tests: vault tests (#2366)

packages/services/src/Domain/Vault/UseCase/ChangeVaultKeyOptions.ts

@@ -0,0 +1,150 @@
+import { MutatorClientInterface, SyncServiceInterface } from '@standardnotes/services'
+import {
+  KeySystemRootKeyPasswordType,
+  KeySystemRootKeyStorageMode,
+  VaultListingInterface,
+  VaultListingMutator,
+} from '@standardnotes/models'
+import { ChangeVaultKeyOptionsDTO } from './ChangeVaultKeyOptionsDTO'
+import { GetVault } from './GetVault'
+import { EncryptionProviderInterface } from '../../Encryption/EncryptionProviderInterface'
+import { KeySystemKeyManagerInterface } from '../../KeySystem/KeySystemKeyManagerInterface'
+
+export class ChangeVaultKeyOptions {
+  constructor(
+    private mutator: MutatorClientInterface,
+    private sync: SyncServiceInterface,
+    private encryption: EncryptionProviderInterface,
+    private keys: KeySystemKeyManagerInterface,
+    private getVault: GetVault,
+  ) {}
+
+  async execute(dto: ChangeVaultKeyOptionsDTO): Promise<void> {
+    const useStorageMode = dto.newKeyStorageMode ?? dto.vault.keyStorageMode
+
+    if (dto.newPasswordType) {
+      if (dto.vault.keyPasswordType === dto.newPasswordType.passwordType) {
+        throw new Error('Vault password type is already set to this type')
+      }
+
+      if (dto.newPasswordType.passwordType === KeySystemRootKeyPasswordType.UserInputted) {
+        if (!dto.newPasswordType.userInputtedPassword) {
+          throw new Error('User inputted password is required')
+        }
+        await this.changePasswordTypeToUserInputted(dto.vault, dto.newPasswordType.userInputtedPassword, useStorageMode)
+      } else if (dto.newPasswordType.passwordType === KeySystemRootKeyPasswordType.Randomized) {
+        await this.changePasswordTypeToRandomized(dto.vault, useStorageMode)
+      }
+    }
+
+    if (dto.newKeyStorageMode) {
+      const result = this.getVault.execute({ keySystemIdentifier: dto.vault.systemIdentifier })
+
+      if (result.isFailed()) {
+        throw new Error('Vault not found')
+      }
+
+      const latestVault = result.getValue()
+
+      if (latestVault.rootKeyParams.passwordType !== KeySystemRootKeyPasswordType.UserInputted) {
+        throw new Error('Vault uses randomized password and cannot change its storage preference')
+      }
+
+      if (dto.newKeyStorageMode === latestVault.keyStorageMode) {
+        throw new Error('Vault already uses this storage preference')
+      }
+
+      if (
+        dto.newKeyStorageMode === KeySystemRootKeyStorageMode.Local ||
+        dto.newKeyStorageMode === KeySystemRootKeyStorageMode.Ephemeral
+      ) {
+        await this.changeStorageModeToLocalOrEphemeral(latestVault, dto.newKeyStorageMode)
+      } else if (dto.newKeyStorageMode === KeySystemRootKeyStorageMode.Synced) {
+        await this.changeStorageModeToSynced(latestVault)
+      }
+    }
+
+    await this.sync.sync()
+  }
+
+  private async changePasswordTypeToUserInputted(
+    vault: VaultListingInterface,
+    userInputtedPassword: string,
+    storageMode: KeySystemRootKeyStorageMode,
+  ): Promise<void> {
+    const newRootKey = this.encryption.createUserInputtedKeySystemRootKey({
+      systemIdentifier: vault.systemIdentifier,
+      userInputtedPassword: userInputtedPassword,
+    })
+
+    if (storageMode === KeySystemRootKeyStorageMode.Synced) {
+      await this.mutator.insertItem(newRootKey, true)
+    } else {
+      this.keys.intakeNonPersistentKeySystemRootKey(newRootKey, storageMode)
+    }
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.rootKeyParams = newRootKey.keyParams
+    })
+
+    await this.keys.reencryptKeySystemItemsKeysForVault(vault.systemIdentifier)
+  }
+
+  private async changePasswordTypeToRandomized(
+    vault: VaultListingInterface,
+    storageMode: KeySystemRootKeyStorageMode,
+  ): Promise<void> {
+    const newRootKey = this.encryption.createRandomizedKeySystemRootKey({
+      systemIdentifier: vault.systemIdentifier,
+    })
+
+    if (storageMode !== KeySystemRootKeyStorageMode.Synced) {
+      throw new Error('Cannot change to randomized password if root key storage is not synced')
+    }
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.rootKeyParams = newRootKey.keyParams
+    })
+
+    await this.mutator.insertItem(newRootKey, true)
+
+    await this.keys.reencryptKeySystemItemsKeysForVault(vault.systemIdentifier)
+  }
+
+  private async changeStorageModeToLocalOrEphemeral(
+    vault: VaultListingInterface,
+    newKeyStorageMode: KeySystemRootKeyStorageMode,
+  ): Promise<void> {
+    const primaryKey = this.keys.getPrimaryKeySystemRootKey(vault.systemIdentifier)
+    if (!primaryKey) {
+      throw new Error('No primary key found')
+    }
+
+    this.keys.intakeNonPersistentKeySystemRootKey(primaryKey, newKeyStorageMode)
+    await this.keys.deleteAllSyncedKeySystemRootKeys(vault.systemIdentifier)
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.keyStorageMode = newKeyStorageMode
+    })
+
+    await this.sync.sync()
+  }
+
+  private async changeStorageModeToSynced(vault: VaultListingInterface): Promise<void> {
+    const allRootKeys = this.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+    const syncedRootKeys = this.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+    for (const key of allRootKeys) {
+      const existingSyncedKey = syncedRootKeys.find((syncedKey) => syncedKey.token === key.token)
+      if (existingSyncedKey) {
+        continue
+      }
+
+      await this.mutator.insertItem(key)
+    }
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.keyStorageMode = KeySystemRootKeyStorageMode.Synced
+    })
+  }
+}

