Basic Authentication Flow

/**
 * Agent-Pass Basic Authentication Flow Example
 * 
 * This demonstrates the complete Agent-Pass authentication process:
 * 1. Create controller and agent identities
 * 2. Issue an Agent Capability Credential
 * 3. Generate authentication challenge
 * 4. Create Verifiable Presentation
 * 5. Verify with dual signatures
 */

import { AgentPass } from '@agent-pass/core';

async function demonstrateAgentPassFlow() {
  console.log('🚀 Agent-Pass Protocol Demonstration');
  console.log('=====================================\n');

  // Initialize the Agent-Pass library
  const agentPass = new AgentPass();

  try {
    // ===== STEP 1: CREATE IDENTITIES =====
    console.log('📝 Step 1: Creating Identities');
    console.log('-------------------------------');
    
    // Create controller identity (human user)
    const controller = await agentPass.createControllerIdentity({
      alias: 'human-controller',
      keyType: 'Ed25519'
    });
    console.log(`✅ Controller DID: ${controller.did}`);
    
    // Create agent identity (AI agent)
    const agent = await agentPass.createAgentIdentity({
      alias: 'email-agent',
      keyType: 'Ed25519'
    });
    console.log(`✅ Agent DID: ${agent.did}\n`);

    // ===== STEP 2: ISSUE CAPABILITY CREDENTIAL =====
    console.log('🔐 Step 2: Issuing Agent Capability Credential');
    console.log('-----------------------------------------------');
    
    const credential = await agentPass.createAgentCapabilityCredential(
      controller,
      agent,
      {
        scope: ['read:emails', 'send:emails', 'manage:calendar'],
        constraints: {
          maxEmailsPerDay: 100,
          allowedDomains: ['example.com', 'workos.com'],
          timeWindow: {
            start: '09:00',
            end: '17:00'
          }
        },
        expirationDate: new Date(Date.now() + 24 * 60 * 60 * 1000) // 24 hours
      }
    );
    
    console.log('✅ Agent Capability Credential created');
    console.log(`   Issuer (Controller): ${credential.issuer}`);
    console.log(`   Subject (Agent): ${credential.credentialSubject.id}`);
    console.log(`   Scope: ${credential.credentialSubject.scope.join(', ')}`);
    console.log(`   Expires: ${credential.expirationDate}\n`);

    // ===== STEP 3: AUTHENTICATION CHALLENGE =====
    console.log('🎯 Step 3: Creating Authentication Challenge');
    console.log('--------------------------------------------');
    
    const challenge = await agentPass.createChallenge({
      domain: 'workos.com'
    });
    
    console.log(`✅ Challenge generated: ${challenge.challenge.substring(0, 16)}...`);
    console.log(`   Domain: ${challenge.domain}`);
    console.log(`   Expires at: ${new Date(challenge.expiresAt)}\n`);

    // ===== STEP 4: CREATE VERIFIABLE PRESENTATION =====
    console.log('📋 Step 4: Creating Verifiable Presentation');
    console.log('--------------------------------------------');
    
    const presentation = await agentPass.createPresentation(
      agent,
      controller,
      [credential],
      challenge
    );
    
    console.log('✅ Verifiable Presentation created');
    console.log(`   Holder: ${presentation.holder}`);
    console.log(`   Credentials: ${presentation.verifiableCredential.length}`);
    console.log(`   Has proof: ${!!presentation.proof}\n`);

    // ===== STEP 5: VERIFY AUTHENTICATION =====
    console.log('✅ Step 5: Verifying Authentication');
    console.log('-----------------------------------');
    
    const verification = await agentPass.verifyPresentation(
      presentation,
      challenge,
      {
        domain: 'workos.com',
        requiredScope: ['read:emails']
      }
    );
    
    if (verification.verified) {
      console.log('🎉 Authentication SUCCESSFUL!');
      console.log(`✅ Agent DID: ${verification.agentDid}`);
      console.log(`✅ Controller DID: ${verification.controllerDid}`);
      console.log(`✅ Granted Scope: ${verification.scope?.join(', ')}`);
      console.log(`✅ Constraints verified: ${!!verification.constraintsValid}`);
      console.log(`✅ Valid until: ${new Date(verification.expiresAt)}`);
    } else {
      console.log('❌ Authentication FAILED');
      console.log(`   Reason: ${verification.reason}`);
      console.log(`   Error: ${verification.error}`);
    }

    // ===== STEP 6: SCOPE-BASED AUTHORIZATION =====
    console.log('\n🔒 Step 6: Testing Scope-based Authorization');
    console.log('---------------------------------------------');
    
    // Test allowed scope
    const canSendEmails = await agentPass.hasScope(verification, 'send:emails');
    console.log(`📧 Can send emails to example.com: ${canSendEmails ? '✅ YES' : '❌ NO'}`);
    
    // Test scope constraint (domain restriction)
    const emailRequest = {
      action: 'send:emails',
      domain: 'unauthorized.com'
    };
    
    const canSendToOtherDomain = await agentPass.validateConstraints(verification, emailRequest);
    console.log(`📧 Can send emails to unauthorized.com: ${canSendToOtherDomain ? '✅ YES' : '❌ NO'}`);

  } catch (error) {
    console.error('❌ Agent-Pass demonstration failed:', error);
  }
}

// Run the demonstration
demonstrateAgentPassFlow();