@dxos/client-services 0.6.13 → 0.6.14-main.1366248

package/src/packlets/identity/identity.ts

@@ -14,15 +14,18 @@ import {
 } from '@dxos/credentials';
 import { type Signer } from '@dxos/crypto';
 import { type Space } from '@dxos/echo-pipeline';
-import { writeMessages } from '@dxos/feed-store';
+import { type EdgeConnection } from '@dxos/edge-client';
+import { writeMessages, type FeedWrapper } from '@dxos/feed-store';
 import { invariant } from '@dxos/invariant';
 import { PublicKey, type SpaceId } from '@dxos/keys';
 import { log } from '@dxos/log';
+import { type Runtime } from '@dxos/protocols/proto/dxos/config';
 import { type FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
 import {
   AdmittedFeed,
   type DeviceProfileDocument,
   type ProfileDocument,
+  type Credential,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DeviceAdmissionRequest } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type Presence } from '@dxos/teleport-extension-gossip';
@@ -32,6 +35,7 @@ import { type ComplexMap, ComplexSet } from '@dxos/util';
 
 import { TrustedKeySetAuthVerifier } from './authenticator';
 import { DefaultSpaceStateMachine } from './default-space-state-machine';
+import { EdgeFeedReplicator } from '../spaces';
 
 export type IdentityParams = {
   identityKey: PublicKey;
@@ -39,6 +43,9 @@ export type IdentityParams = {
   signer: Signer;
   space: Space;
   presence?: Presence;
+
+  edgeConnection?: EdgeConnection;
+  edgeFeatures?: Runtime.Client.EdgeFeatures;
 };
 
 /**
@@ -52,6 +59,8 @@ export class Identity {
   private readonly _deviceStateMachine: DeviceStateMachine;
   private readonly _profileStateMachine: ProfileStateMachine;
   private readonly _defaultSpaceStateMachine: DefaultSpaceStateMachine;
+  private readonly _edgeFeedReplicator?: EdgeFeedReplicator = undefined;
+
   public readonly authVerifier: TrustedKeySetAuthVerifier;
 
   public readonly identityKey: PublicKey;
@@ -59,15 +68,15 @@ export class Identity {
 
   public readonly stateUpdate = new Event();
 
-  constructor({ space, signer, identityKey, deviceKey, presence }: IdentityParams) {
-    this.space = space;
-    this._signer = signer;
-    this._presence = presence;
+  constructor(params: IdentityParams) {
+    this.space = params.space;
+    this._signer = params.signer;
+    this._presence = params.presence;
 
-    this.identityKey = identityKey;
-    this.deviceKey = deviceKey;
+    this.identityKey = params.identityKey;
+    this.deviceKey = params.deviceKey;
 
-    log.trace('dxos.halo.device', { deviceKey });
+    log.trace('dxos.halo.device', { deviceKey: params.deviceKey });
 
     this._deviceStateMachine = new DeviceStateMachine({
       identityKey: this.identityKey,
@@ -88,6 +97,10 @@ export class Identity {
       update: this.stateUpdate,
       authTimeout: AUTH_TIMEOUT,
     });
+
+    if (params.edgeConnection && params.edgeFeatures?.feedReplicator) {
+      this._edgeFeedReplicator = new EdgeFeedReplicator({ messenger: params.edgeConnection, spaceId: this.space.id });
+    }
   }
 
   // TODO(burdon): Expose state object?
@@ -105,9 +118,17 @@ export class Identity {
     await this.space.spaceState.addCredentialProcessor(this._deviceStateMachine);
     await this.space.spaceState.addCredentialProcessor(this._profileStateMachine);
     await this.space.spaceState.addCredentialProcessor(this._defaultSpaceStateMachine);
+    if (this._edgeFeedReplicator) {
+      this.space.protocol.feedAdded.append(this._onFeedAdded);
+    }
     await this.space.open(ctx);
   }
 
