@protontech/drive-sdk 0.3.0 → 0.3.2

package/src/internal/nodes/cryptoService.ts

@@ -7,27 +7,49 @@ import {
     Result,
     Author,
     AnonymousUser,
-    ProtonDriveAccount,
     ProtonDriveTelemetry,
     Logger,
     MetricsDecryptionErrorField,
     MetricVerificationErrorField,
     Membership,
+    ProtonDriveAccount,
 } from '../../interface';
 import { ValidationError } from '../../errors';
-import { getErrorMessage, getVerificationMessage } from '../errors';
-import { splitNodeUid } from '../uids';
+import { getErrorMessage } from '../errors';
 import {
     EncryptedNode,
     EncryptedNodeFolderCrypto,
     DecryptedUnparsedNode,
     DecryptedNode,
     DecryptedNodeKeys,
-    SharesService,
     EncryptedRevision,
     DecryptedUnparsedRevision,
 } from './interface';
 
+export interface NodesCryptoReporter {
+    handleClaimedAuthor(
+        node: NodesCryptoReporterNode,
+        field: MetricVerificationErrorField,
+        signatureType: string,
+        verified: VERIFICATION_STATUS,
+        verificationErrors?: Error[],
+        claimedAuthor?: string,
+        notAvailableVerificationKeys?: boolean,
+    ): Promise<Author>;
+    reportDecryptionError(node: NodesCryptoReporterNode, field: MetricsDecryptionErrorField, error: unknown): void;
+    reportVerificationError(
+        node: NodesCryptoReporterNode,
+        field: MetricVerificationErrorField,
+        verificationErrors?: Error[],
+        claimedAuthor?: string,
+    ): void;
+}
+
+type NodesCryptoReporterNode = {
+    uid: string;
+    creationTime: Date;
+};
+
 /**
  * Provides crypto operations for nodes metadata.
  *
@@ -41,20 +63,16 @@ import {
 export class NodesCryptoService {
     private logger: Logger;
 
-    private reportedDecryptionErrors = new Set<string>();
-    private reportedVerificationErrors = new Set<string>();
-
     constructor(
-        private telemetry: ProtonDriveTelemetry,
-        private driveCrypto: DriveCrypto,
+        telemetry: ProtonDriveTelemetry,
+        protected driveCrypto: DriveCrypto,
         private account: ProtonDriveAccount,
-        private shareService: SharesService,
+        private reporter: NodesCryptoReporter,
     ) {
-        this.telemetry = telemetry;
         this.logger = telemetry.getLogger('nodes-crypto');
         this.driveCrypto = driveCrypto;
         this.account = account;
-        this.shareService = shareService;
+        this.reporter = reporter;
     }
 
     async decryptNode(
@@ -107,7 +125,7 @@ export class NodesCryptoService {
             passphraseSessionKey = keyResult.passphraseSessionKey;
             keyAuthor = keyResult.author;
         } catch (error: unknown) {
-            void this.reportDecryptionError(node, 'nodeKey', error);
+            void this.reporter.reportDecryptionError(node, 'nodeKey', error);
             const message = getErrorMessage(error);
             const errorMessage = c('Error').t`Failed to decrypt node key: ${message}`;
             const { name, author: nameAuthor } = await namePromise;
@@ -159,7 +177,7 @@ export class NodesCryptoService {
                 hashKey = hashKeyResult.hashKey;
                 hashKeyAuthor = hashKeyResult.author;
             } catch (error: unknown) {
-                void this.reportDecryptionError(node, 'nodeHashKey', error);
+                void this.reporter.reportDecryptionError(node, 'nodeHashKey', error);
                 errors.push(error);
             }
 
