Security Model

import { gdb } from 'genosdb'

const db = await gdb('my-secure-db', {
  rtc: true,
  sm: {
    superAdmins: ['0x1234...', '0x5678...']  // Ethereum addresses
  }
})

const db = await gdb('my-app', {
  rtc: true,
  sm: {
    superAdmins: ['0x1234...'],
    customRoles: {
      editor: {
        can: ['write', 'publish'],
        inherits: ['guest']
      },
      moderator: {
        can: ['delete'],
        inherits: ['user']
      }
    }
  }
})

// Assign a role (requires superadmin permission)
await db.sm.assignRole('0xUserAddress...', 'admin')

// Query a user's role
const userRole = await db.sm.getUserRole('0xUserAddress...')
console.log(userRole)  // 'admin'

// Example: User with 'guest' role attempts to write
// SM middleware will reject the operation because 'guest' lacks 'write' permission

// 1. Start new user registration (generates mnemonic)
const { mnemonic, address } = await db.sm.startNewUserRegistration()

console.log('Save this mnemonic securely:', mnemonic)
console.log('Your address:', address)

// 2. Protect the identity with WebAuthn (biometrics/security key)
const protected = await db.sm.protectCurrentIdentityWithWebAuthn(
  '[email protected]'  // Username/identifier
)

if (protected.success) {
  console.log('Identity protected with WebAuthn')
}

// Login using WebAuthn (no password required)
const result = await db.sm.loginCurrentUserWithWebAuthn()

if (result.success) {
  console.log('Logged in as:', result.address)
} else {
  console.error('Login failed:', result.error)
}

// Recover account on a new device
const mnemonic = 'word1 word2 word3 ...'  // User's backup phrase
const result = await db.sm.loginOrRecoverUserWithMnemonic(mnemonic)

if (result.success) {
  console.log('Account recovered:', result.address)
  
  // Re-protect with WebAuthn on the new device
  await db.sm.protectCurrentIdentityWithWebAuthn('[email protected]')
}

const db = await gdb('my-app', {
  rtc: true,
  sm: {
    superAdmins: ['0x1234...'],
    acls: true  // Enable ACL module
  }
})

// Create a node with initial ACL permissions
const nodeId = await db.sm.acls.set(
  { title: 'Private Document', content: '...' },  // Node value
  {
    '0xUserA...': ['read', 'write'],  // UserA can read and write
    '0xUserB...': ['read']            // UserB can only read
  }
)

// Grant write permission to a user
await db.sm.acls.grant(
  nodeId,           // Node ID
  '0xUserC...',     // User address
  ['read', 'write'] // Permissions
)

// Revoke write permission
await db.sm.acls.revoke(
  nodeId,
  '0xUserC...',
  ['write']  // Revoke only write, keep read
)

// User creates a node - becomes owner automatically
const nodeId = await db.put({ type: 'note', text: 'My note' })

// Owner can grant permissions to others
await db.sm.acls.grant(nodeId, '0xOtherUser...', ['read'])

// Store encrypted data (only current user can decrypt)
await db.sm.put({
  secret: 'Sensitive information',
  apiKey: 'sk_1234...'
})

// Retrieve and automatically decrypt (if user is the owner)
const { result } = await db.sm.get(nodeId)

if (result.decrypted) {
  console.log('Decrypted data:', result.value)
} else {
  console.log('Cannot decrypt (not the owner)')
}

// New user creates their profile (allowed once)
await db.put({ name: 'Alice', bio: 'New user' }, 'alice-profile')

// Subsequent writes require proper role assignment
// Superadmin assigns role
await db.sm.assignRole('0xAliceAddress...', 'user')

// Clear current user session
await db.sm.clearSecurity()
console.log('User logged out')

// Get current authenticated user
const currentUser = db.sm.getCurrentUser()

if (currentUser) {
  console.log('Logged in as:', currentUser.address)
} else {
  console.log('No user logged in')
}

const db = await gdb('public-db', {
  rtc: true,
  sm: { superAdmins: ['0x1234...'] }
})

// No user logged in, but SM still enforces security rules
// Incoming operations are verified and applied based on sender's role

import { gdb } from 'genosdb'

// Initialize secure database
const db = await gdb('secure-app', {
  rtc: true,
  sm: {
    superAdmins: ['0xSuperAdmin...'],
    customRoles: {
      editor: { can: ['write', 'publish'], inherits: ['guest'] }
    },
    acls: true
  }
})

// === Registration ===
const { mnemonic, address } = await db.sm.startNewUserRegistration()
console.log('Backup this mnemonic:', mnemonic)

// Protect with WebAuthn
await db.sm.protectCurrentIdentityWithWebAuthn('[email protected]')

// === Superadmin assigns role ===
await db.sm.assignRole(address, 'editor')

// === Create encrypted personal data ===
await db.sm.put({ secret: 'My API key' })

// === Create shared data with ACLs ===
const docId = await db.sm.acls.set(
  { title: 'Team Document', content: '...' },
  {
    '0xTeamMember1...': ['read', 'write'],
    '0xTeamMember2...': ['read']
  }
)

// === Later: Login with WebAuthn ===
const loginResult = await db.sm.loginCurrentUserWithWebAuthn()
if (loginResult.success) {
  console.log('Logged in successfully')
}

// === Logout ===
await db.sm.clearSecurity()