mindoodb 0.0.3 → 0.0.5

package/dist/core/BaseMindooTenant.js

@@ -5,9 +5,13 @@ const types_1 = require("./types");
 const BaseMindooDB_1 = require("./BaseMindooDB");
 const BaseMindooTenantDirectory_1 = require("./BaseMindooTenantDirectory");
 const MindooDocSigner_1 = require("./crypto/MindooDocSigner");
+const RSAEncryption_1 = require("./crypto/RSAEncryption");
+const privateKeyEncryption_1 = require("./crypto/privateKeyEncryption");
 const errors_1 = require("./errors");
 const logging_1 = require("./logging");
 const MindooURI_1 = require("./uri/MindooURI");
+const EncryptedLocalCacheStore_1 = require("./cache/EncryptedLocalCacheStore");
+const CacheManager_1 = require("./cache/CacheManager");
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
  * that works in both browser and server environments.
@@ -23,9 +27,12 @@ const MindooURI_1 = require("./uri/MindooURI");
  *   - PBKDF2 key derivation (for password-based key derivation)
  */
 class BaseMindooTenant {
-    constructor(factory, tenantId, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter, logger, additionalTrustedKeys) {
+    constructor(factory, tenantId, administrationPublicKey, administrationEncryptionPublicKey, currentUser, currentUserPassword, keyBag, storeFactory, cryptoAdapter, logger, additionalTrustedKeys, localCacheStore) {
         this.databaseCache = new Map();
         this.directoryCache = null;
+        this.remoteStoreCache = new Map();
+        // Local cache support
+        this.cacheManager = null;
         this.factory = factory;
         this.tenantId = tenantId;
         this.administrationPublicKey = administrationPublicKey;
@@ -47,6 +54,11 @@ class BaseMindooTenant {
         this.logger =
             logger ||
                 new logging_1.MindooLogger((0, logging_1.getDefaultLogLevel)(), `Tenant:${tenantId}`, true);
+        // Set up cache if a local cache store is provided
+        if (localCacheStore) {
+            const encryptedStore = new EncryptedLocalCacheStore_1.EncryptedLocalCacheStore(localCacheStore, currentUserPassword, this.cryptoAdapter, this.logger.createChild("EncryptedCache"));
+            this.cacheManager = new CacheManager_1.CacheManager(encryptedStore, undefined, this.logger.createChild("CacheManager"));
+        }
     }
     /**
      * Initialize the tenant.
@@ -57,6 +69,22 @@ class BaseMindooTenant {
         const keyCount = (await this.keyBag.listKeys()).length;
         this.logger.info(`Tenant initialized with ${keyCount} keys in KeyBag`);
     }
+    /**
+     * Get the CacheManager for this tenant (null if caching is disabled).
+     */
+    getCacheManager() {
+        return this.cacheManager;
+    }
+    /**
+     * Flush and dispose the cache manager.
+     * Should be called when the tenant is being closed.
+     */
+    async disposeCacheManager() {
+        if (this.cacheManager) {
+            await this.cacheManager.dispose();
+            this.cacheManager = null;
+        }
+    }
     getCryptoAdapter() {
         return this.cryptoAdapter;
     }
@@ -100,9 +128,9 @@ class BaseMindooTenant {
                 }
                 else {
                     this.logger.debug(`Resolving tenant encryption key from KeyBag`);
-                    const tenantKey = await this.keyBag.get("tenant", this.tenantId);
+                    const tenantKey = await this.keyBag.get("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID);
                     if (!tenantKey) {
-                        throw new errors_1.SymmetricKeyNotFoundError(`tenant:${this.tenantId}`);
+                        throw new errors_1.SymmetricKeyNotFoundError(`doc:${this.tenantId}:${types_1.DEFAULT_TENANT_KEY_ID}`);
                     }
                     symmetricKey = tenantKey;
                     this.decryptedTenantKeyCache = symmetricKey;
@@ -112,7 +140,7 @@ class BaseMindooTenant {
             else {
                 this.logger.debug(`Getting named key from KeyBag: ${decryptionKeyId}`);
                 // Get the decrypted key from KeyBag
-                const decryptedKey = await this.keyBag.get("doc", decryptionKeyId);
+                const decryptedKey = await this.keyBag.get("doc", this.tenantId, decryptionKeyId);
                 if (!decryptedKey) {
                     throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
                 }
@@ -210,9 +238,9 @@ class BaseMindooTenant {
                 symmetricKey = this.decryptedTenantKeyCache;
             }
             else {
-                const tenantKey = await this.keyBag.get("tenant", this.tenantId);
+                const tenantKey = await this.keyBag.get("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID);