+  public async joinNetwork() {
+    await this.space.startProtocol();
+    await this._edgeFeedReplicator?.open();
+  }
+
   @trace.span()
   async close(ctx: Context) {
     await this._presence?.close();
@@ -115,6 +136,13 @@ export class Identity {
     await this.space.spaceState.removeCredentialProcessor(this._defaultSpaceStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._profileStateMachine);
     await this.space.spaceState.removeCredentialProcessor(this._deviceStateMachine);
+
+    if (this._edgeFeedReplicator) {
+      this.space.protocol.feedAdded.remove(this._onFeedAdded);
+    }
+
+    await this._edgeFeedReplicator?.close();
+
     await this.space.close();
   }
 
@@ -135,6 +163,10 @@ export class Identity {
     return this.space.controlPipeline;
   }
 
+  get haloSpaceId() {
+    return this.space.id;
+  }
+
   get haloSpaceKey() {
     return this.space.key;
   }
@@ -151,6 +183,10 @@ export class Identity {
     return this._presence;
   }
 
+  get signer() {
+    return this._signer;
+  }
+
   /**
    * Issues credentials as identity.
    * Requires identity to be ready.
@@ -180,7 +216,7 @@ export class Identity {
     await this.controlPipeline.state.waitUntilTimeframe(new Timeframe([[receipt.feedKey, receipt.seq]]));
   }
 
-  async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }: DeviceAdmissionRequest) {
+  async admitDevice({ deviceKey, controlFeedKey, dataFeedKey }: DeviceAdmissionRequest): Promise<Credential> {
     log('Admitting device:', {
       identityKey: this.identityKey,
       hostDevice: this.deviceKey,
@@ -189,17 +225,18 @@ export class Identity {
       dataFeedKey,
     });
     const signer = this.getIdentityCredentialSigner();
+    const deviceCredential = await signer.createCredential({
+      subject: deviceKey,
+      assertion: {
+        '@type': 'dxos.halo.credentials.AuthorizedDevice',
+        identityKey: this.identityKey,
+        deviceKey,
+      },
+    });
     await writeMessages(
       this.controlPipeline.writer,
       [
-        await signer.createCredential({
-          subject: deviceKey,
-          assertion: {
-            '@type': 'dxos.halo.credentials.AuthorizedDevice',
-            identityKey: this.identityKey,
-            deviceKey,
-          },
-        }),
+        deviceCredential,
         await signer.createCredential({
           subject: controlFeedKey,
           assertion: {
@@ -222,5 +259,11 @@ export class Identity {
         }),
       ].map((credential): FeedMessage.Payload => ({ credential: { credential } })),
     );
+
+    return deviceCredential;
   }
+
+  private _onFeedAdded = async (feed: FeedWrapper<any>) => {
+    await this._edgeFeedReplicator!.addFeed(feed);
+  };
 }

package/src/packlets/invitations/device-invitation-protocol.test.ts

@@ -2,19 +2,20 @@
 // Copyright 2022 DXOS.org
 //
 
-import { expect } from 'chai';
+import { describe, expect, test, onTestFinished } from 'vitest';
 
 import { asyncChain } from '@dxos/async';
 import { Context } from '@dxos/context';
 import { AlreadyJoinedError } from '@dxos/protocols';
 import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
-import { describe, test, afterTest } from '@dxos/test';
 
 import { type ServiceContext } from '../services';
 import { createPeers, createServiceContext, performInvitation } from '../testing';
 
 const closeAfterTest = async (peer: ServiceContext) => {
-  afterTest(() => peer.close());
+  onTestFinished(async () => {
+    await peer.close();
+  });
   return peer;
 };
 
