@mh-gg/room-security 0.1.1-alpha.20260613T085325975Z

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@mh-gg/room-security",
+  "version": "0.1.1-alpha.20260613T085325975Z",
+  "description": "Standalone room membership, invite, ban, and key epoch security library for matterhorn.",
+  "type": "commonjs",
+  "main": "src/index.cjs",
+  "exports": {
+    ".": "./src/index.cjs"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "dependencies": {
+    "@mh-gg/protocol": "^0.1.1-alpha.20260613T085325975Z"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.cjs",
+    "coverage": "node --test --experimental-test-coverage --test-coverage-lines=80 --test-coverage-functions=80 --test-coverage-branches=80 --test-coverage-include=src/*.cjs test/*.test.cjs"
+  }
+}

package/src/auth.cjs

@@ -0,0 +1,93 @@
+const { findInviteByProof } = require("./invites.cjs");
+const { createJoinRequest } = require("./joinRequests.cjs");
+const {
+  createMemberCredential,
+  issueMemberSecret,
+  memberForProfile,
+  normalizeMemberSecret,
+  verifyMemberProof
+} = require("./members.cjs");
+const { ensureRoomSecurity } = require("./store.cjs");
+const { text } = require("./values.cjs");
+
+function sanitizeProfile(profile, clientId) {
+  const callPubkey = typeof profile?.callPubkey === "string" && /^[0-9a-f]{64}$/i.test(profile.callPubkey)
+    ? profile.callPubkey.toLowerCase()
+    : undefined;
+  const sanitized = {
+    id: text(profile?.id || clientId, 120),
+    name: text(profile?.name || "Guest", 80),
+    avatar: text(profile?.avatar || "✨", 64)
+  };
+  if (callPubkey) sanitized.callPubkey = callPubkey;
+  return sanitized;
+}
+
+function authenticateMember(store, message, profile, now) {
+  const member = store.members?.[message.auth.id];
+  if (!member || member.profileId !== message.clientId) {
+    return { ok: false, code: "bad-member", message: "Member credential was not recognized." };
+  }
+  if (member.bannedAt) return { ok: false, code: "banned", message: "This member is banned from the room." };
+
+  const verification = verifyMemberProof(member, message.auth.proof, store.roomName, message.clientId, profile.callPubkey);
+  if (!verification.ok) return { ok: false, code: "bad-member", message: "Member credential proof did not match." };
+
+  member.lastSeenAt = now;
+  return { ok: true, profile, member, memberSecret: verification.memberSecret };
+}
+
+function authenticateInvite(store, message, profile, now) {
+  const invite = findInviteByProof(store, message.auth, store.roomName, message.clientId, profile.callPubkey);
+  if (!invite) return { ok: false, code: "bad-secret", message: "Room invite proof did not match." };
+  if (invite.status === "disabled" || invite.status === "removed") {
+    return { ok: false, code: "invite-disabled", message: "This invite is no longer active." };
+  }
+  if (invite.status === "retired") {
+    const request = createJoinRequest(store, invite, profile, now);
+    return { ok: false, joinRequested: true, request };
+  }
+  if ((invite.type || "public") === "member" && invite.claimedBy) {
+    return { ok: false, code: "invite-claimed", message: "This invite has already been claimed." };
+  }
+
+  let member = memberForProfile(store, message.clientId);
+  if (member?.bannedAt) return { ok: false, code: "banned", message: "This member is banned from the room." };
+
+  let memberSecret;
+  if (!member) {
+    const credential = createMemberCredential(store, profile, "guest", now);
+    member = credential.member;
+    memberSecret = credential.memberSecret;
+  } else {
+    normalizeMemberSecret(member);
+    memberSecret = issueMemberSecret(member);
+    member.lastSeenAt = now;
+  }
+
+  if ((invite.type || "public") === "member") {
+    invite.claimedBy = member.id;
+    invite.status = "claimed";
+    invite.claimedAt = now;
+  }
+  return { ok: true, profile, member, memberSecret };
+}
+
+function authenticateClientHello(store, message, now = Date.now()) {
+  ensureRoomSecurity(store, now);
+  const profile = sanitizeProfile(message.profile, message.clientId);
+  if (profile.id !== message.clientId) {
+    return { ok: false, code: "bad-profile", message: "Client profile did not match the connection." };
+  }
+  if (store.state.guests[profile.id]?.bannedAt) {
+    return { ok: false, code: "banned", message: "This member is banned from the room." };
+  }
+
+  if (message.auth?.type === "member") return authenticateMember(store, message, profile, now);
+  return authenticateInvite(store, message, profile, now);
+}
+
+module.exports = {
+  authenticateClientHello,
+  sanitizeProfile
+};

