mindoodb 0.0.2 → 0.0.4

package/dist/core/BaseMindooTenant.js

@@ -1,11 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenant = void 0;
+const types_1 = require("./types");
 const BaseMindooDB_1 = require("./BaseMindooDB");
 const BaseMindooTenantDirectory_1 = require("./BaseMindooTenantDirectory");
 const MindooDocSigner_1 = require("./crypto/MindooDocSigner");
+const privateKeyEncryption_1 = require("./crypto/privateKeyEncryption");
 const errors_1 = require("./errors");
 const logging_1 = require("./logging");
+const MindooURI_1 = require("./uri/MindooURI");
+const EncryptedLocalCacheStore_1 = require("./cache/EncryptedLocalCacheStore");
+const CacheManager_1 = require("./cache/CacheManager");
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
  * that works in both browser and server environments.
@@ -21,19 +26,20 @@ const logging_1 = require("./logging");
  *   - PBKDF2 key derivation (for password-based key derivation)
  */
 class BaseMindooTenant {
-    constructor(factory, tenantId, tenantEncryptionKey, tenantEncryptionKeyPassword, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter, logger) {
+    constructor(factory, tenantId, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter, logger, additionalTrustedKeys, localCacheStore) {
         this.databaseCache = new Map();
         this.directoryCache = null;
+        // Local cache support
+        this.cacheManager = null;
         this.factory = factory;
         this.tenantId = tenantId;
-        this.tenantEncryptionKey = tenantEncryptionKey;
-        this.tenantEncryptionKeyPassword = tenantEncryptionKeyPassword;
         this.administrationPublicKey = administrationPublicKey;
         this.administrationEncryptionPublicKey = administrationEncryptionPublicKey;
         this.currentUser = currentUser;
         this.currentUserPassword = currentUserPassword;
         this.keyBag = keyBag;
         this.storeFactory = storeFactory;
+        this.additionalTrustedKeys = additionalTrustedKeys;
         // Import createCryptoAdapter dynamically to avoid issues in browser environments
         if (!cryptoAdapter) {
             const { createCryptoAdapter } = require("./crypto/CryptoAdapter");
@@ -46,6 +52,11 @@ class BaseMindooTenant {
         this.logger =
             logger ||
                 new logging_1.MindooLogger((0, logging_1.getDefaultLogLevel)(), `Tenant:${tenantId}`, true);
+        // Set up cache if a local cache store is provided
+        if (localCacheStore) {
+            const encryptedStore = new EncryptedLocalCacheStore_1.EncryptedLocalCacheStore(localCacheStore, currentUserPassword, this.cryptoAdapter, this.logger.createChild("EncryptedCache"));
+            this.cacheManager = new CacheManager_1.CacheManager(encryptedStore, undefined, this.logger.createChild("CacheManager"));
+        }
     }
     /**
      * Initialize the tenant.
@@ -56,6 +67,22 @@ class BaseMindooTenant {
         const keyCount = (await this.keyBag.listKeys()).length;
         this.logger.info(`Tenant initialized with ${keyCount} keys in KeyBag`);
     }
+    /**
+     * Get the CacheManager for this tenant (null if caching is disabled).
+     */
+    getCacheManager() {
+        return this.cacheManager;
+    }
+    /**
+     * Flush and dispose the cache manager.
+     * Should be called when the tenant is being closed.
