@dxos/client-services 0.1.22 → 0.1.24-next.6b1f434

package/src/packlets/identity/identity.test.ts

@@ -5,7 +5,7 @@
 import expect from 'expect';
 
 import { CredentialGenerator, verifyCredential } from '@dxos/credentials';
-import { MOCK_AUTH_PROVIDER, MOCK_AUTH_VERIFIER, Space, SpaceProtocol, valueEncoding } from '@dxos/echo-db';
+import { MOCK_AUTH_PROVIDER, MOCK_AUTH_VERIFIER, Space, SpaceProtocol, valueEncoding } from '@dxos/echo-pipeline';
 import { FeedFactory, FeedStore } from '@dxos/feed-store';
 import { Keyring } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
@@ -60,10 +60,10 @@ describe('identity/identity', () => {
       spaceKey,
       protocol,
       genesisFeed: controlFeed,
-      controlFeed,
-      dataFeed,
       feedProvider: (feedKey) => feedStore.openFeed(feedKey)
-    });
+    })
+      .setControlFeed(controlFeed)
+      .setDataFeed(dataFeed);
 
     const identity = new Identity({
       signer: keyring,
@@ -88,8 +88,7 @@ describe('identity/identity', () => {
 
       for (const credential of credentials) {
         await identity.controlPipeline.writer.write({
-          '@type': 'dxos.echo.feed.CredentialsMessage',
-          credential
+          credential: { credential }
         });
       }
     }
@@ -166,10 +165,10 @@ describe('identity/identity', () => {
         spaceKey,
         protocol,
         genesisFeed: controlFeed,
-        controlFeed,
-        dataFeed,
         feedProvider: (feedKey) => feedStore.openFeed(feedKey)
-      });
+      })
+        .setControlFeed(controlFeed)
+        .setDataFeed(dataFeed);
 
       const identity = (identity1 = new Identity({
         signer: keyring,
@@ -194,8 +193,7 @@ describe('identity/identity', () => {
 
         for (const credential of credentials) {
           await identity.controlPipeline.writer.write({
-            '@type': 'dxos.echo.feed.CredentialsMessage',
-            credential
+            credential: { credential }
           });
         }
       }
@@ -246,10 +244,10 @@ describe('identity/identity', () => {
         spaceKey,
         protocol,
         genesisFeed: await feedStore.openFeed(genesisFeedKey),
-        controlFeed,
-        dataFeed,
         feedProvider: (feedKey) => feedStore.openFeed(feedKey)
-      });
+      })
+        .setControlFeed(controlFeed)
+        .setDataFeed(dataFeed);
 
       const identity = (identity2 = new Identity({
         signer: keyring,
@@ -268,15 +266,16 @@ describe('identity/identity', () => {
     {
       const signer = identity1.getIdentityCredentialSigner();
       void identity1.controlPipeline.writer.write({
-        '@type': 'dxos.echo.feed.CredentialsMessage',
-        credential: await signer.createCredential({
-          subject: identity2.deviceKey,
-          assertion: {
-            '@type': 'dxos.halo.credentials.AuthorizedDevice',
-            identityKey: identity1.identityKey,
-            deviceKey: identity2.deviceKey
-          }
-        })
+        credential: {
+          credential: await signer.createCredential({
+            subject: identity2.deviceKey,
+            assertion: {
+              '@type': 'dxos.halo.credentials.AuthorizedDevice',
+              identityKey: identity1.identityKey,
+              deviceKey: identity2.deviceKey
+            }
+          })
+        }
       });
 
       await identity2.ready();

package/src/packlets/identity/identity.ts

@@ -14,16 +14,17 @@ import {
   CredentialConsumer
 } from '@dxos/credentials';
 import { Signer } from '@dxos/crypto';
-import { Space } from '@dxos/echo-db';
+import { failUndefined } from '@dxos/debug';
+import { Space } from '@dxos/echo-pipeline';
 import { writeMessages } from '@dxos/feed-store';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
-import { TypedMessage } from '@dxos/protocols';
+import { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
 import { AdmittedFeed, ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { HaloAdmissionCredentials } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { ComplexSet } from '@dxos/util';
 
