@keeper-security/keeper-sdk-javascript 0.1.0

package/src/sharing/Sharing.ts

@@ -0,0 +1,282 @@
+import {
+    Auth,
+    Records,
+    Authentication,
+    platform,
+    getPublicKeysMessage,
+    getRecordsDetailsMessage,
+    webSafe64FromBytes,
+    recordsShareUpdateMessage,
+    normal64Bytes,
+} from '@keeper-security/keeperapi'
+import { extractErrorMessage, KeeperSdkError } from '../utils/errors'
+
+enum ShareStatus {
+    Success = 'success',
+    PendingAccept = 'pending_accept',
+    MissingPublicKey = 'missing_public_key',
+    Error = 'error',
+    Unknown = 'unknown',
+}
+
+export type ShareRecordInput = {
+    recordUid: string
+    email: string
+    canEdit?: boolean
+    canShare?: boolean
+}
+
+export type ShareRecordResult = {
+    recordUid: string
+    email: string
+    success: boolean
+    status: string
+    message: string
+}
+
+export type RemoveShareInput = {
+    recordUid: string
+    email: string
+}
+
+export type RemoveShareResult = {
+    recordUid: string
+    email: string
+    success: boolean
+    status: string
+    message: string
+}
+
+type UserKeys = {
+    username: string
+    rsaPublicKey: Uint8Array | null
+    eccPublicKey: Uint8Array | null
+    errorCode: string | null
+}
+
+async function loadUserPublicKey(auth: Auth, email: string): Promise<UserKeys> {
+    const msg = getPublicKeysMessage({ usernames: [email] })
+    let response: Authentication.IGetPublicKeysResponse
+
+    try {
+        response = await auth.executeRest(msg)
+    } catch (err) {
+        throw new KeeperSdkError(`Failed to fetch public key for ${email}: ${extractErrorMessage(err)}`)
+    }
+
+    const keyResponses = response.keyResponses || []
+    if (keyResponses.length === 0) {
+        throw new KeeperSdkError(`No public key returned for ${email}`, 'missing_public_key')
+    }
+
+    const entry = keyResponses[0]
+    if (entry.errorCode) {
+        throw new KeeperSdkError(
+            `Public key lookup failed for ${email}: ${entry.errorCode} - ${entry.message || ''}`,
+            entry.errorCode
+        )
+    }
+
+    return {
+        username: entry.username || email,
+        rsaPublicKey: entry.publicKey && entry.publicKey.length > 0 ? (entry.publicKey as Uint8Array) : null,
+        eccPublicKey: entry.publicEccKey && entry.publicEccKey.length > 0 ? (entry.publicEccKey as Uint8Array) : null,
+        errorCode: entry.errorCode || null,
+    }
+}
+
+export async function shareRecord(
+    auth: Auth,
+    recordKey: Uint8Array,
+    input: ShareRecordInput
+): Promise<ShareRecordResult> {
+    const { recordUid, email, canEdit = false, canShare = false } = input
+
+    const userKeys = await loadUserPublicKey(auth, email)
+
+    let encryptedRecordKey: Uint8Array
+    let useEccKey = false
+
+    if (userKeys.eccPublicKey) {
+        encryptedRecordKey = await platform.publicEncryptEC(recordKey, userKeys.eccPublicKey)
+        useEccKey = true
+    } else if (userKeys.rsaPublicKey) {
+        const rsaKeyBase64 = platform.bytesToBase64(userKeys.rsaPublicKey)
+        encryptedRecordKey = platform.publicEncrypt(recordKey, rsaKeyBase64)
+        useEccKey = false
+    } else {
+        return {
+            recordUid,
+            email,
+            success: false,
+            status: ShareStatus.MissingPublicKey,
+            message: `No usable public key available for ${email}`,
+        }
+    }
+
+    const sharedRecord: Records.ISharedRecord = {
+        toUsername: email,
+        recordUid: normal64Bytes(recordUid),
+        recordKey: encryptedRecordKey,
+        editable: canEdit,
+        shareable: canShare,
+        useEccKey,
+    }
+
+    const msg = recordsShareUpdateMessage({ addSharedRecord: [sharedRecord] })
+
+    let response: Records.IRecordShareUpdateResponse
+    try {
+        response = await auth.executeRest(msg)
+    } catch (err) {
+        return {
+            recordUid,
