Reconnexion/ng-eventually
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(inbox): commentaires alignés sur l'inbox par document

Browse Source 
Deux commentaires de openDocumentInbox décrivaient encore l'adresse publiée à
la création, retirée en 5a7009b. Le critère de refus est la propriété, et la
raison est nommée : ouvrir l'inbox est ce qui PUBLIE l'adresse du document, donc
un non-propriétaire s'y router les dépôts. En amont l'acte équivalent est le
propriétaire qui commite `AddInboxCap` avec la clé du repo — personne d'autre ne
le peut.
This commit is contained in:
Sylvain Duchesne
2026-08-03 16:58:10 +02:00
parent 5a7009bd75
commit fba0128a7e
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/client/src/store-registry.ts
+8 -8
View File
@@ -1126,11 +1126,11 @@ export async function openDocumentInbox(doc: Nuri): Promise<Nuri> {
const known = (await readInboxCapsFor(doc)) ?? null;
if (known) return known;
// OWNERSHIP is the criterion — not "is there an address yet", since every document
// carries one from creation (its owner's inbox). Opening a dedicated inbox REPLACES
// that address, so letting a non-owner do it would redirect the owner's deposits to
// the caller: usurpation, silent, and on a document the caller merely reads.
// Holding a cap is not ownership; a cap can be received.
// OWNERSHIP is the criterion, and holding a cap is NOT ownership — a cap can be
// received. Opening an inbox is what PUBLISHES this document's address, so a
// non-owner doing it would route the owner's deposits to itself, silently, on a
// document it merely reads. Upstream the equivalent act is the owner committing
// `AddInboxCap` with the repo's own key; nobody else can.
if (!(await ownsDocument(doc))) {
throw new Error(
"[ng-eventually] openDocumentInbox: refused — you may only open an inbox on a document " +
@@ -1156,9 +1156,9 @@ export async function openDocumentInbox(doc: Nuri): Promise<Nuri> {
console.error(accessLogPrefix() + " openDocumentInbox persist failed:", error);
}
}
// …and the PUBLIC half, in the document itself, so a depositor finds THIS inbox
// instead of the owner's general one that `createEntityDoc` published. Replacement,
// not addition: one document, one address.
// …and the PUBLIC half, in the document itself, so a depositor can find it at all.
// Without this the inbox is reachable only by its owner — the opposite of what an
// inbox is for, and the bug this path shipped with.
await publishInboxAddress(doc, inbox);
return inbox;
}