mindoodb 0.0.19 → 0.0.21

package/dist/core/BaseMindooTenant.d.ts

@@ -33,6 +33,24 @@ export declare class BaseMindooTenant implements MindooTenant {
     private databaseCache;
     private directoryCache;
     private remoteStoreCache;
+    /**
+     * Cursor into the local KeyBag changes feed. Tracks the last event
+     * consumed by {@link reconcileKeyBagChanges} so we can replay only the
+     * deltas and stay idempotent across both live notifications and
+     * explicit reconcile calls.
+     */
+    private keyBagChangeCursor;
+    /**
+     * Disposer returned by {@link KeyBag.onChanges} for live notifications.
+     * `null` once the tenant has been torn down via {@link disposeCacheManager}.
+     */
+    private unsubscribeKeyBagChanges;
+    /**
+     * Single-flight latch for {@link reconcileKeyBagChanges}. Concurrent calls
+     * coalesce onto the same in-flight reconcile so live listener firings and
+     * explicit calls cannot race against each other or duplicate work.
+     */
+    private keyBagReconcilePromise;
     private decryptedTenantKeyCache?;
     private decryptedUserSigningKeyCache?;
     private decryptedUserEncryptionKeyCache?;
@@ -49,7 +67,21 @@ export declare class BaseMindooTenant implements MindooTenant {
      * Map value: true if trusted, false if explicitly revoked
      */
     private additionalTrustedKeys?;
-    constructor(factory: MindooTenantFactory, tenantId: string, administrationPublicKey: string, administrationEncryptionPublicKey: string, currentUser: PrivateUserId, currentUserPassword: string, keyBag: KeyBag, storeFactory: ContentAddressedStoreFactory, cryptoAdapter: CryptoAdapter, logger?: Logger, additionalTrustedKeys?: ReadonlyMap<string, boolean>, localCacheStore?: LocalCacheStore);
+    constructor(factory: MindooTenantFactory, tenantId: string, administrationPublicKey: string, administrationEncryptionPublicKey: string, currentUser: PrivateUserId, currentUserPassword: string, keyBag: KeyBag, storeFactory: ContentAddressedStoreFactory, cryptoAdapter: CryptoAdapter, logger?: Logger, additionalTrustedKeys?: ReadonlyMap<string, boolean>, localCacheStore?: LocalCacheStore, 
+    /**
+     * Optional pre-derived crypto material for the current user. When the
+     * caller has already decrypted the user's signing/encryption private
+     * keys (e.g. once at login) and/or derived the cache encryption key,
+     * passing them here skips the per-instance PBKDF2 + decrypt path. The
+     * `currentUserPassword` argument may then be empty and is never used
+     * downstream (as long as the requested key is already present in the
+     * cache).
+     */
+    preDecryptedMaterial?: {
+        signingKey?: CryptoKey;
+        encryptionKey?: CryptoKey;
+        cacheEncryptionKey?: CryptoKey;
+    });
     /**
      * Initialize the tenant.
      */
@@ -64,6 +96,7 @@ export declare class BaseMindooTenant implements MindooTenant {
      */
     disposeCacheManager(): Promise<void>;
     getCryptoAdapter(): CryptoAdapter;
+    private normalizeTimeTravelDate;
     getFactory(): MindooTenantFactory;
     getId(): string;
     /**
@@ -95,7 +128,30 @@ export declare class BaseMindooTenant implements MindooTenant {
     openDirectory(): Promise<MindooTenantDirectory>;
     private assertCurrentUserCanOpenDB;
     openDB(id: string, options?: OpenDBOptions): Promise<MindooDB>;
+    /**
+     * Replay any pending KeyBag mutations for this tenant and refresh open
+     * live databases so document visibility matches the current key set.
+     *
+     * Designed as the single barrier callers can `await` to be certain that
+     * subsequent reads observe the latest add/remove of doc keys. Behaviour:
+     *
+     *  - Idempotent and concurrency-safe. Concurrent callers share the same
+     *    in-flight reconcile via {@link keyBagReconcilePromise}, and a second
+     *    call after the cursor catches up is a fast no-op.
