@secrecy/lib 1.85.1 → 1.85.2-feat-folder-perms.1

package/dist/lib/client/SecrecyCloudClient.js

@@ -9,38 +9,32 @@ import { apiNodeForEncryptionToInternal, apiNodeFullToInternalFull, apiNodeToExt
 import { buildBytesFromApiData } from '../crypto/domain.js';
 import { chunkByTotalItems } from '../utils/object.js';
 import { uploadData } from './upload.js';
-import { encryptName, generateAndEncryptNameAndKey } from '../crypto/helpers.js';
+import { encryptName, encryptNameKey } from '../crypto/helpers.js';
 import { downloadDataFromLink, } from './data-link.js';
+import { secretStreamKeygen } from '../crypto/data.js';
 export class SecrecyCloudClient {
     #client;
     constructor(client) {
         this.#client = client;
     }
     async addDataToHistory({ dataId, nodeId, }) {
+        const currentNode = await apiNodeFullToInternalFull(await this.#client.apiClient.cloud.nodeFullById.query({ id: nodeId }), this.#client.keyPairs);
+        const currentData = currentNode.history.find((d) => d.id === dataId);
+        if (currentData === undefined) {
+            throw new Error(`Data ${dataId} is not in node ${nodeId}`);
+        }
+        const encryptedAccesses = Object.keys(currentNode.identities).map((pubKey) => ({
+            pubKey,
+            key: currentData.key
+                ? sodium.to_hex(encryptCryptoBox(sodium.from_hex(currentData.key), pubKey, this.#client.currentIdentityPrivateKey))
+                : null,
+        }));
         const addDataToHistory = await this.#client.apiClient.cloud.addDataToHistory.mutate({
             dataId,
             nodeId,
-            fromIdentityPubKey: this.#client.currentIdentity.identityPubKey,
+            encryptedAccesses,
         });
         const node = await apiNodeFullToInternalFull(addDataToHistory, this.#client.keyPairs);
-        const data = node.history.find((d) => d.id === dataId);
-        if (data !== undefined) {
-            const othersIdentities = Object.entries(node.identities).filter(([id]) => id !== this.#client.currentIdentity.identityPubKey);
-            const shares = othersIdentities.map(([publicKey]) => {
-                return {
-                    pubKey: publicKey,
-                    key: data.key
-                        ? sodium.to_hex(encryptCryptoBox(sodium.from_hex(data.key), publicKey, this.#client.currentIdentityPrivateKey))
-                        : null,
-                };
-            });
-            await this.#client.apiClient.cloud.shareDataInHistory.mutate({
-                dataId: data.id,
-                nodeId,
-                users: shares,
-                fromIdentityPubKey: this.#client.currentIdentity.identityPubKey,
-            });
-        }
         return internalNodeFullToNodeFull(node);
     }
     async uploadData(opts) {
@@ -81,17 +75,20 @@ export class SecrecyCloudClient {
         return await Promise.all(nodesSharedWithMe.map(async (node) => await apiNodeToExternal(node, this.#client.keyPairs)));
     }
     async deleteNodeSharing({ nodeId, destPubKey, }) {
+        const node = await this.node({ id: nodeId });
+        const rootAccessSharedByPubKey = node.accesses.find((access) => access.identityPubKey === destPubKey && access.type === 'ROOT')?.sharedByPubKey;
         const { isDeleted } = await this.#client.apiClient.cloud.deleteNodeSharing.mutate({
             nodeId,
             destPubKey,
+            rootAccessSharedByPubKey,
             fromIdentityPubKey: this.#client.currentIdentity.identityPubKey,
         });
         return isDeleted;
     }
-    async leaveNodeSharing({ nodeId, fromPubKey, }) {
+    async leaveNodeSharing({ nodeId, sharedByPubKey, }) {
         const { isDeleted } = await this.#client.apiClient.cloud.leaveSharing.mutate({
             nodeId,
-            fromPubKey,
+            sharedByPubKey,
             fromIdentityPubKey: this.#client.currentIdentity.identityPubKey,
         });
         return isDeleted;
@@ -110,7 +107,7 @@ export class SecrecyCloudClient {
         }
         name =
             typeof name === 'string' && node.accesses[0].nameKey !== null
-                ? await encryptName(name, node.accesses[0].nameKey)
+                ? await encryptName(name, sodium.from_hex(node.accesses[0].nameKey))
                 : null;
         const { isDuplicated } = await this.#client.apiClient.cloud.duplicateNode.mutate({
             nodeId,
@@ -128,34 +125,23 @@ export class SecrecyCloudClient {
         return isDeleted;
     }
     async createFolder({ name, parentFolderId, }) {
-        const { encryptedNameKey, encryptedName } = await generateAndEncryptNameAndKey({
-            name,
-            privateKey: this.#client.currentIdentityPrivateKey,
-            publicKey: this.#client.currentIdentity.identityPubKey,
-        });
+        const nameKey = secretStreamKeygen();
+        const encName = await encryptName(name, nameKey);
+        const parentFolder = await this.node({ id: parentFolderId });
+        const encryptedAccesses = await Promise.all(Object.keys(parentFolder.identities).map(async (pubKey) => ({
+            pubKey,
+            nameKey: await encryptNameKey({
+                nameKey,
+                privateKey: this.#client.currentIdentityPrivateKey,
