@serfab/cadre-host 0.8.1 → 0.10.0

package/src/auth/trust-circle.ts

@@ -3,7 +3,7 @@ import debug from 'debug';
 
 import type { CadreInvite } from '@serfab/cadre-core';
 
-import { AuthorityNodeUnavailableError } from '../authority/authority-node-client.js';
+import { OwnerNodeUnavailableError } from '../owner/owner-node-client.js';
 
 import type { TrustCircleStore } from './trust-circle-store.js';
 import type {
@@ -42,10 +42,22 @@ export interface CadreNodeLike {
   acceptPhone(options: { phonePeerId: string; token?: string }, issuedInvite?: CadreInvite): Promise<void>;
   removePeer(peerId: string): Promise<void>;
   encodeInvite(invite: CadreInvite): string;
-  /** Enumerate the cadre's `CadrePeer` membership (over the admin channel). */
+  /**
+   * Enumerate the cadre's *addressable* peers (over the admin channel) —
+   * anyone with an address record, including devices no owner vouched for.
+   * Used only for {@link removeMember}, where "the row exists" is the point.
+   */
   listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>>;
-  /** Probe whether a peer is a `CadrePeer` member (over the admin channel). */
+  /** Probe whether a peer is *addressable* (over the admin channel). See {@link listMembers}. */
   isMember(peerId: string): Promise<boolean>;
+  /**
+   * Enumerate the cadre's *authorized* membership (over the admin channel) —
+   * devices an owner key vouched for. Excludes the node's own self-published
+   * row. This is the real membership test the trust-circle listing shows.
+   */
+  listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>>;
+  /** Probe whether a peer is *authorized*. See {@link listAuthorizedMembers}. */
+  isAuthorizedMember(peerId: string): Promise<boolean>;
 }
 
 /**
@@ -53,9 +65,9 @@ export interface CadreNodeLike {
  * membership management.
  *
  * Membership is canonical in the cadre control DB (`CadrePeer` table),
- * reached over the authority node's admin channel; labels and pending tokens
+ * reached over the owner node's admin channel; labels and pending tokens
  * live in the host-local `TrustCircleStore`. When the node is unreachable,
- * authority operations surface `node_unavailable` (→ 503) and `list()`
+ * owner operations surface `node_unavailable` (→ 503) and `list()`
  * degrades to the local labels file.
  */
 export class TrustCircleService {
@@ -78,7 +90,7 @@ export class TrustCircleService {
 
   /**
    * Issue a new invite. Generates a token, persists a pending row, and
-   * delegates to cadre-core to embed the host's authority addresses.
+   * delegates to cadre-core to embed the host's owner addresses.
    */
   async issueInvite(opts: { label: string; ttlMs?: number }): Promise<{
     encodedInvite: string;
@@ -127,7 +139,7 @@ export class TrustCircleService {
    *
    * Crash-safety tradeoff: if the host crashes between `acceptPhone` success
    * and the durable `removePending`, a retry will dial in fine but the
-   * authority node's `acceptPhone` will reject the second `CadrePeer` insert
+   * owner node's `acceptPhone` will reject the second `CadrePeer` insert
    * with a PK constraint error (cadre-core does not upsert). That surfaces to
    * the redeemer as a non-`node_unavailable` failure; the admin can revoke
    * the lingering pending row. This is a narrower window than the prior
@@ -167,7 +179,7 @@ export class TrustCircleService {
       // matches by construction) and re-checks expiration.
       const reconstructed: CadreInvite = {
         partyId: '',
-        authorityAddrs: [],
+        ownerAddrs: [],
         token: pending.token,
         createdAt: new Date(pending.createdAt).getTime(),
         ...(pending.expiresAt ? { expiresAt: new Date(pending.expiresAt).getTime() } : {}),
@@ -212,6 +224,13 @@ export class TrustCircleService {
   /**
    * Remove an authorised member. Deletes the CadrePeer row and the local
    * label. Throws not_found when the peer is in neither place.
+   *
+   * NOTE: no special case for the host's own peer ID — the local UI hides the
+   * Remove button on the `self` row, but `DELETE /auth/members/<ownPeerId>`
+   * (or `cadre-host trust revoke <ownPeerId>`) will delete the node's own
+   * `CadrePeer` row. cadre-core re-registers self on node start, so a restart
+   * heals it. If that stops being true, or the removal path grows a
+   * non-loopback caller, guard `self` rows here.
    */
   async removeMember(peerId: string): Promise<void> {
     const inLocal = this.store.getMember(peerId);
@@ -240,10 +259,15 @@ export class TrustCircleService {
   }
 
