openmates 0.11.0-alpha.8 → 0.11.0-alpha.9

package/dist/{chunk-2YHQ7NP4.js → chunk-QJE5DL63.js}

@@ -91,6 +91,16 @@ async function decryptWithAesGcmCombined(encryptedWithIvB64, rawKeyBytes) {
     return null;
   }
 }
+async function deriveEmailEncryptionKeyB64(email, emailSaltB64) {
+  const encoder = new TextEncoder();
+  const emailBytes = encoder.encode(email);
+  const saltBytes = base64ToBytes(emailSaltB64);
+  const combined = new Uint8Array(emailBytes.length + saltBytes.length);
+  combined.set(emailBytes);
+  combined.set(saltBytes, emailBytes.length);
+  const hashBuffer = await cryptoApi.subtle.digest("SHA-256", toArrayBuffer(combined));
+  return bytesToBase64(new Uint8Array(hashBuffer));
+}
 async function decryptBytesWithAesGcm(encryptedWithIvB64, rawKeyBytes) {
   try {
     const combined = base64ToBytes(encryptedWithIvB64);
@@ -554,6 +564,18 @@ function saveSession(session) {
   } else if (result.type === "plaintext") {
     onDisk.masterKeyExportedB64 = session.masterKeyExportedB64;
   }
+  if (session.emailEncryptionKeyB64) {
+    const emailKeyResult = storeMasterKey(
+      session.emailEncryptionKeyB64,
+      `${session.hashedEmail}:email`
+    );
+    onDisk.emailEncryptionKeyStorage = emailKeyResult.type;
+    if (emailKeyResult.type === "encrypted") {
+      onDisk.emailEncryptionKeyEncrypted = emailKeyResult.encryptedData;
+    } else if (emailKeyResult.type === "plaintext") {
+      onDisk.emailEncryptionKeyB64 = session.emailEncryptionKeyB64;
+    }
+  }
   writeJsonFile(filePath, onDisk);
   if (result.type !== "plaintext") {
     process.stderr.write("Decrypting data...\n");
@@ -564,17 +586,19 @@ function loadSession() {
   const onDisk = readJsonFile(filePath);
   if (!onDisk) return null;
   let masterKey = null;
+  let emailEncryptionKey = null;
   if (!onDisk.masterKeyStorage) {
     masterKey = onDisk.masterKeyExportedB64 ?? null;
     if (masterKey) {
-      const session = buildSession(onDisk, masterKey);
+      emailEncryptionKey = getEmailEncryptionKeyFromDisk(onDisk);
+      const session = buildSession(onDisk, masterKey, emailEncryptionKey);
       try {
         saveSession(session);
         process.stderr.write("Decrypting data...\n");
       } catch {
       }
     }
-    return masterKey ? buildSession(onDisk, masterKey) : null;
+    return masterKey ? buildSession(onDisk, masterKey, getEmailEncryptionKeyFromDisk(onDisk)) : null;
   }
   switch (onDisk.masterKeyStorage) {
     case "keychain":
@@ -598,7 +622,7 @@ function loadSession() {
     );
     return null;
   }
-  return buildSession(onDisk, masterKey);
+  return buildSession(onDisk, masterKey, getEmailEncryptionKeyFromDisk(onDisk));
 }
 function clearSession() {
   const filePath = join(ensureStateDir(), "session.json");
@@ -606,17 +630,36 @@ function clearSession() {
   if (onDisk?.masterKeyStorage) {
     deleteMasterKey(onDisk.masterKeyStorage, onDisk.hashedEmail);
   }
+  if (onDisk?.emailEncryptionKeyStorage) {
+    deleteMasterKey(onDisk.emailEncryptionKeyStorage, `${onDisk.hashedEmail}:email`);
+  }
   if (existsSync2(filePath)) {
     rmSync(filePath);
   }
 }
-function buildSession(onDisk, masterKey) {
+function getEmailEncryptionKeyFromDisk(onDisk) {
+  if (!onDisk.emailEncryptionKeyStorage) return onDisk.emailEncryptionKeyB64 ?? null;
+  switch (onDisk.emailEncryptionKeyStorage) {
+    case "keychain":
+      return retrieveMasterKey("keychain", `${onDisk.hashedEmail}:email`);
+    case "encrypted":
+      return retrieveMasterKey(
+        "encrypted",
+        `${onDisk.hashedEmail}:email`,
+        onDisk.emailEncryptionKeyEncrypted
+      );
+    case "plaintext":
+      return onDisk.emailEncryptionKeyB64 ?? null;
+  }
+}
+function buildSession(onDisk, masterKey, emailEncryptionKey) {
   return {
     apiUrl: onDisk.apiUrl,
     sessionId: onDisk.sessionId,
     wsToken: onDisk.wsToken,
     cookies: onDisk.cookies,
     masterKeyExportedB64: masterKey,
+    emailEncryptionKeyB64: emailEncryptionKey,
     hashedEmail: onDisk.hashedEmail,
     userEmailSalt: onDisk.userEmailSalt,
     createdAt: onDisk.createdAt,
@@ -1828,6 +1871,7 @@ var OpenMatesClient = class _OpenMatesClient {
       authorizerDeviceName: complete.data.authorizer_device_name ?? null,
       autoLogoutMinutes: complete.data.auto_logout_minutes ?? null
     };
