was-teaching-server 0.9.1

package/dist/zcap.js

@@ -0,0 +1,478 @@
+import { securityLoader } from '@interop/security-document-loader';
+import { verifyCapabilityInvocation } from '@interop/http-signature-zcap-verify';
+import jsigs from '@interop/jsonld-signatures';
+import { CapabilityDelegation } from '@interop/zcap';
+import { Ed25519VerificationKey } from '@interop/ed25519-verification-key';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import * as didKey from '@interop/did-method-key';
+import { AuthVerificationError, InvalidRevocationError, UnauthorizedError } from './errors.js';
+import { capabilitySummaries, revocationChainInspector } from './lib/revocations.js';
+const didKeyDriver = didKey.driver();
+didKeyDriver.use({
+    multibaseMultikeyHeader: 'z6Mk',
+    fromMultibase: Ed25519VerificationKey.from
+});
+/**
+ * The root capability id convention: `urn:zcap:root:` + the url-encoded
+ * invocation target (shared by WAS and webkms).
+ * @param target {string}   the root invocation target (full URL)
+ * @returns {string}
+ */
+function rootCapabilityId(target) {
+    return `urn:zcap:root:${encodeURIComponent(target)}`;
+}
+/**
+ * Builds a document loader whose `urn` protocol handler synthesizes
+ * `urn:zcap:root:<target>` capabilities on demand, with the controller chosen
+ * per target. The zcap library only dereferences a root capability it already
+ * expects (per `expectedRootCapability`), so `controllerFor` sees expected
+ * targets only -- it may still throw to refuse one outright.
+ *
+ * @param options {object}
+ * @param options.controllerFor {(target: string) => IDID | string[]}   maps a
+ *   decoded root invocation target to the controller(s) of its synthesized
+ *   root capability
+ * @returns {IDocumentLoader}
+ */
+function rootCapabilityLoader({ controllerFor }) {
+    const loader = securityLoader();
+    loader.setProtocolHandler({
+        protocol: 'urn',
+        handler: {
+            get: async ({ id, url }) => {
+                const resolvedUrl = url || id;
+                const rootZcapTarget = decodeURIComponent(resolvedUrl.split('urn:zcap:root:')[1]);
+                return {
+                    '@context': 'https://w3id.org/zcap/v1',
+                    id: resolvedUrl,
+                    invocationTarget: rootZcapTarget,
+                    controller: controllerFor(rootZcapTarget)
+                };
+            }
+        }
+    });
+    return loader.build();
+}
+/**
+ * Resolves an invocation's keyId to an Ed25519 verifier (the
+ * `verifyCapabilityInvocation` HTTP-signature key hook).
+ * @param options {object}
+ * @param options.keyId {string}   the did:key verification method URL
+ * @returns {Promise<{ verifier: object, verificationMethod: IVerificationMethod }>}
+ */
+async function getVerifier({ keyId }) {
+    const verificationMethod = await didKeyDriver.get({ url: keyId });
+    const key = await Ed25519VerificationKey.from(verificationMethod);
+    const verifier = key.verifier();
+    return {
+        verifier,
+        verificationMethod: verificationMethod
+    };
+}
+/**
+ * Returns true when a `Capability-Invocation` header value is the bare root
+ * form (`zcap id="urn:zcap:root:..."` -- the signer invokes the root capability
+ * directly), false when it embeds a delegated capability
+ * (`zcap capability="<base64url(gzip(json))>"`). The check is safe on the raw
+ * header: a `capability=` substring cannot occur inside the root form's
+ * url-encoded `id` (where `=` is percent-encoded).
+ *
+ * @param options {object}
+ * @param options.invocation {string}   the raw `Capability-Invocation` header
+ * @returns {boolean}
+ */
+export function isRootInvocation({ invocation }) {
+    return !invocation.includes('capability=');
+}
+/**
+ * Verifies the capability-invocation signature on a request against the Space
+ * controller's key. Throws AuthVerificationError if verification itself errors,
+ * or UnauthorizedError if the capability does not verify.
