@tearleads/client-sdk 0.1.105 → 0.1.106

package/workflows/organizations/memberships/leaveRequestMembersEvidence.js

@@ -0,0 +1,80 @@
+import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { assertProjectionVerificationCurrent } from "../../../data/keyingProjectionVerification/types.js";
+import { requireOrganizationGroupHead } from "../../../data/principals/organizationAuthorityDescriptor.js";
+import { createRuntimePrincipalPolicyCurrentResolver, } from "../../principals/runtimePolicyRecovery.js";
+import { loadCurrentOrganizationAuthority } from "../currentOrganizationAuthority.js";
+import { loadLocalOrganizationPolicyReference } from "../readModel/localReadModelDetails.js";
+import { createLeaveRequestMembershipCheck, } from "./leaveRequestMembership.js";
+/**
+ * The organization's current Members head as the member's own device
+ * discovers and verifies it now, for a leave request to cite.
+ */
+export async function loadCurrentMembersHead(input) {
+    const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(input.runtime);
+    if (!resolveCurrentPolicy)
+        throw new ProjectionDependencyUnavailableError("Asking to leave requires private paged recovery");
+    const authority = await loadCurrentOrganizationAuthority({
+        execSql: input.runtime.infra.execSql,
+        organizationId: input.organizationId,
+        resolveCurrentPolicy,
+        stillCurrent: input.stillCurrent,
+    });
+    assertProjectionVerificationCurrent(authority.stillCurrent);
+    const head = requireOrganizationGroupHead(authority.descriptor, authority.descriptor.memberGroupId);
+    return {
+        keyEpoch: head.keyEpoch,
+        keyFingerprint: head.keyFingerprint,
+        principalId: head.principalId,
+        stateHash: head.stateHash,
+        version: head.version,
+    };
+}
+/**
+ * Checks leave requests against the Members head in the organization policy
+ * this device's read model selected, verified exactly through the private
+ * paged verifier (from local evidence when it has it), and walks verified
+ * Members history the same way when a request cites an earlier key epoch.
+ */
+export function createRuntimeLeaveRequestMembershipCheck(input) {
+    const resolve = createRuntimePrincipalPolicyCurrentResolver(input.runtime);
+    return createLeaveRequestMembershipCheck({
+        async loadMembersHead() {
+            if (!resolve)
+                return null;
+            const organizationReference = await loadLocalOrganizationPolicyReference({
+                currentUserId: input.currentUserId,
+                execSql: input.runtime.infra.execSql,
+                organizationId: input.organizationId,
+                principalId: input.organizationId,
+                principalType: "organization",
+            });
+            if (!organizationReference)
+                return null;
+            const authority = await loadCurrentOrganizationAuthority({
+                execSql: input.runtime.infra.execSql,
+                organizationId: input.organizationId,
+                organizationReference,
+                resolveCurrentPolicy: resolve,
+                stillCurrent: input.stillCurrent,
+            });
+            assertProjectionVerificationCurrent(authority.stillCurrent);
+            return requireOrganizationGroupHead(authority.descriptor, authority.descriptor.memberGroupId);
+        },
+        loadHistoryPage: resolve
+            ? async (head, beforeVersion) => {
+                const resolved = await resolve({
+                    organizationId: input.organizationId,
+                    reference: head,
+                    preferLocalCurrent: true,
+                    stillCurrent: input.stillCurrent,
+                    historyPage: beforeVersion === undefined ? {} : { beforeVersion },
+                });
+                assertProjectionVerificationCurrent(resolved.stillCurrent);
+                if (!resolved.historyPage)
+                    throw new Error("Verified Members history page is missing");
+                return resolved.historyPage;
+            }
+            : undefined,
+    });
+}
+//# sourceMappingURL=leaveRequestMembersEvidence.js.map