@@ -170,7 +188,7 @@ export class NodesCryptoService {
                 };
                 folderExtendedAttributesAuthor = extendedAttributesResult.author;
             } catch (error: unknown) {
-                void this.reportDecryptionError(node, 'nodeExtendedAttributes', error);
+                void this.reporter.reportDecryptionError(node, 'nodeExtendedAttributes', error);
                 errors.push(error);
             }
         }
@@ -194,7 +212,7 @@ export class NodesCryptoService {
             try {
                 activeRevision = resultOk(await activeRevisionPromise);
             } catch (error: unknown) {
-                void this.reportDecryptionError(node, 'nodeExtendedAttributes', error);
+                void this.reporter.reportDecryptionError(node, 'nodeExtendedAttributes', error);
                 const message = getErrorMessage(error);
                 const errorMessage = c('Error').t`Failed to decrypt active revision: ${message}`;
                 activeRevision = resultError(new Error(errorMessage));
@@ -205,7 +223,7 @@ export class NodesCryptoService {
                 contentKeyPacketSessionKey = keySessionKeyResult.sessionKey;
                 contentKeyPacketAuthor =
                     keySessionKeyResult.verified !== undefined &&
-                    (await this.handleClaimedAuthor(
+                    (await this.reporter.handleClaimedAuthor(
                         node,
                         'nodeContentKey',
                         c('Property').t`content key`,
@@ -214,7 +232,7 @@ export class NodesCryptoService {
                         node.encryptedCrypto.signatureEmail,
                     ));
             } catch (error: unknown) {
-                void this.reportDecryptionError(node, 'nodeContentKey', error);
+                void this.reporter.reportDecryptionError(node, 'nodeContentKey', error);
                 const message = getErrorMessage(error);
                 const errorMessage = c('Error').t`Failed to decrypt content key: ${message}`;
                 contentKeyPacketAuthor = resultError({
@@ -295,7 +313,7 @@ export class NodesCryptoService {
             passphrase: key.passphrase,
             key: key.key,
             passphraseSessionKey: key.passphraseSessionKey,
-            author: await this.handleClaimedAuthor(
+            author: await this.reporter.handleClaimedAuthor(
                 node,
                 'nodeKey',
                 c('Property').t`key`,
@@ -326,7 +344,7 @@ export class NodesCryptoService {
 
             return {
                 name: resultOk(name),
-                author: await this.handleClaimedAuthor(
+                author: await this.reporter.handleClaimedAuthor(
                     node,
                     'nodeName',
                     c('Property').t`name`,
@@ -337,7 +355,7 @@ export class NodesCryptoService {
                 ),
             };
         } catch (error: unknown) {
-            void this.reportDecryptionError(node, 'nodeName', error);
+            void this.reporter.reportDecryptionError(node, 'nodeName', error);
             const errorMessage = getErrorMessage(error);
             return {
                 name: resultError(new Error(errorMessage)),
@@ -378,7 +396,7 @@ export class NodesCryptoService {
                     inviterEmailKeys || [],
                 );
 
-                sharedBy = await this.handleClaimedAuthor(
+                sharedBy = await this.reporter.handleClaimedAuthor(
                     node,
                     'membershipInviter',
                     c('Property').t`membership`,
@@ -387,7 +405,7 @@ export class NodesCryptoService {
                     node.encryptedCrypto.membership.inviterEmail,
                 );
             } catch (error: unknown) {
-                void this.reportVerificationError(node, 'membershipInviter');
+                void this.reporter.reportVerificationError(node, 'membershipInviter');
                 this.logger.error('Failed to verify invitation', error);
                 sharedBy = resultError({
                     claimedAuthor: node.encryptedCrypto.membership.inviterEmail,
@@ -428,7 +446,7 @@ export class NodesCryptoService {
 
         return {
             hashKey,
-            author: await this.handleClaimedAuthor(
+            author: await this.reporter.handleClaimedAuthor(
                 node,
                 'nodeHashKey',
                 c('Property').t`hash key`,
@@ -491,7 +509,7 @@ export class NodesCryptoService {
 
