@protontech/drive-sdk 0.1.2 → 0.2.0

package/src/internal/nodes/cryptoService.test.ts

@@ -1,5 +1,5 @@
 import { DriveCrypto, PrivateKey, SessionKey, VERIFICATION_STATUS } from '../../crypto';
-import { ProtonDriveAccount, ProtonDriveTelemetry, RevisionState } from '../../interface';
+import { MemberRole, ProtonDriveAccount, ProtonDriveTelemetry, RevisionState } from '../../interface';
 import { getMockTelemetry } from '../../tests/telemetry';
 import { DecryptedNode, DecryptedNodeKeys, DecryptedUnparsedNode, EncryptedNode, SharesService } from './interface';
 import { NodesCryptoService } from './cryptoService';
@@ -48,13 +48,18 @@ describe('nodesCryptoService', () => {
                     armoredNodeName: 'armoredName',
                 }),
             ),
-            // @ts-expect-error No need to implement all methods for mocking
+            // @ts-expect-error Faking sessionKey as string.
             decryptAndVerifySessionKey: jest.fn(async () =>
                 Promise.resolve({
                     sessionKey: 'contentKeyPacketSessionKey',
                     verified: VERIFICATION_STATUS.SIGNED_AND_VALID,
                 }),
             ),
+            verifyInvitation: jest.fn(async () =>
+                Promise.resolve({
+                    verified: VERIFICATION_STATUS.SIGNED_AND_VALID,
+                }),
+            ),
         };
         account = {
             // @ts-expect-error No need to implement all methods for mocking
@@ -75,42 +80,60 @@ describe('nodesCryptoService', () => {
     const parentKey = 'parentKey' as unknown as PrivateKey;
 
     function verifyLogEventVerificationError(options = {}) {
-        expect(telemetry.logEvent).toHaveBeenCalledTimes(1);
-        expect(telemetry.logEvent).toHaveBeenCalledWith({
+        expect(telemetry.recordMetric).toHaveBeenCalledTimes(1);
+        expect(telemetry.recordMetric).toHaveBeenCalledWith({
             eventName: 'verificationError',
             volumeType: 'own_volume',
             fromBefore2024: false,
             addressMatchingDefaultShare: false,
+            uid: 'volumeId~nodeId',
             ...options,
         });
     }
 
     function verifyLogEventDecryptionError(options = {}) {
-        expect(telemetry.logEvent).toHaveBeenCalledTimes(1);
-        expect(telemetry.logEvent).toHaveBeenCalledWith({
+        expect(telemetry.recordMetric).toHaveBeenCalledTimes(1);
+        expect(telemetry.recordMetric).toHaveBeenCalledWith({
             eventName: 'decryptionError',
             volumeType: 'own_volume',
             fromBefore2024: false,
+            uid: 'volumeId~nodeId',
             ...options,
         });
     }
 
     describe('folder node', () => {
-        const encryptedNode = {
-            uid: 'volumeId~nodeId',
-            parentUid: 'volumeId~parentId',
-            encryptedCrypto: {
-                signatureEmail: 'signatureEmail',
-                nameSignatureEmail: 'nameSignatureEmail',
-                armoredKey: 'armoredKey',
-                armoredNodePassphrase: 'armoredNodePassphrase',
-                armoredNodePassphraseSignature: 'armoredNodePassphraseSignature',
-                folder: {
-                    armoredHashKey: 'armoredHashKey',
-                    armoredExtendedAttributes: 'folderArmoredExtendedAttributes',
+        let encryptedNode: EncryptedNode;
+
+        beforeEach(() => {
+            encryptedNode = {
+                uid: 'volumeId~nodeId',
+                parentUid: 'volumeId~parentId',
+                membership: {
+                    role: MemberRole.Admin,
+                    inviteTime: new Date(1234567890000),
                 },
-            },
-        } as EncryptedNode;
+                encryptedCrypto: {
+                    signatureEmail: 'signatureEmail',
+                    nameSignatureEmail: 'nameSignatureEmail',
+                    armoredKey: 'armoredKey',
+                    armoredNodePassphrase: 'armoredNodePassphrase',
+                    armoredNodePassphraseSignature: 'armoredNodePassphraseSignature',
+                    folder: {
+                        armoredHashKey: 'armoredHashKey',
+                        armoredExtendedAttributes: 'folderArmoredExtendedAttributes',
+                    },
+                    membership: {
+                        inviterEmail: 'inviterEmail',
+                        base64MemberSharePassphraseKeyPacket: 'base64MemberSharePassphraseKeyPacket',
+                        armoredInviterSharePassphraseKeyPacketSignature:
+                            'armoredInviterSharePassphraseKeyPacketSignature',
+                        armoredInviteeSharePassphraseSessionKeySignature:
+                            'armoredInviteeSharePassphraseSessionKeySignature',
+                    },
+                },
+            } as EncryptedNode;
+        });
 
