@serfab/cadre-core 0.10.0 → 0.11.0

package/src/seed-bootstrap.ts

@@ -404,7 +404,7 @@ export class SeedBootstrapService {
       insert into CadreControl.DeviceToken (PeerId, Platform, Token, UpdatedAt, Sig, StampId)
         with context OwnerKey = ?, Signature = ?
         values (?, ?, ?, ?, ?, ?)
-    `, [this.ownerPublicKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig, stampId]);
+    `, [this.ownerPublicKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig, stampId], 'device-token-insert');
     log('Device token inserted (owner-signed): %s', record.peerId);
   }
 
@@ -751,8 +751,8 @@ export class SeedBootstrapService {
     // `ApplySeedResult.ownerDialsFailed`). Recovery is not this loop's job —
     // `CadreNode.dialColdStartBootstrap` retries these same addresses on every
     // control-cohort reconcile pass until the control database has siblings.
-    // `createSeed` projects EVERY CadrePeer row, so an owner applying a seed
-    // minted after it joined finds ITSELF in the owner list. Dialing self always
+    // `createSeed` projects every non-revoked CadrePeer row, so an owner applying
+    // a seed minted after it joined finds ITSELF in the owner list. Dialing self always
     // throws, which would report a healthy owner as "seeded but stranded".
     // Optional-chained: partial libp2p handles (unit-test doubles) omit `peerId`,
     // and an undefined self simply matches nothing.
@@ -966,6 +966,13 @@ export class SeedBootstrapService {
    * This makes any owner node markable — not just the local one — and ties
    * `isOwner` to the control table rather than to `peerId === self`.
    *
+   * Read through {@link ControlDatabase.queryCadrePeers}, not a raw `CadrePeer`
+   * select: that reader drops any row whose `StampId` is retired in
+   * `CadreControl.Revocation`, so a removed member's addresses are never packed
+   * into a seed and pushed into a joiner's peerstore (`applySeed` adds every
+   * seed peer's addrs and dials the owner-flagged ones). A revoked peer is off
+   * the addressable surface everywhere, and this is one of its exits.
+   *
    * NOTE: this is the one owner lookup deliberately left on the REPLICATED
    * table rather than the node-local anchor. `SeedPeer.isOwner` is a dial hint
    * — the receiver dials owner-flagged peers first — not a trust decision, and
@@ -980,29 +987,22 @@ export class SeedBootstrapService {
     }
 
     const ownerKeys = await this.controlDatabase.getOwnerKeys();
-    const db = this.controlDatabase.getDatabase();
-    const peers: SeedPeer[] = [];
-
-    // Query CadrePeer table
-    for await (const row of db.eval('select PeerId, Multiaddr from CadreControl.CadrePeer')) {
-      const peerId = row.PeerId as string;
-      const multiaddr = row.Multiaddr as string | null;
+    const rows = await this.controlDatabase.queryCadrePeers();
 
+    return rows.map(({ peerId, multiaddr }) => {
       // Derive the peer's ed25519 key from its PeerId; a non-Ed25519 peer or an
       // unparsable id yields null and is treated as a non-owner rather than
       // failing the whole seed creation.
       const pubKeyB64 = ed25519PublicKeyB64FromPeerId(peerId);
       const isOwner = pubKeyB64 !== null && ownerKeys.has(pubKeyB64);
 
-      peers.push({
+      return {
         peerId,
         multiaddrs: multiaddr ? multiaddr.split(',') : [],
         isOwner,
         ...(isOwner ? { publicKey: pubKeyB64 } : {}),
-      });
-    }
-
-    return peers;
+      };
+    });
   }
 
