@openlfcp/client 0.3.1 → 0.5.0

package/dist/identity/rotation.js

@@ -3,7 +3,7 @@ import { generateResourceDEK, sha256 } from "@openlfcp/crypto";
 import { ABILITY, actsFor, addSequence, checkDataUnit, hasAbility, hasSequence, InMemorySeenUnits, isExposingRevocation, KEY_EPOCH_REASON, parseDataUnit, receiveDataUnit, rotateEpoch, } from "@openlfcp/wire";
 import { snapshotFrontier } from "../outbound.js";
 import { loadControlChain } from "../storage.js";
-import { deliverKeys, fetchDeks, readersAt, runControlPhase, storeDek, withoutEquivocations, } from "./context.js";
+import { deliverKeys, fetchDeks, readersAt, revokedByIdentity, runControlPhase, storeDek, withoutEquivocations, } from "./context.js";
 import { getPendingDek, OperationJournal, PackageLedger, pendingDekRef, phaseOf, putPendingDek, } from "./journal.js";
 import { IdentityUnavailable } from "./network.js";
 import { keyEpochAfter, recordSeq } from "./phases.js";
@@ -58,6 +58,8 @@ export function exposingRevocationsSince(chain) {
  * signature, authorization and the actor chain are checked (0.3.0).
  */
 export async function verifiedFrontier(channel, chain, local = { units: [], snapshot: [] }, data) {
+    if (data?.profile !== undefined)
+        checkUnitProfile(data.profile, "FrontierData.profile");
     const R = chain.state.resourceId;
     const opened = await channel.open(R);
     const ranges = opened.kind === "nack"
@@ -103,7 +105,7 @@ export async function verifiedFrontier(channel, chain, local = { units: [], snap
         // covers are attested by it (W §29.3).
         if (!covered &&
             data !== undefined &&
-            !(await acceptedAsData(chain, bytes, toHex(check.unitId), local, data)))
+            !(await acceptedAsData(chain, bytes, toHex(check.unitId), p.actor, local, data)))
             continue;
         const actor = toHex(p.actor);
         const last = latest.get(actor);
@@ -164,13 +166,14 @@ const opaque = (dataProfile) => ({
  * not decided here means those steps passed). A unit this client cannot
  * decrypt cannot be verified and stays outside the frontier (W §19).
  */
-async function acceptedAsData(chain, bytes, unitId, local, data) {
+async function acceptedAsData(chain, bytes, unitId, actor, local, data) {
     if (local.accepted?.has(unitId) === true)
         return true;
     if (local.refused?.has(unitId) === true)
         return false;
+    // The receiver's own check of this unit: bound to its Resource and signer (W §26.3 rule 7).
     const profile = data.profile !== undefined && data.profile.dataProfile === chain.state.dataProfile
-        ? data.profile
+        ? data.profile.codecFor({ resourceId: chain.state.resourceId, actor })
         : opaque(chain.state.dataProfile);
     const r = await receiveDataUnit(chain, bytes, {
         seen: new InMemorySeenUnits(),
@@ -188,9 +191,14 @@ async function acceptedAsData(chain, bytes, unitId, local, data) {
  * reuse it (§9.4). After the ACK the DEK goes to every reader of the new
  * head, each package recorded in the ledger; the revoked device, a
  * consumed or cancelled pairing device and suspended devices are not
- * readers and receive nothing.
+ * readers and receive nothing. With `identityChain`, neither does a reader that
+ * the rotator's Identity Resource has revoked, or whose chain in the
+ * Resource passes through such a device: a pair not yet propagated there
+ * (IDENTITY-PROFILE-01 §7.1 step 1) is treated as revoked, and the rotation
+ * closes the epoch for it as for the device just revoked.
  */
 export async function rotateAfter(o) {
+    checkFlowProfiles(o);
     const journal = new OperationJournal(o.storage);
     const me = o.installation.signer;
     const R = o.resource;
@@ -262,7 +270,8 @@ export async function rotateAfter(o) {
         ledger: new PackageLedger(o.storage),
         chain,
         sender: me,
-        recipients: readersAt(chain.state),
+        recipients: readersAt(chain.state).filter((r) => o.identityChain === undefined ||
+            !revokedByIdentity(o.identityChain, chain.state, r.principalId)),
         deks: send,
     });
     const phase = phaseOf(await journal.load(o.operation), id);
@@ -278,11 +287,28 @@ export async function rotateAfter(o) {
  * stored accepted units and verified Snapshots, when the storage keeps them),
  * merged into the verified frontier (§8.3).
  */
-/** The codec the application gave for the Resource's Data Profile, if any. */
+/** The profile the application gave for the Resource's Data Profile, if any. */
 const profileFor = (o, chain) => {
-    const profile = o.dataProfiles?.find((p) => p.dataProfile === chain.state.dataProfile);
+    const profile = o.profiles?.find((p) => p.dataProfile === chain.state.dataProfile);
     return profile === undefined ? {} : { profile };
 };
+/**
+ * A profile given where a per-unit check is needed must be one: a bare codec
+ * (0.3.1's FlowOptions.dataProfiles, FrontierData.profile) cannot bind the
+ * change's actor to the unit's signer, so it is refused, never used as a
+ * weaker check (W §26.3 rule 7).
+ */
+function checkUnitProfile(profile, where) {
+    if (typeof profile.codecFor !== "function")
+        throw new TypeError(`${where} needs a per-unit profile (dataProfile and codecFor({resourceId, actor})), not a bare codec`);
+}
+/** The flow options of a rotation: 0.3.1's bare `dataProfiles` is refused, never checked less. */
+export function checkFlowProfiles(o) {
+    if (o.dataProfiles !== undefined)
+        throw new TypeError("FlowOptions.dataProfiles (bare codecs, 0.3.1) is replaced by FlowOptions.profiles (codecFor per unit): a codec without the unit's signer cannot check the change's actor");
+    for (const p of o.profiles ?? [])
+        checkUnitProfile(p, "FlowOptions.profiles");
+}
 async function localAccepted(o, chain) {
     const st = o.storage;
     if (st.dataUnits === undefined || st.snapshots === undefined)
@@ -328,6 +354,7 @@ async function localAccepted(o, chain) {
  * it (§9.1, §9.2). Run before planning new work on a Resource.
  */
 export async function resumeRotations(o) {
+    checkFlowProfiles(o);
     const journal = new OperationJournal(o.storage);
     const out = [];
     for (const op of await journal.list())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/client",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "LFCP client: session, Control Plane and Data Plane synchronization.",
   "keywords": [
     "openlfcp",
@@ -42,9 +42,9 @@
     "tag": "latest"
   },
   "dependencies": {
-    "@openlfcp/core": "^0.3.1",
-    "@openlfcp/crypto": "^0.3.1",
-    "@openlfcp/storage": "^0.3.1",
-    "@openlfcp/wire": "^0.3.1"
+    "@openlfcp/core": "^0.5.0",
+    "@openlfcp/crypto": "^0.5.0",
+    "@openlfcp/storage": "^0.5.0",
+    "@openlfcp/wire": "^0.5.0"
   }
 }