@dxos/client-services 0.1.21 → 0.1.23

package/src/packlets/identity/authenticator.ts

@@ -11,7 +11,7 @@ import { log } from '@dxos/log';
 import { schema } from '@dxos/protocols';
 import { ComplexSet } from '@dxos/util';
 
-export const createHaloAuthProvider =
+export const createAuthProvider =
   (signer: CredentialSigner): AuthProvider =>
   async (nonce) => {
     const credential = await signer.createCredential({
@@ -25,8 +25,9 @@ export const createHaloAuthProvider =
     return schema.getCodecForType('dxos.halo.credentials.Credential').encode(credential);
   };
 
-export type HaloAuthVerifierParams = {
-  trustedDevicesProvider: () => ComplexSet<PublicKey>;
+export type TrustedKeySetAuthVerifierParams = {
+  // TODO(dmaretskyi): Change to `isTrusted: (key) => bool`.
+  trustedKeysProvider: () => ComplexSet<PublicKey>;
   update: Event<void>;
   /**
    * Timeout to wait for the device key to be added to the trusted set.
@@ -35,26 +36,27 @@ export type HaloAuthVerifierParams = {
 };
 
 /**
- * Verifies credentials of another device of the same identity in the HALO space.
- * Will wait up to `authTimeout` for the device key to be added to the trusted set.
+ * Verifies credentials of another member in the space based on a set of trusted key.
+ * Will wait up to `authTimeout` for the key to be added to the trusted set.
  */
-export class HaloAuthVerifier {
+export class TrustedKeySetAuthVerifier {
   private _ctx = new Context();
 
-  constructor(private readonly _params: HaloAuthVerifierParams) {}
+  constructor(private readonly _params: TrustedKeySetAuthVerifierParams) {}
 
   async close() {
     await this._ctx.dispose();
   }
 
-  private _isTrustedDevice(deviceKey: PublicKey) {
-    const deviceSet = this._params.trustedDevicesProvider();
+  private _isTrustedKey(deviceKey: PublicKey) {
+    const deviceSet = this._params.trustedKeysProvider();
     return deviceSet.has(deviceKey);
   }
 
   get verifier(): AuthVerifier {
     return async (nonce, auth) => {
       const credential = schema.getCodecForType('dxos.halo.credentials.Credential').decode(auth);
+      log('authenticating...', { credential });
 
       const result = await verifyCredential(credential);
       if (result.kind === 'fail') {
@@ -67,7 +69,8 @@ export class HaloAuthVerifier {
         return false;
       }
 
-      if (this._isTrustedDevice(credential.issuer)) {
+      if (this._isTrustedKey(credential.issuer)) {
+        log('key is not currently in trusted set, waiting...', { key: credential.issuer });
         return true;
       }
 
@@ -76,13 +79,15 @@ export class HaloAuthVerifier {
         trigger.wake(false);
       });
       const clear = this._params.update.on(this._ctx, () => {
-        if (this._isTrustedDevice(credential.issuer)) {
+        if (this._isTrustedKey(credential.issuer)) {
+          log('auth success', { key: credential.issuer });
           trigger.wake(true);
+        } else {
+          log('key is not currently in trusted set, waiting...', { key: credential.issuer });
         }
       });
       try {
-        await trigger.wait({ timeout: this._params.authTimeout });
-        return true;
+        return await trigger.wait({ timeout: this._params.authTimeout });
       } catch {
         return false;
       } finally {

package/src/packlets/identity/identity-manager.ts

@@ -14,7 +14,7 @@ import { AdmittedFeed, IdentityRecord, SpaceRecord } from '@dxos/protocols/proto
 import { deferFunction } from '@dxos/util';
 
 import { Identity } from '../identity';
-import { createHaloAuthProvider } from './authenticator';
+import { createAuthProvider } from './authenticator';
 
