@muhkoo/connect 0.2.0-alpha.1 → 0.2.0-alpha.2

package/dist/connect.d.ts

@@ -2385,6 +2385,14 @@ interface JoinRequest {
     desiredEpoch?: number;
     ts?: number;
 }
+/** A space member's published identity keys (the keyring directory). */
+interface RosterMember {
+    memberId: string;
+    /** Base64url-encoded JWK of the member's identity ECDH public key. */
+    identityEcdhPub: string;
+    /** Base64url-encoded JWK of the member's identity ECDSA public key. */
+    identityEcdsaPub?: string;
+}
 
 /**
  * PacketCipher — the strategy `Network` uses to seal/open a packet's payload.
@@ -2504,15 +2512,14 @@ interface KeyringTransport {
     postWrappedKey(targetMemberId: string, wrapped: WrappedKey, fromMemberId: string): Promise<void>;
     /** Outstanding join requests (for an online key-holder to fulfill). */
     fetchPending(): Promise<JoinRequest[]>;
-    /** Current roster: member ids + their identity ECDH public keys. */
-    fetchRoster(): Promise<Array<{
-        memberId: string;
-        identityEcdhPub: string;
-    }>>;
+    /** Current roster: member ids + their identity ECDH/ECDSA public keys. */
+    fetchRoster(): Promise<RosterMember[]>;
     /** Advisory epoch bump; returns the agreed new epoch. */
     rotate(nextEpoch: number): Promise<{
         epoch: number;
     }>;
+    /** Add `username` to a private channel's membership allowlist. */
+    invite(username: string): Promise<void>;
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 /** PersonalSpace-backed cache of this member's group keys (epoch → base64 key). */
@@ -2525,6 +2532,9 @@ interface SpaceKeyringDeps {
     memberId: string;
     /** This member's identity ECDH public key, base64url JWK (for join requests). */
     identityEcdhPub: string;
+    /** This member's identity ECDSA public key, base64url JWK (published for
+     * sender-signature verification). */
+    identityEcdsaPub?: string;
     /** Resolves this member's identity ECDH private key (for unwrapping). */
     ownPrivateKey: () => CryptoKey | null;
     transport: KeyringTransport;
@@ -2536,7 +2546,13 @@ declare class SpaceKeyring implements EpochKeyProvider {
     private readonly keys;
     private epoch;
     private readonly policy;
+    /** Cached member directory: memberId → imported ECDSA verify key. */
+    private readonly memberEcdsa;
     constructor(deps: SpaceKeyringDeps);
+    /** The cached ECDSA verify key for a member, if known. */
+    ecdsaKeyFor(memberId: string): CryptoKey | undefined;
+    /** Refresh the member directory (memberId → ECDSA key) from the roster. */
+    refreshDirectory(): Promise<void>;
     currentEpoch(): number;
     keyForEpoch(epoch: number): Uint8Array | undefined;
     hasAnyKey(): boolean;
@@ -2546,7 +2562,11 @@ declare class SpaceKeyring implements EpochKeyProvider {
     private persist;
     /** Creator path: mint epoch-0 group key for a brand-new space. */
     bootstrapNew(): Promise<void>;
-    /** Post a join request so an online key-holder can wrap a key for us. */
+    /**
+     * Post a join request so an online key-holder can wrap a key for us. Also
+     * publishes our identity keys in the member directory (so others can verify
+     * our message signatures, and the keeper can wrap to us).
+     */
     requestKey(desiredEpoch?: number): Promise<void>;
     /**
      * Pull and unwrap any blobs addressed to us. Returns the number of new
@@ -2572,6 +2592,8 @@ declare class SpaceKeyring implements EpochKeyProvider {
         memberId: string;
         identityEcdhPub: string;
     }>): Promise<number>;
+    /** Add `username` to a private channel's membership allowlist (member-only). */
+    invite(username: string): Promise<void>;
 }
 
 /**
@@ -2718,6 +2740,8 @@ declare class Space {
     create(): Promise<void>;
     /** Wrap the group key for a newcomer and post it (key-holder action). */
     admit(memberId: string, identityEcdhPub: string): Promise<void>;
+    /** Invite a user to this (private) channel's membership allowlist. */
+    invite(username: string): Promise<void>;
     /** Rotate to a fresh epoch and re-wrap to the roster (rotate spaces). */
     rotate(roster?: Array<{
         memberId: string;
@@ -2741,6 +2765,13 @@ declare class Space {
      * packet string; false means it's the full `{spaceMessage, name, ...}` frame.