   /**

package/src/seed-trust-policy.ts

@@ -1,140 +1,140 @@
-/**
- * Trust-anchor policy for control-network seeds.
- *
- * A seed carries an ed25519 signature over its body and the `signerKey` that
- * produced it. Verifying that signature only proves the seed is internally
- * consistent — it does NOT prove the signer is an owner, because both the
- * signer key and the seed's own `isOwner` peer flags are attacker-supplied.
- * The trust decision must therefore rest on an anchor that does not come from
- * the seed body:
- *
- *  1. Anchored — keys in the receiver's NODE-LOCAL `TrustedOwnerStore`: the
- *     non-replicated, per-party record of owner keys established out of band
- *     (founding the party, the `CadreInvite` that enrolled this node, an
- *     operator pin). Deliberately NOT the replicated `CadreControl.OwnerKey`
- *     table — any connecting node can genesis-insert its own key there and let
- *     it replicate, so that table can be made to say "yes" by a stranger.
- *  2. Pinned out-of-band — keys handed to the node for this seed only (carried
- *     by a `CadreInvite.ownerKeys`, or pinned by an operator) without having
- *     been anchored yet.
- *  3. TOFU (opt-in) — an explicit confirmation callback invoked on first sight
- *     of an unknown signer key. Interactive hosts only; off by default.
- *
- * Secure default (`anchoredTrustPolicy`): a node with an empty anchor and no
- * pinned keys rejects the seed — a seed can no longer vouch for its own signer,
- * and neither can a polluted replicated table.
- *
- * A key accepted via anchor 2 or 3 is reported back through
- * {@link SeedTrustDecision.anchorAs} so `applySeed` can persist it into the
- * node-local anchor, and later seeds from the same owner are accepted without
- * re-supplying the invite/confirmation.
- */
-import type { TrustSource } from './trusted-owner-store.js';
-
-export interface SeedTrustContext {
-  /** Party the seed claims to belong to. */
-  partyId: string;
-  /** ed25519 base64url signer key — already signature-verified by `applySeed`. */
-  signerKey: string;
-  /**
-   * The receiver's anchored owner keys, sourced from its node-local
-   * `TrustedOwnerStore` — NOT from the seed, and NOT from the replicated
-   * `OwnerKey` table. Empty for a node whose anchor was never seeded.
-   */
-  knownOwnerKeys: ReadonlySet<string>;
-}
-
-export interface SeedTrustDecision {
-  /** Whether the signer key is trusted. */
-  trusted: boolean;
-  /** Human-readable reason, surfaced as the seed-apply error when not trusted. */
-  reason?: string;
-  /**
-   * Set when the key was trusted via an anchor OUTSIDE the node-local store (a
-   * pinned key, a TOFU confirmation): the provenance to record it under, so
-   * `applySeed` persists it and the next seed from that owner is anchored
-   * without re-supplying the pin. Omitted when the key was already anchored
-   * (nothing to persist) or not trusted at all.
-   */
-  anchorAs?: Exclude<TrustSource, 'genesis'>;
-}
-
-/**
- * Decides whether a signature-verified seed's signer key should be trusted.
- * May be synchronous (anchored/pinned) or asynchronous (TOFU confirmation).
- */
-export interface SeedTrustPolicy {
-  evaluate(ctx: SeedTrustContext): Promise<SeedTrustDecision> | SeedTrustDecision;
-}
-
-/**
- * Default policy: trust only keys already in the receiver's node-local
- * trusted-owner anchor. A node whose anchor was never seeded (no genesis, no
- * invite pin, no operator pin) rejects every seed.
- */
-export function anchoredTrustPolicy(): SeedTrustPolicy {
-  return {
-    evaluate({ signerKey, knownOwnerKeys }) {
-      if (knownOwnerKeys.has(signerKey)) {
-        return { trusted: true };
-      }
-      return {
-        trusted: false,
-        reason: 'Signer key is not an anchored owner (anchored trust policy)',
-      };
