@dxos/client-services 0.8.4-main.fffef41 → 0.8.4-staging.60fe92afc8

package/src/packlets/identity/identity-manager.ts

@@ -6,14 +6,13 @@ import platform from 'platform';
 import { Event } from '@dxos/async';
 import { Context } from '@dxos/context';
 import { CredentialGenerator, createCredentialSignerWithKey, createDidFromIdentityKey } from '@dxos/credentials';
-import { type MetadataStore, type SpaceManager, type SwarmIdentity } from '@dxos/echo-pipeline';
+import { type IMetadataStore, type SpaceManager, type SwarmIdentity } from '@dxos/echo-host';
 import { type EdgeConnection } from '@dxos/edge-client';
 import { type FeedStore } from '@dxos/feed-store';
 import { invariant } from '@dxos/invariant';
-import { type Keyring } from '@dxos/keyring';
+import { type KeyringApi } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
-import { trace } from '@dxos/protocols';
 import { Device, DeviceKind } from '@dxos/protocols/proto/dxos/client/services';
 import { type Runtime } from '@dxos/protocols/proto/dxos/config';
 import { type FeedMessage } from '@dxos/protocols/proto/dxos/echo/feed';
@@ -28,7 +27,7 @@ import {
 import { Gossip, Presence } from '@dxos/teleport-extension-gossip';
 import { Timeframe } from '@dxos/timeframe';
 import { trace as Trace } from '@dxos/tracing';
-import { deferFunction, isNode } from '@dxos/util';
+import { deferFunction, isNode, isTauri } from '@dxos/util';
 
 import { createAuthProvider } from './authenticator';
 import { Identity } from './identity';
@@ -36,14 +35,14 @@ import { Identity } from './identity';
 const DEVICE_PRESENCE_ANNOUNCE_INTERVAL = 10_000;
 const DEVICE_PRESENCE_OFFLINE_TIMEOUT = 20_000;
 
-interface ConstructSpaceParams {
+interface ConstructSpaceProps {
   spaceRecord: SpaceMetadata;
   swarmIdentity: SwarmIdentity;
   identityKey: PublicKey;
   gossip: Gossip;
 }
 
-export type JoinIdentityParams = {
+export type JoinIdentityProps = {
   identityKey: PublicKey;
   deviceKey: PublicKey;
   haloSpaceKey: PublicKey;
@@ -67,9 +66,9 @@ export type CreateIdentityOptions = {
   deviceProfile?: DeviceProfileDocument;
 };
 
-export type IdentityManagerParams = {
-  metadataStore: MetadataStore;
-  keyring: Keyring;
+export type IdentityManagerProps = {
+  metadataStore: IMetadataStore;
+  keyring: KeyringApi;
   feedStore: FeedStore<FeedMessage>;
   spaceManager: SpaceManager;
   edgeConnection?: EdgeConnection;
@@ -83,8 +82,8 @@ export type IdentityManagerParams = {
 export class IdentityManager {
   readonly stateUpdate = new Event();
 
-  private readonly _metadataStore: MetadataStore;
-  private readonly _keyring: Keyring;
+  private readonly _metadataStore: IMetadataStore;
+  private readonly _keyring: KeyringApi;
   private readonly _feedStore: FeedStore<FeedMessage>;
   private readonly _spaceManager: SpaceManager;
   private readonly _devicePresenceAnnounceInterval: number;
@@ -95,7 +94,7 @@ export class IdentityManager {
   private _identity?: Identity;
 
   // TODO(dmaretskyi): Perhaps this should take/generate the peerKey outside of an initialized identity.
-  constructor(params: IdentityManagerParams) {
+  constructor(params: IdentityManagerProps) {
     this._metadataStore = params.metadataStore;
     this._keyring = params.keyring;
     this._feedStore = params.feedStore;
@@ -112,8 +111,7 @@ export class IdentityManager {
 
