Merge pull request #321 from NillionNetwork/feat/update-nuc-ts

Author: tim-hm

justfile

@@ -21,7 +21,7 @@ install:
 
 # Check for formatting, lint, and type errors
 check:
-    pnpm exec biome ci && pnpm exec tsc -b --noEmit
+    pnpm exec tsc -b && pnpm exec biome ci && pnpm exec tsc -b --noEmit
 
 # Format, fix, and type check all files
 fix:

packages/api/package.json

@@ -26,7 +26,7 @@
     "@hono/prometheus": "^1.0.2",
     "@hono/standard-validator": "^0.1.5",
     "@hono/zod-validator": "^0.7.4",
-    "@nillion/nuc": "^1.0.0",
+    "@nillion/nuc": "^1.1.0-rc.0",
     "@noble/curves": "^2.0.1",
     "@noble/hashes": "^2.0.1",
     "@standard-community/standard-json": "^0.3.5",

packages/api/src/middleware/capability.middleware.ts

@@ -31,7 +31,9 @@ export function loadNucToken<
         );
       }
 
-      const envelope = Codec.decodeBase64Url(tokenString);
+      // We must use the unsafe decode first to extract the subject/claims required
+      // to fetch the correct context (User/Builder) for validation
+      const envelope = Codec._unsafeDecodeBase64Url(tokenString);
       c.set("envelope", envelope);
 
       return next();
@@ -60,7 +62,9 @@ export function loadSubjectAndVerifyAsAdmin<
   return async (c, next) => {
     try {
       const envelope = c.get("envelope");
-      Validator.validate(envelope, { rootIssuers: [nildbNodeDid.didString] });
+      await Validator.validate(envelope, {
+        rootIssuers: [nildbNodeDid.didString],
+      });
       return next();
     } catch (cause) {
       if (cause && typeof cause === "object" && "message" in cause) {
@@ -127,7 +131,7 @@ export function loadSubjectAndVerifyAsBuilder<
       const nilauthDid = Did.fromPublicKey(config.nilauthPubKey);
       const nildbNodeDid = bindings.node.did;
 
-      Validator.validate(envelope, {
+      await Validator.validate(envelope, {
         rootIssuers: [nilauthDid.didString],
         params: {
           tokenRequirements: {
@@ -215,7 +219,7 @@ export function loadSubjectAndVerifyAsUser<
           StatusCodes.UNAUTHORIZED,
         );
       }
-      Validator.validate(envelope, {
+      await Validator.validate(envelope, {
         rootIssuers: [subject],
       });
       c.set("user", user);

packages/api/tests/02-integration/02-builder-lifecycle.test.ts

@@ -25,6 +25,7 @@ describe("02-builder-lifecycle.test.js", () => {
       .command("/nil/db")
       .audience(bindings.node.did)
       .subject(builderDid)
+      .expiresIn(1000 * 10)
       .signAndSerialize(builderSigner);
 
     const response = await app.request(PathsV1.collections.root, {

packages/api/tests/fixture/fixture.ts

@@ -123,6 +123,7 @@ export async function buildFixture(
     .subject(adminDid)
     .command(NucCmd.nil.db.root)
     .audience(adminDid)
+    .expiresIn(1000 * 60 * 5)
     .sign(node.signer);
   const system = new AdminClient({
     baseUrl: bindings.config.nodePublicEndpoint,

packages/api/tsconfig.json

@@ -7,7 +7,7 @@
       "@nildb/*": ["./src/*"],
       "@nillion/nildb-types": ["../types/src/lib.ts"],
       "@nillion/nildb-types/*": ["../types/src/*"],
-      "@nillion/nildb-shared": ["../shared/src/index.ts"],
+      "@nillion/nildb-shared": ["../shared/src/lib.ts"],
       "@nillion/nildb-shared/*": ["../shared/src/*"],
       "@nillion/nildb-client": ["../client/src/index.ts"],
       "@nillion/nildb-client/*": ["../client/src/*"]

packages/client/package.json

@@ -17,7 +17,7 @@
     "stub": "tsdown --stub"
   },
   "dependencies": {
-    "@nillion/nuc": "^1.0.0",
+    "@nillion/nuc": "^1.1.0-rc.0",
     "@nillion/nildb-types": "workspace:*"
   },
   "devDependencies": {

packages/client/src/admin/client.ts

@@ -29,6 +29,7 @@ export class AdminClient {
     const nodeDid = Did.fromPublicKey(this.options.nodePublicKey);
     return await Builder.invocationFrom(this.nodeDelegation)
       .audience(nodeDid)
+      .expiresIn(60 * 1000)
       .signAndSerialize(this.options.signer);
   }
 

packages/client/src/builder/client.ts

@@ -64,6 +64,7 @@ export class BuilderClient {
 
     return await Builder.invocationFrom(rootToken)
       .audience(nodeDid)
+      .expiresIn(60 * 1000)
       .signAndSerialize(this.options.signer);
   }
 

packages/client/src/user/client.ts

@@ -35,6 +35,7 @@ export class UserClient {
       .command(NucCmd.nil.db.users.root)
       .audience(nodeDid)
       .subject(did)
+      .expiresIn(60 * 1000)
       .signAndSerialize(this.options.signer);
   }