@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/documents/shared/containerKekPathVerification.d.ts

@@ -0,0 +1,15 @@
+import type { VerifiedContainerAccessManifest } from "../../../internal/crypto/index.js";
+import type { ContainerWriterProjectionResponse } from "../../../internal/validators/response/index.js";
+import { type PrincipalPolicyCache } from "../../keyingProjectionVerification.js";
+import type { ExecSql } from "../../sqlite/sqlSchema.js";
+import type { ProjectionVerificationOptions } from "./types.js";
+export type UnwrapContainerKekPathInput = {
+    execSql?: ExecSql | undefined;
+    knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;
+    persistVerificationCheckpoints?: boolean | undefined;
+    principalPolicyCache?: PrincipalPolicyCache | undefined;
+    projection: ContainerWriterProjectionResponse;
+    secretKey: Uint8Array;
+    verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;
+} & ProjectionVerificationOptions;
+export declare function verifyContainerKekPathProjection(input: UnwrapContainerKekPathInput): Promise<void>;

package/data/documents/shared/containerKekPathVerification.js

@@ -0,0 +1,23 @@
+import { collectContainerWriterProjectionPrincipalPolicies, } from "../../keyingProjectionVerification.js";
+import { resolveProjectionVerifier } from "./types.js";
+export async function verifyContainerKekPathProjection(input) {
+    if (input.projection.path.length !== input.projection.containerKeks.length) {
+        throw new Error("Container writer projection path and KEKs are inconsistent");
+    }
+    const resolveProjectionUserKey = resolveProjectionVerifier(input, "Container KEK unwrap");
+    if (input.trustedLocalProjection === true ||
+        resolveProjectionUserKey === null) {
+        return;
+    }
+    await collectContainerWriterProjectionPrincipalPolicies({
+        execSql: input.execSql,
+        persistVerificationCheckpoints: input.persistVerificationCheckpoints,
+        principalPolicyCache: input.principalPolicyCache,
+        projection: input.projection,
+        resolveUserKey: resolveProjectionUserKey,
+        stillCurrent: input.stillCurrent,
+        verifiedByHash: input.verifiedByHash,
+        warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,
+    });
+}
+//# sourceMappingURL=containerKekPathVerification.js.map

package/data/documents/shared/containerKekPathVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerKekPathVerification.js","sourceRoot":"","sources":["containerKekPathVerification.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iDAAiD,GAElD,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAYpD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAkC;IAElC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,wBAAwB,GAAG,yBAAyB,CACxD,KAAK,EACL,sBAAsB,CACvB,CAAC;IACF,IACE,KAAK,CAAC,sBAAsB,KAAK,IAAI;QACrC,wBAAwB,KAAK,IAAI,EACjC,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,wBAAwB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { VerifiedContainerAccessManifest } from \"@tearleads/crypto\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  collectContainerWriterProjectionPrincipalPolicies,\n  type PrincipalPolicyCache,\n} from \"../../keyingProjectionVerification\";\nimport type { ExecSql } from \"../../sqlite/sqlSchema\";\nimport type { ProjectionVerificationOptions } from \"./types\";\nimport { resolveProjectionVerifier } from \"./types\";\n\nexport type UnwrapContainerKekPathInput = {\n  execSql?: ExecSql | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  persistVerificationCheckpoints?: boolean | undefined;\n  principalPolicyCache?: PrincipalPolicyCache | undefined;\n  projection: ContainerWriterProjectionResponse;\n  secretKey: Uint8Array;\n  verifiedByHash?: Map<string, VerifiedContainerAccessManifest> | undefined;\n} & ProjectionVerificationOptions;\n\nexport async function verifyContainerKekPathProjection(\n  input: UnwrapContainerKekPathInput,\n): Promise<void> {\n  if (input.projection.path.length !== input.projection.containerKeks.length) {\n    throw new Error(\n      \"Container writer projection path and KEKs are inconsistent\",\n    );\n  }\n  const resolveProjectionUserKey = resolveProjectionVerifier(\n    input,\n    \"Container KEK unwrap\",\n  );\n  if (\n    input.trustedLocalProjection === true ||\n    resolveProjectionUserKey === null\n  ) {\n    return;\n  }\n\n  await collectContainerWriterProjectionPrincipalPolicies({\n    execSql: input.execSql,\n    persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n    principalPolicyCache: input.principalPolicyCache,\n    projection: input.projection,\n    resolveUserKey: resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    verifiedByHash: input.verifiedByHash,\n    warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n  });\n}\n"]}

package/data/documents/shared/containerKekWrapping.js

@@ -0,0 +1,61 @@
+import { deriveContainerKekWrappingPublicKey, unwrapContainerKekParentWrap, } from "../../../internal/crypto/index.js";
+import { isPlainObject as isPlainRecord } from "../../../internal/validators/isPlainObject.js";
+import { projectionKekLabel } from "./containerKekPathHistory.js";
+import { readManifestContainerId } from "./readers.js";
+export async function unwrapContainerKekFromParentWrap(input) {
+    if (!input.parentContainerKeyEpochId) {
+        return null;
+    }
+    const parentKek = input.parentKeksByEpochId.get(input.parentContainerKeyEpochId);
+    if (!parentKek) {
+        return null;
+    }
+    // The epoch-record fingerprint is a SELECTOR for picking the right envelope
+    // among several, not the security boundary — the AEAD tag below is what
+    // authenticates the parent key. Keyring-recovered historical KEKs carry no
+    // epoch record (only the material and the epoch id that commits to it), so
+    // for those the epoch id alone selects and decryption authenticates.
+    //
+    // Without this, an ancestor rotation would strand every descendant still
+    // pinned to the predecessor epoch: opening the descendant requires the
+    // parent's historical KEK, and that is exactly the key a lazy rekey needs in
+    // order to materialize a post-rotation epoch. A cold client would have no
+    // way back in.
+    const parentWrap = input.wraps.find((wrap) => wrap.recipientKind === "container" &&
+        wrap.recipientId === parentKek.containerId &&
+        wrap.recipientKeyEpochId === input.parentContainerKeyEpochId &&
+        (parentKek.keyEpochHash === null ||
+            wrap.recipientKeyFingerprint === parentKek.keyEpochHash));
+    if (!parentWrap) {
+        return null;
+    }
+    try {
+        return await unwrapContainerKekParentWrap({
+            parentContainerId: parentKek.containerId,
+            parentKeyMaterial: parentKek.keyMaterial,
+            kemCipherText: parentWrap.kemCipherText,
+            wrappedKey: parentWrap.wrappedKey,
+        });
+    }
+    catch (error) {
+        throw new Error(`${input.label} parent wrap could not be unwrapped`, {
+            cause: error,
+        });
+    }
+}
+export async function assertSignedWrappingPublicKey(projection, index, keyMaterial) {
+    const manifest = projection.path[index];
+    if (!manifest || !isPlainRecord(manifest.state))
+        throw new Error("Container manifest is missing");
+    const containerId = readManifestContainerId(manifest);
+    if (!containerId)
+        throw new Error("Container manifest ID is missing");
+    const publicKey = await deriveContainerKekWrappingPublicKey({
+        containerId,
+        keyMaterial,
+    });
+    if (Reflect.get(manifest.state, "containerKeyPublicKey") !== publicKey) {
+        throw new Error(`${projectionKekLabel(index)} wrapping public key does not match KEK material`);
+    }
+}
+//# sourceMappingURL=containerKekWrapping.js.map

