@mmmbuto/nexuscrew 0.9.57 → 0.9.59

package/lib/notify/asks.js

@@ -17,6 +17,22 @@ const MAX_OPEN = 100;
 // che arrivano da un peer e quelle poste da questo nodo sono due classi
 // distinte, e le prime non devono poter esaurire il budget delle seconde.
 const MAX_OPEN_IMPORTED = 100;
+const MAX_IMPORTED_DISMISSALS = 1000;
+const SYNC_STATES = new Set(['pending', 'confirmed-dismissed', 'confirmed-answered', 'blocked']);
+function askFingerprint(ask) {
+  return crypto.createHash('sha256').update(JSON.stringify([String(ask.question || ''), Array.isArray(ask.options) ? ask.options : [], String(ask.session || '')])).digest('hex');
+}
+function validDismissals(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) && Object.entries(value).every(([key, r]) =>
+    r && key === `${r.ownerId}|${r.ownerAskId}` && /^[a-f0-9]{32}$/.test(r.ownerId) && /^[a-f0-9]{8}$/.test(r.ownerAskId)
+    && /^[a-f0-9]{64}$/.test(r.ownerAskFingerprint) && SYNC_STATES.has(r.syncState)
+    && ['known', 'unknown'].includes(r.generation)
+    && (r.generation === 'unknown' ? r.ownerAskTs === null : Number.isSafeInteger(r.ownerAskTs) && r.ownerAskTs > 0)
+    && (r.cellId === undefined || (typeof r.cellId === 'string' && /^[A-Za-z0-9._-]{1,32}$/.test(r.cellId)))
+    && r.dismissed === true && Number.isSafeInteger(r.attempts) && r.attempts >= 0
+    && Number.isFinite(r.nextRetryAt) && r.nextRetryAt >= 0
+    && r.dismissedReason === 'owner-unreachable' && Number.isFinite(r.dismissedTs));
+}
 const MAX_KEEP = 100;          // ask totali persistiti (i piu' vecchi answered si potano)
 const MAX_QUESTION = 2000;
 const MAX_OPTIONS = 8;
@@ -39,11 +55,14 @@ function createAsksStore(opts = {}) {
   //    per non sovrascrivere il file malformato con un defaults vuoto, che
   //    cancellerebbe le domande aperte.
   let asks = null;
+  let importedDismissals = null;
+  const dismissalCap = opts.maxImportedDismissals || MAX_IMPORTED_DISMISSALS;
   function load() {
     if (asks) return asks;
     const r = readJsonStrict(filePath);
-    if (r.state === 'absent') { asks = []; return asks; }
-    if (r.state === 'ok' && Array.isArray(r.value.asks)) {
+    if (r.state === 'absent') { asks = []; importedDismissals = {}; return asks; }
+    if (r.state === 'ok' && Array.isArray(r.value.asks) && (r.value.importedDismissals === undefined || validDismissals(r.value.importedDismissals))) {
+      importedDismissals = r.value.importedDismissals || {};
       asks = r.value.asks.filter((a) => a && typeof a === 'object' && typeof a.id === 'string');
       return asks;
     }
@@ -58,7 +77,8 @@ function createAsksStore(opts = {}) {
     if (asks) return { readable: true };
     const r = readJsonStrict(filePath);
     if (r.state === 'absent') return { readable: true };
-    if (r.state === 'ok' && Array.isArray(r.value.asks)) return { readable: true };
+    if (r.state === 'ok' && Array.isArray(r.value.asks) && (r.value.importedDismissals === undefined || validDismissals(r.value.importedDismissals))) return { readable: true };
+    if (r.state === 'ok' && r.value.importedDismissals !== undefined && !validDismissals(r.value.importedDismissals)) return { readable: false, reason: 'malformed imported dismissals' };
     const reason = r.state === 'malformed'
       ? r.reason
       : `forma invalida: 'asks' non e' un array (${r.value && r.value.asks !== undefined ? typeof r.value.asks : 'assente'})`;
@@ -86,7 +106,7 @@ function createAsksStore(opts = {}) {
       const drop = new Set(answered.slice(0, excess).map((a) => a.id));
       asks = list.filter((a) => !drop.has(a.id));
     }
-    atomicWriteJson(filePath, { asks: load() });
+    atomicWriteJson(filePath, { asks: load(), importedDismissals: importedDismissals || {} });
   }
 
