55 lines
3.1 KiB
TypeScript
55 lines
3.1 KiB
TypeScript
import { Account, AuthorityType } from './chain/account';
|
|
import type { PrivateKey, PublicKey } from './crypto';
|
|
/** Layer 1 authority class carried by account objects. */
|
|
export type AccountAuthorityClass = 'owner' | 'active' | 'posting';
|
|
/** Reason returned by local single-key authority evaluation. */
|
|
export type AuthorityValidationReason = 'authority_satisfied' | 'posting_authority_not_satisfied' | 'authority_not_satisfied' | 'missing_delegated_authority' | 'membership_limit_exceeded' | 'account_auths_limit_exceeded';
|
|
export interface AuthorityEvaluationOptions {
|
|
/** Resolve delegated account authorities. For posting checks, return the delegated account's posting authority. */
|
|
getAuthority?: (account: string) => AuthorityType | undefined;
|
|
/** Canonical Layer 1 recursion limit. Defaults to BLURT_MAX_SIG_CHECK_DEPTH. */
|
|
maxRecursion?: number;
|
|
/** Canonical Layer 1 authority membership limit. Defaults to BLURT_MAX_AUTHORITY_MEMBERSHIP. */
|
|
maxMembership?: number;
|
|
/** Canonical Layer 1 delegated-account check limit. Defaults to BLURT_MAX_SIG_CHECK_ACCOUNTS. */
|
|
maxAccountAuths?: number;
|
|
}
|
|
export interface AccountAuthorityValidationOptions {
|
|
/** Resolve delegated account objects. Posting validation uses delegated accounts' posting authorities. */
|
|
getAccount?: (account: string) => Account | undefined;
|
|
maxRecursion?: number;
|
|
maxMembership?: number;
|
|
maxAccountAuths?: number;
|
|
}
|
|
export interface AuthorityEvaluationResult {
|
|
authorized: boolean;
|
|
threshold: number;
|
|
totalWeight: number;
|
|
matchedKey: string | null;
|
|
matchedKeys: string[];
|
|
approvedAccounts: string[];
|
|
visitedAccounts: string[];
|
|
missingAccounts: string[];
|
|
reason: AuthorityValidationReason;
|
|
}
|
|
export interface AccountAuthorityValidationResult {
|
|
account: string;
|
|
authority: AccountAuthorityClass;
|
|
key: string;
|
|
authorized: boolean;
|
|
reason: AuthorityValidationReason;
|
|
matches: Record<AccountAuthorityClass, AuthorityEvaluationResult>;
|
|
missingAccounts: string[];
|
|
}
|
|
/**
|
|
* Evaluate whether one public/private key satisfies an authority object.
|
|
*
|
|
* This mirrors the Layer 1 `sign_state` single-key semantics used for required
|
|
* signatures: key weights are counted directly, account authorities recurse via
|
|
* the supplied authority getter, and thresholds decide authorization.
|
|
*/
|
|
export declare function evaluateAuthorityForKey(authority: AuthorityType, key: string | PublicKey | PrivateKey, options?: AuthorityEvaluationOptions): AuthorityEvaluationResult;
|
|
/** Inspect one key against one account authority class plus sibling classes for least-privilege warnings. */
|
|
export declare function validateAccountAuthority(account: Account, key: string | PublicKey | PrivateKey, authority: AccountAuthorityClass, options?: AccountAuthorityValidationOptions): AccountAuthorityValidationResult;
|
|
/** Validate whether one key satisfies an account's posting authority. */
|
|
export declare function validatePostingAuthority(account: Account, key: string | PublicKey | PrivateKey, options?: AccountAuthorityValidationOptions): AccountAuthorityValidationResult;
|