@protontech/drive-sdk 0.0.10

package/dist/internal/nodes/cryptoService.test.js

@@ -0,0 +1,698 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("../../crypto");
+const interface_1 = require("../../interface");
+const telemetry_1 = require("../../tests/telemetry");
+const cryptoService_1 = require("./cryptoService");
+describe("nodesCryptoService", () => {
+    let telemetry;
+    let driveCrypto;
+    let account;
+    let sharesService;
+    let cryptoService;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        telemetry = (0, telemetry_1.getMockTelemetry)();
+        driveCrypto = {
+            decryptKey: jest.fn(async () => Promise.resolve({
+                passphrase: "pass",
+                key: "decryptedKey",
+                passphraseSessionKey: "passphraseSessionKey",
+                verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_VALID,
+            })),
+            decryptNodeName: jest.fn(async () => Promise.resolve({
+                name: "name",
+                verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_VALID,
+            })),
+            decryptNodeHashKey: jest.fn(async () => Promise.resolve({
+                hashKey: new Uint8Array(),
+                verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_VALID,
+            })),
+            decryptExtendedAttributes: jest.fn(async () => Promise.resolve({
+                extendedAttributes: "{}",
+                verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_VALID,
+            })),
+            encryptNodeName: jest.fn(async () => Promise.resolve({
+                armoredNodeName: "armoredName",
+            })),
+            // @ts-expect-error No need to implement all methods for mocking
+            decryptAndVerifySessionKey: jest.fn(async () => Promise.resolve({
+                sessionKey: "contentKeyPacketSessionKey",
+                verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_VALID,
+            })),
+        };
+        account = {
+            // @ts-expect-error No need to implement all methods for mocking
+            getPublicKeys: jest.fn(async () => [{ _idx: 21312 }]),
+        };
+        // @ts-expect-error No need to implement all methods for mocking
+        sharesService = {
+            getMyFilesShareMemberEmailKey: jest.fn(async () => ({
+                email: "email",
+                addressKey: "key",
+            })),
+            getVolumeMetricContext: jest.fn().mockResolvedValue('own_volume'),
+        };
+        cryptoService = new cryptoService_1.NodesCryptoService(telemetry, driveCrypto, account, sharesService);
+    });
+    const parentKey = "parentKey";
+    function verifyLogEventVerificationError(options = {}) {
+        expect(telemetry.logEvent).toHaveBeenCalledTimes(1);
+        expect(telemetry.logEvent).toHaveBeenCalledWith({
+            eventName: "verificationError",
+            context: "own_volume",
+            fromBefore2024: false,
+            addressMatchingDefaultShare: false,
+            ...options,
+        });
+    }
+    function verifyLogEventDecryptionError(options = {}) {
+        expect(telemetry.logEvent).toHaveBeenCalledTimes(1);
+        expect(telemetry.logEvent).toHaveBeenCalledWith({
+            eventName: "decryptionError",
+            context: "own_volume",
+            fromBefore2024: false,
+            ...options,
+        });
+    }
+    describe("folder node", () => {
+        const encryptedNode = {
+            uid: "volumeId~nodeId",
+            parentUid: "volumeId~parentId",
+            encryptedCrypto: {
+                signatureEmail: "signatureEmail",
+                nameSignatureEmail: "nameSignatureEmail",
+                armoredKey: "armoredKey",
+                armoredNodePassphrase: "armoredNodePassphrase",
+                armoredNodePassphraseSignature: "armoredNodePassphraseSignature",
+                folder: {
+                    armoredHashKey: "armoredHashKey",
+                    armoredExtendedAttributes: "folderArmoredExtendedAttributes",
+                },
+            },
+        };
+        function verifyResult(result, expectedNode = {}, expectedKeys = {}) {
+            expect(result).toMatchObject({
+                node: {
+                    name: { ok: true, value: "name" },
+                    keyAuthor: { ok: true, value: "signatureEmail" },
+                    nameAuthor: { ok: true, value: "nameSignatureEmail" },
+                    folder: {
+                        extendedAttributes: "{}",
+                    },
+                    activeRevision: undefined,
+                    errors: undefined,
+                    ...expectedNode,
+                },
+                ...expectedKeys === 'noKeys' ? {} : {
+                    keys: {
+                        passphrase: "pass",
+                        key: "decryptedKey",
+                        passphraseSessionKey: "passphraseSessionKey",
+                        hashKey: new Uint8Array(),
+                        ...expectedKeys,
+                    }
+                },
+            });
