@dxos/client-services 0.1.21 → 0.1.23

package/dist/lib/node/index.cjs

@@ -39,7 +39,6 @@ __export(src_exports, {
   ClientServicesProxy: () => ClientServicesProxy,
   DevtoolsHostEvents: () => DevtoolsHostEvents,
   DevtoolsServiceImpl: () => DevtoolsServiceImpl,
-  HaloAuthVerifier: () => HaloAuthVerifier,
   HaloInvitationsHandler: () => HaloInvitationsHandler,
   HaloInvitationsProxy: () => HaloInvitationsProxy,
   HaloInvitationsServiceImpl: () => HaloInvitationsServiceImpl,
@@ -59,11 +58,12 @@ __export(src_exports, {
   SpaceServiceImpl: () => SpaceServiceImpl,
   SystemServiceImpl: () => SystemServiceImpl,
   TracingServiceImpl: () => TracingServiceImpl,
+  TrustedKeySetAuthVerifier: () => TrustedKeySetAuthVerifier,
   WorkerRuntime: () => WorkerRuntime,
   WorkerSession: () => WorkerSession,
   clientServiceBundle: () => clientServiceBundle,
+  createAuthProvider: () => createAuthProvider,
   createDefaultModelFactory: () => createDefaultModelFactory,
-  createHaloAuthProvider: () => createHaloAuthProvider,
   createStorageObjects: () => createStorageObjects,
   getNetworkPeers: () => getNetworkPeers,
   subscribeToFeedBlocks: () => subscribeToFeedBlocks,
@@ -563,7 +563,7 @@ var import_context = require("@dxos/context");
 var import_credentials = require("@dxos/credentials");
 var import_log2 = require("@dxos/log");
 var import_protocols = require("@dxos/protocols");
-var createHaloAuthProvider = (signer) => async (nonce) => {
+var createAuthProvider = (signer) => async (nonce) => {
   const credential = await signer.createCredential({
     assertion: {
       "@type": "dxos.halo.credentials.Auth"
@@ -573,7 +573,7 @@ var createHaloAuthProvider = (signer) => async (nonce) => {
   });
   return import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
 };
-var HaloAuthVerifier = class {
+var TrustedKeySetAuthVerifier = class {
   constructor(_params) {
     this._params = _params;
     this._ctx = new import_context.Context();
@@ -581,20 +581,28 @@ var HaloAuthVerifier = class {
   async close() {
     await this._ctx.dispose();
   }
-  _isTrustedDevice(deviceKey) {
-    const deviceSet = this._params.trustedDevicesProvider();
+  _isTrustedKey(deviceKey) {
+    const deviceSet = this._params.trustedKeysProvider();
     return deviceSet.has(deviceKey);
   }
   get verifier() {
     return async (nonce, auth) => {
       const credential = import_protocols.schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
+      (0, import_log2.log)("authenticating...", {
+        credential
+      }, {
+        file: "authenticator.ts",
+        line: 59,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
       const result = await (0, import_credentials.verifyCredential)(credential);
       if (result.kind === "fail") {
         (0, import_log2.log)("Invalid credential", {
           result
         }, {
           file: "authenticator.ts",
-          line: 61,
+          line: 63,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -606,13 +614,21 @@ var HaloAuthVerifier = class {
           credential
         }, {
           file: "authenticator.ts",
-          line: 66,
+          line: 68,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         return false;
       }
-      if (this._isTrustedDevice(credential.issuer)) {
+      if (this._isTrustedKey(credential.issuer)) {
+        (0, import_log2.log)("key is not currently in trusted set, waiting...", {
+          key: credential.issuer
+        }, {
+          file: "authenticator.ts",
+          line: 73,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
         return true;
       }
       const trigger = new import_async4.Trigger();
@@ -620,15 +636,31 @@ var HaloAuthVerifier = class {
         trigger.wake(false);
       });
       const clear = this._params.update.on(this._ctx, () => {
-        if (this._isTrustedDevice(credential.issuer)) {
+        if (this._isTrustedKey(credential.issuer)) {
+          (0, import_log2.log)("auth success", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 83,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
