@tearleads/client-sdk 0.1.19 → 0.1.21

package/data/keyingProjectionVerification/principalPolicySnapshotVerification.js

@@ -1,208 +0,0 @@
-import { KeyingVerificationError, principalPolicyMatchesReference, toFingerprint, verifyPrincipalPolicyCheckpoint, } from "../../internal/crypto/index.js";
-import { loadPrincipalPolicyCheckpoint } from "../persistence/keyingCheckpointPersistence.js";
-import { loadPrincipalPolicyBundleForReference } from "../persistence/principalPolicyReferencePersistence.js";
-import { ProjectionDependencyUnavailableError } from "./dependencyUnavailable.js";
-import { verifyReceivedPolicySnapshot } from "./snapshotVerificationCache.js";
-function identityKey(input) {
-    return `${input.principalType}:${input.principalId}`;
-}
-function snapshotStates(snapshot) {
-    return [
-        ...snapshot.previousStates.map((entry) => entry.state),
-        snapshot.currentState,
-    ];
-}
-function snapshotReference(snapshot) {
-    const state = snapshot.currentState;
-    return {
-        principalType: state.principalType,
-        principalId: state.principalId,
-        version: state.version,
-        keyEpoch: state.keyEpoch,
-        stateHash: state.stateHash,
-        keyFingerprint: state.keyFingerprint,
-    };
-}
-async function signerPublicKeys(input) {
-    const keys = new Map();
-    for (const state of snapshotStates(input.snapshot)) {
-        const key = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;
-        if (keys.has(key)) {
-            continue;
-        }
-        const identity = await input.resolveUserKey(state.signerUserId);
-        if (!identity) {
-            throw new ProjectionDependencyUnavailableError(`Principal policy snapshot signer ${state.signerUserId} is unavailable`);
-        }
-        const fingerprint = await toFingerprint(identity.signingPublicKey);
-        if (fingerprint !== state.signerUserKeyFingerprint) {
-            throw new KeyingVerificationError("signer_mismatch", "Principal policy snapshot signer fingerprint mismatch");
-        }
-        keys.set(key, {
-            userId: state.signerUserId,
-            signingKeyFingerprint: fingerprint,
-            signingPublicKey: identity.signingPublicKey,
-        });
-    }
-    return [...keys.values()];
-}
-function authorityReference(snapshot) {
-    const references = snapshotStates(snapshot).flatMap((state) => state.externalAuthority ? [state.externalAuthority] : []);
-    if (references.length === 0) {
-        return null;
-    }
-    const [first] = references;
-    if (!first ||
-        references.some((reference) => reference.principalId !== first.principalId ||
-            reference.principalType !== first.principalType)) {
-        throw new KeyingVerificationError("invalid_shape", "Principal policy snapshot cites inconsistent external authority");
-    }
-    return references.reduce((latest, reference) => reference.version > latest.version ? reference : latest);
-}
-function externalAuthority(policy) {
-    const states = policy.history.map((entry) => {
-        if (entry.state.principalType !== "group" ||
-            entry.projection.length === 0 ||
-            entry.projection.some((member) => member.role !== "admin")) {
-            throw new KeyingVerificationError("unauthorized", "Principal policy snapshot authority is invalid");
-        }
-        return {
-            head: {
-                principalType: "group",
-                principalId: entry.state.principalId,
-                version: entry.state.version,
-                keyEpoch: entry.state.keyEpoch,
-                stateHash: entry.state.stateHash,
-                keyFingerprint: entry.state.keyFingerprint,
-            },
-            projection: entry.projection,
-        };
-    });
-    const current = states.at(-1);
-    if (!current) {
-        throw new KeyingVerificationError("missing_dependency", "Principal policy snapshot authority is empty");
-    }
-    return { currentHead: current.head, states };
-}
-async function verifySnapshotAuthorization(input) {
-    const reference = snapshotReference(input.snapshot);
-    const authorityHead = authorityReference(input.snapshot);
-    if (reference.principalType === "organization" && authorityHead) {
-        throw new KeyingVerificationError("unauthorized", "organization states cannot cite external authority");
-    }