      */
     private decodeFrame;
+    /**
+     * True if `packet` carries a valid signature by `source`'s identity key.
+     * On a directory cache miss, refresh once (a new member may have just
+     * joined) before giving up. Without a keyring (legacy handle) there's
+     * nothing to verify against → reject.
+     */
+    private verifySender;
     private emitEvent;
     private requireKeyring;
     private requireCipher;
@@ -2883,6 +2914,7 @@ declare class SpaceNamespace {
      */
     createSpace(opts?: {
         historyPolicy?: HistoryPolicy;
+        private?: boolean;
     }): Promise<Space>;
     /** Join an existing space by id (its public key). Resolves once a key arrives. */
     joinSpace(spaceId: string, opts?: {
@@ -2904,6 +2936,7 @@ declare class SpaceNamespace {
      */
     createChannel(name: string, opts?: {
         historyPolicy?: HistoryPolicy;
+        private?: boolean;
     }): Promise<Space>;
     /**
      * Join an existing channel by name. Throws {@link ChannelNotFoundError} if
@@ -2913,7 +2946,7 @@ declare class SpaceNamespace {
         timeoutMs?: number;
     }): Promise<Space>;
     private build;
-    /** Ensure the member has an identity ECDH keypair; return its public key. */
+    /** Ensure the member has an identity keypair; return its public ECDH + ECDSA keys. */
     private ensureIdentity;
     private fetchPolicy;
     private fetchTicket;
@@ -3002,13 +3035,11 @@ declare class KeyringClient implements KeyringTransport {
     fetchBlobs(memberId: string): Promise<WrappedKey[]>;
     postWrappedKey(targetMemberId: string, wrapped: WrappedKey, fromMemberId: string): Promise<void>;
     fetchPending(): Promise<JoinRequest[]>;
-    fetchRoster(): Promise<Array<{
-        memberId: string;
-        identityEcdhPub: string;
-    }>>;
+    fetchRoster(): Promise<RosterMember[]>;
     rotate(nextEpoch: number): Promise<{
         epoch: number;
     }>;
+    invite(username: string): Promise<void>;
     fetchMetadata(): Promise<SpaceMetadata | null>;
 }
 

package/dist/server/index.js

@@ -4791,6 +4791,46 @@ async function importEcdhPublicKey(encoded) {
 }
 /** The space's id is just its encoded ECDH public key. */
 const encodeSpaceId = exportEcdhPublicKey;
+// ---------------------------------------------------------------------------
+// Sender authentication (ECDSA P-384, matching the Double Ratchet path).
+// A fan-out message is signed by its sender's identity ECDSA key so receivers
+// can verify authorship end-to-end — independent of the relay, which only
+// stamps `source` server-side. SHA-256 hash to match `DoubleRatchet`.
+// ---------------------------------------------------------------------------
+const ECDSA_PARAMS = { name: "ECDSA", namedCurve: "P-384" };
+const ECDSA_SIGN = { name: "ECDSA", hash: "SHA-256" };
+/** Encode an ECDSA public `CryptoKey` as a base64url JWK string. */
+async function exportEcdsaPublicKey(key) {
+    const jwk = await getSubtle().exportKey("jwk", key);
+    return toBase64Url(utf8Encode(JSON.stringify(jwk)));
+}
+/** Decode a base64url JWK string back into an ECDSA verify-only public key. */
+async function importEcdsaPublicKey(encoded) {
+    const jwk = JSON.parse(utf8Decode(fromBase64Url(encoded)));
+    return getSubtle().importKey("jwk", jwk, ECDSA_PARAMS, true, ["verify"]);
+}
+/**
+ * Canonical bytes a sender signs (and a receiver re-derives). Binds the claimed
+ * sender + routing + the sealed ciphertext, so a relay can't relabel `source`
+ * and a member can't reuse another's ciphertext under a new envelope.