+     */
+    async disposeCacheManager() {
+        if (this.cacheManager) {
+            await this.cacheManager.dispose();
+            this.cacheManager = null;
+        }
+    }
     getCryptoAdapter() {
         return this.cryptoAdapter;
     }
@@ -84,9 +111,6 @@ class BaseMindooTenant {
     getAdministrationEncryptionPublicKey() {
         return this.administrationEncryptionPublicKey;
     }
-    getTenantEncryptionKey() {
-        return this.tenantEncryptionKey;
-    }
     async encryptPayload(payload, decryptionKeyId) {
         this.logger.debug(`Encrypting payload with key: ${decryptionKeyId}`);
         this.logger.debug(`Payload size: ${payload.length} bytes`);
@@ -101,18 +125,20 @@ class BaseMindooTenant {
                     this.logger.debug(`Using cached tenant key, length: ${symmetricKey.length} bytes`);
                 }
                 else {
-                    this.logger.debug(`Decrypting tenant encryption key`);
-                    // Decrypt tenant encryption key
-                    const decrypted = await this.decryptPrivateKey(this.tenantEncryptionKey, this.tenantEncryptionKeyPassword, "default");
-                    symmetricKey = new Uint8Array(decrypted);
+                    this.logger.debug(`Resolving tenant encryption key from KeyBag`);
+                    const tenantKey = await this.keyBag.get("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID);
+                    if (!tenantKey) {
+                        throw new errors_1.SymmetricKeyNotFoundError(`doc:${this.tenantId}:${types_1.DEFAULT_TENANT_KEY_ID}`);
+                    }
+                    symmetricKey = tenantKey;
                     this.decryptedTenantKeyCache = symmetricKey;
-                    this.logger.debug(`Decrypted tenant key, length: ${symmetricKey.length} bytes`);
+                    this.logger.debug(`Loaded tenant key from KeyBag, length: ${symmetricKey.length} bytes`);
                 }
             }
             else {
                 this.logger.debug(`Getting named key from KeyBag: ${decryptionKeyId}`);
                 // Get the decrypted key from KeyBag
-                const decryptedKey = await this.keyBag.get(decryptionKeyId);
+                const decryptedKey = await this.keyBag.get("doc", this.tenantId, decryptionKeyId);
                 if (!decryptedKey) {
                     throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
                 }
@@ -210,15 +236,17 @@ class BaseMindooTenant {
                 symmetricKey = this.decryptedTenantKeyCache;
             }
             else {
-                // Decrypt tenant encryption key
-                const decrypted = await this.decryptPrivateKey(this.tenantEncryptionKey, this.tenantEncryptionKeyPassword, "default");
-                symmetricKey = new Uint8Array(decrypted);
+                const tenantKey = await this.keyBag.get("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID);
+                if (!tenantKey) {
+                    throw new errors_1.SymmetricKeyNotFoundError(`doc:${this.tenantId}:${types_1.DEFAULT_TENANT_KEY_ID}`);
+                }
+                symmetricKey = tenantKey;
                 this.decryptedTenantKeyCache = symmetricKey;
             }
         }
         else {
             // Get the decrypted key from KeyBag
-            const decryptedKey = await this.keyBag.get(decryptionKeyId);
+            const decryptedKey = await this.keyBag.get("doc", this.tenantId, decryptionKeyId);
             if (!decryptedKey) {
                 throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
             }
@@ -306,11 +334,17 @@ class BaseMindooTenant {
         // Convert PrivateUserId to PublicUserId
         return {
             username: this.currentUser.username,
-            administrationSignature: this.currentUser.administrationSignature,
             userSigningPublicKey: this.currentUser.userSigningKeyPair.publicKey,
             userEncryptionPublicKey: this.currentUser.userEncryptionKeyPair.publicKey,
         };
     }
+    /**
+     * Get the additional trusted signing keys map, if configured.
+     * Used by BaseMindooTenantDirectory to check keys before the directory DB.
