@brightchain/brightchain-api-lib 0.14.0 → 0.15.0

package/src/lib/encryption/encryptedMetadataService.js

@@ -0,0 +1,224 @@
+"use strict";
+/**
+ * Encrypted Metadata Service — handles metadata encryption/decryption
+ * for CBL Index entries in encrypted pools.
+ *
+ * Controls which metadata fields remain searchable (unencrypted) based
+ * on pool configuration, encrypts the rest, and enforces query restrictions
+ * on encrypted fields.
+ *
+ * @see Requirements 16.1, 16.2, 16.3, 16.4, 16.5
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptedMetadataService = void 0;
+const brightchain_lib_1 = require("@brightchain/brightchain-lib");
+const errors_1 = require("./errors");
+/**
+ * Fields that are always unencrypted regardless of pool configuration.
+ * These are structural fields required for block lookups, pool scoping,
+ * and basic index operations.
+ *
+ * Block IDs (checksums) are always unencrypted because they are content
+ * hashes of the encrypted data (Requirement 16.2).
+ */
+const ALWAYS_UNENCRYPTED_FIELDS = [
+    '_id',
+    'magnetUrl',
+    'blockId1',
+    'blockId2',
+    'blockSize',
+    'poolId',
+    'createdAt',
+    'sequenceNumber',
+    'visibility',
+    'createdBy',
+];
+/**
+ * Fields that may be encrypted unless explicitly listed as searchable
+ * in the pool configuration (Requirement 16.3).
+ */
+const ENCRYPTABLE_FIELDS = [
+    'metadata.fileName',
+    'metadata.mimeType',
+    'metadata.originalSize',
+    'metadata.tags',
+    'userCollection',
+    'fileId',
+    'versionNumber',
+    'previousVersion',
+];
+class EncryptedMetadataService {
+    constructor(encryptionService, config) {
+        this.encryptionService = encryptionService;
+        this.config = config;
+    }
+    /**
+     * Encrypt non-searchable metadata fields on a CBL index entry.
+     *
+     * Fields listed in ALWAYS_UNENCRYPTED_FIELDS are never encrypted.
+     * Fields listed in ENCRYPTABLE_FIELDS are encrypted unless they appear
+     * in the pool config's searchableMetadataFields.
+     *
+     * Encrypted values are stored as base64 strings in the entry's
+     * `encryptedFields` map, and the original fields are set to undefined.
+     *
+     * @param entry - The CBL index entry to encrypt
+     * @param poolKey - The 32-byte symmetric pool key for AES-256-GCM encryption
+     * @returns A new entry with non-searchable fields encrypted
+     * @see Requirements 16.1, 16.3
+     */
+    async encryptMetadata(entry, poolKey) {
+        if (this.config.mode === brightchain_lib_1.EncryptionMode.None) {
+            return { ...entry };
+        }
+        const result = { ...entry };
+        if (result.metadata) {
+            result.metadata = { ...result.metadata };
+        }
+        const encryptedFields = {
+            ...(result.encryptedFields ?? {}),
+        };
+        for (const fieldPath of ENCRYPTABLE_FIELDS) {
+            if (this.isSearchable(fieldPath)) {
+                continue;
+            }
+            const value = this.getFieldValue(result, fieldPath);
+            if (value === undefined) {
+                continue;
+            }
+            const serialized = JSON.stringify(value);
+            const plaintext = new TextEncoder().encode(serialized);
+            const ciphertext = await this.encryptionService.encryptPoolShared(plaintext, poolKey);
+            encryptedFields[fieldPath] = this.uint8ArrayToBase64(ciphertext);
+            this.clearFieldValue(result, fieldPath);
+        }
+        result.encryptedFields = encryptedFields;
+        return result;
+    }
+    /**
+     * Decrypt encrypted metadata fields on a CBL index entry,
+     * restoring original field values from the `encryptedFields` map.
+     *
+     * @param entry - The CBL index entry with encrypted fields
+     * @param poolKey - The 32-byte symmetric pool key for AES-256-GCM decryption
+     * @returns A new entry with all fields decrypted and restored
+     */
+    async decryptMetadata(entry, poolKey) {
+        if (!entry.encryptedFields ||
+            Object.keys(entry.encryptedFields).length === 0) {
+            return { ...entry };
+        }
+        const result = { ...entry };
