@peers-app/peers-sdk 0.27.4 → 0.28.0

package/dist/device/get-trust-level-fn.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getTrustLevelFn = getTrustLevelFn;
 const context_1 = require("../context");
 const data_1 = require("../data");
+const user_permissions_1 = require("../data/user-permissions");
 const key_change_1 = require("../identity/key-change");
 const socket_type_1 = require("./socket.type");
 function applyReportedDeviceName(device, deviceInfo) {
@@ -32,9 +33,7 @@ function getTrustLevelFn(me, serverUrl) {
             return socket_type_1.TrustLevel.Untrusted;
         }
         // if this is my own device it is trusted
-        if (deviceInfo.userId === me.userId &&
-            deviceInfo.publicKey === me.publicKey &&
-            deviceInfo.publicBoxKey === me.publicBoxKey) {
+        if ((0, user_permissions_1.sameUserIdentity)(deviceInfo, me)) {
             // if (deviceInfo.deviceId === thisDeviceId()) {
             //   return TrustLevel.Untrusted;
             // }
@@ -96,9 +95,7 @@ function getTrustLevelFn(me, serverUrl) {
                 (device ? deviceInfo.userId !== device.userId : false))) {
             return socket_type_1.TrustLevel.Untrusted;
         }
-        if (effectiveUser &&
-            (deviceInfo.publicKey !== effectiveUser.publicKey ||
-                deviceInfo.publicBoxKey !== effectiveUser.publicBoxKey)) {
+        if (effectiveUser && !(0, user_permissions_1.sameUserIdentity)(deviceInfo, effectiveUser)) {
             // A different box key for the key on record is a mismatch. A different signing key is
             // accepted only when the anchors on record confirm a rotation.
             if (deviceInfo.publicKey === effectiveUser.publicKey) {

package/dist/device/socket.type.d.ts

@@ -14,8 +14,8 @@ export interface RPCSendOptions {
     /** Arm the outbound frame cipher with these keys right after this reply frame has been sent. */
     armFrameCipherAfter?: FrameKeys;
 }
-/** Reply callback handed to RPC handlers. */
-export type RPCCallback = (error?: any, result?: any, sendOptions?: RPCSendOptions) => void;
+/** Reply callback handed to RPC handlers; async transports resolve after sending the reply. */
+export type RPCCallback = (error?: any, result?: any, sendOptions?: RPCSendOptions) => void | Promise<void>;
 /** Which direction(s) of the frame cipher to arm. */
 export type FrameCipherDirection = "both" | "send" | "receive";
 /**
@@ -40,11 +40,6 @@ export type TransportType = "ws" | "wrtc" | "unknown";
 export interface ISocket {
     id?: string;
     connected?: boolean;
-    /**
-     * @deprecated No longer needed - all sockets handle their own encoding.
-     * Kept temporarily for backwards compatibility during v1->v2 transition.
-     */
-    handlesOwnEncoding?: boolean;
     /**
      * Transport type for this socket. Used to optimize chunk sizes for raw byte streaming.
      * - 'wrtc': WebRTC (64KB max due to SCTP limits)
@@ -82,8 +77,8 @@ export interface ISocket {
     /**
      * Arms the per-connection frame cipher (see `frame-cipher.ts`). Sockets that
      * implement this seal every outbound frame and require every inbound frame to
-     * be sealed once the corresponding direction is armed. `Connection` only
-     * advertises `frameCrypto` support in its handshake when this is present.
+     * be sealed once the corresponding direction is armed. `Connection` refuses
+     * to run a handshake on a socket without it.
      * @param keys - This peer's send and receive keys
      * @param direction - Defaults to `"both"`. The handshake server arms
      *   `"receive"` first and lets the reply's {@link RPCSendOptions} arm send.
@@ -94,9 +89,8 @@ export interface ISocket {
     /**
      * Controls delivery of inbound plaintext `STREAM_*` frames. Sockets start
      * permissive so bare transports keep working; `Connection` turns this off on
-     * construction and only turns it back on for a verified legacy peer. Sealed
-     * stream frames are always delivered because arming implies a completed
-     * handshake.
+     * construction. Sealed stream frames are always delivered because arming
+     * implies a completed handshake.
      */
     setPlaintextStreamsAllowed?(allowed: boolean): void;
 }

package/dist/device-pairing/types.d.ts

@@ -1142,15 +1142,15 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1164,15 +1164,15 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1188,16 +1188,16 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     sourceIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
     destinationIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1212,16 +1212,16 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     sourceIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
     destinationIdentity: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1262,15 +1262,15 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1293,8 +1293,8 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1310,8 +1310,8 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1342,15 +1342,15 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1375,8 +1375,8 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1393,8 +1393,8 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     device: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1460,15 +1460,15 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1479,8 +1479,8 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     initializedDevice: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1491,8 +1491,8 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     initializedDevice: {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1515,15 +1515,15 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         }, "strip", z.ZodTypeAny, {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         }, {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         }>;
@@ -1534,8 +1534,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1546,8 +1546,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1564,8 +1564,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1580,8 +1580,8 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         initializedDevice: {
             publicKey: string;
             userId: string;
-            deviceId: string;
             publicBoxKey: string;
+            deviceId: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };

