tests: vaults-2 (#2368)

packages/snjs/lib/Application/Dependencies/Dependencies.ts

@@ -47,7 +47,7 @@ import {
   IntegrityService,
   InternalEventBus,
   KeySystemKeyManager,
-  RemoveItemsLocally,
+  DiscardItemsLocally,
   RevisionManager,
   SelfContactManager,
   StatusService,
@@ -118,6 +118,7 @@ import {
   ContactBelongsToVault,
   DeleteContact,
   VaultLockService,
+  RemoveItemsFromMemory,
 } from '@standardnotes/services'
 import { ItemManager } from '../../Services/Items/ItemManager'
 import { PayloadManager } from '../../Services/Payloads/PayloadManager'
@@ -222,8 +223,16 @@ export class Dependencies {
       return new DecryptBackupFile(this.get(TYPES.EncryptionService))
     })
 
-    this.factory.set(TYPES.RemoveItemsLocally, () => {
-      return new RemoveItemsLocally(this.get(TYPES.ItemManager), this.get(TYPES.DiskStorageService))
+    this.factory.set(TYPES.DiscardItemsLocally, () => {
+      return new DiscardItemsLocally(this.get(TYPES.ItemManager), this.get(TYPES.DiskStorageService))
+    })
+
+    this.factory.set(TYPES.RemoveItemsFromMemory, () => {
+      return new RemoveItemsFromMemory(
+        this.get(TYPES.DiskStorageService),
+        this.get(TYPES.ItemManager),
+        this.get(TYPES.PayloadManager),
+      )
     })
 
     this.factory.set(TYPES.FindContact, () => {
@@ -442,7 +451,7 @@ export class Dependencies {
         this.get(TYPES.MutatorService),
         this.get(TYPES.KeySystemKeyManager),
         this.get(TYPES.SyncService),
-        this.get(TYPES.RemoveItemsLocally),
+        this.get(TYPES.DiscardItemsLocally),
       )
     })
 
@@ -555,7 +564,7 @@ export class Dependencies {
         this.get(TYPES.MutatorService),
         this.get(TYPES.ItemManager),
         this.get(TYPES.CreateNewDefaultItemsKey),
-        this.get(TYPES.RemoveItemsLocally),
+        this.get(TYPES.DiscardItemsLocally),
         this.get(TYPES.FindDefaultItemsKey),
       )
     })
@@ -723,6 +732,7 @@ export class Dependencies {
         this.get(TYPES.ConvertToSharedVault),
         this.get(TYPES.DeleteSharedVault),
         this.get(TYPES.IsVaultOwner),
+        this.get(TYPES.DiscardItemsLocally),
         this.get(TYPES.InternalEventBus),
       )
     })
@@ -1221,6 +1231,7 @@ export class Dependencies {
         this.get(TYPES.ItemManager),
         this.get(TYPES.MutatorService),
         this.get(TYPES.DiskStorageService),
+        this.get(TYPES.RemoveItemsFromMemory),
         this.get(TYPES.InternalEventBus),
       )
     })

packages/snjs/lib/Application/Dependencies/Types.ts

@@ -89,7 +89,7 @@ export const TYPES = {
   GetRevision: Symbol.for('GetRevision'),
   DeleteRevision: Symbol.for('DeleteRevision'),
   ImportDataUseCase: Symbol.for('ImportDataUseCase'),
-  RemoveItemsLocally: Symbol.for('RemoveItemsLocally'),
+  DiscardItemsLocally: Symbol.for('DiscardItemsLocally'),
   FindContact: Symbol.for('FindContact'),
   GetAllContacts: Symbol.for('GetAllContacts'),
   CreateOrEditContact: Symbol.for('CreateOrEditContact'),
@@ -150,6 +150,7 @@ export const TYPES = {
   EncryptTypeAPayloadWithKeyLookup: Symbol.for('EncryptTypeAPayloadWithKeyLookup'),
   DecryptBackupFile: Symbol.for('DecryptBackupFile'),
   IsVaultOwner: Symbol.for('IsVaultOwner'),
+  RemoveItemsFromMemory: Symbol.for('RemoveItemsFromMemory'),
 