         function verifyResult(
             result: { node: DecryptedUnparsedNode; keys?: DecryptedNodeKeys },
@@ -125,6 +148,11 @@ describe('nodesCryptoService', () => {
                     folder: {
                         extendedAttributes: '{}',
                     },
+                    membership: {
+                        role: MemberRole.Admin,
+                        inviteTime: new Date(1234567890000),
+                        sharedBy: { ok: true, value: 'inviterEmail' },
+                    },
                     activeRevision: undefined,
                     errors: undefined,
                     ...expectedNode,
@@ -145,19 +173,7 @@ describe('nodesCryptoService', () => {
 
         describe('should decrypt successfuly', () => {
             it('same author everywhere', async () => {
-                const encryptedNode = {
-                    encryptedCrypto: {
-                        signatureEmail: 'signatureEmail',
-                        nameSignatureEmail: 'signatureEmail',
-                        armoredKey: 'armoredKey',
-                        armoredNodePassphrase: 'armoredNodePassphrase',
-                        armoredNodePassphraseSignature: 'armoredNodePassphraseSignature',
-                        folder: {
-                            armoredHashKey: 'armoredHashKey',
-                            armoredExtendedAttributes: 'folderArmoredExtendedAttributes',
-                        },
-                    },
-                } as EncryptedNode;
+                encryptedNode.encryptedCrypto.nameSignatureEmail = 'signatureEmail';
 
                 const result = await cryptoService.decryptNode(encryptedNode, parentKey);
                 verifyResult(result, {
@@ -165,18 +181,20 @@ describe('nodesCryptoService', () => {
                     nameAuthor: { ok: true, value: 'signatureEmail' },
                 });
 
-                expect(account.getPublicKeys).toHaveBeenCalledTimes(1);
+                expect(account.getPublicKeys).toHaveBeenCalledTimes(2); // signatureEmail (for both key and name) and inviterEmail
                 expect(account.getPublicKeys).toHaveBeenCalledWith('signatureEmail');
-                expect(telemetry.logEvent).not.toHaveBeenCalled();
+                expect(account.getPublicKeys).toHaveBeenCalledWith('inviterEmail');
+                expect(telemetry.recordMetric).not.toHaveBeenCalled();
             });
 
             it('different authors on key and name', async () => {
                 const result = await cryptoService.decryptNode(encryptedNode, parentKey);
                 verifyResult(result);
-                expect(account.getPublicKeys).toHaveBeenCalledTimes(2);
+                expect(account.getPublicKeys).toHaveBeenCalledTimes(3); // signatureEmail, nameSignatureEmail, inviterEmail
                 expect(account.getPublicKeys).toHaveBeenCalledWith('signatureEmail');
                 expect(account.getPublicKeys).toHaveBeenCalledWith('nameSignatureEmail');
-                expect(telemetry.logEvent).not.toHaveBeenCalled();
+                expect(account.getPublicKeys).toHaveBeenCalledWith('inviterEmail');
+                expect(telemetry.recordMetric).not.toHaveBeenCalled();
             });
         });
 
@@ -188,6 +206,7 @@ describe('nodesCryptoService', () => {
                         key: 'decryptedKey' as unknown as PrivateKey,
                         passphraseSessionKey: 'passphraseSessionKey' as unknown as SessionKey,
                         verified: VERIFICATION_STATUS.NOT_SIGNED,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
 
@@ -200,6 +219,7 @@ describe('nodesCryptoService', () => {
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeKey',
+                    error: 'verification error',
                 });
             });
 
@@ -208,6 +228,7 @@ describe('nodesCryptoService', () => {
                     Promise.resolve({
                         name: 'name',
                         verified: VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
 
@@ -215,11 +236,15 @@ describe('nodesCryptoService', () => {
                 verifyResult(result, {
                     nameAuthor: {
                         ok: false,
-                        error: { claimedAuthor: 'nameSignatureEmail', error: 'Signature verification for name failed' },
+                        error: {
+                            claimedAuthor: 'nameSignatureEmail',
+                            error: 'Signature verification for name failed: verification error',
+                        },
                     },
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeName',
+                    error: 'verification error',
                 });
             });
 
