mindoodb 0.0.51 → 0.0.54

package/dist/node/server/TenantManager.d.ts

@@ -19,13 +19,14 @@
 import { NodeCryptoAdapter } from "../crypto/NodeCryptoAdapter";
 import { AuthenticationService } from "../../core/appendonlystores/network/AuthenticationService";
 import { ServerNetworkContentAddressedStore } from "../../appendonlystores/network/ServerNetworkContentAddressedStore";
+import type { ServerPeerTokenResolver, ServerTrustedWitnessResolver } from "../../appendonlystores/network/ServerNetworkContentAddressedStore";
 import type { WitnessSigner } from "../../core/crypto/WitnessReceipt";
 import type { TimestampProvider } from "../../core/accesscontrol/timestamp/TimestampProvider";
 import type { MindooTenant, MindooTenantDirectory, ContentAddressedStore, DirectoryUserLookup } from "../../core/types";
 import { StoreKind } from "../../core/types";
 import type { PrivateUserId } from "../../core/userid";
 import { StoreFactory } from "./StoreFactory";
-import type { TenantConfig, TenantContext, RegisterTenantRequest, TrustedServer, NamedRemoteServerConfig } from "./types";
+import type { TenantConfig, TenantContext, RegisterTenantRequest, TrustedServer } from "./types";
 interface LoadedTenant {
     context: TenantContext;
     storeFactory: StoreFactory;
@@ -55,6 +56,7 @@ export declare class SimpleMindooDirectory implements Pick<MindooTenantDirectory
         encryptionPublicKey: string;
     } | null>;
     getUserBySigningPublicKey(publicKey: string): Promise<DirectoryUserLookup | null>;
+    private toLookup;
     isUserRevoked(username: string): Promise<boolean>;
     validatePublicSigningKey(publicKey: string, _opts?: {
         forceRefresh?: boolean;
@@ -79,6 +81,10 @@ export declare class TenantManager {
     private trustedServers;
     /** Lazily-built, cached witness signer (server's Ed25519 signing identity). */
     private witnessSigner;
+    /** Lazily-imported RSA private key for peer replication (see getServerEncryptionPrivateKey). */
+    private serverEncryptionPrivateKey;
+    /** Peer wiring handed down to every server store; see setPeerAccessControl. */
+    private peerAccessControl;
     /** Per-tenant persistent registry of executed purges (docs/accesscontrol.md §13). */
     private purgedDocRegistries;
     /** In-flight purge executions, keyed by normalized tenant id (serializes runs). */
@@ -86,6 +92,44 @@ export declare class TenantManager {
     constructor(dataDir: string, serverPassword?: string);
     getServerIdentity(): PrivateUserId | null;
     getServerPublicInfo(): TrustedServer | null;
+    getDataDir(): string;
+    /**
+     * Teach every server store how to recognise a trusted peer.
+     *
+     * `MindooDBServer` calls this once at startup. Two hooks, both required for
+     * peer replication to be correct:
+     *
+     * - `peerTokenResolver` lets a peer's cluster-level JWT through the tenant
+     *   sync routes. A peer holds no per-tenant grant, so without it the mirror
+     *   would need a second replication protocol; with it the peer reuses the
+     *   client one and the store skips the per-user gates that do not apply to a
+     *   full replica.
+     * - `trustedWitnessResolver` decides whose witness receipts may be preserved
+     *   instead of re-stamped (convergence invariant 3). Without it a replicated
+     *   entry would get a fresh `receivedAt` on every hop and "trusted time"
+     *   would mean "time it reached the last server".
+     *
+     * Must be called before the first {@link getServerStore}, since stores are
+     * cached per tenant and database.
+     */
+    setPeerAccessControl(options: {
+        peerTokenResolver?: ServerPeerTokenResolver;
+        trustedWitnessResolver?: ServerTrustedWitnessResolver;
+    }): void;
+    /**
+     * Database ids this server holds for a tenant, read from
+     * `{dataDir}/{tenantId}/stores`. Used by peer replication to mirror every
+     * database rather than a configured subset.
+     */
+    listDatabases(tenantId: string): string[];
+    /**
+     * The server's own RSA private key, imported for decryption.
