@dxos/client-services 0.7.5-main.9d2a38b → 0.7.5-main.e94eead

package/src/packlets/identity/identity-recovery-manager.ts

@@ -9,8 +9,16 @@ import { invariant } from '@dxos/invariant';
 import { type Keyring } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
-import { EdgeAuthChallengeError, type RecoverIdentityRequest, type RecoverIdentityResponseBody } from '@dxos/protocols';
+import {
+  EdgeAuthChallengeError,
+  type RecoverIdentityRequest as EdgeRecoverIdentityRequest,
+  type RecoverIdentityResponseBody,
+} from '@dxos/protocols';
 import { schema } from '@dxos/protocols/proto';
+import {
+  type CreateRecoveryCredentialRequest,
+  type RecoverIdentityRequest,
+} from '@dxos/protocols/proto/dxos/client/services';
 import { Timeframe } from '@dxos/timeframe';
 
 import { type Identity } from './identity';
@@ -24,13 +32,26 @@ export class EdgeIdentityRecoveryManager {
     private readonly _acceptRecoveredIdentity: (params: JoinIdentityParams) => Promise<Identity>,
   ) {}
 
-  public async createRecoveryPhrase() {
+  public async createRecoveryCredential({ data }: CreateRecoveryCredentialRequest) {
     const identity = this._identityProvider();
     invariant(identity);
 
-    const seedphrase = generateSeedPhrase();
-    const keypair = keyPairFromSeedPhrase(seedphrase);
-    const recoveryKey = PublicKey.from(keypair.publicKey);
+    let recoveryKey: PublicKey;
+    let lookupKey: PublicKey;
+    let algorithm: string;
+    let recoveryCode: string | undefined;
+    if (data) {
+      recoveryKey = data.recoveryKey;
+      lookupKey = data.lookupKey;
+      algorithm = data.algorithm;
+    } else {
+      recoveryCode = generateSeedPhrase();
+      const keypair = keyPairFromSeedPhrase(recoveryCode);
+      recoveryKey = PublicKey.from(keypair.publicKey);
+      lookupKey = PublicKey.from(keypair.publicKey);
+      algorithm = 'ED25519';
+    }
+
     const identityKey = identity.identityKey;
     const credential = await identity.getIdentityCredentialSigner().createCredential({
       subject: identityKey,
@@ -38,24 +59,88 @@ export class EdgeIdentityRecoveryManager {
         '@type': 'dxos.halo.credentials.IdentityRecovery',
         recoveryKey,
         identityKey,
+        algorithm,
+        lookupKey,
       },
     });
 
     const receipt = await identity.controlPipeline.writer.write({ credential: { credential } });
     await identity.controlPipeline.state.waitUntilTimeframe(new Timeframe([[receipt.feedKey, receipt.seq]]));
 
-    return { seedphrase };
+    return { recoveryCode };
+  }
+
+  public async requestRecoveryChallenge() {
+    invariant(this._edgeClient, 'Not connected to EDGE.');
+
+    const deviceKey = await this._keyring.createKey();
+    const controlFeedKey = await this._keyring.createKey();
+    const request: EdgeRecoverIdentityRequest = {
+      deviceKey: deviceKey.toHex(),
+      controlFeedKey: controlFeedKey.toHex(),
+    };
+
+    try {
+      await this._edgeClient.recoverIdentity(request);
+      throw new Error('No challenge received.');
+    } catch (error: any) {
+      if (!(error instanceof EdgeAuthChallengeError)) {
+        throw error;
+      }
+      return {
+        deviceKey,
+        controlFeedKey,
+        challenge: error.challenge,
+      };
+    }
+  }
+
+  public async recoverIdentityWithExternalSignature({
+    lookupKey,
+    deviceKey,
+    controlFeedKey,
+    signature,
+    clientDataJson,
+    authenticatorData,
+  }: RecoverIdentityRequest.ExternalSignature) {
+    invariant(this._edgeClient, 'Not connected to EDGE.');
+
+    const request: EdgeRecoverIdentityRequest = {
+      lookupKey: lookupKey.toHex(),
+      deviceKey: deviceKey.toHex(),
+      controlFeedKey: controlFeedKey.toHex(),
+      signature:
+        clientDataJson && authenticatorData
+          ? {
+              signature: Buffer.from(signature).toString('base64'),
+              clientDataJson: Buffer.from(clientDataJson).toString('base64'),
+              authenticatorData: Buffer.from(authenticatorData).toString('base64'),
+            }
+          : Buffer.from(signature).toString('base64'),
+    };
+
+    const response = await this._edgeClient.recoverIdentity(request);
+
+    await this._acceptRecoveredIdentity({
+      authorizedDeviceCredential: decodeCredential(response.deviceAuthCredential),
+      haloGenesisFeedKey: PublicKey.fromHex(response.genesisFeedKey),
+      haloSpaceKey: PublicKey.fromHex(response.haloSpaceKey),
+      identityKey: PublicKey.fromHex(response.identityKey),
+      deviceKey,
+      controlFeedKey,
+      dataFeedKey: await this._keyring.createKey(),
+    });
   }
 
