@peers-app/peers-sdk 0.27.4 → 0.28.0

package/dist/data/group-authority.js

@@ -0,0 +1,281 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeGroupAuthority = computeGroupAuthority;
+exports.roleInGroupAuthority = roleInGroupAuthority;
+exports.groupSigner = groupSigner;
+exports.getGroupAuthority = getGroupAuthority;
+exports.invalidateGroupAuthority = invalidateGroupAuthority;
+const keys_1 = require("../keys");
+const group_member_roles_1 = require("./group-member-roles");
+const user_permissions_1 = require("./user-permissions");
+/**
+ * Build a group's {@link IGroupAuthority} from its rows. Pure and deterministic: the same rows
+ * give the same roles on every device, whatever order they arrived in.
+ *
+ * - **Profiles:** `users` maps each user to the profile row that settles their keys: the first
+ *   row for a user pins the keys (an unsigned contact stub included) and a self-signed row with
+ *   the same keys verifies them.
+ * - **Founder:** from `pinnedGroup`. Without a personal pin no authority counts. A group row
+ *   naming a different founder counts only if the pinned founder signed it.
+ * - **Members:** starting from the founder, a membership counts when its signature is valid
+ *   and its signer already counts as at least Admin and at least the role granted. Repeated
+ *   until nothing changes, so a row can't justify itself or another row that justifies it.
+ *   Deleted rows don't count.
+ * - **Keys:** a role belongs to a key, not only a user id. The founder's key is their verified
+ *   profile row's. A membership names the member's key: it counts for that key, or for the
+ *   key the member's verified profile row has if that row shows the named key handing over to
+ *   it ({@link keySucceeds}). A profile row with any other key (a namesake a member forged on a
+ *   device that had never seen the real one) stops the grant counting rather than inheriting
+ *   it. Signatures count only by these keys.
+ * - **Group settings:** the group row's `publicRole` counts only when that row is signed by the
+ *   founder or a counted Admin; otherwise no public access is granted.
+ *
+ * @param input - The group's rows.
+ */
+function computeGroupAuthority(input) {
+    const { groupId, pinnedGroup, group } = input;
+    const users = verifiedUsers(input.users);
+    const keys = new Map();
+    const pinnedFounder = pinnedGroup?.groupId === groupId ? pinnedGroup.founderUserId : undefined;
+    const groupSigningKey = group && group.groupId === groupId ? (0, keys_1.signedByKey)(group) : undefined;
+    const signedByPinnedFounder = !!pinnedFounder && !!groupSigningKey && groupSigningKey === users.get(pinnedFounder)?.publicKey;
+    let founderUserId = pinnedFounder;
+    if (group && founderUserId && group.founderUserId !== founderUserId && signedByPinnedFounder) {
+        founderUserId = group.founderUserId;
+    }
+    const founderKey = founderUserId && users.get(founderUserId)?.publicKey;
+    if (founderUserId && founderKey)
+        keys.set(founderUserId, founderKey);
+    const roles = new Map();
+    if (founderUserId)
+        roles.set(founderUserId, group_member_roles_1.GroupMemberRole.Founder);
+    const pending = input.members
+        .filter((member) => member.groupId === groupId && !member.deleted)
+        .filter((member) => member.userId !== founderUserId)
+        .sort((a, b) => a.role - b.role ||
+        (a.groupMemberId < b.groupMemberId ? -1 : a.groupMemberId > b.groupMemberId ? 1 : 0));
+    const memberKey = (member) => {
+        if (!member.publicKey)
+            return undefined;
+        const profile = users.get(member.userId);
+        if (!profile)
+            return member.publicKey;
+        return (0, user_permissions_1.keySucceeds)(profile, member.publicKey) ? profile.publicKey : undefined;
+    };
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const member of pending) {
+            if (roles.has(member.userId))
+                continue;
+            const signerRole = groupSigner({ keys, roles }, member)?.signerRole;
+            if (signerRole === undefined ||
+                signerRole < group_member_roles_1.GroupMemberRole.Admin ||
