@mrbelloc/encrypted-store 0.3.0 → 1.3.1

package/dist/encryptedStore.js

@@ -1,338 +1,367 @@
 /**
- * Encrypted storage with change detection for small datasets
- * Wraps Fireproof with AES-256-GCM encryption + real-time event system
+ * Encrypted storage with change detection using PouchDB
+ * Simple API: put, get, delete, loadAll
  */
 import { EncryptionHelper } from "./encryption.js";
-/**
- * EncryptedStore class
- *
- * Main entry point for encrypted storage with change detection
- */
 export class EncryptedStore {
     db;
     encryptionHelper;
     listener;
-    knownIds = new Set(); // Set of known document IDs (stripped, e.g., "alice")
-    fullIdMap = new Map(); // stripped id -> full id with table
-    isSubscribed = false;
-    unsubscribe = null; // Callback to unsubscribe from changes
-    connection = null;
-    clock = null; // High water mark for changes() API
+    changesHandler = null;
+    syncHandler = null;
+    processingChain = Promise.resolve();
     constructor(db, password, listener) {
         this.db = db;
         this.encryptionHelper = new EncryptionHelper(password);
-        this.listener = listener;
+        this.listener = listener || { onChange: () => { }, onDelete: () => { } };
     }
-    /** Load all documents and set up change detection (call once after creating store) */
+    /** Load all documents and set up change detection */
     async loadAll() {
-        // Reconnect subscription to ensure we receive all changes
-        this.reconnect();
-        const { encryptedMap, fullIdMap } = await this.readAllEncrypted();
-        this.fullIdMap = fullIdMap;
-        // Build initial set of known IDs
-        this.knownIds = new Set(encryptedMap.keys());
-        // Decrypt all documents for initial docsAdded event
-        const docs = [];
-        for (const [id, encryptedData] of encryptedMap) {
-            try {
-                const decrypted = await this.decryptFromEncryptedData(encryptedData, id);
-                docs.push(decrypted);
+        try {
+            const result = await this.db.allDocs({
+                include_docs: true,
+                conflicts: true,
+            });
+            const docs = [];
+            const errors = [];
+            const conflicts = [];
+            for (const row of result.rows) {
+                if (!row.doc || row.id.startsWith("_design/"))
+                    continue;
+                const encryptedDoc = row.doc;
+                if (encryptedDoc.d) {
+                    try {
+                        const doc = await this.decryptDoc(encryptedDoc);
+                        docs.push(doc);
+                        // Check for conflicts
+                        if (encryptedDoc._conflicts && encryptedDoc._conflicts.length > 0) {
+                            const conflictInfo = await this.buildConflictInfo(encryptedDoc._id, encryptedDoc._rev, encryptedDoc._conflicts, doc);
+                            conflicts.push(conflictInfo);
+                        }
+                    }
+                    catch (error) {
+                        errors.push({
+                            docId: encryptedDoc._id,
+                            error: error instanceof Error ? error : new Error(String(error)),
+                            rawDoc: encryptedDoc,
+                        });
+                    }
+                }
             }
-            catch (error) {
-                // Skip documents we can't decrypt
+            if (docs.length > 0) {
+                this.listener.onChange(docs);
+            }
+            if (errors.length > 0 && this.listener.onError) {
+                this.listener.onError(errors);
+            }
+            if (conflicts.length > 0 && this.listener.onConflict) {
+                this.listener.onConflict(conflicts);
             }
-        }
-        // Initialize clock for changes() API
-        try {
-            const result = await this.db.changes();
-            this.clock = result.clock;
-            console.log("[EncryptedStore] Initialized changes clock");
         }
         catch (error) {
-            console.warn("[EncryptedStore] db.changes() not available, falling back to subscription only");
-        }
-        // Fire initial docsAdded for everything, grouped by table
-        if (docs.length > 0) {
-            const events = this.groupByTable(docs, fullIdMap);
-            this.listener.docsAdded(events);
+            console.error("[EncryptedStore] loadAll failed:", error);
         }
+        this.setupSubscription();
     }
     /** Create or update a document */
-    async put(type, doc) {
-        // Generate ID if not provided
+    async put(table, doc) {
         if (!doc._id) {
-            doc._id = this.generateId();
+            doc._id =
+                crypto.randomUUID?.() ||
+                    `${Date.now()}-${Math.random().toString(36).slice(2)}`;
         }
-        // Build full ID with type prefix
-        const fullId = `${type}_${doc._id}`;
-        // Encrypt the document
+        const fullId = `${table}_${doc._id}`;
         const encryptedDoc = await this.encryptDoc(doc, fullId);