-  public async recoverIdentity(args: { seedphrase: string }) {
+  public async recoverIdentity({ recoveryCode }: { recoveryCode: string }) {
     invariant(this._edgeClient, 'Not connected to EDGE.');
 
-    const recoveryKeypair = keyPairFromSeedPhrase(args.seedphrase);
+    const recoveryKeypair = keyPairFromSeedPhrase(recoveryCode);
     const recoveryKey = PublicKey.from(recoveryKeypair.publicKey);
     const deviceKey = await this._keyring.createKey();
     const controlFeedKey = await this._keyring.createKey();
-    const request: RecoverIdentityRequest = {
-      recoveryKey: recoveryKey.toHex(),
+    const request: EdgeRecoverIdentityRequest = {
+      lookupKey: recoveryKey.toHex(),
       deviceKey: deviceKey.toHex(),
       controlFeedKey: controlFeedKey.toHex(),
     };

package/src/packlets/identity/identity-service.ts

@@ -11,6 +11,7 @@ import { type Keyring } from '@dxos/keyring';
 import { log } from '@dxos/log';
 import {
   type CreateIdentityRequest,
+  type CreateRecoveryCredentialRequest,
   type Identity as IdentityProto,
   type IdentityService,
   type QueryIdentityResponse,
@@ -76,6 +77,7 @@ export class IdentityServiceImpl extends Resource implements IdentityService {
     }
 
     return {
+      did: this._identityManager.identity.did,
       identityKey: this._identityManager.identity.identityKey,
       spaceKey: this._identityManager.identity.space.key,
       profile: this._identityManager.identity.profileDocument,
@@ -89,12 +91,23 @@ export class IdentityServiceImpl extends Resource implements IdentityService {
     return this._getIdentity()!;
   }
 
-  async createRecoveryPhrase() {
-    return this._recoveryManager.createRecoveryPhrase();
+  async createRecoveryCredential(request: CreateRecoveryCredentialRequest) {
+    return this._recoveryManager.createRecoveryCredential(request);
+  }
+
+  async requestRecoveryChallenge() {
+    return this._recoveryManager.requestRecoveryChallenge();
   }
 
   async recoverIdentity(request: RecoverIdentityRequest): Promise<IdentityProto> {
-    await this._recoveryManager.recoverIdentity(request);
+    if (request.recoveryCode) {
+      await this._recoveryManager.recoverIdentity({ recoveryCode: request.recoveryCode });
+    } else if (request.external) {
+      await this._recoveryManager.recoverIdentityWithExternalSignature(request.external);
+    } else {
+      throw new Error('Invalid request.');
+    }
+
     return this._getIdentity()!;
   }
 

package/src/packlets/identity/identity.test.ts

@@ -5,7 +5,7 @@
 import { onTestFinished, describe, expect, test } from 'vitest';
 
 import { Context } from '@dxos/context';
-import { CredentialGenerator, verifyCredential } from '@dxos/credentials';
+import { createDidFromIdentityKey, CredentialGenerator, verifyCredential } from '@dxos/credentials';
 import {
   createIdFromSpaceKey,
   MetadataStore,
@@ -206,6 +206,7 @@ describe('identity/identity', () => {
 
