mindoodb 0.0.1 → 0.0.3

package/dist/core/BaseMindooTenant.js

@@ -1,10 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenant = void 0;
+const types_1 = require("./types");
 const BaseMindooDB_1 = require("./BaseMindooDB");
 const BaseMindooTenantDirectory_1 = require("./BaseMindooTenantDirectory");
 const MindooDocSigner_1 = require("./crypto/MindooDocSigner");
 const errors_1 = require("./errors");
+const logging_1 = require("./logging");
+const MindooURI_1 = require("./uri/MindooURI");
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
  * that works in both browser and server environments.
@@ -20,19 +23,18 @@ const errors_1 = require("./errors");
  *   - PBKDF2 key derivation (for password-based key derivation)
  */
 class BaseMindooTenant {
-    constructor(factory, tenantId, tenantEncryptionKey, tenantEncryptionKeyPassword, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter) {
+    constructor(factory, tenantId, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter, logger, additionalTrustedKeys) {
         this.databaseCache = new Map();
         this.directoryCache = null;
         this.factory = factory;
         this.tenantId = tenantId;
-        this.tenantEncryptionKey = tenantEncryptionKey;
-        this.tenantEncryptionKeyPassword = tenantEncryptionKeyPassword;
         this.administrationPublicKey = administrationPublicKey;
         this.administrationEncryptionPublicKey = administrationEncryptionPublicKey;
         this.currentUser = currentUser;
         this.currentUserPassword = currentUserPassword;
         this.keyBag = keyBag;
         this.storeFactory = storeFactory;
+        this.additionalTrustedKeys = additionalTrustedKeys;
         // Import createCryptoAdapter dynamically to avoid issues in browser environments
         if (!cryptoAdapter) {
             const { createCryptoAdapter } = require("./crypto/CryptoAdapter");
@@ -41,15 +43,19 @@ class BaseMindooTenant {
         else {
             this.cryptoAdapter = cryptoAdapter;
         }
+        // Create logger if not provided (for backward compatibility)
+        this.logger =
+            logger ||
+                new logging_1.MindooLogger((0, logging_1.getDefaultLogLevel)(), `Tenant:${tenantId}`, true);
     }
     /**
      * Initialize the tenant.
      */
     async initialize() {
-        console.log(`[BaseMindooTenant] Initializing tenant ${this.tenantId}`);
+        this.logger.info(`Initializing tenant ${this.tenantId}`);
         // KeyBag is already loaded by the caller before passing it to the constructor
         const keyCount = (await this.keyBag.listKeys()).length;
-        console.log(`[BaseMindooTenant] Tenant initialized with ${keyCount} keys in KeyBag`);
+        this.logger.info(`Tenant initialized with ${keyCount} keys in KeyBag`);
     }
     getCryptoAdapter() {
         return this.cryptoAdapter;
@@ -79,98 +85,97 @@ class BaseMindooTenant {
     getAdministrationEncryptionPublicKey() {
         return this.administrationEncryptionPublicKey;
     }
-    getTenantEncryptionKey() {
-        return this.tenantEncryptionKey;
-    }
     async encryptPayload(payload, decryptionKeyId) {
-        console.log(`[BaseMindooTenant] Encrypting payload with key: ${decryptionKeyId}`);
-        console.log(`[BaseMindooTenant] Payload size: ${payload.length} bytes`);
+        this.logger.debug(`Encrypting payload with key: ${decryptionKeyId}`);
+        this.logger.debug(`Payload size: ${payload.length} bytes`);
         // Get the symmetric key for this key ID
         let symmetricKey;
         try {
             if (decryptionKeyId === "default") {
-                console.log(`[BaseMindooTenant] Using default key (tenant encryption key)`);
+                this.logger.debug(`Using default key (tenant encryption key)`);
                 // Use cached tenant encryption key if available
                 if (this.decryptedTenantKeyCache) {
                     symmetricKey = this.decryptedTenantKeyCache;
-                    console.log(`[BaseMindooTenant] Using cached tenant key, length: ${symmetricKey.length} bytes`);
+                    this.logger.debug(`Using cached tenant key, length: ${symmetricKey.length} bytes`);
                 }
                 else {
-                    console.log(`[BaseMindooTenant] Decrypting tenant encryption key`);
-                    // Decrypt tenant encryption key
-                    const decrypted = await this.decryptPrivateKey(this.tenantEncryptionKey, this.tenantEncryptionKeyPassword, "default");
-                    symmetricKey = new Uint8Array(decrypted);
+                    this.logger.debug(`Resolving tenant encryption key from KeyBag`);
