@brightchain/brightchain-api-lib 0.15.0 → 0.17.0

package/src/lib/controllers/api/quorum.js

@@ -118,489 +118,6 @@ function serializeMember(member) {
 class QuorumController extends base_1.BaseController {
     constructor(application) {
         super(application);
-        // === Member Management Handlers ===
-        /**
-         * POST /api/quorum/members
-         * Add a new member to the quorum with generated cryptographic keys.
-         *
-         * Creates a new member with ECIES key pair and adds them to the quorum.
-         * The mnemonic phrase is returned for key recovery - it should be stored
-         * securely by the user as it cannot be retrieved later.
-         *
-         * @param req - Request containing member name and optional metadata
-         * @returns Member details and mnemonic on success
-         *
-         * @example
-         * ```json
-         * // Request
-         * POST /api/quorum/members
-         * {
-         *   "name": "Alice",
-         *   "email": "alice@example.com",
-         *   "role": "admin"
-         * }
-         *
-         * // Response
-         * {
-         *   "message": "Member added successfully",
-         *   "member": {
-         *     "id": "abc123...",
-         *     "publicKey": "04...",
-         *     "metadata": { "name": "Alice", "email": "alice@example.com", "role": "admin" },
-         *     "isActive": true,
-         *     "createdAt": "2025-01-16T10:00:00Z",
-         *     "updatedAt": "2025-01-16T10:00:00Z"
-         *   },
-         *   "mnemonic": "word1 word2 word3..."
-         * }
-         * ```
-         */
-        this.handleAddMember = async (req) => {
-            try {
-                const { name, email, role } = req.body;
-                // Validate required fields
-                if (!name) {
-                    return (0, errorResponse_1.validationError)('Missing required field: name');
-                }
-                // Create a new member with generated keys
-                const eciesService = brightchain_lib_1.ServiceProvider.getInstance().eciesService;
-                const emailString = email
-                    ? new ecies_lib_1.EmailString(email)
-                    : new ecies_lib_1.EmailString(`${name.toLowerCase().replace(/\s+/g, '.')}@placeholder.local`);
-                const memberWithMnemonic = ecies_lib_1.Member.newMember(eciesService, ecies_lib_1.MemberType.User, name, emailString);
-                const metadata = {
-                    name,
-                    email,
-                    role,
-                };
-                const quorumService = this.quorumServiceWrapper.getService();
-                const quorumMember = await quorumService.addMember(memberWithMnemonic.member, metadata);
-                return {
-                    statusCode: 201,
-                    response: {
-                        message: 'Member added successfully',
-                        member: serializeMember(quorumMember),
-                        mnemonic: memberWithMnemonic.mnemonic.value ?? '',
-                    },
-                };
-            }
-            catch (_error) {
-                if (_error instanceof brightchain_lib_1.QuorumError) {
-                    return (0, errorResponse_1.mapQuorumError)(_error);
-                }
-                return (0, errorResponse_1.handleError)(_error);
-            }
-        };
-        /**
-         * GET /api/quorum/members
-         * List all active quorum members.
-         *
-         * Returns all members that are currently active in the quorum.
-         * Inactive (removed) members are not included in the response.
-         *
-         * @param _req - Request (no parameters required)
-         * @returns Array of member objects on success
-         *
-         * @example
-         * ```json
-         * // Request
-         * GET /api/quorum/members
-         *
-         * // Response
-         * {
-         *   "message": "Members retrieved successfully",
-         *   "members": [
-         *     {
-         *       "id": "abc123...",
-         *       "publicKey": "04...",
-         *       "metadata": { "name": "Alice", "role": "admin" },
-         *       "isActive": true,
-         *       "createdAt": "2025-01-16T10:00:00Z",
-         *       "updatedAt": "2025-01-16T10:00:00Z"
-         *     }
-         *   ]
-         * }
-         * ```
-         */
-        this.handleListMembers = async (_req) => {
-            try {
-                const quorumService = this.quorumServiceWrapper.getService();
-                const members = await quorumService.listMembers();
-                return {
-                    statusCode: 200,
-                    response: {
-                        message: 'Members retrieved successfully',
-                        members: members.map(serializeMember),
-                    },
-                };
-            }
-            catch (_error) {
-                if (_error instanceof brightchain_lib_1.QuorumError) {
-                    return (0, errorResponse_1.mapQuorumError)(_error);
-                }
-                return (0, errorResponse_1.handleError)(_error);
-            }
-        };
-        /**
-         * DELETE /api/quorum/members/:memberId
-         * Remove a member from the quorum (deactivate).
