feat(contracts,api): access model v2 P1a - Free mode, artist mode changes, free keys#76
Merged
Conversation
…ree keys Ticket 24 P1, chain + key-service half of the approved v2 pivot: Contracts (artist SmartRuntime pallets): - AccessMode gains Free (=2, appended: storage-safe). Free tracks have no price and no personhood requirement; registration normalizes both to zero. - musicRegSetAccessMode (artist-only, active tracks): change a track's access policy without re-uploading or re-pinning - the ciphertext and CID never change, only the key-release policy. Emits TrackAccessModeChanged. Past Classic buyers keep access through paidAccess across mode flips. - musicAccCanAccess grants Free tracks to everyone; payAccess still rejects non-Classic tracks. New selector routed in ArtistRuntimeFactory. - 8 new hardhat tests (Free registration/normalization/no-payment, mode-flip matrix incl. buyer survival, artist-only guard, policy validation on change, inactive guard + event). 34 passing. ABIs regenerated. Key service: - checkPublicAccess(contentHash): probes musicAccCanAccess with the zero address - true iff the track's CURRENT mode grants access to everyone. Chain-authoritative, fail-closed like checkTrackAccess. - POST /api/tracks/:contentHash/free-key: releases the key for Free tracks with no signature, wallet, or session (free must feel free); covered by the API-wide rate limit. A track flipped back to paid stops being served on the next request. - Denials lose the 42% preview framing (playbackMode/previewRatio retired): a denial is a reason plus an unlock CTA, never a degraded playback mode. Runtime-compatible with the current frontend (it reads only access and contentKey); client types follow in the P1b web PR. - 27 API tests passing (4 new free-key cases), typecheck clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
✅ Deploy Preview for muzinga ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
…deleted The web half of ticket 24 P1, on top of P1a (Free mode contracts + free-key endpoint): Free mode, end to end: - AccessMode gains 'free' in the app types, chain encoding (free=2), publish UI (third "Free for everyone" door + review copy), and catalog/release labels. - Guests probe access with the zero address, so Free tracks resolve playable with no wallet; requestFreeContentKey fetches their key with no signature. Gated tracks keep the signed path unchanged. Preview machinery deleted (the doctrine is retired, not hidden): - useCatalog: 42% slicing, preview cutoff/limit, preview-asset resolution, and the preview branches of fetch/decrypt are gone. Access is binary: authorized plays full, unauthorized gets the unlock gate and no audio. - PlaybackProvider/PersistentAudio/ListenerShell lose the cutoff wiring; playbackModeForAccess removed from accessPolicy; the WAV preview encoders (shared/utils/audio.ts + test) are deleted outright. - Publish no longer generates preview assets (uploadPreviewToBackend gone); the API /api/uploads/preview route and its tests are removed. previewCID stays optional in the manifest schema so already-pinned manifests validate; nothing produces or reads it. - Room hosts without access stream nothing and move the room to a playable track. The room playback-mode wire protocol stays (always 'full') for compatibility; removal is scheduled with the signaling cleanup. - UI copy de-previewed (locked state, unlock CTA, "Free to discover") and the e2e specs rewritten to v2 expectations (classic: locked-not-preview; room-join: no-stream-for-unauthorized-host, manual advance). Playwright not run here - needs a local pass. Docs: threat model (access modes + retired preview boundary), web README access policy, backlog doctrine + ticket rows, ticket 18 retirement note, ticket 24 P1 delivery notes, and docs/index.html positioning (same-PR Pages alignment rule). Web: 90 unit tests, lint 0 errors, build clean. API: 24 tests, typecheck clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
One SIWE-style signature opens a ~24h session; every later key request rides
a bearer token instead of a fresh wallet signature. The token proves identity
only - the on-chain access check still runs per track on every request.
Key service:
- sessionTokens.ts: HMAC-SHA256 tokens over a strict claim shape, key
HKDF-derived from CONTENT_KEY_MASTER_SECRET with a dedicated info label (no
new secret, no shared bytes with content keys), constant-time verify, 24h
TTL, jti revocation (in-memory, process-lifetime - documented boundary).
- signatures.ts: canonical SIGN_IN message + verifySignInRequest (expiry ->
signature -> nonce consumption, same fail-closed order).
- POST /api/auth/session (401 on bad signature, 503 when unconfigured so the
per-request path remains) and idempotent POST /api/auth/logout.
- key-request route accepts {sessionToken, purpose}; the chain check runs
against the token's address, never client input. 13 new tests (37 total).
Web:
- ensureDotifySession: reuse the stored per-address token (refresh margin),
else one sign-in signature; requestContentKey rides the token, retries once
with a fresh sign-in on 401, and falls back to per-request signing when the
backend lacks session support (404/503).
- Wallet disconnect also signs the session out server-side and forgets the
stored token.
Threat model gains the session-auth boundary section; ticket 24 delivery
notes updated. API 37/37 + typecheck; web 90 unit, lint 0 errors, build ok.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat(api,web): access model v2 P2 - sign once, listen freely
feat(web,api): access model v2 P1b - free mode UI, preview machinery deleted
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First implementation slice of the approved v2 design (#75,
docs/design/dotify-v2-access-and-streaming.md, ticket 24). This is the chain + key-service half of P1; the web half (UI modes + preview-machinery deletion) follows as P1b on top.Contracts (artist SmartRuntime pallets)
AccessMode.Free(=2, appended - storage-safe for the enum layout). Free tracks carry no price and no personhood requirement; registration normalizes both to zero.musicRegSetAccessMode(artist-only, active tracks): change a track's access policy without re-uploading or re-pinning - ciphertext and CID never change, only the key-release policy. EmitsTrackAccessModeChanged. Past Classic buyers keep access throughpaidAccessacross mode flips (tested both directions).musicAccCanAccessgrants Free tracks to everyone;musicRoyPayAccessstill rejects non-Classic tracks (no paying for free music by accident).ArtistRuntimeFactory; ABIs regenerated intoweb/src/generated.Key service
checkPublicAccess(contentHash): probesmusicAccCanAccess(hash, address(0))- the zero address is never artist/owner/buyer/verified, so this returns true iff the track's current mode grants access to everyone. No new ABI, chain-authoritative, fail-closed (RPC down / not found / ambiguous -> denied).POST /api/tracks/:contentHash/free-key: releases the content key for Free tracks with no signature, no wallet, no session - free must feel free. Covered by the API-wide rate limit; a track flipped back to paid stops being served on the very next request.playbackMode: 'preview'/previewRatio- a denial is a reason + unlock CTA. Runtime-compatible with the current frontend (it only readsaccess/contentKey); client types update in P1b.Notes for review
contracts/working-tree changes (README, hardhat.config, deploy scripts) are excluded, as in previous PRs.Verification: hardhat 34/34, API 27/27 +
tsc --noEmitclean,web npm run buildclean against the regenerated ABI. ASCII-only additions.🤖 Generated with Claude Code