+        }
+        describe("should decrypt successfuly", () => {
+            it("same author everywhere", async () => {
+                const encryptedNode = {
+                    encryptedCrypto: {
+                        signatureEmail: "signatureEmail",
+                        nameSignatureEmail: "signatureEmail",
+                        armoredKey: "armoredKey",
+                        armoredNodePassphrase: "armoredNodePassphrase",
+                        armoredNodePassphraseSignature: "armoredNodePassphraseSignature",
+                        folder: {
+                            armoredHashKey: "armoredHashKey",
+                            armoredExtendedAttributes: "folderArmoredExtendedAttributes",
+                        },
+                    },
+                };
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: true, value: "signatureEmail" },
+                    nameAuthor: { ok: true, value: "signatureEmail" },
+                });
+                expect(account.getPublicKeys).toHaveBeenCalledTimes(1);
+                expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+                expect(telemetry.logEvent).not.toHaveBeenCalled();
+            });
+            it("different authors on key and name", async () => {
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result);
+                expect(account.getPublicKeys).toHaveBeenCalledTimes(2);
+                expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+                expect(account.getPublicKeys).toHaveBeenCalledWith("nameSignatureEmail");
+                expect(telemetry.logEvent).not.toHaveBeenCalled();
+            });
+        });
+        describe("should decrypt with verification issues", () => {
+            it("on node key", async () => {
+                driveCrypto.decryptKey = jest.fn(async () => Promise.resolve({
+                    passphrase: "pass",
+                    key: "decryptedKey",
+                    passphraseSessionKey: "passphraseSessionKey",
+                    verified: crypto_1.VERIFICATION_STATUS.NOT_SIGNED,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Missing signature for key" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeKey',
+                });
+            });
+            it("on node name", async () => {
+                driveCrypto.decryptNodeName = jest.fn(async () => Promise.resolve({
+                    name: "name",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    nameAuthor: { ok: false, error: { claimedAuthor: "nameSignatureEmail", error: "Signature verification for name failed" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeName',
+                });
+            });
+            it("on hash key", async () => {
+                driveCrypto.decryptNodeHashKey = jest.fn(async () => Promise.resolve({
+                    hashKey: new Uint8Array(),
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Signature verification for hash key failed" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeHashKey',
+                });
+            });
+            it("on node key and hash key reports error from node key", async () => {
+                driveCrypto.decryptKey = jest.fn(async () => Promise.resolve({
+                    passphrase: "pass",
+                    key: "decryptedKey",
+                    passphraseSessionKey: "passphraseSessionKey",
+                    verified: crypto_1.VERIFICATION_STATUS.NOT_SIGNED,
+                }));
+                driveCrypto.decryptNodeHashKey = jest.fn(async () => Promise.resolve({
+                    hashKey: new Uint8Array(),
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Missing signature for key" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeKey',
+                });
+            });
+            it("on folder extended attributes", async () => {
+                driveCrypto.decryptExtendedAttributes = jest.fn(async () => Promise.resolve({
+                    extendedAttributes: "{}",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Signature verification for attributes failed" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeExtendedAttributes',
+                });
+            });
+        });
+        describe("should decrypt with decryption issues", () => {
+            it("on node key", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptKey = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Failed to decrypt node key: Decryption error" } },
+                    errors: [new Error("Decryption error")],
+                    folder: undefined,
+                }, 'noKeys');
+                verifyLogEventDecryptionError({
+                    field: 'nodeKey',
+                    error,
+                });
+            });
+            it("on node name", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptNodeName = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    name: { ok: false, error },
+                    nameAuthor: { ok: false, error: { claimedAuthor: "nameSignatureEmail", error: "Decryption error" } },
+                }, 'noKeys');
