@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-IP2QBAGS.js

@@ -0,0 +1,589 @@
+import {
+  burnPaperRecoveryEntry,
+  loadPaperRecoveryEntries,
+  loadShamirRecoveryEntries,
+  unwrapDeksFromPaperEntry,
+  unwrapDeksFromShamirEntry
+} from "./chunk-6QILBDZU.js";
+import {
+  dekKey
+} from "./chunk-4R4Q64W5.js";
+import {
+  assertStrongPassphrase,
+  mintKeyringCanary,
+  persistKeyring
+} from "./chunk-5ZOSG3RJ.js";
+import {
+  openEnvelopeJson
+} from "./chunk-QQJXBZCO.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  deriveKey,
+  encrypt,
+  generateSalt,
+  unwrapKey,
+  wrapKey
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_KEYRING_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  DelegationTargetMissingError,
+  InvalidKeyError,
+  NoAccessError,
+  PermissionDeniedError,
+  PrivilegeEscalationError,
+  RecoveryProfileNotImplementedError,
+  TeamNotEnabledError,
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-party/team/magic-link-grant.ts
+var MAGIC_LINK_GRANTS_COLLECTION = "_magic_link_grants";
+var MAGIC_LINK_CONTENT_INFO_PREFIX = "noydb-magic-link-content-v1:";
+var MAGIC_LINK_KEK_INFO_PREFIX = "noydb-magic-link-v1:";
+async function deriveMagicLinkContentKey(serverSecret, token, vault) {
+  const subtle = globalThis.crypto.subtle;
+  const ikmBytes = serverSecret instanceof Uint8Array ? serverSecret : new TextEncoder().encode(serverSecret);
+  const tokenBytes = new TextEncoder().encode(token);
+  const saltBuffer = await subtle.digest("SHA-256", tokenBytes);
+  const info = new TextEncoder().encode(MAGIC_LINK_CONTENT_INFO_PREFIX + vault);
+  const ikm = await subtle.importKey("raw", ikmBytes, "HKDF", false, ["deriveKey"]);
+  return subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: saltBuffer, info },
+    ikm,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function writeMagicLinkGrant(store, vault, grantor, contentKey, grantKek, recordId, opts) {
+  const collectionName = opts.collection ?? null;
+  const sourceKey = collectionName ? dekKey(collectionName, opts.tier) : `__any#${opts.tier}`;
+  const sourceDek = grantor.deks.get(sourceKey);
+  if (!sourceDek) {
+    throw new DelegationTargetMissingError(
+      `grantor cannot find tier ${opts.tier} DEK for ${collectionName ?? "(any)"}`
+    );
+  }
+  const wrappedDek = await wrapKey(sourceDek, grantKek);
+  const until = typeof opts.until === "string" ? opts.until : opts.until.toISOString();
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  const payload = {
+    id: recordId,
+    toUser: opts.toUser,
+    fromUser: grantor.userId,
+    tier: opts.tier,
+    collection: collectionName,
+    ...opts.record && { record: opts.record },
+    until,
+    wrappedDek,
+    createdAt,
+    ...opts.note && { note: opts.note }
+  };
+  const { iv, data } = await encrypt(JSON.stringify(payload), contentKey);
+  const envelope = {
+    _noydb: 1,
+    _v: 1,
+    _ts: createdAt,
+    _iv: iv,
+    _data: data,
+    _by: grantor.userId
+  };
+  await store.put(vault, MAGIC_LINK_GRANTS_COLLECTION, recordId, envelope);
+  return { recordId, payload };
+}
+async function readMagicLinkGrantRecord(store, vault, contentKey, recordId) {
+  const env = await store.get(vault, MAGIC_LINK_GRANTS_COLLECTION, recordId);
+  if (!env) return null;
+  try {
+    const json = await openEnvelopeJson(env, contentKey);
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+async function listMagicLinkGrants(store, vault, contentKey, token) {
+  const ids = await store.list(vault, MAGIC_LINK_GRANTS_COLLECTION);
+  const matching = ids.filter((id) => id === token || id.startsWith(`${token}:`));
+  const out = [];
+  for (const id of matching) {
+    const payload = await readMagicLinkGrantRecord(store, vault, contentKey, id);
