diff --git a/apps/api/drizzle-do/0008_sync_access_revocations.sql b/apps/api/drizzle-do/0008_sync_access_revocations.sql new file mode 100644 index 00000000..97ea53cb --- /dev/null +++ b/apps/api/drizzle-do/0008_sync_access_revocations.sql @@ -0,0 +1,7 @@ +CREATE TABLE `sync_access_revocations` ( + `key` text PRIMARY KEY NOT NULL, + `minimum_version` integer, + `expires_at` integer NOT NULL +); +--> statement-breakpoint +DELETE FROM `maintenance_jobs` WHERE `key` = 'sharing_access'; diff --git a/apps/api/drizzle-do/meta/0008_snapshot.json b/apps/api/drizzle-do/meta/0008_snapshot.json new file mode 100644 index 00000000..1cc698ba --- /dev/null +++ b/apps/api/drizzle-do/meta/0008_snapshot.json @@ -0,0 +1,526 @@ +{ + "version": "6", + "dialect": "sqlite", + "id": "8f3505f2-c1af-44b4-86b9-fd9f091b39f5", + "prevId": "64bf5baf-ff70-43eb-8310-fe4d564e865d", + "tables": { + "blobs": { + "name": "blobs", + "columns": { + "blob_id": { + "name": "blob_id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "state": { + "name": "state", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "size_bytes": { + "name": "size_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "last_uploaded_at": { + "name": "last_uploaded_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "delete_after": { + "name": "delete_after", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "idx_blobs_state_delete_after": { + "name": "idx_blobs_state_delete_after", + "columns": [ + "state", + "delete_after" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "coordinator_state": { + "name": "coordinator_state", + "columns": { + "id": { + "name": "id", + "type": "integer", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "vault_id": { + "name": "vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "current_cursor": { + "name": "current_cursor", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "storage_used_bytes": { + "name": "storage_used_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "storage_limit_bytes": { + "name": "storage_limit_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "max_file_size_bytes": { + "name": "max_file_size_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "version_history_retention_days": { + "name": "version_history_retention_days", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 1 + }, + "last_commit_at": { + "name": "last_commit_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_gc_at": { + "name": "last_gc_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "sync_paused_at": { + "name": "sync_paused_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "sync_pause_reason": { + "name": "sync_pause_reason", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": {}, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "entries": { + "name": "entries", + "columns": { + "entry_id": { + "name": "entry_id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "revision": { + "name": "revision", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "blob_id": { + "name": "blob_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "encrypted_metadata": { + "name": "encrypted_metadata", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "deleted": { + "name": "deleted", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "updated_seq": { + "name": "updated_seq", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_by_user_id": { + "name": "updated_by_user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_by_local_vault_id": { + "name": "updated_by_local_vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "last_mutation_id": { + "name": "last_mutation_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "idx_entries_updated_seq_entry_id": { + "name": "idx_entries_updated_seq_entry_id", + "columns": [ + "updated_seq", + "entry_id" + ], + "isUnique": false + }, + "idx_entries_blob_id": { + "name": "idx_entries_blob_id", + "columns": [ + "blob_id" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "entry_versions": { + "name": "entry_versions", + "columns": { + "version_id": { + "name": "version_id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "entry_id": { + "name": "entry_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "source_revision": { + "name": "source_revision", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "op_type": { + "name": "op_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "blob_id": { + "name": "blob_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "encrypted_metadata": { + "name": "encrypted_metadata", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "reason": { + "name": "reason", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "bucket_start_ms": { + "name": "bucket_start_ms", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "captured_at": { + "name": "captured_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_by_user_id": { + "name": "created_by_user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_by_local_vault_id": { + "name": "created_by_local_vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "idx_entry_versions_entry_captured_at": { + "name": "idx_entry_versions_entry_captured_at", + "columns": [ + "entry_id", + "captured_at", + "version_id" + ], + "isUnique": false + }, + "idx_entry_versions_auto_bucket": { + "name": "idx_entry_versions_auto_bucket", + "columns": [ + "entry_id", + "reason", + "bucket_start_ms" + ], + "isUnique": true + }, + "idx_entry_versions_expires_at": { + "name": "idx_entry_versions_expires_at", + "columns": [ + "expires_at" + ], + "isUnique": false + }, + "idx_entry_versions_blob_expires_at": { + "name": "idx_entry_versions_blob_expires_at", + "columns": [ + "blob_id", + "expires_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "local_vault_connections": { + "name": "local_vault_connections", + "columns": { + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "local_vault_id": { + "name": "local_vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "last_connected_at": { + "name": "last_connected_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": {}, + "foreignKeys": {}, + "compositePrimaryKeys": { + "local_vault_connections_user_id_local_vault_id_pk": { + "columns": [ + "user_id", + "local_vault_id" + ], + "name": "local_vault_connections_user_id_local_vault_id_pk" + } + }, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "maintenance_jobs": { + "name": "maintenance_jobs", + "columns": { + "key": { + "name": "key", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "due_at": { + "name": "due_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "retry_count": { + "name": "retry_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "last_error": { + "name": "last_error", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_error_at": { + "name": "last_error_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "idx_maintenance_jobs_due_at": { + "name": "idx_maintenance_jobs_due_at", + "columns": [ + "due_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "sync_access_revocations": { + "name": "sync_access_revocations", + "columns": { + "minimum_version": { + "name": "minimum_version", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "key": { + "name": "key", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + } + }, + "indexes": {}, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + } + }, + "views": {}, + "enums": {}, + "_meta": { + "schemas": {}, + "tables": {}, + "columns": {} + }, + "internal": { + "indexes": {} + } +} diff --git a/apps/api/drizzle-do/meta/_journal.json b/apps/api/drizzle-do/meta/_journal.json index 3d6896c5..e766e6e8 100644 --- a/apps/api/drizzle-do/meta/_journal.json +++ b/apps/api/drizzle-do/meta/_journal.json @@ -57,6 +57,13 @@ "when": 1786857725150, "tag": "0007_aberrant_logan", "breakpoints": true + }, + { + "idx": 8, + "version": "6", + "when": 1790557279952, + "tag": "0008_sync_access_revocations", + "breakpoints": true } ] } \ No newline at end of file diff --git a/apps/api/drizzle-do/migrations.js b/apps/api/drizzle-do/migrations.js index 3dc5bc02..8943d735 100644 --- a/apps/api/drizzle-do/migrations.js +++ b/apps/api/drizzle-do/migrations.js @@ -7,6 +7,7 @@ import m0004 from './0004_broad_jack_power.sql'; import m0005 from './0005_clever_killer_shrike.sql'; import m0006 from './0006_jazzy_rage.sql'; import m0007 from './0007_aberrant_logan.sql'; +import m0008 from './0008_sync_access_revocations.sql'; export default { journal, @@ -18,7 +19,8 @@ m0003, m0004, m0005, m0006, -m0007 +m0007, +m0008 } } \ No newline at end of file diff --git a/apps/api/drizzle/0007_plus_sharing.sql b/apps/api/drizzle/0007_plus_sharing.sql new file mode 100644 index 00000000..95c033d6 --- /dev/null +++ b/apps/api/drizzle/0007_plus_sharing.sql @@ -0,0 +1,73 @@ +CREATE TABLE `invitation_vault` ( + `invitation_id` text NOT NULL, + `vault_id` text NOT NULL, + PRIMARY KEY(`invitation_id`, `vault_id`), + FOREIGN KEY (`invitation_id`) REFERENCES `invitation`(`id`) ON UPDATE no action ON DELETE cascade, + FOREIGN KEY (`vault_id`) REFERENCES `vault`(`id`) ON UPDATE no action ON DELETE cascade +); +--> statement-breakpoint +CREATE TABLE `sharing_audit` ( + `id` text PRIMARY KEY NOT NULL, + `organization_id` text NOT NULL, + `actor_id` text NOT NULL, + `action` text NOT NULL, + `target_id` text NOT NULL, + `created_at` integer NOT NULL, + FOREIGN KEY (`organization_id`) REFERENCES `organization`(`id`) ON UPDATE no action ON DELETE cascade +); +--> statement-breakpoint +CREATE INDEX `sharing_audit_org_idx` ON `sharing_audit` (`organization_id`,`created_at`);--> statement-breakpoint +CREATE TABLE `sharing_refresh` ( + `vault_id` text PRIMARY KEY NOT NULL, + `revision` text NOT NULL, + `created_at` integer NOT NULL, + FOREIGN KEY (`vault_id`) REFERENCES `vault`(`id`) ON UPDATE no action ON DELETE cascade +); +--> statement-breakpoint +CREATE TABLE `vault_key_request` ( + `id` text PRIMARY KEY NOT NULL, + `vault_id` text NOT NULL, + `user_id` text NOT NULL, + `purpose` text NOT NULL, + `access_version` integer NOT NULL, + `public_key` text NOT NULL, + `status` text NOT NULL, + `envelope_json` text, + `approved_by` text, + `created_at` integer NOT NULL, + `expires_at` integer NOT NULL, + FOREIGN KEY (`vault_id`) REFERENCES `vault`(`id`) ON UPDATE no action ON DELETE cascade, + FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade, + FOREIGN KEY (`approved_by`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE no action +); +--> statement-breakpoint +CREATE INDEX `vault_key_request_vault_status_idx` ON `vault_key_request` (`vault_id`,`status`);--> statement-breakpoint +CREATE INDEX `vault_key_request_user_idx` ON `vault_key_request` (`user_id`);--> statement-breakpoint +ALTER TABLE `vault` ADD `shared_at` integer;--> statement-breakpoint +ALTER TABLE `vault_membership` ADD `access_version` integer DEFAULT 1 NOT NULL; +--> statement-breakpoint +ALTER TABLE `vault_membership` ADD `explicit_access` integer DEFAULT true NOT NULL; +--> statement-breakpoint +ALTER TABLE `vault_membership` ADD `is_creator` integer DEFAULT false NOT NULL; +--> statement-breakpoint +UPDATE vault_membership SET is_creator = (role = 'owner'); +--> statement-breakpoint +ALTER TABLE `vault_membership` DROP COLUMN `role`; +--> statement-breakpoint +-- Preserve legacy shared-password access for existing active users before disabling +-- the unscoped wrapper fallback on shared vaults. No key is decrypted or rotated. +INSERT INTO vault_key_wrapper (id, vault_id, key_version, kind, user_id, envelope_json, created_at, revoked_at) +SELECT lower(hex(randomblob(16))), w.vault_id, w.key_version, 'password', m.user_id, w.envelope_json, w.created_at, NULL +FROM vault_key_wrapper w +JOIN vault v ON v.id = w.vault_id AND v.active_key_version = w.key_version +JOIN vault_membership m ON m.vault_id = w.vault_id AND m.status = 'active' +JOIN member om ON om.organization_id = v.organization_id AND om.user_id = m.user_id +WHERE w.kind = 'password' AND w.user_id IS NULL AND w.revoked_at IS NULL +AND w.id = (SELECT old.id FROM vault_key_wrapper old + WHERE old.vault_id = w.vault_id AND old.kind = 'password' AND old.user_id IS NULL + AND old.revoked_at IS NULL AND old.key_version = v.active_key_version + ORDER BY old.created_at DESC, old.id DESC LIMIT 1) +ON CONFLICT (vault_id, kind, user_id) DO NOTHING; +--> statement-breakpoint +UPDATE vault SET shared_at = created_at +WHERE (SELECT count(*) FROM vault_membership m WHERE m.vault_id = vault.id AND m.status != 'revoked') > 1; diff --git a/apps/api/drizzle/meta/0007_snapshot.json b/apps/api/drizzle/meta/0007_snapshot.json new file mode 100644 index 00000000..7e0ce889 --- /dev/null +++ b/apps/api/drizzle/meta/0007_snapshot.json @@ -0,0 +1,1774 @@ +{ + "version": "6", + "dialect": "sqlite", + "id": "3c5e57c5-f6bc-4863-a824-417df9e6e7f8", + "prevId": "91325ebc-6c89-495d-b45a-f2510b635d5f", + "tables": { + "account": { + "name": "account", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "issuer": { + "name": "issuer", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'local:credential'" + }, + "account_id": { + "name": "account_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "provider_id": { + "name": "provider_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "access_token": { + "name": "access_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "refresh_token": { + "name": "refresh_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "id_token": { + "name": "id_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "access_token_expires_at": { + "name": "access_token_expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "refresh_token_expires_at": { + "name": "refresh_token_expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "scope": { + "name": "scope", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "password": { + "name": "password", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "account_userId_idx": { + "name": "account_userId_idx", + "columns": [ + "user_id" + ], + "isUnique": false + }, + "account_issuer_accountId_uidx": { + "name": "account_issuer_accountId_uidx", + "columns": [ + "issuer", + "account_id" + ], + "isUnique": true + } + }, + "foreignKeys": { + "account_user_id_user_id_fk": { + "name": "account_user_id_user_id_fk", + "tableFrom": "account", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "device_code": { + "name": "device_code", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "device_code": { + "name": "device_code", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_code": { + "name": "user_code", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "last_polled_at": { + "name": "last_polled_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "polling_interval": { + "name": "polling_interval", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "scope": { + "name": "scope", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "device_code_deviceCode_uidx": { + "name": "device_code_deviceCode_uidx", + "columns": [ + "device_code" + ], + "isUnique": true + }, + "device_code_userCode_uidx": { + "name": "device_code_userCode_uidx", + "columns": [ + "user_code" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "invitation": { + "name": "invitation", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "role": { + "name": "role", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'pending'" + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "inviter_id": { + "name": "inviter_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "invitation_organizationId_idx": { + "name": "invitation_organizationId_idx", + "columns": [ + "organization_id" + ], + "isUnique": false + }, + "invitation_email_idx": { + "name": "invitation_email_idx", + "columns": [ + "email" + ], + "isUnique": false + } + }, + "foreignKeys": { + "invitation_organization_id_organization_id_fk": { + "name": "invitation_organization_id_organization_id_fk", + "tableFrom": "invitation", + "tableTo": "organization", + "columnsFrom": [ + "organization_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "invitation_inviter_id_user_id_fk": { + "name": "invitation_inviter_id_user_id_fk", + "tableFrom": "invitation", + "tableTo": "user", + "columnsFrom": [ + "inviter_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "member": { + "name": "member", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "role": { + "name": "role", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'member'" + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "member_organizationId_idx": { + "name": "member_organizationId_idx", + "columns": [ + "organization_id" + ], + "isUnique": false + }, + "member_userId_idx": { + "name": "member_userId_idx", + "columns": [ + "user_id" + ], + "isUnique": false + } + }, + "foreignKeys": { + "member_organization_id_organization_id_fk": { + "name": "member_organization_id_organization_id_fk", + "tableFrom": "member", + "tableTo": "organization", + "columnsFrom": [ + "organization_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "member_user_id_user_id_fk": { + "name": "member_user_id_user_id_fk", + "tableFrom": "member", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "organization": { + "name": "organization", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "slug": { + "name": "slug", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "logo": { + "name": "logo", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "polar_customer_id": { + "name": "polar_customer_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "synced_vaults_override": { + "name": "synced_vaults_override", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "organization_slug_unique": { + "name": "organization_slug_unique", + "columns": [ + "slug" + ], + "isUnique": true + }, + "organization_polar_customer_id_unique": { + "name": "organization_polar_customer_id_unique", + "columns": [ + "polar_customer_id" + ], + "isUnique": true + }, + "organization_slug_uidx": { + "name": "organization_slug_uidx", + "columns": [ + "slug" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "session": { + "name": "session", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "ip_address": { + "name": "ip_address", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "user_agent": { + "name": "user_agent", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "active_organization_id": { + "name": "active_organization_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "session_token_unique": { + "name": "session_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "session_userId_idx": { + "name": "session_userId_idx", + "columns": [ + "user_id" + ], + "isUnique": false + } + }, + "foreignKeys": { + "session_user_id_user_id_fk": { + "name": "session_user_id_user_id_fk", + "tableFrom": "session", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "user": { + "name": "user", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "email_verified": { + "name": "email_verified", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + }, + "image": { + "name": "image", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "user_email_unique": { + "name": "user_email_unique", + "columns": [ + "email" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "verification": { + "name": "verification", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "identifier": { + "name": "identifier", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "value": { + "name": "value", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "verification_identifier_idx": { + "name": "verification_identifier_idx", + "columns": [ + "identifier" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "polar_subscription": { + "name": "polar_subscription", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "product_id": { + "name": "product_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "polar_customer_id": { + "name": "polar_customer_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "polar_subscription_id": { + "name": "polar_subscription_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "polar_checkout_id": { + "name": "polar_checkout_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "period_start": { + "name": "period_start", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "period_end": { + "name": "period_end", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "cancel_at_period_end": { + "name": "cancel_at_period_end", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "polar_subscription_organizationId_idx": { + "name": "polar_subscription_organizationId_idx", + "columns": [ + "organization_id" + ], + "isUnique": false + }, + "polar_subscription_customerId_idx": { + "name": "polar_subscription_customerId_idx", + "columns": [ + "polar_customer_id" + ], + "isUnique": false + }, + "polar_subscription_status_idx": { + "name": "polar_subscription_status_idx", + "columns": [ + "status", + "period_end" + ], + "isUnique": false + }, + "polar_subscription_polarSubscriptionId_uidx": { + "name": "polar_subscription_polarSubscriptionId_uidx", + "columns": [ + "polar_subscription_id" + ], + "isUnique": true + } + }, + "foreignKeys": { + "polar_subscription_organization_id_organization_id_fk": { + "name": "polar_subscription_organization_id_organization_id_fk", + "tableFrom": "polar_subscription", + "tableTo": "organization", + "columnsFrom": [ + "organization_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "vault": { + "name": "vault", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "shared_at": { + "name": "shared_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "active_key_version": { + "name": "active_key_version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast((julianday('now') - 2440587.5)*86400000 as integer))" + }, + "deleted_at": { + "name": "deleted_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "purge_status": { + "name": "purge_status", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "purge_error": { + "name": "purge_error", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "vault_organizationId_idx": { + "name": "vault_organizationId_idx", + "columns": [ + "organization_id" + ], + "isUnique": false + }, + "vault_deletedAt_idx": { + "name": "vault_deletedAt_idx", + "columns": [ + "deleted_at" + ], + "isUnique": false + }, + "vault_organization_name_active_uidx": { + "name": "vault_organization_name_active_uidx", + "columns": [ + "organization_id", + "name" + ], + "isUnique": true, + "where": "\"vault\".\"deleted_at\" is null" + } + }, + "foreignKeys": { + "vault_organization_id_organization_id_fk": { + "name": "vault_organization_id_organization_id_fk", + "tableFrom": "vault", + "tableTo": "organization", + "columnsFrom": [ + "organization_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "vault_key_wrapper": { + "name": "vault_key_wrapper", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "vault_id": { + "name": "vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "key_version": { + "name": "key_version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "kind": { + "name": "kind", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "envelope_json": { + "name": "envelope_json", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast((julianday('now') - 2440587.5)*86400000 as integer))" + }, + "revoked_at": { + "name": "revoked_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "vault_key_wrapper_vaultId_idx": { + "name": "vault_key_wrapper_vaultId_idx", + "columns": [ + "vault_id" + ], + "isUnique": false + }, + "vault_key_wrapper_userId_idx": { + "name": "vault_key_wrapper_userId_idx", + "columns": [ + "user_id" + ], + "isUnique": false + }, + "vault_key_wrapper_vault_kind_user_unique": { + "name": "vault_key_wrapper_vault_kind_user_unique", + "columns": [ + "vault_id", + "kind", + "user_id" + ], + "isUnique": true + } + }, + "foreignKeys": { + "vault_key_wrapper_vault_id_vault_id_fk": { + "name": "vault_key_wrapper_vault_id_vault_id_fk", + "tableFrom": "vault_key_wrapper", + "tableTo": "vault", + "columnsFrom": [ + "vault_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "vault_key_wrapper_user_id_user_id_fk": { + "name": "vault_key_wrapper_user_id_user_id_fk", + "tableFrom": "vault_key_wrapper", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "vault_membership": { + "name": "vault_membership", + "columns": { + "vault_id": { + "name": "vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "access_version": { + "name": "access_version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 1 + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "joined_at": { + "name": "joined_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast((julianday('now') - 2440587.5)*86400000 as integer))" + }, + "revoked_at": { + "name": "revoked_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "explicit_access": { + "name": "explicit_access", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": true + }, + "is_creator": { + "name": "is_creator", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + } + }, + "indexes": { + "vault_membership_userId_status_idx": { + "name": "vault_membership_userId_status_idx", + "columns": [ + "user_id", + "status" + ], + "isUnique": false + }, + "vault_membership_vaultId_status_idx": { + "name": "vault_membership_vaultId_status_idx", + "columns": [ + "vault_id", + "status" + ], + "isUnique": false + } + }, + "foreignKeys": { + "vault_membership_vault_id_vault_id_fk": { + "name": "vault_membership_vault_id_vault_id_fk", + "tableFrom": "vault_membership", + "tableTo": "vault", + "columnsFrom": [ + "vault_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "vault_membership_user_id_user_id_fk": { + "name": "vault_membership_user_id_user_id_fk", + "tableFrom": "vault_membership", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": { + "vault_membership_vault_id_user_id_pk": { + "columns": [ + "vault_id", + "user_id" + ], + "name": "vault_membership_vault_id_user_id_pk" + } + }, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "vault_sync_status": { + "name": "vault_sync_status", + "columns": { + "vault_id": { + "name": "vault_id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "health_status": { + "name": "health_status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'unknown'" + }, + "health_reasons_json": { + "name": "health_reasons_json", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'[]'" + }, + "current_cursor": { + "name": "current_cursor", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "entry_count": { + "name": "entry_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "live_blob_count": { + "name": "live_blob_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "staged_blob_count": { + "name": "staged_blob_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "pending_delete_blob_count": { + "name": "pending_delete_blob_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "storage_used_bytes": { + "name": "storage_used_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "storage_limit_bytes": { + "name": "storage_limit_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "active_local_vault_count": { + "name": "active_local_vault_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "websocket_count": { + "name": "websocket_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "oldest_staged_blob_age_ms": { + "name": "oldest_staged_blob_age_ms", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "oldest_pending_delete_age_ms": { + "name": "oldest_pending_delete_age_ms", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_commit_at": { + "name": "last_commit_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_gc_at": { + "name": "last_gc_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_flushed_at": { + "name": "last_flushed_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "vault_sync_status_health_idx": { + "name": "vault_sync_status_health_idx", + "columns": [ + "health_status", + "updated_at" + ], + "isUnique": false + }, + "vault_sync_status_storage_idx": { + "name": "vault_sync_status_storage_idx", + "columns": [ + "storage_used_bytes", + "storage_limit_bytes" + ], + "isUnique": false + } + }, + "foreignKeys": { + "vault_sync_status_vault_id_vault_id_fk": { + "name": "vault_sync_status_vault_id_vault_id_fk", + "tableFrom": "vault_sync_status", + "tableTo": "vault", + "columnsFrom": [ + "vault_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "invitation_vault": { + "name": "invitation_vault", + "columns": { + "invitation_id": { + "name": "invitation_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "vault_id": { + "name": "vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": {}, + "foreignKeys": { + "invitation_vault_invitation_id_invitation_id_fk": { + "name": "invitation_vault_invitation_id_invitation_id_fk", + "tableFrom": "invitation_vault", + "tableTo": "invitation", + "columnsFrom": [ + "invitation_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "invitation_vault_vault_id_vault_id_fk": { + "name": "invitation_vault_vault_id_vault_id_fk", + "tableFrom": "invitation_vault", + "tableTo": "vault", + "columnsFrom": [ + "vault_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": { + "invitation_vault_invitation_id_vault_id_pk": { + "columns": [ + "invitation_id", + "vault_id" + ], + "name": "invitation_vault_invitation_id_vault_id_pk" + } + }, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "sharing_audit": { + "name": "sharing_audit", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "actor_id": { + "name": "actor_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "action": { + "name": "action", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "target_id": { + "name": "target_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "sharing_audit_org_idx": { + "name": "sharing_audit_org_idx", + "columns": [ + "organization_id", + "created_at" + ], + "isUnique": false + } + }, + "foreignKeys": { + "sharing_audit_organization_id_organization_id_fk": { + "name": "sharing_audit_organization_id_organization_id_fk", + "tableFrom": "sharing_audit", + "tableTo": "organization", + "columnsFrom": [ + "organization_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "sharing_refresh": { + "name": "sharing_refresh", + "columns": { + "vault_id": { + "name": "vault_id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "revision": { + "name": "revision", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": {}, + "foreignKeys": { + "sharing_refresh_vault_id_vault_id_fk": { + "name": "sharing_refresh_vault_id_vault_id_fk", + "tableFrom": "sharing_refresh", + "tableTo": "vault", + "columnsFrom": [ + "vault_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "vault_key_request": { + "name": "vault_key_request", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "vault_id": { + "name": "vault_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "purpose": { + "name": "purpose", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "access_version": { + "name": "access_version", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "public_key": { + "name": "public_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "envelope_json": { + "name": "envelope_json", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "approved_by": { + "name": "approved_by", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "vault_key_request_vault_status_idx": { + "name": "vault_key_request_vault_status_idx", + "columns": [ + "vault_id", + "status" + ], + "isUnique": false + }, + "vault_key_request_user_idx": { + "name": "vault_key_request_user_idx", + "columns": [ + "user_id" + ], + "isUnique": false + } + }, + "foreignKeys": { + "vault_key_request_vault_id_vault_id_fk": { + "name": "vault_key_request_vault_id_vault_id_fk", + "tableFrom": "vault_key_request", + "tableTo": "vault", + "columnsFrom": [ + "vault_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "vault_key_request_user_id_user_id_fk": { + "name": "vault_key_request_user_id_user_id_fk", + "tableFrom": "vault_key_request", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "vault_key_request_approved_by_user_id_fk": { + "name": "vault_key_request_approved_by_user_id_fk", + "tableFrom": "vault_key_request", + "tableTo": "user", + "columnsFrom": [ + "approved_by" + ], + "columnsTo": [ + "id" + ], + "onDelete": "no action", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + } + }, + "views": {}, + "enums": {}, + "_meta": { + "schemas": {}, + "tables": {}, + "columns": {} + }, + "internal": { + "indexes": {} + } +} diff --git a/apps/api/drizzle/meta/_journal.json b/apps/api/drizzle/meta/_journal.json index 9e91c535..1542a486 100644 --- a/apps/api/drizzle/meta/_journal.json +++ b/apps/api/drizzle/meta/_journal.json @@ -50,6 +50,13 @@ "when": 1787664774337, "tag": "0006_mute_bloodstrike", "breakpoints": true + }, + { + "idx": 7, + "version": "6", + "when": 1790485061751, + "tag": "0007_plus_sharing", + "breakpoints": true } ] } \ No newline at end of file diff --git a/apps/api/public/i18n/de.json b/apps/api/public/i18n/de.json index 8a068e77..aff04571 100644 --- a/apps/api/public/i18n/de.json +++ b/apps/api/public/i18n/de.json @@ -87,7 +87,7 @@ "createNameLabel": "Vault-Name", "createPasswordLabel": "Vault-Passwort", "createConfirmPasswordLabel": "Vault-Passwort (Bestätigung)", - "createPasswordHint": "Das Passwort kann nicht wiederhergestellt werden. Bewahren Sie es sicher auf. Geben Sie dasselbe Passwort ein, wenn Sie dieses Vault in Obsidian verbinden.", + "createPasswordHint": "Bewahre dieses Passwort sicher auf. Bei Verlust muss ein anderer Vault-Administrator, der den Vault-Schlüssel noch besitzt, die Wiederherstellung genehmigen.", "createConfirm": "Vault erstellen", "creating": "Wird erstellt...", "createdVault": "{name} wurde erstellt. Verbinden Sie es in Obsidian mit demselben Vault-Passwort.", @@ -132,6 +132,85 @@ "queuedForDeletion": "{name} wurde in die Löschwarteschlange gestellt.", "unknown": "Unbekannt", "created": "Erstellt am {date}", - "deletionStatus": "Löschen {status}" + "deletionStatus": "Löschen {status}", + "organization": "Organisation", + "organizations": "Organisationen verwalten" + }, + "organizations": { + "title": "Organisationen", + "subtitle": "Verwalte Mitglieder, Einladungen und den Zugriff auf verschlüsselte Vaults.", + "name": "Organisationsname", + "rename": "Umbenennen", + "organizationRole": "Organisationsrolle", + "role": "Rolle", + "email": "E-Mail-Adresse", + "invite": "Mitglied einladen", + "inviteHelp": "Wähle die Vaults, auf die dieses Mitglied zugreifen und die es bearbeiten kann. Eigentümer und Administratoren können auf alle Vaults zugreifen und sie verwalten. Ausstehende Einladungen reservieren Mitgliedsplätze.", + "selectVault": "Wähle mindestens einen Vault.", + "sent": "Einladungs-E-Mail gesendet.", + "copyLink": "Kopiere diesen Link und teile ihn mit der eingeladenen Person. Sie muss sich mit der eingeladenen E-Mail-Adresse anmelden.", + "inviteLink": "Einladungslink", + "invitations": "Einladungen", + "members": "Mitglieder", + "remove": "Mitglied entfernen", + "revoke": "Zugriff entziehen", + "grant": "Zugriff gewähren", + "leave": "Organisation verlassen", + "removeConfirm": "Synchronisierung für diese Person beenden? Bereits heruntergeladene Dateien bleiben auf ihren Geräten.", + "pendingRefresh": "Zugriff entzogen. Bestehende Verbindungen werden geschlossen. Aktualisiere die Seite zur Kontrolle.", + "noAccess": "Kein Zugriff", + "yourAccess": "Dein Zugriff", + "owner": "Eigentümer", + "admin": "Administrator", + "member": "Mitglied", + "active": "Aktiv", + "pending_key": "Wartet auf Schlüsseleinrichtung", + "revoked": "Entzogen", + "pending": "Ausstehend", + "expired": "Abgelaufen", + "canceled": "Abgebrochen", + "rejected": "Abgelehnt", + "accepted": "Angenommen", + "refresh": "Aktualisieren", + "working": "Speichern…", + "saved": "Gespeichert.", + "failed": "Anfrage konnte nicht abgeschlossen werden.", + "signIn": "Bitte melde dich an.", + "loaded": "Organisation geladen.", + "noOrganizations": "Keine Organisationen gefunden.", + "noVaults": "Keine Vaults verfügbar. Erstelle einen unter Remote-Vaults oder bitte einen Administrator um Zugriff.", + "suspended": "Gemeinsame Synchronisierung pausiert. Die Daten bleiben erhalten. Nach Erneuerung von Plus wird der Zugriff fortgesetzt.", + "keyHelp": "Öffne in Obsidian Synch → Vault-Freigabe und Passwörter, um Zugriff anzufordern oder zu genehmigen und dein eigenes Passwort festzulegen. Gespeicherte Versionen werden ebenfalls geteilt.", + "plusLimits": "Plus: 3 Mitglieder einschließlich Eigentümer · 3 Vaults · 2 GB pro Vault · 100 MB pro Datei · 1 Jahr Versionsverlauf", + "cancel": "Einladung abbrechen", + "resend": "Erneut senden", + "vaults": "Remote-Vaults", + "organization": "Organisation", + "billing": "Abrechnung verwalten", + "sharingRequired": "Organisationsfreigaben sind mit Plus oder auf selbst gehosteten Servern verfügbar." + }, + "invitations": { + "organizationRole": "Organisationsrolle", + "owner": "Eigentümer", + "admin": "Administrator", + "member": "Mitglied", + "pending": "Ausstehend", + "expired": "Abgelaufen", + "canceled": "Abgebrochen", + "rejected": "Abgelehnt", + "accepted": "Angenommen", + "failed": "Anfrage konnte nicht abgeschlossen werden.", + "signIn": "Bitte melde dich an.", + "title": "Organisationseinladung", + "subtitle": "Prüfe die Vault-Berechtigungen dieser Einladung.", + "missing": "Öffne den Einladungslink deines Administrators.", + "history": "Nach Annahme und Schlüsselfreigabe erhältst du auch Zugriff auf gespeicherte Versionen.", + "keyHelp": "Öffne nach der Annahme im Synch-Obsidian-Plugin auf deinem Gerät die Vault-Freigabe und Passwörter. Fordere eine Administratorfreigabe an und lege dein eigenes Passwort fest.", + "accept": "Einladung annehmen", + "reject": "Einladung ablehnen", + "next": "Einladung angenommen. Setze die Schlüsseleinrichtung in Obsidian fort.", + "organizations": "Organisation verwalten", + "switchAccount": "Konto wechseln", + "wrongAccount": "Diese Einladung ist für dieses Konto nicht verfügbar. Melde dich mit der eingeladenen E-Mail-Adresse an." } } diff --git a/apps/api/public/i18n/ja.json b/apps/api/public/i18n/ja.json index 024da174..63509c86 100644 --- a/apps/api/public/i18n/ja.json +++ b/apps/api/public/i18n/ja.json @@ -87,7 +87,7 @@ "createNameLabel": "Vault 名", "createPasswordLabel": "Vault パスワード", "createConfirmPasswordLabel": "Vault パスワード（確認）", - "createPasswordHint": "パスワードは復元できないため、安全な場所に保管してください。Obsidian からこの vault に接続する際に同じパスワードを入力します。", + "createPasswordHint": "パスワードを安全に保管してください。紛失時の復旧にはvaultキーを持つ別のvault管理者の承認が必要です。", "createConfirm": "Vault を作成", "creating": "作成中...", "createdVault": "{name} を作成しました。Obsidian から同じ vault パスワードで接続してください。", @@ -132,6 +132,85 @@ "queuedForDeletion": "{name}を削除キューに追加しました。", "unknown": "不明", "created": "作成日 {date}", - "deletionStatus": "削除 {status}" + "deletionStatus": "削除 {status}", + "organization": "組織", + "organizations": "組織を管理" + }, + "organizations": { + "title": "組織の管理", + "subtitle": "メンバー、招待、暗号化された Vault へのアクセスを管理します。", + "name": "組織名", + "rename": "名前を変更", + "organizationRole": "組織の役割", + "role": "役割", + "email": "メールアドレス", + "invite": "メンバーを招待", + "inviteHelp": "メンバーがアクセス・編集できる保管庫を選択してください。所有者と管理者はすべての保管庫にアクセスして管理できます。保留中の招待もメンバー数に含まれます。", + "selectVault": "Vault を1つ以上選択してください。", + "sent": "招待メールを送信しました。", + "copyLink": "この招待リンクをコピーして相手に伝えてください。招待されたメールアドレスでログインする必要があります。", + "inviteLink": "招待リンク", + "invitations": "招待", + "members": "メンバー", + "remove": "メンバーを削除", + "revoke": "アクセスを取り消す", + "grant": "アクセスを許可", + "leave": "組織から退出", + "removeConfirm": "この人の同期アクセスを停止しますか？端末にダウンロード済みのファイルは残ります。", + "pendingRefresh": "アクセスを取り消しました。既存の接続を終了中です。更新して確認してください。", + "noAccess": "アクセスなし", + "yourAccess": "自分の権限", + "owner": "所有者", + "admin": "管理者", + "member": "メンバー", + "active": "有効", + "pending_key": "キー設定待ち", + "revoked": "取り消し済み", + "pending": "承諾待ち", + "expired": "期限切れ", + "canceled": "キャンセル済み", + "rejected": "拒否済み", + "accepted": "承諾済み", + "refresh": "更新", + "working": "保存中…", + "saved": "保存しました。", + "failed": "リクエストを完了できません。", + "signIn": "ログインしてください。", + "loaded": "組織を読み込みました。", + "noOrganizations": "組織がありません。", + "noVaults": "利用可能な Vault がありません。リモート Vault で作成するか、管理者にアクセスを申請してください。", + "suspended": "共有同期は停止中です。データは保持され、Plus を再契約するとアクセスが再開します。", + "keyHelp": "Obsidian の Synch → Vault の共有とパスワードでアクセスを申請・承認し、自分の Vault パスワードを設定してください。保存済みの履歴も共有されます。", + "plusLimits": "Plus：所有者を含む3名 · Vault 3個 · 各 Vault 2 GB · ファイルあたり100 MB · 履歴1年", + "cancel": "招待をキャンセル", + "resend": "再送信", + "vaults": "リモート Vault", + "organization": "組織", + "billing": "請求を管理", + "sharingRequired": "Plusまたはセルフホスト環境で組織のvaultを共有できます。" + }, + "invitations": { + "organizationRole": "組織の役割", + "owner": "所有者", + "admin": "管理者", + "member": "メンバー", + "pending": "承諾待ち", + "expired": "期限切れ", + "canceled": "キャンセル済み", + "rejected": "拒否済み", + "accepted": "承諾済み", + "failed": "リクエストを完了できません。", + "signIn": "ログインしてください。", + "title": "組織への招待", + "subtitle": "招待に含まれる Vault のアクセス権を確認してください。", + "missing": "管理者から受け取った招待リンクを開いてください。", + "history": "承諾してキーの承認を受けると、保存済みの履歴にもアクセスできます。", + "keyHelp": "承諾後、使用する端末の Synch Obsidian プラグインで Vault の共有とパスワードを開き、管理者に承認を申請して自分のパスワードを設定してください。", + "accept": "招待を承諾", + "reject": "招待を拒否", + "next": "招待を承諾しました。Obsidian でキー設定を続けてください。", + "organizations": "組織を管理", + "switchAccount": "アカウントを切り替え", + "wrongAccount": "このアカウントでは招待を開けません。招待を受け取ったメールアドレスでログインしてください。" } } diff --git a/apps/api/public/i18n/ko.json b/apps/api/public/i18n/ko.json index 7e034508..f484a58c 100644 --- a/apps/api/public/i18n/ko.json +++ b/apps/api/public/i18n/ko.json @@ -87,7 +87,7 @@ "createNameLabel": "Vault 이름", "createPasswordLabel": "Vault 비밀번호", "createConfirmPasswordLabel": "Vault 비밀번호 확인", - "createPasswordHint": "비밀번호는 복구할 수 없으니 안전한 곳에 보관하세요. Obsidian에서 이 vault를 연결할 때 같은 비밀번호를 입력합니다.", + "createPasswordHint": "비밀번호를 안전하게 보관하세요. 분실 시 vault 키를 가진 다른 vault 관리자의 승인이 있어야 복구할 수 있습니다.", "createConfirm": "Vault 생성", "creating": "생성 중...", "createdVault": "{name}이(가) 생성되었습니다. Obsidian에서 같은 vault 비밀번호로 연결하세요.", @@ -132,6 +132,85 @@ "queuedForDeletion": "{name} 삭제가 대기열에 추가되었습니다.", "unknown": "알 수 없음", "created": "생성일 {date}", - "deletionStatus": "삭제 {status}" + "deletionStatus": "삭제 {status}", + "organization": "조직", + "organizations": "조직 관리" + }, + "organizations": { + "title": "조직 관리", + "subtitle": "멤버, 초대, 암호화된 vault의 접근 권한을 관리합니다.", + "name": "조직 이름", + "rename": "이름 변경", + "organizationRole": "조직 역할", + "role": "역할", + "email": "이메일 주소", + "invite": "멤버 초대", + "inviteHelp": "멤버가 접근하고 편집할 vault를 선택하세요. 소유자와 관리자는 모든 vault에 접근하고 관리할 수 있습니다. 대기 중인 초대도 멤버 수에 포함됩니다.", + "selectVault": "Vault를 하나 이상 선택하세요.", + "sent": "초대 이메일을 보냈습니다.", + "copyLink": "초대 링크를 복사해 초대한 사람에게 전달하세요. 초대받은 이메일 주소로 로그인해야 합니다.", + "inviteLink": "초대 링크", + "invitations": "초대", + "members": "멤버", + "remove": "멤버 제거", + "revoke": "접근 회수", + "grant": "접근 허용", + "leave": "조직 탈퇴", + "removeConfirm": "이 사람의 동기화 접근을 중지할까요? 이미 기기에 내려받은 파일은 유지됩니다.", + "pendingRefresh": "접근 권한을 회수했습니다. 기존 연결을 종료 중이니 새로고침해 확인하세요.", + "noAccess": "접근 없음", + "yourAccess": "내 권한", + "owner": "소유자", + "admin": "관리자", + "member": "멤버", + "active": "활성", + "pending_key": "키 설정 대기", + "revoked": "회수됨", + "pending": "수락 대기", + "expired": "만료됨", + "canceled": "취소됨", + "rejected": "거절됨", + "accepted": "수락됨", + "refresh": "새로고침", + "working": "저장 중…", + "saved": "저장했습니다.", + "failed": "요청을 완료할 수 없습니다.", + "signIn": "로그인해 주세요.", + "loaded": "조직을 불러왔습니다.", + "noOrganizations": "조직이 없습니다.", + "noVaults": "사용 가능한 vault가 없습니다. 원격 vault에서 생성하거나 관리자에게 접근을 요청하세요.", + "suspended": "공유 동기화가 중지되었습니다. 데이터는 보존되며 Plus를 재구독하면 접근이 재개됩니다.", + "keyHelp": "Obsidian의 Synch → Vault 공유 및 비밀번호에서 접근을 요청·승인하고 개인 vault 비밀번호를 설정하세요. 보관된 과거 이력도 공유됩니다.", + "plusLimits": "Plus: 소유자 포함 3명 · Vault 3개 · Vault별 2 GB · 파일당 100 MB · 이력 1년", + "cancel": "초대 취소", + "resend": "재전송", + "vaults": "원격 vault", + "organization": "조직", + "billing": "구독 관리", + "sharingRequired": "Plus 또는 self-hosted에서 조직의 vault를 공유할 수 있습니다." + }, + "invitations": { + "organizationRole": "조직 역할", + "owner": "소유자", + "admin": "관리자", + "member": "멤버", + "pending": "수락 대기", + "expired": "만료됨", + "canceled": "취소됨", + "rejected": "거절됨", + "accepted": "수락됨", + "failed": "요청을 완료할 수 없습니다.", + "signIn": "로그인해 주세요.", + "title": "조직 초대", + "subtitle": "초대에 포함된 vault 접근 권한을 확인하세요.", + "missing": "관리자가 제공한 초대 링크를 열어주세요.", + "history": "초대를 수락하고 키 승인을 받으면 보관된 과거 이력에도 접근할 수 있습니다.", + "keyHelp": "수락 후 사용할 기기의 Synch Obsidian 플러그인에서 Vault 공유 및 비밀번호를 열어 관리자 승인을 요청하고 자신의 vault 비밀번호를 설정하세요.", + "accept": "초대 수락", + "reject": "초대 거절", + "next": "초대를 수락했습니다. Obsidian에서 키 설정을 계속하세요.", + "organizations": "조직 관리", + "switchAccount": "계정 전환", + "wrongAccount": "이 계정에서는 초대를 열 수 없습니다. 초대를 받은 이메일 주소로 로그인하세요." } } diff --git a/apps/api/public/i18n/zh-cn.json b/apps/api/public/i18n/zh-cn.json index 69e3b0aa..0121a064 100644 --- a/apps/api/public/i18n/zh-cn.json +++ b/apps/api/public/i18n/zh-cn.json @@ -87,7 +87,7 @@ "createNameLabel": "Vault 名称", "createPasswordLabel": "Vault 密码", "createConfirmPasswordLabel": "确认 vault 密码", - "createPasswordHint": "密码无法找回，请妥善保管。在 Obsidian 中连接此 vault 时需要输入相同的密码。", + "createPasswordHint": "请妥善保管密码。丢失后，需要仍持有 vault 密钥的其他 vault 管理员批准才能恢复。", "createConfirm": "创建 vault", "creating": "创建中...", "createdVault": "{name} 已创建。请在 Obsidian 中使用相同的 vault 密码连接。", @@ -132,6 +132,85 @@ "queuedForDeletion": "{name} 已加入删除队列。", "unknown": "未知", "created": "创建于 {date}", - "deletionStatus": "删除 {status}" + "deletionStatus": "删除 {status}", + "organization": "组织", + "organizations": "管理组织" + }, + "organizations": { + "title": "组织管理", + "subtitle": "管理成员、邀请以及加密 Vault 的访问权限。", + "name": "组织名称", + "rename": "重命名", + "organizationRole": "组织角色", + "role": "角色", + "email": "电子邮件地址", + "invite": "邀请成员", + "inviteHelp": "选择此成员可以访问和编辑的保险库。所有者和管理员可以访问和管理所有保险库。待处理的邀请也会占用成员名额。", + "selectVault": "请至少选择一个 Vault。", + "sent": "邀请邮件已发送。", + "copyLink": "复制此邀请链接并发送给受邀人。对方必须使用受邀的电子邮件地址登录。", + "inviteLink": "邀请链接", + "invitations": "邀请", + "members": "成员", + "remove": "移除成员", + "revoke": "撤销访问", + "grant": "授予访问", + "leave": "退出组织", + "removeConfirm": "停止此人的同步访问？已下载到设备上的文件仍会保留。", + "pendingRefresh": "访问权限已撤销，正在关闭现有连接。请刷新以确认。", + "noAccess": "无访问权限", + "yourAccess": "我的权限", + "owner": "所有者", + "admin": "管理员", + "member": "成员", + "active": "已启用", + "pending_key": "等待密钥设置", + "revoked": "已撤销", + "pending": "待接受", + "expired": "已过期", + "canceled": "已取消", + "rejected": "已拒绝", + "accepted": "已接受", + "refresh": "刷新", + "working": "保存中…", + "saved": "已保存。", + "failed": "无法完成请求。", + "signIn": "请登录。", + "loaded": "组织已加载。", + "noOrganizations": "没有组织。", + "noVaults": "没有可用的 Vault。请在远程 Vault 中创建，或向管理员申请访问。", + "suspended": "共享同步已暂停。数据会保留，续订 Plus 后将恢复访问。", + "keyHelp": "在 Obsidian 的 Synch → Vault 共享与密码中申请或批准访问，并设置个人 Vault 密码。保留的历史记录也会共享。", + "plusLimits": "Plus：含所有者共 3 人 · 3 个 Vault · 每个 Vault 2 GB · 每个文件 100 MB · 1 年历史记录", + "cancel": "取消邀请", + "resend": "重新发送", + "vaults": "远程 Vault", + "organization": "组织", + "billing": "管理订阅", + "sharingRequired": "Plus 或自托管服务器支持组织 vault 共享。" + }, + "invitations": { + "organizationRole": "组织角色", + "owner": "所有者", + "admin": "管理员", + "member": "成员", + "pending": "待接受", + "expired": "已过期", + "canceled": "已取消", + "rejected": "已拒绝", + "accepted": "已接受", + "failed": "无法完成请求。", + "signIn": "请登录。", + "title": "组织邀请", + "subtitle": "查看此邀请包含的 Vault 访问权限。", + "missing": "请打开管理员提供的邀请链接。", + "history": "接受邀请并获得密钥批准后，你也可以访问保留的历史记录。", + "keyHelp": "接受后，在所用设备的 Synch Obsidian 插件中打开 Vault 共享与密码，申请管理员批准并设置自己的 Vault 密码。", + "accept": "接受邀请", + "reject": "拒绝邀请", + "next": "邀请已接受。请在 Obsidian 中继续设置密钥。", + "organizations": "管理组织", + "switchAccount": "切换账号", + "wrongAccount": "此账号无法查看邀请。请使用收到邀请的邮箱登录。" } } diff --git a/apps/api/public/i18n/zh-tw.json b/apps/api/public/i18n/zh-tw.json index 77041369..915b622f 100644 --- a/apps/api/public/i18n/zh-tw.json +++ b/apps/api/public/i18n/zh-tw.json @@ -87,7 +87,7 @@ "createNameLabel": "Vault 名稱", "createPasswordLabel": "Vault 密碼", "createConfirmPasswordLabel": "確認 vault 密碼", - "createPasswordHint": "密碼無法復原，請妥善保管。在 Obsidian 連接此 vault 時需要輸入相同的密碼。", + "createPasswordHint": "請妥善保管密碼。遺失後，須由仍持有 vault 金鑰的其他 vault 管理員批准才能復原。", "createConfirm": "建立 vault", "creating": "建立中...", "createdVault": "{name} 已建立。請在 Obsidian 使用相同的 vault 密碼連接。", @@ -132,6 +132,85 @@ "queuedForDeletion": "{name} 已加入刪除佇列。", "unknown": "未知", "created": "建立於 {date}", - "deletionStatus": "刪除 {status}" + "deletionStatus": "刪除 {status}", + "organization": "組織", + "organizations": "管理組織" + }, + "organizations": { + "title": "組織管理", + "subtitle": "管理成員、邀請以及加密 Vault 的存取權限。", + "name": "組織名稱", + "rename": "重新命名", + "organizationRole": "組織角色", + "role": "角色", + "email": "電子郵件地址", + "invite": "邀請成員", + "inviteHelp": "選擇此成員可以存取和編輯的保管庫。擁有者和管理員可以存取和管理所有保管庫。待處理的邀請也會占用成員名額。", + "selectVault": "請至少選擇一個 Vault。", + "sent": "邀請郵件已傳送。", + "copyLink": "複製此邀請連結並傳送給受邀人。對方必須使用受邀的電子郵件地址登入。", + "inviteLink": "邀請連結", + "invitations": "邀請", + "members": "成員", + "remove": "移除成員", + "revoke": "撤銷存取", + "grant": "授予存取", + "leave": "退出組織", + "removeConfirm": "停止此人的同步存取？已下載到裝置上的檔案仍會保留。", + "pendingRefresh": "存取權限已撤銷，正在關閉現有連線。請重新整理以確認。", + "noAccess": "無存取權限", + "yourAccess": "我的權限", + "owner": "擁有者", + "admin": "管理員", + "member": "成員", + "active": "已啟用", + "pending_key": "等待金鑰設定", + "revoked": "已撤銷", + "pending": "待接受", + "expired": "已過期", + "canceled": "已取消", + "rejected": "已拒絕", + "accepted": "已接受", + "refresh": "重新整理", + "working": "儲存中…", + "saved": "已儲存。", + "failed": "無法完成請求。", + "signIn": "請登入。", + "loaded": "組織已載入。", + "noOrganizations": "沒有組織。", + "noVaults": "沒有可用的 Vault。請在遠端 Vault 中建立，或向管理員申請存取。", + "suspended": "共享同步已暫停。資料會保留，續訂 Plus 後將恢復存取。", + "keyHelp": "在 Obsidian 的 Synch → Vault 共享與密碼中申請或核准存取，並設定個人 Vault 密碼。保留的歷史紀錄也會共享。", + "plusLimits": "Plus：含擁有者共 3 人 · 3 個 Vault · 每個 Vault 2 GB · 每個檔案 100 MB · 1 年歷史紀錄", + "cancel": "取消邀請", + "resend": "重新傳送", + "vaults": "遠端 Vault", + "organization": "組織", + "billing": "管理訂閱", + "sharingRequired": "Plus 或自架伺服器支援組織 vault 共享。" + }, + "invitations": { + "organizationRole": "組織角色", + "owner": "擁有者", + "admin": "管理員", + "member": "成員", + "pending": "待接受", + "expired": "已過期", + "canceled": "已取消", + "rejected": "已拒絕", + "accepted": "已接受", + "failed": "無法完成請求。", + "signIn": "請登入。", + "title": "組織邀請", + "subtitle": "查看此邀請包含的 Vault 存取權限。", + "missing": "請開啟管理員提供的邀請連結。", + "history": "接受邀請並取得金鑰核准後，你也可以存取保留的歷史紀錄。", + "keyHelp": "接受後，在使用裝置的 Synch Obsidian 外掛中開啟 Vault 共享與密碼，申請管理員核准並設定自己的 Vault 密碼。", + "accept": "接受邀請", + "reject": "拒絕邀請", + "next": "邀請已接受。請在 Obsidian 中繼續設定金鑰。", + "organizations": "管理組織", + "switchAccount": "切換帳號", + "wrongAccount": "此帳號無法查看邀請。請使用收到邀請的信箱登入。" } } diff --git a/apps/api/public/invitations.html b/apps/api/public/invitations.html new file mode 100644 index 00000000..9a5f16e9 --- /dev/null +++ b/apps/api/public/invitations.html @@ -0,0 +1,93 @@ + + + + + + Synch invitation + + + + + +
+
Synch
+

Organization invitation

Review the vault access included with your invitation.

+ +

…

+
+
+ + + diff --git a/apps/api/public/organization-ui.js b/apps/api/public/organization-ui.js new file mode 100644 index 00000000..f684b866 --- /dev/null +++ b/apps/api/public/organization-ui.js @@ -0,0 +1,6 @@ +// Organization management depends on role; sharing actions check plan entitlement. +window.synchOrganizationUI = { + canManage(organization) { + return ["owner", "admin"].includes(organization?.role); + }, +}; diff --git a/apps/api/public/organizations.html b/apps/api/public/organizations.html new file mode 100644 index 00000000..bb79e32a --- /dev/null +++ b/apps/api/public/organizations.html @@ -0,0 +1,211 @@ + + + + + + Synch organizations + + + + + + +
+
SynchRemote vaults
+ + +