         return {
             extendedAttributes,
-            author: await this.handleClaimedAuthor(
+            author: await this.reporter.handleClaimedAuthor(
                 node,
                 'nodeExtendedAttributes',
                 c('Property').t`attributes`,
@@ -509,6 +527,7 @@ export class NodesCryptoService {
         extendedAttributes?: string,
     ): Promise<{
         encryptedCrypto: EncryptedNodeFolderCrypto & {
+            armoredNodePassphraseSignature: string;
             // signatureEmail and nameSignatureEmail are not optional.
             signatureEmail: string;
             nameSignatureEmail: string;
@@ -626,118 +645,6 @@ export class NodesCryptoService {
             nameSignatureEmail: email,
         };
     }
-
-    private async handleClaimedAuthor(
-        node: { uid: string; creationTime: Date },
-        field: MetricVerificationErrorField,
-        signatureType: string,
-        verified: VERIFICATION_STATUS,
-        verificationErrors?: Error[],
-        claimedAuthor?: string,
-        notAvailableVerificationKeys = false,
-    ): Promise<Author> {
-        const author = handleClaimedAuthor(
-            signatureType,
-            verified,
-            verificationErrors,
-            claimedAuthor,
-            notAvailableVerificationKeys,
-        );
-        if (!author.ok) {
-            void this.reportVerificationError(node, field, verificationErrors, claimedAuthor);
-        }
-        return author;
-    }
-
-    private async reportVerificationError(
-        node: { uid: string; creationTime: Date },
-        field: MetricVerificationErrorField,
-        verificationErrors?: Error[],
-        claimedAuthor?: string,
-    ) {
-        if (this.reportedVerificationErrors.has(node.uid)) {
-            return;
-        }
-        this.reportedVerificationErrors.add(node.uid);
-
-        const fromBefore2024 = node.creationTime < new Date('2024-01-01');
-
-        let addressMatchingDefaultShare, volumeType;
-        try {
-            const { volumeId } = splitNodeUid(node.uid);
-            const { email } = await this.shareService.getMyFilesShareMemberEmailKey();
-            addressMatchingDefaultShare = claimedAuthor ? claimedAuthor === email : undefined;
-            volumeType = await this.shareService.getVolumeMetricContext(volumeId);
-        } catch (error: unknown) {
-            this.logger.error('Failed to check if claimed author matches default share', error);
-        }
-
-        this.logger.warn(
-            `Failed to verify ${field} for node ${node.uid} (from before 2024: ${fromBefore2024}, matching address: ${addressMatchingDefaultShare})`,
-        );
-
-        this.telemetry.recordMetric({
-            eventName: 'verificationError',
-            volumeType,
-            field,
-            addressMatchingDefaultShare,
-            fromBefore2024,
-            error: verificationErrors?.map((e) => e.message).join(', '),
-            uid: node.uid,
-        });
-    }
-
-    private async reportDecryptionError(node: EncryptedNode, field: MetricsDecryptionErrorField, error: unknown) {
-        if (this.reportedDecryptionErrors.has(node.uid)) {
-            return;
-        }
-
-        const fromBefore2024 = node.creationTime < new Date('2024-01-01');
-
-        let volumeType;
-        try {
-            const { volumeId } = splitNodeUid(node.uid);
-            volumeType = await this.shareService.getVolumeMetricContext(volumeId);
-        } catch (error: unknown) {
-            this.logger.error('Failed to get metric context', error);
-        }
-
-        this.logger.error(`Failed to decrypt node ${node.uid} (from before 2024: ${fromBefore2024})`, error);
-
-        this.telemetry.recordMetric({
-            eventName: 'decryptionError',
-            volumeType,
-            field,
-            fromBefore2024,
-            error,
-            uid: node.uid,
-        });
-        this.reportedDecryptionErrors.add(node.uid);
-    }
-}
-
-/**
- * @param signatureType - Must be translated before calling this function.
- */
-function handleClaimedAuthor(
-    signatureType: string,
-    verified: VERIFICATION_STATUS,
-    verificationErrors?: Error[],
-    claimedAuthor?: string,
-    notAvailableVerificationKeys = false,
-): Author {
-    if (!claimedAuthor && notAvailableVerificationKeys) {
-        return resultOk(null as AnonymousUser);
-    }
-
-    if (verified === VERIFICATION_STATUS.SIGNED_AND_VALID) {
-        return resultOk(claimedAuthor || (null as AnonymousUser));
-    }
-
-    return resultError({
-        claimedAuthor: claimedAuthor,
-        error: getVerificationMessage(verified, verificationErrors, signatureType, notAvailableVerificationKeys),
-    });
 }
 