+                    const tenantKey = await this.keyBag.get("tenant", this.tenantId);
+                    if (!tenantKey) {
+                        throw new errors_1.SymmetricKeyNotFoundError(`tenant:${this.tenantId}`);
+                    }
+                    symmetricKey = tenantKey;
                     this.decryptedTenantKeyCache = symmetricKey;
-                    console.log(`[BaseMindooTenant] Decrypted tenant key, length: ${symmetricKey.length} bytes`);
+                    this.logger.debug(`Loaded tenant key from KeyBag, length: ${symmetricKey.length} bytes`);
                 }
             }
             else {
-                console.log(`[BaseMindooTenant] Getting named key from KeyBag: ${decryptionKeyId}`);
+                this.logger.debug(`Getting named key from KeyBag: ${decryptionKeyId}`);
                 // Get the decrypted key from KeyBag
-                const decryptedKey = await this.keyBag.get(decryptionKeyId);
+                const decryptedKey = await this.keyBag.get("doc", decryptionKeyId);
                 if (!decryptedKey) {
                     throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
                 }
                 symmetricKey = decryptedKey;
-                console.log(`[BaseMindooTenant] Got named key, length: ${symmetricKey.length} bytes`);
+                this.logger.debug(`Got named key, length: ${symmetricKey.length} bytes`);
             }
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] Error getting symmetric key:`, error);
+            this.logger.error(`Error getting symmetric key:`, error);
             throw error;
         }
-        console.log(`[BaseMindooTenant] Got symmetric key, length: ${symmetricKey.length} bytes`);
+        this.logger.debug(`Got symmetric key, length: ${symmetricKey.length} bytes`);
         const subtle = this.cryptoAdapter.getSubtle();
         // Bind getRandomValues to maintain 'this' context
         const randomValues = this.cryptoAdapter.getRandomValues.bind(this.cryptoAdapter);
         // Import the symmetric key
-        console.log(`[BaseMindooTenant] Importing symmetric key for AES-GCM`);
+        this.logger.debug(`Importing symmetric key for AES-GCM`);
         let cryptoKey;
         try {
             // Create a new Uint8Array to ensure we have a proper ArrayBuffer
             const keyArray = new Uint8Array(symmetricKey);
-            console.log(`[BaseMindooTenant] Key buffer size: ${keyArray.buffer.byteLength} bytes`);
+            this.logger.debug(`Key buffer size: ${keyArray.buffer.byteLength} bytes`);
             cryptoKey = await subtle.importKey("raw", keyArray.buffer, { name: "AES-GCM" }, false, // not extractable
             ["encrypt"]);
-            console.log(`[BaseMindooTenant] Successfully imported key`);
+            this.logger.debug(`Successfully imported key`);
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] Error importing key:`, error);
-            console.error(`[BaseMindooTenant] Key length: ${symmetricKey.length}, expected: 32 bytes for AES-256`);
+            this.logger.error(`Error importing key:`, error);
+            this.logger.error(`Key length: ${symmetricKey.length}, expected: 32 bytes for AES-256`);
             throw error;
         }
         // Generate IV (12 bytes for AES-GCM)
-        console.log(`[BaseMindooTenant] Generating IV`);
+        this.logger.debug(`Generating IV`);
         let iv;
         try {
             const ivArray = new Uint8Array(12);
             randomValues(ivArray);
             iv = new Uint8Array(ivArray.buffer, ivArray.byteOffset, ivArray.byteLength);
-            console.log(`[BaseMindooTenant] Generated IV: ${iv.length} bytes`);
+            this.logger.debug(`Generated IV: ${iv.length} bytes`);
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] Error generating IV:`, error);
+            this.logger.error(`Error generating IV:`, error);
             throw error;
         }
         // Encrypt the payload
-        console.log(`[BaseMindooTenant] Encrypting payload with AES-GCM`);
-        console.log(`[BaseMindooTenant] Payload buffer size: ${payload.buffer.byteLength} bytes`);
-        console.log(`[BaseMindooTenant] Payload byteOffset: ${payload.byteOffset}, byteLength: ${payload.byteLength}`);
+        this.logger.debug(`Encrypting payload with AES-GCM`);
+        this.logger.debug(`Payload buffer size: ${payload.buffer.byteLength} bytes`);
+        this.logger.debug(`Payload byteOffset: ${payload.byteOffset}, byteLength: ${payload.byteLength}`);
         let encrypted;
         try {
             // Create a new Uint8Array to ensure we have a proper ArrayBuffer
             const payloadArray = new Uint8Array(payload);