+                signerRole < member.role) {
+                continue;
+            }
+            const key = memberKey(member);
+            if (member.role > group_member_roles_1.GroupMemberRole.None) {
+                if (!key)
+                    continue;
+                keys.set(member.userId, key);
+            }
+            roles.set(member.userId, member.role);
+            changed = true;
+        }
+    }
+    const groupSignerRole = group ? groupSigner({ keys, roles }, group)?.signerRole : undefined;
+    const groupRowAccepted = !!group &&
+        group.groupId === groupId &&
+        group.founderUserId === founderUserId &&
+        (signedByPinnedFounder ||
+            (groupSignerRole !== undefined &&
+                groupSignerRole >= group_member_roles_1.GroupMemberRole.Admin &&
+                groupSignerRole >= (group.publicRole ?? group_member_roles_1.GroupMemberRole.None)));
+    return {
+        groupId,
+        founderUserId,
+        publicRole: groupRowAccepted
+            ? (group.publicRole ?? group_member_roles_1.GroupMemberRole.None)
+            : group_member_roles_1.GroupMemberRole.None,
+        roles,
+        keys,
+        group: groupRowAccepted ? group : undefined,
+        users,
+    };
+}
+/**
+ * A user's role under `authority`: their counted membership, else the group's public role.
+ *
+ * Pass `publicKey` whenever the user is a remote caller: the role then counts only if it
+ * belongs to the key the caller authenticated with ({@link IGroupAuthority.keys}). Otherwise a
+ * device that proved a namesake's key somewhere else (another group's copy of a forged profile)
+ * would get the member's role here. A membership with role None applies whatever the key.
+ *
+ * @param authority - From {@link computeGroupAuthority} or {@link getGroupAuthority}.
+ * @param userId - User whose role is requested.
+ * @param publicKey - The signing key the caller authenticated with, when it is remote.
+ */
+function roleInGroupAuthority(authority, userId, publicKey) {
+    const role = authority.roles.get(userId);
+    if (role === undefined)
+        return authority.publicRole;
+    if (role > group_member_roles_1.GroupMemberRole.None &&
+        publicKey !== undefined &&
+        authority.keys.get(userId) !== publicKey) {
+        return authority.publicRole;
+    }
+    return role;
+}
+/**
+ * Each user's profile row that settles their keys, from self-signed Users rows. The first row
+ * for a user pins the keys, including an unsigned contact stub; a self-signed row with the same
+ * keys verifies them.
+ *
+ * @param users - Users rows, most trusted first.
+ */
+function verifiedUsers(users) {
+    const verified = new Map();
+    const pins = new Map();
+    for (const user of users) {
+        if (!user.publicKey)
+            continue;
+        const pin = pins.get(user.userId) ?? user;
+        pins.set(user.userId, pin);
+        if (!(0, user_permissions_1.sameUserIdentity)(user, pin))
+            continue;
+        if (verified.has(user.userId) || !(0, user_permissions_1.isSelfSignedUser)(user))
+            continue;
+        verified.set(user.userId, user);
+    }
+    return verified;
+}
+/**
+ * The counted member who signed `row` and their role: its signature verifies with the key
+ * their role belongs to under `authority`. Undefined for anyone else, whatever their profile says.
+ *
+ * @param authority - The group's verified authority.
+ * @param row - A signed row.
+ */
+function groupSigner(authority, row) {
+    const key = (0, keys_1.signedByKey)(row);
+    if (!key)
+        return undefined;
+    for (const [userId, memberKey] of authority.keys) {
+        if (memberKey === key) {
+            return { signer: userId, signerRole: authority.roles.get(userId) ?? group_member_roles_1.GroupMemberRole.None };
+        }
+    }
+    return undefined;
+}
+const caches = new WeakMap();
+const subscribed = new WeakMap();
+/**
+ * The verified authority for `groupId`, cached per user context and rebuilt after any change
+ * to that group's Groups, GroupMembers or Users rows, or to the user's own Groups or Users rows.