 interface ConstructSpaceParams {
   spaceRecord: SpaceRecord;
@@ -166,9 +166,7 @@ export class IdentityManager {
       spaceRecord: identityRecord.haloSpace,
       swarmIdentity: {
         peerKey: identityRecord.deviceKey,
-        credentialProvider: createHaloAuthProvider(
-          createCredentialSignerWithKey(this._keyring, identityRecord.deviceKey)
-        ),
+        credentialProvider: createAuthProvider(createCredentialSignerWithKey(this._keyring, identityRecord.deviceKey)),
         credentialAuthenticator: deferFunction(() => identity.authVerifier.verifier)
       },
       identityKey: identityRecord.identityKey

package/src/packlets/identity/identity.ts

@@ -23,7 +23,7 @@ import { AdmittedFeed, ProfileDocument } from '@dxos/protocols/proto/dxos/halo/c
 import { HaloAdmissionCredentials } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { ComplexSet } from '@dxos/util';
 
-import { HaloAuthVerifier } from './authenticator';
+import { TrustedKeySetAuthVerifier } from './authenticator';
 
 /**
  * Timeout for the device to be added to the trusted set during auth.
@@ -45,7 +45,7 @@ export class Identity {
   private readonly _signer: Signer;
   private readonly _deviceStateMachine: CredentialConsumer<DeviceStateMachine>;
   private readonly _profileStateMachine: CredentialConsumer<ProfileStateMachine>;
-  public readonly authVerifier: HaloAuthVerifier;
+  public readonly authVerifier: TrustedKeySetAuthVerifier;
 
   public readonly identityKey: PublicKey;
   public readonly deviceKey: PublicKey;
@@ -73,8 +73,8 @@ export class Identity {
       })
     );
 
-    this.authVerifier = new HaloAuthVerifier({
-      trustedDevicesProvider: () => this.authorizedDeviceKeys,
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => this.authorizedDeviceKeys,
       update: this.stateUpdate,
       authTimeout: AUTH_TIMEOUT
     });

package/src/packlets/services/service-context.ts

@@ -5,8 +5,6 @@
 import { Trigger } from '@dxos/async';
 import { failUndefined } from '@dxos/debug';
 import {
-  MOCK_AUTH_PROVIDER,
-  MOCK_AUTH_VERIFIER,
   valueEncoding,
   DataServiceSubscriptions,
   MetadataStore,
@@ -122,8 +120,6 @@ export class ServiceContext {
     log('initializing spaces...');
     const identity = this.identityManager.identity ?? failUndefined();
     const signingContext: SigningContext = {
-      credentialProvider: MOCK_AUTH_PROVIDER,
-      credentialAuthenticator: MOCK_AUTH_VERIFIER,
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey,

package/src/packlets/spaces/data-space-manager.test.ts

@@ -0,0 +1,74 @@
+//
+// Copyright 2022 DXOS.org
+//
+
+import { expect } from 'chai';
+
+import { createAdmissionCredentials } from '@dxos/credentials';
+import { AuthStatus, DataServiceSubscriptions } from '@dxos/echo-db';
+import { writeMessages } from '@dxos/feed-store';
+import { ModelFactory } from '@dxos/model-factory';
+import { ObjectModel } from '@dxos/object-model';
+import { test, describe } from '@dxos/test';
+
+import { createSigningContext, syncItems, TestBuilder } from '../testing';
+import { DataSpaceManager } from './data-space-manager';
+
+describe('DataSpaceManager', () => {
+  test('sync between peers', async () => {
+    const builder = new TestBuilder();
+
+    const peer1 = builder.createPeer();
+    const identity1 = await createSigningContext(peer1.keyring);
+    const dataSpaceManager1 = new DataSpaceManager(
+      peer1.spaceManager,
+      peer1.metadataStore,
+      new DataServiceSubscriptions(),
+      peer1.keyring,
+      identity1,
+      new ModelFactory().registerModel(ObjectModel),
+      peer1.snapshotStore
+    );
+
+    const peer2 = builder.createPeer();
+    const identity2 = await createSigningContext(peer2.keyring);
+    const dataSpaceManager2 = new DataSpaceManager(
+      peer2.spaceManager,
+      peer2.metadataStore,
+      new DataServiceSubscriptions(),
+      peer2.keyring,
+      identity2,
+      new ModelFactory().registerModel(ObjectModel),
+      peer1.snapshotStore
+    );
+
+    const space1 = await dataSpaceManager1.createSpace();
+    const space2 = await dataSpaceManager2.acceptSpace({
+      spaceKey: space1.key,
+      genesisFeedKey: space1.inner.genesisFeedKey,
+      controlFeedKey: await peer2.keyring.createKey(),
+      dataFeedKey: await peer2.keyring.createKey()
+    });
+
+    // Admit peer2 to space1.
+    await writeMessages(
+      space1.inner.controlPipeline.writer,
+      await createAdmissionCredentials(
+        identity1.credentialSigner,
+        identity2.identityKey,
+        identity2.deviceKey,
+        space1.key,
+        space2.inner.controlFeedKey,
+        space2.inner.dataFeedKey,
+        space2.inner.genesisFeedKey
+      )
+    );
+
+    await syncItems(space1, space2);
+
+    expect(space1.inner.protocol.sessions.get(identity2.deviceKey)).to.exist;
+    expect(space1.inner.protocol.sessions.get(identity2.deviceKey)?.authStatus).to.equal(AuthStatus.SUCCESS);
+    expect(space2.inner.protocol.sessions.get(identity1.deviceKey)).to.exist;
+    expect(space2.inner.protocol.sessions.get(identity1.deviceKey)?.authStatus).to.equal(AuthStatus.SUCCESS);
+  });
+});

