@protontech/drive-sdk 0.0.10

package/src/internal/shares/apiService.ts

@@ -0,0 +1,176 @@
+import { DriveAPIService, drivePaths } from "../apiService";
+import { makeMemberUid } from "../uids";
+import { EncryptedShare, EncryptedRootShare, EncryptedShareCrypto, ShareType } from "./interface";
+
+type PostCreateVolumeRequest = Extract<drivePaths['/drive/volumes']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostCreateVolumeResponse = drivePaths['/drive/volumes']['post']['responses']['200']['content']['application/json'];
+
+type PostCreateShareRequest = Extract<drivePaths['/drive/volumes/{volumeID}/shares']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostCreateShareResponse = drivePaths['/drive/volumes/{volumeID}/shares']['post']['responses']['200']['content']['application/json'];
+
+type GetMyFilesResponse = drivePaths['/drive/v2/shares/my-files']['get']['responses']['200']['content']['application/json'];
+type GetVolumeResponse = drivePaths['/drive/volumes/{volumeID}']['get']['responses']['200']['content']['application/json'];
+type GetShareResponse = drivePaths['/drive/shares/{shareID}']['get']['responses']['200']['content']['application/json'];
+
+/**
+ * Provides API communication for fetching shares and creating volumes.
+ * 
+ * The service is responsible for transforming local objects to API payloads
+ * and vice versa. It should not contain any business logic.
+ */
+export class SharesAPIService {
+    constructor(private apiService: DriveAPIService) {
+        this.apiService = apiService;
+    }
+
+    async getMyFiles(): Promise<EncryptedRootShare> {
+        const response = await this.apiService.get<GetMyFilesResponse>('drive/v2/shares/my-files');
+        return {
+            volumeId: response.Volume.VolumeID,
+            shareId: response.Share.ShareID,
+            rootNodeId: response.Link.Link.LinkID,
+            creatorEmail: response.Share.CreatorEmail,
+            encryptedCrypto: {
+                armoredKey: response.Share.Key,
+                armoredPassphrase: response.Share.Passphrase,
+                armoredPassphraseSignature: response.Share.PassphraseSignature,
+            },
+            addressId: response.Share.AddressID,
+            type: ShareType.Main,
+        };
+    }
+
+    async getVolume(volumeId: string): Promise<{ shareId: string }> {
+        const response = await this.apiService.get<GetVolumeResponse>(`drive/volumes/${volumeId}`);
+        return {
+            shareId: response.Volume.Share.ShareID,
+        }
+    }
+
+    async getShare(shareId: string): Promise<EncryptedShare> {
+        const response = await this.apiService.get<GetShareResponse>(`drive/shares/${shareId}`);
+        return convertSharePayload(response);
+    }
+
+    /**
+     * Returns root share with address key.
+     * 
+     * This function provides access to root shares that provides access
+     * to node tree via address key. For this reason, caller must use this
+     * only when it is clear the shareId is root share.
+     * 
+     * @throws Error when share is not root share.
+     */
+    async getRootShare(shareId: string): Promise<EncryptedRootShare> {
+        const response = await this.apiService.get<GetShareResponse>(`drive/shares/${shareId}`);
+
+        if (!response.AddressID) {
+            throw new Error('Loading share without direct access is not supported');
+        }
+
+        return {
+            ...convertSharePayload(response),
+            addressId: response.AddressID,
+        };
+    }
+
+    async createVolume(
+        share: {
+            addressId: string,
+            addressKeyId: string,
+        } & EncryptedShareCrypto,
+        node: {
+            encryptedName: string,
+            armoredKey: string,
+            armoredPassphrase: string,
+            armoredPassphraseSignature: string,
+            armoredHashKey: string,
+        },
+    ): Promise<{ volumeId: string, shareId: string, rootNodeId: string }> {
+        const response = await this.apiService.post<
+            // Volume & share names are deprecated.
+            Omit<PostCreateVolumeRequest, 'VolumeName' | 'ShareName'>,
+            PostCreateVolumeResponse
+        >('drive/volumes', {
+            AddressID: share.addressId,
+            AddressKeyID: share.addressKeyId,
+            ShareKey: share.armoredKey,
+            SharePassphrase: share.armoredPassphrase,
+            SharePassphraseSignature: share.armoredPassphraseSignature,
+
+            FolderName: node.encryptedName,
+            FolderKey: node.armoredKey,
+            FolderPassphrase: node.armoredPassphrase,
+            FolderPassphraseSignature: node.armoredPassphraseSignature,
+            FolderHashKey: node.armoredHashKey,
+        });
+        return {
+            volumeId: response.Volume.ID,
+            shareId: response.Volume.Share.ShareID,
+            rootNodeId: response.Volume.Share.LinkID,
+        }
+    }
+
+    async createShare(
+        volumeId: string,
+        share: {
+            addressId: string,
+        } & EncryptedShareCrypto,
+        node: {
+            nodeId: string,
+            encryptedName: string,
+            nameKeyPacket: string,
+            passphraseKeyPacket: string,
+        },
+    ): Promise<{ shareId: string }> {
+        const response = await this.apiService.post<
+            // Share name is deprecated.
+            Omit<PostCreateShareRequest, 'Name'>,
+            PostCreateShareResponse
+        >(`/drive/volumes/${volumeId}/shares`, {
+            AddressID: share.addressId,
+            ShareKey: share.armoredKey,
+            SharePassphrase: share.armoredPassphrase,
+            SharePassphraseSignature: share.armoredPassphraseSignature,
+            RootLinkID: node.nodeId,
+            NameKeyPacket: node.nameKeyPacket,
+            PassphraseKeyPacket: node.passphraseKeyPacket,
+        });
+
+        return {
+            shareId: response.Share.ID,
+        }
+    }
+}
+
+function convertSharePayload(response: GetShareResponse): EncryptedShare {
+    return {
+        volumeId: response.VolumeID,
+        shareId: response.ShareID,
+        rootNodeId: response.LinkID,
+        creatorEmail: response.Creator,
+        creationTime: response.CreateTime ? new Date(response.CreateTime*1000) : undefined,
+        encryptedCrypto: {
+            armoredKey: response.Key,
+            armoredPassphrase: response.Passphrase,
+            armoredPassphraseSignature: response.PassphraseSignature,
+        },
+        membership: response.Memberships?.[0] ? {
+            memberUid: makeMemberUid(response.ShareID, response.Memberships[0].MemberID),
+        } : undefined,
+        type: convertShareTypeNumberToEnum(response.Type),
+    };
+}
+
+function convertShareTypeNumberToEnum(type: 1 | 2 | 3 | 4): ShareType {
+    switch (type) {
+        case 1:
+            return ShareType.Main;
+        case 2:
+            return ShareType.Standard;
+        case 3:
+            return ShareType.Device;
+        case 4:
+            return ShareType.Photo;
+    }
+}