 function getClaimedAuthor(

package/src/internal/nodes/index.ts

@@ -10,6 +10,7 @@ import { NodeAPIService } from './apiService';
 import { NodesCache } from './cache';
 import { NodesCryptoCache } from './cryptoCache';
 import { NodesCryptoService } from './cryptoService';
+import { NodesCryptoReporter } from './cryptoReporter';
 import { SharesService } from './interface';
 import { NodesAccess } from './nodesAccess';
 import { NodesManagement } from './nodesManagement';
@@ -40,7 +41,8 @@ export function initNodesModule(
     const api = new NodeAPIService(telemetry.getLogger('nodes-api'), apiService);
     const cache = new NodesCache(telemetry.getLogger('nodes-cache'), driveEntitiesCache);
     const cryptoCache = new NodesCryptoCache(telemetry.getLogger('nodes-cache'), driveCryptoCache);
-    const cryptoService = new NodesCryptoService(telemetry, driveCrypto, account, sharesService);
+    const cryptoReporter = new NodesCryptoReporter(telemetry, sharesService);
+    const cryptoService = new NodesCryptoService(telemetry, driveCrypto, account, cryptoReporter);
     const nodesAccess = new NodesAccess(
         telemetry.getLogger('nodes'),
         api,

package/src/internal/nodes/interface.ts

@@ -18,6 +18,8 @@ import {
 interface BaseNode {
     // Internal metadata
     hash?: string; // root node doesn't have any hash
+    // ecnryptedName should not be needed to keep, nameSessionKey should be enough.
+    // We will improve this in the future.
     encryptedName: string;
 
     // Basic node metadata
@@ -54,7 +56,7 @@ export interface EncryptedNodeCrypto {
     nameSignatureEmail?: string;
     armoredKey: string;
     armoredNodePassphrase: string;
-    armoredNodePassphraseSignature: string;
+    armoredNodePassphraseSignature?: string;
     membership?: {
         inviterEmail: string;
         base64MemberSharePassphraseKeyPacket: string;

package/src/internal/nodes/nodesAccess.ts

@@ -289,7 +289,7 @@ export class NodesAccess {
         }
 
         const { node: unparsedNode, keys } = await this.cryptoService.decryptNode(encryptedNode, parentKey);
-        const node = await this.parseNode(unparsedNode);
+        const node = await parseNode(this.logger, unparsedNode);
         try {
             await this.cache.setNode(node);
         } catch (error: unknown) {
@@ -305,65 +305,6 @@ export class NodesAccess {
         return { node, keys };
     }
 
