msgctl 0.1.0a1__py3-none-any.whl

msg/plugins/custodial_lifecycle.py

@@ -0,0 +1,224 @@
+"""Owner-signed transitions for an existing custodial upgrade operation."""
+from __future__ import annotations
+
+import hmac
+from dataclasses import replace
+
+from msg.core.codec import b64, canonical, decode, digest, loads, parse_time, unb64, wire
+from msg.core.errors import require
+from msg.core.models import AuditEvent, Credential, Event, HandlerOutput, ResourceRef, Signature
+from msg.plugins.common import create_resource, new_id
+from msg.security.age_keys import public_from_recipient
+from msg.security.crypto import verify
+from msg.security.custodial_migration import (ordered, owned_age_inventory, output_refs,
+                                            snapshot, stage_statement)
+from msg.security.vault import open_signer, seal_retired_encryption_key, server_upgrade_proof
+
+
+def activate_encryption_target(tx, subject, challenge, details, now):
+    """After both possession proofs, new writes must no longer target the vault key."""
+    key = details['new_encryption_key_id']
+    current = tx.one('SELECT key_id FROM encryption_subkeys WHERE subject=? AND is_primary=1', (subject,))
+    if current == (key,):
+        return
+    require(current == (details['old_encryption_key_id'],), 'custodial_encryption_target_changed')
+    tx.execute('UPDATE encryption_subkeys SET is_primary=0,retired_at=? WHERE subject=? AND is_primary=1',
+               (wire(now), subject), write=True)
+    tx.execute('INSERT INTO encryption_subkeys VALUES (?,?,?,?,?,?,?)',
+        (key, subject, challenge['encryption_recipient'],
+         b64(public_from_recipient(challenge['encryption_recipient'])), wire(now), None, 1), write=True)
+
+
+async def audit(tx, ctx, request, subject, kind, data, *, before=None):
+    event = Event(id=new_id('audit'), type=kind, time=ctx.now, request_id=request.request_id,
+                  actor=ctx.principal.actor, subject=subject,
+                  resources=(ResourceRef(id=subject),), data=data)
+    await tx.append_audit(AuditEvent(event=event, authority=(ResourceRef(id=subject),),
+        before_digest=digest(before) if before is not None else None, after_digest=digest(data),
+        previous_digest=None, entry_digest='', result='committed'))
+
+
+def authorize_migration(ctx, subject, credential_id, status, details):
+    if subject.kind == 'custodial':
+        require(ctx.principal.method == 'token' and ctx.principal.credential_id == credential_id,
+                'custodial_token_required')
+        require(status in {'pending', 'pending_rewrap'}, 'custodial_upgrade_not_pending')
+    else:
+        require(subject.kind == 'registered' and ctx.principal.method == 'signature' and
+                ctx.principal.credential_id == details['new_identity_key_id'] and status == 'completed',
+                'custodial_upgrade_new_key_required')
+
+
+async def transition(app, ctx, request, tx, subject):
+    args = request.arguments
+    row = tx.one('''SELECT credential_id,status,expires_at,challenge,ephemeral_nonce,
+        ephemeral_ciphertext,body FROM custodial_upgrades WHERE id=? AND subject=?''',
+        (args['challenge_id'], subject.resource_id))
+    require(row is not None, 'custodial_upgrade_not_pending')
+    challenge, details = loads(row[3]), loads(row[6])
+    authorize_migration(ctx, subject, row[0], row[1], details)
+    verify(unb64(challenge['public_key']), canonical(stage_statement(subject.resource_id, args,
+        request.request_id)), decode(Signature, args['migration_ack']), purpose='custodial-decision-v1')
+    if row[1] == 'pending':
+        require(args['action'] == 'refresh' and ctx.now < parse_time(row[2]), 'custodial_upgrade_not_pending_rewrap')
+        expected = server_upgrade_proof(app, subject.resource_id, challenge, row[4], row[5])
+        require(hmac.compare_digest(expected, args['age_proof']), 'age_possession_failed')
+    else:
+        require(hmac.compare_digest(details['age_possession_digest'], digest(args['age_proof'])),
+                'age_possession_failed')
+    state = await snapshot(tx, subject.resource_id, row[1], challenge, details, now=ctx.now)
+    state.require_observation(args)
+    before = digest(details)
+    if args['action'] == 'refresh':
+        # Preserve disappeared history as unresolved work; never delete it from a
+        # manifest just because the source is no longer enumerable.
