@learncard/lca-api-service 1.3.2 → 1.5.0

package/src/models/SigningAuthority.ts

@@ -2,17 +2,28 @@ import { z } from 'zod';
 
 export const SIGNING_AUTHORITIES_COLLECTION = 'signingauthorities';
 
+/**
+ * Encrypted seeds authenticate _id, ownerDid, name, and did (including an absent did).
+ * Never rename/backfill these fields in place: decrypt using the ORIGINAL identity, then
+ * re-encrypt for the new identity and atomically replace the metadata and envelope together.
+ */
 export const MongoSigningAuthorityValidator = z.object({
     _id: z.string().optional(),
     ownerDid: z.string(),
     name: z.string(),
-    seed: z.string(),
+    // Legacy and prepared migration rows only. New writes use the envelope fields.
+    seed: z.string().optional(),
+    encryptedSeed: z.string().optional(),
+    encryptedDek: z.string().optional(),
+    keyVersion: z.enum(['kms-v1', 'local-v1']).optional(),
     did: z.string().optional(),
     endpoint: z.string().optional(),
 });
 
-export const SigningAuthorityResponseValidator = MongoSigningAuthorityValidator.omit({
-    seed: true,
+export const SigningAuthorityResponseValidator = MongoSigningAuthorityValidator.pick({
+    _id: true,
+    ownerDid: true,
+    name: true,
 }).extend({
     did: z.string(),
     endpoint: z.string(),

package/src/models/UserKey.escrowPin.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it, vi } from 'vitest';
+import { getEscrowPinStatus, type MongoUserKeyType } from './UserKey';
+
+vi.mock('@mongo', () => ({ default: {} }));
+
+describe('getEscrowPinStatus', () => {
+    it('distinguishes an absent PIN from lockout', () => {
+        const userKey = { shareVersion: 1 } as MongoUserKeyType;
+        expect(getEscrowPinStatus(userKey)).toEqual({
+            state: 'none',
+            enabled: false,
+            attemptsRemaining: 0,
+        });
+    });
+
+    it.each(['locked', 'stale'] as const)('reports %s without exposing salt', state => {
+        const userKey = {
+            shareVersion: 1,
+            escrowPin: {
+                salt: 'salt',
+                shareVersion: state === 'stale' ? 2 : 1,
+                failedAttempts: 0,
+                enabledAt: new Date(),
+                ...(state === 'locked' ? { disabledAt: new Date() } : {}),
+            },
+        } as MongoUserKeyType;
+        expect(getEscrowPinStatus(userKey)).toEqual({
+            state,
+            enabled: false,
+            attemptsRemaining: 10,
+        });
+    });
+
+    it.each([0, 9, 10, 11])(
+        'does not label reservations as verified lockout (%i reserved)',
+        failedAttempts => {
+            const userKey = {
+                shareVersion: 1,
+                escrowPin: { salt: 'salt', shareVersion: 1, failedAttempts, enabledAt: new Date() },
+            } as MongoUserKeyType;
+            expect(getEscrowPinStatus(userKey)).toEqual({
+                state: 'enabled',
+                enabled: true,
+                attemptsRemaining: Math.max(0, 10 - failedAttempts),
+                salt: 'salt',
+            });
+        }
+    );
+});