Some minor adjustments to get stuff working

src/builder.rs

@@ -175,10 +175,23 @@ where
         })
         .map_err(|e| Error::InternalUcanError { msg: e.to_string() })?;
 
-        let signature = signer
-            .sign(&[header.as_ref(), ".".as_bytes(), payload.as_ref()].concat())
-            .to_vec()
-            .into();
+        let header_enc = serde_json::to_value(&header)
+            .map_err(|e| Error::InternalUcanError { msg: e.to_string() })?;
+
+        let payload_enc = serde_json::to_value(&payload)
+            .map_err(|e| Error::InternalUcanError { msg: e.to_string() })?;
+
+        let signed_data = format!(
+            "{}.{}",
+            header_enc.as_str().ok_or(Error::InternalUcanError {
+                msg: "Expected base64 encoding of header".to_string(),
+            })?,
+            payload_enc.as_str().ok_or(Error::InternalUcanError {
+                msg: "Expected base64 encoding of payload".to_string(),
+            })?,
+        );
+
+        let signature = signer.sign(signed_data.as_ref()).to_vec().into();
 
         Ok(Ucan {
             header,

src/plugins.rs

@@ -11,7 +11,7 @@ use crate::{
     error::Error,
     semantics::{
         ability::{Ability, TopAbility},
-        caveat::Caveat,
+        caveat::{Caveat, EmptyCaveat},
         resource::Resource,
     },
 };
@@ -20,7 +20,8 @@ pub mod ucan;
 pub mod wnfs;
 
 #[distributed_slice]
-static STATIC_PLUGINS: [&dyn Plugin<
+#[doc(hidden)]
+pub static STATIC_PLUGINS: [&dyn Plugin<
     Resource = Box<dyn Resource>,
     Ability = Box<dyn Ability>,
     Caveat = Box<dyn Caveat>,
@@ -88,7 +89,8 @@ where
     C: 'static,
     E: 'static,
 {
-    inner: &'static dyn Plugin<Resource = R, Ability = A, Caveat = C, Error = E>,
+    #[doc(hidden)]
+    pub inner: &'static dyn Plugin<Resource = R, Ability = A, Caveat = C, Error = E>,
 }
 
 impl<R, A, C, E> Plugin for WrappedPlugin<R, A, C, E>
@@ -149,6 +151,13 @@ where
             return Ok(None);
         };
 
+        if ability.is::<TopAbility>() {
+            return Ok(Some(Box::new(
+                erased_serde::deserialize::<EmptyCaveat>(deserializer)
+                    .map_err(|e| anyhow::anyhow!(e))?,
+            )));
+        }
+
         let Some(ability) = ability.downcast_ref::<A>() else {
             return Ok(None);
         };
@@ -216,7 +225,7 @@ macro_rules! register_plugin {
             Resource = Box<dyn $crate::semantics::resource::Resource>,
             Ability = Box<dyn $crate::semantics::ability::Ability>,
             Caveat = Box<dyn $crate::semantics::caveat::Caveat>,
-            Error = Error,
+            Error = $crate::error::Error,
         > = &$crate::plugins::WrappedPlugin { inner: $plugin };
     };
 }

src/plugins/ucan.rs

@@ -6,7 +6,6 @@ use cid::Cid;
 use url::Url;
 
 use crate::{
-    error::Error,
     semantics::{ability::Ability, caveat::EmptyCaveat},
     Did,
 };
@@ -68,7 +67,9 @@ impl Plugin for UcanPlugin {
         _ability: &Self::Ability,
         deserializer: &mut dyn erased_serde::Deserializer<'_>,
     ) -> Result<Option<Self::Caveat>, Self::Error> {
-        erased_serde::deserialize(deserializer).map_err(|e| anyhow::anyhow!(e))
+        Ok(Some(
+            erased_serde::deserialize(deserializer).map_err(|e| anyhow::anyhow!(e))?,
+        ))
     }
 }
 

src/plugins/wnfs.rs

@@ -2,10 +2,7 @@
 
 use std::fmt::Display;
 
