@peers-app/peers-sdk 0.27.4 → 0.28.0

package/dist/data/authority-write-checks.js

@@ -0,0 +1,324 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkGroupMember = checkGroupMember;
+exports.checkGroup = checkGroup;
+exports.checkPackageWrite = checkPackageWrite;
+exports.isPackageRowAdminSigned = isPackageRowAdminSigned;
+exports.checkPackageVersion = checkPackageVersion;
+const lodash_1 = require("lodash");
+const package_author_signing_1 = require("../package-installer/package-author-signing");
+const system_ids_1 = require("../system-ids");
+const devices_1 = require("./devices");
+const group_authority_1 = require("./group-authority");
+const group_member_roles_1 = require("./group-member-roles");
+const write_checks_1 = require("./orm/write-checks");
+const package_table_identity_1 = require("./package-table-identity");
+const persistent_vars_1 = require("./persistent-vars");
+const user_permissions_1 = require("./user-permissions");
+/**
+ * Write checks for the rows that decide authority in a group: memberships, the group row, user
+ * profiles (roles are traced through their keys), device ownership claims, packages and package
+ * versions. Sync writes rows without running the table classes' checks, so the host runs these
+ * on every synced change to a group context, and the table classes run the same checks on local
+ * saves. A refused change stays in history but its row isn't written. The personal context is
+ * left alone: only the user's own devices write it.
+ *
+ * Table names are literals here: the table modules import these checks, so importing their
+ * constants would make a cycle.
+ */
+/**
+ * The counted member who signed `row` and their role under the group's verified authority;
+ * refuses the write when nobody who counts signed it. Call only for a group context.
+ */
+async function requireSigner(tableName, row, context) {
+    const authority = await (0, group_authority_1.getGroupAuthority)(context.dataContext.userContext, context.dataContext.dataContextId);
+    const signer = (0, group_authority_1.groupSigner)(authority, row);
+    if (!signer) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "signature doesn't verify against a counted member's key");
+    }
+    return { authority, ...signer };
+}
+/**
+ * Check the signed stamp: package approvals belong to this context, and a replacement must
+ * not have been signed before the row on record. The
+ * tables' `signAndSave` puts `signedAt` under the signature, so a member can't restore a revoked
+ * grant, an earlier group setting or an earlier release selection by serving a copy of an older,
+ * validly signed row as a new change. Remember the stored stamp in device-local personal
+ * storage before it can be deleted: an unsigned package delete must not erase revocations.
+ * A row signed before the field existed counts as oldest.
+ */
+async function checkSignedOrder(tableName, existing, candidate, context) {
+    if (candidate &&
+        write_checks_1.packageApprovalTables.has(tableName) &&
+        candidate.signedContextId !== context.dataContext.groupId) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "signature is for another context or has no context");
+    }
+    if (candidate?.signedAt !== undefined && !Number.isSafeInteger(candidate.signedAt)) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "invalid signed timestamp");
+    }
+    const deletedFloor = write_checks_1.packageApprovalTables.has(tableName)
+        ? await (0, write_checks_1.deletedSignedAt)(tableName, context, candidate ? undefined : existing)
+        : 0;
+    const floor = Math.max(deletedFloor, existing?.signedAt ?? 0);
+    if (candidate &&
+        ((candidate.signedAt ?? 0) < floor ||
+            (deletedFloor > 0 && (candidate.signedAt ?? 0) <= deletedFloor))) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "signed before the row on record");
+    }
+    if (candidate?.signedAt !== undefined &&
+        candidate.signedAt === existing?.signedAt &&
+        candidate.signature !== existing.signature) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "conflicting signatures at the same signed timestamp");
+    }
+}
+/**
+ * A membership must be signed by a member who counts as at least Admin, at least the role
+ * granted, and at least the member's current role. Only the founder writes the founder's row.
+ * A membership is removed by a signed soft delete; a hard delete is allowed only for a
+ * duplicate row (the user has another membership row), as unique-conflict cleanup writes.