+     *
+     * Peer replication needs it because the remote wraps transported entries to
+     * this server's `encryptionPublicKey` (the one in its `trusted-servers.json`),
+     * exactly as it would wrap them for a client.
+     */
+    getServerEncryptionPrivateKey(): Promise<CryptoKey | undefined>;
     /**
      * Build (and cache) the server's witness identity used to stamp receipts on
      * accepted entries (docs/accesscontrol.md §5.3). Returns undefined when the
@@ -102,6 +146,15 @@ export declare class TenantManager {
     getTimestampProvider(): Promise<TimestampProvider | undefined>;
     listTrustedServers(): TrustedServer[];
     addTrustedServer(server: TrustedServer): void;
+    /**
+     * Add or replace a trusted server by name.
+     *
+     * Peer CRUD needs an upsert: `addTrustedServer` throws on an existing name,
+     * which is right for `add-to-network` (a silent overwrite of a peer's keys
+     * would be a trust change disguised as a config edit) but wrong for the admin
+     * API, where changing a peer's url or role is the common case.
+     */
+    saveTrustedServer(server: TrustedServer): void;
     removeTrustedServer(name: string): boolean;
     private persistTrustedServers;
     private getServerKeyBagPath;
@@ -117,20 +170,38 @@ export declare class TenantManager {
     private resolveIncomingPublicInfosKey;
     private getStoredPublicInfosKeys;
     private persistTenantPublicInfosKey;
+    /**
+     * All stored `$publicinfos` AES key versions for a tenant from `server.keybag`.
+     * Empty when the tenant was never published or the server keybag is locked.
+     */
+    getPublicInfosKeysForTenant(tenantId: string): Promise<Uint8Array[]>;
     listTenantPublicInfosFingerprints(tenantId: string): Promise<string[]>;
     registerTenant(request: RegisterTenantRequest): Promise<RegisterTenantResult>;
     getTenant(tenantId: string): Promise<LoadedTenant>;
     tenantExists(tenantId: string): boolean;
+    /**
+     * Read the tenant's registered admin signing key without fully loading the
+     * tenant. Returns `null` if the tenant is missing or the config is unreadable.
+     */
+    getTenantAdminSigningPublicKey(tenantId: string): string | null;
+    /**
+     * True when `publicsignkey` is the registered tenant-admin signing key for
+     * `tenantId` (PEM whitespace-insensitive).
+     */
+    isTenantAdminSigningKeyFor(tenantId: string, publicsignkey: string): boolean;
+    /**
+     * True when `publicsignkey` is the registered admin signing key of any
+     * tenant on this server. Used to issue a system JWT so that admin can
+     * DELETE their own tenant; other `/system/*` routes stay capability-gated.
+     */
+    isRegisteredTenantAdminSigningKey(publicsignkey: string): boolean;
     listTenants(): string[];
     /**
      * Update operator-owned fields of an existing tenant configuration.
      * Only the fields present in `updates` are overwritten.
      */
-    updateTenantConfig(tenantId: string, updates: Partial<Pick<TenantConfig, "defaultStoreType" | "remoteServers">>): void;
+    updateTenantConfig(tenantId: string, updates: Partial<Pick<TenantConfig, "defaultStoreType">>): void;
     removeTenant(tenantId: string): Promise<void>;
-    getTenantSyncServers(tenantId: string): NamedRemoteServerConfig[];
-    addTenantSyncServer(tenantId: string, server: NamedRemoteServerConfig): void;
-    removeTenantSyncServer(tenantId: string, serverName: string): boolean;
     getServerStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ServerNetworkContentAddressedStore>;
     /**
      * Build a Tier 1 evaluator closure for a server store, or undefined when the
@@ -140,6 +211,16 @@ export declare class TenantManager {
      * store (metadata only, no decryption) and comparing it to the change author.
      */
     private buildTier1Evaluator;
+    /**
+     * Builtin `userdirectory` write invariant: admin may create/delete, only the
+     * owning person may change. `username_hash` is read from the decrypted
+     * `doc_create` payload (`$publicinfos`). Personal documents are sealed to
+     * their owner and therefore undecryptable here, so they are owned by whoever
+     * signed their `doc_create` — `resolveCreatorSigningKey` answers that from
+     * the entry chain alone.