@@ -22,7 +23,9 @@ describe('services/device', () => {
   test('creates identity', async () => {
     const peer = await createServiceContext();
     await peer.open(new Context());
-    afterTest(() => peer.close());
+    onTestFinished(async () => {
+      await peer.close();
+    });
 
     const identity = await peer.createIdentity();
     expect(identity).not.to.be.undefined;

package/src/packlets/invitations/device-invitation-protocol.ts

@@ -2,6 +2,7 @@
 // Copyright 2023 DXOS.org
 //
 
+import { getCredentialAssertion } from '@dxos/credentials';
 import { invariant } from '@dxos/invariant';
 import { type Keyring } from '@dxos/keyring';
 import { type PublicKey } from '@dxos/keys';
@@ -25,7 +26,9 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
   ) {}
 
   toJSON(): object {
-    return {};
+    return {
+      kind: 'device',
+    };
   }
 
   checkCanInviteNewMembers(): ApiError | undefined {
@@ -49,7 +52,8 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
   async admit(_: Invitation, request: AdmissionRequest): Promise<AdmissionResponse> {
     invariant(request.device);
     const identity = this._getIdentity();
-    await identity.admitDevice(request.device);
+    const credential = await identity.admitDevice(request.device);
+    invariant(getCredentialAssertion(credential)['@type'] === 'dxos.halo.credentials.AuthorizedDevice');
 
     return {
       device: {
@@ -57,6 +61,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
         haloSpaceKey: identity.haloSpaceKey,
         genesisFeedKey: identity.haloGenesisFeedKey,
         controlTimeframe: identity.controlPipeline.state.timeframe,
+        credential,
       },
     };
   }
@@ -109,6 +114,7 @@ export class DeviceInvitationProtocol implements InvitationProtocol {
       dataFeedKey,
       controlTimeframe,
       deviceProfile: profile,
+      authorizedDeviceCredential: response.device.credential,
     });
 
     return { identityKey };