+ */
+async function checkGroupMember(existing, candidate, context) {
+    const groupId = context.dataContext.groupId;
+    if (!groupId)
+        return;
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    if (!candidate) {
+        if (!existing)
+            return;
+        const rows = [
+            ...(await GroupMembers(context.dataContext).list({ userId: existing.userId })),
+            ...(context.retainedRows ?? []),
+        ].filter((row) => !context.deletedRecordIds?.includes(row.groupMemberId));
+        if (rows.some((row) => row.groupId === existing.groupId &&
+            row.userId === existing.userId &&
+            row.groupMemberId !== existing.groupMemberId))
+            return;
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "memberships are removed by a signed delete");
+    }
+    if (candidate.groupId !== groupId || candidate.groupMemberId !== context.recordId) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "the row names another group");
+    }
+    if (existing &&
+        (existing.userId !== candidate.userId || existing.groupId !== candidate.groupId)) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "membership identity cannot change");
+    }
+    await checkSignedOrder("GroupMembers", existing, candidate, context);
+    const sameMember = await GroupMembers(context.dataContext).findOne({
+        groupId,
+        userId: candidate.userId,
+    });
+    if (sameMember && sameMember.groupMemberId !== candidate.groupMemberId) {
+        // Duplicate repair may change the primary key, but must retain the member's revocation.
+        await checkSignedOrder("GroupMembers", sameMember, candidate, context);
+    }
+    const { authority, signer, signerRole } = await requireSigner("GroupMembers", candidate, context);
+    if (candidate.userId === authority.founderUserId && signer !== authority.founderUserId) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "only the founder writes the founder's row");
+    }
+    const currentRole = authority.roles.get(candidate.userId) ?? group_member_roles_1.GroupMemberRole.None;
+    if (signerRole < group_member_roles_1.GroupMemberRole.Admin ||
+        signerRole < candidate.role ||
+        signerRole < currentRole) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", `${signer} (${group_member_roles_1.GroupMemberRole[signerRole] ?? signerRole}) can't set this membership`);
+    }
+}
+/**
+ * The group row must be signed by the founder or an Admin who counts, and only the founder can
+ * name a different founder. Sync never deletes it.
+ */
+async function checkGroup(existing, candidate, context) {
+    const groupId = context.dataContext.groupId;
+    if (!groupId)
+        return;
+    if (!candidate) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "the group row isn't deleted by sync");
+    }
+    if (candidate.groupId !== groupId || context.recordId !== groupId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "the row names another group");
+    }
+    await checkSignedOrder("Groups", existing, candidate, context);
+    // A counted signer implies a pinned founder: every key is traced back to one.
+    const { authority, signer, signerRole } = await requireSigner("Groups", candidate, context);
+    if (candidate.founderUserId !== authority.founderUserId && signer !== authority.founderUserId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "only the founder can name a new founder");
+    }
+    if (signerRole < group_member_roles_1.GroupMemberRole.Admin) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", `${signer} isn't an Admin`);
+    }
+    if ((candidate.publicRole ?? group_member_roles_1.GroupMemberRole.None) > signerRole) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "public role exceeds the signer's role");
+    }
+}
+/** Fields of a Packages row a Writer may change; everything else needs an Admin. */
+const writerPackageFields = new Set(["name", "description", "signature", "signedAt"]);
+/**
+ * A Writer may add a package; changing an existing one beyond its name and description (the
+ * active version, follow policy, update URL, publisher key, repository, disabled) needs an
+ * Admin. Deletes stay open to any member, as the table allows locally.
+ */
+async function checkPackageWrite(existing, candidate, context) {
+    if (!context.dataContext.groupId)
+        return;
+    await checkSignedOrder("Packages", existing, candidate, context);
+    if (!candidate)
+        return;
+    const { signerRole } = await requireSigner("Packages", candidate, context);
+    const needsAdmin = existing
+        ? [...new Set([...Object.keys(existing), ...Object.keys(candidate)])].some((field) => !writerPackageFields.has(field) &&
+            !(0, lodash_1.isEqual)(existing[field], candidate[field]))
+        : !!candidate.activePackageVersionId;
+    if (signerRole < (needsAdmin ? group_member_roles_1.GroupMemberRole.Admin : group_member_roles_1.GroupMemberRole.Writer)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Packages", needsAdmin
+            ? "only an Admin can change a package's settings or select a version"
+            : "only a Writer can add a package");
+    }
+}
+/**
+ * Whether an Admin's device may act on a package row by itself: install releases from its
+ * `updateUrl`, copy releases signed by its publisher key in from other contexts, and select one
+ * by its follow policy. Each of those signs the result with the Admin's key, so the row must be
+ * one an Admin signed: a Writer may add a package row, or delete one and add it again, with any
+ * publisher key and update URL. A peers-core row instead qualifies only while it names the
+ * peers-core publisher key (or a revoked one, which is re-pinned to it before any release is
+ * checked), whoever signed it. Always true outside a group.