+                verifyLogEventDecryptionError({
+                    field: 'nodeName',
+                    error,
+                });
+            });
+            it("on hash key", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptNodeHashKey = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    errors: [error],
+                }, 'noKeys');
+                verifyLogEventDecryptionError({
+                    field: 'nodeHashKey',
+                    error,
+                });
+            });
+            it("on folder extended attributes", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptExtendedAttributes = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    folder: undefined,
+                    errors: [error],
+                }, 'noKeys');
+                verifyLogEventDecryptionError({
+                    field: 'nodeExtendedAttributes',
+                    error,
+                });
+            });
+        });
+        it("should fail when keys cannot be loaded", async () => {
+            account.getPublicKeys = jest.fn().mockRejectedValue(new Error("Failed to load keys"));
+            const result = cryptoService.decryptNode(encryptedNode, parentKey);
+            await expect(result).rejects.toThrow("Failed to load keys");
+        });
+    });
+    describe("file node", () => {
+        const encryptedNode = {
+            uid: "volumeId~nodeId",
+            parentUid: "volumeId~parentId",
+            encryptedCrypto: {
+                signatureEmail: "signatureEmail",
+                nameSignatureEmail: "nameSignatureEmail",
+                armoredKey: "armoredKey",
+                armoredNodePassphrase: "armoredNodePassphrase",
+                armoredNodePassphraseSignature: "armoredNodePassphraseSignature",
+                file: {
+                    base64ContentKeyPacket: "base64ContentKeyPacket",
+                },
+                activeRevision: {
+                    uid: "revisionUid",
+                    state: "active",
+                    signatureEmail: "revisionSignatureEmail",
+                    armoredExtendedAttributes: "encryptedExtendedAttributes",
+                },
+            },
+        };
+        function verifyResult(result, expectedNode = {}, expectedKeys = {}) {
+            expect(result).toMatchObject({
+                node: {
+                    name: { ok: true, value: "name" },
+                    keyAuthor: { ok: true, value: "signatureEmail" },
+                    nameAuthor: { ok: true, value: "nameSignatureEmail" },
+                    folder: undefined,
+                    activeRevision: {
+                        ok: true, value: {
+                            uid: "revisionUid",
+                            state: interface_1.RevisionState.Active,
+                            creationTime: undefined,
+                            extendedAttributes: "{}",
+                            contentAuthor: { ok: true, value: "revisionSignatureEmail" },
+                        }
+                    },
+                    errors: undefined,
+                    ...expectedNode,
+                },
+                ...expectedKeys === 'noKeys' ? {} : {
+                    keys: {
+                        passphrase: "pass",
+                        key: "decryptedKey",
+                        passphraseSessionKey: "passphraseSessionKey",
+                        hashKey: undefined,
+                        contentKeyPacketSessionKey: "contentKeyPacketSessionKey",
+                        ...expectedKeys,
+                    },
+                },
+            });
+        }
+        describe("should decrypt successfuly", () => {
+            it("same author everywhere", async () => {
+                const encryptedNode = {
+                    encryptedCrypto: {
+                        signatureEmail: "signatureEmail",
+                        nameSignatureEmail: "signatureEmail",
+                        armoredKey: "armoredKey",
+                        armoredNodePassphrase: "armoredNodePassphrase",
+                        armoredNodePassphraseSignature: "armoredNodePassphraseSignature",
+                        file: {
+                            base64ContentKeyPacket: "base64ContentKeyPacket",
+                        },
+                        activeRevision: {
+                            uid: "revisionUid",
+                            state: "active",
+                            signatureEmail: "signatureEmail",
+                            armoredExtendedAttributes: "encryptedExtendedAttributes",
+                        },
+                    },
+                };
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: true, value: "signatureEmail" },
+                    nameAuthor: { ok: true, value: "signatureEmail" },
+                    activeRevision: {
+                        ok: true, value: {
+                            uid: "revisionUid",
+                            state: interface_1.RevisionState.Active,
+                            // @ts-expect-error Ignore mocked data.
