Export the note lock key whenever a note uses it and warn when an import cannot update locked notes

Author: keshav0479

packages/lib/services/e2ee/EncryptionService.ts

@@ -810,9 +810,9 @@ export default class EncryptionService {
 		return `${isNoteLock ? 'JLD' : 'JED'}01${encryptionMetadata}`;
 	}
 
-	public async decodeHeaderString(cipherText: string) {
+	public async decodeHeaderString(cipherText: string, isNoteLock = false) {
 		const source = this.stringReader_(cipherText);
-		return this.decodeHeaderSource_(source);
+		return this.decodeHeaderSource_(source, isNoteLock);
 	}
 
 	// eslint-disable-next-line @typescript-eslint/no-explicit-any -- See encryptAbstract_ source/destination

packages/lib/services/interop/InteropService.noteLock.test.ts

@@ -183,13 +183,38 @@ describe('InteropService.noteLock', () => {
 		expect(result.warnings).toEqual(['1 locked note(s) could not be unlocked and were not exported']);
 	});
 
-	it.each([
-		{ label: 'no note is locked', flagEnabled: true, isLocked: 0 },
-		{ label: 'note lock is disabled', flagEnabled: false, isLocked: 1 },
-	])('should not write the key file when $label', async ({ flagEnabled, isLocked }) => {
-		Setting.setValue('featureFlag.noteLock', flagEnabled);
+	it('should not write the key file when no note is locked', async () => {
+		await setUpUnlockedSession();
+		const folder = await Folder.save({ title: 'folder' });
+		await Note.save({ title: 'note', body: 'plain body', parent_id: folder.id });
+
+		await InteropService.instance().export({ path: exportDir(), format: ExportModuleOutputFormat.Raw });
+
+		expect(await fs.pathExists(`${exportDir()}/${noteLockKeyFileName}`)).toBe(false);
+	});
+
+	it('should write the key file for a note locked with the profile key even with note lock disabled', async () => {
+		await setUpUnlockedSession();
+		const folder = await Folder.save({ title: 'folder' });
+		const note = await Note.save({ title: 'note', body: 'secret', parent_id: folder.id });
+		await lockNote(note.id);
+
+		Setting.setValue('featureFlag.noteLock', false);
+		await InteropService.instance().export({ path: exportDir(), format: ExportModuleOutputFormat.Raw });
+
+		expect(JSON.parse(await fs.readFile(`${exportDir()}/${noteLockKeyFileName}`, 'utf-8')).id).toBe(NoteLockKey.instance().load().id);
+	});
+
+	it('should not write the key file when the locked notes use another key', async () => {
+		await setUpUnlockedSession();
+		const otherKey = await encryptionService().generateMasterKey('other');
+		const body = await encryptionService().encryptString('secret', {
+			masterKeyId: '0123456789abcdef0123456789abcdef',
+			decryptedMasterKey: await encryptionService().decryptMasterKeyContent(otherKey, 'other'),
+			isNoteLock: true,
+		});
 		const folder = await Folder.save({ title: 'folder' });
-		await Note.save({ title: 'note', body: 'plain body', parent_id: folder.id, is_locked: isLocked });
+		await Note.save({ title: 'note', body, parent_id: folder.id, is_locked: 1 });
 
 		await InteropService.instance().export({ path: exportDir(), format: ExportModuleOutputFormat.Raw });
 
@@ -204,11 +229,12 @@ describe('InteropService.noteLock', () => {
 		await lockNote(note.id);
 		await InteropService.instance().export({ path: exportDir(), format: ExportModuleOutputFormat.Raw });
 
-		await InteropService.instance().import({ path: exportDir(), format: 'raw' });
+		const result = await InteropService.instance().import({ path: exportDir(), format: 'raw' });
 
 		const imported = (await Note.all()).find(n => n.id !== note.id && !!n.is_locked);
 		expect(imported.body).not.toContain('secret');
 		expect((await Note.load(imported.id, { useNoteLock: true })).body).toContain('secret');
+		expect(result.warnings).toEqual([]);
 
 		// The extracted list follows the remapped resource id, so the resource stays associated.
 		const importedResourceIds = Note.unserializeExtractedResourceIds(imported.extracted_resource_ids);
@@ -300,11 +326,29 @@ describe('InteropService.noteLock', () => {
 
 		await rotateProfileKey('new password');
 
