@protontech/drive-sdk 0.0.10

package/src/internal/devices/manager.test.ts

@@ -0,0 +1,129 @@
+import { Device, DeviceType, Logger } from '../../interface';
+import { ValidationError } from '../../errors';
+import { getMockLogger } from '../../tests/logger';
+import { DevicesAPIService } from './apiService';
+import { DevicesCryptoService } from './cryptoService';
+import { SharesService, NodesService, NodesManagementService, DeviceMetadata } from './interface';
+import { DevicesManager } from './manager';
+
+describe('DevicesManager', () => {
+    let logger: Logger;
+    let apiService: jest.Mocked<DevicesAPIService>;
+    let cryptoService: jest.Mocked<DevicesCryptoService>;
+    let sharesService: jest.Mocked<SharesService>;
+    let nodesService: jest.Mocked<NodesService>;
+    let nodesManagementService: jest.Mocked<NodesManagementService>;
+    let manager: DevicesManager;
+
+    beforeEach(() => {
+        logger = getMockLogger();
+        // @ts-expect-error No need to implement all methods for mocking
+        apiService = {
+            createDevice: jest.fn(),
+            getDevices: jest.fn(),
+            removeNameFromDevice: jest.fn(),
+            deleteDevice: jest.fn(),
+        };
+        // @ts-expect-error No need to implement all methods for mocking
+        cryptoService = {
+            createDevice: jest.fn(),
+        };
+        // @ts-expect-error No need to implement all methods for mocking
+        sharesService = {
+            getMyFilesIDs: jest.fn(),
+        };
+        // @ts-expect-error No need to implement all methods for mocking
+        nodesService = {};
+        nodesManagementService = {
+            renameNode: jest.fn(),
+        };
+
+        manager = new DevicesManager(
+            logger,
+            apiService,
+            cryptoService,
+            sharesService,
+            nodesService,
+            nodesManagementService,
+        );
+    });
+
+    it('creates device', async () => {
+        const volumeId = 'volume123';
+        const name = 'Test Device';
+        const deviceType = DeviceType.Linux;
+        const address = { addressId: 'address123', addressKeyId: 'key123' };
+        const shareKey = { armoredKey: 'armoredKey', armoredPassphrase: 'passphrase', armoredPassphraseSignature: 'signature' };
+        const node = { encryptedName: 'encryptedName', key: { armoredKey: 'nodeKey', armoredPassphrase: 'nodePassphrase', armoredPassphraseSignature: 'nodeSignature' }, armoredHashKey: 'hashKey' };
+        const createdDevice = { uid: 'device123', rootFolderUid: 'rootFolder123', type: deviceType, shareId: 'shareid' } as DeviceMetadata;
+
+        sharesService.getMyFilesIDs.mockResolvedValue({ volumeId });
+        cryptoService.createDevice.mockResolvedValue({ address, shareKey, node });
+        apiService.createDevice.mockResolvedValue(createdDevice);
+
+        const result = await manager.createDevice(name, deviceType);
+
+        expect(sharesService.getMyFilesIDs).toHaveBeenCalled();
+        expect(cryptoService.createDevice).toHaveBeenCalledWith(name);
+        expect(apiService.createDevice).toHaveBeenCalledWith(
+            { volumeId, type: deviceType },
+            {
+                addressId: address.addressId,
+                addressKeyId: address.addressKeyId,
+                armoredKey: shareKey.armoredKey,
+                armoredSharePassphrase: shareKey.armoredPassphrase,
+                armoredSharePassphraseSignature: shareKey.armoredPassphraseSignature,
+            },
+            {
+                encryptedName: node.encryptedName,
+                armoredKey: node.key.armoredKey,
+                armoredNodePassphrase: node.key.armoredPassphrase,
+                armoredNodePassphraseSignature: node.key.armoredPassphraseSignature,
+                armoredHashKey: node.armoredHashKey,
+            }
+        );
+        expect(result).toEqual({ ...createdDevice, name: { ok: true, value: name } });
+    });
+
+    it('renames device with deprecated name', async () => {
+        const deviceUid = 'device123';
+        const name = 'New Device Name';
+        const device = { uid: deviceUid, rootFolderUid: 'rootFolder123', hasDeprecatedName: true, shareId: 'shareid' } as DeviceMetadata;
+
+        apiService.getDevices.mockResolvedValue([device]);
+
+        const result = await manager.renameDevice(deviceUid, name);
+
+        expect(apiService.getDevices).toHaveBeenCalled();
+        expect(apiService.removeNameFromDevice).toHaveBeenCalledWith(deviceUid);
+        expect(nodesManagementService.renameNode).toHaveBeenCalledWith(device.rootFolderUid, name, { allowRenameRootNode: true });
+        expect(result).toEqual({ ...device, name: { ok: true, value: name } });
+    });
+
+    it('renames device without deprecated name', async () => {
+        const deviceUid = 'device123';
+        const name = 'New Device Name';
+        const device = { uid: deviceUid, rootFolderUid: 'rootFolder123', hasDeprecatedName: false, shareId: 'shareid' } as DeviceMetadata;
+
+        apiService.getDevices.mockResolvedValue([device]);
+
+        const result = await manager.renameDevice(deviceUid, name);
+
+        expect(apiService.getDevices).toHaveBeenCalled();
+        expect(apiService.removeNameFromDevice).not.toHaveBeenCalled();
+        expect(nodesManagementService.renameNode).toHaveBeenCalledWith(device.rootFolderUid, name, { allowRenameRootNode: true });
+        expect(result).toEqual({ ...device, name: { ok: true, value: name } });
+    });
+
+    it('renames non-existing device', async () => {
+        const deviceUid = 'nonexistentDevice';
+        const name = 'New Device Name';
+
+        apiService.getDevices.mockResolvedValue([]);
+
+        await expect(manager.renameDevice(deviceUid, name)).rejects.toThrow(ValidationError);
+        expect(apiService.getDevices).toHaveBeenCalled();
+        expect(apiService.removeNameFromDevice).not.toHaveBeenCalled();
+        expect(nodesManagementService.renameNode).not.toHaveBeenCalled();
+    });
+});