-    if (!authorityHead) {
-        const direct = await verifyReceivedPolicySnapshot({
-            expectedReference: reference,
-            signerPublicKeys: input.signerPublicKeys,
-            snapshot: input.snapshot,
-        });
-        if (!direct.ok)
-            throw direct.error;
-        return direct.value;
-    }
-    const authorityPolicy = await input.resolveAuthority(authorityHead);
-    if (!principalPolicyMatchesReference({
-        policy: authorityPolicy,
-        reference: authorityHead,
-    })) {
-        throw new KeyingVerificationError("missing_dependency", "Principal policy snapshot authority omits the referenced head");
-    }
-    const verified = await verifyReceivedPolicySnapshot({
-        expectedReference: reference,
-        externalAuthority: externalAuthority(authorityPolicy),
-        signerPublicKeys: input.signerPublicKeys,
-        snapshot: input.snapshot,
-    });
-    if (!verified.ok) {
-        throw verified.error;
-    }
-    return verified.value;
-}
-async function enforceSnapshotCheckpoint(input) {
-    const checkpoint = await loadPrincipalPolicyCheckpoint(input.execSql, input.reference.principalType, input.reference.principalId);
-    if (!checkpoint)
-        return true;
-    if (input.policy.version >= checkpoint.version) {
-        verifyPrincipalPolicyCheckpoint({
-            chain: input.policy.history,
-            currentState: input.policy.state,
-            localCheckpoint: checkpoint,
-        });
-        return true;
-    }
-    const localDescendant = await loadPrincipalPolicyBundleForReference(input.execSql, input.reference, checkpoint);
-    if (!localDescendant) {
-        throw new KeyingVerificationError("rollback", "Principal policy snapshot cannot be connected to the newer local checkpoint");
-    }
-    return false;
-}
-export async function verifyPrincipalPolicySnapshots(input) {
-    const snapshotsByPrincipal = new Map();
-    for (const snapshot of input.snapshots) {
-        const key = identityKey(snapshot.currentState);
-        if (snapshotsByPrincipal.has(key)) {
-            throw new KeyingVerificationError("invalid_shape", "Principal policy snapshots contain a duplicate principal");
-        }
-        snapshotsByPrincipal.set(key, snapshot);
-    }
-    const verifiedByPrincipal = new Map();
-    const visiting = new Set();
-    const verifyOne = async (snapshot) => {
-        const key = identityKey(snapshot.currentState);
-        const cached = verifiedByPrincipal.get(key);
-        if (cached) {
-            return cached;
-        }
-        if (visiting.has(key)) {
-            throw new KeyingVerificationError("invalid_shape", "Principal policy snapshot authority contains a cycle");
-        }
-        visiting.add(key);
-        try {
-            const publicKeys = await signerPublicKeys({
-                resolveUserKey: input.resolveUserKey,
-                snapshot,
-            });
-            const policy = await verifySnapshotAuthorization({
-                resolveAuthority: async (reference) => {
-                    const authoritySnapshot = snapshotsByPrincipal.get(identityKey(reference));
-                    if (!authoritySnapshot) {
-                        throw new KeyingVerificationError("missing_dependency", "Principal policy snapshot authority is missing");
-                    }
-                    return verifyOne(authoritySnapshot);
-                },
-                signerPublicKeys: publicKeys,
-                snapshot,
-            });
-            verifiedByPrincipal.set(key, policy);
-            return policy;
-        }
-        finally {
-            visiting.delete(key);
-        }
-    };
-    for (const snapshot of input.snapshots) {
-        await verifyOne(snapshot);
-    }
-    return [...verifiedByPrincipal.values()];
-}
-export async function enforcePrincipalPolicySnapshotCheckpoints(input) {
-    const policiesToPin = [];
-    for (const policy of input.policies) {
-        const shouldPin = await enforceSnapshotCheckpoint({
-            execSql: input.execSql,
-            policy,
-            reference: {
-                principalType: policy.state.principalType,
-                principalId: policy.state.principalId,
-                version: policy.state.version,
-                keyEpoch: policy.state.keyEpoch,
-                stateHash: policy.state.stateHash,
