA;KAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAA;AAE9D;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,cAAc,CAAA;CACxB,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAE1D,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,SAAS,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,cAAc,CAAA;QACvB;;;;;;WAMG;QACH,gBAAgB,EAAE,uBAAuB,CAAA;QACzC;;;;;WAKG;QACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;QAClC;;;;;;;;;WASG;QACH,YAAY,CAAC,EAAE,oBAAoB,CAAA;QACnC;;;;;;WAMG;QACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;KAC9C;IACD,UAAU,cAAc;QACtB;;;;;;WAMG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;QAChC;;;;WAIG;QACH,IAAI,CAAC,EAAE,UAAU,CAAA;QACjB;;;;;;WAMG;QACH,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CACF"}
|
package/dist/types.js
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
<!doctype html>
|
|
2
|
+
<html lang="en">
|
|
3
|
+
<head>
|
|
4
|
+
<meta charset="utf-8">
|
|
5
|
+
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
6
|
+
<title>WAS Teaching Server: {{title}}</title>
|
|
7
|
+
<link rel="stylesheet" href="/common/css/materialize.1.0.0.min.css" />
|
|
8
|
+
</head>
|
|
9
|
+
<body>
|
|
10
|
+
{{{body}}}
|
|
11
|
+
</body>
|
|
12
|
+
</html>
|
package/dist/zcap.d.ts
ADDED
|
@@ -0,0 +1,267 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* ZCap verification: handleZcapVerify() checks the capability-invocation
|
|
3
|
+
* signature against the Space controller's Ed25519 key, synthesizing the root
|
|
4
|
+
* capability via the document loader. Also home to the zcap *revocation*
|
|
5
|
+
* verification pair, shared by the `/kms` and WAS route families:
|
|
6
|
+
* verifyRevocationChain() validates a to-be-revoked capability's delegation
|
|
7
|
+
* chain, and handleRevocationInvocationVerify() authorizes the submission
|
|
8
|
+
* under the dual-root rule (the scope's root -- a keystore or a Space -- or
|
|
9
|
+
* the revocation URL's own root controlled by any chain participant --
|
|
10
|
+
* ezcap-express's `authorizeZcapRevocation` convention).
|
|
11
|
+
*/
|
|
12
|
+
import type { IncomingHttpHeaders } from 'node:http';
|
|
13
|
+
import { type VerifyCapabilityInvocationResult } from '@interop/http-signature-zcap-verify';
|
|
14
|
+
import { type InspectCapabilityChain } from '@interop/zcap';
|
|
15
|
+
import type { CapabilitySummary, IDID, RevocationScope, StorageBackend } from './types.js';
|
|
16
|
+
/** Minimal logger surface used during verification (console / request.log). */
|
|
17
|
+
interface ZcapLogger {
|
|
18
|
+
error: (...args: any[]) => void;
|
|
19
|
+
}
|
|
20
|
+
/**
|
|
21
|
+
* Returns true when a `Capability-Invocation` header value is the bare root
|
|
22
|
+
* form (`zcap id="urn:zcap:root:..."` -- the signer invokes the root capability
|
|
23
|
+
* directly), false when it embeds a delegated capability
|
|
24
|
+
* (`zcap capability="<base64url(gzip(json))>"`). The check is safe on the raw
|
|
25
|
+
* header: a `capability=` substring cannot occur inside the root form's
|
|
26
|
+
* url-encoded `id` (where `=` is percent-encoded).
|
|
27
|
+
*
|
|
28
|
+
* @param options {object}
|
|
29
|
+
* @param options.invocation {string} the raw `Capability-Invocation` header
|
|
30
|
+
* @returns {boolean}
|
|
31
|
+
*/
|
|
32
|
+
export declare function isRootInvocation({ invocation }: {
|
|
33
|
+
invocation: string;
|
|
34
|
+
}): boolean;
|
|
35
|
+
/**
|
|
36
|
+
* Verifies the capability-invocation signature on a request against the Space
|
|
37
|
+
* controller's key. Throws AuthVerificationError if verification itself errors,
|
|
38
|
+
* or UnauthorizedError if the capability does not verify.