package/src/packlets/invitations/edge-invitation-handler.ts

@@ -0,0 +1,188 @@
+//
+// Copyright 2024 DXOS.org
+//
+
+import { type MutexGuard, scheduleMicroTask, scheduleTask } from '@dxos/async';
+import { type Context } from '@dxos/context';
+import { sign } from '@dxos/crypto';
+import { type EdgeHttpClient } from '@dxos/edge-client';
+import { invariant } from '@dxos/invariant';
+import { SpaceId } from '@dxos/keys';
+import { log } from '@dxos/log';
+import {
+  EdgeAuthChallengeError,
+  EdgeCallFailedError,
+  type JoinSpaceRequest,
+  type JoinSpaceResponseBody,
+} from '@dxos/protocols';
+import { schema } from '@dxos/protocols/proto';
+import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
+import { type DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
+import {
+  type AdmissionResponse,
+  type AdmissionRequest,
+  type SpaceAdmissionRequest,
+} from '@dxos/protocols/proto/dxos/halo/invitations';
+
+import { type InvitationProtocol } from './invitation-protocol';
+import { type FlowLockHolder, type GuardedInvitationState } from './invitation-state';
+import { tryAcquireBeforeContextDisposed } from './utils';
+
+export interface EdgeInvitationHandlerCallbacks {
+  onInvitationSuccess(response: AdmissionResponse, request: AdmissionRequest): Promise<void>;
+}
+
+export const MAX_RETRIES_PER_INVITATION = 5;
+export const DEFAULT_REQUEST_RETRY_INTERVAL_MS = 3000;
+export const DEFAULT_REQUEST_RETRY_JITTER_MS = 500;
+
+export type EdgeInvitationConfig = {
+  retryInterval?: number;
+  retryJitter?: number;
+};
+
+export class EdgeInvitationHandler implements FlowLockHolder {
+  private _flowLock: MutexGuard | undefined;
+
+  private readonly _retryInterval: number;
+  private readonly _retryJitter: number;
+
+  constructor(
+    config: EdgeInvitationConfig | undefined,
+    private readonly _client: EdgeHttpClient | undefined,
+    private readonly _callbacks: EdgeInvitationHandlerCallbacks,
+  ) {
+    this._retryInterval = config?.retryInterval ?? DEFAULT_REQUEST_RETRY_INTERVAL_MS;
+    this._retryJitter = config?.retryJitter ?? DEFAULT_REQUEST_RETRY_JITTER_MS;
+  }
+
+  public handle(
+    ctx: Context,
+    guardedState: GuardedInvitationState,
+    protocol: InvitationProtocol,
+    deviceProfile?: DeviceProfileDocument,
+  ) {
+    if (!this._client) {
+      log('edge disabled');
+      return;
+    }
+
+    const invitation = guardedState.current;
+    const spaceId = invitation.spaceId;
+    const canBeHandledByEdge =
+      invitation.authMethod !== Invitation.AuthMethod.SHARED_SECRET &&
+      invitation.type === Invitation.Type.DELEGATED &&
+      invitation.kind === Invitation.Kind.SPACE &&
+      spaceId != null &&
+      SpaceId.isValid(spaceId);
+
+    if (!canBeHandledByEdge) {
+      log('invitation could not be handled by edge', { invitation });
+      return;
+    }
+
+    ctx.onDispose(() => {
+      this._flowLock?.release();
+      this._flowLock = undefined;
+    });
+
+    let requestCount = 0;
+    const tryHandleInvitation = async () => {
+      requestCount++;
+      const admissionRequest = await protocol.createAdmissionRequest(deviceProfile);
+      if (admissionRequest.space) {
+        try {
+          await this._handleSpaceInvitationFlow(ctx, guardedState, admissionRequest.space, spaceId);
+        } catch (error) {
+          if (error instanceof EdgeCallFailedError) {
+            log.info('join space with edge unsuccessful', {
+              reason: error.message,
+              retryable: error.isRetryable,
+              after: error.retryAfterMs ?? this._calculateNextRetryMs(),
+            });
+            if (error.isRetryable && requestCount < MAX_RETRIES_PER_INVITATION) {
+              scheduleTask(ctx, tryHandleInvitation, error.retryAfterMs ?? this._calculateNextRetryMs());
+            }
+          } else if (requestCount < MAX_RETRIES_PER_INVITATION) {
+            log.info('failed to handle invitation with edge', { error });
+            scheduleTask(ctx, tryHandleInvitation, this._calculateNextRetryMs());
+          }
+        }
+      }
+    };
+    scheduleMicroTask(ctx, tryHandleInvitation);
+  }
+
+  private async _handleSpaceInvitationFlow(
+    ctx: Context,
+    guardedState: GuardedInvitationState,
+    admissionRequest: SpaceAdmissionRequest,
+    spaceId: SpaceId,
+  ) {
+    try {
+      log('edge invitation flow');
+      this._flowLock = await tryAcquireBeforeContextDisposed(ctx, guardedState.mutex);
+      log.verbose('edge invitation flow acquired the lock');
+
+      guardedState.set(this, Invitation.State.CONNECTING);
+
+      const response = await this._joinSpaceByInvitation(guardedState, spaceId, {
+        identityKey: admissionRequest.identityKey.toHex(),
+        invitationId: guardedState.current.invitationId,
+      });
+
+      const admissionResponse = await this._mapToAdmissionResponse(response);
+      await this._callbacks.onInvitationSuccess(admissionResponse, { space: admissionRequest });
+    } catch (error) {
+      guardedState.set(this, Invitation.State.ERROR);
+      throw error;
+    } finally {
+      this._flowLock?.release();
+      this._flowLock = undefined;
+    }
+  }
+
+  private async _mapToAdmissionResponse(edgeResponse: JoinSpaceResponseBody): Promise<AdmissionResponse> {
+    const credentialBytes = Buffer.from(edgeResponse.spaceMemberCredential, 'base64');
+    const codec = schema.getCodecForType('dxos.halo.credentials.Credential');
+    return {
+      space: {
+        credential: codec.decode(credentialBytes),
+      },
+    };
+  }
+
+  private async _joinSpaceByInvitation(
+    guardedState: GuardedInvitationState,
+    spaceId: SpaceId,
+    request: JoinSpaceRequest,
+  ): Promise<JoinSpaceResponseBody> {
+    invariant(this._client);
+    try {
+      return await this._client.joinSpaceByInvitation(spaceId, request);
+    } catch (error: any) {
+      if (error instanceof EdgeAuthChallengeError) {
+        const publicKey = guardedState.current.guestKeypair?.publicKey;
+        const privateKey = guardedState.current.guestKeypair?.privateKey;
+        if (!privateKey || !publicKey) {
+          throw error;
+        }
+        const signature = sign(Buffer.from(error.challenge, 'base64'), privateKey);
+        return this._client.joinSpaceByInvitation(spaceId, {
+          ...request,
+          signature: Buffer.from(signature).toString('base64'),
+        });
+      } else {
+        throw error;
+      }
+    }
+  }
+
+  public hasFlowLock(): boolean {
+    return this._flowLock != null;
+  }
+
+  private _calculateNextRetryMs() {
+    return this._retryInterval + Math.random() * this._retryJitter;
+  }
+}

