mindoodb 0.0.85 → 0.0.88

package/dist/appendonlystores/network/ServerNetworkContentAddressedStore.js

@@ -10,6 +10,9 @@ const EntrySignature_1 = require("../../core/crypto/EntrySignature");
 const idGeneration_1 = require("../../core/utils/idGeneration");
 const WitnessReceipt_1 = require("../../core/crypto/WitnessReceipt");
 const logging_1 = require("../../core/logging");
+const types_3 = require("../../core/accesscontrol/types");
+const sealedTypes_1 = require("../../core/userkeys/sealedTypes");
+const types_4 = require("../../core/types");
 /**
  * Server-side network handler for ContentAddressedStore operations.
  *
@@ -22,6 +25,10 @@ const logging_1 = require("../../core/logging");
  * This is not a ContentAddressedStore implementation itself, but rather
  * a service that wraps a local ContentAddressedStore and handles network requests.
  */
+/** Sliding window of the internal-mail rate limit. */
+const INTERNAL_MAIL_WINDOW_MS = 60 * 60 * 1000;
+/** How often the internal-mail counters are pruned at most. */
+const INTERNAL_MAIL_PRUNE_INTERVAL_MS = 60 * 1000;
 class ServerNetworkContentAddressedStore {
     /**
      * Create a new ServerNetworkContentAddressedStore.
@@ -33,6 +40,14 @@ class ServerNetworkContentAddressedStore {
      * @param logger Optional logger instance
      */
     constructor(localStore, directory, authService, cryptoAdapter, logger, accessControl) {
+        /** docId → creator of its `doc_create` (never changes once known). */
+        this.docCreatorByDocId = new Map();
+        /** Internal mail limits (§6.11): bytes per deposited document, accept times per sender. */
+        /** Bytes per internal mail doc and when it was last seen (pruned after an hour). */
+        this.internalMailBytesByDocId = new Map();
+        /** doc_create times per sender within the last hour (pruned, empty senders dropped). */
+        this.internalMailTimesBySender = new Map();
+        this.internalMailPrunedAt = 0;
         /** Cached `username_hash` per userdirectory docId, filled as creates are seen. */
         this.userdirectoryHashByDocId = new Map();
         /** Cached create signing key per personal userdirectory docId (its owner). */
@@ -51,11 +66,15 @@ class ServerNetworkContentAddressedStore {
         this.tier1Evaluator = accessControl?.tier1Evaluator;
         this.wipeGrantDocIdResolver = accessControl?.wipeGrantDocIdResolver;
         this.dbAccessEvaluator = accessControl?.dbAccessEvaluator;
+        this.dbAccessModeEvaluator = accessControl?.dbAccessModeEvaluator;
         this.revokedKeyResolver = accessControl?.revokedKeyResolver;
         this.purgedDocResolver = accessControl?.purgedDocResolver;
         this.builtinWriteContext = accessControl?.builtinWriteContext;
         this.peerTokenResolver = accessControl?.peerTokenResolver;
         this.trustedWitnessResolver = accessControl?.trustedWitnessResolver;
+        this.readScopeResolver = accessControl?.readScopeResolver;
+        this.docCreatorResolver = accessControl?.docCreatorResolver;
+        this.purgeRequestValidator = accessControl?.purgeRequestValidator;
     }
     /**
      * Resolve the reader's RSA encryption public key for transport encryption.
@@ -159,6 +178,97 @@ class ServerNetworkContentAddressedStore {
         }
         return kept;
     }
+    /**
+     * The read scope of the request's principal (§6.12), or `null` when it reads
+     * everything. Peers mirror the store completely; the directory stores are
+     * never scoped.
+     */
+    async resolveReadScope(payload) {
+        if (payload.peer)
+            return null;
+        if (!this.readScopeResolver)
+            return null;
+        const dbId = this.localStore.getId();
+        if (dbId === ServerNetworkContentAddressedStore.DIRECTORY_DB_ID || dbId === types_1.USER_DIRECTORY_DB_ID) {
+            return null;
+        }
+        return this.readScopeResolver(this.readPrincipal(payload));
+    }
+    /** The creator of `docId`'s `doc_create`, cached once known. */
+    async docCreator(docId) {
+        const cached = this.docCreatorByDocId.get(docId);
+        if (cached)
+            return cached;
+        let found = null;
+        if (this.docCreatorResolver) {
+            found = await this.docCreatorResolver(docId);
+        }
+        else {
+            const metas = await this.localStore.findNewEntriesForDoc([], docId);
+            const create = metas.find((m) => m.entryType === "doc_create");
+            if (create) {
+                found = { signingKey: create.createdByPublicKey, trustedTime: create.receivedAt ?? create.createdAt };
+            }
+        }
+        if (found)
+            this.docCreatorByDocId.set(docId, found);
+        return found;
+    }
+    /**
+     * A per-request decision cache for "may the principal see this document".
