diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub')
3 files changed, 62 insertions, 20 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js index f079f80..3d56f69 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js @@ -68,28 +68,39 @@ extendTransport(class { return 'unknown'; } const known = await _readPinnedAccount(this.nodePk, userId); - const entry = roster.byAccount.get(userId); - if (known && known.includes(devicePk)) return 'pinned'; - if (!known) { - // First sight, so **everything the node says** is pinned — not only what - // a chain reaches. There is nothing to compare against yet: that is what - // trust-on-first-use means, and pinning only the verified subset would - // raise "key changed" on a legitimate second device whose - // countersignature simply predates it being kept. What TOFU buys is that - // a substitution *later* is visible; it cannot buy anything now. - if (entry) await _writePinnedAccount(this.nodePk, userId, entry.all); - return entry && entry.all.includes(devicePk) ? 'first' : 'changed'; + let verdict = _judgeDevice(known, roster.byAccount.get(userId), devicePk); + // The roster is this connection's copy, read once. Somebody who joined the + // group, or added a device, since it was read is absent from it, and their + // first message raised "key changed" — found live, twice in one + // conversation, on a member invited after the page was opened. So the + // roster is read again before that is said, once per account and device + // on this connection: a node substituting keys gets one more read for each + // key it makes up, and the same answer. + if (verdict.status === 'changed') { + try { + roster = await this._rosterRecheckedFor(userId, devicePk); + verdict = _judgeDevice(known, roster.byAccount.get(userId), devicePk); + } catch { /* the verdict on the copy we had stands */ } } - if (entry && entry.verified.includes(devicePk) - && entry.chain.get(devicePk) - && known.includes(entry.chain.get(devicePk))) { - // Countersigned by a key we already trust for this account: a second - // device of someone we know, admitted without anybody comparing digits. - await _writePinnedAccount(this.nodePk, userId, - [...new Set([...known, devicePk])]); - return 'linked'; + if (verdict.pin) await _writePinnedAccount(this.nodePk, userId, verdict.pin); + return verdict.status; + } + + /** + * The roster as re-read for this key, read once per connection. Held as the + * promise, not as "done": live messages are opened concurrently, and two from + * a device that just joined must both wait for the one read, not have the + * second answer "changed" while the first is still asking. + */ + _rosterRecheckedFor(userId, devicePk) { + if (!this._rosterRechecks) this._rosterRechecks = new Map(); + const key = `${userId} ${devicePk}`; + let read = this._rosterRechecks.get(key); + if (!read) { + read = this.groupRoster({ fresh: true }); + this._rosterRechecks.set(key, read); } - return 'changed'; + return read; } /** diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js index cac3b52..d2e8c94 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js @@ -103,6 +103,36 @@ async function _writePinnedAccount(nodePk, userId, keys) { } /** + * How `devicePk` stands against what is pinned for its account (`known`, null + * at first sight) and what the roster lists for it (`entry`): `{ status, pin }`, + * `pin` being the keys to keep if that answer stands. Decides and writes + * nothing, so a verdict reached on a stale roster can be taken again on a fresh + * one without having pinned half a set first. The statuses are + * `accountDeviceStatus`'s. + */ +function _judgeDevice(known, entry, devicePk) { + if (known && known.includes(devicePk)) return { status: 'pinned', pin: null }; + if (!known) { + // First sight, so **everything the node says** is pinned — not only what + // a chain reaches. There is nothing to compare against yet: that is what + // trust-on-first-use means, and pinning only the verified subset would + // raise "key changed" on a legitimate second device whose + // countersignature simply predates it being kept. What TOFU buys is that + // a substitution *later* is visible; it cannot buy anything now. + const pin = entry ? entry.all : null; + return { status: entry && entry.all.includes(devicePk) ? 'first' : 'changed', pin }; + } + if (entry && entry.verified.includes(devicePk) + && entry.chain.get(devicePk) + && known.includes(entry.chain.get(devicePk))) { + // Countersigned by a key we already trust for this account: a second + // device of someone we know, admitted without anybody comparing digits. + return { status: 'linked', pin: [...new Set([...known, devicePk])] }; + } + return { status: 'changed', pin: null }; +} + +/** * A wire payload as text. * * A plaintext message arrives as a string from the node; msgpack `bin` arrives diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js index 9dcea4f..fa5d28b 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js @@ -1247,6 +1247,7 @@ class MeshBayTransport { this._chatKeysInFlight = null; this._roster = null; this._rosterInFlight = null; + this._rosterRechecks = null; // Tell the node which of this account's devices is on this connection, // after the ack and unconditionally: a peer `check_version` admitted // speaks this message, and identifying the device is what makes chat |