     const identity = new Identity({
       signer: keyring,
+      did: await createDidFromIdentityKey(identityKey),
       identityKey,
       deviceKey,
       space,

package/src/packlets/identity/identity.ts

@@ -17,7 +17,7 @@ import { type Space } from '@dxos/echo-pipeline';
 import { type EdgeConnection } from '@dxos/edge-client';
 import { writeMessages, type FeedWrapper } from '@dxos/feed-store';
 import { invariant } from '@dxos/invariant';
-import { PublicKey, type SpaceId } from '@dxos/keys';
+import { type IdentityDid, PublicKey, type SpaceId } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { type Runtime } from '@dxos/protocols/proto/dxos/config';
 import { type FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
@@ -38,6 +38,7 @@ import { DefaultSpaceStateMachine } from './default-space-state-machine';
 import { EdgeFeedReplicator } from '../spaces';
 
 export type IdentityParams = {
+  did: IdentityDid;
   identityKey: PublicKey;
   deviceKey: PublicKey;
   signer: Signer;
@@ -63,6 +64,7 @@ export class Identity {
 
   public readonly authVerifier: TrustedKeySetAuthVerifier;
 
+  public readonly did: IdentityDid;
   public readonly identityKey: PublicKey;
   public readonly deviceKey: PublicKey;
 
@@ -73,6 +75,7 @@ export class Identity {
     this._signer = params.signer;
     this._presence = params.presence;
 
+    this.did = params.did;
     this.identityKey = params.identityKey;
     this.deviceKey = params.deviceKey;
 

package/src/packlets/invitations/invitations-handler.ts

@@ -3,7 +3,7 @@
 //
 
 import { type PushStream, scheduleTask, TimeoutError, type Trigger } from '@dxos/async';
-import { INVITATION_TIMEOUT } from '@dxos/client-protocol';
+import { INVITATION_TIMEOUT, getExpirationTime } from '@dxos/client-protocol';
 import { type Context, ContextDisposedError } from '@dxos/context';
 import { createKeyPair, sign } from '@dxos/crypto';
 import { type EdgeHttpClient } from '@dxos/edge-client';
@@ -11,7 +11,7 @@ import { invariant } from '@dxos/invariant';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { createTeleportProtocolFactory, type SwarmNetworkManager, type SwarmConnection } from '@dxos/network-manager';
-import { InvalidInvitationExtensionRoleError, trace } from '@dxos/protocols';
+import { InvalidInvitationError, InvalidInvitationExtensionRoleError, trace } from '@dxos/protocols';
 import { type AdmissionKeypair, Invitation } from '@dxos/protocols/proto/dxos/client/services';
 import { type DeviceProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { AuthenticationResponse, type IntroductionResponse } from '@dxos/protocols/proto/dxos/halo/invitations';
@@ -188,8 +188,9 @@ export class InvitationsHandler {
       return extension;
     };
 
-    if (invitation.lifetime && invitation.created) {
-      if (invitation.created.getTime() + invitation.lifetime * 1000 < Date.now()) {
+    const expiresOn = getExpirationTime(invitation);
+    if (expiresOn) {
+      if (expiresOn.getTime() < Date.now()) {
         log.warn('invitation has already expired');
         guardedState.set(null, Invitation.State.EXPIRED);
         void ctx.dispose().catch((err) => log.catch(err));
@@ -204,7 +205,7 @@ export class InvitationsHandler {
           metrics.increment('dxos.invitation.expired');
           await ctx.dispose();
         },
-        invitation.created.getTime() + invitation.lifetime * 1000 - Date.now(),
+        expiresOn.getTime() - Date.now(),
       );
     }
 
@@ -397,7 +398,7 @@ export class InvitationsHandler {
     edgeInvitationHandler.handle(ctx, guardedState, protocol, deviceProfile);
 
     scheduleTask(ctx, async () => {
-      const error = protocol.checkInvitation(invitation);
+      const error = checkInvitation(protocol, invitation);
       if (error) {
         stream.error(error);
         await ctx.dispose();
@@ -499,6 +500,14 @@ export class InvitationsHandler {
   }
 }
 