-            console.log(`[BaseMindooTenant] Using payload array: ${payloadArray.length} bytes`);
+            this.logger.debug(`Using payload array: ${payloadArray.length} bytes`);
             encrypted = await subtle.encrypt({
                 name: "AES-GCM",
                 iv: iv,
                 tagLength: 128, // 128-bit authentication tag
             }, cryptoKey, payloadArray);
-            console.log(`[BaseMindooTenant] Successfully encrypted payload, encrypted size: ${encrypted.byteLength} bytes`);
+            this.logger.debug(`Successfully encrypted payload, encrypted size: ${encrypted.byteLength} bytes`);
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] Error encrypting payload:`, error);
-            console.error(`[BaseMindooTenant] Error details:`, {
+            this.logger.error(`Error encrypting payload:`, error);
+            this.logger.error(`Error details:`, {
                 errorName: error instanceof Error ? error.name : typeof error,
                 errorMessage: error instanceof Error ? error.message : String(error),
                 payloadLength: payload.length,
@@ -181,16 +186,16 @@ class BaseMindooTenant {
         }
         // Combine IV and encrypted data
         // Format: IV (12 bytes) + encrypted data (includes authentication tag)
-        console.log(`[BaseMindooTenant] Combining IV and encrypted data`);
+        this.logger.debug(`Combining IV and encrypted data`);
         const encryptedArray = new Uint8Array(encrypted);
         const result = new Uint8Array(12 + encryptedArray.length);
         result.set(iv, 0);
         result.set(encryptedArray, 12);
-        console.log(`[BaseMindooTenant] Encrypted payload (${payload.length} -> ${result.length} bytes)`);
+        this.logger.debug(`Encrypted payload (${payload.length} -> ${result.length} bytes)`);
         return result;
     }
     async decryptPayload(encryptedPayload, decryptionKeyId) {
-        console.log(`[BaseMindooTenant] Decrypting payload with key: ${decryptionKeyId}`);
+        this.logger.debug(`Decrypting payload with key: ${decryptionKeyId}`);
         if (encryptedPayload.length < 12) {
             throw new Error("Encrypted payload too short (missing IV)");
         }
@@ -205,15 +210,17 @@ class BaseMindooTenant {
                 symmetricKey = this.decryptedTenantKeyCache;
             }
             else {
-                // Decrypt tenant encryption key
-                const decrypted = await this.decryptPrivateKey(this.tenantEncryptionKey, this.tenantEncryptionKeyPassword, "default");
-                symmetricKey = new Uint8Array(decrypted);
+                const tenantKey = await this.keyBag.get("tenant", this.tenantId);
+                if (!tenantKey) {
+                    throw new errors_1.SymmetricKeyNotFoundError(`tenant:${this.tenantId}`);
+                }
+                symmetricKey = tenantKey;
                 this.decryptedTenantKeyCache = symmetricKey;
             }
         }
         else {
             // Get the decrypted key from KeyBag
-            const decryptedKey = await this.keyBag.get(decryptionKeyId);
+            const decryptedKey = await this.keyBag.get("doc", decryptionKeyId);
             if (!decryptedKey) {
                 throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
             }
@@ -229,11 +236,11 @@ class BaseMindooTenant {
             iv: iv,
             tagLength: 128, // 128-bit authentication tag
         }, cryptoKey, encryptedData.buffer);
-        console.log(`[BaseMindooTenant] Decrypted payload (${encryptedPayload.length} -> ${decrypted.byteLength} bytes)`);
+        this.logger.debug(`Decrypted payload (${encryptedPayload.length} -> ${decrypted.byteLength} bytes)`);
         return new Uint8Array(decrypted);
     }
     async signPayload(payload) {
-        console.log(`[BaseMindooTenant] Signing payload`);
+        this.logger.debug(`Signing payload`);
         // Get the current user's signing private key (decrypted)
         const signingKey = await this.getDecryptedSigningKey();
         const subtle = this.cryptoAdapter.getSubtle();
@@ -241,11 +248,11 @@ class BaseMindooTenant {
         const signature = await subtle.sign({
             name: "Ed25519",
         }, signingKey, payload.buffer);
-        console.log(`[BaseMindooTenant] Signed payload (signature: ${signature.byteLength} bytes)`);
+        this.logger.debug(`Signed payload (signature: ${signature.byteLength} bytes)`);
         return new Uint8Array(signature);
     }
     async signPayloadWithKey(payload, signingKeyPair, password) {
-        console.log(`[BaseMindooTenant] Signing payload with provided key`);
+        this.logger.debug(`Signing payload with provided key`);
