@peerbit/server 7.0.1 → 8.0.0

package/dist/ui/index.html

@@ -23,7 +23,7 @@
       Learn how to configure a non-root public URL by running `npm run build`.
     -->
 	<title>Peerbit</title>
-  <script type="module" crossorigin src="/assets/index-CjZwCewh.js"></script>
+  <script type="module" crossorigin src="/assets/index-DS8hXn9k.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-CIfVvUo9.css">
 </head>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peerbit/server",
-  "version": "7.0.1",
+  "version": "8.0.0",
   "author": "Peerbit contributors",
   "repository": {
     "type": "git",
@@ -66,7 +66,7 @@
     "shx": "^0.3.4",
     "uuid": "^11.1.1",
     "@peerbit/test-lib": "0.0.1",
-    "@peerbit/test-utils": "3.1.8"
+    "@peerbit/test-utils": "3.1.10"
   },
   "dependencies": {
     "@dao-xyz/borsh": "^6.0.0",
@@ -89,12 +89,12 @@
     "tty-table": "^4.2.1",
     "uint8arrays": "^5.1.0",
     "yargs": "^17.7.2",
+    "@peerbit/program": "6.0.39",
     "@peerbit/crypto": "3.1.4",
+    "@peerbit/blocks": "4.2.6",
+    "@peerbit/pubsub": "5.3.4",
     "@peerbit/time": "3.0.1",
-    "@peerbit/pubsub": "5.3.2",
-    "@peerbit/blocks": "4.2.4",
-    "@peerbit/program": "6.0.37",
-    "peerbit": "5.3.8"
+    "peerbit": "5.3.10"
   },
   "bugs": {
     "url": "https://github.com/dao-xyz/peerbit/issues"

package/src/cli.ts

@@ -482,13 +482,51 @@ export const cli = async (args?: string[]) => {
 								createClient(await getKeypair(args.directory), remote),
 							),
 						);
-						const resolvedOrRejected = await Promise.allSettled(
-							apis.map((x) => x.peer.id.get()),
+						const identityStatuses = await Promise.all(
+							apis.map(async (api, index) => {
+								let observed: string;
+								try {
+									observed = peerIdFromString(
+										await api.peer.id.get(),
+									).toString();
+								} catch {
+									return "offline" as const;
+								}
+								const pinned = all[index].peerId;
+								if (!pinned) return "unpinned" as const;
+								let expected: string;
+								try {
+									expected = peerIdFromString(pinned).toString();
+								} catch {
+									return "mismatch" as const;
+								}
+								if (observed !== expected) return "mismatch" as const;
+								try {
+									const verified = peerIdFromString(
+										await api.peer.id.verify(),
+									).toString();
+									return verified === expected
+										? ("verified" as const)
+										: ("mismatch" as const);
+								} catch {
+									return "unverified" as const;
+								}
+							}),
 						);
 
