fetch and merge upsteam changes

src/core/dwn-error.ts

@@ -55,6 +55,7 @@ export enum DwnErrorCode {
   PrivateKeySignerUnsupportedCurve = 'PrivateKeySignerUnsupportedCurve',
   ProtocolAuthorizationActionNotAllowed = 'ProtocolAuthorizationActionNotAllowed',
   ProtocolAuthorizationActionRulesNotFound = 'ProtocolAuthorizationActionRulesNotFound',
+  ProtocolAuthorizationExpiryReached = 'ProtocolAuthorizationExpiryReached',
   ProtocolAuthorizationIncorrectDataFormat = 'ProtocolAuthorizationIncorrectDataFormat',
   ProtocolAuthorizationIncorrectContextId = 'ProtocolAuthorizationIncorrectContextId',
   ProtocolAuthorizationIncorrectProtocolPath = 'ProtocolAuthorizationIncorrectProtocolPath',
@@ -75,6 +76,7 @@ export enum DwnErrorCode {
   ProtocolAuthorizationTagsInvalidSchema = 'ProtocolAuthorizationTagsInvalidSchema',
   ProtocolsConfigureDuplicateActorInRuleSet = 'ProtocolsConfigureDuplicateActorInRuleSet',
   ProtocolsConfigureDuplicateRoleInRuleSet = 'ProtocolsConfigureDuplicateRoleInRuleSet',
+  ProtocolsConfigureInvalidExpiry = 'ProtocolsConfigureInvalidExpiry',
   ProtocolsConfigureInvalidSize = 'ProtocolsConfigureInvalidSize',
   ProtocolsConfigureInvalidActionMissingOf = 'ProtocolsConfigureInvalidActionMissingOf',
   ProtocolsConfigureInvalidActionOfNotAllowed = 'ProtocolsConfigureInvalidActionOfNotAllowed',

src/core/protocol-authorization.ts

@@ -161,6 +161,9 @@ export class ProtocolAuthorization {
       ancestorMessageChain,
       messageStore,
     );
+
+    // Verify expiry
+    ProtocolAuthorization.verifyExpiry(incomingMessage, ruleSet)
   }
 
   public static async authorizeQueryOrSubscribe(
@@ -726,6 +729,31 @@ export class ProtocolAuthorization {
     }
   }
 
+  /**
+   * Verifies that reads adhere to the $expiry constraint if provided
+   * @throws {Error} if expiry date is passed.
+   */
+  private static verifyExpiry(
+    incomingMessage: RecordsRead,
+    ruleSet: ProtocolRuleSet
+  ): void {
+    const ruleExpiry = ruleSet.$expiry;
+    if (!ruleExpiry) {
+      return;
+    }
+
+    const dateCreated = incomingMessage.message.descriptor.filter?.dateCreated;
+    if (!dateCreated) {
+      return;
+    }
+
+    const dateExpiry = dateCreated + ruleExpiry;
+    if (Date.now() > dateExpiry) {
+      throw new DwnError(DwnErrorCode.ProtocolAuthorizationExpiryReached, `dateExpiry ${dateExpiry} has passed`);
+    }
+
+  }
+
   /**
    * If the given RecordsWrite is not a role record, this method does nothing and succeeds immediately.
    *

src/interfaces/protocols-configure.ts

@@ -132,7 +132,7 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
   ): void {
     const { ruleSet, ruleSetProtocolPath, recordTypes, roles } = input;
 
-    // Validate $actions in the rule set
+    // Validate $size in the rule set
     if (ruleSet.$size !== undefined) {
       const { min = 0, max } = ruleSet.$size;