+            email,
+            success: false,
+            status: ShareStatus.Error,
+            message: extractErrorMessage(err),
+        }
+    }
+
+    const addStatuses = response.addSharedRecordStatus || []
+    if (addStatuses.length > 0) {
+        const st = addStatuses[0]
+        const isSuccess = st.status === ShareStatus.Success || st.status === ShareStatus.PendingAccept
+        return {
+            recordUid,
+            email: st.username || email,
+            success: isSuccess,
+            status: st.status || ShareStatus.Unknown,
+            message: st.message || st.status || '',
+        }
+    }
+
+    return {
+        recordUid,
+        email,
+        success: true,
+        status: ShareStatus.Success,
+        message: 'Record shared successfully',
+    }
+}
+
+export async function removeRecordShare(auth: Auth, input: RemoveShareInput): Promise<RemoveShareResult> {
+    const { recordUid, email } = input
+
+    const msg = recordsShareUpdateMessage({
+        removeSharedRecord: [
+            {
+                toUsername: email,
+                recordUid: normal64Bytes(recordUid),
+            },
+        ],
+    })
+
+    let response: Records.IRecordShareUpdateResponse
+    try {
+        response = await auth.executeRest(msg)
+    } catch (err) {
+        return {
+            recordUid,
+            email,
+            success: false,
+            status: ShareStatus.Error,
+            message: extractErrorMessage(err),
+        }
+    }
+
+    const removeStatuses = response.removeSharedRecordStatus || []
+    if (removeStatuses.length > 0) {
+        const st = removeStatuses[0]
+        return {
+            recordUid,
+            email: st.username || email,
+            success: st.status === ShareStatus.Success,
+            status: st.status || ShareStatus.Unknown,
+            message: st.message || st.status || '',
+        }
+    }
+
+    return {
+        recordUid,
+        email,
+        success: true,
+        status: ShareStatus.Success,
+        message: 'Share removed successfully',
+    }
+}
+
+export type RecordUserPermission = {
+    username: string
+    accountUid?: string
+    owner: boolean
+    shareAdmin: boolean
+    shareable: boolean
+    editable: boolean
+    awaitingApproval: boolean
+    expiration?: number
+}
+
+export type RecordSharedFolderPermission = {
+    sharedFolderUid: string
+    resharable: boolean
+    editable: boolean
+    revision?: number
+    expiration?: number
+}
+
+export type RecordShareInfo = {
+    recordUid: string
+    userPermissions: RecordUserPermission[]
+    sharedFolderPermissions: RecordSharedFolderPermission[]
+}
+
+function bytesToUid(bytes: Uint8Array | null | undefined): string | undefined {
+    return bytes && bytes.length > 0 ? webSafe64FromBytes(bytes) : undefined
+}
+
+function longToNumber(value: number | { toNumber: () => number } | null | undefined): number | undefined {
+    if (value == null) return undefined
+    return typeof value === 'number' ? value : value.toNumber()
+}
+
+export async function getRecordShareInfo(auth: Auth, recordUid: string): Promise<RecordShareInfo | null> {
+    const msg = getRecordsDetailsMessage({
+        clientTime: Date.now(),
+        recordUid: [normal64Bytes(recordUid)],
+        recordDetailsInclude: Records.RecordDetailsInclude.SHARE_ONLY,
+    })
+
+    let response: Records.IGetRecordDataWithAccessInfoResponse
+    try {
+        response = await auth.executeRest(msg)
+    } catch (err) {
+        throw new KeeperSdkError(
+            `Failed to fetch share info for ${recordUid}: ${extractErrorMessage(err)}`
+        )
+    }
+
+    const detail = response.recordDataWithAccessInfo?.[0]
+    if (!detail) return null
+
+    const userPermissions: RecordUserPermission[] = (detail.userPermission ?? []).map((u) => ({
+        username: u.username || '',
