@vrtmrz/livesync-commonlib 0.1.30 → 0.1.32

package/dist/services/base/SettingService.js

@@ -13,6 +13,7 @@ import { ServiceBase } from "./ServiceBase.js";
 import { createInstanceLogFunction } from "../lib/logUtils.js";
 import { isCloudantURI } from "../../pouchdb/utils_couchdb.js";
 import { decryptString, encryptString } from "../../encryption/stringEncryption.js";
+import { encryptWithEphemeralSalt } from "octagonal-wheels/encryption/hkdf";
 import {
   activateP2PRemoteConfiguration,
   activateRemoteConfiguration,
@@ -20,6 +21,7 @@ import {
   migrateP2PActiveRemoteConfigurationIdInPlace
 } from "../../serviceFeatures/remoteConfig.js";
 import { ConnectionStringParser } from "../../common/ConnectionString.js";
+import { configuredIdKey } from "../../common/idDerivation.js";
 class SettingService extends ServiceBase {
   deviceAndVaultName = "";
   APIService;
@@ -151,6 +153,32 @@ class SettingService extends ServiceBase {
       Object.assign(settings, patch);
       Object.assign(this.settings, patch);
     }
+    const idKey = configuredIdKey(settings);
+    if (settings.idDerivationVersion === 1) {
+      if (idKey === false) {
+        throw new Error("The configured ID derivation key is unavailable.");
+      }
+      let passphrase = this.usedPassphrase;
+      if (passphrase === "") {
+        passphrase = await this.getPassphrase(settings);
+      }
+      if (passphrase === false || passphrase === "") {
+        const message = "Failed to retrieve a passphrase for the ID derivation key. Settings were not saved.";
+        this._log(message, LOG_LEVEL_URGENT);
+        throw new Error(message);
+      }
+      const encryptedIdKey = await encryptString(idKey, passphrase + SALT_OF_PASSPHRASE);
+      if (encryptedIdKey === "") {
+        const message = "Failed to encrypt the ID derivation key. Settings were not saved.";
+        this._log(message, LOG_LEVEL_URGENT);
+        throw new Error(message);
+      }
+      settings.encryptedIdDerivationKey = encryptedIdKey;
+      settings.idDerivationKey = "";
+      this.usedPassphrase = passphrase;
+    } else {
+      settings.encryptedIdDerivationKey = "";
+    }
     settings.deviceAndVaultName = "";
     if (settings.P2P_DevicePeerName && settings.P2P_DevicePeerName.trim() !== "") {
       this._log("Saving device peer name to small config");
@@ -207,7 +235,7 @@ class SettingService extends ServiceBase {
         settings.endpoint = "";
       }
       if (settings.encrypt && settings.passphrase != "") {
-        settings.encryptedPassphrase = await this.encryptConfigurationItem(settings.passphrase, settings);
+        settings.encryptedPassphrase = await this.encryptPlainConfigurationItem(settings.passphrase, settings);
         settings.passphrase = "";
       }
       await this.encryptRemoteConfigurationUris(settings);
@@ -405,8 +433,14 @@ class SettingService extends ServiceBase {
     return false;
   }
   async encryptConfigurationItem(src, settings) {
+    return this.encryptConfigurationItemWith(src, settings, encryptString);
+  }
+  async encryptPlainConfigurationItem(src, settings) {
+    return this.encryptConfigurationItemWith(src, settings, encryptWithEphemeralSalt);
+  }
+  async encryptConfigurationItemWith(src, settings, encrypt) {
     if (this.usedPassphrase != "") {
-      return await encryptString(src, this.usedPassphrase + SALT_OF_PASSPHRASE);
+      return await encrypt(src, this.usedPassphrase + SALT_OF_PASSPHRASE);
     }
     const passphrase = await this.getPassphrase(settings);
     if (passphrase === false) {
@@ -416,7 +450,7 @@ class SettingService extends ServiceBase {
       );
       return "";
     }
-    const dec = await encryptString(src, passphrase + SALT_OF_PASSPHRASE);
+    const dec = await encrypt(src, passphrase + SALT_OF_PASSPHRASE);
     if (dec) {
       this.usedPassphrase = passphrase;
       return dec;
@@ -428,7 +462,27 @@ class SettingService extends ServiceBase {
    * @param settings The settings to decrypt.
    */
   async decryptSettings(settings) {
+    if (settings.idDerivationVersion !== 1) {
+      configuredIdKey(settings);
+    } else if (!settings.encryptedIdDerivationKey) {
+      throw new Error("The configured ID derivation key is missing or unavailable.");
+    }
     const passphrase = await this.getPassphrase(settings);
+    if (settings.idDerivationVersion === 1) {
+      if (passphrase === false || passphrase === "") {
+        throw new Error("The configured ID derivation key cannot be decrypted without a passphrase.");
+      }
+      const decryptedIdKey = await this.decryptConfigurationItem(settings.encryptedIdDerivationKey, passphrase);
+      if (decryptedIdKey === false) {
+        throw new Error("The configured ID derivation key could not be decrypted.");
+      }
+      try {
+        configuredIdKey({ ...settings, idDerivationKey: decryptedIdKey });
+      } catch {
+        throw new Error("The configured ID derivation key is invalid.");
+      }
+      settings.idDerivationKey = decryptedIdKey;
+    }
     if (passphrase === false) {
       this._log("No passphrase found for data.json! Verify configuration before syncing.", LOG_LEVEL_URGENT);
       const hasEncryptedRemoteConfigurations = Object.values(settings.remoteConfigurations || {}).some(