+ */
+function canonicalMessage(fields) {
+    return [fields.source, fields.target, fields.subject, fields.epoch, fields.iv, fields.ciphertext].join("\n");
+}
+/** Sign the canonical bytes with the sender's ECDSA identity private key. */
+async function signSpaceMessage(canonical, ecdsaPriv) {
+    const sig = await getSubtle().sign(ECDSA_SIGN, ecdsaPriv, utf8Encode(canonical));
+    return toBase64(new Uint8Array(sig));
+}
+/** Verify a signature over the canonical bytes against the sender's ECDSA key. */
+async function verifySpaceMessage(canonical, sigB64, ecdsaPub) {
+    try {
+        return await getSubtle().verify(ECDSA_SIGN, ecdsaPub, fromBase64(sigB64), utf8Encode(canonical));
+    }
+    catch {
+        return false;
+    }
+}
 /** Generate a fresh space identity keypair (P-384 ECDH). */
 async function generateSpaceIdentity() {
     const kp = await getSubtle().generateKey(ECDH_PARAMS, true, ["deriveBits"]);
@@ -5019,12 +5059,19 @@ class Space {
         const cipher = this.requireCipher(opts.contentType);
         const message = new Message(payload);
         const headers = await cipher.seal(message.serialize());
-        const packet = new Packet({
-            subject: opts.channel ?? "default",
-            source: this.deps.myId(),
-            target: this.name,
-            headers,
-        });
+        const source = this.deps.myId();
+        const subject = opts.channel ?? "default";
+        // Sign the message with our identity ECDSA key so receivers can verify
+        // authorship end-to-end (independent of the relay's `source` stamp).
+        const authPriv = KeyStore.getInstance().getAuthKeyPair(source)?.privateKey;
+        if (authPriv) {
+            const canonical = canonicalMessage({
+                source, target: this.name, subject,
+                epoch: Number(headers.epoch), iv: String(headers.iv), ciphertext: String(headers.ciphertext),
+            });
+            headers.sig = await signSpaceMessage(canonical, authPriv);
+        }
+        const packet = new Packet({ subject, source, target: this.name, headers });
         this.sendRaw({ spaceMessage: packet.serialize() });
     }
     /** Subscribe to decrypted fan-out messages. Returns an unsubscribe fn. */
@@ -5056,6 +5103,9 @@ class Space {
         if (!res.ok)
             throw new Error(`Space.history: ${res.status} ${res.statusText}`);
         const body = (await res.json());
+        // Warm the member directory once so historical senders' signatures verify.
+        // (refreshDirectory swallows its own transport errors.)
+        await this.deps.keyring?.refreshDirectory();
         const messages = [];
         for (const raw of body.messages ?? []) {
             const decoded = await this.decodeFrame(raw, cipher);
@@ -5091,6 +5141,9 @@ class Space {
         const keyring = this.requireKeyring();
         await keyring.bootstrapNew();
         await this.connect();
+        // Publish our identity in the member directory so peers can verify our
+        // message signatures (the creator never "joins", so register here).
+        await keyring.requestKey().catch(() => { });
         // Admit anyone who requested a key before we were listening.
         if (this.deps.autoAdmit !== false) {
             await keyring.admitPending().catch(() => { });
@@ -5100,6 +5153,10 @@ class Space {
     async admit(memberId, identityEcdhPub) {
         await this.requireKeyring().admit(memberId, identityEcdhPub);
     }
+    /** Invite a user to this (private) channel's membership allowlist. */
+    async invite(username) {
+        await this.requireKeyring().invite(username);
+    }
     /** Rotate to a fresh epoch and re-wrap to the roster (rotate spaces). */
     async rotate(roster) {
         return this.requireKeyring().rotate(roster);
@@ -5142,7 +5199,9 @@ class Space {
         if (f.joinRequest && typeof f.joinRequest === "object") {
             const req = f.joinRequest;
             this.emitEvent("join-request", req);
-            // Auto-admit: if we hold the group key, wrap it for the newcomer.
