@mblaney/holster 1.0.25 → 1.0.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mblaney/holster",
-  "version": "1.0.25",
+  "version": "1.0.26",
   "description": "Holster is a service that allows synchronising data between devices using Node, Deno, Bun or the browser.",
   "type": "module",
   "main": "index.js",

package/src/ham.js

@@ -95,6 +95,8 @@ Ham.mix = async (change, graph, secure, listen) => {
 
       const signedTimestamps = new Set()
       const signedProperties = new Set()
+
+      // Verify timestamp signatures (numeric keys in node._["s"])
       for (const [key, sig] of Object.entries(node._["s"] || {})) {
         const asNumber = Number(key)
         if (!isNaN(asNumber) && asNumber > 0) {
@@ -103,7 +105,7 @@ Ham.mix = async (change, graph, secure, listen) => {
             signedTimestamps.add(asNumber)
             // Add all properties with this timestamp to signed set
             for (const [prop, ts] of Object.entries(node._[">"] || {})) {
-              if (ts === asNumber) {
+              if (Number(ts) === asNumber) {
                 signedProperties.add(prop)
               }
             }
@@ -111,6 +113,10 @@ Ham.mix = async (change, graph, secure, listen) => {
         }
       }
 
+      // Verify per-property signatures (backward compatibility)
+      const perPropertySignedProps = await SEA.verifyProperties(node, pub)
+      perPropertySignedProps.forEach(prop => signedProperties.add(prop))
+
       // If no properties verified, skip this update
       if (signedProperties.size === 0) {
         continue

package/src/sea.js

@@ -238,6 +238,59 @@ const SEA = {
       return false
     }
   },
+  // Verify individual property signatures stored in node._["s"]
+  // Returns array of valid property names
+  verifyProperties: async (node, pub, cb) => {
+    if (!pub || !node) {
+      if (cb) cb([])
+      return []
+    }
+
+    const key = await utils.subtle.importKey(
+      "jwk",
+      utils.jwk(pub),
+      {name: "ECDSA", namedCurve: "P-256"},
+      false,
+      ["verify"],
+    )
+
+    const alg = {name: "ECDSA", hash: {name: "SHA-256"}}
+    const valid = []
+    const propertySignatures = (node._ && node._["s"]) || {}
+
+    // Verify each property individually
+    for (const k of Object.keys(node).sort()) {
+      if (k === "_" || k == userPublicKey) continue
+
+      const propSig = propertySignatures[k]
+      if (!propSig) {
+        console.log(`warning: property '${k}' missing signature`)
+        continue
+      }
+
+      try {
+        const hash = await utils.sha256(node[k])
+        const sig = new Uint8Array(SafeBuffer.from(propSig, "base64"))
+
+        const isValid = await utils.subtle.verify(
+          alg,
+          key,
+          sig,
+          new Uint8Array(hash),
+        )
+        if (isValid) {
+          valid.push(k)
+        } else {
+          console.log(`warning: property '${k}' signature verification failed`)
+        }
+      } catch (err) {
+        console.log(`warning: property '${k}' error verifying: ${err.message}`)
+      }
+    }
+
+    if (cb) cb(valid)
+    return valid
+  },
   work: async (data, salt, cb) => {
     if (typeof salt === "function") {
       cb = salt

package/src/wire.js

@@ -302,10 +302,9 @@ const Wire = opt => {
 
     const ack = Get(lex, graph)
     const track = utils.text.random(9)
-    // Request the whole node in secure mode for verification.
     const request = JSON.stringify({
       "#": dup.track(track),
-      get: opt.secure ? {"#": lex["#"]} : lex,
+      get: lex,
     })
 
     if (ack) {