+    await this.hydrateEmailEncryptionKey(session);
     saveSession(session);
   }
   async whoAmI() {
@@ -2811,8 +2855,9 @@ var OpenMatesClient = class _OpenMatesClient {
       `CreditNote_${invoiceId}.pdf`
     );
   }
-  async requestRefund(invoiceId, emailEncryptionKey) {
-    this.requireSession();
+  async requestRefund(invoiceId) {
+    const session = this.requireSession();
+    const emailEncryptionKey = await this.ensureEmailEncryptionKey(session);
     const response = await this.http.post(
       "/v1/payments/refund",
       { invoice_id: invoiceId, email_encryption_key: emailEncryptionKey },
@@ -3380,6 +3425,34 @@ Required: ${schema.required.join(", ")}`
       data: response.data
     };
   }
+  async ensureEmailEncryptionKey(session) {
+    if (session.emailEncryptionKeyB64) return session.emailEncryptionKeyB64;
+    await this.hydrateEmailEncryptionKey(session);
+    if (session.emailEncryptionKeyB64) return session.emailEncryptionKeyB64;
+    throw new Error(
+      "Email encryption key is missing. Run `openmates login` again to refresh your local encryption keys."
+    );
+  }
+  async hydrateEmailEncryptionKey(session) {
+    const response = await this.http.post(
+      "/v1/auth/session",
+      { session_id: session.sessionId },
+      this.getCliRequestHeaders()
+    );
+    const encryptedEmail = response.data.user?.encrypted_email_with_master_key;
+    if (!response.ok || !response.data.success || typeof encryptedEmail !== "string") {
+      return;
+    }
+    const email = await decryptWithAesGcmCombined(
+      encryptedEmail,
+      base64ToBytes(session.masterKeyExportedB64)
+    );
+    if (!email) return;
+    session.emailEncryptionKeyB64 = await deriveEmailEncryptionKeyB64(
+      email,
+      session.userEmailSalt
+    );
+  }
   requireSession() {
     if (!this.session) {
       throw new Error("Not logged in. Run `openmates login`.");
@@ -7761,7 +7834,7 @@ var SETTINGS_EXECUTABLE_COMMANDS = [
   { path: ["billing", "invoices", "list"], description: "List invoices", examples: ["openmates settings billing invoices list --json"] },
   { path: ["billing", "invoices", "download"], description: "Download an invoice PDF", examples: ["openmates settings billing invoices download <invoice-id> --output ./invoices"] },
   { path: ["billing", "invoices", "credit-note"], description: "Download a credit note PDF", examples: ["openmates settings billing invoices credit-note <invoice-id> --output ./invoices"] },
-  { path: ["billing", "invoices", "refund"], description: "Request a refund for an invoice", examples: ["openmates settings billing invoices refund <invoice-id> --email-encryption-key <base64>"] },
+  { path: ["billing", "invoices", "refund"], description: "Request a refund for an invoice", examples: ["openmates settings billing invoices refund <invoice-id> --yes"] },
   { path: ["billing", "gift-card", "redeem"], description: "Redeem a gift card", examples: ["openmates settings billing gift-card redeem ABCD-1234"] },
   { path: ["billing", "gift-card", "list"], description: "List redeemed gift cards", examples: ["openmates settings billing gift-card list"] },
   { path: ["billing", "auto-topup", "low-balance", "set"], description: "Configure low-balance auto top-up", examples: ["openmates settings billing auto-topup low-balance set --enabled true --amount 1000 --currency eur --email you@example.com"] },
@@ -8196,11 +8269,9 @@ async function handleSettings(client, subcommand, rest, flags) {
   }
   if (matches(tokens, ["billing", "invoices", "refund"])) {
     const invoiceId = rest[2];
-    const emailEncryptionKey = typeof flags["email-encryption-key"] === "string" ? flags["email-encryption-key"] : void 0;
     if (!invoiceId) throw new Error("Missing invoice ID.");
-    if (!emailEncryptionKey) throw new Error("Missing --email-encryption-key. The backend requires the encrypted email key for refund requests.");
     if (flags.yes !== true) await confirmOrExit(`Request refund for invoice ${invoiceId}? [y/N] `);
-    await printSettingsMutationResult(client.requestRefund(invoiceId, emailEncryptionKey), flags);
+    await printSettingsMutationResult(client.requestRefund(invoiceId), flags);
     return;
   }
   if (matches(tokens, ["billing", "gift-card", "redeem"]) || subcommand === "gift-card" && rest[0] === "redeem") {