         const subtle = this.cryptoAdapter.getSubtle();
         // Decrypt the provided signing private key
         const decryptedKeyBuffer = await this.decryptPrivateKey(signingKeyPair.privateKey, password, "signing");
@@ -258,15 +265,15 @@ class BaseMindooTenant {
         const signature = await subtle.sign({
             name: "Ed25519",
         }, signingKey, payload.buffer);
-        console.log(`[BaseMindooTenant] Signed payload with provided key (signature: ${signature.byteLength} bytes)`);
+        this.logger.debug(`Signed payload with provided key (signature: ${signature.byteLength} bytes)`);
         return new Uint8Array(signature);
     }
     async verifySignature(payload, signature, publicKey) {
-        console.log(`[BaseMindooTenant] Verifying signature`);
+        this.logger.debug(`Verifying signature`);
         const directory = await this.openDirectory();
         const isTrusted = await directory.validatePublicSigningKey(publicKey);
         if (!isTrusted) {
-            console.warn(`[BaseMindooTenant] Public key not trusted: ${publicKey}`);
+            this.logger.warn(`Public key not trusted: ${publicKey}`);
             return false;
         }
         const subtle = this.cryptoAdapter.getSubtle();
@@ -281,11 +288,11 @@ class BaseMindooTenant {
         const isValid = await subtle.verify({
             name: "Ed25519",
         }, cryptoKey, signature.buffer, payload.buffer);
-        console.log(`[BaseMindooTenant] Signature verification result: ${isValid}`);
+        this.logger.info(`Signature verification result: ${isValid}`);
         return isValid;
     }
     async validatePublicSigningKey(publicKey) {
-        console.log(`[BaseMindooTenant] Validating public signing key`);
+        this.logger.info(`Validating public signing key`);
         // Load the directory database to check if this key belongs to a trusted user
         const directoryDB = await this.openDB("directory");
         // TODO: Query the directory database to check if this public key belongs to a registered,
@@ -301,14 +308,21 @@ class BaseMindooTenant {
         // Convert PrivateUserId to PublicUserId
         return {
             username: this.currentUser.username,
-            administrationSignature: this.currentUser.administrationSignature,
             userSigningPublicKey: this.currentUser.userSigningKeyPair.publicKey,
             userEncryptionPublicKey: this.currentUser.userEncryptionKeyPair.publicKey,
         };
     }
+    /**
+     * Get the additional trusted signing keys map, if configured.
+     * Used by BaseMindooTenantDirectory to check keys before the directory DB.
+     */
+    getAdditionalTrustedKeys() {
+        return this.additionalTrustedKeys;
+    }
     async openDirectory() {
         if (!this.directoryCache) {
-            this.directoryCache = new BaseMindooTenantDirectory_1.BaseMindooTenantDirectory(this);
+            const directoryLogger = this.logger.createChild("Directory");
+            this.directoryCache = new BaseMindooTenantDirectory_1.BaseMindooTenantDirectory(this, directoryLogger);
         }
         return this.directoryCache;
     }
@@ -331,18 +345,151 @@ class BaseMindooTenant {
         const { adminOnlyDb, attachmentConfig, ...storeOptions } = effectiveOptions;
         // Create the database stores using the factory
         const { docStore, attachmentStore } = this.storeFactory.createStore(id, storeOptions);
-        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, adminOnlyDb ?? false);
+        const dbLogger = this.logger.createChild("BaseMindooDB");
+        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, adminOnlyDb ?? false, dbLogger);
         await db.initialize();
         // Cache the database for future use
         this.databaseCache.set(id, db);
         return db;
     }
     createDocSignerFor(signKey) {
-        console.log(`[BaseMindooTenant] Creating MindooDocSigner for signing key pair`);
-        return new MindooDocSigner_1.MindooDocSigner(this, signKey);
+        this.logger.debug(`Creating MindooDocSigner for signing key pair`);
+        const signerLogger = this.logger.createChild("MindooDocSigner");
+        return new MindooDocSigner_1.MindooDocSigner(this, signKey, signerLogger);
+    }
+    async approveJoinRequest(joinRequest, options) {
+        // Parse the join request if it's a URI string
+        let request;
+        if (typeof joinRequest === "string") {
+            if (!(0, MindooURI_1.isMindooURI)(joinRequest)) {
+                throw new Error("Invalid join request: expected a JoinRequest object or a mdb://join-request/... URI string");
+            }
+            const decoded = (0, MindooURI_1.decodeMindooURI)(joinRequest);