           trigger.wake(true);
+        } else {
+          (0, import_log2.log)("key is not currently in trusted set, waiting...", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 86,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
         }
       });
       try {
-        await trigger.wait({
+        return await trigger.wait({
           timeout: this._params.authTimeout
         });
-        return true;
       } catch (e) {
         return false;
       } finally {
@@ -662,8 +694,8 @@ var Identity = class {
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit()
     }));
-    this.authVerifier = new HaloAuthVerifier({
-      trustedDevicesProvider: () => this.authorizedDeviceKeys,
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => this.authorizedDeviceKeys,
       update: this.stateUpdate,
       authTimeout: AUTH_TIMEOUT
     });
@@ -914,7 +946,7 @@ var IdentityManager = class {
       spaceRecord: identityRecord.haloSpace,
       swarmIdentity: {
         peerKey: identityRecord.deviceKey,
-        credentialProvider: createHaloAuthProvider((0, import_credentials4.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
+        credentialProvider: createAuthProvider((0, import_credentials4.createCredentialSignerWithKey)(this._keyring, identityRecord.deviceKey)),
         credentialAuthenticator: (0, import_util3.deferFunction)(() => identity.authVerifier.verifier)
       },
       identityKey: identityRecord.identityKey
@@ -929,7 +961,7 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey
     }, {
       file: "identity-manager.ts",
-      line: 182,
+      line: 180,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2168,19 +2200,22 @@ var import_keyring = require("@dxos/keyring");
 var import_log10 = require("@dxos/log");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+var import_node_assert11 = __toESM(require("node:assert"));
 var import_async12 = require("@dxos/async");
 var import_context5 = require("@dxos/context");
 var import_echo_db2 = require("@dxos/echo-db");
-var import_keys6 = require("@dxos/keys");
+var import_keys7 = require("@dxos/keys");
 var import_log9 = require("@dxos/log");
 var import_teleport_extension_presence = require("@dxos/teleport-extension-presence");
-var import_util4 = require("@dxos/util");
+var import_util5 = require("@dxos/util");
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
 var import_node_assert10 = __toESM(require("node:assert"));
 var import_async11 = require("@dxos/async");
 var import_context4 = require("@dxos/context");
 var import_echo_db = require("@dxos/echo-db");
+var import_keys6 = require("@dxos/keys");
+var import_util4 = require("@dxos/util");
 var __decorate = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -2191,6 +2226,7 @@ var __decorate = function(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var AUTH_TIMEOUT2 = 3e4;
 var DataSpace = class DataSpace2 {
   constructor(params) {
     this._ctx = new import_context4.Context();
@@ -2205,6 +2241,11 @@ var DataSpace = class DataSpace2 {
       feedInfoProvider: (feedKey) => this._inner.spaceState.feeds.get(feedKey),
       snapshotId: params.snapshotId
     });
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => new import_util4.ComplexSet(import_keys6.PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
+      update: this._inner.stateUpdate,
+      authTimeout: AUTH_TIMEOUT2
+    });
   }
   get key() {
     return this._inner.key;
@@ -2234,6 +2275,7 @@ var DataSpace = class DataSpace2 {
   }
   async close() {
     await this._ctx.dispose();
+    await this.authVerifier.close();
     await this._inner.close();
     await this._presence.destroy();
   }
@@ -2264,7 +2306,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._snapshotStore = _snapshotStore;
     this._ctx = new import_context5.Context();
     this.updated = new import_async12.Event();
-    this._spaces = new import_util4.ComplexMap(import_keys6.PublicKey.hash);
+    this._spaces = new import_util5.ComplexMap(import_keys7.PublicKey.hash);
   }
   // TODO(burdon): Remove.