+     * Fail-closed: a document whose `doc_create` is unknown is hidden.
+     */
+    scopeChecker(scope) {
+        const decided = new Map();
+        return (docId) => {
+            let decision = decided.get(docId);
+            if (!decision) {
+                decision = (async () => {
+                    const creator = await this.docCreator(docId);
+                    return creator ? scope.ownsDocument(creator.signingKey, creator.trustedTime) : false;
+                })();
+                decided.set(docId, decision);
+            }
+            return decision;
+        };
+    }
+    /** Drop metadata of documents outside the principal's read scope (§6.12). */
+    async filterMetasByReadScope(metas, scope) {
+        if (!scope || metas.length === 0)
+            return metas;
+        const visible = this.scopeChecker(scope);
+        const kept = [];
+        for (const meta of metas) {
+            if (await visible(meta.docId))
+                kept.push(meta);
+        }
+        return kept;
+    }
+    /** Drop ids of entries outside the principal's read scope (§6.12). */
+    async filterIdsByReadScope(ids, scope) {
+        if (!scope || ids.length === 0)
+            return ids;
+        const visible = this.scopeChecker(scope);
+        const kept = [];
+        for (const id of ids) {
+            const meta = await this.localStore.getEntryMetadata(id);
+            if (meta && (await visible(meta.docId)))
+                kept.push(id);
+        }
+        return kept;
+    }
+    /** Both per-user read filters (§13 revoked keys, §6.12 read scope) on metadata. */
+    async filterMetasForReader(metas, payload) {
+        const revoked = await this.resolveRevokedKeyIds(payload);
+        const scope = await this.resolveReadScope(payload);
+        return this.filterMetasByReadScope(this.filterMetasByRevokedKeys(metas, revoked), scope);
+    }
+    /** Both per-user read filters (§13 revoked keys, §6.12 read scope) on ids. */
+    async filterIdsForReader(ids, payload) {
+        const revoked = await this.resolveRevokedKeyIds(payload);
+        const scope = await this.resolveReadScope(payload);
+        return this.filterIdsByReadScope(await this.filterIdsByRevokedKeys(ids, revoked), scope);
+    }
     /**
      * Get the ID of the underlying store.
      */
@@ -208,8 +318,7 @@ class ServerNetworkContentAddressedStore {
         this.logger.debug(`Found ${newEntries.length} new entries`);
         const allowed = await this.wipeAllowedIds(tokenPayload);
         const scoped = allowed ? newEntries.filter((e) => allowed.has(e.id)) : newEntries;
-        const revoked = await this.resolveRevokedKeyIds(tokenPayload);
-        return this.filterMetasByRevokedKeys(scoped, revoked);
+        return this.filterMetasForReader(scoped, tokenPayload);
     }
     /**
      * Handle a findNewEntriesForDoc request from a client.
@@ -230,8 +339,7 @@ class ServerNetworkContentAddressedStore {
         this.logger.debug(`Found ${newEntries.length} new entries for doc ${docId}`);
         const allowed = await this.wipeAllowedIds(tokenPayload);
         const scoped = allowed ? newEntries.filter((e) => allowed.has(e.id)) : newEntries;
-        const revoked = await this.resolveRevokedKeyIds(tokenPayload);
-        return this.filterMetasByRevokedKeys(scoped, revoked);
+        return this.filterMetasForReader(scoped, tokenPayload);
     }
     /**
      * Handle a findEntries request from a client.
@@ -252,8 +360,7 @@ class ServerNetworkContentAddressedStore {
         this.logger.debug(`Found ${entries.length} entries`);
         const allowed = await this.wipeAllowedIds(tokenPayload);
         const scoped = allowed ? entries.filter((e) => allowed.has(e.id)) : entries;
-        const revoked = await this.resolveRevokedKeyIds(tokenPayload);
-        return this.filterMetasByRevokedKeys(scoped, revoked);
+        return this.filterMetasForReader(scoped, tokenPayload);
     }
     /**
      * Handle a cursor-based scanEntriesSince request from a client.