…

+
+
+ + + diff --git a/apps/api/public/styles.css b/apps/api/public/styles.css index ae8837cc..dc6d42a1 100644 --- a/apps/api/public/styles.css +++ b/apps/api/public/styles.css @@ -742,3 +742,86 @@ dialog::backdrop { width: 480px; } } + +/* Organization management keeps actions beside their scope on wide screens. */ +.org-toolbar, .org-inline, .org-row { display: flex; align-items: end; gap: 0.75rem; flex-wrap: wrap; } +.org-toolbar { margin: 1.5rem 0; align-items: center; } +.org-toolbar .input { width: auto; min-width: 12rem; flex: 1; } +.org-detail { display: grid; gap: 1.25rem; margin-top: 1.25rem; } +.org-panel { border: 1px solid var(--zinc-800); border-radius: 0.75rem; padding: 1.5rem; display: grid; gap: 1rem; } +.org-heading { font-size: 1.125rem; font-weight: 600; color: var(--zinc-100); line-height: 1.5; } +.org-form { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 1rem; } +.org-form p { grid-column: 1 / -1; } +.org-field { display: grid; gap: 0.5rem; flex: 1; min-width: 10rem; } +.org-person { flex: 1; min-width: 12rem; overflow-wrap: anywhere; } +.org-row { align-items: center; padding: 0.75rem 0; border-bottom: 1px solid var(--zinc-800); } +.org-row .input, .org-inline > .input { width: auto; } +.org-warning { color: #fbbf24; } +.org-panel ul { padding-left: 1.25rem; } +@media (max-width: 600px) { .org-form { grid-template-columns: 1fr; } .org-panel { padding: 1rem; } .org-row .input { flex: 1; } } + +.organization-topbar { justify-content: space-between; gap: 1rem; flex-wrap: wrap; } + +/* Organization settings follow the document order at every viewport width. */ +.organizations-page { background: #0d0e10; font-size: 1rem; line-height: 1.6; } +.organization-page { max-width: 50rem; padding-block: 1.5rem 4rem; } +.organization-page .organization-topbar { margin-bottom: 1.75rem; padding-bottom: 1rem; border-bottom: 1px solid var(--zinc-800); } +.organization-page .brand { font-size: 0.875rem; line-height: 1.5; font-weight: 650; letter-spacing: 0.14em; } +.organization-page .vaults-header { margin-bottom: 1.5rem; } +.organization-page .page-title { font-size: 1.875rem; font-weight: 600; line-height: 1.3; } +.organization-page .vaults-subtitle { font-size: 1rem; color: var(--zinc-400); } +.organization-page .org-toolbar { margin: 0; padding: 0.75rem 0; } +.organization-page .org-toolbar .input { flex: 0 1 16rem; min-width: 0; } +.organization-page #vaults-link { margin-left: auto; font-size: 1rem; color: var(--zinc-300); } +.organization-page #vaults-link::after, .organization-page .org-billing::after { content: ' ↗'; color: var(--zinc-500); } +.organization-page #status { font-size: 0.9375rem; } +.organization-page #status:empty { display: none; } +.organization-page #status[data-kind="error"] { color: var(--red-400); } +.organization-page .org-detail { grid-template-columns: minmax(0, 1fr); gap: 0; margin-top: 0.75rem; } +.organization-page .org-panel { background: transparent; border: 0; border-top: 1px solid #2a2b30; border-radius: 0; padding: 1.5rem 0; gap: 1rem; align-content: start; min-width: 0; } +.organization-page .org-heading { font-size: 1.25rem; font-weight: 600; letter-spacing: -0.02em; } +.organization-page .org-summary { display: flex; flex-wrap: wrap; align-items: baseline; gap: 0.75rem 1.5rem; border-top: 0; padding: 0 0 1.5rem; } +.organization-page .org-summary .org-warning { flex-basis: 100%; } +.organization-page .org-summary > p { font-size: 0.9375rem; line-height: 1.7; } +.organization-page .org-billing { justify-self: start; font-size: 0.9375rem; white-space: nowrap; } +.organization-page .org-settings { flex: 1; font-size: 0.9375rem; } +.organization-page .org-settings summary { cursor: pointer; width: fit-content; } +.organization-page .org-settings form { margin-top: 1rem; max-width: 34rem; } +.organization-page .org-panel-heading { display: flex; align-items: center; gap: 0.5rem; } +.organization-page .org-count { padding: 0.0625rem 0.4375rem; border-radius: 0.375rem; background: #2a2b30; color: var(--zinc-300); font-size: 0.875rem; } +.organization-page .org-row { padding: 0.875rem 0; gap: 0.75rem; } +.organization-page .org-row:last-child { border-bottom: 0; padding-bottom: 0; } +.organization-page .org-person { display: flex; align-items: center; gap: 0.75rem; min-width: 0; flex-basis: 12rem; } +.organization-page .org-person-info { display: grid; gap: 0.1875rem; min-width: 0; } +.organization-page .org-person-name { font-size: 1rem; color: var(--zinc-200); } +.organization-page .vault-meta { font-size: 0.9375rem; color: #9799a3; word-break: normal; overflow-wrap: anywhere; } +.organization-page .org-invite-disclosure summary { cursor: pointer; color: var(--zinc-200); font-size: 1rem; width: fit-content; } +.organization-page .org-invite-disclosure[open] summary { margin-bottom: 1.25rem; } +.organization-page .org-role { font-size: 0.9375rem; color: var(--zinc-400); } +.organization-page .org-form { grid-template-columns: minmax(0, 1fr); gap: 1rem; } +.organization-page .org-form > .btn { grid-column: 1 / -1; justify-self: start; min-width: 8rem; margin-top: 0.25rem; } +.organization-page .org-field { min-width: 0; } +.organization-page .label { font-size: 0.9375rem; line-height: 1.5; } +.organization-page .org-form > p { line-height: 1.7; font-size: 0.9375rem; padding: 0; max-width: 40rem; } +.organization-page .input { font-family: inherit; font-size: 1rem; border-radius: 0.5rem; min-height: 2.75rem; background-color: #101114; border-color: #35363d; } +.organization-page .input:disabled { opacity: 0.65; } +.organization-page .btn { font-size: 0.9375rem; line-height: 1.5; border-radius: 0.5rem; min-height: 2.75rem; } +.organization-page :is(a, button, summary, input, select):focus-visible { outline: 2px solid #b2b5cd; outline-offset: 3px; } +.organization-page .org-list-title { font-size: 0.9375rem; font-weight: 500; padding-top: 1rem; border-top: 1px solid var(--zinc-800); color: var(--zinc-300); } +.organization-page .org-vaults { display: grid; gap: 0.875rem; padding-top: 1.5rem; border-top: 1px solid #2a2b30; } +.organization-page .org-section-title { color: var(--zinc-200); font-size: 1.25rem; font-weight: 600; margin-top: 0.25rem; } +.organization-page .org-help { font-size: 0.9375rem; line-height: 1.75; color: #9799a3; max-width: 55rem; margin-bottom: 0.375rem; } +.organization-page .org-vault { gap: 0.375rem; padding: 1rem 1.25rem; border: 1px solid #2a2b30; border-radius: 0.5rem; background: #141518; } +.organization-page .org-vault > .org-inline { margin-top: 1rem; } +.organization-page #invite-result { margin-top: 1rem; } +@media (max-width: 480px) { + .organization-page { padding-inline: 1rem; padding-top: 1rem; } + .organization-page .organization-topbar { margin-bottom: 2rem; } + .organization-page .org-vault { padding: 1rem; } + .organization-page .org-toolbar .label { width: 100%; } + .organization-page .org-toolbar .input { flex: 1; } + .organization-page #vaults-link { width: 100%; margin-left: 0; } + .organization-page .org-form { grid-template-columns: 1fr; } + .organization-page .org-row > .input { max-width: 100%; } + .organization-page .org-inline > .input { width: 100%; } +} diff --git a/apps/api/public/vault-crypto.js b/apps/api/public/vault-crypto.js index 8318572f..5d769f30 100644 --- a/apps/api/public/vault-crypto.js +++ b/apps/api/public/vault-crypto.js @@ -1,4 +1,4 @@ -"use strict";var synchVaultCrypto=(()=>{var EA=Object.create;var x=Object.defineProperty;var fA=Object.getOwnPropertyDescriptor;var DA=Object.getOwnPropertyNames;var FA=Object.getPrototypeOf,cA=Object.prototype.hasOwnProperty;var kA=(I,i)=>()=>{try{return i||I((i={exports:{}}).exports,i),i.exports}catch(r){throw i=0,r}},pA=(I,i)=>{for(var r in i)x(I,r,{get:i[r],enumerable:!0})},rA=(I,i,r,a)=>{if(i&&typeof i=="object"||typeof i=="function")for(let F of DA(i))!cA.call(I,F)&&F!==r&&x(I,F,{get:()=>i[F],enumerable:!(a=fA(i,F))||a.enumerable});return I};var SA=(I,i,r)=>(r=I!=null?EA(FA(I)):{},rA(i||!I||!I.__esModule?x(r,"default",{value:I,enumerable:!0}):r,I)),UA=I=>rA(x({},"__esModule",{value:!0}),I);var BA=kA((v,oA)=>{(function(I,i){typeof v=="object"&&typeof oA<"u"?i(v):typeof define=="function"&&define.amd?define(["exports"],i):i((I=typeof globalThis<"u"?globalThis:I||self).hashwasm=I.hashwasm||{})})(v,(function(I){"use strict";function i(A,C,g,e){return new(g||(g=Promise))((function(t,o){function h(s){try{B(e.next(s))}catch(D){o(D)}}function n(s){try{B(e.throw(s))}catch(D){o(D)}}function B(s){var D;s.done?t(s.value):(D=s.value,D instanceof g?D:new g((function(f){f(D)}))).then(h,n)}B((e=e.apply(A,C||[])).next())}))}typeof SuppressedError=="function"&&SuppressedError;var r,a={name:"argon2",data:"AGFzbQEAAAABKQVgAX8Bf2AAAX9gEH9/f39/f39/f39/f39/f38AYAR/f39/AGACf38AAwYFAAECAwQFBgEBAoCAAgYIAX8BQZCoBAsHQQQGbWVtb3J5AgASSGFzaF9TZXRNZW1vcnlTaXplAAAOSGFzaF9HZXRCdWZmZXIAAQ5IYXNoX0NhbGN1bGF0ZQAECvEyBVgBAn9BACEBAkAgAEEAKAKICCICRg0AAkAgACACayIAQRB2IABBgIB8cSAASWoiAEAAQX9HDQBB/wHADwtBACEBQQBBACkDiAggAEEQdK18NwOICAsgAcALcAECfwJAQQAoAoAIIgANAEEAPwBBEHQiADYCgAhBACgCiAgiAUGAgCBGDQACQEGAgCAgAWsiAEEQdiAAQYCAfHEgAElqIgBAAEF/Rw0AQQAPC0EAQQApA4gIIABBEHStfDcDiAhBACgCgAghAAsgAAvcDgECfiAAIAQpAwAiECAAKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAMIBAgDCkDAIVCIIkiEDcDACAIIBAgCCkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgBCAQIAQpAwCFQiiJIhA3AwAgACAQIAApAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIAwgECAMKQMAhUIwiSIQNwMAIAggECAIKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAEIBAgBCkDAIVCAYk3AwAgASAFKQMAIhAgASkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgDSAQIA0pAwCFQiCJIhA3AwAgCSAQIAkpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAUgECAFKQMAhUIoiSIQNwMAIAEgECABKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACANIBAgDSkDAIVCMIkiEDcDACAJIBAgCSkDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgBSAQIAUpAwCFQgGJNwMAIAIgBikDACIQIAIpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIA4gECAOKQMAhUIgiSIQNwMAIAogECAKKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAGIBAgBikDAIVCKIkiEDcDACACIBAgAikDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgDiAQIA4pAwCFQjCJIhA3AwAgCiAQIAopAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIAYgECAGKQMAhUIBiTcDACADIAcpAwAiECADKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAPIBAgDykDAIVCIIkiEDcDACALIBAgCykDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgByAQIAcpAwCFQiiJIhA3AwAgAyAQIAMpAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIA8gECAPKQMAhUIwiSIQNwMAIAsgECALKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAHIBAgBykDAIVCAYk3AwAgACAFKQMAIhAgACkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgDyAQIA8pAwCFQiCJIhA3AwAgCiAQIAopAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAUgECAFKQMAhUIoiSIQNwMAIAAgECAAKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAPIBAgDykDAIVCMIkiEDcDACAKIBAgCikDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgBSAQIAUpAwCFQgGJNwMAIAEgBikDACIQIAEpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAwgECAMKQMAhUIgiSIQNwMAIAsgECALKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAGIBAgBikDAIVCKIkiEDcDACABIBAgASkDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgDCAQIAwpAwCFQjCJIhA3AwAgCyAQIAspAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIAYgECAGKQMAhUIBiTcDACACIAcpAwAiECACKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACANIBAgDSkDAIVCIIkiEDcDACAIIBAgCCkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgByAQIAcpAwCFQiiJIhA3AwAgAiAQIAIpAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIA0gECANKQMAhUIwiSIQNwMAIAggECAIKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAHIBAgBykDAIVCAYk3AwAgAyAEKQMAIhAgAykDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgDiAQIA4pAwCFQiCJIhA3AwAgCSAQIAkpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAQgECAEKQMAhUIoiSIQNwMAIAMgECADKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAOIBAgDikDAIVCMIkiEDcDACAJIBAgCSkDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgBCAQIAQpAwCFQgGJNwMAC98aAQN/QQAhBEEAIAIpAwAgASkDAIU3A5AIQQAgAikDCCABKQMIhTcDmAhBACACKQMQIAEpAxCFNwOgCEEAIAIpAxggASkDGIU3A6gIQQAgAikDICABKQMghTcDsAhBACACKQMoIAEpAyiFNwO4CEEAIAIpAzAgASkDMIU3A8AIQQAgAikDOCABKQM4hTcDyAhBACACKQNAIAEpA0CFNwPQCEEAIAIpA0ggASkDSIU3A9gIQQAgAikDUCABKQNQhTcD4AhBACACKQNYIAEpA1iFNwPoCEEAIAIpA2AgASkDYIU3A/AIQQAgAikDaCABKQNohTcD+AhBACACKQNwIAEpA3CFNwOACUEAIAIpA3ggASkDeIU3A4gJQQAgAikDgAEgASkDgAGFNwOQCUEAIAIpA4gBIAEpA4gBhTcDmAlBACACKQOQASABKQOQAYU3A6AJQQAgAikDmAEgASkDmAGFNwOoCUEAIAIpA6ABIAEpA6ABhTcDsAlBACACKQOoASABKQOoAYU3A7gJQQAgAikDsAEgASkDsAGFNwPACUEAIAIpA7gBIAEpA7gBhTcDyAlBACACKQPAASABKQPAAYU3A9AJQQAgAikDyAEgASkDyAGFNwPYCUEAIAIpA9ABIAEpA9ABhTcD4AlBACACKQPYASABKQPYAYU3A+gJQQAgAikD4AEgASkD4AGFNwPwCUEAIAIpA+gBIAEpA+gBhTcD+AlBACACKQPwASABKQPwAYU3A4AKQQAgAikD+AEgASkD+AGFNwOICkEAIAIpA4ACIAEpA4AChTcDkApBACACKQOIAiABKQOIAoU3A5gKQQAgAikDkAIgASkDkAKFNwOgCkEAIAIpA5gCIAEpA5gChTcDqApBACACKQOgAiABKQOgAoU3A7AKQQAgAikDqAIgASkDqAKFNwO4CkEAIAIpA7ACIAEpA7AChTcDwApBACACKQO4AiABKQO4AoU3A8gKQQAgAikDwAIgASkDwAKFNwPQCkEAIAIpA8gCIAEpA8gChTcD2ApBACACKQPQAiABKQPQAoU3A+AKQQAgAikD2AIgASkD2AKFNwPoCkEAIAIpA+ACIAEpA+AChTcD8ApBACACKQPoAiABKQPoAoU3A/gKQQAgAikD8AIgASkD8AKFNwOAC0EAIAIpA/gCIAEpA/gChTcDiAtBACACKQOAAyABKQOAA4U3A5ALQQAgAikDiAMgASkDiAOFNwOYC0EAIAIpA5ADIAEpA5ADhTcDoAtBACACKQOYAyABKQOYA4U3A6gLQQAgAikDoAMgASkDoAOFNwOwC0EAIAIpA6gDIAEpA6gDhTcDuAtBACACKQOwAyABKQOwA4U3A8ALQQAgAikDuAMgASkDuAOFNwPIC0EAIAIpA8ADIAEpA8ADhTcD0AtBACACKQPIAyABKQPIA4U3A9gLQQAgAikD0AMgASkD0AOFNwPgC0EAIAIpA9gDIAEpA9gDhTcD6AtBACACKQPgAyABKQPgA4U3A/ALQQAgAikD6AMgASkD6AOFNwP4C0EAIAIpA/ADIAEpA/ADhTcDgAxBACACKQP4AyABKQP4A4U3A4gMQQAgAikDgAQgASkDgASFNwOQDEEAIAIpA4gEIAEpA4gEhTcDmAxBACACKQOQBCABKQOQBIU3A6AMQQAgAikDmAQgASkDmASFNwOoDEEAIAIpA6AEIAEpA6AEhTcDsAxBACACKQOoBCABKQOoBIU3A7gMQQAgAikDsAQgASkDsASFNwPADEEAIAIpA7gEIAEpA7gEhTcDyAxBACACKQPABCABKQPABIU3A9AMQQAgAikDyAQgASkDyASFNwPYDEEAIAIpA9AEIAEpA9AEhTcD4AxBACACKQPYBCABKQPYBIU3A+gMQQAgAikD4AQgASkD4ASFNwPwDEEAIAIpA+gEIAEpA+gEhTcD+AxBACACKQPwBCABKQPwBIU3A4ANQQAgAikD+AQgASkD+ASFNwOIDUEAIAIpA4AFIAEpA4AFhTcDkA1BACACKQOIBSABKQOIBYU3A5gNQQAgAikDkAUgASkDkAWFNwOgDUEAIAIpA5gFIAEpA5gFhTcDqA1BACACKQOgBSABKQOgBYU3A7ANQQAgAikDqAUgASkDqAWFNwO4DUEAIAIpA7AFIAEpA7AFhTcDwA1BACACKQO4BSABKQO4BYU3A8gNQQAgAikDwAUgASkDwAWFNwPQDUEAIAIpA8gFIAEpA8gFhTcD2A1BACACKQPQBSABKQPQBYU3A+ANQQAgAikD2AUgASkD2AWFNwPoDUEAIAIpA+AFIAEpA+AFhTcD8A1BACACKQPoBSABKQPoBYU3A/gNQQAgAikD8AUgASkD8AWFNwOADkEAIAIpA/gFIAEpA/gFhTcDiA5BACACKQOABiABKQOABoU3A5AOQQAgAikDiAYgASkDiAaFNwOYDkEAIAIpA5AGIAEpA5AGhTcDoA5BACACKQOYBiABKQOYBoU3A6gOQQAgAikDoAYgASkDoAaFNwOwDkEAIAIpA6gGIAEpA6gGhTcDuA5BACACKQOwBiABKQOwBoU3A8AOQQAgAikDuAYgASkDuAaFNwPIDkEAIAIpA8AGIAEpA8AGhTcD0A5BACACKQPIBiABKQPIBoU3A9gOQQAgAikD0AYgASkD0AaFNwPgDkEAIAIpA9gGIAEpA9gGhTcD6A5BACACKQPgBiABKQPgBoU3A/AOQQAgAikD6AYgASkD6AaFNwP4DkEAIAIpA/AGIAEpA/AGhTcDgA9BACACKQP4BiABKQP4BoU3A4gPQQAgAikDgAcgASkDgAeFNwOQD0EAIAIpA4gHIAEpA4gHhTcDmA9BACACKQOQByABKQOQB4U3A6APQQAgAikDmAcgASkDmAeFNwOoD0EAIAIpA6AHIAEpA6AHhTcDsA9BACACKQOoByABKQOoB4U3A7gPQQAgAikDsAcgASkDsAeFNwPAD0EAIAIpA7gHIAEpA7gHhTcDyA9BACACKQPAByABKQPAB4U3A9APQQAgAikDyAcgASkDyAeFNwPYD0EAIAIpA9AHIAEpA9AHhTcD4A9BACACKQPYByABKQPYB4U3A+gPQQAgAikD4AcgASkD4AeFNwPwD0EAIAIpA+gHIAEpA+gHhTcD+A9BACACKQPwByABKQPwB4U3A4AQQQAgAikD+AcgASkD+AeFNwOIEEGQCEGYCEGgCEGoCEGwCEG4CEHACEHICEHQCEHYCEHgCEHoCEHwCEH4CEGACUGICRACQZAJQZgJQaAJQagJQbAJQbgJQcAJQcgJQdAJQdgJQeAJQegJQfAJQfgJQYAKQYgKEAJBkApBmApBoApBqApBsApBuApBwApByApB0ApB2ApB4ApB6ApB8ApB+ApBgAtBiAsQAkGQC0GYC0GgC0GoC0GwC0G4C0HAC0HIC0HQC0HYC0HgC0HoC0HwC0H4C0GADEGIDBACQZAMQZgMQaAMQagMQbAMQbgMQcAMQcgMQdAMQdgMQeAMQegMQfAMQfgMQYANQYgNEAJBkA1BmA1BoA1BqA1BsA1BuA1BwA1ByA1B0A1B2A1B4A1B6A1B8A1B+A1BgA5BiA4QAkGQDkGYDkGgDkGoDkGwDkG4DkHADkHIDkHQDkHYDkHgDkHoDkHwDkH4DkGAD0GIDxACQZAPQZgPQaAPQagPQbAPQbgPQcAPQcgPQdAPQdgPQeAPQegPQfAPQfgPQYAQQYgQEAJBkAhBmAhBkAlBmAlBkApBmApBkAtBmAtBkAxBmAxBkA1BmA1BkA5BmA5BkA9BmA8QAkGgCEGoCEGgCUGoCUGgCkGoCkGgC0GoC0GgDEGoDEGgDUGoDUGgDkGoDkGgD0GoDxACQbAIQbgIQbAJQbgJQbAKQbgKQbALQbgLQbAMQbgMQbANQbgNQbAOQbgOQbAPQbgPEAJBwAhByAhBwAlByAlBwApByApBwAtByAtBwAxByAxBwA1ByA1BwA5ByA5BwA9ByA8QAkHQCEHYCEHQCUHYCUHQCkHYCkHQC0HYC0HQDEHYDEHQDUHYDUHQDkHYDkHQD0HYDxACQeAIQegIQeAJQegJQeAKQegKQeALQegLQeAMQegMQeANQegNQeAOQegOQeAPQegPEAJB8AhB+AhB8AlB+AlB8ApB+ApB8AtB+AtB8AxB+AxB8A1B+A1B8A5B+A5B8A9B+A8QAkGACUGICUGACkGICkGAC0GIC0GADEGIDEGADUGIDUGADkGIDkGAD0GID0GAEEGIEBACAkACQCADRQ0AA0AgACAEaiIDIAIgBGoiBSkDACABIARqIgYpAwCFIARBkAhqKQMAhSADKQMAhTcDACADQQhqIgMgBUEIaikDACAGQQhqKQMAhSAEQZgIaikDAIUgAykDAIU3AwAgBEEQaiIEQYAIRw0ADAILC0EAIQQDQCAAIARqIgMgAiAEaiIFKQMAIAEgBGoiBikDAIUgBEGQCGopAwCFNwMAIANBCGogBUEIaikDACAGQQhqKQMAhSAEQZgIaikDAIU3AwAgBEEQaiIEQYAIRw0ACwsL5QcMBX8BfgR/An4BfwF+AX8Bfgd/AX4DfwF+AkBBACgCgAgiAiABQQp0aiIDKAIIIAFHDQAgAygCDCEEIAMoAgAhBUEAIAMoAhQiBq03A7gQQQAgBK0iBzcDsBBBACAFIAEgBUECdG4iCGwiCUECdK03A6gQAkACQAJAAkAgBEUNAEF/IQogBUUNASAIQQNsIQsgCEECdCIErSEMIAWtIQ0gBkF/akECSSEOQgAhDwNAQQAgDzcDkBAgD6chEEIAIRFBACEBA0BBACARNwOgECAPIBGEUCIDIA5xIRIgBkEBRiAPUCITIAZBAkYgEUICVHFxciEUQX8gAUEBakEDcSAIbEF/aiATGyEVIAEgEHIhFiABIAhsIRcgA0EBdCEYQgAhGQNAQQBCADcDwBBBACAZNwOYECAYIQECQCASRQ0AQQBCATcDwBBBkBhBkBBBkCBBABADQZAYQZAYQZAgQQAQA0ECIQELAkAgASAITw0AIAQgGaciGmwgF2ogAWohAwNAIANBACAEIAEbQQAgEVAiGxtqQX9qIRwCQAJAIBQNAEEAKAKACCICIBxBCnQiHGohCgwBCwJAIAFB/wBxIgINAEEAQQApA8AQQgF8NwPAEEGQGEGQEEGQIEEAEANBkBhBkBhBkCBBABADCyAcQQp0IRwgAkEDdEGQGGohCkEAKAKACCECCyACIANBCnRqIAIgHGogAiAKKQMAIh1CIIinIAVwIBogFhsiHCAEbCABIAFBACAZIBytUSIcGyIKIBsbIBdqIAogC2ogExsgAUUgHHJrIhsgFWqtIB1C/////w+DIh0gHX5CIIggG61+QiCIfSAMgqdqQQp0akEBEAMgA0EBaiEDIAggAUEBaiIBRw0ACwsgGUIBfCIZIA1SDQALIBFCAXwiEachASARQgRSDQALIA9CAXwiDyAHUg0AC0EAKAKACCECCyAJQQx0QYB4aiEXIAVBf2oiCkUNAgwBC0EAQgM3A6AQQQAgBEF/aq03A5AQQYB4IRcLIAIgF2ohGyAIQQx0IQhBACEcA0AgCCAcQQFqIhxsQYB4aiEEQQAhAQNAIBsgAWoiAyADKQMAIAIgBCABamopAwCFNwMAIANBCGoiAyADKQMAIAIgBCABQQhyamopAwCFNwMAIAFBCGohAyABQRBqIQEgA0H4B0kNAAsgHCAKRw0ACwsgAiAXaiEbQXghAQNAIAIgAWoiA0EIaiAbIAFqIgRBCGopAwA3AwAgA0EQaiAEQRBqKQMANwMAIANBGGogBEEYaikDADcDACADQSBqIARBIGopAwA3AwAgAUEgaiIBQfgHSQ0ACwsL",hash:"e4cdc523"};class F{constructor(){this.mutex=Promise.resolve()}lock(){let C=()=>{};return this.mutex=this.mutex.then((()=>new Promise(C))),new Promise((g=>{C=g}))}dispatch(C){return i(this,void 0,void 0,(function*(){let g=yield this.lock();try{return yield Promise.resolve(C())}finally{g()}}))}}let J=typeof globalThis<"u"?globalThis:typeof self<"u"?self:typeof window<"u"?window:global,d=(r=J.Buffer)!==null&&r!==void 0?r:null,Y=J.TextEncoder?new J.TextEncoder:null;function z(A,C){return(15&A)+(A>>6|A>>3&8)<<4|(15&C)+(C>>6|C>>3&8)}function $(A,C){let g=C.length>>1;for(let e=0;e>>4;A[e++]=o>9?o+AA:o+IA,o=15&C[t],A[e++]=o>9?o+AA:o+IA}return String.fromCharCode.apply(null,A)}let l=d!==null?A=>{if(typeof A=="string"){let C=d.from(A,"utf8");return new Uint8Array(C.buffer,C.byteOffset,C.length)}if(d.isBuffer(A))return new Uint8Array(A.buffer,A.byteOffset,A.length);if(ArrayBuffer.isView(A))return new Uint8Array(A.buffer,A.byteOffset,A.byteLength);throw new Error("Invalid data type!")}:A=>{if(typeof A=="string")return Y.encode(A);if(ArrayBuffer.isView(A))return new Uint8Array(A.buffer,A.byteOffset,A.byteLength);throw new Error("Invalid data type!")},U="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",N=new Uint8Array(256);for(let A=0;A>18&63)+U.charAt(n>>12&63)+U.charAt(n>>6&63)+U.charAt(63&n);t.push(B)}if(e===1){let h=A[g-1],n=U.charAt(h>>2),B=U.charAt(h<<4&63);t.push(`${n}${B}`),C&&t.push("==")}else if(e===2){let h=(A[g-2]<<8)+A[g-1],n=U.charAt(h>>10),B=U.charAt(h>>4&63),s=U.charAt(h<<2&63);t.push(`${n}${B}${s}`),C&&t.push("=")}return t.join("")}function gA(A){let C=Math.floor(.75*A.length),g=A.length;return A[g-1]==="="&&(C-=1,A[g-2]==="="&&(C-=1)),C}function CA(A){let C=gA(A),g=A.length,e=new Uint8Array(C),t=0;for(let o=0;o>4,t+=1,e[t]=(15&n)<<4|B>>2,t+=1,e[t]=(3&B)<<6|63&s,t+=1}return e}let L=16384,aA=new F,Z=new Map;function eA(A,C){return i(this,void 0,void 0,(function*(){let g=null,e=null,t=!1;if(typeof WebAssembly>"u")throw new Error("WebAssembly is not supported in this environment!");let o=()=>new DataView(g.exports.memory.buffer).getUint32(g.exports.STATE_SIZE,!0),h=aA.dispatch((()=>i(this,void 0,void 0,(function*(){if(!Z.has(A.name)){let w=CA(A.data),E=WebAssembly.compile(w);Z.set(A.name,E)}let Q=yield Z.get(A.name);g=yield WebAssembly.instantiate(Q,{})})))),n=(Q=null)=>{t=!0,g.exports.Hash_Init(Q)},B=Q=>{if(!t)throw new Error("update() called before init()");(w=>{let E=0;for(;E{if(!t)throw new Error("digest() called before init()");return t=!1,g.exports.Hash_Final(w),Q==="binary"?e.slice(0,C):T(s,e,C)},f=Q=>typeof Q=="string"?Q.length<4096:Q.byteLength!0;break;case"blake2b":case"blake2s":k=(Q,w)=>w<=512&&f(Q);break;case"blake3":k=(Q,w)=>w===0&&f(Q);break;case"xxhash64":case"xxhash3":case"xxhash128":case"crc64":k=()=>!1}return yield i(this,void 0,void 0,(function*(){g||(yield h);let Q=g.exports.Hash_GetBuffer(),w=g.exports.memory.buffer;e=new Uint8Array(w,Q,L)})),{getMemory:()=>e,writeMemory:(Q,w=0)=>{e.set(Q,w)},getExports:()=>g.exports,setMemorySize:Q=>{g.exports.Hash_SetMemorySize(Q);let w=g.exports.Hash_GetBuffer(),E=g.exports.memory.buffer;e=new Uint8Array(E,w,Q)},init:n,update:B,digest:D,save:()=>{if(!t)throw new Error("save() can only be called after init() and before digest()");let Q=g.exports.Hash_GetState(),w=o(),E=g.exports.memory.buffer,c=new Uint8Array(E,Q,w),G=new Uint8Array(4+w);return $(G,A.hash),G.set(c,4),G},load:Q=>{if(!(Q instanceof Uint8Array))throw new Error("load() expects an Uint8Array generated by save()");let w=g.exports.Hash_GetState(),E=o(),c=4+E,G=g.exports.memory.buffer;if(Q.length!==c)throw new Error(`Bad state length (expected ${c} bytes, got ${Q.length})`);if(!(function(p,S){if(p.length!==2*S.length)return!1;for(let y=0;y{if(!k(Q,w))return n(w),B(Q),D("hex",E);let c=l(Q);return e.set(c),g.exports.Hash_Calculate(c.length,w,E),T(s,e,C)},hashLength:C}}))}var sA={name:"blake2b",data:"AGFzbQEAAAABEQRgAAF/YAJ/fwBgAX8AYAAAAwoJAAECAwECAgABBQQBAQICBg4CfwFBsIsFC38AQYAICwdwCAZtZW1vcnkCAA5IYXNoX0dldEJ1ZmZlcgAACkhhc2hfRmluYWwAAwlIYXNoX0luaXQABQtIYXNoX1VwZGF0ZQAGDUhhc2hfR2V0U3RhdGUABw5IYXNoX0NhbGN1bGF0ZQAIClNUQVRFX1NJWkUDAQrTOAkFAEGACQvrAgIFfwF+AkAgAUEBSA0AAkACQAJAIAFBgAFBACgC4IoBIgJrIgNKDQAgASEEDAELQQBBADYC4IoBAkAgAkH/AEoNACACQeCJAWohBSAAIQRBACEGA0AgBSAELQAAOgAAIARBAWohBCAFQQFqIQUgAyAGQQFqIgZB/wFxSg0ACwtBAEEAKQPAiQEiB0KAAXw3A8CJAUEAQQApA8iJASAHQv9+Vq18NwPIiQFB4IkBEAIgACADaiEAAkAgASADayIEQYEBSA0AIAIgAWohBQNAQQBBACkDwIkBIgdCgAF8NwPAiQFBAEEAKQPIiQEgB0L/flatfDcDyIkBIAAQAiAAQYABaiEAIAVBgH9qIgVBgAJLDQALIAVBgH9qIQQMAQsgBEEATA0BC0EAIQUDQCAFQQAoAuCKAWpB4IkBaiAAIAVqLQAAOgAAIAQgBUEBaiIFQf8BcUoNAAsLQQBBACgC4IoBIARqNgLgigELC78uASR+QQBBACkD0IkBQQApA7CJASIBQQApA5CJAXwgACkDICICfCIDhULr+obav7X2wR+FQiCJIgRCq/DT9K/uvLc8fCIFIAGFQiiJIgYgA3wgACkDKCIBfCIHIASFQjCJIgggBXwiCSAGhUIBiSIKQQApA8iJAUEAKQOoiQEiBEEAKQOIiQF8IAApAxAiA3wiBYVCn9j52cKR2oKbf4VCIIkiC0K7zqqm2NDrs7t/fCIMIASFQiiJIg0gBXwgACkDGCIEfCIOfCAAKQNQIgV8Ig9BACkDwIkBQQApA6CJASIQQQApA4CJASIRfCAAKQMAIgZ8IhKFQtGFmu/6z5SH0QCFQiCJIhNCiJLznf/M+YTqAHwiFCAQhUIoiSIVIBJ8IAApAwgiEHwiFiAThUIwiSIXhUIgiSIYQQApA9iJAUEAKQO4iQEiE0EAKQOYiQF8IAApAzAiEnwiGYVC+cL4m5Gjs/DbAIVCIIkiGkLx7fT4paf9p6V/fCIbIBOFQiiJIhwgGXwgACkDOCITfCIZIBqFQjCJIhogG3wiG3wiHSAKhUIoiSIeIA98IAApA1giCnwiDyAYhUIwiSIYIB18Ih0gDiALhUIwiSIOIAx8Ih8gDYVCAYkiDCAWfCAAKQNAIgt8Ig0gGoVCIIkiFiAJfCIaIAyFQiiJIiAgDXwgACkDSCIJfCIhIBaFQjCJIhYgGyAchUIBiSIMIAd8IAApA2AiB3wiDSAOhUIgiSIOIBcgFHwiFHwiFyAMhUIoiSIbIA18IAApA2giDHwiHCAOhUIwiSIOIBd8IhcgG4VCAYkiGyAZIBQgFYVCAYkiFHwgACkDcCINfCIVIAiFQiCJIhkgH3wiHyAUhUIoiSIUIBV8IAApA3giCHwiFXwgDHwiIoVCIIkiI3wiJCAbhUIoiSIbICJ8IBJ8IiIgFyAYIBUgGYVCMIkiFSAffCIZIBSFQgGJIhQgIXwgDXwiH4VCIIkiGHwiFyAUhUIoiSIUIB98IAV8Ih8gGIVCMIkiGCAXfCIXIBSFQgGJIhR8IAF8IiEgFiAafCIWIBUgHSAehUIBiSIaIBx8IAl8IhyFQiCJIhV8Ih0gGoVCKIkiGiAcfCAIfCIcIBWFQjCJIhWFQiCJIh4gGSAOIBYgIIVCAYkiFiAPfCACfCIPhUIgiSIOfCIZIBaFQiiJIhYgD3wgC3wiDyAOhUIwiSIOIBl8Ihl8IiAgFIVCKIkiFCAhfCAEfCIhIB6FQjCJIh4gIHwiICAiICOFQjCJIiIgJHwiIyAbhUIBiSIbIBx8IAp8IhwgDoVCIIkiDiAXfCIXIBuFQiiJIhsgHHwgE3wiHCAOhUIwiSIOIBkgFoVCAYkiFiAffCAQfCIZICKFQiCJIh8gFSAdfCIVfCIdIBaFQiiJIhYgGXwgB3wiGSAfhUIwiSIfIB18Ih0gFoVCAYkiFiAVIBqFQgGJIhUgD3wgBnwiDyAYhUIgiSIYICN8IhogFYVCKIkiFSAPfCADfCIPfCAHfCIihUIgiSIjfCIkIBaFQiiJIhYgInwgBnwiIiAjhUIwiSIjICR8IiQgFoVCAYkiFiAOIBd8Ig4gDyAYhUIwiSIPICAgFIVCAYkiFCAZfCAKfCIXhUIgiSIYfCIZIBSFQiiJIhQgF3wgC3wiF3wgBXwiICAPIBp8Ig8gHyAOIBuFQgGJIg4gIXwgCHwiGoVCIIkiG3wiHyAOhUIoiSIOIBp8IAx8IhogG4VCMIkiG4VCIIkiISAdIB4gDyAVhUIBiSIPIBx8IAF8IhWFQiCJIhx8Ih0gD4VCKIkiDyAVfCADfCIVIByFQjCJIhwgHXwiHXwiHiAWhUIoiSIWICB8IA18IiAgIYVCMIkiISAefCIeIBogFyAYhUIwiSIXIBl8IhggFIVCAYkiFHwgCXwiGSAchUIgiSIaICR8IhwgFIVCKIkiFCAZfCACfCIZIBqFQjCJIhogHSAPhUIBiSIPICJ8IAR8Ih0gF4VCIIkiFyAbIB98Iht8Ih8gD4VCKIkiDyAdfCASfCIdIBeFQjCJIhcgH3wiHyAPhUIBiSIPIBsgDoVCAYkiDiAVfCATfCIVICOFQiCJIhsgGHwiGCAOhUIoiSIOIBV8IBB8IhV8IAx8IiKFQiCJIiN8IiQgD4VCKIkiDyAifCAHfCIiICOFQjCJIiMgJHwiJCAPhUIBiSIPIBogHHwiGiAVIBuFQjCJIhUgHiAWhUIBiSIWIB18IAR8IhuFQiCJIhx8Ih0gFoVCKIkiFiAbfCAQfCIbfCABfCIeIBUgGHwiFSAXIBogFIVCAYkiFCAgfCATfCIYhUIgiSIXfCIaIBSFQiiJIhQgGHwgCXwiGCAXhUIwiSIXhUIgiSIgIB8gISAVIA6FQgGJIg4gGXwgCnwiFYVCIIkiGXwiHyAOhUIoiSIOIBV8IA18IhUgGYVCMIkiGSAffCIffCIhIA+FQiiJIg8gHnwgBXwiHiAghUIwiSIgICF8IiEgGyAchUIwiSIbIB18IhwgFoVCAYkiFiAYfCADfCIYIBmFQiCJIhkgJHwiHSAWhUIoiSIWIBh8IBJ8IhggGYVCMIkiGSAfIA6FQgGJIg4gInwgAnwiHyAbhUIgiSIbIBcgGnwiF3wiGiAOhUIoiSIOIB98IAZ8Ih8gG4VCMIkiGyAafCIaIA6FQgGJIg4gFSAXIBSFQgGJIhR8IAh8IhUgI4VCIIkiFyAcfCIcIBSFQiiJIhQgFXwgC3wiFXwgBXwiIoVCIIkiI3wiJCAOhUIoiSIOICJ8IAh8IiIgGiAgIBUgF4VCMIkiFSAcfCIXIBSFQgGJIhQgGHwgCXwiGIVCIIkiHHwiGiAUhUIoiSIUIBh8IAZ8IhggHIVCMIkiHCAafCIaIBSFQgGJIhR8IAR8IiAgGSAdfCIZIBUgISAPhUIBiSIPIB98IAN8Ih2FQiCJIhV8Ih8gD4VCKIkiDyAdfCACfCIdIBWFQjCJIhWFQiCJIiEgFyAbIBkgFoVCAYkiFiAefCABfCIZhUIgiSIbfCIXIBaFQiiJIhYgGXwgE3wiGSAbhUIwiSIbIBd8Ihd8Ih4gFIVCKIkiFCAgfCAMfCIgICGFQjCJIiEgHnwiHiAiICOFQjCJIiIgJHwiIyAOhUIBiSIOIB18IBJ8Ih0gG4VCIIkiGyAafCIaIA6FQiiJIg4gHXwgC3wiHSAbhUIwiSIbIBcgFoVCAYkiFiAYfCANfCIXICKFQiCJIhggFSAffCIVfCIfIBaFQiiJIhYgF3wgEHwiFyAYhUIwiSIYIB98Ih8gFoVCAYkiFiAVIA+FQgGJIg8gGXwgCnwiFSAchUIgiSIZICN8IhwgD4VCKIkiDyAVfCAHfCIVfCASfCIihUIgiSIjfCIkIBaFQiiJIhYgInwgBXwiIiAjhUIwiSIjICR8IiQgFoVCAYkiFiAbIBp8IhogFSAZhUIwiSIVIB4gFIVCAYkiFCAXfCADfCIXhUIgiSIZfCIbIBSFQiiJIhQgF3wgB3wiF3wgAnwiHiAVIBx8IhUgGCAaIA6FQgGJIg4gIHwgC3wiGoVCIIkiGHwiHCAOhUIoiSIOIBp8IAR8IhogGIVCMIkiGIVCIIkiICAfICEgFSAPhUIBiSIPIB18IAZ8IhWFQiCJIh18Ih8gD4VCKIkiDyAVfCAKfCIVIB2FQjCJIh0gH3wiH3wiISAWhUIoiSIWIB58IAx8Ih4gIIVCMIkiICAhfCIhIBogFyAZhUIwiSIXIBt8IhkgFIVCAYkiFHwgEHwiGiAdhUIgiSIbICR8Ih0gFIVCKIkiFCAafCAJfCIaIBuFQjCJIhsgHyAPhUIBiSIPICJ8IBN8Ih8gF4VCIIkiFyAYIBx8Ihh8IhwgD4VCKIkiDyAffCABfCIfIBeFQjCJIhcgHHwiHCAPhUIBiSIPIBggDoVCAYkiDiAVfCAIfCIVICOFQiCJIhggGXwiGSAOhUIoiSIOIBV8IA18IhV8IA18IiKFQiCJIiN8IiQgD4VCKIkiDyAifCAMfCIiICOFQjCJIiMgJHwiJCAPhUIBiSIPIBsgHXwiGyAVIBiFQjCJIhUgISAWhUIBiSIWIB98IBB8IhiFQiCJIh18Ih8gFoVCKIkiFiAYfCAIfCIYfCASfCIhIBUgGXwiFSAXIBsgFIVCAYkiFCAefCAHfCIZhUIgiSIXfCIbIBSFQiiJIhQgGXwgAXwiGSAXhUIwiSIXhUIgiSIeIBwgICAVIA6FQgGJIg4gGnwgAnwiFYVCIIkiGnwiHCAOhUIoiSIOIBV8IAV8IhUgGoVCMIkiGiAcfCIcfCIgIA+FQiiJIg8gIXwgBHwiISAehUIwiSIeICB8IiAgGCAdhUIwiSIYIB98Ih0gFoVCAYkiFiAZfCAGfCIZIBqFQiCJIhogJHwiHyAWhUIoiSIWIBl8IBN8IhkgGoVCMIkiGiAcIA6FQgGJIg4gInwgCXwiHCAYhUIgiSIYIBcgG3wiF3wiGyAOhUIoiSIOIBx8IAN8IhwgGIVCMIkiGCAbfCIbIA6FQgGJIg4gFSAXIBSFQgGJIhR8IAt8IhUgI4VCIIkiFyAdfCIdIBSFQiiJIhQgFXwgCnwiFXwgBHwiIoVCIIkiI3wiJCAOhUIoiSIOICJ8IAl8IiIgGyAeIBUgF4VCMIkiFSAdfCIXIBSFQgGJIhQgGXwgDHwiGYVCIIkiHXwiGyAUhUIoiSIUIBl8IAp8IhkgHYVCMIkiHSAbfCIbIBSFQgGJIhR8IAN8Ih4gGiAffCIaIBUgICAPhUIBiSIPIBx8IAd8IhyFQiCJIhV8Ih8gD4VCKIkiDyAcfCAQfCIcIBWFQjCJIhWFQiCJIiAgFyAYIBogFoVCAYkiFiAhfCATfCIahUIgiSIYfCIXIBaFQiiJIhYgGnwgDXwiGiAYhUIwiSIYIBd8Ihd8IiEgFIVCKIkiFCAefCAFfCIeICCFQjCJIiAgIXwiISAiICOFQjCJIiIgJHwiIyAOhUIBiSIOIBx8IAt8IhwgGIVCIIkiGCAbfCIbIA6FQiiJIg4gHHwgEnwiHCAYhUIwiSIYIBcgFoVCAYkiFiAZfCABfCIXICKFQiCJIhkgFSAffCIVfCIfIBaFQiiJIhYgF3wgBnwiFyAZhUIwiSIZIB98Ih8gFoVCAYkiFiAVIA+FQgGJIg8gGnwgCHwiFSAdhUIgiSIaICN8Ih0gD4VCKIkiDyAVfCACfCIVfCANfCIihUIgiSIjfCIkIBaFQiiJIhYgInwgCXwiIiAjhUIwiSIjICR8IiQgFoVCAYkiFiAYIBt8IhggFSAahUIwiSIVICEgFIVCAYkiFCAXfCASfCIXhUIgiSIafCIbIBSFQiiJIhQgF3wgCHwiF3wgB3wiISAVIB18IhUgGSAYIA6FQgGJIg4gHnwgBnwiGIVCIIkiGXwiHSAOhUIoiSIOIBh8IAt8IhggGYVCMIkiGYVCIIkiHiAfICAgFSAPhUIBiSIPIBx8IAp8IhWFQiCJIhx8Ih8gD4VCKIkiDyAVfCAEfCIVIByFQjCJIhwgH3wiH3wiICAWhUIoiSIWICF8IAN8IiEgHoVCMIkiHiAgfCIgIBggFyAahUIwiSIXIBt8IhogFIVCAYkiFHwgBXwiGCAchUIgiSIbICR8IhwgFIVCKIkiFCAYfCABfCIYIBuFQjCJIhsgHyAPhUIBiSIPICJ8IAx8Ih8gF4VCIIkiFyAZIB18Ihl8Ih0gD4VCKIkiDyAffCATfCIfIBeFQjCJIhcgHXwiHSAPhUIBiSIPIBkgDoVCAYkiDiAVfCAQfCIVICOFQiCJIhkgGnwiGiAOhUIoiSIOIBV8IAJ8IhV8IBN8IiKFQiCJIiN8IiQgD4VCKIkiDyAifCASfCIiICOFQjCJIiMgJHwiJCAPhUIBiSIPIBsgHHwiGyAVIBmFQjCJIhUgICAWhUIBiSIWIB98IAt8IhmFQiCJIhx8Ih8gFoVCKIkiFiAZfCACfCIZfCAJfCIgIBUgGnwiFSAXIBsgFIVCAYkiFCAhfCAFfCIahUIgiSIXfCIbIBSFQiiJIhQgGnwgA3wiGiAXhUIwiSIXhUIgiSIhIB0gHiAVIA6FQgGJIg4gGHwgEHwiFYVCIIkiGHwiHSAOhUIoiSIOIBV8IAF8IhUgGIVCMIkiGCAdfCIdfCIeIA+FQiiJIg8gIHwgDXwiICAhhUIwiSIhIB58Ih4gGSAchUIwiSIZIB98IhwgFoVCAYkiFiAafCAIfCIaIBiFQiCJIhggJHwiHyAWhUIoiSIWIBp8IAp8IhogGIVCMIkiGCAdIA6FQgGJIg4gInwgBHwiHSAZhUIgiSIZIBcgG3wiF3wiGyAOhUIoiSIOIB18IAd8Ih0gGYVCMIkiGSAbfCIbIA6FQgGJIg4gFSAXIBSFQgGJIhR8IAx8IhUgI4VCIIkiFyAcfCIcIBSFQiiJIhQgFXwgBnwiFXwgEnwiIoVCIIkiI3wiJCAOhUIoiSIOICJ8IBN8IiIgGyAhIBUgF4VCMIkiFSAcfCIXIBSFQgGJIhQgGnwgBnwiGoVCIIkiHHwiGyAUhUIoiSIUIBp8IBB8IhogHIVCMIkiHCAbfCIbIBSFQgGJIhR8IA18IiEgGCAffCIYIBUgHiAPhUIBiSIPIB18IAJ8Ih2FQiCJIhV8Ih4gD4VCKIkiDyAdfCABfCIdIBWFQjCJIhWFQiCJIh8gFyAZIBggFoVCAYkiFiAgfCADfCIYhUIgiSIZfCIXIBaFQiiJIhYgGHwgBHwiGCAZhUIwiSIZIBd8Ihd8IiAgFIVCKIkiFCAhfCAIfCIhIB+FQjCJIh8gIHwiICAiICOFQjCJIiIgJHwiIyAOhUIBiSIOIB18IAd8Ih0gGYVCIIkiGSAbfCIbIA6FQiiJIg4gHXwgDHwiHSAZhUIwiSIZIBcgFoVCAYkiFiAafCALfCIXICKFQiCJIhogFSAefCIVfCIeIBaFQiiJIhYgF3wgCXwiFyAahUIwiSIaIB58Ih4gFoVCAYkiFiAVIA+FQgGJIg8gGHwgBXwiFSAchUIgiSIYICN8IhwgD4VCKIkiDyAVfCAKfCIVfCACfCIChUIgiSIifCIjIBaFQiiJIhYgAnwgC3wiAiAihUIwiSILICN8IiIgFoVCAYkiFiAZIBt8IhkgFSAYhUIwiSIVICAgFIVCAYkiFCAXfCANfCINhUIgiSIXfCIYIBSFQiiJIhQgDXwgBXwiBXwgEHwiECAVIBx8Ig0gGiAZIA6FQgGJIg4gIXwgDHwiDIVCIIkiFXwiGSAOhUIoiSIOIAx8IBJ8IhIgFYVCMIkiDIVCIIkiFSAeIB8gDSAPhUIBiSINIB18IAl8IgmFQiCJIg98IhogDYVCKIkiDSAJfCAIfCIJIA+FQjCJIgggGnwiD3wiGiAWhUIoiSIWIBB8IAd8IhAgEYUgDCAZfCIHIA6FQgGJIgwgCXwgCnwiCiALhUIgiSILIAUgF4VCMIkiBSAYfCIJfCIOIAyFQiiJIgwgCnwgE3wiEyALhUIwiSIKIA58IguFNwOAiQFBACADIAYgDyANhUIBiSINIAJ8fCICIAWFQiCJIgUgB3wiBiANhUIoiSIHIAJ8fCICQQApA4iJAYUgBCABIBIgCSAUhUIBiSIDfHwiASAIhUIgiSISICJ8IgkgA4VCKIkiAyABfHwiASAShUIwiSIEIAl8IhKFNwOIiQFBACATQQApA5CJAYUgECAVhUIwiSIQIBp8IhOFNwOQiQFBACABQQApA5iJAYUgAiAFhUIwiSICIAZ8IgGFNwOYiQFBACASIAOFQgGJQQApA6CJAYUgAoU3A6CJAUEAIBMgFoVCAYlBACkDqIkBhSAKhTcDqIkBQQAgASAHhUIBiUEAKQOwiQGFIASFNwOwiQFBACALIAyFQgGJQQApA7iJAYUgEIU3A7iJAQvdAgUBfwF+AX8BfgJ/IwBBwABrIgAkAAJAQQApA9CJAUIAUg0AQQBBACkDwIkBIgFBACgC4IoBIgKsfCIDNwPAiQFBAEEAKQPIiQEgAyABVK18NwPIiQECQEEALQDoigFFDQBBAEJ/NwPYiQELQQBCfzcD0IkBAkAgAkH/AEoNAEEAIQQDQCACIARqQeCJAWpBADoAACAEQQFqIgRBgAFBACgC4IoBIgJrSA0ACwtB4IkBEAIgAEEAKQOAiQE3AwAgAEEAKQOIiQE3AwggAEEAKQOQiQE3AxAgAEEAKQOYiQE3AxggAEEAKQOgiQE3AyAgAEEAKQOoiQE3AyggAEEAKQOwiQE3AzAgAEEAKQO4iQE3AzhBACgC5IoBIgVBAUgNAEEAIQRBACECA0AgBEGACWogACAEai0AADoAACAEQQFqIQQgBSACQQFqIgJB/wFxSg0ACwsgAEHAAGokAAv9AwMBfwF+AX8jAEGAAWsiAiQAQQBBgQI7AfKKAUEAIAE6APGKAUEAIAA6APCKAUGQfiEAA0AgAEGAiwFqQgA3AAAgAEH4igFqQgA3AAAgAEHwigFqQgA3AAAgAEEYaiIADQALQQAhAEEAQQApA/CKASIDQoiS853/zPmE6gCFNwOAiQFBAEEAKQP4igFCu86qptjQ67O7f4U3A4iJAUEAQQApA4CLAUKr8NP0r+68tzyFNwOQiQFBAEEAKQOIiwFC8e30+KWn/aelf4U3A5iJAUEAQQApA5CLAULRhZrv+s+Uh9EAhTcDoIkBQQBBACkDmIsBQp/Y+dnCkdqCm3+FNwOoiQFBAEEAKQOgiwFC6/qG2r+19sEfhTcDsIkBQQBBACkDqIsBQvnC+JuRo7Pw2wCFNwO4iQFBACADp0H/AXE2AuSKAQJAIAFBAUgNACACQgA3A3ggAkIANwNwIAJCADcDaCACQgA3A2AgAkIANwNYIAJCADcDUCACQgA3A0ggAkIANwNAIAJCADcDOCACQgA3AzAgAkIANwMoIAJCADcDICACQgA3AxggAkIANwMQIAJCADcDCCACQgA3AwBBACEEA0AgAiAAaiAAQYAJai0AADoAACAAQQFqIQAgBEEBaiIEQf8BcSABSA0ACyACQYABEAELIAJBgAFqJAALEgAgAEEDdkH/P3EgAEEQdhAECwkAQYAJIAAQAQsGAEGAiQELGwAgAUEDdkH/P3EgAUEQdhAEQYAJIAAQARADCwsLAQBBgAgLBPAAAAA=",hash:"c6f286e6"};function tA(A){return!Number.isInteger(A)||A<8||A>512||A%8!=0?new Error("Invalid variant! Valid values: 8, 16, ..., 512"):null}function W(A=512,C=null){if(tA(A))return Promise.reject(tA(A));let g=null,e=A;if(C!==null){if(g=l(C),g.length>64)return Promise.reject(new Error("Max key length is 64 bytes"));t=A,o=g.length,e=t|o<<16}var t,o;let h=A/8;return eA(sA,h).then((n=>{e>512&&n.writeMemory(g),n.init(e);let B={init:e>512?()=>(n.writeMemory(g),n.init(e),B):()=>(n.init(e),B),update:s=>(n.update(s),B),digest:s=>n.digest(s),save:()=>n.save(),load:s=>(n.load(s),B),blockSize:128,digestSize:h};return B}))}new F;let QA=new DataView(new ArrayBuffer(4));function u(A){return QA.setInt32(0,A,!0),new Uint8Array(QA.buffer)}function q(A,C,g){return i(this,void 0,void 0,(function*(){if(g<=64){let B=yield W(8*g);return B.update(u(g)),B.update(C),B.digest("binary")}let e=Math.ceil(g/32)-2,t=new Uint8Array(g);A.init(),A.update(u(g)),A.update(C);let o=A.digest("binary");t.set(o.subarray(0,32),0);for(let B=1;B{var C;if(!A||typeof A!="object")throw new Error("Invalid options parameter. It requires an object.");if(!A.password)throw new Error("Password must be specified");if(A.password=l(A.password),A.password.length<1)throw new Error("Password must be specified");if(!A.salt)throw new Error("Salt must be specified");if(A.salt=l(A.salt),A.salt.length<8)throw new Error("Salt should be at least 8 bytes long");if(A.secret=l((C=A.secret)!==null&&C!==void 0?C:""),!Number.isInteger(A.iterations)||A.iterations<1)throw new Error("Iterations should be a positive number");if(!Number.isInteger(A.parallelism)||A.parallelism<1)throw new Error("Parallelism should be a positive number");if(!Number.isInteger(A.hashLength)||A.hashLength<4)throw new Error("Hash length should be at least 4 bytes.");if(!Number.isInteger(A.memorySize))throw new Error("Memory size should be specified.");if(A.memorySize<8*A.parallelism)throw new Error("Memory size should be at least 8 * parallelism.");if(A.outputType===void 0&&(A.outputType="hex"),!["hex","binary","encoded"].includes(A.outputType))throw new Error(`Insupported output type ${A.outputType}. Valid values: ['hex', 'binary', 'encoded']`)};I.argon2Verify=function(A){return i(this,void 0,void 0,(function*(){(e=>{if(!e||typeof e!="object")throw new Error("Invalid options parameter. It requires an object.");if(e.hash===void 0||typeof e.hash!="string")throw new Error("Hash should be specified")})(A);let C=((e,t,o)=>{let h=t.match(/^\$argon2(id|i|d)\$v=([0-9]+)\$((?:[mtp]=[0-9]+,){2}[mtp]=[0-9]+)\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)$/);if(!h)throw new Error("Invalid hash");let[,n,B,s,D,f]=h;if(B!=="19")throw new Error(`Unsupported version: ${B}`);let k={},Q={m:"memorySize",p:"parallelism",t:"iterations"};for(let w of s.split(",")){let[E,c]=w.split("=");k[Q[E]]=Number(c)}return Object.assign(Object.assign({},k),{password:e,secret:o,hashType:n,salt:CA(D),hashLength:gA(f),outputType:"encoded"})})(A.password,A.hash,A.secret);M(C);let g=A.hash.lastIndexOf("$")+1;return(yield b(C)).substring(g)===A.hash.substring(g)}))},I.argon2d=function(A){return i(this,void 0,void 0,(function*(){return M(A),b(Object.assign(Object.assign({},A),{hashType:"d"}))}))},I.argon2i=function(A){return i(this,void 0,void 0,(function*(){return M(A),b(Object.assign(Object.assign({},A),{hashType:"i"}))}))},I.argon2id=function(A){return i(this,void 0,void 0,(function*(){return M(A),b(Object.assign(Object.assign({},A),{hashType:"id"}))}))}}))});var MA={};pA(MA,{VaultPasswordError:()=>P,createArgon2idMetadata:()=>j,createPasswordWrappedRemoteVaultKey:()=>KA,decodeBase64:()=>H,deriveWrapKey:()=>R,encodeBase64:()=>V,randomBytes:()=>m,toArrayBuffer:()=>K,unwrapRemoteVaultKeyWithPassword:()=>JA,validateVaultPassword:()=>NA});function m(I){return crypto.getRandomValues(new Uint8Array(I))}function V(I){let i=[];for(let r=0;rSA(BA(),1)),a=r.default?.argon2id??r["module.exports"]?.argon2id;if(!a)throw new Error("argon2id module failed to load");let F=await a({password:new TextEncoder().encode(I),salt:H(i.salt),iterations:i.iterations,parallelism:i.parallelism,memorySize:i.memoryKiB,hashLength:lA,outputType:"binary"});return await crypto.subtle.importKey("raw",K(F),{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}var nA="aes-256-gcm",hA=1,uA=1,dA=32,GA=12,P=class extends Error{constructor(r,a){super(a);this.code=r;this.name="VaultPasswordError"}};async function KA(I,i={}){let r=wA(I),a=m(dA),F=j(i.kdfOverrides),J=await R(r,F),d=m(GA),Y=await VA(J,a,d);return{remoteVaultKey:a,envelope:{version:hA,keyVersion:uA,kdf:F,wrap:{algorithm:nA,nonce:V(d),ciphertext:V(Y)}}}}async function JA(I,i){let r=wA(I);HA(i);let a=H(i.kdf.salt),F=H(i.wrap.nonce),J=H(i.wrap.ciphertext),d=await R(r,{...i.kdf,salt:V(a)}),Y=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(F)},d,K(J));return new Uint8Array(Y)}async function VA(I,i,r){let a=await crypto.subtle.encrypt({name:"AES-GCM",iv:K(r)},I,K(i));return new Uint8Array(a)}function HA(I){if(I.version!==hA)throw new Error(`unsupported wrapper version: ${I.version}`);if(I.wrap.algorithm!==nA)throw new Error(`unsupported wrap algorithm: ${I.wrap.algorithm}`)}function wA(I){if(!I)throw new P("required","Password is required.");if(I!==I.trim())throw new P("outer_spaces","Password cannot start or end with spaces.");return I}var mA=new Set(["123456","123456789","1234567890","password","password1","password123","qwerty","qwerty123","letmein","admin","welcome","iloveyou","vault","vaultpassword","synch","synchpassword","obsidian","obsidianvault","obsidianvaultpassword","synchvaultpassword"]),YA=["password","qwerty","letmein","admin","welcome","iloveyou","vault","synch","obsidian"];function NA(I){return I?I!==I.trim()?{ok:!1,code:"outer_spaces",message:"Password cannot start or end with spaces."}:I.length<12?{ok:!1,code:"min_length",count:12,message:"Password must be at least 12 characters."}:I.length>256?{ok:!1,code:"max_length",count:256,message:"Password must be 256 characters or fewer."}:PA(I)?{ok:!1,code:"too_weak",message:"Password is too easy to guess. Use a longer passphrase."}:OA(I)?{ok:!1,code:"repeated_character",message:"Password cannot be one repeated character."}:bA(I)?{ok:!1,code:"simple_sequence",message:"Password cannot be a simple sequence."}:{ok:!0}:{ok:!1,code:"required",message:"Password is required."}}function OA(I){return new Set(I.toLowerCase()).size===1}function PA(I){let i=I.toLowerCase().replace(/[^a-z0-9]/g,"");if(mA.has(i))return!0;for(let r of YA)i=i.split(r).join("");return i===""||/^[0-9]+$/.test(i)}function bA(I){if(!/^[a-z]+$/i.test(I)&&!/^[0-9]+$/.test(I))return!1;let i=I.toLowerCase(),r=i.charCodeAt(1)-i.charCodeAt(0);if(r!==1&&r!==-1)return!1;for(let a=1;a{var kA=Object.create;var v=Object.defineProperty;var uA=Object.getOwnPropertyDescriptor;var SA=Object.getOwnPropertyNames;var lA=Object.getPrototypeOf,dA=Object.prototype.hasOwnProperty;var UA=(I,i)=>()=>{try{return i||I((i={exports:{}}).exports,i),i.exports}catch(g){throw i=0,g}},GA=(I,i)=>{for(var g in i)v(I,g,{get:i[g],enumerable:!0})},BA=(I,i,g,B)=>{if(i&&typeof i=="object"||typeof i=="function")for(let E of SA(i))!dA.call(I,E)&&E!==g&&v(I,E,{get:()=>i[E],enumerable:!(B=uA(i,E))||B.enumerable});return I};var KA=(I,i,g)=>(g=I!=null?kA(lA(I)):{},BA(i||!I||!I.__esModule?v(g,"default",{value:I,enumerable:!0}):g,I)),mA=I=>BA(v({},"__esModule",{value:!0}),I);var sA=UA((X,hA)=>{(function(I,i){typeof X=="object"&&typeof hA<"u"?i(X):typeof define=="function"&&define.amd?define(["exports"],i):i((I=typeof globalThis<"u"?globalThis:I||self).hashwasm=I.hashwasm||{})})(X,(function(I){"use strict";function i(A,t,e,r){return new(e||(e=Promise))((function(C,o){function h(w){try{Q(r.next(w))}catch(D){o(D)}}function a(w){try{Q(r.throw(w))}catch(D){o(D)}}function Q(w){var D;w.done?C(w.value):(D=w.value,D instanceof e?D:new e((function(c){c(D)}))).then(h,a)}Q((r=r.apply(A,t||[])).next())}))}typeof SuppressedError=="function"&&SuppressedError;var g,B={name:"argon2",data:"AGFzbQEAAAABKQVgAX8Bf2AAAX9gEH9/f39/f39/f39/f39/f38AYAR/f39/AGACf38AAwYFAAECAwQFBgEBAoCAAgYIAX8BQZCoBAsHQQQGbWVtb3J5AgASSGFzaF9TZXRNZW1vcnlTaXplAAAOSGFzaF9HZXRCdWZmZXIAAQ5IYXNoX0NhbGN1bGF0ZQAECvEyBVgBAn9BACEBAkAgAEEAKAKICCICRg0AAkAgACACayIAQRB2IABBgIB8cSAASWoiAEAAQX9HDQBB/wHADwtBACEBQQBBACkDiAggAEEQdK18NwOICAsgAcALcAECfwJAQQAoAoAIIgANAEEAPwBBEHQiADYCgAhBACgCiAgiAUGAgCBGDQACQEGAgCAgAWsiAEEQdiAAQYCAfHEgAElqIgBAAEF/Rw0AQQAPC0EAQQApA4gIIABBEHStfDcDiAhBACgCgAghAAsgAAvcDgECfiAAIAQpAwAiECAAKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAMIBAgDCkDAIVCIIkiEDcDACAIIBAgCCkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgBCAQIAQpAwCFQiiJIhA3AwAgACAQIAApAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIAwgECAMKQMAhUIwiSIQNwMAIAggECAIKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAEIBAgBCkDAIVCAYk3AwAgASAFKQMAIhAgASkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgDSAQIA0pAwCFQiCJIhA3AwAgCSAQIAkpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAUgECAFKQMAhUIoiSIQNwMAIAEgECABKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACANIBAgDSkDAIVCMIkiEDcDACAJIBAgCSkDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgBSAQIAUpAwCFQgGJNwMAIAIgBikDACIQIAIpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIA4gECAOKQMAhUIgiSIQNwMAIAogECAKKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAGIBAgBikDAIVCKIkiEDcDACACIBAgAikDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgDiAQIA4pAwCFQjCJIhA3AwAgCiAQIAopAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIAYgECAGKQMAhUIBiTcDACADIAcpAwAiECADKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAPIBAgDykDAIVCIIkiEDcDACALIBAgCykDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgByAQIAcpAwCFQiiJIhA3AwAgAyAQIAMpAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIA8gECAPKQMAhUIwiSIQNwMAIAsgECALKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAHIBAgBykDAIVCAYk3AwAgACAFKQMAIhAgACkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgDyAQIA8pAwCFQiCJIhA3AwAgCiAQIAopAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAUgECAFKQMAhUIoiSIQNwMAIAAgECAAKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAPIBAgDykDAIVCMIkiEDcDACAKIBAgCikDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgBSAQIAUpAwCFQgGJNwMAIAEgBikDACIQIAEpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAwgECAMKQMAhUIgiSIQNwMAIAsgECALKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACAGIBAgBikDAIVCKIkiEDcDACABIBAgASkDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgDCAQIAwpAwCFQjCJIhA3AwAgCyAQIAspAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIAYgECAGKQMAhUIBiTcDACACIAcpAwAiECACKQMAIhF8IBFCAYZC/v///x+DIBBC/////w+DfnwiEDcDACANIBAgDSkDAIVCIIkiEDcDACAIIBAgCCkDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgByAQIAcpAwCFQiiJIhA3AwAgAiAQIAIpAwAiEXwgEEL/////D4MgEUIBhkL+////H4N+fCIQNwMAIA0gECANKQMAhUIwiSIQNwMAIAggECAIKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAHIBAgBykDAIVCAYk3AwAgAyAEKQMAIhAgAykDACIRfCARQgGGQv7///8fgyAQQv////8Pg358IhA3AwAgDiAQIA4pAwCFQiCJIhA3AwAgCSAQIAkpAwAiEXwgEUIBhkL+////H4MgEEL/////D4N+fCIQNwMAIAQgECAEKQMAhUIoiSIQNwMAIAMgECADKQMAIhF8IBBC/////w+DIBFCAYZC/v///x+DfnwiEDcDACAOIBAgDikDAIVCMIkiEDcDACAJIBAgCSkDACIRfCAQQv////8PgyARQgGGQv7///8fg358IhA3AwAgBCAQIAQpAwCFQgGJNwMAC98aAQN/QQAhBEEAIAIpAwAgASkDAIU3A5AIQQAgAikDCCABKQMIhTcDmAhBACACKQMQIAEpAxCFNwOgCEEAIAIpAxggASkDGIU3A6gIQQAgAikDICABKQMghTcDsAhBACACKQMoIAEpAyiFNwO4CEEAIAIpAzAgASkDMIU3A8AIQQAgAikDOCABKQM4hTcDyAhBACACKQNAIAEpA0CFNwPQCEEAIAIpA0ggASkDSIU3A9gIQQAgAikDUCABKQNQhTcD4AhBACACKQNYIAEpA1iFNwPoCEEAIAIpA2AgASkDYIU3A/AIQQAgAikDaCABKQNohTcD+AhBACACKQNwIAEpA3CFNwOACUEAIAIpA3ggASkDeIU3A4gJQQAgAikDgAEgASkDgAGFNwOQCUEAIAIpA4gBIAEpA4gBhTcDmAlBACACKQOQASABKQOQAYU3A6AJQQAgAikDmAEgASkDmAGFNwOoCUEAIAIpA6ABIAEpA6ABhTcDsAlBACACKQOoASABKQOoAYU3A7gJQQAgAikDsAEgASkDsAGFNwPACUEAIAIpA7gBIAEpA7gBhTcDyAlBACACKQPAASABKQPAAYU3A9AJQQAgAikDyAEgASkDyAGFNwPYCUEAIAIpA9ABIAEpA9ABhTcD4AlBACACKQPYASABKQPYAYU3A+gJQQAgAikD4AEgASkD4AGFNwPwCUEAIAIpA+gBIAEpA+gBhTcD+AlBACACKQPwASABKQPwAYU3A4AKQQAgAikD+AEgASkD+AGFNwOICkEAIAIpA4ACIAEpA4AChTcDkApBACACKQOIAiABKQOIAoU3A5gKQQAgAikDkAIgASkDkAKFNwOgCkEAIAIpA5gCIAEpA5gChTcDqApBACACKQOgAiABKQOgAoU3A7AKQQAgAikDqAIgASkDqAKFNwO4CkEAIAIpA7ACIAEpA7AChTcDwApBACACKQO4AiABKQO4AoU3A8gKQQAgAikDwAIgASkDwAKFNwPQCkEAIAIpA8gCIAEpA8gChTcD2ApBACACKQPQAiABKQPQAoU3A+AKQQAgAikD2AIgASkD2AKFNwPoCkEAIAIpA+ACIAEpA+AChTcD8ApBACACKQPoAiABKQPoAoU3A/gKQQAgAikD8AIgASkD8AKFNwOAC0EAIAIpA/gCIAEpA/gChTcDiAtBACACKQOAAyABKQOAA4U3A5ALQQAgAikDiAMgASkDiAOFNwOYC0EAIAIpA5ADIAEpA5ADhTcDoAtBACACKQOYAyABKQOYA4U3A6gLQQAgAikDoAMgASkDoAOFNwOwC0EAIAIpA6gDIAEpA6gDhTcDuAtBACACKQOwAyABKQOwA4U3A8ALQQAgAikDuAMgASkDuAOFNwPIC0EAIAIpA8ADIAEpA8ADhTcD0AtBACACKQPIAyABKQPIA4U3A9gLQQAgAikD0AMgASkD0AOFNwPgC0EAIAIpA9gDIAEpA9gDhTcD6AtBACACKQPgAyABKQPgA4U3A/ALQQAgAikD6AMgASkD6AOFNwP4C0EAIAIpA/ADIAEpA/ADhTcDgAxBACACKQP4AyABKQP4A4U3A4gMQQAgAikDgAQgASkDgASFNwOQDEEAIAIpA4gEIAEpA4gEhTcDmAxBACACKQOQBCABKQOQBIU3A6AMQQAgAikDmAQgASkDmASFNwOoDEEAIAIpA6AEIAEpA6AEhTcDsAxBACACKQOoBCABKQOoBIU3A7gMQQAgAikDsAQgASkDsASFNwPADEEAIAIpA7gEIAEpA7gEhTcDyAxBACACKQPABCABKQPABIU3A9AMQQAgAikDyAQgASkDyASFNwPYDEEAIAIpA9AEIAEpA9AEhTcD4AxBACACKQPYBCABKQPYBIU3A+gMQQAgAikD4AQgASkD4ASFNwPwDEEAIAIpA+gEIAEpA+gEhTcD+AxBACACKQPwBCABKQPwBIU3A4ANQQAgAikD+AQgASkD+ASFNwOIDUEAIAIpA4AFIAEpA4AFhTcDkA1BACACKQOIBSABKQOIBYU3A5gNQQAgAikDkAUgASkDkAWFNwOgDUEAIAIpA5gFIAEpA5gFhTcDqA1BACACKQOgBSABKQOgBYU3A7ANQQAgAikDqAUgASkDqAWFNwO4DUEAIAIpA7AFIAEpA7AFhTcDwA1BACACKQO4BSABKQO4BYU3A8gNQQAgAikDwAUgASkDwAWFNwPQDUEAIAIpA8gFIAEpA8gFhTcD2A1BACACKQPQBSABKQPQBYU3A+ANQQAgAikD2AUgASkD2AWFNwPoDUEAIAIpA+AFIAEpA+AFhTcD8A1BACACKQPoBSABKQPoBYU3A/gNQQAgAikD8AUgASkD8AWFNwOADkEAIAIpA/gFIAEpA/gFhTcDiA5BACACKQOABiABKQOABoU3A5AOQQAgAikDiAYgASkDiAaFNwOYDkEAIAIpA5AGIAEpA5AGhTcDoA5BACACKQOYBiABKQOYBoU3A6gOQQAgAikDoAYgASkDoAaFNwOwDkEAIAIpA6gGIAEpA6gGhTcDuA5BACACKQOwBiABKQOwBoU3A8AOQQAgAikDuAYgASkDuAaFNwPIDkEAIAIpA8AGIAEpA8AGhTcD0A5BACACKQPIBiABKQPIBoU3A9gOQQAgAikD0AYgASkD0AaFNwPgDkEAIAIpA9gGIAEpA9gGhTcD6A5BACACKQPgBiABKQPgBoU3A/AOQQAgAikD6AYgASkD6AaFNwP4DkEAIAIpA/AGIAEpA/AGhTcDgA9BACACKQP4BiABKQP4BoU3A4gPQQAgAikDgAcgASkDgAeFNwOQD0EAIAIpA4gHIAEpA4gHhTcDmA9BACACKQOQByABKQOQB4U3A6APQQAgAikDmAcgASkDmAeFNwOoD0EAIAIpA6AHIAEpA6AHhTcDsA9BACACKQOoByABKQOoB4U3A7gPQQAgAikDsAcgASkDsAeFNwPAD0EAIAIpA7gHIAEpA7gHhTcDyA9BACACKQPAByABKQPAB4U3A9APQQAgAikDyAcgASkDyAeFNwPYD0EAIAIpA9AHIAEpA9AHhTcD4A9BACACKQPYByABKQPYB4U3A+gPQQAgAikD4AcgASkD4AeFNwPwD0EAIAIpA+gHIAEpA+gHhTcD+A9BACACKQPwByABKQPwB4U3A4AQQQAgAikD+AcgASkD+AeFNwOIEEGQCEGYCEGgCEGoCEGwCEG4CEHACEHICEHQCEHYCEHgCEHoCEHwCEH4CEGACUGICRACQZAJQZgJQaAJQagJQbAJQbgJQcAJQcgJQdAJQdgJQeAJQegJQfAJQfgJQYAKQYgKEAJBkApBmApBoApBqApBsApBuApBwApByApB0ApB2ApB4ApB6ApB8ApB+ApBgAtBiAsQAkGQC0GYC0GgC0GoC0GwC0G4C0HAC0HIC0HQC0HYC0HgC0HoC0HwC0H4C0GADEGIDBACQZAMQZgMQaAMQagMQbAMQbgMQcAMQcgMQdAMQdgMQeAMQegMQfAMQfgMQYANQYgNEAJBkA1BmA1BoA1BqA1BsA1BuA1BwA1ByA1B0A1B2A1B4A1B6A1B8A1B+A1BgA5BiA4QAkGQDkGYDkGgDkGoDkGwDkG4DkHADkHIDkHQDkHYDkHgDkHoDkHwDkH4DkGAD0GIDxACQZAPQZgPQaAPQagPQbAPQbgPQcAPQcgPQdAPQdgPQeAPQegPQfAPQfgPQYAQQYgQEAJBkAhBmAhBkAlBmAlBkApBmApBkAtBmAtBkAxBmAxBkA1BmA1BkA5BmA5BkA9BmA8QAkGgCEGoCEGgCUGoCUGgCkGoCkGgC0GoC0GgDEGoDEGgDUGoDUGgDkGoDkGgD0GoDxACQbAIQbgIQbAJQbgJQbAKQbgKQbALQbgLQbAMQbgMQbANQbgNQbAOQbgOQbAPQbgPEAJBwAhByAhBwAlByAlBwApByApBwAtByAtBwAxByAxBwA1ByA1BwA5ByA5BwA9ByA8QAkHQCEHYCEHQCUHYCUHQCkHYCkHQC0HYC0HQDEHYDEHQDUHYDUHQDkHYDkHQD0HYDxACQeAIQegIQeAJQegJQeAKQegKQeALQegLQeAMQegMQeANQegNQeAOQegOQeAPQegPEAJB8AhB+AhB8AlB+AlB8ApB+ApB8AtB+AtB8AxB+AxB8A1B+A1B8A5B+A5B8A9B+A8QAkGACUGICUGACkGICkGAC0GIC0GADEGIDEGADUGIDUGADkGIDkGAD0GID0GAEEGIEBACAkACQCADRQ0AA0AgACAEaiIDIAIgBGoiBSkDACABIARqIgYpAwCFIARBkAhqKQMAhSADKQMAhTcDACADQQhqIgMgBUEIaikDACAGQQhqKQMAhSAEQZgIaikDAIUgAykDAIU3AwAgBEEQaiIEQYAIRw0ADAILC0EAIQQDQCAAIARqIgMgAiAEaiIFKQMAIAEgBGoiBikDAIUgBEGQCGopAwCFNwMAIANBCGogBUEIaikDACAGQQhqKQMAhSAEQZgIaikDAIU3AwAgBEEQaiIEQYAIRw0ACwsL5QcMBX8BfgR/An4BfwF+AX8Bfgd/AX4DfwF+AkBBACgCgAgiAiABQQp0aiIDKAIIIAFHDQAgAygCDCEEIAMoAgAhBUEAIAMoAhQiBq03A7gQQQAgBK0iBzcDsBBBACAFIAEgBUECdG4iCGwiCUECdK03A6gQAkACQAJAAkAgBEUNAEF/IQogBUUNASAIQQNsIQsgCEECdCIErSEMIAWtIQ0gBkF/akECSSEOQgAhDwNAQQAgDzcDkBAgD6chEEIAIRFBACEBA0BBACARNwOgECAPIBGEUCIDIA5xIRIgBkEBRiAPUCITIAZBAkYgEUICVHFxciEUQX8gAUEBakEDcSAIbEF/aiATGyEVIAEgEHIhFiABIAhsIRcgA0EBdCEYQgAhGQNAQQBCADcDwBBBACAZNwOYECAYIQECQCASRQ0AQQBCATcDwBBBkBhBkBBBkCBBABADQZAYQZAYQZAgQQAQA0ECIQELAkAgASAITw0AIAQgGaciGmwgF2ogAWohAwNAIANBACAEIAEbQQAgEVAiGxtqQX9qIRwCQAJAIBQNAEEAKAKACCICIBxBCnQiHGohCgwBCwJAIAFB/wBxIgINAEEAQQApA8AQQgF8NwPAEEGQGEGQEEGQIEEAEANBkBhBkBhBkCBBABADCyAcQQp0IRwgAkEDdEGQGGohCkEAKAKACCECCyACIANBCnRqIAIgHGogAiAKKQMAIh1CIIinIAVwIBogFhsiHCAEbCABIAFBACAZIBytUSIcGyIKIBsbIBdqIAogC2ogExsgAUUgHHJrIhsgFWqtIB1C/////w+DIh0gHX5CIIggG61+QiCIfSAMgqdqQQp0akEBEAMgA0EBaiEDIAggAUEBaiIBRw0ACwsgGUIBfCIZIA1SDQALIBFCAXwiEachASARQgRSDQALIA9CAXwiDyAHUg0AC0EAKAKACCECCyAJQQx0QYB4aiEXIAVBf2oiCkUNAgwBC0EAQgM3A6AQQQAgBEF/aq03A5AQQYB4IRcLIAIgF2ohGyAIQQx0IQhBACEcA0AgCCAcQQFqIhxsQYB4aiEEQQAhAQNAIBsgAWoiAyADKQMAIAIgBCABamopAwCFNwMAIANBCGoiAyADKQMAIAIgBCABQQhyamopAwCFNwMAIAFBCGohAyABQRBqIQEgA0H4B0kNAAsgHCAKRw0ACwsgAiAXaiEbQXghAQNAIAIgAWoiA0EIaiAbIAFqIgRBCGopAwA3AwAgA0EQaiAEQRBqKQMANwMAIANBGGogBEEYaikDADcDACADQSBqIARBIGopAwA3AwAgAUEgaiIBQfgHSQ0ACwsL",hash:"e4cdc523"};class E{constructor(){this.mutex=Promise.resolve()}lock(){let t=()=>{};return this.mutex=this.mutex.then((()=>new Promise(t))),new Promise((e=>{t=e}))}dispatch(t){return i(this,void 0,void 0,(function*(){let e=yield this.lock();try{return yield Promise.resolve(t())}finally{e()}}))}}let U=typeof globalThis<"u"?globalThis:typeof self<"u"?self:typeof window<"u"?window:global,K=(g=U.Buffer)!==null&&g!==void 0?g:null,T=U.TextEncoder?new U.TextEncoder:null;function P(A,t){return(15&A)+(A>>6|A>>3&8)<<4|(15&t)+(t>>6|t>>3&8)}function eA(A,t){let e=t.length>>1;for(let r=0;r>>4;A[r++]=o>9?o+gA:o+tA,o=15&t[C],A[r++]=o>9?o+gA:o+tA}return String.fromCharCode.apply(null,A)}let m=K!==null?A=>{if(typeof A=="string"){let t=K.from(A,"utf8");return new Uint8Array(t.buffer,t.byteOffset,t.length)}if(K.isBuffer(A))return new Uint8Array(A.buffer,A.byteOffset,A.length);if(ArrayBuffer.isView(A))return new Uint8Array(A.buffer,A.byteOffset,A.byteLength);throw new Error("Invalid data type!")}:A=>{if(typeof A=="string")return T.encode(A);if(ArrayBuffer.isView(A))return new Uint8Array(A.buffer,A.byteOffset,A.byteLength);throw new Error("Invalid data type!")},l="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",b=new Uint8Array(256);for(let A=0;A>18&63)+l.charAt(a>>12&63)+l.charAt(a>>6&63)+l.charAt(63&a);C.push(Q)}if(r===1){let h=A[e-1],a=l.charAt(h>>2),Q=l.charAt(h<<4&63);C.push(`${a}${Q}`),t&&C.push("==")}else if(r===2){let h=(A[e-2]<<8)+A[e-1],a=l.charAt(h>>10),Q=l.charAt(h>>4&63),w=l.charAt(h<<2&63);C.push(`${a}${Q}${w}`),t&&C.push("=")}return C.join("")}function CA(A){let t=Math.floor(.75*A.length),e=A.length;return A[e-1]==="="&&(t-=1,A[e-2]==="="&&(t-=1)),t}function nA(A){let t=CA(A),e=A.length,r=new Uint8Array(t),C=0;for(let o=0;o>4,C+=1,r[C]=(15&a)<<4|Q>>2,C+=1,r[C]=(3&Q)<<6|63&w,C+=1}return r}let W=16384,FA=new E,Z=new Map;function oA(A,t){return i(this,void 0,void 0,(function*(){let e=null,r=null,C=!1;if(typeof WebAssembly>"u")throw new Error("WebAssembly is not supported in this environment!");let o=()=>new DataView(e.exports.memory.buffer).getUint32(e.exports.STATE_SIZE,!0),h=FA.dispatch((()=>i(this,void 0,void 0,(function*(){if(!Z.has(A.name)){let s=nA(A.data),f=WebAssembly.compile(s);Z.set(A.name,f)}let n=yield Z.get(A.name);e=yield WebAssembly.instantiate(n,{})})))),a=(n=null)=>{C=!0,e.exports.Hash_Init(n)},Q=n=>{if(!C)throw new Error("update() called before init()");(s=>{let f=0;for(;f{if(!C)throw new Error("digest() called before init()");return C=!1,e.exports.Hash_Final(s),n==="binary"?r.slice(0,t):L(w,r,t)},c=n=>typeof n=="string"?n.length<4096:n.byteLength!0;break;case"blake2b":case"blake2s":k=(n,s)=>s<=512&&c(n);break;case"blake3":k=(n,s)=>s===0&&c(n);break;case"xxhash64":case"xxhash3":case"xxhash128":case"crc64":k=()=>!1}return yield i(this,void 0,void 0,(function*(){e||(yield h);let n=e.exports.Hash_GetBuffer(),s=e.exports.memory.buffer;r=new Uint8Array(s,n,W)})),{getMemory:()=>r,writeMemory:(n,s=0)=>{r.set(n,s)},getExports:()=>e.exports,setMemorySize:n=>{e.exports.Hash_SetMemorySize(n);let s=e.exports.Hash_GetBuffer(),f=e.exports.memory.buffer;r=new Uint8Array(f,s,n)},init:a,update:Q,digest:D,save:()=>{if(!C)throw new Error("save() can only be called after init() and before digest()");let n=e.exports.Hash_GetState(),s=o(),f=e.exports.memory.buffer,p=new Uint8Array(f,n,s),J=new Uint8Array(4+s);return eA(J,A.hash),J.set(p,4),J},load:n=>{if(!(n instanceof Uint8Array))throw new Error("load() expects an Uint8Array generated by save()");let s=e.exports.Hash_GetState(),f=o(),p=4+f,J=e.exports.memory.buffer;if(n.length!==p)throw new Error(`Bad state length (expected ${p} bytes, got ${n.length})`);if(!(function(u,S){if(u.length!==2*S.length)return!1;for(let G=0;G{if(!k(n,s))return a(s),Q(n),D("hex",f);let p=m(n);return r.set(p),e.exports.Hash_Calculate(p.length,s,f),L(w,r,t)},hashLength:t}}))}var yA={name:"blake2b",data:"AGFzbQEAAAABEQRgAAF/YAJ/fwBgAX8AYAAAAwoJAAECAwECAgABBQQBAQICBg4CfwFBsIsFC38AQYAICwdwCAZtZW1vcnkCAA5IYXNoX0dldEJ1ZmZlcgAACkhhc2hfRmluYWwAAwlIYXNoX0luaXQABQtIYXNoX1VwZGF0ZQAGDUhhc2hfR2V0U3RhdGUABw5IYXNoX0NhbGN1bGF0ZQAIClNUQVRFX1NJWkUDAQrTOAkFAEGACQvrAgIFfwF+AkAgAUEBSA0AAkACQAJAIAFBgAFBACgC4IoBIgJrIgNKDQAgASEEDAELQQBBADYC4IoBAkAgAkH/AEoNACACQeCJAWohBSAAIQRBACEGA0AgBSAELQAAOgAAIARBAWohBCAFQQFqIQUgAyAGQQFqIgZB/wFxSg0ACwtBAEEAKQPAiQEiB0KAAXw3A8CJAUEAQQApA8iJASAHQv9+Vq18NwPIiQFB4IkBEAIgACADaiEAAkAgASADayIEQYEBSA0AIAIgAWohBQNAQQBBACkDwIkBIgdCgAF8NwPAiQFBAEEAKQPIiQEgB0L/flatfDcDyIkBIAAQAiAAQYABaiEAIAVBgH9qIgVBgAJLDQALIAVBgH9qIQQMAQsgBEEATA0BC0EAIQUDQCAFQQAoAuCKAWpB4IkBaiAAIAVqLQAAOgAAIAQgBUEBaiIFQf8BcUoNAAsLQQBBACgC4IoBIARqNgLgigELC78uASR+QQBBACkD0IkBQQApA7CJASIBQQApA5CJAXwgACkDICICfCIDhULr+obav7X2wR+FQiCJIgRCq/DT9K/uvLc8fCIFIAGFQiiJIgYgA3wgACkDKCIBfCIHIASFQjCJIgggBXwiCSAGhUIBiSIKQQApA8iJAUEAKQOoiQEiBEEAKQOIiQF8IAApAxAiA3wiBYVCn9j52cKR2oKbf4VCIIkiC0K7zqqm2NDrs7t/fCIMIASFQiiJIg0gBXwgACkDGCIEfCIOfCAAKQNQIgV8Ig9BACkDwIkBQQApA6CJASIQQQApA4CJASIRfCAAKQMAIgZ8IhKFQtGFmu/6z5SH0QCFQiCJIhNCiJLznf/M+YTqAHwiFCAQhUIoiSIVIBJ8IAApAwgiEHwiFiAThUIwiSIXhUIgiSIYQQApA9iJAUEAKQO4iQEiE0EAKQOYiQF8IAApAzAiEnwiGYVC+cL4m5Gjs/DbAIVCIIkiGkLx7fT4paf9p6V/fCIbIBOFQiiJIhwgGXwgACkDOCITfCIZIBqFQjCJIhogG3wiG3wiHSAKhUIoiSIeIA98IAApA1giCnwiDyAYhUIwiSIYIB18Ih0gDiALhUIwiSIOIAx8Ih8gDYVCAYkiDCAWfCAAKQNAIgt8Ig0gGoVCIIkiFiAJfCIaIAyFQiiJIiAgDXwgACkDSCIJfCIhIBaFQjCJIhYgGyAchUIBiSIMIAd8IAApA2AiB3wiDSAOhUIgiSIOIBcgFHwiFHwiFyAMhUIoiSIbIA18IAApA2giDHwiHCAOhUIwiSIOIBd8IhcgG4VCAYkiGyAZIBQgFYVCAYkiFHwgACkDcCINfCIVIAiFQiCJIhkgH3wiHyAUhUIoiSIUIBV8IAApA3giCHwiFXwgDHwiIoVCIIkiI3wiJCAbhUIoiSIbICJ8IBJ8IiIgFyAYIBUgGYVCMIkiFSAffCIZIBSFQgGJIhQgIXwgDXwiH4VCIIkiGHwiFyAUhUIoiSIUIB98IAV8Ih8gGIVCMIkiGCAXfCIXIBSFQgGJIhR8IAF8IiEgFiAafCIWIBUgHSAehUIBiSIaIBx8IAl8IhyFQiCJIhV8Ih0gGoVCKIkiGiAcfCAIfCIcIBWFQjCJIhWFQiCJIh4gGSAOIBYgIIVCAYkiFiAPfCACfCIPhUIgiSIOfCIZIBaFQiiJIhYgD3wgC3wiDyAOhUIwiSIOIBl8Ihl8IiAgFIVCKIkiFCAhfCAEfCIhIB6FQjCJIh4gIHwiICAiICOFQjCJIiIgJHwiIyAbhUIBiSIbIBx8IAp8IhwgDoVCIIkiDiAXfCIXIBuFQiiJIhsgHHwgE3wiHCAOhUIwiSIOIBkgFoVCAYkiFiAffCAQfCIZICKFQiCJIh8gFSAdfCIVfCIdIBaFQiiJIhYgGXwgB3wiGSAfhUIwiSIfIB18Ih0gFoVCAYkiFiAVIBqFQgGJIhUgD3wgBnwiDyAYhUIgiSIYICN8IhogFYVCKIkiFSAPfCADfCIPfCAHfCIihUIgiSIjfCIkIBaFQiiJIhYgInwgBnwiIiAjhUIwiSIjICR8IiQgFoVCAYkiFiAOIBd8Ig4gDyAYhUIwiSIPICAgFIVCAYkiFCAZfCAKfCIXhUIgiSIYfCIZIBSFQiiJIhQgF3wgC3wiF3wgBXwiICAPIBp8Ig8gHyAOIBuFQgGJIg4gIXwgCHwiGoVCIIkiG3wiHyAOhUIoiSIOIBp8IAx8IhogG4VCMIkiG4VCIIkiISAdIB4gDyAVhUIBiSIPIBx8IAF8IhWFQiCJIhx8Ih0gD4VCKIkiDyAVfCADfCIVIByFQjCJIhwgHXwiHXwiHiAWhUIoiSIWICB8IA18IiAgIYVCMIkiISAefCIeIBogFyAYhUIwiSIXIBl8IhggFIVCAYkiFHwgCXwiGSAchUIgiSIaICR8IhwgFIVCKIkiFCAZfCACfCIZIBqFQjCJIhogHSAPhUIBiSIPICJ8IAR8Ih0gF4VCIIkiFyAbIB98Iht8Ih8gD4VCKIkiDyAdfCASfCIdIBeFQjCJIhcgH3wiHyAPhUIBiSIPIBsgDoVCAYkiDiAVfCATfCIVICOFQiCJIhsgGHwiGCAOhUIoiSIOIBV8IBB8IhV8IAx8IiKFQiCJIiN8IiQgD4VCKIkiDyAifCAHfCIiICOFQjCJIiMgJHwiJCAPhUIBiSIPIBogHHwiGiAVIBuFQjCJIhUgHiAWhUIBiSIWIB18IAR8IhuFQiCJIhx8Ih0gFoVCKIkiFiAbfCAQfCIbfCABfCIeIBUgGHwiFSAXIBogFIVCAYkiFCAgfCATfCIYhUIgiSIXfCIaIBSFQiiJIhQgGHwgCXwiGCAXhUIwiSIXhUIgiSIgIB8gISAVIA6FQgGJIg4gGXwgCnwiFYVCIIkiGXwiHyAOhUIoiSIOIBV8IA18IhUgGYVCMIkiGSAffCIffCIhIA+FQiiJIg8gHnwgBXwiHiAghUIwiSIgICF8IiEgGyAchUIwiSIbIB18IhwgFoVCAYkiFiAYfCADfCIYIBmFQiCJIhkgJHwiHSAWhUIoiSIWIBh8IBJ8IhggGYVCMIkiGSAfIA6FQgGJIg4gInwgAnwiHyAbhUIgiSIbIBcgGnwiF3wiGiAOhUIoiSIOIB98IAZ8Ih8gG4VCMIkiGyAafCIaIA6FQgGJIg4gFSAXIBSFQgGJIhR8IAh8IhUgI4VCIIkiFyAcfCIcIBSFQiiJIhQgFXwgC3wiFXwgBXwiIoVCIIkiI3wiJCAOhUIoiSIOICJ8IAh8IiIgGiAgIBUgF4VCMIkiFSAcfCIXIBSFQgGJIhQgGHwgCXwiGIVCIIkiHHwiGiAUhUIoiSIUIBh8IAZ8IhggHIVCMIkiHCAafCIaIBSFQgGJIhR8IAR8IiAgGSAdfCIZIBUgISAPhUIBiSIPIB98IAN8Ih2FQiCJIhV8Ih8gD4VCKIkiDyAdfCACfCIdIBWFQjCJIhWFQiCJIiEgFyAbIBkgFoVCAYkiFiAefCABfCIZhUIgiSIbfCIXIBaFQiiJIhYgGXwgE3wiGSAbhUIwiSIbIBd8Ihd8Ih4gFIVCKIkiFCAgfCAMfCIgICGFQjCJIiEgHnwiHiAiICOFQjCJIiIgJHwiIyAOhUIBiSIOIB18IBJ8Ih0gG4VCIIkiGyAafCIaIA6FQiiJIg4gHXwgC3wiHSAbhUIwiSIbIBcgFoVCAYkiFiAYfCANfCIXICKFQiCJIhggFSAffCIVfCIfIBaFQiiJIhYgF3wgEHwiFyAYhUIwiSIYIB98Ih8gFoVCAYkiFiAVIA+FQgGJIg8gGXwgCnwiFSAchUIgiSIZICN8IhwgD4VCKIkiDyAVfCAHfCIVfCASfCIihUIgiSIjfCIkIBaFQiiJIhYgInwgBXwiIiAjhUIwiSIjICR8IiQgFoVCAYkiFiAbIBp8IhogFSAZhUIwiSIVIB4gFIVCAYkiFCAXfCADfCIXhUIgiSIZfCIbIBSFQiiJIhQgF3wgB3wiF3wgAnwiHiAVIBx8IhUgGCAaIA6FQgGJIg4gIHwgC3wiGoVCIIkiGHwiHCAOhUIoiSIOIBp8IAR8IhogGIVCMIkiGIVCIIkiICAfICEgFSAPhUIBiSIPIB18IAZ8IhWFQiCJIh18Ih8gD4VCKIkiDyAVfCAKfCIVIB2FQjCJIh0gH3wiH3wiISAWhUIoiSIWIB58IAx8Ih4gIIVCMIkiICAhfCIhIBogFyAZhUIwiSIXIBt8IhkgFIVCAYkiFHwgEHwiGiAdhUIgiSIbICR8Ih0gFIVCKIkiFCAafCAJfCIaIBuFQjCJIhsgHyAPhUIBiSIPICJ8IBN8Ih8gF4VCIIkiFyAYIBx8Ihh8IhwgD4VCKIkiDyAffCABfCIfIBeFQjCJIhcgHHwiHCAPhUIBiSIPIBggDoVCAYkiDiAVfCAIfCIVICOFQiCJIhggGXwiGSAOhUIoiSIOIBV8IA18IhV8IA18IiKFQiCJIiN8IiQgD4VCKIkiDyAifCAMfCIiICOFQjCJIiMgJHwiJCAPhUIBiSIPIBsgHXwiGyAVIBiFQjCJIhUgISAWhUIBiSIWIB98IBB8IhiFQiCJIh18Ih8gFoVCKIkiFiAYfCAIfCIYfCASfCIhIBUgGXwiFSAXIBsgFIVCAYkiFCAefCAHfCIZhUIgiSIXfCIbIBSFQiiJIhQgGXwgAXwiGSAXhUIwiSIXhUIgiSIeIBwgICAVIA6FQgGJIg4gGnwgAnwiFYVCIIkiGnwiHCAOhUIoiSIOIBV8IAV8IhUgGoVCMIkiGiAcfCIcfCIgIA+FQiiJIg8gIXwgBHwiISAehUIwiSIeICB8IiAgGCAdhUIwiSIYIB98Ih0gFoVCAYkiFiAZfCAGfCIZIBqFQiCJIhogJHwiHyAWhUIoiSIWIBl8IBN8IhkgGoVCMIkiGiAcIA6FQgGJIg4gInwgCXwiHCAYhUIgiSIYIBcgG3wiF3wiGyAOhUIoiSIOIBx8IAN8IhwgGIVCMIkiGCAbfCIbIA6FQgGJIg4gFSAXIBSFQgGJIhR8IAt8IhUgI4VCIIkiFyAdfCIdIBSFQiiJIhQgFXwgCnwiFXwgBHwiIoVCIIkiI3wiJCAOhUIoiSIOICJ8IAl8IiIgGyAeIBUgF4VCMIkiFSAdfCIXIBSFQgGJIhQgGXwgDHwiGYVCIIkiHXwiGyAUhUIoiSIUIBl8IAp8IhkgHYVCMIkiHSAbfCIbIBSFQgGJIhR8IAN8Ih4gGiAffCIaIBUgICAPhUIBiSIPIBx8IAd8IhyFQiCJIhV8Ih8gD4VCKIkiDyAcfCAQfCIcIBWFQjCJIhWFQiCJIiAgFyAYIBogFoVCAYkiFiAhfCATfCIahUIgiSIYfCIXIBaFQiiJIhYgGnwgDXwiGiAYhUIwiSIYIBd8Ihd8IiEgFIVCKIkiFCAefCAFfCIeICCFQjCJIiAgIXwiISAiICOFQjCJIiIgJHwiIyAOhUIBiSIOIBx8IAt8IhwgGIVCIIkiGCAbfCIbIA6FQiiJIg4gHHwgEnwiHCAYhUIwiSIYIBcgFoVCAYkiFiAZfCABfCIXICKFQiCJIhkgFSAffCIVfCIfIBaFQiiJIhYgF3wgBnwiFyAZhUIwiSIZIB98Ih8gFoVCAYkiFiAVIA+FQgGJIg8gGnwgCHwiFSAdhUIgiSIaICN8Ih0gD4VCKIkiDyAVfCACfCIVfCANfCIihUIgiSIjfCIkIBaFQiiJIhYgInwgCXwiIiAjhUIwiSIjICR8IiQgFoVCAYkiFiAYIBt8IhggFSAahUIwiSIVICEgFIVCAYkiFCAXfCASfCIXhUIgiSIafCIbIBSFQiiJIhQgF3wgCHwiF3wgB3wiISAVIB18IhUgGSAYIA6FQgGJIg4gHnwgBnwiGIVCIIkiGXwiHSAOhUIoiSIOIBh8IAt8IhggGYVCMIkiGYVCIIkiHiAfICAgFSAPhUIBiSIPIBx8IAp8IhWFQiCJIhx8Ih8gD4VCKIkiDyAVfCAEfCIVIByFQjCJIhwgH3wiH3wiICAWhUIoiSIWICF8IAN8IiEgHoVCMIkiHiAgfCIgIBggFyAahUIwiSIXIBt8IhogFIVCAYkiFHwgBXwiGCAchUIgiSIbICR8IhwgFIVCKIkiFCAYfCABfCIYIBuFQjCJIhsgHyAPhUIBiSIPICJ8IAx8Ih8gF4VCIIkiFyAZIB18Ihl8Ih0gD4VCKIkiDyAffCATfCIfIBeFQjCJIhcgHXwiHSAPhUIBiSIPIBkgDoVCAYkiDiAVfCAQfCIVICOFQiCJIhkgGnwiGiAOhUIoiSIOIBV8IAJ8IhV8IBN8IiKFQiCJIiN8IiQgD4VCKIkiDyAifCASfCIiICOFQjCJIiMgJHwiJCAPhUIBiSIPIBsgHHwiGyAVIBmFQjCJIhUgICAWhUIBiSIWIB98IAt8IhmFQiCJIhx8Ih8gFoVCKIkiFiAZfCACfCIZfCAJfCIgIBUgGnwiFSAXIBsgFIVCAYkiFCAhfCAFfCIahUIgiSIXfCIbIBSFQiiJIhQgGnwgA3wiGiAXhUIwiSIXhUIgiSIhIB0gHiAVIA6FQgGJIg4gGHwgEHwiFYVCIIkiGHwiHSAOhUIoiSIOIBV8IAF8IhUgGIVCMIkiGCAdfCIdfCIeIA+FQiiJIg8gIHwgDXwiICAhhUIwiSIhIB58Ih4gGSAchUIwiSIZIB98IhwgFoVCAYkiFiAafCAIfCIaIBiFQiCJIhggJHwiHyAWhUIoiSIWIBp8IAp8IhogGIVCMIkiGCAdIA6FQgGJIg4gInwgBHwiHSAZhUIgiSIZIBcgG3wiF3wiGyAOhUIoiSIOIB18IAd8Ih0gGYVCMIkiGSAbfCIbIA6FQgGJIg4gFSAXIBSFQgGJIhR8IAx8IhUgI4VCIIkiFyAcfCIcIBSFQiiJIhQgFXwgBnwiFXwgEnwiIoVCIIkiI3wiJCAOhUIoiSIOICJ8IBN8IiIgGyAhIBUgF4VCMIkiFSAcfCIXIBSFQgGJIhQgGnwgBnwiGoVCIIkiHHwiGyAUhUIoiSIUIBp8IBB8IhogHIVCMIkiHCAbfCIbIBSFQgGJIhR8IA18IiEgGCAffCIYIBUgHiAPhUIBiSIPIB18IAJ8Ih2FQiCJIhV8Ih4gD4VCKIkiDyAdfCABfCIdIBWFQjCJIhWFQiCJIh8gFyAZIBggFoVCAYkiFiAgfCADfCIYhUIgiSIZfCIXIBaFQiiJIhYgGHwgBHwiGCAZhUIwiSIZIBd8Ihd8IiAgFIVCKIkiFCAhfCAIfCIhIB+FQjCJIh8gIHwiICAiICOFQjCJIiIgJHwiIyAOhUIBiSIOIB18IAd8Ih0gGYVCIIkiGSAbfCIbIA6FQiiJIg4gHXwgDHwiHSAZhUIwiSIZIBcgFoVCAYkiFiAafCALfCIXICKFQiCJIhogFSAefCIVfCIeIBaFQiiJIhYgF3wgCXwiFyAahUIwiSIaIB58Ih4gFoVCAYkiFiAVIA+FQgGJIg8gGHwgBXwiFSAchUIgiSIYICN8IhwgD4VCKIkiDyAVfCAKfCIVfCACfCIChUIgiSIifCIjIBaFQiiJIhYgAnwgC3wiAiAihUIwiSILICN8IiIgFoVCAYkiFiAZIBt8IhkgFSAYhUIwiSIVICAgFIVCAYkiFCAXfCANfCINhUIgiSIXfCIYIBSFQiiJIhQgDXwgBXwiBXwgEHwiECAVIBx8Ig0gGiAZIA6FQgGJIg4gIXwgDHwiDIVCIIkiFXwiGSAOhUIoiSIOIAx8IBJ8IhIgFYVCMIkiDIVCIIkiFSAeIB8gDSAPhUIBiSINIB18IAl8IgmFQiCJIg98IhogDYVCKIkiDSAJfCAIfCIJIA+FQjCJIgggGnwiD3wiGiAWhUIoiSIWIBB8IAd8IhAgEYUgDCAZfCIHIA6FQgGJIgwgCXwgCnwiCiALhUIgiSILIAUgF4VCMIkiBSAYfCIJfCIOIAyFQiiJIgwgCnwgE3wiEyALhUIwiSIKIA58IguFNwOAiQFBACADIAYgDyANhUIBiSINIAJ8fCICIAWFQiCJIgUgB3wiBiANhUIoiSIHIAJ8fCICQQApA4iJAYUgBCABIBIgCSAUhUIBiSIDfHwiASAIhUIgiSISICJ8IgkgA4VCKIkiAyABfHwiASAShUIwiSIEIAl8IhKFNwOIiQFBACATQQApA5CJAYUgECAVhUIwiSIQIBp8IhOFNwOQiQFBACABQQApA5iJAYUgAiAFhUIwiSICIAZ8IgGFNwOYiQFBACASIAOFQgGJQQApA6CJAYUgAoU3A6CJAUEAIBMgFoVCAYlBACkDqIkBhSAKhTcDqIkBQQAgASAHhUIBiUEAKQOwiQGFIASFNwOwiQFBACALIAyFQgGJQQApA7iJAYUgEIU3A7iJAQvdAgUBfwF+AX8BfgJ/IwBBwABrIgAkAAJAQQApA9CJAUIAUg0AQQBBACkDwIkBIgFBACgC4IoBIgKsfCIDNwPAiQFBAEEAKQPIiQEgAyABVK18NwPIiQECQEEALQDoigFFDQBBAEJ/NwPYiQELQQBCfzcD0IkBAkAgAkH/AEoNAEEAIQQDQCACIARqQeCJAWpBADoAACAEQQFqIgRBgAFBACgC4IoBIgJrSA0ACwtB4IkBEAIgAEEAKQOAiQE3AwAgAEEAKQOIiQE3AwggAEEAKQOQiQE3AxAgAEEAKQOYiQE3AxggAEEAKQOgiQE3AyAgAEEAKQOoiQE3AyggAEEAKQOwiQE3AzAgAEEAKQO4iQE3AzhBACgC5IoBIgVBAUgNAEEAIQRBACECA0AgBEGACWogACAEai0AADoAACAEQQFqIQQgBSACQQFqIgJB/wFxSg0ACwsgAEHAAGokAAv9AwMBfwF+AX8jAEGAAWsiAiQAQQBBgQI7AfKKAUEAIAE6APGKAUEAIAA6APCKAUGQfiEAA0AgAEGAiwFqQgA3AAAgAEH4igFqQgA3AAAgAEHwigFqQgA3AAAgAEEYaiIADQALQQAhAEEAQQApA/CKASIDQoiS853/zPmE6gCFNwOAiQFBAEEAKQP4igFCu86qptjQ67O7f4U3A4iJAUEAQQApA4CLAUKr8NP0r+68tzyFNwOQiQFBAEEAKQOIiwFC8e30+KWn/aelf4U3A5iJAUEAQQApA5CLAULRhZrv+s+Uh9EAhTcDoIkBQQBBACkDmIsBQp/Y+dnCkdqCm3+FNwOoiQFBAEEAKQOgiwFC6/qG2r+19sEfhTcDsIkBQQBBACkDqIsBQvnC+JuRo7Pw2wCFNwO4iQFBACADp0H/AXE2AuSKAQJAIAFBAUgNACACQgA3A3ggAkIANwNwIAJCADcDaCACQgA3A2AgAkIANwNYIAJCADcDUCACQgA3A0ggAkIANwNAIAJCADcDOCACQgA3AzAgAkIANwMoIAJCADcDICACQgA3AxggAkIANwMQIAJCADcDCCACQgA3AwBBACEEA0AgAiAAaiAAQYAJai0AADoAACAAQQFqIQAgBEEBaiIEQf8BcSABSA0ACyACQYABEAELIAJBgAFqJAALEgAgAEEDdkH/P3EgAEEQdhAECwkAQYAJIAAQAQsGAEGAiQELGwAgAUEDdkH/P3EgAUEQdhAEQYAJIAAQARADCwsLAQBBgAgLBPAAAAA=",hash:"c6f286e6"};function QA(A){return!Number.isInteger(A)||A<8||A>512||A%8!=0?new Error("Invalid variant! Valid values: 8, 16, ..., 512"):null}function q(A=512,t=null){if(QA(A))return Promise.reject(QA(A));let e=null,r=A;if(t!==null){if(e=m(t),e.length>64)return Promise.reject(new Error("Max key length is 64 bytes"));C=A,o=e.length,r=C|o<<16}var C,o;let h=A/8;return oA(yA,h).then((a=>{r>512&&a.writeMemory(e),a.init(r);let Q={init:r>512?()=>(a.writeMemory(e),a.init(r),Q):()=>(a.init(r),Q),update:w=>(a.update(w),Q),digest:w=>a.digest(w),save:()=>a.save(),load:w=>(a.load(w),Q),blockSize:128,digestSize:h};return Q}))}new E;let aA=new DataView(new ArrayBuffer(4));function V(A){return aA.setInt32(0,A,!0),new Uint8Array(aA.buffer)}function _(A,t,e){return i(this,void 0,void 0,(function*(){if(e<=64){let Q=yield q(8*e);return Q.update(V(e)),Q.update(t),Q.digest("binary")}let r=Math.ceil(e/32)-2,C=new Uint8Array(e);A.init(),A.update(V(e)),A.update(t);let o=A.digest("binary");C.set(o.subarray(0,32),0);for(let Q=1;Q{var t;if(!A||typeof A!="object")throw new Error("Invalid options parameter. It requires an object.");if(!A.password)throw new Error("Password must be specified");if(A.password=m(A.password),A.password.length<1)throw new Error("Password must be specified");if(!A.salt)throw new Error("Salt must be specified");if(A.salt=m(A.salt),A.salt.length<8)throw new Error("Salt should be at least 8 bytes long");if(A.secret=m((t=A.secret)!==null&&t!==void 0?t:""),!Number.isInteger(A.iterations)||A.iterations<1)throw new Error("Iterations should be a positive number");if(!Number.isInteger(A.parallelism)||A.parallelism<1)throw new Error("Parallelism should be a positive number");if(!Number.isInteger(A.hashLength)||A.hashLength<4)throw new Error("Hash length should be at least 4 bytes.");if(!Number.isInteger(A.memorySize))throw new Error("Memory size should be specified.");if(A.memorySize<8*A.parallelism)throw new Error("Memory size should be at least 8 * parallelism.");if(A.outputType===void 0&&(A.outputType="hex"),!["hex","binary","encoded"].includes(A.outputType))throw new Error(`Insupported output type ${A.outputType}. Valid values: ['hex', 'binary', 'encoded']`)};I.argon2Verify=function(A){return i(this,void 0,void 0,(function*(){(r=>{if(!r||typeof r!="object")throw new Error("Invalid options parameter. It requires an object.");if(r.hash===void 0||typeof r.hash!="string")throw new Error("Hash should be specified")})(A);let t=((r,C,o)=>{let h=C.match(/^\$argon2(id|i|d)\$v=([0-9]+)\$((?:[mtp]=[0-9]+,){2}[mtp]=[0-9]+)\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)$/);if(!h)throw new Error("Invalid hash");let[,a,Q,w,D,c]=h;if(Q!=="19")throw new Error(`Unsupported version: ${Q}`);let k={},n={m:"memorySize",p:"parallelism",t:"iterations"};for(let s of w.split(",")){let[f,p]=s.split("=");k[n[f]]=Number(p)}return Object.assign(Object.assign({},k),{password:r,secret:o,hashType:a,salt:nA(D),hashLength:CA(c),outputType:"encoded"})})(A.password,A.hash,A.secret);M(t);let e=A.hash.lastIndexOf("$")+1;return(yield O(t)).substring(e)===A.hash.substring(e)}))},I.argon2d=function(A){return i(this,void 0,void 0,(function*(){return M(A),O(Object.assign(Object.assign({},A),{hashType:"d"}))}))},I.argon2i=function(A){return i(this,void 0,void 0,(function*(){return M(A),O(Object.assign(Object.assign({},A),{hashType:"i"}))}))},I.argon2id=function(A){return i(this,void 0,void 0,(function*(){return M(A),O(Object.assign(Object.assign({},A),{hashType:"id"}))}))}}))});var _A={};GA(_A,{VaultPasswordError:()=>N,createArgon2idMetadata:()=>z,createKeyTransferReceiver:()=>TA,createPasswordWrappedRemoteVaultKey:()=>bA,decodeBase64:()=>F,decryptTransferredVaultKey:()=>qA,deriveWrapKey:()=>R,encodeBase64:()=>d,encryptVaultKeyForReceiver:()=>ZA,keyTransferVerificationCode:()=>WA,randomBytes:()=>H,toArrayBuffer:()=>y,unwrapRemoteVaultKeyWithPassword:()=>YA,validateKeyTransferPublicKey:()=>LA,validateVaultPassword:()=>xA,wrapRemoteVaultKeyWithPassword:()=>cA});function H(I){return crypto.getRandomValues(new Uint8Array(I))}function d(I){let i=[];for(let g=0;gKA(sA(),1)),B=g.default?.argon2id??g["module.exports"]?.argon2id;if(!B)throw new Error("argon2id module failed to load");let E=await B({password:new TextEncoder().encode(I),salt:F(i.salt),iterations:i.iterations,parallelism:i.parallelism,memorySize:i.memoryKiB,hashLength:JA,outputType:"binary"});return await crypto.subtle.importKey("raw",y(E),{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}var wA="aes-256-gcm",fA=1,$=1,EA=32,HA=12,N=class extends Error{constructor(g,B){super(B);this.code=g;this.name="VaultPasswordError"}};async function bA(I,i={}){let g=H(EA);return{remoteVaultKey:g,envelope:await cA(I,g,i)}}async function cA(I,i,g={}){if(i.byteLength!==EA)throw new Error("Invalid vault key length");let B=z(g.kdfOverrides),E=await R(DA(I),B),U=H(HA),K=await NA(E,i,U,g.binding);return{version:g.binding?2:fA,keyVersion:$,...g.binding?{binding:g.binding}:{},kdf:B,wrap:{algorithm:wA,nonce:d(U),ciphertext:d(K)}}}async function YA(I,i,g){let B=DA(I);if(PA(i),i.version===2&&(!g||!i.binding||i.binding.vaultId!==g.vaultId||i.binding.userId!==g.userId))throw new Error("Vault password wrapper belongs to a different vault or user");let E=F(i.kdf.salt),U=F(i.wrap.nonce),K=F(i.wrap.ciphertext),T=await R(B,{...i.kdf,salt:d(E)}),P=await crypto.subtle.decrypt({name:"AES-GCM",iv:y(U),...i.version===2?{additionalData:pA(i.binding)}:{}},T,y(K));return new Uint8Array(P)}async function NA(I,i,g,B){let E=await crypto.subtle.encrypt({name:"AES-GCM",iv:y(g),...B?{additionalData:pA(B)}:{}},I,y(i));return new Uint8Array(E)}function PA(I){if(I.version!==fA&&I.version!==2)throw new Error(`unsupported wrapper version: ${I.version}`);if(I.keyVersion!==$||I.version===1&&I.binding||I.version===2&&(!I.binding?.userId||!I.binding.vaultId))throw new Error("Invalid password wrapper binding or key version");if(I.wrap.algorithm!==wA)throw new Error(`unsupported wrap algorithm: ${I.wrap.algorithm}`)}function DA(I){if(!I)throw new N("required","Password is required.");if(I!==I.trim())throw new N("outer_spaces","Password cannot start or end with spaces.");return I}function pA(I){return new Uint8Array(new TextEncoder().encode(JSON.stringify(["synch.password-wrapper",2,I.vaultId,I.userId,$])))}var OA=new Set(["123456","123456789","1234567890","password","password1","password123","qwerty","qwerty123","letmein","admin","welcome","iloveyou","vault","vaultpassword","synch","synchpassword","obsidian","obsidianvault","obsidianvaultpassword","synchvaultpassword"]),MA=["password","qwerty","letmein","admin","welcome","iloveyou","vault","synch","obsidian"];function xA(I){return I?I!==I.trim()?{ok:!1,code:"outer_spaces",message:"Password cannot start or end with spaces."}:I.length<12?{ok:!1,code:"min_length",count:12,message:"Password must be at least 12 characters."}:I.length>256?{ok:!1,code:"max_length",count:256,message:"Password must be 256 characters or fewer."}:XA(I)?{ok:!1,code:"too_weak",message:"Password is too easy to guess. Use a longer passphrase."}:vA(I)?{ok:!1,code:"repeated_character",message:"Password cannot be one repeated character."}:RA(I)?{ok:!1,code:"simple_sequence",message:"Password cannot be a simple sequence."}:{ok:!0}:{ok:!1,code:"required",message:"Password is required."}}function vA(I){return new Set(I.toLowerCase()).size===1}function XA(I){let i=I.toLowerCase().replace(/[^a-z0-9]/g,"");if(OA.has(i))return!0;for(let g of MA)i=i.split(g).join("");return i===""||/^[0-9]+$/.test(i)}function RA(I){if(!/^[a-z]+$/i.test(I)&&!/^[0-9]+$/.test(I))return!1;let i=I.toLowerCase(),g=i.charCodeAt(1)-i.charCodeAt(0);if(g!==1&&g!==-1)return!1;for(let B=1;BK.toString(16).padStart(2,"0")).join("").match(/.{4}/g).join("-")}async function ZA(I,i,g){if(I.byteLength!==32)throw new Error("Invalid vault key length");let B=await crypto.subtle.encrypt({name:"RSA-OAEP",label:iA(g)},await IA(i),y(I));return{version:1,algorithm:"rsa-oaep-sha256",ciphertext:d(new Uint8Array(B))}}async function qA(I,i,g){if(I.version!==1||I.algorithm!=="rsa-oaep-sha256"||F(I.ciphertext).length!==384)throw new Error("Invalid key transfer envelope");let B=await crypto.subtle.importKey("pkcs8",y(F(i)),AA,!1,["decrypt"]),E=new Uint8Array(await crypto.subtle.decrypt({name:"RSA-OAEP",label:iA(g)},B,y(F(I.ciphertext))));if(E.byteLength!==32)throw new Error("Invalid transferred key length");return E}return mA(_A);})(); /*! Bundled license information: hash-wasm/dist/argon2.umd.min.js: diff --git a/apps/api/public/vaults.html b/apps/api/public/vaults.html index 882d44e1..4653fd70 100644 --- a/apps/api/public/vaults.html +++ b/apps/api/public/vaults.html @@ -7,6 +7,7 @@ +
@@ -28,6 +29,7 @@