+        added = state.data['delta']['added']
+        require(added or state.data['delta']['missing'], 'custodial_inventory_unchanged')
+        details['age_inventory'] = ordered(details['age_inventory'] + added)
+        details['inventory_version'] = details.get('inventory_version', 1) + 1
+        source_keys = details.setdefault('source_keys', {})
+        for item in added:
+            key = tx.setting('keystore_key:' + item['revision'], details['old_encryption_key_id'])
+            source_keys[item['revision']] = key
+            if key == details['new_encryption_key_id']:
+                details.setdefault('rewrap_mappings', {})[item['revision']] = {
+                    'old': item, 'new': item, 'old_key_id': key, 'new_key_id': key,
+                    'recipient': challenge['encryption_recipient'], 'copy_kind': 'new_key_write',
+                    'created_at': wire(ctx.now)}
+        details['last_delta'] = dict(state.data['delta'], version=details['inventory_version'])
+        details.pop('resolution', None)
+    elif args['action'] == 'recovery_envelope':
+        state.unchanged()
+        require(row[1] != 'pending', 'custodial_upgrade_not_pending_rewrap')
+        if details.get('recovery_envelope') is None:
+            ciphertext = seal_retired_encryption_key(app, tx, subject.resource_id,
+                details['old_encryption_key_id'], challenge['encryption_recipient'], args['challenge_id'])
+            folder = tx.one("SELECT id FROM resources WHERE parent=? AND name='keystore'", (subject.resource_id,))
+            require(folder is not None, 'keystore_missing')
+            resource = await create_resource(app, ctx, request, tx, parent=folder[0], type='keystore',
+                name='retired-key-' + digest(args['challenge_id'])[7:31] + '.age', body=ciphertext,
+                media_type='application/octet-stream', mode=0o600)
+            tx.set_setting('keystore_format:' + resource.revision, 'age')
+            tx.set_setting('keystore_key:' + resource.revision, details['new_encryption_key_id'])
+            details['recovery_envelope'] = {'subject_id': subject.resource_id,
+                'challenge_id': args['challenge_id'], 'old_key_id': details['old_encryption_key_id'],
+                'new_key_id': details['new_encryption_key_id'], 'recipient': challenge['encryption_recipient'],
+                'purpose': 'retired-encryption-subkey-recovery', 'method': 'compatibility_recovery',
+                'ciphertext': {'id': resource.id, 'revision': resource.revision,
+                               'ciphertext_digest': digest(ciphertext)}}
+    else:
+        require(args['action'] == 'finalize', 'invalid_custodial_transition')
+        resolution = args.get('resolution')
+        if resolution == 'verified' or state.data['delta']['added']:
+            state.unchanged()
+        require(not (row[1]=='completed' and state.data['retirement']['online_encryption_key_deleted']),
+                'custodial_upgrade_already_finalized')
+        unresolved = state.data['unresolved_revisions']
+        require(args.get('reviewed_policy_version') == state.data['recovery_policy_version'],
+                'custodial_recovery_policy_review_required')
+        if resolution == 'verified':
+            require(state.data['history_recoverable'], 'custodial_history_ack_required')
+            require(not args.get('loss_revisions'), 'custodial_loss_scope_mismatch')
+        else:
+            require(resolution in {'accept_loss', 'retain_decrypt'} and args.get('reason'),
+                    'custodial_resolution_required')
+            require(sorted(args.get('loss_revisions', ())) == unresolved,
+                    'custodial_loss_scope_mismatch')