-                keyFingerprint: policy.state.keyFingerprint,
-            },
-        });
-        if (shouldPin)
-            policiesToPin.push(policy);
-    }
-    return policiesToPin;
-}
-//# sourceMappingURL=principalPolicySnapshotVerification.js.map

package/data/keyingProjectionVerification/principalPolicySnapshotVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principalPolicySnapshotVerification.js","sourceRoot":"","sources":["principalPolicySnapshotVerification.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,aAAa,EACb,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,MAAM,oDAAoD,CAAC;AAE3G,OAAO,EAAE,oCAAoC,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAG3E,SAAS,WAAW,CAAC,KAGpB;IACC,OAAO,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,QAAyC;IAC/D,OAAO;QACL,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACtD,QAAQ,CAAC,YAAY;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAyC;IAEzC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpC,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAG/B;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0C,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oCAAoC,CAC5C,oCAAoC,KAAK,CAAC,YAAY,iBAAiB,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,WAAW,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;YACnD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;YACZ,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,qBAAqB,EAAE,WAAW;YAClC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAyC;IAEzC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5D,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;IAC3B,IACE,CAAC,KAAK;QACN,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC3C,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAClD,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAC7C,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAuC;IAEvC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,IACE,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;YACrC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,EAC1D,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa,EAAE,OAAgB;gBAC/B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;aAC3C;YACD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAM1C;IACC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,aAAa,KAAK,cAAc,IAAI,aAAa,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,iBAAiB,EAAE,SAAS;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,IACE,CAAC,+BAA+B,CAAC;QAC/B,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,aAAa;KACzB,CAAC,EACF,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;QAClD,iBAAiB,EAAE,SAAS;QAC5B,iBAAiB,EAAE,iBAAiB,CAAC,eAAe,CAAC;QACrD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IACC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CACpD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,KAAK,CAAC,SAAS,CAAC,WAAW,CAC5B,CAAC;IACF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/C,+BAA+B,CAAC;YAC9B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC3B,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YAChC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,qCAAqC,CACjE,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,EACf,UAAU,CACX,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAGpD;IACC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;IACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,SAAS,GAAG,KAAK,EACrB,QAAyC,EACC,EAAE;QAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,sDAAsD,CACvD,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;gBAC/C,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;oBACpC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,CAChD,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;oBACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;oBACJ,CAAC;oBACD,OAAO,SAAS,CAAC,iBAAiB,CAAC,CAAC;gBACtC,CAAC;gBACD,gBAAgB,EAAE,UAAU;gBAC5B,QAAQ;aACT,CAAC,CAAC;YACH,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAG/D;IACC,MAAM,aAAa,GAAsC,EAAE,CAAC;IAC5D,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM;YACN,SAAS,EAAE;gBACT,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;gBACzC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;gBACrC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;gBACjC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;aAC5C;SACF,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicySignerPublicKey,\n  