+ *
+ * @param options {object}
+ * @param options.url {string}   request URL (path), resolved against serverUrl
+ * @param options.allowedTarget {string}   the capability's expected
+ *   invocationTarget (full URL, including host and port)
+ * @param options.allowedAction {string}   expected action, e.g. an HTTP verb
+ * @param options.method {string}   the HTTP method of the request
+ * @param options.headers {IncomingHttpHeaders}   the request headers (including
+ *   `authorization`, `capability-invocation`, and `digest`)
+ * @param options.serverUrl {string}   this server's base URL
+ * @param options.spaceController {IDID}   the did:key that controls the Space
+ * @param [options.requestName] {string}   human-readable request name, used in
+ *   error titles
+ * @param [options.logger] {ZcapLogger}   logger for verification errors;
+ *   defaults to `console`
+ * @param [options.allowTargetQuery] {boolean}   tolerate query parameters that
+ *   extend `allowedTarget` on the request URL (see `verifyZcap`)
+ * @param [options.allowTargetAttenuation] {boolean}   accept a request URL
+ *   that path-extends `allowedTarget` under a capability rooted at
+ *   `allowedTarget` (see `verifyZcap`)
+ * @param [options.attenuatedRootTarget] {string}   an ancestor target (e.g.
+ *   the Space URL) whose root capability is also accepted as the root of a
+ *   delegated chain that attenuates down to the request URL (see `verifyZcap`)
+ * @param options.revocation {object|string}   the revocation-store check, run
+ *   against the dereferenced chain after signature verification. REQUIRED so
+ *   that skipping revocation is a stated decision, never an omission: pass
+ *   `{ storage, scope }` -- the scope (keystore or Space) the chain roots
+ *   in -- or the literal `'no-revocation-scope'` when the verified target has
+ *   no scope a revocation could be stored under (a create/consent
+ *   verification for a not-yet-existing resource, or a collection-level root
+ *   like `/kms/keystores`).
+ * @param [options.maxChainLength] {number}   max delegation chain length,
+ *   root included (see `verifyZcap`)
+ * @param [options.maxDelegationTtl] {number}   max delegated-zcap TTL in
+ *   milliseconds (see `verifyZcap`)
+ * @returns {Promise<VerifyCapabilityInvocationResult>}   the successful
+ *   verification result (callers needing the dereferenced chain, e.g. the
+ *   per-key `maxCapabilityChainLength` gate, read it from here)
+ */
+export async function handleZcapVerify({ url, allowedTarget, allowedAction, method, headers, serverUrl, spaceController, requestName = '', logger = console, allowTargetQuery = false, allowTargetAttenuation = false, attenuatedRootTarget, revocation, maxChainLength, maxDelegationTtl }) {
+    const inspectCapabilityChain = revocation === 'no-revocation-scope'
+        ? undefined
+        : revocationChainInspector(revocation);
+    let zcapVerifyResult;
+    try {
+        zcapVerifyResult = await verifyZcap({
+            url,
+            allowedTarget,
+            allowedAction,
+            method,
+            headers,
+            serverUrl,
+            spaceController,
+            allowTargetQuery,
+            allowTargetAttenuation,
+            attenuatedRootTarget,
+            inspectCapabilityChain,
+            maxChainLength,
+            maxDelegationTtl
+        });
+    }
+    catch (err) {
+        logger.error({ err }, 'ZCAP verification failed');
+        throw new AuthVerificationError({ requestName, cause: err });
+    }
+    if (!zcapVerifyResult.verified) {
+        throw new UnauthorizedError({ requestName });
+    }
+    return zcapVerifyResult;
+}
+/**
+ * Performs the underlying capability-invocation verification: builds a document
+ * loader whose `urn` protocol handler synthesizes the root capability on demand
+ * (its controller is the Space controller), then calls
+ * verifyCapabilityInvocation().
+ *
+ * @param options {object}
+ * @param options.url {string}   request URL (path), resolved against serverUrl
+ * @param options.allowedTarget {string}   expected invocationTarget (full URL)
+ * @param options.allowedAction {string}   expected action, e.g. an HTTP verb
+ * @param options.method {string}   the HTTP method of the request
+ * @param options.headers {IncomingHttpHeaders}   the request headers
+ * @param options.serverUrl {string}   this server's base URL
+ * @param options.spaceController {IDID}   the did:key that controls the Space
+ * @param [options.allowTargetQuery] {boolean}   when set, accept a request URL
+ *   that adds query parameters to `allowedTarget` (e.g. List Collection's
+ *   `?limit`/`cursor`) as authorized by a capability for the bare target. The
+ *   spec requires that pagination parameters select a page within an
+ *   already-authorized target without changing the target a capability must
+ *   match. The zcap library otherwise requires the capability's
+ *   `invocationTarget` to equal the full request URL exactly, so this enables
+ *   target attenuation (the library treats a `?`-query suffix as a valid RESTful
+ *   attenuation) and admits both the bare-target root capability (a delegate
+ *   following `next`) and the query-bearing one (a controller invoking the URL
+ *   directly). The actual gate -- the bare-target root capability -- is
+ *   unchanged. (TODO: the `/quotas` endpoint should adopt this too, so its
+ *   per-Collection breakdown can return to the spec's `?include=collections`
+ *   opt-in.)