|
|
39
|
+
*
|
|
40
|
+
* @param options {object}
|
|
41
|
+
* @param options.url {string} request URL (path), resolved against serverUrl
|
|
42
|
+
* @param options.allowedTarget {string} the capability's expected
|
|
43
|
+
* invocationTarget (full URL, including host and port)
|
|
44
|
+
* @param options.allowedAction {string} expected action, e.g. an HTTP verb
|
|
45
|
+
* @param options.method {string} the HTTP method of the request
|
|
46
|
+
* @param options.headers {IncomingHttpHeaders} the request headers (including
|
|
47
|
+
* `authorization`, `capability-invocation`, and `digest`)
|
|
48
|
+
* @param options.serverUrl {string} this server's base URL
|
|
49
|
+
* @param options.spaceController {IDID} the did:key that controls the Space
|
|
50
|
+
* @param [options.requestName] {string} human-readable request name, used in
|
|
51
|
+
* error titles
|
|
52
|
+
* @param [options.logger] {ZcapLogger} logger for verification errors;
|
|
53
|
+
* defaults to `console`
|
|
54
|
+
* @param [options.allowTargetQuery] {boolean} tolerate query parameters that
|
|
55
|
+
* extend `allowedTarget` on the request URL (see `verifyZcap`)
|
|
56
|
+
* @param [options.allowTargetAttenuation] {boolean} accept a request URL
|
|
57
|
+
* that path-extends `allowedTarget` under a capability rooted at
|
|
58
|
+
* `allowedTarget` (see `verifyZcap`)
|
|
59
|
+
* @param [options.attenuatedRootTarget] {string} an ancestor target (e.g.
|
|
60
|
+
* the Space URL) whose root capability is also accepted as the root of a
|
|
61
|
+
* delegated chain that attenuates down to the request URL (see `verifyZcap`)
|
|
62
|
+
* @param options.revocation {object|string} the revocation-store check, run
|
|
63
|
+
* against the dereferenced chain after signature verification. REQUIRED so
|
|
64
|
+
* that skipping revocation is a stated decision, never an omission: pass
|
|
65
|
+
* `{ storage, scope }` -- the scope (keystore or Space) the chain roots
|
|
66
|
+
* in -- or the literal `'no-revocation-scope'` when the verified target has
|
|
67
|
+
* no scope a revocation could be stored under (a create/consent
|
|
68
|
+
* verification for a not-yet-existing resource, or a collection-level root
|
|
69
|
+
* like `/kms/keystores`).
