refactor(s3 & encryption): rectify memoryDB meta key usage

packages/encryption/src/wrapper/index.ts

@@ -33,7 +33,7 @@ export type EncryptionDBSchema = {
 
 export type EncryptionDBMeta = {
 	encryptionKeys?: DerivedKeys;
-	lastEncryptionUid?: string;
+	encryptionMarker?: string;
 };
 
 export type EncryptionDB = DatabaseSync<EncryptionDBSchema, EncryptionDBMeta>;
@@ -57,11 +57,11 @@ class EncryptionFs implements WrappedFs {
 			decryptedToEncrypted: memoryDB.getStore('decryptedToEncrypted'),
 			encryptedToDecrypted: memoryDB.getStore('encryptedToDecrypted'),
 		};
-		if (memoryDB.getMeta('lastEncryptionUid') !== marker) {
+		if (memoryDB.getMeta('encryptionMarker') !== marker) {
 			this.pathStores.decryptedToEncrypted.clear();
 			this.pathStores.encryptedToDecrypted.clear();
 			memoryDB.setMeta('encryptionKeys', undefined);
-			memoryDB.setMeta('lastEncryptionUid', marker);
+			memoryDB.setMeta('encryptionMarker', marker);
 		}
 	}
 

packages/encryption/test/encryption.test.ts

@@ -15,7 +15,7 @@ const memoryDB = openMemoryDB<EncryptionDBSchema, EncryptionDBMeta>('encryption-
 beforeEach(() => {
 	memoryDB.clearStores();
 	memoryDB.setMeta('encryptionKeys', undefined);
-	memoryDB.setMeta('lastEncryptionUid', undefined);
+	memoryDB.setMeta('encryptionMarker', undefined);
 });
 
 function must<T>(value: T | undefined, message: string): T {
@@ -309,7 +309,7 @@ test('uid change resets persistent path cache', async () => {
 	const second = createRemote({ uid: 'uid-b' });
 	const secondShim = encryptionWrapper(second.fs, { memoryDB, password: PASSWORD });
 
-	expect(memoryDB.getMeta('lastEncryptionUid')).toBe('uid-b~password');
+	expect(memoryDB.getMeta('encryptionMarker')).toBe('uid-b~password');
 	expect(memoryDB.getMeta('encryptionKeys')).toBeUndefined();
 	expect(memoryDB.getStore('decryptedToEncrypted').keys()).toStrictEqual([]);
 	expect(memoryDB.getStore('encryptedToDecrypted').keys()).toStrictEqual([]);
@@ -326,7 +326,7 @@ test('password change resets persistent path cache', async () => {
 	const second = createRemote({ uid: 'uid-a' });
 	const secondShim = encryptionWrapper(second.fs, { memoryDB, password: WRONG_PASSWORD });
 
-	expect(memoryDB.getMeta('lastEncryptionUid')).toBe('uid-a~wrong-password');
+	expect(memoryDB.getMeta('encryptionMarker')).toBe('uid-a~wrong-password');
 	expect(memoryDB.getMeta('encryptionKeys')).toBeUndefined();
 	expect(memoryDB.getStore('decryptedToEncrypted').keys()).toStrictEqual([]);
 	expect(memoryDB.getStore('encryptedToDecrypted').keys()).toStrictEqual([]);

packages/s3/src/index.ts

@@ -43,10 +43,7 @@ export type S3Settings = {
 	};
 };
 
-export type S3DB = DatabaseSync<
-	Record<string, unknown>,
-	{ signingKey: Binary; signingKeyMarker: string }
->;
+export type S3DB = DatabaseSync<Record<string, unknown>, { s3Key?: Binary; s3KeyMarker?: string }>;
 
 export default class S3 {
 	private readonly cleanup: Array<() => void> = [];

packages/s3/src/s3/sigv4.ts

@@ -142,15 +142,15 @@ export async function signRequest(
 
 	let kSigning: Binary;
 	const marker = `${secretAccessKey}~${dateStamp}~${region}~${service}`;
-	const cache = db.getMeta('signingKey');
-	if (db.getMeta('signingKeyMarker') === marker && cache) kSigning = cache;
+	const cache = db.getMeta('s3Key');
+	if (db.getMeta('s3KeyMarker') === marker && cache) kSigning = cache;
 	else {
 		const kDate = await hmac(encoder.encode(`AWS4${secretAccessKey}`), dateStamp);
 		const kRegion = await hmac(kDate, region);
 		const kService = await hmac(kRegion, service);
 		kSigning = await hmac(kService, 'aws4_request');
-		db.setMeta('signingKeyMarker', marker);
-		db.setMeta('signingKey', kSigning);
+		db.setMeta('s3KeyMarker', marker);
+		db.setMeta('s3Key', kSigning);
 	}
 	const signature = toHex(await hmac(kSigning, stringToSign));
 	const credential = `${accessKeyId}/${credentialScope}`;

packages/s3/test/helpers.ts

@@ -3,7 +3,7 @@ import { openMemoryDB } from 'uni-kv';
 
 export const memoryDB = openMemoryDB<
 	Record<string, unknown>,
-	{ signingKey: Binary; signingKeyMarker: string }
+	{ s3Key?: Binary; s3KeyMarker?: string }
 >('s3-test');
 
 export const emptyBinary: Binary = new Uint8Array(0);

packages/s3/test/sigv4-middleware.test.ts

@@ -1,12 +1,12 @@
 import type { Request, RequestParam } from '@hesprs/sync-engine-sdk';
 import { beforeEach, expect, test } from 'bun:test';
 import { sigv4Middleware } from '@/s3/sigv4';
-import { defaultCredentials, defaultResponse, emptyBinary, memoryDB } from './helpers';
+import { defaultCredentials, defaultResponse, memoryDB } from './helpers';
 
 beforeEach(() => {
 	memoryDB.clearStores();
-	memoryDB.setMeta('signingKey', emptyBinary);
-	memoryDB.setMeta('signingKeyMarker', '');
+	memoryDB.setMeta('s3Key', undefined);
+	memoryDB.setMeta('s3KeyMarker', '');
 });
 
 function createTransport() {
@@ -109,11 +109,11 @@ test('middleware reuses signing key for matching credentials and date', async ()
 	const request = sigv4Middleware(transport, defaultCredentials, memoryDB);
 
 	await request('https://s3.example.com/vault/first.md');
-	const signingKey = memoryDB.getMeta('signingKey');
+	const signingKey = memoryDB.getMeta('s3Key');
 	if (!signingKey) throw new Error('Expected signing key cache entry');
 
 	await request('https://s3.example.com/vault/second.md');
 
-	expect(memoryDB.getMeta('signingKey')).toBe(signingKey);
-	expect(memoryDB.getMeta('signingKeyMarker')).toMatch(/^secret-key~\d{8}~us-east-1~s3$/u);
+	expect(memoryDB.getMeta('s3Key')).toBe(signingKey);
+	expect(memoryDB.getMeta('s3KeyMarker')).toMatch(/^secret-key~\d{8}~us-east-1~s3$/u);
 });