@serfab/cadre-core 0.8.1 → 0.10.0

package/src/strand-formation-manager.ts

@@ -1,10 +1,18 @@
 import debug from 'debug';
+import { fromString as uint8ArrayFromString } from 'uint8arrays';
 import type { Libp2p } from '@libp2p/interface';
 import type {
   OpenInvitation,
   FormStrandResult,
   StrandFormationDisclosure
 } from './types.js';
+import {
+  FormationApprovalError,
+  type FormationApprovalFailure
+} from './formation-approval.js';
+// control-database does not import this manager, so this import introduces no cycle.
+import { FormationAbortedError, InvitationExhaustedError } from './control-database.js';
+import { canonicalJson } from './canonical-json.js';
 import type {
   DisclosureValidator,
   FormationUsageRecorder,
@@ -14,6 +22,8 @@ import type {
 } from './strand-solicitation.js';
 import {
   FormationListener,
+  INVALID_TOKEN_REASON,
+  PROVISION_RESPONSE_TRAVEL_MARGIN_MS,
   dialFormation,
   isValidResponderCreatesResult,
   type FormationContactMessage,
@@ -24,6 +34,28 @@ import {
 
 const log = debug('sereus:cadre:formation-manager');
 
+/**
+ * Largest serialized disclosure a responder will accept (8 KiB). The disclosure is
+ * attacker-influenced text destined for a replicated table (`FormationUsage.Disclosure`)
+ * and for the approval hook's signed digest — the cap bounds both, and is enforced BEFORE
+ * any database read or hook contact so an oversized blob costs nothing downstream.
+ */
+const MAX_DISCLOSURE_BYTES = 8 * 1024;
+
+/**
+ * Rejection reason a would-be joiner is told for each approval-failure category
+ * (see {@link FormationApprovalFailure}). Distinct per category on purpose: mapping any
+ * of these onto the generic 'Formation conflict, retry' would tell an operator to retry
+ * what retrying can never fix (e.g. a non-enrolled validation key).
+ */
+const APPROVAL_REJECTION_REASONS: Record<FormationApprovalFailure, string> = {
+  refused: 'Formation approval refused',
+  unavailable: 'Formation approval unavailable, retry',
+  malformed: 'Formation approval invalid',
+  unenrolled: 'Formation approval key is not enrolled',
+  misconfigured: 'Formation approval misconfigured'
+};
+
 /**
  * Configuration for StrandFormationManager
  */
@@ -32,6 +64,14 @@ export interface StrandFormationManagerConfig {
   sessionTimeoutMs?: number;
   /** Step timeout in milliseconds */
   stepTimeoutMs?: number;
+  /**
+   * Provisioning budget in milliseconds for the RESPONDER's `provisionStrand` hook call.
+   * The initiator's `await-response` wait is derived automatically from this value plus
+   * `PROVISION_RESPONSE_TRAVEL_MARGIN_MS` (`strand-formation-protocol.ts`) — never set
+   * directly — so the ordering documented there (approval hook < responder provisioning <
+   * initiator await-response < session) cannot collapse when this is configured.
+   */
+  provisionTimeoutMs?: number;
   /** Maximum concurrent sessions */
   maxConcurrentSessions?: number;
   /** Enable debug logging */
@@ -97,11 +137,12 @@ export class StrandFormationManager {
     this.listener = new FormationListener({
       validateToken: (token) => this.validateToken(token),
       validateDisclosure: (token, disclosure) => this.validateDisclosure(token, disclosure),
-      provisionStrand: (token, initiatorPartyId, disclosure) =>
-        this.provisionAsResponder(token, initiatorPartyId, disclosure),
+      provisionStrand: (contact, signal) =>
+        this.provisionAsResponder(contact, signal),
       getResponderIdentity: () => ({ partyId: this.partyId, cadrePeerAddrs: this.cadrePeerAddrs }),
       sessionTimeoutMs: this.config.sessionTimeoutMs,
       stepTimeoutMs: this.config.stepTimeoutMs,
+      provisionTimeoutMs: this.config.provisionTimeoutMs,
       maxConcurrentSessions: this.config.maxConcurrentSessions
     });
 
