Delegate consumer/add on first authorization

[Gozala]

Currently registration flow is somewhat complex:

1. Agent needs to authorize using access/authorize
2. Pull delegations by invoking access/claim
3. From received delegations deduce that it needs to create a new space (which is not trivial because it may have delegations from others).
4. If it deduced that it space is needed it needs to generate new space and invoke provider/add to install a provider for it.
   • Not this will fail if account has already called provider/add prior.
5. Delegate all space capabilities to the account.

We could simplify this a lot by just delegating consumer/add capability on first authorization so that in step 2 you'll have get it without having to guessing if you need to do provider/add. In other words with this flow the steps would change as follows:

1. Agent needs to authorize using access/authorize
2. Pull delegations by invoking access/claim.
3. If you received delegation includes consumer/add where nb.consumer is agent DID
   1. Invoke it to complete registration.
   2. Delegate * to an account.

[gobengo]

customer/add do you mean consumer/add or a new hypothetical customer/add?

[Gozala]

customer/add do you mean consumer/add or a new hypothetical customer/add?

Yes thanks for flagging

[Gozala]

I have realized there is a major flaw with this proposal and I don't think we should do it, at least the way it has been proposed. Below I'll try to explain the flaw:

1. Agent invoking authorization may only request store/list capability.
2. If it is the first agent to perform authorization it will suddenly have complete authority over space.
3. Even if we require that agent include { can: * with: ucan:* } delegation with authorization, it still could revoke it in a future.

This is especially a problem if agent happens to be generated by malicious website. In fact our current provider/add based flow is also problematic for the same reason.

What would be a proper approach here ?

I think proper solution would be to mediate space creation / registration with a user instead which can be done in a following way:

1. Untrusted app Agent can requests access/authorize from the account.
2. We forward that request to the target mailbox (further limiting time frame etc...).
3. Link in the email takes you to the interactive webpage which initiates negotiation
4. During negotiation we discover if the account already has a space.
5. If account does not have a space webpage generates a space and delegates capabilities to the account.
6. Then account account redelegates whatever agent requested (assuming user confirms that) from the space.

Difference here is that email takes to you to the page that allows you to create a space and register it as opposed to some agent that can be a malicious app.