+ * @param [options.allowTargetAttenuation] {boolean}   when set, accept a
+ *   request URL that *path*-extends `allowedTarget` (e.g. a WebKMS key
+ *   operation posted to `<keystoreId>/keys/<keyId>` under a capability rooted
+ *   at the keystore). The root capability is `allowedTarget`'s alone -- unlike
+ *   `allowTargetQuery`, the extended URL is never itself an acceptable root --
+ *   so both a root invocation by the controller and a delegated zcap whose
+ *   `invocationTarget` narrows down to the request URL verify against the
+ *   `allowedTarget` root (the webkms authorization model, which roots the
+ *   invocation target at the keystore id).
+ * @param [options.attenuatedRootTarget] {string}   when set, an *ancestor*
+ *   invocation target (the Space URL for the WAS route families) whose root
+ *   capability is accepted -- in addition to `allowedTarget`'s own -- as the
+ *   root of the invocation. This is what lets a controller delegate one
+ *   capability for a whole Space (or a Collection under it, by attenuating
+ *   the `invocationTarget` down at delegation time) and have the delegate
+ *   invoke it against any URL underneath: the chain roots at the ancestor's
+ *   root capability and narrows toward the request URL (RESTful attenuation,
+ *   the same shape `allowTargetAttenuation` gives the WebKMS keystore).
+ *   Root invocations of `allowedTarget`'s own root capability verify
+ *   unchanged, so this only widens what the Space controller can delegate,
+ *   never who can access.
+ * @param [options.inspectCapabilityChain] {InspectCapabilityChain}   hook run
+ *   against the dereferenced chain after signature verification -- the
+ *   revocation-check extension point (a stored revocation of any capability
+ *   in the chain fails the verification). Both route families pass one, scoped
+ *   to the keystore or the Space the request roots in.
+ * @param [options.maxChainLength] {number}   max delegation chain length,
+ *   root included (the `/kms` families pass `KMS_MAX_CHAIN_LENGTH`; absent,
+ *   the zcap library's own default applies)
+ * @param [options.maxDelegationTtl] {number}   max delegated-zcap TTL in
+ *   milliseconds, measured `expires` minus the delegation proof's `created`
+ *   (the `/kms` families pass `KMS_MAX_DELEGATION_TTL`; absent, unbounded)
+ * @returns {Promise<VerifyCapabilityInvocationResult>}
+ */
+export async function verifyZcap({ url, allowedTarget, allowedAction, method, headers, serverUrl, spaceController, allowTargetQuery = false, allowTargetAttenuation = false, attenuatedRootTarget, inspectCapabilityChain, maxChainLength, maxDelegationTtl }) {
+    const fullRequestUrl = new URL(url, serverUrl).toString();
+    let expected;
+    if (allowTargetQuery || attenuatedRootTarget) {
+        // The acceptable roots: the ancestor's root capability (a delegated chain
+        // rooted at e.g. the Space URL, narrowing to the request URL), the
+        // `allowedTarget`'s own (a root invocation, or a delegated chain for the
+        // exact target -- the pre-existing shapes, unchanged), and, under
+        // `allowTargetQuery`, the query-bearing request URL's own (a controller
+        // invoking the query URL directly).
+        const rootTargets = [
+            ...(attenuatedRootTarget ? [attenuatedRootTarget] : []),
+            allowedTarget,
+            ...(allowTargetQuery ? [fullRequestUrl] : [])
+        ];
+        expected = {
+            expectedAction: allowedAction,
+            expectedHost: new URL(serverUrl).host,
+            expectedRootCapability: [...new Set(rootTargets.map(rootCapabilityId))],
+            // The proof's invocationTarget is the invoked URL: `allowedTarget`
+            // itself, or (under `allowTargetQuery`) the query-bearing request URL.
+            // The array form is narrowed to `string` by the verify fork's option
+            // type, but the underlying `@interop/zcap` CapabilityInvocation
+            // accepts `string | string[]` -- hence the cast.
