@protontech/drive-sdk 0.0.10

package/dist/internal/shares/cryptoCache.test.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cache_1 = require("../../cache");
+const cryptoCache_1 = require("./cryptoCache");
+describe('sharesCryptoCache', () => {
+    let memoryCache;
+    let cache;
+    const generatePrivateKey = (name) => {
+        return name;
+    };
+    const generateSessionKey = (name) => {
+        return name;
+    };
+    beforeEach(() => {
+        memoryCache = new cache_1.MemoryCache();
+        cache = new cryptoCache_1.SharesCryptoCache(memoryCache);
+    });
+    it('should store and retrieve keys', async () => {
+        const shareId = 'newShareId';
+        const keys = { key: generatePrivateKey('privateKey'), passphraseSessionKey: generateSessionKey('sessionKey') };
+        await cache.setShareKey(shareId, keys);
+        const result = await cache.getShareKey(shareId);
+        expect(result).toStrictEqual(keys);
+    });
+    it('should replace and retrieve new keys', async () => {
+        const shareId = 'newShareId';
+        const keys1 = { key: generatePrivateKey('privateKey1'), passphraseSessionKey: generateSessionKey('sessionKey1') };
+        const keys2 = { key: generatePrivateKey('privateKey2'), passphraseSessionKey: generateSessionKey('sessionKey2') };
+        await cache.setShareKey(shareId, keys1);
+        await cache.setShareKey(shareId, keys2);
+        const result = await cache.getShareKey(shareId);
+        expect(result).toStrictEqual(keys2);
+    });
+    it('should remove keys', async () => {
+        const shareId = 'newShareId';
+        const keys = { key: generatePrivateKey('privateKey'), passphraseSessionKey: generateSessionKey('sessionKey') };
+        await cache.setShareKey(shareId, keys);
+        await cache.removeShareKey([shareId]);
+        try {
+            await cache.getShareKey(shareId);
+            throw new Error('Should have thrown an error');
+        }
+        catch (error) {
+            expect(`${error}`).toBe('Error: Entity not found');
+        }
+    });
+    it('should throw an error when retrieving a non-existing entity', async () => {
+        const shareId = 'newShareId';
+        try {
+            await cache.getShareKey(shareId);
+            throw new Error('Should have thrown an error');
+        }
+        catch (error) {
+            expect(`${error}`).toBe('Error: Entity not found');
+        }
+    });
+});
+//# sourceMappingURL=cryptoCache.test.js.map

package/dist/internal/shares/cryptoCache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoCache.test.js","sourceRoot":"","sources":["../../../src/internal/shares/cryptoCache.test.ts"],"names":[],"mappings":";;AACA,uCAA0C;AAE1C,+CAAkD;AAElD,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAC/B,IAAI,WAA8C,CAAC;IACnD,IAAI,KAAwB,CAAC;IAE7B,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,EAAE;QACxC,OAAO,IAA6B,CAAA;IACxC,CAAC,CAAA;IAED,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,EAAE;QACxC,OAAO,IAA6B,CAAA;IACxC,CAAC,CAAA;IAED,UAAU,CAAC,GAAG,EAAE;QACZ,WAAW,GAAG,IAAI,mBAAW,EAAE,CAAC;QAChC,KAAK,GAAG,IAAI,+BAAiB,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,YAAY,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;QAE/G,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,YAAY,CAAC;QAC7B,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;QAClH,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;QAElH,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,OAAO,GAAG,YAAY,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;QAE/G,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACD,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,OAAO,GAAG,YAAY,CAAC;QAE7B,IAAI,CAAC;YACD,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvD,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/internal/shares/cryptoService.d.ts