+ *
+ * @param userContext - Context that owns the group.
+ * @param groupId - Group id (never the personal context).
+ */
+async function getGroupAuthority(userContext, groupId) {
+    let byGroup = caches.get(userContext);
+    if (!byGroup) {
+        byGroup = new Map();
+        caches.set(userContext, byGroup);
+    }
+    let entry = byGroup.get(groupId);
+    if (!entry) {
+        entry = { generation: 0 };
+        byGroup.set(groupId, entry);
+    }
+    const dataContext = userContext.getDataContext(groupId);
+    if (entry.dataContext !== dataContext) {
+        invalidateGroupAuthority(userContext, groupId);
+        entry.dataContext = dataContext;
+    }
+    if (entry.loaded)
+        return entry.loaded;
+    if (entry.loading)
+        return entry.loading;
+    const cache = entry;
+    const generation = cache.generation;
+    const loading = (async () => {
+        await subscribeToAuthorityRows(userContext, groupId);
+        const loaded = await readGroupAuthority(userContext, groupId);
+        // Invalidation during the asynchronous reads also invalidates this caller's result.
+        if (cache.generation !== generation)
+            return getGroupAuthority(userContext, groupId);
+        cache.loaded = loaded;
+        return loaded;
+    })();
+    cache.loading = loading;
+    try {
+        return await loading;
+    }
+    finally {
+        if (cache.loading === loading)
+            cache.loading = undefined;
+    }
+}
+/** Drop cached authority for one group, or every group of `userContext`. */
+function invalidateGroupAuthority(userContext, groupId) {
+    const byGroup = caches.get(userContext);
+    if (!byGroup)
+        return;
+    const entries = groupId ? [byGroup.get(groupId)] : [...byGroup.values()];
+    for (const entry of entries) {
+        if (!entry)
+            continue;
+        entry.generation++;
+        entry.loaded = undefined;
+        entry.loading = undefined;
+    }
+}
+async function readGroupAuthority(userContext, groupId) {
+    const { Groups } = await Promise.resolve().then(() => require("./groups"));
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    const { Users } = await Promise.resolve().then(() => require("./users"));
+    const groupContext = userContext.getDataContext(groupId);
+    const [pinnedGroup, group, members, personalUsers, groupUsers] = await Promise.all([
+        Groups(userContext.userDataContext).get(groupId),
+        Groups(groupContext).get(groupId),
+        GroupMembers(groupContext).list({ groupId }),
+        Users(userContext.userDataContext).list(),
+        Users(groupContext).list(),
+    ]);
+    return computeGroupAuthority({
+        groupId,
+        pinnedGroup,
+        group,
+        members,
+        users: [...personalUsers, ...groupUsers],
+    });
+}
+async function subscribeToAuthorityRows(userContext, groupId) {
+    let groups = subscribed.get(userContext);
+    if (!groups) {
+        groups = new Map();
+        subscribed.set(userContext, groups);
+    }
+    const { Groups } = await Promise.resolve().then(() => require("./groups"));
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    const { Users } = await Promise.resolve().then(() => require("./users"));
+    for (const [key, dataContext] of [
+        ["", userContext.userDataContext],
+        [groupId, userContext.getDataContext(groupId)],
+    ]) {
+        const previous = groups.get(key);
+        if (previous?.dataContext === dataContext)
+            continue;
+        for (const subscription of previous?.subscriptions ?? [])
+            subscription.unsubscribe();
+        const invalidate = () => invalidateGroupAuthority(userContext, key || undefined);
+        const tables = key
+            ? [Groups(dataContext), GroupMembers(dataContext), Users(dataContext)]
+            : [Groups(dataContext), Users(dataContext)];
+        groups.set(key, {
+            dataContext,
+            subscriptions: tables.map((table) => table.dataChanged.subscribe(invalidate)),
+        });
