Merge upstream develop

Author: github-actions[bot]

.gitlab/ci/build_rs_core.yml

@@ -57,7 +57,7 @@ rs-core-tests:
 rs-common-format-check:
   extends: .rust-check
   script:
-    - cd packages/rs-core
+    - cd packages/rs-common
     - cargo fmt --check
 
 rs-common-clippy:

apps/polycentric/src/features/identity-pairing/hooks/usePairIdentityClaimer.ts

@@ -17,9 +17,11 @@ export function usePairIdentityClaimer(
   const pairingSessionServer = options?.pairingSessionServer;
   const [identityKey, setIdentityKey] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
+  const [authorized, setAuthorized] = useState(false);
   const [approved, setApproved] = useState(false);
   const [claimInProgress, setClaimInProgress] = useState(false);
 
+  // Join the pairing session on the server and learn the issuer identity.
   useEffect(() => {
     if (!pairingSessionCode || identityKey) return;
 
@@ -51,51 +53,72 @@ export function usePairIdentityClaimer(
     claimAndWait();
   }, [pairingSessionCode, pairingSessionServer, identityKey, client]);
 
+  // Poll the issuer's identity until the current key is authorized.
+  // Stops once `authorized` flips to true.
   useEffect(() => {
-    if (!identityKey || !pairingSessionServer) return;
+    if (!identityKey || !pairingSessionServer || authorized) return;
 
     let cancelled = false;
 
-    const pollApproval = async () => {
+    const pollAuthorization = async () => {
       try {
         const state = await client.identityManager.fetchIdentityState(
           identityKey,
           pairingSessionServer,
         );
+        if (cancelled) return;
         const currentKey = client.currentKeyPair?.publicKey;
+        if (!currentKey) return;
 
-        if (!currentKey || cancelled) return;
+        const keys = new Set<string>();
+        state.rotationKeys.forEach((k) => keys.add(publicKeyToString(k)));
+        state.signingKeys.forEach((k) => keys.add(publicKeyToString(k)));
 
-        const authorized = new Set<string>();
-        state.rotationKeys.forEach((k) => authorized.add(publicKeyToString(k)));
-        state.signingKeys.forEach((k) => authorized.add(publicKeyToString(k)));
-
-        if (authorized.has(publicKeyToString(currentKey))) {
-          // add the pairing session server to our servers list
-          if (!client.servers.includes(pairingSessionServer)) {
-            client.servers.push(pairingSessionServer);
-          }
-
-          // fetch and apply the identity document
-          await client.identityManager.claim(identityKey);
-
-          setApproved(true);
+        if (keys.has(publicKeyToString(currentKey))) {
+          setAuthorized(true);
         }
       } catch {
         // polling failed, will retry on next interval
       }
     };
 
-    void pollApproval();
+    void pollAuthorization();
     const interval = setInterval(() => {
-      void pollApproval();
+      void pollAuthorization();
     }, 2000);
 
     return () => {
       cancelled = true;
       clearInterval(interval);
     };
-  }, [identityKey, pairingSessionServer, client]);
+  }, [identityKey, pairingSessionServer, client, authorized]);
+
+  // Claim exactly once when authorization is observed.
+  useEffect(() => {
+    if (!authorized || !identityKey || !pairingSessionServer) return;
+
+    let cancelled = false;
+
+    void (async () => {
+      try {
+        if (!client.servers.includes(pairingSessionServer)) {
+          client.servers.push(pairingSessionServer);
+        }
+        await client.identityManager.claim(identityKey);
+        if (!cancelled) setApproved(true);
+      } catch (err) {
+        if (!cancelled) {
+          const message =
+            err instanceof Error ? err.message : 'Failed to claim identity';
+          setError(message);
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [authorized, identityKey, pairingSessionServer, client]);
 
   return {
     error,

apps/polycentric/src/features/identity-pairing/screens/PairIdentityIssuerScreen.tsx

@@ -271,7 +271,8 @@ export default function PairIdentityIssuerScreen() {
                                 pairAsRotationKey,
                               );
                               router.back();
-                            } catch {
+                            } catch (err) {
+                              console.error('approve failed:', err);
                             } finally {
                               setApprovingClaimers((prev) => {
                                 const next = new Set(prev);

packages/js-core/src/client-internal/pairing-session-manager.ts

@@ -53,13 +53,10 @@ export class PairingSessionManager {
     identityKey: string,
     server: string,
   ): Promise<ActivePairingSession> {
-    // Create and sign the local InitialPairingSession
     const pairingSessionBytes = Proto.InitialPairingSession.toBinary(
       Proto.InitialPairingSession.create({
         issuerIdentity: identityKey,
-        // Servers don't allow these to be in the future.
-        // 1 second in the past to prevent timing issues.
-        createdAt: BigInt(Date.now() - 1_000),
+        timestamp: BigInt(Date.now()),
       }),
     );
     const signedMessage = await this.signMessage(pairingSessionBytes);
@@ -71,12 +68,11 @@ export class PairingSessionManager {
     const session = Proto.PairingSession.fromBinary(
       new Uint8Array(sessionBytes),
     );
-    const initialSession = session.initialSession!;
 