   // Validazione input fail-closed. Ritorna {ok:false,error} o {ok:true,value}.
@@ -121,7 +141,7 @@ function createAsksStore(opts = {}) {
   // L'`id` locale e' nostro e all'owner non dice nulla; e' la coppia che nomina
   // lo STESSO oggetto sui due nodi, quindi e' la chiave con cui si riconcilia.
   function findImported(ownerId, ownerAskId) {
-    return load().find((a) => isImported(a) && a.ownerId === String(ownerId)
+    return load().slice().reverse().find((a) => isImported(a) && a.ownerId === String(ownerId)
       && a.ownerAskId === String(ownerAskId)) || null;
   }
 
@@ -132,6 +152,11 @@ function createAsksStore(opts = {}) {
     const ur = unreadableGuard();
     if (ur) return { ok: false, reason: 'store-unreadable', changed: false, ask: null };
     const ask = findImported(ownerId, ownerAskId);
+    const record = getImportedDismissal(ownerId, ownerAskId);
+    if (record) {
+      const synced = updateImportedDismissal(ownerId, ownerAskId, { syncState: outcome === 'answered' ? 'confirmed-answered' : 'confirmed-dismissed', ownerOutcome: outcome });
+      if (!synced.ok) return { ...synced, changed: false, ask: null };
+    }
     if (!ask) return { ok: true, changed: false, ask: null };
     if (ask.answered || ask.dismissed) return { ok: true, changed: false, ask };
     if (outcome === 'answered') { ask.answered = true; ask.answeredReconciled = true; }
@@ -141,7 +166,7 @@ function createAsksStore(opts = {}) {
     return { ok: true, changed: true, ask };
   }
 
-  function create({ question, options, session, ownerId, ownerAskId, originNode, originCell }) {
+  function create({ question, options, session, ownerId, ownerAskId, originNode, originCell, ownerAskTs }) {
     const ur = unreadableGuard();
     if (ur) return { ok: false, reason: 'store-unreadable', error: `store illeggibile (${ur}): creazione rifiutata` };
     const v = validate({ question, options });
@@ -152,7 +177,12 @@ function createAsksStore(opts = {}) {
     // se ne crea un secondo.
     if (originNode && ownerId && ownerAskId) {
       const existing = findImported(ownerId, ownerAskId);
-      if (existing) return { ok: true, ask: existing, deduped: true };
+      const incoming = { id: ownerAskId, question: v.value.question, options: v.value.options, session: String(session || ''), originNode, ownerAskTs };
+      if (isImportedDismissed(ownerId, incoming)) return { ok: true, ask: existing, suppressed: true, deduped: !!existing };
+      if (existing && askFingerprint(existing) === askFingerprint(incoming)
+        && (generationTs(existing) === null || generationTs(incoming) === null || generationTs(existing) === generationTs(incoming))) {
+        return { ok: true, ask: existing, deduped: true };
+      }
     }
     // Cap duro sugli aperti, SEPARATO PER CLASSE: gli importati non consumano il
     // budget dei locali. Con un cap unico, cento domande ricevute da un peer
@@ -188,6 +218,7 @@ function createAsksStore(opts = {}) {
       // ri-esportato (nessun loop A->B->A). Un ask locale non ha questo campo.
       ...(originNode ? { originNode: String(originNode) } : {}),
       ...(originCell ? { originCell: String(originCell) } : {}),
+      ...(Number.isSafeInteger(ownerAskTs) && ownerAskTs > 0 ? { ownerAskTs } : {}),
       ts: now(),
       revision: 0,
       answered: false,
@@ -208,6 +239,83 @@ function createAsksStore(opts = {}) {
       .map((a) => ({ ...a, ...(a.options ? { options: a.options.slice() } : {}) }));
   }
 
