@dxos/credentials 0.7.5-labs.e27f9b9 → 0.7.5-main.2567c87

package/dist/lib/browser/index.mjs

@@ -1,22 +1,5 @@
 import "@dxos/node-std/globals";
 
-// packages/core/halo/credentials/src/did.ts
-import { subtleCrypto } from "@dxos/crypto";
-import { PublicKey, IdentityDid } from "@dxos/keys";
-import { ComplexMap } from "@dxos/util";
-var IDENTITY_DIDS_CACHE = new ComplexMap(PublicKey.hash);
-var createDidFromIdentityKey = async (identityKey) => {
-  const cachedValue = IDENTITY_DIDS_CACHE.get(identityKey);
-  if (cachedValue !== void 0) {
-    return cachedValue;
-  }
-  const digest = await subtleCrypto.digest("SHA-256", identityKey.asUint8Array());
-  const bytes = new Uint8Array(digest).slice(0, IdentityDid.byteLength);
-  const identityDid = IdentityDid.encode(bytes);
-  IDENTITY_DIDS_CACHE.set(identityKey, identityDid);
-  return identityDid;
-};
-
 // packages/core/halo/credentials/src/invitations.ts
 var defaultSecretProvider = async () => Buffer.from("0000");
 var defaultSecretValidator = async (invitation, secret) => true;
@@ -52,7 +35,7 @@ var generatePasscode = (length = 4) => {
 
 // packages/core/halo/credentials/src/credentials/signing.ts
 import stableStringify from "json-stable-stringify";
-import { PublicKey as PublicKey2 } from "@dxos/keys";
+import { PublicKey } from "@dxos/keys";
 import { Timeframe } from "@dxos/timeframe";
 import { arrayToBuffer } from "@dxos/util";
 var getCredentialProofPayload = (credential) => {
@@ -87,7 +70,7 @@ var canonicalStringify = (obj) => stableStringify(obj, {
     }
     const original = this[key];
     if (value) {
-      if (PublicKey2.isPublicKey(value)) {
+      if (PublicKey.isPublicKey(value)) {
         return value.toHex();
       }
       if (Buffer.isBuffer(value)) {
@@ -152,9 +135,9 @@ var checkCredentialType = (credential, type) => credential.subject.assertion["@t
 var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
 
 // packages/core/halo/credentials/src/credentials/credential-factory.ts
-import { subtleCrypto as subtleCrypto2 } from "@dxos/crypto";
+import { subtleCrypto } from "@dxos/crypto";
 import { invariant as invariant2 } from "@dxos/invariant";
-import { PublicKey as PublicKey3 } from "@dxos/keys";
+import { PublicKey as PublicKey2 } from "@dxos/keys";
 
 // packages/core/halo/credentials/src/credentials/verifier.ts
 import { verifySignature } from "@dxos/crypto";
@@ -279,7 +262,7 @@ var createCredential = async ({ signer, issuer, subject, assertion, signingKey,
   if (chain) {
     credential.proof.chain = chain;
   }
-  credential.id = PublicKey3.from(await subtleCrypto2.digest("SHA-256", signedPayload));
+  credential.id = PublicKey2.from(await subtleCrypto.digest("SHA-256", signedPayload));
   return credential;
 };
 var createCredentialMessage = (credential) => {
@@ -624,22 +607,22 @@ var verifyPresentationSignature = async (presentation, proof) => {
 };
 
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
-import { runInContextAsync, synchronized } from "@dxos/async";
+import { runInContextAsync } from "@dxos/async";
 import { Context } from "@dxos/context";
-import { PublicKey as PublicKey8 } from "@dxos/keys";
+import { PublicKey as PublicKey7 } from "@dxos/keys";
 import { log as log3 } from "@dxos/log";
 import { SpaceMember as SpaceMember3 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { Callback as Callback4, ComplexMap as ComplexMap6, ComplexSet as ComplexSet3 } from "@dxos/util";
+import { Callback as Callback4, ComplexMap as ComplexMap5, ComplexSet as ComplexSet3 } from "@dxos/util";
 