+const checkInvitation = (protocol: InvitationProtocol, invitation: Partial<Invitation>) => {
+  const expiresOn = getExpirationTime(invitation);
+  if (expiresOn && expiresOn.getTime() < Date.now()) {
+    return new InvalidInvitationError('Invitation already expired.');
+  }
+  return protocol.checkInvitation(invitation);
+};
+
 export const createAdmissionKeypair = (): AdmissionKeypair => {
   const keypair = createKeyPair();
   return { publicKey: PublicKey.from(keypair.publicKey), privateKey: keypair.secretKey };

package/src/packlets/invitations/invitations-manager.ts

@@ -202,7 +202,7 @@ export class InvitationsManager {
       created = new Date(),
       guestKeypair = undefined,
       role = SpaceMember.Role.ADMIN,
-      lifetime = 86400, // 1 day,
+      lifetime = 86400 * 7, // 7 days,
       multiUse = false,
       ...options
     } = _options ?? {};

package/src/packlets/invitations/space-invitation-protocol.ts

@@ -28,6 +28,7 @@ import {
 } from '@dxos/protocols/proto/dxos/halo/invitations';
 
 import { type InvitationProtocol } from './invitation-protocol';
+import { computeExpirationTime } from './utils';
 import { type DataSpaceManager, type SigningContext } from '../spaces';
 
 export class SpaceInvitationProtocol implements InvitationProtocol {
@@ -113,9 +114,7 @@ export class SpaceInvitationProtocol implements InvitationProtocol {
         authMethod: invitation.authMethod,
         swarmKey: invitation.swarmKey,
         role: invitation.role ?? SpaceMember.Role.ADMIN,
-        expiresOn: invitation.lifetime
-          ? new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime)
-          : undefined,
+        expiresOn: computeExpirationTime(invitation),
         multiUse: invitation.multiUse ?? false,
         guestKey:
           invitation.authMethod === Invitation.AuthMethod.KNOWN_PUBLIC_KEY

package/src/packlets/invitations/utils.ts

@@ -10,6 +10,13 @@ export const stateToString = (state: Invitation.State): string => {
   return Object.entries(Invitation.State).find(([key, val]) => val === state)?.[0] ?? 'unknown';
 };
 
+export const computeExpirationTime = (invitation: Partial<Invitation>): Date | undefined => {
+  if (!invitation.lifetime) {
+    return;
+  }
+  return new Date((invitation.created?.getTime() ?? Date.now()) + invitation.lifetime * 1000);
+};
+
 export const tryAcquireBeforeContextDisposed = async (ctx: Context, mutex: Mutex): Promise<MutexGuard> => {
   let guard: MutexGuard | undefined;
   return cancelWithContext(

package/src/packlets/spaces/data-space-manager.ts

@@ -503,7 +503,7 @@ export class DataSpaceManager extends Resource {
     });
     dataSpace.postOpen.append(async () => {
       const setting = dataSpace.getEdgeReplicationSetting();
-      if (setting === EdgeReplicationSetting.ENABLED) {
+      if (!setting || setting === EdgeReplicationSetting.ENABLED) {
         await this._echoEdgeReplicator?.connectToSpace(dataSpace.id);
       } else if (this._echoEdgeReplicator) {
         log('not connecting EchoEdgeReplicator because of EdgeReplicationSetting', { spaceId: dataSpace.id });
@@ -511,7 +511,7 @@ export class DataSpaceManager extends Resource {
     });
     dataSpace.preClose.append(async () => {
       const setting = dataSpace.getEdgeReplicationSetting();
-      if (setting === EdgeReplicationSetting.ENABLED) {
+      if (!setting || setting === EdgeReplicationSetting.ENABLED) {
         await this._echoEdgeReplicator?.disconnectFromSpace(dataSpace.id);
       }
     });
@@ -609,7 +609,7 @@ export class DataSpaceManager extends Resource {
         invitationId: invitation.invitationId,
         swarmKey: invitation.swarmKey,
         guestKeypair: invitation.guestKey ? { publicKey: invitation.guestKey } : undefined,
-        lifetime: invitation.expiresOn ? invitation.expiresOn.getTime() - Date.now() : undefined,
+        lifetime: invitation.expiresOn ? (invitation.expiresOn.getTime() - Date.now()) / 1000 : undefined,
         multiUse: invitation.multiUse,
         delegationCredentialId: credentialId,
         persistent: false,