packages/services/src/Domain/Vault/UseCase/ChangeVaultKeyOptionsDTO.ts

@@ -0,0 +1,10 @@
+import { KeySystemRootKeyPasswordType, KeySystemRootKeyStorageMode, VaultListingInterface } from '@standardnotes/models'
+
+export type ChangeVaultKeyOptionsDTO = {
+  vault: VaultListingInterface
+  newPasswordType:
+    | { passwordType: KeySystemRootKeyPasswordType.Randomized }
+    | { passwordType: KeySystemRootKeyPasswordType.UserInputted; userInputtedPassword: string }
+    | undefined
+  newKeyStorageMode: KeySystemRootKeyStorageMode | undefined
+}

packages/services/src/Domain/Vault/UseCase/CreateVault.ts

@@ -0,0 +1,117 @@
+import { SyncServiceInterface } from '../../Sync/SyncServiceInterface'
+import { UuidGenerator } from '@standardnotes/utils'
+import {
+  KeySystemRootKeyParamsInterface,
+  KeySystemRootKeyPasswordType,
+  VaultListingContentSpecialized,
+  VaultListingInterface,
+  KeySystemRootKeyStorageMode,
+  FillItemContentSpecialized,
+  KeySystemRootKeyInterface,
+} from '@standardnotes/models'
+import { MutatorClientInterface } from '../../Mutator/MutatorClientInterface'
+import { ContentType } from '@standardnotes/domain-core'
+import { EncryptionProviderInterface } from '../../Encryption/EncryptionProviderInterface'
+import { KeySystemKeyManagerInterface } from '../../KeySystem/KeySystemKeyManagerInterface'
+
+export class CreateVault {
+  constructor(
+    private mutator: MutatorClientInterface,
+    private encryption: EncryptionProviderInterface,
+    private keys: KeySystemKeyManagerInterface,
+    private sync: SyncServiceInterface,
+  ) {}
+
+  async execute(dto: {
+    vaultName: string
+    vaultDescription?: string
+    userInputtedPassword: string | undefined
+    storagePreference: KeySystemRootKeyStorageMode
+  }): Promise<VaultListingInterface> {
+    const keySystemIdentifier = UuidGenerator.GenerateUuid()
+
+    const rootKey = await this.createKeySystemRootKey({
+      keySystemIdentifier,
+      vaultName: dto.vaultName,
+      vaultDescription: dto.vaultDescription,
+      userInputtedPassword: dto.userInputtedPassword,
+      storagePreference: dto.storagePreference,
+    })
+
+    await this.createKeySystemItemsKey(keySystemIdentifier, rootKey.token)
+
+    const vaultListing = await this.createVaultListing({
+      keySystemIdentifier,
+      vaultName: dto.vaultName,
+      vaultDescription: dto.vaultDescription,
+      passwordType: dto.userInputtedPassword
+        ? KeySystemRootKeyPasswordType.UserInputted
+        : KeySystemRootKeyPasswordType.Randomized,
+      rootKeyParams: rootKey.keyParams,
+      storage: dto.storagePreference,
+    })
+
+    await this.sync.sync()
+
+    return vaultListing
+  }
+
+  private async createVaultListing(dto: {
+    keySystemIdentifier: string
+    vaultName: string
+    vaultDescription?: string
+    passwordType: KeySystemRootKeyPasswordType
+    rootKeyParams: KeySystemRootKeyParamsInterface
+    storage: KeySystemRootKeyStorageMode
+  }): Promise<VaultListingInterface> {
+    const content: VaultListingContentSpecialized = {