                 if (!tenantKey) {
-                    throw new errors_1.SymmetricKeyNotFoundError(`tenant:${this.tenantId}`);
+                    throw new errors_1.SymmetricKeyNotFoundError(`doc:${this.tenantId}:${types_1.DEFAULT_TENANT_KEY_ID}`);
                 }
                 symmetricKey = tenantKey;
                 this.decryptedTenantKeyCache = symmetricKey;
@@ -220,7 +248,7 @@ class BaseMindooTenant {
         }
         else {
             // Get the decrypted key from KeyBag
-            const decryptedKey = await this.keyBag.get("doc", decryptionKeyId);
+            const decryptedKey = await this.keyBag.get("doc", this.tenantId, decryptionKeyId);
             if (!decryptedKey) {
                 throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
             }
@@ -326,12 +354,31 @@ class BaseMindooTenant {
         }
         return this.directoryCache;
     }
+    async assertCurrentUserCanOpenDB(id) {
+        if (id === "directory") {
+            return;
+        }
+        const currentUser = await this.getCurrentUserId();
+        if (currentUser.userSigningPublicKey === this.getAdministrationPublicKey()) {
+            return;
+        }
+        const directory = await this.openDirectory();
+        const registeredUser = await directory.getUserPublicKeys(currentUser.username);
+        const hasMatchingGrant = registeredUser?.signingPublicKey === currentUser.userSigningPublicKey &&
+            registeredUser?.encryptionPublicKey === currentUser.userEncryptionPublicKey;
+        if (hasMatchingGrant) {
+            return;
+        }
+        this.logger.warn(`Denied database open for ungranted user ${currentUser.username} on database ${id}`);
+        throw new Error(`User "${currentUser.username}" does not have tenant access yet; the tenant admin must grant access first.`);
+    }
     async openDB(id, options) {
         // Enforce admin-only mode for directory database - this is a security invariant
         // The directory database must only accept entries signed by the admin key
         const effectiveOptions = id === "directory"
             ? { ...options, adminOnlyDb: true }
             : options ?? {};
+        await this.assertCurrentUserCanOpenDB(id);
         // Return cached database if it exists
         const cached = this.databaseCache.get(id);
         if (cached) {
@@ -342,11 +389,14 @@ class BaseMindooTenant {
             return cached;
         }
         // Extract store options and DB-specific options
-        const { adminOnlyDb, attachmentConfig, ...storeOptions } = effectiveOptions;
+        const { adminOnlyDb, attachmentConfig, documentCacheConfig, snapshotConfig, performanceCallback, ...storeOptions } = effectiveOptions;
         // Create the database stores using the factory
         const { docStore, attachmentStore } = this.storeFactory.createStore(id, storeOptions);
         const dbLogger = this.logger.createChild("BaseMindooDB");
-        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, adminOnlyDb ?? false, dbLogger);
+        const db = new BaseMindooDB_1.BaseMindooDB(this, docStore, attachmentStore, attachmentConfig, documentCacheConfig, snapshotConfig, adminOnlyDb ?? false, dbLogger, performanceCallback);
+        if (this.cacheManager) {
+            db.setCacheManager(this.cacheManager);
+        }
         await db.initialize();
         // Cache the database for future use
         this.databaseCache.set(id, db);
@@ -384,12 +434,12 @@ class BaseMindooTenant {
         };
         await directory.registerUser(publicUserId, options.adminSigningKey, options.adminPassword);
         // 2. Export the tenant key encrypted with the share password
-        const encryptedTenantKey = await this.keyBag.encryptAndExportKey("tenant", this.tenantId, options.sharePassword);
+        const encryptedTenantKey = await this.keyBag.encryptAndExportKey("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID, options.sharePassword);
         if (!encryptedTenantKey) {
             throw new Error(`Failed to export tenant key for tenant "${this.tenantId}"`);
         }
         // 3. Export the $publicinfos key encrypted with the share password
-        const encryptedPublicInfosKey = await this.keyBag.encryptAndExportKey("doc", types_1.PUBLIC_INFOS_KEY_ID, options.sharePassword);
+        const encryptedPublicInfosKey = await this.keyBag.encryptAndExportKey("doc", this.tenantId, types_1.PUBLIC_INFOS_KEY_ID, options.sharePassword);
         if (!encryptedPublicInfosKey) {
             throw new Error(`Failed to export $publicinfos key`);
         }
@@ -415,23 +465,59 @@ class BaseMindooTenant {
     }
     /**
      * Publish (register) this tenant on a MindooDB server.
