@dxos/credentials 0.4.10-main.fd8ea31 → 0.4.10-next.71cec10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/credentials",
-  "version": "0.4.10-main.fd8ea31",
+  "version": "0.4.10-next.71cec10",
   "description": "DXOS Credentials",
   "homepage": "https://github.com/dxos/dxos/tree/main/packages/core/halo/credentials#readme",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -25,20 +25,20 @@
     "performance-now": "^2.1.0",
     "pump": "^3.0.0",
     "stream-to-array": "^2.3.0",
-    "@dxos/async": "0.4.10-main.fd8ea31",
-    "@dxos/codec-protobuf": "0.4.10-main.fd8ea31",
-    "@dxos/debug": "0.4.10-main.fd8ea31",
-    "@dxos/crypto": "0.4.10-main.fd8ea31",
-    "@dxos/context": "0.4.10-main.fd8ea31",
-    "@dxos/invariant": "0.4.10-main.fd8ea31",
-    "@dxos/feed-store": "0.4.10-main.fd8ea31",
-    "@dxos/keys": "0.4.10-main.fd8ea31",
-    "@dxos/log": "0.4.10-main.fd8ea31",
-    "@dxos/node-std": "0.4.10-main.fd8ea31",
-    "@dxos/protocols": "0.4.10-main.fd8ea31",
-    "@dxos/keyring": "0.4.10-main.fd8ea31",
-    "@dxos/timeframe": "0.4.10-main.fd8ea31",
-    "@dxos/util": "0.4.10-main.fd8ea31"
+    "@dxos/async": "0.4.10-next.71cec10",
+    "@dxos/codec-protobuf": "0.4.10-next.71cec10",
+    "@dxos/context": "0.4.10-next.71cec10",
+    "@dxos/crypto": "0.4.10-next.71cec10",
+    "@dxos/feed-store": "0.4.10-next.71cec10",
+    "@dxos/debug": "0.4.10-next.71cec10",
+    "@dxos/invariant": "0.4.10-next.71cec10",
+    "@dxos/keyring": "0.4.10-next.71cec10",
+    "@dxos/keys": "0.4.10-next.71cec10",
+    "@dxos/node-std": "0.4.10-next.71cec10",
+    "@dxos/timeframe": "0.4.10-next.71cec10",
+    "@dxos/log": "0.4.10-next.71cec10",
+    "@dxos/util": "0.4.10-next.71cec10",
+    "@dxos/protocols": "0.4.10-next.71cec10"
   },
   "devDependencies": {
     "@types/encoding-down": "^5.0.0",
@@ -50,7 +50,7 @@
     "@types/pify": "^3.0.2",
     "@types/pump": "^1.1.0",
     "@types/stream-to-array": "^2.3.0",
-    "@dxos/random-access-storage": "0.4.10-main.fd8ea31"
+    "@dxos/random-access-storage": "0.4.10-next.71cec10"
   },
   "publishConfig": {
     "access": "public"

package/src/credentials/credential-generator.ts

@@ -13,7 +13,6 @@ import {
   type ProfileDocument,
   SpaceMember,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { Timeframe } from '@dxos/timeframe';
 
 import { createCredential, type CredentialSigner } from './credential-factory';
@@ -208,7 +207,6 @@ export const createAdmissionCredentials = async (
   spaceKey: PublicKey,
   genesisFeedKey: PublicKey,
   profile?: ProfileDocument,
-  invitationCredentialId?: PublicKey,
 ): Promise<FeedMessage.Payload[]> => {
   const credentials = await Promise.all([
     await signer.createCredential({
@@ -219,7 +217,6 @@ export const createAdmissionCredentials = async (
         role: SpaceMember.Role.ADMIN, // TODO(burdon): Configure.
         profile,
         genesisFeedKey,
-        invitationCredentialId,
       },
     }),
   ]);
@@ -228,24 +225,3 @@ export const createAdmissionCredentials = async (
     credential: { credential },
   }));
 };
-
-export const createDelegatedSpaceInvitationCredential = async (
-  signer: CredentialSigner,
-  subject: PublicKey,
-  invitation: DelegateSpaceInvitation,
-): Promise<FeedMessage.Payload> => {
-  const credential = await signer.createCredential({
-    subject,
-    assertion: {
-      '@type': 'dxos.halo.invitations.DelegateSpaceInvitation',
-      invitationId: invitation.invitationId,
-      authMethod: invitation.authMethod,
-      swarmKey: invitation.swarmKey,
-      role: invitation.role,
-      guestKey: invitation.guestKey,
-      expiresOn: invitation.expiresOn,
-      multiUse: invitation.multiUse,
-    },
-  });
-  return { credential: { credential } };
-};

