@protontech/drive-sdk 0.0.10

package/src/internal/upload/apiService.ts

@@ -0,0 +1,243 @@
+import { c } from "ttag";
+
+import { base64StringToUint8Array, uint8ArrayToBase64String } from "../../crypto";
+import { APICodeError, DriveAPIService, drivePaths, isCodeOk } from "../apiService";
+import { splitNodeUid, makeNodeUid, splitNodeRevisionUid, makeNodeRevisionUid } from "../uids";
+import { UploadTokens } from "./interface";
+import { ThumbnailType } from "../../interface";
+
+type PostCheckAvailableHashesRequest = Extract<drivePaths['/drive/v2/volumes/{volumeID}/links/{linkID}/checkAvailableHashes']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostCheckAvailableHashesResponse = drivePaths['/drive/v2/volumes/{volumeID}/links/{linkID}/checkAvailableHashes']['post']['responses']['200']['content']['application/json'];
+
+type PostCreateDraftRequest = Extract<drivePaths['/drive/v2/volumes/{volumeID}/files']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostCreateDraftResponse = drivePaths['/drive/v2/volumes/{volumeID}/files']['post']['responses']['200']['content']['application/json'];
+
+type PostCreateDraftRevisionRequest = Extract<drivePaths['/drive/v2/volumes/{volumeID}/files/{linkID}/revisions']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostCreateDraftRevisionResponse = drivePaths['/drive/v2/volumes/{volumeID}/files/{linkID}/revisions']['post']['responses']['200']['content']['application/json'];
+
+type GetVerificationDataResponse = drivePaths['/drive/v2/volumes/{volumeID}/links/{linkID}/revisions/{revisionID}/verification']['get']['responses']['200']['content']['application/json'];
+
+type PostRequestBlockUploadRequest = Extract<drivePaths['/drive/blocks']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostRequestBlockUploadResponse = drivePaths['/drive/blocks']['post']['responses']['200']['content']['application/json'];
+
+type PostCommitRevisionRequest = Extract<drivePaths['/drive/v2/volumes/{volumeID}/files/{linkID}/revisions/{revisionID}']['put']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostCommitRevisionResponse = drivePaths['/drive/v2/volumes/{volumeID}/files/{linkID}/revisions/{revisionID}']['put']['responses']['200']['content']['application/json'];
+
+type PostDeleteNodesRequest = Extract<drivePaths['/drive/v2/volumes/{volumeID}/delete_multiple']['post']['requestBody'], { 'content': object }>['content']['application/json'];
+type PostDeleteNodesResponse = drivePaths['/drive/v2/volumes/{volumeID}/delete_multiple']['post']['responses']['200']['content']['application/json'];
+
+export class UploadAPIService {
+    constructor(private apiService: DriveAPIService) {
+        this.apiService = apiService;
+    }
+
+    async checkAvailableHashes(parentNodeUid: string, hashes: string[]): Promise<{
+        availalbleHashes: string[],
+        pendingHashes: {
+            hash: string,
+            nodeUid: string,
+            revisionUid: string,
+            clientUid?: string,
+        }[],
+    }> {
+        const { volumeId, nodeId: parentNodeId } = splitNodeUid(parentNodeUid);
+        const result = await this.apiService.post<
+            PostCheckAvailableHashesRequest,
+            PostCheckAvailableHashesResponse
+        >(`drive/v2/volumes/${volumeId}/links/${parentNodeId}/checkAvailableHashes`, {
+            Hashes: hashes,
+            ClientUID: null,
+        });
+
+        return {
+            availalbleHashes: result.AvailableHashes,
+            pendingHashes: result.PendingHashes.map((hash) => ({
+                hash: hash.Hash,
+                nodeUid: makeNodeUid(volumeId, hash.LinkID),
+                revisionUid: makeNodeRevisionUid(volumeId, hash.LinkID, hash.RevisionID),
+                clientUid: hash.ClientUID || undefined,
+            })),
+        }
+    }
+
+    async createDraft(parentNodeUid: string, node: {
+        armoredEncryptedName: string,
+        hash: string,
+        mediaType: string,
+        clientUID?: string,
+        intendedUploadSize?: number,
+        armoredNodeKey: string,
+        armoredNodePassphrase: string,
+        armoredNodePassphraseSignature: string,
+        base64ContentKeyPacket: string,
+        armoredContentKeyPacketSignature: string,
+        signatureEmail: string,
+    }): Promise<{
+        nodeUid: string,
+        nodeRevisionUid: string,
+    }> {
+        const { volumeId, nodeId: parentNodeId } = splitNodeUid(parentNodeUid);
+        const result = await this.apiService.post<
+            PostCreateDraftRequest,
+            PostCreateDraftResponse
+        >(`drive/v2/volumes/${volumeId}/files`, {
+            ParentLinkID: parentNodeId,
+            Name: node.armoredEncryptedName,
+            Hash: node.hash,
+            MIMEType: node.mediaType,
+            ClientUID: node.clientUID || null,
+            IntendedUploadSize: node.intendedUploadSize || null,
+            NodeKey: node.armoredNodeKey,
+            NodePassphrase: node.armoredNodePassphrase,
+            NodePassphraseSignature: node.armoredNodePassphraseSignature,
+            ContentKeyPacket: node.base64ContentKeyPacket,
+            ContentKeyPacketSignature: node.armoredContentKeyPacketSignature,
+            SignatureAddress: node.signatureEmail,
+        });
+
+        return {
+            nodeUid: makeNodeUid(volumeId, result.File.ID),
+            nodeRevisionUid: makeNodeRevisionUid(volumeId, result.File.ID, result.File.RevisionID),
+        }
+    }
+
+    async createDraftRevision(nodeUid: string, revision: {
+        currentRevisionUid: string,
+        clientUID?: string,
+        intendedUploadSize?: number,
+    }): Promise<{
+        nodeRevisionUid: string,
+    }> {
