How-to

Forward a message to a final recipient

Goal

Your agent received a multi-party ciphertext addressed to a chain that includes a final recipient. Peel your layer and hand the remainder off to that recipient — without ever seeing the plaintext.

How the relay works

A relay agent in a Bridge chain is just an intermediate hop of a multi-party message. It needs only:

• The ciphertext the originator produced via MultiEncryptMessageUsingSharedKeyAsync
• An ASK between itself and the original sender (fetched once per kgt window)

It peels its layer with DecryptMessageUsingSharedKeyPreAsync and hands the inner ciphertext, along with the original sender's identity and the kgt, to the next hop. The plaintext envelope is recovered only by the final recipient.

Code

// Step 1: fetch the agent's ASK against the original sender at this kgt
string agentSideAsk = await agent.FetchAskAsync(
    recipient: originalSender, kgt: kgt);
// (preview23+ Bridge: retry briefly on a kgt-boundary empty/placeholder)

// Step 2: peel one layer — leaves the inner ciphertext for the next hop
string innerCiphertext = await agent.DecryptMessageUsingSharedKeyPreAsync(
    ciphertext, agentSideAsk);

// Step 3: (optional) Casbin authorization gate
var decision = await agent.Authorization.AuthorizeAsync(
    sender:      originalSender,
    destination: finalRecipient,
    direction:   "outbound",
    sessionId:   agent.Name);
if (!decision.Allowed) { return; /* deny */ }

// Step 4: hand the inner ciphertext + envelope metadata to the next hop
//          via your own transport (HTTP, queue, file drop, …)
var envelope = new {
    kgt,
    destination     = finalRecipient,
    original_sender = originalSender,   // so the next hop knows whose ASK to fetch
    sender_agent    = agent.Name,       // your identity as the relay
    ciphertext      = innerCiphertext
};

What the end recipient does

// On the final recipient (alice). Receives the envelope via your transport.
string aliceAsk = await alice.FetchDestinationAskAsync(
    logintoken: aliceToken, envelope.kgt,
    destination: "~D~" + envelope.original_sender);   // ~D~ = decrypt-mode ASK

string plaintextEnvelope = await alice.MultiDecryptMessageUsingSharedKeyAsync(
    envelope.ciphertext, aliceAsk);

using var doc = JsonDocument.Parse(plaintextEnvelope);
Console.WriteLine($"SENDER  : {doc.RootElement.GetProperty("SENDER").GetString()}");
Console.WriteLine($"RECEIVER: {doc.RootElement.GetProperty("RECEIVER").GetString()}");
Console.WriteLine($"BODY    : {doc.RootElement.GetProperty("BODY").GetString()}");