@@ -286,10 +393,11 @@ class ServerNetworkContentAddressedStore {
         // Per-user revoked-key blacklist (§13): silently omit revoked entries from
         // the page. Filtering after paging only shrinks a page; the store's own
         // cursor still advances so the client keeps making progress.
-        const revoked = await this.resolveRevokedKeyIds(tokenPayload);
+        // The read scope (§6.12) filters the same way: a page may come back empty
+        // while `nextCursor`/`hasMore` still move on over hidden entries.
         if (this.localStore.scanEntriesSince) {
             const result = await this.localStore.scanEntriesSince(cursor, effectiveLimit, filters);
-            return { ...result, entries: this.filterMetasByRevokedKeys(result.entries, revoked) };
+            return { ...result, entries: await this.filterMetasForReader(result.entries, tokenPayload) };
         }
         // Fallback: emulate cursor scan using existing metadata query.
         const all = filters?.docId
@@ -326,7 +434,7 @@ class ServerNetworkContentAddressedStore {
         const page = sorted.slice(startIndex, startIndex + max);
         const last = page.length > 0 ? page[page.length - 1] : null;
         return {
-            entries: this.filterMetasByRevokedKeys(page, revoked),
+            entries: await this.filterMetasForReader(page, tokenPayload),
             nextCursor: last ? { receiptOrder: last.receiptOrder ?? 0, id: last.id } : cursor,
             hasMore: startIndex + page.length < sorted.length,
         };
@@ -348,7 +456,7 @@ class ServerNetworkContentAddressedStore {
      * Handle sync capability negotiation.
      */
     async handleGetCapabilities(token) {
-        const tokenPayload = await this.validateToken(token);
+        const tokenPayload = await this.validateToken(token, true);
         this.logger.debug(`Token validated for user: ${tokenPayload.sub}`);
         return {
             protocolVersion: "sync-v5",
@@ -380,11 +488,17 @@ class ServerNetworkContentAddressedStore {
      * Cheap: token validation + an in-memory read on the local store.
      */
     async handleGetStoreHead(token) {
-        await this.validateToken(token);
+        const tokenPayload = await this.validateToken(token);
         if (!this.localStore.getStoreHead) {
             throw new types_2.NetworkError(types_2.NetworkErrorType.SERVER_ERROR, "Local store does not support getStoreHead");
         }
-        return this.localStore.getStoreHead();
+        const head = await this.localStore.getStoreHead();
+        // A scoped reader (§6.12) gets its own epoch lineage: when the scope
+        // changes (mode switched, reader rule added or removed) the epoch differs
+        // and the client re-scans from the start instead of trusting a cursor that
+        // skipped entries it could not see before.
+        const scope = await this.resolveReadScope(tokenPayload);
+        return scope ? { ...head, epoch: `${head.epoch}:scope:${scope.scopeId}` } : head;
     }
     /**
      * Handle a getCompactionStatus request from a client.
@@ -487,8 +601,8 @@ class ServerNetworkContentAddressedStore {
         // path. Even if a client already knows a revoked entry's id, the server
         // never hands back its bytes. A StoreEntry carries its own decryptionKeyId,
         // so we filter without an extra metadata lookup.
-        const revoked = await this.resolveRevokedKeyIds(tokenPayload);
-        const servableEntries = this.filterMetasByRevokedKeys(entries, revoked);
+        // Read scope (§6.12): fail-closed as well, by the entry's document.
+        const servableEntries = await this.filterMetasForReader(entries, tokenPayload);
         return { servableEntries, encryptionPublicKey, username };
     }
     async handleGetEntryMetadata(token, id) {
@@ -508,6 +622,11 @@ class ServerNetworkContentAddressedStore {
         if (revoked && meta.decryptionKeyId && revoked.has(meta.decryptionKeyId)) {
             return null;
         }
+        // Read scope (§6.12): nothing about other people's documents.