+                publicKey: pubKey,
+            }),
+        })));
         const createdFolder = await this.#client.apiClient.cloud.createFolder.mutate({
-            name: encryptedName,
+            name: encName,
             parentId: parentFolderId ?? null,
-            nameKey: encryptedNameKey,
-            fromIdentityPubKey: this.#client.currentIdentity.identityPubKey,
+            encryptedAccesses,
         });
-        const folder = await apiNodeToExternalNodeFull(createdFolder, this.#client.keyPairs);
-        if (folder.parent) {
-            const othersIdentities = Object.entries(folder.parent.identities).filter(([id]) => id !== this.#client.currentIdentity.identityPubKey);
-            // TODO: ??
-            if (othersIdentities.length > 0) {
-                await this.shareNode(othersIdentities.map(([identityPubKey, permissions]) => ({
-                    pubKey: identityPubKey,
-                    nodeId: folder.id,
-                    rights: permissions.rights,
-                    addAccess: permissions.addAccess,
-                    delAccess: permissions.delAccess,
-                    sharingAddAccess: permissions.sharingAddAccess,
-                    sharingDelAccess: permissions.sharingDelAccess,
-                })));
-            }
-        }
-        return folder;
+        return apiNodeToExternalNodeFull(createdFolder, this.#client.keyPairs);
     }
     async node({ id, deleted, } = {}) {
         const node = await this.#client.apiClient.cloud.nodeById.query({
@@ -286,6 +272,7 @@ export class SecrecyCloudClient {
                             if (!item) {
                                 throw new Error('Unable to retrieve user mapped nodes!');
                             }
+                            console.dir({ node, item });
                             return {
                                 id: node.id,
                                 data: node.data,
@@ -373,7 +360,7 @@ export class SecrecyCloudClient {
         }
         name =
             typeof name === 'string' && node.accesses[0].nameKey !== null
-                ? await encryptName(name, node.accesses[0].nameKey)
+                ? await encryptName(name, sodium.from_hex(node.accesses[0].nameKey))
                 : null;
         const updateNode = await this.#client.apiClient.cloud.updateNode.mutate({
             deletedAt: deletedAt ?? null,
@@ -534,35 +521,35 @@ export class SecrecyCloudClient {
         else {
             key = data.key;
         }
-        key = key
-            ? sodium.to_hex(encryptCryptoBox(sodium.from_hex(key), this.#client.currentIdentity.identityPubKey, this.#client.currentIdentityPrivateKey))
-            : null;
-        const { encryptedNameKey, encryptedName } = await generateAndEncryptNameAndKey({
-            name,
-            privateKey: this.#client.currentIdentityPrivateKey,
-            publicKey: this.#client.currentIdentity.identityPubKey,
-        });
+        const rawDataKey = key ? sodium.from_hex(key) : null;
+        const nameKey = secretStreamKeygen();
+        const encName = await encryptName(name, nameKey);
+        const parentFolder = nodeId ? nodesCache.get(nodeId) : await this.node();
+        if (!parentFolder) {
+            throw new Error('Unable to retrieve parent');
+        }
+        const encryptedAccesses = await Promise.all(Object.keys(parentFolder.identities).map(async (pubKey) => {
+            const encryptedNameKey = await encryptNameKey({
+                nameKey,
+                privateKey: this.#client.currentIdentityPrivateKey,
+                publicKey: pubKey,
+            });
+            const dataKey = rawDataKey
+                ? sodium.to_hex(encryptCryptoBox(rawDataKey, pubKey, this.#client.currentIdentityPrivateKey))
+                : null;
+            return {
+                pubKey,
+                nameKey: encryptedNameKey,
+                key: dataKey,
+            };
+        }));
         const saveInCloud = await this.#client.apiClient.cloud.saveInCloud.mutate({
             dataId,
-            key,
             nodeId: nodeId ?? null,
-            fileName: encryptedName,
-            nameKey: encryptedNameKey,
-            fromIdentityPubKey: this.#client.currentIdentity.identityPubKey,
+            fileName: encName,
+            encryptedAccesses,
         });
-        const node = await apiNodeToExternalNodeFull(saveInCloud, this.#client.keyPairs);
-        if (node.parent) {
-            const othersIdentities = Object.entries(node.parent.identities).filter(([id]) => id !== this.#client.currentIdentity.identityPubKey);
-            // TODO: ??
-            if (othersIdentities.length > 0) {
-                await this.shareNode(othersIdentities.map(([identityPubKey, permissions]) => ({
-                    pubKey: identityPubKey,
-                    nodeId: node.id,
-                    ...permissions,
-                })));
-            }
-        }
-        return node;
+        return apiNodeToExternalNodeFull(saveInCloud, this.#client.keyPairs);
     }
     encryptNodesForIdentities = async (identityNodes) => {
         const nodeIds = Object.values(identityNodes).flatMap((nodeIds) => nodeIds);