ReferencedPrincipalHead,\n  VerifiedPrincipalPolicySnapshot,\n} from \"@tearleads/crypto\";\nimport {\n  KeyingVerificationError,\n  principalPolicyMatchesReference,\n  toFingerprint,\n  verifyPrincipalPolicyCheckpoint,\n} from \"@tearleads/crypto\";\nimport type { PrincipalPolicySnapshotResponse } from \"@tearleads/validators/response\";\nimport { loadPrincipalPolicyCheckpoint } from \"../persistence/keyingCheckpointPersistence\";\nimport { loadPrincipalPolicyBundleForReference } from \"../persistence/principalPolicyReferencePersistence\";\nimport type { ExecSql } from \"../sqlite/sqlSchema\";\nimport { ProjectionDependencyUnavailableError } from \"./dependencyUnavailable\";\nimport { verifyReceivedPolicySnapshot } from \"./snapshotVerificationCache\";\nimport type { ProjectionUserKeyResolver } from \"./types\";\n\nfunction identityKey(input: {\n  readonly principalId: string;\n  readonly principalType: string;\n}): string {\n  return `${input.principalType}:${input.principalId}`;\n}\n\nfunction snapshotStates(snapshot: PrincipalPolicySnapshotResponse) {\n  return [\n    ...snapshot.previousStates.map((entry) => entry.state),\n    snapshot.currentState,\n  ];\n}\n\nfunction snapshotReference(\n  snapshot: PrincipalPolicySnapshotResponse,\n): ReferencedPrincipalHead {\n  const state = snapshot.currentState;\n  return {\n    principalType: state.principalType,\n    principalId: state.principalId,\n    version: state.version,\n    keyEpoch: state.keyEpoch,\n    stateHash: state.stateHash,\n    keyFingerprint: state.keyFingerprint,\n  };\n}\n\nasync function signerPublicKeys(input: {\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly snapshot: PrincipalPolicySnapshotResponse;\n}): Promise<PrincipalPolicySignerPublicKey[]> {\n  const keys = new Map<string, PrincipalPolicySignerPublicKey>();\n  for (const state of snapshotStates(input.snapshot)) {\n    const key = `${state.signerUserId}:${state.signerUserKeyFingerprint}`;\n    if (keys.has(key)) {\n      continue;\n    }\n    const identity = await input.resolveUserKey(state.signerUserId);\n    if (!identity) {\n      throw new ProjectionDependencyUnavailableError(\n        `Principal policy snapshot signer ${state.signerUserId} is unavailable`,\n      );\n    }\n    const fingerprint = await toFingerprint(identity.signingPublicKey);\n    if (fingerprint !== state.signerUserKeyFingerprint) {\n      throw new KeyingVerificationError(\n        \"signer_mismatch\",\n        \"Principal policy snapshot signer fingerprint mismatch\",\n      );\n    }\n    keys.set(key, {\n      userId: state.signerUserId,\n      signingKeyFingerprint: fingerprint,\n      signingPublicKey: identity.signingPublicKey,\n    });\n  }\n  return [...keys.values()];\n}\n\nfunction authorityReference(\n  snapshot: PrincipalPolicySnapshotResponse,\n): ReferencedPrincipalHead | null {\n  const references = snapshotStates(snapshot).flatMap((state) =>\n    state.externalAuthority ? [state.externalAuthority] : [],\n  );\n  if (references.length === 0) {\n    return null;\n  }\n  const [first] = references;\n  if (\n    !first ||\n    references.some(\n      (reference) =>\n        reference.principalId !== first.principalId ||\n        reference.principalType !== first.principalType,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"invalid_shape\",\n      \"Principal policy snapshot cites inconsistent external authority\",\n    );\n  }\n  return references.reduce((latest, reference) =>\n    reference.version > latest.version ? reference : latest,\n  );\n}\n\nfunction externalAuthority(\n  policy: VerifiedPrincipalPolicySnapshot,\n): PrincipalPolicyExternalAuthority {\n  const states = policy.history.map((entry) => {\n    if (\n      entry.state.principalType !== \"group\" ||\n      entry.projection.length === 0 ||\n      entry.projection.some((member) => member.role !