-         *
-         * Marks the member as inactive. The member's access to existing documents
-         * they are part of is preserved, but they cannot be added to new documents.
-         *
-         * @param req - Request containing the member ID parameter
-         * @returns Success confirmation on success, or 404 if not found
-         *
-         * @example
-         * ```json
-         * // Request
-         * DELETE /api/quorum/members/abc123...
-         *
-         * // Response
-         * {
-         *   "message": "Member removed successfully",
-         *   "success": true,
-         *   "memberId": "abc123..."
-         * }
-         * ```
-         */
-        this.handleRemoveMember = async (req) => {
-            try {
-                const { memberId } = req.params;
-                if (!memberId) {
-                    return (0, errorResponse_1.validationError)('Missing required parameter: memberId');
-                }
-                const quorumService = this.quorumServiceWrapper.getService();
-                await quorumService.removeMember(memberId);
-                return {
-                    statusCode: 200,
-                    response: {
-                        message: 'Member removed successfully',
-                        success: true,
-                        memberId,
-                    },
-                };
-            }
-            catch (_error) {
-                if (_error instanceof brightchain_lib_1.QuorumError) {
-                    return (0, errorResponse_1.mapQuorumError)(_error);
-                }
-                return (0, errorResponse_1.handleError)(_error);
-            }
-        };
-        // === Document Sealing/Unsealing Handlers ===
-        /**
-         * POST /api/quorum/documents/seal
-         * Seal a document using Shamir's Secret Sharing.
-         *
-         * Encrypts the document with a randomly generated symmetric key, then splits
-         * the key into shares using Shamir's Secret Sharing. Each share is encrypted
-         * with the corresponding member's public key.
-         *
-         * @param req - Request containing document, member IDs, and optional threshold
-         * @returns Document ID and sealing metadata on success
-         *
-         * @example
-         * ```json
-         * // Request
-         * POST /api/quorum/documents/seal
-         * {
-         *   "document": { "secret": "data", "value": 42 },
-         *   "memberIds": ["member1...", "member2...", "member3..."],
-         *   "sharesRequired": 2
-         * }
-         *
-         * // Response
-         * {
-         *   "message": "Document sealed successfully",
-         *   "documentId": "doc123...",
-         *   "memberIds": ["member1...", "member2...", "member3..."],
-         *   "sharesRequired": 2,
-         *   "createdAt": "2025-01-16T10:00:00Z"
-         * }
-         * ```
-         */
-        this.handleSealDocument = async (req) => {
-            try {
-                const { document, memberIds, sharesRequired } = req.body;
-                // Validate required fields
-                if (document === undefined) {
-                    return (0, errorResponse_1.validationError)('Missing required field: document');
-                }
-                if (!memberIds || !Array.isArray(memberIds) || memberIds.length < 2) {
-                    return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INVALID_MEMBER_COUNT, 'At least 2 member IDs are required for sealing');
-                }
-                // Validate threshold if provided
-                if (sharesRequired !== undefined) {
-                    if (sharesRequired < 2) {
-                        return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INVALID_THRESHOLD, 'sharesRequired must be at least 2');
-                    }
-                    if (sharesRequired > memberIds.length) {
-                        return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INVALID_THRESHOLD, 'sharesRequired cannot exceed the number of members');
-                    }
-                }
-                // Get the agent (authenticated member) from session
-                const sessionsController = this.application.getController('sessions');
-                let agent;
-                try {
-                    const sessionMember = sessionsController.getMemberFromSession(req.headers.authorization);
-                    // Cast to GuidV4 member type - the session controller returns a generic Member
-                    agent = sessionMember;
-                }
-                catch {
-                    return (0, errorResponse_1.unauthorizedError)();
-                }
-                if (!agent) {
-                    return (0, errorResponse_1.unauthorizedError)();
-                }
-                const quorumService = this.quorumServiceWrapper.getService();
-                const result = await quorumService.sealDocument(agent, document, memberIds, sharesRequired);
-                return {
-                    statusCode: 201,
-                    response: {
-                        message: 'Document sealed successfully',
-                        documentId: result.documentId,
-                        memberIds: result.memberIds,
-                        sharesRequired: result.sharesRequired,
-                        createdAt: result.createdAt.toISOString(),
-                    },
-                };
-            }
-            catch (_error) {
-                if (_error instanceof brightchain_lib_1.QuorumError) {
-                    return (0, errorResponse_1.mapQuorumError)(_error);
-                }
-                return (0, errorResponse_1.handleError)(_error);
-            }
-        };
-        /**
-         * POST /api/quorum/documents/:documentId/unseal
-         * Unseal a document using member credentials (mnemonics).
