alvaro/normogen
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

feat: hard revoke / re-key (Phase C, #3) #15

Merged
alvaro merged 2 commits from feat/3-phase-c-rekey into main 2026-07-20 01:32:55 +00:00
Conversation 0 Commits 2 Files changed 10 +10 -5
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 6d6af67f2f - Show all commits

15
backend/src/handlers/profile_share.rs
View file

@ -613,7 +613,10 @@ pub async fn rekey_profile(
} }
// 3. Rotate the owner share (store the new account-wrapped profile DEK). // 3. Rotate the owner share (store the new account-wrapped profile DEK).
let updated = match profiles // update_wrapped_dek uses find_one_and_update, which returns the PRE-image
// by default — so we don't read the new values back from it; we echo the
// request values (exactly what was stored) in the response below.
match profiles
.update_wrapped_dek( .update_wrapped_dek(
&profile_id, &profile_id,
&owner, &owner,
@ -622,7 +625,7 @@ pub async fn rekey_profile(
) )
.await .await
{ {
Ok(Some(p)) => p, Ok(Some(_)) => {}
Ok(None) => { Ok(None) => {
return Err(( return Err((
StatusCode::NOT_FOUND, StatusCode::NOT_FOUND,
@ -636,7 +639,7 @@ pub async fn rekey_profile(
Json(serde_json::json!({ "error": "database error" })), Json(serde_json::json!({ "error": "database error" })),
)); ));
} }
}; }
// 4. Upsert each submitted recipient envelope (fresh ECDH-wrapped DEK + // 4. Upsert each submitted recipient envelope (fresh ECDH-wrapped DEK +
// ephemeral pubkey, replacing the old envelope). Preserve the original // ephemeral pubkey, replacing the old envelope). Preserve the original
@ -695,8 +698,10 @@ pub async fn rekey_profile(
StatusCode::OK, StatusCode::OK,
Json(RekeyResponse { Json(RekeyResponse {
profile_id, profile_id,
wrapped_profile_dek: updated.wrapped_profile_dek, // Echo the request values (exactly what was stored). Avoids the
wrapped_profile_dek_iv: updated.wrapped_profile_dek_iv, // find_one_and_update pre-image gotcha.
wrapped_profile_dek: req.new_wrapped_profile_dek,
wrapped_profile_dek_iv: req.new_wrapped_profile_dek_iv,
retained_recipient_user_ids: keep, retained_recipient_user_ids: keep,
}), }),
)) ))