+        const scope = await this.resolveReadScope(tokenPayload);
+        if (scope && (await this.filterMetasByReadScope([meta], scope)).length === 0) {
+            return null;
+        }
         return meta;
     }
     /**
@@ -531,7 +650,7 @@ class ServerNetworkContentAddressedStore {
     async handlePutEntries(token, entries) {
         this.logger.debug(`Handling putEntries request for ${entries.length} entries`);
         // Validate token
-        const tokenPayload = await this.validateToken(token);
+        const tokenPayload = await this.validateToken(token, true);
         this.logger.debug(`Token validated for user: ${tokenPayload.sub}`);
         // Server-to-server push: enables witness-receipt preservation below.
         const peerIngest = tokenPayload.peer !== undefined;
@@ -552,6 +671,10 @@ class ServerNetworkContentAddressedStore {
         const purgedDocIds = this.purgedDocResolver
             ? await this.purgedDocResolver()
             : null;
+        // Author-scoped read (§6.12): a scoped principal may only write its own
+        // documents (create new ones, change its own), never into other people's.
+        const readScope = await this.resolveReadScope(tokenPayload);
+        const ownsForWrite = readScope ? this.scopeChecker(readScope) : null;
         // A single acceptance time for this batch so receipts are consistent and a
         // batch cannot interleave with the witness's own monotonic clock (§5.3).
         const receivedAt = Date.now();
@@ -651,6 +774,27 @@ class ServerNetworkContentAddressedStore {
                 this.rejectEntry(rejected, entry.id, `Entry ${entry.id} has an invalid author signature`);
                 continue;
             }
+            // Deposit-only principal (docs/accesscontrol.md §6.10): the deposit check
+            // replaces Tier 1 for its entries, because the doc_deposit rule is what
+            // authorizes them. Anything that is not a sealed create (or a chunk of
+            // one) is refused.
+            if (tokenPayload.deposit) {
+                const denied = (await this.evaluateDepositEntry(entry, tokenPayload, tokenPayload.deposit.maxRecipients, tokenPayload.deposit.docIdPrefixes)) ?? this.evaluateInternalMailLimits(entry, tokenPayload.deposit.internalMail);
+                if (denied) {
+                    this.rejectEntry(rejected, entry.id, denied.reason, denied.rejectionClass);
+                    continue;
+                }
+            }
+            // Purge requests in personal databases (§6.11): only by someone who may
+            // read the database, only for documents that are already deleted.
+            // Independent of the ACL master switch, like the builtin invariants.
+            if (this.purgeRequestValidator && (0, builtinDbInvariants_1.isPurgeRequestDocId)(entry.docId)) {
+                const denied = await this.purgeRequestValidator(entry, entries);
+                if (denied) {
+                    this.rejectEntry(rejected, entry.id, `Entry ${entry.id}: ${denied}`, "policy");
+                    continue;
+                }
+            }
             // Builtin `userdirectory` write invariant (docs/userkeys.md §6.5). Runs
             // before Tier 1 so it holds even when the ACL master switch is on.
             const dbId = this.witnessDbid ?? this.localStore.getId();
@@ -664,13 +808,22 @@ class ServerNetworkContentAddressedStore {
             // Rule-based Tier 1 enforcement (docs/accesscontrol.md §7). The server can
             // only decide the identity tier; content-tier (Tier 2) gates are deferred
             // to clients and treated as allowed here.
-            if (this.tier1Evaluator) {
+            if (this.tier1Evaluator && !tokenPayload.deposit) {
                 const decision = await this.tier1Evaluator(entry, this.witnessDbid ?? this.localStore.getId());
                 if (!decision.allowed) {
                     this.rejectEntry(rejected, entry.id, `Entry ${entry.id} denied by Tier 1 policy: ${decision.reason}`, "policy");
                     continue;
                 }
             }
+            if (readScope && ownsForWrite) {
+                const ownsIt = entry.entryType === "doc_create"
+                    ? await readScope.ownsDocument(entry.createdByPublicKey, receivedAt)
+                    : await this.ownsDocumentInBatch(entry, entries, readScope, ownsForWrite);
+                if (!ownsIt) {
+                    this.rejectEntry(rejected, entry.id, `Entry ${entry.id} writes into a document outside the principal's read scope`, "policy");
+                    continue;
+                }
+            }
             // Stamp a witness receipt onto the accepted entry (§5.3). Self-authored
             // entries (the witness pushing its own data) are not self-witnessed.
