@volter/world-runtime 2.0.5 → 2.0.6

package/dist/src/served-world.js

@@ -31,7 +31,7 @@ import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
-import { appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow, parentEntries, rebaseBranch, } from '@volter/world-core';
+import { appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow, parentEntries, rebaseBranch, } from '@volter/world-core';
 import { approveWorldChangeset, createWorldChangeset, diffWorld, findWorldChangeset, listWorldChangesets, pushWorldChangeset, verifyWorldChangeset, worldChangesetsDir } from "./changeset.js";
 import { fetchFromOrigin } from "./origin.js";
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart } from "./console-apart.js";
@@ -415,6 +415,9 @@ export class WorldDoors {
         for (const k of also)
             ids.add(k.id);
         this.keepKeys(this.keys().filter((k) => !ids.has(k.id)));
+        // a session a revoked key opened ends with it
+        if (Object.values(this.sessions()).some((x) => x.key !== undefined && ids.has(x.key)))
+            this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, x]) => x.key === undefined || !ids.has(x.key))));
         // the keys are gone whatever a removal answers; a branch that stays is said, not hidden (its parent key no longer opens this World)
         for (const k of [...gone, ...also])
             if (k.branch)
@@ -472,8 +475,10 @@ export class WorldDoors {
             const who = new URL(request.url).searchParams.get('person');
             if (via !== 'token' || !who)
                 return Response.json({ error: 'DELETE /keys?person=<subject>, with the World\'s token' }, { status: via !== 'token' ? 403 : 400 });
-            // their keys, the parent keys of the branches they made, and those branches
-            return Response.json({ revoked: await this.revokeKeys((k) => person(k) === who) });
+            // their keys, the parent keys of the branches they made, and those branches; and the sessions their passes opened
+            const revoked = await this.revokeKeys((k) => person(k) === who);
+            this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, s]) => s.sub !== who)));
+            return Response.json({ revoked });
         }
         if (id && request.method === 'DELETE') {
             const found = this.keys().find((k) => k.id === id);
@@ -1053,21 +1058,29 @@ export class WorldDoors {
             return Response.json({ twin: name, state, view: cut.view, position: cut.position, tree: readTree(state, controlRoot, { view: cut.view }) });
         }
         if (kind === 'changesets' && request.method === 'GET') {
+            // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
             if (name) {
                 const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name });
-                return Response.json(l.changeset);
+                return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset) });
             }
-            return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset) });
+            return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => ({ ...l.changeset, currentHash: changesetContentHash(l.changeset) })) });
         }
         if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
             const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
             return Response.json(outcome);
         }
         if (kind === 'changesets' && name && verb === 'approve' && request.method === 'POST') {
-            const body = (await request.json());
-            if (!body.as)
-                return Response.json({ error: 'approve: { as, note? }' }, { status: 400 });
-            return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal: body.as, ...(body.note ? { note: body.note } : {}) }));
+            const body = (await request.json().catch(() => ({})));
+            // a browser's session signs as whom it was opened for (a platform's pass names the person; this machine's own page
+            // is the person at it), never as whatever the page says; a token or a key names its principal, as before, and so
+            // does a session the World's write token opened (it is that token's holder, who names themselves)
+            const held = via === 'session' ? this.sessions()[this.credential(request).session ?? ''] : undefined;
+            const named = typeof body.as === 'string' && body.as.trim() ? body.as.trim().slice(0, 80) : undefined;
+            const tokenSession = held !== undefined && !held.who && held.key === undefined && held.scope === 'write';
+            const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : named;
+            if (!principal)
+                return Response.json({ error: via === 'session' && !tokenSession ? 'this session names no person to sign as: open the World from its platform, or approve with its token' : 'approve: { as, note? } — name who approves' }, { status: via === 'session' && !tokenSession ? 403 : 400 });
+            return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
         }
         if (kind === 'links' && !name && request.method === 'GET')
             return Response.json({ links: this.links() });
@@ -1361,8 +1374,10 @@ export class WorldDoors {
         const cookie = this.sessionCookie(url, held ?? this.openSession(scope, undefined, key));
         const who = held ? this.sessions()[held]?.who : undefined;
         const issuer = held ? this.sessions()[held]?.issuer : undefined;
-        // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out
-        return Response.json({ world: this.served, scope, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
+        // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out;
+        // `signsAs`: whom an approval from this session is recorded as, or null when the page must name them (a token's)
+        const signsAs = who ?? (this.host.localTrust?.() ? 'this machine' : null);
+        return Response.json({ world: this.served, scope, signsAs, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
     }
     /** THE CLOCK: the frozen instant every twin stamps from, kept in the World's store. It moves only
      *  forward once the World has entries (a twin's catch-up stamps each move at its due time, so a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -68,7 +68,7 @@
   },
   "peerDependencies": {
     "@volter/world-core": "2.0.4",
-    "@volter/world-console": "2.0.5"
+    "@volter/world-console": "2.0.6"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",