+     *  - Cursor-based. Replays from the persisted cursor in
+     *    {@link keyBagChangeCursor}, so missed live notifications are
+     *    automatically recovered.
+     *  - Tenant-scoped. Events for other tenants in a shared KeyBag are
+     *    consumed (the cursor still advances) but ignored.
+     *  - Invalidates the cached tenant default key when its add/remove was
+     *    observed, so the next encrypt/decrypt call re-reads the bag.
+     *  - Skips time-travel databases. Those views are immutable historical
+     *    cuts and never participate in visibility reconciliation.
+     */
+    reconcileKeyBagChanges(): Promise<void>;
     createDocSignerFor(signKey: SigningKeyPair): MindooDocSigner;
+    private exportJoinResponseDocKeyVersions;
+    private resolveJoinResponseDocKeyIds;
     /**
      * Approve a join request and produce a join response.
      */
@@ -171,6 +227,14 @@ export declare class BaseMindooTenant implements MindooTenant {
      * @returns true if the key can be resolved, false otherwise
      */
     hasDecryptionKey(decryptionKeyId: string): Promise<boolean>;
+    /**
+     * Stable fingerprint of the doc-type keys this tenant currently has
+     * access to, delegating to {@link KeyBag.getDocKeyFingerprint} scoped
+     * to this tenant. Persisted by {@link BaseMindooDB} alongside its cache
+     * checkpoint so warm starts can skip a full metadata scan when the
+     * KeyBag composition has not changed.
+     */
+    getDocKeyFingerprint(): Promise<string>;
     /**
      * Get the symmetric key for a given key ID.
      * This is a protected helper method that can be used by subclasses.

package/dist/core/BaseMindooTenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,WAAW,EACX,YAAY,EACZ,yBAAyB,EAEzB,sBAAsB,EAEvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAI3D,OAAO,EAAE,MAAM,EAAoC,MAAM,WAAW,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAGlF,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IAoCnC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAO1C,gBAAgB,IAAI,aAAa;IAIjC,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAIxC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAyHjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA4D1F,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBrD,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAoChB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwChG,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;YAQvC,0BAA0B;IA4BlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IAsDpE,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;IAQ5D;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IAmFtH;;;;;;OAMG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoGzF;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IAgEjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjE;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CAiDvB"}
+{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EAEzB,sBAAsB,EAEvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAI3D,OAAO,EAAE,MAAM,EAAoC,MAAM,WAAW,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAA8B;IAG5D,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;KAChC;IAwEH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa1C,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAIxC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAyHjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA4D1F,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBrD,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAoChB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwChG,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;YAQvC,0BAA0B;IA4BlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8EpE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmD7C,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAsC9C,OAAO,CAAC,4BAA4B;IA0BpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IAqEtH;;;;;;OAMG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoGzF;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IAkEjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CAiDvB"}

package/dist/core/BaseMindooTenant.js

@@ -12,6 +12,7 @@ const logging_1 = require("./logging");
 const MindooURI_1 = require("./uri/MindooURI");
 const EncryptedLocalCacheStore_1 = require("./cache/EncryptedLocalCacheStore");
 const CacheManager_1 = require("./cache/CacheManager");
+const databaseIdValidation_1 = require("./databaseIdValidation");
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
  * that works in both browser and server environments.
@@ -27,10 +28,38 @@ const CacheManager_1 = require("./cache/CacheManager");
  *   - PBKDF2 key derivation (for password-based key derivation)
  */
 class BaseMindooTenant {
-    constructor(factory, tenantId, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter, logger, additionalTrustedKeys, localCacheStore) {
+    constructor(factory, tenantId, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter, logger, additionalTrustedKeys, localCacheStore, 
+    /**
+     * Optional pre-derived crypto material for the current user. When the
+     * caller has already decrypted the user's signing/encryption private
+     * keys (e.g. once at login) and/or derived the cache encryption key,
+     * passing them here skips the per-instance PBKDF2 + decrypt path. The
+     * `currentUserPassword` argument may then be empty and is never used
+     * downstream (as long as the requested key is already present in the
+     * cache).