@@ -138,12 +179,15 @@ export class StrandFormationManager {
    * Form a strand with a responder via an open invitation (initiator side).
    *
    * Builds a contact message carrying the real token + disclosure + this party's
-   * real cadre addresses, dials the responder over the native protocol, and
-   * validates the responder's result before returning.
+   * real cadre addresses + the joiner's consent (minted and signed by the
+   * solicitation layer — this manager only places it on the contact), dials the
+   * responder over the native protocol, and validates the responder's result
+   * before returning.
    */
   async formStrand(
     invitation: OpenInvitation,
     disclosure: StrandFormationDisclosure,
+    consent: { peerKey: string; usageStampId: string; peerSignature: string },
     node: Libp2p
   ): Promise<FormStrandResult> {
     log('Forming strand with invitation token: %s', invitation.token);
@@ -151,6 +195,9 @@ export class StrandFormationManager {
     const contact: FormationContactMessage = {
       token: invitation.token,
       partyId: disclosure.partyId ?? this.partyId,
+      peerKey: consent.peerKey,
+      usageStampId: consent.usageStampId,
+      peerSignature: consent.peerSignature,
       disclosure,
       cadrePeerAddrs: this.cadrePeerAddrs
     };
@@ -163,6 +210,7 @@ export class StrandFormationManager {
         validateResponse: (response) => this.validateResponse(invitation, disclosure, response),
         sessionTimeoutMs: this.config.sessionTimeoutMs,
         stepTimeoutMs: this.config.stepTimeoutMs,
+        provisionTimeoutMs: this.initiatorProvisionTimeoutMs(),
         protocolId: this.config.protocolId
       });
 
@@ -189,6 +237,20 @@ export class StrandFormationManager {
     return { listeners: this.listener.activeCount, dialers: this.dialerSessions };
   }
 
+  /**
+   * Derive the initiator's await-response budget from the configured RESPONDER budget —
+   * never the same number (see `StrandFormationManagerConfig.provisionTimeoutMs`). Mirrors
+   * `resolveProvisionTimeoutMs`'s own "`0`/negative means unset" rule so an unset config
+   * still lets both sides fall back to their own independent defaults; must NOT hardcode
+   * `DEFAULT_PROVISION_TIMEOUT_MS` here, or the per-role clamping downstream is defeated.
+   * A value too large for the session is clamped per role, and the responder's ceiling holds
+   * the same margin back, so the ordering survives there too.
+   */
+  private initiatorProvisionTimeoutMs(): number | undefined {
+    const host = this.config.provisionTimeoutMs;
+    return host && host > 0 ? host + PROVISION_RESPONSE_TRAVEL_MARGIN_MS : undefined;
+  }
+
   // ── Responder-side hooks ─────────────────────────────────────────────────────
 
