cojson 0.18.36 → 0.18.38

package/src/permissions.ts

@@ -8,6 +8,7 @@ import {
   ParentGroupReferenceRole,
   RawGroup,
   isInheritableRole,
+  isSelfExtension,
 } from "./coValues/group.js";
 import { KeyID } from "./crypto/crypto.js";
 import {
@@ -17,7 +18,6 @@ import {
   getParentGroupId,
 } from "./ids.js";
 import { JsonValue } from "./jsonValue.js";
-import { logger } from "./logger.js";
 import { expectGroup } from "./typeUtils/expectGroup.js";
 
 export type PermissionsDef =
@@ -70,25 +70,6 @@ function canAdmin(role: Role | undefined): boolean {
   return role === "admin" || role === "manager";
 }
 
-type MemberState = { [agent: RawAccountID | AgentID]: Role; [EVERYONE]?: Role };
-
-let logPermissionErrors = true;
-
-export function disablePermissionErrors() {
-  logPermissionErrors = false;
-}
-
-function logPermissionError(
-  message: string,
-  attributes?: Record<string, JsonValue>,
-) {
-  if (logPermissionErrors === false) {
-    return;
-  }
-
-  logger.debug("Permission error: " + message, attributes);
-}
-
 export function determineValidTransactions(coValue: CoValueCore): void {
   if (!coValue.isAvailable()) {
     throw new Error("determineValidTransactions CoValue is not available");
@@ -130,7 +111,10 @@ export function determineValidTransactions(coValue: CoValueCore): void {
       );
 
       if (!effectiveTransactor) {
-        tx.markInvalid();
+        tx.markInvalid("Transactor not found in group", {
+          transactor: tx.author,
+          group: groupAtTime.toJSON(),
+        });
         continue;
       }
 
@@ -158,7 +142,10 @@ export function determineValidTransactions(coValue: CoValueCore): void {
         transactorRoleAtTxTime !== "writer" &&
         transactorRoleAtTxTime !== "writeOnly"
       ) {
-        tx.markInvalid();
+        tx.markInvalid("Transactor has no write permissions", {
+          transactor: tx.author,
+          transactorRole: transactorRoleAtTxTime ?? "undefined",
+        });
         continue;
       }
 
@@ -193,77 +180,78 @@ function isHigherRole(a: Role, b: Role | undefined) {
   return a === "writer" && b === "reader";
 }
 
-function resolveMemberStateFromParentReference(
-  coValue: CoValueCore,
-  memberState: MemberState,
-  parentReference: ParentGroupReference,
-  roleMapping: ParentGroupReferenceRole,
-  extendChain: Set<CoValueCore["id"]>,
-) {
-  const parentGroup = coValue.node.expectCoValueLoaded(
-    getParentGroupId(parentReference),
-    "Expected parent group to be loaded",
-  );
+class MemberRoleResolver {
+  private parentGroups = new Map<RawGroup, ParentGroupReferenceRole>();
+  private memberRoles = new Map<RawAccountID | AgentID | Everyone, Role>();
 
-  if (parentGroup.verified.header.ruleset.type !== "group") {
-    return;
+  setDirectRole(member: RawAccountID | AgentID | Everyone, role: Role) {
+    this.memberRoles.set(member, role);
   }
 
-  // Skip circular references
-  if (extendChain.has(parentGroup.id)) {
-    return;
+  removeMember(member: RawAccountID | AgentID | Everyone) {
+    this.memberRoles.delete(member);
   }
 
-  const initialAdmin = parentGroup.verified.header.ruleset.initialAdmin;
+  addParentGroup(parentGroup: RawGroup, roleMapping: ParentGroupReferenceRole) {
+    this.parentGroups.set(parentGroup, roleMapping);
+  }
 
-  if (!initialAdmin) {
-    throw new Error("Group must have initialAdmin");
+  removeParentGroup(parentGroup: RawGroup) {
+    this.parentGroups.delete(parentGroup);
   }
 
-  extendChain.add(parentGroup.id);
+  getDirectRole(member: RawAccountID | AgentID | Everyone) {
+    return this.memberRoles.get(member);
+  }
 