+     */
+    preDecryptedMaterial) {
         this.databaseCache = new Map();
         this.directoryCache = null;
         this.remoteStoreCache = new Map();
+        /**
+         * Cursor into the local KeyBag changes feed. Tracks the last event
+         * consumed by {@link reconcileKeyBagChanges} so we can replay only the
+         * deltas and stay idempotent across both live notifications and
+         * explicit reconcile calls.
+         */
+        this.keyBagChangeCursor = null;
+        /**
+         * Disposer returned by {@link KeyBag.onChanges} for live notifications.
+         * `null` once the tenant has been torn down via {@link disposeCacheManager}.
+         */
+        this.unsubscribeKeyBagChanges = null;
+        /**
+         * Single-flight latch for {@link reconcileKeyBagChanges}. Concurrent calls
+         * coalesce onto the same in-flight reconcile so live listener firings and
+         * explicit calls cannot race against each other or duplicate work.
+         */
+        this.keyBagReconcilePromise = null;
         // Local cache support
         this.cacheManager = null;
         this.factory = factory;
@@ -50,9 +79,44 @@ class BaseMindooTenant {
         this.logger =
             logger ||
                 new logging_1.MindooLogger((0, logging_1.getDefaultLogLevel)(), `Tenant:${tenantId}`, true);
-        // Set up cache if a local cache store is provided
+        // Hook the local KeyBag changes feed:
+        //  - Snapshot the cursor so any pre-existing key state is treated as
+        //    "already seen" and only future mutations trigger reconciliation.
+        //  - Subscribe to live events scoped to this tenant; missed events
+        //    are still recovered when callers invoke
+        //    {@link reconcileKeyBagChanges} explicitly (it replays from the
+        //    cursor regardless of whether the listener fired).
+        this.keyBagChangeCursor = this.keyBag.getLatestChangeCursor();
+        this.unsubscribeKeyBagChanges = this.keyBag.onChanges((event) => {
+            if (event.type !== "doc" || event.tenantId !== this.tenantId) {
+                return;
+            }
+            // Fire-and-forget: errors are surfaced via the reconcile path itself.
+            // We intentionally do not await here to keep the mutation call site
+            // synchronous from the listener's perspective.
+            void this.reconcileKeyBagChanges();
+        });
+        // Pre-warm the per-user CryptoKey caches so getDecryptedSigningKey()
+        // and getDecryptedEncryptionKey() never run PBKDF2 + decryptPrivateKey
+        // when the caller has already derived these keys at login.
+        if (preDecryptedMaterial?.signingKey) {
+            this.decryptedUserSigningKeyCache = preDecryptedMaterial.signingKey;
+        }
+        if (preDecryptedMaterial?.encryptionKey) {
+            this.decryptedUserEncryptionKeyCache = preDecryptedMaterial.encryptionKey;
+        }
+        // Set up cache if a local cache store is provided. When a pre-derived
+        // cache encryption key is available, prefer that to skip the password
+        // path and avoid retaining the plaintext password inside the encrypted
+        // cache wrapper.
         if (localCacheStore) {
-            const encryptedStore = new EncryptedLocalCacheStore_1.EncryptedLocalCacheStore(localCacheStore, currentUserPassword, this.cryptoAdapter, this.logger.createChild("EncryptedCache"));
+            const encryptedStore = preDecryptedMaterial?.cacheEncryptionKey
+                ? new EncryptedLocalCacheStore_1.EncryptedLocalCacheStore(localCacheStore, {
+                    cacheKey: preDecryptedMaterial.cacheEncryptionKey,
+                    cryptoAdapter: this.cryptoAdapter,
+                    logger: this.logger.createChild("EncryptedCache"),
+                })
+                : new EncryptedLocalCacheStore_1.EncryptedLocalCacheStore(localCacheStore, currentUserPassword, this.cryptoAdapter, this.logger.createChild("EncryptedCache"));
             this.cacheManager = new CacheManager_1.CacheManager(encryptedStore, undefined, this.logger.createChild("CacheManager"));
         }
     }
@@ -76,6 +140,12 @@ class BaseMindooTenant {
      * Should be called when the tenant is being closed.