package/workflows/organizations/memberships/leaveRequestMembersEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaveRequestMembersEvidence.js","sourceRoot":"","sources":["leaveRequestMembersEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,EACL,2CAA2C,GAE5C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EACL,iCAAiC,GAElC,MAAM,0BAA0B,CAAC;AAQlC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2B;IAE3B,MAAM,oBAAoB,GAAG,2CAA2C,CACtE,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC,oBAAoB;QACvB,MAAM,IAAI,oCAAoC,CAC5C,iDAAiD,CAClD,CAAC;IACJ,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,4BAA4B,CACvC,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CAAC,aAAa,CACnC,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CACtD,KAAgE;IAEhE,MAAM,OAAO,GAAG,2CAA2C,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,OAAO,iCAAiC,CAAC;QACvC,KAAK,CAAC,eAAe;YACnB,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,qBAAqB,GAAG,MAAM,oCAAoC,CAAC;gBACvE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,cAAc;gBACjC,aAAa,EAAE,cAAc;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,qBAAqB;gBAAE,OAAO,IAAI,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC;gBACvD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,qBAAqB;gBACrB,oBAAoB,EAAE,OAAO;gBAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;YACH,mCAAmC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAC5D,OAAO,4BAA4B,CACjC,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CAAC,aAAa,CACnC,CAAC;QACJ,CAAC;QACD,eAAe,EAAE,OAAO;YACtB,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;oBAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,SAAS,EAAE,IAAI;oBACf,kBAAkB,EAAE,IAAI;oBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE;iBAClE,CAAC,CAAC;gBACH,mCAAmC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC3D,IAAI,CAAC,QAAQ,CAAC,WAAW;oBACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,OAAO,QAAQ,CAAC,WAAW,CAAC;YAC9B,CAAC;YACH,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OrganizationLeaveRequestMembersHead } from \"@tearleads/validators/util\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { assertProjectionVerificationCurrent } from \"../../../data/keyingProjectionVerification/types\";\nimport { requireOrganizationGroupHead } from \"../../../data/principals/organizationAuthorityDescriptor\";\nimport {\n  createRuntimePrincipalPolicyCurrentResolver,\n  type PrincipalPolicyRecoveryRuntime,\n} from \"../../principals/runtimePolicyRecovery\";\nimport { loadCurrentOrganizationAuthority } from \"../currentOrganizationAuthority\";\nimport { loadLocalOrganizationPolicyReference } from \"../readModel/localReadModelDetails\";\nimport {\n  createLeaveRequestMembershipCheck,\n  type LeaveRequestMembershipCheck,\n} from \"./leaveRequestMembership\";\n\ninterface MembersEvidenceInput {\n  readonly runtime: PrincipalPolicyRecoveryRuntime;\n  readonly organizationId: string;\n  readonly stillCurrent: () => boolean;\n}\n\n/**\n * The organization's current Members head as the member's own device\n * discovers and verifies it now, for a leave request to cite.\n */\nexport async function loadCurrentMembersHead(\n  input: MembersEvidenceInput,\n): Promise<OrganizationLeaveRequestMembersHead> {\n  const resolveCurrentPolicy = createRuntimePrincipalPolicyCurrentResolver(\n    input.runtime,\n  );\n  if (!resolveCurrentPolicy)\n    throw new ProjectionDependencyUnavailableError(\n      \"Asking to leave requires private paged recovery\",\n    );\n  const authority = await loadCurrentOrganizationAuthority({\n    execSql: input.runtime.infra.execSql,\n    organizationId: input.organizationId,\n    resolveCurrentPolicy,\n    stillCurrent: input.stillCurrent,\n  });\n  assertProjectionVerificationCurrent(authority.stillCurrent);\n  const head = requireOrganizationGroupHead(\n    authority.descriptor,\n    authority.descriptor.memberGroupId,\n  );\n  return {\n    keyEpoch: head.keyEpoch,\n    keyFingerprint: head.keyFingerprint,\n    principalId: head.principalId,\n    stateHash: head.stateHash,\n    version: head.version,\n  };\n}\n\n/**\n * Checks leave requests against the Members head in the organization policy\n * this device's read model selected, verified exactly through the private\n * paged verifier (from local evidence when it has it), and walks verified\n * Members history the same way when a request cites an earlier key epoch.