mindoodb 0.0.84 → 0.0.86

package/dist/core/BaseMindooTenantDirectory.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenantDirectory = void 0;
 const types_1 = require("./types");
+const errors_1 = require("./errors");
 const timeSource_1 = require("./utils/timeSource");
 const singleFlight_1 = require("./utils/singleFlight");
 const logging_1 = require("./logging");
@@ -20,6 +21,48 @@ const MAX_UNKNOWN_KEYS_TRACKED = 1000;
 function unionStrings(existing, added) {
     return Array.from(new Set([...existing, ...added]));
 }
+/**
+ * Grant documents by `username_hash`, maintained by the unified cache pass.
+ * Keeps ids only, never documents, so its size is independent of the
+ * document cache.
+ */
+class GrantDocumentIndex {
+    constructor() {
+        this.idsByHash = new Map();
+        /** id -> hash and position in modification order (grows on every re-seen change). */
+        this.entries = new Map();
+        this.nextOrder = 0;
+    }
+    /** Latest state of a document: its `username_hash` if it is a grant, else undefined. */
+    record(docId, usernameHash) {
+        const previous = this.entries.get(docId);
+        if (previous) {
+            this.entries.delete(docId);
+            const ids = this.idsByHash.get(previous.hash);
+            ids?.delete(docId);
+            if (ids && ids.size === 0)
+                this.idsByHash.delete(previous.hash);
+        }
+        if (typeof usernameHash !== "string")
+            return;
+        this.entries.set(docId, { hash: usernameHash, order: this.nextOrder++ });
+        let ids = this.idsByHash.get(usernameHash);
+        if (!ids) {
+            ids = new Set();
+            this.idsByHash.set(usernameHash, ids);
+        }
+        ids.add(docId);
+    }
+    /** Ids of the grants carrying any of `hashes`, oldest change first. */
+    docIdsFor(hashes) {
+        const ids = [];
+        for (const hash of hashes) {
+            for (const id of this.idsByHash.get(hash) ?? [])
+                ids.push(id);
+        }
+        return ids.sort((a, b) => this.entries.get(a).order - this.entries.get(b).order);
+    }
+}
 class BaseMindooTenantDirectory {
     constructor(tenant, logger) {
         this.directoryDB = null;
@@ -33,6 +76,13 @@ class BaseMindooTenantDirectory {
         // (docs/accesscontrol.md §6.5), so the set of trusted keys is recomputed as
         // the union of all grant documents' current key arrays after each cache pass.
         this.grantDocIdToSigningKeys = new Map();
+        // Index of grant documents: `username_hash` -> ids of the (non-deleted,
+        // readable) grant documents carrying it, plus each id's position in
+        // modification order. findGrantAccessDocuments loads only the documents
+        // it returns instead of re-scanning the whole directory: the token check
+        // runs it on every sync request, and with more grants than the document
+        // cache holds the scan rebuilt every grant from its changes each time.
+        this.grantIndex = new GrantDocumentIndex();
         // Best-effort reverse lookup cache for public signing key -> user details.
         // Entries remain available even after revocation so historical UIs can still show identity labels.
         this.userLookupCache = new Map();
@@ -141,7 +191,19 @@ class BaseMindooTenantDirectory {
         }
         return this.directoryDB;
     }
+    async registerUsers(users, administrationPrivateKey, administrationPrivateKeyPassword) {
+        await this.tenant.withDecryptedKeyReuse(async () => {
+            for (const user of users) {
+                await this.registerUserWithKeyReuse(user.userId, administrationPrivateKey, administrationPrivateKeyPassword, user.userDetails, user.label, user.options);
+            }
+        });
+    }
     async registerUser(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label, options) {
+        // One registration signs several directory changes and key distributions
+        // with the administration key; decrypt it once instead of for each.