@@ -228,6 +253,7 @@ describe('nodesCryptoService', () => {
                     Promise.resolve({
                         hashKey: new Uint8Array(),
                         verified: VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
 
@@ -235,11 +261,15 @@ describe('nodesCryptoService', () => {
                 verifyResult(result, {
                     keyAuthor: {
                         ok: false,
-                        error: { claimedAuthor: 'signatureEmail', error: 'Signature verification for hash key failed' },
+                        error: {
+                            claimedAuthor: 'signatureEmail',
+                            error: 'Signature verification for hash key failed: verification error',
+                        },
                     },
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeHashKey',
+                    error: 'verification error',
                 });
             });
 
@@ -250,6 +280,7 @@ describe('nodesCryptoService', () => {
                         key: 'decryptedKey' as unknown as PrivateKey,
                         passphraseSessionKey: 'passphraseSessionKey' as unknown as SessionKey,
                         verified: VERIFICATION_STATUS.NOT_SIGNED,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
                 driveCrypto.decryptNodeHashKey = jest.fn(async () =>
@@ -268,6 +299,7 @@ describe('nodesCryptoService', () => {
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeKey',
+                    error: 'verification error',
                 });
             });
 
@@ -276,6 +308,7 @@ describe('nodesCryptoService', () => {
                     Promise.resolve({
                         extendedAttributes: '{}',
                         verified: VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
 
@@ -285,12 +318,39 @@ describe('nodesCryptoService', () => {
                         ok: false,
                         error: {
                             claimedAuthor: 'signatureEmail',
-                            error: 'Signature verification for attributes failed',
+                            error: 'Signature verification for attributes failed: verification error',
                         },
                     },
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeExtendedAttributes',
+                    error: 'verification error',
+                });
+            });
+
+            it('on membership', async () => {
+                driveCrypto.verifyInvitation = jest.fn().mockResolvedValue({
+                    verified: VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                    verificationErrors: [new Error('verification error')],
+                });
+
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    membership: {
+                        role: MemberRole.Admin,
+                        inviteTime: new Date(1234567890000),
+                        sharedBy: {
+                            ok: false,
+                            error: {
+                                claimedAuthor: 'inviterEmail',
+                                error: 'Signature verification for membership failed: verification error',
+                            },
+                        },
+                    },
+                });
+                verifyLogEventVerificationError({
+                    field: 'membershipInviter',
+                    error: 'verification error',
                 });
             });
         });
@@ -380,6 +440,27 @@ describe('nodesCryptoService', () => {
                     error,
                 });
             });
+
+            it('on membership', async () => {
+                const error = new Error('Decryption error');
+                driveCrypto.verifyInvitation = jest.fn(async () => Promise.reject(error));
+
+                const result = await cryptoService.decryptNode(encryptedNode, parentKey);
+                verifyResult(result, {
+                    membership: {
+                        role: MemberRole.Admin,
+                        inviteTime: new Date(1234567890000),
+                        sharedBy: {
+                            ok: false,
+                            error: { claimedAuthor: 'inviterEmail', error: 'Failed to verify invitation' },
+                        },
+                    },
+                });
+                verifyLogEventVerificationError({
+                    field: 'membershipInviter',
+                    addressMatchingDefaultShare: undefined,
+                });
+            });
         });
 
         it('should fail when keys cannot be loaded', async () => {
@@ -491,7 +572,7 @@ describe('nodesCryptoService', () => {
 
                 expect(account.getPublicKeys).toHaveBeenCalledTimes(2); // node + revision
                 expect(account.getPublicKeys).toHaveBeenCalledWith('signatureEmail');
-                expect(telemetry.logEvent).not.toHaveBeenCalled();
+                expect(telemetry.recordMetric).not.toHaveBeenCalled();
             });
 
             it('different authors on key and name', async () => {
@@ -501,7 +582,7 @@ describe('nodesCryptoService', () => {
                 expect(account.getPublicKeys).toHaveBeenCalledWith('signatureEmail');
                 expect(account.getPublicKeys).toHaveBeenCalledWith('nameSignatureEmail');
                 expect(account.getPublicKeys).toHaveBeenCalledWith('revisionSignatureEmail');
-                expect(telemetry.logEvent).not.toHaveBeenCalled();
+                expect(telemetry.recordMetric).not.toHaveBeenCalled();
             });
         });
 