+     */
+    private buildUserdirectoryWriteContext;
+    private findCreateEntry;
     /**
      * Build a database-open evaluator closure for a server store, or undefined
      * when the directory cannot evaluate the database-open policy (e.g. a

package/dist/node/server/TenantManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantManager.d.ts","sourceRoot":"","sources":["../../../src/node/server/TenantManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAC;AAGvH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sDAAsD,CAAC;AAO9F,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EAMrB,mBAAmB,EAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAuB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,qBAAqB,EAErB,aAAa,EACb,uBAAuB,EACxB,MAAM,SAAS,CAAC;AAQjB,UAAU,YAAY;IACpB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;CAC/D;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAoBD,qBAAa,qBAAsB,YAAW,IAAI,CAAC,qBAAqB,EACtE,mBAAmB,GAAG,eAAe,GAAG,0BAA0B,GAAG,2BAA2B,CACjG;IACC,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,MAAM,EAAE,YAAY;IAe1B,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,IAAI,CAAC;IAeH,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAmBjF,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjD,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,OAAO,CAAC;CAgBpB;AA0MD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,aAAa,CAAwC;IAE7D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAAuB;IAC7C,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAA4B;IACjD,qFAAqF;IACrF,OAAO,CAAC,mBAAmB,CAA6C;IACxE,mFAAmF;IACnF,OAAO,CAAC,aAAa,CAAyC;gBAElD,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM;IA+BpD,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAIzC,mBAAmB,IAAI,aAAa,GAAG,IAAI;IAS3C;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA0B5D;;;;;OAKG;IACG,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAUpE,kBAAkB,IAAI,aAAa,EAAE;IAIrC,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAY7C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAW1C,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,mBAAmB;YAIb,gBAAgB;YAahB,kBAAkB;YAalB,gBAAgB;IAK9B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;YAcT,6BAA6B;IAO3C,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,uBAAuB;YAIjB,8BAA8B;YA8B9B,6BAA6B;YAU7B,wBAAwB;YASxB,2BAA2B;IAWnC,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBtE,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmD7E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcxD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC,WAAW,IAAI,MAAM,EAAE;IAoBvB;;;OAGG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAC,GACzE,IAAI;IAoBD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBnD,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,EAAE;IAUjE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAmC5E,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IA2B/D,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kCAAkC,CAAC;IA0D9C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IASnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAczB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKpG,+DAA+D;IAC/D,OAAO,CAAC,oBAAoB;IAY5B;;;;;;;;;;;;OAYG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAW7C,4BAA4B;IAkEpC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtE,gBAAgB,IAAI,iBAAiB;IAI/B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM3D,UAAU,IAAI,IAAI;YASJ,UAAU;IAqExB;;;OAGG;YACW,qBAAqB;CAuCpC"}
+{"version":3,"file":"TenantManager.d.ts","sourceRoot":"","sources":["../../../src/node/server/TenantManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAC;AACvH,OAAO,KAAK,EAAyH,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,mEAAmE,CAAC;AAEtQ,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sDAAsD,CAAC;AAO9F,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EAMrB,mBAAmB,EAGpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAuB,SAAS,EAAwB,MAAM,kBAAkB,CAAC;AAGxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,qBAAqB,EAErB,aAAa,EACd,MAAM,SAAS,CAAC;AAMjB,UAAU,YAAY;IACpB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;CAC/D;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAoBD,qBAAa,qBAAsB,YAAW,IAAI,CAAC,qBAAqB,EACtE,mBAAmB,GAAG,eAAe,GAAG,0BAA0B,GAAG,2BAA2B,CACjG;IACC,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,MAAM,EAAE,YAAY;IAe1B,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,IAAI,CAAC;IAeH,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAevF,OAAO,CAAC,QAAQ;IAeV,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjD,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,OAAO,CAAC;CAgBpB;AAkOD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,aAAa,CAAwC;IAE7D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAAuB;IAC7C,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAA4B;IACjD,gGAAgG;IAChG,OAAO,CAAC,0BAA0B,CAAwB;IAC1D,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB,CAGlB;IACP,qFAAqF;IACrF,OAAO,CAAC,mBAAmB,CAA6C