 // packages/core/halo/credentials/src/state-machine/feed-state-machine.ts
 import { invariant as invariant3 } from "@dxos/invariant";
-import { PublicKey as PublicKey4 } from "@dxos/keys";
-import { Callback, ComplexMap as ComplexMap2 } from "@dxos/util";
+import { PublicKey as PublicKey3 } from "@dxos/keys";
+import { Callback, ComplexMap } from "@dxos/util";
 var __dxlog_file3 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
 var FeedStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._feeds = new ComplexMap2(PublicKey4.hash);
+    this._feeds = new ComplexMap(PublicKey3.hash);
     this.onFeedAdmitted = new Callback();
   }
   get feeds() {
@@ -683,13 +666,13 @@ var FeedStateMachine = class {
 };
 
 // packages/core/halo/credentials/src/state-machine/invitation-state-machine.ts
-import { PublicKey as PublicKey5 } from "@dxos/keys";
-import { Callback as Callback2, ComplexMap as ComplexMap3, ComplexSet } from "@dxos/util";
+import { PublicKey as PublicKey4 } from "@dxos/keys";
+import { Callback as Callback2, ComplexMap as ComplexMap2, ComplexSet } from "@dxos/util";
 var InvitationStateMachine = class {
   constructor() {
-    this._invitations = new ComplexMap3(PublicKey5.hash);
-    this._redeemedInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
-    this._cancelledInvitationCredentialIds = new ComplexSet(PublicKey5.hash);
+    this._invitations = new ComplexMap2(PublicKey4.hash);
+    this._redeemedInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
+    this._cancelledInvitationCredentialIds = new ComplexSet(PublicKey4.hash);
     this.onDelegatedInvitation = new Callback2();
     this.onDelegatedInvitationRemoved = new Callback2();
   }
@@ -754,16 +737,16 @@ var InvitationStateMachine = class {
 
 // packages/core/halo/credentials/src/state-machine/member-state-machine.ts
 import { invariant as invariant5 } from "@dxos/invariant";
-import { PublicKey as PublicKey7 } from "@dxos/keys";
+import { PublicKey as PublicKey6 } from "@dxos/keys";
 import { log as log2 } from "@dxos/log";
 import { SpaceMember as SpaceMember2 } from "@dxos/protocols/proto/dxos/halo/credentials";
-import { ComplexMap as ComplexMap5 } from "@dxos/util";
+import { ComplexMap as ComplexMap4 } from "@dxos/util";
 