+        if (result.metadata) {
+            result.metadata = { ...result.metadata };
+        }
+        for (const [fieldPath, base64Ciphertext] of Object.entries(entry.encryptedFields)) {
+            const ciphertext = this.base64ToUint8Array(base64Ciphertext);
+            const plaintext = await this.encryptionService.decryptPoolShared(ciphertext, poolKey);
+            const serialized = new TextDecoder().decode(plaintext);
+            const value = JSON.parse(serialized);
+            this.setFieldValue(result, fieldPath, value);
+        }
+        // Remove the encryptedFields map after decryption
+        delete result.encryptedFields;
+        return result;
+    }
+    /**
+     * Validate that queried fields are searchable (not encrypted).
+     * Throws EncryptedFieldError if any queried field is encrypted.
+     *
+     * @param queryFields - Field names being queried
+     * @throws EncryptedFieldError if a queried field is encrypted
+     * @see Requirement 16.5
+     */
+    validateQuery(queryFields) {
+        const searchable = this.getSearchableFields();
+        for (const field of queryFields) {
+            if (!searchable.includes(field)) {
+                throw new errors_1.EncryptedFieldError(field, searchable);
+            }
+        }
+    }
+    /**
+     * Returns false if the pool has any encryption mode other than None.
+     * Content-based indexing and CBL address extraction are not possible
+     * on encrypted blocks because the block content is opaque.
+     *
+     * @returns Whether content-based indexing is allowed
+     * @see Requirement 16.4
+     */
+    isContentIndexingAllowed() {
+        return this.config.mode === brightchain_lib_1.EncryptionMode.None;
+    }
+    /**
+     * Returns the list of always-unencrypted fields plus the configured
+     * searchable metadata fields.
+     *
+     * @returns All searchable (unencrypted) field names
+     * @see Requirement 16.1
+     */
+    getSearchableFields() {
+        return [
+            ...ALWAYS_UNENCRYPTED_FIELDS,
+            ...this.config.searchableMetadataFields,
+        ];
+    }
+    // ─── Private Helpers ────────────────────────────────────────────────
+    /**
+     * Check if a field path is searchable (always unencrypted or in config).
+     */
+    isSearchable(fieldPath) {
+        return (ALWAYS_UNENCRYPTED_FIELDS.includes(fieldPath) ||
+            this.config.searchableMetadataFields.includes(fieldPath));
+    }
+    /**
+     * Get a field value from an entry by dot-notation path.
+     */
+    getFieldValue(entry, fieldPath) {
+        const parts = fieldPath.split('.');
+        if (parts.length === 1) {
+            return entry[fieldPath];
+        }
+        if (parts.length === 2 && parts[0] === 'metadata' && entry.metadata) {
+            return entry.metadata[parts[1]];
+        }
+        return undefined;
+    }
+    /**
+     * Clear a field value on an entry by dot-notation path (set to undefined).
+     */
+    clearFieldValue(entry, fieldPath) {
+        const parts = fieldPath.split('.');
+        if (parts.length === 1) {
+            Reflect.deleteProperty(entry, fieldPath);
+        }
+        else if (parts.length === 2 &&
+            parts[0] === 'metadata' &&
+            entry.metadata) {
+            Reflect.deleteProperty(entry.metadata, parts[1]);
+        }
+    }
+    /**
+     * Set a field value on an entry by dot-notation path.
+     */
+    setFieldValue(entry, fieldPath, value) {
+        const parts = fieldPath.split('.');
+        if (parts.length === 1) {
+            Reflect.set(entry, fieldPath, value);
+        }
+        else if (parts.length === 2 && parts[0] === 'metadata') {
+            if (!entry.metadata) {
+                entry.metadata = {};
+            }
+            Reflect.set(entry.metadata, parts[1], value);
+        }
+    }
+    uint8ArrayToBase64(data) {
+        return Buffer.from(data).toString('base64');
+    }
+    base64ToUint8Array(base64) {
+        return new Uint8Array(Buffer.from(base64, 'base64'));
+    }
+}
+exports.EncryptedMetadataService = EncryptedMetadataService;
+//# sourceMappingURL=encryptedMetadataService.js.map

