From 27dca750b92f6dfefe964256ce2be21a232695c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?He=CC=84sperus?= Date: Sat, 22 Aug 2026 17:30:59 +0800 Subject: [PATCH] refactor(s3 & encryption): rectify memoryDB meta key usage --- packages/encryption/src/wrapper/index.ts | 6 +++--- packages/encryption/test/encryption.test.ts | 6 +++--- packages/s3/src/index.ts | 5 +---- packages/s3/src/s3/sigv4.ts | 8 ++++---- packages/s3/test/helpers.ts | 2 +- packages/s3/test/sigv4-middleware.test.ts | 12 ++++++------ 6 files changed, 18 insertions(+), 21 deletions(-) diff --git a/packages/encryption/src/wrapper/index.ts b/packages/encryption/src/wrapper/index.ts index 65ec6cdb..b266bd29 100644 --- a/packages/encryption/src/wrapper/index.ts +++ b/packages/encryption/src/wrapper/index.ts @@ -33,7 +33,7 @@ export type EncryptionDBSchema = { export type EncryptionDBMeta = { encryptionKeys?: DerivedKeys; - lastEncryptionUid?: string; + encryptionMarker?: string; }; export type EncryptionDB = DatabaseSync; @@ -57,11 +57,11 @@ class EncryptionFs implements WrappedFs { decryptedToEncrypted: memoryDB.getStore('decryptedToEncrypted'), encryptedToDecrypted: memoryDB.getStore('encryptedToDecrypted'), }; - if (memoryDB.getMeta('lastEncryptionUid') !== marker) { + if (memoryDB.getMeta('encryptionMarker') !== marker) { this.pathStores.decryptedToEncrypted.clear(); this.pathStores.encryptedToDecrypted.clear(); memoryDB.setMeta('encryptionKeys', undefined); - memoryDB.setMeta('lastEncryptionUid', marker); + memoryDB.setMeta('encryptionMarker', marker); } } diff --git a/packages/encryption/test/encryption.test.ts b/packages/encryption/test/encryption.test.ts index fecfa823..3f85056f 100644 --- a/packages/encryption/test/encryption.test.ts +++ b/packages/encryption/test/encryption.test.ts @@ -15,7 +15,7 @@ const memoryDB = openMemoryDB('encryption- beforeEach(() => { memoryDB.clearStores(); memoryDB.setMeta('encryptionKeys', undefined); - memoryDB.setMeta('lastEncryptionUid', undefined); + memoryDB.setMeta('encryptionMarker', undefined); }); function must(value: T | undefined, message: string): T { @@ -309,7 +309,7 @@ test('uid change resets persistent path cache', async () => { const second = createRemote({ uid: 'uid-b' }); const secondShim = encryptionWrapper(second.fs, { memoryDB, password: PASSWORD }); - expect(memoryDB.getMeta('lastEncryptionUid')).toBe('uid-b~password'); + expect(memoryDB.getMeta('encryptionMarker')).toBe('uid-b~password'); expect(memoryDB.getMeta('encryptionKeys')).toBeUndefined(); expect(memoryDB.getStore('decryptedToEncrypted').keys()).toStrictEqual([]); expect(memoryDB.getStore('encryptedToDecrypted').keys()).toStrictEqual([]); @@ -326,7 +326,7 @@ test('password change resets persistent path cache', async () => { const second = createRemote({ uid: 'uid-a' }); const secondShim = encryptionWrapper(second.fs, { memoryDB, password: WRONG_PASSWORD }); - expect(memoryDB.getMeta('lastEncryptionUid')).toBe('uid-a~wrong-password'); + expect(memoryDB.getMeta('encryptionMarker')).toBe('uid-a~wrong-password'); expect(memoryDB.getMeta('encryptionKeys')).toBeUndefined(); expect(memoryDB.getStore('decryptedToEncrypted').keys()).toStrictEqual([]); expect(memoryDB.getStore('encryptedToDecrypted').keys()).toStrictEqual([]); diff --git a/packages/s3/src/index.ts b/packages/s3/src/index.ts index 0b8a0c05..df5167fd 100644 --- a/packages/s3/src/index.ts +++ b/packages/s3/src/index.ts @@ -43,10 +43,7 @@ export type S3Settings = { }; }; -export type S3DB = DatabaseSync< - Record, - { signingKey: Binary; signingKeyMarker: string } ->; +export type S3DB = DatabaseSync, { s3Key?: Binary; s3KeyMarker?: string }>; export default class S3 { private readonly cleanup: Array<() => void> = []; diff --git a/packages/s3/src/s3/sigv4.ts b/packages/s3/src/s3/sigv4.ts index 2260fcab..7af6dcbc 100644 --- a/packages/s3/src/s3/sigv4.ts +++ b/packages/s3/src/s3/sigv4.ts @@ -142,15 +142,15 @@ export async function signRequest( let kSigning: Binary; const marker = `${secretAccessKey}~${dateStamp}~${region}~${service}`; - const cache = db.getMeta('signingKey'); - if (db.getMeta('signingKeyMarker') === marker && cache) kSigning = cache; + const cache = db.getMeta('s3Key'); + if (db.getMeta('s3KeyMarker') === marker && cache) kSigning = cache; else { const kDate = await hmac(encoder.encode(`AWS4${secretAccessKey}`), dateStamp); const kRegion = await hmac(kDate, region); const kService = await hmac(kRegion, service); kSigning = await hmac(kService, 'aws4_request'); - db.setMeta('signingKeyMarker', marker); - db.setMeta('signingKey', kSigning); + db.setMeta('s3KeyMarker', marker); + db.setMeta('s3Key', kSigning); } const signature = toHex(await hmac(kSigning, stringToSign)); const credential = `${accessKeyId}/${credentialScope}`; diff --git a/packages/s3/test/helpers.ts b/packages/s3/test/helpers.ts index 696211ac..827f0d91 100644 --- a/packages/s3/test/helpers.ts +++ b/packages/s3/test/helpers.ts @@ -3,7 +3,7 @@ import { openMemoryDB } from 'uni-kv'; export const memoryDB = openMemoryDB< Record, - { signingKey: Binary; signingKeyMarker: string } + { s3Key?: Binary; s3KeyMarker?: string } >('s3-test'); export const emptyBinary: Binary = new Uint8Array(0); diff --git a/packages/s3/test/sigv4-middleware.test.ts b/packages/s3/test/sigv4-middleware.test.ts index 299d13ed..d9fe8dbc 100644 --- a/packages/s3/test/sigv4-middleware.test.ts +++ b/packages/s3/test/sigv4-middleware.test.ts @@ -1,12 +1,12 @@ import type { Request, RequestParam } from '@hesprs/sync-engine-sdk'; import { beforeEach, expect, test } from 'bun:test'; import { sigv4Middleware } from '@/s3/sigv4'; -import { defaultCredentials, defaultResponse, emptyBinary, memoryDB } from './helpers'; +import { defaultCredentials, defaultResponse, memoryDB } from './helpers'; beforeEach(() => { memoryDB.clearStores(); - memoryDB.setMeta('signingKey', emptyBinary); - memoryDB.setMeta('signingKeyMarker', ''); + memoryDB.setMeta('s3Key', undefined); + memoryDB.setMeta('s3KeyMarker', ''); }); function createTransport() { @@ -109,11 +109,11 @@ test('middleware reuses signing key for matching credentials and date', async () const request = sigv4Middleware(transport, defaultCredentials, memoryDB); await request('https://s3.example.com/vault/first.md'); - const signingKey = memoryDB.getMeta('signingKey'); + const signingKey = memoryDB.getMeta('s3Key'); if (!signingKey) throw new Error('Expected signing key cache entry'); await request('https://s3.example.com/vault/second.md'); - expect(memoryDB.getMeta('signingKey')).toBe(signingKey); - expect(memoryDB.getMeta('signingKeyMarker')).toMatch(/^secret-key~\d{8}~us-east-1~s3$/u); + expect(memoryDB.getMeta('s3Key')).toBe(signingKey); + expect(memoryDB.getMeta('s3KeyMarker')).toMatch(/^secret-key~\d{8}~us-east-1~s3$/u); });