package/src/internal/shares/cache.test.ts

@@ -0,0 +1,58 @@
+import { MemoryCache } from "../../cache";
+import { getMockLogger } from "../../tests/logger";
+import { SharesCache } from "./cache";
+
+describe('sharesCache', () => {
+    let memoryCache: MemoryCache<string>;
+    let cache: SharesCache;
+
+    beforeEach(async () => {
+        memoryCache = new MemoryCache();
+        await memoryCache.setEntity('volume-badObject', 'aaa');
+
+        cache = new SharesCache(getMockLogger(), memoryCache);
+    });
+
+    it('should store and retrieve volume', async () => {
+        const volumeId = 'volume1';
+        const volume = {
+            volumeId,
+            shareId: 'share1',
+            rootNodeId: 'node1',
+            creatorEmail: 'email',
+            addressId: 'address1',
+        };
+
+        await cache.setVolume(volume);
+        const result = await cache.getVolume(volumeId);
+
+        expect(result).toStrictEqual(volume);
+    });
+
+    it('should throw an error when retrieving a non-existing entity', async () => {
+        const volumeId = 'newVolumeId';
+
+        try {
+            await cache.getVolume(volumeId);
+            fail('Should have thrown an error');
+        } catch (error) {
+            expect(`${error}`).toBe('Error: Entity not found');
+        }
+    });
+
+    it('should throw an error when retrieving a bad keys and remove the key', async () => {
+        try {
+            await cache.getVolume('badObject');
+            fail('Should have thrown an error');
+        } catch (error) {
+            expect(`${error}`).toBe('Error: Failed to deserialize volume: Unexpected token \'a\', \"aaa\" is not valid JSON');
+        }
+
+        try {
+            await memoryCache.getEntity('volumes-badObject');
+            fail('Should have thrown an error');
+        } catch (error) {
+            expect(`${error}`).toBe('Error: Entity not found');
+        }
+    });
+});