   @Trace.span({ showInBrowserTimeline: true })
   async open(ctx: Context): Promise<void> {
-    const traceId = PublicKey.random().toHex();
-    log.trace('dxos.halo.identity-manager.open', trace.begin({ id: traceId }));
+    log('opening identity manager');
 
     const identityRecord = this._metadataStore.getIdentityRecord();
     log('identity record', { identityRecord });
@@ -128,15 +126,14 @@ export class IdentityManager {
 
       this.stateUpdate.emit();
     }
-    log.trace('dxos.halo.identity-manager.open', trace.end({ id: traceId }));
+    log('opened identity manager');
   }
 
-  async close(): Promise<void> {
-    await this._identity?.close(new Context());
+  async close(ctx: Context): Promise<void> {
+    await this._identity?.close(ctx);
   }
 
-  async createIdentity({ profile, deviceProfile }: CreateIdentityOptions = {}): Promise<Identity> {
-    // TODO(nf): populate using context from ServiceContext?
+  async createIdentity({ profile, deviceProfile }: CreateIdentityOptions = {}, ctx?: Context): Promise<Identity> {
     invariant(!this._identity, 'Identity already exists.');
     log('creating identity...');
 
@@ -153,7 +150,7 @@ export class IdentityManager {
     };
 
     const identity = await this._constructIdentity(identityRecord);
-    await identity.open(new Context());
+    await identity.open(ctx ?? Context.default());
 
     {
       const generator = new CredentialGenerator(this._keyring, identityRecord.identityKey, identityRecord.deviceKey);
@@ -211,28 +208,32 @@ export class IdentityManager {
     return identity;
   }
 
-  // TODO(nf): receive platform info rather than generating it here.
   createDefaultDeviceProfile(): DeviceProfileDocument {
+    // See TODOs in credentials.proto.
     let type: DeviceType;
-    // TODO(nf): call Platform service instead?
     if (isNode()) {
       type = DeviceType.AGENT;
     } else {
       if (platform.name?.startsWith('iOS') || platform.name?.startsWith('Android')) {
         type = DeviceType.MOBILE;
-      } else if ((globalThis as any).__args) {
+      } else if (isTauri() || !platform.name) {
+        // Tauri's __TAURI__ global isn't available in web workers. Fallback: WKWebView
+        // (Tauri on macOS) reports null for platform.name; all standard browsers don't.
         type = DeviceType.NATIVE;
       } else {
         type = DeviceType.BROWSER;
       }
     }
 
+    const os = platform.os?.family === 'OS X' ? 'macOS' : platform.os?.family;
+    const name = type === DeviceType.NATIVE || type === DeviceType.MOBILE ? 'App' : platform.name;
+
     return {
       type,
-      platform: platform.name,
+      platform: name,
       platformVersion: platform.version,
       architecture: typeof platform.os?.architecture === 'number' ? String(platform.os.architecture) : undefined,
-      os: platform.os?.family,
+      os,
       osVersion: platform.os?.version,
     };
   }
@@ -240,7 +241,7 @@ export class IdentityManager {
   /**
    * Prepare an identity object as the first step of acceptIdentity flow.
    */
-  async prepareIdentity(params: JoinIdentityParams) {
+  async prepareIdentity(params: JoinIdentityProps, ctx?: Context) {
     log('accepting identity', { params });
     invariant(!this._identity, 'Identity already exists.');
 
@@ -256,7 +257,7 @@ export class IdentityManager {
       },
     };
     const identity = await this._constructIdentity(identityRecord);
-    await identity.open(new Context());
+    await identity.open(ctx ?? Context.default());
     return { identity, identityRecord };
   }
 
@@ -395,7 +396,7 @@ export class IdentityManager {
     return identity;
   }
 
-  private async _constructSpace({ spaceRecord, swarmIdentity, identityKey, gossip }: ConstructSpaceParams) {
+  private async _constructSpace({ spaceRecord, swarmIdentity, identityKey, gossip }: ConstructSpaceProps) {
     return this._spaceManager.constructSpace({
       metadata: {
         key: spaceRecord.key,