@@ -513,6 +594,7 @@ describe('nodesCryptoService', () => {
                         key: 'decryptedKey' as unknown as PrivateKey,
                         passphraseSessionKey: 'passphraseSessionKey' as unknown as SessionKey,
                         verified: VERIFICATION_STATUS.NOT_SIGNED,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
 
@@ -525,6 +607,7 @@ describe('nodesCryptoService', () => {
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeKey',
+                    error: 'verification error',
                 });
             });
 
@@ -533,6 +616,7 @@ describe('nodesCryptoService', () => {
                     Promise.resolve({
                         name: 'name',
                         verified: VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
 
@@ -540,11 +624,15 @@ describe('nodesCryptoService', () => {
                 verifyResult(result, {
                     nameAuthor: {
                         ok: false,
-                        error: { claimedAuthor: 'nameSignatureEmail', error: 'Signature verification for name failed' },
+                        error: {
+                            claimedAuthor: 'nameSignatureEmail',
+                            error: 'Signature verification for name failed: verification error',
+                        },
                     },
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeName',
+                    error: 'verification error',
                 });
             });
 
@@ -553,6 +641,7 @@ describe('nodesCryptoService', () => {
                     Promise.resolve({
                         extendedAttributes: '{}',
                         verified: VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                        verificationErrors: [new Error('verification error')],
                     }),
                 );
 
@@ -570,7 +659,7 @@ describe('nodesCryptoService', () => {
                                 ok: false,
                                 error: {
                                     claimedAuthor: 'revisionSignatureEmail',
-                                    error: 'Signature verification for attributes failed',
+                                    error: 'Signature verification for attributes failed: verification error',
                                 },
                             },
                         },
@@ -578,6 +667,7 @@ describe('nodesCryptoService', () => {
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeExtendedAttributes',
+                    error: 'verification error',
                 });
             });
 
@@ -587,6 +677,7 @@ describe('nodesCryptoService', () => {
                         Promise.resolve({
                             sessionKey: 'contentKeyPacketSessionKey',
                             verified: VERIFICATION_STATUS.SIGNED_AND_INVALID,
+                            verificationErrors: [new Error('verification error')],
                         }) as any,
                 );
 
@@ -596,12 +687,13 @@ describe('nodesCryptoService', () => {
                         ok: false,
                         error: {
                             claimedAuthor: 'signatureEmail',
-                            error: 'Signature verification for content key failed',
+                            error: 'Signature verification for content key failed: verification error',
                         },
                     },
                 });
                 verifyLogEventVerificationError({
                     field: 'nodeContentKey',
+                    error: 'verification error',
                 });
             });
         });
@@ -743,7 +835,7 @@ describe('nodesCryptoService', () => {
             });
 
             expect(account.getPublicKeys).toHaveBeenCalledTimes(2);
-            expect(telemetry.logEvent).not.toHaveBeenCalled();
+            expect(telemetry.recordMetric).not.toHaveBeenCalled();
         });
     });
 
@@ -878,7 +970,7 @@ describe('nodesCryptoService', () => {
                     keyAuthor: { ok: true, value: null },
                     nameAuthor: { ok: true, value: null },
                 });
-                expect(telemetry.logEvent).not.toHaveBeenCalled();
+                expect(telemetry.recordMetric).not.toHaveBeenCalled();
                 expect(driveCrypto.decryptKey).toHaveBeenCalledWith(
                     encryptedNode.encryptedCrypto.armoredKey,
                     encryptedNode.encryptedCrypto.armoredNodePassphrase,

package/src/internal/nodes/cryptoService.ts

@@ -12,6 +12,7 @@ import {
     Logger,
     MetricsDecryptionErrorField,
     MetricVerificationErrorField,
+    Membership,
 } from '../../interface';
 import { ValidationError } from '../../errors';
 import { getErrorMessage, getVerificationMessage } from '../errors';
@@ -90,6 +91,11 @@ export class NodesCryptoService {
 
         const { name, author: nameAuthor } = await this.decryptName(node, parentKey, nameVerificationKeys);
 
