@dxos/credentials 2.33.1-dev.83d113fe → 2.33.1-dev.eb88db79

package/src/auth/auth.test.ts

@@ -0,0 +1,551 @@
+//
+// Copyright 2019 DXOS.org
+//
+
+// DXOS testing browser.
+
+import expect from 'expect';
+import moment from 'moment';
+
+import { PublicKey, randomBytes } from '@dxos/crypto';
+
+import { Filter, Keyring } from '../keys';
+import {
+  admitsKeys,
+  createEnvelopeMessage,
+  createFeedAdmitMessage,
+  createKeyAdmitMessage,
+  createPartyGenesisMessage,
+  PartyState
+} from '../party';
+import { codecLoop, KeyType, Message, SignedMessage } from '../proto';
+import { createAuthMessage } from './auth-message';
+import { PartyAuthenticator } from './authenticator';
+
+const createPartyKeyrings = async () => {
+  // This Keyring has the full key pairs, which is the case when creating a new Party.
+  const keyring = new Keyring();
+  for (const type of Object.values(KeyType)) {
+    if (typeof type === 'string') {
+      await keyring.createKeyRecord({ type: KeyType[type as any] });
+    }
+  }
+
+  const partyKey = keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!.publicKey;
+
+  /* This Keyring will have nothing but the public key of the Party. This mimics the initial state
+   * when joining a Party, since all that is known at that time know at that time is the public key.
+   */
+  const bareKeyring = new Keyring();
+  await bareKeyring.addPublicKey({
+    publicKey: partyKey,
+    type: KeyType.PARTY,
+    trusted: true,
+    own: false
+  });
+
+  return {
+    partyKey,
+    keyring,
+    bareKeyring
+  };
+};
+
+/* eslint-enable @typescript-eslint/no-unused-vars */
+const messageMap = (messages: (Message | SignedMessage)[]): Map<string, Message | SignedMessage> => {
+  const map = new Map();
+  for (const message of messages) {
+    const admits = admitsKeys(message);
+    for (const key of admits) {
+      map.set(key.toHex(), message);
+    }
+  }
+  return map;
+};
+
+const getIdentityKeyChainForDevice = (keyring: Keyring, devicePublicKey: PublicKey, messages: Map<string, Message | SignedMessage>) => {
+  // Excludes all the FEED keys.
+  return Keyring.buildKeyChain(devicePublicKey, messages,
+    keyring.findKeys(Filter.matches({ type: KeyType.FEED })).map(key => key.publicKey));
+};
+
+describe('PartyAuthenticator', () => {
+
+  it('Chain of Keys', async () => {
+    const haloKeyring = new Keyring();
+    const identityKey = await haloKeyring.createKeyRecord({ type: KeyType.PARTY });
+    const deviceKeyA = await haloKeyring.createKeyRecord({ type: KeyType.DEVICE });
+    const deviceKeyB = await haloKeyring.createKeyRecord({ type: KeyType.DEVICE });
+    const deviceKeyC = await haloKeyring.createKeyRecord({ type: KeyType.DEVICE });
+    const feedKeyA = await haloKeyring.createKeyRecord({ type: KeyType.FEED });
+
+    const messages = new Map();
+
+    // The first message in the chain in always a PartyGenesis for the Halo.
+    messages.set(identityKey.publicKey.toHex(), createPartyGenesisMessage(haloKeyring, identityKey, feedKeyA.publicKey, deviceKeyA));
+    messages.set(deviceKeyA.publicKey.toHex(), messages.get(identityKey.publicKey.toHex()));
+    messages.set(feedKeyA.publicKey.toHex(), messages.get(identityKey.publicKey.toHex()));
+
+    // Next is DeviceB greeted by DeviceA.
+    messages.set(deviceKeyB.publicKey.toHex(),
+      createEnvelopeMessage(haloKeyring, identityKey.publicKey,
+        createKeyAdmitMessage(haloKeyring, identityKey.publicKey, deviceKeyB, [deviceKeyB]),
+        [deviceKeyA]
+      ));
+
+    // Next is DeviceC greeted by DeviceB.
+    messages.set(deviceKeyC.publicKey.toHex(),
+      createEnvelopeMessage(haloKeyring, identityKey.publicKey,
+        createKeyAdmitMessage(haloKeyring, identityKey.publicKey, deviceKeyC, [deviceKeyC]),
+        [deviceKeyB]
+      ));
+
+    const targetKeyring = new Keyring();
+    await targetKeyring.addPublicKey({
+      publicKey: identityKey.publicKey,
+      type: KeyType.IDENTITY,
+      trusted: true,
+      own: false
+    });
+
+    for (const deviceKey of [deviceKeyA, deviceKeyB, deviceKeyC]) {
+      const emptyKeyring = new Keyring();
+      const chain = Keyring.buildKeyChain(deviceKey.publicKey, messages);
+      // In the target keyring, which only has the Identity, it should chase all the way back to the Identity.
+      expect(identityKey.publicKey).toEqual((await targetKeyring.findTrusted(chain))!.publicKey);
+      // And in the halo, which has all the keys, it should chase straight back to this key.
+      expect(deviceKey.publicKey).toEqual((await haloKeyring.findTrusted(chain))!.publicKey);
+      // And in an empty Keyring, we should not get anything.
+      expect(await emptyKeyring.findTrusted(chain)).toBeUndefined();
+    }
+  });
+
+  it('good direct', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    // Only add the Identity to the party keyring.
+    await party.processMessages(messages);
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        partyKey,
+      identityKeyRecord!,
+      identityKeyRecord!
+      )
+    );
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(true);
+  });
+
+  it('auth callback is called', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+
+    let called = false;
+    const auth = new PartyAuthenticator(party, async (msg) => {
+      called = true;
+    });
+
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }))!;
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    // Only add the Identity to the party keyring.
+    await party.processMessages(messages);
+
+    const newFeedKeyRecord = await keyring.createKeyRecord({ type: KeyType.FEED })!;
+    const feedAdmit = createFeedAdmitMessage(
+      keyring,
+      partyKey,
+      newFeedKeyRecord.publicKey
+    );
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        partyKey,
+        identityKeyRecord,
+        identityKeyRecord,
+        newFeedKeyRecord,
+        undefined,
+        feedAdmit
+      )
+    );
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(true);
+
+    expect(called).toEqual(true);
+  });
+
+  it('good chain', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+    const deviceKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.DEVICE }));
+    const secondDeviceKeyRecord = await keyring.createKeyRecord({ type: KeyType.DEVICE });
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    // Only add the Identity to the party keyring.
+    await party.processMessages(messages);
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        partyKey,
+      identityKeyRecord!,
+      getIdentityKeyChainForDevice(
+        keyring,
+        secondDeviceKeyRecord.publicKey,