package/src/constants.cjs

@@ -0,0 +1,7 @@
+const RETIRED_KEY_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+const DEFAULT_HISTORY_VISIBILITY = "retained-keyring";
+
+module.exports = {
+  DEFAULT_HISTORY_VISIBILITY,
+  RETIRED_KEY_TTL_MS
+};

package/src/crypto.cjs

@@ -0,0 +1,65 @@
+const crypto = require("node:crypto");
+const { createSnowflakeGenerator, prefixedSnowflakeId } = require("@mh-gg/protocol");
+
+const snowflakes = createSnowflakeGenerator({ nodeId: crypto.randomBytes(2).readUInt16BE(0) & 1023 });
+
+function randomId(prefix = "id") {
+  return prefixedSnowflakeId(prefix, snowflakes.next());
+}
+
+function randomSecret(byteLength = 24) {
+  return crypto.randomBytes(byteLength).toString("base64url");
+}
+
+function sha256Hex(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+function normalizeProofString(value) {
+  return String(value || "").normalize("NFC");
+}
+
+function normalizeCallPubkey(callPubkey) {
+  return callPubkey ? normalizeProofString(callPubkey).toLowerCase() : null;
+}
+
+function proofPreimage(purpose, secret, roomName, clientId, callPubkey) {
+  return JSON.stringify([
+    "matterhorn.secret-proof.v2",
+    normalizeProofString(purpose),
+    normalizeProofString(secret),
+    normalizeProofString(roomName),
+    normalizeProofString(clientId),
+    normalizeCallPubkey(callPubkey)
+  ]);
+}
+
+function secretProof(secret, roomName, clientId, callPubkey) {
+  return sha256Hex(proofPreimage("invite", secret, roomName, clientId, callPubkey));
+}
+
+function memberSecretHash(memberSecret) {
+  return sha256Hex(JSON.stringify([
+    "matterhorn.member-secret-hash.v2",
+    normalizeProofString(memberSecret)
+  ]));
+}
+
+function memberSecretProofFromHash(secretHash, roomName, clientId, callPubkey) {
+  return sha256Hex(proofPreimage("member", secretHash, roomName, clientId, callPubkey));
+}
+
+function memberSecretProof(memberSecret, roomName, clientId, callPubkey) {
+  return memberSecretProofFromHash(memberSecretHash(memberSecret), roomName, clientId, callPubkey);
+}
+
+module.exports = {
+  memberSecretHash,
+  memberSecretProof,
+  memberSecretProofFromHash,
+  proofPreimage,
+  randomId,
+  randomSecret,
+  secretProof,
+  sha256Hex
+};

package/src/index.cjs

@@ -0,0 +1,15 @@
+module.exports = {
+  ...require("./auth.cjs"),
+  ...require("./constants.cjs"),
+  ...require("./crypto.cjs"),
+  ...require("./invites.cjs"),
+  ...require("./joinRequests.cjs"),
+  ...require("./keys.cjs"),
+  ...require("./members.cjs"),
+  ...require("./moderation.cjs"),
+  ...require("./roomIndexKey.cjs"),
+  ...require("./rotation.cjs"),
+  ...require("./store.cjs"),
+  ...require("./timing.cjs"),
+  ...require("./views.cjs")
+};