   // Mappers
   SessionStorageMapper: Symbol.for('SessionStorageMapper'),

packages/snjs/lib/Migrations/Versions/2_20_0.ts

@@ -18,7 +18,7 @@ export class Migration2_20_0 extends Migration {
     const items = this.services.itemManager.getItems(contentType)
 
     for (const item of items) {
-      this.services.itemManager.removeItemLocally(item)
+      this.services.itemManager.removeItemFromMemory(item)
       await this.services.storageService.deletePayloadWithUuid(item.uuid)
     }
   }

packages/snjs/lib/Migrations/Versions/2_36_0.ts

@@ -18,7 +18,7 @@ export class Migration2_36_0 extends Migration {
     const items = this.services.itemManager.getItems(contentType)
 
     for (const item of items) {
-      this.services.itemManager.removeItemLocally(item)
+      this.services.itemManager.removeItemFromMemory(item)
       await this.services.storageService.deletePayloadWithUuid(item.uuid)
     }
   }

packages/snjs/lib/Services/Items/ItemManager.ts

@@ -816,14 +816,14 @@ export class ItemManager extends Services.AbstractService implements Services.It
   /**
    * Important: Caller must coordinate with storage service separately to delete item from persistent database.
    */
-  public removeItemLocally(item: Models.AnyItemInterface): void {
-    this.removeItemsLocally([item])
+  public removeItemFromMemory(item: Models.AnyItemInterface): void {
+    this.removeItemsFromMemory([item])
   }
 
   /**
    * Important: Caller must coordinate with storage service separately to delete item from persistent database.
    */
-  public removeItemsLocally(items: Models.AnyItemInterface[]): void {
+  public removeItemsFromMemory(items: Models.AnyItemInterface[]): void {
     this.collection.discard(items)
     this.payloadManager.removePayloadLocally(items.map((item) => item.payload))
 

packages/snjs/lib/Services/Storage/DiskStorageService.ts

@@ -69,7 +69,7 @@ export class DiskStorageService
   private values!: StorageValuesObject
 
   constructor(
-    private deviceInterface: DeviceInterface,
+    private device: DeviceInterface,
     private identifier: string,
     protected override internalEventBus: InternalEventBusInterface,
   ) {
@@ -82,7 +82,7 @@ export class DiskStorageService
   }
 
   public override deinit() {
-    ;(this.deviceInterface as unknown) = undefined
+    ;(this.device as unknown) = undefined
     ;(this.encryptionProvider as unknown) = undefined
     this.storagePersistable = false
     super.deinit()
@@ -104,9 +104,9 @@ export class DiskStorageService
     this.persistencePolicy = persistencePolicy
 
     if (this.persistencePolicy === StoragePersistencePolicies.Ephemeral) {
-      await this.deviceInterface.clearNamespacedKeychainValue(this.identifier)
-      await this.deviceInterface.removeAllDatabaseEntries(this.identifier)
-      await this.deviceInterface.removeRawStorageValuesForIdentifier(this.identifier)
+      await this.device.clearNamespacedKeychainValue(this.identifier)
+      await this.device.removeAllDatabaseEntries(this.identifier)
+      await this.device.removeRawStorageValuesForIdentifier(this.identifier)
       await this.clearAllPayloads()
     }
   }
@@ -116,7 +116,7 @@ export class DiskStorageService
   }
 
   public async initializeFromDisk(): Promise<void> {
-    const value = await this.deviceInterface.getRawStorageValue(this.getPersistenceKey())
+    const value = await this.device.getRawStorageValue(this.getPersistenceKey())
     const values = value ? JSON.parse(value as string) : undefined
 
     await this.setInitialValues(values)
@@ -240,7 +240,7 @@ export class DiskStorageService
         return values
       }
 