package/src/packlets/spaces/data-space-manager.ts

@@ -2,6 +2,8 @@
 // Copyright 2022 DXOS.org
 //
 
+import assert from 'node:assert';
+
 import { Event, synchronized, trackLeaks } from '@dxos/async';
 import { Context } from '@dxos/context';
 import {
@@ -21,8 +23,9 @@ import { log } from '@dxos/log';
 import { ModelFactory } from '@dxos/model-factory';
 import { SpaceMetadata } from '@dxos/protocols/proto/dxos/echo/metadata';
 import { Presence } from '@dxos/teleport-extension-presence';
-import { ComplexMap } from '@dxos/util';
+import { ComplexMap, deferFunction } from '@dxos/util';
 
+import { createAuthProvider } from '../identity';
 import { DataSpace } from './data-space';
 
 @trackLeaks('open', 'close')
@@ -99,6 +102,8 @@ export class DataSpaceManager {
   // TODO(burdon): Rename join space.
   @synchronized
   async acceptSpace(opts: AcceptSpaceOptions): Promise<DataSpace> {
+    assert(!this._spaces.has(opts.spaceKey), 'Space already exists.');
+
     const metadata: SpaceMetadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey,
@@ -125,8 +130,8 @@ export class DataSpaceManager {
       metadata,
       swarmIdentity: {
         peerKey: this._signingContext.deviceKey,
-        credentialProvider: this._signingContext.credentialProvider,
-        credentialAuthenticator: this._signingContext.credentialAuthenticator
+        credentialProvider: createAuthProvider(this._signingContext.credentialSigner),
+        credentialAuthenticator: deferFunction(() => dataSpace.authVerifier.verifier)
       },
       onNetworkConnection: (session) => {
         session.addExtension(

package/src/packlets/spaces/data-space.ts

@@ -10,6 +10,11 @@ import { Database, DataPipelineControllerImpl, ISpace, MetadataStore, Space, Sna
 import { PublicKey } from '@dxos/keys';
 import { ModelFactory } from '@dxos/model-factory';
 import { Presence } from '@dxos/teleport-extension-presence';
+import { ComplexSet } from '@dxos/util';
+
+import { TrustedKeySetAuthVerifier } from '../identity';
+
+const AUTH_TIMEOUT = 30000;
 
 export type DataSpaceParams = {
   inner: Space;
@@ -27,6 +32,7 @@ export class DataSpace implements ISpace {
   private readonly _dataPipelineController: DataPipelineControllerImpl;
   private readonly _inner: Space;
   private readonly _presence: Presence;
+  public readonly authVerifier: TrustedKeySetAuthVerifier;
 
