@ibgib/web-gib 0.0.60 → 0.0.61

package/dist/ui/component/identity/keystone-details/keystone-details.mjs

@@ -15,7 +15,9 @@ import { parseSpaceIb } from "@ibgib/core-gib/dist/witness/space/space-helper.mj
 import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
 import { promptForSecret } from "../../../../helpers.web.mjs";
-import { isSsoProviderLinked } from "../../../../identity/sso/sso-helpers.mjs";
+import { isSsoProviderLinked, getKeystoneCapabilities, isDelegateExpired } from "@ibgib/core-gib/dist/keystone/delegate/delegate-helpers.mjs";
+import { generatePoolChallenges } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
+import { POOL_ID_MANAGE } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../../../../helpers.mjs";
 const logalot = false;
 export const KEYSTONE_DETAILS_COMPONENT_NAME = 'ibgib-keystone-details';
@@ -51,6 +53,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
     isHistoricalFrame = false;
     _onIdentityChanged = null;
     keystoneCache = new Map();
+    aggregatedDetails;
     constructor() {
         super();
     }
@@ -394,21 +397,36 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             this.elements.btnSetActiveEl.disabled = isTimelineActive;
             this.elements.btnLinkGoogleEl.classList.remove('disabled');
             this.elements.btnLinkGithubEl.classList.remove('disabled');
-            // Check if already linked
-            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'google' });
-            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId: 'github' });
+            // Check if origin provider or linked
+            const originProvider = this.aggregatedDetails?.custodianProvider || this.ibGib?.data?.frameDetails?.custodianProvider;
+            const isGoogleLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'google' });
+            const isGithubLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId: 'github' });
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
             // Google Card States
             const googleCard = this.elements.btnLinkGoogleEl;
             const googleLabel = googleCard.querySelector('.toggle-state-text');
             if (isGoogleLinked) {
                 googleCard.classList.remove('unlinked');
                 googleCard.classList.add('linked');
-                googleLabel.textContent = "Google Linked ✅";
+                const isOrigin = originProvider === 'google';
+                if (isOrigin && !caps.isSovereign) {
+                    googleLabel.textContent = "Google (Primary Account) 🔒";
+                    googleCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                }
+                else if (isOrigin) {
+                    googleLabel.textContent = "Google (Primary Account) ✅";
+                    googleCard.title = "Click to unlink Google provider (requires Master Password).";
+                }
+                else {
+                    googleLabel.textContent = "Google Linked ✅";
+                    googleCard.title = "Click to unlink Google provider.";
+                }
             }
             else {
                 googleCard.classList.remove('linked');
                 googleCard.classList.add('unlinked');
                 googleLabel.textContent = "Unlinked";
+                googleCard.title = "Click to link Google account.";
             }
             // GitHub Card States
             const githubCard = this.elements.btnLinkGithubEl;
@@ -416,15 +434,56 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             if (isGithubLinked) {
                 githubCard.classList.remove('unlinked');
                 githubCard.classList.add('linked');
-                githubLabel.textContent = "GitHub Linked ✅";
+                const isOrigin = originProvider === 'github';
+                if (isOrigin && !caps.isSovereign) {
+                    githubLabel.textContent = "GitHub (Primary Account) 🔒";
+                    githubCard.title = "Cannot unlink primary account without first adding a Master Password below.";
+                }
+                else if (isOrigin) {
+                    githubLabel.textContent = "GitHub (Primary Account) ✅";
+                    githubCard.title = "Click to unlink GitHub provider (requires Master Password).";
+                }
+                else {
+                    githubLabel.textContent = "GitHub Linked ✅";
+                    githubCard.title = "Click to unlink GitHub provider.";
+                }
             }
             else {
                 githubCard.classList.remove('linked');
                 githubCard.classList.add('unlinked');
                 githubLabel.textContent = "Unlinked";
+                githubCard.title = "Click to link GitHub account.";
             }
         }
     }
+    updatePasswordCardView() {
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const cardTitleEl = this.elements?.changePasswordCardEl?.querySelector('h3');
+        const cardDescEl = this.elements?.changePasswordCardEl?.querySelector('.description');
+        const currentPasswordGroup = this.elements?.inputCurrentPasswordEl?.closest('.form-group');
+        const btnChangePassword = this.elements?.btnChangePasswordEl;
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            if (cardTitleEl)
