anon-identity
Version:
Decentralized identity framework with DIDs, Verifiable Credentials, and privacy-preserving selective disclosure
187 lines • 7.27 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.AgentRevocationService = void 0;
const revocation_service_1 = require("../revocation/revocation-service");
const delegation_manager_1 = require("./delegation-manager");
class AgentRevocationService extends revocation_service_1.RevocationService {
constructor(keyPair, issuerDID, storageProvider) {
super(keyPair, issuerDID, storageProvider);
this.agentRevocations = new Map();
this.delegationManager = new delegation_manager_1.DelegationManager();
}
/**
* Revoke an agent's access entirely
*/
async revokeAgent(agentDID, parentDID, reason) {
// Add to agent revocation list
const record = {
agentDID,
parentDID,
revokedAt: new Date(),
reason
};
const records = this.agentRevocations.get(parentDID) || [];
records.push(record);
this.agentRevocations.set(parentDID, records);
// Revoke all delegation credentials for this agent
await this.revokeDelegationCredentialsForAgent(agentDID);
}
/**
* Revoke an agent's access to a specific service
*/
async revokeAgentServiceAccess(agentDID, parentDID, serviceDID, reason) {
// Add to agent revocation list
const record = {
agentDID,
parentDID,
serviceDID,
revokedAt: new Date(),
reason
};
const records = this.agentRevocations.get(parentDID) || [];
records.push(record);
this.agentRevocations.set(parentDID, records);
// Revoke delegation credentials for this service
await this.revokeDelegationCredentialsForService(agentDID, serviceDID);
}
/**
* Check if an agent is revoked
*/
async isAgentRevoked(agentDID, parentDID) {
const records = this.agentRevocations.get(parentDID) || [];
return records.some(r => r.agentDID === agentDID && !r.serviceDID);
}
/**
* Check if an agent's service access is revoked
*/
async isAgentServiceRevoked(agentDID, parentDID, serviceDID) {
const records = this.agentRevocations.get(parentDID) || [];
// Check if entire agent is revoked
const agentRevoked = records.some(r => r.agentDID === agentDID && !r.serviceDID);
if (agentRevoked)
return true;
// Check if specific service access is revoked
return records.some(r => r.agentDID === agentDID &&
r.serviceDID === serviceDID);
}
/**
* Get all revocation records for a parent
*/
getRevocationRecords(parentDID) {
return this.agentRevocations.get(parentDID) || [];
}
/**
* Validate a delegation credential including revocation check
*/
async validateDelegationCredential(credential) {
// Check basic validation
if (!this.delegationManager.validateDelegation(credential)) {
return { valid: false, reason: 'Invalid delegation credential' };
}
const agentDID = credential.credentialSubject.id;
const parentDID = credential.credentialSubject.parentDID;
// Check if agent is entirely revoked
if (await this.isAgentRevoked(agentDID, parentDID)) {
return { valid: false, reason: 'Agent has been revoked' };
}
// Check if credential itself is revoked
if (await this.isRevoked(credential.id)) {
return { valid: false, reason: 'Delegation credential has been revoked' };
}
// Check service-specific revocations
for (const serviceDID of Object.keys(credential.credentialSubject.services)) {
if (await this.isAgentServiceRevoked(agentDID, parentDID, serviceDID)) {
return {
valid: false,
reason: `Agent access to service ${serviceDID} has been revoked`
};
}
}
return { valid: true };
}
/**
* Revoke all delegation credentials for an agent
*/
async revokeDelegationCredentialsForAgent(agentDID) {
// In a real implementation, this would query the storage for all
// delegation credentials issued to this agent and revoke them
// For now, we'll store a marker that can be checked
const credentialId = `delegation:${agentDID}:*`;
await this.revokeCredential(credentialId);
}
/**
* Revoke delegation credentials for a specific service
*/
async revokeDelegationCredentialsForService(agentDID, serviceDID) {
// In a real implementation, this would query and revoke specific credentials
const credentialId = `delegation:${agentDID}:${serviceDID}`;
await this.revokeCredential(credentialId);
}
/**
* Restore an agent's access
*/
async restoreAgent(agentDID, parentDID) {
const records = this.agentRevocations.get(parentDID) || [];
const filteredRecords = records.filter(r => !(r.agentDID === agentDID && !r.serviceDID));
this.agentRevocations.set(parentDID, filteredRecords);
// Unrevoke the marker credential
const credentialId = `delegation:${agentDID}:*`;
await this.unrevokeCredential(credentialId);
}
/**
* Restore an agent's service access
*/
async restoreAgentServiceAccess(agentDID, parentDID, serviceDID) {
const records = this.agentRevocations.get(parentDID) || [];
const filteredRecords = records.filter(r => !(r.agentDID === agentDID && r.serviceDID === serviceDID));
this.agentRevocations.set(parentDID, filteredRecords);
// Unrevoke the service-specific credential
const credentialId = `delegation:${agentDID}:${serviceDID}`;
await this.unrevokeCredential(credentialId);
}
/**
* Get revocation statistics
*/
getRevocationStats() {
let totalAgentsRevoked = 0;
let totalServiceRevocations = 0;
const revocationsByParent = {};
this.agentRevocations.forEach((records, parentDID) => {
revocationsByParent[parentDID] = records.length;
records.forEach(record => {
if (record.serviceDID) {
totalServiceRevocations++;
}
else {
totalAgentsRevoked++;
}
});
});
return {
totalAgentsRevoked,
totalServiceRevocations,
revocationsByParent
};
}
/**
* Export revocation data for backup/migration
*/
exportRevocationData() {
const data = [];
this.agentRevocations.forEach((records, parentDID) => {
data.push({ parentDID, records });
});
return { agentRevocations: data };
}
/**
* Import revocation data from backup/migration
*/
importRevocationData(data) {
this.agentRevocations.clear();
data.agentRevocations.forEach(({ parentDID, records }) => {
this.agentRevocations.set(parentDID, records);
});
}
}
exports.AgentRevocationService = AgentRevocationService;
//# sourceMappingURL=agent-revocation-service.js.map