+            if resolution == 'accept_loss':
+                require(bool(unresolved), 'custodial_loss_scope_mismatch')
+        require(resolution == 'retain_decrypt' or args['external_ciphertexts_migrated'],
+                'custodial_external_history_unresolved')
+        details['resolution'] = {'decision': resolution, 'revisions': unresolved,
+            'reason': args.get('reason'), 'inventory_digest': state.inventory_digest,
+            'results_digest': state.data['results_digest'], 'request_id': request.request_id,
+            'signature': wire(args['migration_ack']), 'reviewed_policy_version': args['reviewed_policy_version'],
+            'external_migration': 'owner_declared_unverified' if args['external_ciphertexts_migrated']
+                                  else 'unknown_retained'}
+        details['external_ciphertexts_migrated'] = args['external_ciphertexts_migrated']
+        return await switch_identity(app, ctx, request, tx, subject, challenge, details,
+                                     retain_decrypt=resolution == 'retain_decrypt')
+    tx.execute('UPDATE custodial_upgrades SET body=? WHERE id=?',
+               (canonical(details).decode(), args['challenge_id']), write=True)
+    await audit(tx, ctx, request, subject.resource_id, 'identity.custodial_' + args['action'],
+                {'challenge_id': args['challenge_id'], 'before_digest': before,
+                 'after_digest': digest(details), 'decision_signature': wire(args['migration_ack'])})
+    return HandlerOutput(data=(await snapshot(tx, subject.resource_id, row[1], challenge, details,
+                                              now=ctx.now)).data)
+
+
+async def switch_identity(app, ctx, request, tx, subject, challenge, details, *, retain_decrypt=False):
+    """One SQL transaction: switch identity, revoke tokens, and restrict/delete online keys."""
+    from msg.plugins.identity import issue_online
+    before = digest(details)
+    uid = subject.resource_id
+    new_key = details['new_identity_key_id']
+    switched = subject.kind == 'registered'
+    if not switched:
+        require(subject.kind == 'custodial', 'custodial_token_required')
+        phase = tx.one('SELECT status FROM custodial_upgrades WHERE id=? AND subject=?',
+                       (challenge['challenge_id'], uid))
+        require(phase is not None, 'custodial_upgrade_not_pending')
+        signer = open_signer(app, tx, uid)
+        endorsement = signer.sign(canonical({'subject_id': uid, 'challenge_id': challenge['challenge_id'],
+            'old_identity_key_id': details['old_identity_key_id'], 'new_identity_key_id': new_key,
+            'new_encryption_key_id': details['new_encryption_key_id'],
+            'inventory_digest': (await snapshot(tx, uid, phase[0], challenge, details)).inventory_digest}),
+            purpose='custodial-upgrade')
+        revoked = []
+        for (raw,) in tx.rows('SELECT body FROM credentials WHERE subject=?', (uid,)):
+            credential = decode(Credential, loads(raw))
+            if credential.revoked_at is None and credential.kind in {'token', 'signing_key'}:
+                await tx.save_credential(replace(credential, revoked_at=ctx.now), subject.auth_version)
+                revoked.append(credential.id)
+        credential = Credential(id=new_key, subject_id=uid, kind='signing_key',
+            verifier=unb64(challenge['public_key']), ceiling=app.primary_ceiling(),
+            not_before=ctx.now, expires_at=None, revoked_at=None)
+        await tx.save_credential(credential, subject.auth_version)
+        tx.execute('UPDATE identity_keys SET is_primary=0,retired_at=? WHERE subject=? AND is_primary=1',
+                   (wire(ctx.now), uid), write=True)
+        tx.execute('INSERT INTO identity_keys VALUES (?,?,?,?,?,?)',