-    },
-  };
-}
-
-/**
- * Cold-start policy: trust anchored keys plus a set pinned out-of-band
- * (typically `CadreInvite.ownerKeys` or operator config). Lets an unenrolled
- * invitee accept its first seed without the seed vouching for itself.
- *
- * @param anchorAs - provenance under which a pin-only acceptance is persisted
- *   into the node-local anchor ('invite' by default — the invite-redemption
- *   case; pass 'operator' for an operator-supplied pin).
- */
-export function pinnedKeyTrustPolicy(
-  pinned: Iterable<string>,
-  anchorAs: Exclude<TrustSource, 'genesis'> = 'invite'
-): SeedTrustPolicy {
-  const pinnedSet = new Set(pinned);
-  return {
-    evaluate({ signerKey, knownOwnerKeys }) {
-      if (knownOwnerKeys.has(signerKey)) {
-        return { trusted: true };
-      }
-      if (pinnedSet.has(signerKey)) {
-        return { trusted: true, anchorAs };
-      }
-      return {
-        trusted: false,
-        reason: 'Signer key is neither an anchored nor a pinned owner (pinned-key trust policy)',
-      };
-    },
-  };
-}
-
-/**
- * Opt-in interactive policy: trust keys already in the node-local anchor, and
- * on an unknown key invoke `confirm` (e.g. a trust-circle UI prompt). The key is
- * trusted iff `confirm` resolves true, and a confirmed key is persisted into the
- * anchor as an 'operator' pin (a human at the console is the same provenance as
- * an explicit operator pin) so the prompt is not repeated. Not enabled by default.
- */
-export function tofuTrustPolicy(
-  confirm: (ctx: SeedTrustContext) => Promise<boolean>
-): SeedTrustPolicy {
-  return {
-    async evaluate(ctx) {
-      if (ctx.knownOwnerKeys.has(ctx.signerKey)) {
-        return { trusted: true };
-      }
-      const accepted = await confirm(ctx);
-      return accepted
-        ? { trusted: true, anchorAs: 'operator' }
-        : { trusted: false, reason: 'TOFU confirmation declined for unknown signer key' };
-    },
-  };
-}
+/**
+ * Trust-anchor policy for control-network seeds.
+ *
+ * A seed carries an ed25519 signature over its body and the `signerKey` that
+ * produced it. Verifying that signature only proves the seed is internally
+ * consistent — it does NOT prove the signer is an owner, because both the
+ * signer key and the seed's own `isOwner` peer flags are attacker-supplied.
+ * The trust decision must therefore rest on an anchor that does not come from
+ * the seed body:
+ *
+ *  1. Anchored — keys in the receiver's NODE-LOCAL `TrustedOwnerStore`: the
+ *     non-replicated, per-party record of owner keys established out of band
+ *     (founding the party, the `CadreInvite` that enrolled this node, an
+ *     operator pin). Deliberately NOT the replicated `CadreControl.OwnerKey`
+ *     table — any connecting node can genesis-insert its own key there and let
+ *     it replicate, so that table can be made to say "yes" by a stranger.
+ *  2. Pinned out-of-band — keys handed to the node for this seed only (carried
+ *     by a `CadreInvite.ownerKeys`, or pinned by an operator) without having
+ *     been anchored yet.
+ *  3. TOFU (opt-in) — an explicit confirmation callback invoked on first sight
+ *     of an unknown signer key. Interactive hosts only; off by default.
+ *
+ * Secure default (`anchoredTrustPolicy`): a node with an empty anchor and no
+ * pinned keys rejects the seed — a seed can no longer vouch for its own signer,
+ * and neither can a polluted replicated table.
+ *
+ * A key accepted via anchor 2 or 3 is reported back through
+ * {@link SeedTrustDecision.anchorAs} so `applySeed` can persist it into the
+ * node-local anchor, and later seeds from the same owner are accepted without
+ * re-supplying the invite/confirmation.
+ */
+import type { TrustSource } from './trusted-owner-store.js';
+
+export interface SeedTrustContext {
+  /** Party the seed claims to belong to. */