+        const { volumeId, nodeId } = splitNodeUid(nodeUid);
+        const { revisionId: currentRevisionId } = splitNodeRevisionUid(revision.currentRevisionUid);
+        
+        const result = await this.apiService.post<
+            PostCreateDraftRevisionRequest,
+            PostCreateDraftRevisionResponse
+        >(`drive/v2/volumes/${volumeId}/files/${nodeId}/revisions`, {
+            CurrentRevisionID: currentRevisionId,
+            ClientUID: revision.clientUID || null,
+            IntendedUploadSize: revision.intendedUploadSize || null,
+        });
+
+        return {
+            nodeRevisionUid: makeNodeRevisionUid(volumeId, nodeId, result.Revision.ID),
+        }
+    }
+
+    async getVerificationData(draftNodeRevisionUid: string): Promise<{
+        verificationCode: Uint8Array,
+        base64ContentKeyPacket: string,
+    }> {
+        const { volumeId, nodeId, revisionId } = splitNodeRevisionUid(draftNodeRevisionUid);
+        const result = await this.apiService.get<
+            GetVerificationDataResponse
+        >(`drive/v2/volumes/${volumeId}/links/${nodeId}/revisions/${revisionId}/verification`);
+        
+        return {
+            verificationCode: base64StringToUint8Array(result.VerificationCode),
+            base64ContentKeyPacket: result.ContentKeyPacket,
+        }
+    }
+
+    async requestBlockUpload(draftNodeRevisionUid: string, addressId: string, blocks: {
+        contentBlocks: {
+            index: number,
+            hash: Uint8Array,
+            encryptedSize: number,
+            armoredSignature: string,
+            verificationToken: Uint8Array,
+        }[],
+        thumbnails?: {
+            type: ThumbnailType,
+            hash: Uint8Array,
+            encryptedSize: number,
+        }[],
+    }): Promise<UploadTokens> {
+        const { volumeId, nodeId, revisionId } = splitNodeRevisionUid(draftNodeRevisionUid);
+        const result = await this.apiService.post<
+            // TODO: Deprected fields but not properly marked in the types.
+            Omit<PostRequestBlockUploadRequest, 'ShareID' | 'Thumbnail' | 'ThumbnailHash' | 'ThumbnailSize'>,
+            PostRequestBlockUploadResponse
+        >('drive/blocks', {
+            AddressID: addressId,
+            VolumeID: volumeId,
+            LinkID: nodeId,
+            RevisionID: revisionId,
+            BlockList: blocks.contentBlocks.map((block) => ({
+                Index: block.index,
+                Hash: uint8ArrayToBase64String(block.hash),
+                EncSignature: block.armoredSignature,
+                Size: block.encryptedSize,
+                Verifier: {
+                    Token: uint8ArrayToBase64String(block.verificationToken),
+                },
+            })),
+            ThumbnailList: (blocks.thumbnails || []).map((block) => ({
+                Hash: uint8ArrayToBase64String(block.hash),
+                Size: block.encryptedSize,
+                Type: block.type,
+            })),
+        });
+
+        return {
+            blockTokens: result.UploadLinks.map((link) => ({
+                index: link.Index,
+                bareUrl: link.BareURL,
+                token: link.Token,
+            })),
+            thumbnailTokens: (result.ThumbnailLinks || []).map((link) => ({
+                // We can type as ThumbnailType because we are passing the type in the request.
+                type: link.ThumbnailType as ThumbnailType,
+                bareUrl: link.BareURL,
+                token: link.Token,
+            })),
+        };
+    }
+
+    async commitDraftRevision(draftNodeRevisionUid: string, options: {
+        armoredManifestSignature: string,
+        signatureEmail: string,
+        armoredExtendedAttributes?: string,
+    }): Promise<void> {
+        const { volumeId, nodeId, revisionId } = splitNodeRevisionUid(draftNodeRevisionUid);
+        await this.apiService.put<
+            // TODO: Deprected fields but not properly marked in the types.
+            Omit<PostCommitRevisionRequest, 'BlockNumber' | 'BlockList' | 'ThumbnailToken' | 'State'>,
+            PostCommitRevisionResponse
+        >(`drive/v2/volumes/${volumeId}/files/${nodeId}/revisions/${revisionId}`, {
+            ManifestSignature: options.armoredManifestSignature,
+            SignatureAddress: options.signatureEmail,
+            XAttr: options.armoredExtendedAttributes || null,
+            Photo: null, // TODO
+        });
+    }
+
+    async deleteDraft(draftNodeUid: string): Promise<void> {
+        const { volumeId, nodeId } = splitNodeUid(draftNodeUid);
+
+        const response = await this.apiService.post<
+            PostDeleteNodesRequest,
+            PostDeleteNodesResponse
+        >(`drive/v2/volumes/${volumeId}/delete_multiple`, {
+            LinkIDs: [nodeId],
+        });
+
+        const code = response.Responses?.[0].Response.Code || 0;
+        if (!isCodeOk(code)) {
+            throw new APICodeError(c('Error').t`Unknown error ${code}`, code)
+        }
+    }
+
+    async deleteDraftRevision(draftNodeRevisionUid: string): Promise<void> {
+        const { volumeId, nodeId, revisionId } = splitNodeRevisionUid(draftNodeRevisionUid);
+        await this.apiService.delete(`/drive/v2/volumes/${volumeId}/files/${nodeId}/revisions/${revisionId}`);
+    }
+
+    async uploadBlock(url: string, token: string, block: Uint8Array, onProgress?: (uploadedBytes: number) => void, signal?: AbortSignal): Promise<void> {
+        const formData = new FormData();
+        formData.append("Block", new Blob([block]), "blob");
+
+        await this.apiService.postBlockStream(url, token, formData, onProgress, signal);
+    }
+}

