Implement ACL for Topology nodes

packages/blueprints/src/AddWinsSet/index.ts

@@ -6,14 +6,20 @@ import {
 	SemanticsType,
 	type Vertex,
 } from "@topology-foundation/object";
+import { Role } from "../constants.js";
 
 export class AddWinsSet<T> implements CRO {
 	operations: string[] = ["add", "remove"];
 	state: Map<T, boolean>;
+	roles: Map<string, number>;
 	semanticsType = SemanticsType.pair;
 
-	constructor() {
+	constructor(nodeIds: string[] | undefined) {
 		this.state = new Map<T, boolean>();
+		this.roles = new Map<string, number>();
+		for (const nodeId of nodeIds || []) {
+			this.roles.set(nodeId, Role.ADMIN);
+		}
 	}
 
 	private _add(value: T): void {
@@ -74,4 +80,23 @@ export class AddWinsSet<T> implements CRO {
 			}
 		}
 	}
+
+	hasRole(nodeId: string, role: number): boolean {
+		if (!this.roles.has(nodeId)) {
+			return false;
+		}
+		return this.roles.get(nodeId) === role;
+	}
+
+	grantRole(nodeId: string): void {
+		if (!this.roles.has(nodeId) || this.roles.get(nodeId) === Role.NONE) {
+			this.roles.set(nodeId, Role.GUEST);
+		}
+	}
+
+	revokeRole(nodeId: string): void {
+		if (this.roles.has(nodeId)) {
+			this.roles.set(nodeId, Role.NONE);
+		}
+	}
 }

packages/blueprints/src/PseudoRandomWinsSet/index.ts

@@ -8,6 +8,7 @@ import {
 	SemanticsType,
 	type Vertex,
 } from "@topology-foundation/object";
+import { Role } from "../constants.js";
 
 const MOD = 1e9 + 9;
 
@@ -29,10 +30,15 @@ function computeHash(s: string): number {
 export class PseudoRandomWinsSet<T> implements CRO {
 	operations: string[] = ["add", "remove"];
 	state: Map<T, boolean>;
+	roles: Map<string, number>;
 	semanticsType = SemanticsType.multiple;
 
-	constructor() {
+	constructor(nodeIds: string[] | undefined) {
 		this.state = new Map<T, boolean>();
+		this.roles = new Map<string, number>();
+		for (const nodeId of nodeIds || []) {
+			this.roles.set(nodeId, Role.ADMIN);
+		}
 	}
 
 	private _add(value: T): void {
@@ -87,4 +93,23 @@ export class PseudoRandomWinsSet<T> implements CRO {
 			}
 		}
 	}
+
+	hasRole(nodeId: string, role: number): boolean {
+		if (!this.roles.has(nodeId)) {
+			return false;
+		}
+		return this.roles.get(nodeId) === role;
+	}
+
+	grantRole(nodeId: string): void {
+		if (!this.roles.has(nodeId) || this.roles.get(nodeId) === Role.NONE) {
+			this.roles.set(nodeId, Role.GUEST);
+		}
+	}
+
+	revokeRole(nodeId: string): void {
+		if (this.roles.has(nodeId)) {
+			this.roles.set(nodeId, Role.NONE);
+		}
+	}
 }

packages/blueprints/src/constants.ts

@@ -0,0 +1,5 @@
+export enum Role {
+	NONE = 0,
+	GUEST = 1,
+	ADMIN = 2,
+}

packages/node/src/operations.ts

@@ -1,5 +1,7 @@
+import { Role } from "@topology-foundation/blueprints/src/constants.js";
 import { NetworkPb } from "@topology-foundation/network";
-import { ObjectPb, type TopologyObject } from "@topology-foundation/object";
+import { ObjectPb } from "@topology-foundation/object";
+import type { CRO, TopologyObject } from "@topology-foundation/object";
 import {
 	topologyMessagesHandler,
 	topologyObjectChangesHandler,
@@ -19,6 +21,10 @@ enum OPERATIONS {
 	UNSUBSCRIBE = 3,
 	/* Actively send the CRO RIBLT to a random peer */
 	SYNC = 4,
+	/* Grant permission guest to another node */
+	GRANT = 5,
+	/* Revoke permission guest from another node */
+	REVOKE = 6,
 }
 
 export function createObject(node: TopologyNode, object: TopologyObject) {
@@ -82,3 +88,62 @@ export async function syncObject(
 		);
 	}
 }
+
+export async function grantPermission(
+	node: TopologyNode,
+	objectId: string,
+	peerId: string,
+) {
+	const object: TopologyObject | undefined = node.objectStore.get(objectId);
+	if (!object) {
+		console.error("topology::node::grantPermission", "Object not found");
+		return;
+	}
+
+	const cro: CRO | undefined = object.cro as CRO;
+	if (!cro) {
+		console.error("topology::node::grantPermission", "CRO not found");
+		return;
+	}
+	if (!cro.hasRole(node.networkNode.peerId, Role.ADMIN)) {
+		console.error("topology::node::grantPermission", "Not an admin");
+		return;
+	}
+	if (cro.hasRole(peerId, Role.ADMIN)) {
+		console.error("topology::node::grantPermission", "Can't grant admin role");
+		return;
+	}
+
+	cro.grantRole(peerId);
+}
+
+export async function revokePermission(
+	node: TopologyNode,
+	objectId: string,
+	peerId: string,
+) {
+	const object: TopologyObject | undefined = node.objectStore.get(objectId);
+	if (!object) {
+		console.error("topology::node::revokePermission", "Object not found");
+		return;
+	}
+
+	const cro: CRO | undefined = object.cro as CRO;
+	if (!cro) {
+		console.error("topology::node::revokePermission", "CRO not found");
+		return;
+	}
+	if (!cro.hasRole(node.networkNode.peerId, Role.ADMIN)) {
+		console.error("topology::node::revokePermission", "Not an admin");
+		return;
+	}
+	if (cro.hasRole(peerId, Role.ADMIN)) {
+		console.error(
+			"topology::node::revokePermission",
+			"Can't revoke admin role",
+		);
+		return;
+	}
+
+	cro.revokeRole(peerId);
+}

packages/node/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.3.0";
+export const VERSION = "0.3.1";

packages/object/src/index.ts

@@ -10,12 +10,14 @@ import * as ObjectPb from "./proto/topology/object/object_pb.js";
 
 export * as ObjectPb from "./proto/topology/object/object_pb.js";
 export * from "./hashgraph/index.js";
-
 export interface CRO {
 	operations: string[];
 	semanticsType: SemanticsType;
 	resolveConflicts: (vertices: Vertex[]) => ResolveConflictsType;
 	mergeCallback: (operations: Operation[]) => void;
+	hasRole: (nodeId: string, role: number) => boolean;
+	grantRole: (nodeId: string) => void;
+	revokeRole: (nodeId: string) => void;
 }
 
 export type TopologyObjectCallback = (