add access control to service level

src/@types/DDO/Service.ts

@@ -1,4 +1,5 @@
 import { ConsumerParameter } from './ConsumerParameter'
+import { Credentials } from './Credentials'
 
 export interface PublisherTrustedAlgorithm {
   /**
@@ -80,6 +81,12 @@ export interface Service {
    */
   serviceEndpoint: string
 
+  /**
+   * Describes the credentials needed to access a service
+   * @type {Credentials}
+   */
+  credentials?: Credentials
+
   /**
    * Describing how long the service can be used after consumption is initiated.
    * @type {number}

src/components/core/handler/downloadHandler.ts

@@ -273,7 +273,7 @@ export class DownloadHandler extends Handler {
         return {
           stream: null,
           status: {
-            httpStatus: 500,
+            httpStatus: 403,
             error: `Error: Access to asset ${ddo.id} was denied`
           }
         }
@@ -347,6 +347,25 @@ export class DownloadHandler extends Handler {
     let service: Service = AssetUtils.getServiceById(ddo, task.serviceId)
     if (!service) service = AssetUtils.getServiceByIndex(ddo, Number(task.serviceId))
     if (!service) throw new Error('Cannot find service')
+
+    // check credentials on service level
+    if (service.credentials) {
+      const accessGranted = checkCredentials(service.credentials, task.consumerAddress)
+      if (!accessGranted) {
+        CORE_LOGGER.logMessage(
+          `Error: Access to service with id ${service.id} was denied`,
+          true
+        )
+        return {
+          stream: null,
+          status: {
+            httpStatus: 403,
+            error: `Error: Access to service with id ${service.id} was denied`
+          }
+        }
+      }
+    }
+
     // 4. Check service type
     const serviceType = service.type
     if (serviceType === 'compute') {

src/test/data/assets.ts

@@ -1,3 +1,5 @@
+import { Credentials } from '../../@types/DDO/Credentials'
+
 export const downloadAsset = {
   '@context': ['https://w3id.org/did/v1'],
   id: '',
@@ -58,6 +60,96 @@ export const downloadAsset = {
   }
 }
 
+const nftLevelCredentials: Credentials = {
+  allow: [
+    {
+      type: 'address',
+      values: ['0xBE5449a6A97aD46c8558A3356267Ee5D2731ab5e']
+    },
+    {
+      type: 'address',
+      values: ['0xA78deb2Fa79463945C247991075E2a0e98Ba7A09']
+    }
+  ],
+  deny: [
+    {
+      type: 'address',
+      values: ['0x02354A1F160A3fd7ac8b02ee91F04104440B28E7']
+    }
+  ]
+}
+
+const serviceLevelCredentials: Credentials = {
+  deny: [
+    {
+      type: 'address',
+      values: ['0xA78deb2Fa79463945C247991075E2a0e98Ba7A09']
+    }
+  ]
+}
+
+export const downloadAssetWithCredentials = {
+  '@context': ['https://w3id.org/did/v1'],
+  id: '',
+  nftAddress: '',
+  version: '4.1.0',
+  chainId: 80001,
+  metadata: {
+    created: '2021-12-20T14:35:20Z',
+    updated: '2021-12-20T14:35:20Z',
+    type: 'dataset',
+    name: 'cli fixed asset',
+    description: 'asset published using ocean.js cli tool',
+    tags: ['test'],
+    author: 'oceanprotocol',
+    license: 'https://market.oceanprotocol.com/terms',
+    additionalInformation: {
+      termsAndConditions: true
+    }
+  },
+  credentials: nftLevelCredentials,
+  services: [
+    {
+      id: 'ccb398c50d6abd5b456e8d7242bd856a1767a890b537c2f8c10ba8b8a10e6025',
+      type: 'download',
+      files: {
+        files: [
+          {
+            type: 'url',
+            url: 'https://raw.githubusercontent.com/oceanprotocol/testdatasets/main/shs_dataset_test.txt',
+            method: 'GET'
+          }
+        ]
+      },
+      credentials: serviceLevelCredentials,
+      datatokenAddress: '',
+      serviceEndpoint: 'https://v4.provider.oceanprotocol.com',
+      timeout: 86400
+    }
+  ],
+  event: {},
+  nft: {
+    address: '',
+    name: 'Ocean Data NFT',
+    symbol: 'OCEAN-NFT',
+    state: 5,
+    tokenURI: '',
+    owner: '',
+    created: ''
+  },
+  purgatory: {
+    state: false
+  },
+  datatokens: [] as any,
+  stats: {
+    allocated: 0,
+    orders: 0,
+    price: {
+      value: '0'
+    }
+  }
+}
+
 export const computeAsset = {
   '@context': ['https://w3id.org/did/v1'],
   id: '',