+                            creationTime: undefined,
+                            extendedAttributes: "{}",
+                            contentAuthor: { ok: true, value: "signatureEmail" },
+                        }
+                    },
+                });
+                expect(account.getPublicKeys).toHaveBeenCalledTimes(2); // node + revision
+                expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+                expect(telemetry.logEvent).not.toHaveBeenCalled();
+            });
+            it("different authors on key and name", async () => {
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result);
+                expect(account.getPublicKeys).toHaveBeenCalledTimes(3);
+                expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+                expect(account.getPublicKeys).toHaveBeenCalledWith("nameSignatureEmail");
+                expect(account.getPublicKeys).toHaveBeenCalledWith("revisionSignatureEmail");
+                expect(telemetry.logEvent).not.toHaveBeenCalled();
+            });
+        });
+        describe("should decrypt with verification issues", () => {
+            it("on node key", async () => {
+                driveCrypto.decryptKey = jest.fn(async () => Promise.resolve({
+                    passphrase: "pass",
+                    key: "decryptedKey",
+                    passphraseSessionKey: "passphraseSessionKey",
+                    verified: crypto_1.VERIFICATION_STATUS.NOT_SIGNED,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Missing signature for key" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeKey',
+                });
+            });
+            it("on node name", async () => {
+                driveCrypto.decryptNodeName = jest.fn(async () => Promise.resolve({
+                    name: "name",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    nameAuthor: { ok: false, error: { claimedAuthor: "nameSignatureEmail", error: "Signature verification for name failed" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeName',
+                });
+            });
+            it("on folder extended attributes", async () => {
+                driveCrypto.decryptExtendedAttributes = jest.fn(async () => Promise.resolve({
+                    extendedAttributes: "{}",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    activeRevision: {
+                        ok: true, value: {
+                            uid: "revisionUid",
+                            extendedAttributes: "{}",
+                            state: interface_1.RevisionState.Active,
+                            // @ts-expect-error Ignore mocked data.
+                            creationTime: undefined,
+                            contentAuthor: { ok: false, error: { claimedAuthor: "revisionSignatureEmail", error: "Signature verification for attributes failed" } },
+                        }
+                    },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeExtendedAttributes',
+                });
+            });
+            it("on content key packet", async () => {
+                driveCrypto.decryptAndVerifySessionKey = jest.fn(async () => Promise.resolve({
+                    sessionKey: "contentKeyPacketSessionKey",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Signature verification for content key failed" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeContentKey',
+                });
+            });
+        });
+        describe("should decrypt with decryption issues", () => {
+            it("on node key", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptKey = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Failed to decrypt node key: Decryption error" } },
+                    activeRevision: { ok: false, error: new Error('Failed to decrypt node key: Decryption error') },
+                    errors: [new Error("Decryption error")],
+                    folder: undefined,
+                }, 'noKeys');
+                verifyLogEventDecryptionError({
+                    field: 'nodeKey',
+                    error,
+                });
+            });
+            it("on node name", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptNodeName = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    name: { ok: false, error },
+                    nameAuthor: { ok: false, error: { claimedAuthor: "nameSignatureEmail", error: "Decryption error" } },
+                }, 'noKeys');
+                verifyLogEventDecryptionError({
+                    field: 'nodeName',
+                    error,
+                });
+            });
+            it("on file extended attributes", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptExtendedAttributes = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    activeRevision: { ok: false, error: new Error('Failed to decrypt active revision: Decryption error') },
+                });
+                verifyLogEventDecryptionError({
+                    field: 'nodeExtendedAttributes',