+        accountUid: bytesToUid(u.accountUid),
+        owner: !!u.owner,
+        shareAdmin: !!u.shareAdmin,
+        shareable: !!u.sharable,
+        editable: !!u.editable,
+        awaitingApproval: !!u.awaitingApproval,
+        expiration: longToNumber(u.expiration as number | null | undefined),
+    }))
+
+    const sharedFolderPermissions: RecordSharedFolderPermission[] = (detail.sharedFolderPermission ?? []).map((s) => ({
+        sharedFolderUid: bytesToUid(s.sharedFolderUid) ?? '',
+        resharable: !!s.resharable,
+        editable: !!s.editable,
+        revision: longToNumber(s.revision as number | null | undefined),
+        expiration: longToNumber(s.expiration as number | null | undefined),
+    }))
+
+    return { recordUid, userPermissions, sharedFolderPermissions }
+}

package/src/storage/InMemoryStorage.ts

@@ -0,0 +1,163 @@
+import type {
+    VaultStorage,
+    VaultStorageData,
+    VaultStorageKind,
+    VaultStorageResult,
+    Dependency,
+    Dependencies,
+    RemovedDependencies,
+    DRecord,
+} from '@keeper-security/keeperapi'
+import { webSafe64FromBytes } from '@keeper-security/keeperapi'
+import { VaultObjectKind } from '../folders/folderHelpers'
+
+export class InMemoryStorage implements VaultStorage {
+    private keys = new Map<string, Uint8Array>()
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- KeyStorage.saveObject<T> is unconstrained
+    private objects = new Map<string, any>()
+    private store = new Map<string, Map<string, VaultStorageData>>()
+    private dependenciesByParent = new Map<string, Dependency[]>()
+    private arrayCache = new Map<string, VaultStorageData[]>()
+
+    public async getKeyBytes(keyId: string): Promise<Uint8Array | undefined> {
+        return this.keys.get(keyId)
+    }
+
+    public async saveKeyBytes(keyId: string, key: Uint8Array): Promise<void> {
+        this.keys.set(keyId, key)
+    }
+
+    public async getObject<T>(key: string): Promise<T | undefined> {
+        return this.objects.get(key) as T | undefined
+    }
+
+    public async saveObject<T>(key: string, value: T): Promise<void> {
+        this.objects.set(key, value)
+    }
+
+    public async put(item: VaultStorageData): Promise<void> {
+        const kind = item.kind
+        if (!this.store.has(kind)) {
+            this.store.set(kind, new Map())
+        }
+        const uid = this.extractUid(item)
+        this.store.get(kind)!.set(uid, item)
+        this.arrayCache.delete(kind)
+    }
+
+    public async get<T extends VaultStorageKind>(kind: T, uid?: string): Promise<VaultStorageResult<T>> {
+        const kindMap = this.store.get(kind)
+        if (!kindMap) return undefined as VaultStorageResult<T>
+
+        if (uid) {
+            return kindMap.get(uid) as VaultStorageResult<T>
+        }
+        const first = kindMap.values().next()
+        return (first.done ? undefined : first.value) as VaultStorageResult<T>
+    }
+
+    public async delete(kind: VaultStorageKind, uid: string | Uint8Array): Promise<void> {
+        const uidStr = typeof uid === 'string' ? uid : webSafe64FromBytes(uid)
+        this.store.get(kind)?.delete(uidStr)
+        this.arrayCache.delete(kind)
+    }
+
+    public async clear(): Promise<void> {
+        this.store.clear()
+        this.keys.clear()
+        this.objects.clear()
+        this.dependenciesByParent.clear()
+        this.arrayCache.clear()
+    }
+
+    public async getDependencies(uid: string): Promise<Dependency[] | undefined> {
+        return this.dependenciesByParent.get(uid)
+    }
+
+    public async addDependencies(dependencies: Dependencies): Promise<void> {
+        for (const [parentUid, children] of Object.entries(dependencies)) {
+            if (!this.dependenciesByParent.has(parentUid)) {
+                this.dependenciesByParent.set(parentUid, [])
+            }
+            const existing = this.dependenciesByParent.get(parentUid)!