-import { HaloAuthVerifier } from './authenticator';
+import { TrustedKeySetAuthVerifier } from './authenticator';
 
 /**
  * Timeout for the device to be added to the trusted set during auth.
@@ -45,7 +46,7 @@ export class Identity {
   private readonly _signer: Signer;
   private readonly _deviceStateMachine: CredentialConsumer<DeviceStateMachine>;
   private readonly _profileStateMachine: CredentialConsumer<ProfileStateMachine>;
-  public readonly authVerifier: HaloAuthVerifier;
+  public readonly authVerifier: TrustedKeySetAuthVerifier;
 
   public readonly identityKey: PublicKey;
   public readonly deviceKey: PublicKey;
@@ -73,8 +74,8 @@ export class Identity {
       })
     );
 
-    this.authVerifier = new HaloAuthVerifier({
-      trustedDevicesProvider: () => this.authorizedDeviceKeys,
+    this.authVerifier = new TrustedKeySetAuthVerifier({
+      trustedKeysProvider: () => this.authorizedDeviceKeys,
       update: this.stateUpdate,
       authTimeout: AUTH_TIMEOUT
     });
@@ -101,7 +102,7 @@ export class Identity {
   async ready() {
     await this._deviceStateMachine.processor.deviceChainReady.wait();
 
-    // TODO(dmaretskyi): Should we also wait for our feeds to be admitted?
+    await this.controlPipeline.state.waitUntilReachedTargetTimeframe({ timeout: 3_000 });
   }
 
   get profileDocument(): ProfileDocument | undefined {
@@ -123,11 +124,15 @@ export class Identity {
     return this.space.genesisFeedKey;
   }
 
+  get deviceCredentialChain() {
+    return this._deviceStateMachine.processor.deviceCredentialChain;
+  }
+
   getAdmissionCredentials(): HaloAdmissionCredentials {
     return {
       deviceKey: this.deviceKey,
-      controlFeedKey: this.space.controlFeedKey,
-      dataFeedKey: this.space.dataFeedKey
+      controlFeedKey: this.space.controlFeedKey ?? failUndefined(),
+      dataFeedKey: this.space.dataFeedKey ?? failUndefined()
     };
   }
 
@@ -191,7 +196,7 @@ export class Identity {
             designation: AdmittedFeed.Designation.DATA
           }
         })
-      ].map((credential): TypedMessage => ({ '@type': 'dxos.echo.feed.CredentialsMessage', credential }))
+      ].map((credential): FeedMessage.Payload => ({ credential: { credential } }))
     );
   }
 }

package/src/packlets/invitations/halo-invitations-handler.test.ts

@@ -3,16 +3,13 @@
 //
 
 import { expect } from 'chai';
-import assert from 'node:assert';
 
-import { asyncChain, Trigger } from '@dxos/async';
-import { raise } from '@dxos/debug';
-import { PublicKey } from '@dxos/keys';
-import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
+import { asyncChain } from '@dxos/async';
 import { describe, test, afterTest } from '@dxos/test';
 
 import { ServiceContext } from '../services';
 import { createPeers, createServiceContext } from '../testing';
+import { performInvitation } from '../testing/invitation-utils';
 
 const closeAfterTest = async (peer: ServiceContext) => {
   afterTest(() => peer.close());
@@ -35,45 +32,7 @@ describe('services/halo', () => {
     const identity1 = await host.createIdentity();
     expect(host.identityManager.identity).to.eq(identity1);
 