+                    error,
+                });
+            });
+            it("on content key packet", async () => {
+                const error = new Error("Decryption error");
+                driveCrypto.decryptAndVerifySessionKey = jest.fn(async () => Promise.reject(error));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: "signatureEmail", error: 'Failed to decrypt content key: Decryption error' } },
+                    errors: [error],
+                }, {
+                    contentKeyPacketSessionKey: undefined,
+                });
+                verifyLogEventDecryptionError({
+                    field: 'nodeContentKey',
+                    error,
+                });
+            });
+        });
+        it("should fail when keys cannot be loaded", async () => {
+            account.getPublicKeys = jest.fn().mockRejectedValue(new Error("Failed to load keys"));
+            const result = cryptoService.decryptNode(encryptedNode, parentKey);
+            await expect(result).rejects.toThrow("Failed to load keys");
+        });
+    });
+    describe("anonymous node", () => {
+        const encryptedNode = {
+            uid: "volumeId~nodeId",
+            parentUid: "volumeId~parentId",
+            encryptedCrypto: {
+                signatureEmail: undefined,
+                nameSignatureEmail: undefined,
+                armoredKey: "armoredKey",
+                armoredNodePassphrase: "armoredNodePassphrase",
+                armoredNodePassphraseSignature: "armoredNodePassphraseSignature",
+                file: {
+                    base64ContentKeyPacket: "base64ContentKeyPacket",
+                },
+                activeRevision: {
+                    uid: "revisionUid",
+                    state: "active",
+                    signatureEmail: "revisionSignatureEmail",
+                    armoredExtendedAttributes: "encryptedExtendedAttributes",
+                },
+            },
+        };
+        const encryptedNodeWithoutParent = {
+            ...encryptedNode,
+            parentUid: undefined,
+        };
+        function verifyResult(result, expectedNode = {}, expectedKeys = {}) {
+            expect(result).toMatchObject({
+                node: {
+                    name: { ok: true, value: "name" },
+                    keyAuthor: { ok: true, value: "signatureEmail" },
+                    nameAuthor: { ok: true, value: "nameSignatureEmail" },
+                    folder: undefined,
+                    activeRevision: {
+                        ok: true, value: {
+                            uid: "revisionUid",
+                            state: interface_1.RevisionState.Active,
+                            creationTime: undefined,
+                            extendedAttributes: "{}",
+                            contentAuthor: { ok: true, value: "revisionSignatureEmail" },
+                        }
+                    },
+                    errors: undefined,
+                    ...expectedNode,
+                },
+                ...expectedKeys === 'noKeys' ? {} : {
+                    keys: {
+                        passphrase: "pass",
+                        key: "decryptedKey",
+                        passphraseSessionKey: "passphraseSessionKey",
+                        hashKey: undefined,
+                        contentKeyPacketSessionKey: "contentKeyPacketSessionKey",
+                        ...expectedKeys,
+                    },
+                },
+            });
+        }
+        describe("should decrypt with verification issues", () => {
+            it("on node key and name with access to parent node", async () => {
+                driveCrypto.decryptKey = jest.fn(async () => Promise.resolve({
+                    passphrase: "pass",
+                    key: "decryptedKey",
+                    passphraseSessionKey: "passphraseSessionKey",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                driveCrypto.decryptNodeName = jest.fn(async () => Promise.resolve({
+                    name: "name",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: false, error: { claimedAuthor: undefined, error: "Signature verification for key failed" } },
+                    nameAuthor: { ok: false, error: { claimedAuthor: undefined, error: "Signature verification for name failed" } },
+                });
+                verifyLogEventVerificationError({
+                    field: 'nodeName',
+                    addressMatchingDefaultShare: undefined,
+                });
+                expect(driveCrypto.decryptKey).toHaveBeenCalledWith(encryptedNode.encryptedCrypto.armoredKey, encryptedNode.encryptedCrypto.armoredNodePassphrase, encryptedNode.encryptedCrypto.armoredNodePassphraseSignature, [parentKey], [parentKey]);
+                expect(driveCrypto.decryptNodeName).toHaveBeenCalledWith(encryptedNode.encryptedName, parentKey, [parentKey]);
+            });
+            it("on anonymous node key and name without access to parent node", async () => {