package/src/lib/encryption/encryptedMetadataService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptedMetadataService.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/encryptedMetadataService.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAMH,kEAA8D;AAC9D,qCAA+C;AAG/C;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAsB;IACnD,KAAK;IACL,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,QAAQ;IACR,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,WAAW;CACH,CAAC;AAEX;;;GAGG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,mBAAmB;IACnB,mBAAmB;IACnB,uBAAuB;IACvB,eAAe;IACf,gBAAgB;IAChB,QAAQ;IACR,eAAe;IACf,iBAAiB;CACT,CAAC;AAEX,MAAa,wBAAwB;IAInC,YACE,iBAAwC,EACxC,MAA6B;QAE7B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,eAAe,CACnB,KAAqB,EACrB,OAAmB;QAEnB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,eAAe,GAA2B;YAC9C,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;SAClC,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAC/D,SAAS,EACT,OAAO,CACR,CAAC;YACF,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAEjE,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,KAAqB,EACrB,OAAmB;QAEnB,IACE,CAAC,KAAK,CAAC,eAAe;YACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAC/C,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAED,KAAK,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CACxD,KAAK,CAAC,eAAe,CACtB,EAAE,CAAC;YACF,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAC9D,UAAU,EACV,OAAO,CACR,CAAC;YACF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAE9C,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,kDAAkD;QAClD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CAAC,WAAqB;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,4BAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,wBAAwB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,IAAI,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB;QACjB,OAAO;YACL,GAAG,yBAAyB;YAC5B,GAAG,IAAI,CAAC,MAAM,CAAC,wBAAwB;SACxC,CAAC;IACJ,CAAC;IAED,uEAAuE;IAEvE;;OAEG;IACK,YAAY,CAAC,SAAiB;QACpC,OAAO,CACL,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,CACzD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAqB,EAAE,SAAiB;QAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,SAAiC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAgC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,KAAqB,EAAE,SAAiB;QAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;aAAM,IACL,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU;YACvB,KAAK,CAAC,QAAQ,EACd,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,KAAqB,EACrB,SAAiB,EACjB,KAAc;QAEd,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACzD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;YACtB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,IAAgB;QACzC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;CACF;AA9ND,4DA8NC"}