package/dist/identity/user-row-change.d.ts

@@ -33,9 +33,11 @@ export interface ResolveUserRowChangeParams {
  * The record is the personal `Users` row when it exists, else the row already stored in the
  * table being written. The rule:
  *
- * - Nothing stored yet: the row is the bootstrap and is applied as it is.
+ * - Nothing stored yet: bootstrap the identity; its initial anchors need an owner signature.
  * - A different key: the anchors on record decide ({@link evaluatePresentedKey}). The
  *   presented anchor list is ignored; the applied row keeps the list on record.
+ * - The user's own row with their current keys: takes the anchor list from their personal row.
+ * - A row with no list keeps the list on record.
  * - The same key and a different list: when nothing is on record the list is accepted as the
  *   bootstrap (an upgraded contact announcing its first anchors); when the personal record
  *   already holds the list it is accepted; otherwise the anchors on record must publish it

package/dist/identity/user-row-change.js

@@ -1,17 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveUserRowChange = resolveUserRowChange;
+const user_permissions_1 = require("../data/user-permissions");
 const users_1 = require("../data/users");
 const anchor_resolution_1 = require("./anchor-resolution");
 const key_change_1 = require("./key-change");
-function withAnchors(row, anchors) {
-    if ((0, anchor_resolution_1.sameAnchorList)(row.anchors, anchors))
-        return row;
-    if (!anchors?.length) {
-        const { anchors: _dropped, ...rest } = row;
-        return rest;
-    }
-    return { ...row, anchors };
+/** `row` carrying `source`'s anchor list and the owner's signature over it, or no list. */
+function withListOf(row, source) {
+    const { anchors: _anchors, anchorsSignature: _signature, ...profile } = row;
+    return { ...profile, ...(0, user_permissions_1.anchorFields)(source) };
+}
+/** `row` as a first record: its list only when the owner signed it, else no list. */
+function bootstrap(row) {
+    return (0, user_permissions_1.hasSignedUserAnchors)(row) ? row : withListOf(row, {});
 }
 /**
  * The one decision for every path that writes another user's `Users` row: a direct save, a
@@ -20,9 +21,11 @@ function withAnchors(row, anchors) {
  * The record is the personal `Users` row when it exists, else the row already stored in the
  * table being written. The rule:
  *
- * - Nothing stored yet: the row is the bootstrap and is applied as it is.
+ * - Nothing stored yet: bootstrap the identity; its initial anchors need an owner signature.
  * - A different key: the anchors on record decide ({@link evaluatePresentedKey}). The
  *   presented anchor list is ignored; the applied row keeps the list on record.
+ * - The user's own row with their current keys: takes the anchor list from their personal row.
+ * - A row with no list keeps the list on record.
  * - The same key and a different list: when nothing is on record the list is accepted as the
  *   bootstrap (an upgraded contact announcing its first anchors); when the personal record
  *   already holds the list it is accepted; otherwise the anchors on record must publish it
@@ -31,12 +34,19 @@ function withAnchors(row, anchors) {
  */
 async function resolveUserRowChange(params) {
     const { existing, incoming, personalContext } = params;
-    if (!existing?.publicKey)
-        return { action: "apply", row: incoming };
     const personal = await (0, users_1.Users)(personalContext).get(incoming.userId);
     const record = personal?.publicKey ? personal : existing;
-    const recordAnchors = personal?.anchors?.length ? personal.anchors : (existing.anchors ?? []);
-    if (incoming.publicKey !== existing.publicKey) {
+    if (!record?.publicKey)
+        return { action: "apply", row: bootstrap(incoming) };
+    const recordAnchors = record.anchors ?? [];
+    // My own row with my current keys: my personal copy is the record of my anchors, so a copy
+    // anywhere else carries that list (a stale or replayed copy can't move it either way).
+    if (incoming.userId === personalContext.userContext.userId &&
+        personal?.publicKey === incoming.publicKey &&
+        personal.publicBoxKey === incoming.publicBoxKey) {
+        return { action: "apply", row: withListOf(incoming, personal) };
+    }
+    if (incoming.publicKey !== record.publicKey || incoming.publicBoxKey !== record.publicBoxKey) {
         const decision = await (0, key_change_1.evaluatePresentedKey)({
             dataContext: personalContext,
             userId: incoming.userId,
@@ -47,18 +57,23 @@ async function resolveUserRowChange(params) {
         if (decision.accepted) {
             // The resolver may have just stored a confirmed list on the personal row.
             const confirmed = await (0, users_1.Users)(personalContext).get(incoming.userId);
-            const anchors = confirmed?.anchors?.length ? confirmed.anchors : recordAnchors;
-            return { action: "apply", row: withAnchors(incoming, anchors) };
+            return {
+                action: "apply",
+                row: withListOf(incoming, confirmed?.anchors?.length ? confirmed : record),
+            };
         }
         if (decision.state === "pending" || decision.state === "recovery-pending") {
             return { action: "defer", reason: "Key change is not confirmed by the anchors on record" };
         }
         return { action: "refuse", reason: "Key change is not confirmed by the anchors on record" };
     }
-    if ((0, anchor_resolution_1.sameAnchorList)(existing.anchors, incoming.anchors))
+    if ((0, anchor_resolution_1.sameAnchorList)(record.anchors, incoming.anchors))
         return { action: "apply", row: incoming };
+    // A row with no list (a stub, a copy that dropped it) proposes no change: keep the record's.
+    if (!incoming.anchors?.length)
+        return { action: "apply", row: withListOf(incoming, record) };
     if (recordAnchors.length === 0)
-        return { action: "apply", row: incoming };
+        return { action: "apply", row: bootstrap(incoming) };
     if ((0, anchor_resolution_1.sameAnchorList)(personal?.anchors, incoming.anchors)) {
         return { action: "apply", row: incoming };
     }
@@ -76,6 +91,6 @@ async function resolveUserRowChange(params) {
             reason: "Anchor list change is not confirmed by the anchors on record",
         };
     }
-    return { action: "apply", row: withAnchors(incoming, recordAnchors) };
+    return { action: "apply", row: withListOf(incoming, record) };
 }
 (0, users_1.setUserRowChangeGuard)((personalContext, incoming, existing) => resolveUserRowChange({ personalContext, incoming, existing }));