+        messageMap([
+          ...messages,
+          createKeyAdmitMessage(keyring, partyKey, deviceKeyRecord!, [identityKeyRecord!]),
+          createKeyAdmitMessage(keyring, partyKey, secondDeviceKeyRecord, [deviceKeyRecord!])
+        ]
+        )
+      )
+      )
+    );
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(true);
+  });
+
+  it('bad chain', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+    const deviceKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.DEVICE }));
+    const secondDeviceKeyRecord = await keyring.createKeyRecord({ type: KeyType.DEVICE });
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    // Only add the Identity to the party keyring.
+    await party.processMessages(messages);
+
+    // A bad chain, it doesn't track back to the Identity.
+    const chain = getIdentityKeyChainForDevice(
+      keyring,
+      secondDeviceKeyRecord.publicKey,
+      messageMap([
+        ...messages,
+        createKeyAdmitMessage(keyring, partyKey, deviceKeyRecord!, [deviceKeyRecord!]),
+        createKeyAdmitMessage(keyring, partyKey, secondDeviceKeyRecord, [deviceKeyRecord!])
+      ]
+      )
+    );
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        partyKey,
+      identityKeyRecord!,
+      chain
+      )
+    );
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(false);
+  });
+
+  // TODO(dboreham): This test isn't discriminating errors because when I broke the code entirely it still passed.
+  it('wrong key', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+    const wrongKey = await keyring.createKeyRecord();
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }))!
+      )
+    ];
+    await party.processMessages(messages);
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        partyKey,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }))!,
+      wrongKey
+      )
+    );
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(false);
+  });
+
+  it('wrong party', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+    await party.processMessages(messages);
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        randomBytes(32),
+      identityKeyRecord!,
+      identityKeyRecord!
+      )
+    );
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(false);
+  });
+
+  it('missing deviceKey', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }))!
+      )
+    ];
+    await party.processMessages(messages);
+
+    const wrappedCredentials = {
+      '@type': 'dxos.credentials.Message',
+      payload:
+      keyring.sign({
+        '@type': 'dxos.credentials.auth.Auth',
+        partyKey,
+        identityKey: identityKeyRecord!.publicKey
+      }, [identityKeyRecord!])
+    };
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(false);
+  });
+
+  it('tampered message', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    await party.processMessages(messages);
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        partyKey,
+      identityKeyRecord!,
+      identityKeyRecord!
+      )
+    );
+
+    const before = await auth.authenticate(wrappedCredentials.payload);
+    expect(before).toBe(true);
+
+    wrappedCredentials.payload.signed.payload.deviceKey = randomBytes(32);
+
+    const after = await auth.authenticate(wrappedCredentials.payload);
+    expect(after).toBe(false);
+  });
+
+  it('tampered signature', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    await party.processMessages(messages);
+
+    const wrappedCredentials = codecLoop(
+      createAuthMessage(
+        keyring,
+        partyKey,
+      identityKeyRecord!,
+      identityKeyRecord!
+      )
+    );
+
+    const before = await auth.authenticate(wrappedCredentials.payload);
+    expect(before).toBe(true);
+
+    wrappedCredentials.payload.signatures[0].signature = randomBytes(64);
+
+    const after = await auth.authenticate(wrappedCredentials.payload);
+    expect(after).toBe(false);
+  });
+
+  it('signature too old', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+    const deviceKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.DEVICE }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    await party.processMessages(messages);
+
+    const wrappedCredentials = {
+      '@type': 'dxos.credentials.Message',
+      payload:
+      keyring.sign({
+        '@type': 'dxos.credentials.auth.Auth',
+        partyKey,
+        identityKey: identityKeyRecord!.publicKey,
+        deviceKey: deviceKeyRecord!.publicKey
+      },
+      [identityKeyRecord!],
+      undefined,
+      moment().subtract(2, 'days').format('YYYY-MM-DDTHH:mm:ssZ')
+      )
+    };
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(false);
+  });
+
+  it('signature too far in future', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+    const deviceKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.DEVICE }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    await party.processMessages(messages);
+
+    const wrappedCredentials = {
+      '@type': 'dxos.credentials.Message',
+      payload:
+      keyring.sign({
+        '@type': 'dxos.credentials.auth.Auth',
+        partyKey,
+        identityKey: identityKeyRecord!.publicKey,
+        deviceKey: deviceKeyRecord!.publicKey
+      },
+      [identityKeyRecord!],
+      undefined,
+      moment().add(2, 'days').format('YYYY-MM-DDTHH:mm:ssZ')
+      )
+    };
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(false);
+  });
+
+  it('signature date invalid', async () => {
+    const { keyring, partyKey } = await createPartyKeyrings();
+    const party = new PartyState(partyKey);
+    const auth = new PartyAuthenticator(party, async () => {});
+    const identityKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.IDENTITY }));
+    const deviceKeyRecord = keyring.findKey(Keyring.signingFilter({ type: KeyType.DEVICE }));
+
+    const messages = [
+      createPartyGenesisMessage(keyring,
+      keyring.findKey(Filter.matches({ type: KeyType.PARTY }))!,
+      keyring.findKey(Keyring.signingFilter({ type: KeyType.FEED }))!.publicKey,
+      identityKeyRecord!
+      )
+    ];
+
+    await party.processMessages(messages);
+
+    const wrappedCredentials = {
+      '@type': 'dxos.credentials.Message',
+      payload:
+      keyring.sign({
+        '@type': 'dxos.credentials.auth.Auth',
+        partyKey,
+        identityKey: identityKeyRecord!.publicKey,
+        deviceKey: deviceKeyRecord!.publicKey
+      },
+      [identityKeyRecord!],
+      undefined,
+      'INVALID'
+      )
+    };
+
+    const ok = await auth.authenticate(wrappedCredentials.payload);
+    expect(ok).toBe(false);
+  });
+
+});

