feat: fix canDelegateCapability et al

1) use new allows method from a ucanto branch to do so
2) throw errors in new space create flow if we adding a provider or delegating access fails
3) claim delegations after authorizing

packages/access-client/package.json

@@ -62,7 +62,7 @@
     "@ipld/dag-cbor": "^9.0.0",
     "@ipld/dag-ucan": "^3.2.0",
     "@ucanto/client": "^5.1.0",
-    "@ucanto/core": "^5.1.0",
+    "@ucanto/core": "file:../../../ucanto/packages/core",
     "@ucanto/interface": "^6.0.0",
     "@ucanto/principal": "^5.1.0",
     "@ucanto/transport": "^5.1.0",

packages/access-client/src/agent.js

@@ -333,9 +333,19 @@ export class Agent {
       expiration: Infinity,
     })
 
-    await this.addProvider(signer)
-    await this.delegateSpaceAccessToAccount(signer)
-
+    const providerResult = await this.addProvider(signer)
+    if (providerResult.error) {
+      throw new Error(providerResult.message, { cause: providerResult })
+    }
+    const delegateSpaceAccessResult = await this.delegateSpaceAccessToAccount(
+      signer
+    )
+    if (delegateSpaceAccessResult.error) {
+      // @ts-ignore it's very weird that this is throwing an error but line 338 above does not - ignore for now
+      throw new Error(delegateSpaceAccessResult.message, {
+        cause: delegateSpaceAccessResult,
+      })
+    }
     /** @type {import('./types').SpaceMeta} */
     const meta = { isRegistered: true }
     // eslint-disable-next-line eqeqeq
@@ -561,6 +571,10 @@ export class Agent {
 
     await this.addProof(sessionDelegation)
     this.#data.setSessionPrincipal(sessionPrincipal)
+
+    // claim delegations here because we will need an ucan/attest from the service to
+    // pair with the session delegation we just claimed to make it work
+    await this.claimDelegations()
   }
 
   async claimDelegations() {
@@ -613,7 +627,7 @@ export class Agent {
       throw new Error('cannot add provider, please authorize first')
     }
 
-    return await this.invokeAndExecute(Provider.add, {
+    return this.invokeAndExecute(Provider.add, {
       audience: this.connection.id,
       with: sessionPrincipal.did(),
       proofs: this.proofs([
@@ -645,7 +659,7 @@ export class Agent {
 
     const spaceSaysAccountCanAdminSpace =
       await createSpaceSaysAccountCanAdminSpace(space, sessionPrincipal)
-    return await this.invokeAndExecute(Access.delegate, {
+    return this.invokeAndExecute(Access.delegate, {
       audience: this.connection.id,
       with: space.did(),
       expiration: Infinity,

packages/access-client/src/delegations.js

@@ -1,6 +1,7 @@
 // @ts-ignore
 // eslint-disable-next-line no-unused-vars
 import * as Ucanto from '@ucanto/interface'
+import * as ucanto from '@ucanto/core'
 import { canDelegateAbility } from '@web3-storage/capabilities/utils'
 
 /**
@@ -44,7 +45,9 @@ export function validate(delegation, opts) {
   } = opts ?? {}
 
   if (checkAudience && delegation.audience.did() !== checkAudience.did()) {
-    throw new Error(`Delegation audience does not match required DID.`)
+    throw new Error(
+      `Delegation audience ${delegation.audience.did()} does not match required DID ${checkAudience.did()}`
+    )
   }
 
   if (checkIsExpired && isExpired(delegation)) {
@@ -62,13 +65,16 @@ export function validate(delegation, opts) {
  * @param {import('@ucanto/interface').Capability} child
  */
 export function canDelegateCapability(delegation, child) {
-  for (const parent of delegation.capabilities) {
-    // TODO is this right?
-    if (
-      (parent.with === child.with || parent.with === 'ucan:*') &&
-      canDelegateAbility(parent.can, child.can)
-    ) {
-      return true
+  // @ts-ignore ignore this until we bring in ucanto as a normal dependency rather than linking to a local version
+  const allowsCapabilities = ucanto.Delegation.allows(delegation)
+  if (allowsCapabilities[child.with]) {
+    const cans = /** @type {import('@ucanto/interface').Ability[]} */ (
+      Object.keys(allowsCapabilities[child.with])
+    )
+    for (const can of cans) {
+      if (canDelegateAbility(can, child.can)) {
+        return true
+      }
     }
   }
   return false