@dxos/credentials 0.4.10-next.71cec10 → 0.5.0

package/dist/lib/browser/index.mjs

@@ -406,7 +406,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, profile) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, profile, invitationCredentialId) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -415,7 +415,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         spaceKey,
         role: SpaceMember.Role.ADMIN,
         profile,
-        genesisFeedKey
+        genesisFeedKey,
+        invitationCredentialId
       }
     })
   ]);
@@ -425,6 +426,26 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
     }
   }));
 };
+var createDelegatedSpaceInvitationCredential = async (signer, subject, invitation) => {
+  const credential = await signer.createCredential({
+    subject,
+    assertion: {
+      "@type": "dxos.halo.invitations.DelegateSpaceInvitation",
+      invitationId: invitation.invitationId,
+      authMethod: invitation.authMethod,
+      swarmKey: invitation.swarmKey,
+      role: invitation.role,
+      guestKey: invitation.guestKey,
+      expiresOn: invitation.expiresOn,
+      multiUse: invitation.multiUse
+    }
+  });
+  return {
+    credential: {
+      credential
+    }
+  };
+};
 
 // packages/core/halo/credentials/src/presentations/presentation.ts
 var signPresentation = async ({ presentation, signer, signerKey, chain, nonce }) => {
@@ -536,10 +557,10 @@ var verifyPresentationSignature = async (presentation, proof) => {
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
 import { runInContextAsync } from "@dxos/async";
 import { Context } from "@dxos/context";
-import { PublicKey as PublicKey5 } from "@dxos/keys";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log as log2 } from "@dxos/log";
 import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Callback as Callback3, ComplexMap as ComplexMap3, ComplexSet } from "@dxos/util";
+import { Callback as Callback4, ComplexMap as ComplexMap4, ComplexSet as ComplexSet2 } from "@dxos/util";
 
 // packages/core/halo/credentials/src/state-machine/feed-state-machine.ts
 import { invariant as invariant2 } from "@dxos/invariant";
@@ -592,17 +613,87 @@ var FeedStateMachine = class {
   }
 };
 
+// packages/core/halo/credentials/src/state-machine/invitation-state-machine.ts
+import { PublicKey as PublicKey4 } from "@dxos/keys";
+import { Callback as Callback2, ComplexMap as ComplexMap2, ComplexSet } from "@dxos/util";
+var InvitationStateMachine = class {
+  constructor() {
+    this._invitations = new ComplexMap2(PublicKey4.hash);
+    this._redeemedInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
+    this._cancelledInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
+    this.onDelegatedInvitation = new Callback2();
+    this.onDelegatedInvitationRemoved = new Callback2();
+  }
+  get invitations() {
+    return this._invitations;
+  }
+  async process(credential) {
+    const credentialId = credential.id;
+    if (credentialId == null) {
+      return;
+    }
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.invitations.CancelDelegatedInvitation": {
+        this._cancelledInvitationCredentialIds.add(assertion.credentialId);
+        const existingInvitation = this._invitations.get(assertion.credentialId);
+        if (existingInvitation != null) {
+          this._invitations.delete(assertion.credentialId);
+          await this.onDelegatedInvitationRemoved.callIfSet({
+            credentialId: assertion.credentialId,
+            invitation: existingInvitation
+          });
+        }
+        break;
+      }
+      case "dxos.halo.invitations.DelegateSpaceInvitation": {
+        if (credential.id) {
+          const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();
+          const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;
+          const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);
+          if (isExpired || wasCancelled || wasUsed) {
+            return;
+          }
+          const invitation = {
+            ...assertion
+          };
+          this._invitations.set(credential.id, invitation);
+          await this.onDelegatedInvitation.callIfSet({
+            credentialId: credential.id,
+            invitation
+          });
+        }
+        break;
+      }
+      case "dxos.halo.credentials.SpaceMember": {
+        if (assertion.invitationCredentialId != null) {
+          this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);
+          const existingInvitation = this._invitations.get(assertion.invitationCredentialId);
+          if (existingInvitation != null && !existingInvitation.multiUse) {
+            this._invitations.delete(assertion.invitationCredentialId);
+            await this.onDelegatedInvitationRemoved.callIfSet({
+              credentialId: assertion.invitationCredentialId,
+              invitation: existingInvitation
+            });
+          }
+        }
+        break;
+      }
+    }
+  }
+};
+
 // packages/core/halo/credentials/src/state-machine/member-state-machine.ts
 import { invariant as invariant3 } from "@dxos/invariant";
-import { PublicKey as PublicKey4 } from "@dxos/keys";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log } from "@dxos/log";
-import { Callback as Callback2, ComplexMap as ComplexMap2 } from "@dxos/util";
+import { Callback as Callback3, ComplexMap as ComplexMap3 } from "@dxos/util";
 var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
 var MemberStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._members = new ComplexMap2(PublicKey4.hash);
-    this.onMemberAdmitted = new Callback2();
+    this._members = new ComplexMap3(PublicKey5.hash);
+    this.onMemberAdmitted = new Callback3();
   }
   get creator() {
     return this._creator;
@@ -699,7 +790,7 @@ var MemberStateMachine = class {
 