-    const observable1 = await host.haloInvitations.createInvitation();
-
-    const complete1 = new Trigger<PublicKey>();
-    const complete2 = new Trigger<PublicKey>();
-
-    const authenticationCode = new Trigger<string>();
-
-    observable1.subscribe({
-      onConnecting: async (invitation1: Invitation) => {
-        const observable2 = guest.haloInvitations!.acceptInvitation(invitation1);
-        observable2.subscribe({
-          onConnecting: async () => {},
-          onConnected: async (invitation2: Invitation) => {
-            expect(invitation1.swarmKey).to.eq(invitation2.swarmKey);
-          },
-          onAuthenticating: async () => {
-            await observable2.authenticate(await authenticationCode.wait());
-          },
-          onSuccess: (invitation: Invitation) => {
-            complete2.wake(invitation.identityKey!);
-          },
-          onCancelled: () => raise(new Error()),
-          onTimeout: (err: Error) => raise(new Error(err.message)),
-          onError: (err: Error) => raise(new Error(err.message))
-        });
-      },
-      onConnected: (invitation: Invitation) => {
-        assert(invitation.authenticationCode);
-        authenticationCode.wake(invitation.authenticationCode);
-      },
-      onSuccess: (invitation: Invitation) => {
-        complete1.wake(host.identityManager.identity!.identityKey);
-      },
-      onCancelled: () => raise(new Error()),
-      onTimeout: (err: Error) => raise(new Error(err.message)),
-      onError: (err: Error) => raise(new Error(err.message))
-    });
-
-    const [identityKey1, identityKey2] = await Promise.all([complete1.wait(), complete2.wait()]);
-    expect(identityKey1).to.deep.eq(identityKey2);
+    await performInvitation(host.haloInvitations, guest.haloInvitations, undefined);
+    expect(guest.identityManager.identity?.identityKey).to.deep.eq(identity1.identityKey);
   });
 });

package/src/packlets/invitations/halo-invitations-handler.ts

@@ -7,7 +7,7 @@ import assert from 'node:assert';
 import { scheduleTask, sleep, Trigger } from '@dxos/async';
 import { Context } from '@dxos/context';
 import { generatePasscode } from '@dxos/credentials';
-import { failUndefined } from '@dxos/debug';
+import { Keyring } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { createTeleportProtocolFactory, NetworkManager, StarTopology } from '@dxos/network-manager';
@@ -22,7 +22,7 @@ import {
 } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { ExtensionContext, RpcExtension } from '@dxos/teleport';
 
-import { IdentityManager } from '../identity';
+import { Identity, JoinIdentityParams } from '../identity';
 import {
   AuthenticatingInvitationProvider,
   AUTHENTICATION_CODE_LENGTH,
@@ -33,6 +33,14 @@ import {
 } from './invitations';
 import { AbstractInvitationsHandler, InvitationsOptions } from './invitations-handler';
 
+type HaloInvitationsHandlerParams = {
+  networkManager: NetworkManager;
+  keyring: Keyring;
+
+  getIdentity: () => Identity;
+  acceptIdentity: (identity: JoinIdentityParams) => Promise<Identity>;
+};
+
 /**
  * Handles the life-cycle of Halo invitations between peers.
  */
@@ -40,10 +48,9 @@ import { AbstractInvitationsHandler, InvitationsOptions } from './invitations-ha
 export class HaloInvitationsHandler extends AbstractInvitationsHandler {
   // prettier-ignore
   constructor(
-    networkManager: NetworkManager,
-    private readonly _identityManager: IdentityManager
+    private readonly _params: HaloInvitationsHandlerParams
   ) {
-    super(networkManager);
+    super(_params.networkManager);
   }
 
   /**
@@ -52,7 +59,7 @@ export class HaloInvitationsHandler extends AbstractInvitationsHandler {
   createInvitation(context: void, options?: InvitationsOptions): CancellableInvitationObservable {
     const { type, timeout = INVITATION_TIMEOUT, swarmKey } = options ?? {};
     assert(type !== Invitation.Type.OFFLINE);
-    const identity = this._identityManager.identity ?? failUndefined();
+    const identity = this._params.getIdentity();
 
     // TODO(dmaretskyi): Add invitation kind: halo/space.
     const invitation: Invitation = {
@@ -78,8 +85,8 @@ export class HaloInvitationsHandler extends AbstractInvitationsHandler {
     const complete = new Trigger<PublicKey>();
 