package/src/packlets/identity/identity-recovery-manager.ts

@@ -2,11 +2,12 @@
 // Copyright 2024 DXOS.org
 //
 
+import { type Context } from '@dxos/context';
 import { generateSeedPhrase, keyPairFromSeedPhrase } from '@dxos/credentials';
 import { sign } from '@dxos/crypto';
 import { type EdgeHttpClient } from '@dxos/edge-client';
 import { invariant } from '@dxos/invariant';
-import { type Keyring } from '@dxos/keyring';
+import { type KeyringApi } from '@dxos/keyring';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import {
@@ -22,14 +23,14 @@ import {
 import { Timeframe } from '@dxos/timeframe';
 
 import { type Identity } from './identity';
-import { type JoinIdentityParams } from './identity-manager';
+import { type JoinIdentityProps } from './identity-manager';
 
 export class EdgeIdentityRecoveryManager {
   constructor(
-    private readonly _keyring: Keyring,
+    private readonly _keyring: KeyringApi,
     private readonly _edgeClient: EdgeHttpClient | undefined,
     private readonly _identityProvider: () => Identity | undefined,
-    private readonly _acceptRecoveredIdentity: (params: JoinIdentityParams) => Promise<Identity>,
+    private readonly _acceptRecoveredIdentity: (params: JoinIdentityProps) => Promise<Identity>,
   ) {}
 
   public async createRecoveryCredential({
@@ -72,7 +73,7 @@ export class EdgeIdentityRecoveryManager {
     return { recoveryCode };
   }
 
-  public async requestRecoveryChallenge() {
+  public async requestRecoveryChallenge(ctx: Context) {
     invariant(this._edgeClient, 'Not connected to EDGE.');
 
     const deviceKey = await this._keyring.createKey();
@@ -83,7 +84,7 @@ export class EdgeIdentityRecoveryManager {
     };
 
     try {
-      await this._edgeClient.recoverIdentity(request);
+      await this._edgeClient.recoverIdentity(ctx, request);
       throw new Error('No challenge received.');
     } catch (error: any) {
       if (!(error instanceof EdgeAuthChallengeError)) {
@@ -97,14 +98,17 @@ export class EdgeIdentityRecoveryManager {
     }
   }
 
-  public async recoverIdentityWithExternalSignature({
-    lookupKey,
-    deviceKey,
-    controlFeedKey,
-    signature,
-    clientDataJson,
-    authenticatorData,
-  }: RecoverIdentityRequest.ExternalSignature): Promise<void> {
+  public async recoverIdentityWithExternalSignature(
+    ctx: Context,
+    {
+      lookupKey,
+      deviceKey,
+      controlFeedKey,
+      signature,
+      clientDataJson,
+      authenticatorData,
+    }: RecoverIdentityRequest.ExternalSignature,
+  ): Promise<void> {
     invariant(this._edgeClient, 'Not connected to EDGE.');
 
     const request: EdgeRecoverIdentityRequest = {
@@ -121,7 +125,7 @@ export class EdgeIdentityRecoveryManager {
           : Buffer.from(signature).toString('base64'),
     };
 
-    const response = await this._edgeClient.recoverIdentity(request);
+    const response = await this._edgeClient.recoverIdentity(ctx, request);
 
     await this._acceptRecoveredIdentity({
       authorizedDeviceCredential: decodeCredential(response.deviceAuthCredential),
@@ -135,9 +139,14 @@ export class EdgeIdentityRecoveryManager {
   }
 
   /**
-   * Recovery identity using an opaque token sent to the user's email.
+   * Recover an identity using an opaque one-time token. Accepts either an email magic-link
+   * `token` (validated by hub-service) or an OAuth `recoveryProof` (redeemed by kms-service).
+   * The two fields are routed to different backends by db-service and must not be conflated.
    */
-  public async recoverIdentityWithToken({ token }: { token: string }): Promise<void> {
+  public async recoverIdentityWithToken(
+    ctx: Context,
+    fields: { token: string } | { recoveryProof: string },
+  ): Promise<void> {
     invariant(this._edgeClient, 'Not connected to EDGE.');
 
     const deviceKey = await this._keyring.createKey();
@@ -145,10 +154,10 @@ export class EdgeIdentityRecoveryManager {
     const request: EdgeRecoverIdentityRequest = {
       deviceKey: deviceKey.toHex(),
       controlFeedKey: controlFeedKey.toHex(),
-      token,
+      ...fields,
     };
 