-      await this.deviceInterface?.setRawStorageValue(this.getPersistenceKey(), JSON.stringify(values))
+      await this.device?.setRawStorageValue(this.getPersistenceKey(), JSON.stringify(values))
 
       return values
     })
@@ -385,7 +385,11 @@ export class DiskStorageService
   }
 
   public async getAllRawPayloads(): Promise<FullyFormedTransferPayload[]> {
-    return this.deviceInterface.getAllDatabaseEntries(this.identifier)
+    return this.device.getAllDatabaseEntries(this.identifier)
+  }
+
+  public async getRawPayloads(uuids: string[]): Promise<FullyFormedTransferPayload[]> {
+    return this.device.getDatabaseEntries(this.identifier, uuids)
   }
 
   public async savePayload(payload: FullyFormedPayloadInterface): Promise<void> {
@@ -440,7 +444,7 @@ export class DiskStorageService
     const exportedDeleted = deleted.map(CreateDeletedLocalStorageContextPayload)
 
     return this.executeCriticalFunction(async () => {
-      return this.deviceInterface?.saveDatabaseEntries(
+      return this.device?.saveDatabaseEntries(
         [...exportedEncrypted, ...exportedDecrypted, ...exportedDeleted],
         this.identifier,
       )
@@ -453,19 +457,19 @@ export class DiskStorageService
 
   public async deletePayloadsWithUuids(uuids: string[]): Promise<void> {
     await this.executeCriticalFunction(async () => {
-      await Promise.all(uuids.map((uuid) => this.deviceInterface.removeDatabaseEntry(uuid, this.identifier)))
+      await Promise.all(uuids.map((uuid) => this.device.removeDatabaseEntry(uuid, this.identifier)))
     })
   }
 
   public async deletePayloadWithUuid(uuid: string) {
     return this.executeCriticalFunction(async () => {
-      await this.deviceInterface.removeDatabaseEntry(uuid, this.identifier)
+      await this.device.removeDatabaseEntry(uuid, this.identifier)
     })
   }
 
   public async clearAllPayloads() {
     return this.executeCriticalFunction(async () => {
-      return this.deviceInterface.removeAllDatabaseEntries(this.identifier)
+      return this.device.removeAllDatabaseEntries(this.identifier)
     })
   }
 
@@ -474,9 +478,9 @@ export class DiskStorageService
       await this.clearValues()
       await this.clearAllPayloads()
 
-      await this.deviceInterface.removeRawStorageValue(namespacedKey(this.identifier, RawStorageKey.SnjsVersion))
+      await this.device.removeRawStorageValue(namespacedKey(this.identifier, RawStorageKey.SnjsVersion))
 
-      await this.deviceInterface.removeRawStorageValue(this.getPersistenceKey())
+      await this.device.removeRawStorageValue(this.getPersistenceKey())
     })
   }
 }

packages/snjs/mocha/TestRegistry/VaultTests.js

@@ -11,7 +11,7 @@ export const VaultTests = {
     'vaults/signatures.test.js',
     'vaults/shared_vaults.test.js',
     'vaults/invites.test.js',
-    'vaults/locking.test.js',
+    'vaults/key-management.test.js',
     'vaults/items.test.js',
     'vaults/conflicts.test.js',
     'vaults/deletion.test.js',

packages/snjs/mocha/auth.test.js

@@ -449,7 +449,7 @@ describe('basic auth', function () {
     }
 
     const mutatorSpy = sinon.spy(this.application.mutator, 'setItemToBeDeleted')
-    const removeItemsSpy = sinon.spy(this.application.items, 'removeItemsLocally')
+    const removeItemsSpy = sinon.spy(this.application.items, 'removeItemsFromMemory')
     const deletePayloadsSpy = sinon.spy(this.application.storage, 'deletePayloadsWithUuids')
 
     await this.context.changePassword('new-password')

packages/snjs/mocha/item_manager.test.js

@@ -201,7 +201,7 @@ describe('item manager', function () {
       observed.push({ changed, inserted, removed, ignored })
     })
     const note = await createNote()
-    await application.items.removeItemLocally(note)
+    await application.items.removeItemFromMemory(note)
 
     expect(observed.length).to.equal(1)
     expect(application.items.findItem(note.uuid)).to.not.be.ok

packages/snjs/mocha/keys.test.js

@@ -190,7 +190,7 @@ describe('keys', function () {
 
     const itemsKey = this.application.encryption.itemsKeyForEncryptedPayload(encryptedPayload)
 
