@agentunion/fastaun 0.5.22 → 0.5.24

package/dist/org-protocol.js

@@ -46,6 +46,9 @@ export class ProtocolError extends Error {
 }
 export class CredentialRenewal {
     tail = Promise.resolve();
+    queryEpoch = 0;
+    verifiedQueries = new Map();
+    queryFlights = new Map();
     ports;
     scanGuard;
     constructor(ports) {
@@ -59,7 +62,11 @@ export class CredentialRenewal {
             },
             signer: (aid) => this.scanOperation(() => ports.signer(aid, this.scanGuard)),
             certificate: (aid, fingerprint, signedAt) => this.scanOperation(() => ports.certificate(aid, fingerprint, signedAt)),
-            call: (method, params, onSent) => this.scanOperation(() => onSent ? ports.call(method, params, onSent) : ports.call(method, params)),
+            call: (method, params, onSent) => this.scanOperation(async () => {
+                const result = await (onSent ? ports.call(method, params, onSent) : ports.call(method, params));
+                this.invalidateMutation(method);
+                return result;
+            }),
             send: (to, payload) => this.scanOperation(() => ports.send(to, payload)),
         };
     }
@@ -67,6 +74,75 @@ export class CredentialRenewal {
         if (this.scanGuard && !this.scanGuard.current())
             throw invalid('credential renewal was superseded');
     }
+    queryScope() {
+        return JSON.stringify([this.ports.currentAid(), this.ports.queryContext?.() ?? '']);
+    }
+    invalidateQueries() {
+        this.queryEpoch++;
+        this.verifiedQueries.clear();
+        this.queryFlights.clear();
+    }
+    invalidateMutation(method) {
+        if (method === 'credential.register' || method === 'credential.revoke'
+            || method.startsWith('org.') && !['org.lifecycle.get', 'org.lifecycle.list', 'org.member.get', 'org.member.list', 'org.credential.getStatus', 'org.credential.revocationList', 'org.audit.query', 'org.authz.check', 'org.health', 'org.status'].includes(method))
+            this.invalidateQueries();
+    }
+    async verifiedQuery(key, load) {
+        const scope = this.queryScope(), cacheKey = scope + ':' + key, now = Date.now() / 1000;
+        for (const [entryKey, entry] of this.verifiedQueries)
+            if (now >= entry.expiresAt)
+                this.verifiedQueries.delete(entryKey);
+        const cached = this.verifiedQueries.get(cacheKey);
+        if (cached)
+            return structuredClone(cached.value);
+        const pending = this.queryFlights.get(cacheKey);
+        if (pending)
+            return structuredClone(await pending);
+        const epoch = this.queryEpoch;
+        const request = (async () => {
+            const result = await load();
+            if (epoch !== this.queryEpoch || scope !== this.queryScope())
+                throw invalid('verified query was superseded');
+            const expiresAt = Math.min(Date.now() / 1000 + 60, result.expiresAt);
+            if (Date.now() / 1000 < expiresAt)
+                this.verifiedQueries.set(cacheKey, { value: structuredClone(result.value), expiresAt });
+            return result.value;
+        })();
+        this.queryFlights.set(cacheKey, request);
+        try {
+            return structuredClone(await request);
+        }
+        finally {
+            if (this.queryFlights.get(cacheKey) === request)
+                this.queryFlights.delete(cacheKey);
+        }
+    }
+    async currentMember(credential, binding, service, actor, signer) {
+        const credentials = { [binding.role === 'admin' ? 'approval_credential' : 'member_credential']: credential, membership_binding: binding };
+        const params = { org_id: credential.iss, member_aid: actor, credentials };
+        return this.verifiedQuery('org.member.get:' + service + ':' + digest(params), async () => {
+            const query = prepareOrganizationRequest('org.member.get', params, service, signer);
+            const result = await this.ports.call('org.member.get', query);
+            const member = result.member ?? result;
+            if (!isInt(member.version) || member.credential_cid !== undefined && member.credential_cid !== credential.cid)
+                throw invalid('current membership differs from managed credential');
+            const proof = result.membership_status;
+            if (!isRecord(proof))
+                return { value: member, expiresAt: 0 };
+            const now = Math.trunc(Date.now() / 1000);
+            if (proof.ver !== 'aun-membership-status/1' || proof.org_id !== credential.iss || proof.member_aid !== actor || proof.credential_cid !== credential.cid
+                || proof.membership_id !== binding.membership_id || proof.role !== binding.role || proof.version !== member.version
+                || proof.status !== 'active' || proof.credential_status !== 'active' || proof.responder !== service || proof.target !== actor || proof.request_id !== query.request_id || proof.nonce !== query.nonce
+                || !isInt(proof.as_of) || proof.as_of > now + 300 || !isInt(proof.expires_at) || proof.expires_at <= now || proof.expires_at <= proof.as_of || proof.expires_at > proof.as_of + 300
+                || !isRecord(proof.signature) || proof.signature.timestamp !== proof.as_of)
+                throw invalid('current membership proof does not match the query');
+            const cert = await this.ports.certificate(service, String(proof.signature.cert_fingerprint));
+            const unsigned = { ...proof };
+            delete unsigned.signature;
+            verifyAgentSignature(proof.signature, unsigned, service, () => cert, Math.trunc(Date.now() / 1000), false);
+            return { value: { ...member, version: proof.version }, expiresAt: Math.min(proof.expires_at, Number(credential.exp), Date.parse(new X509Certificate(cert).validTo) / 1000) };
+        });
+    }
     async scanOperation(operation) {
         this.checkScan();
         const result = await operation();
@@ -173,6 +249,7 @@ export class CredentialRenewal {
         });
     }
     observe(method, params, result) {
+        this.invalidateMutation(method);
         if (method !== 'credential.register' && !method.startsWith('org.'))