+            if (decoded.type !== "join-request") {
+                throw new Error(`Invalid URI type: expected "join-request", got "${decoded.type}"`);
+            }
+            request = decoded.payload;
+        }
+        else {
+            request = joinRequest;
+        }
+        console.log(`[approveJoinRequest] Approving join request for user "${request.username}"`);
+        this.logger.info(`Approving join request for user: ${request.username}`);
+        // 1. Register the user in the directory
+        const directory = await this.openDirectory();
+        const publicUserId = {
+            username: request.username,
+            userSigningPublicKey: request.signingPublicKey,
+            userEncryptionPublicKey: request.encryptionPublicKey,
+        };
+        await directory.registerUser(publicUserId, options.adminSigningKey, options.adminPassword);
+        // 2. Export the tenant key encrypted with the share password
+        const encryptedTenantKey = await this.keyBag.encryptAndExportKey("tenant", this.tenantId, options.sharePassword);
+        if (!encryptedTenantKey) {
+            throw new Error(`Failed to export tenant key for tenant "${this.tenantId}"`);
+        }
+        // 3. Export the $publicinfos key encrypted with the share password
+        const encryptedPublicInfosKey = await this.keyBag.encryptAndExportKey("doc", types_1.PUBLIC_INFOS_KEY_ID, options.sharePassword);
+        if (!encryptedPublicInfosKey) {
+            throw new Error(`Failed to export $publicinfos key`);
+        }
+        // 4. Build the join response
+        const joinResponse = {
+            v: 1,
+            tenantId: this.tenantId,
+            adminSigningPublicKey: this.administrationPublicKey,
+            adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
+            encryptedTenantKey,
+            encryptedPublicInfosKey,
+        };
+        if (options.serverUrl) {
+            joinResponse.serverUrl = options.serverUrl;
+        }
+        console.log(`[approveJoinRequest] ✓ Join request approved for user "${request.username}"`);
+        this.logger.info(`Join request approved for user: ${request.username}`);
+        // Return as URI string or object depending on format option
+        if (options.format === "uri") {
+            return (0, MindooURI_1.encodeMindooURI)("join-response", joinResponse);
+        }
+        return joinResponse;
+    }
+    /**
+     * Publish (register) this tenant on a MindooDB server.
+     */
+    async publishToServer(serverUrl, options) {
+        console.log(`[publishToServer] Publishing tenant "${this.tenantId}" to server: ${serverUrl}`);
+        this.logger.info(`Publishing tenant "${this.tenantId}" to server: ${serverUrl}`);
+        // Export the $publicinfos key so the server can read the directory DB
+        const publicInfosKeyBytes = await this.keyBag.get("doc", types_1.PUBLIC_INFOS_KEY_ID);
+        if (!publicInfosKeyBytes) {
+            throw new Error(`Cannot publish to server: $publicinfos key not found in KeyBag`);
+        }
+        const publicInfosKeyBase64 = this.uint8ArrayToBase64(publicInfosKeyBytes);
+        // Build the registration request
+        const requestBody = {
+            tenantId: this.tenantId,
+            adminSigningPublicKey: this.administrationPublicKey,
+            adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
+            publicInfosKey: publicInfosKeyBase64,
+        };
+        // Add users if provided
+        if (options?.registerUsers && options.registerUsers.length > 0) {
+            requestBody.users = options.registerUsers.map((u) => ({
+                username: u.username,
+                signingPublicKey: u.userSigningPublicKey,
+                encryptionPublicKey: u.userEncryptionPublicKey,
+            }));
+        }
+        // Build headers
+        const headers = {
+            "Content-Type": "application/json",
+        };
+        if (options?.adminApiKey) {
+            headers["x-api-key"] = options.adminApiKey;
+        }
+        // POST to the server's admin register-tenant endpoint
+        const url = `${serverUrl.replace(/\/$/, "")}/admin/register-tenant`;
+        const response = await fetch(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(requestBody),
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Failed to publish tenant to server (HTTP ${response.status}): ${errorBody}`);
+        }
+        console.log(`[publishToServer] ✓ Tenant "${this.tenantId}" published to server successfully`);
+        this.logger.info(`Tenant "${this.tenantId}" published to server successfully`);
+    }
+    /**
+     * Create a remote store connected to a MindooDB server, ready for sync.
