Uh oh!
There was an error while loading. Please reload this page.
moshpit: publish the allocation log so it can be mirrored - #406
Merged
Conversation
`moshpit_tlds` is a cache and `moshpit_tld_log` is the record. That was
decided when the table was written and then went nowhere, because nothing
could read it: no route, no caller, no way for a second copy of the
registry to exist. "The directory can be mirrored and served by anyone"
was true of the schema and false of the product.
GET /api/moshpit/log?since=&limit= answers the only question a mirror
has -- everything after the last seq it stored -- without the server
holding any state about who is asking. Unauthenticated, because a log
only the operator can read settles nothing: publishing the order is what
lets a claim be checked by someone who does not trust us.
The owning account comes back as a stable digest rather than the user
id, which is the line /api/moshpit/tlds/:tld already draws when it says
"already registered" without saying by whom. Two entries by one owner
are still visibly one owner, and every mirror computes the same value.
tldLog() takes {since, limit} and orders by seq, never by `at` -- two
entries can share a millisecond, and a reader that sorts on the clock
puts them in a different order than the writer did.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>| const workdir = mkdtempSync(path.join(tmpdir(), "moshcode-log-test-")); | ||
| process.env.DATABASE_URL = `file:${path.join(workdir, "test.db")}`; | ||
| process.env.SESSION_SECRET = "test-secret"; |
ThreatCrush Security Scan99 finding(s) HIGH/CRITICAL: 5 | MEDIUM: 42 | LOW: 52
…and 49 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
Uh oh!
There was an error while loading. Please reload this page.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
moshpit_tldsis a cache andmoshpit_tld_logis the record — that distinction is written at the top ofapps/pwa/src/moshpit.mjs, along with the claim that "the directory can be mirrored and served by anyone". It was true of the schema and false of the product:tldLog()had no HTTP route and no caller outside a test, so there was no way to read the order in which names were allocated, and therefore no way for a second copy of the registry to exist.This adds
GET /api/moshpit/log?since=&limit=.What it answers
?since=is a seq and it is exclusive — the last entry a mirror stored. That is the only question a mirror ever asks, and answering it needs the server to remember nothing about who is asking, which is what makes the log mirrorable by anyone rather than by whoever we set up as a replica.nextis a cursor, null when caught up — not an absent field, which a client would reasonably read as "start again".Decisions worth arguing with
/api/moshpit/tlds/:tldalready draws when it answers "already registered" without saying by whom: ownership is public, the account behind it is not. The digest is derived only from the id, so two entries by one owner are still visibly one owner and every mirror computes the same value.seq, never byat. Two entries can share a millisecond. A reader that sorts on the clock puts them in a different order than the writer did — at which point two mirrors disagree about who claimed a name first, which is the one fact this table exists to settle.tldLog()now takes{ since, limit }. PreviouslytldLog(limit); the only callers were two assertions inmoshpit-registry.test.mjsthat pass no argument, so nothing external changes.What this does not do
Nothing is signed and nothing is chained yet. A mirror can now replicate the log, but it still cannot prove the log it received is the log we wrote, and
owner_keyremains a dead column. This is the first of five steps, and deliberately the one with no cryptographic commitments in it — the reserved-name list and the digest scheme should be settled before anything starts signing them, because signatures are what make those choices permanent.Tests
apps/pwa/test/moshpit-log.test.mjs, 7 tests, no credentials anywhere in the file — every call it makes is the call a stranger's mirror makes. The one that matters is "following next from zero replays the log exactly once": it walks the cursor to exhaustion and asserts the result drops nothing, repeats nothing, and agrees on order with the unpaged read.Full
apps/pwasuite: 480 pass, 0 fail, 0 skipped.🤖 Generated with Claude Code