package/data/documents/shared/containerKekWrapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerKekWrapping.js","sourceRoot":"","sources":["containerKekWrapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAGpD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAKtD;IACC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAC7C,KAAK,CAAC,yBAAyB,CAChC,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,eAAe;IACf,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,WAAW;QAClC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAC1C,IAAI,CAAC,mBAAmB,KAAK,KAAK,CAAC,yBAAyB;QAC5D,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI;YAC9B,IAAI,CAAC,uBAAuB,KAAK,SAAS,CAAC,YAAY,CAAC,CAC7D,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC;YACxC,iBAAiB,EAAE,SAAS,CAAC,WAAW;YACxC,iBAAiB,EAAE,SAAS,CAAC,WAAW;YACxC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,qCAAqC,EAAE;YACnE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,UAA6C,EAC7C,KAAa,EACb,WAAuB;IAEvB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,mCAAmC,CAAC;QAC1D,WAAW;QACX,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,GAAG,kBAAkB,CAAC,KAAK,CAAC,kDAAkD,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import {\n  type ContainerKeyWrap,\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"@tearleads/crypto\";\nimport { isPlainObject as isPlainRecord } from \"@tearleads/validators/isPlainObject\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { projectionKekLabel } from \"./containerKekPathHistory\";\nimport { readManifestContainerId } from \"./readers\";\nimport type { UnwrappedContainerKek } from \"./types\";\n\nexport async function unwrapContainerKekFromParentWrap(input: {\n  label: string;\n  parentContainerKeyEpochId: string | null;\n  parentKeksByEpochId: ReadonlyMap<string, UnwrappedContainerKek>;\n  wraps: readonly ContainerKeyWrap[];\n}): Promise<Uint8Array | null> {\n  if (!input.parentContainerKeyEpochId) {\n    return null;\n  }\n\n  const parentKek = input.parentKeksByEpochId.get(\n    input.parentContainerKeyEpochId,\n  );\n  if (!parentKek) {\n    return null;\n  }\n\n  // The epoch-record fingerprint is a SELECTOR for picking the right envelope\n  // among several, not the security boundary — the AEAD tag below is what\n  // authenticates the parent key. Keyring-recovered historical KEKs carry no\n  // epoch record (only the material and the epoch id that commits to it), so\n  // for those the epoch id alone selects and decryption authenticates.\n  //\n  // Without this, an ancestor rotation would strand every descendant still\n  // pinned to the predecessor epoch: opening the descendant requires the\n  // parent's historical KEK, and that is exactly the key a lazy rekey needs in\n  // order to materialize a post-rotation epoch. A cold client would have no\n  // way back in.\n  const parentWrap = input.wraps.find(\n    (wrap) =>\n      wrap.recipientKind === \"container\" &&\n      wrap.recipientId === parentKek.containerId &&\n      wrap.recipientKeyEpochId === input.parentContainerKeyEpochId &&\n      (parentKek.keyEpochHash === null ||\n        wrap.recipientKeyFingerprint === parentKek.keyEpochHash),\n  );\n  if (!parentWrap) {\n    return null;\n  }\n\n  try {\n    return await unwrapContainerKekParentWrap({\n      parentContainerId: parentKek.containerId,\n      parentKeyMaterial: parentKek.keyMaterial,\n      kemCipherText: parentWrap.kemCipherText,\n      wrappedKey: parentWrap.wrappedKey,\n    });\n  } catch (error) {\n    throw new Error(`${input.label} parent wrap could not be unwrapped`, {\n      cause: error,\n    });\n  }\n}\n\nexport async function assertSignedWrappingPublicKey(\n  projection: ContainerWriterProjectionResponse,\n  index: number,\n  keyMaterial: Uint8Array,\n): Promise<void> {\n  const manifest = projection.path[index];\n  if (!manifest || !isPlainRecord(manifest.state))\n    throw new Error(\"Container manifest is missing\");\n  const containerId = readManifestContainerId(manifest);\n  if (!containerId) throw new Error(\"Container manifest ID is missing\");\n  const publicKey = await deriveContainerKekWrappingPublicKey({\n    containerId,\n    keyMaterial,\n  });\n  if (Reflect.get(manifest.state, \"containerKeyPublicKey\") !== publicKey) {\n    throw new Error(\n      `${projectionKekLabel(index)} wrapping public key does not match KEK material`,\n    );\n  }\n}\n"]}