+ *
+ * @param pkg - The package row in `dataContext`.
+ * @param dataContext - The context the row belongs to.
+ */
+async function isPackageRowAdminSigned(pkg, dataContext) {
+    if (!dataContext.groupId)
+        return true;
+    if (pkg.packageId === system_ids_1.peersCorePackageId) {
+        return (!!system_ids_1.peersCorePublishPublicKey &&
+            (pkg.publishPublicKey === system_ids_1.peersCorePublishPublicKey ||
+                (0, package_author_signing_1.isRevokedPublisherKey)(pkg.publishPublicKey)));
+    }
+    if (pkg.signedContextId !== dataContext.groupId)
+        return false;
+    const authority = await (0, group_authority_1.getGroupAuthority)(dataContext.userContext, dataContext.groupId);
+    return ((0, group_authority_1.groupSigner)(authority, pkg)?.signerRole ?? group_member_roles_1.GroupMemberRole.None) >= group_member_roles_1.GroupMemberRole.Admin;
+}
+/**
+ * A dev version needs a Writer's signature; any other tag needs an Admin's, so no member can
+ * choose the code other members' devices run. peers-core versions signed by its publisher are
+ * accepted from anyone, since every device installs the bundled release.
+ */
+async function checkPackageVersion(existing, candidate, context) {
+    if (!context.dataContext.groupId)
+        return;
+    if (!candidate)
+        return checkSignedOrder("PackageVersions", existing, candidate, context);
+    const isDev = candidate.versionTag === "dev" && (!existing || existing.versionTag === "dev");
+    if (!isDev &&
+        candidate.packageId === system_ids_1.peersCorePackageId &&
+        (0, package_author_signing_1.verifyPackageAuthorSignature)(candidate, system_ids_1.peersCorePublishPublicKey).valid) {
+        return;
+    }
+    await checkSignedOrder("PackageVersions", existing, candidate, context);
+    const { signerRole } = await requireSigner("PackageVersions", candidate, context);
+    if (signerRole < (isDev ? group_member_roles_1.GroupMemberRole.Writer : group_member_roles_1.GroupMemberRole.Admin)) {
+        throw (0, write_checks_1.writeNotAuthorized)("PackageVersions", isDev ? "only a Writer can add a dev version" : "only an Admin can release a version");
+    }
+}
+/**
+ * A user's profile row is theirs: once a self-signed row is stored, a replacement must be
+ * self-signed too, and it isn't deleted. Roles are traced through these rows' keys, so a member
+ * who could overwrite another member's row could stop that member's grants from counting. The
+ * same rule `UsersTable.save` applies locally; a key change is still judged by the anchors on
+ * record when the row syncs.
+ */
+async function checkUser(existing, candidate, context) {
+    if (!context.dataContext.groupId)
+        return;
+    if (candidate && candidate.userId !== context.recordId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "the row names another user");
+    }
+    if (candidate?.signature && !(0, user_permissions_1.isSelfSignedUser)(candidate)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "the profile isn't signed by its own key");
+    }
+    if (candidate) {
+        // The same identity/anchor rule applies to direct writes and recovery snapshots, which
+        // do not pass through the sync-specific Users hook. A personal pin also governs first insert.