             //
@@ -721,10 +874,125 @@ class ServerNetworkContentAddressedStore {
             (rejected.length > 0 ? ` (${rejected.length} rejected)` : ""));
         return { receipts: stampedMetadata, rejected };
     }
+    /**
+     * What a deposit-only principal may push (docs/accesscontrol.md §6.10):
+     *
+     * - `doc_create` of a sealed document (`decryptionKeyId` is
+     *   `$sealed:<docId>`) carrying 1..`maxRecipients` recipient wraps, signed
+     *   by the depositing device itself, for a document id the store does not
+     *   hold yet. An existing id is refused as `"exists"`, which a depositor
+     *   reads as "already delivered".
+     * - `attachment_chunk` entries of such a document, signed by the depositor.
+     *
+     * Changes, deletes, undeletes and snapshots are always refused: a depositor
+     * cannot read the document, so it has no business editing it.
+     */
+    async evaluateDepositEntry(entry, tokenPayload, maxRecipients, docIdPrefixes) {
+        const policy = (reason) => ({ reason: `Entry ${entry.id}: ${reason}`, rejectionClass: "policy" });
+        // Allowed document ids (§6.10 `docIdPrefixes`); applies to chunks too, which carry the docId.
+        if (entry.docId && !(0, types_3.docIdMatchesPrefixes)(entry.docId, docIdPrefixes)) {
+            return policy(`deposited document ids must start with ${docIdPrefixes.map((p) => `"${p}"`).join(" or ")}`);
+        }
+        if (!entry.docId || entry.decryptionKeyId !== (0, sealedTypes_1.sealedKeyId)(entry.docId)) {
+            return policy("deposit-only principals may only push documents sealed with their own key ($sealed:<docId>)");
+        }
+        if (tokenPayload.deviceSigningKey && entry.createdByPublicKey !== tokenPayload.deviceSigningKey) {
+            return policy("deposit-only principals may only push entries they signed themselves");
+        }
+        if (entry.entryType === "attachment_chunk") {
+            return this.localStore.getStoreKind() === types_4.StoreKind.attachments
+                ? null
+                : policy("attachment chunks belong in the attachment store");
+        }
+        if (entry.entryType !== "doc_create") {
+            return policy(`deposit-only principals may only create documents, not push ${entry.entryType}`);
+        }
+        const wraps = entry.recipients?.wraps?.length ?? 0;
+        if (wraps < 1 || wraps > maxRecipients) {
+            return policy(`a deposited document needs 1 to ${maxRecipients} recipient wraps (has ${wraps})`);
+        }
+        const existing = await this.localStore.findNewEntriesForDoc([], entry.docId);
+        if (existing.length > 0) {
+            return { reason: `Entry ${entry.id}: document ${entry.docId} already exists`, rejectionClass: "exists" };
+        }
+        return null;
+    }
+    /**
+     * Size and rate limits of internal mail (§6.11): per sender (signing key)
+     * and mailbox (this store), a document plus its attachment chunks may not
+     * exceed `maxBytesPerMail` (each store counts its own entries), and at most
+     * `maxMailsPerHour` documents are accepted per sender in a sliding hour.
+     * Counters are in memory: a server restart resets them.
+     */
+    evaluateInternalMailLimits(entry, limits) {
+        if (!limits)
+            return null;
+        const now = Date.now();
+        this.pruneInternalMailCounters(now);
+        const policy = (reason) => ({ reason: `Entry ${entry.id}: ${reason}`, rejectionClass: "policy" });
+        const bytes = (this.internalMailBytesByDocId.get(entry.docId)?.bytes ?? 0) + entry.encryptedData.byteLength;
+        if (bytes > limits.maxBytesPerMail) {
+            return policy(`internal mail is limited to ${limits.maxBytesPerMail} bytes per mail`);
+        }
+        if (entry.entryType === "doc_create") {
+            const recent = (this.internalMailTimesBySender.get(entry.createdByPublicKey) ?? []).filter((t) => now - t < INTERNAL_MAIL_WINDOW_MS);
+            if (recent.length >= limits.maxMailsPerHour) {
+                this.internalMailTimesBySender.set(entry.createdByPublicKey, recent);
+                return policy(`internal mail is limited to ${limits.maxMailsPerHour} mails per hour per sender and mailbox`);
+            }
+            recent.push(now);
+            this.internalMailTimesBySender.set(entry.createdByPublicKey, recent);
+        }
+        this.internalMailBytesByDocId.set(entry.docId, { bytes, at: now });
+        return null;
+    }
+    /**
+     * Drops counters outside the one-hour window, at most once a minute: byte
+     * counts of mails not touched for an hour (a mail's document and attachment
+     * chunks arrive within minutes) and senders without a create in the last hour.
