@peers-app/peers-sdk 0.27.5 → 0.28.1

package/dist/data/group-members.js

@@ -41,12 +41,12 @@ const user_context_singleton_1 = require("../context/user-context-singleton");
 const decorators_1 = require("../data/orm/decorators");
 const zod_types_1 = require("../types/zod-types");
 const utils_1 = require("../utils");
+const authority_write_checks_1 = require("./authority-write-checks");
 const group_member_roles_1 = require("./group-member-roles");
-const group_permissions_1 = require("./group-permissions");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
-const users_1 = require("./users");
+const write_checks_1 = require("./orm/write-checks");
 /** Schema for a signed group membership, including its role and soft deletion state. */
 exports.groupMemberSchema = zod_1.z.object({
     groupMemberId: zod_types_1.zodPeerId,
@@ -55,7 +55,15 @@ exports.groupMemberSchema = zod_1.z.object({
     role: zod_1.z
         .nativeEnum(group_member_roles_1.GroupMemberRole)
         .describe('The role of the user in the group.  Use "none" to explicitly block a user'),
+    publicKey: zod_1.z
+        .string()
+        .optional()
+        .describe("The member's signing key this grant is for. The role counts only for this key, or a key it handed over to (the member's keySuccession)"),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
     deleted: zod_1.z
         .boolean()
         .optional()
@@ -70,6 +78,12 @@ const metaData = {
     fields: (0, types_1.schemaToFields)(exports.groupMemberSchema),
     indexes: [{ fields: ["groupId", "userId"], unique: true }],
 };
+/** A member's key as this device knows it: from their verified profile row. */
+async function knownKeyOf(groupMember) {
+    const { getGroupAuthority } = await Promise.resolve().then(() => require("./group-authority"));
+    const { users } = await getGroupAuthority(await (0, user_context_singleton_1.getUserContext)(), groupMember.groupId);
+    return users.get(groupMember.userId)?.publicKey;
+}
 // Symbol.for keeps signer registration shared by separately installed SDK copies.
 const signingKey = Symbol.for("@peers-app/peers-sdk/group-member-signing");
 const signingGlobals = globalThis;
@@ -87,27 +101,35 @@ let GroupMembersTable = (() => {
         }
         static isPassthrough = false;
         async save(groupMember, opts) {
-            if (GroupMembersTable.isPassthrough) {
-                return super.save(groupMember, opts);
+            if (!GroupMembersTable.isPassthrough) {
+                if (groupMember.groupId === (await (0, user_context_singleton_1.getUserContext)()).userId) {
+                    throw new Error("Group members cannot be added to personal user contexts");
+                }
+                await (0, write_checks_1.checkLocalSave)(this, groupMember, authority_write_checks_1.checkGroupMember);
             }
-            const me = await (0, users_1.getMe)();
-            if (groupMember.groupId === me.userId) {
-                throw new Error("Group members cannot be added to personal user contexts");
-            }
-            const oldGroupMember = groupMember.groupMemberId
-                ? await this.get(groupMember.groupMemberId)
-                : undefined;
-            if (await (0, group_permissions_1.isGroupMemberSignatureValid)(groupMember.groupId, groupMember, oldGroupMember)) {
-                return super.save(groupMember, opts);
-            }
-            throw new Error("Group member signature is not valid");
+            return super.save(groupMember, opts);
         }
         async signAndSave(groupMember, opts) {
             const sign = signingGlobals[signingKey];
             if (!sign) {
                 throw new Error("Group member signing must be enabled to sign and save group members. Call GroupMembersTable.enableGroupMemberSigning(fn) to enable it.");
             }
-            groupMember = sign.call(GroupMembersTable, groupMember);
+            const current = (groupMember.groupMemberId ? await this.get(groupMember.groupMemberId) : undefined) ??
+                (await this.findOne({ groupId: groupMember.groupId, userId: groupMember.userId }));
+            // A key the caller names, else the member's key as this device knows it, else the stored
+            // one. A block (role None) applies whatever the key.
+            const granted = groupMember.role > group_member_roles_1.GroupMemberRole.None;
+            const publicKey = groupMember.publicKey ??
+                (granted ? await knownKeyOf(groupMember) : undefined) ??
+                current?.publicKey;
+            if (!publicKey && granted) {
+                throw new Error(`No signed profile for user ${groupMember.userId} on this device: pass the member's publicKey`);
+            }
+            groupMember = sign.call(GroupMembersTable, {
+                ...groupMember,
+                ...(publicKey ? { publicKey } : {}),
+                ...(await (0, write_checks_1.signingStamp)(this, groupMember, current)),
+            });
             return this.save(groupMember, {
                 saveAsSnapshot: true,
                 restoreIfDeleted: true,
@@ -130,8 +152,8 @@ let GroupMembersTable = (() => {
          * Settle two membership rows for the same user in the same group: devices that approved the
          * same join at once could each write one, under a different id.
          *
-         * Merged only when both rows grant the same access (role and deleted state), so nothing about
-         * the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
+         * Merged only when both rows grant the same access (role, key and deleted state), so nothing
+         * about the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
          * row has it, otherwise the lexicographically smaller id; the winner is kept as it is, signature
          * included. Rows that disagree stay queued for a person. A pure function of the two rows, so
          * every device keeps the same one.
@@ -144,6 +166,7 @@ let GroupMembersTable = (() => {
                 return undefined;
             }
             if (incoming.role !== existing.role ||
+                incoming.publicKey !== existing.publicKey ||
                 Boolean(incoming.deleted) !== Boolean(existing.deleted)) {
                 return undefined;
             }

