@dxos/credentials 0.8.4-main.bc674ce → 0.8.4-main.bcb3aa67d6

package/docs/README.md

@@ -84,20 +84,20 @@ dxos/mesh-protocol --> dxos/codec-protobuf
 
 ## Dependencies
 
-| Module | Direct |
-|---|---|
-| [`@dxos/async`](../../../../common/async/docs/README.md) | ✓ |
-| [`@dxos/codec-protobuf`](../../../../common/codec-protobuf/docs/README.md) | ✓ |
-| [`@dxos/context`](../../../../common/context/docs/README.md) |  |
-| [`@dxos/crypto`](../../../../common/crypto/docs/README.md) | ✓ |
-| [`@dxos/debug`](../../../../common/debug/docs/README.md) | ✓ |
-| [`@dxos/feed-store`](../../../../common/feed-store/docs/README.md) | ✓ |
-| [`@dxos/hypercore`](../../../../common/hypercore/docs/README.md) |  |
-| [`@dxos/keyring`](../../keyring/docs/README.md) | ✓ |
-| [`@dxos/keys`](../../../../common/keys/docs/README.md) | ✓ |
-| [`@dxos/log`](../../../../common/log/docs/README.md) | ✓ |
-| [`@dxos/mesh-protocol`](../../../mesh/mesh-protocol/docs/README.md) | ✓ |
-| [`@dxos/protocols`](../../../protocols/docs/README.md) | ✓ |
-| [`@dxos/random-access-storage`](../../../../common/random-access-storage/docs/README.md) |  |
-| [`@dxos/timeframe`](../../../../common/timeframe/docs/README.md) |  |
-| [`@dxos/util`](../../../../common/util/docs/README.md) | ✓ |
+| Module                                                                                   | Direct  |
+| ---------------------------------------------------------------------------------------- | ------- |
+| [`@dxos/async`](../../../../common/async/docs/README.md)                                 | ✓ |
+| [`@dxos/codec-protobuf`](../../../../common/codec-protobuf/docs/README.md)               | ✓ |
+| [`@dxos/context`](../../../../common/context/docs/README.md)                             |         |
+| [`@dxos/crypto`](../../../../common/crypto/docs/README.md)                               | ✓ |
+| [`@dxos/debug`](../../../../common/debug/docs/README.md)                                 | ✓ |
+| [`@dxos/feed-store`](../../../../common/feed-store/docs/README.md)                       | ✓ |
+| [`@dxos/hypercore`](../../../../common/hypercore/docs/README.md)                         |         |
+| [`@dxos/keyring`](../../keyring/docs/README.md)                                          | ✓ |
+| [`@dxos/keys`](../../../../common/keys/docs/README.md)                                   | ✓ |
+| [`@dxos/log`](../../../../common/log/docs/README.md)                                     | ✓ |
+| [`@dxos/mesh-protocol`](../../../mesh/mesh-protocol/docs/README.md)                      | ✓ |
+| [`@dxos/protocols`](../../../protocols/docs/README.md)                                   | ✓ |
+| [`@dxos/random-access-storage`](../../../../common/random-access-storage/docs/README.md) |         |
+| [`@dxos/timeframe`](../../../../common/timeframe/docs/README.md)                         |         |
+| [`@dxos/util`](../../../../common/util/docs/README.md)                                   | ✓ |