-    private async parseNode(unparsedNode: DecryptedUnparsedNode): Promise<DecryptedNode> {
-        let nodeName: Result<string, Error | InvalidNameError> = unparsedNode.name;
-        if (unparsedNode.name.ok) {
-            try {
-                validateNodeName(unparsedNode.name.value);
-            } catch (error: unknown) {
-                this.logger.warn(`Node name validation failed: ${error instanceof Error ? error.message : error}`);
-                nodeName = resultError({
-                    name: unparsedNode.name.value,
-                    error: error instanceof Error ? error.message : c('Error').t`Unknown error`,
-                });
-            }
-        }
-
-        if (unparsedNode.type === NodeType.File) {
-            const extendedAttributes = unparsedNode.activeRevision?.ok
-                ? parseFileExtendedAttributes(
-                      this.logger,
-                      unparsedNode.activeRevision.value.creationTime,
-                      unparsedNode.activeRevision.value.extendedAttributes,
-                  )
-                : undefined;
-
-            return {
-                ...unparsedNode,
-                isStale: false,
-                activeRevision: !unparsedNode.activeRevision?.ok
-                    ? unparsedNode.activeRevision
-                    : resultOk({
-                          uid: unparsedNode.activeRevision.value.uid,
-                          state: unparsedNode.activeRevision.value.state,
-                          creationTime: unparsedNode.activeRevision.value.creationTime,
-                          storageSize: unparsedNode.activeRevision.value.storageSize,
-                          contentAuthor: unparsedNode.activeRevision.value.contentAuthor,
-                          thumbnails: unparsedNode.activeRevision.value.thumbnails,
-                          ...extendedAttributes,
-                      }),
-                folder: undefined,
-                treeEventScopeId: splitNodeUid(unparsedNode.uid).volumeId,
-            };
-        }
-
-        const extendedAttributes = unparsedNode.folder?.extendedAttributes
-            ? parseFolderExtendedAttributes(this.logger, unparsedNode.folder.extendedAttributes)
-            : undefined;
-        return {
-            ...unparsedNode,
-            name: nodeName,
-            isStale: false,
-            activeRevision: undefined,
-            folder: extendedAttributes
-                ? {
-                      ...extendedAttributes,
-                  }
-                : undefined,
-            treeEventScopeId: splitNodeUid(unparsedNode.uid).volumeId,
-        };
-    }
-
     async getParentKeys(
         node: Pick<DecryptedNode, 'parentUid' | 'shareId'>,
     ): Promise<Pick<DecryptedNodeKeys, 'key' | 'hashKey'>> {
@@ -375,7 +316,7 @@ export class NodesAccess {
                     // Change the error message to be more specific.
                     // Original error message is referring to node, while here
                     // it referes to as parent to follow the method context.
-                    throw new DecryptionError(c('Error').t`Parent cannot be decrypted`);
+                    throw new DecryptionError(c('Error').t`Parent cannot be decrypted`, { cause: error });
                 }
                 throw error;
             }
@@ -458,3 +399,60 @@ export class NodesAccess {
         return node.parentUid ? this.getRootNode(node.parentUid) : node;
     }
 }
+
+export async function parseNode(logger: Logger, unparsedNode: DecryptedUnparsedNode): Promise<DecryptedNode> {
+    let nodeName: Result<string, Error | InvalidNameError> = unparsedNode.name;
+    if (unparsedNode.name.ok) {
+        try {
+            validateNodeName(unparsedNode.name.value);
+        } catch (error: unknown) {
+            logger.warn(`Node name validation failed: ${error instanceof Error ? error.message : error}`);
+            nodeName = resultError({
+                name: unparsedNode.name.value,
+                error: error instanceof Error ? error.message : c('Error').t`Unknown error`,
+            });
+        }
+    }
+
+    const treeEventScopeId = splitNodeUid(unparsedNode.uid).volumeId;
+
+    if (unparsedNode.type === NodeType.File) {
+        const extendedAttributes = unparsedNode.activeRevision?.ok
+            ? parseFileExtendedAttributes(
+                  logger,
+                  unparsedNode.activeRevision.value.creationTime,
+                  unparsedNode.activeRevision.value.extendedAttributes,
+              )
+            : undefined;
+
+        return {
+            ...unparsedNode,
+            isStale: false,
+            activeRevision: !unparsedNode.activeRevision?.ok
+                ? unparsedNode.activeRevision
+                : resultOk({
+                      uid: unparsedNode.activeRevision.value.uid,
+                      state: unparsedNode.activeRevision.value.state,
+                      creationTime: unparsedNode.activeRevision.value.creationTime,
+                      storageSize: unparsedNode.activeRevision.value.storageSize,
+                      contentAuthor: unparsedNode.activeRevision.value.contentAuthor,
+                      thumbnails: unparsedNode.activeRevision.value.thumbnails,
+                      ...extendedAttributes,
+                  }),
+            folder: undefined,
+            treeEventScopeId,
+        };
+    }
+
+    const extendedAttributes = unparsedNode.folder?.extendedAttributes
+        ? parseFolderExtendedAttributes(logger, unparsedNode.folder.extendedAttributes)
+        : undefined;
+    return {
+        ...unparsedNode,
+        name: nodeName,
+        isStale: false,
+        activeRevision: undefined,
+        folder: extendedAttributes,
+        treeEventScopeId,
+    };
+}

