@cero-base/core 1.15.1 → 1.15.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.15.1",
+  "version": "1.15.2",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,
@@ -136,7 +136,7 @@
   },
   "dependencies": {
     "@hyperswarm/secret-stream": "^6.9.1",
-    "autobee": "2.0.0-rc.26",
+    "autobee": "2.0.0-rc.27",
     "autobee-encryption": "0.1.3",
     "b4a": "^1.8.1",
     "bare-crypto": "^1.15.3",

package/src/database/dispatch.js

@@ -266,15 +266,24 @@ export function makeDispatcher(
     const col = `@${ns}/${b.name}`
     if (b.verb === 'member') continue
     if (b.verb === 'device') {
+      // A device row IS the writer→role mapping: getSignerRole resolves a
+      // writer key through it to a member, and every permission check reads
+      // that role. So memberId is never taken off the wire — it stays whatever
+      // add-writer/claim-writer/add-member bound, and an unknown id can only
+      // ever bind to the signer's own member. Otherwise one unauthenticated op
+      // would re-point a writer at the owner and inherit their authority.
+      const bind = async (op, ctx, existing) =>
+        existing?.memberId ?? (await getSignerMember(ctx.view, ctx.key))
       add(`add-${b.verb}`, async (op, ctx) => {
-        await insert(ctx.view, b.name, col, { ...op, memberId: op.memberId ?? null })
+        const existing = await getDevice(ctx.view, op.id)
+        await insert(ctx.view, b.name, col, { ...op, memberId: await bind(op, ctx, existing) })
       })
       add(`set-${b.verb}`, async (op, ctx) => {
         const existing = await getDevice(ctx.view, op.id)
         const ts = op.updatedAt || 0
         await insert(ctx.view, b.name, col, {
           ...op,
-          memberId: existing?.memberId ?? op.memberId ?? null,
+          memberId: await bind(op, ctx, existing),
           createdAt: existing?.createdAt || op.createdAt || ts,
           updatedAt: ts
         })