     // Called for every connecting peer.
-    const createExtension = (): HostHaloInvitationExtension => {
-      const hostInvitationExtension = new HostHaloInvitationExtension({
+    const createExtension = () =>
+      new HostHaloInvitationExtension({
         requestAdmission: async () => {
           log('responding with admission offer', {
             host: identity.deviceKey
@@ -145,8 +152,6 @@ export class HaloInvitationsHandler extends AbstractInvitationsHandler {
           });
         }
       });
-      return hostInvitationExtension;
-    };
 
     scheduleTask(ctx, async () => {
       const topic = invitation.swarmKey!;
@@ -224,18 +229,29 @@ export class HaloInvitationsHandler extends AbstractInvitationsHandler {
                 await extension.rpc.HaloHostService.authenticate({ authenticationCode });
               }
 
-              // 3. Create local identity.
+              const deviceKey = await this._params.keyring.createKey();
+              const controlFeedKey = await this._params.keyring.createKey();
+              const dataFeedKey = await this._params.keyring.createKey();
+
+              // 3. Send admission credentials to host (with local identity keys).
+              log('presenting admission credentials', { identityKey, deviceKey, controlFeedKey, dataFeedKey });
+              await extension.rpc.HaloHostService.presentAdmissionCredentials({
+                deviceKey,
+                controlFeedKey,
+                dataFeedKey
+              });
+
+              // 4. Create local identity.
               // TODO(burdon): Abandon if does not complete (otherwise retry will fail).
-              const identity = await this._identityManager.acceptIdentity({
+              const identity = await this._params.acceptIdentity({
                 identityKey,
+                deviceKey,
                 haloSpaceKey,
-                haloGenesisFeedKey: genesisFeedKey
+                haloGenesisFeedKey: genesisFeedKey,
+                controlFeedKey,
+                dataFeedKey
               });
 
-              // 4. Send admission credentials to host (with local identity keys).
-              log('presenting admission credentials', { guest: identity.deviceKey, identityKey });
-              await extension.rpc.HaloHostService.presentAdmissionCredentials(identity.getAdmissionCredentials());
-
               // 5. Success.
               log('admitted by host', { guest: identity.deviceKey, identityKey });
               complete.wake(identityKey);

package/src/packlets/invitations/invitations.ts

@@ -18,7 +18,7 @@ export const AUTHENTICATION_CODE_LENGTH = 6;
 export const INVITATION_TIMEOUT = 3 * 60_000; // 3 mins.
 
 // TODO(burdon): Don't close until RPC has complete (bug).
-export const ON_CLOSE_DELAY = 500;
+export const ON_CLOSE_DELAY = 1000;
 
 export interface InvitationsService {
   createInvitation(invitation: Invitation): Stream<Invitation>;
@@ -46,6 +46,7 @@ export interface CancellableInvitationObservable extends CancellableObservable<I
   get invitation(): Invitation | undefined;
 }
 
+// TODO(wittjosiah): Update with Observable.value.
 export class InvitationObservableProvider
   extends CancellableObservableProvider<InvitationEvents>
   implements CancellableInvitationObservable

package/src/packlets/invitations/space-invitations-handler.test.ts

@@ -7,14 +7,15 @@ import assert from 'node:assert';
 
 import { asyncChain, latch, Trigger } from '@dxos/async';
 import { raise } from '@dxos/debug';
+import { testLocalDatabase } from '@dxos/echo-pipeline/testing';
 import { PublicKey } from '@dxos/keys';
-import { ObjectModel } from '@dxos/object-model';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
-import { describe, test, afterTest } from '@dxos/test';
+import { afterTest, describe, test } from '@dxos/test';
 import { range } from '@dxos/util';
 
 import { ServiceContext } from '../services';
 import { createIdentity, createPeers, syncItems } from '../testing';
+import { performInvitation } from '../testing/invitation-utils';
 
 const closeAfterTest = async (peer: ServiceContext) => {
   afterTest(() => peer.close());
@@ -26,7 +27,6 @@ describe('services/space-invitations-handler', () => {
     const [peer] = await asyncChain<ServiceContext>([createIdentity, closeAfterTest])(createPeers(1));
 
