@mblaney/holster 1.0.28 → 1.0.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mblaney/holster",
-  "version": "1.0.28",
+  "version": "1.0.29",
   "description": "Holster is a service that allows synchronising data between devices using Node, Deno, Bun or the browser.",
   "type": "module",
   "main": "index.js",

package/src/get.js

@@ -32,6 +32,20 @@ const Get = (lex, graph) => {
         signatures[key] = graph[soul]._["s"][key]
       }
     }
+
+    // Always include userPublicKey for verification, regardless of filter
+    if (userPublicKey && typeof graph[soul][userPublicKey] !== "undefined") {
+      node[userPublicKey] = graph[soul][userPublicKey]
+      node._[">"][userPublicKey] = graph[soul]._[">"][userPublicKey]
+      const pkState = graph[soul]._[">"][userPublicKey]
+      if (graph[soul]._["s"]) {
+        if (graph[soul]._["s"][pkState]) {
+          signatures[pkState] = graph[soul]._["s"][pkState]
+        } else if (graph[soul]._["s"][userPublicKey]) {
+          signatures[userPublicKey] = graph[soul]._["s"][userPublicKey]
+        }
+      }
+    }
   } else {
     for (const key of Object.keys(graph[soul])) {
       // Always include userPublicKey for verification, regardless of filter

package/src/ham.js

@@ -130,9 +130,6 @@ Ham.mix = async (change, graph, secure, listen) => {
     for (const key of Object.keys(node)) {
       if (key === "_") continue
 
-      // Skip metadata fields (including userSignature for old data)
-      if (key === utils.userSignature || key === utils.userPublicKey) continue
-
       // Properties without signatures in this update are left unchanged
       if (validProperties.has(soul) && !validProperties.get(soul).has(key)) {
         continue

package/src/holster.js

@@ -522,8 +522,8 @@ const Holster = opt => {
               }
 
               // The nested objects created above will also have rels on the
-              // parent object, so fetch the node so that the rest of the updates
-              // can be added.
+              // parent object, so fetch the node so that the rest of the
+              // updates can be added.
               wire.get({"#": id}, async msg => {
                 if (msg.err) {
                   _ack(`error getting ${id}: ${msg.err}`)

package/src/wire.js

@@ -197,46 +197,6 @@ const Wire = opt => {
   const rateLimiter = createRateLimiter(isTestEnv)
   const connectionManager = createConnectionManager(opt.maxConnections || 1000)
 
-  // The check function is required because user data must provide a public key
-  // so that it can be verified. The public key might verify the provided
-  // signature but not actually match the user under which the data is being
-  // stored. To avoid this, the current data on a soul needs to be checked to
-  // make sure the stored public key matches the one provided with the update.
-  const check = async (data, send, cb) => {
-    for (const soul of Object.keys(data)) {
-      const msg = await new Promise(res => {
-        getWithCallback({"#": soul}, res, send)
-      })
-      if (msg.err) {
-        if (cb) cb(msg.err)
-        return false
-      }
-
-      const node = data[soul]
-      const key = utils.userPublicKey
-      // If there is no current node then the data is ok to write without
-      // matching public keys, as the provided soul also needs a rel on the
-      // parent node which then also requires checking. Otherwise publc keys
-      // need to match for existing data.
-      if (!msg.put || !msg.put[soul] || msg.put[soul][key] === node[key]) {
-        continue
-      }
-
-      // If a soul exists but does not have a public key, then one should not be
-      // added because the node is not user data. The above check fails in this
-      // case if a public key is provided. Note that this is only an error case
-      // if called via the API, which is when a callback is provided here.
-      // (The wire spec can fetch and put data on the wire without a signature
-      // or public key and this can be ignored.)
-      if (cb) {
-        cb(`error in wire check public key does not match for soul: ${soul}`)
-      }
-      return false
-    }
-
-    return true
-  }
-
   const get = (msg, send) => {
     const ack = Get(msg.get, graph)
     if (ack) {
@@ -248,16 +208,22 @@ const Wire = opt => {
         }),
       )
     } else {
-      store.get(msg.get, (err, ack) => {
-        send(
-          JSON.stringify({
-            "#": dup.track(utils.text.random(9)),
-            "@": msg["#"],
-            put: ack,
-            err: err,
-          }),
-        )
-      })
+      // Always pass secure to ensure public key is fetched. User data may be
+      // requested that requires the public key for verification.
+      store.get(
+        msg.get,
+        (err, ack) => {
+          send(
+            JSON.stringify({
+              "#": dup.track(utils.text.random(9)),
+              "@": msg["#"],
+              put: ack,
+              err: err,
+            }),
+          )
+        },
+        {secure: true},
+      )
     }
   }
 
@@ -275,8 +241,6 @@ const Wire = opt => {
       return
     }
 
-    if (!(await check(update.now, send))) return
-
     store.put(update.now, err => {
       send(
         JSON.stringify({
@@ -378,8 +342,6 @@ const Wire = opt => {
           return
         }
 
-        if (!(await check(update.now, send, cb))) return
-
         // Seed pendingReferences with any new references from API calls
         for (const [soul, node] of Object.entries(update.now)) {
           if (node && typeof node === "object") {