+                   (new_key, uid, challenge['public_key'], wire(ctx.now), None, 1), write=True)
+        activate_encryption_target(tx, uid, challenge, details, ctx.now)
+        resource = await tx.resource(uid)
+        await tx.replace(replace(resource, name='@' + challenge['handle'],
+            generation=resource.generation + 1, modified_at=ctx.now, modified_by=ctx.principal.actor),
+            resource.generation)
+        await tx.update_identity(replace(subject, kind='registered', auth_version=subject.auth_version + 1),
+                                 subject.auth_version)
+        certificate = await issue_online(app, tx, uid, new_key, ctx, request,
+            authority_source={'kind': 'custodial_upgrade', 'challenge_id': challenge['challenge_id'],
+                              'new_key_id': new_key})
+        completed = {'status': 'completed', 'subject_id': uid, 'identity_key_id': new_key,
+            'encryption_key_id': details['new_encryption_key_id'],
+            'encryption_recipient': challenge['encryption_recipient'],
+            'certificate_id': certificate.resource_id, 'previous_credential': ctx.principal.credential_id,
+            'credential_id': new_key, 'signature_source': 'custodial'}
+        await audit(tx, ctx, request, uid, 'identity.custodial_tokens_revoked',
+            {'challenge_id': challenge['challenge_id'], 'credentials': revoked,
+             'new_key_id': new_key, 'old_key_endorsement': wire(endorsement)})
+    else:
+        completed = dict(details['completed_result'])
+    if retain_decrypt:
+        tx.execute('''UPDATE custodial_vault SET status='decrypt_only',signing_nonce=NULL,
+            signing_ciphertext=NULL WHERE subject=?''', (uid,), write=True)
+    else:
+        tx.execute('''UPDATE custodial_vault SET status='destroyed',signing_nonce=NULL,
+            signing_ciphertext=NULL,age_nonce=NULL,age_ciphertext=NULL,destroyed_at=? WHERE subject=?''',
+            (wire(ctx.now), uid), write=True)
+    current = await snapshot(tx, uid, 'completed', challenge, details, now=ctx.now)
+    completed.update(completion_scope='identity_switch_only', phase=current.data['phase'],
+        history_recoverable=current.data['history_recoverable'],
+        verification_scope=current.data['verification_scope'],
+        server_tracked_age_revisions=len(details['age_inventory']), vault_destroyed=not retain_decrypt,
+        external_migration='owner_declared_unverified', external_ciphertexts_verified=False,
+        retirement=current.data['retirement'], resolution=details.get('resolution'),
+        challenge_id=challenge['challenge_id'], finalization_request_id=request.request_id)
+    details['completed_result'] = completed
+    tx.execute('''UPDATE custodial_upgrades SET status='completed',ephemeral_nonce=NULL,
+        ephemeral_ciphertext=NULL,body=? WHERE id=?''',
+        (canonical(details).decode(), challenge['challenge_id']), write=True)
+    await audit(tx, ctx, request, uid, 'identity.custodial_online_key_retirement',
+        {'challenge_id': challenge['challenge_id'], 'old_identity_key_id': details['old_identity_key_id'],
+         'old_encryption_key_id': details['old_encryption_key_id'], 'retirement': current.data['retirement'],
+         'resolution': details.get('resolution'), 'before_digest': before})
+    return HandlerOutput(resources=(ResourceRef(id=uid),), data=completed)

msg/plugins/delivery.py

@@ -0,0 +1,230 @@
+"""Buyer-only in-site delivery of an immutable managed package.
+
+The versioned checkout can prepare a package atomically. A signed acceptance
+or an explicit, digest-bound checkout policy controls settlement; merely reading
+or sending an email never claims a delivery.