     const space = await peer.dataSpaceManager!.createSpace();
-    expect(space.database).not.to.be.undefined;
     expect(peer.dataSpaceManager!.spaces.has(space.key)).to.be.true;
     await space.close();
   });
@@ -34,18 +34,30 @@ describe('services/space-invitations-handler', () => {
   test('genesis with database mutations', async () => {
     const [peer] = await asyncChain<ServiceContext>([createIdentity, closeAfterTest])(createPeers(1));
     const space = await peer.dataSpaceManager!.createSpace();
+    afterTest(() => space.close());
 
-    {
-      const item = await space.database!.createItem<ObjectModel>({ type: 'test' });
-      await item.model.set('name', 'test');
-    }
+    await testLocalDatabase(space.dataPipelineController);
+  });
+
+  test('invitation with no auth', async () => {
+    const [host, guest] = await asyncChain<ServiceContext>([createIdentity, closeAfterTest])(createPeers(2));
+
+    const space1 = await host.dataSpaceManager!.createSpace();
+    const spaceKey = space1.key;
+
+    await performInvitation(host.spaceInvitations!, guest.spaceInvitations!, space1);
 
     {
-      const [item] = space.database!.select({ type: 'test' }).exec().entities;
-      expect(item.model.get('name')).to.eq('test');
-    }
+      const space1 = host.dataSpaceManager!.spaces.get(spaceKey)!;
+      const space2 = guest.dataSpaceManager!.spaces.get(spaceKey)!;
+      expect(space1).not.to.be.undefined;
+      expect(space2).not.to.be.undefined;
 
-    await space.close();
+      await syncItems(space1.dataPipelineController, space2.dataPipelineController);
+
+      await space1.close();
+      await space2.close();
+    }
   });
 
   test('creates and accepts invitation with retry', async () => {
@@ -79,8 +91,8 @@ describe('services/space-invitations-handler', () => {
             complete2.wake(invitation.spaceKey!);
           },
           onCancelled: () => raise(new Error()),
-          onTimeout: (err: Error) => raise(new Error(err.message)),
-          onError: (err: Error) => raise(new Error(err.message))
+          onTimeout: (err: Error) => raise(err),
+          onError: (err: Error) => raise(err)
         });
       },
       onConnected: (invitation: Invitation) => {
@@ -91,8 +103,8 @@ describe('services/space-invitations-handler', () => {
         complete1.wake(invitation.spaceKey!);
       },
       onCancelled: () => raise(new Error()),
-      onTimeout: (err: Error) => raise(new Error(err.message)),
-      onError: (err: Error) => raise(new Error(err.message))
+      onTimeout: (err: Error) => raise(err),
+      onError: (err: Error) => raise(err)
     });
 
     const [spaceKey1, spaceKey2] = await Promise.all([complete1.wait(), complete2.wait()]);
@@ -104,11 +116,15 @@ describe('services/space-invitations-handler', () => {
       expect(space1).not.to.be.undefined;
       expect(space2).not.to.be.undefined;
 
-      await syncItems(space1, space2);
+      await syncItems(space1.dataPipelineController, space2.dataPipelineController);
 
       await space1.close();
       await space2.close();
     }
+
+    expect(
+      guest.identityManager.identity?.space.spaceState.getCredentialsOfType('dxos.halo.credentials.SpaceMember').length
+    ).to.equal(2); // own halo + newly joined space.
   });
 