\n */\nexport function createRuntimeLeaveRequestMembershipCheck(\n  input: MembersEvidenceInput & { readonly currentUserId: string },\n): LeaveRequestMembershipCheck {\n  const resolve = createRuntimePrincipalPolicyCurrentResolver(input.runtime);\n  return createLeaveRequestMembershipCheck({\n    async loadMembersHead() {\n      if (!resolve) return null;\n      const organizationReference = await loadLocalOrganizationPolicyReference({\n        currentUserId: input.currentUserId,\n        execSql: input.runtime.infra.execSql,\n        organizationId: input.organizationId,\n        principalId: input.organizationId,\n        principalType: \"organization\",\n      });\n      if (!organizationReference) return null;\n      const authority = await loadCurrentOrganizationAuthority({\n        execSql: input.runtime.infra.execSql,\n        organizationId: input.organizationId,\n        organizationReference,\n        resolveCurrentPolicy: resolve,\n        stillCurrent: input.stillCurrent,\n      });\n      assertProjectionVerificationCurrent(authority.stillCurrent);\n      return requireOrganizationGroupHead(\n        authority.descriptor,\n        authority.descriptor.memberGroupId,\n      );\n    },\n    loadHistoryPage: resolve\n      ? async (head, beforeVersion) => {\n          const resolved = await resolve({\n            organizationId: input.organizationId,\n            reference: head,\n            preferLocalCurrent: true,\n            stillCurrent: input.stillCurrent,\n            historyPage: beforeVersion === undefined ? {} : { beforeVersion },\n          });\n          assertProjectionVerificationCurrent(resolved.stillCurrent);\n          if (!resolved.historyPage)\n            throw new Error(\"Verified Members history page is missing\");\n          return resolved.historyPage;\n        }\n      : undefined,\n  });\n}\n"]}

package/workflows/organizations/memberships/leaveRequestMembership.d.ts

@@ -0,0 +1,24 @@
+import type { ReferencedPrincipalHead } from "../../../internal/crypto/index.js";
+import type { OrganizationLeaveRequest } from "../../../internal/validators/util/index.js";
+import type { RecoveredPrincipalHistoryPage } from "../../principals/historyRecovery/loadRecoveredPrincipalHistoryPage.js";
+export interface LeaveRequestMembershipEvidence {
+    /** The Members head this device has verified, or null when it has none. */
+    readonly loadMembersHead: () => Promise<ReferencedPrincipalHead | null>;
+    /**
+     * Verified Members history ending at `head`, one page at a time and in
+     * ascending order. Absent where this device cannot read history.
+     */
+    readonly loadHistoryPage?: ((head: ReferencedPrincipalHead, beforeVersion: number | undefined) => Promise<RecoveredPrincipalHistoryPage>) | undefined;
+}
+/** Whether a leave request still belongs to its member's current membership. */
+export type LeaveRequestMembershipCheck = (request: OrganizationLeaveRequest) => Promise<boolean>;
+/**
+ * Checks each leave request against this device's verified Members head.
+ * Removing anyone from Members rotates its key epoch and key, so a request
+ * citing the head's own epoch and key has seen no removal since. One citing an earlier epoch
+ * stands only if verified history shows its member in every Members state
+ * from the cited one on; a request from a membership a removal ended never
+ * does, whatever the server serves beside it. Display only: a request this
+ * device cannot place is shown as no request.
+ */
+export declare function createLeaveRequestMembershipCheck(evidence: LeaveRequestMembershipEvidence): LeaveRequestMembershipCheck;

package/workflows/organizations/memberships/leaveRequestMembership.js

@@ -0,0 +1,65 @@
+// How far back one request's check walks verified Members history: a request
+// stays pending for days, not for hundreds of Members changes.
+const MAX_MEMBERS_HISTORY_PAGES = 8;
+function citesState(request, state) {
+    const cited = request.membersHead;
+    return (state.version === cited.version &&
+        state.stateHash === cited.stateHash &&
+        state.keyEpoch === cited.keyEpoch &&
+        state.keyFingerprint === cited.keyFingerprint);
+}
+// Walks verified Members history back from the head to the cited state,
+// requiring the member in every state on the way.