@@ -0,0 +1,42 @@
+import { ProtonDriveAccount, ProtonDriveTelemetry } from "../../interface";
+import { DriveCrypto, PrivateKey } from "../../crypto";
+import { EncryptedRootShare, DecryptedRootShare, EncryptedShareCrypto, DecryptedShareKey } from "./interface";
+/**
+ * Provides crypto operations for share keys.
+ *
+ * The share crypto service is responsible for encrypting and decrypting share
+ * keys. It should export high-level actions only, such as "decrypt share"
+ * instead of low-level operations like "decrypt share passphrase". Low-level
+ * operations should be kept private to the module.
+ *
+ * The service owns the logic to switch between old and new crypto model.
+ */
+export declare class SharesCryptoService {
+    private telemetry;
+    private driveCrypto;
+    private account;
+    private logger;
+    private reportedDecryptionErrors;
+    private reportedVerificationErrors;
+    constructor(telemetry: ProtonDriveTelemetry, driveCrypto: DriveCrypto, account: ProtonDriveAccount);
+    generateVolumeBootstrap(addressKey: PrivateKey): Promise<{
+        shareKey: {
+            encrypted: EncryptedShareCrypto;
+            decrypted: DecryptedShareKey;
+        };
+        rootNode: {
+            key: {
+                encrypted: EncryptedShareCrypto;
+                decrypted: DecryptedShareKey;
+            };
+            encryptedName: string;
+            armoredHashKey: string;
+        };
+    }>;
+    decryptRootShare(share: EncryptedRootShare): Promise<{
+        share: DecryptedRootShare;
+        key: DecryptedShareKey;
+    }>;
+    private reportDecryptionError;
+    private reportVerificationError;
+}

package/dist/internal/shares/cryptoService.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharesCryptoService = void 0;
+const interface_1 = require("../../interface");
+const crypto_1 = require("../../crypto");
+const errors_1 = require("../errors");
+const interface_2 = require("./interface");
+/**
+ * Provides crypto operations for share keys.
+ *
+ * The share crypto service is responsible for encrypting and decrypting share
+ * keys. It should export high-level actions only, such as "decrypt share"
+ * instead of low-level operations like "decrypt share passphrase". Low-level
+ * operations should be kept private to the module.
+ *
+ * The service owns the logic to switch between old and new crypto model.
+ */
+class SharesCryptoService {
+    telemetry;
+    driveCrypto;
+    account;
+    logger;
+    reportedDecryptionErrors = new Set();
+    reportedVerificationErrors = new Set();
+    constructor(telemetry, driveCrypto, account) {
+        this.telemetry = telemetry;
+        this.driveCrypto = driveCrypto;
+        this.account = account;
+        this.telemetry = telemetry;
+        this.logger = telemetry.getLogger('shares-crypto');
+        this.driveCrypto = driveCrypto;
+        this.account = account;
+    }
+    async generateVolumeBootstrap(addressKey) {
+        const shareKey = await this.driveCrypto.generateKey([addressKey], addressKey);
+        const rootNodeKey = await this.driveCrypto.generateKey([shareKey.decrypted.key], addressKey);
+        const { armoredNodeName } = await this.driveCrypto.encryptNodeName('root', undefined, shareKey.decrypted.key, addressKey);
+        const { armoredHashKey } = await this.driveCrypto.generateHashKey(rootNodeKey.decrypted.key);
+        return {
+            shareKey,
+            rootNode: {
+                key: rootNodeKey,