-         *
-         * Recovers member private keys from provided mnemonics, then uses them
-         * to decrypt shares and reconstruct the original document.
-         *
-         * Note: This endpoint requires the QuorumService to have the document
-         * loaded in memory. For disk-persisted documents, the full reconstruction
-         * is not yet implemented.
-         *
-         * @param req - Request containing document ID and member credentials
-         * @returns Original document on success
-         *
-         * @example
-         * ```json
-         * // Request
-         * POST /api/quorum/documents/doc123.../unseal
-         * {
-         *   "memberCredentials": [
-         *     { "memberId": "member1...", "mnemonic": "word1 word2 word3..." },
-         *     { "memberId": "member2...", "mnemonic": "word4 word5 word6..." }
-         *   ]
-         * }
-         *
-         * // Response
-         * {
-         *   "message": "Document unsealed successfully",
-         *   "document": { "secret": "data", "value": 42 }
-         * }
-         * ```
-         */
-        this.handleUnsealDocument = async (req) => {
-            try {
-                const { documentId } = req.params;
-                const { memberCredentials } = req
-                    .body;
-                if (!documentId) {
-                    return (0, errorResponse_1.validationError)('Missing required parameter: documentId');
-                }
-                if (!memberCredentials ||
-                    !Array.isArray(memberCredentials) ||
-                    memberCredentials.length === 0) {
-                    return (0, errorResponse_1.validationError)('Missing required field: memberCredentials (array of {memberId, mnemonic})');
-                }
-                // Validate each credential has required fields
-                for (const cred of memberCredentials) {
-                    if (!cred.memberId || !cred.mnemonic) {
-                        return (0, errorResponse_1.validationError)('Each memberCredential must have memberId and mnemonic');
-                    }
-                }
-                const quorumService = this.quorumServiceWrapper.getService();
-                // Check if document exists and if we have enough shares
-                const docInfo = await quorumService.getDocument(documentId);
-                if (!docInfo) {
-                    return (0, errorResponse_1.notFoundError)('Document', documentId);
-                }
-                // Check if provided members can unlock the document
-                const memberIds = memberCredentials.map((c) => c.memberId);
-                const canUnlockResult = await quorumService.canUnlock(documentId, memberIds);
-                if (!canUnlockResult.canUnlock) {
-                    return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INSUFFICIENT_SHARES, `Insufficient shares: provided ${canUnlockResult.sharesProvided}, required ${canUnlockResult.sharesRequired}`);
-                }
-                // Recover members with private keys from mnemonics
-                const eciesService = brightchain_lib_1.ServiceProvider.getInstance().eciesService;
-                const membersWithPrivateKey = [];
-                for (const cred of memberCredentials) {
-                    // Get the stored member info to get their metadata
-                    const storedMember = await quorumService.getMember(cred.memberId);
-                    if (!storedMember) {
-                        return (0, errorResponse_1.notFoundError)('Member', cred.memberId);
-                    }
-                    // Recover wallet from mnemonic - need to wrap string in SecureString
-                    const secureString = new ecies_lib_1.SecureString(cred.mnemonic);
-                    const { wallet } = eciesService.walletAndSeedFromMnemonic(secureString);
-                    const recoveredPublicKey = new Uint8Array(wallet.getPublicKey());
-                    // Verify the recovered public key matches the stored one
-                    if ((0, ecies_lib_1.uint8ArrayToHex)(recoveredPublicKey) !==
-                        (0, ecies_lib_1.uint8ArrayToHex)(storedMember.publicKey)) {
-                        return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.SHARE_DECRYPTION_FAILED, `Mnemonic does not match member ${cred.memberId}`);
-                    }
-                    // Create a member with the recovered private key
-                    const email = storedMember.metadata.email
-                        ? new ecies_lib_1.EmailString(storedMember.metadata.email)
-                        : new ecies_lib_1.EmailString(`${storedMember.metadata.name?.toLowerCase().replace(/\s+/g, '.') ?? 'unknown'}@placeholder.local`);
-                    // Use Member.newMember and then replace the wallet
-                    // This is a workaround since Member constructor may not accept wallet directly
-                    const { member: tempMember } = ecies_lib_1.Member.newMember(eciesService, ecies_lib_1.MemberType.User, storedMember.metadata.name ?? 'Unknown', email);
-                    // Create a member-like object with the recovered wallet's private key
-                    // The unsealDocument method needs members with privateKey access
-                    const recoveredMember = Object.create(tempMember);
-                    Object.defineProperty(recoveredMember, 'privateKey', {
-                        get: () => new Uint8Array(wallet.getPrivateKey()),
-                        configurable: true,
-                    });
-                    Object.defineProperty(recoveredMember, 'publicKey', {
-                        get: () => recoveredPublicKey,
-                        configurable: true,
-                    });
-                    membersWithPrivateKey.push(recoveredMember);
-                }
-                // Unseal the document
-                const unsealedDocument = await quorumService.unsealDocument(documentId, membersWithPrivateKey);
-                return {
-                    statusCode: 200,
-                    response: {
-                        message: 'Document unsealed successfully',
-                        document: unsealedDocument,
-                    },
-                };
-            }
-            catch (_error) {
-                if (_error instanceof brightchain_lib_1.QuorumError) {
-                    return (0, errorResponse_1.mapQuorumError)(_error);
-                }
-                return (0, errorResponse_1.handleError)(_error);
-            }
-        };
-        /**
-         * GET /api/quorum/documents/:documentId
-         * Get metadata for a sealed document.