+        const { resolveUserRowChange } = await Promise.resolve().then(() => require("../identity/user-row-change"));
+        const decision = await resolveUserRowChange({
+            personalContext: context.dataContext.userContext.userDataContext,
+            existing,
+            incoming: candidate,
+        });
+        if (decision.action !== "apply")
+            throw (0, write_checks_1.writeNotAuthorized)("Users", decision.reason);
+        candidate.anchors = decision.row.anchors;
+        candidate.anchorsSignature = decision.row.anchorsSignature;
+        if (!candidate.anchors)
+            delete candidate.anchors;
+    }
+    if (!existing?.signature)
+        return;
+    if (!candidate) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "a signed profile isn't deleted");
+    }
+    if (!candidate.signature) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "an unsigned profile can't replace a signed one");
+    }
+}
+/**
+ * A device its owner signed for (`ownerSignature`, checked against the owner's verified key)
+ * stays theirs: it isn't deleted, and a replacement keeps the owner and a valid signature. Mesh
+ * routing encrypts to a device's owner, so a member who could claim another member's device id
+ * would receive what was meant for it. Verified owners stay pinned across key changes; a new
+ * claim waits for its owner's verified profile. An unsigned discovery row may be replaced.
+ */
+async function checkDevice(existing, candidate, context) {
+    const { dataContext, recordId } = context;
+    if (!dataContext.groupId)
+        return;
+    if (candidate && candidate.deviceId !== recordId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "the row names another device");
+    }
+    const { users } = await (0, group_authority_1.getGroupAuthority)(dataContext.userContext, dataContext.groupId);
+    const signed = (row) => !!row && (0, devices_1.isDeviceOwnerSigned)(row, users.get(row.userId)?.publicKey);
+    const vars = (0, persistent_vars_1.PersistentVars)(dataContext.userContext.userDataContext);
+    const name = `deviceOwner:${dataContext.groupId}:${recordId}`;
+    const remembered = await vars.findOne({ name, scope: "device" });
+    const ownerId = remembered?.value.value ??
+        (signed(existing) ? existing?.userId : signed(candidate) ? candidate?.userId : undefined);
+    // Remember a verified owner before writing: profile rotation/recovery must not unpin an
+    // offline device. This is local evidence, retained through history replay and compaction.
+    if (ownerId && !remembered) {
+        await vars.save({ persistentVarId: "", name, scope: "device", value: { value: ownerId } });
+    }
+    if (ownerId && !candidate) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "a device its owner signed for isn't deleted");
+    }
+    if (ownerId && (candidate?.userId !== ownerId || !candidate?.ownerSignature)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "a device its owner signed for stays theirs");
+    }
+    // An unchanged established claim survives a key change; renewing it requires the new key.
+    // A new signed claim waits for its owner's verified profile, so it is pinned on first save.
+    if (candidate?.ownerSignature &&
+        !(ownerId && candidate.ownerSignature === existing?.ownerSignature) &&
+        !signed(candidate)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "the ownership claim doesn't verify");
+    }
+}
+(0, write_checks_1.registerTableWriteCheck)("Users", checkUser);
+(0, write_checks_1.registerTableWriteCheck)("Devices", checkDevice);
+(0, write_checks_1.registerTableWriteCheck)("GroupMembers", checkGroupMember);
+(0, write_checks_1.registerTableWriteCheck)("Groups", checkGroup);
+(0, write_checks_1.registerTableWriteCheck)("Packages", checkPackageWrite);
+(0, write_checks_1.registerTableWriteCheck)("PackageVersions", checkPackageVersion);
+(0, write_checks_1.registerTableWriteCheck)("PersistentVars", (_existing, candidate) => {
+    if (candidate && candidate.scope !== "group") {
+        throw (0, write_checks_1.writeNotAuthorized)("PersistentVars", "personal and device settings do not belong in a group");
+    }
+});
+(0, write_checks_1.registerTableWriteCheck)("TableDefinitions", (_existing, candidate) => {
+    if (!candidate)
+        return;
+    try {
