cursedbelt-server 2.1.0 → 3.0.1

package/src/server/master-lock/principals.spec.ts

@@ -112,12 +112,22 @@ describe("claim 1 — one person's unlock never opens another's", () => {
 		await enroll(OWNER, "the owner's own password");
 		const guestPassword = "a different password entirely";
 		await enroll(GUEST, guestPassword);
-		const kdf = newMasterLockKdfParams();
-		const rotated = await directory.for(OWNER).change({
-			currentVerifier: await deriveMasterLockVerifier("the owner's own password", directory.for(OWNER).kdf as MasterLockKdfParams),
-			kdf,
-			verifier: await deriveMasterLockVerifier("something new", kdf),
-		});
+		// The rotation needs the owner's OWN live unlock — an open session is not proof
+		// somebody is at the keyboard, and per person it is not even proof WHICH person.
+		const ownerKdf = directory.for(OWNER).kdf as MasterLockKdfParams;
+		const ownerVerifier = await deriveMasterLockVerifier("the owner's own password", ownerKdf);
+		directory.for(OWNER).lock();
+		const ownerOpen = await directory.for(OWNER).unlock(ownerVerifier);
+		expect(ownerOpen.ok).toBe(true);
+		const rotated = await directory.for(OWNER).change(
+			new Request("https://orch.example/", {
+				headers: { cookie: `master_lock=${ownerOpen.ok ? ownerOpen.token : ""}` },
+			}),
+			{
+				currentVerifier: ownerVerifier,
+				verifier: await deriveMasterLockVerifier("something new", ownerKdf),
+			},
+		);
 		expect(rotated.ok).toBe(true);
 		// The guest's still opens on the guest's unchanged password.
 		directory.for(GUEST).lock();
@@ -191,11 +201,17 @@ describe("claim 2 — signed in is never enough", () => {
 		expect(fresh.awaitingEnrollment).toBe(true);
 	});
 
-	test("the app-wide mode keeps its opposite default, so collections is untouched", () => {
+	test("🔴 the app-wide default now MATCHES it — there are not two answers any more", () => {
+		// This test used to assert the opposite, and the two modes disagreeing was the whole
+		// reason `enrollable` existed. The accounts model settles it in the per-person
+		// direction for every app, on the owner's ruling: *"if there is no master password
+		// then it has to get one set before a user could add anything."* Nothing is bricked,
+		// because enrollment is the way out of the state in both cases — which is exactly
+		// what made failing closed affordable here and unaffordable there.
 		const appWide = new MasterLock({ store: createMemoryMasterLockStore(null) });
 		expect(appWide.configured).toBe(false);
-		expect(appWide.unlocked).toBe(true);
-		expect(appWide.awaitingEnrollment).toBe(false);
+		expect(appWide.unlocked).toBe(false);
+		expect(appWide.awaitingEnrollment).toBe(true);
 	});
 
 	test("the guard refuses every app path for an un-enrolled principal", async () => {
@@ -246,21 +262,35 @@ describe("claim 3 — enroll only ever creates the password that was never set",
 			const key = "shared";
 			return { read: () => kvv.get(key), write: (json) => kvv.set(key, json) };
 		})();
-		const a = new MasterLock({ store, enrollable: true });
-		const b = new MasterLock({ store, enrollable: true });
+		const a = new MasterLock({ store });
+		const b = new MasterLock({ store });
 		const first = await a.enroll({ kdf: KDF, verifier: await deriveMasterLockVerifier("first", KDF) });
 		expect(first.ok).toBe(true);
 		const second = await b.enroll({ kdf: KDF, verifier: await deriveMasterLockVerifier("second", KDF) });
 		expect(second).toEqual({ ok: false, reason: "already-configured" });
 	});
 
-	test("🔴 it refuses outside per-person mode, so no app-wide lock can be armed by a POST", async () => {
+	test("🔴 an app-wide lock with no account CAN now be armed by a POST — and that is the point", async () => {
+		// The inverse of what this asserted before the accounts model. Enrollment used to be
+		// refused outside per-person mode so that mounting the wall could not silently arm a
+		// lock the owner had not chosen; the owner has since ruled that an app with no master
+		// password must take one before it serves anything, which makes this route the ONLY
+		// way out of that state. It is not a hole for the reason the engine's note gives at
+		// length: whoever reaches it already holds a live session for an account the app
+		// admits, and it refuses the moment an account exists.
 		const appWide = new MasterLock({ store: createMemoryMasterLockStore(null) });
-		const result = await appWide.enroll({
+		const first = await appWide.enroll({
 			kdf: KDF,
 			verifier: await deriveMasterLockVerifier("anything", KDF),
 		});
-		expect(result).toEqual({ ok: false, reason: "not-enrollable" });
+		expect(first.ok && first.accountId).toBe("acct-1");
+
+		// And it can only ever CREATE the password that was never set.
+		const again = await appWide.enroll({
+			kdf: KDF,
+			verifier: await deriveMasterLockVerifier("something else", KDF),
+		});
+		expect(again).toEqual({ ok: false, reason: "already-configured" });
 	});
 