+      systemIdentifier: dto.keySystemIdentifier,
+      rootKeyParams: dto.rootKeyParams,
+      keyStorageMode: dto.storage,
+      name: dto.vaultName,
+      description: dto.vaultDescription,
+    }
+
+    return this.mutator.createItem(ContentType.TYPES.VaultListing, FillItemContentSpecialized(content), true)
+  }
+
+  private async createKeySystemItemsKey(keySystemIdentifier: string, rootKeyToken: string): Promise<void> {
+    const keySystemItemsKey = this.encryption.createKeySystemItemsKey(
+      UuidGenerator.GenerateUuid(),
+      keySystemIdentifier,
+      undefined,
+      rootKeyToken,
+    )
+
+    await this.mutator.insertItem(keySystemItemsKey)
+  }
+
+  private async createKeySystemRootKey(dto: {
+    keySystemIdentifier: string
+    vaultName: string
+    vaultDescription?: string
+    userInputtedPassword: string | undefined
+    storagePreference: KeySystemRootKeyStorageMode
+  }): Promise<KeySystemRootKeyInterface> {
+    let newRootKey: KeySystemRootKeyInterface | undefined
+
+    if (dto.userInputtedPassword) {
+      newRootKey = this.encryption.createUserInputtedKeySystemRootKey({
+        systemIdentifier: dto.keySystemIdentifier,
+        userInputtedPassword: dto.userInputtedPassword,
+      })
+    } else {
+      newRootKey = this.encryption.createRandomizedKeySystemRootKey({
+        systemIdentifier: dto.keySystemIdentifier,
+      })
+    }
+
+    if (dto.storagePreference === KeySystemRootKeyStorageMode.Synced) {
+      await this.mutator.insertItem(newRootKey, true)
+    } else {
+      this.keys.intakeNonPersistentKeySystemRootKey(newRootKey, dto.storagePreference)
+    }
+
+    return newRootKey
+  }
+}

packages/services/src/Domain/Vault/UseCase/DeleteVault.ts

@@ -0,0 +1,32 @@
+import { ClientDisplayableError } from '@standardnotes/responses'
+import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
+import { VaultListingInterface } from '@standardnotes/models'
+import { MutatorClientInterface } from '../../Mutator/MutatorClientInterface'
+import { KeySystemKeyManagerInterface } from '../../KeySystem/KeySystemKeyManagerInterface'
+
+export class DeleteVault {
+  constructor(
+    private items: ItemManagerInterface,
+    private mutator: MutatorClientInterface,
+    private keys: KeySystemKeyManagerInterface,
+  ) {}
+
+  async execute(vault: VaultListingInterface): Promise<ClientDisplayableError | void> {
+    if (!vault.systemIdentifier) {
+      throw new Error('Vault system identifier is missing')
+    }
+
+    await this.keys.deleteNonPersistentSystemRootKeysForVault(vault.systemIdentifier)
+
+    const rootKeys = this.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+    await this.mutator.setItemsToBeDeleted(rootKeys)
+
+    const itemsKeys = this.keys.getKeySystemItemsKeys(vault.systemIdentifier)
+    await this.mutator.setItemsToBeDeleted(itemsKeys)
+
+    const vaultItems = this.items.itemsBelongingToKeySystem(vault.systemIdentifier)
+    await this.mutator.setItemsToBeDeleted(vaultItems)
+
+    await this.mutator.setItemToBeDeleted(vault)
+  }
+}

