@glance-apps/sync 1.0.2 → 1.1.0

package/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-05-25
+
+### Added
+
+- `deriveKeyForSalt(salt: Uint8Array): Promise<CryptoKey>` — derives a fresh
+  non-extractable AES-256-GCM key from the cached passphrase and a caller-supplied
+  salt (PBKDF2-SHA-256, 310 000 iterations). Intended as the `deriveKey` callback
+  for `@glance-apps/intents` per-envelope key derivation (Phase 2.6): the intents
+  emitter generates a random salt per envelope, embeds it in the envelope, and
+  calls this to obtain the encryption key; the poller extracts the salt from the
+  envelope and calls this again to obtain the decryption key — enabling cross-app
+  decryption without sharing a per-app session key.
+
+  Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is held in
+  the current session. Note that this guard is on `_sessionPassphrase`, **not** on
+  `hasEncryptionReady()`: after `initSessionKey()` restores a key from device
+  storage the session key is ready but the passphrase is not. Callers that want to
+  gate on passphrase availability should check `getSyncPassphrase() !== null`.
+
+  `getSessionKey()` (added in 1.0.2) is **not removed**; it remains exported for
+  any consumer that wants the cached per-app `CryptoKey` directly.
+
+## [1.0.3] - 2026-05-23
+
+### Fixed
+
+- **Generic WebDAV — `appFolderName` not used in URLs**: `getFileUrl` and
+  `getDirUrl` now insert `appFolderName` between the server root and the sync
+  filename, matching the behaviour of the Nextcloud and Koofr providers.
+  `webdavUrl` is now expected to be a server root (e.g. `https://dav.example.com`)
+  rather than a full folder path. Callers with an existing `webdavUrl` that
+  already includes the folder path should migrate it into `syncFolder`/`appFolderName`
+  and strip the path back to the origin.
+- **Generic WebDAV — Apache 403 on missing parent directories**: `upload` now
+  calls `mkcolWithParents` when PUT returns 403 in addition to 404/409. Apache
+  `mod_dav` returns 403 (not 409) when both the target directory and its parent
+  are absent. The `if (res.status === 403) throw FORBIDDEN` guard that follows
+  still catches genuine auth failures after the retry.
+
 ## [1.0.2] - 2026-05-22
 
 ### Added
@@ -58,5 +97,8 @@ entire sync infrastructure can be shared across the GLANCE app family.
 - TypeScript declarations in `types/index.d.ts`.
 - WebDAV CORS proxy handler in `api/webdav-proxy.js`.
 
-[Unreleased]: https://github.com/glance-apps/glance-sync/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/glance-apps/glance-sync/compare/v1.0.3...HEAD
+[1.0.3]: https://github.com/glance-apps/glance-sync/compare/v1.0.2...v1.0.3
+[1.0.2]: https://github.com/glance-apps/glance-sync/compare/v1.0.1...v1.0.2
+[1.0.1]: https://github.com/glance-apps/glance-sync/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/glance-apps/glance-sync/releases/tag/v1.0.0

package/README.md

@@ -147,7 +147,8 @@ Pass `encryptionEnabled: true` in the sync config object stored via `engine.setC
 | `isEncryptedEnvelope(value)` | Type guard — returns `true` if the value looks like an `EncryptedEnvelope`. |
 | `setSyncPassphrase(p)` / `getSyncPassphrase()` | Store/retrieve the passphrase in session memory (not persisted). |
 | `hasEncryptionReady()` | Returns `true` if the session key is loaded. |
-| `getSessionKey()` | Returns the cached non-extractable `CryptoKey`, or `null` if no key is loaded — intended for sibling packages (e.g., `@glance-apps/intents`) that need to reuse the same key. |
+| `getSessionKey()` | Returns the cached non-extractable `CryptoKey`, or `null` if no key is loaded. |
+| `deriveKeyForSalt(salt)` | Derives a fresh non-extractable AES-256-GCM key from the cached passphrase and a caller-supplied 16-byte salt (PBKDF2-SHA-256, 310 000 iterations). Intended as the `deriveKey` callback for `@glance-apps/intents` per-envelope encryption: pass `sync.deriveKeyForSalt` to `buildEncryptedEnvelope` / `parseEncryptedEnvelope` so each envelope is independently rekeyed. Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is in session — gate on `getSyncPassphrase() !== null` before using it. |
 
 ### Transport & providers
 
@@ -169,7 +170,7 @@ TypeScript declarations for all of the above are in `types/index.d.ts`.
 
 ## Versioning
 
-This package is at **v1.0.0** and follows [Semantic Versioning](https://semver.org/). Breaking changes to the public API or the sync envelope schema will result in a major version bump.
+This package follows [Semantic Versioning](https://semver.org/). Breaking changes to the public API or the sync envelope schema will result in a major version bump.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glance-apps/sync",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "license": "MIT",
   "type": "module",
   "main": "src/index.js",

package/src/crypto.js

@@ -19,6 +19,45 @@ export function getSyncPassphrase()  { return _sessionPassphrase; }
 export function hasEncryptionReady() { return _sessionKey !== null; }
 export function getSessionKey()      { return _sessionKey; }
 
