@bod.ee/db 0.10.1 → 0.10.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bod.ee/db",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "module": "index.ts",
   "type": "module",
   "exports": {

package/src/client/BodClient.ts

@@ -546,6 +546,11 @@ export class AuthFacade {
     return this.client._send('auth-link-device', { accountFingerprint, password, devicePublicKey, deviceName }) as Promise<{ fingerprint: string }>;
   }
 
+  /** Link device by account display name (resolves fingerprint server-side) */
+  async linkDeviceByName(displayName: string, password: string, devicePublicKey: string, deviceName?: string): Promise<{ fingerprint: string }> {
+    return this.client._send('auth-link-device', { displayName, password, devicePublicKey, deviceName }) as Promise<{ fingerprint: string }>;
+  }
+
   /** Revoke a session */
   async revokeSession(sid: string): Promise<void> {
     await this.client._send('auth-revoke-session', { sid });

package/src/server/Transport.ts

@@ -716,8 +716,18 @@ export class Transport {
             }
             case 'auth-link-device': {
               if (!self.options.keyAuth) return error('KeyAuth not configured', Errors.INTERNAL);
+              // Resolve account: by fingerprint or displayName
+              let accountFp = msg.accountFingerprint;
+              if (!accountFp && msg.displayName) {
+                const match = self.options.keyAuth.listAccounts().find(
+                  (a: any) => a.displayName?.toLowerCase() === msg.displayName.toLowerCase()
+                );
+                if (!match) return error('Account not found', Errors.AUTH_REQUIRED);
+                accountFp = match.fingerprint;
+              }
+              if (!accountFp) return error('accountFingerprint or displayName required', Errors.INVALID);
               // Password is the auth — engine.linkDevice verifies it
-              const linked = self.options.keyAuth.linkDevice(msg.accountFingerprint, msg.password, msg.devicePublicKey, msg.deviceName);
+              const linked = self.options.keyAuth.linkDevice(accountFp, msg.password, msg.devicePublicKey, msg.deviceName);
               if (!linked) return error('Link failed (wrong password or account not found)', Errors.AUTH_REQUIRED);
               return reply(linked);
             }
@@ -737,14 +747,14 @@ export class Transport {
             }
             case 'auth-create-account': {
               if (!self.options.keyAuth) return error('KeyAuth not configured', Errors.INTERNAL);
-              // Root-only, or allowed when zero accounts exist (bootstrap)
+              // Root-only, or allowed when zero accounts exist (bootstrap), or open registration
               if (ws.data.auth) {
                 const ctx = ws.data.auth as { isRoot?: boolean };
                 if (!ctx.isRoot) return error('Root only', Errors.PERMISSION_DENIED);
               } else {
-                // Only allow unauthenticated if no accounts exist yet
                 const accounts = self.options.keyAuth.listAccounts();
-                if (accounts.length > 0) return error('Authentication required', Errors.AUTH_REQUIRED);
+                const allowOpen = self.options.keyAuth.options.allowOpenRegistration;
+                if (accounts.length > 0 && !allowOpen) return error('Authentication required', Errors.AUTH_REQUIRED);
               }
               const result = self.options.keyAuth.createAccount(msg.password, msg.roles, msg.displayName, msg.devicePublicKey);
               return reply(result);

package/tests/keyauth.test.ts

@@ -796,13 +796,40 @@ describe('KeyAuth', () => {
       expect(result.data.isRoot).toBe(true);
       expect(result.data.deviceFingerprint).toBeTruthy();
 
-      // Second unauthenticated create should be rejected
+      // With open registration (default), second create is allowed
       const ws2 = await openWs();
+      const second = await wsSend(ws2, { op: 'auth-create-account', password: 'user2' });
+      expect(second.ok).toBe(true);
+      expect(second.data.isRoot).toBe(false);
+      ws.close();
+      ws2.close();
+    });
+
+    it('auth-create-account closed registration: second account rejected', async () => {
+      // Use a separate DB with closed registration
+      const closedPort = 14400 + Math.floor(Math.random() * 1000);
+      const closedDb = new BodDB({ path: ':memory:', sweepInterval: 0, keyAuth: { allowOpenRegistration: false } });
+      closedDb.serve({ port: closedPort });
+      const openClosedWs = () => new Promise<WebSocket>((res, rej) => {
+        const w = new WebSocket(`ws://localhost:${closedPort}`);
+        w.addEventListener('open', () => res(w));
+        w.addEventListener('error', rej);
+      });
+      const deviceKp = await browserGenerateKeyPair();
+      const ws = await openClosedWs();
+      const result = await wsSend(ws, {
+        op: 'auth-create-account', password: 'root-pw', displayName: 'Root',
+        devicePublicKey: deviceKp.publicKeyBase64,
+      });
+      expect(result.ok).toBe(true);
+
+      const ws2 = await openClosedWs();
       const reject = await wsSend(ws2, { op: 'auth-create-account', password: 'hacker' });
       expect(reject.ok).toBe(false);
       expect(reject.code).toBe('AUTH_REQUIRED');
       ws.close();
       ws2.close();
+      closedDb.close();
     });
 
     it('auth-register-device via WS', async () => {