+     */
+    async connectToServer(serverUrl, dbId) {
+        console.log(`[connectToServer] Connecting to server: ${serverUrl}, db: ${dbId}`);
+        this.logger.info(`Connecting to server: ${serverUrl}, db: ${dbId}`);
+        // Lazy-import network modules to avoid circular dependencies and keep core lightweight
+        const { HttpTransport } = await import("../appendonlystores/network/HttpTransport.js");
+        const { ClientNetworkContentAddressedStore } = await import("../appendonlystores/network/ClientNetworkContentAddressedStore.js");
+        // Create the HTTP transport
+        const baseUrl = `${serverUrl.replace(/\/$/, "")}/${this.tenantId}`;
+        const transport = new HttpTransport({
+            baseUrl,
+            tenantId: this.tenantId,
+            dbId,
+        }, this.logger.createChild("HttpTransport"));
+        // Get the current user's decrypted signing key
+        const signingKey = await this.getDecryptedSigningKey();
+        // Get the current user's decrypted RSA encryption private key (for decrypting entries)
+        const decryptedEncryptionKey = await this.getDecryptedEncryptionKey();
+        // Create the client network store
+        const store = new ClientNetworkContentAddressedStore(dbId, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${dbId}`));
+        console.log(`[connectToServer] ✓ Connected to server for db "${dbId}"`);
+        this.logger.info(`Connected to server for db "${dbId}"`);
+        return store;
     }
     /**
      * Internal method to get the decrypted signing key for the current user.
+     * Protected so that connectToServer() helper and subclasses can access it.
      */
     async getDecryptedSigningKey() {
         // Use cached signing key if available
@@ -360,6 +507,23 @@ class BaseMindooTenant {
         this.decryptedUserSigningKeyCache = cryptoKey;
         return cryptoKey;
     }
+    /**
+     * Internal method to get the decrypted RSA encryption private key for the current user.
+     * Used by connectToServer() to create the network store.
+     */
+    async getDecryptedEncryptionKey() {
+        if (this.decryptedUserEncryptionKeyCache) {
+            return this.decryptedUserEncryptionKeyCache;
+        }
+        const decryptedKeyBuffer = await this.decryptPrivateKey(this.currentUser.userEncryptionKeyPair.privateKey, this.currentUserPassword, "encryption");
+        const subtle = this.cryptoAdapter.getSubtle();
+        const cryptoKey = await subtle.importKey("pkcs8", decryptedKeyBuffer, {
+            name: "RSA-OAEP",
+            hash: "SHA-256",
+        }, false, ["decrypt"]);
+        this.decryptedUserEncryptionKeyCache = cryptoKey;
+        return cryptoKey;
+    }
     /**
      * Internal method to decrypt a private key using password-based key derivation.
      * Protected so that BaseMindooTenantDirectory can access it.
@@ -371,12 +535,12 @@ class BaseMindooTenant {
      * @returns The decrypted private key as ArrayBuffer
      */
     async decryptPrivateKey(encryptedKey, password, saltString) {
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Starting decryption with saltString: ${saltString}`);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Password length: ${password.length}`);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: EncryptedKey iterations: ${encryptedKey.iterations}`);
+        this.logger.debug(`decryptPrivateKey: Starting decryption with saltString: ${saltString}`);
+        this.logger.debug(`decryptPrivateKey: Password length: ${password.length}`);
+        this.logger.debug(`decryptPrivateKey: EncryptedKey iterations: ${encryptedKey.iterations}`);
         const subtle = this.cryptoAdapter.getSubtle();
         // Decode base64 strings
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Decoding base64 strings`);
+        this.logger.debug(`decryptPrivateKey: Decoding base64 strings`);
         let ciphertext;
         let iv;
         let tag;
@@ -386,33 +550,33 @@ class BaseMindooTenant {
             iv = this.base64ToUint8Array(encryptedKey.iv);
             tag = this.base64ToUint8Array(encryptedKey.tag);
             saltBytes = this.base64ToUint8Array(encryptedKey.salt);
-            console.log(`[BaseMindooTenant] decryptPrivateKey: Decoded - ciphertext: ${ciphertext.length} bytes, iv: ${iv.length} bytes, tag: ${tag.length} bytes, salt: ${saltBytes.length} bytes`);
+            this.logger.debug(`decryptPrivateKey: Decoded - ciphertext: ${ciphertext.length} bytes, iv: ${iv.length} bytes, tag: ${tag.length} bytes, salt: ${saltBytes.length} bytes`);
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] decryptPrivateKey: Error decoding base64:`, error);
+            this.logger.error(`decryptPrivateKey: Error decoding base64:`, error);
             throw error;
         }
         // Derive key from password using PBKDF2
         // Combine the stored salt bytes with the salt string for additional security
