From fba0128a7e30b47469a2b9f927f40b2d76f9b3b6 Mon Sep 17 00:00:00 2001 From: Sylvain Duchesne Date: Mon, 3 Aug 2026 16:58:10 +0200 Subject: [PATCH] =?UTF-8?q?docs(inbox):=20commentaires=20align=C3=A9s=20su?= =?UTF-8?q?r=20l'inbox=20par=20document?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deux commentaires de openDocumentInbox décrivaient encore l'adresse publiée à la création, retirée en 5a7009b. Le critère de refus est la propriété, et la raison est nommée : ouvrir l'inbox est ce qui PUBLIE l'adresse du document, donc un non-propriétaire s'y router les dépôts. En amont l'acte équivalent est le propriétaire qui commite `AddInboxCap` avec la clé du repo — personne d'autre ne le peut. --- packages/client/src/store-registry.ts | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/packages/client/src/store-registry.ts b/packages/client/src/store-registry.ts index 4862077..ef51b6f 100644 --- a/packages/client/src/store-registry.ts +++ b/packages/client/src/store-registry.ts @@ -1126,11 +1126,11 @@ export async function openDocumentInbox(doc: Nuri): Promise { const known = (await readInboxCapsFor(doc)) ?? null; if (known) return known; - // OWNERSHIP is the criterion — not "is there an address yet", since every document - // carries one from creation (its owner's inbox). Opening a dedicated inbox REPLACES - // that address, so letting a non-owner do it would redirect the owner's deposits to - // the caller: usurpation, silent, and on a document the caller merely reads. - // Holding a cap is not ownership; a cap can be received. + // OWNERSHIP is the criterion, and holding a cap is NOT ownership — a cap can be + // received. Opening an inbox is what PUBLISHES this document's address, so a + // non-owner doing it would route the owner's deposits to itself, silently, on a + // document it merely reads. Upstream the equivalent act is the owner committing + // `AddInboxCap` with the repo's own key; nobody else can. if (!(await ownsDocument(doc))) { throw new Error( "[ng-eventually] openDocumentInbox: refused — you may only open an inbox on a document " + @@ -1156,9 +1156,9 @@ export async function openDocumentInbox(doc: Nuri): Promise { console.error(accessLogPrefix() + " openDocumentInbox persist failed:", error); } } - // …and the PUBLIC half, in the document itself, so a depositor finds THIS inbox - // instead of the owner's general one that `createEntityDoc` published. Replacement, - // not addition: one document, one address. + // …and the PUBLIC half, in the document itself, so a depositor can find it at all. + // Without this the inbox is reachable only by its owner — the opposite of what an + // inbox is for, and the bug this path shipped with. await publishInboxAddress(doc, inbox); return inbox; }