             return Promise.resolve();
         return this.serial(async () => {
@@ -244,12 +321,7 @@ export class CredentialRenewal {
                             delete request.signature;
                             if (record.membership_binding && !request.membership_binding) {
                                 if (now < credential.exp) {
-                                    const credentials = { [record.membership_binding.role === 'admin' ? 'approval_credential' : 'member_credential']: credential, membership_binding: record.membership_binding };
-                                    const query = prepareOrganizationRequest('org.member.get', { org_id: credential.iss, member_aid: actor, credentials }, record.service_aid, signer);
-                                    const current = await this.ports.call('org.member.get', query);
-                                    const member = current.member ?? current;
-                                    if (!isInt(member.version) || member.credential_cid !== undefined && member.credential_cid !== cid)
-                                        throw invalid('current membership differs from managed credential');
+                                    const member = await this.currentMember(credential, record.membership_binding, record.service_aid, actor, signer);
                                     record.version = member.version;
                                 }
                                 if (!isInt(record.version))
@@ -306,6 +378,14 @@ export class CredentialRenewal {
         verifyAgentSignature(payload.signature, unsigned, expected, () => cert, now);
     }
     async status(credential, actor, allowExpired = false, registrationConfirmedAt, confirmation) {
+        if (registrationConfirmedAt !== undefined || confirmation)
+            return this.statusFresh(credential, actor, allowExpired, registrationConfirmedAt, confirmation);
+        return this.verifiedQuery('credential.status:' + digest({ credential, actor, allowExpired }), async () => {
+            const expiresAt = await this.statusFresh(credential, actor, allowExpired);
+            return { value: expiresAt, expiresAt: Math.min(expiresAt, allowExpired ? Infinity : Number(credential.exp)) };
+        });
+    }
+    async statusFresh(credential, actor, allowExpired = false, registrationConfirmedAt, confirmation) {
         const target = 'credential.' + String(credential.iss).split('.').slice(1).join('.');
         const query = { credential_cid: credential.cid, request_id: organizationIdentifier(), nonce: organizationNonce(), include_chain: true };
         const requestedAt = Math.trunc(Date.now() / 1000);
@@ -328,7 +408,7 @@ export class CredentialRenewal {
             throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'membership registration confirmation is invalid');
         if (confirmation)
             Object.assign(confirmation, structuredClone(proof));
-        return proof.proofExpiresAt;
+        return Math.min(proof.proofExpiresAt, Date.parse(new X509Certificate(cert).validTo) / 1000);
     }
     async receiveNow(from, value, localIssuer, replay = false) {
         if (!isRecord(value) || !['credential.renewal.request', 'credential.renewal.result'].includes(String(value.type)))
@@ -736,6 +816,7 @@ export class CredentialRenewal {
             await this.ports.saveRevocations(actor, state, { ...guard, current });
             if (!current())
                 throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'credential revocation event was superseded');
+            this.invalidateQueries();
         });
     }
     _syncRevocations(guard) {
@@ -751,8 +832,6 @@ export class CredentialRenewal {
             const records = await this.ports.load(actor);
             check();
             const authorities = new Set();
-            if (AID_RE.test(actor))
-                authorities.add('credential.' + actor.split('.').slice(1).join('.'));
             for (const record of Object.values(records)) {
                 if (!isRecord(record) || !isRecord(record.credential))
                     continue;
@@ -772,6 +851,12 @@ export class CredentialRenewal {
                 }
             }
             for (const authority of authorities) {
+                const scope = this.queryScope(), epoch = this.queryEpoch;
+                const cachePrefix = scope + ':credential.revocationList:' + authority + ':';
+                const cached = this.verifiedQueries.get(cachePrefix + digest(state.authorities[authority] ?? {}));
+                if (cached && Date.now() / 1000 < cached.expiresAt)
+                    continue;
+                let expiresAt = Infinity;
                 for (let page = 0; page < 32; page++) {
                     check();
                     const previous = state.authorities[authority] ?? { revoked: {}, since_event_seq: 0, cursor: '' };
@@ -807,15 +892,18 @@ export class CredentialRenewal {
                     for (const event of proof.events)
                         Object.defineProperty(revoked, String(event.cid), { value: Math.max(Object.hasOwn(revoked, String(event.cid)) ? Number(revoked[String(event.cid)]) : 0, Number(event.event_seq)), enumerable: true, configurable: true, writable: true });
                     next.authorities[authority] = { revoked, since_event_seq: proof.next_cursor === '' ? last : Number(proof.next_cursor), cursor: proof.next_cursor, as_of: proof.as_of, expires_at: proof.expires_at };
-                    const commitGuard = { ...guard, current: () => this.ports.currentAid() === actor && (!guard || guard.current()) && Date.now() / 1000 < Number(proof.expires_at) };
+                    expiresAt = Math.min(expiresAt, Number(proof.expires_at), Date.parse(new X509Certificate(certificate).validTo) / 1000);
+                    const commitGuard = { ...guard, current: () => epoch === this.queryEpoch && scope === this.queryScope() && this.ports.currentAid() === actor && (!guard || guard.current()) && Date.now() / 1000 < expiresAt };
                     if (!commitGuard.current())
                         throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'revocation list expired before persistence');
                     await this.ports.saveRevocations(actor, next, commitGuard);
                     if (!commitGuard.current())
                         throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'revocation synchronization was superseded');
                     state = next;
-                    if (proof.next_cursor === '')
+                    if (proof.next_cursor === '') {
+                        this.verifiedQueries.set(cachePrefix + digest(state.authorities[authority]), { value: true, expiresAt: Math.min(Date.now() / 1000 + 60, expiresAt) });
                         break;
+                    }
                 }
             }
         });