   /**
-   * UI snapshot. Joins the canonical CadrePeer list (fetched over the admin
+   * UI snapshot. Joins the *authorized* membership (fetched over the admin
    * channel) with local labels; prunes any orphan labels (peer is no longer
-   * authorised). When the authority node is unreachable, degrades to the
-   * local labels file so listing keeps working while the node is down.
+   * authorised). Addressable-but-unauthorized peers — devices that merely
+   * published an address record without an owner voucher — are deliberately
+   * excluded; this is the listing an operator uses to decide who belongs.
+   * The node's own self-published row is spliced back in from the local
+   * label, since the authorized set excludes self by design. When the owner
+   * node is unreachable, degrades to the local labels file so listing keeps
+   * working while the node is down.
    */
   async list(): Promise<TrustCircleSnapshot> {
     const labels = new Map<string, Omit<TrustCircleMember, 'peerId'>>();
@@ -256,17 +280,17 @@ export class TrustCircleService {
     // Consult the control DB over the admin channel. A node-unavailable error
     // is non-fatal — fall back to the local labels rather than 503-ing a
     // read-only listing.
-    let controlMembers: Array<{ peerId: string }> | null;
+    let authorizedMembers: Array<{ peerId: string }> | null;
     try {
-      controlMembers = await this.cadreNode.listMembers();
+      authorizedMembers = await this.cadreNode.listAuthorizedMembers();
     } catch (err) {
-      if (!(err instanceof AuthorityNodeUnavailableError)) throw err;
-      controlMembers = null;
+      if (!(err instanceof OwnerNodeUnavailableError)) throw err;
+      authorizedMembers = null;
     }
 
-    if (controlMembers) {
+    if (authorizedMembers) {
       const seenPeerIds = new Set<string>();
-      for (const { peerId } of controlMembers) {
+      for (const { peerId } of authorizedMembers) {
         seenPeerIds.add(peerId);
         const label = labels.get(peerId);
         members.push({
@@ -276,9 +300,17 @@ export class TrustCircleService {
           ...(label?.self ? { self: true } : {}),
         });
       }
-      // Prune labels for peers that no longer exist in CadrePeer. Only when we
-      // successfully consulted the node — otherwise a transient outage would
-      // wipe labels.
+      // The authorized set excludes the node's own self-published row —
+      // splice it back in from the local label rather than dropping it.
+      for (const [peerId, row] of labels) {
+        if (row.self && !seenPeerIds.has(peerId)) {
+          seenPeerIds.add(peerId);
+          members.push({ peerId, ...row });
+        }
+      }
+      // Prune labels for peers that are neither authorized nor self. Only
+      // when we successfully consulted the node — otherwise a transient
+      // outage would wipe labels.
       for (const peerId of labels.keys()) {
         if (!seenPeerIds.has(peerId)) {
           this.store.removeMember(peerId);
@@ -306,8 +338,8 @@ export class TrustCircleService {
    * `never` so callers can `.catch(err => this.toDomainError(err))`.
    */
   private toDomainError(err: unknown): never {
-    if (err instanceof AuthorityNodeUnavailableError) {
-      throw new TrustCircleError('node_unavailable', `Authority node unavailable: ${err.message}`);
+    if (err instanceof OwnerNodeUnavailableError) {
+      throw new TrustCircleError('node_unavailable', `Owner node unavailable: ${err.message}`);
     }
     throw err instanceof Error ? err : new Error(String(err));
   }

package/src/auth/types.ts

@@ -62,7 +62,7 @@ export interface TrustCircleSnapshot {
  *   - `not_found`   → 404 (unknown token / unknown peer)
  *   - `expired`     → 410 (invite past expiresAt)
  *   - `already_redeemed` → 409 (token was used and is gone)
- *   - `node_unavailable` → 503 (authority node admin channel down/not ready)
+ *   - `node_unavailable` → 503 (owner node admin channel down/not ready)
  *   - default       → 500
  */
 export interface TrustCircleHandlers {
@@ -84,7 +84,7 @@ export type TrustCircleErrorCode =
   | 'invalid_label'
   | 'invalid_token'
   | 'storage_error'
-  /** The authority node's admin channel is unreachable / not ready. */
+  /** The owner node's admin channel is unreachable / not ready. */
   | 'node_unavailable';
 
 /** Typed error carrying a stable `code` for HTTP mapping. */