@openlfcp/client 0.3.1 → 0.4.0

package/dist/identity/devices.d.ts

@@ -1,6 +1,7 @@
 import { type PrincipalId, type ResourceId } from "@openlfcp/core";
 import type { SecretStore } from "@openlfcp/storage";
-import { type CertificateChain, type ControlState, type DataProfileCodec, type DeviceCertificate, type DeviceCertificatePayload, type DeviceKind, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
+import { type CertificateChain, type ControlState, type DeviceCertificate, type DeviceCertificatePayload, type DeviceKind, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
+import type { DataProfileHandler } from "../apply.js";
 import { type IdentityStorage, type Installation, type KeyDelivery } from "./context.js";
 import { type IdentityNetwork } from "./network.js";
 import { type LinearChain } from "./phases.js";
@@ -32,12 +33,24 @@ export interface FlowOptions {
     readonly network: IdentityNetwork;
     readonly now: () => number;
     /**
-     * The application's Data Profile codecs. A rotation uses the Resource's
-     * codec to judge which units recipients accept as data (W §26.3 rule 7);
-     * without one, only decryption and recorded refusals are checked.
+     * The application's Data Profiles, each as its receiver checks one unit:
+     * `codecFor({resourceId, actor})`, the codec bound to the unit's Resource
+     * and signer (the DataProfileHandler hook; e.g. shared-objects'
+     * sharedObjectsUnitProfile, sectionsUnitProfile, identityUnitProfile). A
+     * rotation judges each unit with its Resource's profile, as recipients do
+     * (W §26.3 rules 6 and 7, including the change's actor); without one, only
+     * decryption and recorded refusals are checked. Replaces 0.3.1's
+     * `dataProfiles` (bare codecs, which cannot bind the actor): a flow given
+     * `dataProfiles` throws instead of checking less.
      */
-    readonly dataProfiles?: readonly DataProfileCodec<unknown>[];
+    readonly profiles?: readonly UnitProfile[];
 }
+/**
+ * One Data Profile's per-unit check (the receiver's DataProfileHandler
+ * `dataProfile` and `codecFor`): `decode` of the codec it returns throws to
+ * reject the unit's plaintext.
+ */
+export type UnitProfile = Pick<DataProfileHandler<unknown>, "dataProfile" | "codecFor">;
 /**
  * The certificates above a leaf that `issuer` signs for `root` in the
  * state: none when the issuer is the root, else the issuer's own current

package/dist/identity/index.d.ts

@@ -1,7 +1,7 @@
 /** Identity flows (IDENTITY-PROFILE-01 §§5–9, LFCP-04-410). */
 export { acceptInvitationAsDevice, claimForRootRecord, createResourceAsDevice, type DeviceAcceptResult, type DeviceCreateResult, type DeviceResourceResult, type IncompleteDeviceResource, selfRegistrationRecord, } from "./accept.js";
 export { type DocumentWrite, deliverKeys, extendChain, fetchDeks, genesisOwner, heldDeks, IdentityConflict, type IdentityDocumentLoad, type IdentityStorage, type Installation, type KeyDelivery, loadIdentityDocument, type PhaseOutcome, readersAt, runControlPhase, runUnitPhase, sealIdentityUnit, storeDek, syncChain, } from "./context.js";
-export { checkIssuance, type Feasibility, type FlowOptions, issuerCertificates, leafPayload, MASK_PRESETS, type MaskPreset, mayManageDevices, type RegisterTarget, type RegistrationResult, type RegistrationStatus, registerDevice, signChain, } from "./devices.js";
+export { checkIssuance, type Feasibility, type FlowOptions, issuerCertificates, leafPayload, MASK_PRESETS, type MaskPreset, mayManageDevices, type RegisterTarget, type RegistrationResult, type RegistrationStatus, registerDevice, signChain, type UnitProfile, } from "./devices.js";
 export { type DeviceEntryValue, IDENTITY_PROFILE, type IdentityAuthor, type IdentityDocumentPort, type IdentityIntent, type IdentityWriterClass, identityPlaintextCodec, identityWriterClass, type PairingRequestValue, principalOfRef, principalRefOf, type RosterEntryValue, resourceRef, } from "./document.js";
 export { type JournalOperation, type JournalPhase, type LedgerEntry, OperationJournal, type OperationKind, type OperationStatus, PackageLedger, pairingSecretRef, pendingDekRef, } from "./journal.js";
 export { ChannelPool, type ConnectionNetworkOptions, connectionNetwork, IDENTITY_EXTENSION, type IdentityAnswer, type IdentityChannel, type IdentityNetwork, IdentityRefused, IdentityUnavailable, type OpenAnswer, } from "./network.js";