Remote vaults

+
Loading vaults...
@@ -64,7 +66,7 @@

Create remote vault

-

The password cannot be recovered, so store it somewhere safe. You will enter the same password when connecting this vault from Obsidian.

+

Keep this password safe. If it is lost, recovery requires another vault administrator who still has the vault key.

@@ -108,6 +110,8 @@

Delete remote vault

const { locale, createTranslator } = window.synchI18n; const { t, ready: translationsReady } = createTranslator("vaults", { title: "Remote vaults", + organization: "Organization", + organizations: "Manage organizations", subtitle: "Manage the encrypted vaults attached to this Synch account. Deleting a remote vault does not delete local Obsidian files.", signOut: "Sign out", signedIn: "Signed in", @@ -119,7 +123,7 @@

Delete remote vault

createNameLabel: "Vault name", createPasswordLabel: "Vault password", createConfirmPasswordLabel: "Confirm vault password", - createPasswordHint: "The password cannot be recovered, so store it somewhere safe. You will enter the same password when connecting this vault from Obsidian.", + createPasswordHint: "Keep this password safe. If it is lost, recovery requires another vault administrator who still has the vault key.", createConfirm: "Create vault", creating: "Creating...", createdVault: "{name} created. Connect it from Obsidian with the same vault password.", @@ -187,7 +191,24 @@

Delete remote vault

const createErrorEl = document.querySelector("#create-error"); const confirmCreateButton = document.querySelector("#confirm-create"); const confirmCreateLabel = document.querySelector("#confirm-create-label"); - let selectedVault = null; + const organizationPicker = document.querySelector("#organization"); + const organizationsLink = document.querySelector("#organizations-link"); + let currentOrganization = null; + organizationPicker.addEventListener("change", () => { void loadVaults(); }); + async function loadOrganizations() { + const selected = organizationPicker.value || new URLSearchParams(location.search).get("organizationId"); + const response = await fetch("/v1/organizations", { credentials: "include" }); + if (response.status === 401) { redirectToLogin(); return; } + if (!response.ok) throw new Error("Unable to load organizations"); + const { organizations } = await response.json(); + // Owners and administrators can manage organizations on every plan. + const visible = organizations.filter(window.synchOrganizationUI.canManage); + organizationPicker.replaceChildren(); + for (const org of visible) { const option = document.createElement("option"); option.value = org.id; option.textContent = org.name; organizationPicker.append(option); } + if (visible.some(org => org.id === selected)) organizationPicker.value = selected; + document.querySelector("#organization-toolbar").classList.toggle("hidden", !organizations.some(window.synchOrganizationUI.canManage)); + } + let selectedVault = null; let creatingVault = false; refreshButton.addEventListener("click", () => { @@ -300,9 +321,29 @@

Delete remote vault

async function loadVaults() { setStatus(t("loading")); + document.querySelector("#organization-toolbar").classList.add("hidden"); + organizationsLink.classList.add("hidden"); + createVaultButton.disabled = true; + listEl.replaceChildren(); refreshButton.disabled = true; try { - const response = await fetch("/v1/vaults?includeDeleting=true", { + await loadOrganizations(); + const organizationId = organizationPicker.value; + if (!organizationId) { currentOrganization = null; renderVaults([]); return; } + const orgResponse = await fetch(`/v1/organizations/${encodeURIComponent(organizationId)}`, { credentials: "include" }); + if (!orgResponse.ok) throw new Error("Unable to load organization"); + currentOrganization = await orgResponse.json(); + const canManageOrganization = window.synchOrganizationUI.canManage(currentOrganization); + if (!canManageOrganization) { + currentOrganization = null; + document.querySelector("#organization-toolbar").classList.add("hidden"); + renderVaults([]); + return; + } + organizationsLink.classList.toggle("hidden", !canManageOrganization); + createVaultButton.disabled = !canManageOrganization; + const organizationUrl = new URL("/organizations", location.origin); organizationUrl.searchParams.set("organizationId", organizationId); organizationUrl.searchParams.set("lang", locale); organizationsLink.href = organizationUrl.toString(); + const response = await fetch("/v1/vaults?includeDeleting=true", { credentials: "include", }); if (response.status === 401) { @@ -314,7 +355,7 @@

Delete remote vault

return; } const json = await response.json(); - renderVaults(Array.isArray(json.vaults) ? json.vaults : []); + renderVaults(Array.isArray(json.vaults) ? json.vaults.filter(vault => vault.organizationId === organizationId) : []); } catch { setStatus(t("apiUnavailable")); } finally { @@ -361,7 +402,8 @@

Delete remote vault

openDeleteDialog(vault); }); - row.append(details, button); + row.append(details); + if (window.synchOrganizationUI.canManage(currentOrganization)) row.append(button); listEl.append(row); } @@ -559,6 +601,7 @@