-use crate::{
-    error::Error,
-    semantics::{ability::Ability, caveat::EmptyCaveat, resource::Resource},
-};
+use crate::semantics::{ability::Ability, caveat::EmptyCaveat, resource::Resource};
 use url::Url;
 
 use super::Plugin;

src/semantics/ability.rs

@@ -8,7 +8,7 @@ use dyn_clone::{clone_trait_object, DynClone};
 use super::caveat::Caveat;
 
 /// An ability defined as part of a semantics
-pub trait Ability: Display + DynClone + Downcast + 'static {
+pub trait Ability: Send + Sync + Display + DynClone + Downcast + 'static {
     /// Returns true if self is a valid attenuation of other
     fn is_valid_attenuation(&self, other: &dyn Ability) -> bool;
 

src/semantics/caveat.rs

@@ -8,7 +8,7 @@ use erased_serde::serialize_trait_object;
 use serde::{Deserialize, Serialize};
 
 /// A caveat defined as part of a semantics
-pub trait Caveat: DynClone + Downcast + erased_serde::Serialize + 'static {
+pub trait Caveat: Send + Sync + DynClone + Downcast + erased_serde::Serialize + 'static {
     /// Returns true if the caveat is valid
     fn is_valid(&self) -> bool;
 

src/semantics/resource.rs

@@ -6,7 +6,7 @@ use downcast_rs::{impl_downcast, Downcast};
 use dyn_clone::{clone_trait_object, DynClone};
 
 /// A resource defined as part of a semantics
-pub trait Resource: Display + DynClone + Downcast + 'static {
+pub trait Resource: Send + Sync + Display + DynClone + Downcast + 'static {
     /// Returns true if self is a valid attenuation of other
     fn is_valid_attenuation(&self, other: &dyn Resource) -> bool;
 }

src/ucan.rs

@@ -156,15 +156,21 @@
         self.validate(at_time, did_verifier_map)?;
 
         for capability in self.capabilities() {
-            if !resource.is_valid_attenuation(capability.resource()) {
+            let attenuated = Capability {
+                resource: dyn_clone::clone_box(&resource),
+                ability: dyn_clone::clone_box(&ability),
+                caveat: dyn_clone::clone_box(capability.caveat()),
+            };
+
+            if !attenuated.is_subsumed_by(&capability) {
                 continue;
             }
 
-            if !ability.is_valid_attenuation(capability.ability()) {
-                continue;
+            if self.issuer() == issuer {
+                capabilities.push(attenuated.clone());
             }
 
-            proof_queue.push_back((self.clone(), capability.clone(), capability.clone()));
+            proof_queue.push_back((self.clone(), attenuated, capability.clone()));
         }
 
         while let Some((ucan, attenuated_cap, leaf_cap)) = proof_queue.pop_front() {
@@ -206,33 +212,16 @@
                             continue;
                         }
 
-                        if ucan.validate(at_time, did_verifier_map).is_err() {
+                        if proof_ucan.validate(at_time, did_verifier_map).is_err() {
                             continue;
                         }
 
-                        for capability in self.capabilities() {
-                            if !attenuated_cap
-                                .resource()
-                                .is_valid_attenuation(capability.resource())
-                            {
-                                continue;
-                            }
-
-                            if !attenuated_cap
-                                .ability()
-                                .is_valid_attenuation(capability.ability())
-                            {
+                        for capability in proof_ucan.capabilities() {
+                            if !attenuated_cap.is_subsumed_by(&capability) {
                                 continue;
                             }
 
-                            if !attenuated_cap
-                                .caveat()
-                                .is_valid_attenuation(capability.caveat())
-                            {
-                                continue;
-                            }
-
-                            if ucan.issuer() == issuer {
+                            if proof_ucan.issuer() == issuer {
                                 capabilities.push(leaf_cap.clone());
                             }
 
@@ -485,3 +474,10 @@
     Deserialize::deserialize(deserializer)
         .map_err(|_| serde::de::Error::custom("required field is missing or has invalid type"))
 }
+
+#[cfg(test)]
+#[test]
+fn test_send_sync() {
+    fn only_sync<T: Send + Sync>() {}
+    only_sync::<Ucan>()
+}