package/src/lib/encryption/encryptionAwareReplication.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Encryption-Aware Replication — enforces encryption-mode-based replication rules.
+ *
+ * - Node-specific encryption: replication is NOT allowed (other nodes cannot decrypt)
+ * - Pool-shared encryption: replication is allowed; pool key must be distributed first
+ * - None: replication is allowed with no key management needed
+ *
+ * Also handles FEC parity block encryption for node-specific mode:
+ * parity blocks must be encrypted with the same node key as data blocks.
+ *
+ * @see Requirements 17.1, 17.2, 17.3, 17.4, 17.5
+ */
+import type { IPoolEncryptionConfig } from '@brightchain/brightchain-lib';
+import { EncryptionMode } from '@brightchain/brightchain-lib';
+import { PoolEncryptionService } from './poolEncryptionService';
+import { PoolKeyManager } from './poolKeyManager';
+export declare class EncryptionAwareReplication {
+    private readonly config;
+    private readonly keyManager;
+    private readonly encryptionService;
+    constructor(config: IPoolEncryptionConfig, keyManager: PoolKeyManager, encryptionService: PoolEncryptionService);
+    /**
+     * Whether replication is allowed for this pool's encryption mode.
+     * Returns true for `none` and `pool-shared`, false for `node-specific`.
+     *
+     * @see Requirements 17.1, 17.2
+     */
+    canReplicate(): boolean;
+    /**
+     * Throws ReplicationNotAllowedError if the pool uses node-specific encryption.
+     * Call before initiating any replication operation.
+     *
+     * @throws ReplicationNotAllowedError if mode is node-specific
+     * @see Requirement 17.1
+     */
+    validateReplication(): void;
+    /**
+     * Prepare a new member to receive replicated blocks by encrypting the
+     * current pool key for them. Only valid for pool-shared mode.
+     *
+     * @param newMemberPublicKey - The new member's secp256k1 public key (33 or 65 bytes)
+     * @returns The current pool key encrypted with the new member's public key (ECIES)
+     * @throws ReplicationNotAllowedError if mode is node-specific
+     * @see Requirement 17.3
+     */
+    prepareNewMember(newMemberPublicKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Whether FEC parity blocks should be encrypted.
+     * True only for node-specific mode, where parity blocks must be
+     * encrypted with the same node key as data blocks.
+     *
+     * @see Requirement 17.5
+     */
+    shouldEncryptParity(): boolean;
+    /**
+     * Encrypt a FEC parity block with the node's public key (ECIES).
+     * Only meaningful for node-specific mode.
+     *
+     * @param parityData - The raw parity block data
+     * @param nodePublicKey - The node's secp256k1 public key (33 or 65 bytes)
+     * @returns The ECIES-encrypted parity block
+     * @see Requirement 17.5
+     */
+    encryptParityBlock(parityData: Uint8Array, nodePublicKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Returns a summary of the replication policy for this pool.
+     *
+     * @see Requirements 17.1, 17.2, 17.3, 17.4
+     */
+    getReplicationPolicy(): {
+        allowed: boolean;
+        mode: EncryptionMode;
+        requiresKeyDistribution: boolean;
+    };
+}
+//# sourceMappingURL=encryptionAwareReplication.d.ts.map

package/src/lib/encryption/encryptionAwareReplication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptionAwareReplication.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/encryptionAwareReplication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAwB;gBAGxD,MAAM,EAAE,qBAAqB,EAC7B,UAAU,EAAE,cAAc,EAC1B,iBAAiB,EAAE,qBAAqB;IAO1C;;;;;OAKG;IACH,YAAY,IAAI,OAAO;IAIvB;;;;;;OAMG;IACH,mBAAmB,IAAI,IAAI;IAM3B;;;;;;;;OAQG;IACG,gBAAgB,CAAC,kBAAkB,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAsC3E;;;;;;OAMG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;;;;;;OAQG;IACG,kBAAkB,CACtB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,UAAU,GACxB,OAAO,CAAC,UAAU,CAAC;IAOtB;;;;OAIG;IACH,oBAAoB,IAAI;QACtB,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,cAAc,CAAC;QACrB,uBAAuB,EAAE,OAAO,CAAC;KAClC;CAOF"}

