bf5aeedbc2
An owner can now rotate a profile's DEK — generating a fresh key, re-encrypting all the profile's data under it (client-side), and re-wrapping to the owner share + kept recipients. A revoked recipient's cached old DEK stops working, closing the soft-revoke window the ADR requires for graduation / suspected compromise. The server stays a blind store: it sees opaque old→new ciphertext blobs flow through, never the DEK or plaintext. No backend crypto. Backend: - ProfileRepository::update_wrapped_dek — rotate the owner share (account-wrapped profile DEK), owner-scoped. - ProfileShareRepository::find_active_for_profile + delete_for_profile_excluding — list current recipients and hard-delete omitted ones. - POST /api/profiles/:id/rekey: validates each submitted envelope against existing active shares (no smuggling new recipients in via rekey), rotates the owner share, upserts recipient envelopes with fresh ephemeral ECDH keys, hard-deletes omitted recipients. - rekey_tests.rs: rotation, hard-revoke-from-recipient-view, no-share rejection, non-owner rejection, revoke-all. Frontend: - useProfileStore.rekeyProfile: fetches all profile data, re-encrypts each row under a new DEK (resume-safe — rows already on the new DEK are skipped), builds fresh ECDH envelopes per kept recipient, commits via POST /rekey, swaps the in-memory DEK. - ProfileSharing: 'Rotate encryption key (hard revoke)' action with a strong confirmation dialog explaining the cost and the resume-safe retry. Best-effort + resumable retry (per design decision); no server-side write lock. Verification: backend cargo build/clippy (-D warnings)/fmt clean, tests compile (integration tests run in CI — Mongo is fixed there). Frontend tsc clean, 31/31 tests pass. ⚠️ Backend integration tests not run locally (no Mongo in this sandbox); CI will run them — I'll fix any failures. Admin-initiated rekey (ADR §5c reserves the permission) is out of scope — handler is owner-only until admin shares are creatable in Phase D. Refs #3.
34 lines
1.2 KiB
Rust
34 lines
1.2 KiB
Rust
pub mod appointments;
|
|
pub mod auth;
|
|
pub mod health;
|
|
pub mod health_stats;
|
|
pub mod interactions;
|
|
pub mod medications;
|
|
pub mod profile;
|
|
pub mod profile_share;
|
|
pub mod sessions;
|
|
pub mod users;
|
|
|
|
// Re-export commonly used handler functions
|
|
pub use appointments::{
|
|
create_appointment, delete_appointment, get_appointment, list_appointments, update_appointment,
|
|
};
|
|
pub use auth::{login, logout, recover_password, recovery_info, refresh, register};
|
|
pub use health::{health_check, ready_check};
|
|
pub use health_stats::{
|
|
create_health_stat, delete_health_stat, get_health_stat, list_health_stats, update_health_stat,
|
|
};
|
|
pub use interactions::{check_interactions, check_new_medication};
|
|
pub use medications::{
|
|
create_medication, delete_medication, get_adherence, get_medication, list_medications,
|
|
log_dose, update_medication,
|
|
};
|
|
pub use profile::{create_profile, delete_profile, get_profile, list_profiles, update_profile};
|
|
pub use profile_share::{
|
|
create_share, delete_share, get_profile_shared_aware, get_public_key, list_shared_with_me,
|
|
list_shares, rekey_profile,
|
|
};
|
|
pub use sessions::{get_sessions, revoke_all_sessions, revoke_session};
|
|
pub use users::{
|
|
change_password, delete_account, get_account, get_settings, update_account, update_settings,
|
|
};
|