      */
     async disposeCacheManager() {
+        // Unsubscribe from KeyBag changes alongside cache teardown. Callers
+        // already use `disposeCacheManager` as the "tenant is closing" signal,
+        // so this keeps lifecycle hooks in one place. Safe to call multiple
+        // times - the disposer is nulled out after the first call.
+        this.unsubscribeKeyBagChanges?.();
+        this.unsubscribeKeyBagChanges = null;
         if (this.cacheManager) {
             await this.cacheManager.dispose();
             this.cacheManager = null;
@@ -84,6 +154,16 @@ class BaseMindooTenant {
     getCryptoAdapter() {
         return this.cryptoAdapter;
     }
+    normalizeTimeTravelDate(value) {
+        if (value == null || value === "") {
+            return null;
+        }
+        const timestamp = value instanceof Date ? value.getTime() : typeof value === "number" ? value : Date.parse(value);
+        if (!Number.isFinite(timestamp)) {
+            throw new Error(`Invalid timeTravelDate: ${String(value)}`);
+        }
+        return timestamp;
+    }
     getFactory() {
         return this.factory;
     }
@@ -356,40 +436,171 @@ class BaseMindooTenant {
         throw new Error(`User "${currentUser.username}" does not have tenant access yet; the tenant admin must grant access first.`);
     }
     async openDB(id, options) {
+        const validDbId = (0, databaseIdValidation_1.validateDatabaseId)(id, "dbId");
         // Enforce admin-only mode for directory database - this is a security invariant
         // The directory database must only accept entries signed by the admin key
-        const effectiveOptions = id === "directory"
+        const effectiveOptions = validDbId === "directory"
             ? { ...options, adminOnlyDb: true }
             : options ?? {};
-        await this.assertCurrentUserCanOpenDB(id);
+        const normalizedTimeTravelDate = this.normalizeTimeTravelDate(effectiveOptions.timeTravelDate);
+        const databaseCacheKey = normalizedTimeTravelDate == null
+            ? validDbId
+            : `${validDbId}::tt:${normalizedTimeTravelDate}`;
+        await this.assertCurrentUserCanOpenDB(validDbId);
         // Return cached database if it exists
-        const cached = this.databaseCache.get(id);
+        const cached = this.databaseCache.get(databaseCacheKey);
         if (cached) {
             // For directory DB, verify admin-only flag matches (defensive check)
-            if (id === "directory" && !cached.isAdminOnlyDb()) {
+            if (validDbId === "directory" && !cached.isAdminOnlyDb()) {
                 throw new Error("Directory database was cached without adminOnlyDb - this should never happen");
             }
+            // Live databases must reflect the current KeyBag state before they
+            // are handed back to callers. Time-travel snapshots are immutable
+            // historical views and intentionally do not participate in
+            // visibility reconciliation, so we skip the call for them.
+            if (normalizedTimeTravelDate == null) {
+                await this.reconcileKeyBagChanges();
+            }
             return cached;
         }
         // Extract store options and DB-specific options
-        const { adminOnlyDb, attachmentConfig, documentCacheConfig, snapshotConfig, performanceCallback, ...storeOptions } = effectiveOptions;
-        // Create the database stores using the factory
-        const { docStore, attachmentStore } = this.storeFactory.createStore(id, storeOptions);
+        const { adminOnlyDb, timeTravelDate: _timeTravelDate, attachmentConfig, documentCacheConfig, snapshotConfig, performanceCallback, ...storeOptions } = effectiveOptions;
+        // Snapshot opens can share an already-open live store instance. This keeps
+        // in-memory factories usable while the snapshot DB maintains isolated state.