;IACxE,mFAAmF;IACnF,OAAO,CAAC,aAAa,CAAyC;gBAElD,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM;IA+BpD,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAIzC,mBAAmB,IAAI,aAAa,GAAG,IAAI;IAS3C,UAAU,IAAI,MAAM;IAIpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,CAAC,OAAO,EAAE;QAC5B,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;QAC5C,sBAAsB,CAAC,EAAE,4BAA4B,CAAC;KACvD,GAAG,IAAI;IAIR;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAezC;;;;;;OAMG;IACG,6BAA6B,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAqBrE;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA0B5D;;;;;OAKG;IACG,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAUpE,kBAAkB,IAAI,aAAa,EAAE;IAIrC,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAY7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAa9C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAW1C,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,mBAAmB;YAIb,gBAAgB;YAahB,kBAAkB;YAalB,gBAAgB;IAK9B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;YAcT,6BAA6B;IAO3C,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,uBAAuB;YAIjB,8BAA8B;YA8B9B,6BAA6B;YAU7B,wBAAwB;YASxB,2BAA2B;IAWzC;;;OAGG;IACG,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIpE,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBtE,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmD7E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcxD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;;OAGG;IACH,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAqB/D;;;OAGG;IACH,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAK5E;;;;OAIG;IACH,iCAAiC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;IASjE,WAAW,IAAI,MAAM,EAAE;IAoBvB;;;OAGG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,GACvD,IAAI;IAiBD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB7C,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kCAAkC,CAAC;IAiE9C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAqD3B;;;;;;;OAOG;IACH,OAAO,CAAC,8BAA8B;YA8BxB,eAAe;IAkB7B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IASnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAczB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKpG,+DAA+D;IAC/D,OAAO,CAAC,oBAAoB;IAY5B;;;;;;;;;;;;OAYG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAW7C,4BAA4B;IAkEpC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtE,gBAAgB,IAAI,iBAAiB;IAI/B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM3D,UAAU,IAAI,IAAI;YASJ,UAAU;IAqExB;;;OAGG;YACW,qBAAqB;CAuCpC"}

package/dist/node/server/TenantManager.js

@@ -31,9 +31,9 @@ const RSAEncryption_1 = require("../../core/crypto/RSAEncryption");
 const privateKeyEncryption_1 = require("../../core/crypto/privateKeyEncryption");
 const KeyBag_1 = require("../../core/keys/KeyBag");
 const types_1 = require("../../core/types");
+const builtinDbInvariants_1 = require("../../core/builtinDbInvariants");
+const DirectoryStateNode_1 = require("../../core/accesscontrol/DirectoryStateNode");
 const StoreFactory_1 = require("./StoreFactory");
-const types_2 = require("./types");
-const urlSafety_1 = require("../../core/utils/urlSafety");
 // ---------------------------------------------------------------------------
 // StoreFactoryAdapter
 // ---------------------------------------------------------------------------
@@ -89,10 +89,21 @@ class SimpleMindooDirectory {
         };
     }
     async getUserBySigningPublicKey(publicKey) {
-        const user = this.usersByKey.get(publicKey);
-        if (!user) {
+        const exact = this.usersByKey.get(publicKey);
+        if (exact) {
+            return this.toLookup(exact);
+        }
+        const needle = publicKey.replace(/\s+/g, "");
+        if (!needle)
             return null;
+        for (const [key, user] of this.usersByKey) {
+            if (key.replace(/\s+/g, "") === needle) {
+                return this.toLookup(user);
+            }
         }
+        return null;
+    }
+    toLookup(user) {
         if (typeof user.username === "string" &&
             this.revokedUsers.has(user.username.toLowerCase())) {
             return null;
@@ -176,7 +187,8 @@ class CompositeMindooDirectory {
         return this.inner.isUserRevoked(username);
     }
     async validatePublicSigningKey(publicKey, opts) {
-        if (this.adminBootstrapIdentity && this.adminBootstrapIdentity.signingPublicKey === publicKey) {
+        if (this.adminBootstrapIdentity &&
+            (0, DirectoryStateNode_1.signingKeysEqual)(this.adminBootstrapIdentity.signingPublicKey, publicKey)) {
             return true;
         }
         const innerResult = await this.inner.validatePublicSigningKey(publicKey, opts);
@@ -208,7 +220,8 @@ class CompositeMindooDirectory {
         // server, mirroring getUserPublicKeys. Without this, key-based identity
         // resolution (and the validateToken active-key check below) would treat the
         // admin's own key as unknown the moment the directory has no admin grant.