   private async validateToken(token: string): Promise<{ valid: boolean }> {
@@ -234,18 +296,33 @@ export class StrandFormationManager {
    *   deferred `StrandExists` CHECK at commit and drop the frame.
    * - **unbound** (no binding): the responder-provisions fallback — see {@link provisionUnbound}.
    *
-   * Defense-in-depth: known provisioning/redeem failures (notably the concurrent
-   * `(Token, UseNumber)` PK collision when two redemptions of one unbound single-use invite
-   * race) are caught and mapped to a logged, retry-suggesting rejection rather than a thrown
-   * insert + a silently-closed stream. The LOG-before-reject keeps this a deliberate
-   * internal-error→protocol-rejection conversion (AGENTS.md: don't eat exceptions silently),
-   * not control-flow-by-exception.
+   * Defense-in-depth: known provisioning/redeem failures are caught and mapped to a logged
+   * protocol rejection rather than a thrown insert + a silently-closed stream. The mapping is
+   * per-failure, NOT blanket retry-suggesting: an exhausted invitation
+   * ({@link InvitationExhaustedError}, raised by `ControlDatabase` whenever a redemption's use
+   * number is past the invite's seat budget — including a first attempt racing another
+   * redemption of the same token on this node, not only a retry) is reported as `'Invalid
+   * token'`, because retrying it can never succeed. The
+   * `(Token, UseNumber)` PK collision that concurrent redemptions of one invite used to
+   * surface here is now retried a layer down and no longer reaches this method. The
+   * LOG-before-reject keeps this a deliberate internal-error→protocol-rejection conversion
+   * (AGENTS.md: don't eat exceptions silently), not control-flow-by-exception.
    */
   private async provisionAsResponder(
-    token: string,
-    initiatorPartyId: string,
-    _disclosure: StrandFormationDisclosure
+    contact: FormationContactMessage,
+    signal?: AbortSignal
   ): Promise<ResponderProvisionOutcome> {
+    const token = contact.token;
+    // CANONICALLY serialized — both sides derive the identical string: this is the exact
+    // text the joiner signed (consent), the approver signs (vouch), and the recorder writes
+    // to `FormationUsage.Disclosure` — a re-serialization anywhere below would break the
+    // signature-over-stored-bytes invariant.
+    const disclosureText = canonicalJson(contact.disclosure);
+    if (uint8ArrayFromString(disclosureText, 'utf8').byteLength > MAX_DISCLOSURE_BYTES) {
+      log('Disclosure over %d bytes; rejecting token %s', MAX_DISCLOSURE_BYTES, token);
+      return { approved: false, reason: 'Disclosure too large' };
+    }
+
     const recorder = this.formationUsageRecorder;
     const resolved: ResolvedHostStrand = recorder?.resolveStrand
       ? await recorder.resolveStrand(token)
@@ -255,7 +332,15 @@ export class StrandFormationManager {
       switch (resolved.kind) {
         case 'bound': {
           // recorder is guaranteed non-null here: only resolveStrand can yield 'bound'.
-          await recorder!.recordUsage(token, initiatorPartyId, resolved.strandId);
+          await recorder!.recordUsage({
+            token,
+            peerKey: contact.peerKey,
+            peerSignature: contact.peerSignature,
+            usageStampId: contact.usageStampId,
+            strandId: resolved.strandId,
+            disclosure: disclosureText,
+            signal
+          });
           return this.approve({
             strand: { strandId: resolved.strandId, createdBy: 'responder' },
             memberPrivateKey: resolved.memberPrivateKey ?? undefined,
@@ -267,9 +352,40 @@ export class StrandFormationManager {
           return { approved: false, reason: 'Host strand not yet available on this responder' };
         }
         case 'unbound':
-          return await this.provisionUnbound(token, initiatorPartyId);
+          return await this.provisionUnbound(contact, disclosureText, signal);
       }
     } catch (err) {
+      if (err instanceof FormationAbortedError) {
+        // The listener's timeout path owns the reply for an abandoned provisioning; mapping
+        // this onto 'Formation conflict, retry' would misreport it as a conflict.
+        throw err;
+      }
+      if (err instanceof FormationApprovalError) {
+        log('approval failed (%s) for token %s: %o', err.failure, token, err);
+        return { approved: false, reason: APPROVAL_REJECTION_REASONS[err.failure] };
+      }
+      if (err instanceof InvitationExhaustedError) {
+        // Shares `INVALID_TOKEN_REASON` with the up-front `validateToken` rejection so the loser
+        // of the race that exposed the spent invite — same-node, first attempt, or a retry that
+        // ran out — sees exactly what a non-racing latecomer sees. No wire-visible distinction between "invalid" and "exhausted" — the
+        // operator signal lives in this log line instead.
+        // NOTE: if a joining client ever has to tell "never valid" from "used up" WITHOUT node
+        // logs, that is a new protocol reason string, not a local change here.
+        log(
+          'invitation exhausted for token %s: use #%d past limit of %d',
+          err.token,
+          err.useNumber,
+          err.totalUses
+        );
+        return { approved: false, reason: INVALID_TOKEN_REASON };
+      }
+      // An approval obtained before landing here is RETRIED, not discarded: the database
+      // layer re-presents the same approver sign-off under a fresh use number when it loses
+      // one to a writer its local write queue does not serialize — another node of the cadre,
+      // another `Database` handle over the same store (see
+      // `ControlDatabase.withUseNumberRetry`). Reaching this catch-all means either that retry
+      // ran out (surfaced above as `InvitationExhaustedError`) or the failure was never
+      // retryable to begin with.
       log('provisionAsResponder failed for token %s: %o', token, err);
       return { approved: false, reason: 'Formation conflict, retry' };
     }
@@ -297,13 +413,23 @@ export class StrandFormationManager {
    * at all?" question lives in backlog `formation-initiatorcreates-cover-or-remove`.
    */
   private async provisionUnbound(
-    token: string,
-    initiatorPartyId: string
+    contact: FormationContactMessage,
+    disclosureText: string,
+    signal?: AbortSignal
   ): Promise<ResponderProvisionOutcome> {
+    const token = contact.token;
     const recorder = this.formationUsageRecorder;
     if (recorder?.provisionAndRecord) {
       const sAppId = await this.resolveInviteSAppId(token);
-      const provisioned = await recorder.provisionAndRecord(token, initiatorPartyId, sAppId);
+      const provisioned = await recorder.provisionAndRecord({
+        token,
+        peerKey: contact.peerKey,
+        peerSignature: contact.peerSignature,
+        usageStampId: contact.usageStampId,
+        sAppId,
+        disclosure: disclosureText,
+        signal
+      });
       return this.approve({
         strand: { strandId: provisioned.strandId, createdBy: 'responder' },
         memberPrivateKey: provisioned.memberPrivateKey ?? undefined,
@@ -313,7 +439,7 @@ export class StrandFormationManager {
 
     if (this.strandProvisioner) {
       const sAppId = await this.resolveInviteSAppId(token);
-      const result = await this.strandProvisioner.provisionStrand(sAppId, initiatorPartyId, this.partyId);
+      const result = await this.strandProvisioner.provisionStrand(sAppId, contact.partyId, this.partyId);
       return this.approve({
         strand: { strandId: result.strandId, createdBy: 'responder' },
         dbConnectionInfo: { endpoint: 'local', credentialsRef: '' }