+     *
+     * When `systemAdminUser` + `systemAdminPassword` are provided the method
+     * performs a challenge/response handshake against `/system/auth/*` to
+     * obtain a JWT, then calls `POST /system/tenants/:tenantId`.
      */
     async publishToServer(serverUrl, options) {
         console.log(`[publishToServer] Publishing tenant "${this.tenantId}" to server: ${serverUrl}`);
         this.logger.info(`Publishing tenant "${this.tenantId}" to server: ${serverUrl}`);
+        const baseUrl = serverUrl.replace(/\/$/, "");
         // Export the $publicinfos key so the server can read the directory DB
-        const publicInfosKeyBytes = await this.keyBag.get("doc", types_1.PUBLIC_INFOS_KEY_ID);
+        const publicInfosKeyBytes = await this.keyBag.get("doc", this.tenantId, types_1.PUBLIC_INFOS_KEY_ID);
         if (!publicInfosKeyBytes) {
             throw new Error(`Cannot publish to server: $publicinfos key not found in KeyBag`);
         }
-        const publicInfosKeyBase64 = this.uint8ArrayToBase64(publicInfosKeyBytes);
-        // Build the registration request
+        // Build the registration request body
         const requestBody = {
-            tenantId: this.tenantId,
             adminSigningPublicKey: this.administrationPublicKey,
             adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
-            publicInfosKey: publicInfosKeyBase64,
         };
+        try {
+            const serverInfoResponse = await fetch(`${baseUrl}/.well-known/mindoodb-server-info`, {
+                headers: {
+                    Accept: "application/json",
+                },
+            });
+            let serverInfoBody = null;
+            try {
+                serverInfoBody = await serverInfoResponse.json();
+            }
+            catch {
+                serverInfoBody = null;
+            }
+            if (!serverInfoResponse.ok) {
+                throw new Error(typeof serverInfoBody?.error === "string"
+                    ? serverInfoBody.error
+                    : `Could not read ${baseUrl}/.well-known/mindoodb-server-info (HTTP ${serverInfoResponse.status}).`);
+            }
+            if (!serverInfoBody
+                || typeof serverInfoBody !== "object"
+                || Array.isArray(serverInfoBody)
+                || typeof serverInfoBody.encryptionPublicKey !== "string") {
+                throw new Error("The server returned an invalid .well-known payload.");
+            }
+            const rsaEncryption = new RSAEncryption_1.RSAEncryption(this.cryptoAdapter);
+            requestBody.encryptedPublicInfosKey = this.uint8ArrayToBase64(await rsaEncryption.encrypt(publicInfosKeyBytes, serverInfoBody.encryptionPublicKey));
+        }
+        catch (error) {
+            console.warn("[publishToServer] Falling back to raw publicInfosKey transport:", error);
+            requestBody.publicInfosKey = this.uint8ArrayToBase64(publicInfosKeyBytes);
+        }
+        if (options?.adminUsername) {
+            requestBody.adminUsername = options.adminUsername;
+        }
         // Add users if provided
         if (options?.registerUsers && options.registerUsers.length > 0) {
             requestBody.users = options.registerUsers.map((u) => ({
@@ -440,15 +526,16 @@ class BaseMindooTenant {
                 encryptionPublicKey: u.userEncryptionPublicKey,
             }));
         }
-        // Build headers
+        // Authenticate as system admin via challenge/response
         const headers = {
             "Content-Type": "application/json",
         };
-        if (options?.adminApiKey) {
-            headers["x-api-key"] = options.adminApiKey;
+        if (options?.systemAdminUser && options?.systemAdminPassword) {
+            const token = await this.authenticateAsSystemAdmin(baseUrl, options.systemAdminUser, options.systemAdminPassword);
+            headers["Authorization"] = `Bearer ${token}`;
         }
-        // POST to the server's admin register-tenant endpoint
-        const url = `${serverUrl.replace(/\/$/, "")}/admin/register-tenant`;
+        // POST to /system/tenants/:tenantId
+        const url = `${baseUrl}/system/tenants/${encodeURIComponent(this.tenantId)}`;
         const response = await fetch(url, {
             method: "POST",
             headers,
@@ -461,31 +548,90 @@ class BaseMindooTenant {
         console.log(`[publishToServer] ✓ Tenant "${this.tenantId}" published to server successfully`);
         this.logger.info(`Tenant "${this.tenantId}" published to server successfully`);
     }
+    /**
+     * Perform system admin challenge/response auth and return a JWT token.