+        (0, package_table_identity_1.validateTableDefinitionRecord)(candidate);
+    }
+    catch (error) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", String(error));
+    }
+});

package/dist/data/change-tracking.d.ts

@@ -26,10 +26,10 @@ export declare const changeRecordSchema: z.ZodObject<{
     supersededAt: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    createdAt: number;
-    changeId: string;
     tableName: string;
+    createdAt: number;
     recordId: string;
+    changeId: string;
     op: "set" | "delete" | "patch-text";
     appliedAt: number;
     value?: any;
@@ -37,10 +37,10 @@ export declare const changeRecordSchema: z.ZodObject<{
     supersededAt?: number | undefined;
 }, {
     path: string;
-    createdAt: number;
-    changeId: string;
     tableName: string;
+    createdAt: number;
     recordId: string;
+    changeId: string;
     op: "set" | "delete" | "patch-text";
     appliedAt: number;
     value?: any;

package/dist/data/create-group.js

@@ -55,6 +55,7 @@ async function createGroup(userContext, input) {
         groupId,
         userId: me.userId,
         role: group_member_roles_1.GroupMemberRole.Founder,
+        publicKey: me.publicKey,
         signature: "",
     });
     return group;

package/dist/data/devices.d.ts

@@ -15,6 +15,7 @@ export declare const deviceSchema: z.ZodObject<{
     reportedName: z.ZodOptional<z.ZodString>;
     serverUrl: z.ZodOptional<z.ZodString>;
     trustLevel: z.ZodNativeEnum<typeof TrustLevel>;
+    ownerSignature: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     userId: string;
     deviceId: string;
@@ -24,6 +25,7 @@ export declare const deviceSchema: z.ZodObject<{
     name?: string | undefined;
     reportedName?: string | undefined;
     serverUrl?: string | undefined;
+    ownerSignature?: string | undefined;
 }, {
     userId: string;
     deviceId: string;
@@ -33,9 +35,29 @@ export declare const deviceSchema: z.ZodObject<{
     name?: string | undefined;
     reportedName?: string | undefined;
     serverUrl?: string | undefined;
+    ownerSignature?: string | undefined;
 }>;
 /** A context-scoped device record containing local state and owner-reported metadata. */
 export type IDevice = z.infer<typeof deviceSchema>;
+/**
+ * What a device's owner signs to claim it: the contents of `ownerSignature`. Each device signs
+ * its own claim with its user's key and writes it to its row in every group it belongs to.
+ *
+ * @param device - The device id and the user it belongs to.
+ */
+export declare function deviceOwnerStatement(device: Pick<IDevice, "deviceId" | "userId">): {
+    purpose: string;
+    deviceId: string;
+    userId: string;
+};
+/**
+ * Whether `device.ownerSignature` is `ownerPublicKey`'s signature over
+ * {@link deviceOwnerStatement}: the owner, not whoever wrote the row, says the device is theirs.
+ *
+ * @param device - A Devices row.
+ * @param ownerPublicKey - The signing key of `device.userId`, as this device knows it.
+ */
+export declare function isDeviceOwnerSigned(device: Pick<IDevice, "deviceId" | "userId" | "ownerSignature">, ownerPublicKey: string | undefined): boolean;
 /** Schema for the signed identity and bounded presentation hints exchanged by devices. */
 export declare const deviceInfoSchema: z.ZodObject<{
     userId: z.ZodEffects<z.ZodString, string, string>;
@@ -47,15 +69,15 @@ export declare const deviceInfoSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     publicKey: string;
     userId: string;
-    deviceId: string;
     publicBoxKey: string;
+    deviceId: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
 }, {
     publicKey: string;
     userId: string;
-    deviceId: string;
     publicBoxKey: string;
+    deviceId: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
 }>;
@@ -155,9 +177,9 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     timestamp: number;
     publicKey: string;
     userId: string;
+    publicBoxKey: string;
     connectionId: string;
     deviceId: string;
-    publicBoxKey: string;
     serverAddress: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
@@ -180,9 +202,9 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     timestamp: number;
     publicKey: string;
     userId: string;
+    publicBoxKey: string;
     connectionId: string;
     deviceId: string;
-    publicBoxKey: string;
     serverAddress: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