packages/services/src/Domain/Vault/UseCase/GetVault.ts

@@ -0,0 +1,29 @@
+import { VaultListingInterface } from '@standardnotes/models'
+import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
+import { ContentType, Result, SyncUseCaseInterface } from '@standardnotes/domain-core'
+
+export class GetVault implements SyncUseCaseInterface<VaultListingInterface> {
+  constructor(private items: ItemManagerInterface) {}
+
+  execute<T extends VaultListingInterface>(
+    query: { keySystemIdentifier: string } | { sharedVaultUuid: string },
+  ): Result<T> {
+    const vaults = this.items.getItems<VaultListingInterface>(ContentType.TYPES.VaultListing)
+
+    if ('keySystemIdentifier' in query) {
+      const result = vaults.find((listing) => listing.systemIdentifier === query.keySystemIdentifier) as T
+      if (!result) {
+        return Result.fail('Vault not found')
+      }
+
+      return Result.ok(result)
+    } else {
+      const result = vaults.find((listing) => listing.sharing?.sharedVaultUuid === query.sharedVaultUuid) as T
+      if (!result) {
+        return Result.fail('Shared vault not found')
+      }
+
+      return Result.ok(result)
+    }
+  }
+}

packages/services/src/Domain/Vault/UseCase/GetVaults.ts

@@ -0,0 +1,15 @@
+import { ContentType, Result, SyncUseCaseInterface } from '@standardnotes/domain-core'
+import { VaultListingInterface } from '@standardnotes/models'
+import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
+
+export class GetVaults implements SyncUseCaseInterface<VaultListingInterface[]> {
+  constructor(private items: ItemManagerInterface) {}
+
+  execute(): Result<VaultListingInterface[]> {
+    const vaults = this.items.getItems<VaultListingInterface>(ContentType.TYPES.VaultListing).sort((a, b) => {
+      return a.name.localeCompare(b.name)
+    })
+
+    return Result.ok(vaults)
+  }
+}

packages/services/src/Domain/Vault/UseCase/MoveItemsToVault.ts

@@ -0,0 +1,42 @@
+import { MutatorClientInterface, SyncServiceInterface } from '@standardnotes/services'
+import { ClientDisplayableError } from '@standardnotes/responses'
+import { DecryptedItemInterface, FileItem, VaultListingInterface } from '@standardnotes/models'
+import { FilesClientInterface } from '@standardnotes/files'
+import { ContentType } from '@standardnotes/domain-core'
+
+export class MoveItemsToVault {
+  constructor(
+    private mutator: MutatorClientInterface,
+    private sync: SyncServiceInterface,
+    private files: FilesClientInterface,
+  ) {}
+
+  async execute(dto: {
+    items: DecryptedItemInterface[]
+    vault: VaultListingInterface
+  }): Promise<ClientDisplayableError | void> {
+    for (const item of dto.items) {
+      await this.mutator.changeItem(item, (mutator) => {
+        mutator.key_system_identifier = dto.vault.systemIdentifier
+        mutator.shared_vault_uuid = dto.vault.isSharedVaultListing() ? dto.vault.sharing.sharedVaultUuid : undefined
+      })
+    }
+
+    await this.sync.sync()
+
+    for (const item of dto.items) {
+      if (item.content_type !== ContentType.TYPES.File) {
+        continue
+      }
+
+      if (dto.vault.isSharedVaultListing()) {
+        await this.files.moveFileToSharedVault(item as FileItem, dto.vault)
+      } else {
+        const itemPreviouslyBelongedToSharedVault = item.shared_vault_uuid
+        if (itemPreviouslyBelongedToSharedVault) {
+          await this.files.moveFileOutOfSharedVault(item as FileItem)
+        }
+      }
+    }
+  }
+}