Delete remote vault

}, body: JSON.stringify({ name, + organizationId: organizationPicker.value, initialWrapper: { kind: "password", envelope }, }), }); diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts index b4573667..56bb5a19 100644 --- a/apps/api/src/app.ts +++ b/apps/api/src/app.ts @@ -1,3 +1,5 @@ +import type { SharingService } from "./sharing/application/service"; +import { registerSharingRoutes } from "./sharing/adapters/routes"; import { Hono } from "hono"; import { cors } from "hono/cors"; @@ -14,7 +16,10 @@ import type { SubscriptionPolicyReader } from "./subscription/application"; import type { IssueSyncToken } from "./sync-access/application"; import { mapSyncAccessApplicationError } from "./sync-access/adapters/inbound/http/error-mapper"; import { registerSyncAccessRoutes } from "./sync-access/adapters/inbound/http/routes"; -import type { DownloadBlob, UploadBlob } from "./sync-blob-transfer/application"; +import type { + DownloadBlob, + UploadBlob, +} from "./sync-blob-transfer/application"; import { mapBlobTransferApplicationError } from "./sync-blob-transfer/adapters/inbound/http/error-mapper"; import { registerBlobTransferRoutes } from "./sync-blob-transfer/adapters/inbound/http/routes"; import { registerCoordinatorAdminRoutes } from "./sync-coordinator/adapters/inbound/http/admin-routes"; @@ -28,6 +33,7 @@ import { mapVaultApplicationError } from "./vault/adapters/inbound/http/error-ma import type { VaultService } from "./vault/application"; export type AppDependencies = { + sharing?: SharingService; authHttpHandler: AuthHttpHandler; sessionReader: SessionReader; syncTokenIssuer: IssueSyncToken; @@ -72,6 +78,12 @@ export function createApp(deps: AppDependencies, config: AppConfig): Hono { syncTokenIssuer: deps.syncTokenIssuer, sessionReader: deps.sessionReader, }); + if (deps.sharing) + registerSharingRoutes(app, { + sharing: deps.sharing, + sessionReader: deps.sessionReader, + trustedOrigins: [new URL(config.authBaseUrl).origin, config.corsOrigin], + }); registerVaultRoutes(app, deps); if (deps.billingService) { registerBillingRoutes(app, { @@ -102,12 +114,13 @@ export function createApp(deps: AppDependencies, config: AppConfig): Hono { ), ); - app.onError((error, c) => - mapSyncAccessApplicationError(error) ?? - mapBlobTransferApplicationError(error) ?? - mapVaultApplicationError(error) ?? - mapBillingApplicationError(error) ?? - onError(error, c), + app.onError( + (error, c) => + mapSyncAccessApplicationError(error) ?? + mapBlobTransferApplicationError(error) ?? + mapVaultApplicationError(error) ?? + mapBillingApplicationError(error) ?? + onError(error, c), ); return app; diff --git a/apps/api/src/billing/adapters/inbound/http/error-mapper.ts b/apps/api/src/billing/adapters/inbound/http/error-mapper.ts index 15d221d7..993f9784 100644 --- a/apps/api/src/billing/adapters/inbound/http/error-mapper.ts +++ b/apps/api/src/billing/adapters/inbound/http/error-mapper.ts @@ -63,6 +63,8 @@ function billingErrorMessage(code: BillingApplicationErrorCode): string { return "switching from annual to monthly billing is not available"; case "billing_customer_not_found": return "billing customer was not found"; + case "billing_email_unavailable": + return "This email cannot be used for this organization's billing. Ask an organization owner or admin with a different email to start checkout."; case "subscription_canceled": return "subscription is already canceled"; case "payment_failed": diff --git a/apps/api/src/billing/adapters/inbound/http/routes.test.ts b/apps/api/src/billing/adapters/inbound/http/routes.test.ts index a7f0f64a..0e64072f 100644 --- a/apps/api/src/billing/adapters/inbound/http/routes.test.ts +++ b/apps/api/src/billing/adapters/inbound/http/routes.test.ts @@ -9,12 +9,29 @@ import type { SessionReader } from "../../../../auth/session"; import { apiError, onError } from "../../../../errors"; import { registerBillingRoutes } from "./routes"; import type { BillingService } from "../../../application"; +import { BillingApplicationError } from "../../../application/errors/billing-errors"; +import { mapBillingApplicationError } from "./error-mapper"; describe("billing routes", () => { beforeEach(() => { vi.clearAllMocks(); }); + it("explains why checkout needs a different billing email", async () => { + authMocks.readSession.mockResolvedValueOnce({ user: { id: "user-1", email: "user@example.com" } }); + const app = createTestApp(fakeBillingService({ + createCheckout: vi.fn(async () => { throw new BillingApplicationError("billing_email_unavailable"); }), + })); + + const response = await app.request("/v1/billing/checkout", { method: "POST" }); + + expect(response.status).toBe(409); + await expect(response.json()).resolves.toMatchObject({ + error: "billing_email_unavailable", + message: expect.stringContaining("different email"), + }); + }); + it("requires authentication for customer portal sessions", async () => { authMocks.readSession.mockResolvedValueOnce(null); const app = createTestApp(); @@ -46,6 +63,7 @@ describe("billing routes", () => { }, body: JSON.stringify({ returnPath: "/ko/billing", + undefined, }), }); @@ -56,6 +74,7 @@ describe("billing routes", () => { expect(billingService.createCustomerPortalSession).toHaveBeenCalledWith( "user-1", "/ko/billing", + undefined, ); }); @@ -183,7 +202,7 @@ function createTestApp(billingService = fakeBillingService()): Hono { sessionReader: authMocks as unknown as SessionReader, billingService, }); - app.onError(onError); + app.onError((error, c) => mapBillingApplicationError(error) ?? onError(error, c)); return app; } diff --git a/apps/api/src/billing/adapters/inbound/http/routes.ts b/apps/api/src/billing/adapters/inbound/http/routes.ts index 61cab100..b9f8975b 100644 --- a/apps/api/src/billing/adapters/inbound/http/routes.ts +++ b/apps/api/src/billing/adapters/inbound/http/routes.ts @@ -13,16 +13,19 @@ import { import type { BillingService } from "../../../application"; const checkoutRequestSchema = z.object({ + organizationId: z.string().min(1).optional(), billingInterval: z.enum(SUBSCRIPTION_BILLING_INTERVALS).optional(), planId: z.enum(SUBSCRIPTION_PLAN_IDS).optional(), }).strict(); const changeRequestSchema = z.object({ + organizationId: z.string().min(1).optional(), billingInterval: z.enum(SUBSCRIPTION_BILLING_INTERVALS), planId: z.enum(SUBSCRIPTION_PLAN_IDS), }).strict(); const portalRequestSchema = z.object({ + organizationId: z.string().min(1).optional(), returnPath: z.string().optional(), }).strict(); @@ -34,9 +37,10 @@ export function registerBillingRoutes( app.post("/v1/billing/checkout", ensureAuthenticatedSession, async (c) => { const user = c.var.user; - const { billingInterval, planId } = await readCheckoutRequestPlanId(c.req.raw); + const { billingInterval, planId, organizationId } = await readCheckoutRequestPlanId(c.req.raw); const checkout = await deps.billingService.createCheckout({ userId: user.id, + organizationId, email: user.email, planId, billingInterval, @@ -47,9 +51,10 @@ export function registerBillingRoutes( app.post("/v1/billing/change", ensureAuthenticatedSession, async (c) => { const user = c.var.user; - const { billingInterval, planId } = await readChangeRequest(c.req.raw); + const { billingInterval, planId, organizationId } = await readChangeRequest(c.req.raw); const status = await deps.billingService.changeSubscriptionPlan({ userId: user.id, + organizationId, planId, billingInterval, }); @@ -59,26 +64,27 @@ export function registerBillingRoutes( app.get("/v1/billing/status", ensureAuthenticatedSession, async (c) => { const user = c.var.user; - const status = await deps.billingService.readBillingStatus(user.id); + const status = await deps.billingService.readBillingStatus(user.id, c.req.query("organizationId")); return c.json(status); }); app.post("/v1/billing/portal", ensureAuthenticatedSession, async (c) => { const user = c.var.user; - const returnPath = await readPortalRequestReturnPath(c.req.raw); + const { returnPath, organizationId } = await readPortalRequest(c.req.raw); const portal = await deps.billingService.createCustomerPortalSession( user.id, returnPath, + organizationId ?? c.req.query("organizationId"), ); return c.json(portal); }); } -async function readPortalRequestReturnPath(request: Request): Promise { +async function readPortalRequest(request: Request): Promise<{ returnPath: string; organizationId?: string }> { if (!request.headers.get("content-type")) { - return "/billing"; + return { returnPath: "/billing" }; } let json: unknown; @@ -98,10 +104,11 @@ async function readPortalRequestReturnPath(request: Request): Promise { throw apiError(400, "bad_request", "invalid billing portal return path"); } - return returnPath; + return { returnPath, organizationId: parsed.data.organizationId }; } async function readChangeRequest(request: Request): Promise<{ + organizationId?: string; billingInterval: SubscriptionBillingInterval; planId: SubscriptionPlanId; }> { @@ -121,6 +128,7 @@ async function readChangeRequest(request: Request): Promise<{ } async function readCheckoutRequestPlanId(request: Request): Promise<{ + organizationId?: string; billingInterval: SubscriptionBillingInterval; planId: SubscriptionPlanId; }> { @@ -142,6 +150,7 @@ async function readCheckoutRequestPlanId(request: Request): Promise<{ return { planId: parsed.data.planId ?? "starter", + organizationId: parsed.data.organizationId, billingInterval: parsed.data.billingInterval ?? "monthly", }; } diff --git a/apps/api/src/billing/adapters/outbound/drizzle-billing-store.test.ts b/apps/api/src/billing/adapters/outbound/drizzle-billing-store.test.ts new file mode 100644 index 00000000..2e925580 --- /dev/null +++ b/apps/api/src/billing/adapters/outbound/drizzle-billing-store.test.ts @@ -0,0 +1,58 @@ +import { createClient, type Client } from "@libsql/client"; +import { drizzle } from "drizzle-orm/libsql"; +import { migrate } from "drizzle-orm/libsql/migrator"; +import { fileURLToPath } from "node:url"; +import { afterEach, describe, expect, it } from "vitest"; + +import { createLibsqlDb } from "../../../db/client"; +import * as schema from "../../../db/d1"; +import type { PolarSubscriptionUpsertInput } from "../../application/dto/billing"; +import { DrizzleBillingStore } from "./drizzle-billing-store"; + +let client: Client; +afterEach(() => client?.close()); + +async function setup() { + client = createClient({ url: ":memory:" }); + await migrate(drizzle(client), { + migrationsFolder: fileURLToPath(new URL("../../../../drizzle", import.meta.url).href), + }); + const db = createLibsqlDb(client); + await db.insert(schema.organization).values(["org-a", "org-b"].map((id) => ({ + id, name: id, slug: id, createdAt: new Date(), + }))); + return { db, store: new DrizzleBillingStore(db) }; +} + +function subscription(organizationId: string): PolarSubscriptionUpsertInput { + return { + id: `sub-${organizationId}`, productId: "starter-product", organizationId, + polarCustomerId: "same-customer", polarSubscriptionId: `polar-sub-${organizationId}`, + polarCheckoutId: null, status: "active", periodStart: null, periodEnd: null, cancelAtPeriodEnd: false, + }; +} + +describe("DrizzleBillingStore", () => { + it("keeps subscription webhooks idempotent", async () => { + const { db, store } = await setup(); + await store.upsertPolarSubscription(subscription("org-a")); + await store.upsertPolarSubscription({ ...subscription("org-a"), status: "canceled" }); + + expect(await db.select().from(schema.polarSubscription)).toEqual([ + expect.objectContaining({ organizationId: "org-a", status: "canceled" }), + ]); + expect(await store.readOrganizationPolarCustomerId("org-a")).toBe("same-customer"); + }); + + it("does not leave a subscription behind when its customer belongs to another organization", async () => { + const { db, store } = await setup(); + await store.upsertPolarSubscription(subscription("org-a")); + + await expect(store.upsertPolarSubscription(subscription("org-b"))).rejects.toThrow(); + + expect(await db.select().from(schema.polarSubscription)).toEqual([ + expect.objectContaining({ organizationId: "org-a", polarCustomerId: "same-customer" }), + ]); + expect(await store.readOrganizationPolarCustomerId("org-b")).toBeNull(); + }); +}); diff --git a/apps/api/src/billing/adapters/outbound/drizzle-billing-store.ts b/apps/api/src/billing/adapters/outbound/drizzle-billing-store.ts index b6c7ba6b..0859ab4d 100644 --- a/apps/api/src/billing/adapters/outbound/drizzle-billing-store.ts +++ b/apps/api/src/billing/adapters/outbound/drizzle-billing-store.ts @@ -75,7 +75,7 @@ export class DrizzleBillingStore implements BillingAccountStore, BillingSubscrip } async upsertPolarSubscription(input: PolarSubscriptionUpsertInput): Promise { - await this.db + const upsertSubscription = this.db .insert(schema.polarSubscription) .values({ id: input.id, @@ -104,12 +104,16 @@ export class DrizzleBillingStore implements BillingAccountStore, BillingSubscrip }, }); - await this.db + const bindCustomer = this.db .update(schema.organization) .set({ polarCustomerId: input.polarCustomerId, }) .where(eq(schema.organization.id, input.organizationId)); + + // organization.polarCustomerId is unique. If another organization already + // owns it, roll back the subscription write too instead of granting access. + await this.db.batch([upsertSubscription, bindCustomer]); } } diff --git a/apps/api/src/billing/adapters/outbound/polar-provider.test.ts b/apps/api/src/billing/adapters/outbound/polar-provider.test.ts index 3fbaf1c4..ae122466 100644 --- a/apps/api/src/billing/adapters/outbound/polar-provider.test.ts +++ b/apps/api/src/billing/adapters/outbound/polar-provider.test.ts @@ -2,6 +2,8 @@ import { beforeEach, describe, expect, it, vi } from "vitest"; const polarMocks = vi.hoisted(() => ({ checkoutsCreate: vi.fn(), + customersGetExternal: vi.fn(), + customersCreate: vi.fn(), customerSessionsCreate: vi.fn(), subscriptionsUpdate: vi.fn(), Polar: vi.fn(function Polar(this: unknown, config: unknown) { @@ -10,6 +12,10 @@ const polarMocks = vi.hoisted(() => ({ checkouts: { create: polarMocks.checkoutsCreate, }, + customers: { + getExternal: polarMocks.customersGetExternal, + create: polarMocks.customersCreate, + }, customerSessions: { create: polarMocks.customerSessionsCreate, }, @@ -27,6 +33,8 @@ vi.mock("@polar-sh/sdk", () => ({ import { AlreadyCanceledSubscription } from "@polar-sh/sdk/models/errors/alreadycanceledsubscription"; import { PaymentFailed } from "@polar-sh/sdk/models/errors/paymentfailed"; import { SubscriptionLocked } from "@polar-sh/sdk/models/errors/subscriptionlocked"; +import { ResourceNotFound } from "@polar-sh/sdk/models/errors/resourcenotfound"; +import { HTTPValidationError } from "@polar-sh/sdk/models/errors/httpvalidationerror"; import { createPolarCheckout, @@ -36,7 +44,8 @@ import { describe("createPolarCheckout", () => { beforeEach(() => { - vi.clearAllMocks(); + vi.resetAllMocks(); + polarMocks.customersGetExternal.mockResolvedValue({ id: "customer-1" }); }); it("creates a starter checkout with organization metadata", async () => { @@ -72,9 +81,8 @@ describe("createPolarCheckout", () => { }); expect(polarMocks.checkoutsCreate).toHaveBeenCalledWith({ products: ["starter-product"], - externalCustomerId: "user-1", - customerEmail: "user@example.com", - successUrl: "https://synch.example/billing/success?checkout_id={CHECKOUT_ID}", + customerId: "customer-1", + successUrl: "https://synch.example/billing/success?checkout_id={CHECKOUT_ID}&organizationId=org-1", metadata: { referenceId: "org-1", organizationId: "org-1", @@ -85,6 +93,79 @@ describe("createPolarCheckout", () => { }); }); + const checkoutInput = { + planId: "starter" as const, + billingInterval: "monthly" as const, + productId: "starter-product", + organizationId: "org-1", + userId: "user-1", + email: "user@example.com", + }; + const httpMeta = (status: number) => ({ + response: new Response(null, { status }), + request: new Request("https://api.polar.sh/v1/customers/"), + body: "", + }); + const missingCustomer = () => new ResourceNotFound( + { error: "ResourceNotFound", detail: "Customer not found" }, httpMeta(404), + ); + const duplicateEmail = () => new HTTPValidationError({ + detail: [{ loc: ["body", "email"], type: "value_error", msg: "A customer with this email address already exists." }], + }, httpMeta(422)); + + it("creates the organization customer before opening checkout", async () => { + polarMocks.customersGetExternal.mockRejectedValueOnce(missingCustomer()); + polarMocks.customersCreate.mockResolvedValueOnce({ id: "new-customer" }); + polarMocks.checkoutsCreate.mockResolvedValueOnce({ id: "checkout-1", url: "https://polar.example/checkout-1" }); + + await createPolarCheckout({ accessToken: "polar-token" }, checkoutInput); + + expect(polarMocks.customersGetExternal).toHaveBeenCalledWith({ externalId: "org-1" }); + expect(polarMocks.customersCreate).toHaveBeenCalledWith({ externalId: "org-1", email: "user@example.com" }); + expect(polarMocks.checkoutsCreate).toHaveBeenCalledWith(expect.objectContaining({ customerId: "new-customer" })); + expect(polarMocks.checkoutsCreate.mock.calls[0][0]).not.toHaveProperty("customerEmail"); + }); + + it("reuses a stored legacy customer even when another admin pays", async () => { + polarMocks.checkoutsCreate.mockResolvedValueOnce({ id: "checkout-1", url: "https://polar.example/checkout-1" }); + + await createPolarCheckout({ accessToken: "polar-token" }, { ...checkoutInput, polarCustomerId: "legacy-customer", email: "other-admin@example.com" }); + + expect(polarMocks.customersGetExternal).not.toHaveBeenCalled(); + expect(polarMocks.customersCreate).not.toHaveBeenCalled(); + expect(polarMocks.checkoutsCreate).toHaveBeenCalledWith(expect.objectContaining({ customerId: "legacy-customer" })); + }); + + it("does not open checkout when the email belongs to another organization's customer", async () => { + polarMocks.customersGetExternal.mockRejectedValue(missingCustomer()); + polarMocks.customersCreate.mockRejectedValueOnce(duplicateEmail()); + + await expect(createPolarCheckout({ accessToken: "polar-token" }, checkoutInput)) + .rejects.toMatchObject({ code: "billing_email_unavailable" }); + + expect(polarMocks.checkoutsCreate).not.toHaveBeenCalled(); + }); + + it("reuses the same organization's customer after concurrent creation", async () => { + polarMocks.customersGetExternal.mockRejectedValueOnce(missingCustomer()) + .mockResolvedValueOnce({ id: "concurrent-customer" }); + polarMocks.customersCreate.mockRejectedValueOnce(duplicateEmail()); + polarMocks.checkoutsCreate.mockResolvedValueOnce({ id: "checkout-1", url: "https://polar.example/checkout-1" }); + + await createPolarCheckout({ accessToken: "polar-token" }, checkoutInput); + + expect(polarMocks.checkoutsCreate).toHaveBeenCalledWith(expect.objectContaining({ customerId: "concurrent-customer" })); + }); + + it("does not treat lookup outages as a missing customer", async () => { + polarMocks.customersGetExternal.mockRejectedValueOnce(new Error("polar unavailable")); + + await expect(createPolarCheckout({ accessToken: "polar-token" }, checkoutInput)).rejects.toThrow("polar unavailable"); + + expect(polarMocks.customersCreate).not.toHaveBeenCalled(); + expect(polarMocks.checkoutsCreate).not.toHaveBeenCalled(); + }); + it("requires a Polar access token", async () => { await expect( createPolarCheckout( diff --git a/apps/api/src/billing/adapters/outbound/polar-provider.ts b/apps/api/src/billing/adapters/outbound/polar-provider.ts index 24e3afa4..784e65e1 100644 --- a/apps/api/src/billing/adapters/outbound/polar-provider.ts +++ b/apps/api/src/billing/adapters/outbound/polar-provider.ts @@ -3,40 +3,30 @@ import type { Subscription } from "@polar-sh/sdk/models/components/subscription" import { AlreadyCanceledSubscription } from "@polar-sh/sdk/models/errors/alreadycanceledsubscription"; import { PaymentFailed } from "@polar-sh/sdk/models/errors/paymentfailed"; import { SubscriptionLocked } from "@polar-sh/sdk/models/errors/subscriptionlocked"; +import { ResourceNotFound } from "@polar-sh/sdk/models/errors/resourcenotfound"; +import { HTTPValidationError } from "@polar-sh/sdk/models/errors/httpvalidationerror"; -import type { - BillingProvider, - } from "../../application/ports/outbound/billing-provider"; +import type { BillingProvider } from "../../application/ports/outbound/billing-provider"; import type { BillingProviderConfig, PolarSubscriptionUpsertInput, } from "../../application/dto/billing"; import { BillingApplicationError } from "../../application/errors/billing-errors"; -import type { - PaidSubscriptionPlanId, - SubscriptionBillingInterval, -} from "../../../subscription/application"; export class PolarBillingProvider implements BillingProvider { constructor(private readonly config: BillingProviderConfig) {} - async createCheckout(input: { - planId: PaidSubscriptionPlanId; - billingInterval: SubscriptionBillingInterval; - productId: string; - organizationId: string; - userId: string; - email: string; - }): Promise<{ checkoutId: string; url: string }> { + async createCheckout(input: Parameters[0]): Promise<{ checkoutId: string; url: string }> { if (!this.config.accessToken) { throw new Error("POLAR_ACCESS_TOKEN is not configured"); } - const checkout = await this.client().checkouts.create({ + const client = this.client(); + const customerId = await this.checkoutCustomerId(client, input); + const checkout = await client.checkouts.create({ products: [input.productId], - externalCustomerId: input.userId, - customerEmail: input.email, + customerId, successUrl: new URL( - "/billing/success?checkout_id={CHECKOUT_ID}", + `/billing/success?checkout_id={CHECKOUT_ID}&organizationId=${encodeURIComponent(input.organizationId)}`, this.config.wwwBaseUrl, ).toString(), metadata: { @@ -50,6 +40,45 @@ export class PolarBillingProvider implements BillingProvider { return { checkoutId: checkout.id, url: checkout.url }; } + private async checkoutCustomerId( + client: Polar, + input: Parameters[0], + ): Promise { + // The persisted binding also preserves customers created before external + // customer IDs changed from user IDs to organization IDs. + if (input.polarCustomerId) return input.polarCustomerId; + const existing = await this.findOrganizationCustomerId(client, input.organizationId); + if (existing) return existing; + + // An unbound checkout falls back to email matching in Polar. Create the + // customer first so a duplicate email fails before any checkout is opened. + try { + const customer = await client.customers.create({ + externalId: input.organizationId, + email: input.email, + }); + return customer.id; + } catch (error) { + if (!(error instanceof HTTPValidationError)) throw error; + // Another request may have just created this same organization's customer. + const concurrent = await this.findOrganizationCustomerId(client, input.organizationId); + if (concurrent) return concurrent; + if (error.detail?.some((detail) => detail.loc.join(".") === "body.email")) { + throw new BillingApplicationError("billing_email_unavailable"); + } + throw error; + } + } + + private async findOrganizationCustomerId(client: Polar, organizationId: string): Promise { + try { + return (await client.customers.getExternal({ externalId: organizationId })).id; + } catch (error) { + if (error instanceof ResourceNotFound) return null; + throw error; + } + } + async updateSubscriptionProduct(input: { organizationId: string; polarSubscriptionId: string; diff --git a/apps/api/src/billing/adapters/outbound/product-ids.ts b/apps/api/src/billing/adapters/outbound/product-ids.ts index e9b8c304..170eb6cd 100644 --- a/apps/api/src/billing/adapters/outbound/product-ids.ts +++ b/apps/api/src/billing/adapters/outbound/product-ids.ts @@ -1,6 +1,8 @@ import type { SubscriptionProductIdsByPlanId } from "../../../subscription/application"; type PolarProductIdEnv = { + POLAR_PLUS_MONTHLY_PRODUCT_ID?: string; + POLAR_PLUS_ANNUAL_PRODUCT_ID?: string; POLAR_STARTER_MONTHLY_PRODUCT_ID?: string; POLAR_STARTER_ANNUAL_PRODUCT_ID?: string; }; @@ -9,6 +11,10 @@ export function readPolarProductIdsByPlanId( env: PolarProductIdEnv, ): SubscriptionProductIdsByPlanId { return { + plus: { + monthly: env.POLAR_PLUS_MONTHLY_PRODUCT_ID, + annual: env.POLAR_PLUS_ANNUAL_PRODUCT_ID, + }, starter: { monthly: env.POLAR_STARTER_MONTHLY_PRODUCT_ID, annual: env.POLAR_STARTER_ANNUAL_PRODUCT_ID, diff --git a/apps/api/src/billing/application/dto/billing.ts b/apps/api/src/billing/application/dto/billing.ts index 384e7ae9..af34ff85 100644 --- a/apps/api/src/billing/application/dto/billing.ts +++ b/apps/api/src/billing/application/dto/billing.ts @@ -40,6 +40,7 @@ export type PolarSubscriptionUpsertInput = { }; export type BillingStatus = { + availablePlusIntervals?: SubscriptionBillingInterval[]; planId: SubscriptionPlanId; billingInterval: SubscriptionBillingInterval | null; active: boolean; diff --git a/apps/api/src/billing/application/errors/billing-errors.ts b/apps/api/src/billing/application/errors/billing-errors.ts index 2f0ec704..9a38b684 100644 --- a/apps/api/src/billing/application/errors/billing-errors.ts +++ b/apps/api/src/billing/application/errors/billing-errors.ts @@ -7,6 +7,7 @@ export type BillingApplicationErrorCode = | "subscription_plan_unchanged" | "billing_interval_downgrade_not_allowed" | "billing_customer_not_found" + | "billing_email_unavailable" | "subscription_canceled" | "payment_failed" | "subscription_locked"; diff --git a/apps/api/src/billing/application/ports/inbound/billing-service.ts b/apps/api/src/billing/application/ports/inbound/billing-service.ts index b7a38214..c2f9add3 100644 --- a/apps/api/src/billing/application/ports/inbound/billing-service.ts +++ b/apps/api/src/billing/application/ports/inbound/billing-service.ts @@ -11,18 +11,21 @@ import type { export interface BillingService { createCheckout(input: { userId: string; + organizationId?: string; email: string; planId: SubscriptionPlanId; billingInterval?: SubscriptionBillingInterval; }): Promise; changeSubscriptionPlan(input: { userId: string; + organizationId?: string; planId: SubscriptionPlanId; billingInterval: SubscriptionBillingInterval; }): Promise; - readBillingStatus(userId: string): Promise; + readBillingStatus(userId: string, selectedOrganizationId?: string): Promise; createCustomerPortalSession( userId: string, returnPath?: string, + selectedOrganizationId?: string, ): Promise; } diff --git a/apps/api/src/billing/application/ports/outbound/billing-provider.ts b/apps/api/src/billing/application/ports/outbound/billing-provider.ts index 28585b56..b2fb9ba8 100644 --- a/apps/api/src/billing/application/ports/outbound/billing-provider.ts +++ b/apps/api/src/billing/application/ports/outbound/billing-provider.ts @@ -14,6 +14,8 @@ export interface BillingProvider { billingInterval: SubscriptionBillingInterval; productId: string; organizationId: string; + /** Existing customer bound to this organization, including legacy user-based IDs. */ + polarCustomerId?: string | null; userId: string; email: string; }): Promise; diff --git a/apps/api/src/billing/application/services/billing-service.test.ts b/apps/api/src/billing/application/services/billing-service.test.ts index 2fa79927..f57a81a0 100644 --- a/apps/api/src/billing/application/services/billing-service.test.ts +++ b/apps/api/src/billing/application/services/billing-service.test.ts @@ -53,12 +53,31 @@ describe("BillingApplicationService", () => { billingInterval: "monthly", productId: "starter-monthly-product", organizationId: "org-1", + polarCustomerId: null, userId: "user-1", email: "user@example.com", }, ); }); + it("uses the selected organization's existing customer when another admin renews", async () => { + polarMocks.createPolarCheckout.mockResolvedValueOnce({ checkoutId: "checkout-2", url: "https://polar.example/checkout-2" }); + const repository = fakeBillingRepository({ + defaultOrganizationId: "org-1", + polarCustomerId: "legacy-org-2-customer", + subscriptions: [], + }); + const service = createBillingService(repository); + + await service.createCheckout({ userId: "new-admin", organizationId: "org-2", email: "new-admin@example.com", planId: "starter" }); + + expect(repository.readDefaultOrganizationIdForUser).not.toHaveBeenCalled(); + expect(repository.readOrganizationPolarCustomerId).toHaveBeenCalledWith("org-2"); + expect(polarMocks.createPolarCheckout).toHaveBeenCalledWith(expect.objectContaining({ + organizationId: "org-2", polarCustomerId: "legacy-org-2-customer", + })); + }); + it("creates annual starter checkout for the user's default organization", async () => { polarMocks.createPolarCheckout.mockResolvedValueOnce({ checkoutId: "checkout-annual", diff --git a/apps/api/src/billing/application/services/billing-service.ts b/apps/api/src/billing/application/services/billing-service.ts index caf4bfae..b4a65525 100644 --- a/apps/api/src/billing/application/services/billing-service.ts +++ b/apps/api/src/billing/application/services/billing-service.ts @@ -21,6 +21,7 @@ import type { BillingService as BillingServicePort } from "../ports/inbound/bill export type BillingServiceConfig = BillingApplicationConfig; type BillingStatus = { + availablePlusIntervals?: SubscriptionBillingInterval[]; planId: SubscriptionPlanId; billingInterval: SubscriptionBillingInterval | null; active: boolean; @@ -43,18 +44,28 @@ export class BillingApplicationService implements BillingServicePort { async createCheckout(input: { userId: string; + organizationId?: string; email: string; planId: SubscriptionPlanId; billingInterval?: SubscriptionBillingInterval; }): Promise<{ checkoutId: string; url: string }> { const billingInterval = input.billingInterval ?? "monthly"; - const organizationId = await this.accountStore.readDefaultOrganizationIdForUser( - input.userId, - ); + const organizationId = + input.organizationId ?? + (await this.accountStore.readDefaultOrganizationIdForUser(input.userId)); if (!organizationId) { throw new BillingApplicationError("organization_required"); } + if ( + !isBillingManagerRole( + await this.accountStore.readOrganizationRoleForUser( + input.userId, + organizationId, + ), + ) + ) + throw new BillingApplicationError("billing_permission_required"); if (!isCheckoutPlanId(input.planId)) { throw new BillingApplicationError("plan_not_available"); } @@ -68,7 +79,8 @@ export class BillingApplicationService implements BillingServicePort { ); } - const billingStatus = await this.readOrganizationBillingStatus(organizationId); + const billingStatus = + await this.readOrganizationBillingStatus(organizationId); if (billingStatus.active) { throw new BillingApplicationError("subscription_already_active"); } @@ -78,6 +90,7 @@ export class BillingApplicationService implements BillingServicePort { billingInterval, productId, organizationId, + polarCustomerId: await this.accountStore.readOrganizationPolarCustomerId(organizationId), userId: input.userId, email: input.email, }); @@ -85,17 +98,21 @@ export class BillingApplicationService implements BillingServicePort { async changeSubscriptionPlan(input: { userId: string; + organizationId?: string; planId: SubscriptionPlanId; billingInterval: SubscriptionBillingInterval; }): Promise { - const organizationId = await this.accountStore.readDefaultOrganizationIdForUser( - input.userId, - ); + const organizationId = + input.organizationId ?? + (await this.accountStore.readDefaultOrganizationIdForUser(input.userId)); if (!organizationId) { throw new BillingApplicationError("organization_required"); } const organizationRole = - await this.accountStore.readOrganizationRoleForUser(input.userId, organizationId); + await this.accountStore.readOrganizationRoleForUser( + input.userId, + organizationId, + ); if (!isBillingManagerRole(organizationRole)) { throw new BillingApplicationError("billing_permission_required"); } @@ -114,17 +131,23 @@ export class BillingApplicationService implements BillingServicePort { } const subscriptions = - await this.subscriptionStore.readOrganizationSubscriptionStatuses(organizationId); + await this.subscriptionStore.readOrganizationSubscriptionStatuses( + organizationId, + ); const current = subscriptions .map((subscription) => ({ subscription, - access: this.subscriptionAccessReader.readSubscriptionAccess(subscription, { - productIdsByPlanId: this.config.productIdsByPlanId, - }), + access: this.subscriptionAccessReader.readSubscriptionAccess( + subscription, + { + productIdsByPlanId: this.config.productIdsByPlanId, + }, + ), })) - .find(({ subscription, access }) => - access !== null - && isChangeableSubscriptionStatus(subscription.status) + .find( + ({ subscription, access }) => + access !== null && + isChangeableSubscriptionStatus(subscription.status), ); if (!current) { throw new BillingApplicationError("subscription_not_active"); @@ -134,8 +157,15 @@ export class BillingApplicationService implements BillingServicePort { } // Annual subscriptions cannot move back to monthly billing; the shorter // interval only becomes available again after the subscription ends. - if (isAnnualToMonthlyDowngrade(current.access?.billingInterval, input.billingInterval)) { - throw new BillingApplicationError("billing_interval_downgrade_not_allowed"); + if ( + isAnnualToMonthlyDowngrade( + current.access?.billingInterval, + input.billingInterval, + ) + ) { + throw new BillingApplicationError( + "billing_interval_downgrade_not_allowed", + ); } const updatedSubscription = await this.provider.updateSubscriptionProduct({ @@ -147,7 +177,9 @@ export class BillingApplicationService implements BillingServicePort { // waiting for the subscription webhook, which stays as an idempotent backup. await this.subscriptionStore.upsertPolarSubscription(updatedSubscription); try { - await this.config.onSubscriptionUpsert?.(updatedSubscription.organizationId); + await this.config.onSubscriptionUpsert?.( + updatedSubscription.organizationId, + ); } catch (error) { // Polar and the local subscription record are already updated. The // webhook remains responsible for retrying this policy refresh. @@ -155,35 +187,58 @@ export class BillingApplicationService implements BillingServicePort { } return { - ...await this.readOrganizationBillingStatus(organizationId), + ...(await this.readOrganizationBillingStatus(organizationId)), canManageBilling: true, }; } - async readBillingStatus(userId: string): Promise { - const organizationId = await this.accountStore.readDefaultOrganizationIdForUser(userId); + async readBillingStatus( + userId: string, + selectedOrganizationId?: string, + ): Promise { + const organizationId = + selectedOrganizationId ?? + (await this.accountStore.readDefaultOrganizationIdForUser(userId)); if (!organizationId) { throw new BillingApplicationError("organization_required"); } const organizationRole = - await this.accountStore.readOrganizationRoleForUser(userId, organizationId); + await this.accountStore.readOrganizationRoleForUser( + userId, + organizationId, + ); + if (!organizationRole) + throw new BillingApplicationError("billing_permission_required"); return { - ...await this.readOrganizationBillingStatus(organizationId), + ...(await this.readOrganizationBillingStatus(organizationId)), canManageBilling: isBillingManagerRole(organizationRole), + ...(this.config.productIdsByPlanId?.plus + ? { + availablePlusIntervals: (["monthly", "annual"] as const).filter( + (interval) => this.config.productIdsByPlanId?.plus?.[interval], + ), + } + : {}), }; } async createCustomerPortalSession( userId: string, returnPath = "/billing", + selectedOrganizationId?: string, ): Promise<{ url: string }> { - const organizationId = await this.accountStore.readDefaultOrganizationIdForUser(userId); + const organizationId = + selectedOrganizationId ?? + (await this.accountStore.readDefaultOrganizationIdForUser(userId)); if (!organizationId) { throw new BillingApplicationError("organization_required"); } const organizationRole = - await this.accountStore.readOrganizationRoleForUser(userId, organizationId); + await this.accountStore.readOrganizationRoleForUser( + userId, + organizationId, + ); if (!isBillingManagerRole(organizationRole)) { throw new BillingApplicationError("billing_permission_required"); } @@ -204,30 +259,40 @@ export class BillingApplicationService implements BillingServicePort { organizationId: string, ): Promise { const subscriptions = - await this.subscriptionStore.readOrganizationSubscriptionStatuses(organizationId); + await this.subscriptionStore.readOrganizationSubscriptionStatuses( + organizationId, + ); const activeSubscription = subscriptions .map((subscription) => ({ subscription, - access: this.subscriptionAccessReader.readSubscriptionAccess(subscription, { - productIdsByPlanId: this.config.productIdsByPlanId, - }), + access: this.subscriptionAccessReader.readSubscriptionAccess( + subscription, + { + productIdsByPlanId: this.config.productIdsByPlanId, + }, + ), })) .find(({ access }) => access !== null); const active = activeSubscription !== undefined; - const planId: SubscriptionPlanId = activeSubscription?.access?.planId ?? "free"; + const planId: SubscriptionPlanId = + activeSubscription?.access?.planId ?? "free"; return { planId, billingInterval: activeSubscription?.access?.billingInterval ?? null, active, status: - activeSubscription?.subscription.status ?? subscriptions[0]?.status ?? "none", + activeSubscription?.subscription.status ?? + subscriptions[0]?.status ?? + "none", cancelAtPeriodEnd: - activeSubscription?.subscription.cancelAtPeriodEnd - ?? subscriptions[0]?.cancelAtPeriodEnd - ?? false, + activeSubscription?.subscription.cancelAtPeriodEnd ?? + subscriptions[0]?.cancelAtPeriodEnd ?? + false, periodEnd: - (activeSubscription?.subscription.periodEnd ?? subscriptions[0]?.periodEnd) - ?.toISOString() ?? null, + ( + activeSubscription?.subscription.periodEnd ?? + subscriptions[0]?.periodEnd + )?.toISOString() ?? null, }; } } diff --git a/apps/api/src/billing/domain/policy.ts b/apps/api/src/billing/domain/policy.ts index 6fa68f93..4d887e06 100644 --- a/apps/api/src/billing/domain/policy.ts +++ b/apps/api/src/billing/domain/policy.ts @@ -1,4 +1,4 @@ -export const BILLING_CHECKOUT_PLAN_IDS = ["starter"] as const; +export const BILLING_CHECKOUT_PLAN_IDS = ["starter", "plus"] as const; export type BillingCheckoutPlanId = (typeof BILLING_CHECKOUT_PLAN_IDS)[number]; diff --git a/apps/api/src/composition/create-api-application.ts b/apps/api/src/composition/create-api-application.ts index b7469c00..310150d0 100644 --- a/apps/api/src/composition/create-api-application.ts +++ b/apps/api/src/composition/create-api-application.ts @@ -1,3 +1,6 @@ +import { DrizzleSharingStore } from "../sharing/adapters/drizzle-sharing-store"; +import { SharingService } from "../sharing/application/service"; +import { SharingAccess } from "../sharing/application/access"; import { createApp } from "../app"; import type { AuthFeatureConfig } from "../auth/better-auth"; import type { BillingApplicationConfig } from "../billing/application"; @@ -19,7 +22,10 @@ import { type CoordinatorNamespace, } from "../sync-coordinator/adapters/outbound/durable-object-rpc/coordinator-proxy-repository"; import type { BlobObjectStorage } from "../sync-blob-transfer/application/ports/outbound/blob-object-storage"; -import { blobObjectKey, blobObjectKeyPrefix } from "../platform/blob/object-key"; +import { + blobObjectKey, + blobObjectKeyPrefix, +} from "../platform/blob/object-key"; import type { VaultPurgeMessage } from "../vault/application"; export type ApiApplicationDependencies = { @@ -72,12 +78,35 @@ export function createApiApplication( productIdsByPlanId: config.productIdsByPlanId, subscriptionAccessReader: subscriptionFeature.accessReader, }); - const authFeature = createAuthFeature(deps.db, { - ...config.auth, - emailVerification: capabilities.emailVerification, - }, billingFeature.authPlugin ? [billingFeature.authPlugin] : []); + const authFeature = createAuthFeature( + deps.db, + { + ...config.auth, + emailVerification: capabilities.emailVerification, + }, + billingFeature.authPlugin ? [billingFeature.authPlugin] : [], + ); + const sharingStore = new DrizzleSharingStore(deps.db); + const sharingAccess = new SharingAccess( + sharingStore, + subscriptionFeature.policyReader, + ); + const sharing = new SharingService( + sharingStore, + subscriptionFeature.policyReader, + coordinatorProxyRepository, + { + ...config.auth, + billingBaseURL: config.billing?.wwwBaseUrl, + requireVerifiedEmail: + capabilities.emailVerification === "required" && !config.auth.devMode, + }, + ); const syncAccessFeature = createSyncAccessFeature({ vaultService: vaultFeature.service, + accessReader: (userId, vaultId) => sharingAccess.require(userId, vaultId), + accessVerifier: async (claims, token) => + coordinatorProxyRepository.authorizeSync(claims.vaultId, token, claims), coordinatorNamespace: deps.coordinatorNamespace, syncTokenSecret: config.syncTokenSecret, syncTokenTtlSeconds: config.syncTokenTtlSeconds, @@ -89,8 +118,10 @@ export function createApiApplication( objectKeyBuilder: { blobObjectKey, blobObjectKeyPrefix }, }); return { + flushSharingRefreshes: () => sharing.flushRefreshes(), app: createApp( { + sharing, authHttpHandler: authFeature.authHttpHandler, sessionReader: authFeature.sessionReader, syncTokenIssuer: syncAccessFeature.tokenIssuer, diff --git a/apps/api/src/composition/create-coordinator-application.ts b/apps/api/src/composition/create-coordinator-application.ts index d1b0c7cf..98bf6042 100644 --- a/apps/api/src/composition/create-coordinator-application.ts +++ b/apps/api/src/composition/create-coordinator-application.ts @@ -1,3 +1,8 @@ +import { DrizzleSharingStore } from "../sharing/adapters/drizzle-sharing-store"; +import { SharingAccess } from "../sharing/application/access"; +import { CoordinatorSyncAccessService, type VerifiedVaultAccess } from "../sync-coordinator/application/services/sync-access-service"; +import { SqliteSyncAccessStore } from "../sync-coordinator/adapters/outbound/sqlite/sync-access-store"; +import { DEFAULT_SYNC_TOKEN_TTL_SECONDS } from "../sync-access/domain/token-policy"; import { SqliteCoordinatorUnitOfWork } from "../sync-coordinator/adapters/outbound/sqlite/unit-of-work"; import { isCommunityEdition, @@ -61,6 +66,7 @@ export type CoordinatorApplicationConfig = { profile: DeploymentProfile; productIdsByPlanId: SubscriptionProductIdsByPlanId; syncTokenSecret: string; + syncTokenTtlSeconds?: number; blobGracePeriodMs?: number; cursorActiveTtlMs?: number; }; @@ -75,10 +81,7 @@ export function createCoordinatorApplication( const cursorActiveTtlMs = config.cursorActiveTtlMs ?? DEFAULT_CURSOR_ACTIVE_TTL_MS; const unitOfWork = new SqliteCoordinatorUnitOfWork(deps.storageHandle); - const { - state: cursorStore, - connections, - } = unitOfWork.stores; + const { state: cursorStore, connections } = unitOfWork.stores; const healthStore = new CoordinatorHealthStore( deps.storageHandle, deps.socketCounter, @@ -89,8 +92,31 @@ export function createCoordinatorApplication( }); const vaultOrganizationReader = createVaultOrganizationReader(deps.db); const syncStatusRepository = new VaultSyncStatusRepository(deps.db); + const sharingStore = new DrizzleSharingStore(deps.db); + const sharingAccess = new SharingAccess(sharingStore, subscriptionFeature.policyReader); + const syncAccess = new CoordinatorSyncAccessService( + new SqliteSyncAccessStore(deps.storageHandle), + deps.socketGateway, + async (vaultId) => { + const vault = await sharingStore.vault(vaultId); + if (!vault) throw new Error("Vault not found while refreshing sync access"); + return { + grants: await sharingStore.accessVersions(vaultId), + suspended: await sharingAccess.isSuspended(vaultId), + }; + }, + Math.max( + DEFAULT_SYNC_TOKEN_TTL_SECONDS, + config.syncTokenTtlSeconds ?? DEFAULT_SYNC_TOKEN_TTL_SECONDS, + ) * 1000, + ); const syncTokenFeature = createSyncTokenFeature({ syncTokenSecret: config.syncTokenSecret, + accessVerifier: async (claims) => syncAccess.require({ + vaultId: claims.vaultId, + userId: claims.sub, + accessVersion: claims.accessVersion ?? 1, + }), }); const syncTokenService = syncTokenFeature.tokenVerifier; const objectKeyBuilder = { blobObjectKey, blobObjectKeyPrefix }; @@ -108,6 +134,7 @@ export function createCoordinatorApplication( objectKeyBuilder, deps.maintenanceScheduler, healthService, + async (vaultId) => !(await sharingAccess.isSuspended(vaultId)), ); const blobService = new BlobService( syncTokenService, @@ -165,6 +192,11 @@ export function createCoordinatorApplication( syncTokenService, vaultService, healthService, + (session) => syncAccess.require({ + vaultId: session.vaultId, + userId: session.userId, + accessVersion: session.accessVersion ?? 1, + }), ); const maintenanceService = new MaintenanceService( deps.maintenanceScheduler, @@ -189,12 +221,27 @@ export function createCoordinatorApplication( services, healthService, connections, + undefined, + async (session) => { + syncAccess.require({ + userId: session.userId, + vaultId: session.vaultId, + accessVersion: session.accessVersion ?? 1, + }); + }, ); return { + authorizeSyncAccess: async (input: VerifiedVaultAccess) => + syncAccess.authorizeVerified(input), app: createCoordinatorApp({ services, socketHandshake: deps.socketGateway, + authorize: (token, vaultId) => + syncTokenService.verifySyncToken(token, vaultId), + refreshSharing: (vaultId) => syncAccess.refresh(vaultId), + canApplyPolicy: async (vaultId) => + !(await sharingAccess.isSuspended(vaultId)), }), services, socketMessageHandler, diff --git a/apps/api/src/composition/features/create-auth-feature.ts b/apps/api/src/composition/features/create-auth-feature.ts index a33be014..dd9cf4e8 100644 --- a/apps/api/src/composition/features/create-auth-feature.ts +++ b/apps/api/src/composition/features/create-auth-feature.ts @@ -23,7 +23,16 @@ export function createAuthFeature( const auth = createBetterAuth(db, { ...config, plugins }); return { - authHttpHandler: (request) => auth.handler(request), + authHttpHandler: (request) => { + // Synch's endpoints enforce vault assignments, plan limits and revocation. + // Internal Better Auth API calls (e.g. personal organization creation) remain available. + let pathname: string; + try { pathname = decodeURIComponent(new URL(request.url).pathname); } catch { return Promise.resolve(Response.json({ error: "invalid_path" }, { status: 400 })); } + if (pathname.startsWith("/api/auth/organization/") && !(request.method === "GET" && pathname === "/api/auth/organization/list")) { + return Promise.resolve(Response.json({ error: "use_organization_api", message: "Use the Synch organization management API" }, { status: 403 })); + } + return auth.handler(request); + }, sessionReader: createBetterAuthSessionReader(auth), }; } diff --git a/apps/api/src/composition/features/create-sync-access-feature.ts b/apps/api/src/composition/features/create-sync-access-feature.ts index d51551d3..513c4434 100644 --- a/apps/api/src/composition/features/create-sync-access-feature.ts +++ b/apps/api/src/composition/features/create-sync-access-feature.ts @@ -1,3 +1,4 @@ +import type { SyncTokenClaims } from "../../sync-access/application/dto/token"; import type { VaultService } from "../../vault/application"; import type { IssueSyncToken, VerifySyncToken } from "../../sync-access/application"; import { CoordinatorSyncPauseReader, type CoordinatorNamespace } from "../../sync-access/adapters/outbound/coordinator-sync-pause-reader"; @@ -22,8 +23,10 @@ export function createSyncAccessFeature(config: { coordinatorNamespace: CoordinatorNamespace; syncTokenSecret: string; syncTokenTtlSeconds?: number; + accessReader?: (userId: string, vaultId: string) => Promise; + accessVerifier?: (claims: SyncTokenClaims, token: string) => Promise; }): SyncAccessFeature { - const tokenFeature = createSyncTokenFeature({ syncTokenSecret: config.syncTokenSecret }); + const tokenFeature = createSyncTokenFeature({ syncTokenSecret: config.syncTokenSecret, accessVerifier: config.accessVerifier }); const pauseReader = new CoordinatorSyncPauseReader(config.coordinatorNamespace); return { ...tokenFeature, @@ -32,15 +35,17 @@ export function createSyncAccessFeature(config: { tokenFeature.codec, pauseReader, config.syncTokenTtlSeconds, + config.accessReader, ), }; } export function createSyncTokenFeature(config: { syncTokenSecret: string; + accessVerifier?: (claims: SyncTokenClaims, token: string) => Promise; }): SyncTokenFeature & { codec: JoseSyncTokenCodec } { const codec = new JoseSyncTokenCodec(config.syncTokenSecret); - const tokenVerifier = new VerifySyncTokenService(codec); + const tokenVerifier = new VerifySyncTokenService(codec, config.accessVerifier); return { codec, tokenVerifier, diff --git a/apps/api/src/composition/features/create-vault-feature.ts b/apps/api/src/composition/features/create-vault-feature.ts index 18c355f6..ca319236 100644 --- a/apps/api/src/composition/features/create-vault-feature.ts +++ b/apps/api/src/composition/features/create-vault-feature.ts @@ -1,3 +1,4 @@ +import { DrizzleSharingStore } from "../../sharing/adapters/drizzle-sharing-store"; import type { AppDb } from "../../db/client"; import type { SubscriptionPolicyReader } from "../../subscription/application"; import type { VaultPurgeMessage, VaultRetentionEmailMessage } from "../../vault/application"; @@ -69,6 +70,7 @@ export function createVaultFeature(config: VaultFeatureConfig): VaultFeature { store, config.policyReader, purgeQueue, + async (userId, organizationId) => { const member = await new DrizzleSharingStore(config.db).membership(organizationId, userId); return member?.role === "owner" || member?.role === "admin"; }, ), organizationReader: new VaultOrganizationService(store), purgeConsumer, diff --git a/apps/api/src/config/cloudflare.ts b/apps/api/src/config/cloudflare.ts index 720f701e..55cab605 100644 --- a/apps/api/src/config/cloudflare.ts +++ b/apps/api/src/config/cloudflare.ts @@ -29,6 +29,8 @@ export type CloudflareRuntimeEnv = Omit< WWW_BASE_URL?: string; POLAR_ACCESS_TOKEN?: string; POLAR_WEBHOOK_SECRET?: string; + POLAR_PLUS_MONTHLY_PRODUCT_ID?: string; + POLAR_PLUS_ANNUAL_PRODUCT_ID?: string; POLAR_STARTER_MONTHLY_PRODUCT_ID?: string; POLAR_STARTER_ANNUAL_PRODUCT_ID?: string; POLAR_SANDBOX?: string; diff --git a/apps/api/src/db/__tests__/libsql-app-db.test.ts b/apps/api/src/db/__tests__/libsql-app-db.test.ts index 5e7abaa4..382a1b87 100644 --- a/apps/api/src/db/__tests__/libsql-app-db.test.ts +++ b/apps/api/src/db/__tests__/libsql-app-db.test.ts @@ -109,7 +109,7 @@ describe("libSQL app DB", () => { db.insert(schema.vaultMembership).values({ vaultId, userId: "user-1", - role: "owner", + isCreator: true, status: "active", }), ]); diff --git a/apps/api/src/db/d1/index.ts b/apps/api/src/db/d1/index.ts index 24a1ebf9..dc72af5f 100644 --- a/apps/api/src/db/d1/index.ts +++ b/apps/api/src/db/d1/index.ts @@ -1,3 +1,4 @@ export * from "./auth-schema"; export * from "./subscription-schema"; export * from "./vault-schema"; +export * from "./sharing-schema"; diff --git a/apps/api/src/db/d1/sharing-schema.ts b/apps/api/src/db/d1/sharing-schema.ts new file mode 100644 index 00000000..727e76e0 --- /dev/null +++ b/apps/api/src/db/d1/sharing-schema.ts @@ -0,0 +1,72 @@ +import { + index, + integer, + primaryKey, + sqliteTable, + text, +} from "drizzle-orm/sqlite-core"; +import { invitation, organization, user } from "./auth-schema"; +import { vault } from "./vault-schema"; + +// Invitation state remains in Better Auth's table; this is Synch's vault scope. +export const invitationVault = sqliteTable( + "invitation_vault", + { + invitationId: text("invitation_id") + .notNull() + .references(() => invitation.id, { onDelete: "cascade" }), + vaultId: text("vault_id") + .notNull() + .references(() => vault.id, { onDelete: "cascade" }), + }, + (t) => [primaryKey({ columns: [t.invitationId, t.vaultId] })], +); + +export const vaultKeyRequest = sqliteTable( + "vault_key_request", + { + id: text("id").primaryKey(), + vaultId: text("vault_id") + .notNull() + .references(() => vault.id, { onDelete: "cascade" }), + userId: text("user_id") + .notNull() + .references(() => user.id, { onDelete: "cascade" }), + purpose: text("purpose").notNull(), + accessVersion: integer("access_version").notNull(), + publicKey: text("public_key").notNull(), + status: text("status").notNull(), + envelopeJson: text("envelope_json"), + approvedBy: text("approved_by").references(() => user.id), + createdAt: integer("created_at").notNull(), + expiresAt: integer("expires_at").notNull(), + }, + (t) => [ + index("vault_key_request_vault_status_idx").on(t.vaultId, t.status), + index("vault_key_request_user_idx").on(t.userId), + ], +); + +export const sharingAudit = sqliteTable( + "sharing_audit", + { + id: text("id").primaryKey(), + organizationId: text("organization_id") + .notNull() + .references(() => organization.id, { onDelete: "cascade" }), + actorId: text("actor_id").notNull(), + action: text("action").notNull(), + targetId: text("target_id").notNull(), + createdAt: integer("created_at").notNull(), + }, + (t) => [index("sharing_audit_org_idx").on(t.organizationId, t.createdAt)], +); + +// Durable delivery records are retried by management reads and scheduled work. +export const sharingRefresh = sqliteTable("sharing_refresh", { + vaultId: text("vault_id") + .primaryKey() + .references(() => vault.id, { onDelete: "cascade" }), + revision: text("revision").notNull(), + createdAt: integer("created_at").notNull(), +}); diff --git a/apps/api/src/db/d1/vault-schema.ts b/apps/api/src/db/d1/vault-schema.ts index dbcd0acf..d93fbdb1 100644 --- a/apps/api/src/db/d1/vault-schema.ts +++ b/apps/api/src/db/d1/vault-schema.ts @@ -19,6 +19,7 @@ export const vault = sqliteTable("vault", { .notNull() .references(() => organization.id, { onDelete: "cascade" }), name: text("name").notNull(), + sharedAt: integer("shared_at", { mode: "timestamp_ms" }), activeKeyVersion: integer("active_key_version").notNull(), createdAt: integer("created_at", { mode: "timestamp_ms" }) .default(sqliteEpochMsNow) @@ -43,7 +44,11 @@ export const vaultMembership = sqliteTable( userId: text("user_id") .notNull() .references(() => user.id, { onDelete: "cascade" }), - role: text("role").notNull(), + accessVersion: integer("access_version").notNull().default(1), + // Creation provenance preserves the existing local-vault connection flow. + // It never grants management authority. + isCreator: integer("is_creator", { mode: "boolean" }).notNull().default(false), + explicitAccess: integer("explicit_access", { mode: "boolean" }).notNull().default(true), status: text("status").notNull(), joinedAt: integer("joined_at", { mode: "timestamp_ms" }) .default(sqliteEpochMsNow) diff --git a/apps/api/src/db/do/index.ts b/apps/api/src/db/do/index.ts index 64d08508..bd9f9c54 100644 --- a/apps/api/src/db/do/index.ts +++ b/apps/api/src/db/do/index.ts @@ -7,6 +7,12 @@ import { uniqueIndex, } from "drizzle-orm/sqlite-core"; +export const syncAccessRevocations = sqliteTable("sync_access_revocations", { + key: text("key").primaryKey(), + minimumVersion: integer("minimum_version"), + expiresAt: integer("expires_at").notNull(), +}); + export const entries = sqliteTable( "entries", { diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts index 868a6032..4d0a0ebc 100644 --- a/apps/api/src/index.ts +++ b/apps/api/src/index.ts @@ -2,7 +2,7 @@ import { logServerError } from "./errors"; import { createQueueConsumer, createRuntimeApp, - runVaultRetentionSchedule, + runScheduledTasks, } from "./runtime"; import type { QueueMessage } from "./runtime"; export { SyncCoordinator } from "./sync-coordinator/adapters/inbound/durable-object-rpc/sync-coordinator"; @@ -26,6 +26,6 @@ export default { await createQueueConsumer(env).handleBatch(batch); }, async scheduled(controller, env): Promise { - await runVaultRetentionSchedule(env, controller.scheduledTime); + await runScheduledTasks(env, controller.cron, controller.scheduledTime); }, } satisfies ExportedHandler; diff --git a/apps/api/src/public-pages.test.ts b/apps/api/src/public-pages.test.ts index 2765bf23..22b5d3e7 100644 --- a/apps/api/src/public-pages.test.ts +++ b/apps/api/src/public-pages.test.ts @@ -3,7 +3,7 @@ import { fileURLToPath } from "node:url"; import { describe, expect, it } from "vitest"; -const apiPublicPages = ["device.html", "signin.html", "signup.html", "vaults.html"] as const; +const apiPublicPages = ["device.html", "signin.html", "signup.html", "vaults.html", "organizations.html", "invitations.html"] as const; const publicDir = new URL("../public/", import.meta.url); diff --git a/apps/api/src/runtime.ts b/apps/api/src/runtime.ts index a9f577f4..7902a910 100644 --- a/apps/api/src/runtime.ts +++ b/apps/api/src/runtime.ts @@ -1,7 +1,7 @@ export { createCoordinatorRuntime } from "./runtime/coordinator"; export { createRuntimeApp } from "./runtime/http"; export { createQueueConsumer } from "./runtime/queue"; -export { runVaultRetentionSchedule } from "./runtime/scheduled"; +export { runScheduledTasks, runVaultRetentionSchedule } from "./runtime/scheduled"; export type { QueueMessage, SubscriptionPolicyRefreshMessage, diff --git a/apps/api/src/runtime/coordinator.ts b/apps/api/src/runtime/coordinator.ts index f7772d4e..2601dbe5 100644 --- a/apps/api/src/runtime/coordinator.ts +++ b/apps/api/src/runtime/coordinator.ts @@ -11,7 +11,10 @@ import { CoordinatorSocketService } from "../sync-coordinator/adapters/outbound/ import { DurableCoordinatorStorage } from "../sync-coordinator/adapters/outbound/storage-lifecycle/durable-object-storage"; import { DurableObjectCoordinatorStorageHandle } from "../sync-coordinator/adapters/outbound/sqlite/storage-handle"; -export function createCoordinatorRuntime(ctx: DurableObjectState, env: CloudflareRuntimeEnv) { +export function createCoordinatorRuntime( + ctx: DurableObjectState, + env: CloudflareRuntimeEnv, +) { const profile = readCloudflareProfile(env); const db = createDb(env.DB); const storage = new DurableCoordinatorStorage(ctx); @@ -32,6 +35,7 @@ export function createCoordinatorRuntime(ctx: DurableObjectState, env: Cloudflar profile, productIdsByPlanId: readPolarProductIdsByPlanId(env), syncTokenSecret: env.SYNC_TOKEN_SECRET, + syncTokenTtlSeconds: env.SYNC_TOKEN_TTL_SECONDS, }, ); const ready = ctx.blockConcurrencyWhile(async (): Promise => { @@ -41,6 +45,7 @@ export function createCoordinatorRuntime(ctx: DurableObjectState, env: Cloudflar return { app: application.app, + authorizeSyncAccess: application.authorizeSyncAccess, services: application.services, socketMessageHandler: application.socketMessageHandler, socketGateway: socketService, diff --git a/apps/api/src/runtime/node-coordinator-namespace.ts b/apps/api/src/runtime/node-coordinator-namespace.ts index b766043d..f14e04bd 100644 --- a/apps/api/src/runtime/node-coordinator-namespace.ts +++ b/apps/api/src/runtime/node-coordinator-namespace.ts @@ -3,7 +3,10 @@ import path from "node:path"; import { openExclusiveSqliteConnection } from "../sync-coordinator/adapters/outbound/sqlite/storage-handle"; import type { CoordinatorStub } from "../sync-coordinator/adapters/outbound/durable-object-rpc/coordinator-proxy-repository"; -import { createNodeCoordinatorRuntime, type NodeCoordinatorSharedDeps } from "./node-coordinator"; +import { + createNodeCoordinatorRuntime, + type NodeCoordinatorSharedDeps, +} from "./node-coordinator"; import type { NodeCoordinatorRuntime } from "./node-coordinator"; const VAULT_ID_PATTERN = /^[a-zA-Z0-9_-]+$/; @@ -27,6 +30,11 @@ export class NodeCoordinatorNamespace { getByName(vaultId: string): CoordinatorStub { return { + authorizeSyncAccess: async (input) => { + const runtime = this.getOrCreateRuntime(vaultId); + await runtime.ready; + return runtime.authorizeSyncAccess(input); + }, fetch: async (request: Request) => { const runtime = this.getOrCreateRuntime(vaultId); await runtime.ready; @@ -56,7 +64,9 @@ export class NodeCoordinatorNamespace { private vaultFilePath(vaultId: string): string { if (!VAULT_ID_PATTERN.test(vaultId)) { - throw new Error(`refusing to derive a filesystem path from vault id: ${vaultId}`); + throw new Error( + `refusing to derive a filesystem path from vault id: ${vaultId}`, + ); } return path.join(this.dataDir, "vaults", `${vaultId}.sqlite`); } diff --git a/apps/api/src/runtime/node-coordinator.ts b/apps/api/src/runtime/node-coordinator.ts index 5d4b1e68..38860f6c 100644 --- a/apps/api/src/runtime/node-coordinator.ts +++ b/apps/api/src/runtime/node-coordinator.ts @@ -1,3 +1,4 @@ +import type { VerifiedVaultAccess } from "../sync-coordinator/application/services/sync-access-service"; import type Database from "better-sqlite3"; import { createCoordinatorApplication } from "../composition/create-coordinator-application"; @@ -11,6 +12,7 @@ import { SqliteCoordinatorStorageHandle } from "../sync-coordinator/adapters/out import { SqliteCoordinatorStorage } from "../sync-coordinator/adapters/outbound/sqlite/storage-lifecycle"; import { VaultLockRegistry } from "../sync-coordinator/adapters/outbound/sqlite/vault-lock"; import type { ClientControlMessage } from "../sync-coordinator/application/dto/protocol-types"; +import type { SocketSession } from "../sync-coordinator/application/dto/types"; const ALARM_FAILURE_RETRY_MS = 30 * 1000; @@ -18,6 +20,7 @@ export interface NodeCoordinatorSharedDeps { db: AppDb; blobStorage: BlobObjectStorage; syncTokenSecret: string; + syncTokenTtlSeconds?: number; profile: Extract; productIdsByPlanId: SubscriptionProductIdsByPlanId; } @@ -31,7 +34,7 @@ export interface NodeCoordinatorSharedDeps { * A Durable Object also serializes every request to a given instance via * input gates - two concurrent requests for the same vault never interleave * their storage access. A Node process has no such guarantee, so every - * public entry point into this runtime (HTTP requests, socket messages, and + * coordinator SQLite entry point (HTTP requests, socket messages, and * the socket connect/close lifecycle) is funneled through `vaultLock` to * reproduce that serialization. See `VaultLockRegistry` for why this is * necessary and what it doesn't cover (cross-process races, handled instead @@ -51,17 +54,23 @@ export function createNodeCoordinatorRuntime( // but the scheduler needs a callback now - same forward-reference-via- // closure pattern the coordinator's own test helpers use for the DO path. let application: ReturnType; - const maintenanceScheduler = new NodeMaintenanceScheduler(storageHandle, async () => { - try { - await vaultLock.run(vaultId, () => application.services.handleAlarm()); - } catch (error) { - // Mirrors `SyncCoordinator.alarm()`'s catch: an unhandled rejection - // here would crash the whole Node process (unlike a DO, where a - // failed alarm invocation only affects that one object). - console.error("[node-coordinator] maintenance alarm failed", formatLogError(error)); - maintenanceScheduler.retryAfter(ALARM_FAILURE_RETRY_MS); - } - }); + const maintenanceScheduler = new NodeMaintenanceScheduler( + storageHandle, + async () => { + try { + await vaultLock.run(vaultId, () => application.services.handleAlarm()); + } catch (error) { + // Mirrors `SyncCoordinator.alarm()`'s catch: an unhandled rejection + // here would crash the whole Node process (unlike a DO, where a + // failed alarm invocation only affects that one object). + console.error( + "[node-coordinator] maintenance alarm failed", + formatLogError(error), + ); + maintenanceScheduler.retryAfter(ALARM_FAILURE_RETRY_MS); + } + }, + ); application = createCoordinatorApplication( { db: deps.db, @@ -76,6 +85,7 @@ export function createNodeCoordinatorRuntime( profile: deps.profile, productIdsByPlanId: deps.productIdsByPlanId, syncTokenSecret: deps.syncTokenSecret, + syncTokenTtlSeconds: deps.syncTokenTtlSeconds, }, ); @@ -85,6 +95,9 @@ export function createNodeCoordinatorRuntime( })(); return { + // Authorization reads only local revocations without queuing behind blob writes. + authorizeSyncAccess: (input: VerifiedVaultAccess) => + ready.then(() => application.authorizeSyncAccess(input)), app: { fetch: (request: Request) => vaultLock.run(vaultId, () => application.app.fetch(request)), @@ -104,6 +117,9 @@ export function createNodeCoordinatorRuntime( }), }, socketConnectionService: { + // No await/lock queue between this local check and native socket acceptance. + assertSessionAccess: (session: SocketSession) => + application.socketConnectionService.assertSessionAccess(session), prepareSocketSession: (token: string | null, id: string) => vaultLock.run(vaultId, () => application.socketConnectionService.prepareSocketSession(token, id), @@ -123,11 +139,18 @@ export function createNodeCoordinatorRuntime( }; } -export type NodeCoordinatorRuntime = ReturnType; +export type NodeCoordinatorRuntime = ReturnType< + typeof createNodeCoordinatorRuntime +>; function formatLogError(error: unknown): Record { if (error instanceof Error) { - return { name: error.name, message: error.message, stack: error.stack, cause: error.cause }; + return { + name: error.name, + message: error.message, + stack: error.stack, + cause: error.cause, + }; } return { message: String(error) }; } diff --git a/apps/api/src/runtime/node-websocket.ts b/apps/api/src/runtime/node-websocket.ts index f3757392..507aeb4a 100644 --- a/apps/api/src/runtime/node-websocket.ts +++ b/apps/api/src/runtime/node-websocket.ts @@ -75,6 +75,7 @@ export function createNodeWebSocketUpgradeHandler(runtime: NodeRuntime, publicUr readSyncToken(request), vaultId, ); + coordinator.socketConnectionService.assertSessionAccess(session); } catch { socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n"); socket.destroy(); diff --git a/apps/api/src/runtime/node.ts b/apps/api/src/runtime/node.ts index 63dc0bec..2ae37d62 100644 --- a/apps/api/src/runtime/node.ts +++ b/apps/api/src/runtime/node.ts @@ -73,6 +73,7 @@ export async function createNodeRuntime(config: NodeRuntimeConfig) { db, blobStorage: config.blobStorage, syncTokenSecret: config.syncTokenSecret, + syncTokenTtlSeconds: config.syncTokenTtlSeconds, profile: NODE_COMMUNITY_PROFILE, productIdsByPlanId: {}, }); @@ -114,11 +115,18 @@ export async function createNodeRuntime(config: NodeRuntimeConfig) { return c.json({ error: "not_found", message: "unknown route" }, 404); }); + const sharingRefreshTimer = setInterval(() => { + void application + .flushSharingRefreshes() + .catch((error) => console.error("sharing refresh retry failed", error)); + }, 5 * 60 * 1000); + sharingRefreshTimer.unref(); return { fetch: (request: Request) => application.app.fetch(request), coordinatorNamespace, syncTokenVerifier: application.syncTokenVerifier, dispose: () => { + clearInterval(sharingRefreshTimer); coordinatorNamespace.closeAll(); void client.close(); }, diff --git a/apps/api/src/runtime/scheduled.ts b/apps/api/src/runtime/scheduled.ts index 09b3e87c..f360625a 100644 --- a/apps/api/src/runtime/scheduled.ts +++ b/apps/api/src/runtime/scheduled.ts @@ -1,3 +1,5 @@ +import { DrizzleSharingStore } from "../sharing/adapters/drizzle-sharing-store"; +import { CoordinatorProxyRepository } from "../sync-coordinator/adapters/outbound/durable-object-rpc/coordinator-proxy-repository"; import { readPolarProductIdsByPlanId } from "../billing/adapters/outbound/product-ids"; import { readCloudflareProfile, @@ -7,6 +9,27 @@ import { isCommunityEdition } from "../config/deployment-profile"; import { createSubscriptionFeature } from "../composition/features/create-subscription-feature"; import { createVaultRetentionFeature } from "../composition/features/create-vault-feature"; import { createDb } from "../db/client"; +import { flushSharingRefreshes } from "../sharing/application/refresh"; + +export const SHARING_REFRESH_CRON = "*/5 * * * *"; +export const VAULT_RETENTION_CRON = "0 */6 * * *"; + +export async function runScheduledTasks( + env: CloudflareRuntimeEnv, + cron: string, + now = Date.now(), +): Promise { + if (cron === SHARING_REFRESH_CRON) await runSharingRefreshSchedule(env); + else if (cron === VAULT_RETENTION_CRON) await runVaultRetentionSchedule(env, now); +} + +export async function runSharingRefreshSchedule( + env: CloudflareRuntimeEnv, +): Promise { + const sharingStore = new DrizzleSharingStore(createDb(env.DB)); + await flushSharingRefreshes(sharingStore, new CoordinatorProxyRepository(env.SYNC_COORDINATOR)); + await sharingStore.pruneExpiredRequests(); +} export async function runVaultRetentionSchedule( env: CloudflareRuntimeEnv, diff --git a/apps/api/src/sharing/adapters/drizzle-sharing-store.ts b/apps/api/src/sharing/adapters/drizzle-sharing-store.ts new file mode 100644 index 00000000..da6de255 --- /dev/null +++ b/apps/api/src/sharing/adapters/drizzle-sharing-store.ts @@ -0,0 +1,618 @@ +import type { SharingStore, InvitationRecord } from "../application/store"; +import { + and, + asc, + desc, + eq, + exists, + gt, + inArray, + isNull, + ne, + sql, + type SQL, +} from "drizzle-orm"; +import type { AppDb } from "../../db/client"; +import * as s from "../../db/d1"; +import type { + VaultGrant, + KeyRequest, + PasswordEnvelope, +} from "../application/types"; + +export class DrizzleSharingStore implements SharingStore { + constructor(readonly db: AppDb) {} + + async claimInvitationDelivery(invite: InvitationRecord): Promise { + const now = Date.now(); + const rows = await this.db + .all(sql`INSERT INTO sharing_audit (id, organization_id, actor_id, action, target_id, created_at) + SELECT ${crypto.randomUUID()}, ${invite.organizationId}, ${invite.inviterId}, 'invitation_delivery', ${invite.id}, ${now} + WHERE NOT EXISTS (SELECT 1 FROM sharing_audit WHERE target_id=${invite.id} AND action='invitation_delivery' AND created_at>${now - 60000}) + AND (SELECT count(*) FROM sharing_audit WHERE organization_id=${invite.organizationId} AND action='invitation_delivery' AND created_at>${now - 3600000})<20 RETURNING id`); + return rows.length > 0; + } + async pruneExpiredRequests() { + await this.db + .update(s.vaultKeyRequest) + .set({ status: "canceled", envelopeJson: null }) + .where( + and( + sql`${s.vaultKeyRequest.expiresAt}<=${Date.now()}`, + inArray(s.vaultKeyRequest.status, ["pending", "approved"]), + ), + ); + } + async accessVersions(vaultId: string) { + return this.db.select({ userId: s.vaultMembership.userId, accessVersion: s.vaultMembership.accessVersion }) + .from(s.vaultMembership).where(eq(s.vaultMembership.vaultId, vaultId)); + } + async organizations(userId: string) { + return this.db + .select({ + id: s.organization.id, + name: s.organization.name, + role: s.member.role, + }) + .from(s.organization) + .innerJoin(s.member, eq(s.member.organizationId, s.organization.id)) + .where(eq(s.member.userId, userId)) + .orderBy(asc(s.member.createdAt)); + } + async membership(organizationId: string, userId: string) { + return ( + ( + await this.db + .select() + .from(s.member) + .where( + and( + eq(s.member.organizationId, organizationId), + eq(s.member.userId, userId), + ), + ) + .limit(1) + )[0] ?? null + ); + } + async user(userId: string) { + return ( + ( + await this.db + .select() + .from(s.user) + .where(eq(s.user.id, userId)) + .limit(1) + )[0] ?? null + ); + } + async members(organizationId: string) { + return this.db + .select({ + id: s.member.userId, + name: s.user.name, + email: s.user.email, + role: s.member.role, + }) + .from(s.member) + .innerJoin(s.user, eq(s.user.id, s.member.userId)) + .where(eq(s.member.organizationId, organizationId)); + } + async organization(organizationId: string) { + return ( + ( + await this.db + .select() + .from(s.organization) + .where(eq(s.organization.id, organizationId)) + .limit(1) + )[0] ?? null + ); + } + async rename(organizationId: string, name: string) { + await this.db + .update(s.organization) + .set({ name }) + .where(eq(s.organization.id, organizationId)); + } + async vault(vaultId: string) { + return ( + ( + await this.db + .select() + .from(s.vault) + .where(and(eq(s.vault.id, vaultId), isNull(s.vault.deletedAt))) + .limit(1) + )[0] ?? null + ); + } + async vaults(organizationId: string) { + return this.db + .select() + .from(s.vault) + .where( + and( + eq(s.vault.organizationId, organizationId), + isNull(s.vault.deletedAt), + ), + ); + } + async grants(vaultId: string) { + return this.db + .select({ + userId: s.vaultMembership.userId, + status: s.vaultMembership.status, + name: s.user.name, + email: s.user.email, + }) + .from(s.vaultMembership) + .innerJoin(s.user, eq(s.user.id, s.vaultMembership.userId)) + .where(eq(s.vaultMembership.vaultId, vaultId)); + } + async grant(vaultId: string, userId: string) { + return ( + ( + await this.db + .select() + .from(s.vaultMembership) + .where( + and( + eq(s.vaultMembership.vaultId, vaultId), + eq(s.vaultMembership.userId, userId), + ), + ) + .limit(1) + )[0] ?? null + ); + } + async invitations(organizationId: string) { + return this.db + .select() + .from(s.invitation) + .where(eq(s.invitation.organizationId, organizationId)) + .orderBy(desc(s.invitation.createdAt)) + .limit(100); + } + async invitation(invitationId: string) { + return ( + ( + await this.db + .select() + .from(s.invitation) + .where(eq(s.invitation.id, invitationId)) + .limit(1) + )[0] ?? null + ); + } + async invitationGrants(invitationId: string) { + return this.db + .select({ + vaultId: s.invitationVault.vaultId, + name: s.vault.name, + }) + .from(s.invitationVault) + .innerJoin(s.vault, eq(s.vault.id, s.invitationVault.vaultId)) + .where(eq(s.invitationVault.invitationId, invitationId)); + } + async audit( + organizationId: string, + actorId: string, + action: string, + targetId: string, + ) { + await this.db + .insert(s.sharingAudit) + .values({ + id: crypto.randomUUID(), + organizationId, + actorId, + action, + targetId, + createdAt: Date.now(), + }); + } + + async createInvitation(input: { + organizationId: string; + email: string; + role: string; + inviterId: string; + grants: VaultGrant[]; + memberLimit: number; + }) { + const id = crypto.randomUUID(); + const now = Date.now(); + const expires = now + 48 * 60 * 60 * 1000; + // A single conditional INSERT reserves the seat, including concurrent invitations. + const rows = await this.db.all<{ id: string }>(sql` + INSERT INTO invitation (id, organization_id, email, role, status, expires_at, created_at, inviter_id) + SELECT ${id}, ${input.organizationId}, ${input.email}, ${input.role}, 'pending', ${expires}, ${now}, ${input.inviterId} + WHERE NOT EXISTS (SELECT 1 FROM invitation WHERE organization_id=${input.organizationId} AND lower(email)=${input.email} AND status='pending' AND expires_at>${now}) + AND NOT EXISTS (SELECT 1 FROM member JOIN user ON user.id=member.user_id WHERE member.organization_id=${input.organizationId} AND lower(user.email)=${input.email}) + AND (${input.memberLimit}=0 OR ( + (SELECT count(*) FROM member WHERE organization_id=${input.organizationId}) + + (SELECT count(*) FROM invitation WHERE organization_id=${input.organizationId} AND status='pending' AND expires_at>${now}) + ) < ${input.memberLimit}) RETURNING id`); + if (!rows.length) return null; + try { + if (input.grants.length) await this.db + .insert(s.invitationVault) + .values(input.grants.map((g) => ({ invitationId: id, vaultId: g.vaultId }))); + } catch (error) { + await this.db + .update(s.invitation) + .set({ status: "canceled" }) + .where(eq(s.invitation.id, id)); + throw error; + } + return this.invitation(id); + } + async setInvitationStatus(id: string, status: string) { + await this.db + .update(s.invitation) + .set({ status }) + .where(and(eq(s.invitation.id, id), eq(s.invitation.status, "pending"))); + } + + async acceptInvitation( + invite: InvitationRecord, + userId: string, + grants: VaultGrant[], + ) { + // Acceptance and grant creation are atomic. A conditional source prevents replay + // after cancellation, expiry or prior acceptance from restoring revoked access. + const pending = sql`exists (select 1 from invitation where id=${invite.id} and status='pending' and expires_at>${Date.now()})`; + const memberId = crypto.randomUUID(); + const results = await this.db.batch([ + this.db.insert(s.member).select( + this.db + .select({ + id: sql`${memberId}`.as("id"), + organizationId: sql`${invite.organizationId}`.as( + "organizationId", + ), + userId: sql`${userId}`.as("userId"), + role: sql`${invite.role ?? "member"}`.as("role"), + createdAt: sql`${Date.now()}`.as("createdAt"), + }) + .from(s.invitation) + .where( + and( + eq(s.invitation.id, invite.id), + pending, + sql`not exists (select 1 from member where organization_id=${invite.organizationId} and user_id=${userId})`, + ), + ), + ), + ...grants.map((g) => + this.db + .insert(s.vaultMembership) + .select( + this.db + .select({ + vaultId: sql`${g.vaultId}`.as("vaultId"), + userId: sql`${userId}`.as("userId"), + accessVersion: sql`1`.as("accessVersion"), + isCreator: sql`0`.as("isCreator"), + explicitAccess: sql`1`.as("explicitAccess"), + status: sql`'pending_key'`.as("status"), + joinedAt: sql`${Date.now()}`.as("joinedAt"), + revokedAt: sql`null`.as("revokedAt"), + }) + .from(s.invitation) + .where(and(eq(s.invitation.id, invite.id), pending)), + ) + .onConflictDoUpdate({ + target: [s.vaultMembership.vaultId, s.vaultMembership.userId], + set: { + explicitAccess: true, + status: "pending_key", + revokedAt: null, + accessVersion: sql`${s.vaultMembership.accessVersion}+1`, + }, + setWhere: eq(s.vaultMembership.status, "revoked"), + }), + ), + ...grants.map((g) => + this.db + .update(s.vault) + .set({ sharedAt: sql`coalesce(${s.vault.sharedAt}, ${Date.now()})` }) + .where(and(eq(s.vault.id, g.vaultId), pending)), + ), + this.db + .update(s.invitation) + .set({ status: "accepted" }) + .where(and(eq(s.invitation.id, invite.id), pending)) + .returning({ id: s.invitation.id }), + ]); + return (results[results.length - 1] as unknown[]).length > 0; + } + + async addGrant(vaultId: string, userId: string) { + await this.db.batch([ + this.db + .insert(s.vaultMembership) + .values({ vaultId, userId, explicitAccess: true, status: "pending_key" }) + .onConflictDoUpdate({ + target: [s.vaultMembership.vaultId, s.vaultMembership.userId], + set: { + explicitAccess: true, + status: "pending_key", + revokedAt: null, + accessVersion: sql`${s.vaultMembership.accessVersion}+1`, + }, + setWhere: eq(s.vaultMembership.status, "revoked"), + }), + this.db + .update(s.vault) + .set({ sharedAt: sql`coalesce(${s.vault.sharedAt}, ${Date.now()})` }) + .where(eq(s.vault.id, vaultId)), + ]); + } + async ensureManagerGrant(vaultId: string, userId: string) { + // Materialize only the key-enrollment state. Management is inherited from + // the organization, including for vaults created after the manager joined. + await this.db.batch([ + this.db.insert(s.vaultMembership).select(sql` + SELECT v.id, m.user_id, 1, 0, 0, 'pending_key', ${Date.now()}, NULL + FROM vault v JOIN member m ON m.organization_id=v.organization_id + WHERE v.id=${vaultId} AND v.deleted_at IS NULL AND m.user_id=${userId} AND m.role IN ('owner','admin') + `).onConflictDoUpdate({ + target: [s.vaultMembership.vaultId, s.vaultMembership.userId], + set: { explicitAccess: false, status: "pending_key", revokedAt: null, accessVersion: sql`${s.vaultMembership.accessVersion}+1` }, + setWhere: eq(s.vaultMembership.status, "revoked"), + }), + this.db.update(s.vault).set({ sharedAt: sql`coalesce(${s.vault.sharedAt},${Date.now()})` }).where(and( + eq(s.vault.id, vaultId), + sql`(SELECT count(*) FROM vault_membership WHERE vault_id=${vaultId} AND status IN ('active','pending_key'))>1`, + )), + ]); + } + async changeOrganizationRole( + organizationId: string, + userId: string, + role: string, + ) { + const update = this.db.update(s.member).set({ role }).where(and( + eq(s.member.organizationId, organizationId), eq(s.member.userId, userId), ne(s.member.role, "owner"))); + // Evaluate inherited grants inside the same transaction as demotion so a + // concurrent key-enrollment request cannot escape revocation. + const inherited = sql`(select v.id from vault v join vault_membership g on g.vault_id=v.id + join member m on m.organization_id=v.organization_id and m.user_id=g.user_id + where v.organization_id=${organizationId} and g.user_id=${userId} and g.explicit_access=0 and m.role='member')`; + await this.db.batch([update, ...