== \"admin\")\n    ) {\n      throw new KeyingVerificationError(\n        \"unauthorized\",\n        \"Principal policy snapshot authority is invalid\",\n      );\n    }\n    return {\n      head: {\n        principalType: \"group\" as const,\n        principalId: entry.state.principalId,\n        version: entry.state.version,\n        keyEpoch: entry.state.keyEpoch,\n        stateHash: entry.state.stateHash,\n        keyFingerprint: entry.state.keyFingerprint,\n      },\n      projection: entry.projection,\n    };\n  });\n  const current = states.at(-1);\n  if (!current) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal policy snapshot authority is empty\",\n    );\n  }\n  return { currentHead: current.head, states };\n}\n\nasync function verifySnapshotAuthorization(input: {\n  readonly resolveAuthority: (\n    reference: ReferencedPrincipalHead,\n  ) => Promise<VerifiedPrincipalPolicySnapshot>;\n  readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n  readonly snapshot: PrincipalPolicySnapshotResponse;\n}): Promise<VerifiedPrincipalPolicySnapshot> {\n  const reference = snapshotReference(input.snapshot);\n  const authorityHead = authorityReference(input.snapshot);\n  if (reference.principalType === \"organization\" && authorityHead) {\n    throw new KeyingVerificationError(\n      \"unauthorized\",\n      \"organization states cannot cite external authority\",\n    );\n  }\n  if (!authorityHead) {\n    const direct = await verifyReceivedPolicySnapshot({\n      expectedReference: reference,\n      signerPublicKeys: input.signerPublicKeys,\n      snapshot: input.snapshot,\n    });\n    if (!direct.ok) throw direct.error;\n    return direct.value;\n  }\n  const authorityPolicy = await input.resolveAuthority(authorityHead);\n  if (\n    !principalPolicyMatchesReference({\n      policy: authorityPolicy,\n      reference: authorityHead,\n    })\n  ) {\n    throw new KeyingVerificationError(\n      \"missing_dependency\",\n      \"Principal policy snapshot authority omits the referenced head\",\n    );\n  }\n  const verified = await verifyReceivedPolicySnapshot({\n    expectedReference: reference,\n    externalAuthority: externalAuthority(authorityPolicy),\n    signerPublicKeys: input.signerPublicKeys,\n    snapshot: input.snapshot,\n  });\n  if (!verified.ok) {\n    throw verified.error;\n  }\n  return verified.value;\n}\n\nasync function enforceSnapshotCheckpoint(input: {\n  readonly execSql: ExecSql;\n  readonly policy: VerifiedPrincipalPolicySnapshot;\n  readonly reference: ReferencedPrincipalHead;\n}): Promise<boolean> {\n  const checkpoint = await loadPrincipalPolicyCheckpoint(\n    input.execSql,\n    input.reference.principalType,\n    input.reference.principalId,\n  );\n  if (!checkpoint) return true;\n  if (input.policy.version >= checkpoint.version) {\n    verifyPrincipalPolicyCheckpoint({\n      chain: input.policy.history,\n      currentState: input.policy.state,\n      localCheckpoint: checkpoint,\n    });\n    return true;\n  }\n  const localDescendant = await loadPrincipalPolicyBundleForReference(\n    input.execSql,\n    input.reference,\n    checkpoint,\n  );\n  if (!localDescendant) {\n    throw new KeyingVerificationError(\n      \"rollback\",\n      \"Principal policy snapshot cannot be connected to the newer local checkpoint\",\n    );\n  }\n  return false;\n}\n\nexport async function verifyPrincipalPolicySnapshots(input: {\n  readonly resolveUserKey: ProjectionUserKeyResolver;\n  readonly snapshots: readonly PrincipalPolicySnapshotResponse[];\n}): Promise<VerifiedPrincipalPolicySnapshot[]> {\n  const snapshotsByPrincipal = new Map<\n    string,\n    PrincipalPolicySnapshotResponse\n  >();\n  for (const snapshot of input.snapshots) {\n    const key = identityKey(snapshot.currentState);\n    if (snapshotsByPrincipal.has(key)) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Principal policy snapshots contain a duplicate principal\",\n      );\n    }\n    snapshotsByPrincipal.set(key, snapshot);\n  }\n  const verifiedByPrincipal = new Map<\n    string,\n    VerifiedPrincipalPolicySnapshot\n  >();\n  const visiting = new Set<string>();\n\n  const verifyOne = async (\n    snapshot: PrincipalPolicySnapshotResponse,\n  ): Promise<VerifiedPrincipalPolicySnapshot> => {\n    const key = identityKey(snapshot.currentState);\n    const cached = verifiedByPrincipal.get(key);\n    if (cached) {\n      return cached;\n    }\n    if (visiting.has(key)) {\n      throw new KeyingVerificationError(\n        \"invalid_shape\",\n        \"Principal policy snapshot authority contains a cycle\",\n      );\n    }\n    visiting.add(key);\n    try {\n      const publicKeys = await signerPublicKeys({\n        resolveUserKey: input.resolveUserKey,\n        snapshot,\n      });\n      const policy = await verifySnapshotAuthorization({\n        resolveAuthority: async (reference) => {\n          const authoritySnapshot = snapshotsByPrincipal.get(\n            identityKey(reference),\n          );\n          if (!authoritySnapshot) {\n            throw new KeyingVerificationError(\n              \"missing_dependency\",\n              \"Principal policy snapshot authority is missing\",\n            );\n          }\n          return verifyOne(authoritySnapshot);\n        },\n        signerPublicKeys: publicKeys,\n        snapshot,\n      });\n      verifiedByPrincipal.set(key, policy);\n      return policy;\n    } finally {\n      visiting.delete(key);\n    }\n  };\n\n  for (const snapshot of input.snapshots) {\n    await verifyOne(snapshot);\n  }\n  return [...verifiedByPrincipal.values()];\n}\n\nexport async function enforcePrincipalPolicySnapshotCheckpoints(input: {\n  readonly execSql: ExecSql;\n  readonly policies: readonly VerifiedPrincipalPolicySnapshot[];\n}): Promise<VerifiedPrincipalPolicySnapshot[]> {\n  const policiesToPin: VerifiedPrincipalPolicySnapshot[] = [];\n  for (const policy of input.policies) {\n    const shouldPin = await enforceSnapshotCheckpoint({\n      execSql: input.execSql,\n      policy,\n      reference: {\n        principalType: policy.state.principalType,\n        principalId: policy.state.principalId,\n        version: policy.state.version,\n        keyEpoch: policy.state.keyEpoch,\n        stateHash: policy.state.stateHash,\n        keyFingerprint: policy.state.keyFingerprint,\n      },\n    });\n    if (shouldPin) policiesToPin.push(policy);\n  }\n  return policiesToPin;\n}\n"]}

package/data/keyingProjectionVerification/snapshotVerificationCache.js

@@ -1,39 +0,0 @@
-import { bytesToHex, createIncrementalSha256, verifyPrincipalPolicySnapshot, } from "../../internal/crypto/index.js";
-// Bind independently decoded responses to their actual bytes, reference, trusted
-// signer keys and external authority. Checkpoints remain checked by the caller.
-const verified = new Map();
-const MAX_CACHED_SOURCE_CHARACTERS = 4_000_000;
-const MAX_ENTRIES = 16;
-function freezeResult(value) {
-    for (const child of Object.values(value)) {
-        if (typeof child === "object" && child !== null && !Object.isFrozen(child))
-            freezeResult(child);
-    }
-    Object.freeze(value);
-}
-export async function verifyReceivedPolicySnapshot(input) {
-    const source = JSON.stringify(input);
-    if (source.length > MAX_CACHED_SOURCE_CHARACTERS)
-        return verifyPrincipalPolicySnapshot(input);
-    const hash = createIncrementalSha256();
-    hash.update(new TextEncoder().encode(source));
-    const key = bytesToHex(hash.digest());
-    const cached = verified.get(key);
-    if (cached) {
-        verified.delete(key);
-        verified.set(key, cached);
-        return cached;
-    }
-    const result = await verifyPrincipalPolicySnapshot(structuredClone(input));
-    if (result.ok) {
-        freezeResult(result);
-        verified.set(key, result);
-        while (verified.size > MAX_ENTRIES) {
-            const oldest = verified.keys().next().value;
-            if (oldest !== undefined)
-                verified.delete(oldest);
-        }
-    }
-    return result;
-}
-//# sourceMappingURL=snapshotVerificationCache.js.map

package/data/keyingProjectionVerification/snapshotVerificationCache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"snapshotVerificationCache.js","sourceRoot":"","sources":["snapshotVerificationCache.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAK3B,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;AACnD,MAAM,4BAA4B,GAAG,SAAS,CAAC;AAC/C,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,SAAS,YAAY,CAAC,KAAa;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxE,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,GAAG,4BAA4B;QAC9C,OAAO,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  bytesToHex,\n  createIncrementalSha256,\n  verifyPrincipalPolicySnapshot,\n} from \"@tearleads/crypto\";\n\ntype SnapshotInput = Parameters<typeof verifyPrincipalPolicySnapshot>[0];\ntype SnapshotResult = Awaited<ReturnType<typeof verifyPrincipalPolicySnapshot>>;\n\n// Bind independently decoded responses to their actual bytes, reference, trusted\n// signer keys and external authority. Checkpoints remain checked by the caller.\nconst verified = new Map<string, SnapshotResult>();\nconst MAX_CACHED_SOURCE_CHARACTERS = 4_000_000;\nconst MAX_ENTRIES = 16;\n\nfunction freezeResult(value: object): void {\n  for (const child of Object.values(value)) {\n    if (typeof child === \"object\" && child !