-        if (this.adminBootstrapIdentity && this.adminBootstrapIdentity.signingPublicKey === publicKey) {
+        if (this.adminBootstrapIdentity &&
+            (0, DirectoryStateNode_1.signingKeysEqual)(this.adminBootstrapIdentity.signingPublicKey, publicKey)) {
             return {
                 username: this.adminBootstrapIdentity.username,
                 signingPublicKey: this.adminBootstrapIdentity.signingPublicKey,
@@ -270,6 +283,19 @@ class CompositeMindooDirectory {
         // Config-based directories carry no database-open policy -> unrestricted.
         return true;
     }
+    /**
+     * Forwarded so server-side `userdirectory` writes can resolve the signer's
+     * grant. Without this, `evaluateUserdirectoryInvariant` sees a missing
+     * method, leaves `signerUsernameHash` null, and denies every non-admin
+     * change as "signer is not a granted device" — including the founder
+     * wrapping a second device of their own User-Key.
+     */
+    async resolveUsernameHashForSigningKey(signingKey, trustedTime) {
+        if (typeof this.inner.resolveUsernameHashForSigningKey === "function") {
+            return this.inner.resolveUsernameHashForSigningKey(signingKey, trustedTime);
+        }
+        return null;
+    }
 }
 // ---------------------------------------------------------------------------
 // TenantManager
@@ -289,6 +315,8 @@ class TenantManager {
         this.loadedTenants = new Map();
         this.serverIdentity = null;
         this.trustedServers = [];
+        /** Peer wiring handed down to every server store; see setPeerAccessControl. */
+        this.peerAccessControl = {};
         /** Per-tenant persistent registry of executed purges (docs/accesscontrol.md §13). */
         this.purgedDocRegistries = new Map();
         /** In-flight purge executions, keyed by normalized tenant id (serializes runs). */
@@ -331,6 +359,66 @@ class TenantManager {
             encryptionPublicKey: this.serverIdentity.userEncryptionKeyPair.publicKey,
         };
     }
+    getDataDir() {
+        return this.dataDir;
+    }
+    /**
+     * Teach every server store how to recognise a trusted peer.
+     *
+     * `MindooDBServer` calls this once at startup. Two hooks, both required for
+     * peer replication to be correct:
+     *
+     * - `peerTokenResolver` lets a peer's cluster-level JWT through the tenant
+     *   sync routes. A peer holds no per-tenant grant, so without it the mirror
+     *   would need a second replication protocol; with it the peer reuses the
+     *   client one and the store skips the per-user gates that do not apply to a
+     *   full replica.
+     * - `trustedWitnessResolver` decides whose witness receipts may be preserved
+     *   instead of re-stamped (convergence invariant 3). Without it a replicated
+     *   entry would get a fresh `receivedAt` on every hop and "trusted time"
+     *   would mean "time it reached the last server".
+     *
+     * Must be called before the first {@link getServerStore}, since stores are
+     * cached per tenant and database.
+     */
+    setPeerAccessControl(options) {
+        this.peerAccessControl = options;
+    }
+    /**
+     * Database ids this server holds for a tenant, read from
+     * `{dataDir}/{tenantId}/stores`. Used by peer replication to mirror every
+     * database rather than a configured subset.
+     */
+    listDatabases(tenantId) {
+        const storesDir = (0, path_1.join)(this.resolveTenantDir(tenantId.toLowerCase()), "stores");
+        if (!(0, fs_1.existsSync)(storesDir)) {
+            return [];
+        }
+        try {
+            return (0, fs_1.readdirSync)(storesDir).filter((entry) => (0, fs_1.statSync)((0, path_1.join)(storesDir, entry)).isDirectory());
+        }
+        catch (error) {
+            console.warn(`[TenantManager] Could not list databases for ${tenantId}:`, error);
+            return [];
+        }
+    }
+    /**
+     * The server's own RSA private key, imported for decryption.
+     *
+     * Peer replication needs it because the remote wraps transported entries to
+     * this server's `encryptionPublicKey` (the one in its `trusted-servers.json`),
+     * exactly as it would wrap them for a client.