+async function memberStayedSinceCitedState(request, head, loadHistoryPage) {
+    let expectedVersion = head.version;
+    let beforeVersion;
+    for (let pages = 0; pages < MAX_MEMBERS_HISTORY_PAGES; pages += 1) {
+        const page = await loadHistoryPage(head, beforeVersion);
+        for (const entry of [...page.entries].reverse()) {
+            const { state } = entry;
+            if (state.principalType !== head.principalType ||
+                state.principalId !== head.principalId ||
+                state.version !== expectedVersion ||
+                (state.version === head.version && state.stateHash !== head.stateHash))
+                return false;
+            if (!entry.projection.some((member) => member.userId === request.userId))
+                return false;
+            if (state.version === request.membersHead.version)
+                return citesState(request, state);
+            expectedVersion -= 1;
+        }
+        if (page.nextBeforeVersion === null || page.entries.length === 0)
+            return false;
+        beforeVersion = page.nextBeforeVersion;
+    }
+    return false;
+}
+/**
+ * Checks each leave request against this device's verified Members head.
+ * Removing anyone from Members rotates its key epoch and key, so a request
+ * citing the head's own epoch and key has seen no removal since. One citing an earlier epoch
+ * stands only if verified history shows its member in every Members state
+ * from the cited one on; a request from a membership a removal ended never
+ * does, whatever the server serves beside it. Display only: a request this
+ * device cannot place is shown as no request.
+ */
+export function createLeaveRequestMembershipCheck(evidence) {
+    let membersHead;
+    return async (request) => {
+        membersHead ??= evidence.loadMembersHead().catch(() => null);
+        const head = await membersHead;
+        const cited = request.membersHead;
+        if (head?.principalType !== "group" ||
+            cited.principalId !== head.principalId ||
+            cited.keyEpoch > head.keyEpoch)
+            return false;
+        // One signed chain holds one key per epoch, so a matching epoch with a
+        // different key can only come from a fork, never from this history.
+        if (cited.keyEpoch === head.keyEpoch)
+            return cited.keyFingerprint === head.keyFingerprint;
+        if (!evidence.loadHistoryPage || cited.version >= head.version)
+            return false;
+        return memberStayedSinceCitedState(request, head, evidence.loadHistoryPage).catch(() => false);
+    };
+}
+//# sourceMappingURL=leaveRequestMembership.js.map

package/workflows/organizations/memberships/leaveRequestMembership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaveRequestMembership.js","sourceRoot":"","sources":["leaveRequestMembership.ts"],"names":[],"mappings":"AAIA,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAsBpC,SAAS,UAAU,CACjB,OAAiC,EACjC,KAAgE;IAEhE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAClC,OAAO,CACL,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC/B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACnC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACjC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAC9C,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,kDAAkD;AAClD,KAAK,UAAU,2BAA2B,CACxC,OAAiC,EACjC,IAA6B,EAC7B,eAEC;IAED,IAAI,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC;IACnC,IAAI,aAAiC,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,yBAAyB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YACxB,IACE,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;gBAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;gBACtC,KAAK,CAAC,OAAO,KAAK,eAAe;gBACjC,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC;gBAEtE,OAAO,KAAK,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;gBACtE,OAAO,KAAK,CAAC;YACf,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,OAAO;gBAC/C,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpC,eAAe,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAAwC;IAExC,IAAI,WAAgE,CAAC;IACrE,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,WAAW,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;QAClC,IACE,IAAI,EAAE,aAAa,KAAK,OAAO;YAC/B,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YACtC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ;YAE9B,OAAO,KAAK,CAAC;QACf,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAClC,OAAO,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAC5D,OAAO,KAAK,CAAC;QACf,OAAO,2BAA2B,CAChC,OAAO,EACP,IAAI,EACJ,QAAQ,CAAC,eAAe,CACzB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport type { OrganizationLeaveRequest } from \"@tearleads/validators/util\";\nimport type { RecoveredPrincipalHistoryPage } from \"../../principals/historyRecovery/loadRecoveredPrincipalHistoryPage\";\n\n// How far back one request's check walks verified Members history: a request\n// stays pending for days, not for hundreds of Members changes.