 						if (all.length > 0) {
 							const rows: string[][] = [];
 							for (const [ix, remote] of all.entries()) {
+								const status =
+									identityStatuses[ix] === "verified"
+										? chalk.green("Y")
+										: identityStatuses[ix] === "unpinned"
+											? chalk.yellow("Y (unpinned)")
+											: identityStatuses[ix] === "mismatch"
+												? chalk.red("ID MISMATCH")
+												: identityStatuses[ix] === "unverified"
+													? chalk.red("ID UNVERIFIED")
+													: chalk.red("N");
 								const row = [
 									remote.name,
 									remote.group || "",
@@ -497,15 +535,13 @@ export const cli = async (args?: string[]) => {
 										: remote.origin?.type === "hetzner"
 											? `hetzner\n${remote.origin.location}\n${remote.origin.serverId}`
 											: "",
-									resolvedOrRejected[ix].status === "fulfilled"
-										? chalk.green("Y")
-										: chalk.red("N"),
+									status,
 									remote.address,
 								];
 								rows.push(row);
 							}
 							const table = Table(
-								["Name", "Group", "Origin", "Online", "Address"].map((x) => {
+								["Name", "Group", "Origin", "Status", "Address"].map((x) => {
 									return { value: x, align: "left" };
 								}),
 								rows,
@@ -537,6 +573,11 @@ export const cli = async (args?: string[]) => {
 								alias: "g",
 								default: DEFAULT_REMOTE_GROUP,
 							})
+							.option("peer-id", {
+								describe:
+									"Expected server peer ID for first enrollment (an existing pin cannot be replaced)",
+								type: "string",
+							})
 							.option("directory", {
 								describe: "Peerbit directory",
 								defaultDescription: "~.peerbit",
@@ -551,8 +592,40 @@ export const cli = async (args?: string[]) => {
 						if (args.name === "localhost") {
 							throw new Error("Remote can not be named 'localhost'");
 						}
-						const api = await createClient(await getKeypair(args.directory), {
+						const remotes = new Remotes(getRemotesPath(args.directory));
+						const existing = remotes.getByName(args.name);
+						const pinnedPeerId = existing?.peerId
+							? peerIdFromString(existing.peerId).toString()
+							: undefined;
+						const suppliedPeerId = args["peer-id"]
+							? peerIdFromString(args["peer-id"]).toString()
+							: undefined;
+						if (
+							pinnedPeerId &&
+							suppliedPeerId &&
+							pinnedPeerId !== suppliedPeerId
+						) {
+							throw new Error(
+								`Remote '${args.name}' is already pinned to ${pinnedPeerId}. Remove it before enrolling a different server identity.`,
+							);
+						}
+						const keypair = await getKeypair(args.directory);
+						const discovery = await createClient(keypair, {
+							address: args.address,
+						});
+						const discoveredPeerId = peerIdFromString(
+							await discovery.peer.id.get(),
+						).toString();
+						const expectedPeerId =
+							pinnedPeerId ?? suppliedPeerId ?? discoveredPeerId;
+						if (expectedPeerId !== discoveredPeerId) {
+							throw new Error(
+								`Server peer ID mismatch: expected ${expectedPeerId}, received ${discoveredPeerId}`,
+							);
+						}
+						const api = await createClient(keypair, {
 							address: args.address,
+							peerId: expectedPeerId,
 						});
 						try {
 							await api.program.list();
@@ -562,12 +635,13 @@ export const cli = async (args?: string[]) => {
 						if (!fs.existsSync(args.directory)) {
 							fs.mkdirSync(args.directory, { recursive: true });
 						}
-						const remotes = new Remotes(getRemotesPath(args.directory));
 						remotes.add({
 							name: args.name,
 							address: args.address,
 							group: args.group,
+							peerId: expectedPeerId,
 						});
+						console.log(`Pinned server peer ID: ${expectedPeerId}`);
 					},
 				})
 				.command({
@@ -666,6 +740,7 @@ export const cli = async (args?: string[]) => {
 										address: "http://localhost:" + LOCAL_API_PORT,
 										name: "localhost",
 										group: DEFAULT_REMOTE_GROUP,
+										peerId: (await keypair.publicKey.toPeerId()).toString(),
 									});
 								} else {
 									const remote = remotes.getByName(name);
@@ -686,6 +761,19 @@ export const cli = async (args?: string[]) => {
 							}
 						}
 
+						const newlyPinned: RemoteObject[] = [];
+						for (const remote of selectedRemotes) {
+							if (remote.peerId) continue;
+							const discovery = await createClient(keypair, {
+								address: remote.address,
+								origin: remote.origin,
+							});
+							remote.peerId = peerIdFromString(
+								await discovery.peer.id.get(),
+							).toString();
+							newlyPinned.push(remote);
+						}
+
 						const maxNameLength = selectedRemotes
 							.map((x) => x.name.length)
 							.reduce((prev, c, i) => {
@@ -731,6 +819,12 @@ export const cli = async (args?: string[]) => {
 									);
 								}
 							}
+							for (const remote of newlyPinned) {
+								remotes.add(remote);
+								console.warn(
+									`Pinned existing remote '${remote.name}' to server peer ID ${remote.peerId}`,
+								);
+							}
 
 							const rl = readline.createInterface({
 								input: process.stdin,

package/src/client.ts

@@ -12,6 +12,7 @@ import { waitForResolved } from "@peerbit/time";
 import { type RemoteOrigin, getRetiredAWSManagementError } from "./remotes.js";
 import {
 	ADDRESS_PATH,
+	AUTH_PATH,
 	BOOTSTRAP_PATH,
 	INSTALL_PATH,
 	LOCAL_API_PORT,
@@ -28,13 +29,18 @@ import {
 	TRUST_PATH,
 	VERSIONS_PATH,
 } from "./routes.js";
-import { signRequest } from "./signed-request.js";
+import {
+	type AuthDescriptor,
+	signRequest,
+	verifyAuthDescriptor,
+} from "./signed-request.js";
 import type { InstallDependency, StartProgram } from "./types.js";
 