package/moon.yml

@@ -1,4 +1,4 @@
-type: library
+layer: library
 language: typescript
 tags:
   - ts-build
@@ -9,3 +9,4 @@ tasks:
     args:
       - '--entryPoint=src/index.ts'
       - '--injectGlobals'
+      - '--platform=neutral'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dxos/credentials",
-  "version": "0.8.4-main.bc674ce",
+  "version": "0.8.4-main.bcb3aa67d6",
   "description": "DXOS Credentials",
   "homepage": "https://github.com/dxos/dxos/tree/main/packages/core/halo/credentials#readme",
   "bugs": "https://github.com/dxos/dxos/issues",
@@ -16,8 +16,7 @@
     ".": {
       "source": "./src/index.ts",
       "types": "./dist/types/src/index.d.ts",
-      "browser": "./dist/lib/browser/index.mjs",
-      "node": "./dist/lib/node-esm/index.mjs"
+      "default": "./dist/lib/neutral/index.mjs"
     }
   },
   "types": "dist/types/src/index.d.ts",
@@ -27,17 +26,17 @@
   "dependencies": {
     "bip39": "^3.1.0",
     "json-stable-stringify": "^1.3.0",
-    "@dxos/async": "0.8.4-main.bc674ce",
-    "@dxos/context": "0.8.4-main.bc674ce",
-    "@dxos/crypto": "0.8.4-main.bc674ce",
-    "@dxos/invariant": "0.8.4-main.bc674ce",
-    "@dxos/keys": "0.8.4-main.bc674ce",
-    "@dxos/log": "0.8.4-main.bc674ce",
-    "@dxos/keyring": "0.8.4-main.bc674ce",
-    "@dxos/node-std": "0.8.4-main.bc674ce",
-    "@dxos/timeframe": "0.8.4-main.bc674ce",
-    "@dxos/util": "0.8.4-main.bc674ce",
-    "@dxos/protocols": "0.8.4-main.bc674ce"
+    "@dxos/context": "0.8.4-main.bcb3aa67d6",
+    "@dxos/async": "0.8.4-main.bcb3aa67d6",
+    "@dxos/crypto": "0.8.4-main.bcb3aa67d6",
+    "@dxos/invariant": "0.8.4-main.bcb3aa67d6",
+    "@dxos/keyring": "0.8.4-main.bcb3aa67d6",
+    "@dxos/keys": "0.8.4-main.bcb3aa67d6",
+    "@dxos/log": "0.8.4-main.bcb3aa67d6",
+    "@dxos/protocols": "0.8.4-main.bcb3aa67d6",
+    "@dxos/node-std": "0.8.4-main.bcb3aa67d6",
+    "@dxos/timeframe": "0.8.4-main.bcb3aa67d6",
+    "@dxos/util": "0.8.4-main.bcb3aa67d6"
   },
   "publishConfig": {
     "access": "public"

package/src/credentials/credential-generator.ts

@@ -10,6 +10,7 @@ import {
   AdmittedFeed,
   type Credential,
   type DeviceProfileDocument,
+  MembershipPolicy,
   type ProfileDocument,
   SpaceMember,
 } from '@dxos/protocols/proto/dxos/halo/credentials';
@@ -38,6 +39,7 @@ export class CredentialGenerator {
     spaceKey: PublicKey,
     controlKey: PublicKey,
     creatorProfile?: ProfileDocument,
+    membershipPolicy: MembershipPolicy = MembershipPolicy.INVITE,
   ): Promise<Credential[]> {
     return [
       await createCredential({
@@ -47,6 +49,7 @@ export class CredentialGenerator {
         assertion: {
           '@type': 'dxos.halo.credentials.SpaceGenesis',
           spaceKey,
+          membershipPolicy,
         },
       }),
 
@@ -221,6 +224,7 @@ export const createAdmissionCredentials = async (
   membershipChainHeads: PublicKey[] = [],
   profile?: ProfileDocument,
   invitationCredentialId?: PublicKey,
+  tags?: string[],
 ): Promise<FeedMessage.Payload[]> => {
   const credentials = await Promise.all([
     await signer.createCredential({
@@ -233,6 +237,7 @@ export const createAdmissionCredentials = async (
         profile,
         genesisFeedKey,
         invitationCredentialId,
+        tags: tags ?? [],
       },
     }),
   ]);

package/src/credentials/signing.ts

@@ -27,6 +27,18 @@ export const getCredentialProofPayload = (credential: Credential): Uint8Array =>
   }
   delete copy.id; // ID is not part of the signature payload.
 
+  // Normalize empty repeated fields in the assertion to avoid proto3 serialization asymmetry.
+  // Proto3 does not encode empty repeated fields, but the codec may restore them as [] after deserialization,
+  // causing a signature mismatch if the original signing payload did not include the field.
+  const assertion = (copy.subject as any)?.assertion;
+  if (assertion) {
+    for (const key of Object.keys(assertion)) {
+      if (Array.isArray(assertion[key]) && assertion[key].length === 0) {
+        delete assertion[key];
+      }
+    }
+  }
+
   return Buffer.from(canonicalStringify(copy));
 };
 

package/src/state-machine/space-state-machine.test.ts

@@ -6,7 +6,7 @@ import { describe, expect, test } from 'vitest';
 
 import { Keyring } from '@dxos/keyring';
 import { type PublicKey } from '@dxos/keys';
-import { AdmittedFeed, type Chain, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { AdmittedFeed, type Chain, MembershipPolicy, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 
 import { createCredential, verifyCredential } from '../credentials';
 