-    const response = await this._edgeClient.recoverIdentity(request);
+    const response = await this._edgeClient.recoverIdentity(ctx, request);
 
     await this._acceptRecoveredIdentity({
       authorizedDeviceCredential: decodeCredential(response.deviceAuthCredential),
@@ -161,7 +170,7 @@ export class EdgeIdentityRecoveryManager {
     });
   }
 
-  public async recoverIdentity({ recoveryCode }: { recoveryCode: string }): Promise<void> {
+  public async recoverIdentity(ctx: Context, { recoveryCode }: { recoveryCode: string }): Promise<void> {
     invariant(this._edgeClient, 'Not connected to EDGE.');
 
     const recoveryKeypair = keyPairFromSeedPhrase(recoveryCode);
@@ -176,13 +185,13 @@ export class EdgeIdentityRecoveryManager {
 
     let response: RecoverIdentityResponseBody;
     try {
-      response = await this._edgeClient.recoverIdentity(request);
+      response = await this._edgeClient.recoverIdentity(ctx, request);
     } catch (error: any) {
       if (!(error instanceof EdgeAuthChallengeError)) {
         throw error;
       }
       const signature = sign(Buffer.from(error.challenge, 'base64'), recoveryKeypair.secretKey);
-      response = await this._edgeClient.recoverIdentity({
+      response = await this._edgeClient.recoverIdentity(ctx, {
         ...request,
         signature: Buffer.from(signature).toString('base64'),
       });

package/src/packlets/identity/identity-service.test.ts

@@ -11,7 +11,6 @@ import { type Identity, type IdentityService } from '@dxos/protocols/proto/dxos/
 
 import { type ServiceContext } from '../services';
 import { createServiceContext } from '../testing';
-
 import { IdentityServiceImpl } from './identity-service';
 
 describe('IdentityService', () => {
@@ -48,6 +47,12 @@ describe('IdentityService', () => {
       await identityService.createIdentity({});
       await expect(identityService.createIdentity({})).rejects.toThrowError('Identity already exists');
     });
+
+    test('creates identity with no spaces', async () => {
+      await identityService.createIdentity({});
+      const dataSpaces = [...(serviceContext.dataSpaceManager?.spaces?.values() ?? [])];
+      expect(dataSpaces.length).to.eq(0);
+    });
   });
 
   describe.skip('recoverIdentity', () => {});
@@ -89,37 +94,11 @@ describe('IdentityService', () => {
   });
 });
 
-describe('open', () => {
-  test('identity without default space fixed', async () => {
-    const serviceContext = await createServiceContext();
-    await serviceContext.open(new Context());
-    const identity = await serviceContext.createIdentity();
-    const identityService = createIdentityService(serviceContext);
-    const getDataSpaces = () => [...(serviceContext.dataSpaceManager?.spaces?.values() ?? [])];
-    expect(getDataSpaces().length).to.eq(0);
-    expect(identity.defaultSpaceId).to.be.undefined;
-    await identityService.open();
-    expect(getDataSpaces()[0].id === identity.defaultSpaceId).to.be.true;
-  });
-
-  test('identity without default space credential fixed', async () => {
-    const serviceContext = await createServiceContext();
-    await serviceContext.open(new Context());
-    const identity = await serviceContext.createIdentity();
-    const space = await serviceContext.dataSpaceManager!.createDefaultSpace();
-    const identityService = createIdentityService(serviceContext);
-    expect(identity.defaultSpaceId).to.be.undefined;
-    await identityService.open();
-    expect(identity.defaultSpaceId === space.id).to.be.true;
-  });
-});
-
 const createIdentityService = (serviceContext: ServiceContext) => {
   return new IdentityServiceImpl(
     serviceContext.identityManager,
     serviceContext.recoveryManager,
     serviceContext.keyring,
-    () => serviceContext.dataSpaceManager!,
     (options) => serviceContext.createIdentity(options),
   );
 };