+                encryptedName: armoredNodeName,
+                armoredHashKey,
+            },
+        };
+    }
+    async decryptRootShare(share) {
+        const { keys: addressKeys } = await this.account.getOwnAddress(share.addressId);
+        const addressPublicKeys = await this.account.getPublicKeys(share.creatorEmail);
+        let key, passphraseSessionKey, verified;
+        try {
+            const result = await this.driveCrypto.decryptKey(share.encryptedCrypto.armoredKey, share.encryptedCrypto.armoredPassphrase, share.encryptedCrypto.armoredPassphraseSignature, addressKeys.map(({ key }) => key), addressPublicKeys);
+            key = result.key;
+            passphraseSessionKey = result.passphraseSessionKey;
+            verified = result.verified;
+        }
+        catch (error) {
+            this.reportDecryptionError(share, error);
+            throw error;
+        }
+        const author = verified === crypto_1.VERIFICATION_STATUS.SIGNED_AND_VALID
+            ? (0, interface_1.resultOk)(share.creatorEmail)
+            : (0, interface_1.resultError)({
+                claimedAuthor: share.creatorEmail,
+                error: (0, errors_1.getVerificationMessage)(verified),
+            });
+        if (!author.ok) {
+            await this.reportVerificationError(share);
+        }
+        return {
+            share: {
+                ...share,
+                author,
+            },
+            key: {
+                key,
+                passphraseSessionKey,
+            },
+        };
+    }
+    reportDecryptionError(share, error) {
+        if (this.reportedDecryptionErrors.has(share.shareId)) {
+            return;
+        }
+        const fromBefore2024 = share.creationTime ? share.creationTime < new Date('2024-01-01') : undefined;
+        this.logger.error(`Failed to decrypt share ${share.shareId} (from before 2024: ${fromBefore2024})`, error);
+        this.telemetry.logEvent({
+            eventName: 'decryptionError',
+            context: shareTypeToMetricContext(share.type),
+            field: 'shareKey',
+            fromBefore2024,
+            error,
+        });
+        this.reportedDecryptionErrors.add(share.shareId);
+    }
+    async reportVerificationError(share) {
+        if (this.reportedVerificationErrors.has(share.shareId)) {
+            return;
+        }
+        const fromBefore2024 = share.creationTime ? share.creationTime < new Date('2024-01-01') : undefined;
+        this.logger.error(`Failed to verify share ${share.shareId} (from before 2024: ${fromBefore2024})`);
+        this.telemetry.logEvent({
+            eventName: 'verificationError',
+            context: shareTypeToMetricContext(share.type),
+            field: 'shareKey',
+            fromBefore2024,
+        });
+        this.reportedVerificationErrors.add(share.shareId);
+    }
+}
+exports.SharesCryptoService = SharesCryptoService;
+function shareTypeToMetricContext(shareType) {
+    // SDK doesn't support public sharing yet, also public sharing
+    // doesn't use a share but shareURL, thus we can simplify and
+    // ignore this case for now.
+    switch (shareType) {
+        case interface_2.ShareType.Main:
+        case interface_2.ShareType.Device:
+        case interface_2.ShareType.Photo:
+            return interface_1.MetricContext.OwnVolume;
+        case interface_2.ShareType.Standard:
+            return interface_1.MetricContext.Shared;
+    }
+}
+//# sourceMappingURL=cryptoService.js.map