+     */
+    getAdditionalTrustedKeys() {
+        return this.additionalTrustedKeys;
+    }
     async openDirectory() {
         if (!this.directoryCache) {
             const directoryLogger = this.logger.createChild("Directory");
@@ -318,12 +352,31 @@ class BaseMindooTenant {
         }
         return this.directoryCache;
     }
+    async assertCurrentUserCanOpenDB(id) {
+        if (id === "directory") {
+            return;
+        }
+        const currentUser = await this.getCurrentUserId();
+        if (currentUser.userSigningPublicKey === this.getAdministrationPublicKey()) {
+            return;
+        }
+        const directory = await this.openDirectory();
+        const registeredUser = await directory.getUserPublicKeys(currentUser.username);
+        const hasMatchingGrant = registeredUser?.signingPublicKey === currentUser.userSigningPublicKey &&
+            registeredUser?.encryptionPublicKey === currentUser.userEncryptionPublicKey;
+        if (hasMatchingGrant) {
+            return;
+        }
+        this.logger.warn(`Denied database open for ungranted user ${currentUser.username} on database ${id}`);
+        throw new Error(`User "${currentUser.username}" does not have tenant access yet; the tenant admin must grant access first.`);
+    }
     async openDB(id, options) {
         // Enforce admin-only mode for directory database - this is a security invariant
         // The directory database must only accept entries signed by the admin key
         const effectiveOptions = id === "directory"
             ? { ...options, adminOnlyDb: true }
             : options ?? {};
+        await this.assertCurrentUserCanOpenDB(id);
         // Return cached database if it exists
         const cached = this.databaseCache.get(id);
         if (cached) {
@@ -334,11 +387,14 @@ class BaseMindooTenant {
             return cached;
         }
         // Extract store options and DB-specific options
-        const { adminOnlyDb, attachmentConfig, ...storeOptions } = effectiveOptions;
+        const { adminOnlyDb, attachmentConfig, documentCacheConfig, snapshotConfig, performanceCallback, ...storeOptions } = effectiveOptions;
         // Create the database stores using the factory
         const { docStore, attachmentStore } = this.storeFactory.createStore(id, storeOptions);
         const dbLogger = this.logger.createChild("BaseMindooDB");
-        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, adminOnlyDb ?? false, dbLogger);
+        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, documentCacheConfig, snapshotConfig, adminOnlyDb ?? false, dbLogger, performanceCallback);
+        if (this.cacheManager) {
+            db.setCacheManager(this.cacheManager);
+        }
         await db.initialize();
         // Cache the database for future use
         this.databaseCache.set(id, db);
@@ -349,8 +405,189 @@ class BaseMindooTenant {
         const signerLogger = this.logger.createChild("MindooDocSigner");
         return new MindooDocSigner_1.MindooDocSigner(this, signKey, signerLogger);
     }
+    async approveJoinRequest(joinRequest, options) {
+        // Parse the join request if it's a URI string
+        let request;
+        if (typeof joinRequest === "string") {
+            if (!(0, MindooURI_1.isMindooURI)(joinRequest)) {
+                throw new Error("Invalid join request: expected a JoinRequest object or a mdb://join-request/... URI string");
+            }
+            const decoded = (0, MindooURI_1.decodeMindooURI)(joinRequest);
+            if (decoded.type !== "join-request") {
+                throw new Error(`Invalid URI type: expected "join-request", got "${decoded.type}"`);
+            }
+            request = decoded.payload;
+        }
+        else {
+            request = joinRequest;
+        }
+        console.log(`[approveJoinRequest] Approving join request for user "${request.username}"`);
+        this.logger.info(`Approving join request for user: ${request.username}`);
+        // 1. Register the user in the directory
+        const directory = await this.openDirectory();
+        const publicUserId = {
+            username: request.username,
+            userSigningPublicKey: request.signingPublicKey,
+            userEncryptionPublicKey: request.encryptionPublicKey,
+        };
+        await directory.registerUser(publicUserId, options.adminSigningKey, options.adminPassword);
+        // 2. Export the tenant key encrypted with the share password
+        const encryptedTenantKey = await this.keyBag.encryptAndExportKey("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID, options.sharePassword);
+        if (!encryptedTenantKey) {
+            throw new Error(`Failed to export tenant key for tenant "${this.tenantId}"`);
+        }
+        // 3. Export the $publicinfos key encrypted with the share password
+        const encryptedPublicInfosKey = await this.keyBag.encryptAndExportKey("doc", this.tenantId, types_1.PUBLIC_INFOS_KEY_ID, options.sharePassword);
+        if (!encryptedPublicInfosKey) {
+            throw new Error(`Failed to export $publicinfos key`);
+        }
+        // 4. Build the join response
+        const joinResponse = {
+            v: 1,
+            tenantId: this.tenantId,
+            adminSigningPublicKey: this.administrationPublicKey,
+            adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
+            encryptedTenantKey,
+            encryptedPublicInfosKey,
+        };
+        if (options.serverUrl) {
+            joinResponse.serverUrl = options.serverUrl;
+        }
+        console.log(`[approveJoinRequest] ✓ Join request approved for user "${request.username}"`);
+        this.logger.info(`Join request approved for user: ${request.username}`);
+        // Return as URI string or object depending on format option
+        if (options.format === "uri") {
+            return (0, MindooURI_1.encodeMindooURI)("join-response", joinResponse);
+        }
+        return joinResponse;
+    }
+    /**
+     * Publish (register) this tenant on a MindooDB server.