package/src/packlets/identity/identity-service.ts

@@ -2,13 +2,12 @@
 // Copyright 2023 DXOS.org
 //
 
-import { Trigger, sleep } from '@dxos/async';
+import { type RequestOptions } from '@dxos/codec-protobuf';
 import { Stream } from '@dxos/codec-protobuf/stream';
-import { Resource } from '@dxos/context';
+import { Context, Resource } from '@dxos/context';
 import { createCredential, signPresentation } from '@dxos/credentials';
 import { invariant } from '@dxos/invariant';
-import { type Keyring } from '@dxos/keyring';
-import { log } from '@dxos/log';
+import { type KeyringApi } from '@dxos/keyring';
 import {
   type CreateIdentityRequest,
   type CreateRecoveryCredentialRequest,
@@ -17,52 +16,30 @@ import {
   type QueryIdentityResponse,
   type RecoverIdentityRequest,
   type SignPresentationRequest,
-  SpaceState,
 } from '@dxos/protocols/proto/dxos/client/services';
 import { type Presentation, type ProfileDocument } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { safeAwaitAll } from '@dxos/util';
-
-import { type DataSpaceManager } from '../spaces';
 
 import { type Identity } from './identity';
 import { type CreateIdentityOptions, type IdentityManager } from './identity-manager';
 import { type EdgeIdentityRecoveryManager } from './identity-recovery-manager';
 
-const DEFAULT_SPACE_SEARCH_TIMEOUT = 10_000;
-
 export class IdentityServiceImpl extends Resource implements IdentityService {
   constructor(
     private readonly _identityManager: IdentityManager,
     private readonly _recoveryManager: EdgeIdentityRecoveryManager,
-    private readonly _keyring: Keyring,
-    private readonly _dataSpaceManagerProvider: () => DataSpaceManager,
-    private readonly _createIdentity: (params: CreateIdentityOptions) => Promise<Identity>,
+    private readonly _keyring: KeyringApi,
+    private readonly _createIdentity: (params: CreateIdentityOptions, ctx?: Context) => Promise<Identity>,
     private readonly _onProfileUpdate?: (profile: ProfileDocument | undefined) => Promise<void>,
   ) {
     super();
   }
 
-  protected override async _open(): Promise<void> {
-    const identity = this._identityManager.identity;
-    if (identity && !identity.defaultSpaceId) {
-      await this._fixIdentityWithoutDefaultSpace(identity);
-    }
-  }
-
-  async createIdentity(request: CreateIdentityRequest): Promise<IdentityProto> {
-    await this._createIdentity({ profile: request.profile, deviceProfile: request.deviceProfile });
-    const dataSpaceManager = this._dataSpaceManagerProvider();
-    await this._createDefaultSpace(dataSpaceManager);
+  async createIdentity(request: CreateIdentityRequest, options?: RequestOptions): Promise<IdentityProto> {
+    const ctx = options?.ctx ?? Context.default();
+    await this._createIdentity({ profile: request.profile, deviceProfile: request.deviceProfile }, ctx);
     return this._getIdentity()!;
   }
 
-  private async _createDefaultSpace(dataSpaceManager: DataSpaceManager): Promise<void> {
-    const space = await dataSpaceManager!.createDefaultSpace();
-    const identity = this._identityManager.identity;
-    invariant(identity);
-    await identity.updateDefaultSpace(space.id);
-  }
-
   queryIdentity(): Stream<QueryIdentityResponse> {
     return new Stream(({ next }) => {
       const emitNext = () => next({ identity: this._getIdentity() });
@@ -96,17 +73,20 @@ export class IdentityServiceImpl extends Resource implements IdentityService {
     return this._recoveryManager.createRecoveryCredential(request);
   }
 
-  async requestRecoveryChallenge() {
-    return this._recoveryManager.requestRecoveryChallenge();
+  async requestRecoveryChallenge(_request: void, options?: RequestOptions) {
+    return this._recoveryManager.requestRecoveryChallenge(options?.ctx ?? Context.default());
   }
 