@@ -214,6 +236,7 @@ export declare function Devices(dataContext?: DataContext): import("..").Table<{
     name?: string | undefined;
     reportedName?: string | undefined;
     serverUrl?: string | undefined;
+    ownerSignature?: string | undefined;
 }>;
 /** Relay server URLs trusted by the active group. */
 export declare const trustedServers: import("./persistent-vars").PersistentVar<string[]>;

package/dist/data/devices.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.thisDeviceId = exports.trustedServers = exports.deviceHandshakeSchema = exports.handshakeFrameCryptoSchema = exports.deviceInfoSchema = exports.deviceSchema = exports.displayNameSchema = exports.DISPLAY_NAME_MAX_LENGTH = void 0;
+exports.deviceOwnerStatement = deviceOwnerStatement;
+exports.isDeviceOwnerSigned = isDeviceOwnerSigned;
 exports.Devices = Devices;
 const zod_1 = require("zod");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const socket_type_1 = require("../device/socket.type");
 const key_contest_1 = require("../identity/key-contest");
+const keys_1 = require("../keys");
 const zod_types_1 = require("../types/zod-types");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
@@ -24,7 +27,35 @@ exports.deviceSchema = zod_1.z.object({
     reportedName: exports.displayNameSchema.optional(),
     serverUrl: zod_1.z.string().optional(),
     trustLevel: zod_1.z.nativeEnum(socket_type_1.TrustLevel),
+    ownerSignature: zod_1.z
+        .string()
+        .optional()
+        .describe("The owner's signature claiming this device for userId (see deviceOwnerStatement). In a group, only a row with a valid one says who a device belongs to, and it stays theirs"),
 });
+/**
+ * What a device's owner signs to claim it: the contents of `ownerSignature`. Each device signs
+ * its own claim with its user's key and writes it to its row in every group it belongs to.
+ *
+ * @param device - The device id and the user it belongs to.
+ */
+function deviceOwnerStatement(device) {
+    return { purpose: "peers-device-owner", deviceId: device.deviceId, userId: device.userId };
+}
+/**
+ * Whether `device.ownerSignature` is `ownerPublicKey`'s signature over
+ * {@link deviceOwnerStatement}: the owner, not whoever wrote the row, says the device is theirs.
+ *
+ * @param device - A Devices row.
+ * @param ownerPublicKey - The signing key of `device.userId`, as this device knows it.
+ */
+function isDeviceOwnerSigned(device, ownerPublicKey) {
+    if (!device.ownerSignature || !ownerPublicKey)
+        return false;
+    return ((0, keys_1.signedByKey)({
+        ...deviceOwnerStatement(device),
+        signature: `${ownerPublicKey}:${device.ownerSignature}`,
+    }) === ownerPublicKey);
+}
 /** Schema for the signed identity and bounded presentation hints exchanged by devices. */
 exports.deviceInfoSchema = zod_1.z.object({
     userId: zod_types_1.zodPeerId,

package/dist/data/group-authority.d.ts

@@ -0,0 +1,111 @@
+import type { UserContext } from "../context/user-context";
+import { GroupMemberRole } from "./group-member-roles";
+import type { IGroupMember } from "./group-members";
+import type { IGroup } from "./groups";
+import type { IUser } from "./users";
+/**
+ * Who holds which role in a group, counting only rows whose signatures check out against the
+ * group's own chain of authority.
+ *
+ * Sync writes rows without running the tables' checks, and any member's device can serve a
+ * row, so a role or setting is believed only when its signer could have granted it. Built by
+ * {@link computeGroupAuthority}; read through {@link getGroupAuthority}.
+ */
+export interface IGroupAuthority {
+    groupId: string;
+    /** The founder: the root every role is traced back to. Undefined when nothing names one. */
+    founderUserId?: string;
+    /** Role anyone without a membership gets, from the group row when that row counts. */
+    publicRole: GroupMemberRole;
+    /** Role of each member whose membership counts. The founder is {@link GroupMemberRole.Founder}. */
+    roles: ReadonlyMap<string, GroupMemberRole>;
+    /**
+     * The signing key each counted role belongs to, by user id. A device presenting a member's
+     * user id with another key doesn't get the member's role (see {@link roleInGroupAuthority}).
+     * Absent for a founder without a verified profile row and for members with role None.