package/dist/internal/shares/cryptoService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoService.js","sourceRoot":"","sources":["../../../src/internal/shares/cryptoService.ts"],"names":[],"mappings":";;;AAAA,+CAAwJ;AACxJ,yCAA4E;AAC5E,sCAAmD;AACnD,2CAAyH;AAEzH;;;;;;;;;GASG;AACH,MAAa,mBAAmB;IAMR;IAAyC;IAAkC;IALvF,MAAM,CAAS;IAEf,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvD,YAAoB,SAA+B,EAAU,WAAwB,EAAU,OAA2B;QAAtG,cAAS,GAAT,SAAS,CAAsB;QAAU,gBAAW,GAAX,WAAW,CAAa;QAAU,YAAO,GAAP,OAAO,CAAoB;QACtH,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,UAAsB;QAQhD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAC7F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1H,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7F,OAAO;YACH,QAAQ;YACR,QAAQ,EAAE;gBACN,GAAG,EAAE,WAAW;gBAChB,aAAa,EAAE,eAAe;gBAC9B,cAAc;aACjB;SACJ,CAAA;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAyB;QAC5C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE/E,IAAI,GAAG,EAAE,oBAAoB,EAAE,QAAQ,CAAC;QACxC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAC5C,KAAK,CAAC,eAAe,CAAC,UAAU,EAChC,KAAK,CAAC,eAAe,CAAC,iBAAiB,EACvC,KAAK,CAAC,eAAe,CAAC,0BAA0B,EAChD,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EACjC,iBAAiB,CACpB,CAAA;YACD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACjB,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;YACnD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAA0C,QAAQ,KAAK,4BAAmB,CAAC,gBAAgB;YACnG,CAAC,CAAC,IAAA,oBAAQ,EAAC,KAAK,CAAC,YAAY,CAAC;YAC9B,CAAC,CAAC,IAAA,uBAAW,EAAC;gBACV,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,KAAK,EAAE,IAAA,+BAAsB,EAAC,QAAQ,CAAC;aAC1C,CAAC,CAAC;QAEP,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO;YACH,KAAK,EAAE;gBACH,GAAG,KAAK;gBACR,MAAM;aACT;YACD,GAAG,EAAE;gBACD,GAAG;gBACH,oBAAoB;aACvB;SACJ,CAAA;IACL,CAAC;IAEO,qBAAqB,CAAC,KAAyB,EAAE,KAAe;QACpE,IAAI,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,OAAO;QACX,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,uBAAuB,cAAc,GAAG,EAAE,KAAK,CAAC,CAAC;QAE3G,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpB,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,UAAU;YACjB,cAAc;YACd,KAAK;SACR,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,KAAyB;QAC3D,IAAI,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO;QACX,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,OAAO,uBAAuB,cAAc,GAAG,CAAC,CAAC;QAEnG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpB,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,UAAU;YACjB,cAAc;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;CACJ;AAjHD,kDAiHC;AAED,SAAS,wBAAwB,CAAC,SAAoB;IAClD,8DAA8D;IAC9D,6DAA6D;IAC7D,4BAA4B;IAC5B,QAAQ,SAAS,EAAE,CAAC;QAChB,KAAK,qBAAS,CAAC,IAAI,CAAC;QACpB,KAAK,qBAAS,CAAC,MAAM,CAAC;QACtB,KAAK,qBAAS,CAAC,KAAK;YAChB,OAAO,yBAAa,CAAC,SAAS,CAAC;QACnC,KAAK,qBAAS,CAAC,QAAQ;YACnB,OAAO,yBAAa,CAAC,MAAM,CAAC;IACpC,CAAC;AACL,CAAC"}