-        // Store in Fireproof
+        // Preserve _rev if document exists
+        try {
+            const existing = await this.db.get(fullId);
+            encryptedDoc._rev = existing._rev;
+        }
+        catch {
+            // Document doesn't exist, that's fine
+        }
         await this.db.put(encryptedDoc);
-        // Fireproof's subscribe will trigger handleChange()
-        // which will reload, compute diff, and fire events
-        return doc;
+        return { ...doc, _table: table };
     }
-    /** Get a document (returns null if not found) */
-    async get(type, id) {
-        const fullId = `${type}_${id}`;
+    /** Get a document by table and id */
+    async get(table, id) {
         try {
-            const encryptedDoc = await this.db.get(fullId);
-            return await this.decryptDoc(encryptedDoc, id);
+            const fullId = `${table}_${id}`;
+            const encryptedDoc = (await this.db.get(fullId, {
+                conflicts: true,
+            }));
+            const doc = await this.decryptDoc(encryptedDoc);
+            // Notify about conflicts if present
+            if (encryptedDoc._conflicts &&
+                encryptedDoc._conflicts.length > 0 &&
+                this.listener.onConflict) {
+                const conflictInfo = await this.buildConflictInfo(encryptedDoc._id, encryptedDoc._rev, encryptedDoc._conflicts, doc);
+                this.listener.onConflict([conflictInfo]);
+            }
+            return doc;
         }
-        catch (error) {
-            // Document not found
+        catch {
             return null;
         }
     }
     /** Delete a document */
-    async delete(type, id) {
-        // Build full ID with type prefix
-        const fullId = `${type}_${id}`;
-        // Delete from Fireproof
-        await this.db.del(fullId);
-        // Fireproof's subscribe will trigger handleChange()
-        // which will detect the deletion and fire docsDeleted event
-    }
-    /** Connect to remote sync with any Fireproof connector */
-    async connectRemote(connector, options) {
-        this.disconnectRemote();
+    async delete(table, id) {
+        const fullId = `${table}_${id}`;
         try {
-            console.log(`[EncryptedStore] Connecting to ${options.host} with namespace: ${options.namespace}`);
-            // Call the connector function
-            const connection = connector(this.db, options.namespace, options.host);
-            // Store connection
-            this.connection = {
-                ready: connection.ready || Promise.resolve(),
-                disconnect: connection.disconnect,
-            };
-            // Wait for connection to be ready
-            await this.connection.ready;
-            console.log(`[EncryptedStore] ✓ Connected to remote`);
+            const doc = await this.db.get(fullId);
+            await this.db.remove(doc);
         }
         catch (error) {
-            console.error(`[EncryptedStore] ✗ Failed to connect:`, error);
-            this.connection = null;
-            throw error;
+            console.warn(`[EncryptedStore] Could not delete ${fullId}:`, error);
         }
     }
-    /** Disconnect from remote sync */
-    disconnectRemote() {
-        if (this.connection && this.connection.disconnect) {
-            this.connection.disconnect();
-            console.log("[EncryptedStore] Disconnected from remote");
+    /** Get all documents (optionally filtered by table) */
+    async getAll(table) {
+        const result = await this.db.allDocs({
+            include_docs: true,
+            conflicts: true,
+        });
+        const docs = [];
+        const errors = [];
+        for (const row of result.rows) {
+            if (!row.doc || row.id.startsWith("_design/"))
+                continue;
+            const encryptedDoc = row.doc;
+            if (encryptedDoc.d) {
+                try {
+                    const doc = await this.decryptDoc(encryptedDoc);
+                    if (!table || doc._table === table) {
+                        docs.push(doc);
+                    }
+                }
+                catch (error) {
+                    errors.push({
+                        docId: encryptedDoc._id,
+                        error: error instanceof Error ? error : new Error(String(error)),
+                        rawDoc: encryptedDoc,
+                    });
+                }
+            }
+        }
+        if (errors.length > 0 && this.listener.onError) {
+            this.listener.onError(errors);
         }
-        this.connection = null;
+        return docs;
     }
-    /** Reconnect subscription to ensure remote changes are received */
-    reconnect() {
-        // Cancel existing subscription if any
-        if (this.unsubscribe) {
-            console.log("[EncryptedStore] Canceling existing subscription");
-            this.unsubscribe();
-            this.unsubscribe = null;
-            this.isSubscribed = false;
+    /** Connect to remote CouchDB for sync */
+    async connectRemote(options) {
+        this.disconnectRemote();
+        const syncOptions = {