package/data/documents/shared/contentRecordAdditionalData.js

@@ -0,0 +1,14 @@
+import { serializeKeyingCanonicalJson } from "../../../internal/crypto/index.js";
+import { documentContentRecordDerivationPayload } from "./contentRecordKeys.js";
+import { DOCUMENT_CONTENT_RECORD_AAD_DOMAIN, TEXT_ENCODER } from "./types.js";
+export function contentRecordAdditionalDataBytes(input) {
+    return TEXT_ENCODER.encode(serializeKeyingCanonicalJson({
+        domain: DOCUMENT_CONTENT_RECORD_AAD_DOMAIN,
+        payload: {
+            ...documentContentRecordDerivationPayload(input),
+            metadataHash: input.metadataHash,
+            nonceDomainHash: input.nonceDomainHash,
+        },
+    }));
+}
+//# sourceMappingURL=contentRecordAdditionalData.js.map

package/data/documents/shared/contentRecordAdditionalData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentRecordAdditionalData.js","sourceRoot":"","sources":["contentRecordAdditionalData.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,kCAAkC,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE3E,MAAM,UAAU,gCAAgC,CAAC,KAOhD;IACC,OAAO,YAAY,CAAC,MAAM,CACxB,4BAA4B,CAAC;QAC3B,MAAM,EAAE,kCAAkC;QAC1C,OAAO,EAAE;YACP,GAAG,sCAAsC,CAAC,KAAK,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC;KACF,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { documentContentRecordDerivationPayload } from \"./contentRecordKeys\";\nimport { DOCUMENT_CONTENT_RECORD_AAD_DOMAIN, TEXT_ENCODER } from \"./types\";\n\nexport function contentRecordAdditionalDataBytes(input: {\n  contentKeyEpoch: number;\n  contentRecordId: string;\n  documentId: string;\n  metadataHash: string;\n  nonceDomainHash: string;\n  organizationId: string;\n}): Uint8Array<ArrayBuffer> {\n  return TEXT_ENCODER.encode(\n    serializeKeyingCanonicalJson({\n      domain: DOCUMENT_CONTENT_RECORD_AAD_DOMAIN,\n      payload: {\n        ...documentContentRecordDerivationPayload(input),\n        metadataHash: input.metadataHash,\n        nonceDomainHash: input.nonceDomainHash,\n      },\n    }),\n  );\n}\n"]}

package/data/documents/shared/contentRecordKeys.js

@@ -0,0 +1,40 @@
+import { CONTENT_RECORD_ENCRYPTION_SUITE, serializeKeyingCanonicalJson, } from "../../../internal/crypto/index.js";
+import { asWebCryptoBytes } from "./readers.js";
+import { DOCUMENT_CONTENT_RECORD_HKDF_SALT, DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN, DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN, TEXT_ENCODER, } from "./types.js";
+export function documentContentRecordDerivationPayload(input) {
+    return {
+        version: 1,
+        organizationId: input.organizationId,
+        objectKind: "document",
+        objectId: input.documentId,
+        contentKeyEpoch: input.contentKeyEpoch,
+        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
+        contentRecordId: input.contentRecordId,
+    };
+}
+function keyInfoBytes(domain, input) {
+    return TEXT_ENCODER.encode(serializeKeyingCanonicalJson({
+        domain,
+        payload: documentContentRecordDerivationPayload(input),
+    }));
+}
+export async function deriveDocumentContentRecordKey(input) {
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: DOCUMENT_CONTENT_RECORD_HKDF_SALT,
+        info: keyInfoBytes(DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN, input),
+    }, input.contentKeyMaterial, { name: "AES-GCM", length: 256 }, false, [input.usage]);
+}
+export async function deriveDocumentPlaintextHashKey(input) {
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: DOCUMENT_CONTENT_RECORD_HKDF_SALT,
+        info: keyInfoBytes(DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN, input),
+    }, input.contentKeyMaterial, { name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign"]);
+}
+export async function importContentKeyMaterial(contentKey) {
+    return crypto.subtle.importKey("raw", asWebCryptoBytes(contentKey), "HKDF", false, ["deriveKey"]);
+}
+//# sourceMappingURL=contentRecordKeys.js.map

package/data/documents/shared/contentRecordKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentRecordKeys.js","sourceRoot":"","sources":["contentRecordKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAE/B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,iCAAiC,EACjC,uCAAuC,EACvC,sDAAsD,EACtD,YAAY,GACb,MAAM,SAAS,CAAC;AAUjB,MAAM,UAAU,sCAAsC,CACpD,KAAwD;IAExD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAc,EACd,KAAwD;IAExD,OAAO,YAAY,CAAC,MAAM,CACxB,4BAA4B,CAAC;QAC3B,MAAM;QACN,OAAO,EAAE,sCAAsC,CAAC,KAAK,CAAC;KACvD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA+D;IAE/D,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,YAAY,CAAC,uCAAuC,EAAE,KAAK,CAAC;KACnE,EACD,KAAK,CAAC,kBAAkB,EACxB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,KAAK,CAAC,KAAK,CAAC,CACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAA4B;IAE5B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,YAAY,CAChB,sDAAsD,EACtD,KAAK,CACN;KACF,EACD,KAAK,CAAC,kBAAkB,EACxB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,gBAAgB,CAAC,UAAU,CAAC,EAC5B,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  type KeyingCanonicalJson,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { asWebCryptoBytes } from \"./readers\";\nimport {\n  DOCUMENT_CONTENT_RECORD_HKDF_SALT,\n  DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN,\n  DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN,\n  TEXT_ENCODER,\n} from \"./types\";\n\ninterface ContentRecordKeyInput {\n  contentKeyMaterial: CryptoKey;\n  contentKeyEpoch: number;\n  contentRecordId: string;\n  documentId: string;\n  organizationId: string;\n}\n\nexport function documentContentRecordDerivationPayload(\n  input: Omit<ContentRecordKeyInput, \"contentKeyMaterial\">,\n): Record<string, KeyingCanonicalJson> {\n  return {\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId: input.contentRecordId,\n  };\n}\n\nfunction keyInfoBytes(\n  domain: string,\n  input: Omit<ContentRecordKeyInput, \"contentKeyMaterial\">,\n): Uint8Array<ArrayBuffer> {\n  return TEXT_ENCODER.encode(\n    serializeKeyingCanonicalJson({\n      domain,\n      payload: documentContentRecordDerivationPayload(input),\n    }),\n  );\n}\n\nexport async function deriveDocumentContentRecordKey(\n  input: ContentRecordKeyInput & { usage: \"decrypt\" | \"encrypt\" },\n): Promise<CryptoKey> {\n  return crypto.subtle.deriveKey(\n    {\n      name: \"HKDF\",\n      hash: \"SHA-256\",\n      salt: DOCUMENT_CONTENT_RECORD_HKDF_SALT,\n      info: keyInfoBytes(DOCUMENT_CONTENT_RECORD_KEY_INFO_DOMAIN, input),\n    },\n    input.contentKeyMaterial,\n    { name: \"AES-GCM\", length: 256 },\n    false,\n    [input.usage],\n  );\n}\n\nexport async function deriveDocumentPlaintextHashKey(\n  input: ContentRecordKeyInput,\n): Promise<CryptoKey> {\n  return crypto.subtle.deriveKey(\n    {\n      name: \"HKDF\",\n      hash: \"SHA-256\",\n      salt: DOCUMENT_CONTENT_RECORD_HKDF_SALT,\n      info: keyInfoBytes(\n        DOCUMENT_CONTENT_RECORD_PLAINTEXT_HASH_KEY_INFO_DOMAIN,\n        input,\n      ),\n    },\n    input.contentKeyMaterial,\n    { name: \"HMAC\", hash: \"SHA-256\", length: 256 },\n    false,\n    [\"sign\"],\n  );\n}\n\nexport async function importContentKeyMaterial(\n  contentKey: Uint8Array,\n): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    \"raw\",\n    asWebCryptoBytes(contentKey),\n    \"HKDF\",\n    false,\n    [\"deriveKey\"],\n  );\n}\n"]}

