feat!: update session API #227
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
83 tasks
gobengo
reviewed
Feb 20, 2023
gobengo
reviewed
Feb 28, 2023
gobengo
approved these changes
Feb 28, 2023
packages/principal/src/account.js
Outdated
| * @template {UCAN.DID} ID | ||
| * @implements {UCAN.Signer<ID, Signature.NON_STANDARD>} | ||
| */ | ||
| class Account { |
There was a problem hiding this comment.
nit: if possible I'd avoid using Account at all here (it's too easy to misinterpret) and call this something like NonStandardSigner. just a thought
There was a problem hiding this comment.
Renamed it to Absentee which I think reflect the better than either misleading Account or NonStandardSigner which isn't specific enough. I'll assume it's ok, if not we can rename in the followup change.
Gozala
commented
Feb 28, 2023
Gozala
commented
Feb 28, 2023
Gozala
commented
Feb 28, 2023
Co-authored-by: Benjamin Goering <[email protected]>
Closed
Merged
This was referenced Apr 11, 2023
Merged
Merged
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #226
Overview
Changes in this PR update our session logic which previously just assigned a
did:keyto adid:mailtoprincipal in the validation context.Instead now we have
ucan/attestcapability that can be used to attest to the fact that specific delegation (that has nondid:keyissuer) has been authorized by the user. In other words when we perform interactive authorization flow like withaccess/authorizewe can delegateucan/attestto the agent been authorized that proofs that we performed an out-of-bound authorization flow in which user has authorized delegation we're attesting to.Now instead of assigning a key we setauthorizationCID, that corresponds to the UCAN Delegation withoutproofsandsignature. With this changes when validator encounters delegation issued by principal other than did:key e.g did:mailto it will attempt to find corresponding./updatecapability proof that setspermitto a CID derived from delegation. If such (valid) delegation is found, validator will not check signature and continue with UCAN verification process. If (session) delegation is found, validator falls back to doing key resolution instead.All in all this gives us a way to authorize agent with a specific set of capabilities as opposed to giving it a sudo capabilities as it used to be the case previously.P.S: I had to update Link schema so that validator could look for./updatewith a very specific CID in it as opposed to finding a mismatching one, which could be problem if there were multiple./updateproofs, because validator stops as soon as it finds success path.Link to the updated spec