+                cardTitleEl.textContent = "Add Master Password";
+            if (cardDescEl)
+                cardDescEl.textContent = "Establish sovereign ownership by adding a master password. This enables direct, independent cryptographic management without relying solely on custodian authentication.";
+            if (currentPasswordGroup)
+                currentPasswordGroup.style.display = 'none';
+            if (btnChangePassword)
+                btnChangePassword.textContent = "Add Master Password";
+        }
+        else {
+            if (cardTitleEl)
+                cardTitleEl.textContent = "Change Password";
+            if (cardDescEl)
+                cardDescEl.textContent = "Rotate your local password that drives this identity. This will cryptographically evolve your primary identity and all registered user-owned delegate keystones to the new password.";
+            if (currentPasswordGroup)
+                currentPasswordGroup.style.display = '';
+            if (btnChangePassword)
+                btnChangePassword.textContent = "Update Password";
+        }
+    }
     async updateFrameDetailsView() {
         const lc = `${this.lc}[${this.updateFrameDetailsView.name}]`;
         try {
@@ -484,6 +543,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                             metaspace,
                             space
                         });
+                        this.aggregatedDetails = aggregated;
                         this.elements.identityAggrDetailsEl.textContent = aggregated ? pretty(aggregated) : '{}';
                         // Update Username and Description fields
                         this.elements.identityNameEl.textContent = aggregated?.username || aggregated?.profile?.name || aggregated?.name || '-';
@@ -491,18 +551,21 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                     }
                     catch (err) {
                         console.warn(`${lc} Error aggregating details: ${extractErrorMsg(err)}`);
+                        this.aggregatedDetails = undefined;
                         this.elements.identityAggrDetailsEl.textContent = '{}';
                         this.elements.identityNameEl.textContent = '-';
                         this.elements.identityDescriptionEl.textContent = '-';
                     }
                 }
                 else {
+                    this.aggregatedDetails = undefined;
                     this.elements.identityAggrDetailsEl.textContent = '{}';
                     this.elements.identityNameEl.textContent = '-';
                     this.elements.identityDescriptionEl.textContent = '-';
                 }
             }
             else {
+                this.aggregatedDetails = undefined;
                 this.elements.identityAggrDetailsEl.textContent = '{}';
                 this.elements.identityNameEl.textContent = '-';
                 this.elements.identityDescriptionEl.textContent = '-';
@@ -532,6 +595,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 await this.renderDelegates(keystone.data?.delegates);
                 this.elements.ssoLinkCardEl.classList.remove('hidden');
                 this.elements.changePasswordCardEl.classList.remove('hidden');
+                this.updatePasswordCardView();
             }
             else {
                 this.elements.delegatesCardEl.classList.add('hidden');
@@ -554,6 +618,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         if (!this.elements) {
             return;
         }
+        this.aggregatedDetails = undefined;
         this.isHistoricalFrame = false;
         if (this.elements.historicalWarningBannerEl) {
             this.elements.historicalWarningBannerEl.classList.add('hidden');
@@ -730,39 +795,66 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             return;
         }
         const metaspace = await getGlobalMetaspace_waitIfNeeded();
-        let localSpaceId;
-        if (metaspace) {
-            const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (space?.ib) {
-                localSpaceId = parseSpaceIb({ spaceIb: space.ib }).spaceId;
-            }
+        if (!metaspace) {
+            throw new Error(`(UNEXPECTED) metaspace falsy? (E: 8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3e)`);
+        }
+        const space = await metaspace.getLocalUserSpace({ lock: false });
+        if (!space) {
+            throw new Error(`(UNEXPECTED) space falsy? (E: 9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4f)`);
         }
+        const localSpaceId = space.ib ? parseSpaceIb({ spaceIb: space.ib }).spaceId : undefined;
         for (const [delegateTjpAddr, info] of Object.entries(delegates)) {
             const tr = document.createElement('tr');
             const deviceName = info.deviceName || info.details?.deviceTag || info.details?.name || 'Device Delegate';
             const tdName = document.createElement('td');
             const delegateSpaceId = info.spaceId || info.details?.spaceId;
-            let badgeEl = null;
-            if (delegateSpaceId) {
-                badgeEl = document.createElement('span');
-                badgeEl.style.marginLeft = '0.5rem';
-                badgeEl.style.padding = '0.15rem 0.4rem';
-                badgeEl.style.borderRadius = '4px';
-                badgeEl.style.fontSize = '0.75rem';
