From 81ade7a400971a3568bbdeff4da0840e173e091d Mon Sep 17 00:00:00 2001
From: Cory McWilliams <cory@unprompted.com>
Date: Sun, 28 Sep 2025 17:19:58 -0400
Subject: [PATCH] core: Make the internal ssb.* API more explicitly not exposed
 to apps.

---
 core/app.js  |  2 +-
 core/core.js | 13 +++++--------
 src/ssb.js.c | 10 +++++++---
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/core/app.js b/core/app.js
index d3f613ff..b697a5d5 100644
--- a/core/app.js
+++ b/core/app.js
@@ -149,7 +149,7 @@ exports.app_socket = async function socket(request, response) {
 								parentApp: parentApp,
 								id: blobId,
 							},
-							await ssb.getIdentityInfo(
+							await ssb_internal.getIdentityInfo(
 								credentials?.session?.name,
 								packageOwner,
 								packageName
diff --git a/core/core.js b/core/core.js
index 3fbd39e4..8376e027 100644
--- a/core/core.js
+++ b/core/core.js
@@ -312,7 +312,7 @@ async function getProcessBlob(blobId, key, options) {
 						{
 							action: 'identities',
 						},
-						await ssb.getIdentityInfo(
+						await ssb_internal.getIdentityInfo(
 							process?.credentials?.session?.name,
 							options?.packageOwner,
 							options?.packageName
@@ -551,9 +551,6 @@ async function getProcessBlob(blobId, key, options) {
 					);
 				}
 			};
-			imports.ssb.addEventListener = undefined;
-			imports.ssb.removeEventListener = undefined;
-			imports.ssb.getIdentityInfo = undefined;
 
 			if (
 				process.credentials &&
@@ -683,19 +680,19 @@ async function getProcessBlob(blobId, key, options) {
 /**
  * SSB message added callback.
  */
-ssb.addEventListener('message', function () {
+ssb_internal.addEventListener('message', function () {
 	broadcastEvent('onMessage', [...arguments]);
 });
 
-ssb.addEventListener('blob', function () {
+ssb_internal.addEventListener('blob', function () {
 	broadcastEvent('onBlob', [...arguments]);
 });
 
-ssb.addEventListener('broadcasts', function () {
+ssb_internal.addEventListener('broadcasts', function () {
 	broadcastEvent('onBroadcastsChanged', []);
 });
 
-ssb.addEventListener('connections', function () {
+ssb_internal.addEventListener('connections', function () {
 	broadcastEvent('onConnectionsChanged', []);
 });
 
diff --git a/src/ssb.js.c b/src/ssb.js.c
index c3cd7f61..84a36951 100644
--- a/src/ssb.js.c
+++ b/src/ssb.js.c
@@ -2370,6 +2370,10 @@ void tf_ssb_register(JSContext* context, tf_ssb_t* ssb)
 	JS_SetPropertyStr(context, global, "ssb", object);
 	JS_SetOpaque(object, ssb);
 
+	JSValue object_internal = JS_NewObjectClass(context, _tf_ssb_classId);
+	JS_SetPropertyStr(context, global, "ssb_internal", object_internal);
+	JS_SetOpaque(object_internal, ssb);
+
 	/* Requires an identity. */
 	JS_SetPropertyStr(context, object, "createIdentity", JS_NewCFunction(context, _tf_ssb_createIdentity, "createIdentity", 1));
 	JS_SetPropertyStr(context, object, "addIdentity", JS_NewCFunction(context, _tf_ssb_addIdentity, "addIdentity", 2));
@@ -2387,7 +2391,6 @@ void tf_ssb_register(JSContext* context, tf_ssb_t* ssb)
 	JS_SetPropertyStr(context, object, "getServerIdentity", JS_NewCFunction(context, _tf_ssb_getServerIdentity, "getServerIdentity", 0));
 	JS_SetPropertyStr(context, object, "getAllIdentities", JS_NewCFunction(context, _tf_ssb_getAllIdentities, "getAllIdentities", 0));
 	JS_SetPropertyStr(context, object, "getActiveIdentity", JS_NewCFunction(context, _tf_ssb_getActiveIdentity, "getActiveIdentity", 3));
-	JS_SetPropertyStr(context, object, "getIdentityInfo", JS_NewCFunction(context, _tf_ssb_getIdentityInfo, "getIdentityInfo", 3));
 	JS_SetPropertyStr(context, object, "blobGet", JS_NewCFunction(context, _tf_ssb_blobGet, "blobGet", 1));
 	JS_SetPropertyStr(context, object, "connections", JS_NewCFunction(context, _tf_ssb_connections, "connections", 0));
 	JS_SetPropertyStr(context, object, "storedConnections", JS_NewCFunction(context, _tf_ssb_storedConnections, "storedConnections", 0));
@@ -2406,8 +2409,9 @@ void tf_ssb_register(JSContext* context, tf_ssb_t* ssb)
 	JS_SetPropertyStr(context, object, "blobStore", JS_NewCFunction(context, _tf_ssb_blobStore, "blobStore", 1));
 
 	/* Trusted only. */
-	JS_SetPropertyStr(context, object, "addEventListener", JS_NewCFunction(context, _tf_ssb_add_event_listener, "addEventListener", 2));
-	JS_SetPropertyStr(context, object, "removeEventListener", JS_NewCFunction(context, _tf_ssb_remove_event_listener, "removeEventListener", 2));
+	JS_SetPropertyStr(context, object_internal, "getIdentityInfo", JS_NewCFunction(context, _tf_ssb_getIdentityInfo, "getIdentityInfo", 3));
+	JS_SetPropertyStr(context, object_internal, "addEventListener", JS_NewCFunction(context, _tf_ssb_add_event_listener, "addEventListener", 2));
+	JS_SetPropertyStr(context, object_internal, "removeEventListener", JS_NewCFunction(context, _tf_ssb_remove_event_listener, "removeEventListener", 2));
 
 	JS_FreeValue(context, global);
 }