@peers-app/peers-sdk 0.27.5 → 0.28.0

package/dist/identity/user-row-change.js

@@ -1,17 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveUserRowChange = resolveUserRowChange;
+const user_permissions_1 = require("../data/user-permissions");
 const users_1 = require("../data/users");
 const anchor_resolution_1 = require("./anchor-resolution");
 const key_change_1 = require("./key-change");
-function withAnchors(row, anchors) {
-    if ((0, anchor_resolution_1.sameAnchorList)(row.anchors, anchors))
-        return row;
-    if (!anchors?.length) {
-        const { anchors: _dropped, ...rest } = row;
-        return rest;
-    }
-    return { ...row, anchors };
+/** `row` carrying `source`'s anchor list and the owner's signature over it, or no list. */
+function withListOf(row, source) {
+    const { anchors: _anchors, anchorsSignature: _signature, ...profile } = row;
+    return { ...profile, ...(0, user_permissions_1.anchorFields)(source) };
+}
+/** `row` as a first record: its list only when the owner signed it, else no list. */
+function bootstrap(row) {
+    return (0, user_permissions_1.hasSignedUserAnchors)(row) ? row : withListOf(row, {});
 }
 /**
  * The one decision for every path that writes another user's `Users` row: a direct save, a
@@ -20,9 +21,11 @@ function withAnchors(row, anchors) {
  * The record is the personal `Users` row when it exists, else the row already stored in the
  * table being written. The rule:
  *
- * - Nothing stored yet: the row is the bootstrap and is applied as it is.
+ * - Nothing stored yet: bootstrap the identity; its initial anchors need an owner signature.
  * - A different key: the anchors on record decide ({@link evaluatePresentedKey}). The
  *   presented anchor list is ignored; the applied row keeps the list on record.
+ * - The user's own row with their current keys: takes the anchor list from their personal row.
+ * - A row with no list keeps the list on record.
  * - The same key and a different list: when nothing is on record the list is accepted as the
  *   bootstrap (an upgraded contact announcing its first anchors); when the personal record
  *   already holds the list it is accepted; otherwise the anchors on record must publish it
@@ -31,12 +34,19 @@ function withAnchors(row, anchors) {
  */
 async function resolveUserRowChange(params) {
     const { existing, incoming, personalContext } = params;
-    if (!existing?.publicKey)
-        return { action: "apply", row: incoming };
     const personal = await (0, users_1.Users)(personalContext).get(incoming.userId);
     const record = personal?.publicKey ? personal : existing;
-    const recordAnchors = personal?.anchors?.length ? personal.anchors : (existing.anchors ?? []);
-    if (incoming.publicKey !== existing.publicKey) {
+    if (!record?.publicKey)
+        return { action: "apply", row: bootstrap(incoming) };
+    const recordAnchors = record.anchors ?? [];
+    // My own row with my current keys: my personal copy is the record of my anchors, so a copy
+    // anywhere else carries that list (a stale or replayed copy can't move it either way).
+    if (incoming.userId === personalContext.userContext.userId &&
+        personal?.publicKey === incoming.publicKey &&
+        personal.publicBoxKey === incoming.publicBoxKey) {
+        return { action: "apply", row: withListOf(incoming, personal) };
+    }
+    if (incoming.publicKey !== record.publicKey || incoming.publicBoxKey !== record.publicBoxKey) {
         const decision = await (0, key_change_1.evaluatePresentedKey)({
             dataContext: personalContext,
             userId: incoming.userId,
@@ -47,18 +57,23 @@ async function resolveUserRowChange(params) {
         if (decision.accepted) {
             // The resolver may have just stored a confirmed list on the personal row.
             const confirmed = await (0, users_1.Users)(personalContext).get(incoming.userId);
-            const anchors = confirmed?.anchors?.length ? confirmed.anchors : recordAnchors;
-            return { action: "apply", row: withAnchors(incoming, anchors) };
+            return {
+                action: "apply",
+                row: withListOf(incoming, confirmed?.anchors?.length ? confirmed : record),
+            };
         }
         if (decision.state === "pending" || decision.state === "recovery-pending") {
             return { action: "defer", reason: "Key change is not confirmed by the anchors on record" };
         }
         return { action: "refuse", reason: "Key change is not confirmed by the anchors on record" };
     }
-    if ((0, anchor_resolution_1.sameAnchorList)(existing.anchors, incoming.anchors))
+    if ((0, anchor_resolution_1.sameAnchorList)(record.anchors, incoming.anchors))
         return { action: "apply", row: incoming };
+    // A row with no list (a stub, a copy that dropped it) proposes no change: keep the record's.
+    if (!incoming.anchors?.length)
+        return { action: "apply", row: withListOf(incoming, record) };
     if (recordAnchors.length === 0)
-        return { action: "apply", row: incoming };
+        return { action: "apply", row: bootstrap(incoming) };
     if ((0, anchor_resolution_1.sameAnchorList)(personal?.anchors, incoming.anchors)) {
         return { action: "apply", row: incoming };
     }
@@ -76,6 +91,6 @@ async function resolveUserRowChange(params) {
             reason: "Anchor list change is not confirmed by the anchors on record",
         };
     }
-    return { action: "apply", row: withAnchors(incoming, recordAnchors) };
+    return { action: "apply", row: withListOf(incoming, record) };
 }
 (0, users_1.setUserRowChangeGuard)((personalContext, incoming, existing) => resolveUserRowChange({ personalContext, incoming, existing }));