package/src/internal/devices/manager.ts

@@ -0,0 +1,113 @@
+import { c } from 'ttag';
+
+import { ValidationError } from '../../errors';
+import { Device, DeviceType, Logger, resultOk } from '../../interface';
+import { DevicesAPIService } from './apiService';
+import { DevicesCryptoService } from './cryptoService';
+import { DeviceMetadata, NodesManagementService, NodesService, SharesService } from './interface';
+
+export class DevicesManager {
+    constructor(
+        private logger: Logger,
+        private apiService: DevicesAPIService,
+        private cryptoService: DevicesCryptoService,
+        private sharesService: SharesService,
+        private nodesService: NodesService,
+        private nodesManagementService: NodesManagementService,
+    ) {
+        this.logger = logger;
+        this.apiService = apiService;
+        this.cryptoService = cryptoService;
+        this.sharesService = sharesService;
+        this.nodesService = nodesService;
+        this.nodesManagementService = nodesManagementService;
+    }
+
+    async *iterateDevices(signal?: AbortSignal): AsyncGenerator<Device> {
+        const devices = await this.apiService.getDevices(signal);
+
+        const nodeUidToDevice = new Map<string, DeviceMetadata>();
+        for (const device of devices) {
+            nodeUidToDevice.set(device.rootFolderUid, device);
+        }
+
+        for await (const node of this.nodesService.iterateNodes(Array.from(nodeUidToDevice.keys()), signal)) {
+            if ('missingUid' in node) {
+                continue;
+            }
+
+            const device = nodeUidToDevice.get(node.uid);
+            if (device) {
+                yield {
+                    ...device,
+                    name: node.name,
+                };
+            }
+        }
+    }
+
+    async createDevice(name: string, deviceType: DeviceType): Promise<Device> {
+        const { volumeId } = await this.sharesService.getMyFilesIDs();
+        const { address, shareKey, node } = await this.cryptoService.createDevice(name);
+
+        const device = await this.apiService.createDevice(
+            {
+                volumeId,
+                type: deviceType,
+            },
+            {
+                addressId: address.addressId,
+                addressKeyId: address.addressKeyId,
+                armoredKey: shareKey.armoredKey,
+                armoredSharePassphrase: shareKey.armoredPassphrase,
+                armoredSharePassphraseSignature: shareKey.armoredPassphraseSignature,
+            },
+            {
+                encryptedName: node.encryptedName,
+                armoredKey: node.key.armoredKey,
+                armoredNodePassphrase: node.key.armoredPassphrase,
+                armoredNodePassphraseSignature: node.key.armoredPassphraseSignature,
+                armoredHashKey: node.armoredHashKey,
+            },
+        );
+        return {
+            ...device,
+            name: resultOk(name),
+        };
+    }
+
+    async renameDevice(deviceUid: string, name: string): Promise<Device> {
+        const device = await this.getDeviceMetadata(deviceUid);
+
+        if (device.hasDeprecatedName) {
+            this.logger.info("Removing deprecated name from device");
+            try {
+                await this.apiService.removeNameFromDevice(deviceUid);
+            } catch (error: unknown) {
+                this.logger.error('Failed to remove name from device', error);
+            }
+        }
+
+        await this.nodesManagementService.renameNode(device.rootFolderUid, name, {
+            allowRenameRootNode: true,
+        });
+
+        return {
+            ...device,
+            name: resultOk(name),
+        }
+    }
+
+    private async getDeviceMetadata(deviceUid: string): Promise<DeviceMetadata> {
+        const devices = await this.apiService.getDevices();
+        const device = devices.find(device => device.uid === deviceUid);
+        if (!device) {
+            throw new ValidationError(c('Error').t`Device not found`);
+        }
+        return device;
+    }
+
+    async deleteDevice(deviceUid: string): Promise<void> {
+        await this.apiService.deleteDevice(deviceUid);
+    }
+}