package/dist/data/group-permissions.d.ts

@@ -1,14 +1,21 @@
 import type { DataContext } from "../context/data-context";
 import type { UserContext } from "../context/user-context";
 import { GroupMemberRole } from "./group-member-roles";
-import type { IGroupMember } from "./group-members";
-import type { IGroup } from "./groups";
 export { GroupMemberRole };
 /**
  * Return a user's {@link GroupMemberRole} in `groupId`.
  *
- * Missing groups and the group's founder resolve to {@link GroupMemberRole.Founder},
- * which is how a personal context (no Groups row) becomes access 100.
+ * In a group, roles come from the group's verified authority ({@link getGroupAuthority}): only
+ * memberships and settings whose signers could grant them count, so a row synced from a member
+ * who changed their own copy of Peers can't raise anyone's role. A group this device doesn't
+ * have gives {@link GroupMemberRole.None}.
+ *
+ * In the personal context (`groupId` is the user's own id), the user is
+ * {@link GroupMemberRole.Founder}, and so is a user they trust as Self; anyone else is None.
+ *
+ * Pass `publicKey` for a remote caller: a role belongs to the key it was granted to, so a
+ * device that authenticated with any other key gets the group's public role (see
+ * `roleInGroupAuthority`). Local lookups leave it out.
  *
  * Prefer passing `userContext` from the provider that owns the data. The
  * process singleton is only a fallback and is not awaited — multi-device
@@ -17,18 +24,10 @@ export { GroupMemberRole };
  * @param groupId - Group id, or the user's id for their personal context.
  * @param userId - User whose role is requested.
  * @param userContext - Provider-owned context. Falls back to {@link peekUserContext}.
+ * @param publicKey - Signing key a remote caller authenticated with.
  * @throws If neither an explicit context nor the process singleton is available.
  */
-export declare function getUserRole(groupId: string, userId: string, userContext?: UserContext): Promise<GroupMemberRole>;
-/**
- * Resolve a group role from the signing public key of a Users record.
- *
- * Uses {@link peekUserContext}; throws if the process singleton is unset.
- *
- * @param groupId - Group or personal context id.
- * @param publicKey - User public key that signed a record.
- */
-export declare function getUserRoleFromPublicKey(groupId: string, publicKey: string): Promise<GroupMemberRole>;
+export declare function getUserRole(groupId: string, userId: string, userContext?: UserContext, publicKey?: string): Promise<GroupMemberRole>;
 /**
  * Return the current user's access level in `dataContext`.
  *
@@ -42,21 +41,6 @@ export declare function getCurrentUserAccessLevel(dataContext: DataContext): Pro
  *
  * @param dataContext - Context whose group/personal role is evaluated.
  * @param userId - User to resolve.
+ * @param publicKey - Signing key a remote caller authenticated with (see {@link getUserRole}).
  */
-export declare function getUserAccessLevel(dataContext: DataContext, userId: string): Promise<number>;
-/**
- * Verify that a group record was signed by an Admin+ member (Founder to change founder).
- *
- * @param group - Proposed group record.
- * @param oldGroup - Previous record when this is an update.
- */
-export declare function verifyGroupSignature(group: IGroup, oldGroup?: IGroup): Promise<void>;
-/**
- * Return whether a group-member write is signed by someone allowed to make it.
- *
- * @param groupId - Group the membership belongs to.
- * @param newGroupMember - Proposed membership row.
- * @param oldGroupMember - Previous row when this is an update.
- * @param signerRole - Optional precomputed signer role.
- */
-export declare function isGroupMemberSignatureValid(groupId: string, newGroupMember: IGroupMember, oldGroupMember?: IGroupMember, signerRole?: GroupMemberRole): Promise<boolean>;
+export declare function getUserAccessLevel(dataContext: DataContext, userId: string, publicKey?: string): Promise<number>;