+        const liveDbForSnapshot = normalizedTimeTravelDate == null
+            ? null
+            : this.databaseCache.get(validDbId);
+        const { docStore, attachmentStore } = liveDbForSnapshot
+            ? {
+                docStore: liveDbForSnapshot.getStore(),
+                attachmentStore: liveDbForSnapshot.getAttachmentStore(),
+            }
+            : this.storeFactory.createStore(validDbId, storeOptions);
         const dbLogger = this.logger.createChild("BaseMindooDB");
-        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, documentCacheConfig, snapshotConfig, adminOnlyDb ?? false, dbLogger, performanceCallback);
-        if (this.cacheManager) {
+        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, documentCacheConfig, snapshotConfig, adminOnlyDb ?? false, dbLogger, performanceCallback, normalizedTimeTravelDate);
+        if (this.cacheManager && normalizedTimeTravelDate == null) {
             db.setCacheManager(this.cacheManager);
         }
         await db.initialize();
         // Cache the database for future use
-        this.databaseCache.set(id, db);
+        this.databaseCache.set(databaseCacheKey, db);
         return db;
     }
+    /**
+     * Replay any pending KeyBag mutations for this tenant and refresh open
+     * live databases so document visibility matches the current key set.
+     *
+     * Designed as the single barrier callers can `await` to be certain that
+     * subsequent reads observe the latest add/remove of doc keys. Behaviour:
+     *
+     *  - Idempotent and concurrency-safe. Concurrent callers share the same
+     *    in-flight reconcile via {@link keyBagReconcilePromise}, and a second
+     *    call after the cursor catches up is a fast no-op.
+     *  - Cursor-based. Replays from the persisted cursor in
+     *    {@link keyBagChangeCursor}, so missed live notifications are
+     *    automatically recovered.
+     *  - Tenant-scoped. Events for other tenants in a shared KeyBag are
+     *    consumed (the cursor still advances) but ignored.
+     *  - Invalidates the cached tenant default key when its add/remove was
+     *    observed, so the next encrypt/decrypt call re-reads the bag.
+     *  - Skips time-travel databases. Those views are immutable historical
+     *    cuts and never participate in visibility reconciliation.
+     */
+    async reconcileKeyBagChanges() {
+        if (this.keyBagReconcilePromise) {
+            return this.keyBagReconcilePromise;
+        }
+        this.keyBagReconcilePromise = (async () => {
+            let sawTenantDocKeyChange = false;
+            let latestCursor = this.keyBagChangeCursor;
+            // Consume every pending event so the cursor advances even for
+            // unrelated tenants sharing the same bag. We only need to react to
+            // doc keys for our own tenant though.
+            for await (const event of this.keyBag.iterateChangesSince(this.keyBagChangeCursor)) {
+                latestCursor = { changeSeq: event.changeSeq };
+                if (event.type !== "doc" || event.tenantId !== this.tenantId) {
+                    continue;
+                }
+                sawTenantDocKeyChange = true;
+                if (event.keyId === types_1.DEFAULT_TENANT_KEY_ID) {
+                    // The cached plaintext default key may now refer to a rotated
+                    // or removed version; drop it so the next access re-resolves.
+                    this.decryptedTenantKeyCache = undefined;
+                }
+            }
+            this.keyBagChangeCursor = latestCursor;
+            if (!sawTenantDocKeyChange) {
+                return;
+            }
+            // Notify every open live database; time-travel views are read-only
+            // historical snapshots and intentionally skip reconciliation.
