test/mocha/helpers.js
// the necessary zcaps in it used by the instance's issuer
the necessary zcaps in it used by the instance's issuer
the necessary zcaps in it used by the instance ' s issuer
async function initializeAccessManagement({
  profileId,
  profileContent,
  profileAgentContent = {},
  edvId,
  hmac,
  keyAgreementKey,
  indexes = [],
  invocationSigner,
  profileAgentRecord
}) {
  const accessManagement = {
    hmac: {id: hmac.id, type: hmac.type},
    keyAgreementKey: {id: keyAgreementKey.id, type: keyAgreementKey.type},
    indexes: [
      {attribute: 'content.id', unique: true},
      {attribute: 'content.type'},
      ...indexes
    ],
    zcaps: {}
  };
  const {profileAgent} = profileAgentRecord;
  const {
    id: profileAgentId,
    zcaps: agentZcaps
  } = profileAgent;
  const {profileCapabilityInvocationKey} = agentZcaps;
  const profileZcaps = {...profileContent.zcaps};
  const capability = `${edvId}/zcaps/documents`;
  accessManagement.edvId = edvId;
  const client = new EdvClient(
    {id: edvId, keyResolver, httpsAgent, keyAgreementKey, hmac});
  for(const index of accessManagement.indexes) {
    client.ensureIndex(index);
  }
  const recipients = [{
    header: {kid: keyAgreementKey.id, alg: JWE_ALG}
  }];
  const profileDocId = await edvHelpers.generateRandom();
  const profileUserDoc = new EdvDocument({
    id: profileDocId, recipients, keyResolver, keyAgreementKey, hmac,
    capability, invocationSigner, client
  });
  const profile = {
    ...profileContent,
    id: profileId,
    type: ['User', 'Profile'],
    accessManagement,
    zcaps: profileZcaps
  };
  await profileUserDoc.write({
    doc: {
      id: profileDocId,
      content: profile
    }
  });
  const documentsUrl = `${edvId}/documents`;
  const delegateUserEdvDocumentRequest = {
    referenceId: profileEdvDocument,
    allowedAction: ['read'],
    controller: profileAgentId,
    parentCapability: capability,
    invocationTarget: {
      id: `${documentsUrl}/${profileDocId}`,
      type: 'urn:edv:document'
    }
  };
  const profileDocZcap = await delegateCapability({
    signer: invocationSigner,
    edvClient: client,
    request: delegateUserEdvDocumentRequest
  });
  const userEdvZcaps = await delegateEdvZcaps({
    signer: invocationSigner,
    controller: profileAgentId,
    documentsUrl,
    hmac,
    edvClient: client,
    keyAgreementKey,
    prefix: 'user',
    capability
  });
  const agentDocId = await edvHelpers.generateRandom();
  const agentDoc = new EdvDocument({
    id: agentDocId,
    recipients,
    keyResolver,
    keyAgreementKey,
    hmac,
    capability,
    invocationSigner,
    client
  });
  const profileAgentZcaps = {...userEdvZcaps};
  const profileAgentDocument = {
    name: 'root',
    ...profileAgentContent,
    id: profileAgentId,
    type: ['User', 'Agent'],
    zcaps: {
      [profileCapabilityInvocationKey.referenceId]:
        profileCapabilityInvocationKey,
      [profileDocZcap.referenceId]: profileDocZcap,
      ...profileAgentZcaps
    },
    authorizedDate: (new Date()).toISOString()
  };
  await agentDoc.write({
    doc: {
      id: agentDocId,
      content: profileAgentDocument
    }
  });
  const delegateEdvDocumentRequest = {
    referenceId: profileAgentEdvDocument,
    allowedAction: ['read'],
    controller: profileAgentId,
    parentCapability: capability,
    invocationTarget: {
      id: `${documentsUrl}/${agentDocId}`,
      type: 'urn:edv:document'
    }
  };
  const userDocumentZcap = await delegateCapability({
    signer: invocationSigner,
    edvClient: client,
    request: delegateEdvDocumentRequest
  });
  const delegateEdvKakRequest = {
    referenceId: 'user-edv-kak',
    controller: profileAgentId,
    allowedAction: ['deriveSecret', 'sign'],
    invocationTarget: {
      id: keyAgreementKey.id,
      type: keyAgreementKey.type,
      publicAlias: keyAgreementKey.id
    },
    parentCapability: keyAgreementKey.id
  };
  const userKakZcap = await delegateCapability({
    signer: invocationSigner,
    edvClient: client,
    request: delegateEdvKakRequest
  });
  const agentRecordZcaps = {
    ...agentZcaps,
    userDocument: userDocumentZcap,
    userKak: userKakZcap
  };
  profileAgent.sequence++;
  profileAgent.zcaps = agentRecordZcaps;
  await profileAgents.update({profileAgent});
  return {profile, profileAgent, client, recipients};
}