+            expectedTarget: [
+                ...new Set([allowedTarget, fullRequestUrl])
+            ],
+            allowTargetAttenuation: true
+        };
+    }
+    else if (allowTargetAttenuation) {
+        expected = {
+            expectedAction: allowedAction,
+            expectedHost: new URL(serverUrl).host,
+            // The proof's invocationTarget is the invoked URL: `allowedTarget`
+            // itself, or a path under it (accepted as a RESTful attenuation).
+            // The only acceptable root capability is `allowedTarget`'s. (Same
+            // array-form cast as above.)
+            expectedRootCapability: rootCapabilityId(allowedTarget),
+            expectedTarget: [
+                ...new Set([allowedTarget, fullRequestUrl])
+            ],
+            allowTargetAttenuation: true
+        };
+    }
+    else {
+        expected = {
+            expectedAction: allowedAction,
+            expectedHost: new URL(serverUrl).host,
+            rootInvocationTarget: allowedTarget,
+            expectedRootCapability: rootCapabilityId(allowedTarget),
+            expectedTarget: allowedTarget
+        };
+    }
+    const documentLoader = rootCapabilityLoader({
+        controllerFor: () => spaceController
+    });
+    // Returns the following object:
+    // {
+    //     capability, capabilityAction, controller,
+    //     dereferencedChain,
+    //     invoker: controller,
+    //     verificationMethod,
+    //     verified: true
+    //   }
+    return await verifyCapabilityInvocation({
+        url: fullRequestUrl,
+        method,
+        headers: headers,
+        ...expected,
+        documentLoader,
+        getVerifier,
+        inspectCapabilityChain,
+        maxChainLength,
+        maxDelegationTtl,
+        suite: new Ed25519Signature2020()
+    });
+}
+/**
+ * Extracts the controller DIDs of one capability (`controller` may be a
+ * single value or an array on a synthesized root).
+ * @param capability {object}   a capability from a dereferenced chain
+ * @returns {string[]}
+ */
+function capabilityControllers(capability) {
+    const { controller } = capability;
+    if (controller === undefined) {
+        return [];
+    }
+    return Array.isArray(controller) ? controller : [controller];
+}
+/**
+ * Verifies the delegation chain of a capability submitted for revocation
+ * (`CapabilityDelegation` proof purpose over the embedded chain), throwing
+ * `InvalidRevocationError` (400) when it does not verify. The chain must root
+ * in the revocation's scope: its root capability's invocation target must be
+ * `rootTarget` -- the keystore URL, or the Space URL for a WAS-route
+ * revocation -- or a path under it (enforced where the root is synthesized,
+ * so a chain aimed at another keystore or Space -- or another service --
+ * cannot be submitted here, per ezcap-express `authorizeZcapRevocation`).
+ * Deliberately structural only -- it does NOT consult the revocation store:
+ * this runs before the invocation is authorized, and a store-dependent
+ * failure here would disclose revocation state to unauthorized callers
+ * (400 already-revoked vs the masked 404). The caller checks the returned
+ * `capabilities` against the store after authorization.
+ *
+ * @param options {object}
+ * @param options.capability {object}   the delegated capability to be revoked
+ *   (the request body, verbatim)
+ * @param options.rootTarget {string}   the scope's full URL -- the keystore or
+ *   the Space -- which the chain is required to root in
+ * @param options.rootController {IDID}   the scope's controller (controller of
+ *   the synthesized root capability)
+ * @param [options.maxChainLength] {number}   max chain length, root included
+ * @param [options.maxDelegationTtl] {number}   max delegated-zcap TTL (ms)
+ * @returns {Promise<{ delegator: string, chainControllers: string[],
+ *   capabilities: CapabilitySummary[] }>}   the capability's delegator (its
+ *   delegation proof's controller), every controller in its chain (the
+ *   parties allowed to submit the revocation), and the chain's
+ *   `(capabilityId, delegator)` pairs for the caller's post-authorization
+ *   revocation-store check
+ */
+export async function verifyRevocationChain({ capability, rootTarget, rootController, maxChainLength, maxDelegationTtl }) {
+    const chainControllers = [];
+    let capabilities = [];
+    const documentLoader = rootCapabilityLoader({
+        controllerFor: target => {
+            if (target !== rootTarget && !target.startsWith(`${rootTarget}/`)) {
+                throw new Error(`The root capability from the revocation's delegation chain must` +
+                    ` have an invocation target that starts with "${rootTarget}".`);
+            }
+            return rootController;
+        }
+    });
+    const suite = new Ed25519Signature2020();
+    const result = (await jsigs.verify(capability, {
+        documentLoader,
+        suite,
+        purpose: new CapabilityDelegation({
+            suite,
+            expectedRootCapability: rootCapabilityId(rootTarget),
+            // Attenuation is always tolerated when judging revocability: a zcap
+            // delegated with attenuation rules an invocation endpoint would refuse
+            // can still be revoked (ezcap-express `_verifyDelegation`).