package/src/invites.cjs

@@ -0,0 +1,75 @@
+const { randomId, randomSecret, secretProof } = require("./crypto.cjs");
+const { constantTimeEqualHex } = require("./timing.cjs");
+const { fail } = require("./values.cjs");
+
+function publicInviteForClient(invite) {
+  if (!invite) return undefined;
+  return {
+    id: invite.id,
+    type: invite.type || "public",
+    status: invite.status,
+    secret: invite.secret,
+    createdAt: invite.createdAt,
+    retiredAt: invite.retiredAt,
+    disabledAt: invite.disabledAt,
+    removedAt: invite.removedAt,
+    claimedBy: invite.claimedBy
+  };
+}
+
+function activePublicInvite(store) {
+  return (store.publicInvites || []).find((invite) => (invite.type || "public") === "public" && invite.status === "active");
+}
+
+function createPublicInvite(store, now = Date.now(), type = "public") {
+  const invite = {
+    id: randomId("invite"),
+    type,
+    secret: randomSecret(),
+    status: "active",
+    createdAt: now
+  };
+  store.publicInvites.push(invite);
+  if (type === "public") store.roomSecret = invite.secret;
+  return invite;
+}
+
+function disableInvite(store, inviteId, now = Date.now()) {
+  const invite = (store.publicInvites || []).find((item) => item.id === inviteId);
+  if (!invite || invite.status === "removed") return fail("Invite not found.");
+  if (invite.status === "active") {
+    invite.status = "disabled";
+    invite.disabledAt = now;
+  }
+  return { ok: true, invite };
+}
+
+function removeInvite(store, inviteId, now = Date.now()) {
+  const invite = (store.publicInvites || []).find((item) => item.id === inviteId);
+  if (!invite) return fail("Invite not found.");
+  invite.status = "removed";
+  invite.removedAt = now;
+  return { ok: true, invite };
+}
+
+function findInviteByProof(store, auth, roomName, clientId, callPubkey) {
+  const invites = store.publicInvites || [];
+  if (auth?.type !== "invite" || !auth.proof) return undefined;
+
+  if (auth.id) {
+    const invite = invites.find((item) => item.id === auth.id);
+    if (!invite) return undefined;
+    return constantTimeEqualHex(secretProof(invite.secret, roomName, clientId, callPubkey), auth.proof) ? invite : undefined;
+  }
+
+  return invites.find((invite) => constantTimeEqualHex(secretProof(invite.secret, roomName, clientId, callPubkey), auth.proof));
+}
+
+module.exports = {
+  activePublicInvite,
+  createPublicInvite,
+  disableInvite,
+  findInviteByProof,
+  publicInviteForClient,
+  removeInvite
+};

package/src/joinRequests.cjs

@@ -0,0 +1,55 @@
+const { randomId } = require("./crypto.cjs");
+const { createMemberCredential, memberForProfile } = require("./members.cjs");
+const { fail, text } = require("./values.cjs");
+
+function createJoinRequest(store, invite, profile, now = Date.now()) {
+  const existing = Object.values(store.joinRequests || {}).find((request) => {
+    return request.status === "pending" && request.inviteId === invite.id && request.profileId === profile.id;
+  });
+  if (existing) return existing;
+
+  const request = {
+    id: randomId("join"),
+    inviteId: invite.id,
+    profileId: profile.id,
+    profile,
+    status: "pending",
+    createdAt: now
+  };
+  store.joinRequests[request.id] = request;
+  return request;
+}
+
+function approveJoinRequest(store, requestId, now = Date.now()) {
+  const request = store.joinRequests[text(requestId, 120)];
+  if (!request || request.status !== "pending") return fail("Join request not found.");
+  let member = memberForProfile(store, request.profileId);
+  if (member?.bannedAt) return fail("This member is banned from the room.");
+
+  let memberSecret;
+  if (!member) {
+    const credential = createMemberCredential(store, request.profile, "guest", now);
+    member = credential.member;
+    memberSecret = credential.memberSecret;
+  }
+
+  request.status = "approved";
+  request.decidedAt = now;
+  request.memberId = member.id;
+  if (memberSecret) request.memberSecret = memberSecret;
+  return { ok: true, request, member, memberSecret };
+}
+
+function denyJoinRequest(store, requestId, now = Date.now()) {
+  const request = store.joinRequests[text(requestId, 120)];
+  if (!request || request.status !== "pending") return fail("Join request not found.");
+  request.status = "denied";
+  request.decidedAt = now;
+  return { ok: true, request };
+}
+
+module.exports = {
+  approveJoinRequest,
+  createJoinRequest,
+  denyJoinRequest
+};