(role === "member" ? this.revocationStatements(inherited, userId) : [])]); + } + + async revoke(vaultIds: string[], userId: string, organizationId?: string) { + if (!vaultIds.length) { + if (organizationId) + await this.db + .delete(s.member) + .where( + and( + eq(s.member.organizationId, organizationId), + eq(s.member.userId, userId), + ), + ); + return; + } + const statements = this.revocationStatements(vaultIds, userId, organizationId); + await this.db.batch([statements[0]!, ...statements.slice(1)]); + } + private revocationStatements(vaultIds: string[] | SQL, userId: string, organizationId?: string) { + if (Array.isArray(vaultIds) && !vaultIds.length) return []; + const now = Date.now(); + return [ + this.db + .update(s.vaultMembership) + .set({ + status: "revoked", + revokedAt: new Date(now), + accessVersion: sql`${s.vaultMembership.accessVersion}+1`, + }) + .where( + and( + inArray(s.vaultMembership.vaultId, vaultIds), + eq(s.vaultMembership.userId, userId), + ne(s.vaultMembership.status, "revoked"), + ), + ), + this.db + .update(s.vaultKeyWrapper) + .set({ revokedAt: new Date(now) }) + .where( + and( + inArray(s.vaultKeyWrapper.vaultId, vaultIds), + eq(s.vaultKeyWrapper.userId, userId), + ), + ), + this.db + .update(s.vaultKeyRequest) + .set({ status: "canceled", envelopeJson: null }) + .where( + and( + inArray(s.vaultKeyRequest.vaultId, vaultIds), + eq(s.vaultKeyRequest.userId, userId), + ), + ), + this.db.insert(s.sharingRefresh).select( + this.db.select({ vaultId: s.vault.id, revision: sql`${crypto.randomUUID()}`.as("revision"), createdAt: sql`${now}`.as("createdAt") }) + .from(s.vault).where(inArray(s.vault.id, vaultIds)), + ).onConflictDoUpdate({ target: s.sharingRefresh.vaultId, set: { revision: crypto.randomUUID(), createdAt: now } }), + ...(organizationId + ? [ + this.db + .delete(s.member) + .where( + and( + eq(s.member.organizationId, organizationId), + eq(s.member.userId, userId), + ), + ), + ] + : []), + ]; + } + async refreshes() { + return this.db.select().from(s.sharingRefresh).limit(100); + } + async finishRefresh(vaultId: string, revision: string) { + await this.db + .delete(s.sharingRefresh) + .where( + and( + eq(s.sharingRefresh.vaultId, vaultId), + eq(s.sharingRefresh.revision, revision), + ), + ); + } + async queueRefresh(vaultId: string) { + await this.db + .insert(s.sharingRefresh) + .values({ vaultId, revision: crypto.randomUUID(), createdAt: Date.now() }) + .onConflictDoUpdate({ + target: s.sharingRefresh.vaultId, + set: { revision: crypto.randomUUID(), createdAt: Date.now() }, + }); + } + async keyRequests(vaultId: string) { + return this.db + .select() + .from(s.vaultKeyRequest) + .where( + and( + eq(s.vaultKeyRequest.vaultId, vaultId), + inArray(s.vaultKeyRequest.status, ["pending", "approved"]), + gt(s.vaultKeyRequest.expiresAt, Date.now()), + ), + ) + .orderBy(asc(s.vaultKeyRequest.createdAt)); + } + async keyRequest(id: string) { + return ( + ( + await this.db + .select() + .from(s.vaultKeyRequest) + .where(eq(s.vaultKeyRequest.id, id)) + .limit(1) + )[0] ?? null + ); + } + async createKeyRequest(input: KeyRequest) { + await this.db.batch([ + this.db + .update(s.vaultKeyRequest) + .set({ status: "canceled", envelopeJson: null }) + .where( + and( + eq(s.vaultKeyRequest.vaultId, input.vaultId), + eq(s.vaultKeyRequest.userId, input.userId), + inArray(s.vaultKeyRequest.status, ["pending", "approved"]), + ), + ), + this.db.insert(s.vaultKeyRequest).values(input), + ]); + } + async approveKeyRequest( + id: string, + approvedBy: string, + envelopeJson: string, + ) { + return ( + ( + await this.db + .update(s.vaultKeyRequest) + .set({ status: "approved", approvedBy, envelopeJson }) + .where( + and( + eq(s.vaultKeyRequest.id, id), + eq(s.vaultKeyRequest.status, "pending"), + gt(s.vaultKeyRequest.expiresAt, Date.now()), + sql`exists (select 1 from vault_membership a join vault v on v.id=a.vault_id join member o on o.organization_id=v.organization_id and o.user_id=a.user_id where a.vault_id=vault_key_request.vault_id and a.user_id=${approvedBy} and a.status='active' and o.role in ('owner','admin') and v.deleted_at is null)`, + sql`exists (select 1 from vault_membership m where m.vault_id=vault_key_request.vault_id and m.user_id=vault_key_request.user_id and m.access_version=vault_key_request.access_version and m.status in ('active','pending_key'))`, + ), + ) + .returning() + ).length > 0 + ); + } + async passwordWrapper(vaultId: string, userId: string) { + return ( + ( + await this.db + .select() + .from(s.vaultKeyWrapper) + .where( + and( + eq(s.vaultKeyWrapper.vaultId, vaultId), + eq(s.vaultKeyWrapper.userId, userId), + eq(s.vaultKeyWrapper.kind, "password"), + isNull(s.vaultKeyWrapper.revokedAt), + ), + ) + .limit(1) + )[0]?.envelopeJson ?? null + ); + } + async completeKeyRequest(request: KeyRequest, envelope: PasswordEnvelope) { + const current = and( + eq(s.vaultKeyRequest.id, request.id), + eq(s.vaultKeyRequest.status, "approved"), + gt(s.vaultKeyRequest.expiresAt, Date.now()), + sql`exists (select 1 from vault_membership m join member o on o.user_id=m.user_id join vault v on v.id=m.vault_id and v.organization_id=o.organization_id where m.vault_id=${request.vaultId} and m.user_id=${request.userId} and m.access_version=${request.accessVersion} and m.status in ('active','pending_key'))`, + ); + const results = await this.db.batch([ + this.db + .insert(s.vaultKeyWrapper) + .select( + this.db + .select({ + id: sql`${crypto.randomUUID()}`.as("id"), + vaultId: sql`${request.vaultId}`.as("vaultId"), + keyVersion: sql`${envelope.keyVersion}`.as("keyVersion"), + kind: sql`'password'`.as("kind"), + userId: sql`${request.userId}`.as("userId"), + envelopeJson: + sql`${JSON.stringify(envelope)}`.as( + "envelopeJson", + ), + createdAt: sql`${Date.now()}`.as("createdAt"), + revokedAt: sql`null`.as("revokedAt"), + }) + .from(s.vaultKeyRequest) + .where(current), + ) + .onConflictDoUpdate({ + target: [ + s.vaultKeyWrapper.vaultId, + s.vaultKeyWrapper.kind, + s.vaultKeyWrapper.userId, + ], + set: { envelopeJson: envelope, revokedAt: null }, + }), + this.db + .update(s.vaultMembership) + .set({ status: "active", revokedAt: null }) + .where( + and( + eq(s.vaultMembership.vaultId, request.vaultId), + eq(s.vaultMembership.userId, request.userId), + eq(s.vaultMembership.accessVersion, request.accessVersion), + exists( + this.db + .select({ id: s.vaultKeyRequest.id }) + .from(s.vaultKeyRequest) + .where(current), + ), + ), + ), + this.db + .update(s.vaultKeyRequest) + .set({ status: "completed", envelopeJson: null }) + .where(current) + .returning({ id: s.vaultKeyRequest.id }), + ]); + return (results[2] as unknown[]).length > 0; + } +} diff --git a/apps/api/src/sharing/adapters/routes.ts b/apps/api/src/sharing/adapters/routes.ts new file mode 100644 index 00000000..803152dd --- /dev/null +++ b/apps/api/src/sharing/adapters/routes.ts @@ -0,0 +1,294 @@ +import { Hono } from "hono"; +import { zValidator } from "@hono/zod-validator"; +import { z } from "zod"; +import type { SessionReader } from "../../auth/session"; +import { createEnsureAuthenticatedSession } from "../../platform/http/authenticated-session"; +import { vaultKeyEnvelopeSchema } from "../../vault/application/dto/vault-key-envelope"; +import type { SharingService } from "../application/service"; +import { SharingError } from "../application/types"; + +const id = z.string().uuid(); +const role = z.enum(["admin", "member"]); +const envelope = z + .object({ + version: z.literal(1), + algorithm: z.literal("rsa-oaep-sha256"), + ciphertext: z.string().regex(/^[A-Za-z0-9+/]{512}$/), + }) + .strict(); + +export function registerSharingRoutes( + app: Hono, + deps: { + sharing: SharingService; + sessionReader: SessionReader; + trustedOrigins: string[]; + }, +) { + const signedIn = createEnsureAuthenticatedSession(deps.sessionReader); + const sharingPath = (path: string) => + /^\/v1\/(organizations|invitations)(\/|$)/.test(path) || + /^\/v1\/vaults\/[^/]+\/(grants|members|key-requests)(\/|$)/.test(path); + const api = new Hono<{ + Variables: { user: import("../../auth/session").AuthenticatedUser }; + }>(); + api.use("*", async (c, next) => { + if (sharingPath(c.req.path)) return signedIn(c, next); + await next(); + }); + api.use("*", async (c, next) => { + const writesUserData = + sharingPath(c.req.path) || + /^\/v1\/(vaults(?:\/[^/]+(?:\/password-wrapper)?)?|billing(?:\/[^/]+)?)$/.test( + c.req.path, + ); + if ( + writesUserData && + !["GET", "HEAD", "OPTIONS"].includes(c.req.method) && + !c.req.header("authorization")?.startsWith("Bearer ") + ) { + const origin = c.req.header("origin"); + if (!origin || !deps.trustedOrigins.includes(origin)) + throw new SharingError( + 403, + "invalid_origin", + "Request origin is not trusted", + ); + } + await next(); + }); + const service = deps.sharing; + api.get("/organizations", async (c) => + c.json({ organizations: await service.listOrganizations(c.var.user.id) }), + ); + api.get("/organizations/:orgId", async (c) => + c.json(await service.organization(c.var.user.id, c.req.param("orgId"))), + ); + api.patch( + "/organizations/:orgId", + zValidator( + "json", + z.object({ name: z.string().trim().min(1).max(100) }).strict(), + ), + async (c) => { + await service.rename( + c.var.user.id, + c.req.param("orgId"), + c.req.valid("json").name, + ); + return c.json({ ok: true }); + }, + ); + api.get("/organizations/:orgId/members", async (c) => + c.json({ + members: (await service.organization(c.var.user.id, c.req.param("orgId"))) + .members, + }), + ); + api.post( + "/organizations/:orgId/invitations", + zValidator( + "json", + z + .object({ + email: z.string().email(), + role: role.default("member"), + vaults: z + .array(z.object({ vaultId: id }).strict()) + .max(100).default([]), + }) + .strict(), + ), + async (c) => + c.json( + await service.invite( + c.var.user, + c.req.param("orgId"), + c.req.valid("json"), + ), + 201, + ), + ); + api.get("/organizations/:orgId/invitations", async (c) => + c.json({ + invitations: ( + await service.organization(c.var.user.id, c.req.param("orgId")) + ).invitations, + }), + ); + api.post("/organizations/:orgId/invitations/:id/resend", async (c) => + c.json( + await service.resend( + c.var.user.id, + c.req.param("orgId"), + c.req.param("id"), + ), + ), + ); + api.post("/organizations/:orgId/invitations/:id/cancel", async (c) => { + await service.cancel( + c.var.user.id, + c.req.param("orgId"), + c.req.param("id"), + ); + return c.json({ ok: true }); + }); + api.get("/invitations/:id", async (c) => + c.json(await service.invitation(c.var.user, c.req.param("id"))), + ); + api.post("/invitations/:id/accept", async (c) => + c.json(await service.respond(c.var.user, c.req.param("id"), true)), + ); + api.post("/invitations/:id/reject", async (c) => + c.json(await service.respond(c.var.user, c.req.param("id"), false)), + ); + api.patch( + "/organizations/:orgId/members/:userId", + zValidator("json", z.object({ role }).strict()), + async (c) => + c.json( + await service.changeMember( + c.var.user.id, + c.req.param("orgId"), + c.req.param("userId"), + c.req.valid("json").role, + ), + ), + ); + api.delete("/organizations/:orgId/members/:userId", async (c) => + c.json( + await service.changeMember( + c.var.user.id, + c.req.param("orgId"), + c.req.param("userId"), + ), + ), + ); + api.post("/vaults/:vaultId/members", (c) => + c.json( + { + error: "use_vault_grants", + message: "Use vault grants and key requests to share a vault", + }, + 410, + ), + ); + api.post( + "/vaults/:vaultId/grants", + zValidator("json", z.object({ userId: z.string().min(1) }).strict()), + async (c) => + c.json( + await service.changeVaultMember( + c.var.user.id, + c.req.param("vaultId"), + c.req.valid("json").userId, + true, + ), + ), + ); + api.delete("/vaults/:vaultId/members/:userId", async (c) => + c.json( + await service.changeVaultMember( + c.var.user.id, + c.req.param("vaultId"), + c.req.param("userId"), + ), + ), + ); + api.get("/vaults/:vaultId/key-requests", async (c) => + c.json({ + requests: await service.listKeyRequests( + c.var.user.id, + c.req.param("vaultId"), + ), + }), + ); + api.get("/vaults/:vaultId/key-requests/:id", async (c) => + c.json( + await service.getKeyRequest( + c.var.user.id, + c.req.param("vaultId"), + c.req.param("id"), + ), + ), + ); + api.post( + "/vaults/:vaultId/key-requests", + zValidator( + "json", + z + .object({ + id, + publicKey: z + .string() + .min(400) + .max(1024) + .regex(/^[A-Za-z0-9+/]+={0,2}$/), + }) + .strict(), + ), + async (c) => { + const input = c.req.valid("json"); + try { + const key = await crypto.subtle.importKey( + "spki", + Uint8Array.from(atob(input.publicKey), (v) => v.charCodeAt(0)), + { name: "RSA-OAEP", hash: "SHA-256" }, + false, + ["encrypt"], + ); + const params = key.algorithm as unknown as { + modulusLength: number; + publicExponent: Uint8Array; + }; + if ( + params.modulusLength !== 3072 || + Array.from(params.publicExponent).join(",") !== "1,0,1" + ) + throw new Error("Invalid key"); + } catch { + throw new SharingError( + 400, + "invalid_receiver_key", + "Invalid receiver key", + ); + } + return c.json( + await service.startKeyRequest( + c.var.user.id, + c.req.param("vaultId"), + input.id, + input.publicKey, + ), + 201, + ); + }, + ); + api.post( + "/vaults/:vaultId/key-requests/:id/approve", + zValidator("json", z.object({ envelope }).strict()), + async (c) => { + await service.approveKeyRequest( + c.var.user.id, + c.req.param("vaultId"), + c.req.param("id"), + c.req.valid("json").envelope, + ); + return c.json({ ok: true }); + }, + ); + api.post( + "/vaults/:vaultId/key-requests/:id/complete", + zValidator("json", z.object({ envelope: vaultKeyEnvelopeSchema }).strict()), + async (c) => { + await service.completeKeyRequest( + c.var.user.id, + c.req.param("vaultId"), + c.req.param("id"), + c.req.valid("json").envelope, + ); + return c.json({ ok: true }); + }, + ); + app.route("/v1", api); +} diff --git a/apps/api/src/sharing/application/access.ts b/apps/api/src/sharing/application/access.ts new file mode 100644 index 00000000..864296e9 --- /dev/null +++ b/apps/api/src/sharing/application/access.ts @@ -0,0 +1,44 @@ +import type { SubscriptionPolicyReader } from "../../subscription/application"; +import { organizationSharingPolicy } from "../../subscription/domain/policy"; +import type { SharingStore } from "./store"; +import { SharingError } from "./types"; + +/** Authoritative D1 checks used when issuing a sync token. */ +export class SharingAccess { + constructor( + private readonly store: SharingStore, + private readonly policy: SubscriptionPolicyReader, + ) {} + async isSuspended(vaultId: string): Promise { + const vault = await this.store.vault(vaultId); + if (!vault?.sharedAt) return false; + return !organizationSharingPolicy( + (await this.policy.readOrganizationPolicy(vault.organizationId)).id, + ).enabled; + } + async require( + userId: string, + vaultId: string, + ): Promise { + const vault = await this.store.vault(vaultId); + const grant = await this.store.grant(vaultId, userId); + if ( + !vault || + !grant || + grant.status !== "active" || + !(await this.store.membership(vault.organizationId, userId)) + ) + throw new SharingError( + 403, + "vault_access_denied", + "Vault access has been removed or is awaiting key setup", + ); + if (vault.sharedAt && (await this.isSuspended(vaultId))) + throw new SharingError( + 403, + "sharing_suspended", + "Shared vault sync is paused until the organization renews Sync Plus", + ); + return grant.accessVersion; + } +} diff --git a/apps/api/src/sharing/application/refresh.ts b/apps/api/src/sharing/application/refresh.ts new file mode 100644 index 00000000..605d2033 --- /dev/null +++ b/apps/api/src/sharing/application/refresh.ts @@ -0,0 +1,24 @@ +import type { SharingStore } from "./store"; + +export interface SharingInvalidator { + refreshSharingAccess(vaultId: string): Promise; +} + +/** Failed work stays durable until a later request or scheduled retry succeeds. */ +export async function flushSharingRefreshes( + store: Pick, + invalidator: SharingInvalidator, +): Promise { + let complete = true; + for (const task of await store.refreshes()) { + try { + await invalidator.refreshSharingAccess(task.vaultId); + // A newer change queued during the refresh must survive this completion. + await store.finishRefresh(task.vaultId, task.revision); + } catch (error) { + complete = false; + console.error("sharing refresh retry pending", { vaultId: task.vaultId, error }); + } + } + return complete; +} diff --git a/apps/api/src/sharing/application/service.ts b/apps/api/src/sharing/application/service.ts new file mode 100644 index 00000000..c835ee66 --- /dev/null +++ b/apps/api/src/sharing/application/service.ts @@ -0,0 +1,532 @@ +import type { EmailSender } from "../../auth/better-auth"; +import type { SubscriptionPolicyReader } from "../../subscription/application"; +import { organizationSharingPolicy } from "../../subscription/domain/policy"; +import type { SharingStore } from "./store"; +import { flushSharingRefreshes, type SharingInvalidator } from "./refresh"; +export type { SharingInvalidator } from "./refresh"; +import { + SharingError, + type SharingActor, + type VaultGrant, + type TransferEnvelope, + type PasswordEnvelope, + type KeyRequest, +} from "./types"; + +export type SharingConfig = { + baseURL: string; + billingBaseURL?: string; + requireVerifiedEmail: boolean; + email?: EmailSender; + emailFrom?: string; + allowedEmails?: string; +}; + +export class SharingService { + constructor( + private readonly store: SharingStore, + private readonly policy: SubscriptionPolicyReader, + private readonly invalidator: SharingInvalidator, + private readonly config: SharingConfig, + ) {} + + async listOrganizations(userId: string) { + return Promise.all( + (await this.store.organizations(userId)).map(async (org) => ({ + ...org, + plan: await this.policy.readOrganizationPolicy(org.id), + })), + ); + } + async requireOrganization( + userId: string, + organizationId: string, + manage = false, + ) { + const member = await this.store.membership(organizationId, userId); + if (!member || (manage && !isManager(member.role))) forbidden(); + return member!; + } + async requireVault( + userId: string, + vaultId: string, + manage = false, + pending = false, + ) { + const vault = await this.store.vault(vaultId); + if (!vault) throw new SharingError(404, "not_found", "Vault not found"); + const member = await this.requireOrganization(userId, vault.organizationId, manage); + const storedGrant = await this.store.grant(vaultId, userId); + const grant = isManager(member.role) && (!storedGrant || storedGrant.status === "revoked") + ? { userId, isCreator: storedGrant?.isCreator ?? false, explicitAccess: false, status: "pending_key", accessVersion: storedGrant?.accessVersion ?? 0 } + : storedGrant; + if ( + !grant || + !( + grant.status === "active" || + (pending && grant.status === "pending_key") + ) + ) + forbidden(); + return { vault, grant: grant!, member }; + } + private async requireVaultManagement(userId: string, vaultId: string) { + const vault = await this.store.vault(vaultId); + if (!vault) throw new SharingError(404, "not_found", "Vault not found"); + await this.requireOrganization(userId, vault.organizationId, true); + return vault; + } + async requireSharing(organizationId: string) { + const plan = await this.policy.readOrganizationPolicy(organizationId); + const sharing = organizationSharingPolicy(plan.id); + if (!sharing.enabled) + throw new SharingError( + 403, + "sharing_unavailable", + "Organization sharing requires Sync Plus", + ); + return sharing; + } + async organization(userId: string, organizationId: string) { + const actor = await this.requireOrganization(userId, organizationId); + const [organization, plan, members, vaults] = await Promise.all([ + this.store.organization(organizationId), + this.policy.readOrganizationPolicy(organizationId), + this.store.members(organizationId), + this.store.vaults(organizationId), + ]); + const manage = isManager(actor.role); + const visibleVaults = []; + for (const vault of vaults) { + const grant = await this.store.grant(vault.id, userId); + if (!manage && (!grant || grant.status === "revoked")) continue; + const status = manage && (!grant || grant.status === "revoked") ? "pending_key" : grant?.status ?? null; + const grants = manage ? await this.store.grants(vault.id) : []; + visibleVaults.push({ + id: vault.id, + name: vault.name, + shared: vault.sharedAt !== null, + personal: grant?.isCreator === true, + canManage: manage, + status, + members: manage ? members.flatMap((member) => { + const grant = grants.find((grant) => grant.userId === member.id); + if (!isManager(member.role) && !grant) return []; + return [{ userId: member.id, name: member.name, email: member.email, + canManage: isManager(member.role), + status: isManager(member.role) && (!grant || grant.status === "revoked") ? "pending_key" : grant!.status }]; + }) : [], + }); + } + await this.flushRefreshes(); + return { + id: organizationId, + billingUrl: this.config.billingBaseURL + ? new URL( + `/billing?organizationId=${encodeURIComponent(organizationId)}`, + this.config.billingBaseURL, + ).toString() + : null, + name: organization!.name, + role: actor.role, + plan, + sharing: organizationSharingPolicy(plan.id), + members: manage ? members : members.filter((m) => m.id === userId), + vaults: visibleVaults, + invitations: manage ? await this.store.invitations(organizationId) : [], + }; + } + async rename(userId: string, organizationId: string, name: string) { + await this.requireOrganization(userId, organizationId, true); + await this.store.rename(organizationId, name); + } + + async invite( + actor: SharingActor, + organizationId: string, + input: { email: string; role: "admin" | "member"; vaults: VaultGrant[] }, + ) { + const inviter = await this.requireOrganization( + actor.id, + organizationId, + true, + ); + if (input.role === "admin" && inviter.role !== "owner") forbidden(); + const policy = await this.requireSharing(organizationId); + const email = input.email.trim().toLowerCase(); + const allowed = this.config.allowedEmails + ?.split(",") + .map((v) => v.trim().toLowerCase()) + .filter(Boolean); + if (allowed?.length && !allowed.includes(email)) + throw new SharingError( + 400, + "email_not_allowed", + "This server's account allowlist does not include that email", + ); + if ( + (input.role === "member" && !input.vaults.length) || + new Set(input.vaults.map((v) => v.vaultId)).size !== input.vaults.length + ) + throw new SharingError(400, "invalid_vaults", "Select each vault once"); + for (const item of input.vaults) { + const vault = await this.requireVaultManagement(actor.id, item.vaultId); + if (vault.organizationId !== organizationId) forbidden(); + } + const invitation = await this.store.createInvitation({ + organizationId, + email, + role: input.role, + inviterId: actor.id, + grants: input.role === "admin" ? [] : input.vaults, + memberLimit: policy.memberLimit, + }); + if (!invitation) + throw new SharingError( + 409, + "invitation_conflict", + "Member limit reached, or this person is already a member or invited", + ); + await this.store.audit(organizationId, actor.id, "invited", invitation.id); + return this.deliverInvitation(invitation.id, invitation.email); + } + private async deliverInvitation(id: string, email: string) { + const url = new URL("/invitations", this.config.baseURL); + url.searchParams.set("invitationId", id); + let emailSent = false; + if (this.config.email && this.config.emailFrom) { + const invite = await this.store.invitation(id); + if (!invite || !(await this.store.claimInvitationDelivery(invite))) + throw new SharingError( + 429, + "delivery_rate_limited", + "Wait a minute before resending this invitation", + ); + try { + await this.config.email.send({ + from: this.config.emailFrom, + to: email, + subject: "Invitation to a Synch organization", + text: `Sign in with this email address to review your Synch invitation:\n\n${url}\n\nYour vault password and encryption keys are never included in invitations.`, + }); + emailSent = true; + } catch { + /* The durable invitation remains visible and can be resent. */ + } + } + return { id, url: url.toString(), emailSent }; + } + async resend(userId: string, organizationId: string, id: string) { + await this.requireOrganization(userId, organizationId, true); + await this.requireSharing(organizationId); + const invite = await this.store.invitation(id); + if ( + !invite || + invite.organizationId !== organizationId || + invite.status !== "pending" || + invite.expiresAt.getTime() <= Date.now() + ) + throw new SharingError( + 409, + "invitation_unavailable", + "Create a new invitation for expired or canceled invitations", + ); + const last = await this.store.invitationGrants(id); + if (invite.role !== "admin" && !last.length) + throw new SharingError( + 409, + "invitation_incomplete", + "Cancel this invitation and create it again", + ); + return this.deliverInvitation(id, invite.email); + } + async cancel(userId: string, organizationId: string, id: string) { + await this.requireOrganization(userId, organizationId, true); + const invite = await this.store.invitation(id); + if (!invite || invite.organizationId !== organizationId) forbidden(); + await this.store.setInvitationStatus(id, "canceled"); + await this.store.audit(organizationId, userId, "invitation_canceled", id); + } + private async recipient(actor: SharingActor, id: string) { + const invite = await this.store.invitation(id); + const user = await this.store.user(actor.id); + if (!invite || invite.email.toLowerCase() !== actor.email.toLowerCase()) + forbidden(); + if (this.config.requireVerifiedEmail && !user?.emailVerified) + throw new SharingError( + 403, + "verify_email", + "Verify your email before opening an invitation", + ); + return invite!; + } + async invitation(actor: SharingActor, id: string) { + const invite = await this.recipient(actor, id); + const org = await this.store.organization(invite.organizationId); + return { + id, + organizationId: invite.organizationId, + organizationName: org?.name, + role: invite.role, + status: + invite.expiresAt.getTime() <= Date.now() && invite.status === "pending" + ? "expired" + : invite.status, + vaults: invite.role === "admin" + ? (await this.store.vaults(invite.organizationId)).map((vault) => ({ vaultId: vault.id, name: vault.name })) + : await this.store.invitationGrants(id), + }; + } + async respond(actor: SharingActor, id: string, accept: boolean) { + const invite = await this.recipient(actor, id); + if (invite.status === "accepted") + return { organizationId: invite.organizationId }; + if (invite.status !== "pending" || invite.expiresAt.getTime() <= Date.now()) + throw new SharingError( + 409, + "invitation_unavailable", + "Invitation expired or canceled", + ); + if (!accept) { + await this.store.setInvitationStatus(id, "rejected"); + return { organizationId: invite.organizationId }; + } + await this.requireSharing(invite.organizationId); + const inviter = await this.requireOrganization( + invite.inviterId, + invite.organizationId, + true, + ); + if (invite.role === "admin" && inviter.role !== "owner") forbidden(); + const grants = invite.role === "admin" ? [] : await this.store.invitationGrants(id); + if (invite.role !== "admin" && !grants.length) + throw new SharingError( + 409, + "invitation_incomplete", + "The invitation has no vault assignments", + ); + for (const grant of grants) { + const vault = await this.requireVaultManagement(invite.inviterId, grant.vaultId); + if (vault.organizationId !== invite.organizationId) forbidden(); + } + if ( + !(await this.store.acceptInvitation( + invite, + actor.id, + grants as VaultGrant[], + )) + ) + throw new SharingError( + 409, + "invitation_changed", + "Invitation changed; refresh and try again", + ); + for (const grant of grants) await this.refresh(grant.vaultId); + await this.store.audit( + invite.organizationId, + actor.id, + "invitation_accepted", + id, + ); + return { organizationId: invite.organizationId }; + } + async changeMember( + userId: string, + organizationId: string, + targetId: string, + role?: "admin" | "member", + ) { + const actor = await this.requireOrganization(userId, organizationId); + const target = await this.store.membership(organizationId, targetId); + if (!target) { + if (!role) return { pending: !(await this.flushRefreshes()) }; + forbidden(); + } + if (target!.role === "owner") + throw new SharingError( + 409, + "owner_protected", + "The organization owner cannot be removed or demoted here", + ); + if (role) { + if (actor.role !== "owner") forbidden(); + await this.store.changeOrganizationRole(organizationId, targetId, role); + } else { + if ( + userId !== targetId && + (!isManager(actor.role) || + (target!.role === "admin" && actor.role !== "owner")) + ) + forbidden(); + const vaults = await this.store.vaults(organizationId); + await this.store.revoke( + vaults.map((v) => v.id), + targetId, + organizationId, + ); + } + await this.store.audit( + organizationId, + userId, + role ? "member_role_changed" : "member_removed", + targetId, + ); + return { pending: !(await this.flushRefreshes()) }; + } + async changeVaultMember(userId: string, vaultId: string, targetId: string, add = false) { + const vault = await this.requireVaultManagement(userId, vaultId); + const target = await this.requireOrganization(targetId, vault.organizationId); + // Managers inherit access to every vault; individual grants cannot override it. + if (isManager(target.role)) forbidden(); + if (add) { + await this.requireSharing(vault.organizationId); + await this.store.addGrant(vaultId, targetId); + await this.store.queueRefresh(vaultId); + } else await this.store.revoke([vaultId], targetId); + await this.store.audit(vault.organizationId, userId, add ? "vault_grant_added" : "vault_grant_revoked", targetId); + return { pending: !(await this.flushRefreshes()) }; + } + async listKeyRequests(userId: string, vaultId: string) { + const { grant, member } = await this.requireVault(userId, vaultId, false, true); + return (await this.store.keyRequests(vaultId)).filter( + (r) => + r.userId === userId || + (grant.status === "active" && isManager(member.role)), + ); + } + async getKeyRequest(userId: string, vaultId: string, id: string) { + const { grant, member } = await this.requireVault(userId, vaultId, false, true); + const request = await this.store.keyRequest(id); + if ( + !request || + request.vaultId !== vaultId || + (request.userId !== userId && (grant.status !== "active" || !isManager(member.role))) + ) + forbidden(); + return request!; + } + async startKeyRequest( + userId: string, + vaultId: string, + id: string, + publicKey: string, + ) { + const { vault } = await this.requireVault(userId, vaultId, false, true); + await this.requireSharing(vault.organizationId); + await this.store.ensureManagerGrant(vaultId, userId); + const { grant } = await this.requireVault(userId, vaultId, false, true); + const existing = await this.store.keyRequest(id); + if (existing) { + if ( + existing.userId !== userId || + existing.vaultId !== vaultId || + existing.publicKey !== publicKey + ) + forbidden(); + return existing; + } + const request: KeyRequest = { + id, + vaultId, + userId, + accessVersion: grant.accessVersion, + publicKey, + purpose: grant.status === "pending_key" ? "enrollment" : "recovery", + status: "pending", + envelopeJson: null, + approvedBy: null, + createdAt: Date.now(), + expiresAt: Date.now() + 48 * 60 * 60 * 1000, + }; + await this.store.createKeyRequest(request); + await this.store.audit(vault.organizationId, userId, "key_requested", id); + return request; + } + async approveKeyRequest( + userId: string, + vaultId: string, + id: string, + envelope: TransferEnvelope, + ) { + const { vault } = await this.requireVault(userId, vaultId, true); + await this.requireSharing(vault.organizationId); + const request = await this.store.keyRequest(id); + if (!request || request.vaultId !== vaultId || request.userId === userId) + forbidden(); + await this.requireVault(request!.userId, vaultId, false, true); + if ( + !(await this.store.approveKeyRequest( + id, + userId, + JSON.stringify(envelope), + )) + ) + throw new SharingError( + 409, + "request_changed", + "Key request changed or expired", + ); + await this.store.audit(vault.organizationId, userId, "key_approved", id); + } + async completeKeyRequest( + userId: string, + vaultId: string, + id: string, + envelope: PasswordEnvelope, + ) { + const { vault } = await this.requireVault(userId, vaultId, false, true); + await this.requireSharing(vault.organizationId); + const request = await this.store.keyRequest(id); + if (!request || request.userId !== userId || request.vaultId !== vaultId) + forbidden(); + if (request!.status === "completed") { + if ( + JSON.stringify(await this.store.passwordWrapper(vaultId, userId)) !== + JSON.stringify(envelope) + ) + throw new SharingError( + 409, + "password_changed", + "Your vault password has changed since this request completed", + ); + return; + } + if ( + envelope.version !== 2 || + envelope.binding?.vaultId !== vaultId || + envelope.binding?.userId !== userId || + envelope.keyVersion !== vault.activeKeyVersion + ) + throw new SharingError( + 400, + "invalid_wrapper", + "Password wrapper does not match this vault and user", + ); + if (!(await this.store.completeKeyRequest(request!, envelope))) + throw new SharingError( + 409, + "request_changed", + "Key request changed or expired", + ); + await this.refresh(vaultId); + await this.store.audit(vault.organizationId, userId, "key_received", id); + } + async refresh(vaultId: string) { + await this.store.queueRefresh(vaultId); + await this.flushRefreshes(); + } + async flushRefreshes(): Promise { + await this.store.pruneExpiredRequests(); + return flushSharingRefreshes(this.store, this.invalidator); + } +} +function isManager(role: string | null | undefined) { + return role === "owner" || role === "admin"; +} +function forbidden(): never { + throw new SharingError( + 403, + "forbidden", + "You do not have permission for this operation", + ); +} diff --git a/apps/api/src/sharing/application/store.ts b/apps/api/src/sharing/application/store.ts new file mode 100644 index 00000000..6bb8f8e5 --- /dev/null +++ b/apps/api/src/sharing/application/store.ts @@ -0,0 +1,132 @@ +import type { VaultGrant, KeyRequest, PasswordEnvelope } from "./types"; + +export type SharingVault = { + id: string; + organizationId: string; + name: string; + activeKeyVersion: number; + sharedAt: Date | null; +}; +export type SharingMembership = { + userId: string; + isCreator: boolean; + explicitAccess: boolean; + status: string; + accessVersion: number; +}; +export type OrganizationMembership = { + organizationId: string; + userId: string; + role: string; +}; +export type OrganizationMember = { + id: string; + name: string; + email: string; + role: string; +}; +export type InvitationRecord = { + id: string; + organizationId: string; + email: string; + role: string | null; + status: string; + expiresAt: Date; + createdAt: Date; + inviterId: string; +}; +export type RefreshTask = { + vaultId: string; + revision: string; + createdAt: number; +}; +export type CreateInvitation = { + organizationId: string; + email: string; + role: string; + inviterId: string; + grants: VaultGrant[]; + memberLimit: number; +}; + +/** Persistence contract; domain and application code do not depend on Drizzle. */ +export interface SharingStore { + organizations( + userId: string, + ): Promise<{ id: string; name: string; role: string }[]>; + membership( + organizationId: string, + userId: string, + ): Promise; + user(userId: string): Promise<{ id: string; emailVerified: boolean } | null>; + members(organizationId: string): Promise; + organization( + organizationId: string, + ): Promise<{ id: string; name: string } | null>; + rename(organizationId: string, name: string): Promise; + vault(vaultId: string): Promise; + vaults(organizationId: string): Promise; + grant(vaultId: string, userId: string): Promise; + grants( + vaultId: string, + ): Promise< + { + userId: string; + status: string; + name: string; + email: string; + }[] + >; + invitations(organizationId: string): Promise; + invitation(id: string): Promise; + invitationGrants( + id: string, + ): Promise<{ vaultId: string; name: string }[]>; + createInvitation(input: CreateInvitation): Promise; + setInvitationStatus(id: string, status: string): Promise; + acceptInvitation( + invite: InvitationRecord, + userId: string, + grants: VaultGrant[], + ): Promise; + addGrant(vaultId: string, userId: string): Promise; + ensureManagerGrant(vaultId: string, userId: string): Promise; + changeOrganizationRole( + organizationId: string, + userId: string, + role: string, + ): Promise; + revoke( + vaultIds: string[], + userId: string, + organizationId?: string, + ): Promise; + keyRequests(vaultId: string): Promise; + keyRequest(id: string): Promise; + createKeyRequest(request: KeyRequest): Promise; + approveKeyRequest( + id: string, + approvedBy: string, + envelopeJson: string, + ): Promise; + passwordWrapper( + vaultId: string, + userId: string, + ): Promise; + completeKeyRequest( + request: KeyRequest, + envelope: PasswordEnvelope, + ): Promise; + audit( + organizationId: string, + actorId: string, + action: string, + targetId: string, + ): Promise; + claimInvitationDelivery(invite: InvitationRecord): Promise; + pruneExpiredRequests(): Promise; + refreshes(): Promise; + accessVersions(vaultId: string): Promise<{ userId: string; accessVersion: number }[]>; + queueRefresh(vaultId: string): Promise; + finishRefresh(vaultId: string, revision: string): Promise; +} diff --git a/apps/api/src/sharing/application/types.ts b/apps/api/src/sharing/application/types.ts new file mode 100644 index 00000000..fbaee719 --- /dev/null +++ b/apps/api/src/sharing/application/types.ts @@ -0,0 +1,33 @@ +import type { VaultKeyEnvelope } from "../../vault/domain/types"; + +export type OrganizationRole = "owner" | "admin" | "member"; +export type VaultGrant = { vaultId: string }; +export type TransferEnvelope = { + version: 1; + algorithm: "rsa-oaep-sha256"; + ciphertext: string; +}; +export type KeyRequest = { + id: string; + vaultId: string; + userId: string; + purpose: string; + accessVersion: number; + publicKey: string; + status: string; + envelopeJson: string | null; + approvedBy: string | null; + createdAt: number; + expiresAt: number; +}; +export class SharingError extends Error { + constructor( + readonly status: 400 | 403 | 404 | 409 | 429 | 503, + readonly code: string, + message: string, + ) { + super(message); + } +} +export type SharingActor = { id: string; email: string }; +export type PasswordEnvelope = VaultKeyEnvelope; diff --git a/apps/api/src/sharing/migration.test.ts b/apps/api/src/sharing/migration.test.ts new file mode 100644 index 00000000..89773515 --- /dev/null +++ b/apps/api/src/sharing/migration.test.ts @@ -0,0 +1,65 @@ +import { readMigrationFiles } from "drizzle-orm/migrator"; +import { createClient } from "@libsql/client"; +import { fileURLToPath } from "node:url"; +import { expect, it } from "vitest"; + +it("preserves legacy passwords when migrating existing shared vaults", async () => { + const client = createClient({ url: ":memory:" }); + try { + const migrations = readMigrationFiles({ + migrationsFolder: fileURLToPath( + new URL("../../drizzle", import.meta.url).href, + ), + }); + for (const migration of migrations.slice(0, -1)) + for (const sql of migration.sql) await client.execute(sql); + for (const id of ["owner", "member", "removed"]) { + await client.execute({ + sql: "INSERT INTO user(id,name,email,email_verified,created_at,updated_at) VALUES (?,?,?,1,1,1)", + args: [id, id, id + "@example.com"], + }); + } + await client.execute( + "INSERT INTO organization(id,name,slug,created_at) VALUES ('org','Org','org',1)", + ); + await client.execute( + "INSERT INTO vault(id,organization_id,name,active_key_version,created_at) VALUES ('vault','org','Vault',1,1)", + ); + for (const id of ["owner", "member", "removed"]) { + await client.execute({ + sql: "INSERT INTO member(id,organization_id,user_id,role,created_at) VALUES (?,'org',?,'member',1)", + args: [id, id], + }); + await client.execute({ + sql: "INSERT INTO vault_membership(vault_id,user_id,role,status,joined_at) VALUES ('vault',?,'member',?,1)", + args: [id, id === "removed" ? "revoked" : "active"], + }); + } + await client.execute("UPDATE vault_membership SET role='owner' WHERE user_id='owner'"); + await client.execute( + "INSERT INTO vault_key_wrapper(id,vault_id,key_version,kind,user_id,envelope_json,created_at) VALUES ('common','vault',1,'password',NULL,'existing ciphertext',1)", + ); + for (const sql of migrations.at(-1)!.sql) await client.execute(sql); + expect((await client.execute("PRAGMA table_info(vault_membership)")).rows.map((row) => row.name)).not.toContain("role"); + expect((await client.execute("SELECT user_id,is_creator,explicit_access FROM vault_membership ORDER BY user_id")).rows.map((row) => [row.user_id, row.is_creator, row.explicit_access])).toEqual([ + ["member", 0, 1], ["owner", 1, 1], ["removed", 0, 1], + ]); + const rows = await client.execute( + "SELECT user_id,envelope_json FROM vault_key_wrapper WHERE user_id IS NOT NULL ORDER BY user_id", + ); + expect(rows.rows.map((row) => [row.user_id, row.envelope_json])).toEqual([ + ["member", "existing ciphertext"], + ["owner", "existing ciphertext"], + ]); + expect( + (await client.execute("SELECT shared_at FROM vault")).rows[0].shared_at, + ).toBe(1); + expect( + ( + await client.execute("SELECT access_version FROM vault_membership") + ).rows.map((row) => row.access_version), + ).toEqual([1, 1, 1]); + } finally { + client.close(); + } +}); diff --git a/apps/api/src/sharing/sharing.test.ts b/apps/api/src/sharing/sharing.test.ts new file mode 100644 index 00000000..0c19e574 --- /dev/null +++ b/apps/api/src/sharing/sharing.test.ts @@ -0,0 +1,488 @@ +import { DrizzleVaultStore } from "../vault/adapters/outbound/drizzle-vault-store"; +import { afterEach, describe, expect, it } from "vitest"; +import { createClient, type Client } from "@libsql/client"; +import { drizzle } from "drizzle-orm/libsql"; +import { migrate } from "drizzle-orm/libsql/migrator"; +import { fileURLToPath } from "node:url"; +import { eq } from "drizzle-orm"; +import { createLibsqlDb } from "../db/client"; +import * as s from "../db/d1"; +import { DrizzleSharingStore } from "./adapters/drizzle-sharing-store"; +import { SharingService } from "./application/service"; +import { SharingAccess } from "./application/access"; +import { getSubscriptionPlanPolicy } from "../subscription/domain/policy"; + +const clients: Client[] = []; +afterEach(() => { + clients.splice(0).forEach((c) => c.close()); +}); +async function setup() { + const client = createClient({ url: ":memory:" }); + clients.push(client); + await migrate(drizzle(client), { + migrationsFolder: fileURLToPath( + new URL("../../drizzle", import.meta.url).href, + ), + }); + const db = createLibsqlDb(client); + const store = new DrizzleSharingStore(db); + for (const id of ["owner", "alice", "bob", "carol"]) + await db.insert(s.user).values({ + id, + name: id, + email: `${id}@example.com`, + emailVerified: true, + }); + await db + .insert(s.organization) + .values({ id: "org", name: "Team", slug: "team", createdAt: new Date() }); + await db.insert(s.member).values({ + id: "owner-membership", + userId: "owner", + organizationId: "org", + role: "owner", + createdAt: new Date(), + }); + for (const id of ["vault-a", "vault-b"]) { + await db + .insert(s.vault) + .values({ id, organizationId: "org", name: id, activeKeyVersion: 1 }); + await db.insert(s.vaultMembership).values({ + vaultId: id, + userId: "owner", + isCreator: true, + status: "active", + }); + } + let plan: "plus" | "free" = "plus"; + const policy = { + readOrganizationPolicy: async () => getSubscriptionPlanPolicy(plan), + }; + const service = new SharingService( + store, + policy, + { refreshSharingAccess: async () => {} }, + { baseURL: "https://example.com", requireVerifiedEmail: true }, + ); + return { + db, + store, + service, + access: new SharingAccess(store, policy), + setPlan: (p: typeof plan) => { + plan = p; + }, + }; +} +const actor = (id: string) => ({ id, email: `${id}@example.com` }); +const grants = [{ vaultId: "vault-a" }]; +const wrapper = (userId: string) => ({ + version: 2, + keyVersion: 1, + binding: { vaultId: "vault-a", userId }, + kdf: { + name: "argon2id", + memoryKiB: 65536, + iterations: 3, + parallelism: 1, + salt: "MDEyMzQ1Njc4OWFiY2RlZg==", + }, + wrap: { + algorithm: "aes-256-gcm", + nonce: "AAECAwQFBgcICQoL", + ciphertext: "test", + }, +}); + +describe("organization vault sharing", () => { + it("gives administrators every current and future vault without separate grants", async () => { + const { service, store, db, access } = await setup(); + const invite = await service.invite(actor("owner"), "org", { + email: actor("alice").email, role: "admin", vaults: [], + }); + await service.resend("owner", "org", invite.id); + expect((await service.invitation(actor("alice"), invite.id)).vaults).toHaveLength(2); + await service.respond(actor("alice"), invite.id, true); + const vaultStore = new DrizzleVaultStore(db); + const created = await vaultStore.createVaultForUser("owner", "org", "Later", { + kind: "password", envelope: { ...wrapper("owner"), version: 1, binding: undefined }, + }); + const org = await service.organization("alice", "org"); + expect(org.vaults).toHaveLength(3); + expect(org.vaults.every((v) => v.canManage && v.status === "pending_key" && !v.personal)).toBe(true); + expect((await vaultStore.listVaultsForUser("alice")).map((v) => v.id)).toContain(created.id); + expect(await store.grant(created.id, "alice")).toBeNull(); + // Management does not require receiving the encryption key first. + const bob = await service.invite(actor("alice"), "org", { + email: actor("bob").email, role: "member", vaults: [{ vaultId: created.id }], + }); + await service.respond(actor("bob"), bob.id, true); + await service.changeVaultMember("alice", "vault-b", "bob", true); + await expect(service.changeVaultMember("owner", created.id, "alice")).rejects.toMatchObject({ code: "forbidden" }); + // Content access still requires the recipient's own encrypted wrapper. + await expect(access.require("alice", "vault-a")).rejects.toMatchObject({ code: "vault_access_denied" }); + const request = await service.startKeyRequest("alice", "vault-a", "admin-enrollment", "receiver-key"); + expect((await store.grant("vault-a", "alice"))?.explicitAccess).toBe(false); + await service.approveKeyRequest("owner", "vault-a", request.id, { + version: 1, algorithm: "rsa-oaep-sha256", ciphertext: "encrypted", + }); + await service.completeKeyRequest("alice", "vault-a", request.id, wrapper("alice")); + expect(await access.require("alice", "vault-a")).toBe(1); + // Current organization role authorizes key sharing, not legacy vault roles. + await service.changeVaultMember("alice", "vault-a", "bob", true); + const bobRequest = await service.startKeyRequest("bob", "vault-a", "bob-enrollment", "bob-key"); + await service.approveKeyRequest("alice", "vault-a", bobRequest.id, { + version: 1, algorithm: "rsa-oaep-sha256", ciphertext: "encrypted", + }); + await service.changeMember("owner", "org", "alice", "member"); + expect((await store.grant("vault-a", "alice"))?.status).toBe("revoked"); + expect(await store.passwordWrapper("vault-a", "alice")).toBeNull(); + expect((await service.organization("alice", "org")).vaults).toHaveLength(0); + await expect(access.require("alice", "vault-a")).rejects.toMatchObject({ code: "vault_access_denied" }); + await expect(service.changeVaultMember("alice", "vault-a", "bob")).rejects.toMatchObject({ code: "forbidden" }); + }); + + it("preserves explicit member access across promotion and demotion without granting members management rights", async () => { + const { service, store, db } = await setup(); + const invite = await service.invite(actor("owner"), "org", { + email: actor("alice").email, role: "member", vaults: grants, + }); + await service.respond(actor("alice"), invite.id, true); + await db.update(s.vaultMembership).set({ status: "active" }).where(eq(s.vaultMembership.userId, "alice")); + await expect(service.requireVault("alice", "vault-a", true)).rejects.toMatchObject({ code: "forbidden" }); + await service.changeMember("owner", "org", "alice", "admin"); + expect((await service.organization("alice", "org")).vaults).toHaveLength(2); + await service.startKeyRequest("alice", "vault-b", "inherited-key", "receiver-key"); + await service.changeMember("owner", "org", "alice", "member"); + expect((await store.grant("vault-a", "alice"))?.status).toBe("active"); + expect((await store.grant("vault-b", "alice"))?.status).toBe("revoked"); + expect((await store.keyRequest("inherited-key"))?.status).toBe("canceled"); + expect((await service.organization("alice", "org")).vaults.map((v) => v.id)).toEqual(["vault-a"]); + await service.changeMember("owner", "org", "alice", "admin"); + await service.startKeyRequest("alice", "vault-b", "renewed-key", "new-receiver-key"); + expect((await store.grant("vault-b", "alice"))?.accessVersion).toBeGreaterThan(1); + }); + + it("reserves three seats including the owner and grants only selected vaults after acceptance", async () => { + const { service, store, access } = await setup(); + const a = await service.invite(actor("owner"), "org", { + email: actor("alice").email, + role: "member", + vaults: grants, + }); + await service.invite(actor("owner"), "org", { + email: actor("bob").email, + role: "member", + vaults: grants, + }); + await expect( + service.invite(actor("owner"), "org", { + email: actor("carol").email, + role: "member", + vaults: grants, + }), + ).rejects.toMatchObject({ code: "invitation_conflict" }); + await service.respond(actor("alice"), a.id, true); + expect((await store.grant("vault-a", "alice"))?.status).toBe("pending_key"); + expect(await store.grant("vault-b", "alice")).toBeNull(); + await expect(access.require("alice", "vault-a")).rejects.toMatchObject({ + code: "vault_access_denied", + }); + const org = await service.organization("alice", "org"); + expect(org.vaults.map((v) => v.id)).toEqual(["vault-a"]); + expect(org.members.map((m) => m.id)).toEqual(["alice"]); + }); + it("rejects privilege escalation, wrong recipients, foreign vaults and expired invitations", async () => { + const { service, db, store, setPlan } = await setup(); + await db.insert(s.member).values({ + id: "alice-org", + organizationId: "org", + userId: "alice", + role: "admin", + createdAt: new Date(), + }); + await db.insert(s.vaultMembership).values({ + vaultId: "vault-a", + userId: "alice", + isCreator: false, + status: "active", + }); + await expect( + service.invite(actor("alice"), "org", { + email: actor("bob").email, + role: "admin", + vaults: grants, + }), + ).rejects.toMatchObject({ code: "forbidden" }); + await expect( + service.changeMember("alice", "org", "owner"), + ).rejects.toMatchObject({ code: "owner_protected" }); + await db + .insert(s.organization) + .values({ + id: "other-org", + name: "Other", + slug: "other", + createdAt: new Date(), + }); + await db + .insert(s.member) + .values({ + id: "other-owner", + organizationId: "other-org", + userId: "owner", + role: "owner", + createdAt: new Date(), + }); + await db + .insert(s.vault) + .values({ + id: "foreign-vault", + organizationId: "other-org", + name: "Foreign", + activeKeyVersion: 1, + }); + await db + .insert(s.vaultMembership) + .values({ + vaultId: "foreign-vault", + userId: "owner", + isCreator: true, + status: "active", + }); + await expect( + service.invite(actor("owner"), "org", { + email: actor("bob").email, + role: "member", + vaults: [{ vaultId: "foreign-vault" }], + }), + ).rejects.toMatchObject({ code: "forbidden" }); + const invite = await service.invite(actor("owner"), "org", { + email: actor("bob").email, + role: "member", + vaults: grants, + }); + await expect( + service.respond(actor("carol"), invite.id, true), + ).rejects.toMatchObject({ code: "forbidden" }); + setPlan("free"); + await expect( + service.respond(actor("bob"), invite.id, true), + ).rejects.toMatchObject({ code: "sharing_unavailable" }); + setPlan("plus"); + await db + .update(s.invitation) + .set({ expiresAt: new Date(0) }) + .where(eq(s.invitation.id, invite.id)); + await expect( + service.respond(actor("bob"), invite.id, true), + ).rejects.toMatchObject({ code: "invitation_unavailable" }); + expect(await store.membership("org", "bob")).toBeNull(); + }); + it("reserves seats and vault quota atomically under concurrent requests", async () => { + const { service, db, store } = await setup(); + const invites = await Promise.allSettled( + ["alice", "bob", "carol"].map((id) => + service.invite(actor("owner"), "org", { + email: actor(id).email, + role: "member", + vaults: grants, + }), + ), + ); + expect( + invites.filter((value) => value.status === "fulfilled"), + ).toHaveLength(2); + for (const result of invites) + if (result.status === "fulfilled") { + const invite = await store.invitation(result.value.id); + const id = invite!.email.split("@")[0]; + await Promise.allSettled([ + service.respond(actor(id), invite!.id, true), + service.respond(actor(id), invite!.id, true), + ]); + } + expect(await store.members("org")).toHaveLength(3); + const vaultStore = new DrizzleVaultStore(db); + const vaults = await Promise.allSettled( + [0, 1, 2, 3].map((i) => + vaultStore.createVaultForUser( + "owner", + "org", + `concurrent-${i}`, + { + kind: "password", + envelope: { ...wrapper("owner"), version: 1, binding: undefined }, + }, + 3, + ), + ), + ); + expect(vaults.filter((value) => value.status === "fulfilled")).toHaveLength( + 1, + ); + expect(await vaultStore.countVaultsForOrganization("org")).toBe(3); + }); + it("invalidates stale recovery when the user changes their password and retains failed refresh delivery", async () => { + const { service, store, db } = await setup(); + const invite = await service.invite(actor("owner"), "org", { + email: actor("alice").email, + role: "member", + vaults: grants, + }); + await service.respond(actor("alice"), invite.id, true); + const request = await service.startKeyRequest( + "alice", + "vault-a", + "request-1", + "public-key", + ); + await service.approveKeyRequest("owner", "vault-a", request.id, { + version: 1, + algorithm: "rsa-oaep-sha256", + ciphertext: "encrypted", + }); + await service.completeKeyRequest( + "alice", + "vault-a", + request.id, + wrapper("alice"), + ); + const recovery = await service.startKeyRequest( + "alice", + "vault-a", + "recovery", + "new-key", + ); + await service.approveKeyRequest("owner", "vault-a", recovery.id, { + version: 1, + algorithm: "rsa-oaep-sha256", + ciphertext: "encrypted", + }); + const newWrapper = { + ...wrapper("alice"), + wrap: { ...wrapper("alice").wrap, ciphertext: "new-password-ciphertext" }, + }; + await new DrizzleVaultStore(db).upsertPasswordWrapperForUser( + "alice", + "vault-a", + newWrapper, + ); + await expect( + service.completeKeyRequest( + "alice", + "vault-a", + recovery.id, + wrapper("alice"), + ), + ).rejects.toMatchObject({ code: "request_changed" }); + expect(await store.passwordWrapper("vault-a", "alice")).toEqual(newWrapper); + const failing = new SharingService( + store, + { readOrganizationPolicy: async () => getSubscriptionPlanPolicy("plus") }, + { + refreshSharingAccess: async () => { + throw new Error("unavailable"); + }, + }, + { baseURL: "https://example.com", requireVerifiedEmail: true }, + ); + expect( + await failing.changeVaultMember("owner", "vault-a", "alice"), + ).toEqual({ pending: true }); + expect((await store.refreshes()).length).toBeGreaterThan(0); + expect(await service.flushRefreshes()).toBe(true); + expect(await store.refreshes()).toHaveLength(0); + }); + + it("enrolls, recovers without changing roles, and does not resurrect a revoked grant", async () => { + const { service, store, access } = await setup(); + const a = await service.invite(actor("owner"), "org", { + email: actor("alice").email, + role: "member", + vaults: grants, + }); + await service.respond(actor("alice"), a.id, true); + const req = await service.startKeyRequest( + "alice", + "vault-a", + "request-1", + "public-key", + ); + await service.approveKeyRequest("owner", "vault-a", req.id, { + version: 1, + algorithm: "rsa-oaep-sha256", + ciphertext: "encrypted", + }); + await service.completeKeyRequest( + "alice", + "vault-a", + req.id, + wrapper("alice"), + ); + expect(await access.require("alice", "vault-a")).toBe(1); + expect((await store.grant("vault-a", "alice"))?.explicitAccess).toBe(true); + const recovery = await service.startKeyRequest( + "alice", + "vault-a", + "request-2", + "new-public-key", + ); + expect(recovery.purpose).toBe("recovery"); + await service.changeVaultMember("owner", "vault-a", "alice"); + await expect( + service.completeKeyRequest( + "alice", + "vault-a", + recovery.id, + wrapper("alice"), + ), + ).rejects.toMatchObject({ code: "forbidden" }); + await service.respond(actor("alice"), a.id, true); + expect((await store.grant("vault-a", "alice"))?.status).toBe("revoked"); + await expect(access.require("alice", "vault-a")).rejects.toMatchObject({ + code: "vault_access_denied", + }); + await service.changeVaultMember( + "owner", + "vault-a", + "alice", + true, + ); + const renewed = await service.startKeyRequest( + "alice", + "vault-a", + "new-membership", + "receiver-key", + ); + await service.approveKeyRequest("owner", "vault-a", renewed.id, { + version: 1, + algorithm: "rsa-oaep-sha256", + ciphertext: "encrypted", + }); + await service.completeKeyRequest( + "alice", + "vault-a", + renewed.id, + wrapper("alice"), + ); + expect(await access.require("alice", "vault-a")).toBeGreaterThan(1); + }); + it("suspends shared vaults when Plus expires, preserves access records and resumes only active members", async () => { + const { service, store, access, setPlan } = await setup(); + const a = await service.invite(actor("owner"), "org", { + email: actor("alice").email, + role: "member", + vaults: grants, + }); + await service.respond(actor("alice"), a.id, true); + setPlan("free"); + await expect(access.require("owner", "vault-a")).rejects.toMatchObject({ + code: "sharing_suspended", + }); + expect(await access.require("owner", "vault-b")).toBe(1); + expect((await store.grant("vault-a", "alice"))?.status).toBe("pending_key"); + setPlan("plus"); + expect(await access.require("owner", "vault-a")).toBe(1); + }); +}); diff --git a/apps/api/src/subscription/domain/policy.ts b/apps/api/src/subscription/domain/policy.ts index c194517d..9d0797d0 100644 --- a/apps/api/src/subscription/domain/policy.ts +++ b/apps/api/src/subscription/domain/policy.ts @@ -1,11 +1,19 @@ export const BYTES_PER_MB = 1_000_000; export const BYTES_PER_GB = 1_000_000_000; -export const SUBSCRIPTION_PLAN_IDS = ["free", "starter", "self_hosted"] as const; +export const SUBSCRIPTION_PLAN_IDS = [ + "free", + "starter", + "plus", + "self_hosted", +] as const; export const SUBSCRIPTION_BILLING_INTERVALS = ["monthly", "annual"] as const; export type SubscriptionPlanId = (typeof SUBSCRIPTION_PLAN_IDS)[number]; -export type PaidSubscriptionPlanId = Exclude; +export type PaidSubscriptionPlanId = Exclude< + SubscriptionPlanId, + "free" | "self_hosted" +>; export type SubscriptionBillingInterval = (typeof SUBSCRIPTION_BILLING_INTERVALS)[number]; export type SubscriptionProductIdsByPlanId = Partial< @@ -23,7 +31,7 @@ export type SubscriptionPlanPolicy = { monthlyUsd: number; annualMonthlyUsd: number; annualUsd: number; - }; + } | null; limits: { syncedVaults: number; storageLimitBytes: number; @@ -91,6 +99,23 @@ export const SUBSCRIPTION_PLAN_POLICIES = { storageUpgrade: false, }, }, + plus: { + id: "plus", + name: "Sync Plus", + // Flat organization pricing includes up to three members, including the owner. + pricing: { + monthlyUsd: 9, + annualMonthlyUsd: 90 / 12, + annualUsd: 90, + }, + limits: { + syncedVaults: 3, + storageLimitBytes: 2 * BYTES_PER_GB, + maxFileSizeBytes: 100 * BYTES_PER_MB, + versionHistoryRetentionDays: 365, + }, + features: { snapshots: true, storageUpgrade: false }, + }, self_hosted: { id: "self_hosted", name: "Self Hosted", @@ -125,8 +150,7 @@ export function applySubscriptionPlanLimitOverrides( return { ...policy, limits: { - syncedVaults: - overrides.syncedVaults ?? policy.limits.syncedVaults, + syncedVaults: overrides.syncedVaults ?? policy.limits.syncedVaults, storageLimitBytes: policy.limits.storageLimitBytes, maxFileSizeBytes: policy.limits.maxFileSizeBytes, versionHistoryRetentionDays: policy.limits.versionHistoryRetentionDays, @@ -148,13 +172,17 @@ export function subscriptionGrantsAccess( return false; } if (ACTIVE_ACCESS_STATUSES.has(subscription.status)) { - return !subscription.periodEnd || subscription.periodEnd.getTime() > Date.now(); + return ( + !subscription.periodEnd || subscription.periodEnd.getTime() > Date.now() + ); } if (!PERIOD_ACCESS_STATUSES.has(subscription.status)) { return false; } - return !!subscription.periodEnd && subscription.periodEnd.getTime() > Date.now(); + return ( + !!subscription.periodEnd && subscription.periodEnd.getTime() > Date.now() + ); } export function subscriptionAccessPlanId( @@ -180,7 +208,9 @@ export function subscriptionAccess( } const productIdsByPlanId = config.productIdsByPlanId ?? {}; - for (const [planId, productIdsByInterval] of Object.entries(productIdsByPlanId)) { + for (const [planId, productIdsByInterval] of Object.entries( + productIdsByPlanId, + )) { for (const [billingInterval, productId] of Object.entries( productIdsByInterval ?? {}, )) { @@ -195,3 +225,11 @@ export function subscriptionAccess( return null; } + +/** Organization sharing entitlement; zero member limit means unrestricted. */ +export function organizationSharingPolicy(planId: SubscriptionPlanId) { + return { + enabled: planId === "plus" || planId === "self_hosted", + memberLimit: planId === "self_hosted" ? 0 : 3, + }; +} diff --git a/apps/api/src/sync-access/adapters/outbound/jose-sync-token-codec.ts b/apps/api/src/sync-access/adapters/outbound/jose-sync-token-codec.ts index 5659f4e6..1d0957cf 100644 --- a/apps/api/src/sync-access/adapters/outbound/jose-sync-token-codec.ts +++ b/apps/api/src/sync-access/adapters/outbound/jose-sync-token-codec.ts @@ -18,6 +18,7 @@ export class JoseSyncTokenCodec implements SyncTokenCodec { async signSyncToken(claims: SyncTokenClaims): Promise { return await new SignJWT({ + accessVersion: claims.accessVersion, vaultId: claims.vaultId, localVaultId: claims.localVaultId, displayName: claims.displayName, diff --git a/apps/api/src/sync-access/application/services/sync-token-service.ts b/apps/api/src/sync-access/application/services/sync-token-service.ts index 558611b0..2aa9a249 100644 --- a/apps/api/src/sync-access/application/services/sync-token-service.ts +++ b/apps/api/src/sync-access/application/services/sync-token-service.ts @@ -23,6 +23,7 @@ export class IssueSyncTokenService implements IssueSyncToken { private readonly syncTokenCodec: Pick, private readonly syncPauseReader: SyncPauseReader, syncTokenTtlSeconds = DEFAULT_SYNC_TOKEN_TTL_SECONDS, + private readonly accessReader?: (userId: string, vaultId: string) => Promise, ) { this.syncTokenTtlSeconds = syncTokenTtlSeconds; } @@ -39,7 +40,9 @@ export class IssueSyncTokenService implements IssueSyncToken { } const now = Math.floor(Date.now() / 1000); + const accessVersion = await this.accessReader?.(input.userId, input.vaultId); const claims = { + ...(accessVersion === undefined ? {} : { accessVersion }), sub: input.userId, vaultId: input.vaultId, localVaultId: input.localVaultId, @@ -61,7 +64,7 @@ export class IssueSyncTokenService implements IssueSyncToken { } export class VerifySyncTokenService implements VerifySyncToken { - constructor(private readonly syncTokenCodec: Pick) {} + constructor(private readonly syncTokenCodec: Pick, private readonly accessVerifier?: (claims: SyncTokenClaims, token: string) => Promise) {} async verifySyncToken( token: string | null | undefined, @@ -78,6 +81,7 @@ export class VerifySyncTokenService implements VerifySyncToken { if (expectedVaultId && claims.vaultId !== expectedVaultId) { throw new SyncAccessApplicationError("vault_mismatch"); } + await this.accessVerifier?.