package/src/internal/upload/blockVerifier.ts

@@ -0,0 +1,40 @@
+import { PrivateKey, SessionKey } from "../../crypto";
+import { UploadAPIService } from "./apiService";
+import { UploadCryptoService } from "./cryptoService";
+
+export class BlockVerifier {
+    private verificationCode?: Uint8Array;
+    private contentKeyPacketSessionKey?: SessionKey;
+
+    constructor(
+        private apiService: UploadAPIService,
+        private cryptoService: UploadCryptoService,
+        private nodeKey: PrivateKey,
+        private draftNodeRevisionUid: string,
+    ) {
+        this.apiService = apiService;
+        this.cryptoService = cryptoService;
+        this.draftNodeRevisionUid = draftNodeRevisionUid;
+    }
+
+    async loadVerificationData() {
+        const result = await this.apiService.getVerificationData(this.draftNodeRevisionUid);
+        this.verificationCode = result.verificationCode;
+        this.contentKeyPacketSessionKey = await this.cryptoService.getContentKeyPacketSessionKey(this.nodeKey, result.base64ContentKeyPacket);
+    }
+
+    async verifyBlock(encryptedBlock: Uint8Array): Promise<{
+        verificationToken: Uint8Array,
+    }> {
+        if (!this.verificationCode || !this.contentKeyPacketSessionKey) {
+            throw new Error('Verifying block before loading verification data');
+        }
+
+        return this.cryptoService.verifyBlock(
+            this.nodeKey,
+            this.contentKeyPacketSessionKey,
+            this.verificationCode,
+            encryptedBlock,
+        );
+    }
+}