         // This ensures different key types (signing, encryption, etc.) use different derived keys
         // even if they share the same password
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Combining salt with saltString`);
+        this.logger.debug(`decryptPrivateKey: Combining salt with saltString`);
         const saltStringBytes = new TextEncoder().encode(saltString);
         const combinedSalt = new Uint8Array(saltBytes.length + saltStringBytes.length);
         combinedSalt.set(saltBytes);
         combinedSalt.set(saltStringBytes, saltBytes.length);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Combined salt length: ${combinedSalt.length} bytes`);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Importing password key for PBKDF2`);
+        this.logger.debug(`decryptPrivateKey: Combined salt length: ${combinedSalt.length} bytes`);
+        this.logger.debug(`decryptPrivateKey: Importing password key for PBKDF2`);
         let passwordKey;
         try {
             passwordKey = await subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits", "deriveKey"]);
-            console.log(`[BaseMindooTenant] decryptPrivateKey: Successfully imported password key`);
+            this.logger.debug(`decryptPrivateKey: Successfully imported password key`);
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] decryptPrivateKey: Error importing password key:`, error);
+            this.logger.error(`decryptPrivateKey: Error importing password key:`, error);
             throw error;
         }
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Deriving key with PBKDF2 (iterations: ${encryptedKey.iterations})`);
+        this.logger.debug(`decryptPrivateKey: Deriving key with PBKDF2 (iterations: ${encryptedKey.iterations})`);
         let derivedKey;
         try {
             derivedKey = await subtle.deriveKey({
@@ -424,39 +588,39 @@ class BaseMindooTenant {
                 name: "AES-GCM",
                 length: 256,
             }, false, ["decrypt"]);
-            console.log(`[BaseMindooTenant] decryptPrivateKey: Successfully derived key`);
+            this.logger.debug(`decryptPrivateKey: Successfully derived key`);
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] decryptPrivateKey: Error deriving key:`, error);
+            this.logger.error(`decryptPrivateKey: Error deriving key:`, error);
             throw error;
         }
         // Combine ciphertext and tag (GCM authentication tag is separate)
         // AES-GCM expects the tag to be appended to the ciphertext
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Combining ciphertext and tag`);
+        this.logger.debug(`decryptPrivateKey: Combining ciphertext and tag`);
         const encryptedData = new Uint8Array(ciphertext.length + tag.length);
         encryptedData.set(ciphertext);
         encryptedData.set(tag, ciphertext.length);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Combined encrypted data length: ${encryptedData.length} bytes`);
+        this.logger.debug(`decryptPrivateKey: Combined encrypted data length: ${encryptedData.length} bytes`);
         // Decrypt the private key
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Decrypting with AES-GCM`);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: IV length: ${iv.length} bytes (expected: 12 for AES-GCM)`);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Tag length: ${tag.length} bytes (expected: 16 for 128-bit tag)`);
-        console.log(`[BaseMindooTenant] decryptPrivateKey: Ciphertext length: ${ciphertext.length} bytes`);
+        this.logger.debug(`decryptPrivateKey: Decrypting with AES-GCM`);
+        this.logger.debug(`decryptPrivateKey: IV length: ${iv.length} bytes (expected: 12 for AES-GCM)`);
+        this.logger.debug(`decryptPrivateKey: Tag length: ${tag.length} bytes (expected: 16 for 128-bit tag)`);
+        this.logger.debug(`decryptPrivateKey: Ciphertext length: ${ciphertext.length} bytes`);
         let decrypted;
         try {
             // Create a new ArrayBuffer to ensure we have the correct buffer without any offset issues
             const encryptedBuffer = new Uint8Array(encryptedData).buffer;
-            console.log(`[BaseMindooTenant] decryptPrivateKey: Encrypted buffer size: ${encryptedBuffer.byteLength} bytes`);
+            this.logger.debug(`decryptPrivateKey: Encrypted buffer size: ${encryptedBuffer.byteLength} bytes`);
             decrypted = await subtle.decrypt({
                 name: "AES-GCM",
                 iv: new Uint8Array(iv), // Create a new Uint8Array to ensure proper buffer
                 tagLength: 128,
             }, derivedKey, encryptedBuffer);
-            console.log(`[BaseMindooTenant] decryptPrivateKey: Successfully decrypted, result length: ${decrypted.byteLength} bytes`);
+            this.logger.debug(`decryptPrivateKey: Successfully decrypted, result length: ${decrypted.byteLength} bytes`);
