@volter/world-runtime 2.0.33 → 2.0.34

package/dist/src/served-world.js

@@ -1189,6 +1189,15 @@ export class WorldDoors {
         }
         if (kind === 'links' && !name && request.method === 'GET')
             return Response.json({ links: this.links() });
+        // OPENING A SEAL — pointing this World at a vendor (a link, a twin's root) or sealing the credential it uses there — is
+        // the World token's act, or a person's at its page: never a key's, which an app or a script holds (an app that could
+        // open its own seal would be unsealed by itself, not deliberately)
+        const opensSeal = (kind === 'links' && name && (request.method === 'PUT' || request.method === 'DELETE'))
+            || (kind === 'twins' && name && (verb === 'root' || verb === 'credential') && request.method === 'PUT')
+            // a check runs in a local World's own process, with all it can reach: putting or removing one is the same act
+            || (kind === 'checks' && name && (request.method === 'PUT' || request.method === 'DELETE'));
+        if (opensSeal && via === 'key')
+            return Response.json({ error: 'opening a seal is the World\'s token\'s act, or a person\'s at its page: a key cannot point this World at a vendor, seal a credential, or change its checks' }, { status: 403 });
         if (kind === 'links' && name && request.method === 'PUT') {
             if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(name) || this.up().services[name])
                 return Response.json({ error: 'a link is named [a-z0-9_-] and is not a twin of this World' }, { status: 400 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.33",
+  "version": "2.0.34",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",

package/src/served-world.ts

@@ -1037,6 +1037,14 @@ export class WorldDoors {
       return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
     }
     if (kind === 'links' && !name && request.method === 'GET') return Response.json({ links: this.links() });
+    // OPENING A SEAL — pointing this World at a vendor (a link, a twin's root) or sealing the credential it uses there — is
+    // the World token's act, or a person's at its page: never a key's, which an app or a script holds (an app that could
+    // open its own seal would be unsealed by itself, not deliberately)
+    const opensSeal = (kind === 'links' && name && (request.method === 'PUT' || request.method === 'DELETE'))
+      || (kind === 'twins' && name && (verb === 'root' || verb === 'credential') && request.method === 'PUT')
+      // a check runs in a local World's own process, with all it can reach: putting or removing one is the same act
+      || (kind === 'checks' && name && (request.method === 'PUT' || request.method === 'DELETE'));
+    if (opensSeal && via === 'key') return Response.json({ error: 'opening a seal is the World\'s token\'s act, or a person\'s at its page: a key cannot point this World at a vendor, seal a credential, or change its checks' }, { status: 403 });
     if (kind === 'links' && name && request.method === 'PUT') {
       if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(name) || this.up().services[name]) return Response.json({ error: 'a link is named [a-z0-9_-] and is not a twin of this World' }, { status: 400 });
       const body = (await request.json()) as { origin?: string };