-  const { memberState: parentGroupMemberState } =
-    determineValidTransactionsForGroup(parentGroup, initialAdmin, extendChain);
+  getRoleAtTime(member: RawAccountID | AgentID | Everyone, time: number) {
+    let role = this.memberRoles.get(member);
 
-  for (const agent of Object.keys(parentGroupMemberState) as Array<
-    keyof MemberState
-  >) {
-    const parentRole = parentGroupMemberState[agent];
-    const currentRole = memberState[agent];
+    for (const [parentGroup, roleMapping] of this.parentGroups.entries()) {
+      const parentRole = parentGroup.atTime(time).roleOfInternal(member);
 
-    if (isInheritableRole(parentRole)) {
-      if (roleMapping !== "extend" && isHigherRole(roleMapping, currentRole)) {
-        memberState[agent] = roleMapping;
-      } else if (isHigherRole(parentRole, currentRole)) {
-        memberState[agent] = parentRole;
+      if (!parentRole || !isInheritableRole(parentRole)) {
+        continue;
+      }
+
+      const resolvedParentRole =
+        roleMapping === "extend" ? parentRole : roleMapping;
+
+      if (isHigherRole(resolvedParentRole, role)) {
+        role = resolvedParentRole;
       }
     }
+
+    return role;
   }
 }
 
 function determineValidTransactionsForGroup(
   coValue: CoValueCore,
   initialAdmin: RawAccountID | AgentID,
-  extendChain?: Set<CoValueCore["id"]>,
-): { memberState: MemberState } {
+): void {
   coValue.verifiedTransactions.sort(coValue.compareTransactions);
 
-  const memberState: MemberState = {};
   const writeOnlyKeys: Record<RawAccountID | AgentID, KeyID> = {};
   const writeKeys = new Set<string>();
+  const memberRoleResolver = new MemberRoleResolver();
 
   for (const transaction of coValue.verifiedTransactions) {
     const transactor = transaction.author;
-    const transactorRole = memberState[transactor];
+
+    const transactorRole = memberRoleResolver.getRoleAtTime(
+      transactor,
+      transaction.currentMadeAt,
+    );
 
     const tx = transaction.tx;
 
     if (tx.privacy === "private") {
-      if (memberState[transactor] === "admin") {
+      if (transactorRole === "admin") {
         transaction.markValid();
         continue;
       } else {
-        logPermissionError(
+        transaction.markInvalid(
           "Only admins can make private transactions in groups",
         );
         continue;
@@ -285,21 +273,18 @@ function determineValidTransactionsForGroup(
       | MapOpPayload<`child_${CoID<RawGroup>}`, CoID<RawGroup>>;
 
     if (changes.length !== 1) {
-      logPermissionError("Group transaction must have exactly one change");
-      transaction.markInvalid();
+      transaction.markInvalid("Group transaction must have exactly one change");
       continue;
     }
 
     if (change.op !== "set") {
-      logPermissionError("Group transaction must set a role or readKey");
-      transaction.markInvalid();
+      transaction.markInvalid("Group transaction must set a role or readKey");
       continue;
     }
 
     if (change.key === "readKey") {
       if (!canAdmin(transactorRole)) {
-        logPermissionError("Only admins can set readKeys");
-        transaction.markInvalid();
+        transaction.markInvalid("Only admins can set readKeys");
         continue;
       }
 
@@ -307,8 +292,7 @@ function determineValidTransactionsForGroup(
       continue;
     } else if (change.key === "profile") {
       if (!canAdmin(transactorRole)) {
-        logPermissionError("Only admins can set profile");
-        transaction.markInvalid();
+        transaction.markInvalid("Only admins can set profile");
         continue;
       }
 
@@ -316,7 +300,7 @@ function determineValidTransactionsForGroup(
       continue;
     } else if (change.key === "root") {
       if (!canAdmin(transactorRole)) {
-        logPermissionError("Only admins can set root");
+        transaction.markInvalid("Only admins can set root");
         continue;
       }
 