packages/services/src/Domain/Vault/UseCase/RemoveItemFromVault.ts

@@ -0,0 +1,26 @@
+import { MutatorClientInterface, SyncServiceInterface } from '@standardnotes/services'
+import { ClientDisplayableError } from '@standardnotes/responses'
+import { DecryptedItemInterface, FileItem } from '@standardnotes/models'
+import { ContentType } from '@standardnotes/domain-core'
+import { FilesClientInterface } from '@standardnotes/files'
+
+export class RemoveItemFromVault {
+  constructor(
+    private mutator: MutatorClientInterface,
+    private sync: SyncServiceInterface,
+    private files: FilesClientInterface,
+  ) {}
+
+  async execute(dto: { item: DecryptedItemInterface }): Promise<ClientDisplayableError | void> {
+    await this.mutator.changeItem(dto.item, (mutator) => {
+      mutator.key_system_identifier = undefined
+      mutator.shared_vault_uuid = undefined
+    })
+
+    await this.sync.sync()
+
+    if (dto.item.content_type === ContentType.TYPES.File) {
+      await this.files.moveFileOutOfSharedVault(dto.item as FileItem)
+    }
+  }
+}

packages/services/src/Domain/Vault/UseCase/RotateVaultKey.ts

@@ -0,0 +1,95 @@
+import { UuidGenerator, assert } from '@standardnotes/utils'
+import { ClientDisplayableError, isClientDisplayableError } from '@standardnotes/responses'
+import {
+  KeySystemIdentifier,
+  KeySystemRootKeyInterface,
+  KeySystemRootKeyPasswordType,
+  KeySystemRootKeyStorageMode,
+  VaultListingInterface,
+  VaultListingMutator,
+} from '@standardnotes/models'
+import { MutatorClientInterface } from '../../Mutator/MutatorClientInterface'
+import { EncryptionProviderInterface } from '../../Encryption/EncryptionProviderInterface'
+import { KeySystemKeyManagerInterface } from '../../KeySystem/KeySystemKeyManagerInterface'
+
+export class RotateVaultKey {
+  constructor(
+    private mutator: MutatorClientInterface,
+    private encryption: EncryptionProviderInterface,
+    private keys: KeySystemKeyManagerInterface,
+  ) {}
+
+  async execute(params: {
+    vault: VaultListingInterface
+    sharedVaultUuid: string | undefined
+    userInputtedPassword: string | undefined
+  }): Promise<undefined | ClientDisplayableError[]> {
+    const currentRootKey = this.keys.getPrimaryKeySystemRootKey(params.vault.systemIdentifier)
+    if (!currentRootKey) {
+      throw new Error('Cannot rotate key system root key; key system root key not found')
+    }
+
+    let newRootKey: KeySystemRootKeyInterface | undefined
+
+    if (currentRootKey.keyParams.passwordType === KeySystemRootKeyPasswordType.UserInputted) {
+      if (!params.userInputtedPassword) {
+        throw new Error('Cannot rotate key system root key; user inputted password required')
+      }
+
+      newRootKey = this.encryption.createUserInputtedKeySystemRootKey({
+        systemIdentifier: params.vault.systemIdentifier,
+        userInputtedPassword: params.userInputtedPassword,
+      })
+    } else if (currentRootKey.keyParams.passwordType === KeySystemRootKeyPasswordType.Randomized) {
+      newRootKey = this.encryption.createRandomizedKeySystemRootKey({
+        systemIdentifier: params.vault.systemIdentifier,
+      })
+    }
+
+    if (!newRootKey) {
+      throw new Error('Cannot rotate key system root key; new root key not created')
+    }
+
+    if (params.vault.keyStorageMode === KeySystemRootKeyStorageMode.Synced) {
+      await this.mutator.insertItem(newRootKey, true)
+    } else {
+      this.keys.intakeNonPersistentKeySystemRootKey(newRootKey, params.vault.keyStorageMode)
+    }
+
+    await this.mutator.changeItem<VaultListingMutator>(params.vault, (mutator) => {
+      assert(newRootKey)
+      mutator.rootKeyParams = newRootKey.keyParams
+    })
+
+    const errors: ClientDisplayableError[] = []
+
+    const updateKeySystemItemsKeyResult = await this.createNewKeySystemItemsKey({
+      keySystemIdentifier: params.vault.systemIdentifier,
+      sharedVaultUuid: params.sharedVaultUuid,
+      rootKeyToken: newRootKey.token,
+    })
+
+    if (isClientDisplayableError(updateKeySystemItemsKeyResult)) {
+      errors.push(updateKeySystemItemsKeyResult)
+    }
+
+    await this.keys.reencryptKeySystemItemsKeysForVault(params.vault.systemIdentifier)
+
+    return errors
+  }
+
+  private async createNewKeySystemItemsKey(params: {
+    keySystemIdentifier: KeySystemIdentifier
+    sharedVaultUuid: string | undefined
+    rootKeyToken: string
+  }): Promise<ClientDisplayableError | void> {
+    const newItemsKeyUuid = UuidGenerator.GenerateUuid()
+    const newItemsKey = this.encryption.createKeySystemItemsKey(
+      newItemsKeyUuid,
+      params.keySystemIdentifier,
+      params.sharedVaultUuid,
+      params.rootKeyToken,
+    )
+    await this.mutator.insertItem(newItemsKey)
+  }
+}

