cojson 0.13.5 → 0.13.10

package/src/coValues/group.ts

@@ -258,29 +258,38 @@ export class RawGroup<
     role: Role,
   ) {
     if (account === EVERYONE) {
-      if (!(role === "reader" || role === "writer")) {
+      if (!(role === "reader" || role === "writer" || role === "writeOnly")) {
         throw new Error(
-          "Can't make everyone something other than reader or writer",
+          "Can't make everyone something other than reader, writer or writeOnly",
         );
       }
-
       const currentReadKey = this.core.getCurrentReadKey();
 
       if (!currentReadKey.secret) {
         throw new Error("Can't add member without read key secret");
       }
 
+      const previousRole = this.get(account);
+
       this.set(account, role, "trusting");
 
       if (this.get(account) !== role) {
         throw new Error("Failed to set role");
       }
 
-      this.set(
-        `${currentReadKey.id}_for_${EVERYONE}`,
-        currentReadKey.secret,
-        "trusting",
-      );
+      if (role === "writeOnly") {
+        if (previousRole === "reader" || previousRole === "writer") {
+          this.rotateReadKey();
+        }
+
+        this.delete(`${currentReadKey.id}_for_${EVERYONE}`);
+      } else {
+        this.set(
+          `${currentReadKey.id}_for_${EVERYONE}`,
+          currentReadKey.secret,
+          "trusting",
+        );
+      }
 
       return;
     }
@@ -299,44 +308,18 @@ export class RawGroup<
      * invite.
      */
     if (role === "writeOnly" || role === "writeOnlyInvite") {
-      const writeKeyForNewMember = this.core.crypto.newRandomKeySecret();
+      const previousRole = this.get(memberKey);
 
-      this.set(memberKey, role, "trusting");
-      this.set(`writeKeyFor_${memberKey}`, writeKeyForNewMember.id, "trusting");
-
-      this.storeKeyRevelationForMember(
-        memberKey,
-        agent,
-        writeKeyForNewMember.id,
-        writeKeyForNewMember.secret,
-      );
-
-      for (const otherMemberKey of this.getMemberKeys()) {
-        const memberRole = this.get(otherMemberKey);
-
-        if (
-          memberRole === "reader" ||
-          memberRole === "writer" ||
-          memberRole === "admin" ||
-          memberRole === "readerInvite" ||
-          memberRole === "writerInvite" ||
-          memberRole === "adminInvite"
-        ) {
-          const otherMemberAgent = this.core.node
-            .resolveAccountAgent(
-              otherMemberKey,
-              "Expected member agent to be loaded",
-            )
-            ._unsafeUnwrap({ withStackTrace: true });
-
-          this.storeKeyRevelationForMember(
-            otherMemberKey,
-            otherMemberAgent,
-            writeKeyForNewMember.id,
-            writeKeyForNewMember.secret,
-          );
-        }
+      if (
+        previousRole === "reader" ||
+        previousRole === "writer" ||
+        previousRole === "admin"
+      ) {
+        this.rotateReadKey();
       }
+
+      this.set(memberKey, role, "trusting");
+      this.internalCreateWriteOnlyKeyForMember(memberKey, agent);
     } else {
       const currentReadKey = this.core.getCurrentReadKey();
 
@@ -370,6 +353,49 @@ export class RawGroup<
     }
   }
 
+  internalCreateWriteOnlyKeyForMember(
+    memberKey: RawAccountID | AgentID,
+    agent: AgentID,
+  ) {
+    const writeKeyForNewMember = this.core.crypto.newRandomKeySecret();
+
+    this.set(`writeKeyFor_${memberKey}`, writeKeyForNewMember.id, "trusting");
+
+    this.storeKeyRevelationForMember(
+      memberKey,
+      agent,
+      writeKeyForNewMember.id,
+      writeKeyForNewMember.secret,
+    );
+
+    for (const otherMemberKey of this.getMemberKeys()) {
+      const memberRole = this.get(otherMemberKey);
+
+      if (
+        memberRole === "reader" ||
+        memberRole === "writer" ||
+        memberRole === "admin" ||
+        memberRole === "readerInvite" ||
+        memberRole === "writerInvite" ||
+        memberRole === "adminInvite"
+      ) {
+        const otherMemberAgent = this.core.node
+          .resolveAccountAgent(
+            otherMemberKey,
+            "Expected member agent to be loaded",
+          )
+          ._unsafeUnwrap({ withStackTrace: true });
+
+        this.storeKeyRevelationForMember(
+          otherMemberKey,
+          otherMemberAgent,
+          writeKeyForNewMember.id,
+          writeKeyForNewMember.secret,
+        );
+      }
+    }
+  }
+
   private storeKeyRevelationForMember(
     memberKey: RawAccountID | AgentID,
     agent: AgentID,
@@ -409,7 +435,19 @@ export class RawGroup<
     if (this.myRole() === "writeOnly") {
       const accountId = this.core.node.account.id;
 