+    if (payload) out.push(payload);
+  }
+  return out;
+}
+async function unwrapMagicLinkGrant(payload, grantKek) {
+  return unwrapKey(payload.wrappedDek, grantKek);
+}
+async function revokeMagicLinkGrant(store, vault, token) {
+  const ids = await store.list(vault, MAGIC_LINK_GRANTS_COLLECTION);
+  const matching = ids.filter((id) => id === token || id.startsWith(`${token}:`));
+  for (const id of matching) {
+    await store.delete(vault, MAGIC_LINK_GRANTS_COLLECTION, id);
+  }
+  return matching.length;
+}
+function magicLinkGrantRecordId(token, index) {
+  return index === 0 ? token : `${token}:${index}`;
+}
+function isMagicLinkGrantExpired(payload, now = /* @__PURE__ */ new Date()) {
+  return payload.until <= now.toISOString();
+}
+
+// src/port/with/team-strategy.ts
+var NO_TEAM = {
+  async grant() {
+    throw new TeamNotEnabledError();
+  },
+  async revoke() {
+    throw new TeamNotEnabledError();
+  },
+  async rotate() {
+    throw new TeamNotEnabledError();
+  }
+};
+
+// src/with-party/team/rotate-recover.ts
+async function rotatePassphrase(store, vault, userId, input) {
+  if (!input.allowWeakPassphrase) {
+    assertStrongPassphrase(input.newPassphrase, input.passphrasePolicy);
+  }
+  const env = await store.get(vault, "_keyring", userId);
+  if (!env) {
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}".`);
+  }
+  const file = JSON.parse(env._data);
+  const oldSalt = base64ToBuffer(file.salt);
+  const oldKek = await deriveKey(input.oldPassphrase, oldSalt);
+  const deks = /* @__PURE__ */ new Map();
+  for (const [coll, wrapped] of Object.entries(file.deks)) {
+    deks.set(coll, await unwrapKey(wrapped, oldKek));
+  }
+  const newSalt = generateSalt();
+  const newKek = await deriveKey(input.newPassphrase, newSalt);
+  const wrappedDeks = {};
+  for (const [coll, dek] of deks) {
+    wrappedDeks[coll] = await wrapKey(dek, newKek);
+  }
+  const oldSlots = file.authenticators ?? [];
+  const newSlots = [];
+  if (input.slotCeremonies && oldSlots.length > 0) {
+    for (const oldSlot of oldSlots) {
+      const ceremony = input.slotCeremonies[oldSlot.id];
+      if (!ceremony) continue;
+      const result = await ceremony({ newKek, newDeks: deks, oldSlot });
+      if (result.id !== oldSlot.id) {
+        throw new ValidationError(
+          `slotCeremonies['${oldSlot.id}'] returned id="${result.id}". The id must match the rotated slot \u2014 a ceremony cannot change a slot's identity.`
+        );
+      }
+      if (result.method !== oldSlot.method) {
+        throw new ValidationError(
+          `slotCeremonies['${oldSlot.id}'] returned method="${result.method}", expected "${oldSlot.method}". The method must match the rotated slot \u2014 a ceremony cannot change the auth method (e.g. webauthn \u2192 password) under cover of rotation.`
+        );
+      }
+      const oldWrapKind = oldSlot.wrapKind ?? "kek";
+      const newWrapKind = result.wrapKind ?? "kek";
+      if (oldWrapKind !== newWrapKind) {
+        throw new ValidationError(
+          `slotCeremonies['${oldSlot.id}'] returned wrapKind="${newWrapKind}", expected "${oldWrapKind}". The wrap format must match the rotated slot \u2014 a ceremony cannot change the wrap shape (e.g. wrap-KEK \u2192 wrap-DEKs) under cover of rotation, since that would silently change the session tier produced at unlock.`
+        );
+      }
+      const baseFields = {
+        id: result.id,
+        method: result.method,
+        // Preserve original enrolled_at — rotation is rewrapping, not
+        // re-enrollment. The slot's enrolment timestamp tracks when
+        // the user originally added the slot, not when it was last
+        // rewrapped. Forensics consumers reading enrolled_at are
+        // tracking the slot's ORIGIN, not its CURRENT wrapping.