-    await this.application.items.removeItemLocally(itemsKey)
+    await this.application.items.removeItemFromMemory(itemsKey)
 
     const erroredPayload = await this.application.encryption.decryptSplitSingle({
       usesItemsKeyWithKeyLookup: {

packages/snjs/mocha/lib/web_device_interface.js

@@ -63,6 +63,16 @@ export default class WebDeviceInterface {
     return models
   }
 
+  async getDatabaseEntries(identifier, ids) {
+    const models = []
+    for (const id of ids) {
+      const key = this._keyForPayloadId(id, identifier)
+      const model = JSON.parse(localStorage[key])
+      models.push(model)
+    }
+    return models
+  }
+
   async getDatabaseLoadChunks(options, identifier) {
     const entries = await this.getAllDatabaseEntries(identifier)
     const {

packages/snjs/mocha/sync_tests/integrity.test.js

@@ -53,7 +53,7 @@ describe('sync integrity', () => {
     const didEnterOutOfSync = awaitSyncEventPromise(this.application, SyncEvent.EnterOutOfSync)
     await this.application.sync.sync({ checkIntegrity: true })
 
-    await this.application.items.removeItemLocally(item)
+    await this.application.items.removeItemFromMemory(item)
     await this.application.sync.sync({ checkIntegrity: true, awaitAll: true })
 
     await didEnterOutOfSync
@@ -70,7 +70,7 @@ describe('sync integrity', () => {
     const didExitOutOfSync = awaitSyncEventPromise(this.application, SyncEvent.ExitOutOfSync)
 
     await this.application.sync.sync({ checkIntegrity: true })
-    await this.application.items.removeItemLocally(item)
+    await this.application.items.removeItemFromMemory(item)
     await this.application.sync.sync({ checkIntegrity: true, awaitAll: true })
 
     await Promise.all([didEnterOutOfSync, didExitOutOfSync])