-         *
-         * Returns information about the document including which members have access
-         * and how many shares are required to unseal it.
-         *
-         * @param req - Request containing the document ID parameter
-         * @returns Document metadata on success, or 404 if not found
-         *
-         * @example
-         * ```json
-         * // Request
-         * GET /api/quorum/documents/doc123...
-         *
-         * // Response
-         * {
-         *   "message": "Document retrieved successfully",
-         *   "document": {
-         *     "id": "doc123...",
-         *     "memberIds": ["member1...", "member2...", "member3..."],
-         *     "sharesRequired": 2,
-         *     "createdAt": "2025-01-16T10:00:00Z",
-         *     "creatorId": "creator..."
-         *   }
-         * }
-         * ```
-         */
-        this.handleGetDocument = async (req) => {
-            try {
-                const { documentId } = req.params;
-                if (!documentId) {
-                    return (0, errorResponse_1.validationError)('Missing required parameter: documentId');
-                }
-                const quorumService = this.quorumServiceWrapper.getService();
-                const document = await quorumService.getDocument(documentId);
-                if (!document) {
-                    return (0, errorResponse_1.notFoundError)('Document', documentId);
-                }
-                return {
-                    statusCode: 200,
-                    response: {
-                        message: 'Document retrieved successfully',
-                        document,
-                    },
-                };
-            }
-            catch (_error) {
-                if (_error instanceof brightchain_lib_1.QuorumError) {
-                    return (0, errorResponse_1.mapQuorumError)(_error);
-                }
-                return (0, errorResponse_1.handleError)(_error);
-            }
-        };
-        /**
-         * GET /api/quorum/documents/:documentId/can-unlock
-         * Check if a set of members can unlock a document.
-         *
-         * Determines whether the provided members have enough shares to meet
-         * the threshold required to unseal the document.
-         *
-         * @param req - Request containing document ID and member IDs query parameter
-         * @returns Unlock status and share count information
-         *
-         * @example
-         * ```json
-         * // Request
-         * GET /api/quorum/documents/doc123.../can-unlock?memberIds=member1,member2
-         *
-         * // Response
-         * {
-         *   "message": "Can-unlock check completed",
-         *   "canUnlock": true,
-         *   "sharesProvided": 2,
-         *   "sharesRequired": 2,
-         *   "missingMembers": ["member3..."]
-         * }
-         * ```
-         */
-        this.handleCanUnlock = async (req) => {
-            try {
-                const { documentId } = req.params;
-                const { memberIds: memberIdsStr } = req
-                    .query;
-                if (!documentId) {
-                    return (0, errorResponse_1.validationError)('Missing required parameter: documentId');
-                }
-                if (!memberIdsStr) {
-                    return (0, errorResponse_1.validationError)('Missing required query parameter: memberIds (comma-separated)');
-                }
-                const memberIds = memberIdsStr
-                    .split(',')
-                    .map((id) => id.trim());
-                const quorumService = this.quorumServiceWrapper.getService();
-                const result = await quorumService.canUnlock(documentId, memberIds);
-                return {
-                    statusCode: 200,
-                    response: {
-                        message: 'Can-unlock check completed',
-                        ...result,
-                    },
-                };
-            }
-            catch (_error) {
-                if (_error instanceof brightchain_lib_1.QuorumError) {
-                    return (0, errorResponse_1.mapQuorumError)(_error);
-                }
-                return (0, errorResponse_1.handleError)(_error);
-            }
-        };
         this.quorumServiceWrapper = new quorum_1.QuorumServiceWrapper(application);
     }
     initRouteDefinitions() {
@@ -653,6 +170,489 @@ class QuorumController extends base_1.BaseController {
             canUnlock: this.handleCanUnlock.bind(this),
         };
     }
+    // === Member Management Handlers ===
+    /**
+     * POST /api/quorum/members
+     * Add a new member to the quorum with generated cryptographic keys.