(claims, token); return claims; } } diff --git a/apps/api/src/sync-access/application/services/verify-sync-token-service.test.ts b/apps/api/src/sync-access/application/services/verify-sync-token-service.test.ts new file mode 100644 index 00000000..c7070281 --- /dev/null +++ b/apps/api/src/sync-access/application/services/verify-sync-token-service.test.ts @@ -0,0 +1,48 @@ +import { expect, it, vi } from "vitest"; +import { VerifySyncTokenService } from "./sync-token-service"; +import type { SyncTokenClaims } from "../dto/token"; + +const claims: SyncTokenClaims = { + sub: "user", + vaultId: "vault", + localVaultId: "device", + displayName: "User", + scope: "vault:sync", + iat: 1, + exp: 9999999999, + accessVersion: 3, +}; +it.each(["signature", "scope", "vault"])( + "does not send unverified identity to the trusted coordinator (%s)", + async (failure) => { + const codec = { + verifySyncToken: vi.fn(async () => { + if (failure === "signature") throw new Error("bad signature"); + return failure === "scope" + ? ({ ...claims, scope: "other" } as unknown as SyncTokenClaims) + : claims; + }), + }; + const authorize = vi.fn(); + const service = new VerifySyncTokenService(codec, authorize); + await expect( + service.verifySyncToken( + "token", + failure === "vault" ? "foreign" : "vault", + ), + ).rejects.toBeDefined(); + expect(authorize).not.toHaveBeenCalled(); + }, +); +it("checks the current access version after authentication and propagates revocation", async () => { + const denial = new Error("revoked"); + const authorize = vi.fn(async () => { + throw denial; + }); + const service = new VerifySyncTokenService( + { verifySyncToken: async () => claims }, + authorize, + ); + await expect(service.verifySyncToken("token", "vault")).rejects.toBe(denial); + expect(authorize).toHaveBeenCalledWith(claims, "token"); +}); diff --git a/apps/api/src/sync-access/domain/token-policy.ts b/apps/api/src/sync-access/domain/token-policy.ts index 818fa812..ca371be7 100644 --- a/apps/api/src/sync-access/domain/token-policy.ts +++ b/apps/api/src/sync-access/domain/token-policy.ts @@ -1,4 +1,5 @@ export type SyncTokenClaimValues = { + accessVersion?: number; sub: string; vaultId: string; localVaultId: string; @@ -42,7 +43,9 @@ export function parseSyncTokenClaimValues(value: unknown): SyncTokenClaimValues return null; } + if (claims.accessVersion !== undefined && (typeof claims.accessVersion !== "number" || !Number.isSafeInteger(claims.accessVersion) || claims.accessVersion < 1)) return null; return { + ...(claims.accessVersion === undefined ? {} : { accessVersion: claims.accessVersion as number }), sub, vaultId, localVaultId, diff --git a/apps/api/src/sync-coordinator/adapters/inbound/durable-object-rpc/sync-coordinator.ts b/apps/api/src/sync-coordinator/adapters/inbound/durable-object-rpc/sync-coordinator.ts index e71ddab2..a6c7bc23 100644 --- a/apps/api/src/sync-coordinator/adapters/inbound/durable-object-rpc/sync-coordinator.ts +++ b/apps/api/src/sync-coordinator/adapters/inbound/durable-object-rpc/sync-coordinator.ts @@ -1,3 +1,7 @@ +import type { + VerifiedVaultAccess, + VaultAccessDecision, +} from "../../../application/services/sync-access-service"; import { DurableObject } from "cloudflare:workers"; import { apiError } from "../../../../errors"; import type { @@ -32,22 +36,36 @@ import { const ALARM_FAILURE_RETRY_MS = 30 * 1000; export class SyncCoordinator extends DurableObject { + private readonly authorizeVerified: ReturnType< + typeof createCoordinatorRuntime + >["authorizeSyncAccess"]; private readonly app: ReturnType["app"]; private readonly services: CoordinatorApplicationPort; private readonly socketMessageHandler: CoordinatorSocketMessageHandler; - private readonly socketGateway: ReturnType["socketGateway"]; + private readonly socketGateway: ReturnType< + typeof createCoordinatorRuntime + >["socketGateway"]; private readonly ready: Promise; constructor(ctx: DurableObjectState, env: Env) { super(ctx, env); const runtime = createCoordinatorRuntime(ctx, env); this.app = runtime.app; + this.authorizeVerified = runtime.authorizeSyncAccess; this.services = runtime.services; this.socketMessageHandler = runtime.socketMessageHandler; this.socketGateway = runtime.socketGateway; this.ready = runtime.ready; } + // This method is exposed only on the internal namespace binding, never HTTP. + async authorizeSyncAccess( + input: VerifiedVaultAccess, + ): Promise { + await this.ready; + return this.authorizeVerified(input); + } + async fetch(request: Request): Promise { try { await this.ready; @@ -58,7 +76,10 @@ export class SyncCoordinator extends DurableObject { } } - async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise { + async webSocketMessage( + ws: WebSocket, + message: string | ArrayBuffer, + ): Promise { let connectionId: string | null = null; try { connectionId = this.socketGateway.connectionIdFor(ws); @@ -177,9 +198,7 @@ export class SyncCoordinator extends DurableObject { await this.withRpcError("runGc", () => this.services.runGc()); } - async repairSyncState( - vaultId: string, - ): Promise { + async repairSyncState(vaultId: string): Promise { return await this.withRpcError("repairSyncState", () => this.services.repairSyncState(vaultId), ); @@ -204,15 +223,21 @@ export class SyncCoordinator extends DurableObject { try { const retryAt = Date.now() + ALARM_FAILURE_RETRY_MS; await this.ctx.storage.setAlarm(retryAt); - console.error("[sync-coordinator] durable object alarm retry scheduled", { - objectId: this.ctx.id.toString(), - retryAt, - }); + console.error( + "[sync-coordinator] durable object alarm retry scheduled", + { + objectId: this.ctx.id.toString(), + retryAt, + }, + ); } catch (retryError) { - console.error("[sync-coordinator] durable object alarm retry scheduling failed", { - objectId: this.ctx.id.toString(), - error: formatLogError(retryError), - }); + console.error( + "[sync-coordinator] durable object alarm retry scheduling failed", + { + objectId: this.ctx.id.toString(), + error: formatLogError(retryError), + }, + ); throw error; } } @@ -311,7 +336,10 @@ function internalErrorResponse(): Response { ); } -function formatRequestForLog(request: Request): { method: string; path: string } { +function formatRequestForLog(request: Request): { + method: string; + path: string; +} { const url = new URL(request.url); return { method: request.method, @@ -322,7 +350,11 @@ function formatRequestForLog(request: Request): { method: string; path: string } function mapCoordinatorRpcError(error: unknown): unknown { if (!(error instanceof SyncCoordinatorApplicationError)) return error; if (error.code === "sync_paused") { - return apiError(503, "sync_paused", "vault sync is temporarily paused for repair"); + return apiError( + 503, + "sync_paused", + "vault sync is temporarily paused for repair", + ); } return apiError( rpcErrorStatus(error.code), diff --git a/apps/api/src/sync-coordinator/adapters/inbound/http/routes.test.ts b/apps/api/src/sync-coordinator/adapters/inbound/http/routes.test.ts index 46e220f3..e84d30e6 100644 --- a/apps/api/src/sync-coordinator/adapters/inbound/http/routes.test.ts +++ b/apps/api/src/sync-coordinator/adapters/inbound/http/routes.test.ts @@ -20,6 +20,7 @@ function appWithStageError(error: SyncAccessApplicationError) { purgeVault: unused, prepareSocketSession: unused, completeSocketOpen: unused, + assertSessionAccess: unused, } satisfies CoordinatorHttpServices; return { app: createCoordinatorApp({ diff --git a/apps/api/src/sync-coordinator/adapters/inbound/http/routes.ts b/apps/api/src/sync-coordinator/adapters/inbound/http/routes.ts index 6be81f29..53f18c2e 100644 --- a/apps/api/src/sync-coordinator/adapters/inbound/http/routes.ts +++ b/apps/api/src/sync-coordinator/adapters/inbound/http/routes.ts @@ -4,10 +4,22 @@ import { z } from "zod"; import { onError } from "../../../../errors"; import { mapSyncCoordinatorApplicationError } from "./error-mapper"; -import { BLOB_SIZE_HEADER, parseBlobSizeHeader } from "../../../../platform/http/blob-size"; -import { parseBearerToken, SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX } from "../../../../sync-access/application"; -import type { SyncPauseState, SyncRepairResult } from "../../../application/dto/sync-repair"; -import type { SocketSession, VaultStateLimits } from "../../../application/dto/types"; +import { + BLOB_SIZE_HEADER, + parseBlobSizeHeader, +} from "../../../../platform/http/blob-size"; +import { + parseBearerToken, + SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX, +} from "../../../../sync-access/application"; +import type { + SyncPauseState, + SyncRepairResult, +} from "../../../application/dto/sync-repair"; +import type { + SocketSession, + VaultStateLimits, +} from "../../../application/dto/types"; export interface CoordinatorHttpServices { repairSyncState(vaultId: string): Promise; @@ -24,8 +36,12 @@ export interface CoordinatorHttpServices { limits: VaultStateLimits, ): Promise<{ applied: boolean }>; purgeVault(vaultId: string): Promise; - prepareSocketSession(token: string | null, vaultId: string): Promise; + prepareSocketSession( + token: string | null, + vaultId: string, + ): Promise; completeSocketOpen(): Promise; + assertSessionAccess(session: SocketSession): void; } export type CoordinatorSocketHandshake = { @@ -38,13 +54,23 @@ const policyLimitsSchema = z.object({ versionHistoryRetentionDays: z.number().int().nonnegative(), }); -export function createCoordinatorApp( - deps: { - services: CoordinatorHttpServices; - socketHandshake: CoordinatorSocketHandshake; - }, -) { +export function createCoordinatorApp(deps: { + services: CoordinatorHttpServices; + socketHandshake: CoordinatorSocketHandshake; + authorize?: (token: string | null, vaultId: string) => Promise; + refreshSharing?: (vaultId: string) => Promise; + canApplyPolicy?: (vaultId: string) => Promise; +}) { const app = new Hono(); + app.post("/internal/v1/vaults/:vaultId/authorize", async (c) => { + if (!deps.authorize) return c.json({ error: "access_unavailable" }, 503); + await deps.authorize(readSyncToken(c.req.raw), c.req.param("vaultId")); + return c.json({ ok: true }); + }); + app.post("/internal/v1/vaults/:vaultId/sharing-refresh", async (c) => { + await deps.refreshSharing?.(c.req.param("vaultId")); + return c.json({ ok: true }); + }); app.post( "/internal/v1/vaults/:vaultId/sync-repair", @@ -85,7 +111,9 @@ export function createCoordinatorApp( ), async (c) => { const { vaultId, blobId } = c.req.valid("param"); - const sizeBytes = parseBlobSizeHeader(c.req.raw.headers.get(BLOB_SIZE_HEADER)); + const sizeBytes = parseBlobSizeHeader( + c.req.raw.headers.get(BLOB_SIZE_HEADER), + ); if (sizeBytes === null) { return c.json( { @@ -95,7 +123,12 @@ export function createCoordinatorApp( 400, ); } - await deps.services.stageBlob(readSyncToken(c.req.raw), vaultId, blobId, sizeBytes); + await deps.services.stageBlob( + readSyncToken(c.req.raw), + vaultId, + blobId, + sizeBytes, + ); return new Response(null, { status: 204 }); }, ); @@ -133,10 +166,10 @@ export function createCoordinatorApp( async (c) => { const { vaultId } = c.req.valid("param"); const body = c.req.valid("json"); - const result = await deps.services.applyVaultPolicy( - vaultId, - body.limits, - ); + await deps.refreshSharing?.(c.req.param("vaultId")); + if (deps.canApplyPolicy && !(await deps.canApplyPolicy(vaultId))) + return c.json({ applied: false }); + const result = await deps.services.applyVaultPolicy(vaultId, body.limits); return c.json(result); }, ); @@ -181,6 +214,7 @@ export function createCoordinatorApp( readSyncToken(request), vaultId, ); + deps.services.assertSessionAccess(session); const response = await deps.socketHandshake.openSocket(request, session); await deps.services.completeSocketOpen(); return response; @@ -196,7 +230,10 @@ export function createCoordinatorApp( ), ); - app.onError((error, c) => mapSyncCoordinatorApplicationError(error) ?? onError(error, c)); + app.onError( + (error, c) => + mapSyncCoordinatorApplicationError(error) ?? onError(error, c), + ); return app; } diff --git a/apps/api/src/sync-coordinator/adapters/inbound/websocket/control-message-handler.ts b/apps/api/src/sync-coordinator/adapters/inbound/websocket/control-message-handler.ts index 1c9c88c3..a68286c5 100644 --- a/apps/api/src/sync-coordinator/adapters/inbound/websocket/control-message-handler.ts +++ b/apps/api/src/sync-coordinator/adapters/inbound/websocket/control-message-handler.ts @@ -1,3 +1,4 @@ +import { SharingError } from "../../../../sharing/application/types"; import type { CommitMutationsMessage, CommitMutationsResult, @@ -59,7 +60,9 @@ export type CoordinatorControlMessageServices = { ): Promise; }; -export class CoordinatorControlMessageHandler implements CoordinatorSocketMessageHandler { +export class CoordinatorControlMessageHandler + implements CoordinatorSocketMessageHandler +{ constructor( private readonly socketService: Pick< SocketGateway, @@ -85,6 +88,7 @@ export class CoordinatorControlMessageHandler implements CoordinatorSocketMessag "recordLocalVaultConnection" >, private readonly presenceStore = new PresenceStore(), + private readonly authorize?: (session: SocketSession) => Promise, ) {} async handle( @@ -106,6 +110,36 @@ export class CoordinatorControlMessageHandler implements CoordinatorSocketMessag return; } + try { + await this.authorize?.(session); + } catch (error) { + const revoked = + error instanceof SharingError && error.code === "vault_access_denied"; + const suspended = + error instanceof SharingError && error.code === "sharing_suspended"; + this.socketService.sendSocketMessage(connectionId, { + type: "session_error", + code: suspended + ? "sharing_suspended" + : revoked + ? "unauthorized" + : "access_unavailable", + message: + error instanceof Error + ? error.message + : "Vault access could not be verified", + }); + this.socketService.closeSocket( + connectionId, + revoked ? 4403 : 1013, + suspended + ? "shared sync paused" + : revoked + ? "vault access denied" + : "vault access temporarily unavailable", + ); + return; + } if (parsed.type === "hello") { try { const currentCursor = this.vaultStateStore.currentCursor(); diff --git a/apps/api/src/sync-coordinator/adapters/outbound/durable-object-rpc/coordinator-proxy-repository.ts b/apps/api/src/sync-coordinator/adapters/outbound/durable-object-rpc/coordinator-proxy-repository.ts index e535d931..4adb13fa 100644 --- a/apps/api/src/sync-coordinator/adapters/outbound/durable-object-rpc/coordinator-proxy-repository.ts +++ b/apps/api/src/sync-coordinator/adapters/outbound/durable-object-rpc/coordinator-proxy-repository.ts @@ -1,14 +1,26 @@ +import type { + VerifiedVaultAccess, + VaultAccessDecision, +} from "../../../application/services/sync-access-service"; +import type { SyncTokenClaims } from "../../../../sync-access/application/dto/token"; +import { SharingError } from "../../../../sharing/application/types"; import type { SubscriptionPlanPolicy } from "../../../../subscription/application"; -import type { SyncPauseState, SyncRepairResult } from "../../../application/ports/outbound"; +import type { + SyncPauseState, + SyncRepairResult, +} from "../../../application/ports/outbound"; export type CoordinatorStub = { + authorizeSyncAccess?( + input: VerifiedVaultAccess, + ): Promise; fetch(request: Request): Promise; }; /** * Structural, not `DurableObjectStub`-typed: on Cloudflare this is a real DO - * namespace binding, but `DurableObjectStub`'s only member this class uses is - * `fetch()`, so an in-process Node coordinator map satisfies this too. + * namespace binding; Node supplies the same fetch and typed authorization RPC. + * Fetch-only transports can use the authenticated internal HTTP endpoint. */ export type CoordinatorNamespace = { getByName(name: string): CoordinatorStub; @@ -17,6 +29,63 @@ export type CoordinatorNamespace = { export class CoordinatorProxyRepository { constructor(private readonly namespace: CoordinatorNamespace) {} + async refreshSharingAccess(vaultId: string): Promise { + const result = await this.fetch( + vaultId, + new Request( + `https://internal/internal/v1/vaults/${encodeURIComponent(vaultId)}/sharing-refresh`, + { method: "POST" }, + ), + ); + if (!result.ok) throw new Error("Unable to apply sharing access changes"); + } + async authorizeSync( + vaultId: string, + token: string, + claims: SyncTokenClaims, + ): Promise { + const stub = this.namespace.getByName(vaultId); + if (stub.authorizeSyncAccess) { + // Signature, expiry and vault binding have already been checked by VerifySyncTokenService. + // The coordinator remains the single owner of live authorization and invalidation. + let result: VaultAccessDecision; + try { + result = await stub.authorizeSyncAccess({ + vaultId, + userId: claims.sub, + accessVersion: claims.accessVersion ?? 1, + }); + } catch { + throw new SharingError( + 503, + "access_unavailable", + "Vault access could not be verified", + ); + } + if (!result.ok) + throw new SharingError(result.status, result.code, result.message); + return; + } + // Fetch-only transports retain the fully authenticated internal HTTP route. + const result = await this.fetch( + vaultId, + new Request( + `https://internal/internal/v1/vaults/${encodeURIComponent(vaultId)}/authorize`, + { method: "POST", headers: { authorization: `Bearer ${token}` } }, + ), + ); + if (!result.ok) { + const body = (await result.json().catch(() => null)) as { + error?: string; + message?: string; + } | null; + throw new SharingError( + result.status >= 500 ? 503 : 403, + body?.error ?? "access_unavailable", + body?.message ?? "Vault access could not be verified", + ); + } + } async fetch(vaultId: string, request: Request): Promise { const stub = this.namespace.getByName(vaultId); return await stub.fetch(request); @@ -30,7 +99,9 @@ export class CoordinatorProxyRepository { ), ); if (!response.ok) { - throw new Error(`failed to read sync state for vault ${vaultId}: ${response.status}`); + throw new Error( + `failed to read sync state for vault ${vaultId}: ${response.status}`, + ); } const body = (await response.json()) as { @@ -48,7 +119,9 @@ export class CoordinatorProxyRepository { ), ); if (!response.ok) { - throw new Error(`failed to repair sync state for vault ${vaultId}: ${response.status}`); + throw new Error( + `failed to repair sync state for vault ${vaultId}: ${response.status}`, + ); } return (await response.json()) as SyncRepairResult; @@ -117,8 +190,7 @@ export class CoordinatorProxyRepository { limits: { storageLimitBytes: limits.storageLimitBytes, maxFileSizeBytes: limits.maxFileSizeBytes, - versionHistoryRetentionDays: - limits.versionHistoryRetentionDays, + versionHistoryRetentionDays: limits.versionHistoryRetentionDays, }, }), }, diff --git a/apps/api/src/sync-coordinator/adapters/outbound/scheduler/maintenance-scheduler.ts b/apps/api/src/sync-coordinator/adapters/outbound/scheduler/maintenance-scheduler.ts index bb9cb3db..0c4ba16d 100644 --- a/apps/api/src/sync-coordinator/adapters/outbound/scheduler/maintenance-scheduler.ts +++ b/apps/api/src/sync-coordinator/adapters/outbound/scheduler/maintenance-scheduler.ts @@ -62,7 +62,9 @@ export class CoordinatorMaintenanceScheduler { } try { - const nextDueAt = await handlers[job.key](now); + const handler = handlers[job.key]; + if (!handler) throw new Error(`No maintenance handler for ${job.key}`); + const nextDueAt = await handler(now); if (nextDueAt === null) { this.deleteJob(job.key); } else { @@ -230,7 +232,10 @@ export class CoordinatorMaintenanceScheduler { } function isMaintenanceJobKey(value: string): value is MaintenanceJobKey { - return value === "blob_gc" || value === "health_summary_flush"; + return ( + value === "blob_gc" || + value === "health_summary_flush" + ); } function maintenanceRetryDelayMs(retryCount: number): number { diff --git a/apps/api/src/sync-coordinator/adapters/outbound/scheduler/node-maintenance-scheduler.ts b/apps/api/src/sync-coordinator/adapters/outbound/scheduler/node-maintenance-scheduler.ts index 1c4d747e..279dd4a6 100644 --- a/apps/api/src/sync-coordinator/adapters/outbound/scheduler/node-maintenance-scheduler.ts +++ b/apps/api/src/sync-coordinator/adapters/outbound/scheduler/node-maintenance-scheduler.ts @@ -65,7 +65,9 @@ export class NodeMaintenanceScheduler implements MaintenanceScheduler, Maintenan } try { - const nextDueAt = await handlers[job.key](now); + const handler = handlers[job.key]; + if (!handler) throw new Error(`No maintenance handler for ${job.key}`); + const nextDueAt = await handler(now); if (nextDueAt === null) { this.deleteJob(job.key); } else { diff --git a/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.test.ts b/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.test.ts index f8da3414..9206f4f9 100644 --- a/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.test.ts +++ b/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.test.ts @@ -7,6 +7,32 @@ const OPEN = 1; const CLOSED = 3; describe("CoordinatorSocketService", () => { + it("preserves the access version after a socket attachment is restored", () => { + const session = testSession({ accessVersion: 3 }); + let attachment: unknown; + const socket = { + deserializeAttachment: () => attachment, + serializeAttachment: (value: unknown) => { attachment = value; }, + } as unknown as WebSocket; + const state = testDurableObjectState([socket]); + const service = new CoordinatorSocketService(state); + const connectionId = service.connectionIdFor(socket); + service.attachSocketSession(connectionId, session); + + // A fresh adapter has no in-memory connection IDs, as after hibernation. + const restored = new CoordinatorSocketService(state); + expect(restored.readSocketSession(connectionId)).toEqual(session); + }); + + it.each([0, -1, 1.5, Number.NaN, "3", null])( + "rejects an invalid stored access version: %s", + (accessVersion) => { + const socket = testSocket({ ...testSession(), accessVersion } as SocketSession); + const service = new CoordinatorSocketService(testDurableObjectState([socket])); + expect(service.readSocketSession(service.connectionIdFor(socket))).toBeNull(); + }, + ); + it("closes superseded sockets even when their final message races with close", () => { const current = testSocket(testSession({ localVaultId: "local-vault-1" })); const superseded = testSocket(testSession({ localVaultId: "local-vault-1" })); diff --git a/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.ts b/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.ts index d1e33f3f..22b95eb1 100644 --- a/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.ts +++ b/apps/api/src/sync-coordinator/adapters/outbound/socket/durable-object-service.ts @@ -151,10 +151,18 @@ export class CoordinatorSocketService implements SocketGateway { readSocketSession(connectionId: string): SocketSession | null { const socket = this.findSocket(connectionId); - if (!socket) return null; + if (!socket || socket.readyState === WebSocket.CLOSING || socket.readyState === WebSocket.CLOSED) return null; return this.readSocketSessionFromSocket(socket, connectionId); } + listSocketSessions(): { connectionId: string; session: SocketSession }[] { + return this.ctx.getWebSockets().flatMap((socket) => { + const connectionId = this.connectionIdFor(socket); + const session = this.readSocketSession(connectionId); + return session ? [{ connectionId, session }] : []; + }); + } + private readSocketSessionFromSocket( socket: WebSocket, connectionId: string, @@ -168,25 +176,30 @@ export class CoordinatorSocketService implements SocketGateway { typeof maybeSession.localVaultId !== "string" || typeof maybeSession.vaultId !== "string" ) return null; - return { - userId: maybeSession.userId, - localVaultId: maybeSession.localVaultId, - vaultId: maybeSession.vaultId, - displayName: typeof maybeSession.displayName === "string" ? maybeSession.displayName : "", - wantsStorageStatus: maybeSession.wantsStorageStatus === true, - wantsPresence: maybeSession.wantsPresence === true, - presenceEntryId: - typeof maybeSession.presenceEntryId === "string" - ? maybeSession.presenceEntryId - : null, - presenceWatchEntryIds: Array.isArray(maybeSession.presenceWatchEntryIds) - ? maybeSession.presenceWatchEntryIds.filter( - (entryId): entryId is string => - typeof entryId === "string" && entryId.trim().length > 0, - ) - : [], - }; - } + if ( + maybeSession.accessVersion !== undefined && + (!Number.isSafeInteger(maybeSession.accessVersion) || maybeSession.accessVersion < 1) + ) return null; + return { + userId: maybeSession.userId, + localVaultId: maybeSession.localVaultId, + vaultId: maybeSession.vaultId, + ...(maybeSession.accessVersion === undefined ? {} : { accessVersion: maybeSession.accessVersion }), + displayName: typeof maybeSession.displayName === "string" ? maybeSession.displayName : "", + wantsStorageStatus: maybeSession.wantsStorageStatus === true, + wantsPresence: maybeSession.wantsPresence === true, + presenceEntryId: + typeof maybeSession.presenceEntryId === "string" + ? maybeSession.presenceEntryId + : null, + presenceWatchEntryIds: Array.isArray(maybeSession.presenceWatchEntryIds) + ? maybeSession.presenceWatchEntryIds.filter( + (entryId): entryId is string => + typeof entryId === "string" && entryId.trim().length > 0, + ) + : [], + }; + } private findSocket(connectionId: string): WebSocket | null { for (const socket of this.ctx.getWebSockets()) { diff --git a/apps/api/src/sync-coordinator/adapters/outbound/socket/node-service.ts b/apps/api/src/sync-coordinator/adapters/outbound/socket/node-service.ts index 10eb9459..8fc4d293 100644 --- a/apps/api/src/sync-coordinator/adapters/outbound/socket/node-service.ts +++ b/apps/api/src/sync-coordinator/adapters/outbound/socket/node-service.ts @@ -53,12 +53,17 @@ export class NodeSocketGateway implements SocketGateway { } readSocketSession(connectionId: string): SocketSession | null { - for (const record of this.sockets.values()) { - if (record.id === connectionId) return record.session; + for (const [socket, record] of this.sockets) { + if (record.id === connectionId && socket.readyState === socket.OPEN) return record.session; } return null; } + listSocketSessions(): { connectionId: string; session: SocketSession }[] { + return [...this.sockets].filter(([socket]) => socket.readyState === socket.OPEN) + .map(([, record]) => ({ connectionId: record.id, session: record.session })); + } + sendSocketMessage(connectionId: string, message: ServerControlMessage): boolean { const socket = this.socketFor(connectionId); return socket ? this.trySend(socket, JSON.stringify(message)) : false; diff --git a/apps/api/src/sync-coordinator/adapters/outbound/sqlite/storage-lifecycle.ts b/apps/api/src/sync-coordinator/adapters/outbound/sqlite/storage-lifecycle.ts index 40e8c74b..1f9a9c19 100644 --- a/apps/api/src/sync-coordinator/adapters/outbound/sqlite/storage-lifecycle.ts +++ b/apps/api/src/sync-coordinator/adapters/outbound/sqlite/storage-lifecycle.ts @@ -25,6 +25,7 @@ export class SqliteCoordinatorStorage implements CoordinatorStorageLifecycle { DELETE FROM entries; DELETE FROM blobs; DELETE FROM maintenance_jobs; + DELETE FROM sync_access_revocations; DELETE FROM local_vault_connections; DELETE FROM coordinator_state; `); diff --git a/apps/api/src/sync-coordinator/adapters/outbound/sqlite/sync-access-store.ts b/apps/api/src/sync-coordinator/adapters/outbound/sqlite/sync-access-store.ts new file mode 100644 index 00000000..39ab4b23 --- /dev/null +++ b/apps/api/src/sync-coordinator/adapters/outbound/sqlite/sync-access-store.ts @@ -0,0 +1,28 @@ +import { eq, lte } from "drizzle-orm"; +import { syncAccessRevocations } from "../../../../db/do"; +import type { + SyncAccessStore, + SyncAccessRevocation, +} from "../../../application/ports/outbound/sync-access-store"; +import type { CoordinatorStorageHandle } from "./storage-handle"; + +export class SqliteSyncAccessStore implements SyncAccessStore { + constructor(private readonly handle: CoordinatorStorageHandle) {} + + readRevocations(): SyncAccessRevocation[] { + return this.handle.db.select().from(syncAccessRevocations).all(); + } + + writeRevocation(entry: SyncAccessRevocation): void { + this.handle.db.insert(syncAccessRevocations).values(entry) + .onConflictDoUpdate({ target: syncAccessRevocations.key, set: entry }).run(); + } + + deleteRevocation(key: string): void { + this.handle.db.delete(syncAccessRevocations).where(eq(syncAccessRevocations.key, key)).run(); + } + + prune(now: number): void { + this.handle.db.delete(syncAccessRevocations).where(lte(syncAccessRevocations.expiresAt, now)).run(); + } +} diff --git a/apps/api/src/sync-coordinator/application/dto/types.ts b/apps/api/src/sync-coordinator/application/dto/types.ts index 36f52d76..0e6a8eb9 100644 --- a/apps/api/src/sync-coordinator/application/dto/types.ts +++ b/apps/api/src/sync-coordinator/application/dto/types.ts @@ -335,6 +335,7 @@ export type ServerControlMessage = | PresenceAvailabilityMessage; export type SocketSession = { + accessVersion?: number; userId: string; localVaultId: string; vaultId: string; diff --git a/apps/api/src/sync-coordinator/application/ports/outbound/socket-gateway.ts b/apps/api/src/sync-coordinator/application/ports/outbound/socket-gateway.ts index e21730ad..b697d15e 100644 --- a/apps/api/src/sync-coordinator/application/ports/outbound/socket-gateway.ts +++ b/apps/api/src/sync-coordinator/application/ports/outbound/socket-gateway.ts @@ -8,6 +8,7 @@ import type { } from "../../dto/types"; export interface SocketGateway { + listSocketSessions(): { connectionId: string; session: SocketSession }[]; readSocketSession(connectionId: string): SocketSession | null; attachSocketSession(connectionId: string, session: SocketSession): void; sendSocketMessage(connectionId: string, message: ServerControlMessage): boolean; diff --git a/apps/api/src/sync-coordinator/application/ports/outbound/sync-access-store.ts b/apps/api/src/sync-coordinator/application/ports/outbound/sync-access-store.ts new file mode 100644 index 00000000..9b95d5fa --- /dev/null +++ b/apps/api/src/sync-coordinator/application/ports/outbound/sync-access-store.ts @@ -0,0 +1,14 @@ +/** Keys distinguish vault-wide suspension from individual user revocations. */ +export type SyncAccessRevocation = { + key: string; + /** Null for a vault-wide suspension. */ + minimumVersion: number | null; + expiresAt: number; +}; + +export interface SyncAccessStore { + readRevocations(): SyncAccessRevocation[]; + writeRevocation(revocation: SyncAccessRevocation): void; + deleteRevocation(key: string): void; + prune(now: number): void; +} diff --git a/apps/api/src/sync-coordinator/application/services/bind-coordinator-api.ts b/apps/api/src/sync-coordinator/application/services/bind-coordinator-api.ts index b1a89e0d..5122bfbe 100644 --- a/apps/api/src/sync-coordinator/application/services/bind-coordinator-api.ts +++ b/apps/api/src/sync-coordinator/application/services/bind-coordinator-api.ts @@ -16,6 +16,7 @@ export type CoordinatorApi = CoordinatorApplicationPort & { vaultId: string, ): Promise; completeSocketOpen(): Promise; + assertSessionAccess(session: SocketSession): void; readSyncPause(vaultId: string): SyncPauseState | null; detachLocalVault(session: SocketSession): Promise; stageBlob( @@ -53,6 +54,7 @@ export function bindCoordinatorApi(services: CoordinatorApiServices): Coordinato prepareSocketSession: (token, vaultId) => services.socketConnectionService.prepareSocketSession(token, vaultId), completeSocketOpen: () => services.socketConnectionService.completeSocketOpen(), + assertSessionAccess: (session) => services.socketConnectionService.assertSessionAccess(session), readSyncPause: (vaultId) => services.vaultService.readSyncPause(vaultId), repairSyncState: (vaultId) => services.vaultService.repairSyncState(vaultId), listEntryStates: (session, message) => diff --git a/apps/api/src/sync-coordinator/application/services/blob-gc-service.ts b/apps/api/src/sync-coordinator/application/services/blob-gc-service.ts index 4f56bc8e..460c6a7d 100644 --- a/apps/api/src/sync-coordinator/application/services/blob-gc-service.ts +++ b/apps/api/src/sync-coordinator/application/services/blob-gc-service.ts @@ -50,6 +50,7 @@ export class BlobGcService { HealthService, "scheduleSummaryFlush" | "notifyStorageStatusChanged" >, + private readonly mayCollect?: (vaultId: string) => Promise, ) {} async scheduleAt(dueAt: number, now = Date.now()): Promise { @@ -84,6 +85,11 @@ export class BlobGcService { return null; } + if (this.mayCollect && !(await this.mayCollect(effectiveVaultId))) { + const retryAt = (options.now ?? Date.now()) + 60 * 60 * 1000; + await this.scheduleAt(retryAt); + return retryAt; + } const now = options.now ?? Date.now(); this.unitOfWork.stores.versions.expireEntryVersions(now); const due = this.unitOfWork.stores.gc.listCollectibleBlobs( @@ -126,6 +132,7 @@ export class BlobGcService { vaultId: string, blobIds: readonly string[], ): Promise { + if (this.mayCollect && !(await this.mayCollect(vaultId))) return; const uniqueBlobIds = [...new Set(blobIds)]; if (uniqueBlobIds.length === 0) { return; diff --git a/apps/api/src/sync-coordinator/application/services/socket-connection-service.ts b/apps/api/src/sync-coordinator/application/services/socket-connection-service.ts index 223c3d71..d8916e33 100644 --- a/apps/api/src/sync-coordinator/application/services/socket-connection-service.ts +++ b/apps/api/src/sync-coordinator/application/services/socket-connection-service.ts @@ -1,18 +1,32 @@ import type { SyncTokenVerifier } from "../ports/outbound"; import type { SocketSession } from "../dto/types"; import type { HealthService } from "./health-service"; +import { SyncAccessApplicationError } from "../../../sync-access/application"; export interface VaultInitializer { ensureVaultState(vaultId: string): Promise; } export class SocketConnectionService { + private readonly preparedExpiry = new WeakMap(); + constructor( private readonly syncTokenService: SyncTokenVerifier, private readonly vaultInitializer: VaultInitializer, private readonly healthService: Pick, + private readonly assertCurrentAccess?: (session: SocketSession) => void, ) {} + /** Recheck synchronously immediately before acceptance, without yielding to a revocation. */ + assertSessionAccess(session: SocketSession): void { + const expiresAt = this.preparedExpiry.get(session) ?? 0; + if (expiresAt <= Date.now()) { + throw new SyncAccessApplicationError("invalid_token"); + } + this.assertCurrentAccess?.(session); + this.preparedExpiry.delete(session); + } + /** * Completes an accepted socket while it is registered with the gateway. * Both the Durable Object and Node upgrade paths must call this so the @@ -36,6 +50,9 @@ export class SocketConnectionService { const claims = await this.syncTokenService.verifySyncToken(token, vaultId); await this.vaultInitializer.ensureVaultState(claims.vaultId); const session = { + ...(claims.accessVersion === undefined + ? {} + : { accessVersion: claims.accessVersion }), userId: claims.sub, localVaultId: claims.localVaultId, vaultId: claims.vaultId, @@ -45,6 +62,7 @@ export class SocketConnectionService { presenceEntryId: null, presenceWatchEntryIds: [], }; + this.preparedExpiry.set(session, claims.exp * 1000); return session; } } diff --git a/apps/api/src/sync-coordinator/application/services/sync-access-service.test.ts b/apps/api/src/sync-coordinator/application/services/sync-access-service.test.ts new file mode 100644 index 00000000..c1a762a3 --- /dev/null +++ b/apps/api/src/sync-coordinator/application/services/sync-access-service.test.ts @@ -0,0 +1,184 @@ +import { afterEach, describe, expect, it, vi } from "vitest"; +import { + CoordinatorSyncAccessService, + type SyncAccessSnapshot, +} from "./sync-access-service"; +import { SocketConnectionService } from "./socket-connection-service"; +import { SqliteSyncAccessStore } from "../../adapters/outbound/sqlite/sync-access-store"; +import { + createSqliteCoordinator, + closeAllTestSqliteCoordinators, + testSession, +} from "../../adapters/outbound/sqlite/test-helpers"; +import { createMockCoordinatorSocketService } from "../../test-helpers"; + +afterEach(() => { + vi.useRealTimers(); + closeAllTestSqliteCoordinators(); +}); + +async function setup() { + const { handle } = await createSqliteCoordinator(); + const store = new SqliteSyncAccessStore(handle); + let snapshot: SyncAccessSnapshot = { + suspended: false, + grants: [{ userId: "member", accessVersion: 1 }], + }; + const readSnapshot = vi.fn(async () => snapshot); + const sessions = ["owner", "member"].map((userId) => ({ + connectionId: userId, + session: testSession({ userId, accessVersion: 1 }), + })); + const sockets = createMockCoordinatorSocketService({ + listSocketSessions: () => [...sessions], + closeSocket: vi.fn((id) => { + const index = sessions.findIndex((session) => session.connectionId === id); + if (index >= 0) sessions.splice(index, 1); + }), + }); + const create = () => new CoordinatorSyncAccessService( + store, sockets, readSnapshot, 120_000, + ); + return { + store, readSnapshot, sockets, create, service: create(), + setSnapshot: (value: Partial) => { + snapshot = { ...snapshot, ...value }; + }, + }; +} +const member = { vaultId: "vault-1", userId: "member", accessVersion: 1 }; + +describe("coordinator-local sync access", () => { + it("authorizes messages and reconnects without D1 reads", async () => { + const { service, readSnapshot } = await setup(); + service.require(member); + readSnapshot.mockRejectedValue(new Error("D1 is unavailable")); + for (let i = 0; i < 20; i++) expect(() => service.require(member)).not.toThrow(); + expect(readSnapshot).not.toHaveBeenCalled(); + }); + + it("persists the minimum version and only disconnects the revoked user's sockets", async () => { + const { service, setSnapshot, sockets, create, readSnapshot } = await setup(); + service.require(member); + setSnapshot({ grants: [{ userId: "member", accessVersion: 2 }] }); + await service.refresh("vault-1"); + expect(sockets.closeSocket).toHaveBeenCalledExactlyOnceWith("member", 1012, "vault access changed; reconnect"); + expect(() => service.require(member)).toThrow("This sync session is no longer authorized"); + expect(() => service.require({ ...member, userId: "owner" })).not.toThrow(); + + // A fresh service has no in-memory state, as after DO hibernation/restart. + const restored = create(); + readSnapshot.mockRejectedValue(new Error("D1 is unavailable")); + expect(() => restored.require(member)).toThrow("This sync session is no longer authorized"); + expect(() => restored.require({ ...member, accessVersion: 3 })).not.toThrow(); + expect(readSnapshot).toHaveBeenCalledTimes(1); + }); + + it("keeps old versions blocked through regrant and prunes after their token lifetime", async () => { + const { service, setSnapshot, store, readSnapshot } = await setup(); + vi.useFakeTimers(); + vi.setSystemTime(1_000_000); + setSnapshot({ grants: [{ userId: "member", accessVersion: 3 }] }); + await service.refresh("vault-1"); + expect(() => service.require(member)).toThrow("This sync session is no longer authorized"); + expect(() => service.require({ ...member, accessVersion: 3 })).not.toThrow(); + vi.setSystemTime(1_119_999); + service.require({ ...member, accessVersion: 3 }); + expect(store.readRevocations()).toHaveLength(1); + vi.setSystemTime(1_120_000); + service.require({ ...member, accessVersion: 3 }); + expect(store.readRevocations()).toEqual([]); + expect(readSnapshot).toHaveBeenCalledTimes(1); + }); + + it("applies subscription notifications and persists the block until renewal or token expiry", async () => { + const { service, store, setSnapshot, readSnapshot, sockets, create } = await setup(); + vi.useFakeTimers(); + vi.setSystemTime(1_000_000); + setSnapshot({ suspended: true }); + // No DO timer or D1 poll: a subscription notification initiates the change. + service.require(member); + expect(readSnapshot).not.toHaveBeenCalled(); + await service.refresh("vault-1"); + expect(sockets.closeSocket).toHaveBeenCalledTimes(2); + expect(service.authorizeVerified(member)).toMatchObject({ code: "sharing_suspended" }); + expect(create().authorizeVerified(member)).toMatchObject({ code: "sharing_suspended" }); + expect(store.readRevocations()).toEqual([ + { key: "vault", minimumVersion: null, expiresAt: 1_120_000 }, + ]); + + // Renewal removes the vault-wide block while retaining revoked members. + setSnapshot({ suspended: false, grants: [{ userId: "member", accessVersion: 2 }] }); + await service.refresh("vault-1"); + expect(() => service.require({ ...member, userId: "owner" })).not.toThrow(); + expect(() => service.require(member)).toThrow("This sync session is no longer authorized"); + expect(store.readRevocations()).toEqual([ + { key: "user:member", minimumVersion: 2, expiresAt: 1_120_000 }, + ]); + }); + + it("retains successful revocations when a later refresh fails and can retry", async () => { + const { service, setSnapshot, readSnapshot, create } = await setup(); + setSnapshot({ grants: [{ userId: "member", accessVersion: 2 }] }); + await service.refresh("vault-1"); + readSnapshot.mockRejectedValueOnce(new Error("D1 unavailable")); + await expect(service.refresh("vault-1")).rejects.toThrow("D1 unavailable"); + expect(() => create().require(member)).toThrow("This sync session is no longer authorized"); + await expect(service.refresh("vault-1")).resolves.toBeUndefined(); + }); + + it("rejects a prepared socket if access changes before native acceptance", async () => { + const { service, setSnapshot } = await setup(); + const connectionService = new SocketConnectionService( + { + verifySyncToken: async () => { + service.require(member); + return { + sub: member.userId, + vaultId: member.vaultId, + accessVersion: member.accessVersion, + localVaultId: "local-1", + displayName: "Member", + scope: "vault:sync", + iat: Math.floor(Date.now() / 1000), + exp: Math.floor(Date.now() / 1000) + 120, + }; + }, + }, + { + ensureVaultState: async () => { + setSnapshot({ grants: [{ userId: "member", accessVersion: 2 }] }); + await service.refresh("vault-1"); + }, + }, + { scheduleSummaryFlush: async () => {} }, + (session) => service.require({ + vaultId: session.vaultId, + userId: session.userId, + accessVersion: session.accessVersion ?? 1, + }), + ); + const prepared = await connectionService.prepareSocketSession("token", "vault-1"); + expect(() => connectionService.assertSessionAccess(prepared)).toThrow( + "This sync session is no longer authorized", + ); + + // A delayed handshake must not slip through after revocation records expire. + vi.useFakeTimers(); + vi.setSystemTime(Date.now() + 121_000); + service.require({ ...member, accessVersion: 3 }); + expect(() => connectionService.assertSessionAccess(prepared)).toThrow("invalid_token"); + }); + + it("reloads persisted revocations even when a later storage operation fails", async () => { + const { service, store, setSnapshot } = await setup(); + service.require(member); + setSnapshot({ grants: [{ userId: "member", accessVersion: 2 }] }); + vi.spyOn(store, "deleteRevocation").mockImplementationOnce(() => { + throw new Error("storage unavailable"); + }); + await expect(service.refresh("vault-1")).rejects.toThrow("storage unavailable"); + expect(() => service.require(member)).toThrow("This sync session is no longer authorized"); + await expect(service.refresh("vault-1")).resolves.toBeUndefined(); + }); +}); diff --git a/apps/api/src/sync-coordinator/application/services/sync-access-service.ts b/apps/api/src/sync-coordinator/application/services/sync-access-service.ts new file mode 100644 index 00000000..e889a2f5 --- /dev/null +++ b/apps/api/src/sync-coordinator/application/services/sync-access-service.ts @@ -0,0 +1,142 @@ +import { SharingError } from "../../../sharing/application/types"; +import type { SocketGateway } from "../ports/outbound"; +import type { + SyncAccessStore, + SyncAccessRevocation, +} from "../ports/outbound/sync-access-store"; + +/** The API has already verified the token's signature, expiry and vault scope. */ +export type VerifiedVaultAccess = { + vaultId: string; + userId: string; + accessVersion: number; +}; +export type VaultAccessDecision = + | { ok: true } + | { ok: false; status: 403 | 503; code: string; message: string }; +export type SyncAccessSnapshot = { + suspended: boolean; + grants: { userId: string; accessVersion: number }[]; +}; + +const VAULT_SUSPENSION_KEY = "vault"; +const userRevocationKey = (userId: string) => `user:${userId}`; + +/** D1 is read only when an access change or subscription webhook reaches this vault. */ +export class CoordinatorSyncAccessService { + private revocations: Map | undefined; + private nextExpiry = Infinity; + private refreshTail: Promise = Promise.resolve(); + + constructor( + private readonly store: SyncAccessStore, + private readonly sockets: SocketGateway, + private readonly readSnapshot: (vaultId: string) => Promise, + private readonly tokenLifetimeMs: number, + ) {} + + /** Synchronous so socket acceptance can recheck without yielding to a revocation. */ + require(input: VerifiedVaultAccess): void { + this.load(); + const error = this.denial(input.userId, input.accessVersion); + if (error) throw error; + } + + authorizeVerified(input: VerifiedVaultAccess): VaultAccessDecision { + try { + this.require(input); + return { ok: true }; + } catch (error) { + if (error instanceof SharingError) { + return { + ok: false, + status: error.status === 503 ? 503 : 403, + code: error.code, + message: error.message, + }; + } + return { + ok: false, + status: 503, + code: "access_unavailable", + message: "Vault access could not be verified", + }; + } + } + + refresh(vaultId: string): Promise { + // Serialize refreshes so a slower, older D1 read cannot undo a newer change. + const refresh = this.refreshTail.catch(() => {}).then(async () => { + const snapshot = await this.readSnapshot(vaultId); + this.load(); + const expiresAt = Date.now() + this.tokenLifetimeMs; + try { + for (const grant of snapshot.grants) { + if (grant.accessVersion <= 1) continue; + const key = userRevocationKey(grant.userId); + const previous = this.revocations?.get(key); + this.store.writeRevocation({ + key, + minimumVersion: Math.max(grant.accessVersion, previous?.minimumVersion ?? 0), + expiresAt: Math.max(expiresAt, previous?.expiresAt ?? 0), + }); + } + if (snapshot.suspended) { + this.store.writeRevocation({ + key: VAULT_SUSPENSION_KEY, + minimumVersion: null, + expiresAt, + }); + } else { + // Renewal clears only the vault-wide block, never a user's revocation. + this.store.deleteRevocation(VAULT_SUSPENSION_KEY); + } + } finally { + // Reload even after a partial persistence failure; never keep a stale cache. + this.revocations = undefined; + this.load(); + } + this.closeDeniedSockets(); + }); + this.refreshTail = refresh; + return refresh; + } + + private load(): void { + if (!this.revocations) { + this.revocations = new Map(this.store.readRevocations().map((entry) => [entry.key, entry])); + this.nextExpiry = this.earliestExpiry(); + } + const now = Date.now(); + if (this.nextExpiry > now) return; + // No alarm or polling: expired blocks are discarded on the next access. + this.store.prune(now); + for (const [key, entry] of this.revocations) { + if (entry.expiresAt <= now) this.revocations.delete(key); + } + this.nextExpiry = this.earliestExpiry(); + } + + private earliestExpiry(): number { + return Math.min(...[...(this.revocations?.values() ?? [])].map((entry) => entry.expiresAt)); + } + + private denial(userId: string, version: number): SharingError | null { + if (this.revocations?.has(VAULT_SUSPENSION_KEY)) { + return new SharingError(403, "sharing_suspended", "Shared vault sync is paused until the organization renews Sync Plus"); + } + const revoked = this.revocations?.get(userRevocationKey(userId)); + if (revoked?.minimumVersion != null && version < revoked.minimumVersion) { + return new SharingError(403, "vault_access_denied", "This sync session is no longer authorized"); + } + return null; + } + + private closeDeniedSockets(): void { + for (const { connectionId, session } of this.sockets.listSocketSessions()) { + if (this.denial(session.userId, session.accessVersion ?? 1)) { + this.sockets.closeSocket(connectionId, 1012, "vault access changed; reconnect"); + } + } + } +} diff --git a/apps/api/src/sync-coordinator/test-helpers.ts b/apps/api/src/sync-coordinator/test-helpers.ts index 51a27a1c..8cb9a676 100644 --- a/apps/api/src/sync-coordinator/test-helpers.ts +++ b/apps/api/src/sync-coordinator/test-helpers.ts @@ -163,6 +163,7 @@ export function createMockCoordinatorSocketService( ): SocketGateway { return { readSocketSession: vi.fn(() => null), + listSocketSessions: vi.fn(() => []), attachSocketSession: vi.fn(), sendSocketMessage: vi.fn(() => true), broadcastStorageStatus: vi.fn(), diff --git a/apps/api/src/vault/adapters/inbound/http/routes.ts b/apps/api/src/vault/adapters/inbound/http/routes.ts index 421b8517..97df1ceb 100644 --- a/apps/api/src/vault/adapters/inbound/http/routes.ts +++ b/apps/api/src/vault/adapters/inbound/http/routes.ts @@ -38,6 +38,7 @@ export function registerVaultRoutes( zValidator( "json", z.object({ + organizationId: z.string().min(1).optional(), name: z.string().trim().min(1), initialWrapper: z.object({ kind: z.literal("password"), @@ -48,7 +49,7 @@ export function registerVaultRoutes( async (c) => { const user = c.var.user; const body = c.req.valid("json"); - const created = await deps.vaultService.createVault(user.id, body.name, body.initialWrapper); + const created = await deps.vaultService.createVault(user.id, body.name, body.initialWrapper, body.organizationId); return c.json( { @@ -167,47 +168,4 @@ export function registerVaultRoutes( }, ); - app.post( - "/v1/vaults/:vaultId/members", - ensureAuthenticatedSession, - zValidator( - "param", - z.object({ - vaultId: z.string().trim().min(1), - }), - ), - zValidator( - "json", - z.object({ - userId: z.string().trim().min(1), - role: z.enum(["admin", "member"]), - memberWrapper: z.object({ - kind: z.literal("member"), - envelope: vaultKeyEnvelopeSchema, - }), - }), - ), - async (c) => { - const user = c.var.user; - const { vaultId } = c.req.valid("param"); - const body = c.req.valid("json"); - const wrapper = await deps.vaultService.grantVaultAccess(user.id, vaultId, body); - - return c.json( - { - wrapper: { - id: wrapper.id, - vaultId: wrapper.vaultId, - keyVersion: wrapper.keyVersion, - kind: wrapper.kind, - userId: wrapper.userId, - envelope: wrapper.envelope, - createdAt: wrapper.createdAt.toISOString(), - revokedAt: wrapper.revokedAt?.toISOString() ?? null, - }, - }, - 201, - ); - }, - ); } diff --git a/apps/api/src/vault/adapters/outbound/drizzle-vault-store.ts b/apps/api/src/vault/adapters/outbound/drizzle-vault-store.ts index 2be9e571..e1783e1c 100644 --- a/apps/api/src/vault/adapters/outbound/drizzle-vault-store.ts +++ b/apps/api/src/vault/adapters/outbound/drizzle-vault-store.ts @@ -1,3 +1,4 @@ +import { VaultApplicationError } from "../../application/errors/vault-errors"; import { and, asc, eq, gt, isNotNull, isNull, lte, or, sql } from "drizzle-orm"; import type { AppDb } from "../../../db/client"; @@ -36,7 +37,6 @@ export class DrizzleVaultStore vaultId: schema.vault.id, organizationId: schema.vault.organizationId, deletedAt: schema.vault.deletedAt, - vaultMembershipRole: schema.vaultMembership.role, vaultMembershipStatus: schema.vaultMembership.status, organizationRole: schema.member.role, }) @@ -55,9 +55,7 @@ export class DrizzleVaultStore eq(schema.member.userId, userId), ), ) - .where( - eq(schema.vault.id, vaultId), - ) + .where(eq(schema.vault.id, vaultId)) .limit(1); const row = rows[0]; @@ -69,12 +67,9 @@ export class DrizzleVaultStore } : null, vaultMembership: - row?.vaultMembershipRole !== null && - row?.vaultMembershipRole !== undefined && row?.vaultMembershipStatus !== null && row?.vaultMembershipStatus !== undefined ? { - role: row.vaultMembershipRole, status: row.vaultMembershipStatus, } : null, @@ -95,21 +90,24 @@ export class DrizzleVaultStore organizationId: schema.vault.organizationId, name: schema.vault.name, activeKeyVersion: schema.vault.activeKeyVersion, + sharedAt: schema.vault.sharedAt, createdAt: schema.vault.createdAt, deletedAt: schema.vault.deletedAt, purgeStatus: schema.vault.purgeStatus, purgeError: schema.vault.purgeError, }) .from(schema.vault) - .innerJoin( + .leftJoin( schema.vaultMembership, - eq(schema.vaultMembership.vaultId, schema.vault.id), + and(eq(schema.vaultMembership.vaultId, schema.vault.id), eq(schema.vaultMembership.userId, userId)), + ) + .innerJoin( + schema.member, + eq(schema.member.organizationId, schema.vault.organizationId), ) - .innerJoin(schema.member, eq(schema.member.organizationId, schema.vault.organizationId)) .where( and( - eq(schema.vaultMembership.userId, userId), - eq(schema.vaultMembership.status, "active"), + or(eq(schema.vaultMembership.status, "active"), sql`${schema.member.role} in ('owner','admin')`), eq(schema.member.userId, userId), deletionFilter, ), @@ -142,7 +140,9 @@ export class DrizzleVaultStore return rows.length; } - async listActiveVaultIdsForOrganization(organizationId: string): Promise { + async listActiveVaultIdsForOrganization( + organizationId: string, + ): Promise { const rows = await this.db .select({ id: schema.vault.id, @@ -185,50 +185,43 @@ export class DrizzleVaultStore organizationId: string, name: string, initialWrapper: VaultKeyWrapperInput, + maxVaults = 0, ): Promise { const vaultId = crypto.randomUUID(); - const wrapperId = crypto.randomUUID(); - // `.batch()`, not `.transaction()`: D1 rejects real SQL - // BEGIN/SAVEPOINT transactions at runtime (it requires its own - // storage-level transaction API instead), so drizzle's `.transaction()` - // - despite type-checking fine - throws against real D1. `.batch()` is - // the one atomic multi-write primitive both D1 and libSQL genuinely - // support with the same signature. + const now = Date.now(); + // D1/libSQL batch is atomic; the conditional INSERT reserves the quota slot. + // Dependent writes select that row, so a failed reservation creates nothing. const [rows] = await this.db.batch([ this.db .insert(schema.vault) - .values({ - id: vaultId, - organizationId, - name, - activeKeyVersion: initialWrapper.envelope.keyVersion, - }) + .select( + sql`SELECT ${vaultId}, ${organizationId}, ${name}, null, ${initialWrapper.envelope.keyVersion}, ${now}, null, null, null + WHERE (${maxVaults}=0 OR (SELECT count(*) FROM vault WHERE organization_id=${organizationId} AND deleted_at IS NULL)<${maxVaults}) + AND EXISTS (SELECT 1 FROM member WHERE organization_id=${organizationId} AND user_id=${userId} AND role IN ('owner','admin'))`, + ) .returning(), - this.db.insert(schema.vaultKeyWrapper).values({ - id: wrapperId, - vaultId, - keyVersion: initialWrapper.envelope.keyVersion, - kind: initialWrapper.kind, - userId, - envelopeJson: initialWrapper.envelope, - }), - this.db.insert(schema.vaultMembership).values({ - vaultId, - userId, - role: "owner", - status: "active", - }), + this.db + .insert(schema.vaultKeyWrapper) + .select( + sql`SELECT ${crypto.randomUUID()}, ${vaultId}, ${initialWrapper.envelope.keyVersion}, ${initialWrapper.kind}, ${userId}, ${JSON.stringify(initialWrapper.envelope)}, ${now}, null FROM vault WHERE id=${vaultId}`, + ), + this.db + .insert(schema.vaultMembership) + .select( + sql`SELECT ${vaultId}, ${userId}, 1, 1, 0, 'active', ${now}, null FROM vault WHERE id=${vaultId}`, + ), ]); - - const created = rows[0]; - if (!created) { - throw new Error("vault was not created"); - } - - return toVaultRecord(created); + if (!rows[0]) + throw new VaultApplicationError("vault_limit_exceeded", { + planName: "Organization", + limit: maxVaults, + }); + return toVaultRecord(rows[0]); } - async readDefaultOrganizationIdForUser(userId: string): Promise { + async readDefaultOrganizationIdForUser( + userId: string, + ): Promise { const rows = await this.db .select({ organizationId: schema.member.organizationId, @@ -241,7 +234,10 @@ export class DrizzleVaultStore return rows[0]?.organizationId ?? null; } - async userIsOrganizationMember(userId: string, organizationId: string): Promise { + async userIsOrganizationMember( + userId: string, + organizationId: string, + ): Promise { const rows = await this.db .select({ userId: schema.member.userId, @@ -308,10 +304,10 @@ export class DrizzleVaultStore }) .from(schema.vault) .innerJoin( - schema.vaultMembership, - eq(schema.vaultMembership.vaultId, schema.vault.id), + schema.member, + eq(schema.member.organizationId, schema.vault.organizationId), ) - .innerJoin(schema.user, eq(schema.user.id, schema.vaultMembership.userId)) + .innerJoin(schema.user, eq(schema.user.id, schema.member.userId)) .leftJoin( schema.vaultSyncStatus, eq(schema.vaultSyncStatus.vaultId, schema.vault.id), @@ -319,8 +315,8 @@ export class DrizzleVaultStore .where( and( isNull(schema.vault.deletedAt), - eq(schema.vaultMembership.role, "owner"), - eq(schema.vaultMembership.status, "active"), + isNull(schema.vault.sharedAt), + eq(schema.member.role, "owner"), lte( sql`coalesce(${schema.vaultSyncStatus.lastCommitAt}, ${schema.vault.createdAt})`, inactiveSince, @@ -341,7 +337,9 @@ export class DrizzleVaultStore purgeStatus: "running", purgeError: null, }) - .where(and(eq(schema.vault.id, vaultId), isNotNull(schema.vault.deletedAt))); + .where( + and(eq(schema.vault.id, vaultId), isNotNull(schema.vault.deletedAt)), + ); } async markVaultPurgeFailed(vaultId: string, message: string): Promise { @@ -351,10 +349,15 @@ export class DrizzleVaultStore purgeStatus: "failed", purgeError: message, }) - .where(and(eq(schema.vault.id, vaultId), isNotNull(schema.vault.deletedAt))); + .where( + and(eq(schema.vault.id, vaultId), isNotNull(schema.vault.deletedAt)), + ); } - async markVaultDeletionQueueFailed(vaultId: string, message: string): Promise { + async markVaultDeletionQueueFailed( + vaultId: string, + message: string, + ): Promise { await this.db .update(schema.vault) .set({ @@ -369,63 +372,6 @@ export class DrizzleVaultStore await this.db.delete(schema.vault).where(eq(schema.vault.id, vaultId)); } - async addVaultMember( - vaultId: string, - userId: string, - role: "admin" | "member", - wrapper: VaultKeyWrapperInput, - ): Promise { - const rows = await this.db - .insert(schema.vaultKeyWrapper) - .values({ - id: crypto.randomUUID(), - vaultId, - keyVersion: wrapper.envelope.keyVersion, - kind: wrapper.kind, - userId, - envelopeJson: wrapper.envelope, - revokedAt: null, - }) - .onConflictDoUpdate({ - target: [ - schema.vaultKeyWrapper.vaultId, - schema.vaultKeyWrapper.kind, - schema.vaultKeyWrapper.userId, - ], - set: { - keyVersion: wrapper.envelope.keyVersion, - envelopeJson: wrapper.envelope, - revokedAt: null, - }, - }) - .returning(); - - const created = rows[0]; - if (!created) { - throw new Error(`member wrapper for vault ${vaultId} was not written`); - } - - await this.db - .insert(schema.vaultMembership) - .values({ - vaultId, - userId, - role, - status: "active", - revokedAt: null, - }) - .onConflictDoUpdate({ - target: [schema.vaultMembership.vaultId, schema.vaultMembership.userId], - set: { - role, - status: "active", - revokedAt: null, - }, - }); - - return toVaultKeyWrapperRecord(created); - } - async readVaultBootstrapForUser( userId: string, vaultId: string, @@ -444,7 +390,10 @@ export class DrizzleVaultStore isNull(schema.vaultKeyWrapper.revokedAt), or( eq(schema.vaultKeyWrapper.userId, userId), - isNull(schema.vaultKeyWrapper.userId), + and( + isNull(schema.vaultKeyWrapper.userId), + sql`${vault.sharedAt === null}`, + ), ), ), ) @@ -461,44 +410,37 @@ export class DrizzleVaultStore vaultId: string, envelope: VaultKeyEnvelope, ): Promise { - const rows = await this.db - .insert(schema.vaultKeyWrapper) - .values({ - id: crypto.randomUUID(), - vaultId, - keyVersion: envelope.keyVersion, - kind: "password", - userId, - envelopeJson: envelope, - revokedAt: null, - }) - .onConflictDoUpdate({ - target: [ - schema.vaultKeyWrapper.vaultId, - schema.vaultKeyWrapper.kind, - schema.vaultKeyWrapper.userId, - ], - set: { - keyVersion: envelope.keyVersion, - envelopeJson: envelope, - revokedAt: null, - }, - }) - .returning(); - - const wrapper = rows[0]; - if (!wrapper) { - throw new Error(`password wrapper for vault ${vaultId} was not written`); - } - - await this.db - .update(schema.vault) - .set({ - activeKeyVersion: envelope.keyVersion, - }) - .where(and(eq(schema.vault.id, vaultId), isNull(schema.vault.deletedAt))); - - return toVaultKeyWrapperRecord(wrapper); + const authorized = sql`exists (select 1 from vault v join vault_membership m on m.vault_id=v.id join member o on o.organization_id=v.organization_id and o.user_id=m.user_id where v.id=${vaultId} and v.deleted_at is null and m.user_id=${userId} and m.status='active' and v.active_key_version=${envelope.keyVersion})`; + const [rows] = await this.db.batch([ + this.db + .insert(schema.vaultKeyWrapper) + .select( + sql`select ${crypto.randomUUID()}, ${vaultId}, ${envelope.keyVersion}, 'password', ${userId}, ${JSON.stringify(envelope)}, ${Date.now()}, null where ${authorized}`, + ) + .onConflictDoUpdate({ + target: [ + schema.vaultKeyWrapper.vaultId, + schema.vaultKeyWrapper.kind, + schema.vaultKeyWrapper.userId, + ], + set: { envelopeJson: envelope, revokedAt: null }, + }) + .returning(), + // An older recovery must not overwrite a password that was just changed. + this.db + .update(schema.vaultKeyRequest) + .set({ status: "canceled", envelopeJson: null }) + .where( + and( + eq(schema.vaultKeyRequest.vaultId, vaultId), + eq(schema.vaultKeyRequest.userId, userId), + sql`${schema.vaultKeyRequest.status} in ('pending','approved')`, + authorized, + ), + ), + ]); + if (!rows[0]) throw new VaultApplicationError("forbidden"); + return toVaultKeyWrapperRecord(rows[0]); } private async readAccessibleVaultRowForUser( @@ -511,6 +453,7 @@ export class DrizzleVaultStore organizationId: schema.vault.organizationId, name: schema.vault.name, activeKeyVersion: schema.vault.activeKeyVersion, + sharedAt: schema.vault.sharedAt, createdAt: schema.vault.createdAt, deletedAt: schema.vault.deletedAt, purgeStatus: schema.vault.purgeStatus, @@ -521,7 +464,10 @@ export class DrizzleVaultStore schema.vaultMembership, eq(schema.vaultMembership.vaultId, schema.vault.id), ) - .innerJoin(schema.member, eq(schema.member.organizationId, schema.vault.organizationId)) + .innerJoin( + schema.member, + eq(schema.member.organizationId, schema.vault.organizationId), + ) .where( and( eq(schema.vault.id, vaultId), @@ -550,8 +496,15 @@ function toVaultRecord(row: typeof schema.vault.$inferSelect): VaultRecord { }; } -function isVaultPurgeStatus(value: unknown): value is VaultRecord["purgeStatus"] { - return value === "queued" || value === "running" || value === "failed" || value === null; +function isVaultPurgeStatus( + value: unknown, +): value is VaultRecord["purgeStatus"] { + return ( + value === "queued" || + value === "running" || + value === "failed" || + value === null + ); } function toVaultKeyWrapperRecord( diff --git a/apps/api/src/vault/application/dto/vault-key-envelope.ts b/apps/api/src/vault/application/dto/vault-key-envelope.ts index 0d90241e..2eb51584 100644 --- a/apps/api/src/vault/application/dto/vault-key-envelope.ts +++ b/apps/api/src/vault/application/dto/vault-key-envelope.ts @@ -39,8 +39,9 @@ function base64DecodedLength(value: string): number | null { } } -export const vaultKeyEnvelopeSchema: z.ZodType = z.object({ - version: z.literal(VAULT_KEY_ENVELOPE_VERSION), +const envelopeFields = z.object({ + version: z.union([z.literal(VAULT_KEY_ENVELOPE_VERSION), z.literal(2)]), + binding: z.object({ vaultId: z.string().min(1), userId: z.string().min(1) }).optional(), keyVersion: z.literal(VAULT_KEY_ENVELOPE_KEY_VERSION), kdf: z.object({ name: z.literal("argon2id"), @@ -55,3 +56,5 @@ export const vaultKeyEnvelopeSchema: z.ZodType = z.object({ ciphertext: base64Bytes(WRAPPED_VAULT_KEY_BYTES), }), }); + +export const vaultKeyEnvelopeSchema: z.ZodType = envelopeFields.refine(e => e.version === 2 ? !!e.binding : !e.binding, { message: "Wrapper binding must match its format version" }); diff --git a/apps/api/src/vault/application/ports/inbound/vault-service.ts b/apps/api/src/vault/application/ports/inbound/vault-service.ts index 6a1d7193..11aa43e6 100644 --- a/apps/api/src/vault/application/ports/inbound/vault-service.ts +++ b/apps/api/src/vault/application/ports/inbound/vault-service.ts @@ -16,6 +16,7 @@ export interface VaultService { userId: string, name: string, initialWrapper: VaultKeyWrapperInput, + selectedOrganizationId?: string, ): Promise; getVaultBootstrap(userId: string, vaultId: string): Promise; replacePasswordWrapper( @@ -27,13 +28,4 @@ export interface VaultService { getAccessibleVault(userId: string, vaultId: string): Promise; userCanManageVault(userId: string, vaultId: string): Promise; deleteVault(userId: string, vaultId: string): Promise; - grantVaultAccess( - requesterUserId: string, - vaultId: string, - input: { - userId: string; - role: "admin" | "member"; - memberWrapper: VaultKeyWrapperInput & { kind: "member" }; - }, - ): Promise; } diff --git a/apps/api/src/vault/application/ports/outbound/vault-key-store.ts b/apps/api/src/vault/application/ports/outbound/vault-key-store.ts index 7cc8134f..717d736f 100644 --- a/apps/api/src/vault/application/ports/outbound/vault-key-store.ts +++ b/apps/api/src/vault/application/ports/outbound/vault-key-store.ts @@ -11,16 +11,11 @@ export interface VaultKeyStore { organizationId: string, name: string, initialWrapper: VaultKeyWrapperInput, + maxVaults?: number, ): Promise; upsertPasswordWrapperForUser( userId: string, vaultId: string, envelope: VaultKeyEnvelope, ): Promise; - addVaultMember( - vaultId: string, - userId: string, - role: "admin" | "member", - wrapper: VaultKeyWrapperInput, - ): Promise; } diff --git a/apps/api/src/vault/application/services/vault-service.test.ts b/apps/api/src/vault/application/services/vault-service.test.ts index f394fe24..98ebbd9c 100644 --- a/apps/api/src/vault/application/services/vault-service.test.ts +++ b/apps/api/src/vault/application/services/vault-service.test.ts @@ -46,7 +46,7 @@ function setup(overrides: Record = {}) { })), readVaultAuthorizationFacts: vi.fn(async () => ({ vault: { organizationId: "org-1", deleted: false }, - vaultMembership: { role: "owner", status: "active" }, + vaultMembership: { status: "active" }, organizationRole: "owner", })), markVaultDeletionQueued: vi.fn(async () => true), @@ -87,6 +87,7 @@ describe("VaultApplicationService", () => { "org-1", "Personal", INITIAL_WRAPPER, + 1, ); }); diff --git a/apps/api/src/vault/application/services/vault-service.ts b/apps/api/src/vault/application/services/vault-service.ts index db9bb75d..3a06b695 100644 --- a/apps/api/src/vault/application/services/vault-service.ts +++ b/apps/api/src/vault/application/services/vault-service.ts @@ -1,7 +1,6 @@ import type { SubscriptionPolicyReader } from "../../../subscription/application"; import { canAccessVault, - canGrantVaultAccess, canManageVault, } from "../../domain/policy"; import type { @@ -28,6 +27,7 @@ export class VaultApplicationService implements VaultService { private readonly lifecycleStore: VaultLifecycleStore, private readonly policyReader: SubscriptionPolicyReader, private readonly purgeQueue: VaultPurgeQueue, + private readonly canCreateInOrganization?: (userId: string, organizationId: string) => Promise, ) {} async listVaults( @@ -41,12 +41,14 @@ export class VaultApplicationService implements VaultService { userId: string, name: string, initialWrapper: VaultKeyWrapperInput, + selectedOrganizationId?: string, ): Promise { - const organizationId = await this.catalogStore.readDefaultOrganizationIdForUser(userId); + const organizationId = selectedOrganizationId ?? await this.catalogStore.readDefaultOrganizationIdForUser(userId); if (!organizationId) { throw new VaultApplicationError("organization_required"); } + if (this.canCreateInOrganization && !await this.canCreateInOrganization(userId, organizationId)) throw new VaultApplicationError("forbidden"); const policy = await this.policyReader.readOrganizationPolicy(organizationId); const existingVaultCount = await this.catalogStore.countVaultsForOrganization(organizationId); @@ -74,6 +76,7 @@ export class VaultApplicationService implements VaultService { organizationId, name, initialWrapper, + policy.limits.syncedVaults, ); } @@ -91,9 +94,11 @@ export class VaultApplicationService implements VaultService { vaultId: string, envelope: VaultKeyEnvelope, ): Promise { - if (!(await this.userCanManageVault(userId, vaultId))) { + if (!(await this.userCanAccessVault(userId, vaultId))) { throw new VaultApplicationError("forbidden"); } + const vault = await this.catalogStore.readAccessibleVaultForUser(userId, vaultId); + if (!vault || envelope.keyVersion !== vault.activeKeyVersion || (envelope.version === 2 && (envelope.binding?.userId !== userId || envelope.binding?.vaultId !== vaultId))) throw new VaultApplicationError("forbidden"); return await this.keyStore.upsertPasswordWrapperForUser( userId, @@ -139,41 +144,4 @@ export class VaultApplicationService implements VaultService { return { vaultId, deletionStatus: "queued" }; } - async grantVaultAccess( - requesterUserId: string, - vaultId: string, - input: { - userId: string; - role: "admin" | "member"; - memberWrapper: VaultKeyWrapperInput & { kind: "member" }; - }, - ): Promise { - const authorizationFacts = - await this.authorizationStore.readVaultAuthorizationFacts( - requesterUserId, - vaultId, - ); - if (!canGrantVaultAccess(authorizationFacts)) { - throw new VaultApplicationError("forbidden"); - } - - const organizationId = await this.catalogStore.readVaultOrganizationId(vaultId); - if (!organizationId) { - throw new VaultApplicationError("not_found"); - } - - if ( - !(await this.authorizationStore.userIsOrganizationMember(input.userId, organizationId)) - ) { - throw new VaultApplicationError("not_organization_member"); - } - - return await this.keyStore.addVaultMember( - vaultId, - input.userId, - input.role, - input.memberWrapper, - ); - } - } diff --git a/apps/api/src/vault/domain/policy.test.ts b/apps/api/src/vault/domain/policy.test.ts index d8f31a0b..2ccce876 100644 --- a/apps/api/src/vault/domain/policy.test.ts +++ b/apps/api/src/vault/domain/policy.test.ts @@ -9,7 +9,7 @@ import { const activeMember: VaultAuthorizationFacts = { vault: { organizationId: "org-1", deleted: false }, - vaultMembership: { role: "member", status: "active" }, + vaultMembership: { status: "active" }, organizationRole: "member", }; @@ -20,11 +20,12 @@ describe("vault authorization policy", () => { expect(canGrantVaultAccess(activeMember)).toBe(false); }); - it("allows active vault owners and admins to manage and grant access", () => { + it("allows organization owners and admins to manage and grant access", () => { for (const role of ["owner", "admin"]) { const facts = { ...activeMember, - vaultMembership: { role, status: "active" }, + organizationRole: role, + vaultMembership: null, } satisfies VaultAuthorizationFacts; expect(canManageVault(facts)).toBe(true); @@ -40,7 +41,7 @@ describe("vault authorization policy", () => { } satisfies VaultAuthorizationFacts; expect(canAccessVault(facts)).toBe(false); - expect(canManageVault(facts)).toBe(false); + expect(canManageVault(facts)).toBe(true); expect(canGrantVaultAccess(facts)).toBe(true); }); @@ -48,7 +49,7 @@ describe("vault authorization policy", () => { const facts = { ...activeMember, vault: { organizationId: "org-1", deleted: true }, - vaultMembership: { role: "owner", status: "active" }, + vaultMembership: { status: "active" }, organizationRole: "owner", } satisfies VaultAuthorizationFacts; diff --git a/apps/api/src/vault/domain/policy.ts b/apps/api/src/vault/domain/policy.ts index 788a66af..ffe5d954 100644 --- a/apps/api/src/vault/domain/policy.ts +++ b/apps/api/src/vault/domain/policy.ts @@ -4,7 +4,6 @@ export type VaultAuthorizationFacts = { deleted: boolean; } | null; vaultMembership: { - role: string; status: string; } | null; organizationRole: string | null; @@ -21,19 +20,14 @@ export function canAccessVault(facts: VaultAuthorizationFacts): boolean { export function canManageVault(facts: VaultAuthorizationFacts): boolean { return ( - canAccessVault(facts) && - (facts.vaultMembership?.role === "owner" || - facts.vaultMembership?.role === "admin") + facts.vault !== null && + !facts.vault.deleted && + (facts.organizationRole === "owner" || facts.organizationRole === "admin") ); } export function canGrantVaultAccess(facts: VaultAuthorizationFacts): boolean { - return ( - canManageVault(facts) || - (facts.vault !