+            // A new member appeared — refresh the directory so their future
+            // messages verify, and (if we hold the key) auto-admit them.
+            void this.deps.keyring?.refreshDirectory();
             if (this.deps.autoAdmit !== false && this.deps.keyring?.hasAnyKey() && req.memberId !== this.deps.myId()) {
                 void this.deps.keyring.admit(req.memberId, req.identityEcdhPub).catch(() => { });
             }
@@ -5170,6 +5229,13 @@ class Space {
             const packet = Packet.deserialize(packetJson);
             if (!cipher.handles(packet.headers))
                 return null;
+            // Verify sender authenticity end-to-end: the message must be signed
+            // by `source`'s identity ECDSA key (looked up in the member
+            // directory). Drop anything unsigned, signed by an unknown member,
+            // or whose signature doesn't match — this defeats both member
+            // impersonation and a relay rewriting `source`.
+            if (!(await this.verifySender(packet)))
+                return null;
             const serialized = await cipher.open(packet.headers);
             if (serialized === null)
                 return null; // epoch key we don't hold
@@ -5187,6 +5253,34 @@ class Space {
             return null;
         }
     }
+    /**
+     * True if `packet` carries a valid signature by `source`'s identity key.
+     * On a directory cache miss, refresh once (a new member may have just
+     * joined) before giving up. Without a keyring (legacy handle) there's
+     * nothing to verify against → reject.
+     */
+    async verifySender(packet) {
+        const keyring = this.deps.keyring;
+        const sig = packet.headers?.sig;
+        if (!keyring || typeof sig !== "string")
+            return false;
+        let key = keyring.ecdsaKeyFor(packet.source);
+        if (!key) {
+            await keyring.refreshDirectory();
+            key = keyring.ecdsaKeyFor(packet.source);
+            if (!key)
+                return false;
+        }
+        const canonical = canonicalMessage({
+            source: packet.source,
+            target: packet.target,
+            subject: packet.subject,
+            epoch: Number(packet.headers?.epoch ?? 0),
+            iv: String(packet.headers?.iv ?? ""),
+            ciphertext: String(packet.headers?.ciphertext ?? ""),
+        });
+        return verifySpaceMessage(canonical, sig, key);
+    }
     emitEvent(type, detail) {
         this.events.dispatchEvent(new CustomEvent(type, { detail }));
     }
@@ -5416,10 +5510,37 @@ class SpaceKeyring {
     keys = new Map();
     epoch = 0;
     policy;
+    /** Cached member directory: memberId → imported ECDSA verify key. */
+    memberEcdsa = new Map();
     constructor(deps) {
         this.deps = deps;
         this.policy = deps.historyPolicy ?? "static";
     }
+    // -- member directory (for verifying sender signatures) -------------------
+    /** The cached ECDSA verify key for a member, if known. */
+    ecdsaKeyFor(memberId) {
+        return this.memberEcdsa.get(memberId);
+    }
+    /** Refresh the member directory (memberId → ECDSA key) from the roster. */
+    async refreshDirectory() {
+        let roster;
+        try {
+            roster = await this.deps.transport.fetchRoster();
+        }
+        catch {
+            return;
+        }
+        for (const m of roster) {
+            if (!m.identityEcdsaPub || this.memberEcdsa.has(m.memberId))
+                continue;
+            try {
+                this.memberEcdsa.set(m.memberId, await importEcdsaPublicKey(m.identityEcdsaPub));
+            }
+            catch {
+                /* skip malformed entries */
+            }
+        }
+    }
     // -- EpochKeyProvider ------------------------------------------------------
     currentEpoch() {
         return this.epoch;
@@ -5473,11 +5594,16 @@ class SpaceKeyring {
         await this.persist();
     }
     // -- newcomer: request + pull ---------------------------------------------
-    /** Post a join request so an online key-holder can wrap a key for us. */
+    /**
+     * Post a join request so an online key-holder can wrap a key for us. Also
+     * publishes our identity keys in the member directory (so others can verify
+     * our message signatures, and the keeper can wrap to us).
