devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

fix(dm): ownership transfer divergence after back-and-forth — canonicalize ownerHomeInstance + normalize authority checks

Browse Source 
Manual ownership transfers between two federated instances diverged because
`dm_channels.ownerHomeInstance` was stored as a BARE host (`orbit.ddns.net`)
for federated owners — via `transferGroupDmOwnership` copying `users.homeInstance`
verbatim — while `sourceInstance` always arrives as a full URL on the wire.
`processOwnershipTransferEvent` and `processMemberRemoveEvent` then compared the
two with strict equality and rejected legitimate inbound events as
`unauthorized_source`, keeping ownership permanently divergent across peers.
Live DB inspection on the two test instances confirmed both rows (nova + orbit)
had a BARE `owner_home_instance`, matching the bug report exactly.

Three compounding fixes:

1. Receiver authority checks now compare via `normalizeOriginForCompare` so
   legacy bare-vs-full rows accept legitimate transfers (and kicks).
2. New `canonicalizeHomeInstance` helper in `federationAuth.ts`; every write
   site that persists `ownerHomeInstance` (`transferGroupDmOwnership`, group DM
   creation, lazy federation in member-add, `processMemberAddEvent` bootstrap,
   `processOwnershipTransferEvent` receiver storage) routes through it. Full URL
   is the canonical storage form, matching how `sourceInstance` arrives.
3. `dm_owner_updated` WS event extended with optional `newOwnerHomeUserId` and
   `newOwnerHomeInstance` fields. Client `updateDmOwner` writes them when
   present and leaves existing values untouched otherwise (legacy-server safe).
   Without this, `getOwnerInstanceForDm` returned the previous owner's home
   after a successful WS broadcast, routing the next owner-only op to the wrong
   instance.

Coverage: new `federation.ownershipTransfer.test.ts` (7 receiver tests including
the headline bare-vs-full regression and the dedup replay guard); new bare-vs-full
case in `federation.kick.test.ts`; two new client-side cases in
`groupDm.ownerRouting.test.ts` covering both the extended-payload write path and
the legacy-server passthrough. Tests: 1053 server + 364 web, all green.

Specs updated: `dm-system.md` historical bugs + frontend handler table + WS
state-change events table; `federation.md` `ownership_transfer` receiver flow;
`websocket.md` event-fields table.
This commit is contained in:
Jannis Braun
2026-05-10 22:38:03 +02:00
parent b6842c5590
commit 3c7bb02901
12 changed files with 585 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/shared/src/types.ts
+14 -1
View File
@@ -481,7 +481,20 @@ export type ServerEvent =
| { type: 'federation_approval_request_received'; origin: string; instanceName?: string }
| { type: 'peering_subscription_changed' }
| { type: 'peering_notification_received'; kind: PeeringNotificationKind }
| { type: 'dm_owner_updated'; dmChannelId: string; newOwnerId: string }
| {
type: 'dm_owner_updated';
dmChannelId: string;
newOwnerId: string;
// Federation routing fields. Required for the client to keep
// `dmChannel.ownerHomeInstance` in sync after a transfer — otherwise
// owner-only API calls (`updateMetadata`, `kickMember`, `transferOwnership`)
// continue to route through the previous owner's home instance via
// `getOwnerInstanceForDm` until the user reconnects and receives a fresh
// `ready` payload. Always populated on new emissions; tolerated as
// optional for receivers connected to an older sender.
newOwnerHomeUserId?: string | null;
newOwnerHomeInstance?: string | null;
}
| { type: 'pong' }
| { type: 'error'; message: string };