package/dist/identity/pairing.js

@@ -9,6 +9,7 @@ import { ChannelPool, IdentityUnavailable } from "./network.js";
 import { classifyCancel, classifyConsume, classifyRegister } from "./phases.js";
 import { identityTarget } from "./resource.js";
 import { rotateIfExposed } from "./revocation.js";
+import { checkFlowProfiles } from "./rotation.js";
 /**
  * Pairing a new installation, the managing side `A` (IDENTITY-PROFILE-01
  * §5.3 steps 1, 4–7, 9 and 10): a pairing device `J` registered in the
@@ -323,6 +324,7 @@ export async function pairingRequests(o) {
  * phase 1; phase 2 signs exactly that payload.
  */
 export async function approvePairing(o) {
+    checkFlowProfiles(o);
     const { I, R, J, url } = await readSession(o, o.review.session);
     const pool = new ChannelPool(o.network);
     const me = o.installation.signer;
@@ -413,6 +415,7 @@ export const approvedGrantRecord = (chain, signer, root, device, pairing) => sig
 export const cancelRecord = (chain, signer, root, pairing) => signControlRecord(next(chain), { type: "DEVICE_REVOKE", root, device: pairing, reason: 0n }, signer).bytes;
 /** Resumes a journaled approval from its next phase (§9.1: "If A crashes after step 5 …"). */
 export async function resumeApproval(o, operation) {
+    checkFlowProfiles(o);
     const journal = new OperationJournal(o.storage);
     const pool = new ChannelPool(o.network);
     const me = o.installation.signer;
@@ -565,6 +568,7 @@ export async function resumeApproval(o, operation) {
  * human does not confirm is rejected).
  */
 export async function cancelPairing(o) {
+    checkFlowProfiles(o);
     const { I, R, J, url } = await readSession(o, o.session);
     const journal = new OperationJournal(o.storage);
     const pool = new ChannelPool(o.network);

package/dist/identity/reconcile.js

@@ -8,7 +8,7 @@ import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable,
 import { classifyRegister, classifyRevoke } from "./phases.js";
 import { identityTarget } from "./resource.js";
 import { rotateIfExposed } from "./revocation.js";
-import { resumeRotations } from "./rotation.js";
+import { checkFlowProfiles, resumeRotations } from "./rotation.js";
 /**
  * §7.1 steps 1 and 2 for one target, in their normative order. For the
  * target `I` itself both steps are vacuous. Registrations are planned on
@@ -98,6 +98,7 @@ export function reconcileRecord(target, step, signer) {
  * opened and this installation is the rotator, it rotates (§8.4).
  */
 export async function reconcileDevices(o) {
+    checkFlowProfiles(o);
     const target = await identityTarget(o);
     const me = o.installation.signer;
     const journal = new OperationJournal(o.storage);

package/dist/identity/revocation.js

@@ -7,7 +7,7 @@ import { newOperationId, OperationJournal, phaseOf } from "./journal.js";
 import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 import { classifyRevoke } from "./phases.js";
 import { identityTarget } from "./resource.js";
-import { exposingRevocationsSince, resumeRotations, rotateAfter, rotatorTest, } from "./rotation.js";
+import { checkFlowProfiles, exposingRevocationsSince, resumeRotations, rotateAfter, rotatorTest, } from "./rotation.js";
 const toKeep = (state, root) => [...state.devices.entries()]
     .filter(([, d]) => bytesEqual(d.root, root))
     .map(([hex]) => principalId(fromHex(hex)))
@@ -131,6 +131,7 @@ class SelfDependent extends Error {
  * another reason is `complete` and the rotation test still runs.
  */
 export async function revokeDevice(o) {
+    checkFlowProfiles(o);
     const target = await identityTarget(o);
     const me = o.installation.signer.descriptor.principalId;
     const selfRetire = bytesEqual(me, o.device);
@@ -387,6 +388,7 @@ async function markRevoked(o, channel, journal, operation, I, device) {
  * nothing exposing happened since the last rotation.
  */
 export async function rotateIfExposed(o) {
+    checkFlowProfiles(o);
     // A rotation this operation already started resumes from its journaled phase: its
     // KEY_EPOCH may be committed while its DEK still waits in the pending slot (§9.1).
     const started = phaseOf(await new OperationJournal(o.storage).load(o.operation), `rotate:${toHex(o.resource)}`);