     return {
       code: bytesToHex(signedMessage.signature),
-      identityKey: initialSession.issuerIdentity,
-      createdAt: new Date(Number(initialSession.createdAt)),
+      identityKey: session.issuerIdentity,
+      createdAt: new Date(Number(session.createdAt)),
       expiresAt: new Date(Number(session.expiresAt)),
       signedBy: session.signedBy!,
       claimers: [],
@@ -98,13 +94,12 @@ export class PairingSessionManager {
     const session = Proto.PairingSession.fromBinary(
       new Uint8Array(sessionBytes),
     );
-    const initialSession = session.initialSession!;
     return {
       session,
       claimerPubkeys: [...session.claimerPubkeys],
       pairingSession: {
-        issuerIdentity: initialSession.issuerIdentity,
-        createdAt: new Date(Number(initialSession.createdAt)),
+        issuerIdentity: session.issuerIdentity,
+        createdAt: new Date(Number(session.createdAt)),
         expiresAt: new Date(Number(session.expiresAt)),
         signedBy: session.signedBy!,
       },
@@ -130,13 +125,12 @@ export class PairingSessionManager {
     const session = Proto.PairingSession.fromBinary(
       new Uint8Array(sessionBytes),
     );
-    const initialSession = session.initialSession!;
     return {
       session,
       claimerPubkeys: [...session.claimerPubkeys],
       pairingSession: {
-        issuerIdentity: initialSession.issuerIdentity,
-        createdAt: new Date(Number(initialSession.createdAt)),
+        issuerIdentity: session.issuerIdentity,
+        createdAt: new Date(Number(session.createdAt)),
         expiresAt: new Date(Number(session.expiresAt)),
         signedBy: session.signedBy!,
       },

packages/js-core/src/polycentric-client.ts

@@ -322,7 +322,12 @@ export class PolycentricClient {
       createdAt: BigInt(Date.now()),
     });
 
-    event.vectorClock = this.buildVectorClock(event);
+    const identityContentForVC =
+      collection === COLLECTION.IDENTITY &&
+      content.contentBody.oneofKind === 'identity'
+        ? content.contentBody.identity
+        : undefined;
+    event.vectorClock = this.buildVectorClock(event, identityContentForVC);
 
     return event;
   }
@@ -395,13 +400,19 @@ export class PolycentricClient {
    * Requires the identity event and its content to already have been
    * copied into the core via `copy_events` / `copy_contents`.
    */
-  buildVectorClock(event: Proto.Event): Proto.VectorClock {
+  buildVectorClock(
+    event: Proto.Event,
+    identityContent?: Proto.Identity,
+  ): Proto.VectorClock {
     const clockBytes = this.core.buildVectorClock(
       event.key!.identity,
       event.key!.collection,
       event.identitySequence,
       Proto.PublicKey.toBinary(event.key!.signedBy!).buffer as ArrayBuffer,
       event.key!.sequence,
+      identityContent
+        ? (Proto.Identity.toBinary(identityContent).buffer as ArrayBuffer)
+        : undefined,
     );
     return Proto.VectorClock.fromBinary(new Uint8Array(clockBytes));
   }