package/src/packlets/spaces/data-space.ts

@@ -14,7 +14,7 @@ import {
   type MetadataStore,
   type Space,
 } from '@dxos/echo-pipeline';
-import { SpaceDocVersion } from '@dxos/echo-protocol';
+import { SpaceDocVersion, type SpaceDoc } from '@dxos/echo-protocol';
 import type { EdgeConnection, EdgeHttpClient } from '@dxos/edge-client';
 import { type FeedStore, type FeedWrapper } from '@dxos/feed-store';
 import { failedInvariant } from '@dxos/invariant';
@@ -446,7 +446,7 @@ export class DataSpace {
   private _onNewAutomergeRoot(rootUrl: string) {
     log('loading automerge root doc for space', { space: this.key, rootUrl });
 
-    const handle = this._echoHost.automergeRepo.find(rootUrl as any);
+    const handle = this._echoHost.automergeRepo.find<SpaceDoc>(rootUrl as any);
 
     // TODO(dmaretskyi): Make this single-threaded (but doc loading should still be parallel to not block epoch processing).
     queueMicrotask(async () => {

package/src/packlets/spaces/edge-feed-replicator.ts

@@ -117,7 +117,7 @@ export class EdgeFeedReplicator extends Resource {
   }
 
   async addFeed(feed: FeedWrapper<any>) {
-    log.info('addFeed', { key: feed.key, connected: this._connected, hasConnectionCtx: !!this._connectionCtx });
+    log('addFeed', { key: feed.key, connected: this._connected, hasConnectionCtx: !!this._connectionCtx });
     this._feeds.set(feed.key, feed);
 
     if (this._connected && this._connectionCtx) {
@@ -143,12 +143,12 @@ export class EdgeFeedReplicator extends Resource {
 
   private async _sendMessage(message: ProtocolMessage) {
     if (!this._connectionCtx) {
-      log.info('message dropped because connection was disposed');
+      log('message dropped because connection was disposed');
       return;
     }
 
     if (message.type === 'data') {
-      log.info('sending blocks', {
+      log('sending blocks', {
         feedKey: message.feedKey,
         blocks: message.blocks.map((b) => b.index),
       });
@@ -191,7 +191,7 @@ export class EdgeFeedReplicator extends Resource {
 
           const logMeta = { localLength: feed.length, remoteLength: message.length, feedKey };
           if (message.length > feed.length) {
-            log.info('requesting missing blocks', logMeta);
+            log('requesting missing blocks', logMeta);
 
             await this._sendMessage({
               type: 'request',
@@ -199,7 +199,7 @@ export class EdgeFeedReplicator extends Resource {
               range: { from: feed.length, to: message.length },
             });
           } else if (message.length < feed.length) {
-            log.info('pushing blocks to remote', logMeta);
+            log('pushing blocks to remote', logMeta);
 
             await this._pushBlocks(feed, message.length, feed.length);
           }
@@ -208,7 +208,7 @@ export class EdgeFeedReplicator extends Resource {
         }
 
         case 'data': {
-          log.info('received data', { feed: message.feedKey, blocks: message.blocks.map((b) => b.index) });
+          log('received data', { feed: message.feedKey, blocks: message.blocks.map((b) => b.index) });
 
           const feedKey = PublicKey.fromHex(message.feedKey);
           const feed = this._feeds.get(feedKey);
@@ -229,7 +229,7 @@ export class EdgeFeedReplicator extends Resource {
   }
 
   private async _pushBlocks(feed: FeedWrapper<any>, from: number, to: number) {
-    log.info('pushing blocks', { feed: feed.key.toHex(), from, to });
+    log('pushing blocks', { feed: feed.key.toHex(), from, to });
 