package/data/documents/shared/crypto.js

@@ -0,0 +1,172 @@
+import { CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, createAesGcmIv, serializeKeyingCanonicalJson, } from "../../../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../../../internal/encoding/index.js";
+import { contentRecordAdditionalDataBytes } from "./contentRecordAdditionalData.js";
+import { deriveDocumentContentRecordKey, deriveDocumentPlaintextHashKey, importContentKeyMaterial, } from "./contentRecordKeys.js";
+import { decryptDocumentSyncUpdate } from "./documentSyncUpdateDecryption.js";
+import { isDocumentSyncUpdateIsolationError, isolateDocumentSyncBatchError, isolateDocumentSyncUpdateError, } from "./documentSyncUpdateIsolation.js";
+import { asWebCryptoBytes, readWriteHeader } from "./readers.js";
+import { DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT, } from "./types.js";
+export async function encryptDocumentPendingUpdate(input) {
+    const plaintext = base64ToBytes(input.update.updateData);
+    const contentRecordId = input.update.id;
+    const nonceDomainHash = await computeContentRecordNonceDomainHash({
+        version: 1,
+        organizationId: input.organizationId,
+        objectKind: "document",
+        objectId: input.documentId,
+        contentKeyEpoch: input.contentKeyEpoch,
+        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
+        contentRecordId,
+    });
+    const plaintextHashKey = await deriveDocumentPlaintextHashKey({
+        contentKeyMaterial: input.contentKeyMaterial,
+        contentKeyEpoch: input.contentKeyEpoch,
+        contentRecordId,
+        documentId: input.documentId,
+        organizationId: input.organizationId,
+    });
+    const plaintextHash = await computeDocumentContentRecordPlaintextHash(plaintext, plaintextHashKey);
+    const metadataHash = await computeDocumentContentRecordMetadataHash({
+        ...(input.update.sourceVersionVector
+            ? {
+                checkpointKind: "rotate_baseline",
+                checkpointPayloadKind: "full_history_snapshot",
+                sourceVersionVector: input.update.sourceVersionVector,
+            }
+            : {}),
+        documentId: input.documentId,
+        partialEndVersionVector: input.update.partialEndVersionVector,
+        partialStartVersionVector: input.update.partialStartVersionVector,
+        plaintextHash,
+        updateId: input.update.id,
+    });
+    const recordKey = await deriveDocumentContentRecordKey({
+        contentKeyMaterial: input.contentKeyMaterial,
+        contentKeyEpoch: input.contentKeyEpoch,
+        contentRecordId,
+        documentId: input.documentId,
+        organizationId: input.organizationId,
+        usage: "encrypt",
+    });
+    const iv = createAesGcmIv();
+    const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+        name: "AES-GCM",
+        iv,
+        additionalData: contentRecordAdditionalDataBytes({
+            contentKeyEpoch: input.contentKeyEpoch,
+            contentRecordId,
+            documentId: input.documentId,
+            metadataHash,
+            nonceDomainHash,
+            organizationId: input.organizationId,
+        }),
+    }, recordKey, asWebCryptoBytes(plaintext)));
+    const encryptedData = serializeKeyingCanonicalJson({
+        format: DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT,
+        version: 1,
+        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
+        contentKeyEpoch: input.contentKeyEpoch,
+        contentRecordId,
+        nonceDomainHash,
+        metadataHash,
+        iv: bytesToBase64(iv),
+        ciphertext: bytesToBase64(ciphertext),
+    });
+    return {
+        contentRecordId,
+        encryptedData,
+        metadataHash,
+        plaintextHash,
+        ciphertextHash: await computeDocumentContentRecordCiphertextHash(encryptedData),
+    };
+}
+export async function decryptDocumentSyncUpdates(input) {
+    return decryptDocumentSyncUpdatesByEpoch({
+        contentKeysByEpoch: new Map([[input.contentKeyEpoch, input.contentKey]]),
+        documentId: input.documentId,
+        organizationId: input.organizationId,
+        updates: input.updates,
+    });
+}
+export async function decryptDocumentSyncUpdatesByEpoch(input) {
+    if (input.updates.length === 0) {
+        return [];
+    }
+    const contentKeyMaterialByEpoch = new Map();
+    const contentKeyMaterialForEpoch = (contentKeyEpoch) => {
+        const existing = contentKeyMaterialByEpoch.get(contentKeyEpoch);
+        if (existing) {
+            return existing;
+        }
+        const contentKey = input.contentKeysByEpoch.get(contentKeyEpoch);
+        if (!contentKey) {
+            throw new Error("Document content key missing for sync update epoch");
+        }
+        const imported = importContentKeyMaterial(contentKey);
+        contentKeyMaterialByEpoch.set(contentKeyEpoch, imported);
+        return imported;
+    };
+    const inspections = await Promise.allSettled(input.updates.map(async (update) => {
+        let contentKeyEpoch;
+        try {
+            contentKeyEpoch = readWriteHeader(update.writeHeader, "Document sync response write header").contentKeyEpoch;
+        }
+        catch (error) {
+            throw isolateDocumentSyncUpdateError({
+                cause: error,
+                responseUpdate: update,
+                stage: "write_header",
+                updateId: update.id,
+            });
+        }
+        let contentKeyMaterial;
+        try {
+            contentKeyMaterial = await contentKeyMaterialForEpoch(contentKeyEpoch);
+        }
+        catch (error) {
+            throw isolateDocumentSyncUpdateError({
+                cause: error,
+                responseUpdate: update,
+                stage: "content_key",
+                updateId: update.id,
+            });
+        }
+        return decryptDocumentSyncUpdate({
+            contentKeyMaterial,
+            contentKeyEpoch,
+            documentId: input.documentId,
+            organizationId: input.organizationId,
+            update,
+        });
+    }));
+    const failures = inspections.flatMap((inspection, index) => inspection.status === "rejected"
+        ? [{ index, reason: inspection.reason }]
+        : []);
+    const firstFailure = failures[0];
+    if (failures.length === 1 && firstFailure) {
+        throw firstFailure.reason;
+    }
+    if (failures.length > 1 && firstFailure) {
+        const stage = isDocumentSyncUpdateIsolationError(firstFailure.reason) &&
+            failures.every(({ reason }) => isDocumentSyncUpdateIsolationError(reason) &&
+                reason.stage === firstFailure.reason.stage)
+            ? firstFailure.reason.stage
+            : "decrypt";
+        throw isolateDocumentSyncBatchError({
+            // The per-update errors carry authenticated writer attribution. Once
+            // more than one update fails, retaining those errors beneath an
+            // anonymous batch boundary would disclose the very attribution the
+            // boundary intentionally withholds.
+            cause: new Error("Multiple document sync updates failed decryption inspection"),
+            stage,
+            updateIds: failures.map(({ index }) => input.updates[index]?.id ?? "unknown"),
+        });
+    }
+    return inspections.map((inspection) => {
+        if (inspection.status === "rejected") {
+            throw inspection.reason;
+        }
+        return inspection.value;
+    });
+}
+//# sourceMappingURL=crypto.js.map