+     */
+    async authenticateAsSystemAdmin(baseUrl, adminUser, adminPassword) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        // Decrypt the admin's signing private key
+        const signingKeyBuffer = await this.decryptPrivateKey(adminUser.userSigningKeyPair.privateKey, adminPassword, "signing");
+        const signingKey = await subtle.importKey("pkcs8", signingKeyBuffer, { name: "Ed25519" }, false, ["sign"]);
+        // Step 1: Request challenge from server
+        const challengeRes = await fetch(`${baseUrl}/system/auth/challenge`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                username: adminUser.username,
+                publicsignkey: adminUser.userSigningKeyPair.publicKey,
+            }),
+        });
+        if (!challengeRes.ok) {
+            const errorBody = await challengeRes.text();
+            throw new Error(`System admin challenge failed (HTTP ${challengeRes.status}): ${errorBody}`);
+        }
+        const { challenge } = (await challengeRes.json());
+        // Step 2: Sign the challenge
+        const messageBytes = new TextEncoder().encode(challenge);
+        const signatureBuffer = await subtle.sign({ name: "Ed25519" }, signingKey, messageBytes);
+        const signatureBase64 = this.uint8ArrayToBase64(new Uint8Array(signatureBuffer));
+        // Step 3: Authenticate
+        const authRes = await fetch(`${baseUrl}/system/auth/authenticate`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ challenge, signature: signatureBase64 }),
+        });
+        if (!authRes.ok) {
+            const errorBody = await authRes.text();
+            throw new Error(`System admin authentication failed (HTTP ${authRes.status}): ${errorBody}`);
+        }
+        const result = (await authRes.json());
+        if (!result.success || !result.token) {
+            throw new Error(`System admin authentication failed: ${result.error || "unknown error"}`);
+        }
+        return result.token;
+    }
     /**
      * Create a remote store connected to a MindooDB server, ready for sync.
      */
     async connectToServer(serverUrl, dbId) {
         console.log(`[connectToServer] Connecting to server: ${serverUrl}, db: ${dbId}`);
         this.logger.info(`Connecting to server: ${serverUrl}, db: ${dbId}`);
-        // Lazy-import network modules to avoid circular dependencies and keep core lightweight
-        const { HttpTransport } = await import("../appendonlystores/network/HttpTransport.js");
-        const { ClientNetworkContentAddressedStore } = await import("../appendonlystores/network/ClientNetworkContentAddressedStore.js");
-        // Create the HTTP transport
-        const baseUrl = `${serverUrl.replace(/\/$/, "")}/${this.tenantId}`;
-        const transport = new HttpTransport({
-            baseUrl,
-            tenantId: this.tenantId,
-            dbId,
-        }, this.logger.createChild("HttpTransport"));
-        // Get the current user's decrypted signing key
-        const signingKey = await this.getDecryptedSigningKey();
-        // Get the current user's decrypted RSA encryption private key (for decrypting entries)
-        const decryptedEncryptionKey = await this.getDecryptedEncryptionKey();
-        // Create the client network store
-        const store = new ClientNetworkContentAddressedStore(dbId, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${dbId}`));
-        console.log(`[connectToServer] ✓ Connected to server for db "${dbId}"`);
-        this.logger.info(`Connected to server for db "${dbId}"`);
-        return store;
+        const normalizedServerUrl = serverUrl.replace(/\/$/, "");
+        const cacheKey = `${normalizedServerUrl}::${dbId}`;
+        const cachedStore = this.remoteStoreCache.get(cacheKey);
+        if (cachedStore) {
+            this.logger.debug(`Reusing cached remote store for ${normalizedServerUrl}, db: ${dbId}`);
+            return cachedStore;
+        }
+        const remoteStorePromise = (async () => {
+            // Lazy-import network modules to avoid circular dependencies and keep core lightweight
+            const { HttpTransport } = await import("../appendonlystores/network/HttpTransport.js");
+            const { ClientNetworkContentAddressedStore } = await import("../appendonlystores/network/ClientNetworkContentAddressedStore.js");
+            // Create the HTTP transport
+            const baseUrl = `${normalizedServerUrl}/${this.tenantId}`;
+            const transport = new HttpTransport({
+                baseUrl,
+                tenantId: this.tenantId,
+                dbId,
+            }, this.logger.createChild("HttpTransport"));
+            // Get the current user's decrypted signing key
+            const signingKey = await this.getDecryptedSigningKey();
+            // Get the current user's decrypted RSA encryption private key (for decrypting entries)
+            const decryptedEncryptionKey = await this.getDecryptedEncryptionKey();
+            // Create the client network store
+            const store = new ClientNetworkContentAddressedStore(dbId, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${dbId}`));
+            console.log(`[connectToServer] ✓ Connected to server for db "${dbId}"`);
+            this.logger.info(`Connected to server for db "${dbId}"`);
+            return store;
+        })();
+        this.remoteStoreCache.set(cacheKey, remoteStorePromise);
+        try {
+            return await remoteStorePromise;
+        }
+        catch (error) {
+            this.remoteStoreCache.delete(cacheKey);
+            throw error;
+        }
     }
     /**
      * Internal method to get the decrypted signing key for the current user.
