@dxos/credentials 0.4.10-next.71cec10 → 0.5.0

package/dist/lib/node/index.cjs

@@ -31,6 +31,7 @@ __export(node_exports, {
   CredentialGenerator: () => CredentialGenerator,
   DeviceStateMachine: () => DeviceStateMachine,
   FeedStateMachine: () => FeedStateMachine,
+  InvitationStateMachine: () => InvitationStateMachine,
   MemberStateMachine: () => MemberStateMachine,
   ProfileStateMachine: () => ProfileStateMachine,
   SIGNATURE_TYPE_ED25519: () => SIGNATURE_TYPE_ED25519,
@@ -42,6 +43,7 @@ __export(node_exports, {
   createCredentialMessage: () => createCredentialMessage,
   createCredentialSignerWithChain: () => createCredentialSignerWithChain,
   createCredentialSignerWithKey: () => createCredentialSignerWithKey,
+  createDelegatedSpaceInvitationCredential: () => createDelegatedSpaceInvitationCredential,
   createDeviceAuthorization: () => createDeviceAuthorization,
   credentialTypeFilter: () => credentialTypeFilter,
   defaultSecretProvider: () => defaultSecretProvider,
@@ -80,15 +82,17 @@ var import_util2 = require("@dxos/util");
 var import_invariant2 = require("@dxos/invariant");
 var import_keys4 = require("@dxos/keys");
 var import_util3 = require("@dxos/util");
-var import_invariant3 = require("@dxos/invariant");
 var import_keys5 = require("@dxos/keys");
-var import_log2 = require("@dxos/log");
 var import_util4 = require("@dxos/util");
+var import_invariant3 = require("@dxos/invariant");
+var import_keys6 = require("@dxos/keys");
+var import_log2 = require("@dxos/log");
+var import_util5 = require("@dxos/util");
 var import_async2 = require("@dxos/async");
 var import_invariant4 = require("@dxos/invariant");
-var import_keys6 = require("@dxos/keys");
+var import_keys7 = require("@dxos/keys");
 var import_log3 = require("@dxos/log");
-var import_util5 = require("@dxos/util");
+var import_util6 = require("@dxos/util");
 var import_log4 = require("@dxos/log");
 var defaultSecretProvider = async () => Buffer.from("0000");
 var defaultSecretValidator = async (invitation, secret) => true;
@@ -462,7 +466,7 @@ var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
     credential
   }));
 };
-var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, profile) => {
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, profile, invitationCredentialId) => {
   const credentials = await Promise.all([
     await signer.createCredential({
       subject: identityKey,
@@ -471,7 +475,8 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
         spaceKey,
         role: import_credentials.SpaceMember.Role.ADMIN,
         profile,
-        genesisFeedKey
+        genesisFeedKey,
+        invitationCredentialId
       }
     })
   ]);
@@ -481,6 +486,26 @@ var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFe
     }
   }));
 };
+var createDelegatedSpaceInvitationCredential = async (signer, subject, invitation) => {
+  const credential = await signer.createCredential({
+    subject,
+    assertion: {
+      "@type": "dxos.halo.invitations.DelegateSpaceInvitation",
+      invitationId: invitation.invitationId,
+      authMethod: invitation.authMethod,
+      swarmKey: invitation.swarmKey,
+      role: invitation.role,
+      guestKey: invitation.guestKey,
+      expiresOn: invitation.expiresOn,
+      multiUse: invitation.multiUse
+    }
+  });
+  return {
+    credential: {
+      credential
+    }
+  };
+};
 var signPresentation = async ({ presentation, signer, signerKey, chain, nonce }) => {
   const proof = {
     type: SIGNATURE_TYPE_ED25519,
@@ -629,12 +654,78 @@ var FeedStateMachine = class {
     await this.onFeedAdmitted.callIfSet(info);
   }
 };
+var InvitationStateMachine = class {
+  constructor() {
+    this._invitations = new import_util4.ComplexMap(import_keys5.PublicKey.hash);
+    this._redeemedInvitationCredentialIds = new import_util4.ComplexSet(import_keys5.PublicKey.hash);
+    this._cancelledInvitationCredentialIds = new import_util4.ComplexSet(import_keys5.PublicKey.hash);
+    this.onDelegatedInvitation = new import_util4.Callback();
+    this.onDelegatedInvitationRemoved = new import_util4.Callback();
+  }
+  get invitations() {
+    return this._invitations;
+  }
+  async process(credential) {
+    const credentialId = credential.id;
+    if (credentialId == null) {
+      return;
+    }
+    const assertion = getCredentialAssertion(credential);
+    switch (assertion["@type"]) {
+      case "dxos.halo.invitations.CancelDelegatedInvitation": {
+        this._cancelledInvitationCredentialIds.add(assertion.credentialId);
+        const existingInvitation = this._invitations.get(assertion.credentialId);