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
 var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
-var REVOKABLE_CREDENTIALS = [
+var REVOCABLE_CREDENTIALS = [
   "dxos.halo.credentials.SpaceMember"
 ];
 var SpaceStateMachine = class {
@@ -707,13 +798,16 @@ var SpaceStateMachine = class {
     this._spaceKey = _spaceKey;
     this._members = new MemberStateMachine(this._spaceKey);
     this._feeds = new FeedStateMachine(this._spaceKey);
+    this._invitations = new InvitationStateMachine();
     this._credentials = [];
-    this._credentialsById = new ComplexMap3(PublicKey5.hash);
-    this._processedCredentials = new ComplexSet(PublicKey5.hash);
+    this._credentialsById = new ComplexMap4(PublicKey6.hash);
+    this._processedCredentials = new ComplexSet2(PublicKey6.hash);
     this._credentialProcessors = [];
-    this.onCredentialProcessed = new Callback3();
+    this.onCredentialProcessed = new Callback4();
     this.onMemberAdmitted = this._members.onMemberAdmitted;
     this.onFeedAdmitted = this._feeds.onFeedAdmitted;
+    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
   }
   get creator() {
     return this._members.creator;
@@ -733,6 +827,9 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get invitations() {
+    return this._invitations.invitations;
+  }
   async addCredentialProcessor(processor) {
     if (this._credentialProcessors.find((p) => p.processor === processor)) {
       throw new Error("Credential processor already added.");
@@ -771,7 +868,7 @@ var SpaceStateMachine = class {
       if (result.kind !== "pass") {
         log2.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
           F: __dxlog_file4,
-          L: 139,
+          L: 149,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -784,7 +881,7 @@ var SpaceStateMachine = class {
         if (!this._canRevokeCredentials(credential.issuer)) {
           log2.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file4,
-            L: 148,
+            L: 158,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -794,7 +891,7 @@ var SpaceStateMachine = class {
         if (!toBeRevoked) {
           log2.warn(`Credential to revoke not found: ${credential.subject.id}`, void 0, {
             F: __dxlog_file4,
-            L: 153,
+            L: 163,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -803,7 +900,7 @@ var SpaceStateMachine = class {
         if (!this._credentialCanBeRevoked(toBeRevoked)) {
           log2.warn(`Credential cannot be revoked: ${credential.subject.id}`, void 0, {
             F: __dxlog_file4,
-            L: 157,
+            L: 167,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -816,7 +913,7 @@ var SpaceStateMachine = class {
         if (this._genesisCredential) {
           log2.warn("Space already has a genesis credential.", void 0, {
             F: __dxlog_file4,
-            L: 167,
+            L: 176,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -825,7 +922,7 @@ var SpaceStateMachine = class {
         if (!credential.issuer.equals(this._spaceKey)) {
           log2.warn("Space genesis credential must be issued by space.", void 0, {
             F: __dxlog_file4,
-            L: 171,
+            L: 180,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -834,7 +931,7 @@ var SpaceStateMachine = class {
         if (!credential.subject.id.equals(this._spaceKey)) {
           log2.warn("Space genesis credential must be issued to space.", void 0, {
             F: __dxlog_file4,
-            L: 175,
+            L: 184,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -850,7 +947,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log2.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file4,
-            L: 189,
+            L: 198,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -859,20 +956,21 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log2.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file4,
-            L: 193,
+            L: 202,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         await this._members.process(credential);
+        await this._invitations.process(credential);
         break;
       }
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
           log2.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file4,
-            L: 203,
+            L: 213,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -885,7 +983,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log2.warn("Space must have a genesis credential before admitting feeds.", void 0, {
             F: __dxlog_file4,
-            L: 213,
+            L: 223,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -894,7 +992,7 @@ var SpaceStateMachine = class {
         if (!this._canAdmitFeeds(credential.issuer)) {
           log2.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, void 0, {
             F: __dxlog_file4,
-            L: 217,
+            L: 227,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -903,6 +1001,20 @@ var SpaceStateMachine = class {
         await this._feeds.process(credential, sourceFeed);
         break;
       }
+      case "dxos.halo.invitations.CancelDelegatedInvitation":
+      case "dxos.halo.invitations.DelegateSpaceInvitation": {
+        if (!this._canInviteNewMembers(credential.issuer)) {
+          log2.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file4,
+            L: 238,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        await this._invitations.process(credential);
+        break;
+      }
     }
     const newEntry = {
       credential,
@@ -932,7 +1044,7 @@ var SpaceStateMachine = class {
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember2.Role.ADMIN;
   }
   _credentialCanBeRevoked(entry) {
-    return REVOKABLE_CREDENTIALS.includes(entry.credential.subject.assertion["@type"]);
+    return REVOCABLE_CREDENTIALS.includes(entry.credential.subject.assertion["@type"]);
   }
 };
 var CredentialConsumer = class {
@@ -966,14 +1078,14 @@ var CredentialConsumer = class {
 // packages/core/halo/credentials/src/processor/device-state-machine.ts
 import { Trigger } from "@dxos/async";
 import { invariant as invariant4 } from "@dxos/invariant";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
-import { ComplexMap as ComplexMap4 } from "@dxos/util";
+import { ComplexMap as ComplexMap5 } from "@dxos/util";
 var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap4(PublicKey6.hash);
+    this.authorizedDeviceKeys = new ComplexMap5(PublicKey7.hash);
     this.deviceChainReady = new Trigger();
   }
   async processCredential(credential) {
@@ -1091,6 +1203,7 @@ export {
   CredentialGenerator,
   DeviceStateMachine,
   FeedStateMachine,
+  InvitationStateMachine,
   MemberStateMachine,
   ProfileStateMachine,
   SIGNATURE_TYPE_ED25519,
@@ -1102,6 +1215,7 @@ export {
   createCredentialMessage,
   createCredentialSignerWithChain,
   createCredentialSignerWithKey,
+  createDelegatedSpaceInvitationCredential,
   createDeviceAuthorization,
   credentialTypeFilter,
   defaultSecretProvider,