packages/snjs/mocha/vaults/key-management.test.js

@@ -0,0 +1,398 @@
+import * as Factory from '../lib/factory.js'
+
+chai.use(chaiAsPromised)
+const expect = chai.expect
+
+describe('vault key management', function () {
+  this.timeout(Factory.TwentySecondTimeout)
+
+  let context
+
+  afterEach(async function () {
+    await context.deinit()
+    localStorage.clear()
+  })
+
+  beforeEach(async function () {
+    localStorage.clear()
+
+    context = await Factory.createAppContextWithRealCrypto()
+
+    await context.launch()
+  })
+
+  it('should lock non-persistent vault', async () => {
+    const vault = await context.vaults.createUserInputtedPasswordVault({
+      name: 'test vault',
+      description: 'test vault description',
+      userInputtedPassword: 'test password',
+      storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+    })
+
+    await context.vaultLocks.lockNonPersistentVault(vault)
+
+    expect(context.vaultLocks.isVaultLocked(vault)).to.be.true
+  })
+
+  it('should not be able to lock user-inputted vault with synced key', async () => {
+    const vault = await context.vaults.createUserInputtedPasswordVault({
+      name: 'test vault',
+      description: 'test vault description',
+      userInputtedPassword: 'test password',
+      storagePreference: KeySystemRootKeyStorageMode.Synced,
+    })
+
+    await Factory.expectThrowsAsync(
+      () => context.vaultLocks.lockNonPersistentVault(vault),
+      'Vault uses synced key storage and cannot be locked',
+    )
+  })
+
+  it('should not be able to lock randomized vault', async () => {
+    const vault = await context.vaults.createRandomizedVault({
+      name: 'test vault',
+      description: 'test vault description',
+    })
+
+    await Factory.expectThrowsAsync(
+      () => context.vaultLocks.lockNonPersistentVault(vault),
+      'Vault uses synced key storage and cannot be locked',
+    )
+  })
+
+  it('should throw if attempting to change password of locked vault', async () => {
+    const vault = await context.vaults.createUserInputtedPasswordVault({
+      name: 'test vault',
+      description: 'test vault description',
+      userInputtedPassword: 'test password',
+      storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+    })
+
+    await context.vaultLocks.lockNonPersistentVault(vault)
+
+    await Factory.expectThrowsAsync(
+      () => context.vaults.changeVaultOptions({ vault }),
+      'Attempting to change vault options on a locked vault',
+    )
+  })
+
+  describe('key rotation and persistence', () => {
+    it('rotating ephemeral vault should not persist keys', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      await context.vaults.rotateVaultRootKey(vault, 'test password')
+
+      const syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(syncedKeys.length).to.equal(0)
+
+      const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+      expect(storedKey).to.be.undefined
+    })
+
+    it('rotating local vault should not sync keys', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Local,
+      })
+
+      await context.vaults.rotateVaultRootKey(vault, 'test password')
+
+      const syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(syncedKeys.length).to.equal(0)
+
+      const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+      expect(storedKey).to.not.be.undefined
+    })
+
+    it('rotating synced vault should sync new key', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Synced,
+      })
+
+      await context.vaults.rotateVaultRootKey(vault, 'test password')
+
+      const syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(syncedKeys.length).to.equal(2)
+
+      const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+      expect(storedKey).to.be.undefined
+    })
+  })
+
+  describe('memory management', () => {
+    it('locking a vault should clear decrypted items keys from memory', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      const itemsKeys = context.keys.getKeySystemItemsKeys(vault.systemIdentifier)
+      expect(itemsKeys.length).to.equal(1)
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+
+      const itemsKeysAfterLock = context.keys.getKeySystemItemsKeys(vault.systemIdentifier)
+      expect(itemsKeysAfterLock.length).to.equal(0)
+    })
+
+    it('locking then unlocking a vault should bring items keys back into memory', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+      await context.vaultLocks.unlockNonPersistentVault(vault, 'test password')
+
+      const itemsKeys = context.keys.getKeySystemItemsKeys(vault.systemIdentifier)
+      expect(itemsKeys.length).to.equal(1)
+
+      const rootKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(rootKeys.length).to.equal(1)
+    })
+  })
+
+  describe('changeVaultOptions', () => {
+    describe('change storage type', () => {
+      it('should not be able to change randomized vault from synced to local', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.true
+        expect(result.getError()).to.equal('Vault uses randomized password and cannot change its storage preference')
+      })
+
+      it('should not be able to change randomized vault from synced to ephemeral', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.true
+        expect(result.getError()).to.equal('Vault uses randomized password and cannot change its storage preference')
+      })
+
+      it('should change user password vault from synced to local', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Synced,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(0)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.not.be.undefined
+      })
+
+      it('should change user password vault from synced to ephemeral', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Synced,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Ephemeral,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(0)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const memKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(memKeys.length).to.equal(1)
+      })
+
+      it('should change user password vault from local to synced', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Synced,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(1)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const memKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(memKeys.length).to.equal(1)
+      })
+
+      it('should change user password vault from local to ephemeral', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Ephemeral,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(0)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const memKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(memKeys.length).to.equal(1)
+      })
+    })
+
+    describe('change password type', () => {
+      it('should fail to change password type from randomized to user inputted if password is not supplied', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.UserInputted,
+          },
+        })
+
+        expect(result.isFailed()).to.be.true
+      })
+
+      it('should change password type from randomized to user inputted', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const rootKeysBeforeChange = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(rootKeysBeforeChange.length).to.equal(1)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.UserInputted,
+            userInputtedPassword: 'test password',
+          },
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        const rootKeysAfterChange = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(rootKeysAfterChange.length).to.equal(2)
+
+        expect(rootKeysAfterChange[0].itemsKey).to.not.equal(rootKeysAfterChange[1].itemsKey)
+      })
+
+      it('should change password type from user inputted to randomized', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.Randomized,
+          },
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        const rootKeysAfterChange = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(rootKeysAfterChange.length).to.equal(1)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const updatedVault = context.vaults.getVault({ keySystemIdentifier: vault.systemIdentifier })
+        expect(updatedVault.keyStorageMode).to.equal(KeySystemRootKeyStorageMode.Synced)
+      })
+
+      it('should fail to change password type from user inputted to randomized if storage mode is not synced', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.Randomized,
+          },
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.true
+
+        expect(result.getError()).to.equal('Vault uses randomized password and cannot change its storage preference')
+      })
+    })
+  })
+})

