Changeset 0261730 in Klonkt

Timestamp:

08/08/2026 04:18:37 PM (4 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

abcf51a

Parents:

66d97b8

Message:

guardianship: §1 is flat in beide richtingen, ook bij accept

Het Offer-pad belet een ward om te offeren (a_ward_cannot_guard), maar het
Accept-pad kende geen spiegelbeeld: een actor die al wards heeft kon een
guardianship-Offer accepteren en werd zo ward én guardian tegelijk. §1 eist
flatheid in beide richtingen.

De fout zou zich bovendien niet melden. actorProps() kiest met een if/else
één rol en publiceert dan shaer:guardians terwijl shaer:isGuardian wegvalt:
lokaal blijven escalaties van de eigen wards binnenkomen, terwijl elke
remote §4-check de actor als malformed leest en laat vallen. Een ward die
denkt bewaakt te zijn en het niet is, stil aan beide kanten.

Alleen de accept van de ward kan die toestand maken, dus de kandidaat en de
bestaande guardians lopen er ongemoeid langs.

721 tests groen. Controleproef gedraaid: zonder de controle wordt de nieuwe
test rood en valt ook 'a guardian leaving sends an Undo (§3.2)' om, doordat
de actor dan werkelijk ward wordt.

Refs shaer-gk2; stable (1.6.0) heeft dezelfde omissie, zie shaer-pmo.

Co-Authored-By: Claude Opus 5 <noreply@…>

Files:

• src/services/guardianship/handshake.js (modified) (1 diff)
• test/guardianship.test.js (modified) (1 diff)

src/services/guardianship/handshake.js

@@ -341 +341 @@
     notify(site.slug, { kind: 'offer_rejected', offer: offerId });
     return { status: 202, id: offerId, url: offerId };
+  }
+
+  // §1 is flat in BOTH directions. The Offer path above bars a ward from
+  // offering to guard; this is the mirror: an actor that already guards wards
+  // must not become a ward itself. Only the ward's own accept can create that
+  // state, so the candidate and the existing guardians pass through untouched.
+  //
+  // Without it the inconsistency would also be invisible. actorProps() picks
+  // one role with an if/else and would publish shaer:guardians while dropping
+  // shaer:isGuardian, so this account keeps routing its wards' escalations
+  // locally while every remote §4 check reads it as malformed and drops it —
+  // a ward believing it is watched over when it is not, silent on both sides.
+  if (me === offer.ward_uri && relations.listWards(site.slug).length) {
+    return { status: 403, error: 'a_guardian_cannot_be_guarded' };
   }
 

test/guardianship.test.js

@@ -119 +119 @@
   assert.equal(r.status, 403);
   assert.equal(r.error, 'a_ward_cannot_guard');
+});
+
+test('a guardian cannot be guarded either: §1 is flat in both directions', async () => {
+  // parent guards kid by now, and gran (a guardian, so free to offer) offers
+  // to guard parent. The offer itself is fine; only parent's accept would
+  // make one actor ward and guardian at once.
+  assert.ok(G.listWards('parent').length, 'parent already guards someone');
+  const off = await G.handleGuardianshipOutbox(gran, {
+    type: 'Offer', object: { type: 'Relationship', subject: ME, relationship: 'shaer:Guardian', object: GRAN },
+  });
+  assert.equal(off.status, 202, 'a guardian may still offer to guard');
+  const id = offerIdFrom(off);
+
+  const r = await G.handleGuardianshipOutbox(parent, { type: 'Accept', object: id });
+  assert.equal(r.status, 403);
+  assert.equal(r.error, 'a_guardian_cannot_be_guarded');
+
+  // Nothing recorded, and the actor document still reads as a pure guardian.
+  // Without the check actorProps() would have flipped it to a ward silently.
+  assert.deepEqual(G.listGuardians('parent'), []);
+  const doc = AP.buildActor('https://test.example', parent);
+  assert.equal(doc['shaer:isGuardian'], true);
+  assert.equal(doc['shaer:guardians'], undefined);
+
+  // The candidate and the existing guardians are untouched by the check, so
+  // the offer is refusable in the ordinary way rather than stuck.
+  await G.handleGuardianshipOutbox(parent, { type: 'Reject', object: id });
 });