package/src/internal/download/apiService.ts

@@ -0,0 +1,145 @@
+import { c } from "ttag";
+import { ValidationError } from "../../errors";
+import { DriveAPIService, drivePaths, ObserverStream } from "../apiService";
+import { makeNodeThumbnailUid, splitNodeRevisionUid, splitNodeThumbnailUid } from "../uids";
+import { BlockMetadata } from "./interface";
+
+const BLOCKS_PAGE_SIZE = 20;
+
+type GetRevisionResponse = drivePaths['/drive/v2/volumes/{volumeID}/files/{linkID}/revisions/{revisionID}']['get']['responses']['200']['content']['application/json'];
+
+type PostGetThumbnailsRequest = Extract<drivePaths['/drive/volumes/{volumeID}/thumbnails']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostGetThumbnailsResponse = drivePaths['/drive/volumes/{volumeID}/thumbnails']['post']['responses']['200']['content']['application/json'];
+
+export class DownloadAPIService {
+    constructor(private apiService: DriveAPIService) {
+        this.apiService = apiService;
+    }
+
+    async* iterateRevisionBlocks(nodeRevisionUid: string, signal?: AbortSignal, fromBlockIndex = 1): AsyncGenerator<
+        { type: 'manifestSignature', armoredManifestSignature?: string } |
+        { type: 'thumbnail', base64sha256Hash: string } |
+        { type: 'block' } & BlockMetadata
+    > {
+        const { volumeId, nodeId, revisionId } = splitNodeRevisionUid(nodeRevisionUid);
+
+        while (true) {
+            if (signal?.aborted) {
+                break;
+            }
+
+            const result = await this.apiService.get<GetRevisionResponse>(
+                `drive/v2/volumes/${volumeId}/files/${nodeId}/revisions/${revisionId}?PageSize=${BLOCKS_PAGE_SIZE}&FromBlockIndex=${fromBlockIndex}`,
+                signal,
+            );
+
+            if (fromBlockIndex === 1) {
+                yield {
+                    type: 'manifestSignature',
+                    armoredManifestSignature: result.Revision.ManifestSignature || undefined,
+                };
+
+                if (result.Revision.Thumbnails.length > 0) {
+                    for (const block of result.Revision.Thumbnails) {
+                        yield {
+                            type: 'thumbnail',
+                            base64sha256Hash: block.Hash,
+                        }
+                    }
+                }
+            }
+
+            if (result.Revision.Blocks.length === 0) {
+                break;
+            }
+
+            for (const block of result.Revision.Blocks) {
+                yield {
+                    type: 'block',
+                    ...transformBlock(block),
+                };
+                fromBlockIndex = block.Index + 1;
+            }
+        }
+    }
+
+    async getRevisionBlockToken(nodeRevisionUid: string, blockIndex: number, signal?: AbortSignal): Promise<BlockMetadata> {
+        const { volumeId, nodeId, revisionId } = splitNodeRevisionUid(nodeRevisionUid);
+
+        const result = await this.apiService.get<GetRevisionResponse>(
+            `drive/v2/volumes/${volumeId}/files/${nodeId}/revisions/${revisionId}?PageSize=1&FromBlockIndex=${blockIndex}`,
+            signal,
+        );
+
+        const block = result.Revision.Blocks[0];
+        return transformBlock(block);
+    }
+