+     */
+    async getServerEncryptionPrivateKey() {
+        if (this.serverEncryptionPrivateKey)
+            return this.serverEncryptionPrivateKey;
+        if (!this.serverIdentity || !this.serverPassword)
+            return undefined;
+        const subtle = this.cryptoAdapter.getSubtle();
+        const keyBuffer = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, this.serverIdentity.userEncryptionKeyPair.privateKey, this.serverPassword, "encryption");
+        this.serverEncryptionPrivateKey = await subtle.importKey("pkcs8", keyBuffer, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["decrypt"]);
+        return this.serverEncryptionPrivateKey;
+    }
     /**
      * Build (and cache) the server's witness identity used to stamp receipts on
      * accepted entries (docs/accesscontrol.md §5.3). Returns undefined when the
@@ -379,6 +467,25 @@ class TenantManager {
         this.persistTrustedServers();
         console.log(`[TenantManager] Added trusted server: ${server.name}`);
     }
+    /**
+     * Add or replace a trusted server by name.
+     *
+     * Peer CRUD needs an upsert: `addTrustedServer` throws on an existing name,
+     * which is right for `add-to-network` (a silent overwrite of a peer's keys
+     * would be a trust change disguised as a config edit) but wrong for the admin
+     * API, where changing a peer's url or role is the common case.
+     */
+    saveTrustedServer(server) {
+        const idx = this.trustedServers.findIndex((s) => s.name.toLowerCase() === server.name.toLowerCase());
+        if (idx === -1) {
+            this.trustedServers.push(server);
+        }
+        else {
+            this.trustedServers[idx] = server;
+        }
+        this.persistTrustedServers();
+        console.log(`[TenantManager] Saved trusted server: ${server.name}`);
+    }
     removeTrustedServer(name) {
         const idx = this.trustedServers.findIndex((s) => s.name.toLowerCase() === name.toLowerCase());
         if (idx === -1)
@@ -493,6 +600,13 @@ class TenantManager {
             await this.saveServerKeyBag(keyBag);
         }
     }
+    /**
+     * All stored `$publicinfos` AES key versions for a tenant from `server.keybag`.
+     * Empty when the tenant was never published or the server keybag is locked.
+     */
+    async getPublicInfosKeysForTenant(tenantId) {
+        return this.getStoredPublicInfosKeys(tenantId.toLowerCase());
+    }
     async listTenantPublicInfosFingerprints(tenantId) {
         const normalizedId = tenantId.toLowerCase();
         const configPath = this.resolveTenantConfigPath(normalizedId);
@@ -564,6 +678,52 @@ class TenantManager {
         const configPath = this.resolveTenantConfigPath(normalizedId);
         return (0, fs_1.existsSync)(configPath);
     }
+    /**
+     * Read the tenant's registered admin signing key without fully loading the
+     * tenant. Returns `null` if the tenant is missing or the config is unreadable.
+     */
+    getTenantAdminSigningPublicKey(tenantId) {
+        try {
+            const normalizedId = tenantId.toLowerCase();
+            const cached = this.loadedTenants.get(normalizedId);
+            if (cached?.context.config.adminSigningPublicKey) {
+                return cached.context.config.adminSigningPublicKey;
+            }
+            const configPath = this.resolveTenantConfigPath(normalizedId);
+            if (!(0, fs_1.existsSync)(configPath)) {
+                return null;
+            }
+            const config = JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
+            return typeof config.adminSigningPublicKey === "string" &&
+                config.adminSigningPublicKey.length > 0
+                ? config.adminSigningPublicKey
+                : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * True when `publicsignkey` is the registered tenant-admin signing key for
+     * `tenantId` (PEM whitespace-insensitive).
+     */
+    isTenantAdminSigningKeyFor(tenantId, publicsignkey) {
+        const adminKey = this.getTenantAdminSigningPublicKey(tenantId);
+        return adminKey !== null && (0, DirectoryStateNode_1.signingKeysEqual)(adminKey, publicsignkey);
+    }
+    /**
+     * True when `publicsignkey` is the registered admin signing key of any
+     * tenant on this server. Used to issue a system JWT so that admin can
+     * DELETE their own tenant; other `/system/*` routes stay capability-gated.