-                badgeEl.style.fontWeight = 'bold';
-                if (localSpaceId && delegateSpaceId === localSpaceId) {
-                    badgeEl.textContent = 'This Device';
-                    badgeEl.className = 'badge badge-this-device';
-                    badgeEl.style.backgroundColor = '#1b5e20';
-                    badgeEl.style.color = '#a5d6a7';
+            // Check if delegate is present in local space (via spaceId match or direct presence check)
+            let isThisDevice = false;
+            if (localSpaceId && delegateSpaceId === localSpaceId) {
+                isThisDevice = true;
+            }
+            else {
+                try {
+                    const resGet = await metaspace.get({ addrs: [delegateTjpAddr], space });
+                    isThisDevice = !!(resGet.success && resGet.ibGibs && resGet.ibGibs.length > 0);
                 }
-                else {
-                    badgeEl.textContent = 'Remote Device';
-                    badgeEl.className = 'badge badge-remote-device';
-                    badgeEl.style.backgroundColor = '#0d47a1';
-                    badgeEl.style.color = '#90caf9';
+                catch {
+                    isThisDevice = false;
                 }
             }
+            const badgeEl = document.createElement('span');
+            badgeEl.style.marginLeft = '0.5rem';
+            badgeEl.style.padding = '0.15rem 0.4rem';
+            badgeEl.style.borderRadius = '4px';
+            badgeEl.style.fontSize = '0.75rem';
+            badgeEl.style.fontWeight = 'bold';
+            if (isThisDevice) {
+                badgeEl.textContent = 'This Device';
+                badgeEl.className = 'badge badge-this-device';
+                badgeEl.style.backgroundColor = '#1b5e20';
+                badgeEl.style.color = '#a5d6a7';
+            }
+            else {
+                badgeEl.textContent = 'Remote Device';
+                badgeEl.className = 'badge badge-remote-device';
+                badgeEl.style.backgroundColor = '#0d47a1';
+                badgeEl.style.color = '#90caf9';
+            }
+            // Check expiration
+            const isExpired = isDelegateExpired({ delegateInfo: info });
+            let expiredBadgeEl = null;
+            if (isExpired) {
+                expiredBadgeEl = document.createElement('span');
+                expiredBadgeEl.textContent = 'Expired';
+                expiredBadgeEl.className = 'badge badge-expired';
+                expiredBadgeEl.style.marginLeft = '0.3rem';
+                expiredBadgeEl.style.padding = '0.15rem 0.4rem';
+                expiredBadgeEl.style.borderRadius = '4px';
+                expiredBadgeEl.style.fontSize = '0.75rem';
+                expiredBadgeEl.style.fontWeight = 'bold';
+                expiredBadgeEl.style.backgroundColor = '#b71c1c';
+                expiredBadgeEl.style.color = '#ef9a9a';
+            }
             const applyNameAndBadge = (displayName, hoverText) => {
                 tdName.innerHTML = '';
                 const textSpan = document.createElement('span');
@@ -771,6 +863,9 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                 if (badgeEl) {
                     tdName.appendChild(badgeEl);
                 }
+                if (expiredBadgeEl) {
+                    tdName.appendChild(expiredBadgeEl);
+                }
                 tdName.title = hoverText || displayName;
             };
             const displayName = `💻 ${deviceName}`;
@@ -781,7 +876,7 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             const tdVerbs = document.createElement('td');
             tdVerbs.textContent = info.allowedVerbs ? info.allowedVerbs.join(', ') : '-';
             tdVerbs.title = tdVerbs.textContent;
-            const isRemote = !!(delegateSpaceId && localSpaceId && delegateSpaceId !== localSpaceId);
+            const isRemote = !isThisDevice;
             const tdActions = document.createElement('td');
             const btnView = document.createElement('button');
             btnView.className = 'action-btn secondary small';
@@ -792,22 +887,22 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
                     this.showRemoteDelegateModal(info);
                 }
                 else {
-                    if (info.delegateAddr) {
+                    if (info.delegateAddr || delegateTjpAddr) {
                         let addrToLoad = info.delegateAddr;
-                        if (metaspace) {
-                            const space = await metaspace.getLocalUserSpace({ lock: false });
-                            if (space) {
-                                try {
-                                    const latest = await metaspace.getLatestAddr({ addr: delegateTjpAddr, space });
-                                    if (latest) {
-                                        addrToLoad = latest;
-                                    }
-                                }
-                                catch (err) {
-                                    console.warn(`${lc} Error resolving latest delegate address: ${extractErrorMsg(err)}`);
-                                }
+                        try {
+                            const keystoneService = new KeystoneService_V1();