|
|
70
|
+
* @param [options.maxChainLength] {number} max delegation chain length,
|
|
71
|
+
* root included (see `verifyZcap`)
|
|
72
|
+
* @param [options.maxDelegationTtl] {number} max delegated-zcap TTL in
|
|
73
|
+
* milliseconds (see `verifyZcap`)
|
|
74
|
+
* @returns {Promise<VerifyCapabilityInvocationResult>} the successful
|
|
75
|
+
* verification result (callers needing the dereferenced chain, e.g. the
|
|
76
|
+
* per-key `maxCapabilityChainLength` gate, read it from here)
|
|
77
|
+
*/
|
|
78
|
+
export declare function handleZcapVerify({ url, allowedTarget, allowedAction, method, headers, serverUrl, spaceController, requestName, logger, allowTargetQuery, allowTargetAttenuation, attenuatedRootTarget, revocation, maxChainLength, maxDelegationTtl }: {
|
|
79
|
+
url: string;
|
|
80
|
+
allowedTarget: string;
|
|
81
|
+
allowedAction: string;
|
|
82
|
+
method: string;
|
|
83
|
+
headers: IncomingHttpHeaders;
|
|
84
|
+
serverUrl: string;
|
|
85
|
+
spaceController: IDID;
|
|
86
|
+
requestName?: string;
|
|
87
|
+
logger?: ZcapLogger;
|
|
88
|
+
allowTargetQuery?: boolean;
|
|
89
|
+
allowTargetAttenuation?: boolean;
|
|
90
|
+
attenuatedRootTarget?: string;
|
|
91
|
+
revocation: {
|
|
92
|
+
storage: StorageBackend;
|
|
93
|
+
scope: RevocationScope;
|
|
94
|
+
} | 'no-revocation-scope';
|
|
95
|
+
maxChainLength?: number;
|
|
96
|
+
maxDelegationTtl?: number;
|
|
97
|
+
}): Promise<VerifyCapabilityInvocationResult>;
|
|
98
|
+
/**
|
|
99
|
+
* Performs the underlying capability-invocation verification: builds a document
|
|
100
|
+
* loader whose `urn` protocol handler synthesizes the root capability on demand
|
|
101
|
+
* (its controller is the Space controller), then calls
|
|
102
|
+
* verifyCapabilityInvocation().
|
|
103
|
+
*
|
|
104
|
+
* @param options {object}
|
|
105
|
+
* @param options.url {string} request URL (path), resolved against serverUrl
|
|
106
|
+
* @param options.allowedTarget {string} expected invocationTarget (full URL)
|
|
107
|
+
* @param options.allowedAction {string} expected action, e.g. an HTTP verb
|
|
108
|
+
* @param options.method {string} the HTTP method of the request
|
|
109
|
+
* @param options.headers {IncomingHttpHeaders} the request headers
|
|
110
|
+
* @param options.serverUrl {string} this server's base URL
|
|
111
|
+
* @param options.spaceController {IDID} the did:key that controls the Space
|
|
112
|
+
* @param [options.allowTargetQuery] {boolean} when set, accept a request URL
|
|
113
|
+
* that adds query parameters to `allowedTarget` (e.g. List Collection's
|
|
114
|
+
* `?limit`/`cursor`) as authorized by a capability for the bare target. The
|
|
115
|
+
* spec requires that pagination parameters select a page within an
|
|
116
|
+
* already-authorized target without changing the target a capability must
|
|
117
|
+
* match. The zcap library otherwise requires the capability's
|
|
118
|
+
* `invocationTarget` to equal the full request URL exactly, so this enables
|
|
119
|
+
* target attenuation (the library treats a `?`-query suffix as a valid RESTful
|
|
120
|
+
* attenuation) and admits both the bare-target root capability (a delegate
|
|
121
|
+
* following `next`) and the query-bearing one (a controller invoking the URL
|
|
122
|
+
* directly). The actual gate -- the bare-target root capability -- is
|
|
123
|
+
* unchanged. (TODO: the `/quotas` endpoint should adopt this too, so its
|
|
124
|
+
* per-Collection breakdown can return to the spec's `?include=collections`
|
|
125
|
+
* opt-in.)
|
|
126
|
+
* @param [options.allowTargetAttenuation] {boolean} when set, accept a
|
|
127
|
+
* request URL that *path*-extends `allowedTarget` (e.g. a WebKMS key
|
|
128
|
+
* operation posted to `<keystoreId>/keys/<keyId>` under a capability rooted
|
|
129
|
+
* at the keystore). The root capability is `allowedTarget`'s alone -- unlike
|
|
130
|
+
* `allowTargetQuery`, the extended URL is never itself an acceptable root --
|
|
131
|
+
* so both a root invocation by the controller and a delegated zcap whose
|
|
132
|
+
* `invocationTarget` narrows down to the request URL verify against the
|
|
133
|
+
* `allowedTarget` root (the webkms authorization model, which roots the
|
|
134
|
+
* invocation target at the keystore id).
