@arbidocs/client 0.4.4 → 0.4.6

package/dist/index.cjs

@@ -1006,6 +1006,13 @@ async function performLogin(request, signingPrivateKey, deps) {
     accessToken: data.access_token,
     userExtId: data.user.external_id ?? void 0,
     parentExtId: data.user.parent_ext_id ?? null,
+    profile: {
+      givenName: data.user.given_name,
+      familyName: data.user.family_name ?? null,
+      picture: data.user.picture ?? null,
+      email: data.user.email ?? request.email,
+      isSso: data.user.is_sso === true
+    },
     signingPrivateKey,
     serverSessionKey
   };
@@ -1039,6 +1046,106 @@ async function changePassword(params, deps) {
   await updateSigningPrivateKey(credentials.newSigningPrivateKey);
   return { newSigningPrivateKey: credentials.newSigningPrivateKey };
 }
+function passwordChangeErrorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (err && typeof err === "object") {
+    const obj = err;
+    if (typeof obj.detail === "string") return obj.detail;
+    if (typeof obj.message === "string") return obj.message;
+    if (Array.isArray(obj.detail)) {
+      const msgs = obj.detail.map(
+        (d) => d && typeof d.msg === "string" ? d.msg : null
+      ).filter((m) => m !== null);
+      if (msgs.length) return msgs.join("; ");
+    }
+  }
+  return "Failed to change password";
+}
+async function reEncryptDirectMessages(fetchClient, userExtId, oldSecretKey, newSecretKey) {
+  const { data } = await fetchClient.GET("/v1/notifications/");
+  const messages = (data ?? []).filter((n) => n.type === "user_message" && n.content);
+  const oldSecrets = {};
+  const newSecrets = {};
+  const updates = [];
+  for (const n of messages) {
+    try {
+      const other = n.sender.external_id === userExtId ? n.recipient : n.sender;
+      const id = other.external_id;
+      oldSecrets[id] ??= await computeSharedSecret(other.encryption_public_key, oldSecretKey);
+      newSecrets[id] ??= await computeSharedSecret(other.encryption_public_key, newSecretKey);
+      const plain = await decryptMessageWithSharedSecret(n.content, oldSecrets[id]);
+      updates.push({
+        external_id: n.external_id,
+        content: await encryptMessageWithSharedSecret(plain, newSecrets[id])
+      });
+    } catch {
+    }
+  }
+  if (updates.length === 0) return 0;
+  const patched = await fetchClient.PATCH("/v1/notifications/", { body: { updates } });
+  if (!patched.data) throw new Error("Failed to save re-encrypted messages");
+  return updates.length;
+}
+async function changePasswordWithRekey(params, deps) {
+  const session = await getSession();
+  if (!session) throw new Error("No active session found");
+  const { request, newSigningPrivateKey } = params.currentPassword ? await generatePasswordChangeCredentials(
+    params.email,
+    params.currentPassword,
+    params.newPassword,
+    deps.deploymentDomain
+  ) : await generateRecoveryPasswordChangeCredentials(
+    params.email,
+    session.signingPrivateKey,
+    params.newPassword,
+    deps.deploymentDomain
+  );
+  const current = deriveEncryptionKeypairFromSigning({
+    publicKey: session.signingPrivateKey.slice(32, 64),
+    secretKey: session.signingPrivateKey
+  });
+  const next = deriveEncryptionKeypairFromSigning({
+    publicKey: newSigningPrivateKey.slice(32, 64),
+    secretKey: newSigningPrivateKey
+  });
+  const listed = await deps.fetchClient.GET("/v1/user/workspaces");
+  if (!listed.data) throw new Error("Could not list your workspaces");
+  const rewrapped = {};
+  for (const ws of listed.data.filter((w) => w.is_member)) {
+    if (!ws.wrapped_key) continue;
+    try {
+      rewrapped[ws.external_id] = sealedBoxEncrypt(
+        sealedBoxDecrypt(ws.wrapped_key, current.secretKey),
+        next.publicKey
+      );
+    } catch {
+      throw new Error(`Failed to re-wrap workspace key for ${ws.name || ws.external_id}`);
+    }
+  }
+  let messagesReEncrypted = 0;
+  if (params.userExtId) {
+    try {
+      messagesReEncrypted = await reEncryptDirectMessages(
+        deps.fetchClient,
+        params.userExtId,
+        current.secretKey,
+        next.secretKey
+      );
+    } catch {
+    }
+  }
+  const response = await deps.fetchClient.POST("/v1/user/change_password", {
+    body: { ...request, rewrapped_workspace_keys: rewrapped }
+  });
+  if (response.error || !response.data)
+    throw response.error ?? new Error("Failed to change password");
+  await updateSigningPrivateKey(newSigningPrivateKey);
+  return {
+    newSigningPrivateKey,
+    workspacesUpdated: response.data.workspaces_updated ?? 0,
+    messagesReEncrypted
+  };
+}
 
 // src/client.ts
 var API_PREFIX = "/v1";
@@ -1289,6 +1396,7 @@ exports.base64Encode = base64Encode;
 exports.base64ToBytes = base64ToBytes;
 exports.buildWebSocketUrl = buildWebSocketUrl;
 exports.bytesToBase64 = bytesToBase64;
+exports.changePasswordWithRekey = changePasswordWithRekey;
 exports.clearAllData = clearAllData;
 exports.clearSession = clearSession;
 exports.computeSharedSecret = computeSharedSecret;
@@ -1323,6 +1431,7 @@ exports.initSodium = initSodium;
 exports.initializeDatabase = initializeDatabase;
 exports.isMessageType = isMessageType;
 exports.parseServerMessage = parseServerMessage;
+exports.passwordChangeErrorMessage = passwordChangeErrorMessage;
 exports.prewarmKeyPairs = prewarmKeyPairs;
 exports.saveSession = saveSession;
 exports.sealKeyForSession = sealKeyForSession;