package/dist/identity/rotation.d.ts

@@ -1,8 +1,8 @@
 import { type ControlRecordId, type DataEpoch, type PrincipalId, type ResourceId } from "@openlfcp/core";
 import { type ResourceDEK } from "@openlfcp/crypto";
-import { type ControlState, type DataProfileCodec, type HaveVector, type PrincipalDescriptor } from "@openlfcp/wire";
+import { type ControlState, type HaveVector, type PrincipalDescriptor } from "@openlfcp/wire";
 import { type KeyDelivery } from "./context.js";
-import type { FlowOptions } from "./devices.js";
+import type { FlowOptions, UnitProfile } from "./devices.js";
 import { type ChannelPool, type IdentityChannel } from "./network.js";
 import { type LinearChain } from "./phases.js";
 /**
@@ -73,12 +73,15 @@ export interface FrontierData {
     /** The DEKs held for the Resource's epochs, by epoch number. */
     readonly deks: ReadonlyMap<string, ResourceDEK>;
     /**
-     * The Resource's Data Profile codec, when the application gives it: its
-     * `decode` is the profile's acceptance. Without it only decryption is
+     * The Resource's Data Profile, when the application gives it, as its
+     * receiver checks one unit: `codecFor({resourceId, actor})` is bound to the
+     * unit's Resource and signer, and the codec's `decode` is the profile's
+     * acceptance (the change's actor included). Without it only decryption is
      * checked here, and a profile refusal this installation recorded still
-     * counts (LocalAccepted.refused).
+     * counts (LocalAccepted.refused). 0.3.1 took a bare codec, which cannot
+     * bind the actor: one without `codecFor` is refused (TypeError).
      */
-    readonly profile?: DataProfileCodec<unknown>;
+    readonly profile?: UnitProfile;
 }
 export type RotationStatus = 
 /** This installation committed the KEY_EPOCH and sealed the new DEK to every reader. */
@@ -117,6 +120,8 @@ export declare function rotateAfter(o: FlowOptions & {
     readonly resource: ResourceId;
     readonly revokedAt: bigint;
 }): Promise<RotationOutcome>;
+/** The flow options of a rotation: 0.3.1's bare `dataProfiles` is refused, never checked less. */
+export declare function checkFlowProfiles(o: FlowOptions): void;
 /**
  * Resumes every rotation a journaled operation started and did not adopt:
  * a KEY_EPOCH whose ACK was lost leaves its DEK in the operation's pending