+    }
+}

package/dist/data/group-members.d.ts

@@ -9,7 +9,9 @@ export declare const groupMemberSchema: z.ZodObject<{
     groupId: z.ZodEffects<z.ZodString, string, string>;
     userId: z.ZodEffects<z.ZodString, string, string>;
     role: z.ZodNativeEnum<typeof GroupMemberRole>;
+    publicKey: z.ZodOptional<z.ZodString>;
     signature: z.ZodString;
+    signedAt: z.ZodOptional<z.ZodNumber>;
     deleted: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     role: GroupMemberRole;
@@ -18,6 +20,8 @@ export declare const groupMemberSchema: z.ZodObject<{
     groupId: string;
     groupMemberId: string;
     deleted?: boolean | undefined;
+    publicKey?: string | undefined;
+    signedAt?: number | undefined;
 }, {
     role: GroupMemberRole;
     signature: string;
@@ -25,6 +29,8 @@ export declare const groupMemberSchema: z.ZodObject<{
     groupId: string;
     groupMemberId: string;
     deleted?: boolean | undefined;
+    publicKey?: string | undefined;
+    signedAt?: number | undefined;
 }>;
 /** A signed association between a user and a group with an assigned role. */
 export type IGroupMember = z.infer<typeof groupMemberSchema>;
@@ -40,8 +46,8 @@ export declare class GroupMembersTable extends Table<IGroupMember> {
      * Settle two membership rows for the same user in the same group: devices that approved the
      * same join at once could each write one, under a different id.
      *
-     * Merged only when both rows grant the same access (role and deleted state), so nothing about
-     * the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
+     * Merged only when both rows grant the same access (role, key and deleted state), so nothing
+     * about the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
      * row has it, otherwise the lexicographically smaller id; the winner is kept as it is, signature
      * included. Rows that disagree stay queued for a person. A pure function of the two rows, so
      * every device keeps the same one.

package/dist/data/group-members.js

@@ -41,12 +41,12 @@ const user_context_singleton_1 = require("../context/user-context-singleton");
 const decorators_1 = require("../data/orm/decorators");
 const zod_types_1 = require("../types/zod-types");
 const utils_1 = require("../utils");
+const authority_write_checks_1 = require("./authority-write-checks");
 const group_member_roles_1 = require("./group-member-roles");
-const group_permissions_1 = require("./group-permissions");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
-const users_1 = require("./users");
+const write_checks_1 = require("./orm/write-checks");
 /** Schema for a signed group membership, including its role and soft deletion state. */
 exports.groupMemberSchema = zod_1.z.object({
     groupMemberId: zod_types_1.zodPeerId,
@@ -55,7 +55,15 @@ exports.groupMemberSchema = zod_1.z.object({
     role: zod_1.z
         .nativeEnum(group_member_roles_1.GroupMemberRole)
         .describe('The role of the user in the group.  Use "none" to explicitly block a user'),
+    publicKey: zod_1.z
+        .string()
+        .optional()
+        .describe("The member's signing key this grant is for. The role counts only for this key, or a key it handed over to (the member's keySuccession)"),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
     deleted: zod_1.z
         .boolean()
         .optional()
@@ -70,6 +78,12 @@ const metaData = {
     fields: (0, types_1.schemaToFields)(exports.groupMemberSchema),
     indexes: [{ fields: ["groupId", "userId"], unique: true }],
 };
+/** A member's key as this device knows it: from their verified profile row. */
+async function knownKeyOf(groupMember) {
+    const { getGroupAuthority } = await Promise.resolve().then(() => require("./group-authority"));
+    const { users } = await getGroupAuthority(await (0, user_context_singleton_1.getUserContext)(), groupMember.groupId);
+    return users.get(groupMember.userId)?.publicKey;
+}
 // Symbol.for keeps signer registration shared by separately installed SDK copies.
