mindoodb 0.0.50 → 0.0.53

package/dist/core/userkeys/UserKeyManager.d.ts

@@ -0,0 +1,170 @@
+import type { BaseMindooTenant } from "../BaseMindooTenant";
+import type { EncryptionKeyPair, MindooDB, MindooDoc, PrivateUserId, SigningKeyPair } from "../types";
+import { type PendingUserKeyDevice, type UserKeyDeviceRow, type UserKeyDocumentPayload, type UserKeyEnrollmentStatus } from "./types";
+export declare class UserKeyManager {
+    private readonly tenant;
+    private userDirectoryFetched;
+    private lastUserDirectoryFetchError;
+    private decryptedUserKeyCache;
+    private decryptedUserKeyBytes;
+    private seededBytesMatchLocalPublic;
+    private seededBytesVerifiedForPublicKey;
+    private resolvingOwnDeviceWrap;
+    private reconcileInFlight;
+    constructor(tenant: BaseMindooTenant);
+    noteUserDirectoryFetched(): void;
+    noteUserDirectoryFetchFailed(error: unknown): void;
+    /**
+     * Inject User-Key PKCS8 bytes already decrypted by the host (Haven unlock).
+     * Used when `currentUserPassword` is empty so mint/wrap does not generate a
+     * second pair.
+     */
+    seedDecryptedUserKeyBytes(bytes: Uint8Array): void;
+    /**
+     * RSA round-trip against `publicKeyPem`: seal a probe with the public key and
+     * open it with the seeded private bytes. Cheaper than deriving the public key
+     * from PKCS8 and works on every crypto adapter.
+     */
+    private seededBytesBelongToLocalPublicKey;
+    hasFetchedUserDirectory(): boolean;
+    ensureLocalUserKeyPair(user: PrivateUserId, password: string): Promise<EncryptionKeyPair>;
+    getLocalUserPublicKey(): Promise<string | null>;
+    private decryptUserKeyPairBytes;
+    getDecryptedUserKeyBytes(): Promise<Uint8Array | null>;
+    /**
+     * The User-Key private bytes taken from THIS device's wrap in the own
+     * User-Key document, verified against `publicKeyPem`. Returns null when no
+     * wrap for this device exists or it does not open the pair. Kept free of
+     * {@link getDecryptedUserKeyBytes} so the two cannot recurse.
+     */
+    private ownDeviceWrapPrivateKeyBytes;
+    getDecryptedUserKey(): Promise<CryptoKey | null>;
+    /**
+     * All epochs this device can open, newest first. Used by key-distribution
+     * reconcile so wraps addressed to a retired fingerprint still import.
+     */
+    getUserKeyCryptoKeysForReconcile(): Promise<CryptoKey[]>;
+    openUserDirectory(): Promise<MindooDB>;
+    resolveOwnUserKeyDocument(): Promise<{
+        doc: MindooDoc;
+        payload: UserKeyDocumentPayload;
+    } | null>;
+    /**
+     * Admin path: create a pending userkey document from a join-request public key.
+     */
+    createPendingFromJoin(input: {
+        username: string;
+        userPublicKey: string;
+        signingKeyPair: {
+            publicKey: string;
+            privateKey: import("../types").EncryptedPrivateKey;
+        };
+        signingKeyPassword: string;
+    }): Promise<MindooDoc>;
+    /**
+     * Self-create for legacy users who never sent a User-Key in a join request.
+     * Refuses unless userdirectory has been fetched this session (Trap 1).
+     * On mint, wraps the new private key to every active grant device so already
+     * enrolled devices can import without an approval dialog. Devices added to
+     * the grant afterwards still require explicit approval.
+     */
+    ensureOwnUserKeyDocument(options?: {
+        allowSelfCreate?: boolean;
+    }): Promise<{
+        doc: MindooDoc;
+        payload: UserKeyDocumentPayload;
+    } | null>;
+    /**
+     * Bootstrap / recreate: wrap the new private key to every active grant
+     * device. Later devices added to the grant still require explicit approval.