package/dist/invites/group-approval.js

@@ -35,13 +35,15 @@ async function buildGroupApproval(userContext, input) {
             groupId: input.groupId,
             userId: userContext.userId,
             role: data_1.GroupMemberRole.Founder,
+            publicKey: input.approverKeys.publicKey,
             signature: "",
         });
     }
-    if (!approvingMember || approvingMember.deleted || approvingMember.role < data_1.GroupMemberRole.Admin) {
+    const approvingRole = await (0, data_1.getUserRole)(input.groupId, userContext.userId, userContext);
+    if (!approvingMember || approvingRole < data_1.GroupMemberRole.Admin) {
         throw new Error("Only Admin or higher members can approve group joins");
     }
-    if (input.role > approvingMember.role) {
+    if (input.role > approvingRole) {
         throw new Error("Cannot grant a role higher than your own");
     }
     const groupSecretKey = await (0, data_1.readGroupSecretKey)(userContext, input.groupId, input.approverKeys.secretKey);
@@ -58,27 +60,24 @@ async function buildGroupApproval(userContext, input) {
         groupId: input.groupId,
         userId: input.joiner.userId,
     });
-    let membership;
-    if (existingMember) {
-        existingMember.role = input.role;
-        delete existingMember.deleted;
-        membership = await groupMembersTable.signAndSave(existingMember);
-    }
-    else {
-        // The same id on each of the approver's devices: a join several of them approve at once
-        // is one row, not rows that collide on (groupId, userId).
-        membership = await groupMembersTable.signAndSave({
-            groupMemberId: (0, utils_1.deterministicGroupMemberId)(input.groupId, input.joiner.userId),
-            groupId: input.groupId,
-            userId: input.joiner.userId,
-            role: input.role,
-            signature: "",
-        });
-    }
-    let adminMembers = await groupMembersTable.list({ deleted: { $ne: true }, role: { $gte: data_1.GroupMemberRole.Admin } }, { pageSize: 5, sortBy: ["-groupMemberId"] });
-    if (!adminMembers.some((member) => member.groupMemberId === approvingMember.groupMemberId)) {
-        adminMembers = [approvingMember, ...adminMembers];
-    }
+    // The same id on each approving device, while preserving an existing row's identity.
+    const membership = await groupMembersTable.signAndSave({
+        groupMemberId: (0, utils_1.deterministicGroupMemberId)(input.groupId, input.joiner.userId),
+        signature: "",
+        ...existingMember,
+        groupId: input.groupId,
+        userId: input.joiner.userId,
+        role: input.role,
+        publicKey: input.joiner.publicKey,
+        deleted: undefined,
+    });
+    const authority = await (0, data_1.getGroupAuthority)(userContext, input.groupId);
+    const adminMembers = (await groupMembersTable.list({ groupId: input.groupId })).filter((member) => !member.deleted &&
+        member.role >= data_1.GroupMemberRole.Admin &&
+        authority.roles.get(member.userId) === member.role);
+    // A joiner must verify the complete grant chain before it can admit its first peer: the
+    // verified profile of each member whose key counts, and no other contact of the approver's.
+    const seedUsers = [...authority.keys.keys()].flatMap((userId) => authority.users.get(userId) ?? []);
     const me = await (0, data_1.Users)(userContext.userDataContext).get(userContext.userId);
     if (!me) {
         throw new Error("My user object was not found in the DB. Is the user setup?");
@@ -100,7 +99,7 @@ async function buildGroupApproval(userContext, input) {
         membership,
         seed: {
             groupMembers: adminMembers,
-            users: [me],
+            users: seedUsers,
             devices: seedDevices,
         },
         approver: {