 	test("a malformed submission is refused rather than stored", async () => {
@@ -373,6 +403,6 @@ describe("claim 4 — nothing a caller sends chooses whose lock they meet", () =
 		expect(key).toBe(masterLockPrincipalKey(OWNER));
 		expect(value).not.toContain(OWNER);
 		expect(value).not.toContain("the owner's own password");
-		expect(JSON.parse(value).verifierHash.startsWith("$argon2")).toBe(true);
+		expect(JSON.parse(value).accounts[0].verifierHash.startsWith("$argon2")).toBe(true);
 	});
 });

package/src/server/master-lock/principals.ts

@@ -38,6 +38,12 @@
  * an env var that pre-set someone's password would be exactly the "one credential opens
  * everybody" shape this replaces. A principal with no record is `awaitingEnrollment` —
  * locked, and offered the choose-a-password form.
+ *
+ * 🔴 That last sentence used to need an `enrollable: true` flag, and does not any more.
+ * Failing closed with an enrollment form is now what EVERY lock does when it holds no
+ * account (see `masterLock.ts`'s `unlocked`), so the flag that used to separate the two
+ * modes has nothing left to decide. What still makes this file per-PERSON is the key each
+ * record is stored under, which is the only thing it ever really was.
  */
 import { createHash } from "node:crypto";
 import { MasterLock, type MasterLockStore, readRecord } from "./masterLock";
@@ -105,7 +111,6 @@ export class MasterLockDirectory {
 		};
 		const lock = new MasterLock({
 			store,
-			enrollable: true,
 			...(this.options.now ? { now: this.options.now } : {}),
 			...(this.options.log
 				? { log: (line: string) => this.options.log?.(`[${principalId}] ${line}`) }

package/src/server/master-lock/seed.spec.ts

@@ -34,7 +34,12 @@ describe("mintMasterLockSeed", () => {
 		const a = await mintMasterLockSeed("stage-password-1");
 		const b = await mintMasterLockSeed("stage-password-1");
 		expect(a.kdf.salt).not.toBe(b.kdf.salt);
-		expect(a.verifierHash).not.toBe(b.verifierHash);
+		expect(a.accounts[0]?.verifierHash).not.toBe(b.accounts[0]?.verifierHash);
+		// 🔴 Both mints name the SAME account id, and that is deliberate rather than an
+		// oversight: a seed is what an app boots with before anyone has typed anything, so
+		// the tenant it names has to be the tenant whose rows the app already holds.
+		expect(a.accounts[0]?.id).toBe("acct-1");
+		expect(b.accounts[0]?.id).toBe("acct-1");
 	});
 
 	it("refuses a password short enough to make the lock decorative", async () => {
@@ -50,7 +55,7 @@ describe("serializeMasterLockSeed", () => {
 		const env = serializeMasterLockSeed(record);
 		expect(env.startsWith("'")).toBe(true);
 		expect(env.endsWith("'")).toBe(true);
-		expect(readRecord(env)?.verifierHash).toBe(record.verifierHash);
+		expect(readRecord(env)?.accounts[0]?.verifierHash).toBe(record.accounts[0]?.verifierHash);
 	});
 });
 

package/src/server/master-lock/seed.ts

@@ -28,7 +28,7 @@ import {
 	deriveMasterLockVerifier,
 	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock/kdf";
-import type { MasterLockRecord } from "./masterLock";
+import { FIRST_ACCOUNT_ID, type MasterLockRecord } from "./masterLock";
 
 /**
  * The idle window a freshly minted lock starts with.
@@ -48,6 +48,10 @@ export interface MintMasterLockSeedOptions {
 	idleMs?: number;
 	/** Reuse existing params instead of generating a salt — for a rotation. */
 	kdf?: MasterLockKdfParams;
+	/** What to call the tenant this seed creates. Defaults to `Account 1`. */
+	label?: string;
+	/** The owner's reminder for this password, shown on the lock page's "I forgot". */
+	hint?: string;
 }
 
 /**
@@ -69,8 +73,24 @@ export async function mintMasterLockSeed(
 	const verifier = await deriveMasterLockVerifier(password, kdf);
 	return {
 		kdf,
-		verifierHash: await Bun.password.hash(verifier, { algorithm: "argon2id" }),
 		idleMs: options.idleMs ?? DEFAULT_SEED_IDLE_MS,
+		/*
+		 * 🔴 ONE account, and its id is `FIRST_ACCOUNT_ID` rather than anything derived
+		 * from `options`. A seed is what an app boots with before anybody has typed
+		 * anything, so the tenant it names is the tenant whose rows the app already holds —
+		 * and `readRecord` maps the legacy single-password shape onto the same id for
+		 * exactly that reason. Two different "first" ids would give a seeded app and a
+		 * migrated app different answers to "whose library is this".
+		 */
+		accounts: [
+			{
+				id: FIRST_ACCOUNT_ID,
+				label: options.label ?? "Account 1",
+				hint: options.hint ?? "",
+				verifierHash: await Bun.password.hash(verifier, { algorithm: "argon2id" }),
+				createdAt: 0,
+			},
+		],
 	};
 }