@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/chunk-UNL6YGL5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, under the token's content key\n *   sealedCek,      // that content key, RSA-OAEP-sealed to the target's inbox public half\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * ## Cross-user (core#65)\n *\n * The wrap key is a per-token CONTENT KEY, not anybody's KEK: the tier DEKs are\n * AES-KW-wrapped under it exactly as they used to be under a KEK, and the key\n * itself is RSA-OAEP-sealed to the target's INBOX PUBLIC HALF (core#96 mints\n * that pair for every grantee, private half sealed under a DEK only that\n * member's own KEK unwraps). So a grantor delegates to somebody whose secret it\n * does not know — the thing this module could not do — while the slot NAMES\n * stay readable to any member holding the `_delegations` DEK, which is what\n * makes an audit enumeration possible without making the keys usable.\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore, KeyringFile } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport {\n  buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, wrapKey, unwrapKey,\n  importWrappingKey, importRecipientPublicKeySpki, recipientWrap, recipientUnwrap,\n  bufferToBase64, base64ToBuffer, type EnclaveKey,\n} from '../../capsule/index.js'\nimport { dekKey } from './tiers.js'\nimport { readKeyringFile, openInboxKeyPair } from './keyring.js'\nimport { INBOX_KEY_ID } from '../../kernel/constants.js'\nimport { DelegationTargetMissingError, MemberInboxMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /**\n   * Collection name, or `null` for a COLLECTION-WIDE token — see\n   * {@link DelegationToken.wrappedDeks} for what that means and what it cannot\n   * mean.\n   */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  /**\n   * The delegated tier DEK for {@link DelegationToken.collection}, wrapped\n   * under the target's KEK. Present on a per-collection token; absent on a\n   * collection-wide one, which carries {@link DelegationToken.wrappedDeks}.\n   */\n  readonly wrappedDek?: string\n  /**\n   * A collection-wide token's payload: `<collection>#<tier>` → wrapped DEK, one\n   * entry per collection the grantor held at that tier (core#56).\n   *\n   * ## ⛔ Why a MAP and not one key\n   *\n   * Every collection has its OWN tier DEK — measured, `docs#1` and `ledger#1`\n   * are different keys. The original design tried to express \"every collection\"\n   * as a single DEK under a wildcard slot `__any#<tier>`, which cannot work: one\n   * key decrypts one collection. A wildcard accepted at the access gate would\n   * have passed the check and then failed decryption — a gate that says yes\n   * followed by a crypto error. `__any#` is gone; every entry here merges under\n   * its REAL `<collection>#<tier>` key, so `assertTierAccess` needs no wildcard\n   * and gains no new privilege surface.\n   *\n   * ## ⚠️ \"Every collection\" means \"every collection AS OF ISSUE TIME\"\n   *\n   * This is a SNAPSHOT. A collection created after the token was issued is not\n   * in it and will not be granted by it — the grantor did not hold its DEK to\n   * wrap. That is a real limit of the shape, not an oversight, and it is stated\n   * here because a caller who reads \"all collections\" will otherwise assume\n   * otherwise.\n   */\n  readonly wrappedDeks?: Readonly<Record<string, string>>\n  /**\n   * core#65 — the token's CONTENT KEY, RSA-OAEP-sealed to the target's inbox\n   * public half. `wrappedDek` / `wrappedDeks` are AES-KW-wrapped under it, so\n   * only the target can unwrap them, and only they can: the matching private\n   * half is sealed in their keyring under a DEK their own KEK unwraps.\n   *\n   * Absent on a token written before core#65, whose wraps are under the\n   * grantor's own KEK — those still load for a target that shares that KEK\n   * (the only case that ever worked) and are skipped for anyone else, exactly\n   * as before.\n   */\n  readonly sealedCek?: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N DEK; the\n * target must have a keyring in this vault with an inbox key pair (core#96).\n *\n * core#65 — the wraps are keyed to a per-token content key sealed to that\n * pair, so the grantor needs nothing of the target's but their PUBLIC half.