+  function getImportedDismissal(ownerId, askId) {
+    load();
+    const record = importedDismissals && importedDismissals[`${ownerId}|${askId}`];
+    return record ? { ...record } : null;
+  }
+  function listImportedDismissals() {
+    load();
+    return Object.values(importedDismissals || {}).map(r => ({ ...r }));
+  }
+  function generationTs(ask) {
+    const ts = Object.hasOwn(ask, 'ownerAskTs') ? ask.ownerAskTs : ask.originNode ? null : ask.ts;
+    return Number.isSafeInteger(ts) && ts > 0 ? ts : null;
+  }
+  function sameImportedGeneration(a, b) {
+    const at = generationTs(a), bt = generationTs(b);
+    return askFingerprint(a) === askFingerprint(b) && (at === null || bt === null || at === bt);
+  }
+  function isImportedDismissed(ownerId, ask) {
+    const record = getImportedDismissal(ownerId, ask.ownerAskId || ask.id);
+    if (!record || record.ownerAskFingerprint !== askFingerprint(ask)) return false;
+    // Historical imports have no original owner timestamp. Reusing an id with
+    // identical content remains suppressed; this is not proof of historical identity.
+    const ts = generationTs(ask);
+    return record.generation === 'unknown' || ts === null || record.ownerAskTs === ts;
+  }
+  function dismissalTransaction(change) {
+    const ur = unreadableGuard();
+    if (ur) return { ok: false, reason: 'store-unreadable' };
+    load();
+    const beforeAsks = asks.map(a => ({ ...a }));
+    const beforeRecords = Object.fromEntries(Object.entries(importedDismissals).map(([k, r]) => [k, { ...r }]));
+    try { const result = change(); if (!result.ok) return result; save(); return result; }
+    catch (_) { asks = beforeAsks; importedDismissals = beforeRecords; return { ok: false, reason: 'persist-failed' }; }
+  }
+  function dismissImported({ ownerId, ownerAskId, ask, cellId, retryBinding, syncState = 'pending' } = {}) {
+    return dismissalTransaction(() => {
+      if (!/^[a-f0-9]{32}$/.test(ownerId) || !/^[a-f0-9]{8}$/.test(ownerAskId) || !ask || (ask.ownerAskId || ask.id) !== ownerAskId) return { ok: false, reason: 'unknown' };
+      const candidate = findImported(ownerId, ownerAskId);
+      const alias = candidate && sameImportedGeneration(candidate, ask) ? candidate : null;
+      if (alias && answering.has(alias.id)) return { ok: false, reason: 'answering' };
+      if (ask.answered || (alias && alias.answered)) return { ok: false, reason: 'answered' };
+      const key = `${ownerId}|${ownerAskId}`;
+      const existing = importedDismissals[key];
+      if (existing && isImportedDismissed(ownerId, ask)) return { ok: true, record: { ...existing }, idempotent: true };
+      if (!existing && Object.keys(importedDismissals).length >= dismissalCap) return { ok: false, reason: 'dismissal-cap' };
+      const ts = generationTs(ask);
+      const record = { ownerId, ownerAskId, ...(cellId ? { cellId } : {}), ...(alias ? { localAliasId: alias.id } : {}),
+        dismissed: true, dismissedReason: 'owner-unreachable', dismissedTs: now(),
+        generation: ts === null ? 'unknown' : 'known', ownerAskTs: ts,
+        ownerAskFingerprint: askFingerprint(ask), syncState, attempts: 0, nextRetryAt: 0,
+        ...(syncState === 'blocked' ? { lastReason: 'permission-denied', ...(retryBinding ? { retryBinding } : {}) } : {}) };
+      importedDismissals[key] = record;
+      if (alias) {
+        if (!alias.dismissed) { alias.dismissed = true; alias.dismissedTs = now(); alias.revision = (alias.revision || 0) + 1; }
+        alias.dismissedReason = 'owner-unreachable';
+      }
+      return { ok: true, record: { ...record } };
+    });
+  }
+  function updateImportedDismissal(ownerId, askId, patch) {
+    return dismissalTransaction(() => {
+      const record = importedDismissals[`${ownerId}|${askId}`];
+      if (!record) return { ok: false, reason: 'unknown' };
+      const next = { ...record, ...patch };
+      if (!validDismissals({ [`${ownerId}|${askId}`]: next })) return { ok: false, reason: 'invalid' };
+      importedDismissals[`${ownerId}|${askId}`] = next;
+      return { ok: true, record: { ...next } };
+    });
+  }
+  function adoptImportedDismissal(ownerId, askId, ask) {
+    const record = getImportedDismissal(ownerId, askId);
+    const ts = generationTs(ask);
+    if (!record || (ask.ownerAskId || ask.id) !== askId || ts === null || record.ownerAskFingerprint !== askFingerprint(ask)
+      || (record.generation === 'known' && record.ownerAskTs !== ts)) return { ok: false, reason: 'generation-mismatch' };
+    return updateImportedDismissal(ownerId, askId, { generation: 'known', ownerAskTs: ts });
+  }
+
   // --- ciclo answer (da revisione): claim atomico open -> answering ---------------
   // Node e' single-threaded ma il paste e' un await: due answer concorrenti
   // superavano entrambe il check `answered` prima che una marcasse. Il claim
@@ -301,7 +409,7 @@ function createAsksStore(opts = {}) {
     return commit(id, text);
   }
 