-		await InteropService.instance().import({ path: exportDir(), format: 'raw' });
+		const result = await InteropService.instance().import({ path: exportDir(), format: 'raw' });
 
 		const imported = (await Note.all()).find(n => n.id !== note.id && !!n.is_locked);
 		expect(imported.body).not.toContain('secret');
 		await expect(Note.load(imported.id, { useNoteLock: true })).rejects.toThrow();
+		expect(result.warnings).toEqual(['The locked notes in this backup have not been migrated to the current note lock key and will be unreadable']);
+	});
+
+	it('should warn when a backup with locked notes is imported without a handler into a profile with no note lock key', async () => {
+		await setUpUnlockedSession();
+		const folder = await Folder.save({ title: 'folder' });
+		const note = await Note.save({ title: 'note', body: 'secret', parent_id: folder.id });
+		await lockNote(note.id);
+		await InteropService.instance().export({ path: exportDir(), format: ExportModuleOutputFormat.Raw });
+
+		await setupDatabaseAndSynchronizer(2);
+		await switchClient(2);
+		NoteLockSession.destroyInstance();
+		NoteLockKey.destroyInstance();
+		Setting.setValue('featureFlag.noteLock', true);
+		const result = await InteropService.instance().import({ path: exportDir(), format: 'raw' });
+
+		expect(result.warnings).toEqual(['The locked notes in this backup cannot be read, because no note lock key has been set up on this profile']);
 	});
 
 	it('should keep locked notes unchanged and warn when the provided key does not fit', async () => {

packages/lib/services/interop/InteropService_Exporter_Raw.ts

@@ -4,7 +4,7 @@ import BaseModel from '../../BaseModel';
 import { basename } from '../../path-utils';
 import shim from '../../shim';
 import { BaseItemEntity, NoteEntity, ResourceEntity } from '../database/types';
-import isNoteLockEnabled from '../noteLock/isNoteLockEnabled';
+import EncryptionService from '../e2ee/EncryptionService';
 import NoteLockNote from '../noteLock/NoteLockNote';
 import NoteLockKey, { noteLockKeyFileName } from '../noteLock/NoteLockKey';
 
@@ -22,8 +22,20 @@ export default class InteropService_Exporter_Raw extends InteropService_Exporter
 		await shim.fsDriver().mkdir(this.resourceDir_);
 	}
 
+	// Not behind the feature flag: importers that predate note lock ignore the key file. Only the profile's key can be exported,
+	// so notes locked with another key do not bring it in.
+	private async isLockedWithProfileKey_(note: NoteEntity) {
+		const keyId = NoteLockKey.instance().load()?.id;
+		if (!keyId || !NoteLockNote.isLocked(note)) return false;
+		try {
+			return (await EncryptionService.instance().decodeHeaderString(note.body, true)).masterKeyId === keyId;
+		} catch {
+			return false;
+		}
+	}
+
 	public async processItem(itemType: number, item: BaseItemEntity) {
-		if (itemType === BaseModel.TYPE_NOTE && isNoteLockEnabled() && NoteLockNote.isLocked(item as NoteEntity)) this.hasLockedNotes_ = true;
+		if (itemType === BaseModel.TYPE_NOTE && !this.hasLockedNotes_) this.hasLockedNotes_ = await this.isLockedWithProfileKey_(item as NoteEntity);
 		const ItemClass = BaseItem.getClassByItemType(itemType);
 		const serialized = await ItemClass.serialize(item);
 		const filePath = `${this.destDir_}/${ItemClass.systemPath(item)}`;

packages/lib/services/interop/InteropService_Importer_Raw.ts

@@ -18,7 +18,7 @@ import uuid from '../../uuid';
 import isNoteLockEnabled from '../noteLock/isNoteLockEnabled';
 import NoteLockService from '../noteLock/NoteLockService';
 import NoteLockSession from '../noteLock/NoteLockSession';
-import { DecryptedNoteLockKey, noteLockKeyFileName } from '../noteLock/NoteLockKey';
+import NoteLockKey, { DecryptedNoteLockKey, noteLockKeyFileName } from '../noteLock/NoteLockKey';
 
 export default class InteropService_Importer_Raw extends InteropService_Importer_Base {
 	public async exec(result: ImportExportResult) {
@@ -47,8 +47,14 @@ export default class InteropService_Importer_Raw extends InteropService_Importer
 		let undecryptableNotes = 0;
 		if (isNoteLockEnabled() && await shim.fsDriver().exists(`${this.sourcePath_}/${noteLockKeyFileName}`)) {
 			const keyFile: MasterKeyEntity = JSON.parse(await shim.fsDriver().readFile(`${this.sourcePath_}/${noteLockKeyFileName}`));
+			const profileKeyId = NoteLockKey.instance().load()?.id;
 			if (keyFile?.id && this.options_.onNoteLockKey) {
 				importNoteLockKey = await this.options_.onNoteLockKey(keyFile);
+			} else if (keyFile?.id && !profileKeyId) {
+				// Without a handler, as for the CLI, nothing can update the notes.
+				result.warnings.push('The locked notes in this backup cannot be read, because no note lock key has been set up on this profile');
+			} else if (keyFile?.id && keyFile.id !== profileKeyId) {
+				result.warnings.push('The locked notes in this backup have not been migrated to the current note lock key and will be unreadable');
 			}
 		}
 		// Captured once the prompts have unlocked the session, so locking it partway through does not fail the remaining notes.