+     */
+    isRegisteredTenantAdminSigningKey(publicsignkey) {
+        for (const tenantId of this.listTenants()) {
+            if (this.isTenantAdminSigningKeyFor(tenantId, publicsignkey)) {
+                return true;
+            }
+        }
+        return false;
+    }
     listTenants() {
         if (!(0, fs_1.existsSync)(this.dataDir)) {
             return [];
@@ -593,9 +753,6 @@ class TenantManager {
         if (updates.defaultStoreType !== undefined) {
             config.defaultStoreType = updates.defaultStoreType;
         }
-        if (updates.remoteServers !== undefined) {
-            config.remoteServers = updates.remoteServers;
-        }
         (0, fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2), "utf-8");
         this.loadedTenants.delete(normalizedId);
         console.log(`[TenantManager] Updated tenant config: ${normalizedId}`);
@@ -616,65 +773,6 @@ class TenantManager {
         console.log(`[TenantManager] Removed tenant: ${normalizedId}`);
     }
     // =======================================================================
-    // Per-tenant sync server management
-    // =======================================================================
-    getTenantSyncServers(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        const configPath = this.resolveTenantConfigPath(normalizedId);
-        if (!(0, fs_1.existsSync)(configPath)) {
-            throw new Error(`Tenant ${normalizedId} not found`);
-        }
-        const config = JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
-        return (config.remoteServers || []);
-    }
-    addTenantSyncServer(tenantId, server) {
-        const normalizedId = tenantId.toLowerCase();
-        // SSRF guard (defense in depth alongside the HTTP route): a configured sync
-        // URL is fetched server-side, so reject plaintext/internal targets unless
-        // explicitly allowed for local development.
-        const allowInsecure = /^(1|true)$/i.test(process.env[types_2.ENV_VARS.ALLOW_INSECURE_SYNC_URLS] ?? "");
-        (0, urlSafety_1.assertSafeSyncUrl)(server.url, {
-            requireHttps: !allowInsecure,
-            allowPrivate: allowInsecure,
-        });
-        const configPath = this.resolveTenantConfigPath(normalizedId);
-        if (!(0, fs_1.existsSync)(configPath)) {
-            throw new Error(`Tenant ${normalizedId} not found`);
-        }
-        const config = JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
-        const servers = (config.remoteServers || []);
-        const idx = servers.findIndex((s) => s.name?.toLowerCase() === server.name.toLowerCase());
-        if (idx >= 0) {
-            servers[idx] = server;
-            console.log(`[TenantManager] Updated sync server "${server.name}" for tenant ${normalizedId}`);
-        }
-        else {
-            servers.push(server);
-            console.log(`[TenantManager] Added sync server "${server.name}" for tenant ${normalizedId}`);
-        }
-        config.remoteServers = servers;
-        (0, fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2), "utf-8");
-        this.loadedTenants.delete(normalizedId);
-    }
-    removeTenantSyncServer(tenantId, serverName) {
-        const normalizedId = tenantId.toLowerCase();
-        const configPath = this.resolveTenantConfigPath(normalizedId);
-        if (!(0, fs_1.existsSync)(configPath)) {
-            throw new Error(`Tenant ${normalizedId} not found`);
-        }
-        const config = JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
-        const servers = (config.remoteServers || []);
-        const idx = servers.findIndex((s) => s.name?.toLowerCase() === serverName.toLowerCase());
-        if (idx === -1)
-            return false;
-        servers.splice(idx, 1);
-        config.remoteServers = servers;
-        (0, fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2), "utf-8");
-        this.loadedTenants.delete(normalizedId);
-        console.log(`[TenantManager] Removed sync server "${serverName}" from tenant ${normalizedId}`);
-        return true;
-    }
-    // =======================================================================
     // Server stores
     // =======================================================================
     async getServerStore(tenantId, dbId, storeKind) {
@@ -705,6 +803,9 @@ class TenantManager {
         const purgedDocResolver = dbId === "directory"
             ? undefined
             : () => this.getPurgedDocRegistry(tenantId).getPurgedDocIds(dbId);
+        const builtinWriteContext = dbId === types_1.USER_DIRECTORY_DB_ID
+            ? this.buildUserdirectoryWriteContext(tenant, localStore)
+            : undefined;
         const serverStore = new ServerNetworkContentAddressedStore_1.ServerNetworkContentAddressedStore(localStore, directory, tenant.authService, this.cryptoAdapter, undefined, {
             timestampProvider,
             witnessDbid: dbId,
@@ -713,6 +814,8 @@ class TenantManager {
             dbAccessEvaluator,
             revokedKeyResolver,
             purgedDocResolver,
+            builtinWriteContext,
+            ...this.peerAccessControl,
         });
         tenant.serverStores.set(cacheKey, serverStore);
         console.log(`[TenantManager] Created server store for ${tenantId}/${dbId}/${storeKind}`);
@@ -734,15 +837,27 @@ class TenantManager {
             // The witness evaluates Tier 1 at its acceptance time (now), the same time
             // it will stamp into the receipt (docs/accesscontrol.md §5.3, §7).