package/src/served-world.ts

@@ -32,7 +32,7 @@ import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type Tr
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import {
-  appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow,
+  appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow,
   parentEntries, rebaseBranch, type Changeset, type Entry, type Receipt, type RootConfig,
 } from '@volter/world-core';
 import { approveWorldChangeset, createWorldChangeset, diffWorld, findWorldChangeset, listWorldChangesets, pushWorldChangeset, verifyWorldChangeset, worldChangesetsDir } from './changeset.ts';
@@ -407,6 +407,8 @@ export class WorldDoors {
     const also = this.keys().filter((k) => !ids.has(k.id) && k.madeWith !== undefined && ids.has(k.madeWith)); // branches a revoked key made
     for (const k of also) ids.add(k.id);
     this.keepKeys(this.keys().filter((k) => !ids.has(k.id)));
+    // a session a revoked key opened ends with it
+    if (Object.values(this.sessions()).some((x) => x.key !== undefined && ids.has(x.key))) this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, x]) => x.key === undefined || !ids.has(x.key))));
     // the keys are gone whatever a removal answers; a branch that stays is said, not hidden (its parent key no longer opens this World)
     for (const k of [...gone, ...also]) if (k.branch) await this.host.branches?.remove(k.branch).catch((error: unknown) => { console.error(`${this.served}: branch ${k.branch} stays after its key was revoked: ${error instanceof Error ? error.message : String(error)}`); return false; });
     return [...ids];
@@ -447,8 +449,10 @@ export class WorldDoors {
       // every key made by or for a person: their leaving the org ends what they hold here (the token's act)
       const who = new URL(request.url).searchParams.get('person');
       if (via !== 'token' || !who) return Response.json({ error: 'DELETE /keys?person=<subject>, with the World\'s token' }, { status: via !== 'token' ? 403 : 400 });
-      // their keys, the parent keys of the branches they made, and those branches
-      return Response.json({ revoked: await this.revokeKeys((k) => person(k) === who) });
+      // their keys, the parent keys of the branches they made, and those branches; and the sessions their passes opened
+      const revoked = await this.revokeKeys((k) => person(k) === who);
+      this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, s]) => s.sub !== who)));
+      return Response.json({ revoked });
     }
     if (id && request.method === 'DELETE') {
       const found = this.keys().find((k) => k.id === id);
@@ -931,17 +935,25 @@ export class WorldDoors {
       return Response.json({ twin: name, state, view: cut.view, position: cut.position, tree: readTree(state, controlRoot, { view: cut.view }) });
     }
     if (kind === 'changesets' && request.method === 'GET') {
-      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json(l.changeset); }
-      return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset) });
+      // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
+      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset) }); }
+      return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => ({ ...l.changeset, currentHash: changesetContentHash(l.changeset) })) });
     }
     if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
       const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
       return Response.json(outcome);
     }
     if (kind === 'changesets' && name && verb === 'approve' && request.method === 'POST') {
-      const body = (await request.json()) as { as?: string; note?: string };
-      if (!body.as) return Response.json({ error: 'approve: { as, note? }' }, { status: 400 });
-      return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal: body.as, ...(body.note ? { note: body.note } : {}) }));
+      const body = (await request.json().catch(() => ({}))) as { as?: string; note?: string };
+      // a browser's session signs as whom it was opened for (a platform's pass names the person; this machine's own page
+      // is the person at it), never as whatever the page says; a token or a key names its principal, as before, and so
+      // does a session the World's write token opened (it is that token's holder, who names themselves)
+      const held = via === 'session' ? this.sessions()[this.credential(request).session ?? ''] : undefined;
+      const named = typeof body.as === 'string' && body.as.trim() ? body.as.trim().slice(0, 80) : undefined;
+      const tokenSession = held !== undefined && !held.who && held.key === undefined && held.scope === 'write';
+      const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : named;
+      if (!principal) return Response.json({ error: via === 'session' && !tokenSession ? 'this session names no person to sign as: open the World from its platform, or approve with its token' : 'approve: { as, note? } — name who approves' }, { status: via === 'session' && !tokenSession ? 403 : 400 });
+      return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
     }
     if (kind === 'links' && !name && request.method === 'GET') return Response.json({ links: this.links() });
     if (kind === 'links' && name && request.method === 'PUT') {
@@ -1165,8 +1177,10 @@ export class WorldDoors {
     if (request.method === 'DELETE') { this.endSession(held); return Response.json({ world: this.served, ended: true }, { headers: { 'set-cookie': this.sessionCookie(url, '', '; Max-Age=0')! } }); }
     const cookie = this.sessionCookie(url, held ?? this.openSession(scope, undefined, key))!;
     const who = held ? this.sessions()[held]?.who : undefined; const issuer = held ? this.sessions()[held]?.issuer : undefined;
-    // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out
-    return Response.json({ world: this.served, scope, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
+    // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out;
+    // `signsAs`: whom an approval from this session is recorded as, or null when the page must name them (a token's)
+    const signsAs = who ?? (this.host.localTrust?.() ? 'this machine' : null);
+    return Response.json({ world: this.served, scope, signsAs, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
   }
 
   /** THE CLOCK: the frozen instant every twin stamps from, kept in the World's store. It moves only