feat(core): RevocationCheck implementation and MeshSession revocation-announce plumbing - #66
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
RevocationCheck had no implementation anywhere in the package -- only a hardcoded always-false stub in web-console. createRevocationView returns one keyed by (token-id, issuer) per management.cddl's contract: an entry counts against a token only when both match, so a third party's entry for someone else's token-id is recorded (it is a well-formed, self-certifying entry on its own terms) but never matches a lookup for the token it does not actually govern. record() runs each entry through verifyRevocationEntry first and drops anything that fails rather than storing it. Extracted bytesToHex out of deviceIdToHex since token-id is an arbitrary-length bstr per tokens.cddl, not a 32-byte device-id, so keying the view's map needs a generic byte-string hex encoder rather than a device-id-shaped one.
MeshSession.applyFrame handled relay-data, handshake, gossip, relay-inbound, manage-response and manage-request -- a revocation-announce frame arriving on a session was logged into frameLog and otherwise silently ignored, with no callback or iterator a consumer could subscribe to. There was consequently no way to either send or receive one through MeshSession at all. Added revocationAnnouncements, an async iterable beside incomingManageRequests, flattening a frame's own entries array to one item per entry since each is independently verifiable and independently meaningful regardless of which frame carried it. Added sendRevocationAnnounce beside sendManageRequest, sent directly over the connection since revocation-announce is a gossiped broadcast rather than a request addressed to a specific peer.
Mearman
force-pushed
the
feat/revocation-view
branch
from
September 11, 2026 21:47
039665d to
c12f95e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #59
Two gaps needed together for kick to work end to end:
RevocationCheck (tokens.ts) had no implementation anywhere in the package -- web-console used a hardcoded always-false stub. createRevocationView() returns an in-memory view keyed by (token-id, issuer), fed by verifyRevocationEntry over ingested revocation-announce frames, matching management.cddl's contract that an entry counts only when both token-id and issuer match.
MeshSession.applyFrame handled relay-data, handshake, gossip, relay-inbound, manage-response and manage-request -- a revocation-announce frame arriving on a session was logged into frameLog and otherwise silently ignored, with nothing a consumer could subscribe to. Added revocationAnnouncements (an async iterable beside incomingManageRequests, flattening a frame's entries array to one item per entry) and sendRevocationAnnounce (beside sendManageRequest, sent directly over the connection since this is a gossiped broadcast, not a request addressed to a specific peer).
Extracted bytesToHex out of deviceIdToHex in the same change, since token-id is an arbitrary-length bstr per tokens.cddl rather than a 32-byte device-id, so the revocation view's map key needed a generic byte-string hex encoder.
165 core tests pass (6 new for revocation-view, 2 new for mesh-session's revocation-announce plumbing), Rust conformance suite unaffected (78 passed, no Rust changes -- revocation-announce already had a typed decoder, this only adds TS-side domain logic consuming it).