\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  const targetFound = await readKeyringFile(store, vault, opts.toUser)\n  if (!targetFound) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const targetInbox = targetFound.file.inbox_key\n  if (!targetInbox) {\n    throw new MemberInboxMissingError(\n      opts.toUser,\n      `Delegation target \"${opts.toUser}\" has a keyring with no inbox key pair — it predates core#96, ` +\n      'so a delegated key cannot be sealed to them. Re-grant the user once (a fresh temporary secret ' +\n      'they rotate on first open); the new keyring carries the pair.',\n    )\n  }\n  const cekBytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  const targetKek = await importWrappingKey(cekBytes)\n  const sealedCek = bufferToBase64(await recipientWrap(await importRecipientPublicKeySpki(base64ToBuffer(targetInbox.pub)), cekBytes))\n  cekBytes.fill(0)\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n\n  // Collection-wide: wrap EVERY tier DEK the grantor holds at this tier, each\n  // under its own real slot key. See `wrappedDeks` for why this is a map and\n  // for the as-of-issue-time limit it carries.\n  let wrappedDek: string | undefined\n  let wrappedDeks: Record<string, string> | undefined\n  if (collectionName === null) {\n    const suffix = `#${tier}`\n    const entries: Record<string, string> = {}\n    for (const [slot, dek] of grantor.deks) {\n      if (slot.endsWith(suffix)) entries[slot] = await wrapKey(dek, targetKek)\n    }\n    if (Object.keys(entries).length === 0) {\n      throw new DelegationTargetMissingError(\n        opts.toUser,\n        `grantor holds no tier-${tier} DEK for ANY collection, so a collection-wide ` +\n        `delegation would grant nothing. Obtain a tier grant first, or name a ` +\n        `\\`collection\\`.`,\n      )\n    }\n    wrappedDeks = entries\n  } else {\n    const sourceDek = grantor.deks.get(dekKey(collectionName, tier))\n    if (!sourceDek) {\n      throw new DelegationTargetMissingError(\n        opts.toUser,\n        `grantor holds no tier-${tier} DEK for collection \"${collectionName}\", so there ` +\n        `is nothing to delegate. Obtain the tier grant first.`,\n      )\n    }\n    wrappedDek = await wrapKey(sourceDek, targetKek)\n  }\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    ...(wrappedDek !== undefined && { wrappedDek }),\n    ...(wrappedDeks !== undefined && { wrappedDeks }),\n    sealedCek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 }\n  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity))\n  const envelope = buildRecordEnvelope(\n    identity,\n    { ts: token.createdAt, iv, data},\n  )\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * ## Why the vault calls this EXPLICITLY, and never from `openVault` (core#56)\n *\n * The module header above describes a runtime that scans on every open. Doing\n * that automatically would call `getDEK('_delegations')`, which MINTS a DEK when\n * absent and persists the keyring — so merely opening a vault would write to it.\n * Worse, on a vault whose shared `_delegations` DEK this user does not hold, it\n * would mint a WRONG one and then fail to decrypt every token under it.\n *\n * ⛔ A read path must not have that side effect. `Vault.refreshDelegations()`\n * therefore lists first, returns `[]` when nothing is written, and looks the DEK\n * up WITHOUT minting — which also makes the module header's \"at each open\"\n * cheap to honour, and its \"periodic intervals (tracked by the caller)\" is what\n * an explicit method is.\n *\n * ## Cross-user delegation (core#65) — and the one thing it still needs\n *\n * A token's wraps are keyed to a per-token content key sealed to the target's\n * INBOX PUBLIC HALF, so any member can be a target. Opening one therefore needs\n * that member's inbox PRIVATE half, which is sealed in their keyring file under\n * `deks[INBOX_KEY_ID]` — so this function reads the caller's own keyring file,\n * once, and only when a sealed token is actually addressed to them.\n *\n * ⚠️ A pre-core#65 token (no `sealedCek`) is wrapped under the GRANTOR's KEK and\n * still requires `user.kek`; it is skipped for anyone who does not share it,\n * which is the behaviour those tokens were written under.\n */\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  /** This member's own inbox key pair material, read at most once per call. `null` = read, absent. */\n  let ownInbox: NonNullable<KeyringFile['inbox_key']> | null | undefined\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // core#65 — the wrap key. A sealed token carries its own content key,\n    // opened with this member's inbox pair; a legacy token is under the\n    // grantor's KEK and needs `user.kek`, absent on a tier-3 PIN resume, a\n    // wrap-DEKs tier-2 unlock or a session restore (reached again at the next\n    // tier-1 unlock). A sealed token has no such limit: the pair's private\n    // half is sealed under a DEK the rebuilt set already carries.\n    let wrapKeyForToken: EnclaveKey\n    if (token.sealedCek !