package/src/lib/encryption/encryptionAwareReplication.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Encryption-Aware Replication — enforces encryption-mode-based replication rules.
+ *
+ * - Node-specific encryption: replication is NOT allowed (other nodes cannot decrypt)
+ * - Pool-shared encryption: replication is allowed; pool key must be distributed first
+ * - None: replication is allowed with no key management needed
+ *
+ * Also handles FEC parity block encryption for node-specific mode:
+ * parity blocks must be encrypted with the same node key as data blocks.
+ *
+ * @see Requirements 17.1, 17.2, 17.3, 17.4, 17.5
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionAwareReplication = void 0;
+const brightchain_lib_1 = require("@brightchain/brightchain-lib");
+const errors_1 = require("./errors");
+class EncryptionAwareReplication {
+    constructor(config, keyManager, encryptionService) {
+        this.config = config;
+        this.keyManager = keyManager;
+        this.encryptionService = encryptionService;
+    }
+    /**
+     * Whether replication is allowed for this pool's encryption mode.
+     * Returns true for `none` and `pool-shared`, false for `node-specific`.
+     *
+     * @see Requirements 17.1, 17.2
+     */
+    canReplicate() {
+        return this.config.mode !== brightchain_lib_1.EncryptionMode.NodeSpecific;
+    }
+    /**
+     * Throws ReplicationNotAllowedError if the pool uses node-specific encryption.
+     * Call before initiating any replication operation.
+     *
+     * @throws ReplicationNotAllowedError if mode is node-specific
+     * @see Requirement 17.1
+     */
+    validateReplication() {
+        if (this.config.mode === brightchain_lib_1.EncryptionMode.NodeSpecific) {
+            throw new errors_1.ReplicationNotAllowedError(this.config.poolId);
+        }
+    }
+    /**
+     * Prepare a new member to receive replicated blocks by encrypting the
+     * current pool key for them. Only valid for pool-shared mode.
+     *
+     * @param newMemberPublicKey - The new member's secp256k1 public key (33 or 65 bytes)
+     * @returns The current pool key encrypted with the new member's public key (ECIES)
+     * @throws ReplicationNotAllowedError if mode is node-specific
+     * @see Requirement 17.3
+     */
+    async prepareNewMember(newMemberPublicKey) {
+        if (this.config.mode === brightchain_lib_1.EncryptionMode.NodeSpecific) {
+            throw new errors_1.ReplicationNotAllowedError(this.config.poolId);
+        }
+        if (this.config.mode === brightchain_lib_1.EncryptionMode.None) {
+            // No key distribution needed for unencrypted pools;
+            // return empty array as a no-op signal
+            return new Uint8Array(0);
+        }
+        // Pool-shared: encrypt the current pool key for the new member
+        // We need to get the raw pool key from the current key version,
+        // then re-encrypt it for the new member via ECIES.
+        const currentVersion = this.config.keyVersions.find((kv) => kv.version === this.config.currentKeyVersion);
+        if (!currentVersion ||
+            !currentVersion.encryptedKeys ||
+            currentVersion.encryptedKeys.length === 0) {
+            // No key material available — pool key hasn't been initialized
+            return new Uint8Array(0);
+        }
+        // Encrypt the pool key for the new member using ECIES
+        // We use encryptKeyForMember which wraps encryptNodeSpecific
+        // The caller is responsible for having the raw pool key available;
+        // here we re-encrypt the first member's encrypted key material
+        // as a proxy. In practice, the caller would pass the decrypted key.
+        return this.encryptionService.encryptKeyForMember(currentVersion.encryptedKeys[0].encryptedKey, newMemberPublicKey);
+    }
+    /**
+     * Whether FEC parity blocks should be encrypted.
+     * True only for node-specific mode, where parity blocks must be
+     * encrypted with the same node key as data blocks.
+     *
+     * @see Requirement 17.5
+     */
+    shouldEncryptParity() {
+        return this.config.mode === brightchain_lib_1.EncryptionMode.NodeSpecific;
+    }
+    /**
+     * Encrypt a FEC parity block with the node's public key (ECIES).
+     * Only meaningful for node-specific mode.
+     *
+     * @param parityData - The raw parity block data
+     * @param nodePublicKey - The node's secp256k1 public key (33 or 65 bytes)
+     * @returns The ECIES-encrypted parity block
+     * @see Requirement 17.5
+     */
+    async encryptParityBlock(parityData, nodePublicKey) {
+        return this.encryptionService.encryptNodeSpecific(parityData, nodePublicKey);
+    }
+    /**
+     * Returns a summary of the replication policy for this pool.
+     *
+     * @see Requirements 17.1, 17.2, 17.3, 17.4
+     */
+    getReplicationPolicy() {
+        return {
+            allowed: this.canReplicate(),
+            mode: this.config.mode,
+            requiresKeyDistribution: this.config.mode === brightchain_lib_1.EncryptionMode.PoolShared,
+        };
+    }
+}
+exports.EncryptionAwareReplication = EncryptionAwareReplication;
+//# sourceMappingURL=encryptionAwareReplication.js.map