package/dist/settings.d.ts

@@ -6,8 +6,9 @@
 export { DEFAULT_SETTINGS, NEW_VAULT_SETTINGS, P2P_DEFAULT_SETTINGS, SETTINGS_SCHEMA_DEFAULTS, createNewVaultSettings, } from "./common/models/setting.const.defaults.js";
 export { PREFERRED_BASE, PREFERRED_JOURNAL_SYNC, PREFERRED_SETTING_CLOUDANT, PREFERRED_SETTING_SELF_HOSTED, } from "./common/models/setting.const.preferred.js";
 export { CURRENT_SETTING_VERSION } from "./common/models/setting.const.js";
+export { deriveIdKey, deriveOrImportIdKey, formatIdRecoveryCode, configuredIdKey, ID_DERIVATION_VERSION, ID_RECOVERY_CODE_PREFIX, } from "./common/idDerivation.js";
 export { prepareSettingsForLoad, SettingsMigrationReviewCodes, type PreparedSettings, type SettingsMigrationReviewCode, type SettingsMigrationReviewReason, type SettingsMigrationState, } from "./common/models/setting.lifecycle.js";
 export { assessTweakCompatibility } from "./common/models/tweak.compatibility.js";
 export type { TweakAssessment, TweakAssessmentEntry, TweakAssessmentRelation, TweakAssessmentValue, TweakTransition, TweakTransitionReason, } from "./common/models/tweak.compatibility.js";
 export type { TweakReconstruction, TweakValues } from "./common/models/tweak.definition.js";
-export type { ObsidianLiveSyncSettings, RemoteDBSettings, RemoteTypeSettings, } from "./common/models/setting.type.js";
+export type { ObsidianLiveSyncSettings, RemoteDBSettings, RemoteTypeSettings } from "./common/models/setting.type.js";

package/dist/settings.js

@@ -12,6 +12,14 @@ import {
   PREFERRED_SETTING_SELF_HOSTED
 } from "./common/models/setting.const.preferred.js";
 import { CURRENT_SETTING_VERSION } from "./common/models/setting.const.js";
+import {
+  deriveIdKey,
+  deriveOrImportIdKey,
+  formatIdRecoveryCode,
+  configuredIdKey,
+  ID_DERIVATION_VERSION,
+  ID_RECOVERY_CODE_PREFIX
+} from "./common/idDerivation.js";
 import {
   prepareSettingsForLoad,
   SettingsMigrationReviewCodes
@@ -20,6 +28,8 @@ import { assessTweakCompatibility } from "./common/models/tweak.compatibility.js
 export {
   CURRENT_SETTING_VERSION,
   DEFAULT_SETTINGS,
+  ID_DERIVATION_VERSION,
+  ID_RECOVERY_CODE_PREFIX,
   NEW_VAULT_SETTINGS,
   P2P_DEFAULT_SETTINGS,
   PREFERRED_BASE,
@@ -29,6 +39,10 @@ export {
   SETTINGS_SCHEMA_DEFAULTS,
   SettingsMigrationReviewCodes,
   assessTweakCompatibility,
+  configuredIdKey,
   createNewVaultSettings,
+  deriveIdKey,
+  deriveOrImportIdKey,
+  formatIdRecoveryCode,
   prepareSettingsForLoad
 };