package/src/auth/authenticator.ts

@@ -2,65 +2,44 @@
 // Copyright 2019 DXOS.org
 //
 
-import assert from 'assert';
 import debug from 'debug';
 import moment from 'moment';
 
 import { PublicKey } from '@dxos/crypto';
 
-import { Keyring } from '../keys';
 import { isSignedMessage, PartyState } from '../party';
-import { codec, KeyType, Message } from '../proto';
+import { Auth, SignedMessage } from '../proto';
 
 const log = debug('dxos:halo:auth');
 
 const MAX_AGE = 24 * 60 * 60; // One day.
 
 /**
- * Abstract base class for Authenticators.
+ * Interface for Authenticators.
  * Used by AuthPlugin for authenticating nodes during handshake.
  */
-// TODO(telackey): Explain here the intention behind the abstract base class:
+// TODO(telackey): Explain here the intention behind the interface:
 //  E.g., to have different authentication methods (besides the current PartyAuthenticator) for replication auth,
 //  or to use this base class everywhere auth is done in the project (not used in greeting at present, for example)?
-export abstract class Authenticator {
-  // TODO(dboreham): The following static methods:
-  //  temporary work around move encapsualtion breaking code from `data-client/partitions.js`.
-
-  static encodePayload (credentials: Message) {
-    return codec.encode(credentials);
-  }
-
-  static decodePayload (credentials: Buffer) {
-    return codec.decode(credentials);
-  }
-
+export interface Authenticator {
   /**
    * Return true if the credentials checkout, else false.
-   * @param credentials
-   * @returns {Promise<boolean>}
    */
-  async authenticate(credentials: any): Promise<boolean> { // eslint-disable-line
-    throw new Error('Not Implemented');
-  }
+  authenticate(credentials: SignedMessage): Promise<boolean>
 }
 