package/dist/lib/client/convert/node.js

@@ -84,9 +84,10 @@ function internalNodeToNode(internal) {
             name: b.name,
         })),
         accesses: internal.accesses.map((a) => ({
-            isRoot: a.isRoot,
+            type: a.type,
             identityPubKey: a.identityPubKey,
             sharedByPubKey: a.sharedByPubKey,
+            rootAccess: a.rootAccess,
             rights: a.rights,
             addAccess: a.addAccess,
             delAccess: a.delAccess,

package/dist/lib/crypto/helpers.js

@@ -8,16 +8,19 @@ export function derivePassword(password, salt) {
     return sodium.crypto_pwhash(sodium.crypto_secretbox_KEYBYTES, password, salt, sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE, sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE, sodium.crypto_pwhash_ALG_ARGON2ID13, 'hex');
 }
 export async function encryptName(name, nameKey) {
-    const { data } = await encryptSecretStream(sodium.from_hex(nameKey), sodium.from_string(name));
+    const { data } = await encryptSecretStream(nameKey, sodium.from_string(name));
     return sodium.to_hex(data);
 }
 export async function generateAndEncryptNameAndKey(args) {
     const nameKey = secretStreamKeygen();
-    const encryptedName = await encryptName(args.name, sodium.to_hex(nameKey));
-    const encryptedNameKey = sodium.to_hex(encryptCryptoBox(nameKey, args.publicKey, args.privateKey));
+    const encryptedName = await encryptName(args.name, nameKey);
+    const encryptedNameKey = await encryptNameKey({ ...args, nameKey });
     return {
         nameKey,
         encryptedName,
         encryptedNameKey,
     };
 }
+export async function encryptNameKey(args) {
+    return sodium.to_hex(encryptCryptoBox(args.nameKey, args.publicKey, args.privateKey));
+}

package/dist/types/client/SecrecyCloudClient.d.ts

@@ -32,9 +32,9 @@ export declare class SecrecyCloudClient {
         nodeId: string;
         destPubKey: string;
     }): Promise<boolean>;
-    leaveNodeSharing({ nodeId, fromPubKey, }: {
+    leaveNodeSharing({ nodeId, sharedByPubKey, }: {
         nodeId: string;
-        fromPubKey: string;
+        sharedByPubKey: string;
     }): Promise<boolean>;
     duplicateNode({ nodeId, folderId, name, }: {
         nodeId: string;

package/dist/types/client/types/node.d.ts

@@ -2,10 +2,15 @@ import { type RouterOutputs } from '../../client.js';
 import type { DataMetadata, InternalData, UserAppOrg } from './index.js';
 export type Permissions = ApiNode['identities'][number];
 export type Rights = Permissions['rights'];
+export type NodeAccessType = 'ROOT' | 'INHERITED';
 export type NodeAccess<T extends Record<string, unknown> = Record<string, unknown>> = T & Permissions & {
-    isRoot: boolean;
+    type: NodeAccessType;
     sharedByPubKey: string;
     identityPubKey: string;
+    rootAccess: {
+        type: NodeAccessType;
+        sharedByPubKey: string;
+    } | null;
 };
 export interface NodeBreadcrumbItem {
     id: string;