package/dist/setupUri.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Setup URI sharing for maintained hosts.
+ *
+ * @packageDocumentation
+ */
+export { encodeSettingsToSetupURI, encodeTimeBoundSetupURI, getTimeBoundSetupURIUsableUntil, isTimeBoundSetupURIUsableNow, decodeSettingsFromSetupURI, type TimeBoundSetupURIOptions, type TimeBoundSetupURIResult, type TimeBoundSetupURIMode, } from "./API/processSetting.js";

package/dist/setupUri.js

@@ -0,0 +1,14 @@
+import {
+  encodeSettingsToSetupURI,
+  encodeTimeBoundSetupURI,
+  getTimeBoundSetupURIUsableUntil,
+  isTimeBoundSetupURIUsableNow,
+  decodeSettingsFromSetupURI
+} from "./API/processSetting.js";
+export {
+  decodeSettingsFromSetupURI,
+  encodeSettingsToSetupURI,
+  encodeTimeBoundSetupURI,
+  getTimeBoundSetupURIUsableUntil,
+  isTimeBoundSetupURIUsableNow
+};

package/dist/string_and_binary/path.d.ts

@@ -8,7 +8,7 @@ export declare function stripAllPrefixes(prefixedPath: FilePathWithPrefix): File
 export declare function addPrefix(path: FilePath | FilePathWithPrefix, prefix: string): FilePathWithPrefix;
 export declare function expandFilePathPrefix(path: FilePathWithPrefix | FilePath): [string, FilePathWithPrefix];
 export declare function expandDocumentIDPrefix(id: DocumentID): [string, FilePathWithPrefix];
-export declare function path2id_base(filenameSrc: FilePathWithPrefix | FilePath, obfuscatePassphrase: string | false, caseInsensitive: boolean): Promise<DocumentID>;
+export declare function path2id_base(filenameSrc: FilePathWithPrefix | FilePath, obfuscatePassphrase: string | false, caseInsensitive: boolean, idDerivationKey?: string): Promise<DocumentID>;
 export declare function id2path_base(id: DocumentID, entry?: EntryHasPath): FilePathWithPrefix;
 export declare function getPath(entry: AnyEntry): FilePathWithPrefix;
 export declare function getPathWithoutPrefix(entry: AnyEntry): FilePath;

package/dist/string_and_binary/path.js

@@ -14,6 +14,7 @@ import { memorizeFuncWithLRUCache } from "../common/utils.js";
 import { uint8ArrayToHexString, writeString } from "./convert.js";
 import { unique } from "octagonal-wheels/collection.js";
 import { CHeader, ICHeader, ICXHeader, PSCHeader } from "../common/models/fileaccess.const.js";
+import { computeKeyedId } from "../common/idDerivation.js";
 function isValidFilenameInWidows(filename) {
   const regex = /[\u0000-\u001f]|[\\":?<>|*#]/g;
   if (regex.test(filename)) return false;
@@ -68,7 +69,7 @@ const _hashString = memorizeFuncWithLRUCache(async (key) => {
 function hashString(key) {
   return _hashString(key);
 }
-async function path2id_base(filenameSrc, obfuscatePassphrase, caseInsensitive) {
+async function path2id_base(filenameSrc, obfuscatePassphrase, caseInsensitive, idDerivationKey) {
   if (filenameSrc.startsWith(PREFIX_OBFUSCATED)) return `${filenameSrc}`;
   let filename = `${filenameSrc}`;
   const newPrefix = obfuscatePassphrase ? PREFIX_OBFUSCATED : "";
@@ -82,8 +83,7 @@ async function path2id_base(filenameSrc, obfuscatePassphrase, caseInsensitive) {
   }
   const [prefix, body] = expandFilePathPrefix(x);
   if (body.startsWith(PREFIX_OBFUSCATED)) return newPrefix + x;
-  const hashedPassphrase = await hashString(obfuscatePassphrase);
-  const out = await hashString(`${hashedPassphrase}:${filename}`);
+  const out = idDerivationKey ? await computeKeyedId(idDerivationKey, "document", filename) : await hashString(`${await hashString(obfuscatePassphrase)}:${filename}`);
   return prefix + newPrefix + out;
 }
 function id2path_base(id, entry) {