+            allowTargetAttenuation: true,
+            maxChainLength,
+            maxDelegationTtl,
+            inspectCapabilityChain: async (details) => {
+                // Capture every controller in the dereferenced chain -- these are the
+                // parties the dual-root rule lets submit this revocation -- and the
+                // chain's lookup pairs for the caller's post-authorization store check.
+                for (const chainCapability of details.capabilityChain) {
+                    chainControllers.push(...capabilityControllers(chainCapability));
+                }
+                capabilities = capabilitySummaries(details);
+                return { valid: true };
+            }
+        })
+    }));
+    if (!result.verified) {
+        throw new InvalidRevocationError({
+            detail: 'The provided capability delegation is invalid.',
+            cause: result.error
+        });
+    }
+    const rawDelegator = result.results?.[0]?.purposeResult?.delegator;
+    const delegator = typeof rawDelegator === 'string' ? rawDelegator : rawDelegator?.id;
+    if (!delegator) {
+        throw new InvalidRevocationError({
+            detail: 'The capability delegation has no identifiable delegator.'
+        });
+    }
+    return { delegator, chainControllers, capabilities };
+}
+/**
+ * Verifies the capability invocation on a revocation submission under the
+ * dual-root rule: the invocation may root in the scope -- the keystore or the
+ * Space -- (whose controller may revoke anything delegated from it, delegates
+ * of a revocation capability included, via target attenuation), or in the
+ * revocation URL itself, whose
+ * synthesized root capability is controlled by *every controller in the
+ * to-be-revoked capability's chain* -- so a delegee can revoke its own zcap
+ * without holding a separate capability (ezcap-express
+ * `authorizeZcapRevocation`). Throws like `handleZcapVerify`:
+ * `AuthVerificationError` (400) when verification errors, the 404-masked
+ * `UnauthorizedError` when the invocation does not verify.
+ *
+ * @param options {object}
+ * @param options.url {string}   request URL (path), resolved against serverUrl
+ * @param options.method {string}   the HTTP method of the request
+ * @param options.headers {IncomingHttpHeaders}   the request headers
+ * @param options.serverUrl {string}   this server's base URL
+ * @param options.rootTarget {string}   the scope's full URL (the keystore or
+ *   the Space)
+ * @param options.rootController {IDID}   the scope's controller
+ * @param options.chainControllers {string[]}   every controller in the
+ *   to-be-revoked capability's (already verified) chain
+ * @param options.expectedAction {string}   the action the invocation must
+ *   carry: the webkms `write` on `/kms`, the HTTP verb (`POST`) on the WAS
+ *   route families, whose capabilities are scoped by HTTP method
+ * @param [options.inspectCapabilityChain] {InspectCapabilityChain}   the
+ *   revocation-store hook, run against the *invoking* chain
+ * @param [options.maxChainLength] {number}   max chain length, root included
+ * @param [options.maxDelegationTtl] {number}   max delegated-zcap TTL (ms)
+ * @param [options.requestName] {string}   request name used in error titles
+ * @param [options.logger] {ZcapLogger}   logger for verification errors
+ * @returns {Promise<void>}
+ */
+export async function handleRevocationInvocationVerify({ url, method, headers, serverUrl, rootTarget, rootController, chainControllers, expectedAction, inspectCapabilityChain, maxChainLength, maxDelegationTtl, requestName = '', logger = console }) {
+    const fullRequestUrl = new URL(url, serverUrl).toString();
+    const documentLoader = rootCapabilityLoader({
+        controllerFor: target => {
+            if (target === rootTarget) {
+                return rootController;
+            }
+            if (target === fullRequestUrl) {
+                return chainControllers;
+            }
+            throw new Error(`Unexpected root capability target "${target}" on a revocation.`);
+        }
+    });
+    let zcapVerifyResult;
+    try {
+        zcapVerifyResult = await verifyCapabilityInvocation({
+            url: fullRequestUrl,
+            method,
+            headers: headers,
+            expectedAction,
+            expectedHost: new URL(serverUrl).host,
+            expectedRootCapability: [
+                rootCapabilityId(rootTarget),
+                rootCapabilityId(fullRequestUrl)
+            ],
+            // The invoked target is the revocation URL, a path under the scope's
+            // root; accept either as a delegated zcap's (attenuated) target. The
+            // array form is narrowed to `string` by the verify fork's option type
+            // (see the same cast in `verifyZcap`'s attenuation branch).