package/data/documents/shared/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,cAAc,EACd,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAEL,qCAAqC,GAEtC,MAAM,SAAS,CAAC;AAEjB,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAMlD;IACC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,MAAM,mCAAmC,CAAC;QAChE,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,KAAK,CAAC,UAAU;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,+BAA+B;QAChD,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,yCAAyC,CACnE,SAAS,EACT,gBAAgB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,wCAAwC,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB;YAClC,CAAC,CAAC;gBACE,cAAc,EAAE,iBAA0B;gBAC1C,qBAAqB,EAAE,uBAAgC;gBACvD,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB;aACtD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,yBAAyB;QACjE,aAAa;QACb,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;KAC1B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;QACrD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE;QACF,cAAc,EAAE,gCAAgC,CAAC;YAC/C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY;YACZ,eAAe;YACf,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;KACH,EACD,SAAS,EACT,gBAAgB,CAAC,SAAS,CAAC,CAC5B,CACF,CAAC;IACF,MAAM,aAAa,GAAG,4BAA4B,CAAC;QACjD,MAAM,EAAE,qCAAqC;QAC7C,OAAO,EAAE,CAAC;QACV,eAAe,EAAE,+BAA+B;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe;QACf,eAAe;QACf,YAAY;QACZ,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACrB,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,eAAe;QACf,aAAa;QACb,YAAY;QACZ,aAAa;QACb,cAAc,EACZ,MAAM,0CAA0C,CAAC,aAAa,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,OAAO,iCAAiC,CAAC;QACvC,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAKvD;IACC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxE,MAAM,0BAA0B,GAAG,CAAC,eAAuB,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACtD,yBAAyB,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAC1C,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACjC,IAAI,eAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,eAAe,GAAG,eAAe,CAC/B,MAAM,CAAC,WAAW,EAClB,qCAAqC,CACtC,CAAC,eAAe,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,8BAA8B,CAAC;gBACnC,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,MAAM;gBACtB,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,kBAA6B,CAAC;QAClC,IAAI,CAAC;YACH,kBAAkB,GAAG,MAAM,0BAA0B,CAAC,eAAe,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,8BAA8B,CAAC;gBACnC,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,MAAM;gBACtB,KAAK,EAAE,aAAa;gBACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,kBAAkB;YAClB,eAAe;YACf,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CACzD,UAAU,CAAC,MAAM,KAAK,UAAU;QAC9B,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QACxC,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1C,MAAM,YAAY,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,KAAK,GACT,kCAAkC,CAAC,YAAY,CAAC,MAAM,CAAC;YACvD,QAAQ,CAAC,KAAK,CACZ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACb,kCAAkC,CAAC,MAAM,CAAC;gBAC1C,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,KAAK,CAC7C;YACC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK;YAC3B,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,6BAA6B,CAAC;YAClC,qEAAqE;YACrE,gEAAgE;YAChE,mEAAmE;YACnE,oCAAoC;YACpC,KAAK,EAAE,IAAI,KAAK,CACd,6DAA6D,CAC9D;YACD,KAAK;YACL,SAAS,EAAE,QAAQ,CAAC,GAAG,CACrB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,SAAS,CACrD;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACpC,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,UAAU,CAAC,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  computeDocumentContentRecordPlaintextHash,\n  createAesGcmIv,\n  serializeKeyingCanonicalJson,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport type { DocumentSyncResponse } from \"@tearleads/validators/response\";\nimport type { PendingUpdateRecord } from \"../../sqlite/documentPersistence\";\nimport { contentRecordAdditionalDataBytes } from \"./contentRecordAdditionalData\";\nimport {\n  deriveDocumentContentRecordKey,\n  deriveDocumentPlaintextHashKey,\n  importContentKeyMaterial,\n} from \"./contentRecordKeys\";\nimport { decryptDocumentSyncUpdate } from \"./documentSyncUpdateDecryption\";\nimport {\n  isDocumentSyncUpdateIsolationError,\n  isolateDocumentSyncBatchError,\n  isolateDocumentSyncUpdateError,\n} from \"./documentSyncUpdateIsolation\";\nimport { asWebCryptoBytes, readWriteHeader } from \"./readers\";\nimport {\n  type DecryptedDocumentSyncUpdate,\n  DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT,\n  type DocumentEncryptedPendingUpdate,\n} from \"./types\";\n\nexport async function encryptDocumentPendingUpdate(input: {\n  contentKeyMaterial: CryptoKey;\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  update: PendingUpdateRecord;\n}): Promise<DocumentEncryptedPendingUpdate> {\n  const plaintext = base64ToBytes(input.update.updateData);\n  const contentRecordId = input.update.id;\n  const nonceDomainHash = await computeContentRecordNonceDomainHash({\n    version: 1,\n    organizationId: input.organizationId,\n    objectKind: \"document\",\n    objectId: input.documentId,\n    contentKeyEpoch: input.contentKeyEpoch,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentRecordId,\n  });\n  const plaintextHashKey = await deriveDocumentPlaintextHashKey({\n    contentKeyMaterial: input.contentKeyMaterial,\n    contentKeyEpoch: input.contentKeyEpoch,\n    contentRecordId,\n    documentId: input.documentId,\n    organizationId: input.organizationId,\n  });\n  const plaintextHash = await computeDocumentContentRecordPlaintextHash(\n    plaintext,\n    plaintextHashKey,\n  );\n  const metadataHash = await computeDocumentContentRecordMetadataHash({\n    ...