@dotrino/vault 0.41.0 → 0.42.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/src/enroll.js +6 -3
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dotrino/vault",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.42.0",
|
|
4
4
|
"description": "Usa ESTE dispositivo (navegador) como bóveda/CA del ecosistema Dotrino: atiende enrolamientos por el proxy y firma certificados de delegación a tus máquinas. Incluye el cliente de SERVICIO (Node): un proyecto se enrola una vez y jala sus credenciales del vault en vez del .env (`import '@dotrino/vault/config'`).",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|
|
@@ -47,7 +47,7 @@
|
|
|
47
47
|
"pairing"
|
|
48
48
|
],
|
|
49
49
|
"peerDependencies": {
|
|
50
|
-
"@dotrino/identity": ">=0.
|
|
50
|
+
"@dotrino/identity": ">=0.67.0",
|
|
51
51
|
"@dotrino/proxy-client": ">=0.13.0"
|
|
52
52
|
},
|
|
53
53
|
"license": "MIT",
|
package/src/enroll.js
CHANGED
|
@@ -30,7 +30,7 @@
|
|
|
30
30
|
* `docs/pairing-protocol.md`).
|
|
31
31
|
*/
|
|
32
32
|
import { verifyDeviceSig, pubkeyId, commitCode } from '@dotrino/identity/capabilities'
|
|
33
|
-
import { verifyContinuity } from '@dotrino/identity/acta'
|
|
33
|
+
import { verifyContinuity, canSeal } from '@dotrino/identity/acta'
|
|
34
34
|
|
|
35
35
|
/** Un token de emparejamiento vale 5 min. */
|
|
36
36
|
export const PAIRING_TTL_MS = 5 * 60 * 1000
|
|
@@ -388,9 +388,12 @@ export function createEnrollDesk ({
|
|
|
388
388
|
const pend = [...pending.values()].find((x) => x.state === 'AWAITING_ACTA' && (x.from === from || x.dpub))
|
|
389
389
|
if (!pend) return reply(from, { type: MSG_ERROR, error: 'no adoption awaiting a record' })
|
|
390
390
|
if (!record || typeof record !== 'object') return reply(from, { type: MSG_ERROR, error: 'record missing or unreadable' })
|
|
391
|
-
|
|
391
|
+
// Ya no hay campo `sealer`: se le pregunta al PERMISO. Es la misma comprobación —«¿me
|
|
392
|
+
// nombra a mí la que me mandan?»— dicha en el idioma nuevo, y con varios selladores la
|
|
393
|
+
// respuesta puede ser que sí para más de uno, que es lo correcto.
|
|
394
|
+
if (!canSeal(record, iss)) {
|
|
392
395
|
audit('rejected', { what: 'adopt', reason: 'not-sealer' })
|
|
393
|
-
return reply(from, { type: MSG_ERROR, error: 'that record does not
|
|
396
|
+
return reply(from, { type: MSG_ERROR, error: 'that record does not let this vault seal it' })
|
|
394
397
|
}
|
|
395
398
|
if (record.sealedBy !== pend.dpub) {
|
|
396
399
|
audit('rejected', { what: 'adopt', reason: 'sealed-by-other' })
|