package/dist/internal/shares/cryptoService.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal/shares/cryptoService.test.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("../../crypto");
+const telemetry_1 = require("../../tests/telemetry");
+const interface_1 = require("./interface");
+const cryptoService_1 = require("./cryptoService");
+describe("SharesCryptoService", () => {
+    let telemetry;
+    let driveCrypto;
+    let account;
+    let cryptoService;
+    beforeEach(() => {
+        telemetry = (0, telemetry_1.getMockTelemetry)();
+        // @ts-expect-error No need to implement all methods for mocking
+        driveCrypto = {
+            decryptKey: jest.fn(async () => Promise.resolve({
+                passphrase: "pass",
+                key: "decryptedKey",
+                passphraseSessionKey: "sessionKey",
+                verified: crypto_1.VERIFICATION_STATUS.SIGNED_AND_VALID,
+            })),
+        };
+        account = {
+            // @ts-expect-error No need to implement full response for mocking
+            getOwnAddress: jest.fn(async () => ({
+                keys: [{ key: "addressKey" }],
+            })),
+            getPublicKeys: jest.fn(async () => []),
+        };
+        cryptoService = new cryptoService_1.SharesCryptoService(telemetry, driveCrypto, account);
+    });
+    it("should decrypt root share", async () => {
+        const result = await cryptoService.decryptRootShare({
+            shareId: "shareId",
+            addressId: "addressId",
+            creatorEmail: "signatureEmail",
+            encryptedCrypto: {
+                armoredKey: "armoredKey",
+                armoredPassphrase: "armoredPassphrase",
+                armoredPassphraseSignature: "armoredPassphraseSignature",
+            },
+            type: interface_1.ShareType.Main,
+        });
+        expect(result).toMatchObject({
+            share: {
+                shareId: "shareId",
+                author: { ok: true, value: "signatureEmail" },
+            },
+            key: {
+                key: "decryptedKey",
+                passphraseSessionKey: "sessionKey",
+            },
+        });
+        expect(account.getOwnAddress).toHaveBeenCalledWith("addressId");
+        expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+        expect(telemetry.logEvent).not.toHaveBeenCalled();
+    });
+    it("should decrypt root share with signiture verification error", async () => {
+        driveCrypto.decryptKey = jest.fn(async () => Promise.resolve({
+            passphrase: "pass",
+            key: "decryptedKey",
+            passphraseSessionKey: "sessionKey",
+            verified: crypto_1.VERIFICATION_STATUS.NOT_SIGNED,
+        }));
+        const result = await cryptoService.decryptRootShare({
+            shareId: "shareId",
+            addressId: "addressId",
+            creatorEmail: "signatureEmail",
+            encryptedCrypto: {
+                armoredKey: "armoredKey",
+                armoredPassphrase: "armoredPassphrase",
+                armoredPassphraseSignature: "armoredPassphraseSignature",
+            },
+            type: interface_1.ShareType.Main,
+        });
+        expect(result).toMatchObject({
+            share: {
+                shareId: "shareId",
+                author: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Missing signature" } },
+            },
+            key: {
+                key: "decryptedKey",
+                passphraseSessionKey: "sessionKey",
+            },
+        });
+        expect(account.getOwnAddress).toHaveBeenCalledWith("addressId");
+        expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+        expect(telemetry.logEvent).toHaveBeenCalledWith({
+            eventName: 'verificationError',
+            context: 'own_volume',
+            field: 'shareKey',
+            addressMatchingDefaultShare: undefined,
+            fromBefore2024: undefined,
+        });
+    });
+    it("should handle decrypt issue of root share", async () => {
+        const error = new Error("Decryption error");
+        driveCrypto.decryptKey = jest.fn(async () => Promise.reject(error));
+        const result = cryptoService.decryptRootShare({
+            shareId: "shareId",
+            addressId: "addressId",
+            creatorEmail: "signatureEmail",
+            encryptedCrypto: {
+                armoredKey: "armoredKey",
+                armoredPassphrase: "armoredPassphrase",
+                armoredPassphraseSignature: "armoredPassphraseSignature",
+            },
+            type: interface_1.ShareType.Main,
+        });
+        await expect(result).rejects.toThrow(error);
+        expect(telemetry.logEvent).toHaveBeenCalledWith({
+            eventName: 'decryptionError',
+            context: 'own_volume',
+            field: 'shareKey',
+            fromBefore2024: undefined,
+            error,
+        });
+    });
+});
+//# sourceMappingURL=cryptoService.test.js.map