+            live: options.live ?? true,
+            retry: options.retry ?? true,
+        };
+        this.syncHandler = this.db.sync(options.url, syncOptions);
+        // Setup sync event listeners
+        if (this.listener.onSync) {
+            this.syncHandler
+                .on("change", (info) => {
+                if (this.listener.onSync) {
+                    this.listener.onSync({
+                        direction: info.direction,
+                        change: info.change,
+                    });
+                }
+            })
+                .on("error", (err) => {
+                console.error("[EncryptedStore] sync error:", err);
+            });
         }
-        // Re-subscribe to database changes
-        // We treat subscription as a "something changed" notification
-        // and always query db.changes() to get actual changes (external indexer pattern)
-        console.log("[EncryptedStore] Reconnecting subscription (remote=true)");
-        this.unsubscribe = this.db.subscribe(() => {
-            console.log("[EncryptedStore] Subscription notified - querying db.changes()");
-            this.handleChange().catch((err) => {
-                console.error("EncryptedStore: Error handling change:", err);
+        // Wait for initial sync to start
+        return new Promise((resolve, reject) => {
+            let resolved = false;
+            const timeout = setTimeout(() => {
+                if (!resolved) {
+                    resolved = true;
+                    resolve();
+                }
+            }, 5000);
+            this.syncHandler.on("active", () => {
+                if (!resolved) {
+                    clearTimeout(timeout);
+                    resolved = true;
+                    resolve();
+                }
+            });
+            this.syncHandler.on("error", (err) => {
+                if (!resolved) {
+                    clearTimeout(timeout);
+                    resolved = true;
+                    reject(err);
+                }
             });
-        }, true); // Include remote changes
-        this.isSubscribed = true;
+        });
+    }
+    /** Disconnect from remote sync */
+    disconnectRemote() {
+        if (this.syncHandler) {
+            this.syncHandler.cancel();
+            this.syncHandler = null;
+        }
     }
-    /** Read all encrypted documents (without decrypting) */
-    async readAllEncrypted() {
-        const result = await this.db.query("_id", { descending: false });
-        const encryptedMap = new Map();
-        const fullIdMap = new Map();
-        // Get docs from either result.docs or result.rows
-        const allDocs = result.docs || result.rows.map((row) => row.doc).filter(Boolean);
-        for (const doc of allDocs) {
+    /** Resolve a conflict by choosing the winner */
+    async resolveConflict(table, id, winningDoc) {
+        const fullId = `${table}_${id}`;
+        const doc = (await this.db.get(fullId, { conflicts: true }));
+        if (!doc._conflicts || doc._conflicts.length === 0) {
+            throw new Error(`No conflicts found for ${fullId}`);
+        }
+        // Update with winning document
+        await this.put(table, winningDoc);
+        // Remove all conflicting revisions
+        for (const rev of doc._conflicts) {
             try {
-                const { type, id } = this.parseFullId(doc._id);
-                encryptedMap.set(id, doc.d); // Store encrypted data
-                fullIdMap.set(id, doc._id); // Map "alice" -> "users_alice"
+                await this.db.remove(fullId, rev);
             }
             catch (error) {
-                // Skip documents with invalid ID format
+                console.warn(`Failed to remove conflict ${fullId}@${rev}:`, error);
             }
         }
-        return { encryptedMap, fullIdMap };
     }
-    /**
-     * Query db.changes() and process any new changes (external indexer pattern)
-     * This is called whenever the subscription fires
-     */
-    async handleChange() {
+    /** Check if a document has conflicts without triggering the callback */
+    async getConflictInfo(table, id) {
         try {
-            // Query changes since last clock
-            const result = await this.db.changes(this.clock);
-            console.log(`[EncryptedStore] db.changes() returned ${result.rows.length} changes`);
-            if (result.rows.length === 0) {
-                return;
-            }
-            // Update clock first
-            this.clock = result.clock;
-            // Transform db.changes() format to processable format
-            // db.changes() returns { key, value: { _id, d }, clock }
-            const changes = result.rows.map((row) => row.value);
-            const newDocs = [];
-            const changedDocs = [];
-            const deletedDocs = [];
-            for (const change of changes) {
-                if (change.d) {
-                    // Has encrypted data - it's a create or update
-                    try {
-                        const { type, id } = this.parseFullId(change._id);
-                        // Decrypt the document