package/dist/data/group-permissions.js

@@ -2,21 +2,28 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GroupMemberRole = void 0;
 exports.getUserRole = getUserRole;
-exports.getUserRoleFromPublicKey = getUserRoleFromPublicKey;
 exports.getCurrentUserAccessLevel = getCurrentUserAccessLevel;
 exports.getUserAccessLevel = getUserAccessLevel;
-exports.verifyGroupSignature = verifyGroupSignature;
-exports.isGroupMemberSignatureValid = isGroupMemberSignatureValid;
 const context_1 = require("../context");
-const keys_1 = require("../keys");
+const socket_type_1 = require("../device/socket.type");
 const access_level_1 = require("./access-level");
+const group_authority_1 = require("./group-authority");
 const group_member_roles_1 = require("./group-member-roles");
 Object.defineProperty(exports, "GroupMemberRole", { enumerable: true, get: function () { return group_member_roles_1.GroupMemberRole; } });
 /**
  * Return a user's {@link GroupMemberRole} in `groupId`.
  *
- * Missing groups and the group's founder resolve to {@link GroupMemberRole.Founder},
- * which is how a personal context (no Groups row) becomes access 100.
+ * In a group, roles come from the group's verified authority ({@link getGroupAuthority}): only
+ * memberships and settings whose signers could grant them count, so a row synced from a member
+ * who changed their own copy of Peers can't raise anyone's role. A group this device doesn't
+ * have gives {@link GroupMemberRole.None}.
+ *
+ * In the personal context (`groupId` is the user's own id), the user is
+ * {@link GroupMemberRole.Founder}, and so is a user they trust as Self; anyone else is None.
+ *
+ * Pass `publicKey` for a remote caller: a role belongs to the key it was granted to, so a
+ * device that authenticated with any other key gets the group's public role (see
+ * `roleInGroupAuthority`). Local lookups leave it out.
  *
  * Prefer passing `userContext` from the provider that owns the data. The
  * process singleton is only a fallback and is not awaited — multi-device
@@ -25,51 +32,23 @@ Object.defineProperty(exports, "GroupMemberRole", { enumerable: true, get: funct
  * @param groupId - Group id, or the user's id for their personal context.
  * @param userId - User whose role is requested.
  * @param userContext - Provider-owned context. Falls back to {@link peekUserContext}.
+ * @param publicKey - Signing key a remote caller authenticated with.
  * @throws If neither an explicit context nor the process singleton is available.
  */
-async function getUserRole(groupId, userId, userContext) {
-    const { Groups } = await Promise.resolve().then(() => require("./groups"));
-    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+async function getUserRole(groupId, userId, userContext, publicKey) {
     const ctx = userContext ?? (0, context_1.peekUserContext)();
     if (!ctx) {
         throw new Error("User context is not available");
     }
     await ctx.loadingPromise;
-    const groupDataContext = ctx.getDataContext(groupId);
-    const group = (await Groups(groupDataContext).get(groupId)) ||
-        (await Groups(ctx.userDataContext).get(groupId));
-    // If the group doesn't exist or the current user is explicitly the founder, return Founder role
-    if (!group || group.founderUserId === userId) {
-        return group_member_roles_1.GroupMemberRole.Founder;
+    if (groupId === ctx.userId) {
+        if (userId === ctx.userId)
+            return group_member_roles_1.GroupMemberRole.Founder;
+        const { getUserTrustLevel } = await Promise.resolve().then(() => require("./user-trust-levels"));
+        const trust = await getUserTrustLevel(ctx.userDataContext, userId);
+        return trust === socket_type_1.TrustLevel.Self ? group_member_roles_1.GroupMemberRole.Founder : group_member_roles_1.GroupMemberRole.None;
     }
-    const groupMembership = await GroupMembers(groupDataContext).findOne({ userId });
-    if (groupMembership) {
-        return groupMembership.role;
-    }
-    return group.publicRole || group_member_roles_1.GroupMemberRole.None;
-}
-/**