+        enrolled_at: oldSlot.enrolled_at,
+        enrolled_via_tier: result.enrolled_via_tier ?? oldSlot.enrolled_via_tier,
+        meta: result.meta
+      };
+      const newSlot = result.wrapKind === "deks" ? {
+        ...baseFields,
+        wrapKind: "deks",
+        wrapped_deks: result.wrapped_deks,
+        iv: result.iv
+      } : {
+        ...baseFields,
+        wrapped_kek: result.wrapped_kek
+      };
+      newSlots.push(newSlot);
+    }
+  }
+  const canary = await mintKeyringCanary(newKek);
+  const next = {
+    ...file,
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    deks: wrappedDeks,
+    salt: bufferToBase64(newSalt),
+    authenticators: newSlots,
+    canary
+  };
+  await writeKeyringFile(store, vault, userId, next);
+  return {
+    userId: file.user_id,
+    displayName: file.display_name,
+    role: file.role,
+    permissions: file.permissions,
+    deks,
+    kek: newKek,
+    salt: newSalt,
+    authenticators: newSlots,
+    ...file.export_capability !== void 0 && { exportCapability: file.export_capability },
+    ...file.import_capability !== void 0 && { importCapability: file.import_capability }
+  };
+}
+async function recoverPassphrase(provider, store, vault, userId, input) {
+  if (!input.allowWeakPassphrase) {
+    assertStrongPassphrase(input.newPassphrase, input.passphrasePolicy);
+  }
+  const profile = input.recoveryProof.profile;
+  if (profile === "paper") {
+    return recoverViaPaperCode(store, vault, userId, input);
+  }
+  if (profile === "shamir") {
+    return recoverViaShamir(provider, store, vault, userId, input);
+  }
+  throw new RecoveryProfileNotImplementedError(
+    profile,
+    "https://github.com/vLannaAi/noy-db/issues/196"
+  );
+}
+async function recoverViaPaperCode(store, vault, userId, input) {
+  if (input.recoveryProof.profile !== "paper") throw new Error("unreachable");
+  const { code } = input.recoveryProof.payload;
+  const env = await store.get(vault, "_keyring", userId);
+  if (!env) {
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}".`);
+  }
+  const file = JSON.parse(env._data);
+  const entries = await loadPaperRecoveryEntries(store, vault);
+  if (entries.length === 0) {
+    throw new NoAccessError(
+      `No paper-recovery entries enrolled for vault "${vault}". Enroll via \`db.enrollRecovery({ profile: "paper", entries })\` before relying on recovery.`
+    );
+  }
+  const normalized = normalizePaperCode(code);
+  let recovered;
+  for (const entry of entries) {
+    try {
+      const deks2 = await unwrapDeksFromPaperEntry(entry, normalized);
+      recovered = { deks: deks2, entry };
+      break;
+    } catch {
+    }
+  }
+  if (!recovered) {
+    throw new InvalidKeyError(
+      "Recovery code does not match any enrolled paper entry. The code may have been previously used (single-use) or typed incorrectly."
+    );
+  }
+  const deks = recovered.deks;
+  const newSalt = generateSalt();
+  const newKek = await deriveKey(input.newPassphrase, newSalt);
+  const wrappedDeks = {};
+  for (const [coll, dek] of deks) {
+    wrappedDeks[coll] = await wrapKey(dek, newKek);
+  }
+  const canary = await mintKeyringCanary(newKek);
+  const next = {
+    ...file,
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    deks: wrappedDeks,
+    salt: bufferToBase64(newSalt),
+    authenticators: [],
+    // tier-2 slots wrap old KEK, drop them
+    canary
+  };
+  await burnPaperRecoveryEntry(store, vault, recovered.entry.codeId);
+  await writeKeyringFile(store, vault, userId, next);
+  return {
+    userId: file.user_id,
+    displayName: file.display_name,
+    role: file.role,
+    permissions: file.permissions,
+    deks,
+    kek: newKek,
+    salt: newSalt,
+    authenticators: [],
+    ...file.export_capability !== void 0 && { exportCapability: file.export_capability },
+    ...file.import_capability !== void 0 && { importCapability: file.import_capability }
+  };
+}
+function normalizePaperCode(input) {
+  return input.toUpperCase().replace(/[\s\-_]/g, "");
+}
+async function recoverViaShamir(provider, store, vault, userId, input) {
+  if (input.recoveryProof.profile !== "shamir") throw new Error("unreachable");
+  const { entryId: requestedEntryId, shares: shareStrings } = input.recoveryProof.payload;
+  if (shareStrings.length === 0) {
+    throw new ValidationError(
+      "Shamir recovery requires at least one share; received an empty array."