+     *
+     * Creates a new member with ECIES key pair and adds them to the quorum.
+     * The mnemonic phrase is returned for key recovery - it should be stored
+     * securely by the user as it cannot be retrieved later.
+     *
+     * @param req - Request containing member name and optional metadata
+     * @returns Member details and mnemonic on success
+     *
+     * @example
+     * ```json
+     * // Request
+     * POST /api/quorum/members
+     * {
+     *   "name": "Alice",
+     *   "email": "alice@example.com",
+     *   "role": "admin"
+     * }
+     *
+     * // Response
+     * {
+     *   "message": "Member added successfully",
+     *   "member": {
+     *     "id": "abc123...",
+     *     "publicKey": "04...",
+     *     "metadata": { "name": "Alice", "email": "alice@example.com", "role": "admin" },
+     *     "isActive": true,
+     *     "createdAt": "2025-01-16T10:00:00Z",
+     *     "updatedAt": "2025-01-16T10:00:00Z"
+     *   },
+     *   "mnemonic": "word1 word2 word3..."
+     * }
+     * ```
+     */
+    async handleAddMember(req) {
+        try {
+            const { name, email, role } = req.body;
+            // Validate required fields
+            if (!name) {
+                return (0, errorResponse_1.validationError)('Missing required field: name');
+            }
+            // Create a new member with generated keys
+            const eciesService = brightchain_lib_1.ServiceProvider.getInstance().eciesService;
+            const emailString = email
+                ? new ecies_lib_1.EmailString(email)
+                : new ecies_lib_1.EmailString(`${name.toLowerCase().replace(/\s+/g, '.')}@placeholder.local`);
+            const memberWithMnemonic = ecies_lib_1.Member.newMember(eciesService, ecies_lib_1.MemberType.User, name, emailString);
+            const metadata = {
+                name,
+                email,
+                role,
+            };
+            const quorumService = this.quorumServiceWrapper.getService();
+            const quorumMember = await quorumService.addMember(memberWithMnemonic.member, metadata);
+            return {
+                statusCode: 201,
+                response: {
+                    message: 'Member added successfully',
+                    member: serializeMember(quorumMember),
+                    mnemonic: memberWithMnemonic.mnemonic.value ?? '',
+                },
+            };
+        }
+        catch (_error) {
+            if (_error instanceof brightchain_lib_1.QuorumError) {
+                return (0, errorResponse_1.mapQuorumError)(_error);
+            }
+            return (0, errorResponse_1.handleError)(_error);
+        }
+    }
+    /**
+     * GET /api/quorum/members
+     * List all active quorum members.
+     *
+     * Returns all members that are currently active in the quorum.
+     * Inactive (removed) members are not included in the response.
+     *
+     * @param _req - Request (no parameters required)
+     * @returns Array of member objects on success
+     *
+     * @example
+     * ```json
+     * // Request
+     * GET /api/quorum/members
+     *
+     * // Response
+     * {
+     *   "message": "Members retrieved successfully",
+     *   "members": [
+     *     {
+     *       "id": "abc123...",
+     *       "publicKey": "04...",
+     *       "metadata": { "name": "Alice", "role": "admin" },
+     *       "isActive": true,
+     *       "createdAt": "2025-01-16T10:00:00Z",
+     *       "updatedAt": "2025-01-16T10:00:00Z"
+     *     }
+     *   ]
+     * }
+     * ```
+     */
+    async handleListMembers(_req) {
+        try {
+            const quorumService = this.quorumServiceWrapper.getService();
+            const members = await quorumService.listMembers();
+            return {
+                statusCode: 200,
+                response: {
+                    message: 'Members retrieved successfully',
+                    members: members.map(serializeMember),
+                },
+            };
+        }
+        catch (_error) {
+            if (_error instanceof brightchain_lib_1.QuorumError) {
+                return (0, errorResponse_1.mapQuorumError)(_error);
+            }
+            return (0, errorResponse_1.handleError)(_error);
+        }
+    }
+    /**
+     * DELETE /api/quorum/members/:memberId
+     * Remove a member from the quorum (deactivate).