== null && - !facts.vault.deleted && - facts.organizationRole === "owner") - ); + return canManageVault(facts); } /** Free remote vaults are deleted after 90 days without a synced change. */ diff --git a/apps/api/src/vault/domain/types.ts b/apps/api/src/vault/domain/types.ts index 4102b3ce..b5c176ff 100644 --- a/apps/api/src/vault/domain/types.ts +++ b/apps/api/src/vault/domain/types.ts @@ -15,6 +15,7 @@ export type VaultKeyWrapMetadata = { }; export type VaultKeyEnvelope = { + binding?: { vaultId: string; userId: string }; version: number; keyVersion: number; kdf: VaultKeyDerivationMetadata; diff --git a/apps/api/test/integration/sharing-refresh.test.ts b/apps/api/test/integration/sharing-refresh.test.ts new file mode 100644 index 00000000..116f9eab --- /dev/null +++ b/apps/api/test/integration/sharing-refresh.test.ts @@ -0,0 +1,64 @@ +import { env } from "cloudflare:workers"; +import { describe, expect, it, vi } from "vitest"; +import { createDb } from "../../src/db/client"; +import * as schema from "../../src/db/d1"; +import { DrizzleSharingStore } from "../../src/sharing/adapters/drizzle-sharing-store"; +import { runScheduledTasks, SHARING_REFRESH_CRON } from "../../src/runtime/scheduled"; +import { + SYNC_WEBSOCKET_PROTOCOL, + SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX, +} from "../../src/sync-access/application"; +import { apiRequest, issueSyncToken, signUpAccount, signUpAndCreateVault } from "../helpers/api"; + +describe("scheduled sharing refresh", () => { + it.each([true, false])("retries durable revocations without a management request (self-hosted=%s)", async (selfHosted) => { + const owner = await signUpAndCreateVault(); + const member = await signUpAccount(); + const db = createDb(env.DB); + await db.insert(schema.member).values({ + id: crypto.randomUUID(), organizationId: owner.organizationId, + userId: member.userId, role: "member", createdAt: new Date(), + }); + await db.insert(schema.vaultMembership).values({ + vaultId: owner.vaultId, userId: member.userId, status: "active", + }); + const token = await issueSyncToken(member.sessionCookie, owner.vaultId, "member-device"); + const response = await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { + Upgrade: "websocket", + "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${token.token}`, + }, + }); + expect(response.status).toBe(101); + const socket = response.webSocket!; + socket.accept(); + const log = vi.spyOn(console, "error").mockImplementation(() => {}); + try { + const store = new DrizzleSharingStore(db); + await store.revoke([owner.vaultId], member.userId); + const tasks = await store.refreshes(); + expect(tasks).toHaveLength(1); + // No purge binding: frequent retries must not invoke vault retention. + const scheduledEnv = { ...env, SELF_HOSTED: selfHosted, VAULT_PURGE_QUEUE: undefined }; + await runScheduledTasks({ + ...scheduledEnv, + SYNC_COORDINATOR: { + getByName: () => ({ fetch: async () => new Response(null, { status: 503 }) }), + } as unknown as typeof env.SYNC_COORDINATOR, + }, SHARING_REFRESH_CRON); + expect(await store.refreshes()).toEqual(tasks); + const heartbeat = new Promise((resolve) => socket.addEventListener("message", (event) => { + resolve(JSON.parse(String(event.data))); + }, { once: true })); + socket.send(JSON.stringify({ type: "heartbeat", requestId: "during-outage" })); + expect(await heartbeat).toMatchObject({ type: "heartbeat_ack", requestId: "during-outage" }); + const closed = new Promise((resolve) => socket.addEventListener("close", (event) => resolve(event.code), { once: true })); + await runScheduledTasks(scheduledEnv, SHARING_REFRESH_CRON); + expect(await closed).toBe(1012); + expect(await store.refreshes()).toEqual([]); + } finally { + log.mockRestore(); + if (socket.readyState === WebSocket.OPEN) socket.close(); + } + }); +}); diff --git a/apps/api/test/integration/sharing.test.ts b/apps/api/test/integration/sharing.test.ts new file mode 100644 index 00000000..304933a5 --- /dev/null +++ b/apps/api/test/integration/sharing.test.ts @@ -0,0 +1,493 @@ +import { + SYNC_WEBSOCKET_PROTOCOL, + SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX, +} from "../../src/sync-access/application"; +import { env } from "cloudflare:workers"; +import { runInDurableObject } from "cloudflare:test"; +import { describe, expect, it, vi } from "vitest"; +import { createQueueConsumer } from "../../src/runtime"; +import { + apiRequest, + jsonRequest, + signUpAccount, + signUpAndCreateVault, + DEFAULT_VAULT_WRAPPER, + issueSyncToken, +} from "../helpers/api"; + +async function plus(organizationId: string) { + await env.DB.prepare( + "INSERT INTO polar_subscription (id, product_id, organization_id, polar_customer_id, polar_subscription_id, status, period_end) VALUES (?, 'test-plus-monthly', ?, ?, ?, 'active', ?)", + ) + .bind( + crypto.randomUUID(), + organizationId, + crypto.randomUUID(), + crypto.randomUUID(), + Date.now() + 86400000, + ) + .run(); +} +async function receiverKey() { + const key = await crypto.subtle.generateKey( + { + name: "RSA-OAEP", + hash: "SHA-256", + modulusLength: 3072, + publicExponent: new Uint8Array([1, 0, 1]), + }, + true, + ["encrypt", "decrypt"], + ); + if (!("publicKey" in key)) throw new Error("invalid key pair"); + return btoa( + String.fromCharCode( + ...new Uint8Array( + (await crypto.subtle.exportKey("spki", key.publicKey)) as ArrayBuffer, + ), + ), + ); +} +const mutation = (cookie: string, body?: unknown, method = "POST") => ({ + method, + headers: { cookie, "content-type": "application/json" }, + ...(body === undefined ? {} : { body: JSON.stringify(body) }), +}); + +describe("Plus organization sharing on Cloudflare", () => { + it("uses organization roles for all vault management and revokes inherited access on demotion", async () => { + const owner = await signUpAndCreateVault(); + const admin = await signUpAccount(); + await plus(owner.organizationId); + await env.DB.prepare("UPDATE user SET email_verified=1 WHERE id=?").bind(admin.userId).run(); + const invite = await jsonRequest<{ id: string }>(`/v1/organizations/${owner.organizationId}/invitations`, mutation(owner.sessionCookie, { + email: admin.email, role: "admin", vaults: [], + })); + expect(invite.response.status).toBe(201); + expect((await jsonRequest(`/v1/invitations/${invite.json!.id}/accept`, mutation(admin.sessionCookie))).response.status).toBe(200); + const organization = await jsonRequest<{ vaults: { id: string; canManage: boolean; status: string }[] }>(`/v1/organizations/${owner.organizationId}`, { headers: { cookie: admin.sessionCookie } }); + expect(organization.json!.vaults).toEqual([expect.objectContaining({ id: owner.vaultId, canManage: true, status: "pending_key" })]); + const created = await jsonRequest<{ vault: { id: string } }>("/v1/vaults", mutation(admin.sessionCookie, { + name: "Created by admin", organizationId: owner.organizationId, initialWrapper: DEFAULT_VAULT_WRAPPER, + })); + expect(created.response.status).toBe(201); + // The owner can delete a vault created by someone else before receiving its key. + expect((await jsonRequest(`/v1/vaults/${created.json!.vault.id}`, mutation(owner.sessionCookie, undefined, "DELETE"))).response.status).toBe(202); + const id = crypto.randomUUID(); + const path = `/v1/vaults/${owner.vaultId}/key-requests`; + expect((await jsonRequest(path, mutation(admin.sessionCookie, { id, publicKey: await receiverKey() }))).response.status).toBe(201); + expect((await jsonRequest(`${path}/${id}/approve`, mutation(owner.sessionCookie, { + envelope: { version: 1, algorithm: "rsa-oaep-sha256", ciphertext: "A".repeat(512) }, + }))).response.status).toBe(200); + expect((await jsonRequest(`${path}/${id}/complete`, mutation(admin.sessionCookie, { + envelope: { ...DEFAULT_VAULT_WRAPPER.envelope, version: 2, binding: { vaultId: owner.vaultId, userId: admin.userId } }, + }))).response.status).toBe(200); + const token = await issueSyncToken(admin.sessionCookie, owner.vaultId, "admin-device"); + expect((await jsonRequest(`/v1/organizations/${owner.organizationId}/members/${admin.userId}`, mutation(owner.sessionCookie, { role: "member" }, "PATCH"))).response.status).toBe(200); + expect((await jsonRequest(`/v1/vaults/${owner.vaultId}/bootstrap`, { headers: { cookie: admin.sessionCookie } })).response.status).toBe(403); + expect((await apiRequest(`/v1/vaults/${owner.vaultId}/blobs/denied`, { headers: { authorization: `Bearer ${token.token}` } })).status).toBe(403); + expect((await jsonRequest(`/v1/vaults/${owner.vaultId}`, mutation(admin.sessionCookie, undefined, "DELETE"))).response.status).toBe(403); + }); + + it("revokes existing tokens and sockets, then allows sync after access is granted again", async () => { + const owner = await signUpAndCreateVault(); + const member = await signUpAccount(); + await env.DB.prepare("UPDATE user SET email_verified=1 WHERE id=?") + .bind(member.userId) + .run(); + const invites = `/v1/organizations/${owner.organizationId}/invitations`; + const input = { + email: member.email, + role: "member", + vaults: [{ vaultId: owner.vaultId }], + }; + expect( + (await jsonRequest(invites, mutation(owner.sessionCookie, input))) + .response.status, + ).toBe(403); + expect( + ( + await apiRequest( + "/api/auth/organization/invite-member", + mutation(owner.sessionCookie, { + organizationId: owner.organizationId, + email: member.email, + role: "member", + }), + ) + ).status, + ).toBe(403); + await plus(owner.organizationId); + expect((await jsonRequest(invites, mutation(owner.sessionCookie, { + ...input, vaults: [{ vaultId: owner.vaultId, role: "admin" }], + }))).response.status).toBe(400); + expect( + ( + await apiRequest(invites, { + ...mutation(owner.sessionCookie, input), + headers: { + ...mutation(owner.sessionCookie).headers, + origin: "https://untrusted.example", + }, + }) + ).status, + ).toBe(403); + const invited = await jsonRequest<{ id: string }>( + invites, + mutation(owner.sessionCookie, input), + ); + expect(invited.response.status).toBe(201); + const inviteId = invited.json!.id; + expect( + ( + await jsonRequest( + `/v1/invitations/${inviteId}/accept`, + mutation(owner.sessionCookie), + ) + ).response.status, + ).toBe(403); + expect( + ( + await jsonRequest( + `/v1/invitations/${inviteId}/accept`, + mutation(member.sessionCookie), + ) + ).response.status, + ).toBe(200); + expect( + ( + await jsonRequest(`/v1/vaults/${owner.vaultId}/bootstrap`, { + headers: { cookie: member.sessionCookie }, + }) + ).response.status, + ).toBe(403); + const requestId = crypto.randomUUID(); + const path = `/v1/vaults/${owner.vaultId}/key-requests`; + const requested = await jsonRequest( + path, + mutation(member.sessionCookie, { + id: requestId, + publicKey: await receiverKey(), + }), + ); + expect(requested.response.status).toBe(201); + expect( + ( + await jsonRequest( + `${path}/${requestId}/approve`, + mutation(member.sessionCookie, { + envelope: { + version: 1, + algorithm: "rsa-oaep-sha256", + ciphertext: "A".repeat(512), + }, + }), + ) + ).response.status, + ).toBe(403); + expect( + ( + await jsonRequest( + `${path}/${requestId}/approve`, + mutation(owner.sessionCookie, { + envelope: { + version: 1, + algorithm: "rsa-oaep-sha256", + ciphertext: "A".repeat(512), + }, + }), + ) + ).response.status, + ).toBe(200); + const envelope = { + ...DEFAULT_VAULT_WRAPPER.envelope, + version: 2, + binding: { vaultId: owner.vaultId, userId: member.userId }, + }; + expect( + ( + await jsonRequest( + `${path}/${requestId}/complete`, + mutation(member.sessionCookie, { envelope }), + ) + ).response.status, + ).toBe(200); + const bootstrap = await jsonRequest<{ + wrappers: { userId: string; envelope: unknown }[]; + }>(`/v1/vaults/${owner.vaultId}/bootstrap`, { + headers: { cookie: member.sessionCookie }, + }); + expect(bootstrap.json?.wrappers).toHaveLength(1); + expect(bootstrap.json!.wrappers[0].userId).toBe(member.userId); + const issued = await issueSyncToken( + member.sessionCookie, + owner.vaultId, + "member-device", + ); + const connected = await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { + Upgrade: "websocket", + "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${issued.token}`, + }, + }); + expect(connected.status).toBe(101); + const socket = connected.webSocket!; + socket.accept(); + const ownerToken = await issueSyncToken(owner.sessionCookie, owner.vaultId, "owner-device"); + const ownerConnection = await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { Upgrade: "websocket", "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${ownerToken.token}` }, + }); + expect(ownerConnection.status).toBe(101); + const ownerSocket = ownerConnection.webSocket!; + ownerSocket.accept(); + // Every member with active vault access can edit encrypted content. + expect((await apiRequest(`/v1/vaults/${owner.vaultId}/blobs/member-edit`, { + method: "PUT", headers: { authorization: `Bearer ${issued.token}`, "x-blob-size": "17" }, body: "member ciphertext", + })).status).toBe(201); + expect((await jsonRequest(`/v1/vaults/${owner.vaultId}`, mutation(member.sessionCookie, undefined, "DELETE"))).response.status).toBe(403); + const closed = new Promise((resolve) => + socket.addEventListener("close", (event) => resolve(event.code)), + ); + expect( + ( + await jsonRequest( + `/v1/vaults/${owner.vaultId}/members/${member.userId}`, + mutation(owner.sessionCookie, undefined, "DELETE"), + ) + ).response.status, + ).toBe(200); + expect(await closed).toBe(1012); + const ownerReply = new Promise((resolve) => ownerSocket.addEventListener("message", (event) => resolve(JSON.parse(String(event.data))), { once: true })); + ownerSocket.send(JSON.stringify({ type: "heartbeat", requestId: "owner-still-connected" })); + expect(await ownerReply).toMatchObject({ type: "heartbeat_ack", requestId: "owner-still-connected" }); + ownerSocket.close(); + const revocations = await runInDurableObject(env.SYNC_COORDINATOR.getByName(owner.vaultId), async (_, state) => + state.storage.sql.exec("SELECT key, minimum_version FROM sync_access_revocations").toArray(), + ); + expect(revocations).toContainEqual({ key: `user:${member.userId}`, minimum_version: 2 }); + expect( + ( + await apiRequest(`/v1/vaults/${owner.vaultId}/blobs/old-blob`, { + headers: { authorization: `Bearer ${issued.token}` }, + }) + ).status, + ).toBe(403); + expect( + ( + await jsonRequest( + "/v1/sync/token", + mutation(member.sessionCookie, { + vaultId: owner.vaultId, + localVaultId: "member-device", + }), + ) + ).response.status, + ).toBe(403); + expect( + ( + await jsonRequest( + `/v1/invitations/${inviteId}/accept`, + mutation(member.sessionCookie), + ) + ).response.status, + ).toBe(200); + expect( + ( + await jsonRequest(`/v1/vaults/${owner.vaultId}/bootstrap`, { + headers: { cookie: member.sessionCookie }, + }) + ).response.status, + ).toBe(403); + + // Regranting access must require fresh key approval and a fresh token. + expect((await jsonRequest(`/v1/vaults/${owner.vaultId}/grants`, mutation(owner.sessionCookie, { + userId: member.userId, + }))).response.status).toBe(200); + const renewedRequestId = crypto.randomUUID(); + expect((await jsonRequest(path, mutation(member.sessionCookie, { + id: renewedRequestId, publicKey: await receiverKey(), + }))).response.status).toBe(201); + expect((await jsonRequest(`${path}/${renewedRequestId}/approve`, mutation(owner.sessionCookie, { + envelope: { version: 1, algorithm: "rsa-oaep-sha256", ciphertext: "A".repeat(512) }, + }))).response.status).toBe(200); + expect((await jsonRequest(`${path}/${renewedRequestId}/complete`, mutation(member.sessionCookie, { + envelope, + }))).response.status).toBe(200); + const membership = await env.DB.prepare("SELECT access_version FROM vault_membership WHERE vault_id=? AND user_id=?") + .bind(owner.vaultId, member.userId).first<{ access_version: number }>(); + expect(membership?.access_version).toBe(3); + expect((await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { + Upgrade: "websocket", + "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${issued.token}`, + }, + })).status).toBe(403); + const renewed = await issueSyncToken(member.sessionCookie, owner.vaultId, "member-device"); + const reconnected = await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { + Upgrade: "websocket", + "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${renewed.token}`, + }, + }); + expect(reconnected.status).toBe(101); + const renewedSocket = reconnected.webSocket!; + renewedSocket.accept(); + try { + const reply = new Promise((resolve) => + renewedSocket.addEventListener("message", (event) => resolve(JSON.parse(String(event.data))), { once: true }), + ); + renewedSocket.send(JSON.stringify({ type: "hello", requestId: "renewed-hello", lastKnownCursor: 0 })); + expect(await reply).toMatchObject({ type: "hello_ack", requestId: "renewed-hello" }); + } finally { + renewedSocket.close(); + } + }); + it("suspends shared sync on subscription notifications and preserves retention and membership", async () => { + const owner = await signUpAndCreateVault(); + await plus(owner.organizationId); + await env.DB.prepare("UPDATE vault SET shared_at=? WHERE id=?") + .bind(Date.now(), owner.vaultId) + .run(); + const issued = await issueSyncToken( + owner.sessionCookie, + owner.vaultId, + "owner-device", + ); + + const connected = await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { + Upgrade: "websocket", + "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${issued.token}`, + }, + }); + expect(connected.status).toBe(101); + connected.webSocket!.accept(); + expect( + ( + await apiRequest(`/v1/vaults/${owner.vaultId}/blobs/paused-history`, { + method: "PUT", + headers: { + authorization: `Bearer ${issued.token}`, + "x-blob-size": "19", + }, + body: "retained ciphertext", + }) + ).status, + ).toBe(201); + const closed = new Promise((resolve) => + connected.webSocket!.addEventListener("close", (event) => + resolve(event.code), + ), + ); + await env.DB.prepare("UPDATE polar_subscription SET period_end=? WHERE organization_id=?") + .bind(Date.now() - 1, owner.organizationId).run(); + // The DO does not poll D1 or track subscription dates. The webhook's queued + // policy refresh closes the socket, including clients that are idle. + const stillConnected = new Promise((resolve) => + connected.webSocket!.addEventListener("message", (event) => resolve(JSON.parse(String(event.data))), { once: true }), + ); + connected.webSocket!.send(JSON.stringify({ type: "heartbeat", requestId: "before-webhook" })); + expect(await stillConnected).toMatchObject({ type: "heartbeat_ack", requestId: "before-webhook" }); + await deliverPolicyRefresh(owner.organizationId); + expect(await closed).toBe(1012); + expect((await apiRequest(`/v1/vaults/${owner.vaultId}/blobs/paused-history`, { + headers: { authorization: `Bearer ${issued.token}` }, + })).status).toBe(403); + expect((await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { Upgrade: "websocket", "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${issued.token}` }, + })).status).toBe(403); + const stub = env.SYNC_COORDINATOR.getByName(owner.vaultId); + await runInDurableObject(stub, async (instance, state) => { + const expiredAt = Date.now() - 1; + state.storage.sql.exec( + "UPDATE blobs SET delete_after=? WHERE blob_id='paused-history'", + expiredAt, + ); + state.storage.sql.exec( + `INSERT INTO entry_versions ( + version_id, entry_id, source_revision, op_type, blob_id, encrypted_metadata, + reason, bucket_start_ms, captured_at, expires_at, created_by_user_id, created_by_local_vault_id + ) VALUES ('retained-version', 'old-entry', 1, 'upsert', 'paused-history', 'ciphertext', 'auto', NULL, 1, ?, 'owner', 'device')`, + expiredAt, + ); + await (instance as unknown as { runGc(): Promise }).runGc(); + expect( + state.storage.sql + .exec( + "SELECT version_id FROM entry_versions WHERE version_id='retained-version'", + ) + .toArray(), + ).toHaveLength(1); + expect( + state.storage.sql + .exec("SELECT blob_id FROM blobs WHERE blob_id='paused-history'") + .toArray(), + ).toHaveLength(1); + }); + const denied = await jsonRequest( + "/v1/sync/token", + mutation(owner.sessionCookie, { + vaultId: owner.vaultId, + localVaultId: "owner-device", + }), + ); + expect(denied.response.status).toBe(403); + expect(denied.text).toContain("sharing_suspended"); + const row = await runInDurableObject( + stub, + async (_, state) => + state.storage.sql + .exec<{ + days: number; + }>( + "SELECT version_history_retention_days AS days FROM coordinator_state", + ) + .toArray()[0], + ); + expect(row.days).toBe(365); + expect( + ( + await env.DB.prepare( + "SELECT status FROM vault_membership WHERE vault_id=?", + ) + .bind(owner.vaultId) + .first<{ status: string }>() + )?.status, + ).toBe("active"); + await env.DB.prepare( + "UPDATE polar_subscription SET period_end=? WHERE organization_id=?", + ) + .bind(Date.now() + 86400000, owner.organizationId) + .run(); + await deliverPolicyRefresh(owner.organizationId); + const renewed = await issueSyncToken(owner.sessionCookie, owner.vaultId, "renewed-owner-device"); + const resumed = await apiRequest(`/v1/vaults/${owner.vaultId}/socket`, { + headers: { Upgrade: "websocket", "Sec-WebSocket-Protocol": `${SYNC_WEBSOCKET_PROTOCOL}, ${SYNC_WEBSOCKET_AUTH_PROTOCOL_PREFIX}${renewed.token}` }, + }); + expect(resumed.status).toBe(101); + resumed.webSocket!.accept(); + resumed.webSocket!.close(); + expect( + ( + await jsonRequest( + "/v1/sync/token", + mutation(owner.sessionCookie, { + vaultId: owner.vaultId, + localVaultId: "owner-device", + }), + ) + ).response.status, + ).toBe(200); + }); +}); + +async function deliverPolicyRefresh(organizationId: string): Promise { + const message = { + body: { type: "subscription_policy_refresh", organizationId }, + ack: vi.fn(), + retry: vi.fn(), + }; + await createQueueConsumer(env).handleBatch({ messages: [message] } as never); + expect(message.ack).toHaveBeenCalledOnce(); + expect(message.retry).not.toHaveBeenCalled(); +} diff --git a/apps/api/test/integration/subscription-policy-refresh.test.ts b/apps/api/test/integration/subscription-policy-refresh.test.ts index bbc823cc..9796312b 100644 --- a/apps/api/test/integration/subscription-policy-refresh.test.ts +++ b/apps/api/test/integration/subscription-policy-refresh.test.ts @@ -8,8 +8,31 @@ import { type SubscriptionPlanPolicy, } from "../../src/subscription/domain/policy"; import { signUpAndCreateVault } from "../helpers/api"; +import { createDb } from "../../src/db/client"; +import { DrizzleBillingStore } from "../../src/billing/adapters/outbound/drizzle-billing-store"; describe("subscription policy refresh integration", () => { + it("rolls back a subscription when its billing customer belongs to another organization", async () => { + const first = await signUpAndCreateVault(); + const second = await signUpAndCreateVault(); + const store = new DrizzleBillingStore(createDb(env.DB)); + const input = { + id: "isolated-sub-1", productId: "test-plus-monthly", organizationId: first.organizationId, + polarCustomerId: "isolated-customer", polarSubscriptionId: "isolated-polar-sub-1", + polarCheckoutId: null, status: "active", periodStart: new Date(), + periodEnd: new Date(Date.now() + 86400000), cancelAtPeriodEnd: false, + }; + await store.upsertPolarSubscription(input); + + await expect(store.upsertPolarSubscription({ + ...input, id: "isolated-sub-2", polarSubscriptionId: "isolated-polar-sub-2", organizationId: second.organizationId, + })).rejects.toThrow(); + + expect(await store.readOrganizationSubscriptionStatuses(second.organizationId)).toEqual([]); + expect(await store.readOrganizationPolarCustomerId(second.organizationId)).toBeNull(); + expect(await store.readOrganizationPolarCustomerId(first.organizationId)).toBe("isolated-customer"); + }); + it("applies changed subscription policy limits to active vault durable object state", async () => { const starterProductId = "polar-product-starter"; const primary = await signUpAndCreateVault("Policy refresh vault"); diff --git a/apps/api/test/integration/vaults.test.ts b/apps/api/test/integration/vaults.test.ts index 2f005358..5d4c51ef 100644 --- a/apps/api/test/integration/vaults.test.ts +++ b/apps/api/test/integration/vaults.test.ts @@ -364,7 +364,7 @@ describe("vault integration", () => { expect(denied.response.status).toBe(403); }); - it("grants organization members access to individual vaults", async () => { + it("rejects the legacy member-wrapper endpoint so it cannot bypass key approval", async () => { const primary = await signUpAndCreateVault(); const secondary = await signUpAccount(); @@ -387,56 +387,10 @@ describe("vault integration", () => { }, }), }); - expect(grant.response.status).toBe(201); - expect(grant.json?.wrapper.vaultId).toBe(primary.vaultId); - expect(grant.json?.wrapper.userId).toBe(secondary.userId); - expect(grant.json?.wrapper.kind).toBe("member"); - - const listed = await jsonRequest<{ - vaults: Array<{ id: string; name: string; activeKeyVersion: number }>; - }>("/v1/vaults", { - headers: { - cookie: secondary.sessionCookie, - }, - }); - expect(listed.response.status).toBe(200); - expect(listed.json?.vaults.some((vault) => vault.id === primary.vaultId)).toBe(true); - - const issued = await jsonRequest<{ - token: string; - expiresAt: number; - vaultId: string; - localVaultId: string; - syncFormatVersion: number; - }>("/v1/sync/token", { - method: "POST", - headers: { - "content-type": "application/json", - cookie: secondary.sessionCookie, - }, - body: JSON.stringify({ - vaultId: primary.vaultId, - localVaultId: "member-local-vault", - }), - }); - - expect(issued.response.status).toBe(200); - expect(issued.json?.vaultId).toBe(primary.vaultId); - expect(issued.json?.token).toBeTruthy(); - expect(issued.json?.syncFormatVersion).toBe(2); - - const bootstrap = await jsonRequest<{ - wrappers: Array<{ kind: string; userId: string | null }>; - }>(`/v1/vaults/${encodeURIComponent(primary.vaultId)}/bootstrap`, { - headers: { - cookie: secondary.sessionCookie, - }, - }); - expect(bootstrap.response.status).toBe(200); - expect(bootstrap.json?.wrappers).toEqual([ - expect.objectContaining({ kind: "member", userId: secondary.userId }), - ]); - }); + expect(grant.response.status).toBe(410); + const bootstrap = await jsonRequest(`/v1/vaults/${primary.vaultId}/bootstrap`, { headers: { cookie: secondary.sessionCookie } }); + expect(bootstrap.response.status).toBe(403); + }); it("rejects a second vault on the free plan", async () => { const primary = await signUpAndCreateVault("Personal"); diff --git a/apps/api/test/self-host/e2e.test.ts b/apps/api/test/self-host/e2e.test.ts index c3abf1ae..d0082bad 100644 --- a/apps/api/test/self-host/e2e.test.ts +++ b/apps/api/test/self-host/e2e.test.ts @@ -1,3 +1,7 @@ +import { createPasswordWrappedRemoteVaultKey, unwrapRemoteVaultKeyWithPassword } from "../../../../packages/vault-crypto/src/crypto"; +import { SharingClient } from "../../../../packages/sync-client/src/sharing/client"; +import { SharingManager, type StoredKeyReceiver } from "../../../../packages/sync-client/src/sharing/manager"; +import type { HttpClient } from "../../../../packages/sync-client/src/http/request"; import { serve, type ServerType } from "@hono/node-server"; import { type ChildProcess, spawn } from "node:child_process"; import { mkdtempSync, readdirSync, rmSync, mkdirSync, writeFileSync, readFileSync } from "node:fs"; @@ -88,7 +92,7 @@ async function bootServer(existingDataDir?: string) { dataDir, publicUrl: baseUrl, betterAuthSecret: "test-secret-test-secret-test-secret", - authAllowedEmails: SELF_HOST_ALLOWED_EMAIL, + authAllowedEmails: `${SELF_HOST_ALLOWED_EMAIL},member@test.invalid`, syncTokenSecret: "test-sync-token-secret-test-sync", blobStorage: new LocalDiskBlobObjectStorage(path.join(dataDir, "blobs")), }); @@ -286,6 +290,89 @@ describe("self-hosted Node runtime: end-to-end sync", () => { cleanup = []; }); + it("shares retained history through personal passwords, recovers with approval, and closes revoked sockets", async () => { + const { baseUrl, dataDir, runtime, server, wss } = await bootServer(); + cleanup.push(() => rmSync(dataDir, { recursive: true, force: true })); + cleanup.push(() => runtime.dispose()); + cleanup.push(() => closeServer(server, wss)); + const owner = await signUpAndCreateVault(baseUrl); + const signed = await fetch(`${baseUrl}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json", origin: baseUrl }, body: JSON.stringify({ email: "member@test.invalid", password: "another correct horse battery", name: "Member" }) }); + expect(signed.status).toBe(200); + const memberCookie = signed.headers.get("set-cookie")!.split(";")[0]; + const signup = await signed.json() as { user: { id: string } }; + const userId = signup.user.id; + const request = async (cookie: string, path: string, method = "GET", body?: unknown) => { + const response = await fetch(`${baseUrl}${path}`, { method, headers: { cookie, origin: baseUrl, "content-type": "application/json" }, ...(body === undefined ? {} : { body: JSON.stringify(body) }) }); + return { response, json: await response.json() as Record }; + }; + const ownerIdentity = await request(owner.sessionCookie, "/api/auth/get-session"); + const organizationId = (await request(owner.sessionCookie, "/v1/organizations")).json.organizations[0].id as string; + const wrapped = await createPasswordWrappedRemoteVaultKey("owner keeps a private passphrase"); + const created = await request(owner.sessionCookie, "/v1/vaults", "POST", { name: "Shared history", organizationId, initialWrapper: { kind: "password", envelope: wrapped.envelope } }); + expect(created.response.status).toBe(201); + const vaultId = created.json.vault.id as string; + const ownerToken = await issueSyncToken(baseUrl, owner.sessionCookie, vaultId, "owner-device"); + const ownerSocket = await connectSocket(baseUrl, vaultId, ownerToken); cleanup.push(() => ownerSocket.terminate()); + ownerSocket.send(JSON.stringify({ type: "hello", requestId: "hello-owner", lastKnownCursor: 0 })); await nextMessage(ownerSocket, message => message.type === "hello_ack"); + for (let revision = 0; revision < 2; revision++) { + await uploadBlob(baseUrl, ownerToken, vaultId, `history-${revision}`, `encrypted historical content ${revision}`); + ownerSocket.send(JSON.stringify({ type: "commit_mutations", requestId: `commit-${revision}`, mutations: [{ mutationId: `mutation-${revision}`, entryId: "shared-file", op: "upsert", baseRevision: revision, blobId: `history-${revision}`, encryptedMetadata: `metadata-${revision}` }] })); + await nextMessage(ownerSocket, message => message.type === "commit_mutations_committed"); + } + const invite = await request(owner.sessionCookie, `/v1/organizations/${organizationId}/invitations`, "POST", { email: "member@test.invalid", role: "member", vaults: [{ vaultId }] }); + expect(invite.response.status).toBe(201); + expect((await request(memberCookie, `/v1/invitations/${invite.json.id}/accept`, "POST")).response.status).toBe(200); + expect((await request(memberCookie, `/v1/vaults/${vaultId}/bootstrap`)).response.status).toBe(403); + expect((await request(memberCookie, `/v1/vaults/${owner.vaultId}/bootstrap`)).response.status).toBe(403); + let loseCompleteResponse = true; + const http = (cookie: string): HttpClient => ({ request: async input => { + const headers = new Headers(input.headers); headers.delete("authorization"); headers.set("cookie", cookie); headers.set("origin", baseUrl); + const response = await fetch(input.url, { method: input.method, headers, body: input.body }); + const json = await response.json(); + if (cookie === memberCookie && input.url.endsWith("/complete") && loseCompleteResponse && response.ok) { loseCompleteResponse = false; throw new Error("response lost"); } + return { status: response.status, json }; + } }); + const secrets = new Map(); + const secretStore = { read: async (scope: string) => secrets.get(scope) ?? null, write: async (scope: string, value: StoredKeyReceiver | null) => { if (value) secrets.set(scope, value); else secrets.delete(scope); } }; + const memberClient = new SharingClient(http(memberCookie), baseUrl, "cookie-auth"); + let receiver = new SharingManager(memberClient, userId, secretStore); + const sender = new SharingManager(new SharingClient(http(owner.sessionCookie), baseUrl, "cookie-auth"), ownerIdentity.json.user.id, secretStore); + const pending = await receiver.begin(vaultId); + await expect(sender.approve(pending, wrapped.remoteVaultKey, "wrong-code")).rejects.toThrow("verification code"); + await sender.approve(pending, wrapped.remoteVaultKey, await receiver.verificationCode(pending)); + const password = "member has a separate passphrase"; + await expect(receiver.receive(vaultId, password, password)).rejects.toThrow("response lost"); + // Recreate the manager to model a device restart after an ambiguous response. + receiver = new SharingManager(memberClient, userId, secretStore); + await receiver.receive(vaultId, password, password); + expect(secrets.size).toBe(0); + const bootstrap = (await request(memberCookie, `/v1/vaults/${vaultId}/bootstrap`)).json; + expect(bootstrap.wrappers).toHaveLength(1); expect(bootstrap.wrappers[0].userId).toBe(userId); + expect(await unwrapRemoteVaultKeyWithPassword(password, bootstrap.wrappers[0].envelope, { vaultId, userId })).toEqual(wrapped.remoteVaultKey); + const recovery = await receiver.begin(vaultId); expect(recovery.purpose).toBe("recovery"); + await sender.approve(recovery, wrapped.remoteVaultKey, await receiver.verificationCode(recovery)); + const recoveredPassword = "a freshly recovered personal phrase"; + await receiver.receive(vaultId, recoveredPassword, recoveredPassword); + await receiver.changePassword(vaultId, wrapped.remoteVaultKey, "another personally chosen phrase", "another personally chosen phrase"); + const ownerBootstrap = (await request(owner.sessionCookie, `/v1/vaults/${vaultId}/bootstrap`)).json; + expect(ownerBootstrap.wrappers[0].envelope).toEqual(wrapped.envelope); + const token = await issueSyncToken(baseUrl, memberCookie, vaultId, "member-device"); + const memberSocket = await connectSocket(baseUrl, vaultId, token); cleanup.push(() => memberSocket.terminate()); + memberSocket.send(JSON.stringify({ type: "hello", requestId: "hello-member", lastKnownCursor: 0 })); await nextMessage(memberSocket, message => message.type === "hello_ack"); + memberSocket.send(JSON.stringify({ type: "list_entry_versions", requestId: "history", entryId: "shared-file", before: null, limit: 10 })); + const history = await nextMessage(memberSocket, message => message.type === "entry_versions_listed"); + expect(history).toMatchObject({ versions: expect.arrayContaining([expect.objectContaining({ blobId: "history-1" })]) }); + const closed = new Promise(resolve => memberSocket.once("close", code => resolve(code))); + expect((await request(owner.sessionCookie, `/v1/vaults/${vaultId}/members/${userId}`, "DELETE")).response.status).toBe(200); + expect(await closed).toBe(1012); + const deniedBlob = await fetch(`${baseUrl}/v1/vaults/${vaultId}/blobs/history-1`, { headers: { authorization: `Bearer ${token}` } }); + expect(deniedBlob.status).toBe(403); + expect((await request(memberCookie, "/v1/sync/token", "POST", { vaultId, localVaultId: "member-device" })).response.status).toBe(403); + expect((await request(memberCookie, `/v1/invitations/${invite.json.id}/accept`, "POST")).response.status).toBe(200); + expect((await request(memberCookie, `/v1/vaults/${vaultId}/bootstrap`)).response.status).toBe(403); + for (const page of ["organizations", "invitations"]) expect((await fetch(`${baseUrl}/${page}`)).status).toBe(200); + }, 20000); + it("cleans orphaned upload parts before serving after a process crash", async () => { const dataDir = mkdtempSync(path.join(tmpdir(), "synch-orphan-upload-")); cleanup.push(() => rmSync(dataDir, { recursive: true, force: true })); diff --git a/apps/api/vitest.config.mts b/apps/api/vitest.config.mts index 3fe5007e..ed6b32cc 100644 --- a/apps/api/vitest.config.mts +++ b/apps/api/vitest.config.mts @@ -23,6 +23,7 @@ export default defineConfig({ }, bindings: { BETTER_AUTH_URL: process.env.BETTER_AUTH_URL, + POLAR_PLUS_MONTHLY_PRODUCT_ID: "test-plus-monthly", WWW_BASE_URL: process.env.WWW_BASE_URL ?? "http://localhost:4321", BETTER_AUTH_SECRET: process.env.BETTER_AUTH_SECRET, SYNC_TOKEN_SECRET: process.env.SYNC_TOKEN_SECRET, diff --git a/apps/api/wrangler.jsonc b/apps/api/wrangler.jsonc index 8a5d7383..66f26f39 100644 --- a/apps/api/wrangler.jsonc +++ b/apps/api/wrangler.jsonc @@ -63,6 +63,9 @@ "SYNC_TOKEN_TTL_SECONDS": 120, "SELF_HOSTED": true }, + "triggers": { + "crons": ["*/5 * * * *"] + }, "secrets": { "required": [ "AUTH_ALLOWED_EMAILS", @@ -74,6 +77,7 @@ "managed": { "triggers": { "crons": [ + "*/5 * * * *", "0 */6 * * *" ] }, @@ -151,6 +155,8 @@ "BETTER_AUTH_SECRET", "BETTER_AUTH_URL", "POLAR_ACCESS_TOKEN", + "POLAR_PLUS_ANNUAL_PRODUCT_ID", + "POLAR_PLUS_MONTHLY_PRODUCT_ID", "POLAR_SANDBOX", "POLAR_STARTER_ANNUAL_PRODUCT_ID", "POLAR_STARTER_MONTHLY_PRODUCT_ID", diff --git a/apps/obsidian-plugin/release-notes/next.md b/apps/obsidian-plugin/release-notes/next.md index 05d79e08..4df5a85f 100644 --- a/apps/obsidian-plugin/release-notes/next.md +++ b/apps/obsidian-plugin/release-notes/next.md @@ -2,6 +2,10 @@ ## Added +- Share encrypted vaults on Sync Plus (up to three members) or self-hosted servers, with personal passwords and administrator-approved key setup and recovery. + ## Changed +- Simplified vault setup with a personal/shared vault picker. Invited vaults require an empty local vault; personal vaults allow existing files after confirmation. + ## Fixed diff --git a/apps/obsidian-plugin/src/adapters/key-receiver-storage.ts b/apps/obsidian-plugin/src/adapters/key-receiver-storage.ts new file mode 100644 index 00000000..6e926b9c --- /dev/null +++ b/apps/obsidian-plugin/src/adapters/key-receiver-storage.ts @@ -0,0 +1,44 @@ +import type { Plugin } from "obsidian"; +import type { + KeyReceiverStore, + StoredKeyReceiver, +} from "@synch/sync-client/remote"; +import { getOrCreateSecretScopeId } from "./secret-scope"; + +/** Request private keys belong in Obsidian's secret storage, never plugin data.json. */ +export class ObsidianKeyReceiverStore implements KeyReceiverStore { + constructor(private readonly plugin: Plugin) {} + private async name(scope: string): Promise { + const digest = new Uint8Array( + await crypto.subtle.digest("SHA-256", new TextEncoder().encode(scope)), + ); + const suffix = Array.from(digest, (byte) => + byte.toString(16).padStart(2, "0"), + ).join(""); + return `synch-key-request-${getOrCreateSecretScopeId(this.plugin)}-${suffix}`; + } + async read(scope: string): Promise { + const name = await this.name(scope); + const raw = this.plugin.app.secretStorage.getSecret(name); + if (!raw) return null; + const value = JSON.parse(raw) as StoredKeyReceiver; + if ( + typeof value.id !== "string" || + typeof value.privateKey !== "string" || + typeof value.publicKey !== "string" || + !Number.isFinite(value.expiresAt) + ) + throw new Error("Invalid stored key request"); + if (value.expiresAt <= Date.now()) { + this.plugin.app.secretStorage.setSecret(name, ""); + return null; + } + return value; + } + async write(scope: string, value: StoredKeyReceiver | null): Promise { + this.plugin.app.secretStorage.setSecret( + await this.name(scope), + value ? JSON.stringify(value) : "", + ); + } +} diff --git a/apps/obsidian-plugin/src/adapters/local-vault-content.test.ts b/apps/obsidian-plugin/src/adapters/local-vault-content.test.ts new file mode 100644 index 00000000..cce93a8c --- /dev/null +++ b/apps/obsidian-plugin/src/adapters/local-vault-content.test.ts @@ -0,0 +1,42 @@ +import type { App } from "obsidian"; +import { describe, expect, it, vi } from "vitest"; +import { hasExistingVaultFiles } from "./local-vault-content"; + +function app(files: string[], entries: Record) { + const list = vi.fn(async (path: string) => { + const entry = entries[path]; + if (!entry) throw new Error("unreadable folder"); + return entry; + }); + return { + app: { vault: { configDir: ".custom-obsidian", getFiles: () => files.map((path) => ({ path })), adapter: { list } } } as unknown as App, + list, + }; +} + +describe("empty local vault check", () => { + it("counts files regardless of sync filters", async () => { + const fixture = app(["excluded/image.png"], {}); + expect(await hasExistingVaultFiles(fixture.app)).toBe(true); + expect(fixture.list).not.toHaveBeenCalled(); + }); + it("allows only Obsidian configuration, trash, and empty folders", async () => { + const fixture = app([], { + "": { files: [], folders: [".custom-obsidian", ".trash", "empty"] }, + empty: { files: [], folders: [] }, + }); + expect(await hasExistingVaultFiles(fixture.app)).toBe(false); + expect(fixture.list).not.toHaveBeenCalledWith(".custom-obsidian"); + expect(fixture.list).not.toHaveBeenCalledWith(".trash"); + }); + it("counts hidden files not indexed by Obsidian", async () => { + const fixture = app([], { + "": { files: [], folders: [".hidden"] }, + ".hidden": { files: [".hidden/note.md"], folders: [] }, + }); + expect(await hasExistingVaultFiles(fixture.app)).toBe(true); + }); + it("fails closed when the adapter cannot read a folder", async () => { + await expect(hasExistingVaultFiles(app([], {}).app)).rejects.toThrow("unreadable folder"); + }); +}); diff --git a/apps/obsidian-plugin/src/adapters/local-vault-content.ts b/apps/obsidian-plugin/src/adapters/local-vault-content.ts new file mode 100644 index 00000000..3c802590 --- /dev/null +++ b/apps/obsidian-plugin/src/adapters/local-vault-content.ts @@ -0,0 +1,15 @@ +import type { App } from "obsidian"; + +/** Configuration created by Obsidian itself does not make a fresh vault nonempty. */ +export async function hasExistingVaultFiles(app: App): Promise { + const vault = app.vault; + if (vault.getFiles().length > 0) return true; + const folders = [""]; + while (folders.length > 0) { + const folder = folders.pop()!; + const entries = await vault.adapter.list(folder); + if (entries.files.length > 0) return true; + folders.push(...entries.folders.filter((path) => path !== vault.configDir && path !== ".trash")); + } + return false; +} diff --git a/apps/obsidian-plugin/src/app/plugin-controller.ts b/apps/obsidian-plugin/src/app/plugin-controller.ts index f9436302..8a19a3b9 100644 --- a/apps/obsidian-plugin/src/app/plugin-controller.ts +++ b/apps/obsidian-plugin/src/app/plugin-controller.ts @@ -1,3 +1,5 @@ +import { ObsidianKeyReceiverStore } from "../adapters/key-receiver-storage"; +import { SharingModal } from "../ui/sharing/sharing-modal"; import type { UserVisibleSyncProgress } from "@synch/sync-client/engine"; import { Notice, type Plugin, TFolder } from "obsidian"; @@ -13,6 +15,8 @@ import { import { AuthClient, AuthManager, type AuthReadiness } from "@synch/sync-client/auth"; import { RemoteVaultClient, + SharingClient, + SharingManager, SyncAccessClient, type SyncTokenResponse, SyncTokenManager, @@ -105,6 +109,7 @@ export class SynchPluginController implements SynchSettingsController { }, }); private readonly subscriptionService = new SynchSubscriptionService({ + getOrganizationId: () => this.remoteVaultManager.getActiveSession()?.summary.organizationId, getApiBaseUrl: () => this.getApiBaseUrl(), hasAuthenticatedSession: () => this.hasAuthenticatedSession(), getAuthSessionToken: () => this.authManager.getAuthSessionToken(), @@ -246,6 +251,7 @@ export class SynchPluginController implements SynchSettingsController { getApiBaseUrl: () => this.getApiBaseUrl(), getSyncFileRules: () => this.getSyncFileRules(), getStoredRemoteVaultId: () => this.sessionStore.getStoredRemoteVaultId(), + createVaultAccessContext: () => this.createVaultAccessContext(), hasConnectedRemoteVault: () => this.hasConnectedRemoteVault(), initializeSyncStoreForActiveRemoteVault: async () => { await this.readinessCoordinator.initializeSyncStoreForActiveRemoteVault(); @@ -645,6 +651,31 @@ export class SynchPluginController implements SynchSettingsController { await this.remoteVaultController.connectRemoteVaultFromPrompt(); } + private async createVaultAccessContext() { + const apiBaseUrl = this.getApiBaseUrl(); + const token = this.authManager.getAuthSessionToken(); + const isCurrentAccount = () => this.getApiBaseUrl() === apiBaseUrl && this.authManager.getAuthSessionToken() === token; + const user = await new AuthClient(defaultHttpClient, "synch-obsidian-plugin").getAuthenticatedUser(apiBaseUrl, token); + if (!isCurrentAccount()) throw new Error(t("sharing.accountChanged")); + if (!user) throw new Error("Sign in before managing vault access."); + const manager = new SharingManager(new SharingClient(defaultHttpClient, apiBaseUrl, token), user.userId, new ObsidianKeyReceiverStore(this.plugin)); + return { manager, isCurrentAccount }; + } + + async openVaultSharing(): Promise { + try { + const { manager, isCurrentAccount } = await this.createVaultAccessContext(); + const apiBaseUrl = manager.client.apiBaseUrl; + new SharingModal(this.plugin.app, manager, () => this.remoteVaultManager.getActiveSession(), isCurrentAccount, () => { + const url = new URL("/organizations", apiBaseUrl); + const organizationId = this.remoteVaultManager.getActiveSession()?.summary.organizationId; + if (organizationId) url.searchParams.set("organizationId", organizationId); + url.searchParams.set("lang", getSynchLocale()); + openExternalUrl(url.toString()); + }).open(); + } catch (error) { this.notifyError(error, "error.vaultConnection"); } + } + openRemoteVaultManagementPage(): void { this.remoteVaultController.openRemoteVaultManagementPage(); } diff --git a/apps/obsidian-plugin/src/app/subscription-service.test.ts b/apps/obsidian-plugin/src/app/subscription-service.test.ts new file mode 100644 index 00000000..623a4465 --- /dev/null +++ b/apps/obsidian-plugin/src/app/subscription-service.test.ts @@ -0,0 +1,54 @@ +import { beforeEach, expect, it, vi } from "vitest"; +import { resetObsidianMocks, setRequestUrlMock } from "../test-stubs/obsidian"; +import { SynchSubscriptionService } from "./subscription-service"; + +beforeEach(() => { + resetObsidianMocks(); + vi.restoreAllMocks(); +}); +it("uses the selected vault's organization and ignores a previous organization's late response", async () => { + let organizationId = "personal"; + let finishPersonal!: (value: unknown) => void; + const status = (planId: string) => ({ + status: 200, + json: { + planId, + billingInterval: "monthly", + active: true, + status: "active", + cancelAtPeriodEnd: false, + periodEnd: null, + }, + }); + setRequestUrlMock( + vi.fn(async (input: unknown) => { + const url = new URL((input as { url: string }).url); + if (url.searchParams.get("organizationId") === "personal") + return new Promise((resolve) => { + finishPersonal = resolve; + }); + expect(url.searchParams.get("organizationId")).toBe("shared"); + return status("plus"); + }), + ); + const service = new SynchSubscriptionService({ + getOrganizationId: () => organizationId, + getApiBaseUrl: () => "https://api.synch.run", + hasAuthenticatedSession: () => true, + getAuthSessionToken: () => "token", + refreshUi: vi.fn(), + }); + const previous = service.ensureSubscriptionStatusCheck(); + organizationId = "shared"; + await service.ensureSubscriptionStatusCheck(); + expect(service.getSubscriptionStatus()).toMatchObject({ + state: "loaded", + planId: "plus", + }); + finishPersonal(status("starter")); + await previous; + expect(service.getSubscriptionStatus()).toMatchObject({ + state: "loaded", + planId: "plus", + }); +}); diff --git a/apps/obsidian-plugin/src/app/subscription-service.ts b/apps/obsidian-plugin/src/app/subscription-service.ts index e66aeaf4..cb3a8300 100644 --- a/apps/obsidian-plugin/src/app/subscription-service.ts +++ b/apps/obsidian-plugin/src/app/subscription-service.ts @@ -9,6 +9,7 @@ import type { SynchSubscriptionStatus } from "../ui/contracts"; const SUBSCRIPTION_STATUS_CHECK_INTERVAL_MS = 30 * 1000; export interface SynchSubscriptionServiceDeps { + getOrganizationId?: () => string | undefined; getApiBaseUrl: () => string; hasAuthenticatedSession: () => boolean; getAuthSessionToken: () => string; @@ -17,6 +18,7 @@ export interface SynchSubscriptionServiceDeps { export class SynchSubscriptionService { private readonly billingClient = new BillingClient(defaultHttpClient); + private contextKey = ""; private subscriptionStatusCheckPromise: Promise | null = null; private subscriptionStatusCheckedAt = 0; private subscriptionStatus: SynchSubscriptionStatus = { @@ -26,10 +28,12 @@ export class SynchSubscriptionService { constructor(private readonly deps: SynchSubscriptionServiceDeps) {} getSubscriptionStatus(): SynchSubscriptionStatus { + this.checkContext(); return this.subscriptionStatus; } async ensureSubscriptionStatusCheck(): Promise { + this.checkContext(); if ( !this.deps.hasAuthenticatedSession() || getServerDeployment(this.deps.getApiBaseUrl()) !== "official_cloud" @@ -55,6 +59,7 @@ export class SynchSubscriptionService { } async retrySubscriptionStatusCheck(): Promise { + this.checkContext(); if ( !this.deps.hasAuthenticatedSession() || getServerDeployment(this.deps.getApiBaseUrl()) !== "official_cloud" @@ -86,7 +91,23 @@ export class SynchSubscriptionService { page, getSynchLocale(), ); - openExternalUrl(url); + const scopedUrl = new URL(url); + const organizationId = this.deps.getOrganizationId?.(); + if (organizationId) + scopedUrl.searchParams.set("organizationId", organizationId); + openExternalUrl(scopedUrl.toString()); + } + + private checkContext(): void { + const next = JSON.stringify([ + this.deps.getApiBaseUrl(), + this.deps.getAuthSessionToken(), + this.deps.getOrganizationId?.(), + ]); + if (next !== this.contextKey) { + this.contextKey = next; + this.clearSubscriptionStatus(); + } } private async checkSubscriptionStatus(): Promise { @@ -101,22 +122,30 @@ export class SynchSubscriptionService { return; } + const contextKey = this.contextKey; this.subscriptionStatus = { state: "checking" }; this.subscriptionStatusCheckPromise = this.billingClient - .readBillingStatus(this.deps.getApiBaseUrl(), sessionToken) + .readBillingStatus( + this.deps.getApiBaseUrl(), + sessionToken, + this.deps.getOrganizationId?.(), + ) .then((status) => { + if (contextKey !== this.contextKey) return; this.subscriptionStatus = { state: "loaded", ...status, }; }) .catch((error) => { + if (contextKey !== this.contextKey) return; this.subscriptionStatus = { state: "failed", error: error instanceof Error ? error.message : String(error), }; }) .finally(() => { + if (contextKey !== this.contextKey) return; this.subscriptionStatusCheckedAt = Date.now(); this.subscriptionStatusCheckPromise = null; this.deps.refreshUi(); diff --git a/apps/obsidian-plugin/src/i18n/locales/de.ts b/apps/obsidian-plugin/src/i18n/locales/de.ts index de4c9a21..ad61d00c 100644 --- a/apps/obsidian-plugin/src/i18n/locales/de.ts +++ b/apps/obsidian-plugin/src/i18n/locales/de.ts @@ -1,7 +1,57 @@ -import { en } from "./en"; +import { + en } from "./en"; export const de = { + ...en, + "vault.choose": "Vault auswählen", + "vault.yourVaults": "Deine Vaults", + "vault.sharedWithYou": "Mit dir geteilt", + "vault.missingShared": "Fehlt ein geteilter Vault?", + "vault.acceptOnWeb": "Nimm die Einladung im Browser an und aktualisiere diese Liste.", + "vault.allVaults": "Alle Vaults", + "vault.usePassword": "Mit meinem Passwort verbinden", + "vault.accessApproved": "Zugriff genehmigt. Lege dein eigenes Passwort fest, um dich zu verbinden.", + "vault.copyCode": "Code kopieren", + "vault.checkApproval": "Genehmigung prüfen", + "vault.requestHelp": "Neue Anfrage nötig?", + "vault.invitedNeedsEmpty": "Eingeladene Vaults können nur mit einem leeren lokalen Vault verbunden werden. Erstelle einen neuen Obsidian-Vault, aktiviere dort Synch und verbinde ihn erneut.", + "vault.connectOnboardingHint": "Wähle einen Vault aus. Nimm Organisationseinladungen zuerst im Web an und schließe dann hier die Zugriffsfreigabe und Verbindung ab.", + "vault.owned": "Mein Vault", + "vault.invited": "Eingeladener Vault", + "vault.selectedOption": "Ausgewählt", + "vault.select": "Auswählen", + "vault.saveAndConnect": "Passwort speichern und verbinden", + + "sharing.organization": "Organisation", + "sharing.title": "Vault-Freigabe und Passwörter", + "sharing.passwordConnect": "Verbinde diesen Vault, um dein Vault-Passwort zu ändern.", + "sharing.intro": "Nimm die Organisationseinladung im Browser an. Beantrage oder genehmige dann hier den Vault-Zugriff.", + "sharing.organizations": "Organisationen verwalten", + "sharing.refresh": "Aktualisieren", + "sharing.suspended": "Gemeinsame Synchronisierung erfordert ein aktives Plus-Abo. Bei Self-Hosting ist sie enthalten.", + "sharing.setup": "Zugriff einrichten", + "sharing.recovery": "Passwort wiederherstellen", + "sharing.requestHelp": "Bitte einen Vault-Administrator um Freigabe. Schließe die Einrichtung auf diesem Gerät ab.", + "sharing.request": "Freigabe anfordern", + "sharing.yourCode": "Übermittle diesen vollständigen Prüfcode über einen separaten vertrauenswürdigen Kanal an deinen Administrator.", + "sharing.waiting": "Warte auf die Freigabe durch einen Administrator.", + "sharing.restartHelp": "Wurde diese Anfrage auf einem anderen Gerät erstellt, kehre dorthin zurück oder ersetze sie hier.", + "sharing.restart": "Anfrage ersetzen", + "sharing.approveHelp": "Gib den vollständigen Prüfcode ein, den du über einen separaten vertrauenswürdigen Kanal von dieser Person erhalten hast. Gespeicherte Versionen werden ebenfalls geteilt.", + "sharing.connectFirst": "Verbinde diesen Vault mit deinem eigenen Passwort, bevor du den Zugriff genehmigst.", + "sharing.code": "Prüfcode des Empfängers", + "sharing.approve": "Genehmigen", + "sharing.changePassword": "Mein Vault-Passwort ändern", + "sharing.setPassword": "Mein Vault-Passwort festlegen", + "sharing.passwordHelp": "Nur dein Passwort ändert sich. Andere Mitglieder behalten ihre eigenen Passwörter.", + "sharing.password": "Neues Passwort", + "sharing.confirmPassword": "Passwort bestätigen", + "sharing.save": "Speichern", + "sharing.ready": "Passwort gespeichert. Verbinde den Vault mit diesem Passwort, um zu synchronisieren.", + "sharing.saved": "Dein Vault-Passwort wurde geändert.", + "sharing.accountChanged": "Konto oder Server wurde geändert. Öffne dieses Fenster erneut.", + "sync.downloading": "Wird heruntergeladen", "sync.uploading": "Wird hochgeladen", "sync.completedCount": ({ count }: { count: number }) => `${count} abgeschlossen`, diff --git a/apps/obsidian-plugin/src/i18n/locales/en.ts b/apps/obsidian-plugin/src/i18n/locales/en.ts index 26b2a617..7437a766 100644 --- a/apps/obsidian-plugin/src/i18n/locales/en.ts +++ b/apps/obsidian-plugin/src/i18n/locales/en.ts @@ -1,4 +1,52 @@ export const en = { + "vault.choose": "Choose a vault", + "vault.yourVaults": "Your vaults", + "vault.sharedWithYou": "Shared with you", + "vault.missingShared": "Missing a shared vault?", + "vault.acceptOnWeb": "Accept the invitation in your browser, then refresh this list.", + "vault.allVaults": "All vaults", + "vault.usePassword": "Use my password", + "vault.accessApproved": "Access approved. Set your own password to connect.", + "vault.copyCode": "Copy code", + "vault.checkApproval": "Check approval", + "vault.requestHelp": "Need a new request?", + "vault.invitedNeedsEmpty": "Invited vaults can only connect to an empty local vault. Create a new Obsidian vault, enable Synch there, and connect again.", + "vault.connectOnboardingHint": "Choose a vault below. Accept organization invitations on the web first, then finish access approval and connection here.", + "vault.owned": "My vault", + "vault.invited": "Invited vault", + "vault.selectedOption": "Selected", + "vault.select": "Select", + "vault.saveAndConnect": "Save password and connect", + "sharing.organization": "Organization", + "sharing.title": "Vault sharing and passwords", + "sharing.passwordConnect": "Connect this vault to change your vault password.", + "sharing.intro": "Accept organization invitations in your browser, then request or approve vault access here.", + "sharing.organizations": "Manage organizations", + "sharing.refresh": "Refresh", + "sharing.suspended": "Shared sync requires an active Plus subscription. Self-hosted sharing is included.", + "sharing.setup": "Set up access", + "sharing.recovery": "Recover password", + "sharing.requestHelp": "Request approval from a vault administrator. Return to this device to finish.", + "sharing.request": "Request approval", + "sharing.yourCode": "Share this full verification code with your administrator through a separate trusted channel.", + "sharing.waiting": "Waiting for administrator approval.", + "sharing.restartHelp": "If this request was made on another device, return there or replace it with a new request here.", + "sharing.restart": "Replace request", + "sharing.approveHelp": "Enter the full verification code received from this person through a separate trusted channel. Approval shares retained history too.", + "sharing.connectFirst": "Connect this vault with your own password before approving access.", + "sharing.code": "Recipient verification code", + "sharing.approve": "Approve", + "sharing.changePassword": "Change my vault password", + "sharing.setPassword": "Set my vault password", + "sharing.passwordHelp": "Only your password changes. Other members keep their own passwords.", + "sharing.password": "New password", + "sharing.confirmPassword": "Confirm password", + "sharing.save": "Save", + "sharing.ready": "Password saved. Use Connect vault with this password to begin syncing.", + "sharing.saved": "Your vault password was changed.", + "sharing.accountChanged": "Your account or server changed. Reopen this window.", + + "sync.downloading": "Downloading", "sync.uploading": "Uploading", "sync.completedCount": ({ count }: { count: number }) => `${count} completed`, diff --git a/apps/obsidian-plugin/src/i18n/locales/ja.ts b/apps/obsidian-plugin/src/i18n/locales/ja.ts index f7e38a0a..20d733d0 100644 --- a/apps/obsidian-plugin/src/i18n/locales/ja.ts +++ b/apps/obsidian-plugin/src/i18n/locales/ja.ts @@ -1,7 +1,57 @@ -import { en } from "./en"; +import { + en } from "./en"; export const ja = { + ...en, + "vault.choose": "Vaultを選択", + "vault.yourVaults": "自分のvault", + "vault.sharedWithYou": "共有されたvault", + "vault.missingShared": "共有されたvaultが見つかりませんか？", + "vault.acceptOnWeb": "ブラウザーで招待を承諾してから、この一覧を更新してください。", + "vault.allVaults": "すべてのvault", + "vault.usePassword": "自分のパスワードで接続", + "vault.accessApproved": "アクセスが承認されました。接続用のパスワードを設定してください。", + "vault.copyCode": "コードをコピー", + "vault.checkApproval": "承認を確認", + "vault.requestHelp": "新しい申請が必要ですか？", + "vault.invitedNeedsEmpty": "招待されたvaultは空のローカルvaultにのみ接続できます。新しいObsidian vaultを作成し、Synchを有効にして接続してください。", + "vault.connectOnboardingHint": "vaultを選択してください。組織の招待は先にWebで承諾し、ここでアクセス承認と接続を完了してください。", + "vault.owned": "自分のvault", + "vault.invited": "招待されたvault", + "vault.selectedOption": "選択中", + "vault.select": "選択", + "vault.saveAndConnect": "パスワードを保存して接続", + + "sharing.organization": "組織", + "sharing.title": "Vault の共有とパスワード", + "sharing.passwordConnect": "vaultに接続すると自分のvaultパスワードを変更できます。", + "sharing.intro": "ブラウザーで組織への招待を承諾した後、ここでアクセスの申請や承認を行います。", + "sharing.organizations": "組織を管理", + "sharing.refresh": "更新", + "sharing.suspended": "共有同期には有効な Plus 契約が必要です。セルフホストでは無料です。", + "sharing.setup": "アクセスを設定", + "sharing.recovery": "パスワードを復旧", + "sharing.requestHelp": "Vault 管理者に承認を申請してください。完了するにはこの端末に戻ってください。", + "sharing.request": "承認を申請", + "sharing.yourCode": "別の信頼できる連絡手段で、この確認コード全体を管理者に伝えてください。", + "sharing.waiting": "管理者の承認を待っています。", + "sharing.restartHelp": "別の端末で作成した申請は、その端末で完了するか、ここで新しい申請に置き換えてください。", + "sharing.restart": "申請を置き換える", + "sharing.approveHelp": "別の信頼できる連絡手段で本人から受け取った確認コード全体を入力してください。保存済みの履歴も共有されます。", + "sharing.connectFirst": "承認する前に、自分のパスワードでこの Vault に接続してください。", + "sharing.code": "相手の確認コード", + "sharing.approve": "承認", + "sharing.changePassword": "自分の Vault パスワードを変更", + "sharing.setPassword": "自分の Vault パスワードを設定", + "sharing.passwordHelp": "自分のパスワードのみ変更します。他のメンバーのパスワードは変わりません。", + "sharing.password": "新しいパスワード", + "sharing.confirmPassword": "パスワードの確認", + "sharing.save": "保存", + "sharing.ready": "保存しました。このパスワードで Vault に接続すると同期を開始できます。", + "sharing.saved": "自分の Vault パスワードを変更しました。", + "sharing.accountChanged": "アカウントまたはサーバーが変わりました。この画面を開き直してください。", + "sync.downloading": "ダウンロード中", "sync.uploading": "アップロード中", "sync.completedCount": ({ count }: { count: number }) => `${count}件完了`, diff --git a/apps/obsidian-plugin/src/i18n/locales/ko.ts b/apps/obsidian-plugin/src/i18n/locales/ko.ts index 5f92fe63..6bfddfdf 100644 --- a/apps/obsidian-plugin/src/i18n/locales/ko.ts +++ b/apps/obsidian-plugin/src/i18n/locales/ko.ts @@ -1,4 +1,52 @@ export const ko = { + "vault.choose": "Vault 선택", + "vault.yourVaults": "내 vault", + "vault.sharedWithYou": "공유받은 vault", + "vault.missingShared": "공유받은 vault가 없나요?", + "vault.acceptOnWeb": "브라우저에서 초대를 수락한 뒤 이 목록을 새로고침하세요.", + "vault.allVaults": "모든 vault", + "vault.usePassword": "내 비밀번호로 연결", + "vault.accessApproved": "접근이 승인되었습니다. 연결할 비밀번호를 설정하세요.", + "vault.copyCode": "코드 복사", + "vault.checkApproval": "승인 확인", + "vault.requestHelp": "새 요청이 필요한가요?", + "vault.invitedNeedsEmpty": "초대받은 vault는 비어 있는 로컬 vault에만 연결할 수 있습니다. 새 Obsidian vault를 만들고 Synch를 활성화한 뒤 다시 연결하세요.", + "vault.connectOnboardingHint": "아래에서 vault를 선택하세요. 조직 초대는 먼저 웹에서 수락한 뒤, 여기에서 접근 승인과 연결을 완료하세요.", + "vault.owned": "내 vault", + "vault.invited": "초대받은 vault", + "vault.selectedOption": "선택됨", + "vault.select": "선택", + "vault.saveAndConnect": "비밀번호 저장 후 연결", + "sharing.organization": "조직", + "sharing.title": "Vault 공유 및 비밀번호", + "sharing.passwordConnect": "이 vault에 연결하면 본인의 vault 비밀번호를 변경할 수 있습니다.", + "sharing.intro": "브라우저에서 조직 초대를 수락한 뒤, 여기에서 vault 접근을 요청하거나 승인하세요.", + "sharing.organizations": "조직 관리", + "sharing.refresh": "새로고침", + "sharing.suspended": "공유 동기화에는 유효한 Plus 구독이 필요합니다. Self-hosted는 무료로 제공됩니다.", + "sharing.setup": "접근 설정", + "sharing.recovery": "비밀번호 복구", + "sharing.requestHelp": "Vault 관리자에게 승인을 요청하세요. 완료하려면 이 기기로 돌아와야 합니다.", + "sharing.request": "승인 요청", + "sharing.yourCode": "별도의 신뢰할 수 있는 연락 수단으로 이 확인 코드 전체를 관리자에게 전달하세요.", + "sharing.waiting": "관리자의 승인을 기다리고 있습니다.", + "sharing.restartHelp": "다른 기기에서 만든 요청이라면 해당 기기로 돌아가거나 여기에서 새 요청으로 교체하세요.", + "sharing.restart": "요청 교체", + "sharing.approveHelp": "별도의 신뢰할 수 있는 연락 수단으로 받은 상대방의 확인 코드 전체를 입력하세요. 승인하면 보관된 과거 이력도 공유됩니다.", + "sharing.connectFirst": "접근을 승인하려면 먼저 본인의 비밀번호로 이 vault에 연결하세요.", + "sharing.code": "상대방 확인 코드", + "sharing.approve": "승인", + "sharing.changePassword": "내 vault 비밀번호 변경", + "sharing.setPassword": "내 vault 비밀번호 설정", + "sharing.passwordHelp": "본인의 비밀번호만 바뀝니다. 다른 멤버는 각자의 비밀번호를 유지합니다.", + "sharing.password": "새 비밀번호", + "sharing.confirmPassword": "비밀번호 확인", + "sharing.save": "저장", + "sharing.ready": "비밀번호를 저장했습니다. Vault 연결에서 이 비밀번호를 입력하면 동기화를 시작할 수 있습니다.", + "sharing.saved": "내 vault 비밀번호를 변경했습니다.", + "sharing.accountChanged": "계정 또는 서버가 변경되었습니다. 이 창을 다시 열어주세요.", + + "sync.downloading": "다운로드 중", "sync.uploading": "업로드 중", "sync.completedCount": ({ count }: { count: number }) => `${count}개 완료`, diff --git a/apps/obsidian-plugin/src/i18n/locales/zh-cn.ts b/apps/obsidian-plugin/src/i18n/locales/zh-cn.ts index 344ac886..3bdea866 100644 --- a/apps/obsidian-plugin/src/i18n/locales/zh-cn.ts +++ b/apps/obsidian-plugin/src/i18n/locales/zh-cn.ts @@ -1,7 +1,57 @@ -import { en } from "./en"; +import { + en } from "./en"; export const zhCn = { + ...en, + "vault.choose": "选择 vault", + "vault.yourVaults": "我的 vault", + "vault.sharedWithYou": "与我共享", + "vault.missingShared": "找不到共享的 vault？", + "vault.acceptOnWeb": "请在浏览器中接受邀请，然后刷新此列表。", + "vault.allVaults": "所有 vault", + "vault.usePassword": "使用我的密码", + "vault.accessApproved": "访问已获批准。请设置自己的密码以连接。", + "vault.copyCode": "复制验证码", + "vault.checkApproval": "检查审批", + "vault.requestHelp": "需要新请求？", + "vault.invitedNeedsEmpty": "受邀 vault 只能连接到空的本地 vault。请新建 Obsidian vault，在其中启用 Synch 后重新连接。", + "vault.connectOnboardingHint": "请选择 vault。请先在网页上接受组织邀请，然后在此完成访问审批和连接。", + "vault.owned": "我的 vault", + "vault.invited": "受邀 vault", + "vault.selectedOption": "已选择", + "vault.select": "选择", + "vault.saveAndConnect": "保存密码并连接", + + "sharing.organization": "组织", + "sharing.title": "Vault 共享与密码", + "sharing.passwordConnect": "连接此 vault 后可修改你自己的 vault 密码。", + "sharing.intro": "在浏览器中接受组织邀请后，在此申请或批准 Vault 访问。", + "sharing.organizations": "管理组织", + "sharing.refresh": "刷新", + "sharing.suspended": "共享同步需要有效的 Plus 订阅。自托管可免费使用。", + "sharing.setup": "设置访问", + "sharing.recovery": "恢复密码", + "sharing.requestHelp": "向 Vault 管理员申请批准。请返回此设备完成设置。", + "sharing.request": "申请批准", + "sharing.yourCode": "请通过独立可信的沟通渠道将此完整验证码发送给管理员。", + "sharing.waiting": "等待管理员批准。", + "sharing.restartHelp": "如果在另一台设备上发起了申请，请返回该设备，或在此重新申请以替换旧申请。", + "sharing.restart": "替换申请", + "sharing.approveHelp": "请输入通过独立可信的沟通渠道从对方收到的完整验证码。批准后也会共享保留的历史记录。", + "sharing.connectFirst": "请先使用自己的密码连接此 Vault，再批准访问。", + "sharing.code": "对方验证码", + "sharing.approve": "批准", + "sharing.changePassword": "更改我的 Vault 密码", + "sharing.setPassword": "设置我的 Vault 密码", + "sharing.passwordHelp": "仅更改你的密码。其他成员保留各自的密码。", + "sharing.password": "新密码", + "sharing.confirmPassword": "确认密码", + "sharing.save": "保存", + "sharing.ready": "密码已保存。使用此密码连接 Vault 即可开始同步。", + "sharing.saved": "你的 Vault 密码已更改。", + "sharing.accountChanged": "账户或服务器已更改。请重新打开此窗口。", + "sync.downloading": "正在下载", "sync.uploading": "正在上传", "sync.completedCount": ({ count }: { count: number }) => `已完成 ${count} 项`, diff --git a/apps/obsidian-plugin/src/i18n/locales/zh-tw.ts b/apps/obsidian-plugin/src/i18n/locales/zh-tw.ts index ee0e495e..0f946bc0 100644 --- a/apps/obsidian-plugin/src/i18n/locales/zh-tw.ts +++ b/apps/obsidian-plugin/src/i18n/locales/zh-tw.ts @@ -1,7 +1,57 @@ -import { en } from "./en"; +import { + en } from "./en"; export const zhTw = { + ...en, + "vault.choose": "選擇 vault", + "vault.yourVaults": "我的 vault", + "vault.sharedWithYou": "與我共用", + "vault.missingShared": "找不到共用的 vault？", + "vault.acceptOnWeb": "請在瀏覽器中接受邀請，然後重新整理此清單。", + "vault.allVaults": "所有 vault", + "vault.usePassword": "使用我的密碼", + "vault.accessApproved": "存取已獲核准。請設定自己的密碼以連線。", + "vault.copyCode": "複製驗證碼", + "vault.checkApproval": "檢查核准", + "vault.requestHelp": "需要新請求？", + "vault.invitedNeedsEmpty": "受邀 vault 只能連線至空的本機 vault。請建立新的 Obsidian vault，在其中啟用 Synch 後重新連線。", + "vault.connectOnboardingHint": "請選擇 vault。請先在網頁上接受組織邀請，再於此完成存取核准和連線。", + "vault.owned": "我的 vault", + "vault.invited": "受邀 vault", + "vault.selectedOption": "已選取", + "vault.select": "選取", + "vault.saveAndConnect": "儲存密碼並連線", + + "sharing.organization": "組織", + "sharing.title": "Vault 共享與密碼", + "sharing.passwordConnect": "連接此 vault 後可變更你自己的 vault 密碼。", + "sharing.intro": "在瀏覽器中接受組織邀請後，在此申請或核准 Vault 存取。", + "sharing.organizations": "管理組織", + "sharing.refresh": "重新整理", + "sharing.suspended": "共享同步需要有效的 Plus 訂閱。自架主機可免費使用。", + "sharing.setup": "設定存取", + "sharing.recovery": "復原密碼", + "sharing.requestHelp": "向 Vault 管理員申請核准。請返回此裝置完成設定。", + "sharing.request": "申請核准", + "sharing.yourCode": "請透過獨立可信的聯絡管道將此完整驗證碼傳送給管理員。", + "sharing.waiting": "等待管理員核准。", + "sharing.restartHelp": "如果在另一台裝置上提出申請，請返回該裝置，或在此重新申請以取代舊申請。", + "sharing.restart": "取代申請", + "sharing.approveHelp": "請輸入透過獨立可信的聯絡管道從對方收到的完整驗證碼。核准後也會共享保留的歷史紀錄。", + "sharing.connectFirst": "請先使用自己的密碼連接此 Vault，再核准存取。", + "sharing.code": "對方驗證碼", + "sharing.approve": "核准", + "sharing.changePassword": "變更我的 Vault 密碼", + "sharing.setPassword": "設定我的 Vault 密碼", + "sharing.passwordHelp": "僅變更你的密碼。其他成員保留各自的密碼。", + "sharing.password": "新密碼", + "sharing.confirmPassword": "確認密碼", + "sharing.save": "儲存", + "sharing.ready": "密碼已儲存。使用此密碼連接 Vault 即可開始同步。", + "sharing.saved": "你的 Vault 密碼已變更。", + "sharing.accountChanged": "帳號或伺服器已變更。請重新開啟此視窗。", + "sync.downloading": "正在下載", "sync.uploading": "正在上傳", "sync.completedCount": ({ count }: { count: number }) => `已完成 ${count} 項`, diff --git a/apps/obsidian-plugin/src/test-stubs/obsidian.ts b/apps/obsidian-plugin/src/test-stubs/obsidian.ts index 02a6fb19..7af72eb1 100644 --- a/apps/obsidian-plugin/src/test-stubs/obsidian.ts +++ b/apps/obsidian-plugin/src/test-stubs/obsidian.ts @@ -14,6 +14,7 @@ const settingNames: string[] = []; const settingDescriptions: string[] = []; const settingClasses: string[][] = []; const createdElements: StoredElementRecord[] = []; +const openModals: Modal[] = []; const notices: Array<{ message: string; timeout?: number }> = []; interface CreatedElementRecord { @@ -105,6 +106,7 @@ class MockElement { } export class MockButtonComponent { + buttonEl = new MockElement(); text = ""; disabled = false; private clickCallback: (() => void | Promise) | null = null; @@ -148,6 +150,7 @@ export class MockTextComponent { value: "", autocomplete: "", readOnly: false, + setAttribute(_name: string, _value: string): void {}, rows: 0, classList: { add(_value: string): void {}, @@ -384,16 +387,20 @@ export class Plugin { export const editorInfoField = {}; export class Modal { + modalEl = new MockElement(); containerEl = new MockElement(); contentEl = new MockElement(); constructor(public app: unknown) {} open(): void { + openModals.push(this); this.onOpen(); } close(): void { + const index = openModals.indexOf(this); + if (index >= 0) openModals.splice(index, 1); this.onClose(); } @@ -684,7 +691,12 @@ export function getNotices(): Array<{ message: string; timeout?: number }> { return notices.map((notice) => ({ ...notice })); } +export function getOpenModals(): Modal[] { + return [...openModals]; +} + export function resetObsidianMocks(): void { + openModals.length = 0; requestUrlMock = null; language = "en"; buttonComponents.length = 0; diff --git a/apps/obsidian-plugin/src/ui/contracts.ts b/apps/obsidian-plugin/src/ui/contracts.ts index 58ee6708..d2ce3622 100644 --- a/apps/obsidian-plugin/src/ui/contracts.ts +++ b/apps/obsidian-plugin/src/ui/contracts.ts @@ -99,7 +99,7 @@ export type SynchSubscriptionStatus = } | { state: "loaded"; - planId: "free" | "starter" | "self_hosted"; + planId: "free" | "starter" | "plus" | "self_hosted"; billingInterval: "monthly" | "annual" | null; active: boolean; status: string; diff --git a/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-flow.test.ts b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-flow.test.ts new file mode 100644 index 00000000..5f85660f --- /dev/null +++ b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-flow.test.ts @@ -0,0 +1,195 @@ +import { beforeEach, describe, expect, it, vi } from "vitest"; +import type { SharingManager, SharingOrganization } from "@synch/sync-client/remote"; +import { OrganizationApiUnavailableError } from "@synch/sync-client/remote"; +import { ApiRequestError } from "@synch/sync-client/http"; +import { resetObsidianMocks } from "../../test-stubs/obsidian"; +import { t } from "../../i18n"; +import { ConnectVaultFlow } from "./connect-vault-flow"; + +function setup() { + const organization: SharingOrganization = { + id: "org", name: "Team", role: "member", + sharing: { enabled: true, memberLimit: 3 }, + vaults: [{ id: "vault", name: "Notes", personal: false, canManage: false, status: "active", shared: true, members: [] }], + }; + const manager = { + client: { organizations: vi.fn(async () => [organization]) }, + localRequest: vi.fn(async () => null), + recipientVerificationCode: vi.fn(async () => "verified-code"), + begin: vi.fn(async () => {}), restart: vi.fn(async () => {}), + receive: vi.fn(async () => { organization.vaults[0]!.status = "active"; }), + }; + const deps = { + listLegacyVaults: vi.fn(async () => [{ + id: "legacy", name: "Personal notes", organizationId: "org", + activeKeyVersion: 1, createdAt: "2026-01-01T00:00:00.000Z", + }]), + manager: manager as unknown as SharingManager, + isCurrentAccount: vi.fn(() => true), + hasExistingFiles: vi.fn(async () => false), + confirmPersonalVault: vi.fn(async () => true), + bootstrap: vi.fn(async (_input: unknown, beforeActivate: () => Promise) => { await beforeActivate(); }), + }; + return { flow: new ConnectVaultFlow(deps), deps, manager, organization, vault: organization.vaults[0]! }; +} + +beforeEach(resetObsidianMocks); + +describe("vault connection safety", () => { + it.each([true, false])("preserves merge confirmation on older servers (%s)", async (confirmed) => { + const { flow, manager, deps } = setup(); + manager.client.organizations.mockRejectedValue(new OrganizationApiUnavailableError()); + deps.hasExistingFiles.mockResolvedValue(true); + deps.confirmPersonalVault.mockResolvedValue(confirmed); + expect(await flow.list()).toEqual([expect.objectContaining({ + sharingEnabled: false, + vault: expect.objectContaining({ id: "legacy", personal: true, status: "active" }), + })]); + await expect(flow.connect("legacy", "my password")).resolves.toBe(confirmed); + expect(deps.confirmPersonalVault).toHaveBeenCalledOnce(); + expect(deps.bootstrap).toHaveBeenCalledTimes(confirmed ? 