package/dist/internal/shares/cryptoService.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoService.test.js","sourceRoot":"","sources":["../../../src/internal/shares/cryptoService.test.ts"],"names":[],"mappings":";;AAAA,yCAAwF;AAExF,qDAAyD;AACzD,2CAA4D;AAC5D,mDAAsD;AAEtD,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,IAAI,SAA+B,CAAC;IACpC,IAAI,WAAwB,CAAC;IAC7B,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAkC,CAAC;IAEvC,UAAU,CAAC,GAAG,EAAE;QACZ,SAAS,GAAG,IAAA,4BAAgB,GAAE,CAAC;QAC/B,gEAAgE;QAChE,WAAW,GAAG;YACV,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC5C,UAAU,EAAE,MAAM;gBAClB,GAAG,EAAE,cAAuC;gBAC5C,oBAAoB,EAAE,YAAqC;gBAC3D,QAAQ,EAAE,4BAAmB,CAAC,gBAAgB;aACjD,CAAC,CAAC;SACN,CAAC;QACF,OAAO,GAAG;YACN,kEAAkE;YAClE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,YAAqC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;SACzC,CAAC;QACF,aAAa,GAAG,IAAI,mCAAmB,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAC/C;YACI,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,WAAW;YACtB,YAAY,EAAE,gBAAgB;YAC9B,eAAe,EAAE;gBACb,UAAU,EAAE,YAAY;gBACxB,iBAAiB,EAAE,mBAAmB;gBACtC,0BAA0B,EAAE,4BAA4B;aAC3D;YACD,IAAI,EAAE,qBAAS,CAAC,IAAI;SACD,CAC1B,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YACzB,KAAK,EAAE;gBACH,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE;aAChD;YACD,GAAG,EAAE;gBACD,GAAG,EAAE,cAAc;gBACnB,oBAAoB,EAAE,YAAY;aACrC;SACJ,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACrE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACzE,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACzD,UAAU,EAAE,MAAM;YAClB,GAAG,EAAE,cAAuC;YAC5C,oBAAoB,EAAE,YAAqC;YAC3D,QAAQ,EAAE,4BAAmB,CAAC,UAAU;SAC3C,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAC/C;YACI,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,WAAW;YACtB,YAAY,EAAE,gBAAgB;YAC9B,eAAe,EAAE;gBACb,UAAU,EAAE,YAAY;gBACxB,iBAAiB,EAAE,mBAAmB;gBACtC,0BAA0B,EAAE,4BAA4B;aAC3D;YACD,IAAI,EAAE,qBAAS,CAAC,IAAI;SACD,CAC1B,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YACzB,KAAK,EAAE;gBACH,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE;aAChG;YACD,GAAG,EAAE;gBACD,GAAG,EAAE,cAAc;gBACnB,oBAAoB,EAAE,YAAY;aACrC;SACJ,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACrE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC;YAC5C,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,UAAU;YACjB,2BAA2B,EAAE,SAAS;YACtC,cAAc,EAAE,SAAS;SAC5B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC5C,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,aAAa,CAAC,gBAAgB,CACzC;YACI,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,WAAW;YACtB,YAAY,EAAE,gBAAgB;YAC9B,eAAe,EAAE;gBACb,UAAU,EAAE,YAAY;gBACxB,iBAAiB,EAAE,mBAAmB;gBACtC,0BAA0B,EAAE,4BAA4B;aAC3D;YACD,IAAI,EAAE,qBAAS,CAAC,IAAI;SACD,CAC1B,CAAC;QAEF,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE5C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC;YAC5C,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,SAAS;YACzB,KAAK;SACR,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/internal/shares/index.d.ts