package/src/internal/upload/chunkStreamReader.test.ts

@@ -0,0 +1,89 @@
+import { ChunkStreamReader } from "./chunkStreamReader";
+
+describe("ChunkStreamReader", () => {
+    let stream: ReadableStream<Uint8Array>;
+
+    beforeEach(() => {
+        stream = new ReadableStream<Uint8Array>({
+            start(controller) {
+                controller.enqueue(new Uint8Array([1, 2, 3]));
+                controller.enqueue(new Uint8Array([4, 5, 6]));
+                controller.enqueue(new Uint8Array([7, 8, 9]));
+                controller.enqueue(new Uint8Array([10, 11, 12]));
+                controller.close();
+            },
+        });
+    });
+
+    it("should yield chunks as enqueued if matching the size", async () => {
+        const reader = new ChunkStreamReader(stream, 3);
+
+        const chunks: Uint8Array[] = [];
+        for await (const chunk of reader.iterateChunks()) {
+            chunks.push(new Uint8Array(chunk));
+        }
+
+        expect(chunks.length).toBe(4);
+        expect(chunks[0]).toEqual(new Uint8Array([1, 2, 3]));
+        expect(chunks[1]).toEqual(new Uint8Array([4, 5, 6]));
+        expect(chunks[2]).toEqual(new Uint8Array([7, 8, 9]));
+        expect(chunks[3]).toEqual(new Uint8Array([10, 11, 12]));
+    });
+
+    it("should yield smaller chunks than enqueued chunks", async () => {
+        const reader = new ChunkStreamReader(stream, 2);
+
+        const chunks: Uint8Array[] = [];
+        for await (const chunk of reader.iterateChunks()) {
+            chunks.push(new Uint8Array(chunk));
+        }
+
+        expect(chunks.length).toBe(6);
+        expect(chunks[0]).toEqual(new Uint8Array([1, 2]));
+        expect(chunks[1]).toEqual(new Uint8Array([3, 4]));
+        expect(chunks[2]).toEqual(new Uint8Array([5, 6]));
+        expect(chunks[3]).toEqual(new Uint8Array([7, 8]));
+        expect(chunks[4]).toEqual(new Uint8Array([9, 10]));
+        expect(chunks[5]).toEqual(new Uint8Array([11, 12]));
+    });
+
+    it("should yield bigger chunks than enqueued chunks", async () => {
+        const reader = new ChunkStreamReader(stream, 4);
+
+        const chunks: Uint8Array[] = [];
+        for await (const chunk of reader.iterateChunks()) {
+            chunks.push(new Uint8Array(chunk));
+        }
+
+        expect(chunks.length).toBe(3);
+        expect(chunks[0]).toEqual(new Uint8Array([1, 2, 3, 4]));
+        expect(chunks[1]).toEqual(new Uint8Array([5, 6, 7, 8]));
+        expect(chunks[2]).toEqual(new Uint8Array([9, 10, 11, 12]));
+    });
+
+    it("should yield last incomplete chunk", async () => {
+        const reader = new ChunkStreamReader(stream, 5);
+
+        const chunks: Uint8Array[] = [];
+        for await (const chunk of reader.iterateChunks()) {
+            chunks.push(new Uint8Array(chunk));
+        }
+
+        expect(chunks.length).toBe(3);
+        expect(chunks[0]).toEqual(new Uint8Array([1, 2, 3, 4, 5]));
+        expect(chunks[1]).toEqual(new Uint8Array([6, 7, 8, 9, 10]));
+        expect(chunks[2]).toEqual(new Uint8Array([11, 12]));
+    });
+
+    it("should yield as one big chunk", async () => {
+        const reader = new ChunkStreamReader(stream, 100);
+
+        const chunks: Uint8Array[] = [];
+        for await (const chunk of reader.iterateChunks()) {
+            chunks.push(new Uint8Array(chunk));
+        }
+
+        expect(chunks.length).toBe(1);
+        expect(chunks[0]).toEqual(new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]));
+    });
+});