+  partyId: string;
+  /** ed25519 base64url signer key — already signature-verified by `applySeed`. */
+  signerKey: string;
+  /**
+   * The receiver's anchored owner keys, sourced from its node-local
+   * `TrustedOwnerStore` — NOT from the seed, and NOT from the replicated
+   * `OwnerKey` table. Empty for a node whose anchor was never seeded.
+   */
+  knownOwnerKeys: ReadonlySet<string>;
+}
+
+export interface SeedTrustDecision {
+  /** Whether the signer key is trusted. */
+  trusted: boolean;
+  /** Human-readable reason, surfaced as the seed-apply error when not trusted. */
+  reason?: string;
+  /**
+   * Set when the key was trusted via an anchor OUTSIDE the node-local store (a
+   * pinned key, a TOFU confirmation): the provenance to record it under, so
+   * `applySeed` persists it and the next seed from that owner is anchored
+   * without re-supplying the pin. Omitted when the key was already anchored
+   * (nothing to persist) or not trusted at all.
+   */
+  anchorAs?: Exclude<TrustSource, 'genesis'>;
+}
+
+/**
+ * Decides whether a signature-verified seed's signer key should be trusted.
+ * May be synchronous (anchored/pinned) or asynchronous (TOFU confirmation).
+ */
+export interface SeedTrustPolicy {
+  evaluate(ctx: SeedTrustContext): Promise<SeedTrustDecision> | SeedTrustDecision;
+}
+
+/**
+ * Default policy: trust only keys already in the receiver's node-local
+ * trusted-owner anchor. A node whose anchor was never seeded (no genesis, no
+ * invite pin, no operator pin) rejects every seed.
+ */
+export function anchoredTrustPolicy(): SeedTrustPolicy {
+  return {
+    evaluate({ signerKey, knownOwnerKeys }) {
+      if (knownOwnerKeys.has(signerKey)) {
+        return { trusted: true };
+      }
+      return {
+        trusted: false,
+        reason: 'Signer key is not an anchored owner (anchored trust policy)',
+      };
+    },
+  };
+}
+
+/**
+ * Cold-start policy: trust anchored keys plus a set pinned out-of-band
+ * (typically `CadreInvite.ownerKeys` or operator config). Lets an unenrolled
+ * invitee accept its first seed without the seed vouching for itself.
+ *
+ * @param anchorAs - provenance under which a pin-only acceptance is persisted
+ *   into the node-local anchor ('invite' by default — the invite-redemption
+ *   case; pass 'operator' for an operator-supplied pin).
+ */
+export function pinnedKeyTrustPolicy(
+  pinned: Iterable<string>,
+  anchorAs: Exclude<TrustSource, 'genesis'> = 'invite'
+): SeedTrustPolicy {
+  const pinnedSet = new Set(pinned);
+  return {
+    evaluate({ signerKey, knownOwnerKeys }) {
+      if (knownOwnerKeys.has(signerKey)) {
+        return { trusted: true };
+      }
+      if (pinnedSet.has(signerKey)) {
+        return { trusted: true, anchorAs };
+      }
+      return {
+        trusted: false,
+        reason: 'Signer key is neither an anchored nor a pinned owner (pinned-key trust policy)',
+      };
+    },
+  };
+}
+
+/**
+ * Opt-in interactive policy: trust keys already in the node-local anchor, and
+ * on an unknown key invoke `confirm` (e.g. a trust-circle UI prompt). The key is
+ * trusted iff `confirm` resolves true, and a confirmed key is persisted into the
+ * anchor as an 'operator' pin (a human at the console is the same provenance as
+ * an explicit operator pin) so the prompt is not repeated. Not enabled by default.
+ */
+export function tofuTrustPolicy(
+  confirm: (ctx: SeedTrustContext) => Promise<boolean>
+): SeedTrustPolicy {
+  return {
+    async evaluate(ctx) {
+      if (ctx.knownOwnerKeys.has(ctx.signerKey)) {
+        return { trusted: true };
+      }
+      const accepted = await confirm(ctx);
+      return accepted
+        ? { trusted: true, anchorAs: 'operator' }
+        : { trusted: false, reason: 'TOFU confirmation declined for unknown signer key' };
+    },
+  };
+}