@dxos/client-services 0.1.22 → 0.1.23

package/dist/lib/browser/index.mjs

@@ -486,7 +486,7 @@ import { Context } from "@dxos/context";
 import { verifyCredential } from "@dxos/credentials";
 import { log as log2 } from "@dxos/log";
 import { schema } from "@dxos/protocols";
-var createHaloAuthProvider = (signer) => async (nonce) => {
+var createAuthProvider = (signer) => async (nonce) => {
   const credential = await signer.createCredential({
     assertion: {
       "@type": "dxos.halo.credentials.Auth"
@@ -496,7 +496,7 @@ var createHaloAuthProvider = (signer) => async (nonce) => {
   });
   return schema.getCodecForType("dxos.halo.credentials.Credential").encode(credential);
 };
-var HaloAuthVerifier = class {
+var TrustedKeySetAuthVerifier = class {
   constructor(_params) {
     this._params = _params;
     this._ctx = new Context();
@@ -504,20 +504,28 @@ var HaloAuthVerifier = class {
   async close() {
     await this._ctx.dispose();
   }
-  _isTrustedDevice(deviceKey) {
-    const deviceSet = this._params.trustedDevicesProvider();
+  _isTrustedKey(deviceKey) {
+    const deviceSet = this._params.trustedKeysProvider();
     return deviceSet.has(deviceKey);
   }
   get verifier() {
     return async (nonce, auth) => {
       const credential = schema.getCodecForType("dxos.halo.credentials.Credential").decode(auth);
+      log2("authenticating...", {
+        credential
+      }, {
+        file: "authenticator.ts",
+        line: 59,
+        scope: this,
+        callSite: (f, a) => f(...a)
+      });
       const result = await verifyCredential(credential);
       if (result.kind === "fail") {
         log2("Invalid credential", {
           result
         }, {
           file: "authenticator.ts",
-          line: 61,
+          line: 63,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -529,13 +537,21 @@ var HaloAuthVerifier = class {
           credential
         }, {
           file: "authenticator.ts",
-          line: 66,
+          line: 68,
           scope: this,
           callSite: (f, a) => f(...a)
         });
         return false;
       }
-      if (this._isTrustedDevice(credential.issuer)) {
+      if (this._isTrustedKey(credential.issuer)) {
+        log2("key is not currently in trusted set, waiting...", {
+          key: credential.issuer
+        }, {
+          file: "authenticator.ts",
+          line: 73,
+          scope: this,
+          callSite: (f, a) => f(...a)
+        });
         return true;
       }
       const trigger = new Trigger();
@@ -543,15 +559,31 @@ var HaloAuthVerifier = class {
         trigger.wake(false);
       });
       const clear = this._params.update.on(this._ctx, () => {
-        if (this._isTrustedDevice(credential.issuer)) {
+        if (this._isTrustedKey(credential.issuer)) {
+          log2("auth success", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 83,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
           trigger.wake(true);
+        } else {
+          log2("key is not currently in trusted set, waiting...", {
+            key: credential.issuer
+          }, {
+            file: "authenticator.ts",
+            line: 86,
+            scope: this,
+            callSite: (f, a) => f(...a)
+          });
         }
       });
       try {
-        await trigger.wait({
+        return await trigger.wait({
           timeout: this._params.authTimeout
         });
-        return true;
       } catch (e) {
         return false;
       } finally {
@@ -585,8 +617,8 @@ var Identity = class {
       identityKey: this.identityKey,
       onUpdate: () => this.stateUpdate.emit()
     }));
-    this.authVerifier = new HaloAuthVerifier({
-      trustedDevicesProvider: () => this.authorizedDeviceKeys,
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => this.authorizedDeviceKeys,
       update: this.stateUpdate,
       authTimeout: AUTH_TIMEOUT
     });
@@ -837,7 +869,7 @@ var IdentityManager = class {
       spaceRecord: identityRecord.haloSpace,
       swarmIdentity: {
         peerKey: identityRecord.deviceKey,
-        credentialProvider: createHaloAuthProvider(createCredentialSignerWithKey2(this._keyring, identityRecord.deviceKey)),
+        credentialProvider: createAuthProvider(createCredentialSignerWithKey2(this._keyring, identityRecord.deviceKey)),
         credentialAuthenticator: deferFunction(() => identity.authVerifier.verifier)
       },
       identityKey: identityRecord.identityKey
@@ -852,7 +884,7 @@ var IdentityManager = class {
       identityKey: identityRecord.identityKey
     }, {
       file: "identity-manager.ts",
-      line: 182,
+      line: 180,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2085,25 +2117,28 @@ var SpaceInvitationsServiceImpl = class extends AbstractInvitationsService {
 // packages/sdk/client-services/src/packlets/services/service-context.ts
 import { Trigger as Trigger4 } from "@dxos/async";
 import { failUndefined as failUndefined2 } from "@dxos/debug";
-import { MOCK_AUTH_PROVIDER, MOCK_AUTH_VERIFIER, valueEncoding, DataServiceSubscriptions, MetadataStore, SpaceManager, SnapshotStore } from "@dxos/echo-db";
+import { valueEncoding, DataServiceSubscriptions, MetadataStore, SpaceManager, SnapshotStore } from "@dxos/echo-db";
 import { FeedFactory, FeedStore } from "@dxos/feed-store";
 import { Keyring } from "@dxos/keyring";
 import { log as log10 } from "@dxos/log";
 