package/src/internal/shares/cache.ts

@@ -0,0 +1,64 @@
+import { ProtonDriveEntitiesCache, Logger } from "../../interface";
+import { getErrorMessage } from "../errors";
+import { Volume } from "./interface";
+
+/**
+ * Provides caching for shares and volume metadata.
+ * 
+ * The cache is responsible for serialising and deserialising volume metadata.
+ */
+export class SharesCache {
+    constructor(private logger: Logger, private driveCache: ProtonDriveEntitiesCache) {
+        this.logger = logger;
+        this.driveCache = driveCache;
+    }
+
+    async setVolume(volume: Volume): Promise<void> {
+        const key = getCacheUid(volume.volumeId);
+        const shareData = serializeVolume(volume);
+        await this.driveCache.setEntity(key, shareData);
+    }
+
+    async getVolume(volumeId: string): Promise<Volume> {
+        const key = getCacheUid(volumeId);
+        const volumeData = await this.driveCache.getEntity(key);
+
+        try {
+            return deserializeVolume(volumeData);
+        } catch (error: unknown) {
+            try {
+                await this.removeVolume(volumeId);
+            } catch (removingError: unknown) {
+                this.logger.error('Failed to remove invalid volume from cache', removingError);
+            }
+            throw new Error(`Failed to deserialize volume: ${getErrorMessage(error)}`);
+        }
+    }
+
+    async removeVolume(volumeId: string): Promise<void> {
+        await this.driveCache.removeEntities([getCacheUid(volumeId)]);
+    }
+}
+
+function getCacheUid(volumeId: string) {
+    return `volume-${volumeId}`;
+}
+
+function serializeVolume(volume: Volume) {
+    return JSON.stringify(volume);
+}
+
+function deserializeVolume(shareData: string): Volume {
+     const volume = JSON.parse(shareData);
+     if (
+        !volume || typeof volume !== 'object' ||
+        !volume.volumeId || typeof volume.volumeId !== 'string' ||
+        !volume.shareId || typeof volume.shareId !== 'string' ||
+        !volume.rootNodeId || typeof volume.rootNodeId !== 'string' ||
+        !volume.creatorEmail || typeof volume.creatorEmail !== 'string' ||
+        !volume.addressId || typeof volume.addressId !== 'string'
+    ) {
+        throw new Error('Invalid volume data');
+    }
+    return volume;
+}

package/src/internal/shares/cryptoCache.test.ts

@@ -0,0 +1,70 @@
+import { PrivateKey, SessionKey } from "../../crypto";
+import { MemoryCache } from "../../cache";
+import { CachedCryptoMaterial } from "../../interface";
+import { SharesCryptoCache } from "./cryptoCache";
+
+describe('sharesCryptoCache', () => {
+    let memoryCache: MemoryCache<CachedCryptoMaterial>;
+    let cache: SharesCryptoCache;
+
+    const generatePrivateKey = (name: string) => {
+        return name as unknown as PrivateKey
+    }
+
+    const generateSessionKey = (name: string) => {
+        return name as unknown as SessionKey
+    }
+
+    beforeEach(() => {
+        memoryCache = new MemoryCache();
+        cache = new SharesCryptoCache(memoryCache);
+    });
+
+    it('should store and retrieve keys', async () => {
+        const shareId = 'newShareId';
+        const keys = { key: generatePrivateKey('privateKey'), passphraseSessionKey: generateSessionKey('sessionKey') };
+
+        await cache.setShareKey(shareId, keys);
+        const result = await cache.getShareKey(shareId);
+
+        expect(result).toStrictEqual(keys);
+    });
+
+    it('should replace and retrieve new keys', async () => {
+        const shareId = 'newShareId';
+        const keys1 = { key: generatePrivateKey('privateKey1'), passphraseSessionKey: generateSessionKey('sessionKey1') };
+        const keys2 = { key: generatePrivateKey('privateKey2'), passphraseSessionKey: generateSessionKey('sessionKey2') };
+
+        await cache.setShareKey(shareId, keys1);
+        await cache.setShareKey(shareId, keys2);
+        const result = await cache.getShareKey(shareId);
+
+        expect(result).toStrictEqual(keys2);
+    });
+
+    it('should remove keys', async () => {
+        const shareId = 'newShareId';
+        const keys = { key: generatePrivateKey('privateKey'), passphraseSessionKey: generateSessionKey('sessionKey') };
+
+        await cache.setShareKey(shareId, keys);
+        await cache.removeShareKey([shareId]);
+
+        try {
+            await cache.getShareKey(shareId);
+            throw new Error('Should have thrown an error');
+        } catch (error) {
+            expect(`${error}`).toBe('Error: Entity not found');
+        }
+    });
+
+    it('should throw an error when retrieving a non-existing entity', async () => {
+        const shareId = 'newShareId';
+
+        try {
+            await cache.getShareKey(shareId);
+            throw new Error('Should have thrown an error');
+        } catch (error) {
+            expect(`${error}`).toBe('Error: Entity not found');
+        }
+    });
+});

