/**
* Autobase Operation Types for Identity Registry
*
* Defines operation constants, JSON encode/decode, and validation
* for all Autobase-managed identity registry operations.
*
* Operations are appended to Autobase writer cores and processed
* by the deterministic apply function to build the Hyperbee view.
*/
// User lifecycle
export const OP_CREATE_USER = 'create-user'
export const OP_UPDATE_USER = 'update-user'
export const OP_DEACTIVATE_USER = 'deactivate-user'
export const OP_REACTIVATE_USER = 'reactivate-user'
// Identity CRUD
export const OP_CREATE_IDENTITY = 'create-identity'
export const OP_LINK_IDENTITY = 'link-identity'
export const OP_UNLINK_IDENTITY = 'unlink-identity'
export const OP_REVOKE_IDENTITY = 'revoke-identity'
export const OP_RESTORE_IDENTITY = 'restore-identity'
// Permissions & account management
export const OP_UPGRADE_PERMISSIONS = 'upgrade-permissions'
export const OP_MERGE_ACCOUNTS = 'merge-accounts'
// Admin repair
export const OP_REPAIR_IDENTITY = 'repair-identity'
// Federation (multi-writer)
export const OP_ADD_WRITER = 'add-writer'
const VALID_METHODS = ['web-identity', 'ssh-key', 'keet-identity', 'noise-key']
/**
* Encode an operation to a Buffer for Autobase append
*/
export function encodeOp (op) {
return Buffer.from(JSON.stringify(op))
}
/**
* Decode a Buffer back to an operation object
*/
export function decodeOp (buf) {
return JSON.parse(buf.toString())
}
/**
* Validate an operation has required fields for its type
* @returns {{ valid: boolean, error?: string }}
*/
export function validateOp (op) {
if (!op || !op.type) {
return { valid: false, error: 'Missing operation type' }
}
if (!op.timestamp) {
return { valid: false, error: `${op.type} requires timestamp` }
}
switch (op.type) {
case OP_CREATE_USER:
if (!op.userId) return { valid: false, error: 'create-user requires userId' }
break
case OP_UPDATE_USER:
if (!op.userId) return { valid: false, error: 'update-user requires userId' }
break
case OP_DEACTIVATE_USER:
if (!op.userId) return { valid: false, error: 'deactivate-user requires userId' }
break
case OP_REACTIVATE_USER:
if (!op.userId) return { valid: false, error: 'reactivate-user requires userId' }
break
case OP_CREATE_IDENTITY:
if (!op.identityId) return { valid: false, error: 'create-identity requires identityId' }
if (!op.method || !VALID_METHODS.includes(op.method)) {
return { valid: false, error: 'create-identity requires method (web-identity|ssh-key|keet-identity|noise-key)' }
}
break
case OP_LINK_IDENTITY:
if (!op.identityId) return { valid: false, error: 'link-identity requires identityId' }
if (!op.userId) return { valid: false, error: 'link-identity requires userId' }
break
case OP_UNLINK_IDENTITY:
if (!op.identityId) return { valid: false, error: 'unlink-identity requires identityId' }
break
case OP_REVOKE_IDENTITY:
if (!op.identityId) return { valid: false, error: 'revoke-identity requires identityId' }
break
case OP_RESTORE_IDENTITY:
if (!op.identityId) return { valid: false, error: 'restore-identity requires identityId' }
break
case OP_UPGRADE_PERMISSIONS:
if (!op.userId) return { valid: false, error: 'upgrade-permissions requires userId' }
if (!op.repoName) return { valid: false, error: 'upgrade-permissions requires repoName' }
if (!Array.isArray(op.permissions)) return { valid: false, error: 'upgrade-permissions requires permissions (array)' }
break
case OP_MERGE_ACCOUNTS:
if (!op.primaryUserId) return { valid: false, error: 'merge-accounts requires primaryUserId' }
if (!op.secondaryUserId) return { valid: false, error: 'merge-accounts requires secondaryUserId' }
break
case OP_ADD_WRITER:
if (!op.writerKey) return { valid: false, error: 'add-writer requires writerKey' }
break
default:
return { valid: false, error: `Unknown operation type: ${op.type}` }
}
return { valid: true }
}