packages/services/src/Domain/Vault/VaultService.ts

@@ -0,0 +1,241 @@
+import { isClientDisplayableError } from '@standardnotes/responses'
+import {
+  DecryptedItemInterface,
+  FileItem,
+  KeySystemIdentifier,
+  KeySystemRootKeyStorageMode,
+  VaultListingInterface,
+  VaultListingMutator,
+  isNote,
+} from '@standardnotes/models'
+import { VaultServiceInterface } from './VaultServiceInterface'
+import { ChangeVaultKeyOptionsDTO } from './UseCase/ChangeVaultKeyOptionsDTO'
+import { VaultServiceEvent, VaultServiceEventPayload } from './VaultServiceEvent'
+import { CreateVault } from './UseCase/CreateVault'
+import { AbstractService } from '../Service/AbstractService'
+import { SyncServiceInterface } from '../Sync/SyncServiceInterface'
+import { ItemManagerInterface } from '../Item/ItemManagerInterface'
+import { InternalEventBusInterface } from '../Internal/InternalEventBusInterface'
+import { RemoveItemFromVault } from './UseCase/RemoveItemFromVault'
+import { DeleteVault } from './UseCase/DeleteVault'
+import { MoveItemsToVault } from './UseCase/MoveItemsToVault'
+import { RotateVaultKey } from './UseCase/RotateVaultKey'
+import { GetVault } from './UseCase/GetVault'
+import { ChangeVaultKeyOptions } from './UseCase/ChangeVaultKeyOptions'
+import { MutatorClientInterface } from '../Mutator/MutatorClientInterface'
+import { AlertService } from '../Alert/AlertService'
+import { GetVaults } from './UseCase/GetVaults'
+import { VaultLockServiceInterface } from '../VaultLock/VaultLockServiceInterface'
+
+export class VaultService
+  extends AbstractService<VaultServiceEvent, VaultServiceEventPayload[VaultServiceEvent]>
+  implements VaultServiceInterface
+{
+  constructor(
+    private sync: SyncServiceInterface,
+    private items: ItemManagerInterface,
+    private mutator: MutatorClientInterface,
+    private vaultLocks: VaultLockServiceInterface,
+    private alerts: AlertService,
+    private _getVault: GetVault,
+    private _getVaults: GetVaults,
+    private _changeVaultKeyOptions: ChangeVaultKeyOptions,
+    private _moveItemsToVault: MoveItemsToVault,
+    private _createVault: CreateVault,
+    private _removeItemFromVault: RemoveItemFromVault,
+    private _deleteVault: DeleteVault,
+    private _rotateVaultKey: RotateVaultKey,
+    eventBus: InternalEventBusInterface,
+  ) {
+    super(eventBus)
+  }
+
+  override deinit(): void {
+    super.deinit()
+    ;(this.sync as unknown) = undefined
+    ;(this.items as unknown) = undefined
+    ;(this.mutator as unknown) = undefined
+    ;(this.vaultLocks as unknown) = undefined
+    ;(this.alerts as unknown) = undefined
+    ;(this._getVault as unknown) = undefined
+    ;(this._getVaults as unknown) = undefined
+    ;(this._changeVaultKeyOptions as unknown) = undefined
+    ;(this._moveItemsToVault as unknown) = undefined
+    ;(this._createVault as unknown) = undefined
+    ;(this._removeItemFromVault as unknown) = undefined
+    ;(this._deleteVault as unknown) = undefined
+    ;(this._rotateVaultKey as unknown) = undefined
+  }
+
+  getVaults(): VaultListingInterface[] {
+    return this._getVaults.execute().getValue()
+  }
+
+  public getVault(dto: { keySystemIdentifier: KeySystemIdentifier }): VaultListingInterface | undefined {
+    const result = this._getVault.execute(dto)
+    if (result.isFailed()) {
+      return undefined
+    }
+
+    return result.getValue()
+  }
+
+  public getSureVault(dto: { keySystemIdentifier: KeySystemIdentifier }): VaultListingInterface {
+    const vault = this.getVault(dto)
+    if (!vault) {
+      throw new Error('Vault not found')
+    }
+
+    return vault
+  }
+
+  async createRandomizedVault(dto: { name: string; description?: string }): Promise<VaultListingInterface> {
+    return this.createVaultWithParameters({
+      name: dto.name,
+      description: dto.description,
+      userInputtedPassword: undefined,
+      storagePreference: KeySystemRootKeyStorageMode.Synced,
+    })
+  }
+
+  async createUserInputtedPasswordVault(dto: {
+    name: string
+    description?: string
+    userInputtedPassword: string
+    storagePreference: KeySystemRootKeyStorageMode
+  }): Promise<VaultListingInterface> {
+    return this.createVaultWithParameters(dto)