 // packages/core/halo/credentials/src/graph/credential-graph.ts
 import { invariant as invariant4 } from "@dxos/invariant";
-import { PublicKey as PublicKey6 } from "@dxos/keys";
+import { PublicKey as PublicKey5 } from "@dxos/keys";
 import { log } from "@dxos/log";
-import { Callback as Callback3, ComplexMap as ComplexMap4, ComplexSet as ComplexSet2 } from "@dxos/util";
+import { Callback as Callback3, ComplexMap as ComplexMap3, ComplexSet as ComplexSet2 } from "@dxos/util";
 var __dxlog_file4 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
 var CredentialGraph = class {
   constructor(_stateHandler) {
@@ -779,9 +762,9 @@ var CredentialGraph = class {
       parents: [],
       children: []
     };
-    this._vertexByCredentialId = new ComplexMap4(PublicKey6.hash);
-    this._subjectToVertex = new ComplexMap4(PublicKey6.hash);
-    this._subjectToState = new ComplexMap4(PublicKey6.hash);
+    this._vertexByCredentialId = new ComplexMap3(PublicKey5.hash);
+    this._subjectToVertex = new ComplexMap3(PublicKey5.hash);
+    this._subjectToState = new ComplexMap3(PublicKey5.hash);
     this.onSubjectStateChanged = new Callback3();
   }
   getSubjectState(subjectId) {
@@ -948,7 +931,7 @@ var CredentialGraph = class {
   }
   _replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
     paths.push(...mergeResult.replay.map((path) => {
-      const stateOverrides = path.stateOverrides ?? new ComplexMap4(PublicKey6.hash);
+      const stateOverrides = path.stateOverrides ?? new ComplexMap3(PublicKey5.hash);
       mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
       return {
         ...mergeResult.from,
@@ -1040,12 +1023,12 @@ var CredentialGraph = class {
           ]
         },
         head: choice,
-        credentials: new ComplexSet2(PublicKey6.hash, path.credentials),
-        state: new ComplexMap4(PublicKey6.hash, [
+        credentials: new ComplexSet2(PublicKey5.hash, path.credentials),
+        state: new ComplexMap3(PublicKey5.hash, [
           ...path.state.entries()
         ]),
-        forkIssuers: new ComplexSet2(PublicKey6.hash),
-        forkChangedSubjects: new ComplexSet2(PublicKey6.hash),
+        forkIssuers: new ComplexSet2(PublicKey5.hash),
+        forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
         stateOverrides: path.stateOverrides
       };
       paths.push(fork);
@@ -1057,8 +1040,8 @@ var CredentialGraph = class {
   */
   _setCurrentState(path) {
     const changedSubjects = [];
-    const newStateMap = new ComplexMap4(PublicKey6.hash);
-    const newVertexMap = new ComplexMap4(PublicKey6.hash);
+    const newStateMap = new ComplexMap3(PublicKey5.hash);
+    const newVertexMap = new ComplexMap3(PublicKey5.hash);
     for (const [subjectKey, subjectVertex] of path.state.entries()) {
       const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
       const prevState = this._subjectToState.get(subjectKey);
@@ -1166,13 +1149,13 @@ var CredentialGraph = class {
         [forkPoint.head.id]: []
       },
       stateOverrides: forkPoint.stateOverrides,
-      credentials: new ComplexSet2(PublicKey6.hash, forkPoint.credentials),
-      forkIssuers: new ComplexSet2(PublicKey6.hash, forkPoint.forkIssuers),
-      forkChangedSubjects: new ComplexSet2(PublicKey6.hash, forkPoint.forkChangedSubjects),
+      credentials: new ComplexSet2(PublicKey5.hash, forkPoint.credentials),
+      forkIssuers: new ComplexSet2(PublicKey5.hash, forkPoint.forkIssuers),
+      forkChangedSubjects: new ComplexSet2(PublicKey5.hash, forkPoint.forkChangedSubjects),
       state: forkPoint.state.mapValues((v) => v),
       head: paths[0].head
     };
-    const subjectToBranch = new ComplexMap4(PublicKey6.hash);
+    const subjectToBranch = new ComplexMap3(PublicKey5.hash);
     for (const path of paths) {
       log("processing a path", () => ({
         choices: toChosenPath(path),
@@ -1300,10 +1283,10 @@ var CredentialGraph = class {
     return {
       head: this._root,
       chosenPath: {},
-      forkIssuers: new ComplexSet2(PublicKey6.hash),
-      forkChangedSubjects: new ComplexSet2(PublicKey6.hash),
-      state: new ComplexMap4(PublicKey6.hash),
-      credentials: new ComplexSet2(PublicKey6.hash)
+      forkIssuers: new ComplexSet2(PublicKey5.hash),
+      forkChangedSubjects: new ComplexSet2(PublicKey5.hash),
+      state: new ComplexMap3(PublicKey5.hash),
+      credentials: new ComplexSet2(PublicKey5.hash)
     };
   }
 };
@@ -1319,7 +1302,7 @@ var __dxlog_file5 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/
 var MemberStateMachine = class {
   constructor(_spaceKey) {
     this._spaceKey = _spaceKey;
-    this._memberProfiles = new ComplexMap5(PublicKey7.hash);
+    this._memberProfiles = new ComplexMap4(PublicKey6.hash);
     this._hashgraph = new CredentialGraph(this);
     this.onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
   }
@@ -1461,12 +1444,6 @@ var MemberStateMachine = class {
 };
 