@@ -336,47 +320,51 @@ function determineValidTransactionsForGroup(
         transactorRole !== "writeOnlyInvite" &&
         !isOwnWriteKeyRevelation(change.key, transactor, writeOnlyKeys)
       ) {
-        logPermissionError("Only admins and managers can reveal keys");
-        transaction.markInvalid();
+        transaction.markInvalid("Only admins and managers can reveal keys");
         continue;
       }
 
-      // TODO: check validity of agents who the key is revealed to?
       transaction.markValid();
       continue;
     } else if (isParentExtension(change.key)) {
       if (!canAdmin(transactorRole)) {
-        logPermissionError(
+        transaction.markInvalid(
           "Only admins and managers can set parent extensions",
         );
-        transaction.markInvalid();
         continue;
       }
 
-      extendChain = extendChain ?? new Set([]);
+      const parentGroupId = getParentGroupId(change.key);
 
-      resolveMemberStateFromParentReference(
-        coValue,
-        memberState,
-        change.key,
-        change.value as ParentGroupReferenceRole,
-        extendChain,
+      const parentGroupCore = coValue.node.expectCoValueLoaded(
+        parentGroupId,
+        "Expected parent group to be loaded",
       );
 
-      // Circular reference detected, drop all the transactions involved
-      if (extendChain.has(coValue.id)) {
-        logPermissionError(
-          "Circular extend detected, dropping the transaction",
-        );
-        transaction.markInvalid();
+      if (!parentGroupCore.isGroup()) {
+        transaction.markInvalid("Parent group is not a group");
+        continue;
+      }
+
+      const parentGroup = expectGroup(parentGroupCore.getCurrentContent());
+
+      if (isSelfExtension(coValue, parentGroup)) {
+        transaction.markInvalid("Parent group is a circular dependency");
         continue;
       }
 
+      const value = change.value as ParentGroupReferenceRole;
+
+      if (value === "revoked") {
+        memberRoleResolver.removeParentGroup(parentGroup);
+      } else {
+        memberRoleResolver.addParentGroup(parentGroup, value);
+      }
+
       transaction.markValid();
       continue;
     } else if (isChildExtension(change.key)) {
-      logPermissionError("Child extensions are not allowed anymore");
-      transaction.markInvalid();
+      transaction.markInvalid("Child extensions are not allowed anymore");
       continue;
     } else if (isWriteKeyForMember(change.key)) {
       const memberKey = getAccountOrAgentFromWriteKeyForMember(change.key);
@@ -387,8 +375,7 @@ function determineValidTransactionsForGroup(
         transactorRole !== "writeOnlyInvite" &&
         memberKey !== transactor
       ) {
-        logPermissionError("Only admins and managers can set writeKeys");
-        transaction.markInvalid();
+        transaction.markInvalid("Only admins and managers can set writeKeys");
         continue;
       }
 
@@ -403,10 +390,9 @@ function determineValidTransactionsForGroup(
        * blocking them from accessing the group.ß
        */
       if (writeKeys.has(change.key) && !canAdmin(transactorRole)) {
-        logPermissionError(
+        transaction.markInvalid(
           "Write key already exists and can't be overridden by invite",
         );
-        transaction.markInvalid();
         continue;
       }
 
@@ -432,8 +418,7 @@ function determineValidTransactionsForGroup(
       assignedRole !== "readerInvite" &&
       assignedRole !== "writeOnlyInvite"
     ) {
-      logPermissionError("Group transaction must set a valid role");
-      transaction.markInvalid();
+      transaction.markInvalid("Group transaction must set a valid role");
       continue;
     }
 
@@ -446,10 +431,9 @@ function determineValidTransactionsForGroup(
         assignedRole === "revoked"
       )
     ) {
-      logPermissionError(
+      transaction.markInvalid(
         "Everyone can only be set to reader, writer, writeOnly or revoked",
       );
-      transaction.markInvalid();
       continue;
     }
 
@@ -460,15 +444,10 @@ function determineValidTransactionsForGroup(
         throw new Error("Expected set operation");
       }
 
-      memberState[change.key] = change.value;
+      memberRoleResolver.setDirectRole(change.key, change.value);
       transaction.markValid();
     }
 