+     * Keeps memory bounded by the traffic of the last hour, for the server's lifetime.
+     */
+    pruneInternalMailCounters(now) {
+        if (now - this.internalMailPrunedAt < INTERNAL_MAIL_PRUNE_INTERVAL_MS)
+            return;
+        this.internalMailPrunedAt = now;
+        for (const [docId, counter] of this.internalMailBytesByDocId) {
+            if (now - counter.at >= INTERNAL_MAIL_WINDOW_MS)
+                this.internalMailBytesByDocId.delete(docId);
+        }
+        for (const [sender, times] of this.internalMailTimesBySender) {
+            const recent = times.filter((t) => now - t < INTERNAL_MAIL_WINDOW_MS);
+            if (recent.length === 0)
+                this.internalMailTimesBySender.delete(sender);
+            else if (recent.length !== times.length)
+                this.internalMailTimesBySender.set(sender, recent);
+        }
+    }
+    /** Test hook: sizes of the internal-mail counters. */
+    internalMailCounterSizes() {
+        return { docs: this.internalMailBytesByDocId.size, senders: this.internalMailTimesBySender.size };
+    }
     /**
      * Enforce the hard-wired `userdirectory` write invariant. Returns a denial
      * message, or `null` when the entry is allowed.
      */
+    /**
+     * For a non-create entry under a read scope: is its document the principal's?
+     * The `doc_create` may be in the same batch (not yet stored).
+     */
+    async ownsDocumentInBatch(entry, batch, scope, owns) {
+        const create = batch.find((e) => e.docId === entry.docId && e.entryType === "doc_create");
+        if (create && !(await this.localStore.hasEntries([create.id])).length) {
+            return scope.ownsDocument(create.createdByPublicKey, Date.now());
+        }
+        if (await this.docCreator(entry.docId)) {
+            return owns(entry.docId);
+        }
+        // The document is not on the server yet: attachment chunks are pushed
+        // before the document that references them. The entry's own author decides
+        // (the principal's own write); reads stay hidden until the doc_create is in.
+        return scope.ownsDocument(entry.createdByPublicKey, Date.now());
+    }
     async evaluateUserdirectoryInvariant(entry, trustedTime, batch = []) {
         const op = (0, builtinDbInvariants_1.entryTypeToBuiltinOp)(entry.entryType);
         if (!op || !this.builtinWriteContext) {
@@ -882,7 +1150,7 @@ class ServerNetworkContentAddressedStore {
     async handleHasEntries(token, ids) {
         this.logger.debug(`Handling hasEntries request for ${ids.length} IDs`);
         // Validate token
-        const tokenPayload = await this.validateToken(token);
+        const tokenPayload = await this.validateToken(token, true);
         this.logger.debug(`Token validated for user: ${tokenPayload.sub}`);
         // Check which IDs exist in local store
         const existingIds = await this.localStore.hasEntries(ids);
@@ -909,8 +1177,7 @@ class ServerNetworkContentAddressedStore {
         this.logger.debug(`Returning ${allIds.length} entry IDs`);
         const allowed = await this.wipeAllowedIds(tokenPayload);
         const scoped = allowed ? allIds.filter((id) => allowed.has(id)) : allIds;
-        const revoked = await this.resolveRevokedKeyIds(tokenPayload);
-        return this.filterIdsByRevokedKeys(scoped, revoked);
+        return this.filterIdsForReader(scoped, tokenPayload);
     }
     /**
      * Handle a resolveDependencies request from a client.
@@ -934,18 +1201,35 @@ class ServerNetworkContentAddressedStore {
         // Resolve dependencies in local store
         const resolvedIds = await this.localStore.resolveDependencies(startId, options);
         this.logger.debug(`Resolved ${resolvedIds.length} dependencies`);
-        const revoked = await this.resolveRevokedKeyIds(tokenPayload);
-        return this.filterIdsByRevokedKeys(resolvedIds, revoked);
+        return this.filterIdsForReader(resolvedIds, tokenPayload);
     }
     async handlePlanDocumentMaterialization(token, docId, options) {
         const tokenPayload = await this.validateToken(token);
         this.logger.debug(`Token validated for user: ${tokenPayload.sub}`);
+        const scope = await this.resolveReadScope(tokenPayload);
+        if (scope && !(await this.scopeChecker(scope)(docId))) {
+            // Read scope (§6.12): a document outside it looks like an unknown one.