package/src/internal/shares/cryptoCache.ts

@@ -0,0 +1,35 @@
+import { ProtonDriveCryptoCache } from "../../interface";
+import { DecryptedShareKey } from "./interface";
+
+/**
+ * Provides caching for share crypto material.
+ * 
+ * The cache is responsible for serialising and deserialising share
+ * crypto material.
+ * 
+ * The share crypto materials are cached so the updates to the root
+ * nodes can be decrypted without the need to fetch the share keys
+ * from the server again. Otherwise the rest of the tree requires
+ * only the root node, thus share cache is not needed.
+ */
+export class SharesCryptoCache {
+    constructor(private driveCache: ProtonDriveCryptoCache) {
+        this.driveCache = driveCache;
+    }
+
+    async setShareKey(shareId: string, key: DecryptedShareKey): Promise<void> {
+        await this.driveCache.setEntity(getCacheUid(shareId), key);
+    }
+
+    async getShareKey(shareId: string): Promise<DecryptedShareKey> {
+        return this.driveCache.getEntity(getCacheUid(shareId));
+    }
+
+    async removeShareKey(shareIds: string[]): Promise<void> {
+        await this.driveCache.removeEntities(shareIds.map(getCacheUid));
+    }
+}
+
+function getCacheUid(shareId: string) {
+    return `shareKey-${shareId}`;
+}