+        let membership;
+        if (node.membership) {
+            membership = await this.decryptMembership(node);
+        }
+
         let passphrase, key, passphraseSessionKey, keyAuthor;
         try {
             const keyResult = await this.decryptKey(node, parentKey, keyVerificationKeys);
@@ -110,6 +116,7 @@ export class NodesCryptoService {
                         error: errorMessage,
                     }),
                     nameAuthor,
+                    membership,
                     activeRevision: 'file' in node.encryptedCrypto ? resultError(new Error(errorMessage)) : undefined,
                     folder: undefined,
                     errors: [error],
@@ -187,6 +194,7 @@ export class NodesCryptoService {
                         'nodeContentKey',
                         c('Property').t`content key`,
                         keySessionKeyResult.verified,
+                        keySessionKeyResult.verificationErrors,
                         node.encryptedCrypto.signatureEmail,
                     ));
             } catch (error: unknown) {
@@ -228,6 +236,7 @@ export class NodesCryptoService {
                 name,
                 keyAuthor: finalKeyAuthor,
                 nameAuthor,
+                membership,
                 activeRevision,
                 folder,
                 errors: errors.length ? errors : undefined,
@@ -268,6 +277,7 @@ export class NodesCryptoService {
                 'nodeKey',
                 c('Property').t`key`,
                 key.verified,
+                key.verificationErrors,
                 node.encryptedCrypto.signatureEmail,
                 verificationKeys.length === 0,
             ),
@@ -285,7 +295,7 @@ export class NodesCryptoService {
         const nameSignatureEmail = node.encryptedCrypto.nameSignatureEmail;
 
         try {
-            const { name, verified } = await this.driveCrypto.decryptNodeName(
+            const { name, verified, verificationErrors } = await this.driveCrypto.decryptNodeName(
                 node.encryptedName,
                 parentKey,
                 verificationKeys,
@@ -298,6 +308,7 @@ export class NodesCryptoService {
                     'nodeName',
                     c('Property').t`name`,
                     verified,
+                    verificationErrors,
                     nameSignatureEmail,
                     verificationKeys.length === 0,
                 ),
@@ -319,6 +330,60 @@ export class NodesCryptoService {
         return this.driveCrypto.decryptSessionKey(node.encryptedName, parentKey);
     }
 
+    private async decryptMembership(node: EncryptedNode): Promise<Membership | undefined> {
+        if (!node.membership) {
+            return undefined;
+        }
+
+        let sharedBy: Author;
+        if (node.encryptedCrypto.membership) {
+            let inviterEmailKeys: PublicKey[] | undefined;
+            try {
+                inviterEmailKeys = await this.account.getPublicKeys(node.encryptedCrypto.membership.inviterEmail);
+            } catch (error: unknown) {
+                this.logger.error('Failed to get inviter email keys', error);
+                sharedBy = resultError({
+                    claimedAuthor: node.encryptedCrypto.membership.inviterEmail,
+                    error: c('Error').t`Failed to get inviter keys`,
+                });
+            }
+
+            try {
+                const { verified, verificationErrors } = await this.driveCrypto.verifyInvitation(
+                    node.encryptedCrypto.membership.base64MemberSharePassphraseKeyPacket,
+                    node.encryptedCrypto.membership.armoredInviterSharePassphraseKeyPacketSignature,
+                    inviterEmailKeys || [],
+                );
+
+                sharedBy = await this.handleClaimedAuthor(
+                    node,
+                    'membershipInviter',
+                    c('Property').t`membership`,
+                    verified,
+                    verificationErrors,
+                    node.encryptedCrypto.membership.inviterEmail,
+                );
+            } catch (error: unknown) {
+                void this.reportVerificationError(node, 'membershipInviter');
+                this.logger.error('Failed to verify invitation', error);
+                sharedBy = resultError({
+                    claimedAuthor: node.encryptedCrypto.membership.inviterEmail,
+                    error: c('Error').t`Failed to verify invitation`,
+                });
+            }
+        } else {
+            sharedBy = resultError({
+                error: c('Error').t`Missing inviter email`,
+            });
+        }
+
+        return {
+            role: node.membership.role,
+            inviteTime: node.membership.inviteTime,
+            sharedBy,
+        };
+    }
+
     private async decryptHashKey(
         node: EncryptedNode,
         nodeKey: PrivateKey,
@@ -332,7 +397,7 @@ export class NodesCryptoService {
             throw new Error('Node is not a folder');
         }
 