+     */
     async requestKey(desiredEpoch) {
         await this.deps.transport.postJoinRequest({
             memberId: this.deps.memberId,
             identityEcdhPub: this.deps.identityEcdhPub,
+            identityEcdsaPub: this.deps.identityEcdsaPub,
             desiredEpoch,
         });
     }
@@ -5563,6 +5689,10 @@ class SpaceKeyring {
         await this.persist();
         return nextEpoch;
     }
+    /** Add `username` to a private channel's membership allowlist (member-only). */
+    async invite(username) {
+        await this.deps.transport.invite(username);
+    }
 }
 
 /**
@@ -5623,6 +5753,9 @@ class KeyringClient {
     async rotate(nextEpoch) {
         return this.post("/keyring/rotate", { nextEpoch });
     }
+    async invite(username) {
+        await this.post("/keyring/invite", { username });
+    }
     async fetchMetadata() {
         try {
             return await this.get("/metadata");
@@ -5679,7 +5812,9 @@ class SpaceNamespace {
         const historyPolicy = opts.historyPolicy ?? "static";
         const identity = await generateSpaceIdentity();
         // Register the space (server records pubkey + policy; the DO is lazy).
-        await this.deps.http.post(`/api/spaces/${encodeURIComponent(identity.id)}/metadata`, { spacePubKey: identity.id, historyPolicy });
+        // For a private space the server also records the creator (this user) as
+        // its first member — so the metadata POST must carry the user session.
+        await this.deps.http.post(`/api/spaces/${encodeURIComponent(identity.id)}/metadata`, { spacePubKey: identity.id, historyPolicy, visibility: opts.private ? "private" : "public" });
         const space = await this.build(identity.id, historyPolicy);
         await space.create();
         return space;
@@ -5727,7 +5862,7 @@ class SpaceNamespace {
         const space = await this.createSpace(opts);
         // Register name → id first so a name clash doesn't leave an admitted keeper.
         try {
-            await this.deps.http.post("/api/app/channels", { name, spaceId: space.id });
+            await this.deps.http.post("/api/app/channels", { name, spaceId: space.id, visibility: opts.private ? "private" : "public" });
         }
         catch (err) {
             if (err instanceof HttpError && err.status === 409) {
@@ -5762,7 +5897,7 @@ class SpaceNamespace {
     // -------------------------------------------------------------------------
     async build(spaceId, historyPolicy) {
         const memberId = this.myId();
-        const identityEcdhPub = await this.ensureIdentity(memberId);
+        const { ecdhPub, ecdsaPub } = await this.ensureIdentity(memberId);
         const transport = new KeyringClient({
             spaceId,
             httpBaseUrl: this.deps.http.baseUrl,
@@ -5771,7 +5906,8 @@ class SpaceNamespace {
         const keyring = new SpaceKeyring({
             spaceId,
             memberId,
-            identityEcdhPub,
+            identityEcdhPub: ecdhPub,
+            identityEcdsaPub: ecdsaPub,
             ownPrivateKey: () => KeyStore.getInstance().getKeyPair(memberId)?.privateKey ?? null,
             transport,
             cache: this.deps.cache,
@@ -5788,14 +5924,15 @@ class SpaceNamespace {
             historyPolicy,
         });
     }
-    /** Ensure the member has an identity ECDH keypair; return its public key. */
+    /** Ensure the member has an identity keypair; return its public ECDH + ECDSA keys. */
     async ensureIdentity(memberId) {
         const store = KeyStore.getInstance();
         if (!store.getKeyPair(memberId)) {
             await store.generateOwnKeyPair(memberId);
         }
-        const pub = store.getKeyPair(memberId).publicKey;
-        return exportEcdhPublicKey(pub);
+        const ecdhPub = await exportEcdhPublicKey(store.getKeyPair(memberId).publicKey);
+        const ecdsaPub = await exportEcdsaPublicKey(store.getAuthKeyPair(memberId).publicKey);
+        return { ecdhPub, ecdsaPub };
     }
     async fetchPolicy(spaceId) {
         const meta = await new KeyringClient({