\nconst MAX_MEMBERS_HISTORY_PAGES = 8;\n\nexport interface LeaveRequestMembershipEvidence {\n  /** The Members head this device has verified, or null when it has none. */\n  readonly loadMembersHead: () => Promise<ReferencedPrincipalHead | null>;\n  /**\n   * Verified Members history ending at `head`, one page at a time and in\n   * ascending order. Absent where this device cannot read history.\n   */\n  readonly loadHistoryPage?:\n    | ((\n        head: ReferencedPrincipalHead,\n        beforeVersion: number | undefined,\n      ) => Promise<RecoveredPrincipalHistoryPage>)\n    | undefined;\n}\n\n/** Whether a leave request still belongs to its member's current membership. */\nexport type LeaveRequestMembershipCheck = (\n  request: OrganizationLeaveRequest,\n) => Promise<boolean>;\n\nfunction citesState(\n  request: OrganizationLeaveRequest,\n  state: RecoveredPrincipalHistoryPage[\"entries\"][number][\"state\"],\n): boolean {\n  const cited = request.membersHead;\n  return (\n    state.version === cited.version &&\n    state.stateHash === cited.stateHash &&\n    state.keyEpoch === cited.keyEpoch &&\n    state.keyFingerprint === cited.keyFingerprint\n  );\n}\n\n// Walks verified Members history back from the head to the cited state,\n// requiring the member in every state on the way.\nasync function memberStayedSinceCitedState(\n  request: OrganizationLeaveRequest,\n  head: ReferencedPrincipalHead,\n  loadHistoryPage: NonNullable<\n    LeaveRequestMembershipEvidence[\"loadHistoryPage\"]\n  >,\n): Promise<boolean> {\n  let expectedVersion = head.version;\n  let beforeVersion: number | undefined;\n  for (let pages = 0; pages < MAX_MEMBERS_HISTORY_PAGES; pages += 1) {\n    const page = await loadHistoryPage(head, beforeVersion);\n    for (const entry of [...page.entries].reverse()) {\n      const { state } = entry;\n      if (\n        state.principalType !== head.principalType ||\n        state.principalId !== head.principalId ||\n        state.version !== expectedVersion ||\n        (state.version === head.version && state.stateHash !== head.stateHash)\n      )\n        return false;\n      if (!entry.projection.some((member) => member.userId === request.userId))\n        return false;\n      if (state.version === request.membersHead.version)\n        return citesState(request, state);\n      expectedVersion -= 1;\n    }\n    if (page.nextBeforeVersion === null || page.entries.length === 0)\n      return false;\n    beforeVersion = page.nextBeforeVersion;\n  }\n  return false;\n}\n\n/**\n * Checks each leave request against this device's verified Members head.\n * Removing anyone from Members rotates its key epoch and key, so a request\n * citing the head's own epoch and key has seen no removal since. One citing an earlier epoch\n * stands only if verified history shows its member in every Members state\n * from the cited one on; a request from a membership a removal ended never\n * does, whatever the server serves beside it. Display only: a request this\n * device cannot place is shown as no request.\n */\nexport function createLeaveRequestMembershipCheck(\n  evidence: LeaveRequestMembershipEvidence,\n): LeaveRequestMembershipCheck {\n  let membersHead: Promise<ReferencedPrincipalHead | null> | undefined;\n  return async (request) => {\n    membersHead ??= evidence.loadMembersHead().catch(() => null);\n    const head = await membersHead;\n    const cited = request.membersHead;\n    if (\n      head?.principalType !== \"group\" ||\n      cited.principalId !== head.principalId ||\n      cited.keyEpoch > head.keyEpoch\n    )\n      return false;\n    // One signed chain holds one key per epoch, so a matching epoch with a\n    // different key can only come from a fork, never from this history.\n    if (cited.keyEpoch === head.keyEpoch)\n      return cited.keyFingerprint === head.keyFingerprint;\n    if (!evidence.loadHistoryPage || cited.version >= head.version)\n      return false;\n    return memberStayedSinceCitedState(\n      request,\n      head,\n      evidence.loadHistoryPage,\n    ).catch(() => false);\n  };\n}\n"]}

package/workflows/organizations/memberships/leaveRequestVerification.d.ts

@@ -1,15 +1,23 @@
 import type { TrustedUserIdentityResolver } from "../../../data/trustedUserIdentity/index.js";
 import type { OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationUserDetail } from "../readModel/index.js";
+import type { LeaveRequestMembershipCheck } from "./leaveRequestMembership.js";
+/** What a shown leave request is checked against. */
+export interface LeaveRequestVerifier {
+    readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;
+    readonly membershipIsCurrent: LeaveRequestMembershipCheck;
+}
 /**
  * The user as shown, with its leave request kept only when the member signed
- * it. Every directory user a client presents passes through here, whether a
- * read model or a mutation response carried it.
