@mblaney/holster 1.0.25 → 1.0.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mblaney/holster",
-  "version": "1.0.25",
+  "version": "1.0.27",
   "description": "Holster is a service that allows synchronising data between devices using Node, Deno, Bun or the browser.",
   "type": "module",
   "main": "index.js",

package/src/get.js

@@ -1,4 +1,4 @@
-import {match} from "./utils.js"
+import {match, userPublicKey} from "./utils.js"
 
 const Get = (lex, graph) => {
   if (!lex || typeof lex !== "object") {
@@ -34,7 +34,8 @@ const Get = (lex, graph) => {
     }
   } else {
     for (const key of Object.keys(graph[soul])) {
-      if (match(lex["."], key)) {
+      // Always include userPublicKey for verification, regardless of filter
+      if (key === userPublicKey || match(lex["."], key)) {
         node[key] = graph[soul][key]
         node._[">"][key] = graph[soul]._[">"][key]
         const state = graph[soul]._[">"][key]

package/src/ham.js

@@ -95,6 +95,8 @@ Ham.mix = async (change, graph, secure, listen) => {
 
       const signedTimestamps = new Set()
       const signedProperties = new Set()
+
+      // Verify timestamp signatures (numeric keys in node._["s"])
       for (const [key, sig] of Object.entries(node._["s"] || {})) {
         const asNumber = Number(key)
         if (!isNaN(asNumber) && asNumber > 0) {
@@ -103,7 +105,7 @@ Ham.mix = async (change, graph, secure, listen) => {
             signedTimestamps.add(asNumber)
             // Add all properties with this timestamp to signed set
             for (const [prop, ts] of Object.entries(node._[">"] || {})) {
-              if (ts === asNumber) {
+              if (Number(ts) === asNumber) {
                 signedProperties.add(prop)
               }
             }
@@ -111,6 +113,10 @@ Ham.mix = async (change, graph, secure, listen) => {
         }
       }
 
+      // Verify per-property signatures (backward compatibility)
+      const perPropertySignedProps = await SEA.verifyProperties(node, pub)
+      perPropertySignedProps.forEach(prop => signedProperties.add(prop))
+
       // If no properties verified, skip this update
       if (signedProperties.size === 0) {
         continue

package/src/radisk.js

@@ -34,6 +34,7 @@ const Radisk = opt => {
   if (!opt.write) opt.write = 1 // Wait time before write in milliseconds
   if (!opt.size) opt.size = 1024 * 1024 // File size on disk, default 1MB
   if (!opt.memoryLimit) opt.memoryLimit = 500 // Memory limit in MB
+  if (!opt.readTimeout) opt.readTimeout = 1000 // Read timeout in milliseconds
   if (typeof opt.cache === "undefined") opt.cache = true
 
   if (!opt.store) {
@@ -126,20 +127,34 @@ const Radisk = opt => {
       // Check if there's already a pending read for this key
       if (pendingReads.has(key)) {
         // Add callback to existing pending read
-        pendingReads.get(key).push(cb)
+        pendingReads.get(key).callbacks.push(cb)
         return
       }
 
-      // Start new read and create callback queue
-      pendingReads.set(key, [cb])
+      // Start new read and create callback queue with fired flag
+      const pending = {callbacks: [cb], fired: false, timeoutId: null}
+      pendingReads.set(key, pending)
+
+      // Set a timeout to fire callbacks if read takes too long
+      pending.timeoutId = setTimeout(() => {
+        if (!pending.fired) {
+          pending.fired = true
+          pendingReads.delete(key)
+          const err = new Error("radisk read timeout")
+          pending.callbacks.forEach(callback => callback(err, undefined))
+        }
+      }, opt.readTimeout)
 
       const readStart = Date.now()
       return radisk.read(key, (err, result) => {
+        clearTimeout(pending.timeoutId)
         perfLog("read", readStart, key)
-        // Execute all pending callbacks for this key
-        const callbacks = pendingReads.get(key) || []
-        pendingReads.delete(key)
-        callbacks.forEach(callback => callback(err, result))
+        // Execute all pending callbacks for this key if timeout hasn't fired
+        if (!pending.fired) {
+          pending.fired = true
+          pendingReads.delete(key)
+          pending.callbacks.forEach(callback => callback(err, result))
+        }
       })
     }
 

package/src/sea.js

@@ -238,6 +238,59 @@ const SEA = {
       return false
     }
   },
+  // Verify individual property signatures stored in node._["s"]
+  // Returns array of valid property names
+  verifyProperties: async (node, pub, cb) => {
+    if (!pub || !node) {
+      if (cb) cb([])
+      return []
+    }
+
+    const key = await utils.subtle.importKey(
+      "jwk",
+      utils.jwk(pub),
+      {name: "ECDSA", namedCurve: "P-256"},
+      false,
+      ["verify"],
+    )
+
+    const alg = {name: "ECDSA", hash: {name: "SHA-256"}}
+    const valid = []
+    const propertySignatures = (node._ && node._["s"]) || {}
+
+    // Verify each property individually
+    for (const k of Object.keys(node).sort()) {
+      if (k === "_" || k == userPublicKey) continue
+
+      const propSig = propertySignatures[k]
+      if (!propSig) {
+        console.log(`warning: property '${k}' missing signature`)
+        continue
+      }
+
+      try {
+        const hash = await utils.sha256(node[k])
+        const sig = new Uint8Array(SafeBuffer.from(propSig, "base64"))
+
+        const isValid = await utils.subtle.verify(
+          alg,
+          key,
+          sig,
+          new Uint8Array(hash),
+        )
+        if (isValid) {
+          valid.push(k)
+        } else {
+          console.log(`warning: property '${k}' signature verification failed`)
+        }
+      } catch (err) {
+        console.log(`warning: property '${k}' error verifying: ${err.message}`)
+      }
+    }
+
+    if (cb) cb(valid)
+    return valid
+  },
   work: async (data, salt, cb) => {
     if (typeof salt === "function") {
       cb = salt

package/src/store.js

@@ -226,7 +226,8 @@ const Store = opt => {
       var node
       var signatures = {}
       const each = (value, key) => {
-        if (!utils.match(lex["."], key)) return
+        // Always include userPublicKey for verification, regardless of filter
+        if (key !== utils.userPublicKey && !utils.match(lex["."], key)) return
 
         if (!node) node = {_: {"#": soul, ">": {}}}
         node[key] = value[0]

package/src/wire.js

@@ -302,10 +302,9 @@ const Wire = opt => {
 
     const ack = Get(lex, graph)
     const track = utils.text.random(9)
-    // Request the whole node in secure mode for verification.
     const request = JSON.stringify({
       "#": dup.track(track),
-      get: opt.secure ? {"#": lex["#"]} : lex,
+      get: lex,
     })
 
     if (ack) {