package/src/packlets/invitations/invitation-guest-extenstion.ts

@@ -12,6 +12,7 @@ import { type Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import { type InvitationHostService, InvitationOptions } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type ExtensionContext, RpcExtension } from '@dxos/teleport';
 
+import { type FlowLockHolder } from './invitation-state';
 import { tryAcquireBeforeContextDisposed } from './utils';
 
 const OPTIONS_TIMEOUT = 10_000;
@@ -27,10 +28,13 @@ type InvitationGuestExtensionCallbacks = {
 /**
  * Guest's side for a connection to a concrete peer in p2p network during invitation.
  */
-export class InvitationGuestExtension extends RpcExtension<
-  { InvitationHostService: InvitationHostService },
-  { InvitationHostService: InvitationHostService }
-> {
+export class InvitationGuestExtension
+  extends RpcExtension<
+    { InvitationHostService: InvitationHostService },
+    { InvitationHostService: InvitationHostService }
+  >
+  implements FlowLockHolder
+{
   private _ctx = new Context();
   private _remoteOptions?: InvitationOptions;
   private _remoteOptionsTrigger = new Trigger();
@@ -82,16 +86,16 @@ export class InvitationGuestExtension extends RpcExtension<
     await super.onOpen(context);
 
     try {
-      log('guest acquire lock');
+      log.verbose('guest acquire lock');
       this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
-      log('guest lock acquired');
+      log.verbose('guest lock acquired');
       await cancelWithContext(
         this._ctx,
         this.rpc.InvitationHostService.options({ role: InvitationOptions.Role.GUEST }),
       );
-      log('options sent');
+      log.verbose('options sent');
       await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({ timeout: OPTIONS_TIMEOUT }));
-      log('options received');
+      log.verbose('options received');
       if (this._remoteOptions?.role !== InvitationOptions.Role.HOST) {
         throw new InvalidInvitationExtensionRoleError(undefined, {
           expected: InvitationOptions.Role.HOST,
@@ -124,7 +128,7 @@ export class InvitationGuestExtension extends RpcExtension<
     if (this._invitationFlowLock != null) {
       this._invitationFlowLock.release();
       this._invitationFlowLock = null;
-      log('invitation flow lock released');
+      log.verbose('invitation flow lock released');
     }
   }
 }

package/src/packlets/invitations/invitation-host-extension.ts

@@ -21,6 +21,7 @@ import {
 } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type ExtensionContext, RpcExtension } from '@dxos/teleport';
 
+import type { FlowLockHolder } from './invitation-state';
 import { stateToString, tryAcquireBeforeContextDisposed } from './utils';
 