+"""
+from __future__ import annotations
+
+from functools import partial
+
+from msg.core.codec import b64, canonical, decode, digest, loads, wire
+from msg.core.errors import require
+from msg.core.models import BlobRef, HandlerOutput
+from msg.plugins.common import new_id, registration
+from msg.plugins.money import CURRENCY_ID, _balance, account_requirements
+from msg.market.escrow import EscrowEngine
+from msg.market.delivery_targets import validate_target
+from msg.plugins.orders import _row as order_row, _subject
+from msg.plugins.schemas import IDENTIFIER, obj
+from msg.plugins.store import _package_row
+
+
+MAX_INLINE_BYTES = 1024 * 1024
+_COLUMNS = ('id', 'order_id', 'recipient_subject', 'kind', 'payload_refs',
+            'manifest', 'package_digest', 'delivery_digest', 'channel',
+            'state', 'prepared_at', 'claimed_at', 'receipt')
+
+
+def _delivery(tx, order_id):
+    row = tx.one('''SELECT id,order_id,recipient_subject,kind,payload_refs,
+        manifest,package_digest,delivery_digest,channel,state,prepared_at,
+        claimed_at,receipt FROM store_deliveries WHERE order_id=?''', (order_id,))
+    if row is None:
+        return None
+    result = dict(zip(_COLUMNS, row))
+    result['payload_refs'] = loads(result['payload_refs'])
+    result['manifest'] = loads(result['manifest'])
+    result['receipt'] = loads(result['receipt']) if result['receipt'] else None
+    return result
+
+
+def _buyer_order(tx, order_id, buyer):
+    row = order_row(tx, order_id, buyer)
+    require(row['buyer'] == buyer, 'order_not_found')
+    return row
+
+
+async def _verified_delivery(app, tx, order, delivery):
+    validate_target(order, delivery)
+    require(delivery is not None and
+            delivery['recipient_subject'] == order['buyer'] and
+            delivery['package_digest'] == order['package_digest'] and
+            delivery['channel'] == 'site', 'delivery_mismatch')
+    kind, manifest, refs = await _package(app, tx, order)
+    body = {'delivery_id': delivery['id'], 'order_id': order['id'],
+            'recipient_subject': order['buyer'], 'kind': kind,
+            'manifest': manifest, 'payload_refs': refs,
+            'package_digest': order['package_digest'], 'channel': 'site'}
+    require(delivery['kind'] == kind and delivery['manifest'] == manifest and
+            delivery['payload_refs'] == refs and
+            delivery['delivery_digest'] == digest(body), 'delivery_mismatch')
+
+
+async def _package(app, tx, order):
+    require(order['package_id'] and order['package_revision'] and
+            order['package_digest'], 'delivery_package_mismatch')
+    row = await _package_row(tx, order['package_id'])
+    require(row is not None and row[1] == order['listing_id'] and
+            row[3] == order['seller'] and row[4] == order['package_revision'] and
+            row[8] == order['package_digest'] and row[10] == 'managed_instant' and
+            row[5] in {'file', 'bundle'}, 'delivery_package_mismatch')
+    manifest, refs = loads(row[6]), loads(row[7])
+    snapshot = {'seller': row[3], 'listing_id': row[1],
+                'listing_revision': row[2], 'revision': row[4], 'kind': row[5],
+                'manifest': manifest, 'payload_refs': refs,
+                'total_size': row[9], 'delivery_mode': row[10]}
+    require(digest(snapshot) == order['package_digest'] and
+            row[9] <= MAX_INLINE_BYTES and row[9] >= 0,
+            'delivery_package_mismatch')
+    require(refs and (row[5] == 'bundle' or len(refs) == 1),
+            'delivery_package_mismatch')
+    total = 0
+    for ref in refs:
+        require(isinstance(ref, dict) and isinstance(ref.get('blob'), dict),
+                'delivery_package_mismatch')
+        blob = decode(BlobRef, ref['blob'])
+        require(blob.size >= 0 and blob.size <= MAX_INLINE_BYTES,
+                'delivery_package_mismatch')
+        data = await app.contents.read_bytes(blob, limit=MAX_INLINE_BYTES)
+        require(len(data) == blob.size and digest(data) == blob.digest,
+                'delivery_package_mismatch')
+        total += blob.size
+    require(total == row[9], 'delivery_package_mismatch')
+    return row[5], manifest, refs
+
+
+async def _payload(app, delivery):
+    files = []
+    for ref in delivery['payload_refs']:
+        blob = decode(BlobRef, ref['blob'])
+        data = await app.contents.read_bytes(blob, limit=MAX_INLINE_BYTES)
+        require(len(data) == blob.size and digest(data) == blob.digest,
+                'delivery_package_mismatch')
+        files.append({'id': ref['id'], 'revision': ref['revision'],
+                      'media_type': blob.media_type, 'digest': blob.digest,
+                      'size': blob.size, 'data': b64(data)})
+    return files
+
+
+async def prepare_managed(app, ctx, tx, order):
+    """Prepare inside the caller's transaction; never authenticate or commit here."""