@@ -30,6 +30,7 @@ describe('SpaceStateMachine', () => {
           assertion: {
             '@type': 'dxos.halo.credentials.SpaceGenesis',
             spaceKey: space,
+            membershipPolicy: MembershipPolicy.INVITE,
           },
           signer: keyring,
         }),
@@ -130,6 +131,7 @@ describe('SpaceStateMachine', () => {
           assertion: {
             '@type': 'dxos.halo.credentials.SpaceGenesis',
             spaceKey: space,
+            membershipPolicy: MembershipPolicy.INVITE,
           },
           signer: keyring,
         }),
@@ -211,6 +213,60 @@ describe('SpaceStateMachine', () => {
     expect(spaceState.credentials).toHaveLength(3);
   });
 
+  test('space genesis with tags', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const identity = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    expect(spaceState.tags).toEqual([]);
+
+    expect(
+      await spaceState.process(
+        await createCredential({
+          issuer: space,
+          subject: space,
+          assertion: {
+            '@type': 'dxos.halo.credentials.SpaceGenesis',
+            spaceKey: space,
+            tags: ['personal', 'test'],
+            membershipPolicy: MembershipPolicy.INVITE,
+          },
+          signer: keyring,
+        }),
+        { sourceFeed: feed },
+      ),
+    ).toEqual(true);
+
+    expect(spaceState.tags).toEqual(['personal', 'test']);
+  });
+
+  test('space genesis without tags returns empty array', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.INVITE,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    expect(spaceState.tags).toEqual([]);
+  });
+
   test('storing device credentials and building a chain', async () => {
     const keyring = new Keyring();
     const haloSpace = await keyring.createKey();
@@ -230,6 +286,7 @@ describe('SpaceStateMachine', () => {
           assertion: {
             '@type': 'dxos.halo.credentials.SpaceGenesis',
             spaceKey: haloSpace,
+            membershipPolicy: MembershipPolicy.INVITE,
           },
           signer: keyring,
         }),
@@ -339,4 +396,189 @@ describe('SpaceStateMachine', () => {
 
     expect(await verifyCredential(credential)).toEqual({ kind: 'pass' });
   });
+
+  test('space genesis with membership policy', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.LOCKED,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    expect(spaceState.membershipPolicy).toEqual(MembershipPolicy.LOCKED);
+  });
+
+  test('space genesis without membership policy defaults to INVITE', async () => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    // MembershipPolicy.INVITE is the proto zero-value default.
+    // Existing spaces without the field will have this value.
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.INVITE,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    expect(spaceState.membershipPolicy).toEqual(MembershipPolicy.INVITE);
+  });
+
+  test('locked space rejects new members', async ({ expect }) => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const identity = await keyring.createKey();
+    const identity2 = await keyring.createKey();
+    const feed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.LOCKED,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: identity,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceMember',
+          spaceKey: space,
+          role: SpaceMember.Role.OWNER,
+          genesisFeedKey: feed,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    // Attempt to add a second member — should be rejected.
+    expect(
+      await spaceState.process(
+        await createCredential({
+          issuer: space,
+          subject: identity2,
+          assertion: {
+            '@type': 'dxos.halo.credentials.SpaceMember',
+            spaceKey: space,
+            role: SpaceMember.Role.EDITOR,
+            genesisFeedKey: feed,
+          },
+          signer: keyring,
+        }),
+        { sourceFeed: feed },
+      ),
+    ).toEqual(false);
+
+    expect(spaceState.members.size).toEqual(1);
+  });
+
+  test('locked space allows admitted feeds for existing members', async ({ expect }) => {
+    const keyring = new Keyring();
+    const space = await keyring.createKey();
+    const identity = await keyring.createKey();
+    const device = await keyring.createKey();
+    const feed = await keyring.createKey();
+    const newFeed = await keyring.createKey();
+
+    const spaceState = new SpaceStateMachine(space);
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: space,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceGenesis',
+          spaceKey: space,
+          membershipPolicy: MembershipPolicy.LOCKED,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    await spaceState.process(
+      await createCredential({
+        issuer: space,
+        subject: identity,
+        assertion: {
+          '@type': 'dxos.halo.credentials.SpaceMember',
+          spaceKey: space,
+          role: SpaceMember.Role.OWNER,
+          genesisFeedKey: feed,
+        },
+        signer: keyring,
+      }),
+      { sourceFeed: feed },
+    );
+
+    const chain: Chain = {
+      credential: await createCredential({
+        assertion: {
+          '@type': 'dxos.halo.credentials.AuthorizedDevice',
+          deviceKey: device,
+          identityKey: identity,
+        },
+        subject: device,
+        issuer: identity,
+        signer: keyring,
+      }),
+    };
+
+    // AdmittedFeed should still work on locked space.
+    expect(
+      await spaceState.process(
+        await createCredential({
+          issuer: identity,
+          subject: newFeed,
+          assertion: {
+            '@type': 'dxos.halo.credentials.AdmittedFeed',
+            spaceKey: space,
+            identityKey: identity,
+            deviceKey: device,
+            designation: AdmittedFeed.Designation.CONTROL,
+          },
+          signer: keyring,
+          signingKey: device,
+          chain,
+        }),
+        { sourceFeed: feed },
+      ),
+    ).toEqual(true);
+
+    expect(spaceState.feeds.size).toEqual(1);
+  });
 });

