Business Agents

import { CredentialType, VerificationFailure } from "@baselayer/kya";

// POST /oauth/token. actorToken is the actor_token field of the form body, when sent.
// scopeReference is the scope field. profile is your parsed kya-profile.json.
async function businessTokenEndpoint(
  subjectToken: string,
  scopeReference: string,
  actorToken?: string,
) {
  const disclosureScope = profile.resolveReference(scopeReference);
  if (disclosureScope === null) return oauthError(VerificationFailure.UnknownDisclosureScope);

  const report = await verifier.verify(subjectToken, { actor: actorToken, scope: disclosureScope });
  if (!report.accepted) return oauthError(report.failure);

  const claims = report.exchangeClaims();
  // Without an actor, verify accepts any credential, so confirm it is a business one.
  if (claims.credentialType !== CredentialType.Business) {
    return oauthError(VerificationFailure.UnsupportedCredentialType);
  }
  // attests() asks the business only. actorAttests() asks the person. Require both.
  const screened = claims.attests("watchlist_clear") && claims.actorAttests("watchlist_clear");
  const scope = screened ? "payments" : "browse";
  // Your token carries sub (the business) and act.sub (the person).
  return tokenResponse(claims, scope);
}

from baselayer_kya import CredentialType, VerificationFailure


# POST /oauth/token. actor_token is the actor_token field of the form body, when sent.
# scope_reference is the scope field. profile is your parsed kya-profile.json.
async def business_token_endpoint(
    subject_token: str, scope_reference: str, actor_token: str | None
):
    disclosure_scope = profile.resolve_reference(scope_reference)
    if disclosure_scope is None:
        return oauth_error(VerificationFailure.UnknownDisclosureScope)

    report = (
        await verifier.verify(subject_token, actor=actor_token, scope=disclosure_scope)
        if actor_token is not None
        else await verifier.verify(subject_token, scope=disclosure_scope)
    )
    if report.failure is not None:
        return oauth_error(report.failure)

    claims = report.exchange_claims()
    # Without an actor, verify accepts any credential, so confirm it is a business one.
    if claims.credential_type is not CredentialType.Business:
        return oauth_error(VerificationFailure.UnsupportedCredentialType)
    # attests() asks the business only. actor_attests() asks the person. Require both.
    screened = claims.attests("watchlist_clear") and claims.actor_attests("watchlist_clear")
    scope = "payments" if screened else "browse"
    # Your token carries sub (the business) and act.sub (the person).
    return await token_response(claims, scope)