package/src/state-machine/index.ts

@@ -5,4 +5,3 @@
 export * from './space-state-machine';
 export * from './feed-state-machine';
 export * from './member-state-machine';
-export * from './invitation-state-machine';

package/src/state-machine/space-state-machine.ts

@@ -8,11 +8,9 @@ import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { type TypedMessage } from '@dxos/protocols';
 import { type Credential, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type AsyncCallback, Callback, ComplexMap, ComplexSet } from '@dxos/util';
 
 import { type FeedInfo, FeedStateMachine } from './feed-state-machine';
-import { InvitationStateMachine } from './invitation-state-machine';
 import { MemberStateMachine, type MemberInfo } from './member-state-machine';
 import { getCredentialAssertion, verifyCredential } from '../credentials';
 import { type CredentialProcessor } from '../processor/credential-processor';
@@ -23,7 +21,6 @@ export interface SpaceState {
   readonly credentials: Credential[];
   readonly genesisCredential: Credential | undefined;
   readonly creator: MemberInfo | undefined;
-  readonly invitations: ReadonlyMap<PublicKey, DelegateSpaceInvitation>;
 
   addCredentialProcessor(processor: CredentialProcessor): Promise<void>;
   removeCredentialProcessor(processor: CredentialProcessor): Promise<void>;
@@ -42,7 +39,7 @@ export type CredentialEntry = {
   revoked: boolean;
 };
 
-const REVOCABLE_CREDENTIALS = ['dxos.halo.credentials.SpaceMember'];
+const REVOKABLE_CREDENTIALS = ['dxos.halo.credentials.SpaceMember'];
 
 /**
  * Validates and processes credentials for a single space.
@@ -52,7 +49,6 @@ const REVOCABLE_CREDENTIALS = ['dxos.halo.credentials.SpaceMember'];
 export class SpaceStateMachine implements SpaceState {
   private readonly _members = new MemberStateMachine(this._spaceKey);
   private readonly _feeds = new FeedStateMachine(this._spaceKey);
-  private readonly _invitations = new InvitationStateMachine();
   private readonly _credentials: CredentialEntry[] = [];
   private readonly _credentialsById = new ComplexMap<PublicKey, CredentialEntry>(PublicKey.hash);
   private readonly _processedCredentials = new ComplexSet<PublicKey>(PublicKey.hash);
@@ -63,8 +59,6 @@ export class SpaceStateMachine implements SpaceState {
   readonly onCredentialProcessed = new Callback<AsyncCallback<Credential>>();
   readonly onMemberAdmitted = this._members.onMemberAdmitted;
   readonly onFeedAdmitted = this._feeds.onFeedAdmitted;
-  readonly onDelegatedInvitation = this._invitations.onDelegatedInvitation;
-  readonly onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
 
   constructor(private readonly _spaceKey: PublicKey) {}
 
@@ -92,10 +86,6 @@ export class SpaceStateMachine implements SpaceState {
     return this._genesisCredential;
   }
 
-  get invitations(): ReadonlyMap<PublicKey, DelegateSpaceInvitation> {
-    return this._invitations.invitations;
-  }
-
   async addCredentialProcessor(processor: CredentialProcessor) {
     if (this._credentialProcessors.find((p) => p.processor === processor)) {
       throw new Error('Credential processor already added.');
@@ -169,6 +159,7 @@ export class SpaceStateMachine implements SpaceState {
 
         toBeRevoked.revoked = true;
         await this._members.onRevoked(toBeRevoked.credential, credential);
+
         break;
       }
       case 'dxos.halo.credentials.SpaceGenesis': {
@@ -204,7 +195,6 @@ export class SpaceStateMachine implements SpaceState {
         }
 
         await this._members.process(credential);
-        await this._invitations.process(credential);
         break;
       }
 
