@arbidocs/client 0.4.30 → 0.4.31

package/dist/index.js

@@ -1025,9 +1025,21 @@ async function changePassword(params, deps) {
     params.newPassword,
     deps.deploymentDomain
   );
+  const stored = await getSession();
+  if (!stored) throw new Error("Sign in to change your password");
+  const current = deriveEncryptionKeypairFromSigning({
+    publicKey: stored.signingPrivateKey.slice(32, 64),
+    secretKey: stored.signingPrivateKey
+  });
+  const next = deriveEncryptionKeypairFromSigning({
+    publicKey: credentials.newSigningPrivateKey.slice(32, 64),
+    secretKey: credentials.newSigningPrivateKey
+  });
+  const mailKeys = await rewrapMailKeys(deps.fetchClient, current.secretKey, next.publicKey);
   const response = await deps.fetchClient.POST("/v1/user/change_password", {
     body: {
       ...credentials.request,
+      ...mailKeys,
       rewrapped_workspace_keys: params.rewrappedWorkspaceKeys ?? {}
     }
   });
@@ -1079,6 +1091,43 @@ async function reEncryptDirectMessages(fetchClient, userExtId, oldSecretKey, new
   if (!patched.data) throw new Error("Failed to save re-encrypted messages");
   return updates.length;
 }
+async function rewrapMailKeys(fetchClient, oldPrivateKey, newPublicKey) {
+  const rewrappedMailKeys = {};
+  let mailCursor = 0;
+  while (mailCursor !== null) {
+    const result = await fetchClient.GET(
+      "/v1/mail/native/keys",
+      {
+        params: { query: { cursor: mailCursor } }
+      }
+    );
+    if (!result.data) throw new Error("Could not load mailbox keys for password change");
+    for (const [id, wrapped] of Object.entries(result.data.keys)) {
+      const key = sealedBoxDecrypt(wrapped, oldPrivateKey);
+      try {
+        rewrappedMailKeys[id] = sealedBoxEncrypt(key, newPublicKey);
+      } finally {
+        key.fill(0);
+      }
+    }
+    mailCursor = result.data.next_cursor ?? null;
+  }
+  const connected = await fetchClient.GET("/v1/mail/native/rotation-credentials");
+  if (!connected.data) throw new Error("Could not load mail connections for password change");
+  const rewrappedMailCredentials = {};
+  for (const [id, wrapped] of Object.entries(connected.data)) {
+    const plain = sealedBoxDecrypt(wrapped, oldPrivateKey);
+    try {
+      rewrappedMailCredentials[id] = sealedBoxEncrypt(plain, newPublicKey);
+    } finally {
+      plain.fill(0);
+    }
+  }
+  return {
+    rewrapped_mail_keys: rewrappedMailKeys,
+    rewrapped_mail_credentials: rewrappedMailCredentials
+  };
+}
 async function changePasswordWithRekey(params, deps) {
   const session = await getSession();
   if (!session) throw new Error("No active session found");
@@ -1127,8 +1176,13 @@ async function changePasswordWithRekey(params, deps) {
     } catch {
     }
   }
+  const mailKeys = await rewrapMailKeys(deps.fetchClient, current.secretKey, next.publicKey);
   const response = await deps.fetchClient.POST("/v1/user/change_password", {
-    body: { ...request, rewrapped_workspace_keys: rewrapped }
+    body: {
+      ...request,
+      rewrapped_workspace_keys: rewrapped,
+      ...mailKeys
+    }
   });
   if (response.error || !response.data)
     throw response.error ?? new Error("Failed to change password");