@@ -538,104 +684,22 @@ class BaseMindooTenant {
         this.logger.debug(`decryptPrivateKey: Starting decryption with saltString: ${saltString}`);
         this.logger.debug(`decryptPrivateKey: Password length: ${password.length}`);
         this.logger.debug(`decryptPrivateKey: EncryptedKey iterations: ${encryptedKey.iterations}`);
-        const subtle = this.cryptoAdapter.getSubtle();
-        // Decode base64 strings
-        this.logger.debug(`decryptPrivateKey: Decoding base64 strings`);
-        let ciphertext;
-        let iv;
-        let tag;
-        let saltBytes;
+        this.logger.debug(`decryptPrivateKey: Delegating PBKDF2 + AES-GCM work to shared helper`);
         try {
-            ciphertext = this.base64ToUint8Array(encryptedKey.ciphertext);
-            iv = this.base64ToUint8Array(encryptedKey.iv);
-            tag = this.base64ToUint8Array(encryptedKey.tag);
-            saltBytes = this.base64ToUint8Array(encryptedKey.salt);
-            this.logger.debug(`decryptPrivateKey: Decoded - ciphertext: ${ciphertext.length} bytes, iv: ${iv.length} bytes, tag: ${tag.length} bytes, salt: ${saltBytes.length} bytes`);
-        }
-        catch (error) {
-            this.logger.error(`decryptPrivateKey: Error decoding base64:`, error);
-            throw error;
-        }
-        // Derive key from password using PBKDF2
-        // Combine the stored salt bytes with the salt string for additional security
-        // This ensures different key types (signing, encryption, etc.) use different derived keys
-        // even if they share the same password
-        this.logger.debug(`decryptPrivateKey: Combining salt with saltString`);
-        const saltStringBytes = new TextEncoder().encode(saltString);
-        const combinedSalt = new Uint8Array(saltBytes.length + saltStringBytes.length);
-        combinedSalt.set(saltBytes);
-        combinedSalt.set(saltStringBytes, saltBytes.length);
-        this.logger.debug(`decryptPrivateKey: Combined salt length: ${combinedSalt.length} bytes`);
-        this.logger.debug(`decryptPrivateKey: Importing password key for PBKDF2`);
-        let passwordKey;
-        try {
-            passwordKey = await subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits", "deriveKey"]);
-            this.logger.debug(`decryptPrivateKey: Successfully imported password key`);
-        }
-        catch (error) {
-            this.logger.error(`decryptPrivateKey: Error importing password key:`, error);
-            throw error;
-        }
-        this.logger.debug(`decryptPrivateKey: Deriving key with PBKDF2 (iterations: ${encryptedKey.iterations})`);
-        let derivedKey;
-        try {
-            derivedKey = await subtle.deriveKey({
-                name: "PBKDF2",
-                salt: combinedSalt,
-                iterations: encryptedKey.iterations,
-                hash: "SHA-256",
-            }, passwordKey, {
-                name: "AES-GCM",
-                length: 256,
-            }, false, ["decrypt"]);
-            this.logger.debug(`decryptPrivateKey: Successfully derived key`);
-        }
-        catch (error) {
-            this.logger.error(`decryptPrivateKey: Error deriving key:`, error);
-            throw error;
-        }
-        // Combine ciphertext and tag (GCM authentication tag is separate)
-        // AES-GCM expects the tag to be appended to the ciphertext
-        this.logger.debug(`decryptPrivateKey: Combining ciphertext and tag`);
-        const encryptedData = new Uint8Array(ciphertext.length + tag.length);
-        encryptedData.set(ciphertext);
-        encryptedData.set(tag, ciphertext.length);
-        this.logger.debug(`decryptPrivateKey: Combined encrypted data length: ${encryptedData.length} bytes`);
-        // Decrypt the private key
-        this.logger.debug(`decryptPrivateKey: Decrypting with AES-GCM`);
-        this.logger.debug(`decryptPrivateKey: IV length: ${iv.length} bytes (expected: 12 for AES-GCM)`);
-        this.logger.debug(`decryptPrivateKey: Tag length: ${tag.length} bytes (expected: 16 for 128-bit tag)`);