@@ -232,15 +222,6 @@ export class SpaceStateMachine implements SpaceState {
         await this._feeds.process(credential, sourceFeed);
         break;
       }
-      case 'dxos.halo.invitations.CancelDelegatedInvitation':
-      case 'dxos.halo.invitations.DelegateSpaceInvitation': {
-        if (!this._canInviteNewMembers(credential.issuer)) {
-          log.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`);
-          return false;
-        }
-        await this._invitations.process(credential);
-        break;
-      }
     }
 
     const newEntry: CredentialEntry = { credential, sourceFeed, revoked: false };
@@ -276,7 +257,7 @@ export class SpaceStateMachine implements SpaceState {
 
   private _credentialCanBeRevoked(entry: CredentialEntry) {
     // TODO(dmaretskyi): Prohibit from removing space's creator member credential.
-    return REVOCABLE_CREDENTIALS.includes(entry.credential.subject.assertion['@type']);
+    return REVOKABLE_CREDENTIALS.includes(entry.credential.subject.assertion['@type']);
   }
 }
 

package/dist/types/src/state-machine/invitation-state-machine.d.ts

@@ -1,22 +0,0 @@
-import { PublicKey } from '@dxos/keys';
-import { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
-import { type AsyncCallback, Callback } from '@dxos/util';
-export interface DelegateInvitationCredential {
-    credentialId: PublicKey;
-    invitation: DelegateSpaceInvitation;
-}
-/**
- * Tracks the feed tree for a space.
- * Provides a list of admitted feeds.
- */
-export declare class InvitationStateMachine {
-    private readonly _invitations;
-    private readonly _redeemedInvitationCredentialIds;
-    private readonly _cancelledInvitationCredentialIds;
-    readonly onDelegatedInvitation: Callback<AsyncCallback<DelegateInvitationCredential>>;
-    readonly onDelegatedInvitationRemoved: Callback<AsyncCallback<DelegateInvitationCredential>>;
-    get invitations(): ReadonlyMap<PublicKey, DelegateSpaceInvitation>;
-    process(credential: Credential): Promise<void>;
-}
-//# sourceMappingURL=invitation-state-machine.d.ts.map

package/dist/types/src/state-machine/invitation-state-machine.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"invitation-state-machine.d.ts","sourceRoot":"","sources":["../../../../src/state-machine/invitation-state-machine.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,KAAK,aAAa,EAAE,QAAQ,EAA0B,MAAM,YAAY,CAAC;AAIlF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,SAAS,CAAC;IACxB,UAAU,EAAE,uBAAuB,CAAC;CACrC;AAED;;;GAGG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsE;IACnG,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAkC;IACnF,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAkC;IAEpF,QAAQ,CAAC,qBAAqB,wDAA+D;IAC7F,QAAQ,CAAC,4BAA4B,wDAA+D;IAEpG,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAEjE;IAEK,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAoDrD"}

package/dist/types/src/state-machine/invitation-state-machine.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=invitation-state-machine.test.d.ts.map

package/dist/types/src/state-machine/invitation-state-machine.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"invitation-state-machine.test.d.ts","sourceRoot":"","sources":["../../../../src/state-machine/invitation-state-machine.test.ts"],"names":[],"mappings":""}