+ * it during their current membership. Every directory user a client presents
+ * passes through here, whether a read model or a mutation response carried
+ * it.
  */
-export declare function withVerifiedDirectoryUser(organizationId: string, user: OrganizationDirectoryUser, resolveTrustedUserIdentity: TrustedUserIdentityResolver): Promise<OrganizationDirectoryUser>;
+export declare function withVerifiedDirectoryUser(organizationId: string, user: OrganizationDirectoryUser, verifier: LeaveRequestVerifier): Promise<OrganizationDirectoryUser>;
 /**
- * Keeps only leave requests their member signed, checked against the member's
- * trusted identity; any other is shown as no request at all.
+ * Keeps only leave requests their member signed during their current
+ * membership, checked against the member's trusted identity and this device's
+ * verified Members history; any other is shown as no request at all.
  */
-export declare function withVerifiedLeaveRequests<Result extends OrganizationDirectoryAndGroups | null | undefined>(result: Result, resolveTrustedUserIdentity: TrustedUserIdentityResolver): Promise<Result>;
+export declare function withVerifiedLeaveRequests<Result extends OrganizationDirectoryAndGroups | null | undefined>(result: Result, verifier: LeaveRequestVerifier): Promise<Result>;
 /** The user detail counterpart of withVerifiedLeaveRequests. */
-export declare function withVerifiedUserLeaveRequest(detail: OrganizationUserDetail | null, organizationId: string, resolveTrustedUserIdentity: TrustedUserIdentityResolver): Promise<OrganizationUserDetail | null>;
+export declare function withVerifiedUserLeaveRequest(detail: OrganizationUserDetail | null, organizationId: string, verifier: LeaveRequestVerifier): Promise<OrganizationUserDetail | null>;

package/workflows/organizations/memberships/leaveRequestVerification.js

@@ -1,27 +1,34 @@
 import { isValidOrganizationLeaveRequest } from "../../../internal/crypto/index.js";
 /**
  * The user as shown, with its leave request kept only when the member signed
- * it. Every directory user a client presents passes through here, whether a
- * read model or a mutation response carried it.
+ * it during their current membership. Every directory user a client presents
+ * passes through here, whether a read model or a mutation response carried
+ * it.
  */
-export async function withVerifiedDirectoryUser(organizationId, user, resolveTrustedUserIdentity) {
+export async function withVerifiedDirectoryUser(organizationId, user, verifier) {
     const request = user.leaveRequest;
     if (!request)
         return user;
     // The member's pinned identity, never the key the directory served beside
     // the request: a server that could swap both could forge any member's ask.
-    const identity = await resolveTrustedUserIdentity(user.userId).catch(() => null);
-    const verified = identity !== null &&
+    const identity = await verifier
+        .resolveTrustedUserIdentity(user.userId)
+        .catch(() => null);
+    const signed = identity !== null &&
         request.organizationId === organizationId &&
         request.userId === user.userId &&
         isValidOrganizationLeaveRequest(request, identity.signingPublicKey);
+    // A genuine request from a membership that has since ended would otherwise
+    // look current to an administrator once the member rejoined.
+    const verified = signed && (await verifier.membershipIsCurrent(request));
     return verified ? user : { ...user, leaveRequest: null };
 }
 /**
- * Keeps only leave requests their member signed, checked against the member's
- * trusted identity; any other is shown as no request at all.
+ * Keeps only leave requests their member signed during their current
+ * membership, checked against the member's trusted identity and this device's
+ * verified Members history; any other is shown as no request at all.