-        this.logger.debug(`decryptPrivateKey: Ciphertext length: ${ciphertext.length} bytes`);
-        let decrypted;
-        try {
-            // Create a new ArrayBuffer to ensure we have the correct buffer without any offset issues
-            const encryptedBuffer = new Uint8Array(encryptedData).buffer;
-            this.logger.debug(`decryptPrivateKey: Encrypted buffer size: ${encryptedBuffer.byteLength} bytes`);
-            decrypted = await subtle.decrypt({
-                name: "AES-GCM",
-                iv: new Uint8Array(iv), // Create a new Uint8Array to ensure proper buffer
-                tagLength: 128,
-            }, derivedKey, encryptedBuffer);
+            const decrypted = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, encryptedKey, password, saltString);
             this.logger.debug(`decryptPrivateKey: Successfully decrypted, result length: ${decrypted.byteLength} bytes`);
+            return decrypted;
         }
         catch (error) {
             this.logger.error(`decryptPrivateKey: Error during decryption:`, error);
             this.logger.error(`decryptPrivateKey: Error details:`, {
                 errorName: error instanceof Error ? error.name : typeof error,
                 errorMessage: error instanceof Error ? error.message : String(error),
-                ivLength: iv.length,
-                tagLength: tag.length,
-                ciphertextLength: ciphertext.length,
-                encryptedDataLength: encryptedData.length,
                 iterations: encryptedKey.iterations,
-                saltString: saltString,
-                encryptedDataByteOffset: encryptedData.byteOffset,
-                encryptedDataByteLength: encryptedData.byteLength,
-                encryptedDataBufferLength: encryptedData.buffer.byteLength,
+                saltString,
             });
             throw error;
         }
-        return decrypted;
     }
     /**
      * Helper method to convert base64 string to Uint8Array
@@ -682,6 +746,25 @@ class BaseMindooTenant {
         }
         return bytes.buffer;
     }
+    /**
+     * Check whether the symmetric key for the given key ID is available in the KeyBag.
+     * This is a lightweight probe that does not perform any crypto operations.
+     *
+     * @param decryptionKeyId The key ID ("default" or a named key ID)
+     * @returns true if the key can be resolved, false otherwise
+     */
+    async hasDecryptionKey(decryptionKeyId) {
+        try {
+            await this.getSymmetricKey(decryptionKeyId);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof errors_1.SymmetricKeyNotFoundError) {
+                return false;
+            }
+            throw error;
+        }
+    }
     /**
      * Get the symmetric key for a given key ID.
      * This is a protected helper method that can be used by subclasses.
@@ -695,9 +778,9 @@ class BaseMindooTenant {
             if (this.decryptedTenantKeyCache) {
                 return this.decryptedTenantKeyCache;
             }
-            const tenantKey = await this.keyBag.get("tenant", this.tenantId);
+            const tenantKey = await this.keyBag.get("doc", this.tenantId, types_1.DEFAULT_TENANT_KEY_ID);
             if (!tenantKey) {
-                throw new errors_1.SymmetricKeyNotFoundError(`tenant:${this.tenantId}`);
+                throw new errors_1.SymmetricKeyNotFoundError(`doc:${this.tenantId}:${types_1.DEFAULT_TENANT_KEY_ID}`);
             }
             const symmetricKey = tenantKey;
             this.decryptedTenantKeyCache = symmetricKey;
@@ -705,7 +788,7 @@ class BaseMindooTenant {
         }
         else {
             // Get the decrypted key from KeyBag
-            const decryptedKey = await this.keyBag.get("doc", decryptionKeyId);
+            const decryptedKey = await this.keyBag.get("doc", this.tenantId, decryptionKeyId);
             if (!decryptedKey) {
                 throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
             }