- * Resolve a group role from the signing public key of a Users record.
- *
- * Uses {@link peekUserContext}; throws if the process singleton is unset.
- *
- * @param groupId - Group or personal context id.
- * @param publicKey - User public key that signed a record.
- */
-async function getUserRoleFromPublicKey(groupId, publicKey) {
-    const { Users } = await Promise.resolve().then(() => require("./users"));
-    const userContext = (0, context_1.peekUserContext)();
-    if (!userContext) {
-        throw new Error("User context is not available");
-    }
-    await userContext.loadingPromise;
-    const groupDataContext = userContext.getDataContext(groupId);
-    const user = (await Users(groupDataContext).findOne({ publicKey })) ||
-        (await Users(userContext.userDataContext).findOne({ publicKey }));
-    if (user) {
-        return getUserRole(groupId, user?.userId, userContext);
-    }
-    return group_member_roles_1.GroupMemberRole.None;
+    return (0, group_authority_1.roleInGroupAuthority)(await (0, group_authority_1.getGroupAuthority)(ctx, groupId), userId, publicKey);
 }
 /**
  * Return the current user's access level in `dataContext`.
@@ -87,59 +66,10 @@ async function getCurrentUserAccessLevel(dataContext) {
  *
  * @param dataContext - Context whose group/personal role is evaluated.
  * @param userId - User to resolve.
+ * @param publicKey - Signing key a remote caller authenticated with (see {@link getUserRole}).
  */
-async function getUserAccessLevel(dataContext, userId) {
+async function getUserAccessLevel(dataContext, userId, publicKey) {
     const contextKey = dataContext.groupId ?? dataContext.userContext.userId;
-    const role = await getUserRole(contextKey, userId, dataContext.userContext);
+    const role = await getUserRole(contextKey, userId, dataContext.userContext, publicKey);
     return (0, access_level_1.accessLevelFromGroupRole)(role);
 }
-/**
- * Verify that a group record was signed by an Admin+ member (Founder to change founder).
- *
- * @param group - Proposed group record.
- * @param oldGroup - Previous record when this is an update.
- */
-async function verifyGroupSignature(group, oldGroup) {
-    (0, keys_1.verifyObjectSignature)(group);
-    const publicKey = (0, keys_1.getPublicKeyFromObjectSignature)(group) ?? "";
-    const signerRole = await getUserRoleFromPublicKey(group.groupId, publicKey);
-    if (oldGroup &&
-        oldGroup.founderUserId !== group.founderUserId &&
-        signerRole < group_member_roles_1.GroupMemberRole.Founder) {
-        throw new Error("Only group founders can change the founder of the group");
-    }
-    if (signerRole < group_member_roles_1.GroupMemberRole.Admin) {
-        throw new Error("Only group admins can modify group settings");
-    }
-}
-/**
- * Return whether a group-member write is signed by someone allowed to make it.
- *
- * @param groupId - Group the membership belongs to.
- * @param newGroupMember - Proposed membership row.
- * @param oldGroupMember - Previous row when this is an update.
- * @param signerRole - Optional precomputed signer role.
- */
-async function isGroupMemberSignatureValid(groupId, newGroupMember, oldGroupMember, signerRole) {
-    oldGroupMember ??= newGroupMember;
-    // Basic signature verification
-    if (!(0, keys_1.isObjectSignatureValid)(newGroupMember)) {
-        return false;
-    }
-    // Get the public key that signed this group member
-    const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(newGroupMember);
-    if (!signerPublicKey) {
-        return false;
-    }
-    // Determine signer's role in the group using the user-based permission system
-    signerRole ??= await getUserRoleFromPublicKey(groupId, signerPublicKey);
-    // Validate permissions for group member modifications
-    if (signerRole < group_member_roles_1.GroupMemberRole.Admin) {
-        return false; // Only group admins or above can modify group membership
-    }
-    // admins or above can only modify roles up to their own level
-    if (signerRole < newGroupMember.role || signerRole < oldGroupMember.role) {
-        return false;
-    }
-    return true;
-}