+            expectedTarget: [rootTarget, fullRequestUrl],
+            allowTargetAttenuation: true,
+            documentLoader,
+            getVerifier,
+            inspectCapabilityChain,
+            maxChainLength,
+            maxDelegationTtl,
+            suite: new Ed25519Signature2020()
+        });
+    }
+    catch (err) {
+        logger.error({ err }, 'ZCAP revocation invocation verification failed');
+        throw new AuthVerificationError({ requestName, cause: err });
+    }
+    if (!zcapVerifyResult.verified) {
+        throw new UnauthorizedError({ requestName });
+    }
+}
+//# sourceMappingURL=zcap.js.map

package/dist/zcap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../src/zcap.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAClE,OAAO,EACL,0BAA0B,EAE3B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,MAAM,4BAA4B,CAAA;AAC9C,OAAO,EACL,oBAAoB,EAErB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,KAAK,MAAM,MAAM,yBAAyB,CAAA;AAEjD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACzB,MAAM,sBAAsB,CAAA;AAS7B,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;AACpC,YAAY,CAAC,GAAG,CAAC;IACf,uBAAuB,EAAE,MAAM;IAC/B,aAAa,EAAE,sBAAsB,CAAC,IAAI;CAC3C,CAAC,CAAA;AAEF;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,EAC5B,aAAa,EAGd;IACC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/B,MAAM,CAAC,kBAAkB,CAAC;QACxB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE;YACP,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAgC,EAAE,EAAE;gBACvD,MAAM,WAAW,GAAG,GAAG,IAAI,EAAE,CAAA;gBAC7B,MAAM,cAAc,GAAG,kBAAkB,CACvC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAE,CACxC,CAAA;gBACD,OAAO;oBACL,UAAU,EAAE,0BAA0B;oBACtC,EAAE,EAAE,WAAW;oBACf,gBAAgB,EAAE,cAAc;oBAChC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC;iBAC1C,CAAA;YACH,CAAC;SACF;KACF,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,KAAK,EAAE,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,EAAE,KAAK,EAAqB;IACrD,MAAM,kBAAkB,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAC3C,kBAAgC,CACjC,CAAA;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC/B,OAAO;QACL,QAAQ;QACR,kBAAkB,EAAE,kBAAyC;KAC9D,CAAA;AACH,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,UAAU,EAGX;IACC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,aAAa,EACb,aAAa,EACb,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,EACf,WAAW,GAAG,EAAE,EAChB,MAAM,GAAG,OAAO,EAChB,gBAAgB,GAAG,KAAK,EACxB,sBAAsB,GAAG,KAAK,EAC9B,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,gBAAgB,EAkBjB;IACC,MAAM,sBAAsB,GAC1B,UAAU,KAAK,qBAAqB;QAClC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,UAAU,CAAC;YAClC,GAAG;YACH,aAAa;YACb,aAAa;YACb,MAAM;YACN,OAAO;YACP,SAAS;YACT,eAAe;YACf,gBAAgB;YAChB,sBAAsB;YACtB,oBAAoB;YACpB,sBAAsB;YACtB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAA;QACjD,MAAM,IAAI,qBAAqB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAC/B,GAAG,EACH,aAAa,EACb,aAAa,EACb,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,EACf,gBAAgB,GAAG,KAAK,EACxB,sBAAsB,GAAG,KAAK,EAC9B,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAejB;IACC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;IACzD,IAAI,QAAQ,CAAA;IACZ,IAAI,gBAAgB,IAAI,oBAAoB,EAAE,CAAC;QAC7C,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,kEAAkE;QAClE,wEAAwE;QACxE,oCAAoC;QACpC,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,aAAa;YACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAA;QACD,QAAQ,GAAG;YACT,cAAc,EAAE,aAAa;YAC7B,YAAY,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI;YACrC,sBAAsB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACvE,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,gEAAgE;YAChE,iDAAiD