 const signingKey = Symbol.for("@peers-app/peers-sdk/group-member-signing");
 const signingGlobals = globalThis;
@@ -87,27 +101,35 @@ let GroupMembersTable = (() => {
         }
         static isPassthrough = false;
         async save(groupMember, opts) {
-            if (GroupMembersTable.isPassthrough) {
-                return super.save(groupMember, opts);
+            if (!GroupMembersTable.isPassthrough) {
+                if (groupMember.groupId === (await (0, user_context_singleton_1.getUserContext)()).userId) {
+                    throw new Error("Group members cannot be added to personal user contexts");
+                }
+                await (0, write_checks_1.checkLocalSave)(this, groupMember, authority_write_checks_1.checkGroupMember);
             }
-            const me = await (0, users_1.getMe)();
-            if (groupMember.groupId === me.userId) {
-                throw new Error("Group members cannot be added to personal user contexts");
-            }
-            const oldGroupMember = groupMember.groupMemberId
-                ? await this.get(groupMember.groupMemberId)
-                : undefined;
-            if (await (0, group_permissions_1.isGroupMemberSignatureValid)(groupMember.groupId, groupMember, oldGroupMember)) {
-                return super.save(groupMember, opts);
-            }
-            throw new Error("Group member signature is not valid");
+            return super.save(groupMember, opts);
         }
         async signAndSave(groupMember, opts) {
             const sign = signingGlobals[signingKey];
             if (!sign) {
                 throw new Error("Group member signing must be enabled to sign and save group members. Call GroupMembersTable.enableGroupMemberSigning(fn) to enable it.");
             }
-            groupMember = sign.call(GroupMembersTable, groupMember);
+            const current = (groupMember.groupMemberId ? await this.get(groupMember.groupMemberId) : undefined) ??
+                (await this.findOne({ groupId: groupMember.groupId, userId: groupMember.userId }));
+            // A key the caller names, else the member's key as this device knows it, else the stored
+            // one. A block (role None) applies whatever the key.
+            const granted = groupMember.role > group_member_roles_1.GroupMemberRole.None;
+            const publicKey = groupMember.publicKey ??
+                (granted ? await knownKeyOf(groupMember) : undefined) ??
+                current?.publicKey;
+            if (!publicKey && granted) {
+                throw new Error(`No signed profile for user ${groupMember.userId} on this device: pass the member's publicKey`);
+            }
+            groupMember = sign.call(GroupMembersTable, {
+                ...groupMember,
+                ...(publicKey ? { publicKey } : {}),
+                ...(await (0, write_checks_1.signingStamp)(this, groupMember, current)),
+            });
             return this.save(groupMember, {
                 saveAsSnapshot: true,
                 restoreIfDeleted: true,
@@ -130,8 +152,8 @@ let GroupMembersTable = (() => {
          * Settle two membership rows for the same user in the same group: devices that approved the
          * same join at once could each write one, under a different id.
          *
-         * Merged only when both rows grant the same access (role and deleted state), so nothing about
-         * the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
+         * Merged only when both rows grant the same access (role, key and deleted state), so nothing
+         * about the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
          * row has it, otherwise the lexicographically smaller id; the winner is kept as it is, signature
          * included. Rows that disagree stay queued for a person. A pure function of the two rows, so
          * every device keeps the same one.
@@ -144,6 +166,7 @@ let GroupMembersTable = (() => {
                 return undefined;
             }
             if (incoming.role !== existing.role ||
+                incoming.publicKey !== existing.publicKey ||
                 Boolean(incoming.deleted) !== Boolean(existing.deleted)) {
                 return undefined;
             }

package/dist/data/group-permissions.d.ts

@@ -1,14 +1,21 @@
 import type { DataContext } from "../context/data-context";
 import type { UserContext } from "../context/user-context";
 import { GroupMemberRole } from "./group-member-roles";
-import type { IGroupMember } from "./group-members";
-import type { IGroup } from "./groups";
 export { GroupMemberRole };
 /**
  * Return a user's {@link GroupMemberRole} in `groupId`.