package/src/lib/encryption/encryptionAwareReplication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptionAwareReplication.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/encryptionAwareReplication.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAGH,kEAA8D;AAC9D,qCAAsD;AAItD,MAAa,0BAA0B;IAKrC,YACE,MAA6B,EAC7B,UAA0B,EAC1B,iBAAwC;QAExC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,YAAY,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,mCAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,gBAAgB,CAAC,kBAA8B;QACnD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,mCAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,IAAI,EAAE,CAAC;YAC7C,oDAAoD;YACpD,uCAAuC;YACvC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,+DAA+D;QAC/D,gEAAgE;QAChE,mDAAmD;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACjD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,iBAAiB,CACrD,CAAC;QAEF,IACE,CAAC,cAAc;YACf,CAAC,cAAc,CAAC,aAAa;YAC7B,cAAc,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EACzC,CAAC;YACD,+DAA+D;YAC/D,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,sDAAsD;QACtD,6DAA6D;QAC7D,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAC/C,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,EAC5C,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,YAAY,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CACtB,UAAsB,EACtB,aAAyB;QAEzB,OAAO,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAC/C,UAAU,EACV,aAAa,CACd,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,oBAAoB;QAKlB,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gCAAc,CAAC,UAAU;SACxE,CAAC;IACJ,CAAC;CACF;AAnID,gEAmIC"}

package/src/lib/encryption/errors.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Custom error types for pool encryption operations.
+ *
+ * @see Requirements 14.2, 14.3, 14.5
+ */
+/**
+ * Thrown when an encryption operation fails.
+ */
+export declare class EncryptionError extends Error {
+    readonly cause?: Error;
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * Thrown when a decryption operation fails (wrong key, corrupted data, etc.).
+ */
+export declare class DecryptionError extends Error {
+    readonly cause?: Error;
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * Thrown when a requested key version does not exist in the key history.
+ */
+export declare class KeyVersionNotFoundError extends Error {
+    constructor(version: number);
+}
+/**
+ * Thrown when a query targets an encrypted (non-searchable) metadata field.
+ *
+ * @see Requirement 16.5
+ */
+export declare class EncryptedFieldError extends Error {
+    /** The field name that was queried but is encrypted */
+    readonly fieldName: string;
+    /** The pool's searchable metadata fields for reference */
+    readonly searchableFields: string[];
+    constructor(fieldName: string, searchableFields: string[]);
+}
+/**
+ * Thrown when replication is attempted on a pool with node-specific encryption,
+ * which does not support replication because other nodes cannot decrypt the data.
+ *
+ * @see Requirement 17.1
+ */
+export declare class ReplicationNotAllowedError extends Error {
+    /** The pool ID where replication was attempted */
+    readonly poolId: string;
+    constructor(poolId: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/src/lib/encryption/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAQ7C;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAQ7C;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAK5B;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;gBAExB,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE;CAU1D;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM;CAS3B"}