 // packages/sdk/client-services/src/packlets/spaces/data-space-manager.ts
+import assert11 from "@dxos/node-std/assert";
 import { Event as Event3, synchronized, trackLeaks as trackLeaks2 } from "@dxos/async";
 import { Context as Context5 } from "@dxos/context";
 import { spaceGenesis, SnapshotManager } from "@dxos/echo-db";
-import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log as log9 } from "@dxos/log";
 import { Presence } from "@dxos/teleport-extension-presence";
-import { ComplexMap as ComplexMap2 } from "@dxos/util";
+import { ComplexMap as ComplexMap2, deferFunction as deferFunction2 } from "@dxos/util";
 
 // packages/sdk/client-services/src/packlets/spaces/data-space.ts
 import assert10 from "@dxos/node-std/assert";
 import { trackLeaks } from "@dxos/async";
 import { Context as Context4 } from "@dxos/context";
 import { DataPipelineControllerImpl } from "@dxos/echo-db";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { ComplexSet } from "@dxos/util";
 var __decorate = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
@@ -2114,6 +2149,7 @@ var __decorate = function(decorators, target, key, desc) {
         r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var AUTH_TIMEOUT2 = 3e4;
 var DataSpace = class DataSpace2 {
   constructor(params) {
     this._ctx = new Context4();
@@ -2128,6 +2164,11 @@ var DataSpace = class DataSpace2 {
       feedInfoProvider: (feedKey) => this._inner.spaceState.feeds.get(feedKey),
       snapshotId: params.snapshotId
     });
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => new ComplexSet(PublicKey5.hash, Array.from(this._inner.spaceState.members.keys())),
+      update: this._inner.stateUpdate,
+      authTimeout: AUTH_TIMEOUT2
+    });
   }
   get key() {
     return this._inner.key;
@@ -2157,6 +2198,7 @@ var DataSpace = class DataSpace2 {
   }
   async close() {
     await this._ctx.dispose();
+    await this.authVerifier.close();
     await this._inner.close();
     await this._presence.destroy();
   }
@@ -2187,7 +2229,7 @@ var DataSpaceManager = class DataSpaceManager2 {
     this._snapshotStore = _snapshotStore;
     this._ctx = new Context5();
     this.updated = new Event3();
-    this._spaces = new ComplexMap2(PublicKey5.hash);
+    this._spaces = new ComplexMap2(PublicKey6.hash);
   }
   // TODO(burdon): Remove.
   get spaces() {
@@ -2199,7 +2241,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       spaces: this._metadataStore.spaces.length
     }, {
       file: "data-space-manager.ts",
-      line: 54,
+      line: 57,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2208,7 +2250,7 @@ var DataSpaceManager = class DataSpaceManager2 {
         spaceMetadata
       }, {
         file: "data-space-manager.ts",
-        line: 57,
+        line: 60,
         scope: this,
         callSite: (f, a) => f(...a)
       });
@@ -2218,7 +2260,7 @@ var DataSpaceManager = class DataSpaceManager2 {
           spaceMetadata
         }, {
           file: "data-space-manager.ts",
-          line: 60,
+          line: 63,
           scope: this,
           callSite: (f, a) => f(...a)
         });
@@ -2249,7 +2291,7 @@ var DataSpaceManager = class DataSpaceManager2 {
       spaceKey
     }, {
       file: "data-space-manager.ts",
-      line: 89,
+      line: 92,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2261,6 +2303,7 @@ var DataSpaceManager = class DataSpaceManager2 {
   }
   // TODO(burdon): Rename join space.
   async acceptSpace(opts) {
+    assert11(!this._spaces.has(opts.spaceKey), "Space already exists.");
     const metadata = {
       key: opts.spaceKey,
       genesisFeedKey: opts.genesisFeedKey,
@@ -2284,8 +2327,8 @@ var DataSpaceManager = class DataSpaceManager2 {
       metadata,
       swarmIdentity: {
         peerKey: this._signingContext.deviceKey,