package/src/internal/shares/cryptoService.test.ts

@@ -0,0 +1,137 @@
+import { DriveCrypto, PrivateKey, SessionKey, VERIFICATION_STATUS } from "../../crypto";
+import { ProtonDriveAccount, ProtonDriveTelemetry } from "../../interface";
+import { getMockTelemetry } from "../../tests/telemetry";
+import { EncryptedRootShare, ShareType } from "./interface";
+import { SharesCryptoService } from "./cryptoService";
+
+describe("SharesCryptoService", () => {
+    let telemetry: ProtonDriveTelemetry;
+    let driveCrypto: DriveCrypto;
+    let account: ProtonDriveAccount;
+    let cryptoService: SharesCryptoService;
+
+    beforeEach(() => {
+        telemetry = getMockTelemetry();
+        // @ts-expect-error No need to implement all methods for mocking
+        driveCrypto = {
+            decryptKey: jest.fn(async () => Promise.resolve({
+                passphrase: "pass",
+                key: "decryptedKey" as unknown as PrivateKey,
+                passphraseSessionKey: "sessionKey" as unknown as SessionKey,
+                verified: VERIFICATION_STATUS.SIGNED_AND_VALID,
+            })),
+        };
+        account = {
+            // @ts-expect-error No need to implement full response for mocking
+            getOwnAddress: jest.fn(async () => ({
+                keys: [{ key: "addressKey" as unknown as PrivateKey }],
+            })),
+            getPublicKeys: jest.fn(async () => []),
+        };
+        cryptoService = new SharesCryptoService(telemetry, driveCrypto, account);
+    });
+
+    it("should decrypt root share", async () => {
+        const result = await cryptoService.decryptRootShare(
+            {
+                shareId: "shareId",
+                addressId: "addressId",
+                creatorEmail: "signatureEmail",
+                encryptedCrypto: {
+                    armoredKey: "armoredKey",
+                    armoredPassphrase: "armoredPassphrase",
+                    armoredPassphraseSignature: "armoredPassphraseSignature",
+                },
+                type: ShareType.Main,
+            } as EncryptedRootShare,
+        );
+
+        expect(result).toMatchObject({
+            share: {
+                shareId: "shareId",
+                author: { ok: true, value: "signatureEmail" },
+            },
+            key: {
+                key: "decryptedKey",
+                passphraseSessionKey: "sessionKey",
+            },
+        });
+
+        expect(account.getOwnAddress).toHaveBeenCalledWith("addressId");
+        expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+        expect(telemetry.logEvent).not.toHaveBeenCalled();
+    });
+
+    it("should decrypt root share with signiture verification error", async () => {
+        driveCrypto.decryptKey = jest.fn(async () => Promise.resolve({
+            passphrase: "pass",
+            key: "decryptedKey" as unknown as PrivateKey,
+            passphraseSessionKey: "sessionKey" as unknown as SessionKey,
+            verified: VERIFICATION_STATUS.NOT_SIGNED,
+        }));
+
+        const result = await cryptoService.decryptRootShare(
+            {
+                shareId: "shareId",
+                addressId: "addressId",
+                creatorEmail: "signatureEmail",
+                encryptedCrypto: {
+                    armoredKey: "armoredKey",
+                    armoredPassphrase: "armoredPassphrase",
+                    armoredPassphraseSignature: "armoredPassphraseSignature",
+                },
+                type: ShareType.Main,
+            } as EncryptedRootShare,
+        );
+
+        expect(result).toMatchObject({
+            share: {
+                shareId: "shareId",
+                author: { ok: false, error: { claimedAuthor: "signatureEmail", error: "Missing signature" } },
+            },
+            key: {
+                key: "decryptedKey",
+                passphraseSessionKey: "sessionKey",
+            },
+        });
+
+        expect(account.getOwnAddress).toHaveBeenCalledWith("addressId");
+        expect(account.getPublicKeys).toHaveBeenCalledWith("signatureEmail");
+        expect(telemetry.logEvent).toHaveBeenCalledWith({
+            eventName: 'verificationError',
+            context: 'own_volume',
+            field: 'shareKey',
+            addressMatchingDefaultShare: undefined,
+            fromBefore2024: undefined,
+        });
+    });
+
+    it("should handle decrypt issue of root share", async () => {
+        const error = new Error("Decryption error");
+        driveCrypto.decryptKey = jest.fn(async () => Promise.reject(error));
+
+        const result = cryptoService.decryptRootShare(
+            {
+                shareId: "shareId",
+                addressId: "addressId",
+                creatorEmail: "signatureEmail",
+                encryptedCrypto: {
+                    armoredKey: "armoredKey",
+                    armoredPassphrase: "armoredPassphrase",
+                    armoredPassphraseSignature: "armoredPassphraseSignature",
+                },
+                type: ShareType.Main,
+            } as EncryptedRootShare,
+        );
+
+        await expect(result).rejects.toThrow(error);
+
+        expect(telemetry.logEvent).toHaveBeenCalledWith({
+            eventName: 'decryptionError',
+            context: 'own_volume',
+            field: 'shareKey',
+            fromBefore2024: undefined,
+            error,
+        });
+    });
+});