  *
- * Missing groups and the group's founder resolve to {@link GroupMemberRole.Founder},
- * which is how a personal context (no Groups row) becomes access 100.
+ * In a group, roles come from the group's verified authority ({@link getGroupAuthority}): only
+ * memberships and settings whose signers could grant them count, so a row synced from a member
+ * who changed their own copy of Peers can't raise anyone's role. A group this device doesn't
+ * have gives {@link GroupMemberRole.None}.
+ *
+ * In the personal context (`groupId` is the user's own id), the user is
+ * {@link GroupMemberRole.Founder}, and so is a user they trust as Self; anyone else is None.
+ *
+ * Pass `publicKey` for a remote caller: a role belongs to the key it was granted to, so a
+ * device that authenticated with any other key gets the group's public role (see
+ * `roleInGroupAuthority`). Local lookups leave it out.
  *
  * Prefer passing `userContext` from the provider that owns the data. The
  * process singleton is only a fallback and is not awaited — multi-device
@@ -17,18 +24,10 @@ export { GroupMemberRole };
  * @param groupId - Group id, or the user's id for their personal context.
  * @param userId - User whose role is requested.
  * @param userContext - Provider-owned context. Falls back to {@link peekUserContext}.
+ * @param publicKey - Signing key a remote caller authenticated with.
  * @throws If neither an explicit context nor the process singleton is available.
  */
-export declare function getUserRole(groupId: string, userId: string, userContext?: UserContext): Promise<GroupMemberRole>;
-/**
- * Resolve a group role from the signing public key of a Users record.
- *
- * Uses {@link peekUserContext}; throws if the process singleton is unset.
- *
- * @param groupId - Group or personal context id.
- * @param publicKey - User public key that signed a record.
- */
-export declare function getUserRoleFromPublicKey(groupId: string, publicKey: string): Promise<GroupMemberRole>;
+export declare function getUserRole(groupId: string, userId: string, userContext?: UserContext, publicKey?: string): Promise<GroupMemberRole>;
 /**
  * Return the current user's access level in `dataContext`.
  *
@@ -42,21 +41,6 @@ export declare function getCurrentUserAccessLevel(dataContext: DataContext): Pro
  *
  * @param dataContext - Context whose group/personal role is evaluated.
  * @param userId - User to resolve.
+ * @param publicKey - Signing key a remote caller authenticated with (see {@link getUserRole}).
  */
-export declare function getUserAccessLevel(dataContext: DataContext, userId: string): Promise<number>;
-/**
- * Verify that a group record was signed by an Admin+ member (Founder to change founder).
- *
- * @param group - Proposed group record.
- * @param oldGroup - Previous record when this is an update.
- */
-export declare function verifyGroupSignature(group: IGroup, oldGroup?: IGroup): Promise<void>;
-/**
- * Return whether a group-member write is signed by someone allowed to make it.
- *
- * @param groupId - Group the membership belongs to.
- * @param newGroupMember - Proposed membership row.
- * @param oldGroupMember - Previous row when this is an update.
- * @param signerRole - Optional precomputed signer role.