   test('cancels invitation', async () => {
@@ -133,8 +149,8 @@ describe('services/space-invitations-handler', () => {
           onConnected: async (invitation2: Invitation) => {},
           onSuccess: () => {},
           onCancelled: () => raise(new Error()),
-          onTimeout: (err: Error) => raise(new Error(err.message)),
-          onError: (err: Error) => raise(new Error(err.message))
+          onTimeout: (err: Error) => raise(err),
+          onError: (err: Error) => raise(err)
         });
       },
       onConnected: async (invitation1: Invitation) => {},
@@ -142,13 +158,13 @@ describe('services/space-invitations-handler', () => {
         cancelled.wake();
       },
       onSuccess: () => raise(new Error()),
-      onTimeout: (err: Error) => raise(new Error(err.message)),
-      onError: (err: Error) => raise(new Error(err.message))
+      onTimeout: (err: Error) => raise(err),
+      onError: (err: Error) => raise(err)
     });
 
     const invitation1 = await connecting1.wait();
     const invitation2 = await connecting2.wait();
-    expect(invitation1.swarmKey).to.eq(invitation2.swarmKey);
+    expect(invitation1.swarmKey).to.eq(invitation2.swarmKey); // TODO(burdon): Normalize to use to.deep.eq.
 
     // TODO(burdon): Simulate network latency.
     setTimeout(async () => {
@@ -159,7 +175,8 @@ describe('services/space-invitations-handler', () => {
     await space1.close();
   });
 
-  test('test multi-use invitation', async () => {
+  // TODO(burdon): Flaky.
+  test.skip('test multi-use invitation', async () => {
     const GUEST_COUNT = 3;
     const [host, ...guests] = await asyncChain<ServiceContext>([createIdentity, closeAfterTest])(
       createPeers(GUEST_COUNT + 1)
@@ -180,8 +197,8 @@ describe('services/space-invitations-handler', () => {
         count();
       },
       onCancelled: () => {},
-      onTimeout: (err: Error) => raise(new Error(err.message)),
-      onError: (err: Error) => raise(new Error(err.message))
+      onTimeout: (err: Error) => raise(err),
+      onError: (err: Error) => raise(err)
     });
 
     await Promise.all(
@@ -198,8 +215,8 @@ describe('services/space-invitations-handler', () => {
             success.wake();
           },
           onCancelled: () => raise(new Error()),
-          onTimeout: (err: Error) => raise(new Error(err.message)),
-          onError: (err: Error) => raise(new Error(err.message))
+          onTimeout: (err: Error) => raise(err),
+          onError: (err: Error) => raise(err)
         });
         await success.wait({ timeout: 300 });
       })

package/src/packlets/invitations/space-invitations-handler.ts

@@ -7,7 +7,7 @@ import assert from 'node:assert';
 import { scheduleTask, sleep, Trigger } from '@dxos/async';
 import { Context } from '@dxos/context';
 import { createAdmissionCredentials, generatePasscode, getCredentialAssertion } from '@dxos/credentials';
-import { SigningContext } from '@dxos/echo-db';
+import { SigningContext } from '@dxos/echo-pipeline';
 import { writeMessages } from '@dxos/feed-store';
 import { Keyring } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
@@ -15,6 +15,7 @@ import { log } from '@dxos/log';
 import { createTeleportProtocolFactory, NetworkManager, StarTopology, SwarmConnection } from '@dxos/network-manager';
 import { schema } from '@dxos/protocols';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
+import { FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
 import { ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import {
   AuthenticationRequest,
@@ -137,20 +138,17 @@ export class SpaceInvitationsHandler extends AbstractInvitationsHandler<DataSpac
 
             log('writing guest credentials', { host: this._signingContext.deviceKey, guest: deviceKey });
             // TODO(burdon): Check if already admitted.
-            const credentials = await createAdmissionCredentials(
+            const credentials: FeedMessage.Payload[] = await createAdmissionCredentials(
               this._signingContext.credentialSigner,
               identityKey,
-              deviceKey,
               space.key,
-              controlFeedKey,
-              dataFeedKey,
               space.inner.genesisFeedKey,
               guestProfile
             );
 
             // TODO(dmaretskyi): Refactor.
-            assert(credentials[0]['@type'] === 'dxos.echo.feed.CredentialsMessage');
-            const spaceMemberCredential = credentials[0].credential;
+            assert(credentials[0].credential);
+            const spaceMemberCredential = credentials[0].credential.credential;
             assert(getCredentialAssertion(spaceMemberCredential)['@type'] === 'dxos.halo.credentials.SpaceMember');
 
             await writeMessages(space.inner.controlPipeline.writer, credentials);
@@ -295,8 +293,6 @@ export class SpaceInvitationsHandler extends AbstractInvitationsHandler<DataSpac
                 dataFeedKey
               });
 