package/src/keys.cjs

@@ -0,0 +1,190 @@
+const crypto = require("node:crypto");
+const { DEFAULT_HISTORY_VISIBILITY, RETIRED_KEY_TTL_MS } = require("./constants.cjs");
+const { randomId, randomSecret } = require("./crypto.cjs");
+
+const KEY_EPOCH_GRANT_KIND = "matterhorn.key-epoch-grant";
+const KEY_EPOCH_GRANT_VERSION = 1;
+const KEY_EPOCH_WRAP_ALG = "x25519+hkdf-sha256+aes-256-gcm";
+
+function base64url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+
+function fromBase64url(value) {
+  return Buffer.from(String(value || ""), "base64url");
+}
+
+function epochStatus(epoch) {
+  return epoch?.retiredAt ? "retired" : "active";
+}
+
+function keyEpochMetadata(epoch) {
+  if (!epoch) return undefined;
+  const metadata = {
+    id: epoch.id,
+    index: epoch.index,
+    createdAt: epoch.createdAt,
+    status: epochStatus(epoch)
+  };
+  if (epoch.retiredAt !== undefined) metadata.retiredAt = epoch.retiredAt;
+  if (epoch.historyVisibility) metadata.historyVisibility = epoch.historyVisibility;
+  return metadata;
+}
+
+function grantAad(grant) {
+  return Buffer.from(JSON.stringify([
+    "matterhorn.key-epoch-grant.v1",
+    grant.roomName,
+    grant.epochId,
+    grant.recipientMemberId,
+    grant.recipientDeviceId,
+    grant.recipientEncryptionKeyId
+  ]), "utf8");
+}
+
+function grantKey(sharedSecret, grant) {
+  return Buffer.from(crypto.hkdfSync(
+    "sha256",
+    sharedSecret,
+    grantAad(grant),
+    Buffer.from("matterhorn:key-epoch-grant:v1", "utf8"),
+    32
+  ));
+}
+
+function publicKeyFromSpkiBase64url(value) {
+  return crypto.createPublicKey({ key: fromBase64url(value), type: "spki", format: "der" });
+}
+
+function privateKeyFromPkcs8Base64url(value) {
+  return crypto.createPrivateKey({ key: fromBase64url(value), type: "pkcs8", format: "der" });
+}
+
+function createKeyEpochGrant(store, epoch, recipient, now = Date.now()) {
+  if (!epoch?.epochKey) throw new Error("epochKey is required");
+  if (!recipient?.memberId || !recipient?.deviceId || !recipient?.encryptionKeyId || !recipient?.encryptionPublicKey) {
+    throw new Error("recipient encryption key is required");
+  }
+  const recipientPublicKey = publicKeyFromSpkiBase64url(recipient.encryptionPublicKey);
+  const ephemeral = crypto.generateKeyPairSync("x25519");
+  const sharedSecret = crypto.diffieHellman({ privateKey: ephemeral.privateKey, publicKey: recipientPublicKey });
+  const grant = {
+    kind: KEY_EPOCH_GRANT_KIND,
+    version: KEY_EPOCH_GRANT_VERSION,
+    roomName: store.roomName,
+    epochId: epoch.id,
+    epochIndex: epoch.index,
+    recipientMemberId: recipient.memberId,
+    recipientDeviceId: recipient.deviceId,
+    recipientEncryptionKeyId: recipient.encryptionKeyId,
+    createdAt: now,
+    wrap: {
+      alg: KEY_EPOCH_WRAP_ALG,
+      ephemeralPublicKey: base64url(ephemeral.publicKey.export({ type: "spki", format: "der" }))
+    }
+  };
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", grantKey(sharedSecret, grant), iv);
+  cipher.setAAD(grantAad(grant));
+  const encrypted = Buffer.concat([cipher.update(Buffer.from(epoch.epochKey, "utf8")), cipher.final(), cipher.getAuthTag()]);
+  grant.wrap.iv = base64url(iv);
+  grant.wrappedEpochKey = base64url(encrypted);
+  return grant;
+}
+
+function unwrapKeyEpochGrant(grant, recipientIdentity) {
+  if (!grant || grant.kind !== KEY_EPOCH_GRANT_KIND || grant.version !== KEY_EPOCH_GRANT_VERSION) throw new Error("Key epoch grant is invalid.");