+        if (existingInvitation != null) {
+          this._invitations.delete(assertion.credentialId);
+          await this.onDelegatedInvitationRemoved.callIfSet({
+            credentialId: assertion.credentialId,
+            invitation: existingInvitation
+          });
+        }
+        break;
+      }
+      case "dxos.halo.invitations.DelegateSpaceInvitation": {
+        if (credential.id) {
+          const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();
+          const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;
+          const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);
+          if (isExpired || wasCancelled || wasUsed) {
+            return;
+          }
+          const invitation = {
+            ...assertion
+          };
+          this._invitations.set(credential.id, invitation);
+          await this.onDelegatedInvitation.callIfSet({
+            credentialId: credential.id,
+            invitation
+          });
+        }
+        break;
+      }
+      case "dxos.halo.credentials.SpaceMember": {
+        if (assertion.invitationCredentialId != null) {
+          this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);
+          const existingInvitation = this._invitations.get(assertion.invitationCredentialId);
+          if (existingInvitation != null && !existingInvitation.multiUse) {
+            this._invitations.delete(assertion.invitationCredentialId);
+            await this.onDelegatedInvitationRemoved.callIfSet({
+              credentialId: assertion.invitationCredentialId,
+              invitation: existingInvitation
+            });
+          }
+        }
+        break;
+      }
+    }
+  }
+};
 var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
 var MemberStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._members = new import_util4.ComplexMap(import_keys5.PublicKey.hash);
-    this.onMemberAdmitted = new import_util4.Callback();
+    this._members = new import_util5.ComplexMap(import_keys6.PublicKey.hash);
+    this.onMemberAdmitted = new import_util5.Callback();
   }
   get creator() {
     return this._creator;
@@ -729,7 +820,7 @@ var MemberStateMachine = class {
   }
 };
 var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
-var REVOKABLE_CREDENTIALS = [
+var REVOCABLE_CREDENTIALS = [
   "dxos.halo.credentials.SpaceMember"
 ];
 var SpaceStateMachine = class {
@@ -737,6 +828,7 @@ var SpaceStateMachine = class {
     this._spaceKey = _spaceKey;
     this._members = new MemberStateMachine(this._spaceKey);
     this._feeds = new FeedStateMachine(this._spaceKey);
+    this._invitations = new InvitationStateMachine();
     this._credentials = [];
     this._credentialsById = new import_util2.ComplexMap(import_keys3.PublicKey.hash);
     this._processedCredentials = new import_util2.ComplexSet(import_keys3.PublicKey.hash);
@@ -744,6 +836,8 @@ var SpaceStateMachine = class {
     this.onCredentialProcessed = new import_util2.Callback();
     this.onMemberAdmitted = this._members.onMemberAdmitted;
     this.onFeedAdmitted = this._feeds.onFeedAdmitted;
+    this.onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+    this.onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
   }
   get creator() {
     return this._members.creator;
@@ -763,6 +857,9 @@ var SpaceStateMachine = class {
   get genesisCredential() {
     return this._genesisCredential;
   }
+  get invitations() {
+    return this._invitations.invitations;
+  }
   async addCredentialProcessor(processor) {
     if (this._credentialProcessors.find((p) => p.processor === processor)) {
       throw new Error("Credential processor already added.");
@@ -801,7 +898,7 @@ var SpaceStateMachine = class {
       if (result.kind !== "pass") {
         import_log.log.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
           F: __dxlog_file4,
-          L: 139,
+          L: 149,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -814,7 +911,7 @@ var SpaceStateMachine = class {
         if (!this._canRevokeCredentials(credential.issuer)) {
           import_log.log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file4,
-            L: 148,
+            L: 158,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -824,7 +921,7 @@ var SpaceStateMachine = class {
         if (!toBeRevoked) {
           import_log.log.warn(`Credential to revoke not found: ${credential.subject.id}`, void 0, {
             F: __dxlog_file4,
-            L: 153,
+            L: 163,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -833,7 +930,7 @@ var SpaceStateMachine = class {
         if (!this._credentialCanBeRevoked(toBeRevoked)) {