 // packages/core/halo/credentials/src/state-machine/space-state-machine.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
 var __dxlog_file6 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
 var SpaceStateMachine = class {
   constructor(_spaceKey) {
@@ -1475,8 +1452,8 @@ var SpaceStateMachine = class {
     this._feeds = new FeedStateMachine(this._spaceKey);
     this._invitations = new InvitationStateMachine();
     this._credentials = [];
-    this._credentialsById = new ComplexMap6(PublicKey8.hash);
-    this._processedCredentials = new ComplexSet3(PublicKey8.hash);
+    this._credentialsById = new ComplexMap5(PublicKey7.hash);
+    this._processedCredentials = new ComplexSet3(PublicKey7.hash);
     this._credentialProcessors = [];
     this.onCredentialProcessed = new Callback4();
     this.onMemberRoleChanged = this._members.onMemberRoleChanged;
@@ -1533,20 +1510,18 @@ var SpaceStateMachine = class {
   /**
   * @param credential Message to process.
   * @param fromFeed Key of the feed where this credential is recorded.
+  * @synchronized
   */
   async process(credential, { sourceFeed, skipVerification }) {
-    if (credential.id) {
-      if (this._processedCredentials.has(credential.id)) {
-        return true;
-      }
-      this._processedCredentials.add(credential.id);
+    if (credential.id && this._processedCredentials.has(credential.id)) {
+      return true;
     }
     if (!skipVerification) {
       const result = await verifyCredential(credential);
       if (result.kind !== "pass") {
         log3.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
           F: __dxlog_file6,
-          L: 156,
+          L: 153,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1559,7 +1534,7 @@ var SpaceStateMachine = class {
         if (this._genesisCredential) {
           log3.warn("Space already has a genesis credential.", void 0, {
             F: __dxlog_file6,
-            L: 165,
+            L: 162,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1568,7 +1543,7 @@ var SpaceStateMachine = class {
         if (!credential.issuer.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued by space.", void 0, {
             F: __dxlog_file6,
-            L: 169,
+            L: 166,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1577,7 +1552,7 @@ var SpaceStateMachine = class {
         if (!credential.subject.id.equals(this._spaceKey)) {
           log3.warn("Space genesis credential must be issued to space.", void 0, {
             F: __dxlog_file6,
-            L: 173,
+            L: 170,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1593,7 +1568,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 186,
+            L: 183,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1602,7 +1577,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 190,
+            L: 187,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1616,7 +1591,7 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before adding members.", void 0, {
             F: __dxlog_file6,
-            L: 201,
+            L: 198,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1629,7 +1604,19 @@ var SpaceStateMachine = class {
         if (!this._genesisCredential) {
           log3.warn("Space must have a genesis credential before admitting feeds.", void 0, {
             F: __dxlog_file6,
-            L: 211,
+            L: 208,
+            S: this,
+            C: (f, a) => f(...a)
+          });
+          return false;
+        }
+        if (!this._canAdmitFeeds(credential.issuer)) {
+          log3.warn(`Space member is not authorized to admit feeds: ${credential.issuer}`, {
+            sourceFeed: sourceFeed.toHex(),
+            feed: credential.subject.id.toHex()
+          }, {
+            F: __dxlog_file6,
+            L: 212,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1643,7 +1630,7 @@ var SpaceStateMachine = class {
         if (!this._canInviteNewMembers(credential.issuer)) {