package/src/internal/upload/chunkStreamReader.ts

@@ -0,0 +1,49 @@
+/**
+ * This class is used to read a stream in chunks.
+ *
+ * WARNING: The chunks are reused to avoid allocating new memory for each chunk.
+ * Ensure that the previous chunk is fully read before reading the next chunk.
+ * If you need to keep previous chunks, copy them to a new array.
+ */
+export class ChunkStreamReader {
+    private reader: ReadableStreamDefaultReader<Uint8Array>;
+
+    private chunkSize: number;
+
+    constructor(stream: ReadableStream<Uint8Array>, chunkSize: number) {
+        this.reader = stream.getReader();
+        this.chunkSize = chunkSize;
+    }
+
+    async *iterateChunks(): AsyncGenerator<Uint8Array> {
+        const buffer = new Uint8Array(this.chunkSize);
+
+        let position = 0;
+        while (true) {
+            const { done, value } = await this.reader.read();
+            if (done) {
+                break;
+            }
+
+            let remainingValue = value;
+            while (remainingValue.length > 0) {
+                if (position + remainingValue.length < this.chunkSize) {
+                    buffer.set(remainingValue, position);
+                    position += remainingValue.length;
+                    break;
+                }
+
+                const remainingToFillBuffer = this.chunkSize - position;
+                buffer.set(remainingValue.slice(0, remainingToFillBuffer), position);
+                yield buffer;
+
+                position = 0;
+                remainingValue = remainingValue.slice(remainingToFillBuffer);
+            }
+        }
+
+        if (position > 0) {
+            yield buffer.slice(0, position);
+        }
+    }
+}

package/src/internal/upload/controller.ts

@@ -0,0 +1,25 @@
+import { waitForCondition } from '../wait';
+
+export class UploadController {
+    private paused = false;
+    public promise?: Promise<string>;
+
+    async waitIfPaused(): Promise<void> {
+        await waitForCondition(() => !this.paused);
+    }
+
+    pause(): void {
+        this.paused = true;
+    }
+
+    resume(): void {
+        this.paused = false;
+    }
+
+    async completion(): Promise<string> {
+        if (!this.promise) {
+            throw new Error('UploadController.completion() called before upload started');
+        }
+        return await this.promise;
+    }
+}

