@cero-base/cero 1.15.1 → 1.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/cero",
-  "version": "1.15.1",
+  "version": "1.16.0",
   "description": "The ideal p2p API — everything is a handle, handles contain refs, refs contain rows.",
   "type": "module",
   "sideEffects": false,
@@ -95,7 +95,7 @@
     "test:node": "ls test/*.test.js | xargs -P1 -n1 brittle-node"
   },
   "dependencies": {
-    "@cero-base/core": "^1.15.1",
+    "@cero-base/core": "^1.16.0",
     "b4a": "^1.8.1",
     "bare-abort-controller": "^1.1.2",
     "bare-crypto": "^1.15.3",

package/src/build/index.js

@@ -205,6 +205,7 @@ function register(name, node, ctx) {
       schema: fqn,
       fields: Object.keys(node.fields)
     }
+    if (node.own) refEntry.own = true
     const fileFields = fileFieldNames(node.fields)
     if (fileFields.length) refEntry.files = fileFields
     ctx.meta.refs[name] = refEntry

package/src/build/schemas.js

@@ -14,7 +14,14 @@ export const main = {
     writer: required(bytes),
     sig: required(bytes),
     isIndexer: bool,
-    ts: int
+    ts: int,
+    // Who this writer belongs to, and at what rank. Admission carries its own
+    // authorization so add-writer can refuse exactly when the paired
+    // add-member would — the two apply independently, so without this a
+    // refused grant still leaves an admitted writer behind. Absent on a
+    // device you add for yourself (bootstrap), where there is nothing to cap.
+    memberId: string,
+    role: string
   },
   counter: {
     name: required(string),

package/src/handle/index.js

@@ -12,7 +12,7 @@ import { Identity } from '@cero-base/core/identity'
 import { Database } from '@cero-base/core/database'
 import { epochEntries, blobEpochKey } from '@cero-base/core/database/encryption'
 import { Pairing } from '@cero-base/core/pairing'
-import { toId, grants, addWriterPayload } from '@cero-base/core/utils'
+import { toId, grants, isRank, addWriterPayload } from '@cero-base/core/utils'
 import { CeroError } from '@cero-base/core/errors'
 import { Blobs } from '@cero-base/core/blobs'
 import { decodeId } from '@cero-base/core/blobs/codec'
@@ -483,6 +483,10 @@ export class Handle extends ReadyResource {
       throw CeroError.INVALID(
         'invite() is not available on the root handle — open a child handle first'
       )
+    // An invite is a capability: whoever holds it is admitted. Cap it here or
+    // a member mints one above their own rank, and the mismatch only surfaces
+    // at apply — as a silent drop that still leaves the joiner admitted.
+    if (opts?.role !== undefined && opts.role !== '') await this._checkGrant(opts.role)
     const str = await this.pair.createInvite(opts)
     const record = this.pair.recordOf(str)
     if (record) {
@@ -548,6 +552,14 @@ export class Handle extends ReadyResource {
     if (candidate.invite.role && !grants(candidate.invite.role, role)) {
       throw CeroError.INVALID(`role '${role}' exceeds the invite role '${candidate.invite.role}'`)
     }
+    // Refuse BEFORE confirm() — but without awaiting: confirm has to answer
+    // inside the pairing request's lifetime, and any read here drops it. Rank
+    // validation is synchronous and catches the dangerous case (an app role
+    // name silently grants nothing); the cap against our own rank is enforced
+    // at apply, where add-writer refuses to admit what it cannot grant.
+    if (!isRank(role)) {
+      throw CeroError.INVALID(`role '${role}' is not a rank (owner, admin, member, reader)`)
+    }
 
     // confirm must answer within the incoming pairing request's lifetime —
     // any await before it (even ~100ms) and the response is dropped, the
@@ -586,12 +598,32 @@ export class Handle extends ReadyResource {
         sig,
         master: this.identity.publicKey,
         writer: writerKey,
+        // admission carries who and at what rank, so a grant we cannot make
+        // admits nobody — the two ops apply independently and cannot roll
+        // each other back
+        memberId: member.id,
+        role,
         ts: member.updatedAt || Date.now()
       })
       await tx.call('add-member', member)
     })
   }
 