- */
-export declare function isGroupMemberSignatureValid(groupId: string, newGroupMember: IGroupMember, oldGroupMember?: IGroupMember, signerRole?: GroupMemberRole): Promise<boolean>;
+export declare function getUserAccessLevel(dataContext: DataContext, userId: string, publicKey?: string): Promise<number>;

package/dist/data/group-permissions.js

@@ -2,21 +2,28 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GroupMemberRole = void 0;
 exports.getUserRole = getUserRole;
-exports.getUserRoleFromPublicKey = getUserRoleFromPublicKey;
 exports.getCurrentUserAccessLevel = getCurrentUserAccessLevel;
 exports.getUserAccessLevel = getUserAccessLevel;
-exports.verifyGroupSignature = verifyGroupSignature;
-exports.isGroupMemberSignatureValid = isGroupMemberSignatureValid;
 const context_1 = require("../context");
-const keys_1 = require("../keys");
+const socket_type_1 = require("../device/socket.type");
 const access_level_1 = require("./access-level");
+const group_authority_1 = require("./group-authority");
 const group_member_roles_1 = require("./group-member-roles");
 Object.defineProperty(exports, "GroupMemberRole", { enumerable: true, get: function () { return group_member_roles_1.GroupMemberRole; } });
 /**
  * Return a user's {@link GroupMemberRole} in `groupId`.
  *
- * Missing groups and the group's founder resolve to {@link GroupMemberRole.Founder},
- * which is how a personal context (no Groups row) becomes access 100.
+ * In a group, roles come from the group's verified authority ({@link getGroupAuthority}): only
+ * memberships and settings whose signers could grant them count, so a row synced from a member
+ * who changed their own copy of Peers can't raise anyone's role. A group this device doesn't
+ * have gives {@link GroupMemberRole.None}.
+ *
+ * In the personal context (`groupId` is the user's own id), the user is
+ * {@link GroupMemberRole.Founder}, and so is a user they trust as Self; anyone else is None.
+ *
+ * Pass `publicKey` for a remote caller: a role belongs to the key it was granted to, so a
+ * device that authenticated with any other key gets the group's public role (see
+ * `roleInGroupAuthority`). Local lookups leave it out.
  *
  * Prefer passing `userContext` from the provider that owns the data. The
  * process singleton is only a fallback and is not awaited — multi-device
@@ -25,51 +32,23 @@ Object.defineProperty(exports, "GroupMemberRole", { enumerable: true, get: funct
  * @param groupId - Group id, or the user's id for their personal context.
  * @param userId - User whose role is requested.
  * @param userContext - Provider-owned context. Falls back to {@link peekUserContext}.
+ * @param publicKey - Signing key a remote caller authenticated with.
  * @throws If neither an explicit context nor the process singleton is available.
  */
-async function getUserRole(groupId, userId, userContext) {
-    const { Groups } = await Promise.resolve().then(() => require("./groups"));
-    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+async function getUserRole(groupId, userId, userContext, publicKey) {
     const ctx = userContext ?? (0, context_1.peekUserContext)();
     if (!ctx) {
         throw new Error("User context is not available");
     }
     await ctx.loadingPromise;
-    const groupDataContext = ctx.getDataContext(groupId);
-    const group = (await Groups(groupDataContext).get(groupId)) ||
-        (await Groups(ctx.userDataContext).get(groupId));
-    // If the group doesn't exist or the current user is explicitly the founder, return Founder role
-    if (!group || group.founderUserId === userId) {
-        return group_member_roles_1.GroupMemberRole.Founder;
+    if (groupId === ctx.userId) {
+        if (userId === ctx.userId)
+            return group_member_roles_1.GroupMemberRole.Founder;
+        const { getUserTrustLevel } = await Promise.resolve().then(() => require("./user-trust-levels"));
+        const trust = await getUserTrustLevel(ctx.userDataContext, userId);
+        return trust === socket_type_1.TrustLevel.Self ? group_member_roles_1.GroupMemberRole.Founder : group_member_roles_1.GroupMemberRole.None;
     }
-    const groupMembership = await GroupMembers(groupDataContext).findOne({ userId });
-    if (groupMembership) {
-        return groupMembership.role;
-    }
-    return group.publicRole || group_member_roles_1.GroupMemberRole.None;
-}
-/**
- * Resolve a group role from the signing public key of a Users record.
- *
- * Uses {@link peekUserContext}; throws if the process singleton is unset.
