@peers-app/peers-sdk 0.25.12 → 0.25.14

package/dist/package-installer/package-author-signing.test.js

@@ -128,6 +128,17 @@ describe("package-author-signing", () => {
             const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
             expect(result.valid).toBe(false);
         });
+        it("fails when a signed createdBy is changed", () => {
+            const signed = makePV({ createdBy: "00author0000000000000000a" });
+            const signedSignature = (0, package_author_signing_1.signPackageAuthor)(signed, keys.secretKey);
+            const tampered = {
+                ...signed,
+                createdBy: "00attacker000000000000000a",
+                packageAuthorSignature: signedSignature,
+            };
+            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
+            expect(result.valid).toBe(false);
+        });
     });
     describe("verification fails with wrong key", () => {
         it("rejects when verified against a different key", () => {

package/dist/package-installer/package-publisher.d.ts

@@ -33,7 +33,11 @@ export interface IBuildPublishArtifactsOpts {
     packageVersionId?: string;
     /** App navigation items to include in the tarball metadata. */
     appNavs?: IAppNav[];
-    /** Peer ID of the publisher. Recorded as `createdBy` on the PV. */
+    /**
+     * Peer ID recorded as `createdBy` and covered by the author signature.
+     * Defaults to `packageId`. The remote installer persists this field, and
+     * clients reject the version when the stored value is not the one that was signed.
+     */
     createdBy?: string;
 }
 /** Artifacts produced by {@link buildPublishArtifacts}. */

package/dist/package-installer/package-publisher.js

@@ -42,7 +42,7 @@ async function buildPublishArtifacts(opts) {
         routesBundleFileHash,
         uiBundleFileHash,
         appNavs: opts.appNavs,
-        createdBy: opts.createdBy,
+        createdBy: opts.createdBy || packageId,
         createdAt: now,
     };
     const payload = (0, package_author_signing_1.buildAuthorSignedPayload)(pvFields, publicKey);

package/dist/package-installer/package-publisher.test.js

@@ -93,6 +93,17 @@ describe("package-publisher", () => {
             const sigResult = (0, package_author_signing_1.verifyPackageAuthorSignature)(result.payload, wrongKeys.publicKey);
             expect(sigResult.valid).toBe(false);
         });
+        it("signs the package id as createdBy when the caller omits it", async () => {
+            const keys = (0, keys_1.newKeys)();
+            const opts = makeOpts({
+                publicKey: keys.publicKey,
+                sign: (payload) => (0, package_author_signing_1.signPackageAuthor)(payload, keys.secretKey),
+            });
+            const result = await (0, package_publisher_1.buildPublishArtifacts)(opts);
+            const unpacked = await (0, package_tarball_1.unpackPeersTarball)(result.tarball);
+            expect(unpacked.payload.createdBy).toBe(opts.packageId);
+            expect((0, package_author_signing_1.verifyPackageAuthorSignature)({ ...unpacked.payload, createdBy: opts.packageId }, keys.publicKey).valid).toBe(true);
+        });
         it("defaults versionTag to stable", async () => {
             const result = await (0, package_publisher_1.buildPublishArtifacts)(makeOpts());
             expect(result.pointer.versionTag).toBe("stable");

package/dist/package-installer/package-remote-checker.js

@@ -172,6 +172,9 @@ async function installRemotePackageVersion(dataContext, result) {
         appNavs: unpacked.payload.appNavs,
         packageAuthorSignature: unpacked.payload.packageAuthorSignature,
         signature: "",
+        // New publications include createdBy in the signed payload. Legacy
+        // tarballs omitted it, so their required database value defaults to the
+        // package id but does not pass later record-level author verification.
         createdBy: unpacked.payload.createdBy ?? packageId,
         createdAt: unpacked.payload.createdAt ?? new Date().toISOString(),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.25.12",
+  "version": "0.25.14",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"