-  return { create, get, list, openCount, isImported, findImported, closeImported, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, health, filePath, MAX_OPEN, MAX_OPEN_IMPORTED };
+  return { sameImportedGeneration, dismissImported, getImportedDismissal, listImportedDismissals, isImportedDismissed, updateImportedDismissal, adoptImportedDismissal, askFingerprint, create, get, list, openCount, isImported, findImported, closeImported, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, health, filePath, MAX_OPEN, MAX_OPEN_IMPORTED };
 }
 
-module.exports = { createAsksStore };
+module.exports = { createAsksStore, askFingerprint };

package/lib/notify/event-feed-asks-routes.js

@@ -5,46 +5,81 @@
 //   DELETE /event-feed/asks/:id                                    (dismiss)
 //   GET    /event-feed/asks/:id/requests/:requestId               (attempt status)
 //
-// The gate is the SAME as the stream/snapshot gate (kill-switch -> proven
-// federated origin -> exact [clientId, ownerId] -> known peer -> eventsAccess)
-// PLUS askReplyAccess plus the ask's own cell scope read from the ask store.
+// The action gate verifies the bounded origin chain and the delivering peer,
+// then intersects fresh ASK grants and the authoritative ask cell scope.
+// It is independent of the stream/snapshot gate and local feed reception.
 // Unknown and out-of-scope ids get the SAME opaque 404: an id that does not
 // exist and an id the peer may not see must be indistinguishable. Answer and
 // dismiss run on a DEDICATED budget (6/min/peer, 30/min global) that shares
 // nothing with notify/audio/local ask creation.
 
 const express = require('express');
-const { createFeedGate } = require('./event-feed-routes.js');
+const nodesStore = require('../nodes/store.js');
+const accessPresets = require('../nodes/access-presets.js');
+const { createAudioAcl } = require('../audio/acl.js');
+const { visibilityAllows } = require('./event-feed-acl.js');
 
 const ANSWER_RATE_PER_MIN = 6;
 const ANSWER_GLOBAL_PER_MIN = 30;
 
 function createAskRateLimiter({ now = Date.now } = {}) {
   const perPeer = new Map();
+  const perOrigin = new Map();
   const global = [];
   function prune(list, t) {
     const cutoff = t - 60000;
     while (list.length > 0 && list[0] <= cutoff) list.shift();
   }
-  function check(peerId) {
+  function check(peerId, actorId = peerId) {
     const t = now();
     const list = perPeer.get(peerId) || [];
-    prune(list, t); prune(global, t);
-    if (list.length >= ANSWER_RATE_PER_MIN || global.length >= ANSWER_GLOBAL_PER_MIN) {
+    const origin = perOrigin.get(actorId) || [];
+    prune(list, t); prune(origin, t); prune(global, t);
+    if (list.length >= ANSWER_RATE_PER_MIN || origin.length >= ANSWER_RATE_PER_MIN || global.length >= ANSWER_GLOBAL_PER_MIN) {
       return { allowed: false, reason: 'answer-rate' };
     }
-    list.push(t); perPeer.set(peerId, list); global.push(t);
+    list.push(t); perPeer.set(peerId, list); origin.push(t); perOrigin.set(actorId, origin); global.push(t);
     return { allowed: true };
   }
   return { check };
 }
 