   get spaces() {
@@ -2276,7 +2318,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
-      line: 54,
+      line: 57,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2285,7 +2327,7 @@ var DataSpaceManager = class DataSpaceManager2 {
         spaceMetadata
       }, {
         file: "data-space-manager.ts",
-        line: 57,
+        line: 60,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -2295,7 +2337,7 @@ var DataSpaceManager = class DataSpaceManager2 {
           spaceMetadata
         }, {
           file: "data-space-manager.ts",
-          line: 60,
+          line: 63,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2326,7 +2368,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       spaceKey
     }, {
       file: "data-space-manager.ts",
-      line: 89,
+      line: 92,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2338,6 +2380,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
+    (0, import_node_assert11.default)(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey,
@@ -2361,8 +2404,8 @@ var DataSpaceManager = class DataSpaceManager2 {
       metadata,
       swarmIdentity: {
         peerKey: this._signingContext.deviceKey,
-        credentialProvider: this._signingContext.credentialProvider,
-        credentialAuthenticator: this._signingContext.credentialAuthenticator
+        credentialProvider: createAuthProvider(this._signingContext.credentialSigner),
+        credentialAuthenticator: (0, import_util5.deferFunction)(() => dataSpace.authVerifier.verifier)
       },
       onNetworkConnection: (session) => {
         session.addExtension("dxos.mesh.teleport.presence", presence.createExtension({
@@ -2433,7 +2476,7 @@ var ServiceContext = class {
   async open() {
     (0, import_log10.log)("opening...", {}, {
       file: "service-context.ts",
-      line: 85,
+      line: 83,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2445,7 +2488,7 @@ var ServiceContext = class {
     }
     (0, import_log10.log)("opened", {}, {
       file: "service-context.ts",
-      line: 92,
+      line: 90,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2454,7 +2497,7 @@ var ServiceContext = class {
     var _a;
     (0, import_log10.log)("closing...", {}, {
       file: "service-context.ts",
-      line: 96,
+      line: 94,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2466,7 +2509,7 @@ var ServiceContext = class {
     this.dataServiceSubscriptions.clear();
     (0, import_log10.log)("closed", {}, {
       file: "service-context.ts",
-      line: 103,
+      line: 101,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2474,7 +2517,7 @@ var ServiceContext = class {
   async reset() {
     (0, import_log10.log)("resetting...", {}, {
       file: "service-context.ts",
-      line: 107,
+      line: 105,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2482,7 +2525,7 @@ var ServiceContext = class {
     await this.storage.reset();
     (0, import_log10.log)("reset", {}, {
       file: "service-context.ts",
-      line: 110,
+      line: 108,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2497,14 +2540,12 @@ var ServiceContext = class {
     var _a;
     (0, import_log10.log)("initializing spaces...", {}, {
       file: "service-context.ts",
-      line: 122,
+      line: 120,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     const identity = (_a = this.identityManager.identity) != null ? _a : (0, import_debug4.failUndefined)();
     const signingContext = {
-      credentialProvider: import_echo_db3.MOCK_AUTH_PROVIDER,
-      credentialAuthenticator: import_echo_db3.MOCK_AUTH_VERIFIER,
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey,
@@ -2881,11 +2922,11 @@ var import_messaging = require("@dxos/messaging");
 var import_network_manager4 = require("@dxos/network-manager");
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-var import_node_assert11 = __toESM(require("node:assert"));
+var import_node_assert12 = __toESM(require("node:assert"));
 var import_async17 = require("@dxos/async");
 var import_log12 = require("@dxos/log");
 var import_rpc4 = require("@dxos/rpc");
-var import_util5 = require("@dxos/util");
+var import_util6 = require("@dxos/util");
 var __decorate3 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -2901,9 +2942,9 @@ var WorkerSession = class {
     heartbeatInterval: 1e3
   } }) {
     this._startTrigger = new import_async17.Trigger();
-    this.onClose = new import_util5.Callback();
-    (0, import_node_assert11.default)(options);
-    (0, import_node_assert11.default)(getServices);
+    this.onClose = new import_util6.Callback();
+    (0, import_node_assert12.default)(options);
+    (0, import_node_assert12.default)(getServices);
     this._options = options;
     this._getServices = getServices;
     this._clientRpc = (0, import_rpc4.createProtoRpcPeer)({
@@ -3110,7 +3151,6 @@ var WorkerRuntime = class {
   ClientServicesProxy,
   DevtoolsHostEvents,
   DevtoolsServiceImpl,
-  HaloAuthVerifier,
   HaloInvitationsHandler,
   HaloInvitationsProxy,
   HaloInvitationsServiceImpl,
@@ -3130,11 +3170,12 @@ var WorkerRuntime = class {
   SpaceServiceImpl,
   SystemServiceImpl,
   TracingServiceImpl,
+  TrustedKeySetAuthVerifier,
   WorkerRuntime,
   WorkerSession,
   clientServiceBundle,
+  createAuthProvider,
   createDefaultModelFactory,
-  createHaloAuthProvider,
   createStorageObjects,
   getNetworkPeers,
   subscribeToFeedBlocks,