+        await this.tenant.withDecryptedKeyReuse(() => this.registerUserWithKeyReuse(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label, options));
+    }
+    async registerUserWithKeyReuse(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label, options) {
         this.logger.info(`Registering user: ${userId.username}`);
         // Check if user with same username (case-insensitive) already has ACTIVE
         // access. A grant whose keys were removed (revocation, §6.5) is ignored
@@ -350,22 +412,26 @@ class BaseMindooTenantDirectory {
         // identity round-trips: a cleartext name never collides with a 64-char hex
         // hash, so this is safe (docs/accesscontrol.md §6.5).
         targetHashes.add(username);
-        const matchesTarget = (value) => typeof value === "string" && targetHashes.has(value);
         const matchingDocs = [];
-        // Use the generator-based iteration API for cleaner code.
+        // The unified cache pass above indexed the grant documents by
+        // username_hash; only the matches are loaded, oldest first as the former
+        // full scan returned them.
         // No signature verification needed - DB already enforces admin-only.
         // Revocation no longer uses a separate document: it removes keys from the
         // grant document in place (docs/accesscontrol.md §6.5). A fully-revoked user
         // therefore still has a grant document here, but with empty key arrays.
         // Callers that need "active access" should inspect the key arrays (see
         // {@link isUserRevoked} / {@link getUserPublicKeys}).
-        for await (const { doc } of directoryDB.iterateChangesSince(null)) {
-            const data = doc.getData();
-            if (data.form === "useroperation" &&
-                data.type === "grantaccess" &&
-                matchesTarget(data.username_hash)) {
+        for (const docId of this.grantIndex.docIdsFor(targetHashes)) {
+            try {
+                matchingDocs.push(await directoryDB.getDocument(docId));
                 this.logger.debug(`Found grant access document for username: ${username}`);
-                matchingDocs.push(doc);
+            }
+            catch (error) {
+                // Deleted since the cache pass: no longer a grant, as for the scan.
+                if (!(error instanceof errors_1.DocumentDeletedError) && !(error instanceof errors_1.DocumentNotFoundError)) {
+                    throw error;
+                }
             }
         }
         this.logger.debug(`Found ${matchingDocs.length} grant access document(s) for username: ${username}`);
@@ -594,6 +660,7 @@ class BaseMindooTenantDirectory {
         // are idempotent) instead of leaving its documents half-applied.
         const fullRebuild = startCursor === null;
         const grantDocIdToSigningKeys = fullRebuild ? new Map() : this.grantDocIdToSigningKeys;
+        const grantIndex = fullRebuild ? new GrantDocumentIndex() : this.grantIndex;
         const userLookupCache = fullRebuild ? new Map() : this.userLookupCache;
         const wipeKeyToGrantDocId = fullRebuild ? new Map() : this.wipeKeyToGrantDocId;
         let tenantSettingsCache = fullRebuild ? null : this.tenantSettingsCache;
@@ -616,6 +683,9 @@ class BaseMindooTenantDirectory {
         // Process changes (documents are returned in order by lastModified, oldest to newest)
         for await (const { doc, cursor } of directoryDB.iterateChangesSince(startCursor)) {
             const data = doc.getData();
+            // Deleted and unreadable documents arrive as tombstones with empty
+            // data and drop out, as they never matched the former full scan.
+            grantIndex.record(doc.getId(), data.form === "useroperation" && data.type === "grantaccess" ? data.username_hash : undefined);
             // Process user operation documents (grant/revoke access)
             if (data.form === "useroperation") {
                 // Check if this is a grant access document. A grant may carry MULTIPLE
@@ -813,6 +883,7 @@ class BaseMindooTenantDirectory {
         }
         this.trustedKeysCache = trustedKeysCache;
         this.grantDocIdToSigningKeys = grantDocIdToSigningKeys;
+        this.grantIndex = grantIndex;
         this.userLookupCache = userLookupCache;
         this.wipeKeyToGrantDocId = wipeKeyToGrantDocId;
         this.tenantSettingsCache = tenantSettingsCache;