(input.update.sourceVersionVector\n      ? {\n          checkpointKind: \"rotate_baseline\" as const,\n          checkpointPayloadKind: \"full_history_snapshot\" as const,\n          sourceVersionVector: input.update.sourceVersionVector,\n        }\n      : {}),\n    documentId: input.documentId,\n    partialEndVersionVector: input.update.partialEndVersionVector,\n    partialStartVersionVector: input.update.partialStartVersionVector,\n    plaintextHash,\n    updateId: input.update.id,\n  });\n  const recordKey = await deriveDocumentContentRecordKey({\n    contentKeyMaterial: input.contentKeyMaterial,\n    contentKeyEpoch: input.contentKeyEpoch,\n    contentRecordId,\n    documentId: input.documentId,\n    organizationId: input.organizationId,\n    usage: \"encrypt\",\n  });\n  const iv = createAesGcmIv();\n  const ciphertext = new Uint8Array(\n    await crypto.subtle.encrypt(\n      {\n        name: \"AES-GCM\",\n        iv,\n        additionalData: contentRecordAdditionalDataBytes({\n          contentKeyEpoch: input.contentKeyEpoch,\n          contentRecordId,\n          documentId: input.documentId,\n          metadataHash,\n          nonceDomainHash,\n          organizationId: input.organizationId,\n        }),\n      },\n      recordKey,\n      asWebCryptoBytes(plaintext),\n    ),\n  );\n  const encryptedData = serializeKeyingCanonicalJson({\n    format: DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT,\n    version: 1,\n    encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,\n    contentKeyEpoch: input.contentKeyEpoch,\n    contentRecordId,\n    nonceDomainHash,\n    metadataHash,\n    iv: bytesToBase64(iv),\n    ciphertext: bytesToBase64(ciphertext),\n  });\n\n  return {\n    contentRecordId,\n    encryptedData,\n    metadataHash,\n    plaintextHash,\n    ciphertextHash:\n      await computeDocumentContentRecordCiphertextHash(encryptedData),\n  };\n}\n\nexport async function decryptDocumentSyncUpdates(input: {\n  contentKey: Uint8Array;\n  contentKeyEpoch: number;\n  documentId: string;\n  organizationId: string;\n  updates: readonly DocumentSyncResponse[\"updates\"][number][];\n}): Promise<DecryptedDocumentSyncUpdate[]> {\n  return decryptDocumentSyncUpdatesByEpoch({\n    contentKeysByEpoch: new Map([[input.contentKeyEpoch, input.contentKey]]),\n    documentId: input.documentId,\n    organizationId: input.organizationId,\n    updates: input.updates,\n  });\n}\n\nexport async function decryptDocumentSyncUpdatesByEpoch(input: {\n  contentKeysByEpoch: ReadonlyMap<number, Uint8Array>;\n  documentId: string;\n  organizationId: string;\n  updates: readonly DocumentSyncResponse[\"updates\"][number][];\n}): Promise<DecryptedDocumentSyncUpdate[]> {\n  if (input.updates.length === 0) {\n    return [];\n  }\n  const contentKeyMaterialByEpoch = new Map<number, Promise<CryptoKey>>();\n  const contentKeyMaterialForEpoch = (contentKeyEpoch: number) => {\n    const existing = contentKeyMaterialByEpoch.get(contentKeyEpoch);\n    if (existing) {\n      return existing;\n    }\n\n    const contentKey = input.contentKeysByEpoch.get(contentKeyEpoch);\n    if (!contentKey) {\n      throw new Error(\"Document content key missing for sync update epoch\");\n    }\n    const imported = importContentKeyMaterial(contentKey);\n    contentKeyMaterialByEpoch.set(contentKeyEpoch, imported);\n    return imported;\n  };\n\n  const inspections = await Promise.allSettled(\n    input.updates.map(async (update) => {\n      let contentKeyEpoch: number;\n      try {\n        contentKeyEpoch = readWriteHeader(\n          update.writeHeader,\n          \"Document sync response write header\",\n        ).contentKeyEpoch;\n      } catch (error) {\n        throw isolateDocumentSyncUpdateError({\n          cause: error,\n          responseUpdate: update,\n          stage: \"write_header\",\n          updateId: update.id,\n        });\n      }\n\n      let contentKeyMaterial: CryptoKey;\n      try {\n        contentKeyMaterial = await contentKeyMaterialForEpoch(contentKeyEpoch);\n      } catch (error) {\n        throw isolateDocumentSyncUpdateError({\n          cause: error,\n          responseUpdate: update,\n          stage: \"content_key\",\n          updateId: update.id,\n        });\n      }\n\n      return decryptDocumentSyncUpdate({\n        contentKeyMaterial,\n        contentKeyEpoch,\n        documentId: input.documentId,\n        organizationId: input.organizationId,\n        update,\n      });\n    }),\n  );\n  const failures = inspections.flatMap((inspection, index) =>\n    inspection.status === \"rejected\"\n      ? [{ index, reason: inspection.reason }]\n      : [],\n  );\n  const firstFailure = failures[0];\n  if (failures.length === 1 && firstFailure) {\n    throw firstFailure.reason;\n  }\n  if (failures.length > 1 && firstFailure) {\n    const stage =\n      isDocumentSyncUpdateIsolationError(firstFailure.reason) &&\n      failures.every(\n        ({ reason }) =>\n          isDocumentSyncUpdateIsolationError(reason) &&\n          reason.stage === firstFailure.reason.stage,\n      )\n        ? firstFailure.reason.stage\n        : \"decrypt\";\n    throw isolateDocumentSyncBatchError({\n      // The per-update errors carry authenticated writer attribution. Once\n      // more than one update fails, retaining those errors beneath an\n      // anonymous batch boundary would disclose the very attribution the\n      // boundary intentionally withholds.\n      cause: new Error(\n        \"Multiple document sync updates failed decryption inspection\",\n      ),\n      stage,\n      updateIds: failures.map(\n        ({ index }) => input.updates[index]?.id ?? \"unknown\",\n      ),\n    });\n  }\n  return inspections.map((inspection) => {\n    if (inspection.status === \"rejected\") {\n      throw inspection.reason;\n    }\n    return inspection.value;\n  });\n}\n"]}

