feat: define ucan/revoke capability

packages/capabilities/src/ucan.js

@@ -0,0 +1,52 @@
+/**
+ * UCAN core capabilities.
+ */
+
+import { capability, Schema } from '@ucanto/validator'
+import { equalWith, checkLink, and } from './utils.js'
+
+export const UCANLink = Schema.link({
+  version: 1,
+})
+
+/**
+ * Capability can only be delegated (but not invoked) allowing audience to
+ * derived any `store/` prefixed capability for the (memory) space identified
+ * by DID in the `with` field.
+ */
+export const ucan = capability({
+  can: 'ucan/*',
+  with: Schema.did(),
+  derives: equalWith,
+})
+
+/**
+ * `ucan/revoke` capability is a replacement for the
+ * [UCAN Revocation](https://github.com/ucan-wg/spec#66-revocation) that had
+ * been proposed to a UCAN working group and had a tentative support from
+ * members.
+ */
+export const revoke = capability({
+  can: 'ucan/revoke',
+  /**
+   * With MUST be a DID of the UCAN issuer that is in the proof chain of the
+   * delegation been revoked.
+   */
+  with: Schema.did(),
+  nb: Schema.struct({
+    /**
+     * Link of the UCAN been revoked, it MUST be a UCAN be either issued by a
+     * principal matching `with` field or depend on the delegation issued by
+     * the principal matching `with` field.
+     *
+     * Alternatively `with` field MAY match the `audience` of the this UCAN,
+     * which would imply that that delegate is revoking capabilities delegated
+     * to it. This allows delegate to proof that it is unable to invoke
+     * delegated capabilities.
+     */
+    delegation: UCANLink,
+  }),
+  derives: (claim, from) =>
+    and(equalWith(claim, from)) ??
+    checkLink(claim.nb.delegation, from.nb.delegation, 'nb.delegation'),
+})

packages/capabilities/test/capabilities/ucan.test.js

@@ -0,0 +1,178 @@
+import assert from 'assert'
+import { access } from '@ucanto/validator'
+import { Verifier } from '@ucanto/principal/ed25519'
+import * as UCAN from '../../src/ucan.js'
+import { alice, bob, service, mallory } from '../helpers/fixtures.js'
+import { delegate, parseLink, API } from '@ucanto/core'
+
+/** @type {API.UCANLink} */
+const delegation = parseLink(
+  'bafyreieicjmit6d6ubkd2mw7snpx33ijquxcjetp4fvbjr2dkdonvr5dpe'
+)
+
+describe('ucan/* capabilities', () => {
+  describe('ucan/revoke', () => {
+    it('owner can issue revocation', async () => {
+      const revoke = UCAN.revoke.invoke({
+        issuer: alice,
+        audience: service,
+        with: alice.did(),
+        nb: {
+          delegation,
+        },
+      })
+
+      const result = await access(await revoke.delegate(), {
+        capability: UCAN.revoke,
+        principal: Verifier,
+        authority: service,
+      })
+
+      assert.ok(result.ok)
+    })
+
+    it('delegate can issue revocation', async () => {
+      const revoke = UCAN.revoke.invoke({
+        issuer: bob,
+        audience: service,
+        with: alice.did(),
+        nb: {
+          delegation,
+        },
+        proofs: [
+          await UCAN.revoke.delegate({
+            issuer: alice,
+            audience: bob,
+            with: alice.did(),
+          }),
+        ],
+      })
+
+      const result = await access(await revoke.delegate(), {
+        capability: UCAN.revoke,
+        principal: Verifier,
+        authority: service,
+      })
+
+      assert.ok(result.ok)
+    })
+
+    it('non delegate can not issue revocation', async () => {
+      const proof = await delegate({
+        issuer: alice,
+        audience: bob,
+        capabilities: [
+          {
+            with: alice.did(),
+            can: 'console/log',
+          },
+        ],
+      })
+
+      const revoke = UCAN.revoke.invoke({
+        issuer: mallory,
+        audience: service,
+        with: alice.did(),
+        nb: {
+          delegation: proof.cid,
+        },
+        proofs: [
+          await UCAN.revoke.delegate({
+            issuer: alice,
+            audience: bob,
+            with: alice.did(),
+          }),
+        ],
+      })
+
+      const result = await access(await revoke.delegate(), {
+        capability: UCAN.revoke,
+        principal: Verifier,
+        authority: service,
+      })
+
+      assert.ok(result.error)
+    })
+
+    it('can be derived from ucan/*', async () => {
+      const revoke = UCAN.revoke.invoke({
+        issuer: bob,
+        audience: service,
+        with: alice.did(),
+        nb: {
+          delegation,
+        },
+        proofs: [
+          await UCAN.ucan.delegate({
+            issuer: alice,
+            with: alice.did(),
+            audience: bob,
+          }),
+        ],
+      })
+
+      const result = await access(await revoke.delegate(), {
+        capability: UCAN.revoke,
+        principal: Verifier,
+        authority: service,
+      })
+
+      assert.ok(result.ok)
+    })
+
+    it('with field must match', async () => {
+      const revoke = UCAN.revoke.invoke({
+        issuer: bob,
+        audience: service,
+        with: mallory.did(),
+        nb: {
+          delegation,
+        },
+        proofs: [
+          await UCAN.ucan.delegate({
+            issuer: alice,
+            with: alice.did(),
+            audience: bob,
+          }),
+        ],
+      })
+
+      const result = await access(await revoke.delegate(), {
+        capability: UCAN.revoke,
+        principal: Verifier,
+        authority: service,
+      })
+
+      assert.ok(result.error)
+    })
+
+    it('nb.delegation field must match', async () => {
+      const revoke = UCAN.revoke.invoke({
+        issuer: bob,
+        audience: service,
+        with: alice.did(),
+        nb: {
+          delegation,
+        },
+        proofs: [
+          await UCAN.revoke.delegate({
+            issuer: alice,
+            with: alice.did(),
+            audience: bob,
+            nb: {
+              delegation: parseLink('bafkqaaa'),
+            },
+          }),
+        ],
+      })
+
+      const result = await access(await revoke.delegate(), {
+        capability: UCAN.revoke,
+        principal: Verifier,
+        authority: service,
+      })
+
+      assert.ok(result.error)
+    })
+  })
+})