@@ -0,0 +1,15 @@
+import { ProtonDriveEntitiesCache, ProtonDriveCryptoCache, ProtonDriveAccount, ProtonDriveTelemetry } from "../../interface";
+import { DriveCrypto } from '../../crypto';
+import { DriveAPIService } from "../apiService";
+import { SharesManager } from "./manager";
+export type { EncryptedShare } from "./interface";
+/**
+ * Provides facade for the whole shares module.
+ *
+ * The shares module is responsible for handling shares metadata, including
+ * API communication, encryption, decryption, caching, and event handling.
+ *
+ * This facade provides internal interface that other modules can use to
+ * interact with the shares.
+ */
+export declare function initSharesModule(telemetry: ProtonDriveTelemetry, apiService: DriveAPIService, driveEntitiesCache: ProtonDriveEntitiesCache, driveCryptoCache: ProtonDriveCryptoCache, account: ProtonDriveAccount, crypto: DriveCrypto): SharesManager;

package/dist/internal/shares/index.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initSharesModule = initSharesModule;
+const apiService_1 = require("./apiService");
+const cryptoCache_1 = require("./cryptoCache");
+const cache_1 = require("./cache");
+const cryptoService_1 = require("./cryptoService");
+const manager_1 = require("./manager");
+/**
+ * Provides facade for the whole shares module.
+ *
+ * The shares module is responsible for handling shares metadata, including
+ * API communication, encryption, decryption, caching, and event handling.
+ *
+ * This facade provides internal interface that other modules can use to
+ * interact with the shares.
+ */
+function initSharesModule(telemetry, apiService, driveEntitiesCache, driveCryptoCache, account, crypto) {
+    const api = new apiService_1.SharesAPIService(apiService);
+    const cache = new cache_1.SharesCache(telemetry.getLogger('shares-cache'), driveEntitiesCache);
+    const cryptoCache = new cryptoCache_1.SharesCryptoCache(driveCryptoCache);
+    const cryptoService = new cryptoService_1.SharesCryptoService(telemetry, crypto, account);
+    const sharesManager = new manager_1.SharesManager(telemetry.getLogger('shares'), api, cache, cryptoCache, cryptoService, account);
+    return sharesManager;
+}
+//# sourceMappingURL=index.js.map

package/dist/internal/shares/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/shares/index.ts"],"names":[],"mappings":";;AAoBA,4CAcC;AA/BD,6CAAgD;AAChD,+CAAkD;AAClD,mCAAsC;AACtC,mDAAsD;AACtD,uCAA0C;AAI1C;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAC5B,SAA+B,EAC/B,UAA2B,EAC3B,kBAA4C,EAC5C,gBAAwC,EACxC,OAA2B,EAC3B,MAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,6BAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,mBAAW,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,IAAI,+BAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,mCAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,IAAI,uBAAa,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACxH,OAAO,aAAa,CAAC;AACzB,CAAC"}

package/dist/internal/shares/interface.d.ts

@@ -0,0 +1,94 @@
+import { PrivateKey, SessionKey } from "../../crypto";
+import { Result, UnverifiedAuthorError } from "../../interface";
+/**
+ * Internal interface providing basic identification of volume and its root
+ * share and node.
+ *
+ * No interface should inherit from this, this is only for composition to
+ * create basic volume or share interfaces.
+ *
+ * Volumes do not have necessarily share or node, but we want to always
+ * know what is the root share or node, thus we want to keep this for both
+ * volumes or any type of share.
+ */
+export interface VolumeShareNodeIDs {
+    volumeId: string;
+    shareId: string;
+    rootNodeId: string;
+}
+export type Volume = {
+    /**
+     * Creator email and address ID come from the default share.
+     *
+     * The idea is to keep this information synced, so whenever we check
+     * cached volume information, we have creator details at hand for any
+     * verification checks or creation needs.
+     */
+    creatorEmail: string;
+    addressId: string;
+} & VolumeShareNodeIDs;
+/**
+ * Internal share interface.
+ */
+type BaseShare = {
+    /**
+     * Address ID is set only when user is member of the share.
+     * Owner or invitee of share with higher access in the tree
+     * might not have this field set.
+     */
+    addressId?: string;
+    creationTime?: Date;
+    type: ShareType;
+} & VolumeShareNodeIDs;
+export declare enum ShareType {
+    Main = "main",
+    Standard = "standard",
+    Device = "device",
+    Photo = "photo"
+}
+interface BaseRootShare extends BaseShare {
+    /**
+     * Address ID is always available for root shares, in contrast
+     * to other standard shares that might not have it. See the comment
+     * for BaseShare.
+     */
+    addressId: string;
+}
+/**
+ * Interface used only internaly in the shares module.
+ *
+ * Outside of the module, the decrypted share interface should be used.
+ */
+export interface EncryptedShare extends BaseShare {
+    creatorEmail: string;
+    encryptedCrypto: EncryptedShareCrypto;
+    membership?: ShareMembership;
+}
+interface ShareMembership {
+    memberUid: string;
+}
+/**
+ * Interface used only internaly in the shares module.
+ *
+ * Outside of the module, the decrypted share interface should be used.
+ */
+export interface EncryptedRootShare extends BaseRootShare {
+    creatorEmail: string;
+    encryptedCrypto: EncryptedShareCrypto;
+}
+/**
+ * Interface holding decrypted share metadata.
+ */
+export interface DecryptedRootShare extends BaseRootShare {
+    author: Result<string, UnverifiedAuthorError>;
+}
+export interface EncryptedShareCrypto {
+    armoredKey: string;
+    armoredPassphrase: string;
+    armoredPassphraseSignature: string;
+}
+export interface DecryptedShareKey {
+    key: PrivateKey;
+    passphraseSessionKey: SessionKey;
+}
+export {};

