@icp-sdk/vetkeys 0.5.0-beta.0 → 0.6.0

package/dist/lib/encrypted_maps.es.js

@@ -1,11 +1,11 @@
-import { T as h, E as f, D as g, a as v } from "./index-BUXhtQhx.mjs";
-import { A as m } from "./actor-4fotMNaR.mjs";
+import { TransportSecretKey as v, EncryptedVetKey as f, DerivedPublicKey as g, DerivedKeyMaterial as m } from "./index.es.js";
+import { A as w } from "./actor-CFYb2LZx.mjs";
 function y(r) {
   return new Promise((e, t) => {
     r.oncomplete = r.onsuccess = () => e(r.result), r.onabort = r.onerror = () => t(r.error);
   });
 }
-function w(r, e) {
+function h(r, e) {
   let t;
   const n = () => {
     if (t)
@@ -14,21 +14,59 @@ function w(r, e) {
     return a.onupgradeneeded = () => a.result.createObjectStore(e), t = y(a), t.then((i) => {
       i.onclose = () => t = void 0;
     }, () => {
+      t = void 0;
     }), t;
   };
   return (a, i) => n().then((s) => i(s.transaction(e, a).objectStore(e)));
 }
-let u;
-function d() {
-  return u || (u = w("keyval-store", "keyval")), u;
+let _;
+function p() {
+  return _ || (_ = h("keyval-store", "keyval")), _;
 }
-function k(r, e = d()) {
+function k(r, e = p()) {
   return e("readonly", (t) => y(t.get(r)));
 }
-function E(r, e, t = d()) {
+function E(r, e, t = p()) {
   return t("readwrite", (n) => (n.put(e, r), y(n.transaction)));
 }
-const V = ({ IDL: r }) => {
+function V(r = p()) {
+  return r("readwrite", (e) => (e.clear(), y(e.transaction)));
+}
+class K {
+  #e = /* @__PURE__ */ new Map();
+  get(e) {
+    return Promise.resolve(this.#e.get(e));
+  }
+  set(e, t) {
+    return this.#e.set(e, t), Promise.resolve();
+  }
+  clear() {
+    return this.#e.clear(), Promise.resolve();
+  }
+}
+class C {
+  #e;
+  /**
+   * @param dbName - IndexedDB database name. Defaults to `"ic-vetkeys"`. This
+   *   is the isolation knob: give each identity its own database name (e.g.
+   *   `` `vetkeys-${principal}` ``) so one identity's persisted keys are never
+   *   served to another. The object store name is fixed, because `idb-keyval`
+   *   supports only a single object store per database.
+   */
+  constructor(e = "ic-vetkeys") {
+    this.#e = h(e, "derived-key-material");
+  }
+  async get(e) {
+    return k(e, this.#e);
+  }
+  async set(e, t) {
+    await E(e, t, this.#e);
+  }
+  async clear() {
+    await V(this.#e);
+  }
+}
+const A = ({ IDL: r }) => {
   const e = r.Record({ inner: r.Vec(r.Nat8) }), t = r.Variant({
     Read: r.Null,
     ReadWrite: r.Null,
@@ -47,7 +85,7 @@ const V = ({ IDL: r }) => {
   }), o = r.Variant({
     Ok: r.Opt(t),
     Err: r.Text
-  }), _ = r.Variant({ Ok: r.Vec(e), Err: r.Text });
+  }), u = r.Variant({ Ok: r.Vec(e), Err: r.Text });
   return r.Service({
     get_accessible_shared_map_names: r.Func(
       [],
@@ -112,7 +150,7 @@ const V = ({ IDL: r }) => {
       [a],
       []
     ),
-    remove_map_values: r.Func([r.Principal, e], [_], []),
+    remove_map_values: r.Func([r.Principal, e], [u], []),
     remove_user: r.Func(
       [r.Principal, e, r.Principal],
       [o],
@@ -125,10 +163,10 @@ const V = ({ IDL: r }) => {
     )
   });
 };
-class U {
+class R {
   actor;
   constructor(e, t) {
-    this.actor = m.createActor(V, {
+    this.actor = w.createActor(A, {
       agent: e,
       canisterId: t
     });
@@ -184,7 +222,7 @@ class U {
     return this.actor.remove_user(e, t, n);
   }
 }
-class F {
+class O {
   /**
    * The client instance for interacting with the EncryptedMaps canister.
    */
@@ -193,18 +231,44 @@ class F {
    * The cached verification key for validating encrypted VetKeys.
    */
   verificationKey = void 0;
+  /**
+   * Cache backing the per-map derived key material handles.
+   */
+  #e;
   /**
    * Creates a new instance of the EncryptedMaps client.
    *
+   * @param canisterClient - The client used to talk to the EncryptedMaps canister.
+   * @param options - Optional configuration.
+   * @param options.cache - Strategy for caching derived key material. Defaults to
+   *   {@link InMemoryDerivedKeyMaterialCache} (in-memory only, never persisted).
+   *   Pass {@link IndexedDbDerivedKeyMaterialCache} to persist across page reloads —
+   *   see the security note in the class description.