  */
-export async function withVerifiedLeaveRequests(result, resolveTrustedUserIdentity) {
+export async function withVerifiedLeaveRequests(result, verifier) {
     if (!result?.directory.users.some((user) => user.leaveRequest)) {
         return result;
     }
@@ -30,17 +37,17 @@ export async function withVerifiedLeaveRequests(result, resolveTrustedUserIdenti
         ...result,
         directory: {
             ...result.directory,
-            users: await Promise.all(result.directory.users.map((user) => withVerifiedDirectoryUser(organizationId, user, resolveTrustedUserIdentity))),
+            users: await Promise.all(result.directory.users.map((user) => withVerifiedDirectoryUser(organizationId, user, verifier))),
         },
     };
 }
 /** The user detail counterpart of withVerifiedLeaveRequests. */
-export async function withVerifiedUserLeaveRequest(detail, organizationId, resolveTrustedUserIdentity) {
+export async function withVerifiedUserLeaveRequest(detail, organizationId, verifier) {
     if (!detail?.user.leaveRequest)
         return detail;
     return {
         ...detail,
-        user: await withVerifiedDirectoryUser(organizationId, detail.user, resolveTrustedUserIdentity),
+        user: await withVerifiedDirectoryUser(organizationId, detail.user, verifier),
     };
 }
 //# sourceMappingURL=leaveRequestVerification.js.map

package/workflows/organizations/memberships/leaveRequestVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"leaveRequestVerification.js","sourceRoot":"","sources":["leaveRequestVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAQpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAAsB,EACtB,IAA+B,EAC/B,0BAAuD;IAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAClE,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IACF,MAAM,QAAQ,GACZ,QAAQ,KAAK,IAAI;QACjB,OAAO,CAAC,cAAc,KAAK,cAAc;QACzC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAG7C,MAAc,EACd,0BAAuD;IAEvD,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE;YACT,GAAG,MAAM,CAAC,SAAS;YACnB,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CACtB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,yBAAyB,CACvB,cAAc,EACd,IAAI,EACJ,0BAA0B,CAC3B,CACF,CACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAqC,EACrC,cAAsB,EACtB,0BAAuD;IAEvD,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,MAAM,yBAAyB,CACnC,cAAc,EACd,MAAM,CAAC,IAAI,EACX,0BAA0B,CAC3B;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { isValidOrganizationLeaveRequest } from \"@tearleads/crypto\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type {\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationUserDetail,\n} from \"../readModel\";\n\n/**\n * The user as shown, with its leave request kept only when the member signed\n * it. Every directory user a client presents passes through here, whether a\n * read model or a mutation response carried it.\n */\nexport async function withVerifiedDirectoryUser(\n  organizationId: string,\n  user: OrganizationDirectoryUser,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n): Promise<OrganizationDirectoryUser> {\n  const request = user.leaveRequest;\n  if (!request) return user;\n  // The member's pinned identity, never the key the directory served beside\n  // the request: a server that could swap both could forge any member's ask.\n  const identity = await resolveTrustedUserIdentity(user.userId).catch(\n    () => null,\n  );\n  const verified =\n    identity !== null &&\n    request.organizationId === organizationId &&\n    request.userId === user.userId &&\n    isValidOrganizationLeaveRequest(request, identity.signingPublicKey);\n  return verified ? user : { ...user, leaveRequest: null };\n}\n\n/**\n * Keeps only leave requests their member signed, checked against the member's\n * trusted identity; any other is shown as no request at all.\n */\nexport async function withVerifiedLeaveRequests<\n  Result extends OrganizationDirectoryAndGroups | null | undefined,\n>(\n  result: Result,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n): Promise<Result> {\n  if (!result?.directory.users.some((user) => user.leaveRequest)) {\n    return result;\n  }\n  const { organizationId } = result.directory;\n  return {\n    ...result,\n    directory: {\n      ...result.directory,\n      users: await Promise.all(\n        result.directory.users.map((user) =>\n          withVerifiedDirectoryUser(\n            organizationId,\n            user,\n            resolveTrustedUserIdentity,\n          ),\n        ),\n      ),\n    },\n  };\n}\n\n/** The user detail counterpart of withVerifiedLeaveRequests. */\nexport async function withVerifiedUserLeaveRequest(\n  detail: OrganizationUserDetail | null,\n  organizationId: string,\n  resolveTrustedUserIdentity: TrustedUserIdentityResolver,\n): Promise<OrganizationUserDetail | null> {\n  if (!detail?.user.leaveRequest) return detail;\n  return {\n    ...detail,\n    user: await withVerifiedDirectoryUser(\n      organizationId,\n      detail.user,\n      resolveTrustedUserIdentity,\n    ),\n  };\n}\n"]}