-                        const decrypted = await this.decryptFromEncryptedData(change.d, id);
-                        // Check if it's new or changed
-                        if (this.knownIds.has(id)) {
-                            changedDocs.push(decrypted);
-                        }
-                        else {
-                            newDocs.push(decrypted);
-                            this.knownIds.add(id);
-                            this.fullIdMap.set(id, change._id); // Update fullIdMap for new docs
-                        }
-                    }
-                    catch (error) {
-                        // Skip documents we can't decrypt or parse
-                    }
-                }
-                else {
-                    // No encrypted data - it's a deletion
-                    try {
-                        const { type, id } = this.parseFullId(change._id);
-                        if (this.knownIds.has(id)) {
-                            deletedDocs.push({ _id: id });
-                            this.knownIds.delete(id);
-                            // Keep fullIdMap entry for the deletion event, remove after
-                        }
-                    }
-                    catch (error) {
-                        // Skip invalid IDs
-                    }
-                }
+            const fullId = `${table}_${id}`;
+            const encryptedDoc = (await this.db.get(fullId, {
+                conflicts: true,
+            }));
+            if (!encryptedDoc._conflicts || encryptedDoc._conflicts.length === 0) {
+                return null;
             }
-            // Fire events grouped by table
-            console.log(`[EncryptedStore] Firing events: ${newDocs.length} new, ${changedDocs.length} changed, ${deletedDocs.length} deleted`);
-            if (newDocs.length > 0) {
-                const events = this.groupByTable(newDocs, this.fullIdMap);
-                this.listener.docsAdded(events);
-            }
-            if (changedDocs.length > 0) {
-                const events = this.groupByTable(changedDocs, this.fullIdMap);
-                this.listener.docsChanged(events);
+            const doc = await this.decryptDoc(encryptedDoc);
+            return await this.buildConflictInfo(encryptedDoc._id, encryptedDoc._rev, encryptedDoc._conflicts, doc);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Re-subscribe to changes (useful after disconnect/reconnect) */
+    reconnect() {
+        if (this.changesHandler) {
+            this.changesHandler.cancel();
+            this.changesHandler = null;
+        }
+        this.setupSubscription();
+    }
+    setupSubscription() {
+        this.changesHandler = this.db
+            .changes({
+            since: "now",
+            live: true,
+            include_docs: true,
+            conflicts: true,
+        })
+            .on("change", (change) => {
+            this.processingChain = this.processingChain
+                .then(() => this.handleChange(change))
+                .catch((err) => console.error("[EncryptedStore] handleChange error:", err));
+        })
+            .on("error", (err) => {
+            console.error("[EncryptedStore] changes feed error:", err);
+        });
+    }
+    async handleChange(change) {
+        if (change.id.startsWith("_design/"))
+            return;
+        const encryptedDoc = change.doc;
+        // Deletion
+        if (change.deleted || !encryptedDoc?.d) {
+            const parsed = this.parseFullId(change.id);
+            if (parsed) {
+                this.listener.onDelete([{ _id: parsed.id, _table: parsed.table }]);
             }
-            if (deletedDocs.length > 0) {
-                const events = this.groupDeletedByTable(deletedDocs);
-                this.listener.docsDeleted(events);
-                // Clean up fullIdMap entries for deleted docs
-                for (const doc of deletedDocs) {
-                    this.fullIdMap.delete(doc._id);
-                }
+            return;
+        }
+        // Changed/added document
+        const errors = [];
+        const conflicts = [];
+        try {
+            const doc = await this.decryptDoc(encryptedDoc);
+            // Check for conflicts
+            if (encryptedDoc._conflicts && encryptedDoc._conflicts.length > 0) {
+                const conflictInfo = await this.buildConflictInfo(encryptedDoc._id, encryptedDoc._rev, encryptedDoc._conflicts, doc);
+                conflicts.push(conflictInfo);
             }
+            this.listener.onChange([doc]);
         }
         catch (error) {
-            console.error("[EncryptedStore] db.changes() failed:", error);
+            errors.push({
+                docId: encryptedDoc._id,
+                error: error instanceof Error ? error : new Error(String(error)),
+                rawDoc: encryptedDoc,
+            });
+        }
+        if (errors.length > 0 && this.listener.onError) {
+            this.listener.onError(errors);
+        }
+        if (conflicts.length > 0 && this.listener.onConflict) {
+            this.listener.onConflict(conflicts);
         }
     }