package/src/internal/shares/cryptoService.ts

@@ -0,0 +1,143 @@
+import { ProtonDriveAccount, resultOk, resultError, Result, UnverifiedAuthorError, ProtonDriveTelemetry, Logger, MetricContext } from "../../interface";
+import { DriveCrypto, PrivateKey, VERIFICATION_STATUS } from "../../crypto";
+import { getVerificationMessage } from "../errors";
+import { EncryptedRootShare, DecryptedRootShare, EncryptedShareCrypto, DecryptedShareKey, ShareType } from "./interface";
+
+/**
+ * Provides crypto operations for share keys.
+ * 
+ * The share crypto service is responsible for encrypting and decrypting share
+ * keys. It should export high-level actions only, such as "decrypt share"
+ * instead of low-level operations like "decrypt share passphrase". Low-level
+ * operations should be kept private to the module.
+ * 
+ * The service owns the logic to switch between old and new crypto model.
+ */
+export class SharesCryptoService {
+    private logger: Logger;
+
+    private reportedDecryptionErrors = new Set<string>();
+    private reportedVerificationErrors = new Set<string>();
+
+    constructor(private telemetry: ProtonDriveTelemetry, private driveCrypto: DriveCrypto, private account: ProtonDriveAccount) {
+        this.telemetry = telemetry;
+        this.logger = telemetry.getLogger('shares-crypto');
+        this.driveCrypto = driveCrypto;
+        this.account = account;
+    }
+
+    async generateVolumeBootstrap(addressKey: PrivateKey): Promise<{
+        shareKey: { encrypted: EncryptedShareCrypto, decrypted: DecryptedShareKey },
+        rootNode: {
+            key: { encrypted: EncryptedShareCrypto, decrypted: DecryptedShareKey },
+            encryptedName: string,
+            armoredHashKey: string,
+        }
+    }> {
+        const shareKey = await this.driveCrypto.generateKey([addressKey], addressKey);
+        const rootNodeKey = await this.driveCrypto.generateKey([shareKey.decrypted.key], addressKey);
+        const { armoredNodeName } = await this.driveCrypto.encryptNodeName('root', undefined, shareKey.decrypted.key, addressKey);
+        const { armoredHashKey } = await this.driveCrypto.generateHashKey(rootNodeKey.decrypted.key);
+        return {
+            shareKey,
+            rootNode: {
+                key: rootNodeKey,
+                encryptedName: armoredNodeName,
+                armoredHashKey,
+            },
+        }
+    }
+
+    async decryptRootShare(share: EncryptedRootShare): Promise<{ share: DecryptedRootShare, key: DecryptedShareKey }> {
+        const { keys: addressKeys } = await this.account.getOwnAddress(share.addressId);
+        const addressPublicKeys = await this.account.getPublicKeys(share.creatorEmail);
+
+        let key, passphraseSessionKey, verified;
+        try {
+            const result = await this.driveCrypto.decryptKey(
+                share.encryptedCrypto.armoredKey,
+                share.encryptedCrypto.armoredPassphrase,
+                share.encryptedCrypto.armoredPassphraseSignature,
+                addressKeys.map(({ key }) => key),
+                addressPublicKeys,
+            )
+            key = result.key;
+            passphraseSessionKey = result.passphraseSessionKey;
+            verified = result.verified;
+        } catch (error: unknown) {
+            this.reportDecryptionError(share, error);
+            throw error;
+        }
+
+        const author: Result<string, UnverifiedAuthorError> = verified === VERIFICATION_STATUS.SIGNED_AND_VALID
+            ? resultOk(share.creatorEmail)
+            : resultError({
+                claimedAuthor: share.creatorEmail,
+                error: getVerificationMessage(verified),
+            });
+
+        if (!author.ok) {
+            await this.reportVerificationError(share);
+        }
+
+        return {
+            share: {
+                ...share,
+                author,
+            },
+            key: {
+                key,
+                passphraseSessionKey,
+            },
+        }
+    }
+    
+    private reportDecryptionError(share: EncryptedRootShare, error?: unknown) {
+        if (this.reportedDecryptionErrors.has(share.shareId)) {
+            return;
+        }
+
+        const fromBefore2024 = share.creationTime ? share.creationTime < new Date('2024-01-01') : undefined;
+        this.logger.error(`Failed to decrypt share ${share.shareId} (from before 2024: ${fromBefore2024})`, error);
+
+        this.telemetry.logEvent({
+            eventName: 'decryptionError',
+            context: shareTypeToMetricContext(share.type),
+            field: 'shareKey',
+            fromBefore2024,
+            error,
+        });
+        this.reportedDecryptionErrors.add(share.shareId);
+    }
+
+    private async reportVerificationError(share: EncryptedRootShare) {
+        if (this.reportedVerificationErrors.has(share.shareId)) {
+            return;
+        }
+
+        const fromBefore2024 = share.creationTime ? share.creationTime < new Date('2024-01-01') : undefined;
+        this.logger.error(`Failed to verify share ${share.shareId} (from before 2024: ${fromBefore2024})`);
+
+        this.telemetry.logEvent({
+            eventName: 'verificationError',
+            context: shareTypeToMetricContext(share.type),
+            field: 'shareKey',
+            fromBefore2024,
+        });
+        this.reportedVerificationErrors.add(share.shareId);
+    }
+}
+
+function shareTypeToMetricContext(shareType: ShareType): MetricContext {
+    // SDK doesn't support public sharing yet, also public sharing
+    // doesn't use a share but shareURL, thus we can simplify and
+    // ignore this case for now.
+    switch (shareType) {
+        case ShareType.Main:
+        case ShareType.Device:
+        case ShareType.Photo:
+            return MetricContext.OwnVolume;
+        case ShareType.Standard:
+            return MetricContext.Shared;
+    }
+}