package/src/internal/shares/cryptoCache.test.ts

@@ -1,6 +1,7 @@
 import { PrivateKey, SessionKey } from '../../crypto';
 import { MemoryCache } from '../../cache';
 import { CachedCryptoMaterial } from '../../interface';
+import { getMockLogger } from '../../tests/logger';
 import { SharesCryptoCache } from './cryptoCache';
 
 describe('sharesCryptoCache', () => {
@@ -17,7 +18,7 @@ describe('sharesCryptoCache', () => {
 
     beforeEach(() => {
         memoryCache = new MemoryCache();
-        cache = new SharesCryptoCache(memoryCache);
+        cache = new SharesCryptoCache(getMockLogger(), memoryCache);
     });
 
     it('should store and retrieve keys', async () => {
@@ -53,7 +54,7 @@ describe('sharesCryptoCache', () => {
         const keys = { key: generatePrivateKey('privateKey'), passphraseSessionKey: generateSessionKey('sessionKey') };
 
         await cache.setShareKey(shareId, keys);
-        await cache.removeShareKey([shareId]);
+        await cache.removeShareKeys([shareId]);
 
         try {
             await cache.getShareKey(shareId);

package/src/internal/shares/cryptoCache.ts

@@ -1,4 +1,4 @@
-import { ProtonDriveCryptoCache } from '../../interface';
+import { Logger, ProtonDriveCryptoCache } from '../../interface';
 import { DecryptedShareKey } from './interface';
 
 /**
@@ -13,23 +13,42 @@ import { DecryptedShareKey } from './interface';
  * only the root node, thus share cache is not needed.
  */
 export class SharesCryptoCache {
-    constructor(private driveCache: ProtonDriveCryptoCache) {
+    constructor(
+        private logger: Logger,
+        private driveCache: ProtonDriveCryptoCache,
+    ) {
+        this.logger = logger;
         this.driveCache = driveCache;
     }
 
     async setShareKey(shareId: string, key: DecryptedShareKey): Promise<void> {
-        await this.driveCache.setEntity(getCacheUid(shareId), key);
+        await this.driveCache.setEntity(getCacheKey(shareId), {
+            shareKey: key,
+        });
     }
 
     async getShareKey(shareId: string): Promise<DecryptedShareKey> {
-        return this.driveCache.getEntity(getCacheUid(shareId));
+        const nodeKeysData = await this.driveCache.getEntity(getCacheKey(shareId));
+        if (!nodeKeysData.shareKey) {
+            try {
+                await this.removeShareKeys([shareId]);
+            } catch (removingError: unknown) {
+                // The node keys will not be returned, thus SDK will re-fetch
+                // and re-cache it. Setting it again should then fix the problem.
+                this.logger.warn(
+                    `Failed to remove corrupted node keys from the cache: ${removingError instanceof Error ? removingError.message : removingError}`,
+                );
+            }
+            throw new Error(`Failed to deserialize node keys`);
+        }
+        return nodeKeysData.shareKey;
     }
 
-    async removeShareKey(shareIds: string[]): Promise<void> {
-        await this.driveCache.removeEntities(shareIds.map(getCacheUid));
+    async removeShareKeys(shareIds: string[]): Promise<void> {
+        await this.driveCache.removeEntities(shareIds.map(getCacheKey));
     }
 }
 