|
|
135
|
+
* @param [options.attenuatedRootTarget] {string} when set, an *ancestor*
|
|
136
|
+
* invocation target (the Space URL for the WAS route families) whose root
|
|
137
|
+
* capability is accepted -- in addition to `allowedTarget`'s own -- as the
|
|
138
|
+
* root of the invocation. This is what lets a controller delegate one
|
|
139
|
+
* capability for a whole Space (or a Collection under it, by attenuating
|
|
140
|
+
* the `invocationTarget` down at delegation time) and have the delegate
|
|
141
|
+
* invoke it against any URL underneath: the chain roots at the ancestor's
|
|
142
|
+
* root capability and narrows toward the request URL (RESTful attenuation,
|
|
143
|
+
* the same shape `allowTargetAttenuation` gives the WebKMS keystore).
|
|
144
|
+
* Root invocations of `allowedTarget`'s own root capability verify
|
|
145
|
+
* unchanged, so this only widens what the Space controller can delegate,
|
|
146
|
+
* never who can access.
|
|
147
|
+
* @param [options.inspectCapabilityChain] {InspectCapabilityChain} hook run
|
|
148
|
+
* against the dereferenced chain after signature verification -- the
|
|
149
|
+
* revocation-check extension point (a stored revocation of any capability
|
|
150
|
+
* in the chain fails the verification). Both route families pass one, scoped
|
|
151
|
+
* to the keystore or the Space the request roots in.
|
|
152
|
+
* @param [options.maxChainLength] {number} max delegation chain length,
|
|
153
|
+
* root included (the `/kms` families pass `KMS_MAX_CHAIN_LENGTH`; absent,
|
|
154
|
+
* the zcap library's own default applies)
|
|
155
|
+
* @param [options.maxDelegationTtl] {number} max delegated-zcap TTL in
|
|
156
|
+
* milliseconds, measured `expires` minus the delegation proof's `created`
|
|
157
|
+
* (the `/kms` families pass `KMS_MAX_DELEGATION_TTL`; absent, unbounded)
|
|
158
|
+
* @returns {Promise<VerifyCapabilityInvocationResult>}
|
|
159
|
+
*/
|
|
160
|
+
export declare function verifyZcap({ url, allowedTarget, allowedAction, method, headers, serverUrl, spaceController, allowTargetQuery, allowTargetAttenuation, attenuatedRootTarget, inspectCapabilityChain, maxChainLength, maxDelegationTtl }: {
|
|
161
|
+
url: string;
|
|
162
|
+
allowedTarget: string;
|
|
163
|
+
allowedAction: string;
|
|
164
|
+
method: string;
|
|
165
|
+
headers: IncomingHttpHeaders;
|
|
166
|
+
serverUrl: string;
|
|
167
|
+
spaceController: IDID;
|
|
168
|
+
allowTargetQuery?: boolean;
|
|
169
|
+
allowTargetAttenuation?: boolean;
|
|
170
|
+
attenuatedRootTarget?: string;
|
|
171
|
+
inspectCapabilityChain?: InspectCapabilityChain;
|
|
172
|
+
maxChainLength?: number;
|
|
173
|
+
maxDelegationTtl?: number;
|
|
174
|
+
}): Promise<VerifyCapabilityInvocationResult>;
|
|
175
|
+
/**
|
|
176
|
+
* Verifies the delegation chain of a capability submitted for revocation
|
|
177
|
+
* (`CapabilityDelegation` proof purpose over the embedded chain), throwing
|
|
178
|
+
* `InvalidRevocationError` (400) when it does not verify. The chain must root
|
|
179
|
+
* in the revocation's scope: its root capability's invocation target must be
|
|
180
|
+
* `rootTarget` -- the keystore URL, or the Space URL for a WAS-route
|
|
181
|
+
* revocation -- or a path under it (enforced where the root is synthesized,
|
|
182
|
+
* so a chain aimed at another keystore or Space -- or another service --
|
|
183
|
+
* cannot be submitted here, per ezcap-express `authorizeZcapRevocation`).
