@cero-base/core 1.15.0 → 1.15.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.15.0",
+  "version": "1.15.2",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,
@@ -136,7 +136,7 @@
   },
   "dependencies": {
     "@hyperswarm/secret-stream": "^6.9.1",
-    "autobee": "2.0.0-rc.26",
+    "autobee": "2.0.0-rc.27",
     "autobee-encryption": "0.1.3",
     "b4a": "^1.8.1",
     "bare-crypto": "^1.15.3",

package/src/database/dispatch.js

@@ -266,15 +266,24 @@ export function makeDispatcher(
     const col = `@${ns}/${b.name}`
     if (b.verb === 'member') continue
     if (b.verb === 'device') {
+      // A device row IS the writer→role mapping: getSignerRole resolves a
+      // writer key through it to a member, and every permission check reads
+      // that role. So memberId is never taken off the wire — it stays whatever
+      // add-writer/claim-writer/add-member bound, and an unknown id can only
+      // ever bind to the signer's own member. Otherwise one unauthenticated op
+      // would re-point a writer at the owner and inherit their authority.
+      const bind = async (op, ctx, existing) =>
+        existing?.memberId ?? (await getSignerMember(ctx.view, ctx.key))
       add(`add-${b.verb}`, async (op, ctx) => {
-        await insert(ctx.view, b.name, col, { ...op, memberId: op.memberId ?? null })
+        const existing = await getDevice(ctx.view, op.id)
+        await insert(ctx.view, b.name, col, { ...op, memberId: await bind(op, ctx, existing) })
       })
       add(`set-${b.verb}`, async (op, ctx) => {
         const existing = await getDevice(ctx.view, op.id)
         const ts = op.updatedAt || 0
         await insert(ctx.view, b.name, col, {
           ...op,
-          memberId: existing?.memberId ?? op.memberId ?? null,
+          memberId: await bind(op, ctx, existing),
           createdAt: existing?.createdAt || op.createdAt || ts,
           updatedAt: ts
         })

package/src/database/index.js

@@ -195,13 +195,16 @@ export class Database extends ReadyResource {
       // no cero row records another writer's oplog length to fall back to.
       isTrusted: async (writer, view) => {
         try {
-          if (await view.get(`@${this.ns}/devices`, { id: toId(writer) })) return true
-          // before any device record exists (a boot's genesis-era reference)
-          // only the genesis writer may vouch — its core IS the db key, and
-          // its signatures are unforgeable. Anyone else stays refused: an
-          // empty view is exactly the window an ex-member would target.
-          const any = await view.find(`@${this.ns}/devices`, { limit: 1 }).toArray()
-          return any.length === 0 && !!this.key && b4a.equals(writer, this.key)
+          const row = await bounded(view.get(`@${this.ns}/devices`, { id: toId(writer) }))
+          if (!row) return false
+          if (row.v) return true
+          // only where the view PROVABLY holds no device yet (a boot's
+          // genesis-era reference) may the genesis writer vouch — its core IS
+          // the db key, and its signatures are unforgeable. Everyone else
+          // stays refused: an empty view is the window an ex-member targets.
+          const any = await bounded(view.find(`@${this.ns}/devices`, { limit: 1 }).toArray())
+          if (!any) return false
+          return any.v.length === 0 && !!this.key && b4a.equals(writer, this.key)
         } catch {
           return false
         }
@@ -1240,6 +1243,17 @@ export class Database extends ReadyResource {
   }
 }
 
+// A trust decision reads a historic checkout view, whose blocks may not be
+// servable yet — an unbounded read there wedges autobee's drain forever. The
+// value is wrapped so a timeout (null) is never mistaken for what the read
+// would have returned; undecidable in time means "not trusted", and the
+// caller retries.
+const bounded = (promise, ms = 2000) =>
+  Promise.race([
+    promise.then((v) => ({ v })),
+    new Promise((resolve) => setTimeout(() => resolve(null), ms))
+  ])
+
 // Fields the write path stamps itself — always allowed even if not user-declared.
 const SYSTEM_FIELDS = new Set(['id', 'memberId', 'index', 'createdAt', 'updatedAt'])