package/dist/invites/group-approval.js

@@ -35,13 +35,15 @@ async function buildGroupApproval(userContext, input) {
             groupId: input.groupId,
             userId: userContext.userId,
             role: data_1.GroupMemberRole.Founder,
+            publicKey: input.approverKeys.publicKey,
             signature: "",
         });
     }
-    if (!approvingMember || approvingMember.deleted || approvingMember.role < data_1.GroupMemberRole.Admin) {
+    const approvingRole = await (0, data_1.getUserRole)(input.groupId, userContext.userId, userContext);
+    if (!approvingMember || approvingRole < data_1.GroupMemberRole.Admin) {
         throw new Error("Only Admin or higher members can approve group joins");
     }
-    if (input.role > approvingMember.role) {
+    if (input.role > approvingRole) {
         throw new Error("Cannot grant a role higher than your own");
     }
     const groupSecretKey = await (0, data_1.readGroupSecretKey)(userContext, input.groupId, input.approverKeys.secretKey);
@@ -58,27 +60,24 @@ async function buildGroupApproval(userContext, input) {
         groupId: input.groupId,
         userId: input.joiner.userId,
     });
-    let membership;
-    if (existingMember) {
-        existingMember.role = input.role;
-        delete existingMember.deleted;
-        membership = await groupMembersTable.signAndSave(existingMember);
-    }
-    else {
-        // The same id on each of the approver's devices: a join several of them approve at once
-        // is one row, not rows that collide on (groupId, userId).
-        membership = await groupMembersTable.signAndSave({
-            groupMemberId: (0, utils_1.deterministicGroupMemberId)(input.groupId, input.joiner.userId),
-            groupId: input.groupId,
-            userId: input.joiner.userId,
-            role: input.role,
-            signature: "",
-        });
-    }
-    let adminMembers = await groupMembersTable.list({ deleted: { $ne: true }, role: { $gte: data_1.GroupMemberRole.Admin } }, { pageSize: 5, sortBy: ["-groupMemberId"] });
-    if (!adminMembers.some((member) => member.groupMemberId === approvingMember.groupMemberId)) {
-        adminMembers = [approvingMember, ...adminMembers];
-    }
+    // The same id on each approving device, while preserving an existing row's identity.
+    const membership = await groupMembersTable.signAndSave({
+        groupMemberId: (0, utils_1.deterministicGroupMemberId)(input.groupId, input.joiner.userId),
+        signature: "",
+        ...existingMember,
+        groupId: input.groupId,
+        userId: input.joiner.userId,
+        role: input.role,
+        publicKey: input.joiner.publicKey,
+        deleted: undefined,
+    });
+    const authority = await (0, data_1.getGroupAuthority)(userContext, input.groupId);
+    const adminMembers = (await groupMembersTable.list({ groupId: input.groupId })).filter((member) => !member.deleted &&
+        member.role >= data_1.GroupMemberRole.Admin &&
+        authority.roles.get(member.userId) === member.role);
+    // A joiner must verify the complete grant chain before it can admit its first peer: the
+    // verified profile of each member whose key counts, and no other contact of the approver's.
+    const seedUsers = [...authority.keys.keys()].flatMap((userId) => authority.users.get(userId) ?? []);
     const me = await (0, data_1.Users)(userContext.userDataContext).get(userContext.userId);
     if (!me) {
         throw new Error("My user object was not found in the DB. Is the user setup?");
@@ -100,7 +99,7 @@ async function buildGroupApproval(userContext, input) {
         membership,
         seed: {
             groupMembers: adminMembers,
-            users: [me],
+            users: seedUsers,
             devices: seedDevices,
         },
         approver: {