+     */
+    keys: ReadonlyMap<string, string>;
+    /** The group-context Groups row, when it counts (signed by the founder or a counted Admin). */
+    group?: IGroup;
+    /** Each user's verified profile row (personal rows first), by user id. */
+    users: ReadonlyMap<string, IUser>;
+}
+/** The rows {@link computeGroupAuthority} works from. */
+export interface IGroupAuthorityInput {
+    groupId: string;
+    /**
+     * The user's own copy of the group row (personal context), written when they created or
+     * joined the group. Only their own devices write it, so its founder is the root of trust.
+     */
+    pinnedGroup?: IGroup;
+    /** The group's row in the group context, which any member's device can serve. */
+    group?: IGroup;
+    /** Every GroupMembers row in the group context. */
+    members: readonly IGroupMember[];
+    /**
+     * Users rows that map signing keys to users, most trusted first: the first row pins the
+     * keys, and a matching self-signed row verifies them. Pass personal rows before group rows.
+     */
+    users: readonly IUser[];
+}
+/**
+ * Build a group's {@link IGroupAuthority} from its rows. Pure and deterministic: the same rows
+ * give the same roles on every device, whatever order they arrived in.
+ *
+ * - **Profiles:** `users` maps each user to the profile row that settles their keys: the first
+ *   row for a user pins the keys (an unsigned contact stub included) and a self-signed row with
+ *   the same keys verifies them.
+ * - **Founder:** from `pinnedGroup`. Without a personal pin no authority counts. A group row
+ *   naming a different founder counts only if the pinned founder signed it.
+ * - **Members:** starting from the founder, a membership counts when its signature is valid
+ *   and its signer already counts as at least Admin and at least the role granted. Repeated
+ *   until nothing changes, so a row can't justify itself or another row that justifies it.
+ *   Deleted rows don't count.
+ * - **Keys:** a role belongs to a key, not only a user id. The founder's key is their verified
+ *   profile row's. A membership names the member's key: it counts for that key, or for the
+ *   key the member's verified profile row has if that row shows the named key handing over to
+ *   it ({@link keySucceeds}). A profile row with any other key (a namesake a member forged on a
+ *   device that had never seen the real one) stops the grant counting rather than inheriting
+ *   it. Signatures count only by these keys.
+ * - **Group settings:** the group row's `publicRole` counts only when that row is signed by the
+ *   founder or a counted Admin; otherwise no public access is granted.
+ *
+ * @param input - The group's rows.
+ */
+export declare function computeGroupAuthority(input: IGroupAuthorityInput): IGroupAuthority;
+/**
+ * A user's role under `authority`: their counted membership, else the group's public role.
+ *
+ * Pass `publicKey` whenever the user is a remote caller: the role then counts only if it
+ * belongs to the key the caller authenticated with ({@link IGroupAuthority.keys}). Otherwise a
+ * device that proved a namesake's key somewhere else (another group's copy of a forged profile)
+ * would get the member's role here. A membership with role None applies whatever the key.
+ *
+ * @param authority - From {@link computeGroupAuthority} or {@link getGroupAuthority}.
+ * @param userId - User whose role is requested.
+ * @param publicKey - The signing key the caller authenticated with, when it is remote.
+ */
+export declare function roleInGroupAuthority(authority: IGroupAuthority, userId: string, publicKey?: string): GroupMemberRole;
+/**
+ * The counted member who signed `row` and their role: its signature verifies with the key
+ * their role belongs to under `authority`. Undefined for anyone else, whatever their profile says.
+ *
+ * @param authority - The group's verified authority.
+ * @param row - A signed row.
+ */
+export declare function groupSigner(authority: Pick<IGroupAuthority, "keys" | "roles">, row: {
+    signature?: string;
+}): {
+    signer: string;
+    signerRole: GroupMemberRole;
+} | undefined;
+/**
+ * The verified authority for `groupId`, cached per user context and rebuilt after any change
+ * to that group's Groups, GroupMembers or Users rows, or to the user's own Groups or Users rows.
+ *
+ * @param userContext - Context that owns the group.
+ * @param groupId - Group id (never the personal context).
+ */
+export declare function getGroupAuthority(userContext: UserContext, groupId: string): Promise<IGroupAuthority>;
+/** Drop cached authority for one group, or every group of `userContext`. */
+export declare function invalidateGroupAuthority(userContext: UserContext, groupId?: string): void;