 export const createClient = async (
 	keypair: Identity<Ed25519PublicKey>,
-	remote: { address: string; origin?: RemoteOrigin } = {
+	remote: { address: string; origin?: RemoteOrigin; peerId?: string } = {
 		address: "http://localhost:" + LOCAL_API_PORT,
+		peerId: keypair.publicKey.toPeerId().toString(),
 	},
 ) => {
 	// Add missing protocol
@@ -58,18 +64,100 @@ export const createClient = async (
 	}
 
 	const { default: axios } = await import("axios");
-	const axiosInstance = axios.create();
+	const axiosInstance = axios.create({
+		adapter: ["http", "fetch"],
+		maxRedirects: 0,
+		fetchOptions: { redirect: "manual" },
+		// The signature covers these exact bytes, so no later Axios transform may
+		// serialize or otherwise rewrite the request body.
+		transformRequest: [(data) => data],
+	});
+	const unsignedAxiosInstance = axios.create({
+		adapter: ["http", "fetch"],
+		maxRedirects: 0,
+		fetchOptions: { redirect: "manual" },
+	});
+	const endpointUrl = (path: string) => new URL(path, endpoint).toString();
+	let descriptorPromise: Promise<AuthDescriptor> | undefined;
+	const getAuthDescriptor = () => {
+		if (!remote.peerId) {
+			throw new Error(
+				"A pinned server peer ID is required for authenticated requests",
+			);
+		}
+		if (!descriptorPromise) {
+			descriptorPromise = unsignedAxiosInstance
+				.get(endpointUrl(AUTH_PATH), {
+					timeout: 5000,
+					maxContentLength: 16 * 1024,
+					maxBodyLength: 16 * 1024,
+					validateStatus: (status) => status === 200,
+				})
+				.then((response) => verifyAuthDescriptor(response.data, remote.peerId!))
+				.catch((error) => {
+					descriptorPromise = undefined;
+					throw new Error(
+						"Server does not support signed-request v2 or its identity does not match: " +
+							error?.toString(),
+					);
+				});
+		}
+		return descriptorPromise;
+	};
 	axiosInstance.interceptors.request.use(async (config) => {
-		const url = new URL(config.url!);
+		const url = new URL(config.url!, config.baseURL);
+		const method = config.method!.toUpperCase();
+		const target = url.pathname + url.search;
+		config.method = method;
+		if (
+			method === "GET" &&
+			(target === PEER_ID_PATH ||
+				target === ADDRESS_PATH ||
+				target === AUTH_PATH)
+		) {
+			return config;
+		}
+		let signedBody: string | Uint8Array | undefined;
+		if (config.data == null) {
+			config.data = undefined;
+			signedBody = undefined;
+		} else if (typeof config.data === "string") {
+			signedBody = config.data;
+		} else if (config.data instanceof Uint8Array) {
+			// Copy only this view (not its possibly larger backing buffer), then use a
+			// standalone ArrayBuffer accepted unchanged by both HTTP and fetch adapters.
+			signedBody = Uint8Array.from(config.data);
+			config.data = signedBody.buffer;
+		} else {
+			throw new Error("Authenticated request bodies must be strings or bytes");
+		}
+		const descriptor = await getAuthDescriptor();
 		await signRequest(
-			config.headers,
-			config.method!,
-			url.pathname + url.search,
-			config.data,
+			config.headers as unknown as Record<string, string>,
+			method,
+			target,
+			signedBody,
 			keypair,
+			{
+				serverPeerId: descriptor.serverPeerId,
+				bootId: descriptor.bootId,
+			},
 		);
 		return config;
 	});
+	axiosInstance.interceptors.response.use(
+		(response) => response,
+		(error) => {
+			if (error?.response?.status === 401 || error?.response == null) {
+				// A server restart changes the boot audience. Do not replay the failed
+				// operation; only force the next operation to discover a new descriptor.
+				// Network failure is included because an old keep-alive connection can be
+				// the first observable symptom of a process restart.
+				descriptorPromise = undefined;
+			}
+			return Promise.reject(error);
+		},
+	);
 
 	const validateStatus = (status: number) => {
 		return (status >= 200 && status < 300) || status === 404;
@@ -82,8 +170,6 @@ export const createClient = async (
 		return resp;
 	};
 
-	const endpointUrl = (path: string) => new URL(path, endpoint).toString();
-
 	const getId = async () =>
 		(
 			await waitForResolved(
@@ -102,6 +188,7 @@ export const createClient = async (
 				},
 			)
 		).toString();
+	const verifyId = async () => (await getAuthDescriptor()).serverPeerId;
 
 	const close = async (address: string) => {
 		return throwIfNot200(
@@ -133,6 +220,7 @@ export const createClient = async (
 		peer: {
 			id: {
 				get: getId,
+				verify: verifyId,
 			},
 			addresses: {
 				get: async () => {

package/src/remotes.ts

@@ -25,6 +25,8 @@ export interface RemoteObject {
 	address: string;
 	name: string;
 	group: string;
+	/** Stable server identity pinned when the remote is enrolled. */
+	peerId?: string;
 	origin?: RemoteOrigin;
 }
 