package/data/documents/shared/documentSyncUpdateDecryption.js

@@ -0,0 +1,238 @@
+import { assertAesGcmIv, CONTENT_RECORD_ENCRYPTION_SUITE, computeContentRecordNonceDomainHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, } from "../../../internal/crypto/index.js";
+import { base64ToBytes } from "../../../internal/encoding/index.js";
+import { versionVectorsEqual } from "../../../internal/loro/index.js";
+import { isPlainObject as isPlainRecord } from "../../../internal/validators/isPlainObject.js";
+import { contentRecordAdditionalDataBytes } from "./contentRecordAdditionalData.js";
+import { deriveDocumentContentRecordKey, deriveDocumentPlaintextHashKey, } from "./contentRecordKeys.js";
+import { isolateDocumentSyncUpdateError } from "./documentSyncUpdateIsolation.js";
+import { assertDecryptedDocumentUpdateMetadata } from "./documentUpdateIntegrity.js";
+import { assertDocumentUpdatePlaintextHash } from "./plaintextHash.js";
+import { assertOnlyRecordKeys, asWebCryptoBytes, readRecordPositiveInteger, readRecordString, readWriteHeader, } from "./readers.js";
+import { DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT, DOCUMENT_ENCRYPTED_UPDATE_KEYS, } from "./types.js";
+function parseDocumentEncryptedUpdate(encryptedData) {
+    let value;
+    try {
+        value = JSON.parse(encryptedData);
+    }
+    catch {
+        throw new Error("Document encrypted update is invalid JSON");
+    }
+    if (!isPlainRecord(value)) {
+        throw new Error("Document encrypted update must be an object");
+    }
+    assertOnlyRecordKeys(value, DOCUMENT_ENCRYPTED_UPDATE_KEYS, "Document encrypted update");
+    if (readRecordString(value, "format", "Document encrypted update") !==
+        DOCUMENT_ENCRYPTED_LORO_UPDATE_FORMAT) {
+        throw new Error("Document encrypted update format is invalid");
+    }
+    const version = readRecordPositiveInteger(value, "version", "Document encrypted update");
+    if (version !== 1) {
+        throw new Error(`Document encrypted update version ${version} is invalid; expected 1`);
+    }
+    if (readRecordString(value, "encryptionSuite", "Document encrypted update") !==
+        CONTENT_RECORD_ENCRYPTION_SUITE) {
+        throw new Error("Document encrypted update suite is invalid");
+    }
+    const iv = base64ToBytes(readRecordString(value, "iv", "Document encrypted update"));
+    assertAesGcmIv(iv, "Document encrypted update IV is invalid");
+    return {
+        ciphertext: base64ToBytes(readRecordString(value, "ciphertext", "Document encrypted update")),
+        contentKeyEpoch: readRecordPositiveInteger(value, "contentKeyEpoch", "Document encrypted update"),
+        contentRecordId: readRecordString(value, "contentRecordId", "Document encrypted update"),
+        metadataHash: readRecordString(value, "metadataHash", "Document encrypted update"),
+        nonceDomainHash: readRecordString(value, "nonceDomainHash", "Document encrypted update"),
+        iv,
+    };
+}
+async function assertDocumentEncryptedUpdateMatchesHeader(input) {
+    const { encrypted, update } = input;
+    const hasCheckpointMetadata = update.checkpointKind !== undefined ||
+        update.checkpointPayloadKind !== undefined ||
+        update.sourceVersionVector !== undefined;
+    if (hasCheckpointMetadata &&
+        (update.checkpointKind !== "rotate_baseline" ||
+            update.checkpointPayloadKind !== "full_history_snapshot" ||
+            !update.sourceVersionVector ||
+            !versionVectorsEqual(update.sourceVersionVector, update.partialEndVersionVector))) {
+        throw new Error("Document rotation checkpoint metadata mismatch");
+    }
+    if (encrypted.contentKeyEpoch !== input.contentKeyEpoch) {
+        throw new Error("Document encrypted update content-key epoch mismatch");
+    }
+    if (update.documentId !== input.documentId) {
+        throw new Error("Document encrypted update document id mismatch");
+    }
+    if (encrypted.contentRecordId !==
+        readRecordString(update.writeHeader, "contentRecordId", "write header")) {
+        throw new Error("Document encrypted update content record mismatch");
+    }
+    const metadataHash = await computeDocumentContentRecordMetadataHash({
+        ...(update.checkpointKind === undefined
+            ? {}
+            : { checkpointKind: update.checkpointKind }),
+        ...(update.checkpointPayloadKind === undefined
+            ? {}
+            : { checkpointPayloadKind: update.checkpointPayloadKind }),
+        documentId: input.documentId,
+        partialEndVersionVector: update.partialEndVersionVector,
+        partialStartVersionVector: update.partialStartVersionVector,
+        plaintextHash: update.plaintextHash,
+        ...(update.sourceVersionVector === undefined
+            ? {}
+            : { sourceVersionVector: update.sourceVersionVector }),
+        updateId: update.id,
+    });
+    if (encrypted.metadataHash !== metadataHash ||
+        encrypted.metadataHash !==
+            readRecordString(update.writeHeader, "metadataHash", "write header")) {
+        throw new Error("Document encrypted update metadata hash mismatch");
+    }
+    const nonceDomainHash = await computeContentRecordNonceDomainHash({