package/dist/data/group-resign.d.ts

@@ -0,0 +1,38 @@
+import type { DataContext } from "../context/data-context";
+/** What {@link resignGroupAuthority} did, per table. */
+export interface IResignGroupAuthorityResult {
+    /** Rows re-signed. */
+    resigned: Record<"Groups" | "GroupMembers" | "Packages" | "PackageVersions", number>;
+    /** Rows left as they were because their table refused this user's signature, with why. */
+    refused: {
+        table: string;
+        recordId: string;
+        error: string;
+    }[];
+}
+/** Which rows {@link resignGroupAuthority} re-signs. */
+export interface IResignGroupAuthorityOptions {
+    /** Only rows validly signed with this public key (a key the user just rotated away from). */
+    signedByKey?: string;
+    /**
+     * Sign with this secret key instead of the tables' registered signer. Key rotation passes the
+     * new key, since the running host still signs with the old one until it restarts. Host code
+     * only; never accepted from a client.
+     */
+    secretKey?: string;
+}
+/**
+ * Re-sign the rows that carry a group's authority (the group row, memberships, packages and
+ * package versions) with this device's current key, so they count under the group's verified
+ * authority again: after the hard cutover that started checking synced rows, and after a key
+ * rotation (`signedByKey`), since roles are traced through signatures by current keys.
+ *
+ * Each row goes through its table's `signAndSave`, so its table's rules still apply: the founder
+ * can re-sign everything; an Admin only what an Admin may sign. Rows a table refuses are left
+ * as they were and reported. Re-signing vouches for each row as it is now, so only run it on a
+ * group whose current rows you trust.
+ *
+ * @param dataContext - The group's context (not the personal context).
+ * @param opts - Limit to rows signed by one key.
+ */
+export declare function resignGroupAuthority(dataContext: DataContext, opts?: IResignGroupAuthorityOptions): Promise<IResignGroupAuthorityResult>;

package/dist/data/group-resign.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resignGroupAuthority = resignGroupAuthority;
+const keys_1 = require("../keys");
+const write_checks_1 = require("./orm/write-checks");
+/**
+ * Re-sign the rows that carry a group's authority (the group row, memberships, packages and
+ * package versions) with this device's current key, so they count under the group's verified
+ * authority again: after the hard cutover that started checking synced rows, and after a key
+ * rotation (`signedByKey`), since roles are traced through signatures by current keys.
+ *
+ * Each row goes through its table's `signAndSave`, so its table's rules still apply: the founder
+ * can re-sign everything; an Admin only what an Admin may sign. Rows a table refuses are left
+ * as they were and reported. Re-signing vouches for each row as it is now, so only run it on a
+ * group whose current rows you trust.
+ *
+ * @param dataContext - The group's context (not the personal context).
+ * @param opts - Limit to rows signed by one key.
+ */
+async function resignGroupAuthority(dataContext, opts = {}) {
+    const groupId = dataContext.groupId;
+    if (!groupId) {
+        throw new Error("resignGroupAuthority needs a group context");
+    }
+    const { Groups } = await Promise.resolve().then(() => require("./groups"));
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    const { Packages } = await Promise.resolve().then(() => require("./packages"));
+    const { PackageVersions } = await Promise.resolve().then(() => require("./package-versions"));
+    const result = {
+        resigned: { Groups: 0, GroupMembers: 0, Packages: 0, PackageVersions: 0 },
+        refused: [],
+    };
+    const snapshot = { saveAsSnapshot: true, restoreIfDeleted: true };
+    // Through each table's own save, so its rules still apply to the new signature.
+    const resign = async (table, rows, prepare = (row) => row) => {
+        const tableName = table.tableName;
+        // Only rows that key really signed: a row can name any key in its signature field.
+        for (const row of rows.filter((row) => !opts.signedByKey || (0, keys_1.signedByKey)(row) === opts.signedByKey)) {
+            try {
+                if (opts.secretKey) {
+                    const stamp = await (0, write_checks_1.signingStamp)(table, row, row);
+                    await table.save((0, keys_1.addSignatureToObject)({ ...row, ...stamp }, opts.secretKey), snapshot);
+                }
+                else {
+                    await table.signAndSave(prepare(row), snapshot);
+                }
+                result.resigned[tableName]++;
+            }
+            catch (error) {
+                result.refused.push({
+                    table: tableName,
+                    recordId: row[table.primaryKeyName],
+                    error: String(error),
+                });
+            }
+        }
+    };
+    const groups = Groups(dataContext);
+    const group = await groups.get(groupId);
+    await resign(groups, group ? [group] : []);
+    const members = GroupMembers(dataContext);
+    await resign(members, await members.list({ groupId }), 
+    // A rotation re-signs the grant as it is; otherwise bind it to the member's key as this
+    // device knows it (a grant from before keys were named, or to a key since replaced).
+    ({ publicKey: _named, ...rest }) => rest);
+    const packages = Packages(dataContext);
+    await resign(packages, await packages.list());
+    const versions = PackageVersions(dataContext);
+    await resign(versions, await versions.list());
+    return result;
+}