+     *
+     * When `systemAdminUser` + `systemAdminPassword` are provided the method
+     * performs a challenge/response handshake against `/system/auth/*` to
+     * obtain a JWT, then calls `POST /system/tenants/:tenantId`.
+     */
+    async publishToServer(serverUrl, options) {
+        console.log(`[publishToServer] Publishing tenant "${this.tenantId}" to server: ${serverUrl}`);
+        this.logger.info(`Publishing tenant "${this.tenantId}" to server: ${serverUrl}`);
+        const baseUrl = serverUrl.replace(/\/$/, "");
+        // Export the $publicinfos key so the server can read the directory DB
+        const publicInfosKeyBytes = await this.keyBag.get("doc", this.tenantId, types_1.PUBLIC_INFOS_KEY_ID);
+        if (!publicInfosKeyBytes) {
+            throw new Error(`Cannot publish to server: $publicinfos key not found in KeyBag`);
+        }
+        const publicInfosKeyBase64 = this.uint8ArrayToBase64(publicInfosKeyBytes);
+        // Build the registration request body
+        const requestBody = {
+            adminSigningPublicKey: this.administrationPublicKey,
+            adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
+            publicInfosKey: publicInfosKeyBase64,
+        };
+        if (options?.adminUsername) {
+            requestBody.adminUsername = options.adminUsername;
+        }
+        // Add users if provided
+        if (options?.registerUsers && options.registerUsers.length > 0) {
+            requestBody.users = options.registerUsers.map((u) => ({
+                username: u.username,
+                signingPublicKey: u.userSigningPublicKey,
+                encryptionPublicKey: u.userEncryptionPublicKey,
+            }));
+        }
+        // Authenticate as system admin via challenge/response
+        const headers = {
+            "Content-Type": "application/json",
+        };
+        if (options?.systemAdminUser && options?.systemAdminPassword) {
+            const token = await this.authenticateAsSystemAdmin(baseUrl, options.systemAdminUser, options.systemAdminPassword);
+            headers["Authorization"] = `Bearer ${token}`;
+        }
+        // POST to /system/tenants/:tenantId
+        const url = `${baseUrl}/system/tenants/${encodeURIComponent(this.tenantId)}`;
+        const response = await fetch(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(requestBody),
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Failed to publish tenant to server (HTTP ${response.status}): ${errorBody}`);
+        }
+        console.log(`[publishToServer] ✓ Tenant "${this.tenantId}" published to server successfully`);
+        this.logger.info(`Tenant "${this.tenantId}" published to server successfully`);
+    }
+    /**
+     * Perform system admin challenge/response auth and return a JWT token.