+     *
+     * `legacyUnstampedOnly` wraps only grant devices with no `addedAt` (pre-User-Keys
+     * fleet). Devices stamped with `addedAt` after the userkey document exists still
+     * need an explicit approve.
+     */
+    private wrapPrivateKeyForActiveGrantDevices;
+    private tryImportUserKeyFromWrap;
+    writeOwnDeviceWrap(doc: MindooDoc, payload: UserKeyDocumentPayload): Promise<void>;
+    /**
+     * A wrap-less userkey document cannot be imported by anyone. Replace its
+     * planted public key with this device's local pair and wrap the current
+     * grant (same outcome as a first mint).
+     */
+    private adoptPendingUserKeyDocument;
+    /**
+     * A wrap-less document cannot be used by any device. Either wrap it with the
+     * local pair that matches the planted public key, or replace that key and wrap.
+     * This is the recovery path for an already-minted pending document (the user's
+     * leftover `deviceWraps: {}` row).
+     */
+    private sealPendingUserKeyDocument;
+    isReconciling(): boolean;
+    /**
+     * True when userdirectory has been fetched this session, or is already fully
+     * initialized. In-flight `openDB` does **not** count: treating that as ready
+     * starts reconcile during initialize, which re-enters `updateUnifiedCache`
+     * and unbounded-allocates Automerge/AES heaps.
+     */
+    private canReconcileAgainstUserDirectory;
+    reconcile(options?: {
+        allowSelfCreate?: boolean;
+    }): Promise<UserKeyEnrollmentStatus>;
+    private reconcileInner;
+    listPendingUserKeyDevices(): Promise<PendingUserKeyDevice[]>;
+    listUserKeyDevices(): Promise<UserKeyDeviceRow[]>;
+    /**
+     * Wrap every User-Key epoch to `encryptionPublicKey` (the joining device).
+     * Does not look up the grant overview — join approval just registered the
+     * device, and the directory cache can still miss it.
+     */
+    wrapUserKeyForGrantDevice(encryptionPublicKey: string, label?: string): Promise<void>;
+    approveUserKeyDevice(fingerprint: string): Promise<void>;
+    declineUserKeyDevice(fingerprint: string): Promise<void>;
+    undoDeclineUserKeyDevice(fingerprint: string): Promise<void>;
+    rotateUserKey(): Promise<void>;
+    /**
+     * Admin-only delete of the published user-key document for `username`.
+     * Lookup uses the same grant-binding path as {@link publishedUserKeyFor}.
+     * Recovery path when every device that held the private key is gone.
+     * A remaining enrolled device keeps local access; it does not republish
+     * the tombstone on unlock while `default` is already wrapped to that user.
+     */
+    deletePublishedUserKeyFor(input: {
+        username: string;
+        signingKeyPair: SigningKeyPair;
+        signingKeyPassword: string;
+    }): Promise<void>;
+    publishedUserKeyFor(username: string): Promise<{
+        publicKey: string;
+        fingerprint: string;
+        pending: boolean;
+    } | null>;
+    /**
+     * Lookup only — Trap 1 (no mint from local emptiness) does not apply.
+     * Haven reopens a fresh tenant per action; blocking on
+     * `userDirectoryFetched` made wrapKeyForUser return null so
+     * `acl_keydistribution_default` never gained a User-Key wrap.
+     */
+    private resolvePublishedUserKeyDocument;
+    getEnrollmentStatus(): Promise<UserKeyEnrollmentStatus>;
+    private waitState;
+    private waitStateForDevice;
+    private enrollmentStatus;
+    private epochsNewestFirst;
+    private privateKeyBytesForEpoch;
+    private grantCreatedAtFallback;
+    private wrappedDeviceFingerprints;
+    private dropRevokedDeviceWraps;
+    private findActiveDeviceByFingerprint;
+    /**
+     * Bind a userkey document to the grant that names this person.