async function initializeAccessManagement ( { profileId , profileContent , profileAgentContent = { } , edvId , hmac , keyAgreementKey , indexes = [ ] , invocationSigner , profileAgentRecord } ) { const accessManagement = { hmac : { id : hmac . id , type : hmac . type } , keyAgreementKey : { id : keyAgreementKey . id , type : keyAgreementKey . type } , indexes : [ { attribute : 'content.id' , unique : true } , { attribute : 'content.type' } , ... indexes ] , zcaps : { } } ; const { profileAgent } = profileAgentRecord ; const { id : profileAgentId , zcaps : agentZcaps } = profileAgent ; const { profileCapabilityInvocationKey } = agentZcaps ; const profileZcaps = { ... profileContent . zcaps } ; const capability = ` ${ edvId } ` ; accessManagement . edvId = edvId ; const client = new EdvClient ( { id : edvId , keyResolver , httpsAgent , keyAgreementKey , hmac } ) ; for ( const index of accessManagement . indexes ) { client . ensureIndex ( index ) ; } const recipients = [ { header : { kid : keyAgreementKey . id , alg : JWE_ALG } } ] ; const profileDocId = await edvHelpers . generateRandom ( ) ; const profileUserDoc = new EdvDocument ( { id : profileDocId , recipients , keyResolver , keyAgreementKey , hmac , capability , invocationSigner , client } ) ; const profile = { ... profileContent , id : profileId , type : [ 'User' , 'Profile' ] , accessManagement , zcaps : profileZcaps } ; await profileUserDoc . write ( { doc : { id : profileDocId , content : profile } } ) ; const documentsUrl = ` ${ edvId } ` ; const delegateUserEdvDocumentRequest = { referenceId : profileEdvDocument , allowedAction : [ 'read' ] , controller : profileAgentId , parentCapability : capability , invocationTarget : { id : ` ${ documentsUrl } ${ profileDocId } ` , type : 'urn:edv:document' } } ; const profileDocZcap = await delegateCapability ( { signer : invocationSigner , edvClient : client , request : delegateUserEdvDocumentRequest } ) ; const userEdvZcaps = await delegateEdvZcaps ( { signer : invocationSigner , controller : profileAgentId , documentsUrl , hmac , edvClient : client , keyAgreementKey , prefix : 'user' , capability } ) ; const agentDocId = await edvHelpers . generateRandom ( ) ; const agentDoc = new EdvDocument ( { id : agentDocId , recipients , keyResolver , keyAgreementKey , hmac , capability , invocationSigner , client } ) ; const profileAgentZcaps = { ... userEdvZcaps } ; const profileAgentDocument = { name : 'root' , ... profileAgentContent , id : profileAgentId , type : [ 'User' , 'Agent' ] , zcaps : { [ profileCapabilityInvocationKey . referenceId ] : profileCapabilityInvocationKey , [ profileDocZcap . referenceId ] : profileDocZcap , ... profileAgentZcaps } , authorizedDate : ( new Date ( ) ) . toISOString ( ) } ; await agentDoc . write ( { doc : { id : agentDocId , content : profileAgentDocument } } ) ; const delegateEdvDocumentRequest = { referenceId : profileAgentEdvDocument , allowedAction : [ 'read' ] , controller : profileAgentId , parentCapability : capability , invocationTarget : { id : ` ${ documentsUrl } ${ agentDocId } ` , type : 'urn:edv:document' } } ; const userDocumentZcap = await delegateCapability ( { signer : invocationSigner , edvClient : client , request : delegateEdvDocumentRequest } ) ; const delegateEdvKakRequest = { referenceId : 'user-edv-kak' , controller : profileAgentId , allowedAction : [ 'deriveSecret' , 'sign' ] , invocationTarget : { id : keyAgreementKey . id , type : keyAgreementKey . type , publicAlias : keyAgreementKey . id } , parentCapability : keyAgreementKey . id } ; const userKakZcap = await delegateCapability ( { signer : invocationSigner , edvClient : client , request : delegateEdvKakRequest } ) ; const agentRecordZcaps = { ... agentZcaps , userDocument : userDocumentZcap , userKak : userKakZcap } ; profileAgent . sequence ++ ; profileAgent . zcaps = agentRecordZcaps ; await profileAgents . update ( { profileAgent } ) ; return { profile , profileAgent , client , recipients } ; }
the necessary zcaps in it used by the instance's issuer
the necessary zcaps in it used by the instance ' s issuer
// create access management info // FIXME ensure profileCapabilityInvocationKey is removed // TODO this can be accomplished with back end only code // TODO this can be accomplished with back end only code // now that we have an edv for the test // we need to delegate read only access to us. // the profile agent is only allowed to read its own doc // TODO do this direct through bedrock-edv-storage