-    async decryptFromEncryptedData(encryptedData, id) {
-        // Decrypt the data
-        const decryptedJson = await this.encryptionHelper.decrypt(encryptedData);
-        const decryptedData = JSON.parse(decryptedJson);
-        // Build final document
-        const doc = {
-            _id: id,
-            ...decryptedData,
+    async buildConflictInfo(fullId, currentRev, conflictRevs, winnerDoc) {
+        const parsed = this.parseFullId(fullId);
+        if (!parsed) {
+            throw new Error(`Invalid ID format: ${fullId}`);
+        }
+        const losers = [];
+        const errors = [];
+        for (const rev of conflictRevs) {
+            try {
+                const conflictDoc = (await this.db.get(fullId, {
+                    rev,
+                }));
+                const decrypted = await this.decryptDoc(conflictDoc);
+                losers.push(decrypted);
+            }
+            catch (error) {
+                errors.push({
+                    docId: `${fullId}@${rev}`,
+                    error: error instanceof Error ? error : new Error(String(error)),
+                    rawDoc: { _id: fullId, _rev: rev },
+                });
+            }
+        }
+        if (errors.length > 0 && this.listener.onError) {
+            this.listener.onError(errors);
+        }
+        return {
+            docId: fullId,
+            table: parsed.table,
+            id: parsed.id,
+            currentRev,
+            conflictRevs,
+            winner: winnerDoc,
+            losers,
         };
-        return doc;
+    }
+    async decryptDoc(encryptedDoc) {
+        const parsed = this.parseFullId(encryptedDoc._id);
+        if (!parsed)
+            throw new Error(`Invalid ID format: ${encryptedDoc._id}`);
+        const decrypted = JSON.parse(await this.encryptionHelper.decrypt(encryptedDoc.d));
+        return { _id: parsed.id, _table: parsed.table, ...decrypted };
     }
     async encryptDoc(doc, fullId) {
-        // Extract fields to encrypt (everything except _id)
-        const dataToEncrypt = {};
+        const data = {};
         for (const [key, value] of Object.entries(doc)) {
             if (!key.startsWith("_")) {
-                dataToEncrypt[key] = value;
+                data[key] = value;
             }
         }
-        // Encrypt as JSON
-        const encrypted = await this.encryptionHelper.encrypt(JSON.stringify(dataToEncrypt));
-        // Build encrypted doc
-        const encryptedDoc = {
+        return {
             _id: fullId,
-            d: encrypted,
-        };
-        return encryptedDoc;
-    }
-    async decryptDoc(encryptedDoc, id) {
-        // Decrypt the 'd' field
-        const decryptedJson = await this.encryptionHelper.decrypt(encryptedDoc.d);
-        const decryptedData = JSON.parse(decryptedJson);
-        // Build final document
-        const doc = {
-            _id: id,
-            ...decryptedData,
+            d: await this.encryptionHelper.encrypt(JSON.stringify(data)),
         };
-        return doc;
     }
     parseFullId(fullId) {
-        const firstUnderscore = fullId.indexOf("_");
-        if (firstUnderscore === -1) {
-            throw new Error(`Invalid document ID format: ${fullId}`);
-        }
-        return {
-            type: fullId.substring(0, firstUnderscore),
-            id: fullId.substring(firstUnderscore + 1),
-        };
-    }
-    generateId() {
-        // Use crypto.randomUUID if available, otherwise fallback
-        if (typeof crypto !== "undefined" && crypto.randomUUID) {
-            return crypto.randomUUID();
-        }
-        // Fallback for environments without crypto.randomUUID
-        return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
-    }
-    groupByTable(docs, fullIdMap) {
-        const grouped = new Map();
-        for (const doc of docs) {
-            const fullId = fullIdMap.get(doc._id);
-            if (fullId) {
-                const { type } = this.parseFullId(fullId);
-                if (!grouped.has(type)) {
-                    grouped.set(type, []);
-                }
-                grouped.get(type).push(doc);
-            }
-        }
-        return Array.from(grouped.entries()).map(([table, docs]) => ({
-            table,
-            docs,
-        }));
-    }
-    groupDeletedByTable(deletedDocs) {
-        const grouped = new Map();
-        for (const doc of deletedDocs) {
-            const fullId = this.fullIdMap.get(doc._id);
-            if (fullId) {
-                const { type } = this.parseFullId(fullId);
-                if (!grouped.has(type)) {
-                    grouped.set(type, []);
-                }
-                grouped.get(type).push(doc);
-            }
-        }
-        return Array.from(grouped.entries()).map(([table, docs]) => ({
-            table,
-            docs: docs, // Cast since deletedDocs is simpler structure
-        }));
+        const idx = fullId.indexOf("_");
+        if (idx === -1)
+            return null;
+        return { table: fullId.slice(0, idx), id: fullId.slice(idx + 1) };
     }
 }
 //# sourceMappingURL=encryptedStore.js.map