+    async downloadBlock(baseUrl: string, token: string, onProgress?: (downloadedBytes: number) => void, signal?: AbortSignal): Promise<Uint8Array> {
+        const rawBlockStream = await this.apiService.getBlockStream(baseUrl, token, signal);
+        const progressStream = new ObserverStream((value) => {
+            onProgress?.(value.length);
+        });
+        const blockStream = rawBlockStream.pipeThrough(progressStream);
+        const encryptedBlock = new Uint8Array(await new Response(blockStream).arrayBuffer());
+        return encryptedBlock;
+    }
+
+    // Improvement requested: support multiple volumes.
+    async* iterateThumbnails(thumbnailUids: string[], signal?: AbortSignal): AsyncGenerator<
+        { uid: string, ok: true, bareUrl: string, token: string } |
+        { uid: string, ok: false, error: string }
+    > {
+        const thumbnailIds = thumbnailUids.map(splitNodeThumbnailUid);
+
+        const uniqueVolumeIds = new Set(thumbnailIds.map(({ volumeId }) => volumeId));
+        if (uniqueVolumeIds.size !== 1) {
+            throw new ValidationError(c('Error').t`Loading thumbnails from multiple sections is not allowed`);
+        }
+        const volumeId = thumbnailIds[0].volumeId;
+
+        const result = await this.apiService.post<PostGetThumbnailsRequest, PostGetThumbnailsResponse>(
+            `drive/volumes/${volumeId}/thumbnails`,
+            {
+                ThumbnailIDs: thumbnailIds.map(({ thumbnailId }) => thumbnailId),
+            },
+            signal,
+        );
+
+        for (const thumbnail of result.Thumbnails) {
+            const id = thumbnailIds.find(({ thumbnailId }) => thumbnailId === thumbnail.ThumbnailID);
+            if (!id) {
+                continue;
+            }
+            yield {
+                uid: makeNodeThumbnailUid(id.volumeId, id.nodeId, thumbnail.ThumbnailID),
+                ok: true,
+                bareUrl: thumbnail.BareURL,
+                token: thumbnail.Token,
+            };
+        }
+
+        for (const error of result.Errors) {
+            const id = thumbnailIds.find(({ thumbnailId }) => thumbnailId === error.ThumbnailID);
+            if (!id) {
+                continue;
+            }
+            yield {
+                uid: makeNodeThumbnailUid(id.volumeId, id.nodeId, error.ThumbnailID),
+                ok: false,
+                error: error.Error,
+            };
+        }
+    }
+}
+
+function transformBlock(block: GetRevisionResponse['Revision']['Blocks'][0]): BlockMetadata {
+    return {
+        index: block.Index,
+        bareUrl: block.BareURL as string,
+        token: block.Token as string,
+        base64sha256Hash: block.Hash,
+        signatureEmail: block.SignatureEmail || undefined,
+        armoredSignature: block.EncSignature || undefined,
+    };
+}

package/src/internal/download/controller.ts

@@ -0,0 +1,22 @@
+import { waitForCondition } from '../wait';
+
+export class DownloadController {
+    private paused = false;
+    public promise?: Promise<void>;
+
+    async waitWhilePaused(): Promise<void> {
+        await waitForCondition(() => !this.paused);
+    }
+
+    pause(): void {
+        this.paused = true;
+    }
+
+    resume(): void {
+        this.paused = false;
+    }
+
+    async completion(): Promise<void> {
+        await this.promise;
+    }
+}