+/**
+ * Derives a fresh AES-256-GCM key from the cached passphrase and the supplied
+ * salt. Intended for per-envelope key derivation in `@glance-apps/intents`:
+ * callers generate a new random salt per envelope, embed it in the envelope,
+ * and call this to get the encryption key — enabling cross-app decryption with
+ * the same passphrase but a fresh salt on every write.
+ *
+ * Uses identical PBKDF2 parameters as the rest of this module (SHA-256,
+ * 310 000 iterations, AES-256-GCM). The returned key is non-extractable because
+ * it is ephemeral and never stored.
+ *
+ * Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is
+ * held in the current session (e.g. after `initSessionKey()` restores from
+ * device storage without the user re-entering their passphrase). Note: this
+ * is a different condition from `hasEncryptionReady()` — callers that want to
+ * gate on passphrase availability should check `getSyncPassphrase() !== null`.
+ *
+ * @param {Uint8Array} salt - 16-byte salt to derive the key from
+ * @returns {Promise<CryptoKey>}
+ */
+export async function deriveKeyForSalt(salt) {
+  if (!_sessionPassphrase) {
+    const err = new Error('Encryption passphrase not available. Please enter your sync passphrase.');
+    err.code = 'PASSPHRASE_REQUIRED';
+    throw err;
+  }
+  const enc         = new TextEncoder();
+  const keyMaterial = await crypto.subtle.importKey(
+    'raw', enc.encode(_sessionPassphrase), 'PBKDF2', false, ['deriveKey']
+  );
+  return crypto.subtle.deriveKey(
+    { name: 'PBKDF2', salt, iterations: 310_000, hash: 'SHA-256' },
+    keyMaterial,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['encrypt', 'decrypt']
+  );
+}
+
 // ---------------------------------------------------------------------------
 // IndexedDB key store
 // ---------------------------------------------------------------------------

package/src/index.js

@@ -17,6 +17,7 @@ export {
   clearEncryptionKey,
   hasEncryptionReady,
   getSessionKey,
+  deriveKeyForSalt,
   isEncryptedEnvelope,
   initSessionKey,
 } from './crypto.js';

package/src/providers.js

@@ -261,9 +261,9 @@ export function createProviders(engineConfig) {
     webdav: {
       name: 'Generic WebDAV',
       getFileUrl: (config) =>
-        `${config.webdavUrl.replace(/\/+$/, '')}/${syncFilename}`,
+        `${config.webdavUrl.replace(/\/+$/, '')}/${appFolderName}/${syncFilename}`,
       getDirUrl: (config) =>
-        `${config.webdavUrl.replace(/\/+$/, '')}/`,
+        `${config.webdavUrl.replace(/\/+$/, '')}/${appFolderName}/`,
       getAuthHeaders: (config) => ({
         'X-WebDAV-Auth': 'Basic ' + toBase64(config.username + ':' + config.appPassword)
       }),
@@ -277,7 +277,7 @@ export function createProviders(engineConfig) {
         if (etag) extraHeaders['If-Match'] = etag;
         const doUpload = () => wf('PUT', fileUrl, authHeaders, body, extraHeaders);
         let res = await doUpload();
-        if (res.status === 404 || res.status === 409) {
+        if (res.status === 404 || res.status === 409 || res.status === 403) {
           await mkcol(dirUrl, authHeaders);
           res = await doUpload();
         }
@@ -307,11 +307,11 @@ export function createProviders(engineConfig) {
         return { success: false, error: `Unexpected response: ${res.status}${res.statusText ? ' ' + res.statusText : ''}` };
       },
       configFields: [
-        { key: 'webdavUrl', label: 'WebDAV URL', type: 'url', placeholder: 'https://dav.example.com/dayGLANCE/' },
+        { key: 'webdavUrl', label: 'WebDAV URL', type: 'url', placeholder: 'https://dav.example.com' },
         { key: 'username', label: 'Username', type: 'text', placeholder: 'your-username' },
         { key: 'appPassword', label: 'Password / App Password', type: 'password', placeholder: 'your-password' }
       ],
-      helpText: 'Enter the full URL of the WebDAV folder where dayGLANCE should store its sync file. pCloud, Seafile, and most self-hosted WebDAV providers are supported.'
+      helpText: 'Enter the server root URL (e.g. https://dav.example.com). The sync folder is configured separately via the Sync Folder setting. pCloud, Seafile, and most self-hosted WebDAV providers are supported.'
     }
   };
 }

package/types/index.d.ts

@@ -156,6 +156,17 @@ export function setSyncPassphrase(passphrase: string | null): void;
 export function getSyncPassphrase(): string | null;
 export function hasEncryptionReady(): boolean;
 export function getSessionKey(): CryptoKey | null;
+/**
+ * Derives a fresh non-extractable AES-256-GCM key from the cached passphrase
+ * and the supplied salt (PBKDF2-SHA-256, 310 000 iterations). Intended for
+ * per-envelope key derivation in `@glance-apps/intents`: pass this function as
+ * the `deriveKey` callback to `buildEncryptedEnvelope` / `parseEncryptedEnvelope`.
+ *
+ * Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is held
+ * in the current session. Gate on `getSyncPassphrase() !== null` (not
+ * `hasEncryptionReady()`) before passing this as a callback.
+ */
+export function deriveKeyForSalt(salt: Uint8Array): Promise<CryptoKey>;
 export function encryptData<T>(data: T, config?: CryptoConfig): Promise<EncryptedEnvelope>;
 export function decryptData<T = unknown>(envelope: EncryptedEnvelope, config?: CryptoConfig): Promise<T>;
 export function isEncryptedEnvelope(value: unknown): value is EncryptedEnvelope;