 /// Timeout for the options exchange.
@@ -43,10 +44,13 @@ type InvitationHostExtensionCallbacks = {
 /**
  * Host's side for a connection to a concrete peer in p2p network during invitation.
  */
-export class InvitationHostExtension extends RpcExtension<
-  { InvitationHostService: InvitationHostService },
-  { InvitationHostService: InvitationHostService }
-> {
+export class InvitationHostExtension
+  extends RpcExtension<
+    { InvitationHostService: InvitationHostService },
+    { InvitationHostService: InvitationHostService }
+  >
+  implements FlowLockHolder
+{
   /**
    * @internal
    */
@@ -106,13 +110,11 @@ export class InvitationHostExtension extends RpcExtension<
 
         introduce: async (request) => {
           const { profile, invitationId } = request;
-
           const traceId = PublicKey.random().toHex();
           log.trace('dxos.sdk.invitation-handler.host.introduce', trace.begin({ id: traceId }));
 
           const invitation = this._requireActiveInvitation();
           this._assertInvitationState(Invitation.State.CONNECTED);
-
           if (invitationId !== invitation?.invitationId) {
             log.warn('incorrect invitationId', { expected: invitation.invitationId, actual: invitationId });
             this._callbacks.onError(new Error('Incorrect invitationId.'));
@@ -123,10 +125,9 @@ export class InvitationHostExtension extends RpcExtension<
             };
           }
 
-          log('guest introduced themselves', { guestProfile: profile });
+          log.verbose('guest introduced themselves', { guestProfile: profile });
           this.guestProfile = profile;
           this._callbacks.onStateUpdate(Invitation.State.READY_FOR_AUTHENTICATION);
-
           this._challenge =
             invitation.authMethod === Invitation.AuthMethod.KNOWN_PUBLIC_KEY ? randomBytes(32) : undefined;
 
@@ -142,7 +143,7 @@ export class InvitationHostExtension extends RpcExtension<
           log.trace('dxos.sdk.invitation-handler.host.authenticate', trace.begin({ id: traceId }));
 
           const invitation = this._requireActiveInvitation();
-          log('received authentication request', { authCode: code });
+          log.verbose('received authentication request', { authCode: code });
           let status = AuthenticationResponse.Status.OK;
 
           this._assertInvitationState([Invitation.State.AUTHENTICATING, Invitation.State.READY_FOR_AUTHENTICATION]);
@@ -235,18 +236,15 @@ export class InvitationHostExtension extends RpcExtension<
     await super.onOpen(context);
 
     try {
-      log('host acquire lock');
+      log.verbose('host acquire lock');
       this._invitationFlowLock = await tryAcquireBeforeContextDisposed(this._ctx, this._invitationFlowMutex);
-      log('host lock acquired');
-      const lastState = this._requireActiveInvitation().state;
+      log.verbose('host lock acquired');
       this._callbacks.onStateUpdate(Invitation.State.CONNECTING);
       await this.rpc.InvitationHostService.options({ role: InvitationOptions.Role.HOST });
-      log('options sent');
+      log.verbose('options sent');
       await cancelWithContext(this._ctx, this._remoteOptionsTrigger.wait({ timeout: OPTIONS_TIMEOUT }));
-      log('options received');
+      log.verbose('options received');
       if (this._remoteOptions?.role !== InvitationOptions.Role.GUEST) {
-        // we connected with another host, restore previous real invitation flow status
-        this._callbacks.onStateUpdate(lastState);
         throw new InvalidInvitationExtensionRoleError(undefined, {
           expected: InvitationOptions.Role.GUEST,
           remoteOptions: this._remoteOptions,
@@ -298,7 +296,7 @@ export class InvitationHostExtension extends RpcExtension<
     if (this._invitationFlowLock != null) {
       this._invitationFlowLock?.release();
       this._invitationFlowLock = null;
-      log('invitation flow lock released');
+      log.verbose('invitation flow lock released');
     }
   }
 }