+                            const latestKeystone = await keystoneService.getLatestKeystone({
+                                addr: delegateTjpAddr,
+                                metaspace,
+                                space
+                            });
+                            if (latestKeystone) {
+                                addrToLoad = getIbGibAddr({ ibGib: latestKeystone });
                             }
                         }
+                        catch (err) {
+                            console.warn(`${lc} Error resolving latest delegate keystone: ${extractErrorMsg(err)}`);
+                        }
                         this.dispatchEvent(new CustomEvent('ibgib-view-keystone-details', {
                             detail: { addr: addrToLoad },
                             bubbles: true,
@@ -1090,8 +1185,13 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         }
     }
     async handleSSOClick(providerId) {
-        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, providerId });
+        const isLinked = isSsoProviderLinked({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails, providerId });
         if (isLinked) {
+            const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+            if (!caps.isSovereign) {
+                this.setSSOStatus(`Cannot unlink ${providerId}: This is your only identity recovery and management method. Please add a Master Password first in the Password card below to enable sovereign ownership before unlinking.`, "error");
+                return;
+            }
             await this.handleSSOUnlink(providerId);
         }
         else {
@@ -1149,13 +1249,28 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
             }
             // 2. Evolve parent keystone to remove the custodian pool
             const targetPoolId = `custodian-manage-${providerId}`;
-            const evolvedParent = await keystoneService.removePools({
+            let evolvedParent = await keystoneService.removePools({
                 latestKeystone: this.ibGib,
                 masterSecret: masterSecret,
                 poolIds: [targetPoolId],
                 metaspace,
                 space
             });
+            // Unregister any corresponding outward delegate for this provider if present
+            const delegatesMap = this.ibGib?.data?.delegates;
+            if (delegatesMap) {
+                for (const [delegateTjpAddr, info] of Object.entries(delegatesMap)) {
+                    if (info.deviceName?.includes(providerId)) {
+                        evolvedParent = await keystoneService.unregisterDelegate({
+                            parentKeystone: evolvedParent,
+                            delegateTjpAddr,
+                            masterSecret: masterSecret,
+                            metaspace,
+                            space,
+                        });
+                    }
+                }
+            }
             // 3. Sync evolved parent keystone back to server
             this.setSSOStatus("Publishing evolved identity keystone to server...", "info");
             const syncRes = await getApiBridge().putEvolveKeystone({
@@ -1192,8 +1307,154 @@ export class KeystoneDetailsComponentInstance extends IbGibDynamicComponentInsta
         el.className = `status-msg ${type}`;
         el.classList.remove('hidden');
     }
+    async handleAddMasterPassword() {
+        const lc = `${this.lc}[${this.handleAddMasterPassword.name}]`;
+        this.setChangePasswordStatus("Validating entries...", "info");
+        try {
+            const newPassword = this.elements.inputNewPasswordEl.value;
+            const confirmPassword = this.elements.inputConfirmPasswordEl.value;
+            if (!newPassword) {
+                this.setChangePasswordStatus("Master password is required.", "error");
+                return;
+            }
+            if (newPassword !== confirmPassword) {
+                this.setChangePasswordStatus("Master password and confirmation do not match.", "error");
+                return;
+            }
+            const initialManagePool = this.ibGib?.data?.challengePools?.find(p => p.id === POOL_ID_MANAGE);
+            if (!initialManagePool) {
+                this.setChangePasswordStatus("Primary keystone missing active manage challenge pool.", "error");
+                return;
+            }
+            this.showBusy({
+                isBusy: true,
+                title: 'Elevating Identity...',
+                msg: 'Generating cryptographic sovereign challenge pool...',
+                animationEmoji: '🔑'
+            });
+            this.setChangePasswordStatus("Generating sovereign challenge pool...", "info");
+            const newChallenges = await generatePoolChallenges({
+                config: initialManagePool.config,
+                masterSecret: newPassword,
+            });
+            const newManagePool = {
+                id: POOL_ID_MANAGE,
+                config: initialManagePool.config,
+                challenges: newChallenges,
+            };
+            const primaryTjpAddr = getTjpAddr({ ibGib: this.ibGib }) || getIbGibAddr({ ibGib: this.ibGib });
+            const custodianProvider = this.aggregatedDetails?.custodianProvider || 'google';
+            let requestBody = {
+                primaryTjpAddr,