+     *
+     * Marks the member as inactive. The member's access to existing documents
+     * they are part of is preserved, but they cannot be added to new documents.
+     *
+     * @param req - Request containing the member ID parameter
+     * @returns Success confirmation on success, or 404 if not found
+     *
+     * @example
+     * ```json
+     * // Request
+     * DELETE /api/quorum/members/abc123...
+     *
+     * // Response
+     * {
+     *   "message": "Member removed successfully",
+     *   "success": true,
+     *   "memberId": "abc123..."
+     * }
+     * ```
+     */
+    async handleRemoveMember(req) {
+        try {
+            const { memberId } = req.params;
+            if (!memberId) {
+                return (0, errorResponse_1.validationError)('Missing required parameter: memberId');
+            }
+            const quorumService = this.quorumServiceWrapper.getService();
+            await quorumService.removeMember(memberId);
+            return {
+                statusCode: 200,
+                response: {
+                    message: 'Member removed successfully',
+                    success: true,
+                    memberId,
+                },
+            };
+        }
+        catch (_error) {
+            if (_error instanceof brightchain_lib_1.QuorumError) {
+                return (0, errorResponse_1.mapQuorumError)(_error);
+            }
+            return (0, errorResponse_1.handleError)(_error);
+        }
+    }
+    // === Document Sealing/Unsealing Handlers ===
+    /**
+     * POST /api/quorum/documents/seal
+     * Seal a document using Shamir's Secret Sharing.
+     *
+     * Encrypts the document with a randomly generated symmetric key, then splits
+     * the key into shares using Shamir's Secret Sharing. Each share is encrypted
+     * with the corresponding member's public key.
+     *
+     * @param req - Request containing document, member IDs, and optional threshold
+     * @returns Document ID and sealing metadata on success
+     *
+     * @example
+     * ```json
+     * // Request
+     * POST /api/quorum/documents/seal
+     * {
+     *   "document": { "secret": "data", "value": 42 },
+     *   "memberIds": ["member1...", "member2...", "member3..."],
+     *   "sharesRequired": 2
+     * }
+     *
+     * // Response
+     * {
+     *   "message": "Document sealed successfully",
+     *   "documentId": "doc123...",
+     *   "memberIds": ["member1...", "member2...", "member3..."],
+     *   "sharesRequired": 2,
+     *   "createdAt": "2025-01-16T10:00:00Z"
+     * }
+     * ```
+     */
+    async handleSealDocument(req) {
+        try {
+            const { document, memberIds, sharesRequired } = req.body;
+            // Validate required fields
+            if (document === undefined) {
+                return (0, errorResponse_1.validationError)('Missing required field: document');
+            }
+            if (!memberIds || !Array.isArray(memberIds) || memberIds.length < 2) {
+                return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INVALID_MEMBER_COUNT, 'At least 2 member IDs are required for sealing');
+            }
+            // Validate threshold if provided
+            if (sharesRequired !== undefined) {
+                if (sharesRequired < 2) {
+                    return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INVALID_THRESHOLD, 'sharesRequired must be at least 2');
+                }
+                if (sharesRequired > memberIds.length) {
+                    return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INVALID_THRESHOLD, 'sharesRequired cannot exceed the number of members');
+                }
+            }
+            // Get the agent (authenticated member) from session
+            const sessionsController = this.application.getController('sessions');
+            let agent;
+            try {
+                const sessionMember = sessionsController.getMemberFromSession(req.headers.authorization);
+                // Cast to GuidV4 member type - the session controller returns a generic Member
+                agent = sessionMember;
+            }
+            catch {
+                return (0, errorResponse_1.unauthorizedError)();
+            }
+            if (!agent) {
+                return (0, errorResponse_1.unauthorizedError)();
+            }
+            const quorumService = this.quorumServiceWrapper.getService();
+            const result = await quorumService.sealDocument(agent, document, memberIds, sharesRequired);
+            return {
+                statusCode: 201,
+                response: {
+                    message: 'Document sealed successfully',
+                    documentId: result.documentId,
+                    memberIds: result.memberIds,
+                    sharesRequired: result.sharesRequired,
+                    createdAt: result.createdAt.toISOString(),
+                },
+            };
+        }
+        catch (_error) {
+            if (_error instanceof brightchain_lib_1.QuorumError) {
+                return (0, errorResponse_1.mapQuorumError)(_error);
+            }
+            return (0, errorResponse_1.handleError)(_error);
+        }
+    }
+    /**
+     * POST /api/quorum/documents/:documentId/unseal
+     * Unseal a document using member credentials (mnemonics).