+            for (const db of this.databaseCache.values()) {
+                if (db.isTimeTravelMode()) {
+                    continue;
+                }
+                const reconcile = db.reconcileKeyVisibility;
+                if (typeof reconcile === "function") {
+                    await reconcile.call(db);
+                }
+            }
+        })();
+        try {
+            await this.keyBagReconcilePromise;
+        }
+        finally {
+            this.keyBagReconcilePromise = null;
+        }
+    }
     createDocSignerFor(signKey) {
         this.logger.debug(`Creating MindooDocSigner for signing key pair`);
         const signerLogger = this.logger.createChild("MindooDocSigner");
         return new MindooDocSigner_1.MindooDocSigner(this, signKey, signerLogger);
     }
+    async exportJoinResponseDocKeyVersions(keyId, sharePassword) {
+        const scopedKeyId = `doc:${this.tenantId}:${keyId}`;
+        const details = (await this.keyBag.listKeyDetails())
+            .filter((detail) => detail.scopedKeyId === scopedKeyId)
+            .sort((a, b) => a.versionIndex - b.versionIndex);
+        if (details.length === 0) {
+            throw new Error(`Failed to export document key "${keyId}" for tenant "${this.tenantId}"`);
+        }
+        const versions = [];
+        for (const detail of details) {
+            const encryptedKey = await this.keyBag.encryptAndExportKeyVersion("doc", this.tenantId, keyId, detail.versionIndex, sharePassword);
+            if (!encryptedKey) {
+                throw new Error(`Failed to export document key "${keyId}" version ${detail.versionIndex} for tenant "${this.tenantId}"`);
+            }
+            const { createdAt: encryptedKeyCreatedAt, ...encryptedKeyPayload } = encryptedKey;
+            versions.push({
+                createdAt: detail.createdAt ?? encryptedKeyCreatedAt,
+                encryptedKey: encryptedKeyPayload,
+            });
+        }
+        return { keyId, versions };
+    }
+    resolveJoinResponseDocKeyIds(options) {
+        const requestedKeyIds = options.sharedDocKeyIds ?? [types_1.PUBLIC_INFOS_KEY_ID, types_1.DEFAULT_TENANT_KEY_ID];
+        const keyIds = new Set();
+        keyIds.add(types_1.PUBLIC_INFOS_KEY_ID);
+        for (const keyId of requestedKeyIds) {
+            const normalizedKeyId = keyId.trim();
+            if (normalizedKeyId) {
+                keyIds.add(normalizedKeyId);
+            }
+        }
+        return [
+            types_1.PUBLIC_INFOS_KEY_ID,
+            ...Array.from(keyIds)
+                .filter((keyId) => keyId !== types_1.PUBLIC_INFOS_KEY_ID)
+                .sort((a, b) => {
+                if (a === types_1.DEFAULT_TENANT_KEY_ID)
+                    return -1;
+                if (b === types_1.DEFAULT_TENANT_KEY_ID)
+                    return 1;
+                return a.localeCompare(b);
+            }),
+        ];
+    }
     async approveJoinRequest(joinRequest, options) {
         // Parse the join request if it's a URI string
         let request;
@@ -416,24 +627,17 @@ class BaseMindooTenant {
             userEncryptionPublicKey: request.encryptionPublicKey,
         };
         await directory.registerUser(publicUserId, options.adminSigningKey, options.adminPassword);
-        // 2. Export the tenant key encrypted with the share password
-        const encryptedTenantKey = await this.keyBag.encryptAndExportKey("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID, options.sharePassword);
-        if (!encryptedTenantKey) {
-            throw new Error(`Failed to export tenant key for tenant "${this.tenantId}"`);
-        }
-        // 3. Export the $publicinfos key encrypted with the share password
-        const encryptedPublicInfosKey = await this.keyBag.encryptAndExportKey("doc", this.tenantId, types_1.PUBLIC_INFOS_KEY_ID, options.sharePassword);
-        if (!encryptedPublicInfosKey) {
-            throw new Error(`Failed to export $publicinfos key`);
-        }
-        // 4. Build the join response
+        // 2. Export selected document keys encrypted with the share password.
+        // `$publicinfos` is mandatory because the joining user needs it for
+        // directory access; all selected key ids include every rotated version.