package/src/state-machine/space-state-machine.ts

@@ -7,7 +7,7 @@ import { Context } from '@dxos/context';
 import { PublicKey } from '@dxos/keys';
 import { log } from '@dxos/log';
 import { type TypedMessage } from '@dxos/protocols/proto';
-import { type Credential, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
+import { type Credential, MembershipPolicy, SpaceMember } from '@dxos/protocols/proto/dxos/halo/credentials';
 import { type DelegateSpaceInvitation } from '@dxos/protocols/proto/dxos/halo/invitations';
 import { type AsyncCallback, Callback, ComplexMap, ComplexSet } from '@dxos/util';
 
@@ -24,6 +24,8 @@ export interface SpaceState {
   readonly feeds: ReadonlyMap<PublicKey, FeedInfo>;
   readonly credentials: Credential[];
   readonly genesisCredential: Credential | undefined;
+  readonly tags: string[];
+  readonly membershipPolicy: MembershipPolicy;
   readonly creator: MemberInfo | undefined;
   readonly invitations: ReadonlyMap<PublicKey, DelegateSpaceInvitation>;
 
@@ -61,6 +63,8 @@ export class SpaceStateMachine implements SpaceState {
   private readonly _processedCredentials = new ComplexSet<PublicKey>(PublicKey.hash);
 
   private _genesisCredential: Credential | undefined;
+  private _tags: string[] = [];
+  private _membershipPolicy: MembershipPolicy = MembershipPolicy.INVITE;
   private _credentialProcessors: CredentialConsumer<any>[] = [];
 
   readonly onCredentialProcessed = new Callback<AsyncCallback<Credential>>();
@@ -104,6 +108,14 @@ export class SpaceStateMachine implements SpaceState {
     return this._genesisCredential;
   }
 
+  get tags(): string[] {
+    return this._tags;
+  }
+
+  get membershipPolicy(): MembershipPolicy {
+    return this._membershipPolicy;
+  }
+
   get invitations(): ReadonlyMap<PublicKey, DelegateSpaceInvitation> {
     return this._invitations.invitations;
   }
@@ -180,6 +192,8 @@ export class SpaceStateMachine implements SpaceState {
           return false;
         }
         this._genesisCredential = credential;
+        this._tags = assertion.tags ?? [];
+        this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy.INVITE;
         break;
       }
 
@@ -260,6 +274,11 @@ export class SpaceStateMachine implements SpaceState {
   }
 
   private _canInviteNewMembers(key: PublicKey): boolean {
+    if (this._membershipPolicy === MembershipPolicy.LOCKED) {
+      // When locked, only the space key can add the initial owner during genesis.
+      // Once a member exists, no new members can be added.
+      return key.equals(this._spaceKey) && this._members.members.size === 0;
+    }
     return (
       key.equals(this._spaceKey) ||
       this._members.getRole(key) === SpaceMember.Role.ADMIN ||