@quartz-community/encrypted-pages 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.1.0
+
+### Minor Changes
+
+- 43a26d8: Encrypts the pages that page types render from files (quartz-community/bases-page#11), through Quartz 5.1's `virtualPageHtmlPlugins`: a drawing stored as Markdown with a `password` in its frontmatter is encrypted like a note, and a `.base`, `.canvas` or `.excalidraw` page, which has no frontmatter, is encrypted with the password of the encrypted published note that links to it (the first by slug when several do). Such pages are also added to the shadow content index when unlisted. Before, these pages were always served in the clear.
+
+## 1.0.1
+
+### Patch Changes
+
+- d72090b: Releases are published from GitHub Actions with npm trusted publishing, so each version on npm now carries provenance linking it to the commit and workflow that built it. No changes to the package itself.
+
 ## 1.0.0
 
 ### Major Changes

package/README.md

@@ -71,6 +71,21 @@ All options below are set at the single plugin-entry level and are shared betwee
 | `unlisted` | `boolean` | Overrides `unlistWhenEncrypted`. `true` forces the page unlisted; `false` forces it listed even when `unlistWhenEncrypted` is also set.                                                                                                                                                                   |
 | `stealth`  | `boolean` | When `true` and the page is encrypted, suppresses the page's entry in the shadow content index. The page stays hidden from every listing surface **even after successful client-side decryption**. Implies `unlisted: true` (overrides any explicit `unlisted: false`). No effect on non-encrypted pages. |
 
+## Bases, canvases and drawings
+
+Pages that page types render from files are encrypted too (Quartz 5.1 or later):
+
+- A drawing stored as Markdown (`.excalidraw.md`) has frontmatter: a `password` there encrypts its
+  page, as for a note.
+- A `.base`, `.canvas` or `.excalidraw` file has no frontmatter. Its page is encrypted with the
+  password of the encrypted published note that links to it (`[[Board.canvas]]`), so a board
+  linked from a protected note is protected with it. When several encrypted notes with different
+  passwords link to it, the first by slug wins. Linked only from unencrypted notes, it stays
+  unencrypted; with `explicit-publish`, a file that no published note links to is not published.
+
+An embed in an encrypted note (`![[Board.canvas]]`) shows as a link to the embedded page after
+unlocking the note: embeds are resolved when the page is rendered, after the note was encrypted.
+
 ## How `unlisted` works
 
 When an encrypted page is marked `unlisted: true`:

package/dist/index.js

@@ -2254,50 +2254,82 @@ function decrypt(encryptedBase64, password, iterations) {
   decipher.setAuthTag(authTag);
   return decipher.update(ciphertext, void 0, "utf8") + decipher.final("utf8");
 }
+var inheritedPasswords = /* @__PURE__ */ new WeakMap();
+function encryptTree(tree, file, password, options) {
+  const frontmatter = file.data?.frontmatter ?? {};
+  const html5 = toHtml(tree, { allowDangerousHtml: true });
+  const encryptedData = encryptAesGcm(html5, password, options.iterations);
+  const encryptedContainer = {
+    type: "element",
+    tagName: "div",
+    properties: {
+      className: ["encrypted-page", "popover-hint"],
+      "data-encrypted": encryptedData,
+      "data-iterations": String(options.iterations)
+    },
+    children: []
+  };
+  tree.children = [encryptedContainer];
+  const data = file.data;
+  data.encrypted = true;
+  data.text = "";
+  data.description = "";
+  const frontmatterUnlisted = frontmatter.unlisted;
+  if (typeof frontmatterUnlisted === "boolean") {
+    data.unlisted = frontmatterUnlisted;
+  } else if (options.unlistWhenEncrypted) {
+    data.unlisted = true;
+  }
+  if (frontmatter.stealth === true) {
+    data.stealth = true;
+    data.unlisted = true;
+  }
+}
+function passwordIn(frontmatter, options) {
+  const password = frontmatter?.[options.passwordField];
+  return typeof password === "string" && password.length > 0 ? password : void 0;
+}
 var rehypeEncryptedPages = (options) => {
   return () => (tree, file) => {
-    const frontmatter = file.data?.frontmatter ?? {};
-    const password = frontmatter[options.passwordField];
-    if (typeof password !== "string" || password.length === 0) {
+    const password = passwordIn(file.data?.frontmatter, options);
+    if (password) encryptTree(tree, file, password, options);
+  };
+};
+var rehypeEncryptedVirtualPages = (options, content) => {
+  const passwordBySlug = /* @__PURE__ */ new Map();
+  for (const [, file] of content) {
+    const password = passwordIn(file.data?.frontmatter, options);
+    if (password && typeof file.data?.slug === "string")
+      passwordBySlug.set(file.data.slug, password);
+  }
+  return () => (tree, file) => {
+    const own4 = passwordIn(file.data?.frontmatter, options);
+    if (own4) {
+      encryptTree(tree, file, own4, options);
       return;
     }
-    const html5 = toHtml(tree, { allowDangerousHtml: true });
-    const encryptedData = encryptAesGcm(html5, password, options.iterations);
-    const encryptedContainer = {
-      type: "element",
-      tagName: "div",
-      properties: {
-        className: ["encrypted-page", "popover-hint"],
-        "data-encrypted": encryptedData,
-        "data-iterations": String(options.iterations)
-      },
-      children: []
-    };
-    tree.children = [encryptedContainer];
-    const data = file.data;
-    data.encrypted = true;
-    data.text = "";
-    data.description = "";
-    const frontmatterUnlisted = frontmatter.unlisted;
-    if (typeof frontmatterUnlisted === "boolean") {
-      data.unlisted = frontmatterUnlisted;
-    } else if (options.unlistWhenEncrypted) {
-      data.unlisted = true;
-    }
-    if (frontmatter.stealth === true) {
-      data.stealth = true;
-      data.unlisted = true;
-    }
+    const relativePath = file.data?.relativePath;
+    if (typeof relativePath !== "string" || relativePath.toLowerCase().endsWith(".md")) return;
+    const referencedBy = file.data.referencedBy;
+    if (!Array.isArray(referencedBy)) return;
+    const inherited = [...referencedBy].filter((slug) => typeof slug === "string").sort().map((slug) => passwordBySlug.get(slug)).find((password) => password !== void 0);
+    if (!inherited) return;
+    encryptTree(tree, file, inherited, options);
+    inheritedPasswords.set(file.data, inherited);
   };
 };
 var EncryptedPages = (userOptions) => {
   const options = { ...defaultOptions, ...userOptions };
-  return {
+  const instance = {
     name: "EncryptedPages",
     htmlPlugins() {
       return [rehypeEncryptedPages(options)];
+    },
+    virtualPageHtmlPlugins(_ctx, content) {
+      return [rehypeEncryptedVirtualPages(options, content)];
     }
   };
+  return instance;
 };
 
 // node_modules/@quartz-community/types/dist/index.js
@@ -2343,7 +2375,7 @@ var EncryptedContentIndex = (userOptions) => {
       if (data.unlisted !== true) continue;
       if (data.stealth === true) continue;
       const frontmatter = data.frontmatter ?? {};
-      const password = frontmatter[passwordField];
+      const password = frontmatter[passwordField] ?? inheritedPasswords.get(file.data);
       if (typeof password !== "string" || password.length === 0) continue;
       const iterations = extractIterationsFromTree(tree);
       const shadowEntry = buildShadowEntry(data);