@@ -66,7 +68,16 @@ export class Remotes {
 	add(remote: RemoteObject) {
 		const existing = this.data.remotes.findIndex((x) => x.name === remote.name);
 		if (existing >= 0) {
-			this.data.remotes[existing] = remote;
+			const current = this.data.remotes[existing];
+			if (current.peerId && remote.peerId && current.peerId !== remote.peerId) {
+				throw new Error(
+					`Remote '${remote.name}' is pinned to a different server identity. Remove it before replacing the pin.`,
+				);
+			}
+			this.data.remotes[existing] = {
+				...remote,
+				peerId: current.peerId ?? remote.peerId,
+			};
 		} else {
 			this.data.remotes.push(remote);
 		}

package/src/routes.ts

@@ -14,6 +14,7 @@ export const LOCAL_API_PORT = 8082;
 export const TRUST_PATH = "/trust";
 export const PEER_ID_PATH = "/peer/id";
 export const ADDRESS_PATH = "/peer/address";
+export const AUTH_PATH = "/peer/auth";
 export const STATS_PATH = "/peer/stats";
 export const PROGRAM_PATH = "/program";
 export const PROGRAMS_PATH = "/programs";

package/src/server.ts

@@ -1,7 +1,12 @@
 /* eslint-disable no-console */
 import { deserialize, getSchema } from "@dao-xyz/borsh";
 import { peerIdFromString } from "@libp2p/peer-id";
-import { fromBase64, getPublicKeyFromPeerId } from "@peerbit/crypto";
+import {
+	fromBase64,
+	getPublicKeyFromPeerId,
+	randomBytes,
+	toBase64,
+} from "@peerbit/crypto";
 import {
 	Program,
 	getProgramFromVariant,
@@ -25,6 +30,7 @@ import { getKeypair, getNodePath, getTrustPath } from "./config.js";
 import { create } from "./peerbit.js";
 import {
 	ADDRESS_PATH,
+	AUTH_PATH,
 	BOOTSTRAP_PATH,
 	INSTALL_PATH,
 	LOCAL_API_PORT,
@@ -41,7 +47,14 @@ import {
 	VERSIONS_PATH,
 } from "./routes.js";
 import { JSONArgs, Session } from "./session.js";
-import { getBody, verifyRequest } from "./signed-request.js";
+import {
+	ReplayCapacityError,
+	RequestAuthenticator,
+	RequestBodyTooLargeError,
+	createAuthDescriptor,
+	getBody,
+	verifyRequestBody,
+} from "./signed-request.js";
 import { Trust } from "./trust.js";
 import type {
 	InstallDependency,
@@ -51,6 +64,7 @@ import type {
 } from "./types.js";
 
 const MAX_LISTENER_LIMIT = 1e5;
+const AUTH_DESCRIPTOR_CACHE_MS = 30_000;
 
 const getInstallDir = (): string | null => {
 	return (
@@ -332,6 +346,14 @@ export const startApiServer = async (
 		trust: Trust;
 		session?: Session;
 		port?: number;
+		signedRequests?: {
+			maxPastAgeSeconds?: number;
+			maxFutureSkewSeconds?: number;
+			maxBodyBytes?: number;
+			maxReplayEntries?: number;
+			wallClockMs?: () => number;
+			monotonicClockMs?: () => number;
+		};
 	},
 ): Promise<http.Server> => {
 	const port = properties?.port ?? LOCAL_API_PORT;
@@ -371,22 +393,69 @@ export const startApiServer = async (
 	if (!client.peerId.equals(await client.identity.publicKey.toPeerId())) {
 		throw new Error("Expecting node identity to equal peerId");
 	}
+	const audience = {
+		serverPeerId: client.peerId.toString(),
+		bootId: toBase64(randomBytes(32)),
+	};
+	const wallClockMs = properties.signedRequests?.wallClockMs ?? Date.now;
+	let cachedAuthDescriptor:
+		| {
+				descriptor: Awaited<ReturnType<typeof createAuthDescriptor>>;
+				at: number;
+		  }
+		| undefined;
+	let authDescriptorPromise:
+		| Promise<Awaited<ReturnType<typeof createAuthDescriptor>>>
+		| undefined;
+	const getAuthDescriptor = () => {
+		const now = wallClockMs();
+		if (
+			cachedAuthDescriptor &&
+			now >= cachedAuthDescriptor.at &&
+			now - cachedAuthDescriptor.at < AUTH_DESCRIPTOR_CACHE_MS
+		) {
+			return Promise.resolve(cachedAuthDescriptor.descriptor);
+		}
+		if (!authDescriptorPromise) {
+			authDescriptorPromise = createAuthDescriptor(
+				client.identity,
+				audience,
+				now,
+			)
+				.then((descriptor) => {
+					cachedAuthDescriptor = { descriptor, at: now };
+					return descriptor;
+				})
+				.finally(() => {
+					authDescriptorPromise = undefined;
+				});
+		}
+		return authDescriptorPromise;
+	};
+	const authenticator = new RequestAuthenticator({
+		...audience,
+		...properties.signedRequests,
+		isTrusted: (key) =>
+			key.equals(client.identity.publicKey) ||
+			properties.trust.isTrusted(key.hashcode()),
+	});
 