package/src/state-machine/invitation-state-machine.test.ts

@@ -1,166 +0,0 @@
-//
-// Copyright 2022 DXOS.org
-//
-
-import { expect } from 'chai';
-
-import { Keyring } from '@dxos/keyring';
-import { PublicKey } from '@dxos/keys';
-import { Invitation } from '@dxos/protocols/proto/dxos/client/services';
-import { SpaceMember, type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
-import { describe, test } from '@dxos/test';
-import { range } from '@dxos/util';
-
-import { InvitationStateMachine } from './invitation-state-machine';
-import {
-  createCredential,
-  createCredentialSignerWithKey,
-  createDelegatedSpaceInvitationCredential,
-} from '../credentials';
-
-describe('InvitationStateMachine', () => {
-  const keyring = new Keyring();
-  let space: PublicKey;
-  let identity: PublicKey;
-  const baseInvitation: DelegateSpaceInvitation = {
-    invitationId: PublicKey.random().toHex(),
-    swarmKey: PublicKey.random(),
-    role: SpaceMember.Role.ADMIN,
-    authMethod: Invitation.AuthMethod.KNOWN_PUBLIC_KEY,
-    multiUse: false,
-  };
-  beforeEach(async () => {
-    space = await keyring.createKey();
-    identity = await keyring.createKey();
-  });
-
-  test('invitation delegated', async () => {
-    const stateMachine = createStateMachine();
-    await stateMachine.process(await delegateInvitation(baseInvitation));
-    expectHasInvitation(stateMachine, baseInvitation);
-  });
-
-  test('multiple invitations', async () => {
-    const stateMachine = createStateMachine();
-    const invitations = range(3).map(() => ({ ...baseInvitation, invitationId: PublicKey.random().toHex() }));
-    await Promise.all(
-      invitations.map(async (invitation) => {
-        return stateMachine.process(await delegateInvitation(invitation));
-      }),
-    );
-    invitations.forEach((invitation) => expectHasInvitation(stateMachine, invitation));
-  });
-
-  test('expired invitations are ignored', async () => {
-    const stateMachine = createStateMachine();
-    await stateMachine.process(
-      await delegateInvitation({
-        ...baseInvitation,
-        expiresOn: new Date(Date.now() - 1),
-      }),
-    );
-    expectNoInvitation(stateMachine, baseInvitation);
-  });
-
-  test('single use invitation redeemed when a member joins', async () => {
-    const stateMachine = createStateMachine();
-    const delegatedInvitation = await delegateInvitation(baseInvitation);
-    await stateMachine.process(delegatedInvitation);
-    await stateMachine.process(await admitMember(delegatedInvitation));
-    expectNoInvitation(stateMachine, baseInvitation);
-  });
-
-  test('invitation stays if unrelated admission credential', async () => {
-    const stateMachine = createStateMachine();
-    const unrelatedInvitation = await delegateInvitation({
-      ...baseInvitation,
-      invitationId: PublicKey.random().toHex(),
-    });
-    await stateMachine.process(await delegateInvitation(baseInvitation));
-    await stateMachine.process(await admitMember(unrelatedInvitation));
-    expectHasInvitation(stateMachine, baseInvitation);
-  });
-
-  test('multi-use invitations', async () => {
-    const stateMachine = createStateMachine();
-    const multiUseInvitation = { ...baseInvitation, multiUse: true };
-    const delegatedInvitation = await delegateInvitation(multiUseInvitation);
-    await stateMachine.process(delegatedInvitation);
-    await stateMachine.process(await admitMember(delegatedInvitation));
-    await stateMachine.process(await admitMember(delegatedInvitation));
-    expectHasInvitation(stateMachine, multiUseInvitation);
-  });
-
-  test('explicit cancellation', async () => {
-    const stateMachine = createStateMachine();
-    const delegatedInvitation = await delegateInvitation(baseInvitation);
-    await stateMachine.process(delegatedInvitation);
-    await stateMachine.process(await cancelInvitation(delegatedInvitation));
-    expectNoInvitation(stateMachine, baseInvitation);
-  });
-
-  test('out of order joining', async () => {
-    const stateMachine = createStateMachine();
-    const delegatedInvitation = await delegateInvitation(baseInvitation);
-    await stateMachine.process(await admitMember(delegatedInvitation));
-    await stateMachine.process(delegatedInvitation);
-    expectNoInvitation(stateMachine, baseInvitation);
-  });
-
-  test('out of order cancellation', async () => {
-    const stateMachine = createStateMachine();
-    const delegatedInvitation = await delegateInvitation(baseInvitation);
-    await stateMachine.process(await cancelInvitation(delegatedInvitation));
-    await stateMachine.process(delegatedInvitation);
-    expectNoInvitation(stateMachine, baseInvitation);
-  });
-
-  const expectHasInvitation = (state: InvitationStateMachine, expected: DelegateSpaceInvitation) => {
-    const actual = [...state.invitations.values()].find((i) => i.invitationId === expected.invitationId);
-    expect(actual).to.deep.contain(expected);
-  };
-
-  const expectNoInvitation = (state: InvitationStateMachine, expected: DelegateSpaceInvitation) => {
-    const actual = [...state.invitations.values()].find((i) => i.invitationId === expected.invitationId);
-    expect(actual).to.be.undefined;
-  };
-
-  const delegateInvitation = async (invitation: DelegateSpaceInvitation): Promise<Credential> => {
-    const message = await createDelegatedSpaceInvitationCredential(
-      createCredentialSignerWithKey(keyring, identity),
-      space,
-      invitation,
-    );
-    return message.credential!.credential;
-  };
-
-  const cancelInvitation = async (invitation: Credential): Promise<Credential> => {
-    return createCredential({
-      issuer: space,
-      subject: identity,
-      assertion: {
-        '@type': 'dxos.halo.invitations.CancelDelegatedInvitation',
-        credentialId: invitation.id!,
-      },
-      signer: keyring,
-    });
-  };
-
-  const admitMember = (invitation: Credential) => {
-    return createCredential({
-      issuer: space,
-      subject: identity,
-      assertion: {
-        '@type': 'dxos.halo.credentials.SpaceMember',
-        spaceKey: space,
-        role: SpaceMember.Role.ADMIN,
-        genesisFeedKey: PublicKey.random(),
-        invitationCredentialId: invitation.id,
-      },
-      signer: keyring,
-    });
-  };
-});
-
-const createStateMachine = () => new InvitationStateMachine();