+     *
+     * Recovers member private keys from provided mnemonics, then uses them
+     * to decrypt shares and reconstruct the original document.
+     *
+     * Note: This endpoint requires the QuorumService to have the document
+     * loaded in memory. For disk-persisted documents, the full reconstruction
+     * is not yet implemented.
+     *
+     * @param req - Request containing document ID and member credentials
+     * @returns Original document on success
+     *
+     * @example
+     * ```json
+     * // Request
+     * POST /api/quorum/documents/doc123.../unseal
+     * {
+     *   "memberCredentials": [
+     *     { "memberId": "member1...", "mnemonic": "word1 word2 word3..." },
+     *     { "memberId": "member2...", "mnemonic": "word4 word5 word6..." }
+     *   ]
+     * }
+     *
+     * // Response
+     * {
+     *   "message": "Document unsealed successfully",
+     *   "document": { "secret": "data", "value": 42 }
+     * }
+     * ```
+     */
+    async handleUnsealDocument(req) {
+        try {
+            const { documentId } = req.params;
+            const { memberCredentials } = req
+                .body;
+            if (!documentId) {
+                return (0, errorResponse_1.validationError)('Missing required parameter: documentId');
+            }
+            if (!memberCredentials ||
+                !Array.isArray(memberCredentials) ||
+                memberCredentials.length === 0) {
+                return (0, errorResponse_1.validationError)('Missing required field: memberCredentials (array of {memberId, mnemonic})');
+            }
+            // Validate each credential has required fields
+            for (const cred of memberCredentials) {
+                if (!cred.memberId || !cred.mnemonic) {
+                    return (0, errorResponse_1.validationError)('Each memberCredential must have memberId and mnemonic');
+                }
+            }
+            const quorumService = this.quorumServiceWrapper.getService();
+            // Check if document exists and if we have enough shares
+            const docInfo = await quorumService.getDocument(documentId);
+            if (!docInfo) {
+                return (0, errorResponse_1.notFoundError)('Document', documentId);
+            }
+            // Check if provided members can unlock the document
+            const memberIds = memberCredentials.map((c) => c.memberId);
+            const canUnlockResult = await quorumService.canUnlock(documentId, memberIds);
+            if (!canUnlockResult.canUnlock) {
+                return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.INSUFFICIENT_SHARES, `Insufficient shares: provided ${canUnlockResult.sharesProvided}, required ${canUnlockResult.sharesRequired}`);
+            }
+            // Recover members with private keys from mnemonics
+            const eciesService = brightchain_lib_1.ServiceProvider.getInstance().eciesService;
+            const membersWithPrivateKey = [];
+            for (const cred of memberCredentials) {
+                // Get the stored member info to get their metadata
+                const storedMember = await quorumService.getMember(cred.memberId);
+                if (!storedMember) {
+                    return (0, errorResponse_1.notFoundError)('Member', cred.memberId);
+                }
+                // Recover wallet from mnemonic - need to wrap string in SecureString
+                const secureString = new ecies_lib_1.SecureString(cred.mnemonic);
+                const { wallet } = eciesService.walletAndSeedFromMnemonic(secureString);
+                const recoveredPublicKey = new Uint8Array(wallet.getPublicKey());
+                // Verify the recovered public key matches the stored one
+                if ((0, ecies_lib_1.uint8ArrayToHex)(recoveredPublicKey) !==
+                    (0, ecies_lib_1.uint8ArrayToHex)(storedMember.publicKey)) {
+                    return (0, errorResponse_1.createApiErrorResult)(400, errorResponse_1.ErrorCode.SHARE_DECRYPTION_FAILED, `Mnemonic does not match member ${cred.memberId}`);
+                }
+                // Create a member with the recovered private key
+                const email = storedMember.metadata.email
+                    ? new ecies_lib_1.EmailString(storedMember.metadata.email)
+                    : new ecies_lib_1.EmailString(`${storedMember.metadata.name?.toLowerCase().replace(/\s+/g, '.') ?? 'unknown'}@placeholder.local`);
+                // Use Member.newMember and then replace the wallet
+                // This is a workaround since Member constructor may not accept wallet directly
+                const { member: tempMember } = ecies_lib_1.Member.newMember(eciesService, ecies_lib_1.MemberType.User, storedMember.metadata.name ?? 'Unknown', email);
+                // Create a member-like object with the recovered wallet's private key
+                // The unsealDocument method needs members with privateKey access
+                const recoveredMember = Object.create(tempMember);
+                Object.defineProperty(recoveredMember, 'privateKey', {
+                    get: () => new Uint8Array(wallet.getPrivateKey()),
+                    configurable: true,
+                });
+                Object.defineProperty(recoveredMember, 'publicKey', {
+                    get: () => recoveredPublicKey,
+                    configurable: true,
+                });
+                membersWithPrivateKey.push(recoveredMember);
+            }
+            // Unseal the document
+            const unsealedDocument = await quorumService.unsealDocument(documentId, membersWithPrivateKey);
+            return {
+                statusCode: 200,
+                response: {
+                    message: 'Document unsealed successfully',
+                    document: unsealedDocument,
+                },
+            };
+        }
+        catch (_error) {
+            if (_error instanceof brightchain_lib_1.QuorumError) {
+                return (0, errorResponse_1.mapQuorumError)(_error);
+            }
+            return (0, errorResponse_1.handleError)(_error);
+        }
+    }
+    /**
+     * GET /api/quorum/documents/:documentId
+     * Get metadata for a sealed document.