-      return this.get(`writeKeyFor_${accountId}`) as KeyID;
+      const key = this.get(`writeKeyFor_${accountId}`) as KeyID;
+
+      // When everyone is writeOnly, we need to create a writeOnly key for the current account if missing
+      if (!key && this.get("everyone") === "writeOnly") {
+        this.internalCreateWriteOnlyKeyForMember(
+          accountId,
+          this.core.node.account.currentAgentID(),
+        );
+
+        return this.get(`writeKeyFor_${accountId}`) as KeyID;
+      }
+
+      return key;
     }
 
     return this.get("readKey");

package/src/permissions.ts

@@ -225,6 +225,7 @@ function determineValidTransactionsForGroup(
   });
 
   const memberState: MemberState = {};
+  const writeOnlyKeys: Record<RawAccountID | AgentID, KeyID> = {};
   const validTransactions: ValidTransactionsResult[] = [];
 
   const keyRevelations = new Set<string>();
@@ -302,7 +303,8 @@ function determineValidTransactionsForGroup(
         memberState[transactor] !== "adminInvite" &&
         memberState[transactor] !== "writerInvite" &&
         memberState[transactor] !== "readerInvite" &&
-        memberState[transactor] !== "writeOnlyInvite"
+        memberState[transactor] !== "writeOnlyInvite" &&
+        !isOwnWriteKeyRevelation(change.key, transactor, writeOnlyKeys)
       ) {
         logPermissionError("Only admins can reveal keys");
         continue;
@@ -370,14 +372,19 @@ function determineValidTransactionsForGroup(
       validTransactions.push({ txID: { sessionID, txIndex }, tx });
       continue;
     } else if (isWriteKeyForMember(change.key)) {
+      const memberKey = getAccountOrAgentFromWriteKeyForMember(change.key);
+
       if (
         memberState[transactor] !== "admin" &&
-        memberState[transactor] !== "writeOnlyInvite"
+        memberState[transactor] !== "writeOnlyInvite" &&
+        memberKey !== transactor
       ) {
         logPermissionError("Only admins can set writeKeys");
         continue;
       }
 
+      writeOnlyKeys[memberKey] = change.value as KeyID;
+
       /**
        * writeOnlyInvite need to be able to set writeKeys because every new writeOnly
        * member comes with their own write key.
@@ -422,11 +429,12 @@ function determineValidTransactionsForGroup(
       !(
         change.value === "reader" ||
         change.value === "writer" ||
+        change.value === "writeOnly" ||
         change.value === "revoked"
       )
     ) {
       logPermissionError(
-        "Everyone can only be set to reader, writer or revoked",
+        "Everyone can only be set to reader, writer, writeOnly or revoked",
       );
       continue;
     }
@@ -499,6 +507,12 @@ export function isWriteKeyForMember(
   return co.startsWith("writeKeyFor_");
 }
 
+export function getAccountOrAgentFromWriteKeyForMember(
+  co: `writeKeyFor_${RawAccountID | AgentID}`,
+): RawAccountID | AgentID {
+  return co.slice("writeKeyFor_".length) as RawAccountID | AgentID;
+}
+
 export function isKeyForKeyField(co: string): co is `${KeyID}_for_${KeyID}` {
   return co.startsWith("key_") && co.includes("_for_key");
 }
@@ -520,3 +534,17 @@ function isParentExtension(key: string): key is `parent_${CoID<RawGroup>}` {
 function isChildExtension(key: string): key is `child_${CoID<RawGroup>}` {
   return key.startsWith("child_");
 }
+
+function isOwnWriteKeyRevelation(
+  key: `${KeyID}_for_${string}`,
+  memberKey: RawAccountID | AgentID,
+  writeOnlyKeys: Record<RawAccountID | AgentID, KeyID>,
+): key is `${KeyID}_for_${RawAccountID | AgentID}` {
+  if (Object.keys(writeOnlyKeys).length === 0) {
+    return false;
+  }
+
+  const keyID = key.slice(0, key.indexOf("_for_"));
+
+  return writeOnlyKeys[memberKey] === keyID;
+}