 /**
  * A Party-based Authenticator, which checks that the supplied credentials belong to a Party member.
  */
-export class PartyAuthenticator extends Authenticator {
-  _party: PartyState;
+export class PartyAuthenticator implements Authenticator {
 
   /**
    * Takes the target Party for checking admitted keys and verifying signatures.
-   * @param party
    */
-  constructor (party: PartyState) {
-    assert(party);
-    super();
-
-    this._party = party;
-  }
+  constructor (
+    private readonly _party: PartyState,
+    private readonly _onAuthenticated?: (auth: Auth) => Promise<void>
+  ) {}
 
   /**
    * Authenticate the credentials presented during handshake. The signature on the credentials must be valid and belong
@@ -70,14 +49,14 @@ export class PartyAuthenticator extends Authenticator {
    */
   // TODO(dboreham): Verify that credentials is a message of type `dxos.credentials.SignedMessage`
   //  signing a message of type `dxos.credentials.auth.Auth`.
-  override async authenticate (credentials: any) {
+  async authenticate (credentials: SignedMessage): Promise<boolean> {
     if (!credentials || !isSignedMessage(credentials)) {
       log('Bad credentials:', credentials);
       return false;
     }
 
-    const { created, payload } = credentials.signed || {};
-    const { deviceKey, identityKey, partyKey, feedKey } = payload || {};
+    const { created, payload: auth = {} } = credentials.signed || {};
+    const { deviceKey, identityKey, partyKey } = auth;
     if (!created || !PublicKey.isPublicKey(deviceKey) || !PublicKey.isPublicKey(identityKey) || !PublicKey.isPublicKey(partyKey)) {
       log('Bad credentials:', credentials);
       return false;
@@ -109,14 +88,14 @@ export class PartyAuthenticator extends Authenticator {
 
     const verified = this._party.verifySignatures(credentials);
 
-    // TODO(telackey): Find a better place to do this, since doing it here could be considered a side-effect.
-    if (verified &&
-      PublicKey.isPublicKey(feedKey) &&
-      Keyring.signingKeys(credentials, { deep: false, validate: false }).find(key => key.equals(feedKey)) &&
-      !this._party.memberFeeds.find(partyFeed => partyFeed.equals(feedKey))) {
-      log(`Auto-hinting feedKey: ${feedKey.toHex()} for Device ` +
-        `${deviceKey.toHex()} on Identity ${identityKey.toHex()}`);
-      await this._party.takeHints([{ publicKey: feedKey, type: KeyType.FEED }]);
+    if (
+      verified
+      // feedAdmit &&
+      // PublicKey.isPublicKey(feedKey) &&
+      // !this._party.memberFeeds.find(partyFeed => partyFeed.equals(feedKey))
+    ) {
+      log(`Member authenticated: deviceKey=${deviceKey}, identityKey=${identityKey}`);
+      await this._onAuthenticated?.(auth);
     }
 
     return verified;

package/src/greet/greeter-plugin.test.ts

@@ -123,7 +123,7 @@ it('Greeting Flow using GreetingCommandPlugin', async () => {
   // Present the invitation (by showing up).
   {
     const command = {
-      __type_url: 'dxos.credentials.greet.Command',
+      '@type': 'dxos.credentials.greet.Command',
       command: Command.Type.BEGIN
     };
 
@@ -133,7 +133,7 @@ it('Greeting Flow using GreetingCommandPlugin', async () => {
   // Obtain the nonce and partyKey from the HANDSHAKE response.
   const { nonce, partyKey } = await (async () => {
     const command = {
-      __type_url: 'dxos.credentials.greet.Command',
+      '@type': 'dxos.credentials.greet.Command',
       command: Command.Type.HANDSHAKE,
       secret: await secretProvider(),
       params: []
@@ -149,7 +149,7 @@ it('Greeting Flow using GreetingCommandPlugin', async () => {
     const identityKey = await keyring.createKeyRecord({ type: KeyType.IDENTITY });
 
     const command = {
-      __type_url: 'dxos.credentials.greet.Command',
+      '@type': 'dxos.credentials.greet.Command',
       command: Command.Type.NOTARIZE,
       secret: await secretProvider(),
       params: [
@@ -173,7 +173,7 @@ it('Greeting Flow using GreetingCommandPlugin', async () => {
 
   const oneway = true;
   await plugin.send(rendezvousKey, {
-    __type_url: 'dxos.credentials.greet.Command',
+    '@type': 'dxos.credentials.greet.Command',
     command: Command.Type.FINISH,
     secret: await secretProvider(),
     params: []