+    buyer = order['buyer']
+    require(order['state'] == 'funded' and order['delivered_at'] is None,
+            'order_not_deliverable')
+    validate_target(order)
+    require(order['currency_id'] == CURRENCY_ID and
+            _balance(tx, order['escrow_subject']) == order['total_price_minor'],
+            'escrow_balance_mismatch')
+    kind, manifest, refs = await _package(app, tx, order)
+    delivery_id = new_id('dlv')
+    body = {'delivery_id': delivery_id, 'order_id': order['id'],
+            'recipient_subject': buyer, 'kind': kind,
+            'manifest': manifest, 'payload_refs': refs,
+            'package_digest': order['package_digest'], 'channel': 'site'}
+    delivery_digest = digest(body)
+    tx.execute('''INSERT INTO store_deliveries
+        (id,order_id,recipient_subject,kind,payload_refs,manifest,
+         package_digest,delivery_digest,channel,state,prepared_at,claimed_at,receipt)
+        VALUES (?,?,?,?,?,?,?,?,?,'prepared',?,NULL,NULL)''',
+        (delivery_id, order['id'], buyer, kind, canonical(refs).decode(),
+         canonical(manifest).decode(), order['package_digest'],
+         delivery_digest, 'site', wire(ctx.now)), write=True)
+    changed = tx.execute('''UPDATE store_orders SET state='delivered',delivered_at=?
+        WHERE id=? AND buyer=? AND state='funded' AND delivered_at IS NULL''',
+        (wire(ctx.now), order['id'], buyer), write=True)
+    require(changed.rowcount == 1, 'order_not_deliverable')
+    return _delivery(tx, order['id'])
+
+
+def delivery_summary(delivery):
+    return {'delivery_id': delivery['id'], 'order_id': delivery['order_id'],
+            'state': delivery['state'], 'channel': delivery['channel'],
+            'package_digest': delivery['package_digest'],
+            'delivery_digest': delivery['delivery_digest']}
+
+
+def install(app):
+    op, finish = registration(app, 'delivery', ('orders',))
+    # Account authority belongs to the operation contract, not just the handler:
+    # the executor must apply it before returning an idempotent cached result.