+     * Writes the grant's `username_hash` (not the current write-version hash) so
+     * the userdirectory invariant matches `resolveUsernameHashForSigningKey`.
+     * When `signingPublicKey` is set (self-mint), that key must be on the grant.
+     */
+    private mintBindingForUsername;
+    private labelForOwnEncryptionKey;
+    private defaultAlreadyWrappedForCurrentUser;
+    private directory;
+}
+//# sourceMappingURL=UserKeyManager.d.ts.map

package/dist/core/userkeys/UserKeyManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserKeyManager.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/UserKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAgBtG,OAAO,EAQL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAE7B,MAAM,SAAS,CAAC;AAEjB,qBAAa,cAAc;IAUb,OAAO,CAAC,QAAQ,CAAC,MAAM;IATnC,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,2BAA2B,CAAiB;IACpD,OAAO,CAAC,qBAAqB,CAA0B;IACvD,OAAO,CAAC,qBAAqB,CAA2B;IACxD,OAAO,CAAC,2BAA2B,CAAwB;IAC3D,OAAO,CAAC,+BAA+B,CAAuB;IAC9D,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,iBAAiB,CAAiD;gBAE7C,MAAM,EAAE,gBAAgB;IAErD,wBAAwB,IAAI,IAAI;IAKhC,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAIlD;;;;OAIG;IACH,yBAAyB,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAOlD;;;;OAIG;YACW,iCAAiC;IAqC/C,uBAAuB,IAAI,OAAO;IAI5B,sBAAsB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0DzF,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAMvC,uBAAuB;IAa/B,wBAAwB,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAmC5D;;;;;OAKG;YACW,4BAA4B;IAuCpC,mBAAmB,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAStD;;;OAGG;IACG,gCAAgC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IA6CxD,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC;IAItC,yBAAyB,IAAI,OAAO,CAAC;QACzC,GAAG,EAAE,SAAS,CAAC;QACf,OAAO,EAAE,sBAAsB,CAAC;KACjC,GAAG,IAAI,CAAC;IAgBT;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,OAAO,UAAU,EAAE,mBAAmB,CAAA;SAAE,CAAC;QAC1F,kBAAkB,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,SAAS,CAAC;IAgCtB;;;;;;OAMG;IACG,wBAAwB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC;QAC/E,GAAG,EAAE,SAAS,CAAC;QACf,OAAO,EAAE,sBAAsB,CAAC;KACjC,GAAG,IAAI,CAAC;IAsFT;;;;;;;OAOG;YACW,mCAAmC;YAoEnC,wBAAwB;IAwChC,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA+DxF;;;;OAIG;YACW,2BAA2B;IAiCzC;;;;;OAKG;YACW,0BAA0B;IAwCxC,aAAa,IAAI,OAAO;IAIxB;;;;;OAKG;IACH,OAAO,CAAC,gCAAgC;IAQlC,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;YAY5E,cAAc;IA6EtB,yBAAyB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA2B5D,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAkDvD;;;;OAIG;IACG,yBAAyB,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoDrF,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CxD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAkEpC;;;;;;OAMG;IACG,yBAAyB,CAAC,KAAK,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,cAAc,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IAYX,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACnD,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;KAClB,GAAG,IAAI,CAAC;IAaT;;;;;OAKG;YACW,+BAA+B;IAevC,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAW7D,OAAO,CAAC,SAAS;YAKH,kBAAkB;YAgBlB,gBAAgB;IAa9B,OAAO,CAAC,iBAAiB;YAMX,uBAAuB;YA6CvB,sBAAsB;IAYpC,OAAO,CAAC,yBAAyB;YAQnB,sBAAsB;YAkCtB,6BAA6B;IAY3C;;;;;OAKG;YACW,sBAAsB;YA6BtB,wBAAwB;YAcxB,mCAAmC;YAWnC,SAAS;CAIxB"}