+  if (grant.wrap?.alg !== KEY_EPOCH_WRAP_ALG) throw new Error("Key epoch grant wrap algorithm is invalid.");
+  if (recipientIdentity?.keyId !== grant.recipientEncryptionKeyId) throw new Error("Key epoch grant recipient does not match.");
+  const privateKey = privateKeyFromPkcs8Base64url(recipientIdentity.privateKey);
+  const ephemeralPublicKey = publicKeyFromSpkiBase64url(grant.wrap.ephemeralPublicKey);
+  const sharedSecret = crypto.diffieHellman({ privateKey, publicKey: ephemeralPublicKey });
+  const bytes = fromBase64url(grant.wrappedEpochKey);
+  if (bytes.length < 17) throw new Error("Key epoch grant ciphertext is invalid.");
+  const ciphertext = bytes.subarray(0, bytes.length - 16);
+  const authTag = bytes.subarray(bytes.length - 16);
+  const decipher = crypto.createDecipheriv("aes-256-gcm", grantKey(sharedSecret, grant), fromBase64url(grant.wrap.iv));
+  decipher.setAAD(grantAad(grant));
+  decipher.setAuthTag(authTag);
+  const epochKey = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+  return {
+    id: grant.epochId,
+    index: grant.epochIndex,
+    epochKey,
+    createdAt: grant.createdAt
+  };
+}
+
+function activeKeyEpoch(store) {
+  return (store.keyEpochs || []).find((epoch) => !epoch.retiredAt) || store.keyEpochs?.[store.keyEpochs.length - 1];
+}
+
+function isKeyEpoch(epoch) {
+  return Boolean(epoch)
+    && typeof epoch.id === "string"
+    && typeof epoch.epochKey === "string"
+    && epoch.epochKey.length > 0
+    && Number.isFinite(epoch.createdAt);
+}
+
+function normalizeKeyEpochs(store) {
+  let nextIndex = 1;
+  store.keyEpochs = (store.keyEpochs || [])
+    .filter(isKeyEpoch)
+    .map((epoch) => {
+      const index = Number.isInteger(epoch.index) && epoch.index > 0 ? epoch.index : nextIndex;
+      nextIndex = Math.max(nextIndex, index + 1);
+      return { ...epoch, index };
+    });
+  return store.keyEpochs;
+}
+
+function retainedKeyEpochs(store, now = Date.now()) {
+  return (store.keyEpochs || []).filter((epoch) => !epoch.retiredAt || now - epoch.retiredAt <= RETIRED_KEY_TTL_MS);
+}
+
+function pruneRetiredKeyEpochs(store, now = Date.now()) {
+  const active = activeKeyEpoch(store);
+  store.keyEpochs = retainedKeyEpochs(store, now);
+  if (active && !store.keyEpochs.some((epoch) => epoch.id === active.id)) store.keyEpochs.push(active);
+}
+
+function createKeyEpoch(store, now = Date.now(), epochKey = randomSecret(32), historyVisibility = store?.historyVisibility || DEFAULT_HISTORY_VISIBILITY) {
+  const nextIndex = (store.keyEpochs || []).reduce((max, epoch) => Math.max(max, Number.isInteger(epoch.index) ? epoch.index : 0), 0) + 1;
+  const epoch = {
+    id: randomId("epoch"),
+    index: nextIndex,
+    epochKey,
+    createdAt: now,
+    historyVisibility
+  };
+  store.keyEpochs.push(epoch);
+  return epoch;
+}
+
+function keyringForClient(store, recipient, now = Date.now()) {
+  const retained = retainedKeyEpochs(store);
+  const grants = recipient?.encryptionPublicKey
+    ? retained.map((epoch) => createKeyEpochGrant(store, epoch, recipient, now))
+    : [];
+  return {
+    activeKeyEpoch: keyEpochMetadata(activeKeyEpoch(store)),
+    keyEpochs: retained.map(keyEpochMetadata),
+    keyEpochGrants: grants
+  };
+}
+
+module.exports = {
+  KEY_EPOCH_GRANT_KIND,
+  KEY_EPOCH_GRANT_VERSION,
+  KEY_EPOCH_WRAP_ALG,
+  activeKeyEpoch,
+  createKeyEpoch,
+  createKeyEpochGrant,
+  keyEpochMetadata,
+  keyringForClient,
+  normalizeKeyEpochs,
+  pruneRetiredKeyEpochs,
+  retainedKeyEpochs,
+  unwrapKeyEpochGrant
+};