+{"version":3,"file":"leaveRequestVerification.js","sourceRoot":"","sources":["leaveRequestVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAepE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAAsB,EACtB,IAA+B,EAC/B,QAA8B;IAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ;SAC5B,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC;SACvC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,MAAM,GACV,QAAQ,KAAK,IAAI;QACjB,OAAO,CAAC,cAAc,KAAK,cAAc;QACzC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,+BAA+B,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,MAAc,EAAE,QAA8B;IAC9C,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE;YACT,GAAG,MAAM,CAAC,SAAS;YACnB,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CACtB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,yBAAyB,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,CAAC,CAC1D,CACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAqC,EACrC,cAAsB,EACtB,QAA8B;IAE9B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,MAAM,yBAAyB,CACnC,cAAc,EACd,MAAM,CAAC,IAAI,EACX,QAAQ,CACT;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { isValidOrganizationLeaveRequest } from \"@tearleads/crypto\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport type {\n  OrganizationDirectoryAndGroups,\n  OrganizationDirectoryUser,\n  OrganizationUserDetail,\n} from \"../readModel\";\nimport type { LeaveRequestMembershipCheck } from \"./leaveRequestMembership\";\n\n/** What a shown leave request is checked against. */\nexport interface LeaveRequestVerifier {\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly membershipIsCurrent: LeaveRequestMembershipCheck;\n}\n\n/**\n * The user as shown, with its leave request kept only when the member signed\n * it during their current membership. Every directory user a client presents\n * passes through here, whether a read model or a mutation response carried\n * it.\n */\nexport async function withVerifiedDirectoryUser(\n  organizationId: string,\n  user: OrganizationDirectoryUser,\n  verifier: LeaveRequestVerifier,\n): Promise<OrganizationDirectoryUser> {\n  const request = user.leaveRequest;\n  if (!request) return user;\n  // The member's pinned identity, never the key the directory served beside\n  // the request: a server that could swap both could forge any member's ask.\n  const identity = await verifier\n    .resolveTrustedUserIdentity(user.userId)\n    .catch(() => null);\n  const signed =\n    identity !== null &&\n    request.organizationId === organizationId &&\n    request.userId === user.userId &&\n    isValidOrganizationLeaveRequest(request, identity.signingPublicKey);\n  // A genuine request from a membership that has since ended would otherwise\n  // look current to an administrator once the member rejoined.\n  const verified = signed && (await verifier.membershipIsCurrent(request));\n  return verified ? user : { ...user, leaveRequest: null };\n}\n\n/**\n * Keeps only leave requests their member signed during their current\n * membership, checked against the member's trusted identity and this device's\n * verified Members history; any other is shown as no request at all.\n */\nexport async function withVerifiedLeaveRequests<\n  Result extends OrganizationDirectoryAndGroups | null | undefined,\n>(result: Result, verifier: LeaveRequestVerifier): Promise<Result> {\n  if (!result?.directory.users.some((user) => user.leaveRequest)) {\n    return result;\n  }\n  const { organizationId } = result.directory;\n  return {\n    ...result,\n    directory: {\n      ...result.directory,\n      users: await Promise.all(\n        result.directory.users.map((user) =>\n          withVerifiedDirectoryUser(organizationId, user, verifier),\n        ),\n      ),\n    },\n  };\n}\n\n/** The user detail counterpart of withVerifiedLeaveRequests. */\nexport async function withVerifiedUserLeaveRequest(\n  detail: OrganizationUserDetail | null,\n  organizationId: string,\n  verifier: LeaveRequestVerifier,\n): Promise<OrganizationUserDetail | null> {\n  if (!detail?.user.leaveRequest) return detail;\n  return {\n    ...detail,\n    user: await withVerifiedDirectoryUser(\n      organizationId,\n      detail.user,\n      verifier,\n    ),\n  };\n}\n"]}