package/dist/identity/rotation.js

@@ -58,6 +58,8 @@ export function exposingRevocationsSince(chain) {
  * signature, authorization and the actor chain are checked (0.3.0).
  */
 export async function verifiedFrontier(channel, chain, local = { units: [], snapshot: [] }, data) {
+    if (data?.profile !== undefined)
+        checkUnitProfile(data.profile, "FrontierData.profile");
     const R = chain.state.resourceId;
     const opened = await channel.open(R);
     const ranges = opened.kind === "nack"
@@ -103,7 +105,7 @@ export async function verifiedFrontier(channel, chain, local = { units: [], snap
         // covers are attested by it (W §29.3).
         if (!covered &&
             data !== undefined &&
-            !(await acceptedAsData(chain, bytes, toHex(check.unitId), local, data)))
+            !(await acceptedAsData(chain, bytes, toHex(check.unitId), p.actor, local, data)))
             continue;
         const actor = toHex(p.actor);
         const last = latest.get(actor);
@@ -164,13 +166,14 @@ const opaque = (dataProfile) => ({
  * not decided here means those steps passed). A unit this client cannot
  * decrypt cannot be verified and stays outside the frontier (W §19).
  */
-async function acceptedAsData(chain, bytes, unitId, local, data) {
+async function acceptedAsData(chain, bytes, unitId, actor, local, data) {
     if (local.accepted?.has(unitId) === true)
         return true;
     if (local.refused?.has(unitId) === true)
         return false;
+    // The receiver's own check of this unit: bound to its Resource and signer (W §26.3 rule 7).
     const profile = data.profile !== undefined && data.profile.dataProfile === chain.state.dataProfile
-        ? data.profile
+        ? data.profile.codecFor({ resourceId: chain.state.resourceId, actor })
         : opaque(chain.state.dataProfile);
     const r = await receiveDataUnit(chain, bytes, {
         seen: new InMemorySeenUnits(),
@@ -191,6 +194,7 @@ async function acceptedAsData(chain, bytes, unitId, local, data) {
  * readers and receive nothing.
  */
 export async function rotateAfter(o) {
+    checkFlowProfiles(o);
     const journal = new OperationJournal(o.storage);
     const me = o.installation.signer;
     const R = o.resource;
@@ -278,11 +282,28 @@ export async function rotateAfter(o) {
  * stored accepted units and verified Snapshots, when the storage keeps them),
  * merged into the verified frontier (§8.3).
  */
-/** The codec the application gave for the Resource's Data Profile, if any. */
+/** The profile the application gave for the Resource's Data Profile, if any. */
 const profileFor = (o, chain) => {
-    const profile = o.dataProfiles?.find((p) => p.dataProfile === chain.state.dataProfile);
+    const profile = o.profiles?.find((p) => p.dataProfile === chain.state.dataProfile);
     return profile === undefined ? {} : { profile };
 };
+/**
+ * A profile given where a per-unit check is needed must be one: a bare codec
+ * (0.3.1's FlowOptions.dataProfiles, FrontierData.profile) cannot bind the
+ * change's actor to the unit's signer, so it is refused, never used as a
+ * weaker check (W §26.3 rule 7).
+ */
+function checkUnitProfile(profile, where) {
+    if (typeof profile.codecFor !== "function")
+        throw new TypeError(`${where} needs a per-unit profile (dataProfile and codecFor({resourceId, actor})), not a bare codec`);
+}
+/** The flow options of a rotation: 0.3.1's bare `dataProfiles` is refused, never checked less. */
+export function checkFlowProfiles(o) {
+    if (o.dataProfiles !== undefined)
+        throw new TypeError("FlowOptions.dataProfiles (bare codecs, 0.3.1) is replaced by FlowOptions.profiles (codecFor per unit): a codec without the unit's signer cannot check the change's actor");
+    for (const p of o.profiles ?? [])
+        checkUnitProfile(p, "FlowOptions.profiles");
+}
 async function localAccepted(o, chain) {
     const st = o.storage;
     if (st.dataUnits === undefined || st.snapshots === undefined)
@@ -328,6 +349,7 @@ async function localAccepted(o, chain) {
  * it (§9.1, §9.2). Run before planning new work on a Resource.
  */
 export async function resumeRotations(o) {
+    checkFlowProfiles(o);
     const journal = new OperationJournal(o.storage);
     const out = [];
     for (const op of await journal.list())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/client",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "LFCP client: session, Control Plane and Data Plane synchronization.",
   "keywords": [
     "openlfcp",
@@ -42,9 +42,9 @@
     "tag": "latest"
   },
   "dependencies": {
-    "@openlfcp/core": "^0.3.1",
-    "@openlfcp/crypto": "^0.3.1",
-    "@openlfcp/storage": "^0.3.1",
-    "@openlfcp/wire": "^0.3.1"
+    "@openlfcp/core": "^0.4.0",
+    "@openlfcp/storage": "^0.4.0",
+    "@openlfcp/wire": "^0.4.0",
+    "@openlfcp/crypto": "^0.4.0"
   }
 }