package/src/lib/encryption/errors.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Custom error types for pool encryption operations.
+ *
+ * @see Requirements 14.2, 14.3, 14.5
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReplicationNotAllowedError = exports.EncryptedFieldError = exports.KeyVersionNotFoundError = exports.DecryptionError = exports.EncryptionError = void 0;
+/**
+ * Thrown when an encryption operation fails.
+ */
+class EncryptionError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = 'EncryptionError';
+        if (cause instanceof Error) {
+            this.cause = cause;
+        }
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.EncryptionError = EncryptionError;
+/**
+ * Thrown when a decryption operation fails (wrong key, corrupted data, etc.).
+ */
+class DecryptionError extends Error {
+    constructor(message, cause) {
+        super(message);
+        this.name = 'DecryptionError';
+        if (cause instanceof Error) {
+            this.cause = cause;
+        }
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.DecryptionError = DecryptionError;
+/**
+ * Thrown when a requested key version does not exist in the key history.
+ */
+class KeyVersionNotFoundError extends Error {
+    constructor(version) {
+        super(`Key version ${version} not found in key history`);
+        this.name = 'KeyVersionNotFoundError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.KeyVersionNotFoundError = KeyVersionNotFoundError;
+/**
+ * Thrown when a query targets an encrypted (non-searchable) metadata field.
+ *
+ * @see Requirement 16.5
+ */
+class EncryptedFieldError extends Error {
+    constructor(fieldName, searchableFields) {
+        super(`Field "${fieldName}" is encrypted and not searchable in the current pool configuration. ` +
+            `Searchable fields: ${searchableFields.join(', ')}`);
+        this.name = 'EncryptedFieldError';
+        this.fieldName = fieldName;
+        this.searchableFields = searchableFields;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.EncryptedFieldError = EncryptedFieldError;
+/**
+ * Thrown when replication is attempted on a pool with node-specific encryption,
+ * which does not support replication because other nodes cannot decrypt the data.
+ *
+ * @see Requirement 17.1
+ */
+class ReplicationNotAllowedError extends Error {
+    constructor(poolId) {
+        super(`Replication is not allowed for pool "${poolId}" because it uses node-specific encryption. ` +
+            `Other nodes cannot decrypt node-specific encrypted blocks.`);
+        this.name = 'ReplicationNotAllowedError';
+        this.poolId = poolId;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.ReplicationNotAllowedError = ReplicationNotAllowedError;
+//# sourceMappingURL=errors.js.map

package/src/lib/encryption/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/errors.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;GAEG;AACH,MAAa,eAAgB,SAAQ,KAAK;IAGxC,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAXD,0CAWC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,KAAK;IAGxC,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAXD,0CAWC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,eAAe,OAAO,2BAA2B,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAND,0DAMC;AAED;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IAM5C,YAAY,SAAiB,EAAE,gBAA0B;QACvD,KAAK,CACH,UAAU,SAAS,uEAAuE;YACxF,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAhBD,kDAgBC;AAED;;;;;GAKG;AACH,MAAa,0BAA2B,SAAQ,KAAK;IAInD,YAAY,MAAc;QACxB,KAAK,CACH,wCAAwC,MAAM,8CAA8C;YAC1F,4DAA4D,CAC/D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAbD,gEAaC"}

package/src/lib/encryption/index.d.ts

@@ -0,0 +1,6 @@
+export * from './encryptedMetadataService';
+export * from './encryptionAwareReplication';
+export * from './errors';
+export * from './poolEncryptionService';
+export * from './poolKeyManager';
+//# sourceMappingURL=index.d.ts.map

package/src/lib/encryption/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,UAAU,CAAC;AACzB,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC"}

package/src/lib/encryption/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./encryptedMetadataService"), exports);
+tslib_1.__exportStar(require("./encryptionAwareReplication"), exports);
+tslib_1.__exportStar(require("./errors"), exports);
+tslib_1.__exportStar(require("./poolEncryptionService"), exports);
+tslib_1.__exportStar(require("./poolKeyManager"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/encryption/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/index.ts"],"names":[],"mappings":";;;AAAA,qEAA2C;AAC3C,uEAA6C;AAC7C,mDAAyB;AACzB,kEAAwC;AACxC,2DAAiC"}