package/src/members.cjs

@@ -0,0 +1,74 @@
+const { memberSecretHash, memberSecretProofFromHash, randomId, randomSecret } = require("./crypto.cjs");
+const { constantTimeEqualHex } = require("./timing.cjs");
+
+function memberForProfile(store, profileId) {
+  return Object.values(store.members || {}).find((member) => member.profileId === profileId);
+}
+
+function issueMemberSecret(member) {
+  const memberSecret = randomSecret();
+  member.secretHash = memberSecretHash(memberSecret);
+  delete member.secret;
+  return memberSecret;
+}
+
+function normalizeMemberSecret(member) {
+  if (!member) return undefined;
+  if (!member.secretHash && member.secret) member.secretHash = memberSecretHash(member.secret);
+  delete member.secret;
+  return member.secretHash;
+}
+
+function normalizeMembers(store) {
+  for (const member of Object.values(store.members || {})) {
+    normalizeMemberSecret(member);
+  }
+}
+
+function createMemberCredential(store, profile, role = "guest", now = Date.now()) {
+  const member = {
+    id: randomId("member"),
+    profileId: profile.id,
+    role,
+    createdAt: now,
+    lastSeenAt: now
+  };
+  const memberSecret = issueMemberSecret(member);
+  store.members[member.id] = member;
+  return { member, memberSecret };
+}
+
+function verifyMemberProof(member, proof, roomName, clientId, callPubkey) {
+  const secretHash = normalizeMemberSecret(member);
+  if (secretHash && constantTimeEqualHex(memberSecretProofFromHash(secretHash, roomName, clientId, callPubkey), proof)) return { ok: true };
+  return { ok: false };
+}
+
+function activeAdminProfileIds(store) {
+  const adminIds = new Set(store.state.adminIds || []);
+  for (const member of Object.values(store.members || {})) {
+    if (member.role === "admin") adminIds.add(member.profileId);
+  }
+  return Array.from(adminIds).filter((profileId) => {
+    const guest = store.state.guests[profileId];
+    const member = memberForProfile(store, profileId);
+    return !guest?.bannedAt && !member?.bannedAt;
+  });
+}
+
+function setMemberAdmin(store, member, enabled) {
+  member.role = enabled ? "admin" : "guest";
+  if (enabled && !store.state.adminIds.includes(member.profileId)) store.state.adminIds.push(member.profileId);
+  if (!enabled) store.state.adminIds = store.state.adminIds.filter((id) => id !== member.profileId);
+}
+
+module.exports = {
+  activeAdminProfileIds,
+  createMemberCredential,
+  issueMemberSecret,
+  memberForProfile,
+  normalizeMemberSecret,
+  normalizeMembers,
+  setMemberAdmin,
+  verifyMemberProof
+};

package/src/moderation.cjs

@@ -0,0 +1,56 @@
+const { activeAdminProfileIds, memberForProfile } = require("./members.cjs");
+const { rotatePublicInviteAndKey } = require("./rotation.cjs");
+const { ensureRoomSecurity } = require("./store.cjs");
+const { fail, text } = require("./values.cjs");
+
+function banMember(store, targetProfileId, options = {}) {
+  ensureRoomSecurity(store, options.now || Date.now());
+  const target = store.state.guests[text(targetProfileId, 120)];
+  if (!target) return fail("Guest not found.");
+  if (options.actorProfileId && target.id === options.actorProfileId) return fail("Admins cannot ban themselves.");
+  if (activeAdminProfileIds(store).includes(target.id) && activeAdminProfileIds(store).length <= 1) {
+    return fail("Cannot ban the last active admin.");
+  }
+
+  const now = options.now || Date.now();
+  const targetMember = target.memberId ? store.members[target.memberId] : memberForProfile(store, target.id);
+  if (targetMember) {
+    targetMember.bannedAt = now;
+    targetMember.banReason = text(options.reason, 300);
+    targetMember.role = "guest";
+  }
+  target.bannedAt = now;
+  target.banReason = text(options.reason, 300);
+  target.chatDisabled = true;
+  target.role = "guest";
+  delete store.admins[target.id];
+  store.state.adminIds = store.state.adminIds.filter((id) => id !== target.id);
+
+  const result = { ok: true, closeProfileIds: [target.id] };
+  if (options.rotateSecrets) {
+    rotatePublicInviteAndKey(store, now);
+    result.rotated = true;
+  }
+  return result;
+}
+
+function unbanMember(store, targetProfileId, options = {}) {
+  ensureRoomSecurity(store, options.now || Date.now());
+  const target = store.state.guests[text(targetProfileId, 120)];
+  if (!target) return fail("Guest not found.");
+
+  const targetMember = target.memberId ? store.members[target.memberId] : memberForProfile(store, target.id);
+  if (targetMember) {
+    delete targetMember.bannedAt;
+    delete targetMember.banReason;
+  }
+  delete target.bannedAt;
+  delete target.banReason;
+  target.chatDisabled = false;
+  return { ok: true, openProfileIds: [target.id] };
+}
+
+module.exports = {
+  banMember,
+  unbanMember
+};