+     *
+     * Returns information about the document including which members have access
+     * and how many shares are required to unseal it.
+     *
+     * @param req - Request containing the document ID parameter
+     * @returns Document metadata on success, or 404 if not found
+     *
+     * @example
+     * ```json
+     * // Request
+     * GET /api/quorum/documents/doc123...
+     *
+     * // Response
+     * {
+     *   "message": "Document retrieved successfully",
+     *   "document": {
+     *     "id": "doc123...",
+     *     "memberIds": ["member1...", "member2...", "member3..."],
+     *     "sharesRequired": 2,
+     *     "createdAt": "2025-01-16T10:00:00Z",
+     *     "creatorId": "creator..."
+     *   }
+     * }
+     * ```
+     */
+    async handleGetDocument(req) {
+        try {
+            const { documentId } = req.params;
+            if (!documentId) {
+                return (0, errorResponse_1.validationError)('Missing required parameter: documentId');
+            }
+            const quorumService = this.quorumServiceWrapper.getService();
+            const document = await quorumService.getDocument(documentId);
+            if (!document) {
+                return (0, errorResponse_1.notFoundError)('Document', documentId);
+            }
+            return {
+                statusCode: 200,
+                response: {
+                    message: 'Document retrieved successfully',
+                    document,
+                },
+            };
+        }
+        catch (_error) {
+            if (_error instanceof brightchain_lib_1.QuorumError) {
+                return (0, errorResponse_1.mapQuorumError)(_error);
+            }
+            return (0, errorResponse_1.handleError)(_error);
+        }
+    }
+    /**
+     * GET /api/quorum/documents/:documentId/can-unlock
+     * Check if a set of members can unlock a document.
+     *
+     * Determines whether the provided members have enough shares to meet
+     * the threshold required to unseal the document.
+     *
+     * @param req - Request containing document ID and member IDs query parameter
+     * @returns Unlock status and share count information
+     *
+     * @example
+     * ```json
+     * // Request
+     * GET /api/quorum/documents/doc123.../can-unlock?memberIds=member1,member2
+     *
+     * // Response
+     * {
+     *   "message": "Can-unlock check completed",
+     *   "canUnlock": true,
+     *   "sharesProvided": 2,
+     *   "sharesRequired": 2,
+     *   "missingMembers": ["member3..."]
+     * }
+     * ```
+     */
+    async handleCanUnlock(req) {
+        try {
+            const { documentId } = req.params;
+            const { memberIds: memberIdsStr } = req
+                .query;
+            if (!documentId) {
+                return (0, errorResponse_1.validationError)('Missing required parameter: documentId');
+            }
+            if (!memberIdsStr) {
+                return (0, errorResponse_1.validationError)('Missing required query parameter: memberIds (comma-separated)');
+            }
+            const memberIds = memberIdsStr
+                .split(',')
+                .map((id) => id.trim());
+            const quorumService = this.quorumServiceWrapper.getService();
+            const result = await quorumService.canUnlock(documentId, memberIds);
+            return {
+                statusCode: 200,
+                response: {
+                    message: 'Can-unlock check completed',
+                    ...result,
+                },
+            };
+        }
+        catch (_error) {
+            if (_error instanceof brightchain_lib_1.QuorumError) {
+                return (0, errorResponse_1.mapQuorumError)(_error);
+            }
+            return (0, errorResponse_1.handleError)(_error);
+        }
+    }
 }
 exports.QuorumController = QuorumController;
 //# sourceMappingURL=quorum.js.map