-  async recoverIdentity(request: RecoverIdentityRequest): Promise<IdentityProto> {
+  async recoverIdentity(request: RecoverIdentityRequest, options?: RequestOptions): Promise<IdentityProto> {
+    const ctx = options?.ctx ?? Context.default();
     if (request.recoveryCode) {
-      await this._recoveryManager.recoverIdentity({ recoveryCode: request.recoveryCode });
+      await this._recoveryManager.recoverIdentity(ctx, { recoveryCode: request.recoveryCode });
     } else if (request.external) {
-      await this._recoveryManager.recoverIdentityWithExternalSignature(request.external);
+      await this._recoveryManager.recoverIdentityWithExternalSignature(ctx, request.external);
     } else if (request.token) {
-      await this._recoveryManager.recoverIdentityWithToken({ token: request.token });
+      await this._recoveryManager.recoverIdentityWithToken(ctx, { token: request.token });
+    } else if (request.recoveryProof) {
+      await this._recoveryManager.recoverIdentityWithToken(ctx, { recoveryProof: request.recoveryProof });
     } else {
       throw new Error('Invalid request.');
     }
@@ -141,50 +121,4 @@ export class IdentityServiceImpl extends Resource implements IdentityService {
       signer: this._keyring,
     });
   }
-
-  private async _fixIdentityWithoutDefaultSpace(identity: Identity): Promise<void> {
-    let recodedDefaultSpace = false;
-    let foundDefaultSpace = false;
-    const dataSpaceManager = this._dataSpaceManagerProvider();
-
-    const recordedDefaultSpaceTrigger = new Trigger();
-
-    const allProcessed = safeAwaitAll(
-      dataSpaceManager.spaces.values(),
-      async (space) => {
-        if (space.state === SpaceState.SPACE_CLOSED) {
-          await space.open();
-
-          // Wait until the space is either READY or REQUIRES_MIGRATION.
-          // NOTE: Space could potentially never initialize if the space data is corrupted.
-          const requiresMigration = space.stateUpdate.waitForCondition(
-            () => space.state === SpaceState.SPACE_REQUIRES_MIGRATION,
-          );
-          await Promise.race([space.initializeDataPipeline(), requiresMigration]);
-        }
-        if (await dataSpaceManager.isDefaultSpace(space)) {
-          if (foundDefaultSpace) {
-            log.warn('Multiple default spaces found. Using the first one.', { duplicate: space.id });
-            return;
-          }
-
-          foundDefaultSpace = true;
-          await identity.updateDefaultSpace(space.id);
-          recodedDefaultSpace = true;
-          recordedDefaultSpaceTrigger.wake();
-        }
-      },
-      (err) => {
-        log.catch(err);
-      },
-    );
-
-    // Wait for all spaces to be processed or until the default space is recorded.
-    // If the timeout is reached, create a new default space.
-    await Promise.race([allProcessed, recordedDefaultSpaceTrigger.wait(), sleep(DEFAULT_SPACE_SEARCH_TIMEOUT)]);
-
-    if (!recodedDefaultSpace) {
-      await this._createDefaultSpace(dataSpaceManager);
-    }
-  }
 }

package/src/packlets/identity/identity.test.ts

@@ -15,7 +15,7 @@ import {
   SpaceProtocol,
   createIdFromSpaceKey,
   valueEncoding,
-} from '@dxos/echo-pipeline';
+} from '@dxos/echo-host';
 import { type EdgeConnection, type MessageListener } from '@dxos/edge-client';
 import { FeedFactory, FeedStore } from '@dxos/feed-store';
 import { type FeedWrapper } from '@dxos/feed-store';
@@ -130,7 +130,7 @@ describe('identity/identity', () => {
         onMessage: (_: MessageListener): (() => void) => {
           return () => {};
         },
-        send: async (_) => {
+        send: async (..._) => {
           replicationStarted = true;
         },
       } as EdgeConnection,
@@ -218,7 +218,7 @@ describe('identity/identity', () => {
     });
 
     await identity.open(new Context());
-    await identity.joinNetwork();
+    await identity.joinNetwork(Context.default());
     onTestFinished(() => identity.close(new Context()));
     return { identity, identityKey, keyring, deviceKey, controlFeed, spaceKey, dataFeed };
   };