|
|
184
|
+
* Deliberately structural only -- it does NOT consult the revocation store:
|
|
185
|
+
* this runs before the invocation is authorized, and a store-dependent
|
|
186
|
+
* failure here would disclose revocation state to unauthorized callers
|
|
187
|
+
* (400 already-revoked vs the masked 404). The caller checks the returned
|
|
188
|
+
* `capabilities` against the store after authorization.
|
|
189
|
+
*
|
|
190
|
+
* @param options {object}
|
|
191
|
+
* @param options.capability {object} the delegated capability to be revoked
|
|
192
|
+
* (the request body, verbatim)
|
|
193
|
+
* @param options.rootTarget {string} the scope's full URL -- the keystore or
|
|
194
|
+
* the Space -- which the chain is required to root in
|
|
195
|
+
* @param options.rootController {IDID} the scope's controller (controller of
|
|
196
|
+
* the synthesized root capability)
|
|
197
|
+
* @param [options.maxChainLength] {number} max chain length, root included
|
|
198
|
+
* @param [options.maxDelegationTtl] {number} max delegated-zcap TTL (ms)
|
|
199
|
+
* @returns {Promise<{ delegator: string, chainControllers: string[],
|
|
200
|
+
* capabilities: CapabilitySummary[] }>} the capability's delegator (its
|
|
201
|
+
* delegation proof's controller), every controller in its chain (the
|
|
202
|
+
* parties allowed to submit the revocation), and the chain's
|
|
203
|
+
* `(capabilityId, delegator)` pairs for the caller's post-authorization
|
|
204
|
+
* revocation-store check
|
|
205
|
+
*/
|
|
206
|
+
export declare function verifyRevocationChain({ capability, rootTarget, rootController, maxChainLength, maxDelegationTtl }: {
|
|
207
|
+
capability: Record<string, unknown>;
|
|
208
|
+
rootTarget: string;
|
|
209
|
+
rootController: IDID;
|
|
210
|
+
maxChainLength?: number;
|
|
211
|
+
maxDelegationTtl?: number;
|
|
212
|
+
}): Promise<{
|
|
213
|
+
delegator: string;
|
|
214
|
+
chainControllers: string[];
|
|
215
|
+
capabilities: CapabilitySummary[];
|
|
216
|
+
}>;
|
|
217
|
+
/**
|
|
218
|
+
* Verifies the capability invocation on a revocation submission under the
|
|
219
|
+
* dual-root rule: the invocation may root in the scope -- the keystore or the
|
|
220
|
+
* Space -- (whose controller may revoke anything delegated from it, delegates
|
|
221
|
+
* of a revocation capability included, via target attenuation), or in the
|
|
222
|
+
* revocation URL itself, whose
|
|
223
|
+
* synthesized root capability is controlled by *every controller in the
|
|
224
|
+
* to-be-revoked capability's chain* -- so a delegee can revoke its own zcap
|
|
225
|
+
* without holding a separate capability (ezcap-express
|
|
226
|
+
* `authorizeZcapRevocation`). Throws like `handleZcapVerify`:
|
|
227
|
+
* `AuthVerificationError` (400) when verification errors, the 404-masked
|
|
228
|
+
* `UnauthorizedError` when the invocation does not verify.