;YACjD,cAAc,EAAE;gBACd,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;aACvB;YACtB,sBAAsB,EAAE,IAAI;SAC7B,CAAA;IACH,CAAC;SAAM,IAAI,sBAAsB,EAAE,CAAC;QAClC,QAAQ,GAAG;YACT,cAAc,EAAE,aAAa;YAC7B,YAAY,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI;YACrC,mEAAmE;YACnE,kEAAkE;YAClE,kEAAkE;YAClE,6BAA6B;YAC7B,sBAAsB,EAAE,gBAAgB,CAAC,aAAa,CAAC;YACvD,cAAc,EAAE;gBACd,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;aACvB;YACtB,sBAAsB,EAAE,IAAI;SAC7B,CAAA;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG;YACT,cAAc,EAAE,aAAa;YAC7B,YAAY,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI;YACrC,oBAAoB,EAAE,aAAa;YACnC,sBAAsB,EAAE,gBAAgB,CAAC,aAAa,CAAC;YACvD,cAAc,EAAE,aAAa;SAC9B,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,aAAa,EAAE,GAAG,EAAE,CAAC,eAAe;KACrC,CAAC,CAAA;IAEF,gCAAgC;IAChC,IAAI;IACJ,gDAAgD;IAChD,yBAAyB;IACzB,2BAA2B;IAC3B,0BAA0B;IAC1B,qBAAqB;IACrB,MAAM;IACN,OAAO,MAAM,0BAA0B,CAAC;QACtC,GAAG,EAAE,cAAc;QACnB,MAAM;QACN,OAAO,EAAE,OAAiC;QAC1C,GAAG,QAAQ;QACX,cAAc;QACd,WAAW;QACX,sBAAsB;QACtB,cAAc;QACd,gBAAgB;QAChB,KAAK,EAAE,IAAI,oBAAoB,EAAE;KAClC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,UAE9B;IACC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAA;IACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,gBAAgB,EAOjB;IAKC,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,IAAI,YAAY,GAAwB,EAAE,CAAA;IAC1C,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,aAAa,EAAE,MAAM,CAAC,EAAE;YACtB,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CACb,iEAAiE;oBAC/D,gDAAgD,UAAU,IAAI,CACjE,CAAA;YACH,CAAC;YACD,OAAO,cAAc,CAAA;QACvB,CAAC;KACF,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE;QAC7C,cAAc;QACd,KAAK;QACL,OAAO,EAAE,IAAI,oBAAoB,CAAC;YAChC,KAAK;YACL,sBAAsB,EAAE,gBAAgB,CAAC,UAAU,CAAC;YACpD,oEAAoE;YACpE,uEAAuE;YACvE,4DAA4D;YAC5D,sBAAsB,EAAE,IAAI;YAC5B,cAAc;YACd,gBAAgB;YAChB,sBAAsB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACtC,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;oBACtD,gBAAgB,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAA;gBAClE,CAAC;gBACD,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;gBAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACxB,CAAC;SACF,CAAC;KACH,CAAC,CAMD,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,sBAAsB,CAAC;YAC/B,MAAM,EAAE,gDAAgD;YACxD,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAA;IAClE,MAAM,SAAS,GACb,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,EAAE,EAAE,CAAA;IACpE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAAC;YAC/B,MAAM,EAAE,0DAA0D;SACnE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,EACrD,GAAG,EACH,MAAM,EACN,OAAO,EACP,SAAS,EACT,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,WAAW,GAAG,EAAE,EAChB,MAAM,GAAG,OAAO,EAejB;IACC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;IACzD,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,aAAa,EAAE,MAAM,CAAC,EAAE;YACtB,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,OAAO,cAAc,CAAA;YACvB,CAAC;YACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC9B,OAAO,gBAAgB,CAAA;YACzB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,MAAM,oBAAoB,CACjE,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,0BAA0B,CAAC;YAClD,GAAG,EAAE,cAAc;YACnB,MAAM;YACN,OAAO,EAAE,OAAiC;YAC1C,cAAc;YACd,YAAY,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI;YACrC,sBAAsB,EAAE;gBACtB,gBAAgB,CAAC,UAAU,CAAC;gBAC5B,gBAAgB,CAAC,cAAc,CAAC;aACjC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,4DAA4D;YAC5D,cAAc,EAAE,CAAC,UAAU,EAAE,cAAc,CAAsB;YACjE,sBAAsB,EAAE,IAAI;YAC5B,cAAc;YACd,WAAW;YACX,sBAAsB;YACtB,cAAc;YACd,gBAAgB;YAChB,KAAK,EAAE,IAAI,oBAAoB,EAAE;SAClC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,gDAAgD,CAAC,CAAA;QACvE,MAAM,IAAI,qBAAqB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,109 @@