+        version: 1,
+        organizationId: input.organizationId,
+        objectKind: "document",
+        objectId: input.documentId,
+        contentKeyEpoch: input.contentKeyEpoch,
+        encryptionSuite: CONTENT_RECORD_ENCRYPTION_SUITE,
+        contentRecordId: encrypted.contentRecordId,
+    });
+    if (encrypted.nonceDomainHash !== nonceDomainHash ||
+        encrypted.nonceDomainHash !==
+            readRecordString(update.writeHeader, "nonceDomainHash", "write header")) {
+        throw new Error("Document encrypted update nonce domain mismatch");
+    }
+    const ciphertextHash = await computeDocumentContentRecordCiphertextHash(input.encryptedData);
+    if (ciphertextHash !==
+        readRecordString(update.writeHeader, "ciphertextHash", "write header")) {
+        throw new Error("Document encrypted update ciphertext hash mismatch");
+    }
+}
+async function verifiedEncryptedSyncUpdate(input) {
+    try {
+        const encrypted = parseDocumentEncryptedUpdate(input.update.encryptedData);
+        await assertDocumentEncryptedUpdateMatchesHeader({
+            encrypted,
+            encryptedData: input.update.encryptedData,
+            ...input,
+        });
+        return encrypted;
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "encrypted_record",
+            updateId: input.update.id,
+        });
+    }
+}
+/** Verifies the encrypted record's structure and every binding to its header. */
+export async function assertDocumentSyncUpdateEncryptedRecord(update) {
+    let contentKeyEpoch;
+    let documentId;
+    let organizationId;
+    try {
+        const header = readWriteHeader(update.writeHeader, "Document sync response write header");
+        if (header.objectKind !== "document") {
+            throw new Error("Document sync response write header kind mismatch");
+        }
+        contentKeyEpoch = header.contentKeyEpoch;
+        documentId = header.objectId;
+        organizationId = header.organizationId;
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: update,
+            stage: "write_header",
+            updateId: update.id,
+        });
+    }
+    await verifiedEncryptedSyncUpdate({
+        contentKeyEpoch,
+        documentId,
+        organizationId,
+        update,
+    });
+}
+async function decryptPayload(input) {
+    try {
+        const keyInput = {
+            contentKeyMaterial: input.contentKeyMaterial,
+            contentKeyEpoch: input.contentKeyEpoch,
+            contentRecordId: input.encrypted.contentRecordId,
+            documentId: input.documentId,
+            organizationId: input.organizationId,
+        };
+        const [recordKey, plaintextHashKey] = await Promise.all([
+            deriveDocumentContentRecordKey({ ...keyInput, usage: "decrypt" }),
+            deriveDocumentPlaintextHashKey(keyInput),
+        ]);
+        const updateData = new Uint8Array(await crypto.subtle.decrypt({
+            name: "AES-GCM",
+            iv: asWebCryptoBytes(input.encrypted.iv),
+            additionalData: contentRecordAdditionalDataBytes({
+                contentKeyEpoch: input.contentKeyEpoch,
+                contentRecordId: input.encrypted.contentRecordId,
+                documentId: input.documentId,
+                metadataHash: input.encrypted.metadataHash,
+                nonceDomainHash: input.encrypted.nonceDomainHash,
+                organizationId: input.organizationId,
+            }),
+        }, recordKey, asWebCryptoBytes(input.encrypted.ciphertext)));
+        return { plaintextHashKey, updateData };
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "decrypt",
+            updateId: input.update.id,
+        });
+    }
+}
+export async function decryptDocumentSyncUpdate(input) {
+    const encrypted = await verifiedEncryptedSyncUpdate(input);
+    const { plaintextHashKey, updateData } = await decryptPayload({
+        ...input,
+        encrypted,
+    });
+    try {
+        await assertDocumentUpdatePlaintextHash(updateData, input.update.plaintextHash, plaintextHashKey);
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "plaintext_integrity",
+            updateId: input.update.id,
+        });
+    }
+    try {
+        assertDecryptedDocumentUpdateMetadata(updateData, input.update);
+    }
+    catch (error) {
+        throw isolateDocumentSyncUpdateError({
+            cause: error,
+            responseUpdate: input.update,
+            stage: "loro_metadata",
+            updateId: input.update.id,
+        });
+    }
+    return {
+        ...(input.update.checkpointKind === undefined
+            ? {}
+            : { checkpointKind: input.update.checkpointKind }),
+        ...(input.update.checkpointPayloadKind === undefined
+            ? {}
+            : { checkpointPayloadKind: input.update.checkpointPayloadKind }),
+        id: input.update.id,
+        partialEndVersionVector: input.update.partialEndVersionVector,
+        partialStartVersionVector: input.update.partialStartVersionVector,
+        ...(input.update.sourceVersionVector === undefined
+            ? {}
+            : { sourceVersionVector: input.update.sourceVersionVector }),
+        updateData,
+    };
+}
+//# sourceMappingURL=documentSyncUpdateDecryption.js.map