1 : 0); + expect(manager.begin).not.toHaveBeenCalled(); + }); + + it.each([401, 403, 404, 503])("does not fall back for an ordinary API error (%s)", async (status) => { + const { flow, manager, deps } = setup(); + // A detail endpoint's 404 is not an OrganizationApiUnavailableError. + manager.client.organizations.mockRejectedValue(new ApiRequestError(status, "failed", "Unavailable")); + await expect(flow.list()).rejects.toThrow("Unavailable"); + expect(deps.listLegacyVaults).not.toHaveBeenCalled(); + }); + + it("rechecks the account after loading the legacy vault list", async () => { + const { flow, manager, deps } = setup(); + manager.client.organizations.mockRejectedValue(new OrganizationApiUnavailableError()); + deps.listLegacyVaults.mockImplementation(async () => { + deps.isCurrentAccount.mockReturnValue(false); + return []; + }); + await expect(flow.list()).rejects.toThrow(t("sharing.accountChanged")); + expect(deps.bootstrap).not.toHaveBeenCalled(); + }); + + it.each(["member", "admin"] as const)("blocks an invited %s from connecting existing files", async (role) => { + const { flow, deps, vault } = setup(); + vault.canManage = role === "admin"; + deps.hasExistingFiles.mockResolvedValue(true); + await expect(flow.connect("vault", "password")).rejects.toThrow(t("vault.invitedNeedsEmpty")); + expect(deps.bootstrap).not.toHaveBeenCalled(); + expect(deps.confirmPersonalVault).not.toHaveBeenCalled(); + }); + + it("allows an invited member to connect an empty vault with their own password", async () => { + const { flow, deps } = setup(); + await expect(flow.connect("vault", "my password")).resolves.toBe(true); + expect(deps.bootstrap).toHaveBeenCalledWith({ vaultId: "vault", password: "my password" }, expect.any(Function)); + expect(deps.confirmPersonalVault).not.toHaveBeenCalled(); + }); + + it.each([true, false])("honors personal-vault confirmation (%s)", async (confirmed) => { + const { flow, deps, vault } = setup(); + vault.personal = true; + deps.hasExistingFiles.mockResolvedValue(true); + deps.confirmPersonalVault.mockResolvedValue(confirmed); + await expect(flow.connect("vault", "password")).resolves.toBe(confirmed); + expect(deps.confirmPersonalVault).toHaveBeenCalledOnce(); + expect(deps.bootstrap).toHaveBeenCalledTimes(confirmed ? 1 : 0); + }); + + it("rechecks files after approval completes, before bootstrap", async () => { + const { flow, deps, manager, vault } = setup(); + vault.status = "pending_key"; + manager.receive.mockImplementation(async () => { + vault.status = "active"; + deps.hasExistingFiles.mockResolvedValue(true); + }); + await expect(flow.connect("vault", "password", "password")).rejects.toThrow(t("vault.invitedNeedsEmpty")); + expect(manager.receive).toHaveBeenCalledOnce(); + expect(deps.bootstrap).not.toHaveBeenCalled(); + }); + + it("finishes enrollment and connects with the newly saved password", async () => { + const { flow, manager, deps, vault } = setup(); + vault.status = "pending_key"; + await expect(flow.connect("vault", "my password", "my password")).resolves.toBe(true); + expect(manager.receive).toHaveBeenCalledWith("vault", "my password", "my password"); + expect(deps.bootstrap).toHaveBeenCalledWith({ vaultId: "vault", password: "my password" }, expect.any(Function)); + }); + + it("retries connection after enrollment succeeded but bootstrap failed", async () => { + const { flow, manager, deps, vault } = setup(); + vault.status = "pending_key"; + deps.bootstrap.mockRejectedValueOnce(new Error("offline")); + await expect(flow.connect("vault", "password", "password")).rejects.toThrow("offline"); + await expect(flow.connect("vault", "password", "password")).resolves.toBe(true); + expect(manager.receive).toHaveBeenCalledOnce(); + }); + + it.each(["files", "account"])("rechecks %s after bootstrap I/O and before activation", async (change) => { + const { flow, deps } = setup(); + deps.bootstrap.mockImplementation(async (_input, beforeActivate) => { + if (change === "files") deps.hasExistingFiles.mockResolvedValue(true); + else deps.isCurrentAccount.mockReturnValue(false); + await beforeActivate(); + }); + await expect(flow.connect("vault", "password")).rejects.toThrow( + t(change === "files" ? "vault.invitedNeedsEmpty" : "sharing.accountChanged"), + ); + }); + + it("does not bootstrap until administrator approval and password setup finish", async () => { + const { flow, deps, vault } = setup(); + vault.status = "pending_key"; + await expect(flow.connect("vault", "password")).rejects.toThrow(t("sharing.waiting")); + expect(deps.bootstrap).not.toHaveBeenCalled(); + }); + + it("fails closed when fresh access data cannot be loaded", async () => { + const { flow, manager, deps } = setup(); + await flow.list(); + manager.client.organizations.mockRejectedValueOnce(new Error("offline")); + await expect(flow.connect("vault", "password")).rejects.toThrow("offline"); + expect(deps.bootstrap).not.toHaveBeenCalled(); + }); + + it("rejects access revoked after the picker was opened", async () => { + const { flow, deps, vault } = setup(); + await flow.list(); + vault.status = "revoked"; + await expect(flow.connect("vault", "password")).rejects.toThrow(t("vault.remoteAccessUnavailable")); + expect(deps.bootstrap).not.toHaveBeenCalled(); + }); + + it("rejects account changes while loading or confirming", async () => { + const { flow, deps, vault } = setup(); + vault.personal = true; + deps.confirmPersonalVault.mockImplementation(async () => { + deps.isCurrentAccount.mockReturnValue(false); + return true; + }); + await expect(flow.connect("vault", "password")).rejects.toThrow(t("sharing.accountChanged")); + expect(deps.bootstrap).not.toHaveBeenCalled(); + }); + + it("shows pending grants and excludes revoked or unassigned vaults", async () => { + const { flow, organization, vault } = setup(); + vault.status = "pending_key"; + organization.vaults.push({ ...vault, id: "revoked", status: "revoked" }, { ...vault, id: "unassigned", status: null }); + expect(await flow.list()).toEqual([{ vault, organizationName: "Team", sharingEnabled: true }]); + }); + + it("blocks suspended shared vaults even for their owner", async () => { + const { flow, deps, organization, vault } = setup(); + organization.sharing.enabled = false; + vault.personal = true; + await expect(flow.connect("vault", "password")).rejects.toThrow(t("sharing.suspended")); + expect(deps.bootstrap).not.toHaveBeenCalled(); + }); + + it("does not request approval from a nonempty invited vault", async () => { + const { flow, deps, manager } = setup(); + deps.hasExistingFiles.mockResolvedValue(true); + await expect(flow.request("vault")).rejects.toThrow(t("vault.invitedNeedsEmpty")); + expect(manager.begin).not.toHaveBeenCalled(); + }); +}); diff --git a/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-flow.ts b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-flow.ts new file mode 100644 index 00000000..3c000ff2 --- /dev/null +++ b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-flow.ts @@ -0,0 +1,130 @@ +import type { + BootstrapRemoteVaultInput, + RemoteVaultRecord, + SharingManager, + SharingVault, +} from "@synch/sync-client/remote"; +import { OrganizationApiUnavailableError } from "@synch/sync-client/remote"; +import { t } from "../../i18n"; + +export interface VaultAccessContext { + manager: SharingManager; + isCurrentAccount(): boolean; +} + +export interface ConnectableVault { + vault: SharingVault; + organizationName: string; + sharingEnabled: boolean; +} + +export interface ConnectVaultFlowDeps extends VaultAccessContext { + listLegacyVaults(): Promise; + hasExistingFiles(): Promise; + confirmPersonalVault(): Promise; + bootstrap(input: BootstrapRemoteVaultInput, beforeActivate: () => Promise): Promise; +} + +/** One connection attempt is bound to the account that opened the picker. */ +export class ConnectVaultFlow { + constructor(private readonly deps: ConnectVaultFlowDeps) {} + + assertCurrentAccount(): void { + if (!this.deps.isCurrentAccount()) throw new Error(t("sharing.accountChanged")); + } + + async list(): Promise { + this.assertCurrentAccount(); + let organizations; + try { + organizations = await this.deps.manager.client.organizations(); + } catch (error) { + if (!(error instanceof OrganizationApiUnavailableError)) throw error; + this.assertCurrentAccount(); + const vaults = await this.deps.listLegacyVaults(); + this.assertCurrentAccount(); + // Preserve the original password-and-merge-confirmation flow. Old servers + // do not provide sharing provenance, so no enrollment controls are shown. + return vaults.map(vault => ({ + vault: { id: vault.id, name: vault.name, personal: true, shared: false, + canManage: false, status: "active", members: [] }, + organizationName: "", + sharingEnabled: false, + })); + } + this.assertCurrentAccount(); + return organizations.flatMap((organization) => + organization.vaults + .filter((vault) => vault.status === "active" || vault.status === "pending_key") + .map((vault) => ({ + vault, + organizationName: organization.name, + sharingEnabled: organization.sharing.enabled, + })), + ); + } + + async blockingReason(item: ConnectableVault): Promise { + if (item.vault.shared && !item.sharingEnabled) return t("sharing.suspended"); + // A vault creator owns its grant, including in an organization they joined. + // Invited admins and members must both start with an empty local vault. + if (!item.vault.personal && await this.deps.hasExistingFiles()) { + return t("vault.invitedNeedsEmpty"); + } + return null; + } + + async localRequest(vaultId: string) { + this.assertCurrentAccount(); + const request = await this.deps.manager.localRequest(vaultId); + this.assertCurrentAccount(); + return request; + } + + async verificationCode(vaultId: string): Promise { + this.assertCurrentAccount(); + const code = await this.deps.manager.recipientVerificationCode(vaultId); + this.assertCurrentAccount(); + return code; + } + + async request(vaultId: string, restart = false): Promise { + const item = await this.requireAvailable(vaultId); + if (!item.sharingEnabled) throw new Error(t("sharing.suspended")); + if (restart) await this.deps.manager.restart(vaultId); + else await this.deps.manager.begin(vaultId); + this.assertCurrentAccount(); + } + + async connect(vaultId: string, password: string, confirmPassword?: string): Promise { + let item = await this.requireAvailable(vaultId); + if (item.vault.personal && !await this.deps.confirmPersonalVault()) return false; + this.assertCurrentAccount(); + if (confirmPassword !== undefined && + (item.vault.status === "pending_key" || await this.localRequest(vaultId))) { + await this.deps.manager.receive(vaultId, password, confirmPassword); + // Completing enrollment does not change the local connection. Re-read the + // grant and local files before attaching, including after a slow approval. + item = await this.requireAvailable(vaultId); + } + if (item.vault.status !== "active") throw new Error(t("sharing.waiting")); + const blocked = await this.blockingReason(item); + if (blocked) throw new Error(blocked); + this.assertCurrentAccount(); + await this.deps.bootstrap({ vaultId, password }, async () => { + const reason = await this.blockingReason(item); + if (reason) throw new Error(reason); + this.assertCurrentAccount(); + }); + return true; + } + + private async requireAvailable(vaultId: string): Promise { + const item = (await this.list()).find((entry) => entry.vault.id === vaultId); + if (!item) throw new Error(t("vault.remoteAccessUnavailable")); + const blocked = await this.blockingReason(item); + if (blocked) throw new Error(blocked); + this.assertCurrentAccount(); + return item; + } +} diff --git a/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-modal.test.ts b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-modal.test.ts new file mode 100644 index 00000000..69567935 --- /dev/null +++ b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-modal.test.ts @@ -0,0 +1,191 @@ +import { App } from "obsidian"; +import { beforeEach, describe, expect, it, vi } from "vitest"; +import type { VaultKeyRequest } from "@synch/sync-client/remote"; +import { + getButtonComponents, getCreatedElements, getCreatedElementTexts, + getOpenModals, getTextComponents, resetObsidianMocks, +} from "../../test-stubs/obsidian"; +import { t } from "../../i18n"; +import { ConnectVaultFlow, type ConnectableVault } from "./connect-vault-flow"; +import { openConnectVaultModal } from "./connect-vault-modal"; + +const tick = () => new Promise((resolve) => setTimeout(resolve, 0)); +const button = (label: string) => getButtonComponents().findLast((entry) => entry.text === label)!; +const inlineError = (message: string) => getCreatedElements().some((element) => + element.classes.includes("synch-modal-error") && element.text === message, +); + +function setup(status: "active" | "pending_key" = "active") { + const item: ConnectableVault = { + vault: { id: "vault", name: "Team notes", personal: false, canManage: false, status, shared: true, members: [] }, + organizationName: "Team", sharingEnabled: true, + }; + const flow = { + assertCurrentAccount: vi.fn(), + list: vi.fn(async () => [item]), + blockingReason: vi.fn(async (): Promise => null), + localRequest: vi.fn(async (): Promise => null), + verificationCode: vi.fn(async () => "verified-local-code"), + request: vi.fn(async () => {}), + connect: vi.fn(async () => true), + }; + const open = () => openConnectVaultModal(new App(), flow as unknown as ConnectVaultFlow, null); + return { item, flow, open }; +} + +beforeEach(resetObsidianMocks); + +describe("connect vault onboarding", () => { + it("offers password connection without recovery controls on older servers", async () => { + const { item, open } = setup(); + item.sharingEnabled = false; + item.vault.personal = true; + item.vault.shared = false; + item.organizationName = ""; + const result = open(); + await tick(); + await button("Team notes").click(); + expect(getTextComponents()).toHaveLength(1); + expect(getButtonComponents().map(entry => entry.text)).not.toContain(t("sharing.recovery")); + getOpenModals().at(-1)?.close(); + await expect(result).resolves.toBe(false); + }); + + it("starts with a picker and no password or automatic selection", async () => { + const { open, flow } = setup(); + void open(); + await tick(); + expect(getTextComponents()).toHaveLength(0); + expect(flow.blockingReason).not.toHaveBeenCalled(); + expect(getButtonComponents().map((entry) => entry.text)).toEqual([ + t("sharing.refresh"), "Team notes", t("sharing.refresh"), + ]); + await button("Team notes").click(); + expect(getTextComponents()).toHaveLength(1); + await button(t("vault.allVaults")).click(); + expect(getButtonComponents().at(-2)?.text).toBe("Team notes"); + expect(getButtonComponents().at(-1)?.text).toBe(t("sharing.refresh")); + }); + + it("shows organizations and invitation labels, and connects on Enter", async () => { + const { open, flow } = setup(); + const result = open(); + await tick(); + await button("Team notes")?.click(); + expect(getCreatedElementTexts()).toContain("Team"); + await getTextComponents().at(-1)?.change("my password"); + await getTextComponents().at(-1)?.pressKey("Enter"); + expect(flow.connect).toHaveBeenCalledWith("vault", "my password", undefined); + await expect(result).resolves.toBe(true); + }); + + it("shows connection errors inline and lets the user retry or cancel", async () => { + const { open, flow } = setup(); + flow.connect.mockRejectedValueOnce(new Error("Wrong password")); + const result = open(); + await tick(); + await button("Team notes")?.click(); + await getTextComponents().at(-1)?.change("wrong"); + await button(t("vault.connect")).click(); + expect(inlineError("Wrong password")).toBe(true); + getOpenModals().at(-1)?.close(); + await expect(result).resolves.toBe(false); + }); + + it("cannot cancel, change the selected vault, or submit twice while connecting", async () => { + const { open, flow } = setup(); + let finish!: (connected: boolean) => void; + flow.connect.mockImplementation(() => new Promise((resolve) => { finish = resolve; })); + const result = open(); + await tick(); + await button("Team notes")?.click(); + const submit = button(t("vault.connect")).click(); + await tick(); + expect(button(t("vault.allVaults")).disabled).toBe(true); + getOpenModals().at(-1)?.close(); + expect(getOpenModals()).toHaveLength(1); + await button(t("vault.connect")).click(); + expect(flow.connect).toHaveBeenCalledOnce(); + finish(true); + await submit; + await expect(result).resolves.toBe(true); + }); + + it("guides pending access through request, verified code, approval, and personal password", async () => { + const { open, flow } = setup("pending_key"); + const request = { status: "pending", expiresAt: Date.now() + 60_000 } as VaultKeyRequest; + flow.request.mockImplementation(async () => { flow.localRequest.mockResolvedValue(request); }); + const result = open(); + await tick(); + await button("Team notes")?.click(); + expect(getTextComponents()).toHaveLength(0); + await button(t("sharing.request")).click(); + expect(flow.request).toHaveBeenCalledWith("vault"); + expect(getCreatedElementTexts()).toContain("verified-local-code"); + expect(getCreatedElementTexts()).toContain(t("sharing.waiting")); + request.status = "approved"; + await button(t("vault.checkApproval")).click(); + const [password, confirm] = getTextComponents().slice(-2); + await password?.change("my new password"); + await confirm?.change("my new password"); + await button(t("vault.saveAndConnect")).click(); + expect(flow.connect).toHaveBeenCalledWith("vault", "my new password", "my new password"); + await expect(result).resolves.toBe(true); + }); + + it("resumes an approved request when the picker is reopened", async () => { + const { open, flow } = setup("pending_key"); + flow.localRequest.mockResolvedValue({ status: "approved", expiresAt: Date.now() + 60_000 } as VaultKeyRequest); + void open(); + await tick(); + await button("Team notes")?.click(); + expect(button(t("vault.saveAndConnect"))).toBeDefined(); + expect(flow.verificationCode).not.toHaveBeenCalled(); + expect(flow.request).not.toHaveBeenCalled(); + }); + + it("offers explicit replacement when a saved request is missing on the server", async () => { + const { open, flow } = setup("pending_key"); + flow.localRequest.mockRejectedValueOnce(new Error("Request not found")); + void open(); + await tick(); + await button("Team notes")?.click(); + expect(inlineError("Request not found")).toBe(true); + await button(t("sharing.restart")).click(); + expect(flow.request).toHaveBeenCalledWith("vault", true); + }); + + it("shows an empty-vault explanation without password or approval controls when blocked", async () => { + const { open, flow } = setup("pending_key"); + flow.blockingReason.mockResolvedValue(t("vault.invitedNeedsEmpty")); + void open(); + await tick(); + await button("Team notes")?.click(); + expect(getCreatedElementTexts()).toContain(t("vault.invitedNeedsEmpty")); + expect(getTextComponents()).toHaveLength(0); + expect(getButtonComponents().some((entry) => entry.text === t("sharing.request"))).toBe(false); + }); + + it("offers retry after a list error and explains web invitation acceptance for an empty list", async () => { + const { open, flow } = setup(); + flow.list.mockRejectedValueOnce(new Error("offline")).mockResolvedValue([]); + void open(); + await tick(); + await button("Team notes")?.click(); + expect(inlineError("offline")).toBe(true); + await button(t("sharing.refresh")).click(); + expect(getCreatedElementTexts()).toContain(t("vault.noVaults")); + expect(getCreatedElementTexts()).toContain(t("vault.acceptOnWeb")); + }); + + it("does not reveal request codes or submit after the account changes", async () => { + const { open, flow } = setup("pending_key"); + void open(); + await tick(); + await button("Team notes")?.click(); + flow.assertCurrentAccount.mockImplementation(() => { throw new Error(t("sharing.accountChanged")); }); + await button(t("sharing.request")).click(); + expect(flow.request).not.toHaveBeenCalled(); + expect(inlineError(t("sharing.accountChanged"))).toBe(true); + }); +}); diff --git a/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-modal.ts b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-modal.ts new file mode 100644 index 00000000..47b36d9f --- /dev/null +++ b/apps/obsidian-plugin/src/ui/remote-vault/connect-vault-modal.ts @@ -0,0 +1,258 @@ +import { App, Modal, Setting, setIcon, type ButtonComponent } from "obsidian"; +import { t } from "../../i18n"; +import { submitOnEnter } from "../keyboard"; +import { ConnectVaultFlow, type ConnectableVault } from "./connect-vault-flow"; + +export function openConnectVaultModal( + app: App, + flow: ConnectVaultFlow, + preferredVaultId: string | null, +): Promise { + return new ConnectVaultModal(app, flow, preferredVaultId).openAndWait(); +} + +export class ConnectVaultModal extends Modal { + private resolve: ((connected: boolean) => void) | null = null; + private connected = false; + private busy = false; + private closed = false; + private controls: ButtonComponent[] = []; + private errorEl!: HTMLElement; + private bodyEl!: HTMLElement; + private selectedId: string | null = null; + private recovering = false; + + constructor(app: App, private readonly flow: ConnectVaultFlow, private readonly preferredId: string | null) { + super(app); + } + + openAndWait(): Promise { + return new Promise((resolve) => { + this.resolve = resolve; + this.open(); + }); + } + + onOpen(): void { + this.modalEl.addClass("synch-connect-modal"); + this.contentEl.addClass("synch-connect"); + this.bodyEl = this.contentEl.createDiv(); + this.errorEl = this.contentEl.createEl("p", { cls: "synch-modal-error" }); + this.errorEl.setAttribute("role", "alert"); + this.renderList([], true); + void this.run(() => this.refresh()); + } + + close(): void { + if (!this.busy) super.close(); + } + + onClose(): void { + this.closed = true; + this.contentEl.empty(); + this.resolve?.(this.connected); + this.resolve = null; + } + + private row(cls: string, parent = this.bodyEl): Setting { + const row = new Setting(parent); + row.settingEl.addClass(cls); + return row; + } + + private addButton(setting: Setting, label: string, action: () => Promise | void, cta = false): ButtonComponent { + let control!: ButtonComponent; + setting.addButton((button) => { + button.setButtonText(label).setDisabled(this.busy).onClick(action); + if (cta) button.setCta(); + this.controls.push(button); + control = button; + }); + return control; + } + + private primary(label: string, action: () => Promise): void { + this.addButton(this.row("synch-connect-primary"), label, () => this.run(action), true); + } + + private resetScreen(): void { + this.controls = []; + this.bodyEl.empty(); + } + + private title(title: string, description?: string): void { + this.bodyEl.createEl("h2", { text: title }); + if (description) this.bodyEl.createEl("p", { text: description, cls: "synch-connect-hint" }); + } + + private async run(action: () => Promise): Promise { + if (this.busy || this.closed) return; + this.busy = true; + this.errorEl.setText(""); + this.controls.forEach((button) => { button.setDisabled(true); }); + try { + this.flow.assertCurrentAccount(); + await action(); + } catch (error) { + this.errorEl.setText(error instanceof Error ? error.message : String(error)); + } finally { + this.busy = false; + this.controls.forEach((button) => { button.setDisabled(false); }); + if (this.connected) this.close(); + } + } + + private async refresh(): Promise { + const items = await this.flow.list(); + if (this.selectedId === null) { + this.renderList(items); + return; + } + const selected = items.find((item) => item.vault.id === this.selectedId); + if (!selected) { + this.selectedId = null; + this.renderList(items); + throw new Error(t("vault.remoteAccessUnavailable")); + } + await this.renderAccess(selected); + } + + private renderList(items: ConnectableVault[], loading = false): void { + this.resetScreen(); + this.title(t("vault.choose")); + for (const owned of [true, false]) { + const group = items.filter((item) => (item.vault.personal) === owned); + if (!group.length) continue; + this.bodyEl.createEl("h3", { text: t(owned ? "vault.yourVaults" : "vault.sharedWithYou"), cls: "synch-connect-group" }); + // A previous connection affects ordering only; the user always chooses. + group.sort((a, b) => Number(b.vault.id === this.preferredId) - Number(a.vault.id === this.preferredId)); + for (const item of group) { + const button = this.addButton(this.row("synch-connect-choice"), item.vault.name, () => this.run(async () => { + this.selectedId = item.vault.id; + this.recovering = false; + await this.refresh(); + })); + const el = button.buttonEl; + el.empty(); + const icon = el.createSpan({ cls: "synch-connect-vault-icon" }); + setIcon(icon, owned ? "vault" : "users"); + icon.setAttribute("aria-hidden", "true"); + const text = el.createSpan({ cls: "synch-connect-choice-text" }); + text.createSpan({ text: item.vault.name }); + if (item.organizationName) text.createSpan({ text: item.organizationName, cls: "synch-connect-choice-meta" }); + const arrow = el.createSpan({ cls: "synch-connect-chevron" }); + setIcon(arrow, "chevron-right"); + arrow.setAttribute("aria-hidden", "true"); + } + } + if (!items.length) this.bodyEl.createEl("p", { text: t(loading ? "loading" : "vault.noVaults"), cls: "synch-connect-hint" }); + const help = this.bodyEl.createEl("details", { cls: "synch-connect-help" }); + help.createEl("summary", { text: t("vault.missingShared") }); + help.createEl("p", { text: t("vault.acceptOnWeb") }); + this.addButton(this.row("synch-connect-secondary"), t("sharing.refresh"), () => this.run(() => this.refresh())); + } + + private async renderAccess(item: ConnectableVault): Promise { + this.resetScreen(); + this.addButton(this.row("synch-connect-back"), t("vault.allVaults"), () => this.run(async () => { + this.selectedId = null; + this.recovering = false; + await this.refresh(); + })); + if (item.organizationName) this.bodyEl.createEl("p", { text: item.organizationName, cls: "synch-connect-eyebrow" }); + this.title(item.vault.name); + const blocked = await this.flow.blockingReason(item); + this.flow.assertCurrentAccount(); + if (blocked) { + this.bodyEl.createEl("p", { text: blocked, cls: "synch-connect-notice" }); + return; + } + const { vault } = item; + if (vault.status === "active" && !this.recovering) { + this.passwordForm(vault.id, false); + if (item.sharingEnabled) this.addButton(this.row("synch-connect-secondary"), t("sharing.recovery"), () => this.run(async () => { + this.recovering = true; + await this.refresh(); + })); + return; + } + if (vault.status === "active") this.addButton(this.row("synch-connect-secondary"), t("vault.usePassword"), () => this.run(async () => { + this.recovering = false; + await this.refresh(); + })); + if (!item.sharingEnabled) { + this.bodyEl.createEl("p", { text: t("sharing.suspended"), cls: "synch-connect-notice" }); + return; + } + let request; + try { + request = await this.flow.localRequest(vault.id); + } catch (error) { + this.renderRestart(vault.id); + throw error; + } + if (request && request.status !== "canceled" && request.expiresAt > Date.now()) { + if (request.status === "approved" || request.status === "completed") { + this.bodyEl.createEl("p", { text: t("vault.accessApproved"), cls: "synch-connect-hint" }); + this.passwordForm(vault.id, true); + return; + } + this.bodyEl.createEl("h3", { text: t("sharing.waiting"), cls: "synch-connect-status" }); + this.bodyEl.createEl("p", { text: t("sharing.yourCode"), cls: "synch-connect-hint" }); + const code = await this.flow.verificationCode(vault.id); + this.bodyEl.createEl("code", { text: code, cls: "synch-connect-code" }); + this.addButton(this.row("synch-connect-secondary"), t("vault.copyCode"), () => this.run(async () => { + await navigator.clipboard.writeText(code); + })); + this.primary(t("vault.checkApproval"), () => this.refresh()); + const help = this.bodyEl.createEl("details", { cls: "synch-connect-help" }); + help.createEl("summary", { text: t("vault.requestHelp") }); + this.renderRestart(vault.id, help); + return; + } + if (request) { + this.renderRestart(vault.id); + return; + } + this.bodyEl.createEl("p", { text: t("sharing.requestHelp"), cls: "synch-connect-hint" }); + this.primary(t("sharing.request"), async () => { + await this.flow.request(vault.id); + await this.refresh(); + }); + } + + private renderRestart(vaultId: string, parent = this.bodyEl): void { + parent.createEl("p", { text: t("sharing.restartHelp"), cls: "synch-connect-hint" }); + this.addButton(this.row("synch-connect-secondary", parent), t("sharing.restart"), () => this.run(async () => { + await this.flow.request(vaultId, true); + await this.refresh(); + })); + } + + private passwordForm(vaultId: string, enrollment: boolean): void { + let password = ""; + let confirmation = ""; + const submit = async (): Promise => { + this.connected = await this.flow.connect(vaultId, password, enrollment ? confirmation : undefined); + }; + this.row("synch-connect-field") + .setName(t(enrollment ? "sharing.setPassword" : "vault.password")) + .addText((text) => { + text.inputEl.type = "password"; + text.inputEl.autocomplete = enrollment ? "new-password" : "current-password"; + text.inputEl.setAttribute("aria-label", t(enrollment ? "sharing.setPassword" : "vault.password")); + text.setPlaceholder(t("vault.passwordPlaceholder")).onChange((value) => { password = value; }); + submitOnEnter(text.inputEl, () => this.run(submit)); + }); + if (enrollment) this.row("synch-connect-field") + .setName(t("vault.confirmPassword")) + .addText((text) => { + text.inputEl.type = "password"; + text.inputEl.autocomplete = "new-password"; + text.inputEl.setAttribute("aria-label", t("vault.confirmPassword")); + text.setPlaceholder(t("vault.passwordConfirmPlaceholder")).onChange((value) => { confirmation = value; }); + submitOnEnter(text.inputEl, () => this.run(submit)); + }); + this.primary(t(enrollment ? "vault.saveAndConnect" : "vault.connect"), submit); + } +} diff --git a/apps/obsidian-plugin/src/ui/remote-vault/ports.ts b/apps/obsidian-plugin/src/ui/remote-vault/ports.ts index 31435612..c72709c8 100644 --- a/apps/obsidian-plugin/src/ui/remote-vault/ports.ts +++ b/apps/obsidian-plugin/src/ui/remote-vault/ports.ts @@ -7,12 +7,14 @@ import type { // Minimal port of RemoteVaultManager required by the remote-vault UI flow. export interface RemoteVaultPort { + listCreatableOrganizations(): Promise<{ id: string; name: string }[]>; createRemoteVault( input: CreateRemoteVaultInput, ): Promise; listRemoteVaults(): Promise; bootstrapRemoteVault( input: BootstrapRemoteVaultInput, + beforeActivate?: () => Promise, ): Promise; disconnectRemoteVault(options?: { notify?: boolean }): Promise; } diff --git a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.test.ts b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.test.ts index 93c46980..90ae1a37 100644 --- a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.test.ts +++ b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.test.ts @@ -2,11 +2,14 @@ import { Plugin } from "obsidian"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; import { DEFAULT_SYNC_FILE_RULES } from "@synch/sync-client/core"; -import { resetObsidianMocks, setLanguage } from "../../test-stubs/obsidian"; +import { getButtonComponents, getOpenModals, getCreatedElementTexts, getTextComponents, resetObsidianMocks, setLanguage } from "../../test-stubs/obsidian"; +import { t } from "../../i18n"; +import type { SharingManager } from "@synch/sync-client/remote"; import type { RemoteVaultPort } from "./ports"; import { SynchRemoteVaultController, type RemoteVaultSyncPort, + type SynchRemoteVaultControllerDeps, } from "./remote-vault-controller"; describe("SynchRemoteVaultController", () => { @@ -33,6 +36,7 @@ describe("SynchRemoteVaultController", () => { ...DEFAULT_SYNC_FILE_RULES, }), getStoredRemoteVaultId: () => null, + createVaultAccessContext: vi.fn(), hasConnectedRemoteVault: () => false, initializeSyncStoreForActiveRemoteVault: vi.fn(async () => {}), ensureAutoSyncState: vi.fn(async () => {}), @@ -49,3 +53,91 @@ describe("SynchRemoteVaultController", () => { ); }); }); + +const nextTask = () => new Promise((resolve) => setTimeout(resolve, 0)); +const latestButton = (text: string) => getButtonComponents().findLast((button) => button.text === text)!; + +function connectionFixture(role: "owner" | "member", files: string[]) { + const plugin = new Plugin(); + Object.assign(plugin.app, { + vault: { + configDir: ".obsidian", + getFiles: () => files.map((path) => ({ path })), + adapter: { list: async () => ({ files: [], folders: [] }) }, + }, + }); + const bootstrap = vi.fn(async (_input, beforeActivate) => { await beforeActivate(); }); + const deps: SynchRemoteVaultControllerDeps = { + plugin, + remoteVaultManager: { bootstrapRemoteVault: bootstrap } as unknown as RemoteVaultPort, + syncController: {} as RemoteVaultSyncPort, + clearSyncTokenState: vi.fn(), getApiBaseUrl: () => "https://api.synch.run", + getSyncFileRules: () => ({ ...DEFAULT_SYNC_FILE_RULES }), + getStoredRemoteVaultId: () => null, + createVaultAccessContext: vi.fn(async () => ({ + manager: { client: { organizations: async () => [{ + name: "Team", sharing: { enabled: true }, + vaults: [{ id: "vault", name: "Notes", personal: role === "owner", canManage: role === "owner", status: "active", shared: role !== "owner" }], + }] } } as unknown as SharingManager, + isCurrentAccount: () => true, + })), + hasConnectedRemoteVault: () => false, + initializeSyncStoreForActiveRemoteVault: vi.fn(async () => {}), + ensureAutoSyncState: vi.fn(async () => {}), resetSyncConnection: vi.fn(async () => {}), + notifyError: vi.fn(), + }; + return { controller: new SynchRemoteVaultController(deps), deps, bootstrap }; +} + +describe("connection flow wiring", () => { + beforeEach(resetObsidianMocks); + + it("keeps personal file confirmation and starts sync only after connection succeeds", async () => { + const { controller, deps, bootstrap } = connectionFixture("owner", ["note.md"]); + const result = controller.connectRemoteVaultFromPrompt(); + await nextTask(); + await latestButton("Notes").click(); + await getTextComponents().at(-1)?.change("my password"); + const submission = latestButton(t("vault.connect")).click(); + await nextTask(); + expect(getCreatedElementTexts()).toContain(t("vault.connectExistingConflict")); + expect(bootstrap).not.toHaveBeenCalled(); + await latestButton(t("connectAnyway")).click(); + await submission; + await result; + expect(bootstrap).toHaveBeenCalledOnce(); + expect(deps.initializeSyncStoreForActiveRemoteVault).toHaveBeenCalledOnce(); + expect(deps.ensureAutoSyncState).toHaveBeenCalledOnce(); + expect(deps.notifyError).not.toHaveBeenCalled(); + }); + + it("blocks invited vaults before offering a file merge or password", async () => { + const { controller, deps, bootstrap } = connectionFixture("member", ["note.md"]); + const result = controller.connectRemoteVaultFromPrompt(); + await nextTask(); + await latestButton("Notes").click(); + expect(getCreatedElementTexts()).toContain(t("vault.invitedNeedsEmpty")); + expect(getCreatedElementTexts()).not.toContain(t("vault.connectExistingConflict")); + expect(getTextComponents()).toHaveLength(0); + getOpenModals().at(-1)?.close(); + await result; + expect(bootstrap).not.toHaveBeenCalled(); + expect(deps.ensureAutoSyncState).not.toHaveBeenCalled(); + }); + + it("prevents overlapping setup flows and allows reopening after cancellation", async () => { + const { controller, deps } = connectionFixture("owner", []); + const first = controller.connectRemoteVaultFromPrompt(); + await nextTask(); + await controller.connectRemoteVaultFromPrompt(); + await controller.createRemoteVaultFromPrompt(); + expect(deps.createVaultAccessContext).toHaveBeenCalledOnce(); + getOpenModals().at(-1)?.close(); + await first; + const second = controller.connectRemoteVaultFromPrompt(); + await nextTask(); + expect(deps.createVaultAccessContext).toHaveBeenCalledTimes(2); + getOpenModals().at(-1)?.close(); + await second; + }); +}); diff --git a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.ts b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.ts index d2d2b55d..aa312bff 100644 --- a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.ts +++ b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-controller.ts @@ -3,10 +3,12 @@ import type { Plugin } from "obsidian"; import { getSynchLocale, type SynchErrorContextKey } from "../../i18n"; import { openExternalUrl } from "../../adapters/external-browser"; import { - openBootstrapRemoteVaultModal, openConfirmConnectNonEmptyLocalVaultModal, openCreateRemoteVaultModal, } from "./remote-vault-modals"; +import { hasExistingVaultFiles } from "../../adapters/local-vault-content"; +import { ConnectVaultFlow, type VaultAccessContext } from "./connect-vault-flow"; +import { openConnectVaultModal } from "./connect-vault-modal"; import type { RemoteVaultPort } from "./ports"; import { shouldSyncPath, type SyncFileRules } from "@synch/sync-client/core"; @@ -23,6 +25,7 @@ export interface SynchRemoteVaultControllerDeps { getApiBaseUrl: () => string; getSyncFileRules: () => SyncFileRules; getStoredRemoteVaultId: () => string | null; + createVaultAccessContext: () => Promise; hasConnectedRemoteVault: () => boolean; initializeSyncStoreForActiveRemoteVault: () => Promise; ensureAutoSyncState: () => Promise; @@ -31,15 +34,20 @@ export interface SynchRemoteVaultControllerDeps { } export class SynchRemoteVaultController { + private vaultSetupInProgress = false; + constructor(private readonly deps: SynchRemoteVaultControllerDeps) {} async createRemoteVaultFromPrompt(): Promise { + if (this.vaultSetupInProgress) return; + this.vaultSetupInProgress = true; try { if (this.deps.hasConnectedRemoteVault()) { throw new Error("Disconnect the current vault before creating another one."); } - const input = await openCreateRemoteVaultModal(this.deps.plugin.app, ""); + const organizations = await this.deps.remoteVaultManager.listCreatableOrganizations(); + const input = await openCreateRemoteVaultModal(this.deps.plugin.app, "", organizations); if (!input) { return; } @@ -49,41 +57,45 @@ export class SynchRemoteVaultController { await this.deps.ensureAutoSyncState(); } catch (error) { this.deps.notifyError(error, "error.vaultCreation"); + } finally { + this.vaultSetupInProgress = false; } } async connectRemoteVaultFromPrompt(): Promise { + if (this.vaultSetupInProgress) return; + this.vaultSetupInProgress = true; try { if (this.deps.hasConnectedRemoteVault()) { throw new Error("Disconnect the current vault before connecting another one."); } - if (this.hasSyncableLocalFiles()) { - const confirmed = await openConfirmConnectNonEmptyLocalVaultModal( - this.deps.plugin.app, - ); - if (!confirmed) { - return; - } - } - - const vaults = await this.deps.remoteVaultManager.listRemoteVaults(); - const input = await openBootstrapRemoteVaultModal( + const context = await this.deps.createVaultAccessContext(); + const connected = await openConnectVaultModal( this.deps.plugin.app, - vaults, + new ConnectVaultFlow({ + ...context, + listLegacyVaults: () => this.deps.remoteVaultManager.listRemoteVaults(), + hasExistingFiles: () => hasExistingVaultFiles(this.deps.plugin.app), + confirmPersonalVault: async () => !this.hasSyncableLocalFiles() || + await openConfirmConnectNonEmptyLocalVaultModal(this.deps.plugin.app), + bootstrap: (input, beforeActivate) => this.deps.remoteVaultManager.bootstrapRemoteVault(input, async () => { + if (this.deps.hasConnectedRemoteVault()) { + throw new Error("Disconnect the current vault before connecting another one."); + } + await beforeActivate(); + }), + }), this.deps.getStoredRemoteVaultId(), - async (input) => { - await this.deps.remoteVaultManager.bootstrapRemoteVault(input); - }, ); - if (!input) { - return; - } + if (!connected) return; await this.deps.initializeSyncStoreForActiveRemoteVault(); await this.deps.ensureAutoSyncState(); } catch (error) { this.deps.notifyError(error, "error.vaultConnection"); + } finally { + this.vaultSetupInProgress = false; } } diff --git a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.test.ts b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.test.ts index c6a19403..eeb4fb72 100644 --- a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.test.ts +++ b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.test.ts @@ -1,16 +1,14 @@ import { App } from "obsidian"; -import { beforeEach, describe, expect, it, vi } from "vitest"; +import { beforeEach, describe, expect, it } from "vitest"; import { getButtonComponents, - getCreatedElements, getCreatedElementTexts, getTextComponents, resetObsidianMocks, } from "../../test-stubs/obsidian"; import { t } from "../../i18n"; import { - openBootstrapRemoteVaultModal, openConfirmConnectNonEmptyLocalVaultModal, openCreateRemoteVaultModal, } from "./remote-vault-modals"; @@ -120,136 +118,3 @@ describe("connect non-empty local vault confirmation modal", () => { await expect(confirmed).resolves.toBe(true); }); }); - -describe("connect vault modal", () => { - beforeEach(() => { - resetObsidianMocks(); - }); - - it("keeps the modal open and shows submit errors inline", async () => { - const connect = async (): Promise => { - throw new Error("Unable to unlock vault. Check the password and try again."); - }; - const modalResult = openBootstrapRemoteVaultModal( - new App(), - [ - { - id: "vault-1", - organizationId: "org-1", - name: "Personal", - activeKeyVersion: 1, - createdAt: "2026-05-03T00:00:00.000Z", - }, - ], - null, - connect, - ); - - const connectButton = getButtonComponents().find( - (button) => button.text === "Connect vault", - ); - const [passwordInput] = getTextComponents(); - - await passwordInput?.change("wrong password"); - await connectButton?.click(); - - expect( - getCreatedElements().some( - (element) => - element.classes.includes("synch-modal-error") && - element.text === "Unable to unlock vault. Check the password and try again.", - ), - ).toBe(true); - - let resolved = false; - void modalResult.then(() => { - resolved = true; - }); - await Promise.resolve(); - expect(resolved).toBe(false); - - await getButtonComponents().find((button) => button.text === "Cancel")?.click(); - await expect(modalResult).resolves.toBe(null); - }); - - it("submits when Enter is pressed in the password field", async () => { - const connect = vi.fn(async () => {}); - const modalResult = openBootstrapRemoteVaultModal( - new App(), - [ - { - id: "vault-1", - organizationId: "org-1", - name: "Personal", - activeKeyVersion: 1, - createdAt: "2026-05-03T00:00:00.000Z", - }, - ], - null, - connect, - ); - - const [passwordInput] = getTextComponents(); - await passwordInput?.change("vault password"); - await passwordInput?.pressKey("Enter"); - - expect(connect).toHaveBeenCalledWith({ - vaultId: "vault-1", - password: "vault password", - }); - await expect(modalResult).resolves.toEqual({ - vaultId: "vault-1", - password: "vault password", - }); - }); - - it("does not resolve as canceled while the connect request is pending", async () => { - let finishConnect: (() => void) | null = null; - const connect = async (): Promise => { - await new Promise((resolve) => { - finishConnect = resolve; - }); - }; - const modalResult = openBootstrapRemoteVaultModal( - new App(), - [ - { - id: "vault-1", - organizationId: "org-1", - name: "Personal", - activeKeyVersion: 1, - createdAt: "2026-05-03T00:00:00.000Z", - }, - ], - null, - connect, - ); - - const connectButton = getButtonComponents().find( - (button) => button.text === "Connect vault", - ); - const cancelButton = getButtonComponents().find((button) => button.text === "Cancel"); - const [passwordInput] = getTextComponents(); - - await passwordInput?.change("vault password"); - const clickPromise = connectButton?.click(); - await Promise.resolve(); - - expect(cancelButton?.disabled).toBe(true); - await cancelButton?.click(); - - let resolved = false; - void modalResult.then(() => { - resolved = true; - }); - await Promise.resolve(); - expect(resolved).toBe(false); - - finishConnect?.(); - await clickPromise; - await expect(modalResult).resolves.toEqual({ - vaultId: "vault-1", - password: "vault password", - }); - }); -}); diff --git a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.ts b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.ts index 1244e343..481a8102 100644 --- a/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.ts +++ b/apps/obsidian-plugin/src/ui/remote-vault/remote-vault-modals.ts @@ -3,27 +3,16 @@ import { App, Modal, Setting } from "obsidian"; import { formatVaultPasswordValidationError, t } from "../../i18n"; import { submitOnEnter } from "../keyboard"; import type { - BootstrapRemoteVaultInput, CreateRemoteVaultInput, - RemoteVaultRecord, } from "@synch/sync-client/remote"; import { validateVaultPassword } from "@synch/vault-crypto"; export async function openCreateRemoteVaultModal( app: App, initialVaultName: string, + organizations: { id: string; name: string }[] = [], ): Promise { - const modal = new CreateRemoteVaultModal(app, initialVaultName); - return await modal.openAndWait(); -} - -export async function openBootstrapRemoteVaultModal( - app: App, - vaults: RemoteVaultRecord[], - preferredVaultId: string | null, - onConnect?: (input: BootstrapRemoteVaultInput) => Promise, -): Promise { - const modal = new BootstrapRemoteVaultModal(app, vaults, preferredVaultId, onConnect); + const modal = new CreateRemoteVaultModal(app, initialVaultName, organizations); return await modal.openAndWait(); } @@ -38,13 +27,15 @@ class CreateRemoteVaultModal extends Modal { private resolver: ((value: CreateRemoteVaultInput | null) => void) | null = null; private result: CreateRemoteVaultInput | null = null; private vaultName: string; + private organizationId: string | undefined; private password = ""; private confirmPassword = ""; private submitting = false; - constructor(app: App, initialVaultName: string) { + constructor(app: App, initialVaultName: string, private readonly organizations: { id: string; name: string }[]) { super(app); this.vaultName = initialVaultName; + this.organizationId = organizations[0]?.id; } async openAndWait(): Promise { @@ -88,6 +79,7 @@ class CreateRemoteVaultModal extends Modal { this.result = { name: this.vaultName, + ...(this.organizationId ? { organizationId: this.organizationId } : {}), password: this.password, confirmPassword: this.confirmPassword, }; @@ -100,6 +92,11 @@ class CreateRemoteVaultModal extends Modal { text: t("vault.createHint"), }); + if (this.organizations.length > 0) new Setting(contentEl).setName(t("sharing.organization")).addDropdown(dropdown => { + for (const org of this.organizations) dropdown.addOption(org.id, org.name); + dropdown.setValue(this.organizationId ?? "").onChange(value => { this.organizationId = value; }); + }); + new Setting(contentEl) .setName(t("vault.name")) .setDesc(t("vault.nameDesc")) @@ -294,189 +291,3 @@ class ConfirmConnectNonEmptyLocalVaultModal extends Modal { this.resolver = null; } } - -class BootstrapRemoteVaultModal extends Modal { - private resolver: ((value: BootstrapRemoteVaultInput | null) => void) | null = null; - private result: BootstrapRemoteVaultInput | null = null; - private readonly vaults: RemoteVaultRecord[]; - private selectedVaultId: string; - private password = ""; - private submitting = false; - private allowSubmittingClose = false; - - constructor( - app: App, - vaults: RemoteVaultRecord[], - preferredVaultId: string | null, - private readonly onConnect?: (input: BootstrapRemoteVaultInput) => Promise, - ) { - super(app); - this.vaults = vaults; - this.selectedVaultId = - preferredVaultId && vaults.some((vault) => vault.id === preferredVaultId) - ? preferredVaultId - : vaults[0]?.id ?? ""; - } - - async openAndWait(): Promise { - return await new Promise((resolve) => { - this.resolver = resolve; - this.open(); - }); - } - - onOpen(): void { - const { contentEl } = this; - contentEl.empty(); - - new Setting(contentEl).setName(t("vault.connect")).setHeading(); - let errorEl: { setText(value: string): unknown } | null = null; - let cancelButton: { setDisabled(value: boolean): unknown } | null = null; - let connectButton: { - setButtonText(value: string): unknown; - setDisabled(value: boolean): unknown; - } | null = null; - const setError = (message: string): void => { - errorEl?.setText(message); - }; - const setSubmitting = (value: boolean): void => { - this.submitting = value; - cancelButton?.setDisabled(value); - connectButton?.setDisabled(value); - connectButton?.setButtonText(value ? t("vault.connecting") : t("vault.connect")); - }; - const submitConnect = async (): Promise => { - if (this.submitting) { - return; - } - - const input = { - vaultId: this.selectedVaultId, - password: this.password, - }; - - setError(""); - setSubmitting(true); - try { - await this.onConnect?.(input); - this.result = input; - this.allowSubmittingClose = true; - this.close(); - } catch (error) { - setError(formatErrorMessage(error)); - setSubmitting(false); - } - }; - - contentEl.createEl("p", { - cls: "synch-modal-hint", - text: t("vault.connectHint"), - }); - - if (this.vaults.length === 0) { - contentEl.createEl("p", { - cls: "synch-modal-empty", - text: t("vault.noVaults"), - }); - - new Setting(contentEl).addButton((button) => { - button.setButtonText(t("close")).setCta().onClick(() => { - this.close(); - }); - }); - return; - } - - const selectedLabel = contentEl.createEl("p", { - cls: "synch-modal-selected", - text: t("vault.selected", { label: this.getSelectedVaultLabel() }), - }); - const vaultList = contentEl.createDiv({ - cls: "synch-vault-list", - }); - this.renderVaultButtons(vaultList, selectedLabel); - - new Setting(contentEl) - .setName(t("vault.password")) - .setDesc(t("vault.passwordDescConnect")) - .addText((text) => { - text.inputEl.type = "password"; - text.inputEl.autocomplete = "current-password"; - text.setPlaceholder(t("vault.passwordPlaceholder")).onChange((value) => { - this.password = value; - setError(""); - }); - submitOnEnter(text.inputEl, submitConnect); - }); - - errorEl = contentEl.createEl("p", { - cls: "synch-modal-error", - }); - - new Setting(contentEl) - .addButton((button) => { - button.setButtonText(t("cancel")).onClick(() => { - this.close(); - }); - cancelButton = button; - }) - .addButton((button) => { - button.setButtonText(t("vault.connect")).setCta().onClick(submitConnect); - connectButton = button; - }); - } - - close(): void { - if (this.submitting && !this.allowSubmittingClose) { - return; - } - - super.close(); - } - - onClose(): void { - this.contentEl.empty(); - this.resolver?.(this.result); - this.resolver = null; - } - - private renderVaultButtons(containerEl: HTMLElement, selectedLabel: HTMLParagraphElement): void { - containerEl.empty(); - - for (const vault of this.vaults) { - const button = containerEl.createEl("button", { - cls: "synch-vault-option", - text: vault.name, - }); - button.type = "button"; - - if (vault.id === this.selectedVaultId) { - button.addClass("is-selected"); - } - - button.addEventListener("click", () => { - this.selectedVaultId = vault.id; - selectedLabel.setText(t("vault.selected", { label: this.getSelectedVaultLabel() })); - this.renderVaultButtons(containerEl, selectedLabel); - }); - - } - } - - private getSelectedVaultLabel(): string { - const selectedVault = this.vaults.find((vault) => vault.id === this.selectedVaultId); - if (!selectedVault) { - return t("vault.none"); - } - - return selectedVault.name; - } -} - -function formatErrorMessage(error: unknown): string { - if (error instanceof Error && error.message) { - return error.message; - } - - return String(error); -} diff --git a/apps/obsidian-plugin/src/ui/settings/__tests__/settings-tab-helpers.ts b/apps/obsidian-plugin/src/ui/settings/__tests__/settings-tab-helpers.ts index 0453a818..fee438e7 100644 --- a/apps/obsidian-plugin/src/ui/settings/__tests__/settings-tab-helpers.ts +++ b/apps/obsidian-plugin/src/ui/settings/__tests__/settings-tab-helpers.ts @@ -168,6 +168,7 @@ export function createSettingsTab( signOutDevice: vi.fn(async () => {}), createRemoteVaultFromPrompt: vi.fn(async () => {}), connectRemoteVaultFromPrompt: vi.fn(async () => {}), + openVaultSharing: vi.fn(async () => {}), openRemoteVaultManagementPage: vi.fn(() => {}), disconnectRemoteVault: vi.fn(async () => {}), updateApiBaseUrl: vi.fn(async () => {}), diff --git a/apps/obsidian-plugin/src/ui/settings/controller.ts b/apps/obsidian-plugin/src/ui/settings/controller.ts index 0c7682af..b8cf60c5 100644 --- a/apps/obsidian-plugin/src/ui/settings/controller.ts +++ b/apps/obsidian-plugin/src/ui/settings/controller.ts @@ -60,6 +60,7 @@ export interface SynchSettingsController { createRemoteVaultFromPrompt(): Promise; connectRemoteVaultFromPrompt(): Promise; openRemoteVaultManagementPage(): void; + openVaultSharing(): Promise; disconnectRemoteVault(): Promise; updateApiBaseUrl(value: string): Promise; getSyncFileRules(): SyncFileRules; diff --git a/apps/obsidian-plugin/src/ui/settings/sections/remote-vault.ts b/apps/obsidian-plugin/src/ui/settings/sections/remote-vault.ts index 49be6f87..45339d24 100644 --- a/apps/obsidian-plugin/src/ui/settings/sections/remote-vault.ts +++ b/apps/obsidian-plugin/src/ui/settings/sections/remote-vault.ts @@ -11,6 +11,7 @@ export function populateVaultManageSetting( setting .setName(t("vault.manage")) .setDesc(t("vault.manageDesc")) + .addButton(button => button.setButtonText(t("sharing.title")).onClick(() => { void controller.openVaultSharing(); })) .addButton((button) => button.setButtonText(t("vault.manageRemote")).onClick(() => { controller.openRemoteVaultManagementPage(); diff --git a/apps/obsidian-plugin/src/ui/settings/sections/subscription.ts b/apps/obsidian-plugin/src/ui/settings/sections/subscription.ts index 09f6ccc5..13aabac7 100644 --- a/apps/obsidian-plugin/src/ui/settings/sections/subscription.ts +++ b/apps/obsidian-plugin/src/ui/settings/sections/subscription.ts @@ -72,6 +72,8 @@ function formatSubscriptionDescription( function formatSubscriptionPlanName(planId: string): string { switch (planId) { + case "plus": + return "Sync Plus"; case "starter": return t("subscription.starterPlan"); default: diff --git a/apps/obsidian-plugin/src/ui/settings/setting-definitions.ts b/apps/obsidian-plugin/src/ui/settings/setting-definitions.ts index b594d24b..89d33f91 100644 --- a/apps/obsidian-plugin/src/ui/settings/setting-definitions.ts +++ b/apps/obsidian-plugin/src/ui/settings/setting-definitions.ts @@ -209,6 +209,9 @@ export function buildSynchSettingDefinitions( }, }); + // Onboarding follows the current connection state, including after disconnect. + if (!hasConnectedRemoteVault) return definitions; + if (isOfficialCloud) { definitions.push({ name: t("subscription.label"), diff --git a/apps/obsidian-plugin/src/ui/settings/settings-tab-remote-vault.test.ts b/apps/obsidian-plugin/src/ui/settings/settings-tab-remote-vault.test.ts index 51574524..d444a9ac 100644 --- a/apps/obsidian-plugin/src/ui/settings/settings-tab-remote-vault.test.ts +++ b/apps/obsidian-plugin/src/ui/settings/settings-tab-remote-vault.test.ts @@ -23,31 +23,39 @@ describe("SynchSettingTab remote vault settings", () => { const getLatestButton = (text: string) => [...getButtonComponents()].reverse().find((button) => button.text === text); - it("shows a remote vault management button after sign-in", () => { + it("shows a remote vault management button after connection", () => { const tab = createSettingsTab({ hasAuthenticatedSession: () => true, + hasConnectedRemoteVault: () => true, }); - tab.open(); + expect(getButtonComponents().map((button) => button.text)).toContain(t("vault.manageRemote")); + }); - const buttonTexts = getButtonComponents().map((button) => button.text); - expect(buttonTexts).toContain(t("vault.manageRemote")); + it("only offers create, connect, and sign out before connection", () => { + const tab = createSettingsTab({ hasAuthenticatedSession: () => true }); + tab.open(); + expect(getButtonComponents().map((button) => button.text)).toEqual([ + t("vault.create"), t("vault.connect"), t("auth.signOut"), + ]); + expect(getSettingNames()).not.toContain(t("fileSync.header")); + expect(getSettingNames()).not.toContain(t("subscription.label")); + expect(getSettingNames()).not.toContain(t("diagnostics.header")); }); - it("places remote vault management below authentication when no vault is connected", () => { + it("returns to create and connect after disconnection", async () => { + let connected = true; const tab = createSettingsTab({ hasAuthenticatedSession: () => true, - isDeviceLoginInProgress: () => false, + hasConnectedRemoteVault: () => connected, + disconnectRemoteVault: async () => { connected = false; }, }); - tab.open(); - - const buttonTexts = getButtonComponents().map((button) => button.text); - expect(buttonTexts.slice(0, 4)).toEqual([ - t("vault.create"), - t("vault.connect"), - t("auth.signOut"), - t("vault.manageRemote"), + await getLatestButton(t("vault.disconnect"))?.click(); + resetObsidianMocks(); + tab.open(); + expect(getButtonComponents().map((button) => button.text)).toEqual([ + t("vault.create"), t("vault.connect"), t("auth.signOut"), ]); }); @@ -59,7 +67,7 @@ describe("SynchSettingTab remote vault settings", () => { disconnected.open(); - expect(getSettingNames()).toContain(t("vault.manage")); + expect(getSettingNames()).not.toContain(t("vault.manage")); expect(getSettingNames()).not.toContain(t("vault.setting")); resetObsidianMocks(); diff --git a/apps/obsidian-plugin/src/ui/settings/settings-tab-sync-status.test.ts b/apps/obsidian-plugin/src/ui/settings/settings-tab-sync-status.test.ts index f21c8936..8259969d 100644 --- a/apps/obsidian-plugin/src/ui/settings/settings-tab-sync-status.test.ts +++ b/apps/obsidian-plugin/src/ui/settings/settings-tab-sync-status.test.ts @@ -123,11 +123,9 @@ describe("SynchSettingTab sync status", () => { tab.open(); - expect(getSettingNames().slice(0, 4)).toEqual([ + expect(getSettingNames()).toEqual([ t("sync.label"), t("authentication"), - t("subscription.label"), - t("vault.manage"), ]); }); diff --git a/apps/obsidian-plugin/src/ui/settings/settings-tab.test.ts b/apps/obsidian-plugin/src/ui/settings/settings-tab.test.ts index 17aa057c..eb072b2d 100644 --- a/apps/obsidian-plugin/src/ui/settings/settings-tab.test.ts +++ b/apps/obsidian-plugin/src/ui/settings/settings-tab.test.ts @@ -309,10 +309,11 @@ describe("SynchSettingTab", () => { expect(updateApiBaseUrl).not.toHaveBeenCalled(); }); - it("shows subscription status after sign-in", () => { + it("shows subscription status after vault connection", () => { const ensureSubscriptionStatusCheck = vi.fn(async () => {}); const tab = createSettingsTab({ hasAuthenticatedSession: () => true, + hasConnectedRemoteVault: () => true, ensureSubscriptionStatusCheck, }); @@ -327,6 +328,7 @@ describe("SynchSettingTab", () => { const ensureSubscriptionStatusCheck = vi.fn(async () => {}); const tab = createSettingsTab({ hasAuthenticatedSession: () => true, + hasConnectedRemoteVault: () => true, getApiBaseUrl: () => "https://custom.synch.test", ensureSubscriptionStatusCheck, }); @@ -342,6 +344,7 @@ describe("SynchSettingTab", () => { const openPricingPage = vi.fn(); const tab = createSettingsTab({ hasAuthenticatedSession: () => true, + hasConnectedRemoteVault: () => true, getSubscriptionStatus: () => ({ state: "loaded", planId: "free", @@ -369,6 +372,7 @@ describe("SynchSettingTab", () => { const openBillingManagementPage = vi.fn(); const tab = createSettingsTab({ hasAuthenticatedSession: () => true, + hasConnectedRemoteVault: () => true, getSubscriptionStatus: () => ({ state: "loaded", planId: "starter", @@ -395,6 +399,7 @@ describe("SynchSettingTab", () => { it("shows canceling paid subscription period end", () => { const tab = createSettingsTab({ hasAuthenticatedSession: () => true, + hasConnectedRemoteVault: () => true, getSubscriptionStatus: () => ({ state: "loaded", planId: "starter", @@ -420,6 +425,7 @@ describe("SynchSettingTab", () => { const retrySubscriptionStatusCheck = vi.fn(async () => {}); const tab = createSettingsTab({ hasAuthenticatedSession: () => true, + hasConnectedRemoteVault: () => true, getSubscriptionStatus: () => ({ state: "failed", error: "offline", diff --git a/apps/obsidian-plugin/src/ui/sharing/sharing-modal.ts b/apps/obsidian-plugin/src/ui/sharing/sharing-modal.ts new file mode 100644 index 00000000..53f33a34 --- /dev/null +++ b/apps/obsidian-plugin/src/ui/sharing/sharing-modal.ts @@ -0,0 +1,258 @@ +import { App, Modal, Notice, Setting } from "obsidian"; +import { + SharingManager, + type SharingVault, + type VaultKeyRequest, + type RemoteVaultSession, +} from "@synch/sync-client/remote"; +import { t } from "../../i18n"; + +export class SharingModal extends Modal { + private closed = false; + private busy = false; + constructor( + app: App, + private readonly manager: SharingManager, + private readonly activeSession: () => RemoteVaultSession | null, + private readonly isCurrentAccount: () => boolean, + private readonly openOrganizations: () => void, + ) { + super(app); + } + onOpen(): void { + void this.refresh(); + } + onClose(): void { + this.closed = true; + this.contentEl.empty(); + } + private async run(action: () => Promise): Promise { + if (this.busy || this.closed) return; + if (!this.isCurrentAccount()) { + new Notice(t("sharing.accountChanged")); + this.close(); + return; + } + this.busy = true; + this.contentEl.querySelectorAll("button").forEach((button) => { + button.disabled = true; + }); + try { + await action(); + } catch (error) { + new Notice(error instanceof Error ? error.message : String(error), 10000); + } finally { + this.busy = false; + if (!this.closed) await this.refresh(); + } + } + private async refresh(): Promise { + if (this.closed) return; + this.contentEl.empty(); + this.contentEl.createEl("h2", { text: t("sharing.title") }); + this.contentEl.createEl("p", { text: t("sharing.intro") }); + new Setting(this.contentEl) + .addButton((button) => + button + .setButtonText(t("sharing.organizations")) + .onClick(this.openOrganizations), + ) + .addButton((button) => + button.setButtonText(t("sharing.refresh")).onClick(() => { + void this.run(async () => {}); + }), + ); + const body = this.contentEl.createDiv(); + try { + const organizations = await this.manager.client.organizations(); + if (this.closed) return; + for (const organization of organizations) { + const vaults = organization.vaults.filter( + (vault) => + vault.status === "active" || vault.status === "pending_key", + ); + if (!vaults.length) continue; + body.createEl("h3", { text: organization.name }); + for (const vault of vaults) { + try { + await this.renderVault(body, vault, organization.sharing.enabled); + } catch (error) { + body.createEl("p", { + text: error instanceof Error ? error.message : String(error), + }); + } + } + } + } catch (error) { + body.createEl("p", { + text: error instanceof Error ? error.message : String(error), + }); + } + } + private async renderVault( + parent: HTMLElement, + vault: SharingVault, + canShare: boolean, + ): Promise { + const section = parent.createDiv(); + section.createEl("h4", { text: vault.name }); + const key = + this.activeSession()?.summary.vaultId === vault.id + ? this.activeSession()?.remoteVaultKey + : undefined; + if (key && vault.status === "active") + this.passwordForm( + section, + (password) => + this.manager.changePassword( + vault.id, + key, + password.value, + password.confirm, + ), + "change", + ); + else if (canShare) + new Setting(section) + .setName( + t( + vault.status === "pending_key" + ? "sharing.setup" + : "sharing.recovery", + ), + ) + .setDesc(t("sharing.requestHelp")) + .addButton((button) => + button.setButtonText(t("sharing.request")).onClick(() => { + void this.run(async () => { + await this.manager.begin(vault.id); + }); + }), + ); + if (!canShare) { + if (vault.shared) section.createEl("p", { text: t("sharing.suspended") }); + else if (!key) + section.createEl("p", { text: t("sharing.passwordConnect") }); + return; + } + const requests = await this.manager.client.requests(vault.id); + let localRequest: VaultKeyRequest | null = null; + try { + localRequest = await this.manager.localRequest(vault.id); + } catch (error) { + section.createEl("p", { + text: error instanceof Error ? error.message : String(error), + }); + } + if ( + localRequest?.status === "completed" && + !requests.some((request) => request.id === localRequest.id) + ) + requests.push(localRequest); + for (const request of requests) { + if (request.userId === this.manager.userId) { + // Only the device holding the matching receiver secret can authenticate this code. + // Displaying an API-supplied public key on another device would trust the server. + if (localRequest?.id === request.id) { + section.createEl("p", { text: t("sharing.yourCode") }); + section.createEl("code", { + text: await this.manager.recipientVerificationCode(vault.id), + }); + if (request.status === "approved" || request.status === "completed") + this.passwordForm( + section, + (password) => + this.manager.receive( + vault.id, + password.value, + password.confirm, + ), + "receive", + ); + else section.createEl("p", { text: t("sharing.waiting") }); + } + new Setting(section) + .setDesc(t("sharing.restartHelp")) + .addButton((button) => + button.setButtonText(t("sharing.restart")).onClick(() => { + void this.run(async () => { + await this.manager.restart(vault.id); + }); + }), + ); + } else if ( + request.status === "pending" && + vault.canManage + ) { + this.approvalForm(section, vault, request, key); + } + } + } + private approvalForm( + parent: HTMLElement, + vault: SharingVault, + request: VaultKeyRequest, + key?: Uint8Array, + ): void { + const member = vault.members.find( + (member) => member.userId === request.userId, + ); + const setting = new Setting(parent) + .setName( + `${member?.email ?? request.userId} · ${t(request.purpose === "recovery" ? "sharing.recovery" : "sharing.setup")}`, + ) + .setDesc(t(key ? "sharing.approveHelp" : "sharing.connectFirst")); + if (!key) return; + let code = ""; + setting.addText((text) => + text.setPlaceholder(t("sharing.code")).onChange((value) => { + code = value; + }), + ); + setting.addButton((button) => + button.setButtonText(t("sharing.approve")).onClick(() => { + void this.run(() => this.manager.approve(request, key, code)); + }), + ); + } + private passwordForm( + parent: HTMLElement, + action: (password: { value: string; confirm: string }) => Promise, + mode: "change" | "receive", + ): void { + let value = ""; + let confirm = ""; + const setting = new Setting(parent) + .setName( + t(mode === "change" ? "sharing.changePassword" : "sharing.setPassword"), + ) + .setDesc(t("sharing.passwordHelp")); + setting.addText((text) => { + text.inputEl.type = "password"; + text.inputEl.autocomplete = "new-password"; + text.setPlaceholder(t("sharing.password")).onChange((next) => { + value = next; + }); + }); + setting.addText((text) => { + text.inputEl.type = "password"; + text.inputEl.autocomplete = "new-password"; + text.setPlaceholder(t("sharing.confirmPassword")).onChange((next) => { + confirm = next; + }); + }); + setting.addButton((button) => + button.setButtonText(t("sharing.save")).onClick(() => { + void this.run(async () => { + await action({ value, confirm }); + value = ""; + confirm = ""; + new Notice( + t(mode === "receive" ? "sharing.ready" : "sharing.saved"), + 10000, + ); + }); + }), + ); + } +} diff --git a/apps/obsidian-plugin/styles.css b/apps/obsidian-plugin/styles.css index 6340ef12..4a215bff 100644 --- a/apps/obsidian-plugin/styles.css +++ b/apps/obsidian-plugin/styles.css @@ -564,3 +564,209 @@ box-decoration-break: clone; -webkit-box-decoration-break: clone; } + +/* Vault connection: choose a vault, then complete one focused step. */ +.synch-connect-modal { + width: 480px; + max-width: calc(100vw - 32px); +} + +.synch-connect { + padding: 4px 8px 8px; +} + +.synch-connect h2 { + margin: 0 0 20px; + font-size: 1.4em; + font-weight: var(--font-medium); + overflow-wrap: anywhere; +} + +/* Override Obsidian 1.13 modal row chrome, not other plugin settings. */ +.modal.synch-connect-modal .synch-connect .setting-item:not(.setting-item-heading) { + border: 0; + padding: 0; + background: transparent; +} + +.synch-connect-group { + color: var(--text-muted); + font-size: var(--font-ui-small); + font-weight: var(--font-normal); + margin: 24px 0 8px; +} + +.synch-connect-choice .setting-item-info, +.synch-connect-primary .setting-item-info, +.synch-connect-secondary .setting-item-info, +.synch-connect-back .setting-item-info { + display: none; +} + +.synch-connect-choice .setting-item-control, +.synch-connect-primary .setting-item-control, +.synch-connect-field .setting-item-control { + width: 100%; +} + +.synch-connect-choice button { + width: 100%; + height: auto; + min-height: 68px; + margin: 0 0 8px; + padding: 12px 14px; + display: flex; + align-items: center; + gap: 12px; + border: 1px solid var(--background-modifier-border); + border-radius: var(--radius-m); + background: var(--background-primary); + color: var(--text-normal); + box-shadow: none; + text-align: left; +} + +.synch-connect-choice button:hover { + background: var(--background-modifier-hover); +} + +.synch-connect-choice-text { + display: flex; + flex: 1; + min-width: 0; + flex-direction: column; + gap: 3px; + overflow-wrap: anywhere; + white-space: normal; +} + +.synch-connect-choice-meta, +.synch-connect-eyebrow { + color: var(--text-muted); + font-size: var(--font-ui-small); +} + +.synch-connect-vault-icon, +.synch-connect-chevron { + color: var(--text-muted); + display: flex; + flex-shrink: 0; +} + +.synch-connect-vault-icon svg, +.synch-connect-chevron svg { + width: 18px; + height: 18px; +} + +.synch-connect .synch-connect-back { + margin-bottom: 20px; +} + +.synch-connect-back .setting-item-control { + justify-content: flex-start; +} + +.synch-connect-back button, +.synch-connect-secondary button { + color: var(--text-muted); + background: transparent; + box-shadow: none; + padding: 4px 0; + font-size: var(--font-ui-small); + height: auto; + white-space: normal; +} + +.synch-connect-back button:hover, +.synch-connect-secondary button:hover { + color: var(--text-normal); +} + +.synch-connect-eyebrow { + margin: 0 0 6px; +} + +.synch-connect-hint { + color: var(--text-muted); + margin: 12px 0 20px; +} + +.synch-connect .synch-connect-field { + display: flex; + flex-direction: column; + align-items: stretch; + gap: 8px; + margin-top: 20px; +} + +.synch-connect-field .setting-item-info { + margin: 0; +} + +.synch-connect-field input { + width: 100%; + min-height: 40px; +} + +.synch-connect .synch-connect-primary { + margin-top: 24px; +} + +.synch-connect-primary button { + width: 100%; + min-height: 40px; + height: auto; + white-space: normal; + padding: 10px 14px; +} + +.synch-connect .synch-connect-secondary { + margin-top: 14px; +} + +.synch-connect-help { + color: var(--text-muted); + font-size: var(--font-ui-small); + margin-top: 24px; +} + +.synch-connect-help summary { + cursor: var(--cursor); +} + +.synch-connect-code { + display: block; + padding: 14px; + border-radius: var(--radius-m); + background: var(--background-secondary); + color: var(--text-normal); + overflow-wrap: anywhere; + white-space: normal; + user-select: text; +} + +.synch-connect-status { + font-size: var(--font-ui-medium); + margin: 24px 0 8px; +} + +.synch-connect-notice { + padding: 14px; + border-radius: var(--radius-m); + background: var(--background-secondary); +} + +.synch-connect .synch-modal-error { + margin: 14px 0 0; +} + +.synch-connect .synch-modal-error:empty { + display: none; +} + +@media (pointer: coarse) { + .synch-connect button { + min-height: 44px; + } +} diff --git a/apps/www/package.json b/apps/www/package.json index d8f48b3f..b9c66174 100644 --- a/apps/www/package.json +++ b/apps/www/package.json @@ -8,6 +8,7 @@ "scripts": { "dev": "astro dev", "build": "astro build", + "test:billing": "node --test test/billing-settings.test.mjs test/pricing-checkout.test.mjs", "preview": "astro preview", "preview:cloudflare": "pnpm build && wrangler dev", "deploy": "pnpm build && wrangler deploy", diff --git a/apps/www/src/billing/pricing.ts b/apps/www/src/billing/pricing.ts new file mode 100644 index 00000000..5e3e58fd --- /dev/null +++ b/apps/www/src/billing/pricing.ts @@ -0,0 +1,5 @@ +/** Flat organization prices in USD, including up to three members. */ +export const PLUS_PRICING_USD = { + monthly: 9, + annual: 90, +} as const; diff --git a/apps/www/src/components/BillingSettingsPage.astro b/apps/www/src/components/BillingSettingsPage.astro index 658f6cfa..9e8b1c7c 100644 --- a/apps/www/src/components/BillingSettingsPage.astro +++ b/apps/www/src/components/BillingSettingsPage.astro @@ -3,6 +3,7 @@ import Footer from "./Footer.astro"; import Header from "./Header.astro"; import Layout from "../layouts/Layout.astro"; import { localizedPath, ui, type Locale } from "../i18n"; +import { PLUS_PRICING_USD } from "../billing/pricing"; interface Props { locale: Locale; @@ -44,6 +45,9 @@ const pricingUrl = localizedPath(locale, "/pricing");
+