+     */
+    async authenticateAsSystemAdmin(baseUrl, adminUser, adminPassword) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        // Decrypt the admin's signing private key
+        const signingKeyBuffer = await this.decryptPrivateKey(adminUser.userSigningKeyPair.privateKey, adminPassword, "signing");
+        const signingKey = await subtle.importKey("pkcs8", signingKeyBuffer, { name: "Ed25519" }, false, ["sign"]);
+        // Step 1: Request challenge from server
+        const challengeRes = await fetch(`${baseUrl}/system/auth/challenge`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                username: adminUser.username,
+                publicsignkey: adminUser.userSigningKeyPair.publicKey,
+            }),
+        });
+        if (!challengeRes.ok) {
+            const errorBody = await challengeRes.text();
+            throw new Error(`System admin challenge failed (HTTP ${challengeRes.status}): ${errorBody}`);
+        }
+        const { challenge } = (await challengeRes.json());
+        // Step 2: Sign the challenge
+        const messageBytes = new TextEncoder().encode(challenge);
+        const signatureBuffer = await subtle.sign({ name: "Ed25519" }, signingKey, messageBytes);
+        const signatureBase64 = this.uint8ArrayToBase64(new Uint8Array(signatureBuffer));
+        // Step 3: Authenticate
+        const authRes = await fetch(`${baseUrl}/system/auth/authenticate`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ challenge, signature: signatureBase64 }),
+        });
+        if (!authRes.ok) {
+            const errorBody = await authRes.text();
+            throw new Error(`System admin authentication failed (HTTP ${authRes.status}): ${errorBody}`);
+        }
+        const result = (await authRes.json());
+        if (!result.success || !result.token) {
+            throw new Error(`System admin authentication failed: ${result.error || "unknown error"}`);
+        }
+        return result.token;
+    }
+    /**
+     * Create a remote store connected to a MindooDB server, ready for sync.
+     */
+    async connectToServer(serverUrl, dbId) {
+        console.log(`[connectToServer] Connecting to server: ${serverUrl}, db: ${dbId}`);
+        this.logger.info(`Connecting to server: ${serverUrl}, db: ${dbId}`);
+        // Lazy-import network modules to avoid circular dependencies and keep core lightweight
+        const { HttpTransport } = await import("../appendonlystores/network/HttpTransport.js");
+        const { ClientNetworkContentAddressedStore } = await import("../appendonlystores/network/ClientNetworkContentAddressedStore.js");
+        // Create the HTTP transport
+        const baseUrl = `${serverUrl.replace(/\/$/, "")}/${this.tenantId}`;
+        const transport = new HttpTransport({
+            baseUrl,
+            tenantId: this.tenantId,
+            dbId,
+        }, this.logger.createChild("HttpTransport"));
+        // Get the current user's decrypted signing key
+        const signingKey = await this.getDecryptedSigningKey();
+        // Get the current user's decrypted RSA encryption private key (for decrypting entries)
+        const decryptedEncryptionKey = await this.getDecryptedEncryptionKey();
+        // Create the client network store
+        const store = new ClientNetworkContentAddressedStore(dbId, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${dbId}`));
+        console.log(`[connectToServer] ✓ Connected to server for db "${dbId}"`);
+        this.logger.info(`Connected to server for db "${dbId}"`);
+        return store;
+    }
     /**
      * Internal method to get the decrypted signing key for the current user.
+     * Protected so that connectToServer() helper and subclasses can access it.
      */
     async getDecryptedSigningKey() {
         // Use cached signing key if available
@@ -368,6 +605,23 @@ class BaseMindooTenant {
         this.decryptedUserSigningKeyCache = cryptoKey;
         return cryptoKey;
     }
+    /**
+     * Internal method to get the decrypted RSA encryption private key for the current user.
+     * Used by connectToServer() to create the network store.
+     */
+    async getDecryptedEncryptionKey() {
+        if (this.decryptedUserEncryptionKeyCache) {
+            return this.decryptedUserEncryptionKeyCache;
+        }
+        const decryptedKeyBuffer = await this.decryptPrivateKey(this.currentUser.userEncryptionKeyPair.privateKey, this.currentUserPassword, "encryption");
+        const subtle = this.cryptoAdapter.getSubtle();
+        const cryptoKey = await subtle.importKey("pkcs8", decryptedKeyBuffer, {
+            name: "RSA-OAEP",
+            hash: "SHA-256",
+        }, false, ["decrypt"]);
+        this.decryptedUserEncryptionKeyCache = cryptoKey;
+        return cryptoKey;
+    }
     /**
      * Internal method to decrypt a private key using password-based key derivation.