+            const seenChildUids = new Set(existing.map((dependency) => dependency.uid))
+            for (const child of children) {
+                if (!seenChildUids.has(child.uid)) {
+                    existing.push(child)
+                    seenChildUids.add(child.uid)
+                }
+            }
+        }
+    }
+
+    public async removeDependencies(dependencies: RemovedDependencies): Promise<void> {
+        for (const [parentUid, children] of Object.entries(dependencies)) {
+            if (children === '*') {
+                this.dependenciesByParent.delete(parentUid)
+            } else {
+                const existing = this.dependenciesByParent.get(parentUid)
+                if (existing) {
+                    const removeSet = children as Set<string>
+                    this.dependenciesByParent.set(
+                        parentUid,
+                        existing.filter((dependency) => !removeSet.has(dependency.uid))
+                    )
+                }
+            }
+        }
+    }
+
+    public getAll<T extends VaultStorageData>(kind: VaultStorageKind): T[] {
+        const cached = this.arrayCache.get(kind)
+        if (cached) return cached as T[]
+
+        const kindMap = this.store.get(kind)
+        if (!kindMap) return []
+
+        const arr = Array.from(kindMap.values())
+        this.arrayCache.set(kind, arr)
+        return arr as T[]
+    }
+
+    public getRecords(): DRecord[] {
+        return this.getAll<DRecord>(VaultObjectKind.Record)
+    }
+
+    public getByUid<T extends VaultStorageData>(kind: VaultStorageKind, uid: string): T | undefined {
+        return this.store.get(kind)?.get(uid) as T | undefined
+    }
+
+    public getCount(kind: VaultStorageKind): number {
+        return this.store.get(kind)?.size ?? 0
+    }
+
+    private extractUid(item: VaultStorageData): string {
+        const record = item as VaultStorageData & {
+            uid?: string
+            token?: string
+            sharedFolderUid?: string
+            recordUid?: string
+            accountUid?: string | Uint8Array
+            teamUid?: string
+        }
+        const accountUidStr =
+            typeof record.accountUid === 'string'
+                ? record.accountUid
+                : record.accountUid instanceof Uint8Array
+                  ? webSafe64FromBytes(record.accountUid)
+                  : undefined
+        if (record.uid) return record.uid
+        if (record.token) return record.token
+        if (record.sharedFolderUid && record.recordUid) {
+            return `${record.sharedFolderUid}:${record.recordUid}`
+        }
+        if (record.sharedFolderUid && accountUidStr) {
+            return `${record.sharedFolderUid}:${accountUidStr}`
+        }
+        if (record.sharedFolderUid && record.teamUid) {
+            return `${record.sharedFolderUid}:${record.teamUid}`
+        }
+        if (item.kind === VaultObjectKind.User && accountUidStr) return accountUidStr
+        return '_singleton_'
+    }
+}

package/src/teams/TeamManager.ts

@@ -0,0 +1,61 @@
+import type { Auth } from '@keeper-security/keeperapi'
+import { KeeperSdkError, ResultCodes } from '../utils'
+import {
+    formatTeamsTable,
+    listTeams,
+    renderTeamsAsciiTable,
+    type FormatTeamsTableOptions,
+    type FormattedTeamsTable,
+    type ListTeamRow,
+    type ListTeamsOptions,
+} from './listTeams'
+import {
+    formatTeamView,
+    teamViewTable,
+    viewTeam,
+    type FormatTeamViewOptions,
+    type FormattedTeamViewTable,
+    type TeamView,
+} from './viewTeam'
+
+export type AuthProvider = () => Auth
+
+export class TeamManager {
+    private readonly authProvider: AuthProvider
+
+    constructor(authProvider: AuthProvider) {
+        this.authProvider = authProvider
+    }
+
+    public async listTeams(options: ListTeamsOptions = {}): Promise<ListTeamRow[]> {
+        return listTeams(this.requireAuth(), options)
+    }
+
+    public formatTeamsTable(rows: ListTeamRow[], options: FormatTeamsTableOptions = {}): FormattedTeamsTable {
+        return formatTeamsTable(rows, options)
+    }
+
+    public renderTeamsAsciiTable(table: FormattedTeamsTable, options: { minColWidth?: number } = {}): string {
+        return renderTeamsAsciiTable(table, options)
+    }
+
+    public async viewTeam(identifier: string): Promise<TeamView> {
+        return viewTeam(this.requireAuth(), identifier)
+    }
+
+    public formatTeamView(view: TeamView, options: FormatTeamViewOptions = {}): FormattedTeamViewTable {
+        return formatTeamView(view, options)
+    }
+
+    public teamViewTable(table: FormattedTeamViewTable): string {
+        return teamViewTable(table)
+    }
+
+    private requireAuth(): Auth {
+        const auth = this.authProvider()
+        if (!auth) {
+            throw new KeeperSdkError('You are not logged in. Please log in first.', ResultCodes.NOT_LOGGED_IN)
+        }
+        return auth
+    }
+}