+        const encryptedDocKeys = await Promise.all(this.resolveJoinResponseDocKeyIds(options).map((keyId) => this.exportJoinResponseDocKeyVersions(keyId, options.sharePassword)));
+        // 3. Build the join response
         const joinResponse = {
-            v: 1,
+            v: 2,
             tenantId: this.tenantId,
             adminSigningPublicKey: this.administrationPublicKey,
             adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
-            encryptedTenantKey,
-            encryptedPublicInfosKey,
+            encryptedDocKeys,
         };
         if (options.serverUrl) {
             joinResponse.serverUrl = options.serverUrl;
@@ -580,13 +784,14 @@ class BaseMindooTenant {
      * Create a remote store connected to a MindooDB server, ready for sync.
      */
     async connectToServer(serverUrl, dbId, storeKind = types_1.StoreKind.docs) {
-        console.log(`[connectToServer] Connecting to server: ${serverUrl}, db: ${dbId}, storeKind: ${storeKind}`);
-        this.logger.info(`Connecting to server: ${serverUrl}, db: ${dbId}, storeKind: ${storeKind}`);
+        const validDbId = (0, databaseIdValidation_1.validateDatabaseId)(dbId, "dbId");
+        console.log(`[connectToServer] Connecting to server: ${serverUrl}, db: ${validDbId}, storeKind: ${storeKind}`);
+        this.logger.info(`Connecting to server: ${serverUrl}, db: ${validDbId}, storeKind: ${storeKind}`);
         const normalizedServerUrl = serverUrl.replace(/\/$/, "");
-        const cacheKey = `${normalizedServerUrl}::${dbId}::${storeKind}`;
+        const cacheKey = `${normalizedServerUrl}::${validDbId}::${storeKind}`;
         const cachedStore = this.remoteStoreCache.get(cacheKey);
         if (cachedStore) {
-            this.logger.debug(`Reusing cached remote store for ${normalizedServerUrl}, db: ${dbId}`);
+            this.logger.debug(`Reusing cached remote store for ${normalizedServerUrl}, db: ${validDbId}`);
             return cachedStore;
         }
         const remoteStorePromise = (async () => {
@@ -598,7 +803,7 @@ class BaseMindooTenant {
             const transport = new HttpTransport({
                 baseUrl,
                 tenantId: this.tenantId,
-                dbId,
+                dbId: validDbId,
                 storeKind,
             }, this.logger.createChild("HttpTransport"));
             // Get the current user's decrypted signing key
@@ -606,9 +811,9 @@ class BaseMindooTenant {
             // Get the current user's decrypted RSA encryption private key (for decrypting entries)
             const decryptedEncryptionKey = await this.getDecryptedEncryptionKey();
             // Create the client network store
-            const store = new ClientNetworkContentAddressedStore(dbId, storeKind, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${dbId}:${storeKind}`));
-            console.log(`[connectToServer] ✓ Connected to server for db "${dbId}"`);
-            this.logger.info(`Connected to server for db "${dbId}"`);
+            const store = new ClientNetworkContentAddressedStore(validDbId, storeKind, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${validDbId}:${storeKind}`));
+            console.log(`[connectToServer] ✓ Connected to server for db "${validDbId}"`);
+            this.logger.info(`Connected to server for db "${validDbId}"`);
             return store;
         })();
         this.remoteStoreCache.set(cacheKey, remoteStorePromise);
@@ -752,6 +957,16 @@ class BaseMindooTenant {
             throw error;
         }
     }
+    /**
+     * Stable fingerprint of the doc-type keys this tenant currently has
+     * access to, delegating to {@link KeyBag.getDocKeyFingerprint} scoped
+     * to this tenant. Persisted by {@link BaseMindooDB} alongside its cache
+     * checkpoint so warm starts can skip a full metadata scan when the
+     * KeyBag composition has not changed.
+     */
+    async getDocKeyFingerprint() {
+        return this.keyBag.getDocKeyFingerprint(this.tenantId);
+    }
     /**
      * Get the symmetric key for a given key ID.
      * This is a protected helper method that can be used by subclasses.