packages/snjs/mocha/vaults/key_rotation.test.js

@@ -29,7 +29,7 @@ describe('shared vault key rotation', function () {
 
     contactContext.lockSyncing()
 
-    const spy = sinon.spy(context.keys, 'reencryptKeySystemItemsKeysForVault')
+    const spy = sinon.spy(context.keys, 'queueVaultItemsKeysForReencryption')
 
     const promise = context.resolveWhenSharedVaultKeyRotationInvitesGetSent(sharedVault)
     await context.vaults.rotateVaultRootKey(sharedVault)

packages/snjs/mocha/vaults/locking.test.js

@@ -1,108 +0,0 @@
-import * as Factory from '../lib/factory.js'
-import * as Collaboration from '../lib/Collaboration.js'
-
-chai.use(chaiAsPromised)
-const expect = chai.expect
-
-describe('vault locking', function () {
-  this.timeout(Factory.TwentySecondTimeout)
-
-  let context
-
-  afterEach(async function () {
-    await context.deinit()
-    localStorage.clear()
-  })
-
-  beforeEach(async function () {
-    localStorage.clear()
-
-    context = await Factory.createAppContextWithRealCrypto()
-
-    await context.launch()
-    await context.register()
-  })
-
-  it('should lock non-persistent vault', async () => {
-    const vault = await context.vaults.createUserInputtedPasswordVault({
-      name: 'test vault',
-      description: 'test vault description',
-      userInputtedPassword: 'test password',
-      storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
-    })
-
-    context.vaultLocks.lockNonPersistentVault(vault)
-
-    expect(context.vaultLocks.isVaultLocked(vault)).to.be.true
-  })
-
-  it('should not be able to lock user-inputted vault with synced key', async () => {
-    const vault = await context.vaults.createUserInputtedPasswordVault({
-      name: 'test vault',
-      description: 'test vault description',
-      userInputtedPassword: 'test password',
-      storagePreference: KeySystemRootKeyStorageMode.Synced,
-    })
-
-    expect(() => context.vaultLocks.lockNonPersistentVault(vault)).to.throw(
-      Error,
-      'Vault uses synced key storage and cannot be locked',
-    )
-  })
-
-  it('should not be able to lock randomized vault', async () => {
-    const vault = await context.vaults.createRandomizedVault({
-      name: 'test vault',
-      description: 'test vault description',
-    })
-
-    expect(() => context.vaultLocks.lockNonPersistentVault(vault)).to.throw(
-      Error,
-      'Vault uses synced key storage and cannot be locked',
-    )
-  })
-
-  it('should throw if attempting to change password of locked vault', async () => {
-    const vault = await context.vaults.createUserInputtedPasswordVault({
-      name: 'test vault',
-      description: 'test vault description',
-      userInputtedPassword: 'test password',
-      storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
-    })
-
-    context.vaultLocks.lockNonPersistentVault(vault)
-
-    await Factory.expectThrowsAsync(
-      () => context.vaults.changeVaultOptions({ vault }),
-      'Attempting to change vault options on a locked vault',
-    )
-  })
-
-  it('should respect storage preference when rotating key system root key', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change storage preference from synced to local', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change storage preference from local to synced', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should resync key system items key if it is encrypted with noncurrent key system root key', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change password type from user inputted to randomized', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change password type from randomized to user inputted', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should not be able to change storage mode of third party vault', async () => {
-    console.error('TODO: implement')
-  })
-})