             const trustedTime = Date.now();
-            // Resolve `$author`: for doc_create the author is the creator; otherwise
-            // compare the change signer to the document's original doc_create author.
+            // Resolve `$author` at grant level: creator at the doc_create trusted
+            // time, signer at the witness's acceptance time. Falls back to device-key
+            // equality when the directory cannot answer.
             let isAuthor = entry.entryType === "doc_create";
             if (!isAuthor) {
                 try {
                     const docEntries = await localStore.findNewEntriesForDoc([], entry.docId);
                     const createEntry = docEntries.find((m) => m.entryType === "doc_create");
                     if (createEntry) {
-                        isAuthor = createEntry.createdByPublicKey === entry.createdByPublicKey;
+                        const samePerson = directory.isSamePerson;
+                        if (typeof samePerson === "function") {
+                            isAuthor = await samePerson({
+                                creatorSigningKey: createEntry.createdByPublicKey,
+                                signerSigningKey: entry.createdByPublicKey,
+                                creatorTrustedTime: createEntry.receivedAt ?? createEntry.createdAt,
+                                signerTrustedTime: trustedTime,
+                            });
+                        }
+                        else {
+                            isAuthor = createEntry.createdByPublicKey === entry.createdByPublicKey;
+                        }
                     }
                 }
                 catch {
@@ -759,6 +874,55 @@ class TenantManager {
             });
         };
     }
+    /**
+     * Builtin `userdirectory` write invariant: admin may create/delete, only the
+     * owning person may change. `username_hash` is read from the decrypted
+     * `doc_create` payload (`$publicinfos`). Personal documents are sealed to
+     * their owner and therefore undecryptable here, so they are owned by whoever
+     * signed their `doc_create` — `resolveCreatorSigningKey` answers that from
+     * the entry chain alone.
+     */
+    buildUserdirectoryWriteContext(tenant, localStore) {
+        const adminPublicKey = tenant.context.config.adminSigningPublicKey;
+        const mindooTenant = tenant.mindooTenant;
+        return {
+            adminPublicKey,
+            resolveCreatorSigningKey: async (entry) => {
+                const createEntry = await this.findCreateEntry(localStore, entry);
+                return createEntry?.createdByPublicKey ?? null;
+            },
+            resolveDocumentUsernameHash: mindooTenant
+                ? async (entry) => {
+                    const createEntry = await this.findCreateEntry(localStore, entry);
+                    if (!createEntry)
+                        return null;
+                    try {
+                        const plaintext = await mindooTenant.decryptPayload(createEntry.encryptedData, createEntry.decryptionKeyId);
+                        return (0, builtinDbInvariants_1.usernameHashFromCreateChangeBytes)(plaintext);
+                    }
+                    catch {
+                        return null;
+                    }
+                }
+                : undefined,
+        };
+    }
+    async findCreateEntry(localStore, entry) {
+        if (entry.entryType === "doc_create") {
+            return entry;
+        }
+        try {
+            const metas = await localStore.findNewEntriesForDoc([], entry.docId);
+            const createMeta = metas.find((m) => m.entryType === "doc_create");
+            if (!createMeta)
+                return null;
+            const loaded = await localStore.getEntries([createMeta.id]);
+            return loaded[0] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * Build a database-open evaluator closure for a server store, or undefined
      * when the directory cannot evaluate the database-open policy (e.g. a