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   getExtForLang,
   serializeToYaml
-} from "./chunk-2YHQ7NP4.js";
+} from "./chunk-QJE5DL63.js";
 import "./chunk-SFTCIVE2.js";
 export {
   getExtForLang,

package/dist/index.d.ts

@@ -7,6 +7,7 @@ interface OpenMatesSession {
     wsToken: string | null;
     cookies: Record<string, string>;
     masterKeyExportedB64: string;
+    emailEncryptionKeyB64?: string | null;
     hashedEmail: string;
     userEmailSalt: string;
     createdAt: number;
@@ -489,7 +490,7 @@ declare class OpenMatesClient {
     }>;
     downloadInvoice(invoiceId: string): Promise<DownloadedDocument>;
     downloadCreditNote(invoiceId: string): Promise<DownloadedDocument>;
-    requestRefund(invoiceId: string, emailEncryptionKey: string): Promise<unknown>;
+    requestRefund(invoiceId: string): Promise<unknown>;
     updateUsername(username: string): Promise<unknown>;
     updateProfileImage(filePath: string): Promise<unknown>;
     getNewsletterCategories(): Promise<unknown>;
@@ -637,6 +638,8 @@ declare class OpenMatesClient {
     buildMentionContext(): Promise<MentionContext>;
     private normalizePath;
     private downloadPaymentPdf;
+    private ensureEmailEncryptionKey;
+    private hydrateEmailEncryptionKey;
     private requireSession;
     private getMasterKeyBytes;
     private getValidSessionFromDisk;

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   getExtForLang,
   parseNewChatSuggestionText,
   serializeToYaml
-} from "./chunk-2YHQ7NP4.js";
+} from "./chunk-QJE5DL63.js";
 import "./chunk-SFTCIVE2.js";
 export {
   MATE_NAMES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.11.0-alpha.8",
+  "version": "0.11.0-alpha.9",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",