+function createAskActionGate(deps) {
+  return async (req, res) => {
+    const refuse = (code, reason) => { res.status(code).json({ error: 'forbidden', reason }); return null; };
+    if (deps.eventsEnabled() !== true) return refuse(403, 'events-disabled');
+    const resolved = await deps.originResolver.resolve(req, { requireCell: false });
+    if (!resolved.ok) return refuse(403, resolved.reason);
+    if (resolved.trust !== 'federated') return refuse(403, 'federated-origin-required');
+    const visited = resolved.visited || [];
+    const self = deps.localNodeId();
+    if (visited.length < 2 || visited.at(-1) !== self) return refuse(403, 'hop-chain');
+    const st = nodesStore.loadStore(deps.nodesPath);
+    if (!st) return refuse(503, 'store-unavailable');
+    const deliveringId = visited.at(-2);
+    const delivering = (st.nodes || []).filter((n) => n && n.nodeId === deliveringId);
+    if (delivering.length !== 1) return refuse(403, 'peer-unknown');
+    const acl = createAudioAcl({ nodesPath: deps.nodesPath, loadStoreImpl: () => st });
+    const visibility = acl.allows(resolved);
+    if (!visibility.allowed) return refuse(403, visibility.reason);
+    const actor = resolved.origin.node;
+    const origins = actor === deliveringId ? [] : (st.nodes || []).filter((n) => n && n.nodeId === actor);
+    if (origins.length > 1) return refuse(403, 'peer-unknown');
+    const grants = [delivering[0], ...origins].map((node) => accessPresets.grantsOf(node));
+    if (grants.some((view) => !view.configured || view.grants.eventsAccess !== true || view.grants.askReplyAccess !== true)) {
+      return refuse(403, 'grant-required:ask-action');
+    }
+    return { self, actor, peer: { nodeId: deliveringId, grants: grants[0].grants,
+      allows: ({ cellId }) => grants.every((view) => visibilityAllows(view.grants, cellId)) } };
+  };
+}
+
 function createEventFeedAsksRoutes(deps) {
   const r = express.Router();
   const json = express.json({ limit: '16kb' });
   // deps: { nodesPath, localNodeId, originResolver, eventsEnabled, asks,
   //         answerService, cellForSession, log }
-  const gate = createFeedGate(deps);
+  const gate = createAskActionGate(deps);
   const rate = createAskRateLimiter({ now: deps.now });
   const log = typeof deps.log === 'function' ? deps.log : () => {};
 
@@ -59,10 +94,23 @@ function createEventFeedAsksRoutes(deps) {
     return { ask, cellId };
   }
 
