@serfab/cadre-core 1.16.0 → 1.18.0

package/src/cadre-join-request.ts

@@ -1,7 +1,7 @@
 /**
  * The join request: the text an app that wants to join a cadre copies (or shows as a QR code)
  * so the app that manages the cadre can mint an invitation for it alone
- * (`CadreNode.createCadreInvitation({ peerId: request.peerId, grantsOwner })`).
+ * (`CadreNode.createCadreInvitation({ peerId: request.peerId })`).
  *
  * `sereus-join-request:1.<base64url of canonical JSON>` where the JSON is
  * `{ appName, peerId, reply?, v }`. Nothing in it is secret or signed: the peer id is public, and
@@ -31,6 +31,21 @@ export const CADRE_JOIN_REQUEST_PREFIX = 'sereus-join-request:1.';
  */
 export const CADRE_INVITATION_PREFIX = 'sereus-invite:1.';
 
+/**
+ * What every owner-key export begins with, plain or passphrase-locked, any version
+ * (`owner-key-export.ts`). Declared here for the reason {@link CADRE_INVITATION_PREFIX} is: the
+ * invitation and join-request decoders refuse an owner key by name, so a private key pasted into
+ * the wrong field is never sent to a member.
+ */
+export const OWNER_KEY_EXPORT_STEM = 'sereus-owner-key';
+
+/**
+ * Version 1 of an encoded owner grant (`encodeOwnerGrant` in `owner-grant-protocol.ts`). Declared
+ * here for the same reason: whoever holds a grant can become an owner, so one pasted where an
+ * invitation, a join request or an owner key belongs is refused by name, never sent to a member.
+ */
+export const OWNER_GRANT_PREFIX = 'sereus-owner-grant:1.';
+
 /** Longest `appName` a request carries: one line in an approval prompt. */
 export const CADRE_JOIN_REQUEST_MAX_APP_NAME = 64;
 
@@ -80,14 +95,20 @@ export function encodeCadreJoinRequest(request: CadreJoinRequest): string {
 }
 
 /**
- * Decode the text the owner's app was given. Refuses, naming the problem: an invitation
- * pasted here, any prefix but version 1's, a body that is not base64url JSON of the request's
+ * Decode the text the owner's app was given. Refuses, naming the problem: an owner key, an owner
+ * grant or an invitation pasted here, any prefix but version 1's, a body that is not base64url JSON of the request's
  * shape, a peer id that does not parse or is not Ed25519, an `appName` that is empty or
  * longer than {@link CADRE_JOIN_REQUEST_MAX_APP_NAME} characters once trimmed, and a `reply`
  * that {@link requireCadreJoinReply} refuses.
  */
 export function decodeCadreJoinRequest(text: string): CadreJoinRequest {
 	const trimmed = text.trim();
+	if (trimmed.startsWith(OWNER_KEY_EXPORT_STEM)) {
+		throw new Error('This is an owner key, not a join request; it is private, so import it only where the app asks for an owner key');
+	}
+	if (trimmed.startsWith(OWNER_GRANT_PREFIX)) {
+		throw new Error('This is an owner grant, not a join request; paste it where the app asks for an owner grant');
+	}
 	if (trimmed.startsWith(CADRE_INVITATION_PREFIX)) {
 		throw new Error('This is a cadre invitation, not a join request; paste it where the app asks for an invitation');
 	}