-        credentialProvider: this._signingContext.credentialProvider,
-        credentialAuthenticator: this._signingContext.credentialAuthenticator
+        credentialProvider: createAuthProvider(this._signingContext.credentialSigner),
+        credentialAuthenticator: deferFunction2(() => dataSpace.authVerifier.verifier)
       },
       onNetworkConnection: (session) => {
         session.addExtension("dxos.mesh.teleport.presence", presence.createExtension({
@@ -2356,7 +2399,7 @@ var ServiceContext = class {
   async open() {
     log10("opening...", {}, {
       file: "service-context.ts",
-      line: 85,
+      line: 83,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2368,7 +2411,7 @@ var ServiceContext = class {
     }
     log10("opened", {}, {
       file: "service-context.ts",
-      line: 92,
+      line: 90,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2377,7 +2420,7 @@ var ServiceContext = class {
     var _a;
     log10("closing...", {}, {
       file: "service-context.ts",
-      line: 96,
+      line: 94,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2389,7 +2432,7 @@ var ServiceContext = class {
     this.dataServiceSubscriptions.clear();
     log10("closed", {}, {
       file: "service-context.ts",
-      line: 103,
+      line: 101,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2397,7 +2440,7 @@ var ServiceContext = class {
   async reset() {
     log10("resetting...", {}, {
       file: "service-context.ts",
-      line: 107,
+      line: 105,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2405,7 +2448,7 @@ var ServiceContext = class {
     await this.storage.reset();
     log10("reset", {}, {
       file: "service-context.ts",
-      line: 110,
+      line: 108,
       scope: this,
       callSite: (f, a) => f(...a)
     });
@@ -2420,14 +2463,12 @@ var ServiceContext = class {
     var _a;
     log10("initializing spaces...", {}, {
       file: "service-context.ts",
-      line: 122,
+      line: 120,
       scope: this,
       callSite: (f, a) => f(...a)
     });
     const identity = (_a = this.identityManager.identity) != null ? _a : failUndefined2();
     const signingContext = {
-      credentialProvider: MOCK_AUTH_PROVIDER,
-      credentialAuthenticator: MOCK_AUTH_VERIFIER,
       credentialSigner: identity.getIdentityCredentialSigner(),
       identityKey: identity.identityKey,
       deviceKey: identity.deviceKey,
@@ -2804,7 +2845,7 @@ import { MemorySignalManager, MemorySignalManagerContext, WebsocketSignalManager
 import { NetworkManager, WebRTCTransportProxyFactory } from "@dxos/network-manager";
 
 // packages/sdk/client-services/src/packlets/vault/worker-session.ts
-import assert11 from "@dxos/node-std/assert";
+import assert12 from "@dxos/node-std/assert";
 import { Trigger as Trigger5 } from "@dxos/async";
 import { log as log12, logInfo } from "@dxos/log";
 import { createProtoRpcPeer as createProtoRpcPeer3 } from "@dxos/rpc";
@@ -2825,8 +2866,8 @@ var WorkerSession = class {
   } }) {
     this._startTrigger = new Trigger5();
     this.onClose = new Callback();
-    assert11(options);
-    assert11(getServices);
+    assert12(options);
+    assert12(getServices);
     this._options = options;
     this._getServices = getServices;
     this._clientRpc = createProtoRpcPeer3({
@@ -3032,7 +3073,6 @@ export {
   ClientServicesProxy,
   DevtoolsHostEvents,
   DevtoolsServiceImpl,
-  HaloAuthVerifier,
   HaloInvitationsHandler,
   HaloInvitationsProxy,
   HaloInvitationsServiceImpl,
@@ -3052,11 +3092,12 @@ export {
   SpaceServiceImpl,
   SystemServiceImpl,
   TracingServiceImpl,
+  TrustedKeySetAuthVerifier,
   WorkerRuntime,
   WorkerSession,
   clientServiceBundle,
+  createAuthProvider,
   createDefaultModelFactory,
-  createHaloAuthProvider,
   createStorageObjects,
   getNetworkPeers,
   subscribeToFeedBlocks,