         }
         catch (error) {
-            console.error(`[BaseMindooTenant] decryptPrivateKey: Error during decryption:`, error);
-            console.error(`[BaseMindooTenant] decryptPrivateKey: Error details:`, {
+            this.logger.error(`decryptPrivateKey: Error during decryption:`, error);
+            this.logger.error(`decryptPrivateKey: Error details:`, {
                 errorName: error instanceof Error ? error.name : typeof error,
                 errorMessage: error instanceof Error ? error.message : String(error),
                 ivLength: iv.length,
@@ -531,15 +695,17 @@ class BaseMindooTenant {
             if (this.decryptedTenantKeyCache) {
                 return this.decryptedTenantKeyCache;
             }
-            // Decrypt tenant encryption key
-            const decrypted = await this.decryptPrivateKey(this.tenantEncryptionKey, this.tenantEncryptionKeyPassword, "default");
-            const symmetricKey = new Uint8Array(decrypted);
+            const tenantKey = await this.keyBag.get("tenant", this.tenantId);
+            if (!tenantKey) {
+                throw new errors_1.SymmetricKeyNotFoundError(`tenant:${this.tenantId}`);
+            }
+            const symmetricKey = tenantKey;
             this.decryptedTenantKeyCache = symmetricKey;
             return symmetricKey;
         }
         else {
             // Get the decrypted key from KeyBag
-            const decryptedKey = await this.keyBag.get(decryptionKeyId);
+            const decryptedKey = await this.keyBag.get("doc", decryptionKeyId);
             if (!decryptedKey) {
                 throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
             }
@@ -576,7 +742,7 @@ class BaseMindooTenant {
      * @returns The encrypted payload with mode prefix
      */
     async encryptAttachmentPayload(payload, decryptionKeyId) {
-        console.log(`[BaseMindooTenant] Encrypting attachment payload with key: ${decryptionKeyId}`);
+        this.logger.debug(`Encrypting attachment payload with key: ${decryptionKeyId}`);
         const symmetricKey = await this.getSymmetricKey(decryptionKeyId);
         const subtle = this.cryptoAdapter.getSubtle();
         const randomValues = this.cryptoAdapter.getRandomValues.bind(this.cryptoAdapter);
@@ -595,13 +761,13 @@ class BaseMindooTenant {
             const payloadBuffer = payload.buffer.slice(payload.byteOffset, payload.byteOffset + payload.byteLength);
             const hashBuffer = await subtle.digest("SHA-256", payloadBuffer);
             iv = new Uint8Array(hashBuffer).slice(0, 12);
-            console.log(`[BaseMindooTenant] Using deterministic IV derived from content hash`);
+            this.logger.debug(`Using deterministic IV derived from content hash`);
         }
         else {
             // Random IV
             iv = new Uint8Array(12);
             randomValues(iv);
-            console.log(`[BaseMindooTenant] Using random IV`);
+            this.logger.debug(`Using random IV`);
         }
         // Encrypt the payload
         const payloadArray = new Uint8Array(payload);
@@ -616,7 +782,7 @@ class BaseMindooTenant {
         result[0] = mode;
         result.set(iv, 1);
         result.set(encryptedArray, 13);
-        console.log(`[BaseMindooTenant] Encrypted attachment (mode=${mode}, ${payload.length} -> ${result.length} bytes)`);
+        this.logger.debug(`Encrypted attachment (mode=${mode}, ${payload.length} -> ${result.length} bytes)`);
         return result;
     }
     /**
@@ -628,7 +794,7 @@ class BaseMindooTenant {
      * @returns The decrypted plaintext
      */
     async decryptAttachmentPayload(encryptedPayload, decryptionKeyId) {
-        console.log(`[BaseMindooTenant] Decrypting attachment payload with key: ${decryptionKeyId}`);
+        this.logger.debug(`Decrypting attachment payload with key: ${decryptionKeyId}`);
         if (encryptedPayload.length < 13) {
             throw new Error("Invalid encrypted attachment payload: too short");
         }
@@ -638,7 +804,7 @@ class BaseMindooTenant {
             mode !== BaseMindooTenant.ENCRYPTION_MODE_DETERMINISTIC) {
             throw new Error(`Invalid encryption mode: ${mode}`);
         }
-        console.log(`[BaseMindooTenant] Decrypting attachment with mode=${mode}`);
+        this.logger.debug(`Decrypting attachment with mode=${mode}`);
         // Extract IV (bytes 1-12)
         const iv = encryptedPayload.slice(1, 13);
         // Extract ciphertext (bytes 13 onwards)
@@ -655,7 +821,7 @@ class BaseMindooTenant {
             tagLength: 128,
         }, cryptoKey, ciphertext);
         const result = new Uint8Array(decrypted);
-        console.log(`[BaseMindooTenant] Decrypted attachment (${encryptedPayload.length} -> ${result.length} bytes)`);
+        this.logger.debug(`Decrypted attachment (${encryptedPayload.length} -> ${result.length} bytes)`);
         return result;
     }
 }