+  }
+
+  private async createVaultWithParameters(dto: {
+    name: string
+    description?: string
+    userInputtedPassword: string | undefined
+    storagePreference: KeySystemRootKeyStorageMode
+  }): Promise<VaultListingInterface> {
+    const result = await this._createVault.execute({
+      vaultName: dto.name,
+      vaultDescription: dto.description,
+      userInputtedPassword: dto.userInputtedPassword,
+      storagePreference: dto.storagePreference,
+    })
+
+    return result
+  }
+
+  async moveItemToVault(
+    vault: VaultListingInterface,
+    item: DecryptedItemInterface,
+  ): Promise<DecryptedItemInterface | undefined> {
+    if (this.vaultLocks.isVaultLocked(vault)) {
+      throw new Error('Attempting to add item to locked vault')
+    }
+
+    let linkedFiles: FileItem[] = []
+    if (isNote(item)) {
+      linkedFiles = this.items.getNoteLinkedFiles(item)
+
+      if (linkedFiles.length > 0) {
+        const confirmed = await this.alerts.confirmV2({
+          title: 'Linked files will be moved to vault',
+          text: `This note has ${linkedFiles.length} linked files. They will also be moved to the vault. Do you want to continue?`,
+        })
+        if (!confirmed) {
+          return undefined
+        }
+      }
+    }
+
+    await this._moveItemsToVault.execute({ vault, items: [item, ...linkedFiles] })
+
+    return this.items.findSureItem(item.uuid)
+  }
+
+  async removeItemFromVault(item: DecryptedItemInterface): Promise<DecryptedItemInterface> {
+    const vault = this.getItemVault(item)
+    if (!vault) {
+      throw new Error('Cannot find vault to remove item from')
+    }
+
+    if (this.vaultLocks.isVaultLocked(vault)) {
+      throw new Error('Attempting to remove item from locked vault')
+    }
+
+    await this._removeItemFromVault.execute({ item })
+    return this.items.findSureItem(item.uuid)
+  }
+
+  async deleteVault(vault: VaultListingInterface): Promise<boolean> {
+    if (vault.isSharedVaultListing()) {
+      throw new Error('Shared vault must be deleted through SharedVaultService')
+    }
+
+    const error = await this._deleteVault.execute(vault)
+
+    if (isClientDisplayableError(error)) {
+      return false
+    }
+
+    await this.sync.sync()
+    return true
+  }
+
+  async changeVaultNameAndDescription(
+    vault: VaultListingInterface,
+    params: { name: string; description?: string },
+  ): Promise<VaultListingInterface> {
+    const updatedVault = await this.mutator.changeItem<VaultListingMutator, VaultListingInterface>(vault, (mutator) => {
+      mutator.name = params.name
+      mutator.description = params.description
+    })
+
+    await this.sync.sync()
+
+    return updatedVault
+  }
+
+  async rotateVaultRootKey(vault: VaultListingInterface): Promise<void> {
+    if (this.vaultLocks.isVaultLocked(vault)) {
+      throw new Error('Cannot rotate root key of locked vault')
+    }
+
+    await this._rotateVaultKey.execute({
+      vault,
+      sharedVaultUuid: vault.isSharedVaultListing() ? vault.sharing.sharedVaultUuid : undefined,
+      userInputtedPassword: undefined,
+    })
+
+    await this.notifyEventSync(VaultServiceEvent.VaultRootKeyRotated, { vault })
+
+    await this.sync.sync()
+  }
+
+  isItemInVault(item: DecryptedItemInterface): boolean {
+    return item.key_system_identifier !== undefined
+  }
+
+  getItemVault(item: DecryptedItemInterface): VaultListingInterface | undefined {
+    const latestItem = this.items.findItem(item.uuid)
+    if (!latestItem) {
+      throw new Error('Cannot find latest version of item to get vault for')
+    }
+
+    if (!latestItem.key_system_identifier) {
+      return undefined
+    }
+
+    return this.getVault({ keySystemIdentifier: latestItem.key_system_identifier })
+  }
+
+  async changeVaultOptions(dto: ChangeVaultKeyOptionsDTO): Promise<void> {
+    if (this.vaultLocks.isVaultLocked(dto.vault)) {
+      throw new Error('Attempting to change vault options on a locked vault')
+    }
+
+    await this._changeVaultKeyOptions.execute(dto)
+
+    if (dto.newPasswordType) {
+      await this.notifyEventSync(VaultServiceEvent.VaultRootKeyRotated, { vault: dto.vault })
+    }
+  }
+}