-              // TODO(dmaretskyi): Record credential in our HALO.
-
               // 4. Create local space.
               const assertion = getCredentialAssertion(credential);
               assert(assertion['@type'] === 'dxos.halo.credentials.SpaceMember', 'Invalid credential');
@@ -304,11 +300,12 @@ export class SpaceInvitationsHandler extends AbstractInvitationsHandler<DataSpac
 
               const space = await this._spaceManager.acceptSpace({
                 spaceKey: assertion.spaceKey,
-                genesisFeedKey: assertion.genesisFeedKey,
-                controlFeedKey,
-                dataFeedKey
+                genesisFeedKey: assertion.genesisFeedKey
               });
 
+              // Record credential in our HALO.
+              await this._signingContext.recordCredential(credential);
+
               // 5. Success.
               log('admitted by host', { guest: this._signingContext.deviceKey, spaceKey: space.key });
               complete.wake();

package/src/packlets/services/service-context.test.ts

@@ -0,0 +1,56 @@
+//
+// Copyright 2023 DXOS.org
+//
+
+import { MemorySignalManagerContext } from '@dxos/messaging';
+import { describe, test } from '@dxos/test';
+
+import { createServiceContext, syncItems } from '../testing';
+import { performInvitation } from '../testing/invitation-utils';
+
+describe('services/ServiceContext', () => {
+  test('existing space is synchronized on device invitations', async () => {
+    const networkContext = new MemorySignalManagerContext();
+    const device1 = createServiceContext({ signalContext: networkContext });
+    await device1.createIdentity();
+    const space1 = await device1.dataSpaceManager!.createSpace();
+
+    const device2 = createServiceContext({ signalContext: networkContext });
+    await performInvitation(device1.haloInvitations, device2.haloInvitations, undefined);
+
+    const space2 = await device2.dataSpaceManager!.spaces.get(space1.key);
+    await syncItems(space1.dataPipelineController, space2!.dataPipelineController);
+  });
+
+  test('new space is synchronized on device invitations', async () => {
+    const networkContext = new MemorySignalManagerContext();
+    const device1 = createServiceContext({ signalContext: networkContext });
+    await device1.createIdentity();
+
+    const device2 = createServiceContext({ signalContext: networkContext });
+    await performInvitation(device1.haloInvitations, device2.haloInvitations, undefined);
+
+    const space1 = await device1.dataSpaceManager!.createSpace();
+    await device2.dataSpaceManager?.updated.waitForCondition(() => !!device2.dataSpaceManager!.spaces.get(space1.key));
+    const space2 = await device2.dataSpaceManager!.spaces.get(space1.key);
+    await syncItems(space1.dataPipelineController, space2!.dataPipelineController);
+  });
+
+  test('joined space is synchronized on device invitations', async () => {
+    const networkContext = new MemorySignalManagerContext();
+    const device1 = createServiceContext({ signalContext: networkContext });
+    await device1.createIdentity();
+
+    const device2 = createServiceContext({ signalContext: networkContext });
+    await performInvitation(device1.haloInvitations, device2.haloInvitations, undefined);
+
+    const identity2 = createServiceContext({ signalContext: networkContext });
+    await identity2.createIdentity();
+    const space1 = await identity2.dataSpaceManager!.createSpace();
+    await performInvitation(identity2.spaceInvitations!, device1.spaceInvitations!, space1);
+
+    await device2.dataSpaceManager?.updated.waitForCondition(() => !!device2.dataSpaceManager!.spaces.get(space1.key));
+    const space2 = await device2.dataSpaceManager!.spaces.get(space1.key);
+    await syncItems(space1.dataPipelineController, space2!.dataPipelineController);
+  });
+});