      * Protected so that BaseMindooTenantDirectory can access it.
@@ -382,104 +636,22 @@ class BaseMindooTenant {
         this.logger.debug(`decryptPrivateKey: Starting decryption with saltString: ${saltString}`);
         this.logger.debug(`decryptPrivateKey: Password length: ${password.length}`);
         this.logger.debug(`decryptPrivateKey: EncryptedKey iterations: ${encryptedKey.iterations}`);
-        const subtle = this.cryptoAdapter.getSubtle();
-        // Decode base64 strings
-        this.logger.debug(`decryptPrivateKey: Decoding base64 strings`);
-        let ciphertext;
-        let iv;
-        let tag;
-        let saltBytes;
+        this.logger.debug(`decryptPrivateKey: Delegating PBKDF2 + AES-GCM work to shared helper`);
         try {
-            ciphertext = this.base64ToUint8Array(encryptedKey.ciphertext);
-            iv = this.base64ToUint8Array(encryptedKey.iv);
-            tag = this.base64ToUint8Array(encryptedKey.tag);
-            saltBytes = this.base64ToUint8Array(encryptedKey.salt);
-            this.logger.debug(`decryptPrivateKey: Decoded - ciphertext: ${ciphertext.length} bytes, iv: ${iv.length} bytes, tag: ${tag.length} bytes, salt: ${saltBytes.length} bytes`);
-        }
-        catch (error) {
-            this.logger.error(`decryptPrivateKey: Error decoding base64:`, error);
-            throw error;
-        }
-        // Derive key from password using PBKDF2
-        // Combine the stored salt bytes with the salt string for additional security
-        // This ensures different key types (signing, encryption, etc.) use different derived keys
-        // even if they share the same password
-        this.logger.debug(`decryptPrivateKey: Combining salt with saltString`);
-        const saltStringBytes = new TextEncoder().encode(saltString);
-        const combinedSalt = new Uint8Array(saltBytes.length + saltStringBytes.length);
-        combinedSalt.set(saltBytes);
-        combinedSalt.set(saltStringBytes, saltBytes.length);
-        this.logger.debug(`decryptPrivateKey: Combined salt length: ${combinedSalt.length} bytes`);
-        this.logger.debug(`decryptPrivateKey: Importing password key for PBKDF2`);
-        let passwordKey;
-        try {
-            passwordKey = await subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits", "deriveKey"]);
-            this.logger.debug(`decryptPrivateKey: Successfully imported password key`);
-        }
-        catch (error) {
-            this.logger.error(`decryptPrivateKey: Error importing password key:`, error);
-            throw error;
-        }
-        this.logger.debug(`decryptPrivateKey: Deriving key with PBKDF2 (iterations: ${encryptedKey.iterations})`);
-        let derivedKey;
-        try {
-            derivedKey = await subtle.deriveKey({
-                name: "PBKDF2",
-                salt: combinedSalt,
-                iterations: encryptedKey.iterations,
-                hash: "SHA-256",
-            }, passwordKey, {
-                name: "AES-GCM",
-                length: 256,
-            }, false, ["decrypt"]);
-            this.logger.debug(`decryptPrivateKey: Successfully derived key`);
-        }
-        catch (error) {
-            this.logger.error(`decryptPrivateKey: Error deriving key:`, error);
-            throw error;
-        }
-        // Combine ciphertext and tag (GCM authentication tag is separate)
-        // AES-GCM expects the tag to be appended to the ciphertext
-        this.logger.debug(`decryptPrivateKey: Combining ciphertext and tag`);
-        const encryptedData = new Uint8Array(ciphertext.length + tag.length);
-        encryptedData.set(ciphertext);
-        encryptedData.set(tag, ciphertext.length);
-        this.logger.debug(`decryptPrivateKey: Combined encrypted data length: ${encryptedData.length} bytes`);
-        // Decrypt the private key
-        this.logger.debug(`decryptPrivateKey: Decrypting with AES-GCM`);
-        this.logger.debug(`decryptPrivateKey: IV length: ${iv.length} bytes (expected: 12 for AES-GCM)`);
-        this.logger.debug(`decryptPrivateKey: Tag length: ${tag.length} bytes (expected: 16 for 128-bit tag)`);