   constructor(params: DataSpaceParams) {
     this._inner = params.inner;
@@ -40,6 +46,11 @@ export class DataSpace implements ISpace {
       feedInfoProvider: (feedKey) => this._inner.spaceState.feeds.get(feedKey),
       snapshotId: params.snapshotId
     });
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => new ComplexSet(PublicKey.hash, Array.from(this._inner.spaceState.members.keys())),
+      update: this._inner.stateUpdate,
+      authTimeout: AUTH_TIMEOUT
+    });
   }
 
   get key() {
@@ -78,6 +89,7 @@ export class DataSpace implements ISpace {
 
   async close() {
     await this._ctx.dispose();
+    await this.authVerifier.close();
     await this._inner.close();
     await this._presence.destroy();
   }

package/src/packlets/testing/test-builder.ts

@@ -5,7 +5,10 @@
 import { expect } from 'chai';
 
 import { Config } from '@dxos/config';
-import { ISpace } from '@dxos/echo-db';
+import { createCredentialSignerWithChain, CredentialGenerator } from '@dxos/credentials';
+import { ISpace, MetadataStore, SigningContext, SnapshotStore, SpaceManager, valueEncoding } from '@dxos/echo-db';
+import { FeedFactory, FeedStore } from '@dxos/feed-store';
+import { Keyring } from '@dxos/keyring';
 import { MemorySignalManager, MemorySignalManagerContext } from '@dxos/messaging';
 import { MemoryTransportFactory, NetworkManager } from '@dxos/network-manager';
 import { createStorage, Storage, StorageType } from '@dxos/random-access-storage';
@@ -78,3 +81,86 @@ export const syncItems = async (space1: ISpace, space2: ISpace) => {
     expect(item1.id).to.eq(item2.id);
   }
 };
+
+export class TestBuilder {
+  public readonly signalContext = new MemorySignalManagerContext();
+
+  createPeer(): TestPeer {
+    return new TestPeer(this.signalContext);
+  }
+}
+
+export type TestPeerProps = {
+  storage?: Storage;
+  feedStore?: FeedStore<any>;
+  metadataStore?: MetadataStore;
+  keyring?: Keyring;
+  networkManager?: NetworkManager;
+  spaceManager?: SpaceManager;
+  snapshotStore?: SnapshotStore;
+};
+
+export class TestPeer {
+  private _props: TestPeerProps = {};
+
+  constructor(private readonly signalContext: MemorySignalManagerContext) {}
+
+  get storage() {
+    return (this._props.storage ??= createStorage({ type: StorageType.RAM }));
+  }
+
+  get keyring() {
+    return (this._props.keyring ??= new Keyring(this.storage.createDirectory('keyring')));
+  }
+
+  get feedStore() {
+    return (this._props.feedStore ??= new FeedStore({
+      factory: new FeedFactory({
+        root: this.storage.createDirectory('feeds'),
+        signer: this.keyring,
+        hypercore: {
+          valueEncoding
+        }
+      })
+    }));
+  }
+
+  get metadataStore() {
+    return (this._props.metadataStore ??= new MetadataStore(this.storage.createDirectory('metadata')));
+  }
+
+  get snapshotStore() {
+    return (this._props.snapshotStore ??= new SnapshotStore(this.storage.createDirectory('snapshots')));
+  }
+
+  get networkManager() {
+    return (this._props.networkManager ??= new NetworkManager({
+      signalManager: new MemorySignalManager(this.signalContext),
+      transportFactory: MemoryTransportFactory
+    }));
+  }
+
+  get spaceManager() {
+    return (this._props.spaceManager ??= new SpaceManager({
+      feedStore: this.feedStore,
+      networkManager: this.networkManager
+    }));
+  }
+}
+
+export const createSigningContext = async (keyring: Keyring): Promise<SigningContext> => {
+  const identityKey = await keyring.createKey();
+  const deviceKey = await keyring.createKey();
+
+  return {
+    identityKey,
+    deviceKey,
+    credentialSigner: createCredentialSignerWithChain(
+      keyring,
+      {
+        credential: await new CredentialGenerator(keyring, identityKey, deviceKey).createDeviceAuthorization(deviceKey)
+      },
+      deviceKey
+    )
+  };
+};