-function getCacheUid(shareId: string) {
+function getCacheKey(shareId: string) {
     return `shareKey-${shareId}`;
 }

package/src/internal/shares/index.ts

@@ -33,7 +33,7 @@ export function initSharesModule(
 ) {
     const api = new SharesAPIService(apiService);
     const cache = new SharesCache(telemetry.getLogger('shares-cache'), driveEntitiesCache);
-    const cryptoCache = new SharesCryptoCache(driveCryptoCache);
+    const cryptoCache = new SharesCryptoCache(telemetry.getLogger('shares-cache'), driveCryptoCache);
     const cryptoService = new SharesCryptoService(telemetry, crypto, account);
     const sharesManager = new SharesManager(
         telemetry.getLogger('shares'),

package/src/internal/sharing/cache.ts

@@ -44,11 +44,28 @@ export class SharingCache {
     }
 
     async getSharedWithMeNodeUids(): Promise<string[]> {
-        return this.getNodeUids(SharingType.sharedWithMe);
+        return this.getNodeUids(SharingType.SharedWithMe);
+    }
+
+    async hasSharedWithMeNodeUidsLoaded(): Promise<boolean> {
+        try {
+            await this.getNodeUids(SharingType.SharedWithMe);
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    async addSharedWithMeNodeUid(nodeUid: string): Promise<void> {
+        return this.addNodeUid(SharingType.SharedWithMe, nodeUid);
+    }
+
+    async removeSharedWithMeNodeUid(nodeUid: string): Promise<void> {
+        return this.removeNodeUid(SharingType.SharedWithMe, nodeUid);
     }
 
     async setSharedWithMeNodeUids(nodeUids: string[] | undefined): Promise<void> {
-        return this.setNodeUids(SharingType.sharedWithMe, nodeUids);
+        return this.setNodeUids(SharingType.SharedWithMe, nodeUids);
     }
 
     /**

package/src/internal/sharing/cryptoService.test.ts

@@ -9,7 +9,7 @@ import {
 } from '../../interface';
 import { getMockTelemetry } from '../../tests/telemetry';
 import { SharesService } from './interface';
-import { SharingCryptoService } from './cryptoService';
+import { PUBLIC_LINK_GENERATED_PASSWORD_LENGTH, SharingCryptoService } from './cryptoService';
 
 describe('SharingCryptoService', () => {
     let telemetry: ProtonDriveTelemetry;
@@ -87,6 +87,27 @@ describe('SharingCryptoService', () => {
             expect(telemetry.recordMetric).not.toHaveBeenCalled();
         });
 
+        it('should decrypt bookmark with custom password', async () => {
+            // First 12 characters are the generated password. Anything beyond is the custom password.
+            driveCrypto.decryptShareUrlPassword = jest.fn().mockResolvedValue('urlPassword1WithCustomPassword');
+
+            const result = await cryptoService.decryptBookmark(encryptedBookmark);
+
+            expect(result).toMatchObject({
+                url: resultOk('https://drive.proton.me/urls/tokenId#urlPassword1'),
+                nodeName: resultOk('nodeName'),
+            });
+            expect(driveCrypto.decryptShareUrlPassword).toHaveBeenCalledWith('encryptedUrlPassword', ['addressKey']);
+            expect(driveCrypto.decryptKeyWithSrpPassword).toHaveBeenCalledWith(
+                'urlPassword1WithCustomPassword',
+                'base64SharePasswordSalt',
+                'armoredKey',
+                'armoredPassphrase',
+            );
+            expect(driveCrypto.decryptNodeName).toHaveBeenCalledWith('encryptedName', 'decryptedKey', []);
+            expect(telemetry.recordMetric).not.toHaveBeenCalled();
+        });
+
         it('should handle undecryptable URL password', async () => {
             const error = new Error('Failed to decrypt URL password');
             driveCrypto.decryptShareUrlPassword = jest.fn().mockRejectedValue(error);