+    );
+  }
+  const env = await store.get(vault, "_keyring", userId);
+  if (!env) {
+    throw new NoAccessError(`No keyring found for user "${userId}" in vault "${vault}".`);
+  }
+  const file = JSON.parse(env._data);
+  const allEntries = await loadShamirRecoveryEntries(store, vault);
+  if (allEntries.length === 0) {
+    throw new NoAccessError(
+      `No Shamir-recovery entries enrolled for vault "${vault}". Enroll via \`db.enrollRecovery({ profile: "shamir", k, n })\` before relying on recovery.`
+    );
+  }
+  if (!provider) {
+    throw new Error(
+      "shamir recovery requires a ShamirRecoveryProvider \u2014 pass shamirRecovery: shamirRecoveryProvider() from '@noy-db/on-shamir' to createNoydb()"
+    );
+  }
+  let candidates;
+  if (requestedEntryId !== void 0) {
+    candidates = allEntries.filter((e) => e.entryId === requestedEntryId);
+    if (candidates.length === 0) {
+      throw new NoAccessError(
+        `No Shamir-recovery entry with entryId="${requestedEntryId}" found in vault "${vault}". Available entries: ` + allEntries.map((e) => `"${e.entryId}"`).join(", ")
+      );
+    }
+  } else {
+    candidates = allEntries;
+  }
+  let recoveredDeks;
+  for (const entry of candidates) {
+    if (shareStrings.length < entry.k) {
+      continue;
+    }
+    try {
+      const deks = await unwrapDeksFromShamirEntry(provider, entry, shareStrings);
+      recoveredDeks = deks;
+      break;
+    } catch {
+    }
+  }
+  if (!recoveredDeks) {
+    const minK = Math.min(...candidates.map((e) => e.k));
+    if (shareStrings.length < minK) {
+      throw new InvalidKeyError(
+        `Insufficient Shamir shares to combine: the smallest enrolled threshold is ${minK}, but only ${shareStrings.length} share${shareStrings.length === 1 ? " was" : "s were"} provided.`
+      );
+    }
+    throw new InvalidKeyError(
+      "Shamir shares do not match any enrolled entry. Possible causes: shares were tampered with, came from a different enrollment, or the entry was rotated after these shares were distributed."
+    );
+  }
+  const newSalt = generateSalt();
+  const newKek = await deriveKey(input.newPassphrase, newSalt);
+  const wrappedDeks = {};
+  for (const [coll, dek] of recoveredDeks) {
+    wrappedDeks[coll] = await wrapKey(dek, newKek);
+  }
+  const canary = await mintKeyringCanary(newKek);
+  const next = {
+    ...file,
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    deks: wrappedDeks,
+    salt: bufferToBase64(newSalt),
+    authenticators: [],
+    // tier-2 slots wrap old KEK, drop them on recovery
+    canary
+  };
+  await writeKeyringFile(store, vault, userId, next);
+  return {
+    userId: file.user_id,
+    displayName: file.display_name,
+    role: file.role,
+    permissions: file.permissions,
+    deks: recoveredDeks,
+    kek: newKek,
+    salt: newSalt,
+    authenticators: [],
+    ...file.export_capability !== void 0 && { exportCapability: file.export_capability },
+    ...file.import_capability !== void 0 && { importCapability: file.import_capability }
+  };
+}
+async function writeKeyringFile(store, vault, userId, file) {
+  const envelope = {
+    _noydb: 1,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(file)
+  };
+  await store.put(vault, "_keyring", userId, envelope);
+}
+
+// src/with-party/team/peer-recover.ts
+var ADMIN_RECOVERABLE_TARGETS = ["operator", "viewer", "client", "admin"];
+function canRecover(callerRole, targetRole) {
+  if (callerRole === "owner") return true;
+  if (callerRole === "admin") return ADMIN_RECOVERABLE_TARGETS.includes(targetRole);
+  return false;
+}
+async function recoverUser(store, vault, callerKeyring, options) {
+  const env = await store.get(vault, "_keyring", options.userId);
+  if (!env) {
+    throw new NoAccessError(
+      `recoverUser: user "${options.userId}" has no keyring in vault "${vault}".`
+    );
+  }
+  const target = JSON.parse(env._data);
+  const targetRole = options.role ?? target.role;
+  if (!canRecover(callerKeyring.role, targetRole)) {
+    throw new PermissionDeniedError(
+      `Role "${callerKeyring.role}" cannot recover role "${targetRole}"`
+    );
+  }
+  if (!canRecover(callerKeyring.role, target.role)) {
+    throw new PermissionDeniedError(
+      `Role "${callerKeyring.role}" cannot recover role "${target.role}"`
+    );
+  }