+{
+  "name": "was-teaching-server",
+  "description": "A basic Wallet Attached Storage server used to demonstrate the WAS specification.",
+  "version": "0.9.1",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "common",
+    "src",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "dev": "tsx watch src/start.js",
+    "start": "node dist/start.js | pino-pretty",
+    "build": "pnpm run clear && tsc && pnpm run copy-assets",
+    "clear": "rimraf dist/*",
+    "copy-assets": "node -e \"require('node:fs').cpSync('src/views','dist/views',{recursive:true})\"",
+    "rebuild": "pnpm run clear && pnpm run build",
+    "lint": "eslint src test conformance",
+    "lint:tests": "tsc -p tsconfig.dev.json",
+    "fix": "eslint --fix src test conformance && pnpm run format",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\" \"conformance/**/*.ts\" \"*.md\"",
+    "test-node": "vitest run",
+    "test:pg": "WAS_TEST_DATABASE_URL=postgres://was:was@localhost:5433/was vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test": "pnpm run fix && pnpm run lint && pnpm run lint:tests && pnpm run build && pnpm run test-node",
+    "conformance": "tsx --test conformance/*.test.ts",
+    "conformance:local": "tsx scripts/conformance-local.ts",
+    "reencrypt-kms-records": "tsx scripts/reencrypt-kms-records.ts"
+  },
+  "dependencies": {
+    "@digitalcredentials/bnid": "^5.0.0",
+    "@fastify/cors": "^11.2.0",
+    "@fastify/multipart": "^10.0.0",
+    "@fastify/static": "^9.1.3",
+    "@fastify/view": "^12.0.0",
+    "@interop/data-integrity-core": "^8.2.0",
+    "@interop/did-method-key": "^7.3.3",
+    "@interop/ed25519-signature": "^7.1.3",
+    "@interop/ed25519-verification-key": "^8.0.2",
+    "@interop/http-digest-header": "^3.0.0",
+    "@interop/http-signature-header": "^5.0.2",
+    "@interop/http-signature-zcap-verify": "^12.1.1",
+    "@interop/jsonld-signatures": "^11.8.2",
+    "@interop/lru-memoize": "^4.0.3",
+    "@interop/security-document-loader": "^9.4.1",
+    "@interop/storage-core": "^0.3.4",
+    "@interop/x25519-key-agreement-key": "^5.2.0",
+    "@interop/zcap": "^11.0.4",
+    "fastify": "^5.8.5",
+    "fastify-plugin": "^6.0.0",
+    "fs-json-store": "^8.0.1",
+    "handlebars": "^4.7.9",
+    "mime-types": "^3.0.2",
+    "pg": "^8.22.0",
+    "pino": "^10.3.1",
+    "pino-pretty": "^13.1.3",
+    "tar-stream": "^3.2.0",
+    "undici": "7.28.0",
+    "uuid": "^14.0.0",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@interop/ezcap": "^7.3.2",
+    "@interop/http-signature-zcap-invoke": "^6.2.3",
+    "@interop/was-client": "^0.14.2",
+    "@interop/webkms-client": "^14.7.1",
+    "@types/mime-types": "3.0.1",
+    "@types/node": "^24.0.0",
+    "@types/pg": "^8.20.0",
+    "@types/tar-stream": "3.1.4",
+    "@vitest/coverage-v8": "^4.1.7",
+    "eslint": "^10.4.0",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^17.6.0",
+    "prettier": "^3.8.3",
+    "rimraf": "^6.1.3",
+    "tsx": "^4.20.3",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.59.4",
+    "vitest": "^4.1.7"
+  },
+  "type": "module",
+  "bin": {},
+  "packageManager": "pnpm@11.5.0",
+  "engines": {
+    "node": ">=24.0"
+  },
+  "author": {
+    "name": "Dmitri Zagidulin",
+    "url": "https://github.com/dmitrizagidulin/"
+  },
+  "license": "AGPL-3.0-or-later",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/interop-alliance/was-teaching-server"
+  },
+  "homepage": "https://github.com/interop-alliance/was-teaching-server",
+  "bugs": "https://github.com/interop-alliance/was-teaching-server/issues"
+}