|
|
229
|
+
*
|
|
230
|
+
* @param options {object}
|
|
231
|
+
* @param options.url {string} request URL (path), resolved against serverUrl
|
|
232
|
+
* @param options.method {string} the HTTP method of the request
|
|
233
|
+
* @param options.headers {IncomingHttpHeaders} the request headers
|
|
234
|
+
* @param options.serverUrl {string} this server's base URL
|
|
235
|
+
* @param options.rootTarget {string} the scope's full URL (the keystore or
|
|
236
|
+
* the Space)
|
|
237
|
+
* @param options.rootController {IDID} the scope's controller
|
|
238
|
+
* @param options.chainControllers {string[]} every controller in the
|
|
239
|
+
* to-be-revoked capability's (already verified) chain
|
|
240
|
+
* @param options.expectedAction {string} the action the invocation must
|
|
241
|
+
* carry: the webkms `write` on `/kms`, the HTTP verb (`POST`) on the WAS
|
|
242
|
+
* route families, whose capabilities are scoped by HTTP method
|
|
243
|
+
* @param [options.inspectCapabilityChain] {InspectCapabilityChain} the
|
|
244
|
+
* revocation-store hook, run against the *invoking* chain
|
|
245
|
+
* @param [options.maxChainLength] {number} max chain length, root included
|
|
246
|
+
* @param [options.maxDelegationTtl] {number} max delegated-zcap TTL (ms)
|
|
247
|
+
* @param [options.requestName] {string} request name used in error titles
|
|
248
|
+
* @param [options.logger] {ZcapLogger} logger for verification errors
|
|
249
|
+
* @returns {Promise<void>}
|
|
250
|
+
*/
|
|
251
|
+
export declare function handleRevocationInvocationVerify({ url, method, headers, serverUrl, rootTarget, rootController, chainControllers, expectedAction, inspectCapabilityChain, maxChainLength, maxDelegationTtl, requestName, logger }: {
|
|
252
|
+
url: string;
|
|
253
|
+
method: string;
|
|
254
|
+
headers: IncomingHttpHeaders;
|
|
255
|
+
serverUrl: string;
|
|
256
|
+
rootTarget: string;
|
|
257
|
+
rootController: IDID;
|
|
258
|
+
chainControllers: string[];
|
|
259
|
+
expectedAction: string;
|
|
260
|
+
inspectCapabilityChain?: InspectCapabilityChain;
|
|
261
|
+
maxChainLength?: number;
|
|
262
|
+
maxDelegationTtl?: number;
|
|
263
|
+
requestName?: string;
|
|
264
|
+
logger?: ZcapLogger;
|
|
265
|
+
}): Promise<void>;
|
|
266
|
+
export {};
|
|
267
|
+
//# sourceMappingURL=zcap.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"zcap.d.ts","sourceRoot":"","sources":["../src/zcap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,qCAAqC,CAAA;AAE5C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,eAAe,CAAA;AActB,OAAO,KAAK,EACV,iBAAiB,EACjB,IAAI,EAEJ,eAAe,EACf,cAAc,EACf,MAAM,YAAY,CAAA;AA4EnB,+EAA+E;AAC/E,UAAU,UAAU;IAClB,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,CAAA;CAChC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACX,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAEV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,aAAa,EACb,aAAa,EACb,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,EACf,WAAgB,EAChB,MAAgB,EAChB,gBAAwB,EACxB,sBAA8B,EAC9B,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,gBAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,IAAI,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,UAAU,EACR;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAE,GAAG,qBAAqB,CAAA;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA+B5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAsB,UAAU,CAAC,EAC/B,GAAG,EACH,aAAa,EACb,aAAa,EACb,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,EACf,gBAAwB,EACxB,sBAA8B,EAC9B,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,IAAI,CAAA;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,sBAAsB,CAAC,EAAE,sBAAsB,CAAA;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA6E5C;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,gBAAgB,EACjB,EAAE;IACD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,IAAI,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,YAAY,EAAE,iBAAiB,EAAE,CAAA;CAClC,CAAC,CA4DD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,gCAAgC,CAAC,EACrD,GAAG,EACH,MAAM,EACN,OAAO,EACP,SAAS,EACT,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,WAAgB,EAChB,MAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,IAAI,CAAA;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAA;IACtB,sBAAsB,CAAC,EAAE,sBAAsB,CAAA;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhB"}
|