package/src/state-machine/invitation-state-machine.ts

@@ -1,85 +0,0 @@
-//
-// Copyright 2022 DXOS.org
-//
-
-import { PublicKey } from '@dxos/keys';
-import { type Credential } from '@dxos/protocols/proto/dxos/halo/credentials';
-import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
-import { type AsyncCallback, Callback, ComplexMap, ComplexSet } from '@dxos/util';
-
-import { getCredentialAssertion } from '../credentials';
-
-export interface DelegateInvitationCredential {
-  credentialId: PublicKey;
-  invitation: DelegateSpaceInvitation;
-}
-
-/**
- * Tracks the feed tree for a space.
- * Provides a list of admitted feeds.
- */
-export class InvitationStateMachine {
-  private readonly _invitations = new ComplexMap<PublicKey, DelegateSpaceInvitation>(PublicKey.hash);
-  private readonly _redeemedInvitationCredentialIds = new ComplexSet(PublicKey.hash);
-  private readonly _cancelledInvitationCredentialIds = new ComplexSet(PublicKey.hash);
-
-  readonly onDelegatedInvitation = new Callback<AsyncCallback<DelegateInvitationCredential>>();
-  readonly onDelegatedInvitationRemoved = new Callback<AsyncCallback<DelegateInvitationCredential>>();
-
-  get invitations(): ReadonlyMap<PublicKey, DelegateSpaceInvitation> {
-    return this._invitations;
-  }
-
-  async process(credential: Credential): Promise<void> {
-    const credentialId = credential.id;
-    if (credentialId == null) {
-      return;
-    }
-    const assertion = getCredentialAssertion(credential);
-    switch (assertion['@type']) {
-      case 'dxos.halo.invitations.CancelDelegatedInvitation': {
-        this._cancelledInvitationCredentialIds.add(assertion.credentialId);
-        const existingInvitation = this._invitations.get(assertion.credentialId);
-        if (existingInvitation != null) {
-          this._invitations.delete(assertion.credentialId);
-          await this.onDelegatedInvitationRemoved.callIfSet({
-            credentialId: assertion.credentialId,
-            invitation: existingInvitation,
-          });
-        }
-        break;
-      }
-      case 'dxos.halo.invitations.DelegateSpaceInvitation': {
-        if (credential.id) {
-          const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();
-          const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;
-          const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);
-          if (isExpired || wasCancelled || wasUsed) {
-            return;
-          }
-          const invitation: DelegateSpaceInvitation = { ...assertion };
-          this._invitations.set(credential.id, invitation);
-          await this.onDelegatedInvitation.callIfSet({
-            credentialId: credential.id,
-            invitation,
-          });
-        }
-        break;
-      }
-      case 'dxos.halo.credentials.SpaceMember': {
-        if (assertion.invitationCredentialId != null) {
-          this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);
-          const existingInvitation = this._invitations.get(assertion.invitationCredentialId);
-          if (existingInvitation != null && !existingInvitation.multiUse) {
-            this._invitations.delete(assertion.invitationCredentialId);
-            await this.onDelegatedInvitationRemoved.callIfSet({
-              credentialId: assertion.invitationCredentialId,
-              invitation: existingInvitation,
-            });
-          }
-        }
-        break;
-      }
-    }
-  }
-}