@mblaney/holster 1.0.30 → 1.0.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mblaney/holster",
-  "version": "1.0.30",
+  "version": "1.0.32",
   "description": "Holster is a service that allows synchronising data between devices using Node, Deno, Bun or the browser.",
   "type": "module",
   "main": "index.js",

package/src/buffer.js

@@ -161,6 +161,14 @@ const processArrayLikeInput = input => {
       }
     }
 
+    bytes = new Uint8Array(input)
+  } else if (
+    typeof input === "object" &&
+    input !== null &&
+    typeof input.byteLength === "number"
+  ) {
+    // Handle ArrayBuffer from different contexts (e.g. jsdom)
+    validateBufferSize(input.byteLength, "ArrayBuffer-like processing")
     bytes = new Uint8Array(input)
   } else if (
     typeof input === "object" &&
@@ -184,7 +192,6 @@ const processArrayLikeInput = input => {
         )
       }
     }
-
     bytes = new Uint8Array(arr)
   } else {
     throw new TypeError("Unsupported input type: " + typeof input)

package/src/ham.js

@@ -11,11 +11,10 @@ const Ham = (state, currentState, value, currentValue, signed = false) => {
 
   if (state > currentState) return {incoming: true}
 
-  // state is equal to currentState
-  // If using signed timestamps then reject conflicting values because the
-  // owner can only create one value per timestamp.
+  // state is equal to currentState. Old data is expected to propagate through
+  // the network, but conflicting values with same signed timestamp are ignored
+  // since the owner can only create one value per timestamp.
   if (signed && value !== currentValue) {
-    console.log(`Signed timestamp ${state}: reject conflicting value`)
     return {historical: true}
   }
 
@@ -96,15 +95,36 @@ Ham.mix = async (change, graph, secure, listen) => {
       const signedTimestamps = new Set()
       const signedProperties = new Set()
 
-      // Verify timestamp signatures (numeric keys in node._["s"])
+      // Skip verification of timestamps that are older than what's in the graph
+      // to prevent old signatures from distributed messages causing conflicts
+      const incomingTimestamps = Object.entries(node._[">"] || {})
+
       for (const [key, sig] of Object.entries(node._["s"] || {})) {
         const asNumber = Number(key)
         if (!isNaN(asNumber) && asNumber > 0) {
+          // Check if this timestamp is for properties that already have newer
+          // versions in graph.
+          const hasNewerInGraph = incomingTimestamps.some(([prop, ts]) => {
+            if (Number(ts) === asNumber) {
+              const graphState =
+                graph[soul] && graph[soul]._[">"] ? graph[soul]._[">"][prop] : 0
+              // Skip verification if graph has a newer timestamp for property.
+              if (graphState > asNumber) {
+                return true
+              }
+            }
+            return false
+          })
+
+          if (hasNewerInGraph) {
+            continue
+          }
+
           const isValid = await SEA.verifyTimestamp(asNumber, sig, pub)
           if (isValid) {
             signedTimestamps.add(asNumber)
             // Add all properties with this timestamp to signed set
-            for (const [prop, ts] of Object.entries(node._[">"] || {})) {
+            for (const [prop, ts] of incomingTimestamps) {
               if (Number(ts) === asNumber) {
                 signedProperties.add(prop)
               }
@@ -113,9 +133,27 @@ Ham.mix = async (change, graph, secure, listen) => {
         }
       }
 
-      // Verify per-property signatures (backward compatibility)
-      const perPropertySignedProps = await SEA.verifyProperties(node, pub)
-      perPropertySignedProps.forEach(prop => signedProperties.add(prop))
+      // TODO: Remove per-property signature verification after old data has
+      // been cleared. Only check per-property signatures if there are
+      // properties without timestamp signatures.
+      const propertiesWithoutTimestampSigs = Object.keys(node).filter(k => {
+        if (k === "_" || k === utils.userPublicKey) return false
+        return !incomingTimestamps.some(
+          ([prop, ts]) => prop === k && signedTimestamps.has(Number(ts)),
+        )
+      })
+
+      if (propertiesWithoutTimestampSigs.length > 0) {
+        const nodeToVerify = {_: node._}
+        for (const prop of propertiesWithoutTimestampSigs) {
+          nodeToVerify[prop] = node[prop]
+        }
+        const perPropertySignedProps = await SEA.verifyProperties(
+          nodeToVerify,
+          pub,
+        )
+        perPropertySignedProps.forEach(prop => signedProperties.add(prop))
+      }
 
       // If no properties verified, skip this update
       if (signedProperties.size === 0) {

package/src/user.js

@@ -73,46 +73,7 @@ const User = (opt, wire) => {
             return
           }
 
-          // Migration: broadcast signed data on login if enabled
-          // Can be enabled by setting localStorage.setItem("holster_migrate_signatures", "true")
-          const migrationEnabled =
-            typeof globalThis.localStorage !== "undefined" &&
-            globalThis.localStorage.getItem("holster_migrate_signatures") ===
-              "true"
-
-          if (migrationEnabled) {
-            const migrationData = {}
-            for (const key of Object.keys(data)) {
-              if (
-                key !== "_" &&
-                key !== userPublicKey &&
-                key !== userSignature
-              ) {
-                migrationData[key] = data[key]
-              }
-            }
-            // Sign the timestamp for migration
-            const timestamp = Date.now()
-            const sig = await SEA.signTimestamp(timestamp, user.is)
-            const graph = utils.graph(
-              pub,
-              migrationData,
-              sig,
-              data.pub,
-              timestamp,
-            )
-            wire.put(graph, err => {
-              if (err) {
-                // Log migration error but don't fail authentication
-                console.log(
-                  `warning: failed to migrate signatures on login: ${err}`,
-                )
-              }
-              done(null)
-            })
-          } else {
-            done(null)
-          }
+          done(null)
         },
         {wait: 5000},
       )

package/src/utils.js

@@ -89,21 +89,8 @@ export const graph = (soul, data, sig, pub, timestamp) => {
       g[soul]._[">"][key] = timestamp || Date.now()
     }
   }
-  // Store signatures in node._["s"]
-  // sig can be:
-  // - object: per-property signatures (legacy format)
-  // - string: timestamp signature (new format)
   if (sig && pub && timestamp) {
-    g[soul]._["s"] = {}
-    if (typeof sig === "string") {
-      // Timestamp signature: store with timestamp as key
-      g[soul]._["s"][timestamp] = sig
-    } else if (typeof sig === "object") {
-      // Per-property signatures: store with property names as keys
-      for (const [key, signature] of Object.entries(sig)) {
-        g[soul]._["s"][key] = signature
-      }
-    }
+    g[soul]._["s"] = {[timestamp]: sig}
     g[soul][userPublicKey] = pub
     g[soul]._[">"][userPublicKey] = timestamp
   }

package/src/wire.js

@@ -732,7 +732,7 @@ const Wire = opt => {
       queueProcessor = setTimeout(processQueue, 50)
     }
   }
-  if (!(opt.peers instanceof Array)) {
+  if (!(opt.peers instanceof Array) || opt.peers.length === 0) {
     opt.peers = [`ws://localhost:${opt.port || 8765}`]
   }
   opt.peers.forEach(peer => {