packages/services/src/Domain/Vault/VaultServiceEvent.ts

@@ -0,0 +1,11 @@
+import { VaultListingInterface } from '@standardnotes/models'
+
+export enum VaultServiceEvent {
+  VaultRootKeyRotated = 'VaultRootKeyRotated',
+}
+
+export type VaultServiceEventPayload = {
+  [VaultServiceEvent.VaultRootKeyRotated]: {
+    vault: VaultListingInterface
+  }
+}

packages/services/src/Domain/Vault/VaultServiceInterface.ts

@@ -0,0 +1,39 @@
+import {
+  DecryptedItemInterface,
+  KeySystemIdentifier,
+  KeySystemRootKeyStorageMode,
+  VaultListingInterface,
+} from '@standardnotes/models'
+import { AbstractService } from '../Service/AbstractService'
+import { VaultServiceEvent, VaultServiceEventPayload } from './VaultServiceEvent'
+import { ChangeVaultKeyOptionsDTO } from './UseCase/ChangeVaultKeyOptionsDTO'
+
+export interface VaultServiceInterface
+  extends AbstractService<VaultServiceEvent, VaultServiceEventPayload[VaultServiceEvent]> {
+  createRandomizedVault(dto: { name: string; description?: string }): Promise<VaultListingInterface>
+  createUserInputtedPasswordVault(dto: {
+    name: string
+    description?: string
+    userInputtedPassword: string
+    storagePreference: KeySystemRootKeyStorageMode
+  }): Promise<VaultListingInterface>
+
+  getVaults(): VaultListingInterface[]
+  getVault(dto: { keySystemIdentifier: KeySystemIdentifier }): VaultListingInterface | undefined
+  deleteVault(vault: VaultListingInterface): Promise<boolean>
+
+  moveItemToVault(
+    vault: VaultListingInterface,
+    item: DecryptedItemInterface,
+  ): Promise<DecryptedItemInterface | undefined>
+  removeItemFromVault(item: DecryptedItemInterface): Promise<DecryptedItemInterface>
+  isItemInVault(item: DecryptedItemInterface): boolean
+  getItemVault(item: DecryptedItemInterface): VaultListingInterface | undefined
+
+  changeVaultNameAndDescription(
+    vault: VaultListingInterface,
+    params: { name: string; description: string },
+  ): Promise<VaultListingInterface>
+  rotateVaultRootKey(vault: VaultListingInterface): Promise<void>
+  changeVaultOptions(dto: ChangeVaultKeyOptionsDTO): Promise<void>
+}