@livedesk/hub 0.1.31 → 0.1.33

package/src/security/device-credential-authority.js

@@ -174,6 +174,9 @@ export function createDeviceCredentialAuthority({
   if (!privateKeyText) throw securityError('hub-private-key-secure-store-unavailable');
   const hubPrivateKey = requireP256PrivateKey(privateKeyText);
   const hubPublic = requireP256PublicKey(authority.publicKey);
+  const hubIssuerKeyId = crypto.createHash('sha256')
+    .update(Buffer.from(hubPublic.text, 'base64url'))
+    .digest('base64url');
   const derivedPublic = crypto.createPublicKey(hubPrivateKey).export({ format: 'der', type: 'spki' }).toString('base64url');
   if (derivedPublic !== hubPublic.text) throw securityError('hub-device-authority-key-mismatch');
   const hubId = clean(authority.hubId, 128);
@@ -183,18 +186,33 @@ export function createDeviceCredentialAuthority({
     registry = { version: AUTHORITY_VERSION, devices: {} };
   }
 
-  function persistRegistry() {
-    atomicPrivateJson(registryPath, registry);
+  function persistRegistry(nextRegistry = registry) {
+    atomicPrivateJson(registryPath, nextRegistry);
   }
 
-  function issueCredential({ accountId, deviceId, devicePublicKey, replace = false }) {
+  function normalizeCredentialRequest({ accountId, deviceId, devicePublicKey } = {}) {
     const owner = clean(accountId, 128);
     const id = clean(deviceId, 128);
     if (!owner) throw securityError('device-account-required');
     if (!id) throw securityError('device-id-required');
     const deviceKey = requireP256PublicKey(devicePublicKey);
+    return { owner, id, deviceKey };
+  }
+
+  function assertEnrollmentAllowed(request) {
+    const normalized = normalizeCredentialRequest(request);
+    const existing = registry.devices[normalized.id];
+    if (existing && !existing.revokedAt) throw securityError('device-already-enrolled');
+    if (!existing && Object.keys(registry.devices).length >= MAX_DEVICES) {
+      throw securityError('device-registry-capacity');
+    }
+    return true;
+  }
+
+  function issueCredential({ accountId, deviceId, devicePublicKey }) {
+    const { owner, id, deviceKey } = normalizeCredentialRequest({ accountId, deviceId, devicePublicKey });
     const existing = registry.devices[id];
-    if (existing && !existing.revokedAt && !replace) throw securityError('device-already-enrolled');
+    if (existing && !existing.revokedAt) throw securityError('device-already-enrolled');
     if (!existing && Object.keys(registry.devices).length >= MAX_DEVICES) throw securityError('device-registry-capacity');
     const issuedAt = Math.floor(now());
     const payload = {
@@ -213,18 +231,25 @@ export function createDeviceCredentialAuthority({
       dsaEncoding: 'ieee-p1363'
     }).toString('base64url');
     const credential = `${payloadText}.${signature}`;
-    registry.devices[id] = {
-      serial: payload.serial,
-      accountId: owner,
-      hubId,
-      devicePublicKey: deviceKey.text,
-      credential,
-      issuedAt,
-      expiresAt: payload.expiresAt,
-      revokedAt: '',
-      lastConnectedAt: ''
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: {
+          serial: payload.serial,
+          accountId: owner,
+          hubId,
+          devicePublicKey: deviceKey.text,
+          credential,
+          issuedAt,
+          expiresAt: payload.expiresAt,
+          revokedAt: '',
+          lastConnectedAt: ''
+        }
+      }
     };
-    persistRegistry();
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return { credential, payload: { ...payload }, hubPublicKey: hubPublic.text };
   }
 
@@ -279,23 +304,26 @@ export function createDeviceCredentialAuthority({
     }).toString('base64url');
   }
 