+                driveCrypto.decryptKey = jest.fn(async () => Promise.resolve({
+                    passphrase: "pass",
+                    key: "decryptedKey",
+                    passphraseSessionKey: "passphraseSessionKey",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                driveCrypto.decryptNodeName = jest.fn(async () => Promise.resolve({
+                    name: "name",
+                    verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                }));
+                const result = await cryptoService.decryptNode(encryptedNodeWithoutParent, parentKey);
+                verifyResult(result, {
+                    keyAuthor: { ok: true, value: null },
+                    nameAuthor: { ok: true, value: null },
+                });
+                expect(telemetry.logEvent).not.toHaveBeenCalled();
+                expect(driveCrypto.decryptKey).toHaveBeenCalledWith(encryptedNode.encryptedCrypto.armoredKey, encryptedNode.encryptedCrypto.armoredNodePassphrase, encryptedNode.encryptedCrypto.armoredNodePassphraseSignature, [parentKey], []);
+                expect(driveCrypto.decryptNodeName).toHaveBeenCalledWith(encryptedNode.encryptedName, parentKey, []);
+            });
+        });
+    });
+    describe('moveNode', () => {
+        it('should encrypt node data for move operation', async () => {
+            const node = {
+                name: { ok: true, value: 'testFile.txt' },
+            };
+            const keys = {
+                passphrase: 'nodePassphrase',
+                passphraseSessionKey: 'nodePassphraseSessionKey',
+                nameSessionKey: 'nameSessionKey',
+            };
+            const parentKeys = {
+                key: 'newParentKey',
+                hashKey: new Uint8Array([1, 2, 3]),
+            };
+            const address = {
+                email: 'test@example.com',
+                addressKey: 'addressKey',
+            };
+            driveCrypto.encryptNodeName = jest.fn().mockResolvedValue({
+                armoredNodeName: 'encryptedNodeName',
+            });
+            driveCrypto.generateLookupHash = jest.fn().mockResolvedValue('newHash');
+            driveCrypto.encryptPassphrase = jest.fn().mockResolvedValue({
+                armoredPassphrase: 'encryptedPassphrase',
+                armoredPassphraseSignature: 'passphraseSignature',
+            });
+            const result = await cryptoService.moveNode(node, keys, parentKeys, address);
+            expect(result).toEqual({
+                encryptedName: 'encryptedNodeName',
+                hash: 'newHash',
+                armoredNodePassphrase: 'encryptedPassphrase',
+                armoredNodePassphraseSignature: 'passphraseSignature',
+                signatureEmail: 'test@example.com',
+                nameSignatureEmail: 'test@example.com',
+            });
+            expect(driveCrypto.encryptNodeName).toHaveBeenCalledWith('testFile.txt', keys.nameSessionKey, parentKeys.key, address.addressKey);
+            expect(driveCrypto.generateLookupHash).toHaveBeenCalledWith('testFile.txt', parentKeys.hashKey);
+            expect(driveCrypto.encryptPassphrase).toHaveBeenCalledWith(keys.passphrase, keys.passphraseSessionKey, [parentKeys.key], address.addressKey);
+        });
+        it('should throw error when moving to non-folder', async () => {
+            const node = {
+                name: { ok: true, value: 'testFile.txt' },
+            };
+            const keys = {
+                passphrase: 'nodePassphrase',
+                passphraseSessionKey: 'nodePassphraseSessionKey',
+                nameSessionKey: 'nameSessionKey',
+            };
+            const parentKeys = {
+                key: 'newParentKey',
+                hashKey: undefined,
+            };
+            const address = {
+                email: 'test@example.com',
+                addressKey: 'addressKey',
+            };
+            await expect(cryptoService.moveNode(node, keys, parentKeys, address))
+                .rejects.toThrow('Moving item to a non-folder is not allowed');
+        });
+        it('should throw error when node has invalid name', async () => {
+            const node = {
+                name: { ok: false, error: 'Invalid name' },
+            };
+            const keys = {
+                passphrase: 'nodePassphrase',
+                passphraseSessionKey: 'nodePassphraseSessionKey',
+                nameSessionKey: 'nameSessionKey',
+            };
+            const parentKeys = {
+                key: 'newParentKey',
+                hashKey: new Uint8Array([1, 2, 3]),
+            };
+            const address = {
+                email: 'test@example.com',
+                addressKey: 'addressKey',
+            };
+            await expect(cryptoService.moveNode(node, keys, parentKeys, address))
+                .rejects.toThrow('Cannot move item without a valid name, please rename the item first');
+        });
+    });
+});
+//# sourceMappingURL=cryptoService.test.js.map