packages/js-core/src/proto/polycentric/v2/pairing_service.ts

@@ -27,11 +27,11 @@ export interface InitialPairingSession {
      */
     issuerIdentity: string;
     /**
-     * Creation timestamp in unix milliseconds.
+     * Timestamp so that the pairing session id is unique.
      *
-     * @generated from protobuf field: int64 created_at = 2
+     * @generated from protobuf field: int64 timestamp = 2
      */
-    createdAt: bigint;
+    timestamp: bigint;
 }
 /**
  * *
@@ -53,7 +53,7 @@ export interface JoinPairingSessionBody {
  */
 export interface PairingSession {
     /**
-     * Signature of the signed InitialPairingSession payload.
+     * Signature of the signed InitialPairingSession payload; serves as the session id.
      *
      * @generated from protobuf field: string pairing_session_signature = 1
      */
@@ -65,11 +65,11 @@ export interface PairingSession {
      */
     signedBy?: PublicKey;
     /**
-     * Session metadata.
+     * Identity key the session was created for.
      *
-     * @generated from protobuf field: polycentric.v2.InitialPairingSession initial_session = 3
+     * @generated from protobuf field: string issuer_identity = 3
      */
-    initialSession?: InitialPairingSession;
+    issuerIdentity: string;
     /**
      * Expiration timestamp in unix milliseconds.
      *
@@ -82,6 +82,12 @@ export interface PairingSession {
      * @generated from protobuf field: repeated polycentric.v2.PublicKey claimer_pubkeys = 5
      */
     claimerPubkeys: PublicKey[];
+    /**
+     * Server-authoritative creation timestamp in unix milliseconds.
+     *
+     * @generated from protobuf field: int64 created_at = 6
+     */
+    createdAt: bigint;
 }
 /**
  * *
@@ -160,13 +166,13 @@ class InitialPairingSession$Type extends MessageType<InitialPairingSession> {
     constructor() {
         super("polycentric.v2.InitialPairingSession", [
             { no: 1, name: "issuer_identity", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "created_at", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ }
+            { no: 2, name: "timestamp", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ }
         ]);
     }
     create(value?: PartialMessage<InitialPairingSession>): InitialPairingSession {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.issuerIdentity = "";
-        message.createdAt = 0n;
+        message.timestamp = 0n;
         if (value !== undefined)
             reflectionMergePartial<InitialPairingSession>(this, message, value);
         return message;
@@ -179,8 +185,8 @@ class InitialPairingSession$Type extends MessageType<InitialPairingSession> {
                 case /* string issuer_identity */ 1:
                     message.issuerIdentity = reader.string();
                     break;
-                case /* int64 created_at */ 2:
-                    message.createdAt = reader.int64().toBigInt();
+                case /* int64 timestamp */ 2:
+                    message.timestamp = reader.int64().toBigInt();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -197,9 +203,9 @@ class InitialPairingSession$Type extends MessageType<InitialPairingSession> {
         /* string issuer_identity = 1; */
         if (message.issuerIdentity !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.issuerIdentity);
-        /* int64 created_at = 2; */
-        if (message.createdAt !== 0n)
-            writer.tag(2, WireType.Varint).int64(message.createdAt);
+        /* int64 timestamp = 2; */
+        if (message.timestamp !== 0n)
+            writer.tag(2, WireType.Varint).int64(message.timestamp);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -263,16 +269,19 @@ class PairingSession$Type extends MessageType<PairingSession> {
         super("polycentric.v2.PairingSession", [
             { no: 1, name: "pairing_session_signature", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "signed_by", kind: "message", T: () => PublicKey },
-            { no: 3, name: "initial_session", kind: "message", T: () => InitialPairingSession },
+            { no: 3, name: "issuer_identity", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 4, name: "expires_at", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ },
-            { no: 5, name: "claimer_pubkeys", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PublicKey }
+            { no: 5, name: "claimer_pubkeys", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => PublicKey },
+            { no: 6, name: "created_at", kind: "scalar", T: 3 /*ScalarType.INT64*/, L: 0 /*LongType.BIGINT*/ }
         ]);
     }
     create(value?: PartialMessage<PairingSession>): PairingSession {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.pairingSessionSignature = "";
+        message.issuerIdentity = "";
         message.expiresAt = 0n;
         message.claimerPubkeys = [];
+        message.createdAt = 0n;
         if (value !== undefined)
             reflectionMergePartial<PairingSession>(this, message, value);
         return message;
@@ -288,15 +297,18 @@ class PairingSession$Type extends MessageType<PairingSession> {
                 case /* polycentric.v2.PublicKey signed_by */ 2:
                     message.signedBy = PublicKey.internalBinaryRead(reader, reader.uint32(), options, message.signedBy);
                     break;
-                case /* polycentric.v2.InitialPairingSession initial_session */ 3:
-                    message.initialSession = InitialPairingSession.internalBinaryRead(reader, reader.uint32(), options, message.initialSession);
+                case /* string issuer_identity */ 3:
+                    message.issuerIdentity = reader.string();
                     break;
                 case /* int64 expires_at */ 4:
                     message.expiresAt = reader.int64().toBigInt();
                     break;
                 case /* repeated polycentric.v2.PublicKey claimer_pubkeys */ 5:
                     message.claimerPubkeys.push(PublicKey.internalBinaryRead(reader, reader.uint32(), options));
                     break;
+                case /* int64 created_at */ 6:
+                    message.createdAt = reader.int64().toBigInt();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -315,15 +327,18 @@ class PairingSession$Type extends MessageType<PairingSession> {
         /* polycentric.v2.PublicKey signed_by = 2; */
         if (message.signedBy)
             PublicKey.internalBinaryWrite(message.signedBy, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        /* polycentric.v2.InitialPairingSession initial_session = 3; */
-        if (message.initialSession)
-            InitialPairingSession.internalBinaryWrite(message.initialSession, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        /* string issuer_identity = 3; */
+        if (message.issuerIdentity !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.issuerIdentity);
         /* int64 expires_at = 4; */
         if (message.expiresAt !== 0n)
             writer.tag(4, WireType.Varint).int64(message.expiresAt);
         /* repeated polycentric.v2.PublicKey claimer_pubkeys = 5; */
         for (let i = 0; i < message.claimerPubkeys.length; i++)
             PublicKey.internalBinaryWrite(message.claimerPubkeys[i], writer.tag(5, WireType.LengthDelimited).fork(), options).join();
+        /* int64 created_at = 6; */
+        if (message.createdAt !== 0n)
+            writer.tag(6, WireType.Varint).int64(message.createdAt);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);