-        this.logger.debug(`decryptPrivateKey: Ciphertext length: ${ciphertext.length} bytes`);
-        let decrypted;
-        try {
-            // Create a new ArrayBuffer to ensure we have the correct buffer without any offset issues
-            const encryptedBuffer = new Uint8Array(encryptedData).buffer;
-            this.logger.debug(`decryptPrivateKey: Encrypted buffer size: ${encryptedBuffer.byteLength} bytes`);
-            decrypted = await subtle.decrypt({
-                name: "AES-GCM",
-                iv: new Uint8Array(iv), // Create a new Uint8Array to ensure proper buffer
-                tagLength: 128,
-            }, derivedKey, encryptedBuffer);
+            const decrypted = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, encryptedKey, password, saltString);
             this.logger.debug(`decryptPrivateKey: Successfully decrypted, result length: ${decrypted.byteLength} bytes`);
+            return decrypted;
         }
         catch (error) {
             this.logger.error(`decryptPrivateKey: Error during decryption:`, error);
             this.logger.error(`decryptPrivateKey: Error details:`, {
                 errorName: error instanceof Error ? error.name : typeof error,
                 errorMessage: error instanceof Error ? error.message : String(error),
-                ivLength: iv.length,
-                tagLength: tag.length,
-                ciphertextLength: ciphertext.length,
-                encryptedDataLength: encryptedData.length,
                 iterations: encryptedKey.iterations,
-                saltString: saltString,
-                encryptedDataByteOffset: encryptedData.byteOffset,
-                encryptedDataByteLength: encryptedData.byteLength,
-                encryptedDataBufferLength: encryptedData.buffer.byteLength,
+                saltString,
             });
             throw error;
         }
-        return decrypted;
     }
     /**
      * Helper method to convert base64 string to Uint8Array
@@ -526,6 +698,25 @@ class BaseMindooTenant {
         }
         return bytes.buffer;
     }
+    /**
+     * Check whether the symmetric key for the given key ID is available in the KeyBag.
+     * This is a lightweight probe that does not perform any crypto operations.
+     *
+     * @param decryptionKeyId The key ID ("default" or a named key ID)
+     * @returns true if the key can be resolved, false otherwise
+     */
+    async hasDecryptionKey(decryptionKeyId) {
+        try {
+            await this.getSymmetricKey(decryptionKeyId);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof errors_1.SymmetricKeyNotFoundError) {
+                return false;
+            }
+            throw error;
+        }
+    }
     /**
      * Get the symmetric key for a given key ID.
      * This is a protected helper method that can be used by subclasses.
@@ -539,15 +730,17 @@ class BaseMindooTenant {
             if (this.decryptedTenantKeyCache) {
                 return this.decryptedTenantKeyCache;
             }
-            // Decrypt tenant encryption key
-            const decrypted = await this.decryptPrivateKey(this.tenantEncryptionKey, this.tenantEncryptionKeyPassword, "default");
-            const symmetricKey = new Uint8Array(decrypted);
+            const tenantKey = await this.keyBag.get("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID);
+            if (!tenantKey) {
+                throw new errors_1.SymmetricKeyNotFoundError(`doc:${this.tenantId}:${types_1.DEFAULT_TENANT_KEY_ID}`);
+            }
+            const symmetricKey = tenantKey;
             this.decryptedTenantKeyCache = symmetricKey;
             return symmetricKey;
         }
         else {
             // Get the decrypted key from KeyBag
-            const decryptedKey = await this.keyBag.get(decryptionKeyId);
+            const decryptedKey = await this.keyBag.get("doc", this.tenantId, decryptionKeyId);
             if (!decryptedKey) {
                 throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
             }