+  // Throws unless this handle may grant `role`: it must be a real rank, and
+  // never above our own. `grants` treats an unknown role as "no" everywhere,
+  // so an app role name must fail loudly here rather than silently downstream.
+  async _checkGrant(role) {
+    if (!isRank(role)) {
+      throw CeroError.INVALID(`role '${role}' is not a rank (owner, admin, member, reader)`)
+    }
+    const { data: me } = await this.store.get('members', this.identity.id)
+    // no member row yet = genesis (we are creating the room) — nothing to cap
+    if (!me) return
+    if (!grants(me.role, role)) {
+      throw CeroError.DENIED(null, `role '${role}' exceeds your own role '${me.role}'`)
+    }
+  }
+
   /**
    * Leave a child handle — removes it from the parent's `handles` collection
    * and closes the session. No-op on root handles.
@@ -822,11 +854,11 @@ export class Handle extends ReadyResource {
    * @param {string} id
    * @returns {Promise<Handle>}
    */
-  async _load(type, id) {
+  async _load(type, id, opts) {
     for (const c of this.children) if (c.id === id) return c
     const existing = this._loading.get(id)
     if (existing) return existing
-    const loading = this._reopen(type, id)
+    const loading = this._reopen(type, id, opts)
     this._loading.set(id, loading)
     try {
       return await loading
@@ -843,7 +875,7 @@ export class Handle extends ReadyResource {
    * @param {string} id
    * @returns {Promise<Handle>}
    */
-  async _reopen(type, id) {
+  async _reopen(type, id, opts) {
     const { data } = await this.store.get('handles', id)
     if (!data) throw CeroError.UNKNOWN('handle', id)
     if (data.type !== type)
@@ -868,7 +900,10 @@ export class Handle extends ReadyResource {
     if (firstTime) {
       await this._saveKeyPair(id, writer)
     }
-    this._wireAccept(child)
+    // a reopen must not silently re-arm auto-accept: `accept: false` is a
+    // host-approval gate, and one that comes back on the next open is worse
+    // than none at all
+    if (opts?.accept !== false) this._wireAccept(child, { role: opts?.role })
     bind(child, type)
     this.children.add(child)
     this.emit('handle', child, {})

package/src/lib/operators.js

@@ -341,7 +341,7 @@ function snapshotStream(src, map) {
 export const open = (ref, arg) => {
   if (typeof arg === 'string') return ref.handle._join(arg, ref.name)
   if (arg && typeof arg.invite === 'string') return ref.handle._join(arg.invite, ref.name)
-  if (arg && typeof arg.id === 'string') return ref.handle._load(ref.name, arg.id)
+  if (arg && typeof arg.id === 'string') return ref.handle._load(ref.name, arg.id, arg)
   return ref.handle._create(ref.name, arg)
 }
 

package/types/build/schemas.d.ts

@@ -8,6 +8,8 @@ export const main: {
         sig: import("@cero-base/core").Prim;
         isIndexer: import("@cero-base/core").Prim;
         ts: import("@cero-base/core").Prim;
+        memberId: import("@cero-base/core").Prim;
+        role: import("@cero-base/core").Prim;
     };
     counter: {
         name: import("@cero-base/core").Prim;

package/types/handle/index.d.ts

@@ -254,6 +254,7 @@ export class Handle extends ReadyResource {
      * @returns {Promise<void>}
      */
     accept(candidate: any, { role, name }?: AcceptOpts): Promise<void>;
+    _checkGrant(role: any): Promise<void>;
     /**
      * Leave a child handle — removes it from the parent's `handles` collection
      * and closes the session. No-op on root handles.
@@ -299,7 +300,7 @@ export class Handle extends ReadyResource {
      * @param {string} id
      * @returns {Promise<Handle>}
      */
-    _load(type: string, id: string): Promise<Handle>;
+    _load(type: string, id: string, opts: any): Promise<Handle>;
     /**
      * Reconstruct a child handle by id. Reuses the stored writer keypair if
      * available; otherwise generates a fresh one and claims writer capability.
@@ -308,7 +309,7 @@ export class Handle extends ReadyResource {
      * @param {string} id
      * @returns {Promise<Handle>}
      */
-    _reopen(type: string, id: string): Promise<Handle>;
+    _reopen(type: string, id: string, opts: any): Promise<Handle>;
     /**
      * Pause networking + storage. Idempotent; no-op on child handles.
      *