-        const { hashKey, verified } = await this.driveCrypto.decryptNodeHashKey(
+        const { hashKey, verified, verificationErrors } = await this.driveCrypto.decryptNodeHashKey(
             node.encryptedCrypto.folder.armoredHashKey,
             nodeKey,
             addressKeys,
@@ -345,6 +410,7 @@ export class NodesCryptoService {
                 'nodeHashKey',
                 c('Property').t`hash key`,
                 verified,
+                verificationErrors,
                 node.encryptedCrypto.signatureEmail,
             ),
         };
@@ -394,7 +460,7 @@ export class NodesCryptoService {
             };
         }
 
-        const { extendedAttributes, verified } = await this.driveCrypto.decryptExtendedAttributes(
+        const { extendedAttributes, verified, verificationErrors } = await this.driveCrypto.decryptExtendedAttributes(
             encryptedExtendedAttributes,
             nodeKey,
             addressKeys,
@@ -407,6 +473,7 @@ export class NodesCryptoService {
                 'nodeExtendedAttributes',
                 c('Property').t`attributes`,
                 verified,
+                verificationErrors,
                 signatureEmail,
             ),
         };
@@ -418,7 +485,13 @@ export class NodesCryptoService {
         name: string,
         extendedAttributes?: string,
     ): Promise<{
-        encryptedCrypto: Required<EncryptedNodeFolderCrypto> & { encryptedName: string; hash: string };
+        encryptedCrypto: EncryptedNodeFolderCrypto & {
+            // signatureEmail and nameSignatureEmail are not optional.
+            signatureEmail: string;
+            nameSignatureEmail: string;
+            encryptedName: string;
+            hash: string;
+        };
         keys: DecryptedNodeKeys;
     }> {
         const { email, addressKey } = address;
@@ -536,12 +609,19 @@ export class NodesCryptoService {
         field: MetricVerificationErrorField,
         signatureType: string,
         verified: VERIFICATION_STATUS,
+        verificationErrors?: Error[],
         claimedAuthor?: string,
         notAvailableVerificationKeys = false,
     ): Promise<Author> {
-        const author = handleClaimedAuthor(signatureType, verified, claimedAuthor, notAvailableVerificationKeys);
+        const author = handleClaimedAuthor(
+            signatureType,
+            verified,
+            verificationErrors,
+            claimedAuthor,
+            notAvailableVerificationKeys,
+        );
         if (!author.ok) {
-            void this.reportVerificationError(node, field, claimedAuthor);
+            void this.reportVerificationError(node, field, verificationErrors, claimedAuthor);
         }
         return author;
     }
@@ -549,6 +629,7 @@ export class NodesCryptoService {
     private async reportVerificationError(
         node: { uid: string; creationTime: Date },
         field: MetricVerificationErrorField,
+        verificationErrors?: Error[],
         claimedAuthor?: string,
     ) {
         if (this.reportedVerificationErrors.has(node.uid)) {
@@ -571,12 +652,14 @@ export class NodesCryptoService {
             `Failed to verify ${field} for node ${node.uid} (from before 2024: ${fromBefore2024}, matching address: ${addressMatchingDefaultShare})`,
         );
 
-        this.telemetry.logEvent({
+        this.telemetry.recordMetric({
             eventName: 'verificationError',
             volumeType,
             field,
             addressMatchingDefaultShare,
             fromBefore2024,
+            error: verificationErrors?.map((e) => e.message).join(', '),
+            uid: node.uid,
         });
         this.reportedVerificationErrors.add(node.uid);
     }
@@ -598,12 +681,13 @@ export class NodesCryptoService {
 
         this.logger.error(`Failed to decrypt node ${node.uid} (from before 2024: ${fromBefore2024})`, error);
 
-        this.telemetry.logEvent({
+        this.telemetry.recordMetric({
             eventName: 'decryptionError',
             volumeType,
             field,
             fromBefore2024,
             error,
+            uid: node.uid,
         });
         this.reportedDecryptionErrors.add(node.uid);
     }
@@ -615,6 +699,7 @@ export class NodesCryptoService {
 function handleClaimedAuthor(
     signatureType: string,
     verified: VERIFICATION_STATUS,
+    verificationErrors?: Error[],
     claimedAuthor?: string,
     notAvailableVerificationKeys = false,
 ): Author {
@@ -628,6 +713,6 @@ function handleClaimedAuthor(
 
     return resultError({
         claimedAuthor: claimedAuthor,
-        error: getVerificationMessage(verified, signatureType, notAvailableVerificationKeys),
+        error: getVerificationMessage(verified, verificationErrors, signatureType, notAvailableVerificationKeys),
     });
 }