requestProxyKey

requestProxyKey(ksCollection, messageDetails)

Requests a new proxy key from the auth service’s “new-px” endpoint. The resulting key can only have the same permissions as, or fewer permissions than, the identity requesting it – this cannot be used to escalate privileges or extend an existing proxy key’s expiry.

Arguments:

• ksCollection (KsCollection) – A KsCollection() with an ‘owner’ entry (the keystore that signs the request and becomes the new key’s owner), plus an entry for every address referenced in an auth field of messageDetails.pxRequest.

• messageDetails (object) – Must include pxRequest (see normalizePxRequest()).

Return type:

Promise<IdKeystore>

Any pxRequest component with an auth property (requesting authority over something more than the caller’s own identity, for example, a bank account) is itself wrapped in a signed message using the corresponding keystore from ksCollection, so that the server can confirm the resource owner actually approved it.

Every component’s parameters are validated before anything is sent: each must be null, a string, a wallet.Address (for auth), or a non-NaN number – anything else throws, so a stray NaN can’t silently get JSON-encoded into something that passes the server’s own checks.

Example

const identity = require('dcp/identity');

const ksCollection = new identity.KsCollection();
ksCollection.add(identity.get(), 'owner');

const proxyKey = await identity.requestProxyKey(ksCollection, {
  pxRequest: await identity.normalizePxRequest(['job.exec']),
});