== null && !Object.isFrozen(child))\n      freezeResult(child);\n  }\n  Object.freeze(value);\n}\n\nexport async function verifyReceivedPolicySnapshot(\n  input: SnapshotInput,\n): Promise<SnapshotResult> {\n  const source = JSON.stringify(input);\n  if (source.length > MAX_CACHED_SOURCE_CHARACTERS)\n    return verifyPrincipalPolicySnapshot(input);\n  const hash = createIncrementalSha256();\n  hash.update(new TextEncoder().encode(source));\n  const key = bytesToHex(hash.digest());\n  const cached = verified.get(key);\n  if (cached) {\n    verified.delete(key);\n    verified.set(key, cached);\n    return cached;\n  }\n  const result = await verifyPrincipalPolicySnapshot(structuredClone(input));\n  if (result.ok) {\n    freezeResult(result);\n    verified.set(key, result);\n    while (verified.size > MAX_ENTRIES) {\n      const oldest = verified.keys().next().value;\n      if (oldest !== undefined) verified.delete(oldest);\n    }\n  }\n  return result;\n}\n"]}

package/workflows/containers/child/policyRepair.js

@@ -1,23 +0,0 @@
-import { cachePrincipalPolicyBundles } from "../../principals/policyCache.js";
-export async function cacheRemoteContainerCreatePolicyRepair(input) {
-    const bundles = input.failure.stalePrincipalPolicies;
-    if (!input.execSql ||
-        !bundles ||
-        bundles.length === 0 ||
-        input.stillCurrent?.() === false) {
-        return false;
-    }
-    // The server supplied fresh signed policy bundles with the 409. Verify and
-    // cache them locally before rebuilding the signed create request.
-    await cachePrincipalPolicyBundles({
-        bundles,
-        execSql: input.execSql,
-        getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(input.apiClient),
-        organizationId: input.organizationId,
-        reportSecurityIncident: input.reportSecurityIncident,
-        resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,
-        stillCurrent: input.stillCurrent,
-    });
-    return input.stillCurrent?.() !== false;
-}
-//# sourceMappingURL=policyRepair.js.map

package/workflows/containers/child/policyRepair.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policyRepair.js","sourceRoot":"","sources":["policyRepair.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAQ5D;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACrD,IACE,CAAC,KAAK,CAAC,OAAO;QACd,CAAC,OAAO;QACR,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,2BAA2B,CAAC;QAChC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CACvE,KAAK,CAAC,SAAS,CAChB;QACD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC1C,CAAC","sourcesContent":["import type {\n  ContainerCreateApi,\n  ContainerMutationSubmitFailure,\n} from \"../../../data/containers/shared/types\";\nimport type { SecurityIncidentReporter } from \"../../../data/securityIncidents\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { TrustedUserIdentityResolver } from \"../../../data/trustedUserIdentity\";\nimport { cachePrincipalPolicyBundles } from \"../../principals/policyCache\";\n\nexport async function cacheRemoteContainerCreatePolicyRepair(input: {\n  readonly apiClient: ContainerCreateApi;\n  readonly execSql: ExecSql | undefined;\n  readonly failure: ContainerMutationSubmitFailure;\n  readonly organizationId: string;\n  readonly reportSecurityIncident: SecurityIncidentReporter;\n  readonly resolveTrustedUserIdentity: TrustedUserIdentityResolver;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  const bundles = input.failure.stalePrincipalPolicies;\n  if (\n    !input.execSql ||\n    !bundles ||\n    bundles.length === 0 ||\n    input.stillCurrent?.() === false\n  ) {\n    return false;\n  }\n\n  // The server supplied fresh signed policy bundles with the 409. Verify and\n  // cache them locally before rebuilding the signed create request.\n  await cachePrincipalPolicyBundles({\n    bundles,\n    execSql: input.execSql,\n    getCurrentPrincipalPolicy: input.apiClient.getCurrentPrincipalPolicy.bind(\n      input.apiClient,\n    ),\n    organizationId: input.organizationId,\n    reportSecurityIncident: input.reportSecurityIncident,\n    resolveTrustedUserIdentity: input.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n  });\n  return input.stillCurrent?.() !== false;\n}\n"]}