package/dist/data/groups.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import type { DataContext } from "../context/data-context";
 import { GroupMemberRole } from "./group-member-roles";
+import type { IResignGroupAuthorityOptions, IResignGroupAuthorityResult } from "./group-resign";
 import type { ISaveOptions } from "./orm/data-query";
 import { Table } from "./orm/table";
 /** Schema for a signed group record, including membership policy and group public keys. */
@@ -13,6 +14,7 @@ export declare const groupSchema: z.ZodObject<{
     disabled: z.ZodOptional<z.ZodBoolean>;
     founderUserId: z.ZodEffects<z.ZodString, string, string>;
     signature: z.ZodString;
+    signedAt: z.ZodOptional<z.ZodNumber>;
     publicKey: z.ZodString;
     publicBoxKey: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -25,6 +27,7 @@ export declare const groupSchema: z.ZodObject<{
     founderUserId: string;
     disabled?: boolean | undefined;
     iconClassName?: string | undefined;
+    signedAt?: number | undefined;
     publicRole?: GroupMemberRole | undefined;
 }, {
     name: string;
@@ -36,6 +39,7 @@ export declare const groupSchema: z.ZodObject<{
     founderUserId: string;
     disabled?: boolean | undefined;
     iconClassName?: string | undefined;
+    signedAt?: number | undefined;
     publicRole?: GroupMemberRole | undefined;
 }>;
 /** A signed group record shared between personal and group contexts. */
@@ -47,6 +51,13 @@ export declare class GroupsTable extends Table<IGroup> {
     static isPassthrough: boolean;
     save(group: IGroup, opts?: ISaveOptions): Promise<IGroup>;
     signAndSave(group: IGroup, opts?: ISaveOptions): Promise<IGroup>;
+    /**
+     * Re-sign this group's authority rows (group row, memberships, packages, package versions)
+     * with this device's key. See {@link resignGroupAuthority}. Only on a group context's table.
+     *
+     * @param opts - Limit to rows signed by one key.
+     */
+    resignAuthority(opts?: IResignGroupAuthorityOptions): Promise<IResignGroupAuthorityResult>;
     delete(groupId: string): Promise<void>;
     /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */
     static enableGroupSigning(fn: (group: IGroup) => IGroup): void;