-  function issueRendezvousProof({ roomId, accountId, deviceId, ttlMs = 60_000 } = {}) {
+  function issueRendezvousProof({ roomId, accountId, deviceId, role, ttlMs = 60_000 } = {}) {
     const room = clean(roomId, 160);
     const owner = clean(accountId, 128);
     const device = clean(deviceId, 128);
+    const normalizedRole = clean(role, 16).toLowerCase();
     if (!room || !owner || !device) throw securityError('rendezvous-proof-binding-required');
+    if (!['hub', 'client'].includes(normalizedRole)) throw securityError('rendezvous-proof-role-required');
     const issuedAt = Math.floor(now());
     const payload = {
-      version: 1,
-      protocol: 'livedesk.udp.rendezvous-proof.v1',
+      version: 2,
+      protocol: 'livedesk.udp.rendezvous-proof.v2',
+      issuerKeyId: hubIssuerKeyId,
       roomId: room,
+      role: normalizedRole,
       accountId: owner,
       hubId,
       deviceId: device,
       issuedAt,
       expiresAt: issuedAt + Math.max(10_000, Math.min(120_000, Number(ttlMs) || 60_000)),
-      nonce: crypto.randomBytes(16).toString('base64url'),
-      hubPublicKey: hubPublic.text
+      nonce: crypto.randomBytes(16).toString('base64url')
     };
     const payloadText = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
     return { proof: `${payloadText}.${signHubMessage(payloadText)}`, payload };
@@ -305,9 +333,19 @@ export function createDeviceCredentialAuthority({
     const id = clean(deviceId, 128);
     const record = registry.devices[id];
     if (!record || record.revokedAt) return false;
-    record.revokedAt = new Date(now()).toISOString();
-    record.revokeReason = clean(reason, 160);
-    persistRegistry();
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: {
+          ...record,
+          revokedAt: new Date(now()).toISOString(),
+          revokeReason: clean(reason, 160)
+        }
+      }
+    };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return true;
   }
 
@@ -315,8 +353,15 @@ export function createDeviceCredentialAuthority({
     const id = clean(deviceId, 128);
     const record = registry.devices[id];
     if (!record || record.revokedAt) return false;
-    record.lastConnectedAt = new Date(now()).toISOString();
-    persistRegistry();
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: { ...record, lastConnectedAt: new Date(now()).toISOString() }
+      }
+    };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return true;
   }
 
@@ -335,14 +380,17 @@ export function createDeviceCredentialAuthority({
 
   function clearDevices() {
     const removed = Object.keys(registry.devices).length;
-    registry = { version: AUTHORITY_VERSION, devices: {} };
-    persistRegistry();
+    const nextRegistry = { version: AUTHORITY_VERSION, devices: {} };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return removed;
   }
 
   return Object.freeze({
     hubId,
     hubPublicKey: hubPublic.text,
+    hubIssuerKeyId,
+    assertEnrollmentAllowed,
     issueCredential,
     verifyCredential,
     verifyDeviceSignature,

package/src/security/security-audit-store.js

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { appendFile, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -85,6 +85,25 @@ function parseSeal(raw) {
   }
 }
 
+async function syncFile(filePath, flags = 'r') {
+  const handle = await open(filePath, flags, 0o600);
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+async function appendDurably(filePath, value) {
+  const handle = await open(filePath, 'a', 0o600);
+  try {
+    await handle.writeFile(value, { encoding: 'utf8' });
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
 export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.livedesk') } = {}) {
   const filePath = path.join(dataDir, 'security', 'security-audit-v1.jsonl');
   const sealStore = createOsSecretStore({
@@ -175,6 +194,7 @@ export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.l
     }
     const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
     await writeFile(temporary, `${rebuilt.map(record => JSON.stringify(record)).join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
+    await syncFile(temporary);
     await rename(temporary, filePath);
     records = rebuilt;
     seal.headHash = previousHash;
@@ -195,7 +215,9 @@ export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.l
         const recordHash = hashRecord(previousHash, payloadHash, mac);
         written = { version: AUDIT_VERSION, previousHash, payloadHash, mac, recordHash, payload };
         await mkdir(path.dirname(filePath), { recursive: true });
-        await appendFile(filePath, `${JSON.stringify(written)}\n`, { encoding: 'utf8', mode: 0o600 });
+        // A successful record() is the mutation gate for security-sensitive
+        // operations. Resolve only after the JSONL record is on stable storage.
+        await appendDurably(filePath, `${JSON.stringify(written)}\n`);
         current.push(written);
         seal.headHash = recordHash;
         seal.recordCount = current.length;