+  for (const coll of Object.keys(target.deks)) {
+    if (!callerKeyring.deks.has(coll)) {
+      throw new PrivilegeEscalationError(coll);
+    }
+  }
+  if (options.validatePassphrase && !options.allowWeakPassphrase) {
+    assertStrongPassphrase(options.passphrase, options.passphrasePolicy);
+  }
+  const newSalt = generateSalt();
+  const newKek = await deriveKey(options.passphrase, newSalt);
+  const wrappedDeks = {};
+  for (const coll of Object.keys(target.deks)) {
+    const callerDek = callerKeyring.deks.get(coll);
+    if (!callerDek) {
+      throw new PrivilegeEscalationError(coll);
+    }
+    wrappedDeks[coll] = await wrapKey(callerDek, newKek);
+  }
+  const canary = await mintKeyringCanary(newKek);
+  const next = {
+    ...target,
+    _noydb_keyring: NOYDB_KEYRING_VERSION,
+    role: targetRole,
+    display_name: options.displayName ?? target.display_name,
+    deks: wrappedDeks,
+    salt: bufferToBase64(newSalt),
+    granted_by: callerKeyring.userId,
+    authenticators: [],
+    canary
+  };
+  const envelope = {
+    _noydb: 1,
+    _v: 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: JSON.stringify(next)
+  };
+  await store.put(vault, "_keyring", options.userId, envelope);
+}
+
+// src/with-party/team/authenticators.ts
+async function enrollAuthenticator(store, vault, keyring, options) {
+  const existing = keyring.authenticators.find((a) => a.id === options.id);
+  if (existing) {
+    throw new ValidationError(
+      `enrollAuthenticator: slot id "${options.id}" already exists in vault "${vault}". Remove the slot first or pick a unique id.`
+    );
+  }
+  const base = {
+    id: options.id,
+    method: options.method,
+    enrolled_at: (/* @__PURE__ */ new Date()).toISOString(),
+    enrolled_via_tier: options.enrolled_via_tier ?? 1,
+    meta: options.meta
+  };
+  const slot = options.wrapKind === "deks" ? {
+    ...base,
+    wrapKind: "deks",
+    wrapped_deks: options.wrapped_deks,
+    iv: options.iv
+  } : {
+    ...base,
+    wrapped_kek: options.wrapped_kek
+  };
+  const next = appendSlot(keyring, slot);
+  await persistKeyring(store, vault, next);
+  return next;
+}
+async function updateAuthenticator(store, vault, keyring, slotId, options) {
+  if (options.meta === void 0) {
+    throw new ValidationError(
+      `updateAuthenticator: at least one of meta must be provided (slotId: "${slotId}").`
+    );
+  }
+  const idx = keyring.authenticators.findIndex((a) => a.id === slotId);
+  if (idx === -1) {
+    throw new NoAccessError(
+      `updateAuthenticator: slot "${slotId}" not found in vault "${vault}".`
+    );
+  }
+  const existing = keyring.authenticators[idx];
+  const mergedMeta = { ...existing.meta };
+  for (const [k, v] of Object.entries(options.meta)) {
+    if (v === void 0) continue;
+    if (v === null) {
+      delete mergedMeta[k];
+      continue;
+    }
+    mergedMeta[k] = v;
+  }
+  const next = { ...existing, meta: mergedMeta };
+  const nextSlots = [...keyring.authenticators];
+  nextSlots[idx] = next;
+  const nextKeyring = {
+    ...keyring,
+    authenticators: nextSlots
+  };
+  await persistKeyring(store, vault, nextKeyring);
+  return nextKeyring;
+}
+async function removeAuthenticator(store, vault, keyring, slotId) {
+  const filtered = keyring.authenticators.filter((a) => a.id !== slotId);
+  if (filtered.length === keyring.authenticators.length) {
+    return keyring;
+  }
+  const next = {
+    ...keyring,
+    authenticators: filtered
+  };
+  await persistKeyring(store, vault, next);
+  return next;
+}
+function findAuthenticator(keyring, slotId) {
+  return keyring.authenticators.find((a) => a.id === slotId);
+}
+function appendSlot(keyring, slot) {
+  return {
+    ...keyring,
+    authenticators: [...keyring.authenticators, slot]
+  };
+}
+
+export {
+  MAGIC_LINK_GRANTS_COLLECTION,
+  MAGIC_LINK_CONTENT_INFO_PREFIX,
+  MAGIC_LINK_KEK_INFO_PREFIX,
+  deriveMagicLinkContentKey,
+  writeMagicLinkGrant,
+  readMagicLinkGrantRecord,
+  listMagicLinkGrants,
+  unwrapMagicLinkGrant,
+  revokeMagicLinkGrant,
+  magicLinkGrantRecordId,
+  isMagicLinkGrantExpired,
+  NO_TEAM,
+  rotatePassphrase,
+  recoverPassphrase,
+  recoverUser,
+  enrollAuthenticator,
+  updateAuthenticator,
+  removeAuthenticator,
+  findAuthenticator
+};
+//# sourceMappingURL=chunk-IP2QBAGS.js.map