+   *
    * @example
    * ```ts
    * import { EncryptedMaps } from "@icp-sdk/vetkeys/encrypted_maps";
    *
    * const encryptedMaps = new EncryptedMaps(encryptedMapsClientInstance);
    * ```
+   *
+   * @example Opt into persistent caching, namespaced per identity
+   * ```ts
+   * import {
+   *     EncryptedMaps,
+   *     IndexedDbDerivedKeyMaterialCache,
+   * } from "@icp-sdk/vetkeys/encrypted_maps";
+   *
+   * const encryptedMaps = new EncryptedMaps(encryptedMapsClientInstance, {
+   *     // Namespace the store per identity so one identity's cached keys are
+   *     // never served to another on the same origin.
+   *     cache: new IndexedDbDerivedKeyMaterialCache(`vetkeys-${myPrincipal}`),
+   * });
+   * // Remember to call encryptedMaps.clearCache() on logout / identity change.
+   * ```
    */
-  constructor(e) {
-    this.canisterClient = e;
+  constructor(e, t) {
+    this.canisterClient = e, this.#e = t?.cache ?? new K();
   }
   /**
    * Retrieves a list of maps that were shared with the user and the user still has access to.
@@ -240,13 +304,13 @@ class F {
     for (const [n, a] of e) {
       const i = Uint8Array.from(n[1].inner), s = [];
       for (const [l, o] of a) {
-        const _ = Uint8Array.from(l.inner), p = await this.decryptFor(
+        const u = Uint8Array.from(l.inner), d = await this.decryptFor(
           n[0],
           i,
-          _,
+          u,
           Uint8Array.from(o.inner)
         );
-        s.push([_, p]);
+        s.push([u, d]);
       }
       t.push([
         [n[0], Uint8Array.from(n[1].inner)],
@@ -268,13 +332,13 @@ class F {
         s,
         l
       ] of n.keyvals) {
-        const o = Uint8Array.from(s.inner), _ = await this.decryptFor(
+        const o = Uint8Array.from(s.inner), u = await this.decryptFor(
           n.map_owner,
           a,
           o,
           Uint8Array.from(l.inner)
         );
-        i.push([o, _]);
+        i.push([o, u]);
       }
       t.push({
         accessControl: n.access_control,
@@ -342,13 +406,13 @@ class F {
       ]);
     const i = new Array();
     for (const [s, l] of n.Ok) {
-      const o = Uint8Array.from(s.inner), _ = await this.decryptFor(
+      const o = Uint8Array.from(s.inner), u = await this.decryptFor(
         e,
         t,
         o,
         Uint8Array.from(l.inner)
       );
-      i.push([o, _]);
+      i.push([o, u]);
     }
     return i;
   }
@@ -567,7 +631,7 @@ class F {
    * @throws Error if the operation fails
    */
   async getDerivedKeyMaterial(e, t) {
-    const n = h.random(), a = await this.canisterClient.get_encrypted_vetkey(
+    const n = v.random(), a = await this.canisterClient.get_encrypted_vetkey(
       e,
       c(t),
       c(n.publicKeyBytes())
@@ -579,10 +643,10 @@ class F {
         e.toUint8Array().length,
         ...e.toUint8Array(),
         ...t
-      ]), o = f.deserialize(i), _ = g.deserialize(s);
+      ]), o = f.deserialize(i), u = g.deserialize(s);
       return await o.decryptAndVerify(
         n,
-        _,
+        u,
         l
       ).asDerivedKeyMaterial();
     }
@@ -623,28 +687,50 @@ class F {
    * @returns Promise resolving to the derived key material
    */
   async getDerivedKeyMaterialOrFetchIfNeeded(e, t) {
-    const n = new Uint8Array(t), a = await k([
-      e.toString(),
-      n
-    ]);
+    const n = M(e, t), a = await this.#e.get(n);
     if (a)
-      return await v.fromCryptoKey(
+      return await m.fromCryptoKey(
         a
       );
     const i = await this.getDerivedKeyMaterial(
       e,
       t
     );
-    return await E(
-      [e.toString(), n],
+    return await this.#e.set(
+      n,
       i.getCryptoKey()
     ), i;
   }
+  /**
+   * Clears all cached derived key material.
+   *
+   * Strongly recommended on logout or whenever the authenticated identity
+   * changes: the cache belongs to a single identity, so clearing it (or
+   * discarding the `EncryptedMaps` instance) prevents one identity's key
+   * material from being served to another, and drops the still-usable
+   * decryption capability that otherwise lingers. This matters most with
+   * {@link IndexedDbDerivedKeyMaterialCache}, where cached key handles persist
+   * across sessions until cleared.
+   */
+  async clearCache() {
+    await this.#e.clear();
+  }
+}
+function M(r, e) {
+  return `${r.toString()}|${F(e)}`;
+}
+function F(r) {
+  let e = "";
+  for (const t of r)
+    e += t.toString(16).padStart(2, "0");
+  return e;
 }
 function c(r) {
   return { inner: r };
 }
 export {
-  U as DefaultEncryptedMapsClient,
-  F as EncryptedMaps
+  R as DefaultEncryptedMapsClient,
+  O as EncryptedMaps,
+  K as InMemoryDerivedKeyMaterialCache,
+  C as IndexedDbDerivedKeyMaterialCache
 };