+  r.get('/:id/capability', async (req, res) => {
+    const g = await gate(req, res);
+    if (!g) return;
+    const askId = String(req.params.id || '');
+    const resolved = resolveAskForPeer(g.peer, askId);
+    const readonly = deps.readonly && deps.readonly();
+    const status = !resolved || readonly ? 'denied'
+      : resolved.ask.dismissed ? 'dismissed' : resolved.ask.answered ? 'answered' : 'open';
+    return res.json({ ownerId: g.self, askId, canReply: status === 'open', status,
+      ...(resolved && !readonly ? { generationPrecondition: true, ask: { id: resolved.ask.id, ts: resolved.ask.ts, question: resolved.ask.question,
+        ...(resolved.ask.options ? { options: resolved.ask.options } : {}), session: resolved.ask.session } } : {}) });
+  });
+
   r.post('/:id/answer', json, async (req, res) => {
     const g = await gate(req, res);
     if (!g) return;
-    const verdict = rate.check(g.peer.nodeId);
+    const verdict = rate.check(g.peer.nodeId, g.actor);
     if (!verdict.allowed) return res.status(429).json({ error: 'answer rate', reason: verdict.reason });
     if (deps.readonly && deps.readonly()) {
       return res.status(403).json({ error: 'READONLY: mutazione bloccata' });
@@ -85,13 +133,14 @@ function createEventFeedAsksRoutes(deps) {
     const resolved = resolveAskForPeer(g.peer, askId);
     if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
     const out = await deps.answerService.answerFederated({
-      askId, text: body.text, peerId: g.peer.nodeId, requestId: body.requestId,
+      askId, text: body.text, peerId: g.actor, requestId: body.requestId,
     });
     if (out.ok) {
       // La chiusura nasce dal servizio; qui si aspetta il recapito, cosi' chi ha
       // risposto non vede una risposta che precede la chiusura dei peer.
       if (out.closure) { try { await out.closure; } catch (_) {} }
-      return res.json({ status: out.replay ? out.state : 'committed', requestId: body.requestId });
+      return res.json({ status: out.replay ? out.state : 'committed', requestId: body.requestId,
+        ownerId: g.self, askId, actor: g.actor });
     }
     return res.status(out.code || 500).json({ error: out.error, reason: out.reason });
   });
@@ -99,7 +148,7 @@ function createEventFeedAsksRoutes(deps) {
   r.delete('/:id', async (req, res) => {
     const g = await gate(req, res);
     if (!g) return;
-    const verdict = rate.check(g.peer.nodeId);
+    const verdict = rate.check(g.peer.nodeId, g.actor);
     if (!verdict.allowed) return res.status(429).json({ error: 'answer rate', reason: verdict.reason });
     if (deps.readonly && deps.readonly()) {
       return res.status(403).json({ error: 'READONLY: mutazione bloccata' });
@@ -110,15 +159,26 @@ function createEventFeedAsksRoutes(deps) {
     const askId = String(req.params.id || '');
     const resolved = resolveAskForPeer(g.peer, askId);
     if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
-    // Local answer in flight wins: 409, and a dismissed ask is not answerable.
+    const expected = req.headers['x-nexuscrew-ask-ts'];
+    if (expected !== undefined && (typeof expected !== 'string' || !/^[1-9][0-9]{0,15}$/.test(expected)
+      || !Number.isSafeInteger(Number(expected)))) {
+      return res.status(400).json({ error: 'invalid generation precondition', reason: 'invalid-generation' });
+    }
+    // Keep the generation and terminal guards next to the synchronous service:
+    // authorization may await, but no yield is allowed between this check and dismiss.
+    if (expected !== undefined && resolved.ask.ts !== Number(expected)) {
+      return res.status(409).json({ error: 'ask generation changed', reason: 'generation-mismatch' });
+    }
+    if (resolved.ask.answered) return res.json({ dismissed: false, id: askId, outcome: 'answered', idempotent: true });
+    if (resolved.ask.dismissed) return res.json({ dismissed: true, id: askId, outcome: 'dismissed', idempotent: true });
     const out = deps.answerService.dismiss(askId);
     if (!out.ok) {
       if (out.reason === 'unknown') return res.status(404).json({ error: 'ask inesistente' });
-      if (out.reason === 'answering') return res.status(409).json({ error: 'risposta in corso: non si scarta un ask in answering' });
-      return res.status(500).json({ error: 'dismiss non riuscito' });
+      if (['answering', 'delivery-unknown-block'].includes(out.reason)) return res.status(409).json({ error: out.error || 'ask cannot be dismissed', reason: out.reason });
+      return res.status(out.code || 500).json({ error: out.error || 'dismiss failed', reason: out.reason });
     }
     if (out.closure) { try { await out.closure; } catch (_) {} }
-    return res.json({ dismissed: true, id: askId, idempotent: out.idempotent === true });
+    return res.json({ dismissed: true, id: askId, outcome: 'dismissed', idempotent: out.idempotent === true });
   });
 
   r.get('/:id/requests/:requestId', async (req, res) => {
@@ -133,10 +193,10 @@ function createEventFeedAsksRoutes(deps) {
     if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
     // Scoped: a peer sees ONLY its own attempts, and never the answer text of
     // anyone — the receipt carries a digest, not a payload.
-    const entry = deps.receipts.get(g.peer.nodeId, askId, requestId);
+    const entry = deps.receipts.get(g.actor, askId, requestId);
     if (!entry) return res.status(404).json({ error: 'ask inesistente' });
     return res.json({
-      requestId, askId, state: entry.state,
+      requestId, askId, ownerId: g.self, actor: g.actor, state: entry.state,
       ...(entry.receipt ? { receipt: entry.receipt } : {}),
       ...(entry.updatedAt ? { updatedAt: entry.updatedAt } : {}),
     });