           log3.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
             F: __dxlog_file6,
-            L: 222,
+            L: 226,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1668,6 +1655,9 @@ var SpaceStateMachine = class {
       }
     }
     await this.onCredentialProcessed.callIfSet(credential);
+    if (credential.id) {
+      this._processedCredentials.add(credential.id);
+    }
     return true;
   }
   getMemberRole(memberKey) {
@@ -1679,10 +1669,11 @@ var SpaceStateMachine = class {
   _canInviteNewMembers(key) {
     return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember3.Role.ADMIN || this._members.getRole(key) === SpaceMember3.Role.OWNER;
   }
+  _canAdmitFeeds(key) {
+    const role = this._members.getRole(key);
+    return role === SpaceMember3.Role.EDITOR || role === SpaceMember3.Role.ADMIN || role === SpaceMember3.Role.OWNER;
+  }
 };
-_ts_decorate([
-  synchronized
-], SpaceStateMachine.prototype, "process", null);
 var CredentialConsumer = class {
   constructor(processor, _onOpen, _onClose) {
     this.processor = processor;
@@ -1690,7 +1681,7 @@ var CredentialConsumer = class {
     this._onClose = _onClose;
     this._ctx = new Context(void 0, {
       F: __dxlog_file6,
-      L: 267
+      L: 280
     });
     this._isReadyForLiveCredentials = false;
   }
@@ -1717,14 +1708,14 @@ var CredentialConsumer = class {
 // packages/core/halo/credentials/src/processor/device-state-machine.ts
 import { Trigger } from "@dxos/async";
 import { invariant as invariant6 } from "@dxos/invariant";
-import { PublicKey as PublicKey9 } from "@dxos/keys";
+import { PublicKey as PublicKey8 } from "@dxos/keys";
 import { log as log4 } from "@dxos/log";
-import { ComplexMap as ComplexMap7 } from "@dxos/util";
+import { ComplexMap as ComplexMap6 } from "@dxos/util";
 var __dxlog_file7 = "/home/runner/work/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
 var DeviceStateMachine = class {
   constructor(_params) {
     this._params = _params;
-    this.authorizedDeviceKeys = new ComplexMap7(PublicKey9.hash);
+    this.authorizedDeviceKeys = new ComplexMap6(PublicKey8.hash);
     this.deviceChainReady = new Trigger();
   }
   async processCredential(credential) {
@@ -1747,6 +1738,15 @@ var DeviceStateMachine = class {
     const assertion = getCredentialAssertion(credential);
     switch (assertion["@type"]) {
       case "dxos.halo.credentials.AuthorizedDevice": {
+        invariant6(!this.authorizedDeviceKeys.has(assertion.deviceKey), "Device already added.", {
+          F: __dxlog_file7,
+          L: 51,
+          S: this,
+          A: [
+            "!this.authorizedDeviceKeys.has(assertion.deviceKey)",
+            "'Device already added.'"
+          ]
+        });
         this.authorizedDeviceKeys.set(assertion.deviceKey, {});
         log4("added device", {
           localDeviceKey: this._params.deviceKey,
@@ -1754,7 +1754,7 @@ var DeviceStateMachine = class {
           size: this.authorizedDeviceKeys.size
         }, {
           F: __dxlog_file7,
-          L: 55,
+          L: 54,
           S: this,
           C: (f, a) => f(...a)
         });
@@ -1764,7 +1764,7 @@ var DeviceStateMachine = class {
       case "dxos.halo.credentials.DeviceProfile": {
         invariant6(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
           F: __dxlog_file7,
-          L: 65,
+          L: 64,
           S: this,
           A: [
             "this.authorizedDeviceKeys.has(credential.subject.id)",
@@ -1777,7 +1777,7 @@ var DeviceStateMachine = class {
             profile: assertion.profile
           }, {
             F: __dxlog_file7,
-            L: 68,
+            L: 67,
             S: this,
             C: (f, a) => f(...a)
           });
@@ -1848,7 +1848,6 @@ export {
   createCredentialSignerWithKey,
   createDelegatedSpaceInvitationCredential,
   createDeviceAuthorization,
-  createDidFromIdentityKey,
   credentialTypeFilter,
   defaultSecretProvider,
   defaultSecretValidator,