package/dist/data/groups.js

@@ -39,12 +39,13 @@ exports.Groups = Groups;
 const zod_1 = require("zod");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const zod_types_1 = require("../types/zod-types");
+const authority_write_checks_1 = require("./authority-write-checks");
 const group_member_roles_1 = require("./group-member-roles");
-const group_permissions_1 = require("./group-permissions");
 const decorators_1 = require("./orm/decorators");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
+const write_checks_1 = require("./orm/write-checks");
 /** Schema for a signed group record, including membership policy and group public keys. */
 exports.groupSchema = zod_1.z.object({
     groupId: zod_types_1.zodPeerId,
@@ -61,6 +62,10 @@ exports.groupSchema = zod_1.z.object({
     disabled: zod_1.z.boolean().optional().describe("Whether the group is currently disabled"),
     founderUserId: zod_types_1.zodPeerId.describe("The user ID of the group founder"),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
     publicKey: zod_1.z
         .string()
         .describe("The public key of the group used to verify a data has come from a group member with write permissions or higher"),
@@ -86,26 +91,20 @@ let GroupsTable = (() => {
     let _classSuper = table_1.Table;
     let _instanceExtraInitializers = [];
     let _signAndSave_decorators;
+    let _resignAuthority_decorators;
     return class GroupsTable extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
             _signAndSave_decorators = [(0, decorators_1.ProxyClientTableMethodCalls)()];
+            _resignAuthority_decorators = [(0, decorators_1.ProxyClientTableMethodCalls)()];
             __esDecorate(this, null, _signAndSave_decorators, { kind: "method", name: "signAndSave", static: false, private: false, access: { has: obj => "signAndSave" in obj, get: obj => obj.signAndSave }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _resignAuthority_decorators, { kind: "method", name: "resignAuthority", static: false, private: false, access: { has: obj => "resignAuthority" in obj, get: obj => obj.resignAuthority }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         static isPassthrough = false;
         async save(group, opts) {
-            if (GroupsTable.isPassthrough) {
-                return super.save(group, opts);
-            }
-            const userContext = await (0, user_context_singleton_1.getUserContext)();
-            const userContextGroups = Groups(userContext.userDataContext);
-            if (userContextGroups === this) {
-                // users can do whatever they want to groups in their personal space
-                return super.save(group, opts);
-            }
-            const oldGroup = await this.get(group.groupId);
-            await (0, group_permissions_1.verifyGroupSignature)(group, oldGroup);
+            if (!GroupsTable.isPassthrough)
+                await (0, write_checks_1.checkLocalSave)(this, group, authority_write_checks_1.checkGroup);
             return super.save(group, opts);
         }
         async signAndSave(group, opts) {
@@ -113,9 +112,28 @@ let GroupsTable = (() => {
             if (!sign) {
                 throw new Error("Group signing must be enabled to sign and save groups. Call GroupsTable.enableGroupSigning(fn) to enable it.");
             }
-            group = sign.call(GroupsTable, group);
+            group = sign.call(GroupsTable, {
+                ...group,
+                ...(await (0, write_checks_1.signingStamp)(this, group)),
+            });
             return this.save(group, opts);
         }
+        /**
+         * Re-sign this group's authority rows (group row, memberships, packages, package versions)
+         * with this device's key. See {@link resignGroupAuthority}. Only on a group context's table.
+         *
+         * @param opts - Limit to rows signed by one key.
+         */
+        async resignAuthority(opts) {
+            const { resignGroupAuthority } = await Promise.resolve().then(() => require("./group-resign"));
+            if (!this.groupId) {
+                throw new Error("Re-sign a group from its own context, not the personal context");
+            }
+            // Signs with the registered signer only: a client never supplies a key.
+            return resignGroupAuthority((await (0, user_context_singleton_1.getUserContext)()).getDataContext(this.groupId), {
+                signedByKey: opts?.signedByKey,
+            });
+        }
         async delete(groupId) {
             const userContext = await (0, user_context_singleton_1.getUserContext)();
             const userContextGroups = Groups(userContext.userDataContext);

package/dist/data/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./access-level";
 export * from "./assistants";
+export * from "./authority-write-checks";
 export * from "./change-tracking";
 export * from "./channels";
 export * from "./create-group";
@@ -7,9 +8,11 @@ export * from "./device-sync-info";
 export * from "./devices";
 export * from "./embeddings";
 export * from "./files";
+export * from "./group-authority";
 export * from "./group-member-roles";
 export * from "./group-members";
 export * from "./group-permissions";
+export * from "./group-resign";
 export * from "./group-secret";
 export * from "./group-share";
 export * from "./groups";

package/dist/data/index.js

@@ -16,6 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./access-level"), exports);
 __exportStar(require("./assistants"), exports);
+__exportStar(require("./authority-write-checks"), exports);
 __exportStar(require("./change-tracking"), exports);
 __exportStar(require("./channels"), exports);
 __exportStar(require("./create-group"), exports);
@@ -23,9 +24,11 @@ __exportStar(require("./device-sync-info"), exports);
 __exportStar(require("./devices"), exports);
 __exportStar(require("./embeddings"), exports);
 __exportStar(require("./files"), exports);
+__exportStar(require("./group-authority"), exports);
 __exportStar(require("./group-member-roles"), exports);
 __exportStar(require("./group-members"), exports);
 __exportStar(require("./group-permissions"), exports);
+__exportStar(require("./group-resign"), exports);
 __exportStar(require("./group-secret"), exports);
 __exportStar(require("./group-share"), exports);
 __exportStar(require("./groups"), exports);