Adding a User to a Group

Sequence Diagram

User Request

1. The user sends a request to the server to add a user to a group.

Server Processing

2. The server fetches all the credential fields accessible by the group.
3. The server returns the credential fields to the user.

Background Service Processing

4. The user sends the credential fields and the user to be added to the group to the background service.
5. The background service sends the credential fields to the WASM service for decryption.
6. The WASM service decrypts the credential fields.
7. The WASM service returns the decrypted credential fields to the background service.

[
    {
        "credentialId": "credential_id",
        "fields": [
            {
            "fieldId": "field_id",
            "fieldValue": "decrypted_field_value"
            }
    ]
    }
]

8. The background service sends the decrypted credential fields to the WASM service for encryption with the user’s public key.
9. The WASM service encrypts the credential fields with the user’s public key.
10. The WASM service returns the encrypted credential fields to the background service.
11. The background service returns the encrypted credential fields to the user.

[{
    "userId": "user_id",
    "credentials":[
    {
        "credentialId": "credential_id",
        "fields": [
            {
            "fieldId": "field_id",
            "fieldValue": "encrypted_field_value"
            }
        ]
    }
]
}]

12. The client then sends the whole payload to hash and then sign
13. The client sends the payload to the server with signature in the header.

Server Processing

14. The user sends the payload (encrypted credential fields, user ID, and group ID) to the server.

{
    "groupId": "group_id",
    "memberId": "user_id",
    "memberRole": "role",
    "credentials": [
        {
            "credentialId": "credential_id",
            "fields": [
                {
                    "fieldId": "field_id",
                    "fieldValue": "encrypted_field_value"
                }
            ]
        }
    ]
}

15. The server processes the request after verifying the signature.
16. For each credential:
    • The server infers the access type from the group.
    • The server adds entries to the credential_access table.
    • The server adds entries to the fields table.
17. The server returns the response (success/failure) to the user.

Note: When a user is added to a group, they gain access to all the credentials that are accessible by the group. The server infers the access type for each credential based on the group’s access and adds the necessary entries to the credential_access and fields tables.