+                newManagePool,
+            };
+            if (custodianProvider === 'google' || custodianProvider === 'github') {
+                this.showBusy({
+                    isBusy: true,
+                    title: 'Re-authenticating with Provider...',
+                    msg: `Please complete authentication in the ${custodianProvider} popup window...`,
+                    animationEmoji: '🔒'
+                });
+                this.setChangePasswordStatus(`Please authenticate in the popup with ${custodianProvider} to verify ownership...`, "info");
+                const resPopup = await executeSsoOAuthPopup({
+                    providerId: custodianProvider,
+                    parentTjpAddr: primaryTjpAddr,
+                });
+                if (!resPopup.success || !resPopup.code) {
+                    this.showBusy({ isBusy: false });
+                    this.setChangePasswordStatus(resPopup.message || "Re-authentication cancelled.", "error");
+                    return;
+                }
+                requestBody.providerId = custodianProvider;
+                requestBody.code = resPopup.code;
+                requestBody.redirectUri = resPopup.redirectUri;
+            }
+            else {
+                this.showBusy({ isBusy: false });
+                // Email OTP fallback
+                const email = this.aggregatedDetails?.emails?.[0] || this.ibGib?.data?.emails?.[0];
+                const otpCode = await promptForSecret({
+                    msg: `Enter 6-digit verification code sent to ${email}:`,
+                    confirm: false,
+                });
+                if (!otpCode) {
+                    this.setChangePasswordStatus("Verification code required.", "error");
+                    return;
+                }
+                requestBody.email = email;
+                requestBody.code = otpCode;
+            }
+            this.showBusy({
+                isBusy: true,
+                title: 'Updating Keystone Timeline...',
+                msg: 'Publishing sovereign master password and evolving identity DAG...',
+                animationEmoji: '⏳'
+            });
+            this.setChangePasswordStatus("Elevating identity to sovereign master password on server...", "info");
+            const response = await fetch('/api/identity/custodian/add-master-password', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(requestBody),
+            });
+            const resJson = await response.json();
+            if (!response.ok || !resJson.success) {
+                throw new Error(resJson.error || resJson.message || `Server error (${response.status})`);
+            }
+            const evolvedParent = resJson.primaryKeystone;
+            // Save to local user space & metaspace
+            const metaspace = await getGlobalMetaspace_waitIfNeeded();
+            if (!metaspace) {
+                throw new Error("Global metaspace not available");
+            }
+            const space = await metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                throw new Error("Local user space not available");
+            }
+            await metaspace.put({ ibGibs: [evolvedParent], space });
+            await metaspace.registerNewIbGib({ ibGib: evolvedParent, space });
+            await updateSpecialIndex({
+                type: "keystones",
+                rel8nInfos: [
+                    {
+                        rel8nName: "keystone",
+                        ibGibs: [toDto({ ibGib: evolvedParent })]
+                    }
+                ],
+                metaspace,
+                space
+            });
+            const evolvedAddr = getIbGibAddr({ ibGib: evolvedParent });
+            // Dispatch EVENT_IBGIB_IDENTITY_CHANGED
+            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_IDENTITY_CHANGED, {
+                detail: { activeIdentityAddr: evolvedAddr },
+                bubbles: true,
+                composed: true
+            }));
+            this.setChangePasswordStatus("Successfully added Master Password! Identity is now sovereign.", "success");
+            // Refresh the view
+            this.ibGibAddr = evolvedAddr;
+            this.staticIbGib = evolvedParent;
+            await this.loadIbGib({ getLatest: true });
+            // Clear inputs
+            this.elements.inputNewPasswordEl.value = '';
+            this.elements.inputConfirmPasswordEl.value = '';
+        }
+        catch (error) {
+            console.error(`${lc} Elevation failed: ${extractErrorMsg(error)}`);
+            this.setChangePasswordStatus(`Failed to add master password: ${extractErrorMsg(error)}`, "error");
+        }
+        finally {
+            this.showBusy({ isBusy: false });
+        }
+    }
     async handleChangePassword() {
         const lc = `${this.lc}[${this.handleChangePassword.name}]`;
+        const caps = getKeystoneCapabilities({ keystone: this.ibGib, aggregatedDetails: this.aggregatedDetails });
+        const isCustodialOnly = caps.isCustodial && !caps.isSovereign;
+        if (isCustodialOnly) {
+            await this.handleAddMasterPassword();
+            return;
+        }
         this.setChangePasswordStatus("Validating entries...", "info");
         try {
             const currentPassword = this.elements.inputCurrentPasswordEl.value;