-    function markTransactionAsInvalid(message: string) {
-      logPermissionError(message);
-      transaction.markInvalid();
-    }
-
     // is first self promotion to admin
     if (
       transactorRole === undefined &&
@@ -486,7 +465,10 @@ function determineValidTransactionsForGroup(
       continue;
     }
 
-    const affectedMemberRole = memberState[affectedMember];
+    const affectedMemberRole = memberRoleResolver.getRoleAtTime(
+      affectedMember,
+      transaction.currentMadeAt,
+    );
 
     /**
      * Admins can't:
@@ -498,7 +480,7 @@ function determineValidTransactionsForGroup(
         assignedRole !== "admin" &&
         affectedMember !== transactor
       ) {
-        markTransactionAsInvalid("Admins can't demote admins.");
+        transaction.markInvalid("Admins can't demote admins.");
         continue;
       }
 
@@ -514,20 +496,20 @@ function determineValidTransactionsForGroup(
      */
     if (transactorRole === "manager") {
       if (affectedMemberRole === "admin") {
-        markTransactionAsInvalid("Managers can't demote admins.");
+        transaction.markInvalid("Managers can't demote admins.");
         continue;
       }
       if (change.value === "admin") {
-        markTransactionAsInvalid("Managers can't promote to admin.");
+        transaction.markInvalid("Managers can't promote to admin.");
         continue;
       }
 
       if (change.value === "adminInvite") {
-        markTransactionAsInvalid("Managers can't invite admins.");
+        transaction.markInvalid("Managers can't invite admins.");
         continue;
       }
       if (change.value === "managerInvite") {
-        markTransactionAsInvalid("Managers can't invite managers.");
+        transaction.markInvalid("Managers can't invite managers.");
         continue;
       }
 
@@ -537,42 +519,39 @@ function determineValidTransactionsForGroup(
 
     if (transactorRole === "adminInvite") {
       if (change.value !== "admin") {
-        logPermissionError("AdminInvites can only create admins.");
-        transaction.markInvalid();
+        transaction.markInvalid("AdminInvites can only create admins.");
         continue;
       }
     } else if (transactorRole === "managerInvite") {
       if (change.value !== "manager") {
-        markTransactionAsInvalid("managerInvite can only create managers.");
+        transaction.markInvalid("managerInvite can only create managers.");
         continue;
       }
     } else if (transactorRole === "writerInvite") {
       if (change.value !== "writer") {
-        markTransactionAsInvalid("WriterInvites can only create writers.");
+        transaction.markInvalid("WriterInvites can only create writers.");
         continue;
       }
     } else if (transactorRole === "readerInvite") {
       if (change.value !== "reader") {
-        markTransactionAsInvalid("ReaderInvites can only create reader.");
+        transaction.markInvalid("ReaderInvites can only create reader.");
         continue;
       }
     } else if (transactorRole === "writeOnlyInvite") {
       if (change.value !== "writeOnly") {
-        markTransactionAsInvalid("WriteOnlyInvites can only create writeOnly.");
+        transaction.markInvalid("WriteOnlyInvites can only create writeOnly.");
         continue;
       }
     } else {
-      markTransactionAsInvalid(
+      transaction.markInvalid(
         "Group transaction must be made by current admin, manager, or invite",
       );
       continue;
     }
 
-    memberState[affectedMember] = change.value;
+    memberRoleResolver.setDirectRole(affectedMember, change.value);
     transaction.markValid();
   }
-
-  return { memberState };
 }
 
 function agentInAccountOrMemberInGroup(

package/src/queue/LocalTransactionsSyncQueue.ts

@@ -50,33 +50,14 @@ export class LocalTransactionsSyncQueue {
     coValue: VerifiedState,
     knownStateBefore: CoValueKnownState,
   ) {
-    const content = coValue.newContentSince(knownStateBefore, {
-      skipExpectContentUntil: true, // we need to calculate the streaming header considering the current batch
-    });
+    const content = coValue.newContentSince(knownStateBefore);
 
     if (!content) {
       return;
     }
 
-    let firstChunk = this.firstChunks.get(coValue.id);
-
     for (const piece of content) {
       this.batch.push(piece);
-
-      // Check if the local content updates are in streaming, if so we need to add the info to the first chunk
-      if (firstChunk) {
-        if (!firstChunk.expectContentUntil) {
-          firstChunk.expectContentUntil =
-            knownStateFromContent(firstChunk).sessions;
-        }
-        combineKnownStateSessions(
-          firstChunk.expectContentUntil,
-          knownStateFromContent(piece).sessions,
-        );
-      } else {
-        firstChunk = piece;
-        this.firstChunks.set(coValue.id, firstChunk);
-      }
     }
   }
 

package/src/sync.ts

@@ -484,6 +484,15 @@ export class SyncManager {
           ? "import"
           : peer?.role;
 