 	const getVerifiedBody = async (req: http.IncomingMessage) => {
-		const body = await getBody(req);
-		const result = await verifyRequest(
+		const verified = await authenticator.verify(
 			req.headers,
 			req.method!,
 			req.url!,
-			body,
 		);
-		if (result.equals(client.identity.publicKey)) {
-			return body;
-		}
-		if (properties.trust.isTrusted(result.hashcode())) {
-			return body;
-		}
-		throw new Error("Not trusted");
+		const body = await getBody(req, verified.bodyLength);
+		const decoded = verifyRequestBody(verified, body);
+		// Consume only after the signed bytes have arrived and matched. This keeps a
+		// raced bad body from burning the nonce while remaining atomic before dispatch.
+		authenticator.consume(verified);
+		return decoded;
+	};
+	const closeResponseConnection = (res: http.ServerResponse) => {
+		res.shouldKeepAlive = false;
+		res.setHeader("Connection", "close");
 	};
 
 	const e404 = "404";
@@ -406,14 +475,41 @@ export const startApiServer = async (
 				if (req.url) {
 					let body: string;
 					try {
-						body =
-							req.url.startsWith(PEER_ID_PATH) ||
-							req.url.startsWith(ADDRESS_PATH)
-								? await getBody(req)
-								: await getVerifiedBody(req);
+						const isPublicRequest =
+							req.method === "GET" &&
+							(req.url === PEER_ID_PATH ||
+								req.url === ADDRESS_PATH ||
+								req.url === AUTH_PATH);
+						if (
+							isPublicRequest &&
+							(req.headers["transfer-encoding"] != null ||
+								(req.headers["content-length"] != null &&
+									req.headers["content-length"] !== "0"))
+						) {
+							closeResponseConnection(res);
+							res.writeHead(400);
+							res.end("Public GET endpoints do not accept a request body");
+							return;
+						}
+						body = isPublicRequest ? "" : await getVerifiedBody(req);
 					} catch (error: any) {
-						res.writeHead(401);
-						res.end("Not authorized: " + error.toString());
+						const status =
+							error instanceof RequestBodyTooLargeError
+								? 413
+								: error instanceof ReplayCapacityError
+									? 503
+									: 401;
+						// Authentication can fail before the body is read. Disable keep-alive so
+						// an attacker cannot retain this connection by continuing to stream it.
+						closeResponseConnection(res);
+						res.writeHead(status);
+						res.end(
+							status === 413
+								? "Request body is too large"
+								: status === 503
+									? "Authentication is temporarily unavailable"
+									: "Not authorized",
+						);
 						return;
 					}
 
@@ -884,8 +980,8 @@ export const startApiServer = async (
 							}
 							case "DELETE": {
 								const removed = properties.trust.remove(getPathValue(req, 1));
-								res.writeHead(200);
-								res.end(removed);
+								res.writeHead(removed ? 200 : 404);
+								res.end();
 								break;
 							}
 							default:
@@ -996,6 +1092,12 @@ export const startApiServer = async (
 						} else {
 							r404();
 						}
+					} else if (req.url === AUTH_PATH && req.method === "GET") {
+						const authDescriptor = await getAuthDescriptor();
+						res.setHeader("Cache-Control", "no-store");
+						res.setHeader("Content-Type", "application/json");
+						res.writeHead(200);
+						res.end(JSON.stringify(authDescriptor));
 					} else if (req.url.startsWith(PEER_ID_PATH)) {
 						res.writeHead(200);
 						res.end(client.peerId.toString());