package/dist/internal/shares/interface.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShareType = void 0;
+var ShareType;
+(function (ShareType) {
+    ShareType["Main"] = "main";
+    ShareType["Standard"] = "standard";
+    ShareType["Device"] = "device";
+    ShareType["Photo"] = "photo";
+})(ShareType || (exports.ShareType = ShareType = {}));
+//# sourceMappingURL=interface.js.map

package/dist/internal/shares/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../../src/internal/shares/interface.ts"],"names":[],"mappings":";;;AA8CA,IAAY,SAKX;AALD,WAAY,SAAS;IACjB,0BAAa,CAAA;IACb,kCAAqB,CAAA;IACrB,8BAAiB,CAAA;IACjB,4BAAe,CAAA;AACnB,CAAC,EALW,SAAS,yBAAT,SAAS,QAKpB"}

package/dist/internal/shares/manager.d.ts

@@ -0,0 +1,68 @@
+import { Logger, MetricContext, ProtonDriveAccount } from "../../interface";
+import { PrivateKey } from "../../crypto";
+import { SharesAPIService } from "./apiService";
+import { SharesCache } from "./cache";
+import { SharesCryptoCache } from "./cryptoCache";
+import { SharesCryptoService } from "./cryptoService";
+import { VolumeShareNodeIDs, EncryptedShare } from "./interface";
+/**
+ * Provides high-level actions for managing shares.
+ *
+ * The manager is responsible for handling shares metadata, including
+ * API communication, encryption, decryption, and caching.
+ *
+ * This module uses other modules providing low-level operations, such
+ * as API service, cache, crypto service, etc.
+ */
+export declare class SharesManager {
+    private logger;
+    private apiService;
+    private cache;
+    private cryptoCache;
+    private cryptoService;
+    private account;
+    private myFilesIds?;
+    private rootShares;
+    constructor(logger: Logger, apiService: SharesAPIService, cache: SharesCache, cryptoCache: SharesCryptoCache, cryptoService: SharesCryptoService, account: ProtonDriveAccount);
+    /**
+     * It returns the IDs of the My files section.
+     *
+     * If the default volume or My files section doesn't exist, it creates it.
+     */
+    getMyFilesIDs(): Promise<VolumeShareNodeIDs>;
+    /**
+     * Creates new default volume for the user.
+     *
+     * It generates the volume bootstrap, creates the volume on the server,
+     * and caches the volume metadata.
+     *
+     * User can have only one default volume.
+     *
+     * @throws If the volume cannot be created (e.g., one already exists).
+     */
+    private createVolume;
+    /**
+     * It is a high-level action that retrieves the private key for a share.
+     * If prefers to use the cache, but if the key is not there, it fetches
+     * the share from the API, decrypts it, and caches it.
+     *
+     * @param shareId - The ID of the share.
+     * @returns The private key for the share.
+     * @throws If the share is not found or cannot be decrypted, or cached.
+     */
+    getSharePrivateKey(shareId: string): Promise<PrivateKey>;
+    getMyFilesShareMemberEmailKey(): Promise<{
+        email: string;
+        addressId: string;
+        addressKey: PrivateKey;
+        addressKeyId: string;
+    }>;
+    getContextShareMemberEmailKey(shareId: string): Promise<{
+        email: string;
+        addressId: string;
+        addressKey: PrivateKey;
+        addressKeyId: string;
+    }>;
+    getVolumeMetricContext(volumeId: string): Promise<MetricContext>;
+    loadEncryptedShare(shareId: string): Promise<EncryptedShare>;
+}