     const blocks: FeedBlock[] = await Promise.all(
       rangeFromTo(from, to).map(async (index) => {
@@ -255,7 +255,7 @@ export class EdgeFeedReplicator extends Resource {
   }
 
   private async _integrateBlocks(feed: FeedWrapper<any>, blocks: FeedBlock[]) {
-    log.info('integrating blocks', { feed: feed.key.toHex(), blocks: blocks.length });
+    log('integrating blocks', { feed: feed.key.toHex(), blocks: blocks.length });
 
     for (const block of blocks) {
       if (feed.has(block.index)) {

package/src/packlets/spaces/spaces-service.ts

@@ -4,7 +4,12 @@
 
 import { EventSubscriptions, UpdateScheduler, scheduleTask } from '@dxos/async';
 import { Stream } from '@dxos/codec-protobuf/stream';
-import { createAdmissionCredentials, type CredentialProcessor, getCredentialAssertion } from '@dxos/credentials';
+import {
+  createAdmissionCredentials,
+  createDidFromIdentityKey,
+  type CredentialProcessor,
+  getCredentialAssertion,
+} from '@dxos/credentials';
 import { raise } from '@dxos/debug';
 import { type SpaceManager } from '@dxos/echo-pipeline';
 import { writeMessages } from '@dxos/feed-store';
@@ -115,7 +120,9 @@ export class SpacesServiceImpl implements SpacesService {
         ctx,
         async () => {
           const dataSpaceManager = await this._getDataSpaceManager();
-          const spaces = Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space));
+          const spaces = await Promise.all(
+            Array.from(dataSpaceManager.spaces.values()).map((space) => this._serializeSpace(space)),
+          );
           log('update', () => ({ ids: spaces.map((space) => space.id) }));
           await this._updateMetrics();
           next({ spaces });
@@ -265,10 +272,10 @@ export class SpacesServiceImpl implements SpacesService {
       await myIdentity.controlPipeline.writer.write({ credential: { credential } });
     }
 
-    return { space: this._serializeSpace(dataSpace) };
+    return { space: await this._serializeSpace(dataSpace) };
   }
 
-  private _serializeSpace(space: DataSpace): Space {
+  private async _serializeSpace(space: DataSpace): Promise<Space> {
     return {
       id: space.id,
       spaceKey: space.key,
@@ -291,24 +298,27 @@ export class SpacesServiceImpl implements SpacesService {
 
         spaceRootUrl: space.databaseRoot?.url,
       },
-      members: Array.from(space.inner.spaceState.members.values()).map((member) => {
-        const peers = space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key));
-        const isMe = this._identityManager.identity?.identityKey.equals(member.key);
+      members: await Promise.all(
+        Array.from(space.inner.spaceState.members.values()).map(async (member) => {
+          const peers = space.presence.getPeersOnline().filter(({ identityKey }) => identityKey.equals(member.key));
+          const isMe = this._identityManager.identity?.identityKey.equals(member.key);
 
-        if (isMe) {
-          peers.push(space.presence.getLocalState());
-        }
+          if (isMe) {
+            peers.push(space.presence.getLocalState());
+          }
 
-        return {
-          identity: {
-            identityKey: member.key,
-            profile: member.profile ?? {},
-          },
-          role: member.role,
-          presence: peers.length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE,
-          peerStates: peers,
-        };
-      }),
+          return {
+            identity: {
+              did: await createDidFromIdentityKey(member.key),
+              identityKey: member.key,
+              profile: member.profile ?? {},
+            },
+            role: member.role,
+            presence: peers.length > 0 ? SpaceMember.PresenceState.ONLINE : SpaceMember.PresenceState.OFFLINE,
+            peerStates: peers,
+          };
+        }),
+      ),
       creator: space.inner.spaceState.creator?.key,
       cache: space.cache,
       metrics: space.metrics,

package/src/version.ts

@@ -1 +1 @@
-export const DXOS_VERSION = "0.7.5-main.9d2a38b";
+export const DXOS_VERSION = "0.7.5-main.e94eead";