package/src/internal/download/cryptoService.ts

@@ -0,0 +1,96 @@
+import { c } from 'ttag';
+
+import { DriveCrypto, PrivateKey, PublicKey, SessionKey, uint8ArrayToBase64String, VERIFICATION_STATUS } from "../../crypto";
+import { ProtonDriveAccount, Revision } from "../../interface";
+import { DecryptionError, IntegrityError } from "../../errors";
+import { getErrorMessage } from "../errors";
+import { mergeUint8Arrays } from "../utils";
+import { RevisionKeys } from "./interface";
+
+export class DownloadCryptoService {
+    constructor(private driveCrypto: DriveCrypto, private account: ProtonDriveAccount) {
+        this.account = account;
+        this.driveCrypto = driveCrypto;
+    }
+
+    async getRevisionKeys(nodeKey: { key: PrivateKey, contentKeyPacketSessionKey: SessionKey }, revision: Revision): Promise<RevisionKeys> {
+        const verificationKeys = await this.getRevisionVerificationKeys(revision);
+        return {
+            ...nodeKey,
+            verificationKeys,
+        }
+    }
+
+    async decryptBlock(encryptedBlock: Uint8Array, armoredSignature: string, revisionKeys: RevisionKeys): Promise<Uint8Array> {
+        let decryptedBlock;
+        try {
+            // We do not verify signatures on blocks. We only verify
+            // the signature on the revision content key packet and
+            // the manifest of the revision.
+            // We plan to drop signatures of individual blocks
+            // completely in the future. Any issue on the blocks
+            // should be considered serious integrity issue.
+            const result = await this.driveCrypto.decryptBlock(
+                encryptedBlock,
+                armoredSignature,
+                revisionKeys.key,
+                revisionKeys.contentKeyPacketSessionKey,
+                revisionKeys.verificationKeys,
+            );
+            decryptedBlock = result.decryptedBlock;
+        } catch (error: unknown) {
+            const message = getErrorMessage(error);
+            throw new DecryptionError(c('Error').t`Failed to decrypt block: ${message}`);
+        }
+
+        return decryptedBlock;
+    }
+
+    async decryptThumbnail(thumbnail: Uint8Array, contentKeyPacketSessionKey: SessionKey): Promise<Uint8Array> {
+        let decryptedBlock;
+        try {
+            const result = await this.driveCrypto.decryptThumbnailBlock(
+                thumbnail,
+                contentKeyPacketSessionKey,
+                [], // We ignore verification for thumbnails.
+            );
+            decryptedBlock = result.decryptedThumbnail;
+        } catch (error: unknown) {
+            const message = getErrorMessage(error);
+            throw new DecryptionError(c('Error').t`Failed to decrypt thumbnail: ${message}`);
+        }
+
+        return decryptedBlock;
+    }
+
+    async verifyBlockIntegrity(encryptedBlock: Uint8Array, base64sha256Hash: string): Promise<void> {
+        const digest = await crypto.subtle.digest('SHA-256', encryptedBlock);
+        const expectedHash = uint8ArrayToBase64String(new Uint8Array(digest));
+
+        if (expectedHash !== base64sha256Hash) {
+            throw new IntegrityError(c('Error').t`Data integrity check of one part failed`, {
+                expectedHash,
+                actualHash: base64sha256Hash,
+            });
+        }
+    }
+
+    async verifyManifest(revision: Revision, nodeKey: PrivateKey, allBlockHashes: Uint8Array[], armoredManifestSignature?: string): Promise<void> {
+        const verificationKeys = await this.getRevisionVerificationKeys(revision) || nodeKey;
+        const hash = mergeUint8Arrays(allBlockHashes);
+
+        if (!armoredManifestSignature) {
+            throw new IntegrityError(c('Error').t`Missing integrity signature`);
+        }
+
+        const { verified } = await this.driveCrypto.verifyManifest(hash, armoredManifestSignature, verificationKeys);
+        if (verified !== VERIFICATION_STATUS.SIGNED_AND_VALID) {
+            throw new IntegrityError(c('Error').t`Data integrity check failed`);
+        }
+    }
+
+    private async getRevisionVerificationKeys(revision: Revision): Promise<PublicKey[] | undefined> {
+        const signatureEmail = revision.contentAuthor.ok ? revision.contentAuthor.value : revision.contentAuthor.error.claimedAuthor;
+        return signatureEmail ? await this.account.getPublicKeys(signatureEmail) : undefined;
+    }
+}