           import_log.log.warn(`Credential cannot be revoked: ${credential.subject.id}`, void 0, {
             F: __dxlog_file4,
-            L: 157,
+            L: 167,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -846,7 +943,7 @@ var SpaceStateMachine = class {
         if (this._genesisCredential) {
           import_log.log.warn("Space already has a genesis credential.", void 0, {
             F: __dxlog_file4,
-            L: 167,
+            L: 176,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -855,7 +952,7 @@ var SpaceStateMachine = class {
         if (!credential.issuer.equals(this._spaceKey)) {
           import_log.log.warn("Space genesis credential must be issued by space.", void 0, {
             F: __dxlog_file4,
-            L: 171,
+            L: 180,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -864,7 +961,7 @@ var SpaceStateMachine = class {
         if (!credential.subject.id.equals(this._spaceKey)) {
           import_log.log.warn("Space genesis credential must be issued to space.", void 0, {
             F: __dxlog_file4,
-            L: 175,
+            L: 184,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -880,7 +977,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file4,
-            L: 189,
+            L: 198,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -889,20 +986,21 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           import_log.log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file4,
-            L: 193,
+            L: 202,
             S: this,
             C: (f, a) => f(...a)
           });
           return false;
         }
         await this._members.process(credential);
+        await this._invitations.process(credential);
         break;
       }
       case "dxos.halo.credentials.MemberProfile": {
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file4,
-            L: 203,
+            L: 213,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -915,7 +1013,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           import_log.log.warn("Space must have a genesis credential before admitting feeds.", void 0, {
             F: __dxlog_file4,
-            L: 213,
+            L: 223,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -924,7 +1022,7 @@ var SpaceStateMachine = class {
         if (!this._canAdmitFeeds(credential.issuer)) {
           import_log.log.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, void 0, {
             F: __dxlog_file4,
-            L: 217,
+            L: 227,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -933,6 +1031,20 @@ var SpaceStateMachine = class {
         await this._feeds.process(credential, sourceFeed);
         break;
       }
+      case "dxos.halo.invitations.CancelDelegatedInvitation":
+      case "dxos.halo.invitations.DelegateSpaceInvitation": {
+        if (!this._canInviteNewMembers(credential.issuer)) {
+          import_log.log.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+            F: __dxlog_file4,
+            L: 238,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        await this._invitations.process(credential);
+        break;
+      }
     }
     const newEntry = {
       credential,
@@ -962,7 +1074,7 @@ var SpaceStateMachine = class {
     return key.equals(this._spaceKey) || this._members.getRole(key) === import_credentials2.SpaceMember.Role.ADMIN;
   }
   _credentialCanBeRevoked(entry) {
-    return REVOKABLE_CREDENTIALS.includes(entry.credential.subject.assertion["@type"]);
+    return REVOCABLE_CREDENTIALS.includes(entry.credential.subject.assertion["@type"]);
   }
 };
 var CredentialConsumer = class {
@@ -996,7 +1108,7 @@ var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/
 var DeviceStateMachine = class {
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new import_util5.ComplexMap(import_keys6.PublicKey.hash);
+    this.authorizedDeviceKeys = new import_util6.ComplexMap(import_keys7.PublicKey.hash);
     this.deviceChainReady = new import_async2.Trigger();
   }
   async processCredential(credential) {
@@ -1112,6 +1224,7 @@ var ProfileStateMachine = class {
   CredentialGenerator,
   DeviceStateMachine,
   FeedStateMachine,
+  InvitationStateMachine,
   MemberStateMachine,
   ProfileStateMachine,
   SIGNATURE_TYPE_ED25519,
@@ -1123,6 +1236,7 @@ var ProfileStateMachine = class {
   createCredentialMessage,
   createCredentialSignerWithChain,
   createCredentialSignerWithKey,
+  createDelegatedSpaceInvitationCredential,
   createDeviceAuthorization,
   credentialTypeFilter,
   defaultSecretProvider,