package/src/internal/upload/cryptoService.ts

@@ -0,0 +1,162 @@
+import { c } from "ttag";
+
+import { DriveCrypto, PrivateKey, SessionKey } from "../../crypto";
+import { IntegrityError } from "../../errors";
+import { Thumbnail } from "../../interface";
+import { EncryptedBlock, EncryptedThumbnail, NodeCrypto, NodeRevisionDraftKeys, NodesService } from "./interface";
+
+export class UploadCryptoService {
+    constructor(
+        private driveCrypto: DriveCrypto,
+        private nodesService: NodesService,
+    ) {
+        this.driveCrypto = driveCrypto;
+        this.nodesService = nodesService;
+    }
+
+    async generateFileCrypto(
+        parentUid: string,
+        parentKeys: { key: PrivateKey, hashKey: Uint8Array },
+        name: string,
+    ): Promise<NodeCrypto> {
+        const signatureAddress = await this.nodesService.getRootNodeEmailKey(parentUid);
+
+        const [
+            nodeKeys,
+            { armoredNodeName },
+            hash,
+        ] = await Promise.all([
+            this.driveCrypto.generateKey([parentKeys.key], signatureAddress.addressKey),
+            this.driveCrypto.encryptNodeName(name, undefined, parentKeys.key, signatureAddress.addressKey),
+            this.driveCrypto.generateLookupHash(name, parentKeys.hashKey),
+        ]);
+
+        const contentKey = await this.driveCrypto.generateContentKey(nodeKeys.decrypted.key);
+
+        return {
+            nodeKeys,
+            contentKey,
+            encryptedNode: {
+                encryptedName: armoredNodeName,
+                hash,
+            },
+            signatureAddress,
+        };
+    }
+
+    async generateNameHashes(parentHashKey: Uint8Array, names: string[]): Promise<{ name: string, hash: string }[]> {
+        return Promise.all(names.map(async (name) => ({
+            name,
+            hash: await this.driveCrypto.generateLookupHash(name, parentHashKey)
+        })));
+    }
+
+    async encryptThumbnail(nodeRevisionDraftKeys: NodeRevisionDraftKeys, thumbnail: Thumbnail): Promise<EncryptedThumbnail> {
+        const { encryptedData } = await this.driveCrypto.encryptThumbnailBlock(
+            thumbnail.thumbnail,
+            nodeRevisionDraftKeys.contentKeyPacketSessionKey,
+            nodeRevisionDraftKeys.signatureAddress.addressKey,
+        )
+
+        const digest = await crypto.subtle.digest('SHA-256', encryptedData);
+
+        return {
+            type: thumbnail.type,
+            encryptedData: encryptedData,
+            originalSize: thumbnail.thumbnail.length,
+            encryptedSize: encryptedData.length,
+            hash: new Uint8Array(digest),
+        }
+    }
+
+    async encryptBlock(
+        verifyBlock: (encryptedBlock: Uint8Array) => Promise<{ verificationToken: Uint8Array }>,
+        nodeRevisionDraftKeys: NodeRevisionDraftKeys,
+        block: Uint8Array,
+        index: number,
+    ): Promise<EncryptedBlock> {
+        const { encryptedData, armoredSignature } = await this.driveCrypto.encryptBlock(
+            block,
+            nodeRevisionDraftKeys.key,
+            nodeRevisionDraftKeys.contentKeyPacketSessionKey,
+            nodeRevisionDraftKeys.signatureAddress.addressKey,
+        );
+
+        const digest = await crypto.subtle.digest('SHA-256', encryptedData);
+        const { verificationToken } = await verifyBlock(encryptedData);
+
+        return {
+            index,
+            encryptedData,
+            armoredSignature,
+            verificationToken,
+            originalSize: block.length,
+            encryptedSize: encryptedData.length,
+            hash: new Uint8Array(digest),
+        }
+    }
+
+    async commitFile(nodeRevisionDraftKeys: NodeRevisionDraftKeys, manifest: Uint8Array, extendedAttributes?: string): Promise<{
+        armoredManifestSignature: string,
+        signatureEmail: string,
+        armoredExtendedAttributes?: string,
+    }> {
+        const { armoredManifestSignature } = await this.driveCrypto.signManifest(manifest, nodeRevisionDraftKeys.signatureAddress.addressKey);
+
+        const { armoredExtendedAttributes } = extendedAttributes
+            ? await this.driveCrypto.encryptExtendedAttributes(extendedAttributes, nodeRevisionDraftKeys.key, nodeRevisionDraftKeys.signatureAddress.addressKey)
+            : { armoredExtendedAttributes: undefined };
+
+        return {
+            armoredManifestSignature,
+            signatureEmail: nodeRevisionDraftKeys.signatureAddress.email,
+            armoredExtendedAttributes,
+        }
+    }
+
+    async getContentKeyPacketSessionKey(nodeKey: PrivateKey, base64ContentKeyPacket: string): Promise<SessionKey> {
+        const { sessionKey } = await this.driveCrypto.decryptAndVerifySessionKey(
+            base64ContentKeyPacket,
+            undefined,
+            nodeKey,
+            [],
+        );
+        return sessionKey;
+    }
+
+    async verifyBlock(
+        nodeKey: PrivateKey,
+        contentKeyPacketSessionKey: SessionKey,
+        verificationCode: Uint8Array,
+        encryptedData: Uint8Array,
+    ): Promise<{
+        verificationToken: Uint8Array,
+    }> {
+        // Attempt to decrypt data block, to try to detect bitflips / bad hardware
+        //
+        // We don't check the signature as it is an expensive operation,
+        // and we don't need to here as we always have the manifest signature
+        //
+        // Additionally, we use the key provided by the verification endpoint, to
+        // ensure the correct key was used to encrypt the data
+        try {
+            await this.driveCrypto.decryptBlock(
+                encryptedData,
+                undefined,
+                nodeKey,
+                contentKeyPacketSessionKey,
+            );
+        } catch (error) {
+            throw new IntegrityError(c('Error').t`Data integrity check of one part failed`, {
+                error,
+            });
+        }
+
+        // The verifier requires a 0-padded data packet, so we can
+        // access the array directly and fall back to 0.
+        const verificationToken = verificationCode.map((value, index) => value ^ (encryptedData[index] || 0));
+        return {
+            verificationToken,
+        }
+    }
+}

package/src/internal/upload/digests.ts

@@ -0,0 +1,18 @@
+import { sha1 } from "@noble/hashes/legacy";
+import { bytesToHex } from '@noble/hashes/utils';
+
+export class UploadDigests {
+    constructor(private digestSha1 = sha1.create()) {
+        this.digestSha1 = digestSha1;
+    }
+
+    update(data: Uint8Array): void {
+        this.digestSha1.update(data);
+    }
+
+    digests(): { sha1: string } {
+        return {
+            sha1: bytesToHex(this.digestSha1.digest()),
+        }
+    }
+}