- *
- * @param groupId - Group or personal context id.
- * @param publicKey - User public key that signed a record.
- */
-async function getUserRoleFromPublicKey(groupId, publicKey) {
-    const { Users } = await Promise.resolve().then(() => require("./users"));
-    const userContext = (0, context_1.peekUserContext)();
-    if (!userContext) {
-        throw new Error("User context is not available");
-    }
-    await userContext.loadingPromise;
-    const groupDataContext = userContext.getDataContext(groupId);
-    const user = (await Users(groupDataContext).findOne({ publicKey })) ||
-        (await Users(userContext.userDataContext).findOne({ publicKey }));
-    if (user) {
-        return getUserRole(groupId, user?.userId, userContext);
-    }
-    return group_member_roles_1.GroupMemberRole.None;
+    return (0, group_authority_1.roleInGroupAuthority)(await (0, group_authority_1.getGroupAuthority)(ctx, groupId), userId, publicKey);
 }
 /**
  * Return the current user's access level in `dataContext`.
@@ -87,59 +66,10 @@ async function getCurrentUserAccessLevel(dataContext) {
  *
  * @param dataContext - Context whose group/personal role is evaluated.
  * @param userId - User to resolve.
+ * @param publicKey - Signing key a remote caller authenticated with (see {@link getUserRole}).
  */
-async function getUserAccessLevel(dataContext, userId) {
+async function getUserAccessLevel(dataContext, userId, publicKey) {
     const contextKey = dataContext.groupId ?? dataContext.userContext.userId;
-    const role = await getUserRole(contextKey, userId, dataContext.userContext);
+    const role = await getUserRole(contextKey, userId, dataContext.userContext, publicKey);
     return (0, access_level_1.accessLevelFromGroupRole)(role);
 }
-/**
- * Verify that a group record was signed by an Admin+ member (Founder to change founder).
- *
- * @param group - Proposed group record.
- * @param oldGroup - Previous record when this is an update.
- */
-async function verifyGroupSignature(group, oldGroup) {
-    (0, keys_1.verifyObjectSignature)(group);
-    const publicKey = (0, keys_1.getPublicKeyFromObjectSignature)(group) ?? "";
-    const signerRole = await getUserRoleFromPublicKey(group.groupId, publicKey);
-    if (oldGroup &&
-        oldGroup.founderUserId !== group.founderUserId &&
-        signerRole < group_member_roles_1.GroupMemberRole.Founder) {
-        throw new Error("Only group founders can change the founder of the group");
-    }
-    if (signerRole < group_member_roles_1.GroupMemberRole.Admin) {
-        throw new Error("Only group admins can modify group settings");
-    }
-}
-/**
- * Return whether a group-member write is signed by someone allowed to make it.
- *
- * @param groupId - Group the membership belongs to.
- * @param newGroupMember - Proposed membership row.
- * @param oldGroupMember - Previous row when this is an update.
- * @param signerRole - Optional precomputed signer role.
- */
-async function isGroupMemberSignatureValid(groupId, newGroupMember, oldGroupMember, signerRole) {
-    oldGroupMember ??= newGroupMember;
-    // Basic signature verification
-    if (!(0, keys_1.isObjectSignatureValid)(newGroupMember)) {
-        return false;
-    }
-    // Get the public key that signed this group member
-    const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(newGroupMember);
-    if (!signerPublicKey) {
-        return false;
-    }
-    // Determine signer's role in the group using the user-based permission system
-    signerRole ??= await getUserRoleFromPublicKey(groupId, signerPublicKey);
-    // Validate permissions for group member modifications
-    if (signerRole < group_member_roles_1.GroupMemberRole.Admin) {
-        return false; // Only group admins or above can modify group membership
-    }
-    // admins or above can only modify roles up to their own level
-    if (signerRole < newGroupMember.role || signerRole < oldGroupMember.role) {
-        return false;
-    }
-    return true;
-}