== undefined) {\n      const inboxKeyAes = user.deks.get(INBOX_KEY_ID)\n      if (!inboxKeyAes) continue\n      if (ownInbox === undefined) {\n        const own = await readKeyringFile(store, vault, user.userId)\n        ownInbox = own?.file.inbox_key ?? null\n      }\n      if (!ownInbox) continue\n      try {\n        const pair = await openInboxKeyPair(ownInbox, inboxKeyAes)\n        const cekBytes = await recipientUnwrap(pair, base64ToBuffer(token.sealedCek))\n        try {\n          wrapKeyForToken = await importWrappingKey(cekBytes)\n        } finally {\n          cekBytes.fill(0)\n        }\n      } catch {\n        // Sealed to somebody else's pair, or this member's own pair was\n        // replaced (a re-grant mints a fresh one). Not ours to open.\n        continue\n      }\n    } else {\n      if (!user.kek) continue\n      wrapKeyForToken = user.kek\n    }\n\n    // ⭐ Every merged key lands under its REAL `<collection>#<tier>` slot, which\n    // is exactly what `assertTierAccess` and `getDEK` already look up. There is\n    // no wildcard slot and no lookup change anywhere — see `wrappedDeks`.\n    const wraps: Record<string, string> = token.collection\n      ? (token.wrappedDek ? { [dekKey(token.collection, token.tier)]: token.wrappedDek } : {})\n      : { ...(token.wrappedDeks ?? {}) }\n    if (Object.keys(wraps).length === 0) continue\n\n    let anyMerged = false\n    for (const [slot, wrapped] of Object.entries(wraps)) {\n      let dek: EnclaveKey\n      try {\n        dek = await unwrapKey(wrapped, wrapKeyForToken)\n      } catch {\n        // One unusable entry must not discard the rest of a collection-wide\n        // token — a revoked or re-wrapped collection is the expected case.\n        continue\n      }\n      user.deks.set(slot, dek)\n      anyMerged = true\n    }\n    if (!anyMerged) continue\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEO,IAAM,yBAAyB;AAiFtC,eAAsB,gBACpB,OACA,OACA,SACA,gBACA,MAC0B;AAC1B,QAAM,cAAc,MAAM,gBAAgB,OAAO,OAAO,KAAK,MAAM;AACnE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,cAAc,YAAY,KAAK;AACrC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR,KAAK;AAAA,MACL,sBAAsB,KAAK,MAAM;AAAA,IAGnC;AAAA,EACF;AACA,QAAM,WAAW,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACrE,QAAM,YAAY,MAAM,kBAAkB,QAAQ;AAClD,QAAM,YAAY,eAAe,MAAM,cAAc,MAAM,6BAA6B,eAAe,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC;AACnI,WAAS,KAAK,CAAC;AACf,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAK1C,MAAI;AACJ,MAAI;AACJ,MAAI,mBAAmB,MAAM;AAC3B,UAAM,SAAS,IAAI,IAAI;AACvB,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,MAAM,GAAG,KAAK,QAAQ,MAAM;AACtC,UAAI,KAAK,SAAS,MAAM,EAAG,SAAQ,IAAI,IAAI,MAAM,QAAQ,KAAK,SAAS;AAAA,IACzE;AACA,QAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AACrC,YAAM,IAAI;AAAA,QACR,KAAK;AAAA,QACL,yBAAyB,IAAI;AAAA,MAG/B;AAAA,IACF;AACA,kBAAc;AAAA,EAChB,OAAO;AACL,UAAM,YAAY,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC;AAC/D,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR,KAAK;AAAA,QACL,yBAAyB,IAAI,wBAAwB,cAAc;AAAA,MAErE;AAAA,IACF;AACA,iBAAa,MAAM,QAAQ,WAAW,SAAS;AAAA,EACjD;AAEA,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA,GAAI,eAAe,UAAa,EAAE,WAAW;AAAA,IAC7C,GAAI,gBAAgB,UAAa,EAAE,YAAY;AAAA,IAC/C;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,WAAW,EAAE,YAAY,wBAAwB,IAAI,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS,EAAE;AACpG,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,gBAAgB,eAAe,QAAQ,CAAC;AACtF,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,IAAI,MAAM,WAAW,IAAI,KAAI;AAAA,EACjC;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAoCA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAE/B,MAAI;AACJ,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,wBAAwB,GAAG,GAAG,KAAK,cAAc;AACxG,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAQ3B,QAAI;AACJ,QAAI,MAAM,cAAc,QAAW;AACjC,YAAM,cAAc,KAAK,KAAK,IAAI,YAAY;AAC9C,UAAI,CAAC,YAAa;AAClB,UAAI,aAAa,QAAW;AAC1B,cAAM,MAAM,MAAM,gBAAgB,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,KAAK,KAAK,aAAa;AAAA,MACpC;AACA,UAAI,CAAC,SAAU;AACf,UAAI;AACF,cAAM,OAAO,MAAM,iBAAiB,UAAU,WAAW;AACzD,cAAM,WAAW,MAAM,gBAAgB,MAAM,eAAe,MAAM,SAAS,CAAC;AAC5E,YAAI;AACF,4BAAkB,MAAM,kBAAkB,QAAQ;AAAA,QACpD,UAAE;AACA,mBAAS,KAAK,CAAC;AAAA,QACjB;AAAA,MACF,QAAQ;AAGN;AAAA,MACF;AAAA,IACF,OAAO;AACL,UAAI,CAAC,KAAK,IAAK;AACf,wBAAkB,KAAK;AAAA,IACzB;AAKA,UAAM,QAAgC,MAAM,aACvC,MAAM,aAAa,EAAE,CAAC,OAAO,MAAM,YAAY,MAAM,IAAI,CAAC,GAAG,MAAM,WAAW,IAAI,CAAC,IACpF,EAAE,GAAI,MAAM,eAAe,CAAC,EAAG;AACnC,QAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG;AAErC,QAAI,YAAY;AAChB,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,UAAU,SAAS,eAAe;AAAA,MAChD,QAAQ;AAGN;AAAA,MACF;AACA,WAAK,KAAK,IAAI,MAAM,GAAG;AACvB,kBAAY;AAAA,IACd;AACA,QAAI,CAAC,UAAW;AAChB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/{chunk-747G6CT3.js → chunk-UORWAG7K.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-Y2NBBT6K.js";
 import {
   sha256Hex
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-shape/persisted-schemas/derive.ts
 function isZodSchema(value) {
@@ -79,4 +79,4 @@ export {
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-747G6CT3.js.map
+//# sourceMappingURL=chunk-UORWAG7K.js.map