+    // TODO: We can't handle client-to-client streaming until we
+    // handle the streaming state reset on disconnection
+    if (peer?.role === "client" && msg.expectContentUntil) {
+      msg = {
+        ...msg,
+        expectContentUntil: undefined,
+      };
+    }
+
     coValue.addDependenciesFromContentMessage(msg);
 
     // If some of the dependencies are missing, we wait for them to be available

package/src/tests/StorageApiAsync.test.ts

@@ -539,16 +539,16 @@ describe("StorageApiAsync", () => {
         }),
       ).toMatchInlineSnapshot(`
         [
-          "test -> test-storage | CONTENT Core header: false new: After: 1 New: 1 expectContentUntil: header/3",
-          "test -> test-storage | CONTENT Core2 header: false new: After: 1 New: 1 expectContentUntil: header/3",
+          "test -> test-storage | CONTENT Core header: false new: After: 1 New: 1",
+          "test -> test-storage | CONTENT Core2 header: false new: After: 1 New: 1",
           "test -> test-storage | CONTENT Core header: false new: After: 2 New: 1",
           "test -> test-storage | CONTENT Core2 header: false new: After: 2 New: 1",
           "test-storage -> test | KNOWN CORRECTION Core sessions: empty",
           "test -> test-storage | CONTENT Core header: true new: After: 0 New: 3",
           "test-storage -> test | KNOWN CORRECTION Core2 sessions: empty",
           "test -> test-storage | CONTENT Core2 header: true new: After: 0 New: 3",
-          "test -> test-storage | CONTENT Core header: false new: After: 3 New: 1 expectContentUntil: header/5",
-          "test -> test-storage | CONTENT Core2 header: false new: After: 3 New: 1 expectContentUntil: header/5",
+          "test -> test-storage | CONTENT Core header: false new: After: 3 New: 1",
+          "test -> test-storage | CONTENT Core2 header: false new: After: 3 New: 1",
           "test -> test-storage | CONTENT Core header: false new: After: 4 New: 1",
           "test -> test-storage | CONTENT Core2 header: false new: After: 4 New: 1",
         ]
@@ -606,14 +606,14 @@ describe("StorageApiAsync", () => {
         }),
       ).toMatchInlineSnapshot(`
         [
-          "test -> test-storage | CONTENT Core header: false new: After: 1 New: 1 expectContentUntil: header/3",
-          "test -> test-storage | CONTENT Core2 header: false new: After: 1 New: 1 expectContentUntil: header/3",
+          "test -> test-storage | CONTENT Core header: false new: After: 1 New: 1",
+          "test -> test-storage | CONTENT Core2 header: false new: After: 1 New: 1",
           "test -> test-storage | CONTENT Core header: false new: After: 2 New: 1",
           "test -> test-storage | CONTENT Core2 header: false new: After: 2 New: 1",
           "test-storage -> test | KNOWN CORRECTION Core sessions: empty",
           "test -> test-storage | CONTENT Core header: true new: After: 0 New: 3",
-          "test -> test-storage | CONTENT Core header: false new: After: 3 New: 1 expectContentUntil: header/5",
-          "test -> test-storage | CONTENT Core2 header: false new: After: 3 New: 1 expectContentUntil: header/5",
+          "test -> test-storage | CONTENT Core header: false new: After: 3 New: 1",
+          "test -> test-storage | CONTENT Core2 header: false new: After: 3 New: 1",
           "test -> test-storage | CONTENT Core header: false new: After: 4 New: 1",
           "test -> test-storage | CONTENT Core2 header: false new: After: 4 New: 1",
         ]