+    op = partial(op, requirements=account_requirements)
+
+    @op('delivery.prepare', obj({'order_id': IDENTIFIER}, ('order_id',)),
+        signature=True)
+    async def prepare(ctx, request, tx):
+        buyer = _subject(ctx)
+        order = _buyer_order(tx, request.arguments['order_id'], buyer)
+        delivery = await prepare_managed(app, ctx, tx, order)
+        return HandlerOutput(data={'delivery': delivery_summary(delivery)})
+
+    @op('delivery.get', obj({'order_id': IDENTIFIER}, ('order_id',)), effect='read')
+    async def get(ctx, request, tx):
+        buyer = ctx.principal.subject
+        require(buyer is not None and ctx.principal.actor == buyer,
+                'order_not_found')
+        order = _buyer_order(tx, request.arguments['order_id'], buyer)
+        if tx.one('SELECT 1 FROM order_contracts WHERE order_id=?', (order['id'],)):
+            from msg.market.delivery import read
+            return await read(app, tx, ctx, request)
+        delivery = _delivery(tx, order['id'])
+        require(delivery is not None, 'delivery_not_found')
+        await _verified_delivery(app, tx, order, delivery)
+        from msg.market.delivery_notifications import notification_status
+        return HandlerOutput(data={'delivery': {
+            'delivery_id': delivery['id'], 'order_id': order['id'],
+            'recipient_subject': buyer, 'kind': delivery['kind'],
+            'manifest': delivery['manifest'], 'package_digest': delivery['package_digest'],
+            'delivery_digest': delivery['delivery_digest'], 'channel': 'site',
+            'state': delivery['state'], 'prepared_at': delivery['prepared_at'],
+            'claimed_at': delivery['claimed_at'],
+            'payloads': await _payload(app, delivery),
+            'notification': await notification_status(app, tx, order['id'])}})
+
+    @op('delivery.accept', obj({'order_id': IDENTIFIER,
+        'delivery_digest': {'type': 'string', 'pattern': '^sha256:[a-f0-9]{64}$'}},
+        ('order_id', 'delivery_digest')), signature=True)
+    async def accept(ctx, request, tx):
+        if tx.one('SELECT 1 FROM order_contracts WHERE order_id=?', (request.arguments['order_id'],)):
+            from msg.market.delivery import accept as market_accept
+            return await market_accept(app, tx, ctx, request)
+        receipt,decision,delivery = await EscrowEngine(app).settle(
+            ctx,request,tx,reason='buyer_accept')
+        return HandlerOutput(data={'order_id':request.arguments['order_id'],'state':'settled',
+            'delivery_id':delivery['id'],'receipt':receipt,'decision':decision})
+
+    @op('delivery.claim', obj({'order_id': IDENTIFIER,
+        'delivery_digest': {'type': 'string', 'pattern': '^sha256:[a-f0-9]{64}$'}},
+        ('order_id', 'delivery_digest')), signature=True)
+    async def claim(ctx, request, tx):
+        # Checkout settlement is not evidence of receipt by the buyer. This
+        # later signed ACK only changes the delivery; it cannot debit escrow.
+        buyer = _subject(ctx)
+        order = _buyer_order(tx, request.arguments['order_id'], buyer)
+        delivery = _delivery(tx, order['id'])
+        await _verified_delivery(app, tx, order, delivery)
+        require(delivery['delivery_digest'] == request.arguments['delivery_digest'],
+                'delivery_mismatch')
+        await EscrowEngine(app).verify_checkout_release(tx, order, delivery)
+        require(delivery['state'] == 'prepared', 'delivery_not_acceptable')
+        changed = tx.execute("""UPDATE store_deliveries SET state='claimed',claimed_at=?
+            WHERE order_id=? AND recipient_subject=? AND state='prepared'""",
+            (wire(ctx.now), order['id'], buyer), write=True)
+        require(changed.rowcount == 1, 'delivery_not_acceptable')
+        return HandlerOutput(data={'order_id': order['id'],
+            'delivery_id': delivery['id'], 'state': 'claimed'})
+
+    @op('delivery.notify', obj({'order_id': IDENTIFIER,
+        'enabled': {'type': 'boolean'}}, ('order_id',)), signature=True)
+    async def notify(ctx, request, tx):
+        from msg.market.delivery_notifications import queue_notification
+        buyer = _subject(ctx)
+        order = _buyer_order(tx, request.arguments['order_id'], buyer)
+        await _verified_delivery(app, tx, order, _delivery(tx, order['id']))
+        status = await queue_notification(app, ctx, request, tx, order,
+                                          enabled=request.arguments.get('enabled', True))
+        return HandlerOutput(data={'order_id': order['id'], 'notification': status})
+
+    from msg.market.delivery import install as install_market
+    install_market(app, op)
+    finish()