+            return { docId, snapshotEntryId: null, entryIdsToApply: [] };
+        }
         return this.localStore.planDocumentMaterialization(docId, options);
     }
     async handlePlanDocumentMaterializationBatch(token, docIds, options) {
         const tokenPayload = await this.validateToken(token);
         this.logger.debug(`Token validated for user: ${tokenPayload.sub}`);
-        return this.localStore.planDocumentMaterializationBatch(docIds, options);
+        const scope = await this.resolveReadScope(tokenPayload);
+        if (!scope) {
+            return this.localStore.planDocumentMaterializationBatch(docIds, options);
+        }
+        const visible = this.scopeChecker(scope);
+        const shown = [];
+        for (const docId of docIds)
+            if (await visible(docId))
+                shown.push(docId);
+        const plan = await this.localStore.planDocumentMaterializationBatch(shown, options);
+        const byId = new Map(plan.plans.map((p) => [p.docId, p]));
+        return {
+            plans: docIds.map((docId) => byId.get(docId) ?? { docId, snapshotEntryId: null, entryIdsToApply: [] }),
+        };
     }
     async handlePlanAttachmentReadByWalkingMetadata(token, lastChunkId, attachmentSize, options) {
         const tokenPayload = await this.validateToken(token);
@@ -953,6 +1237,10 @@ class ServerNetworkContentAddressedStore {
         if (!this.localStore.planAttachmentReadByWalkingMetadata) {
             throw new Error("Remote store does not support attachment read planning");
         }
+        const scope = await this.resolveReadScope(tokenPayload);
+        if (scope && (await this.filterIdsByReadScope([lastChunkId], scope)).length === 0) {
+            throw new types_2.NetworkError(types_2.NetworkErrorType.ACCESS_DENIED, "Attachment is outside the principal's read scope");
+        }
         return this.localStore.planAttachmentReadByWalkingMetadata(lastChunkId, attachmentSize, options);
     }
     /**
@@ -962,7 +1250,13 @@ class ServerNetworkContentAddressedStore {
      * @returns The token payload
      * @throws NetworkError if token is invalid
      */
-    async validateToken(token) {
+    /**
+     * @param allowDeposit Whether a deposit-only principal (§6.10) may perform
+     *   this operation. Only pushing (`putEntries`), the existence check push
+     *   relies on (`hasEntries`) and the capability probe pass it; every read is
+     *   refused for such a principal.
+     */
+    async validateToken(token, allowDeposit = false) {
         const payload = await this.authService.validateToken(token);
         if (!payload) {
             // Server-to-server replication: a trusted peer authenticates once at the
@@ -992,7 +1286,29 @@ class ServerNetworkContentAddressedStore {
         // Applied here so it covers every authenticated sync operation (reads and
         // writes) in one place. The directory store is never wired with an
         // evaluator, so it always syncs.
-        if (this.dbAccessEvaluator) {
+        if (this.dbAccessModeEvaluator) {
+            const dbid = this.witnessDbid ?? this.localStore.getId();
+            const access = await this.dbAccessModeEvaluator({ signingKey: payload.deviceSigningKey }, dbid);
+            if (access.mode === "none") {
+                throw new types_2.NetworkError(types_2.NetworkErrorType.ACCESS_DENIED, access.reason
+                    ? `Access denied to database "${dbid}": ${access.reason}`
+                    : `Database "${dbid}" is not in the tenant's allowed database list`);
+            }
+            if (access.mode === "deposit") {
+                if (!allowDeposit) {
+                    throw new types_2.NetworkError(types_2.NetworkErrorType.ACCESS_DENIED, `Database "${dbid}" allows this user to deposit sealed documents only, not to read`);
+                }
+                return {
+                    ...payload,
+                    deposit: {
+                        maxRecipients: access.maxRecipients ?? types_3.DEFAULT_DEPOSIT_MAX_RECIPIENTS,
+                        ...(access.docIdPrefixes?.length ? { docIdPrefixes: access.docIdPrefixes } : {}),
+                        ...(access.internalMail ? { internalMail: access.internalMail } : {}),
+                    },
+                };
+            }
+        }
+        else if (this.dbAccessEvaluator) {
             const dbid = this.witnessDbid ?? this.localStore.getId();
             const allowed = await this.dbAccessEvaluator({ signingKey: payload.deviceSigningKey }, dbid);
             if (!allowed) {