Closer/functions/dist/couples/onCoupleKeyRotated.js

"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.onCoupleKeyRotated = void 0;
exports.isKeyGenerationIncrease = isKeyGenerationIncrease;
const admin = __importStar(require("firebase-admin"));
const firestore_1 = require("firebase-functions/v2/firestore");
const queueAndPush_1 = require("../notifications/queueAndPush");
const log_1 = require("../log");
/**
 * Fires when a couple's key generation increases — one member rotated the couple key.
 *
 * Two jobs in one push, sent to BOTH members (every device):
 *  1. Security signal ("was this you?" philosophy, same class as the restore self-alerts — bypasses
 *     quiet hours, no preference toggle): a key rotation is worth knowing about even when benign.
 *  2. Functional pickup nudge: the partner's closed app still holds only the old key and cannot
 *     decrypt anything written under the new one until it next loads Home — the tap gets them there,
 *     where the existing adoption path unwraps the rotated keyset. No key material is read or logged.
 */
/** Pure edge guard: fire only when keyGeneration strictly increases (ignores every other update). */
function isKeyGenerationIncrease(before, after) {
    const b = typeof before === 'number' ? before : 0;
    const a = typeof after === 'number' ? after : 0;
    return a > b;
}
exports.onCoupleKeyRotated = (0, firestore_1.onDocumentUpdated)('couples/{coupleId}', async (event) => {
    var _a, _b, _c;
    const before = (_a = event.data) === null || _a === void 0 ? void 0 : _a.before.data();
    const after = (_b = event.data) === null || _b === void 0 ? void 0 : _b.after.data();
    if (!isKeyGenerationIncrease(before === null || before === void 0 ? void 0 : before.keyGeneration, after === null || after === void 0 ? void 0 : after.keyGeneration))
        return;
    const { coupleId } = event.params;
    const db = admin.firestore();
    const userIds = ((_c = after === null || after === void 0 ? void 0 : after.userIds) !== null && _c !== void 0 ? _c : []);
    if (userIds.length === 0)
        return;
    log_1.logger.log(`[onCoupleKeyRotated] couple=${coupleId} generation=${after === null || after === void 0 ? void 0 : after.keyGeneration}`);
    // Per-member isolation: one failed send must not cost the other member their alert.
    const results = await Promise.allSettled(userIds.map((uid) => (0, queueAndPush_1.queueAndPush)(db, uid, {
        type: 'couple_key_rotated',
        title: '🔑 Security update',
        body: 'Your shared key was rotated. Open the app and everything continues as normal.',
        coupleId,
        bypassQuietHours: true,
    })));
    results.forEach((r, i) => {
        if (r.status === 'rejected') {
            log_1.logger.warn('[onCoupleKeyRotated] alert failed', { uid: userIds[i], error: String(r.reason) });
        }
    });
});
//# sourceMappingURL=onCoupleKeyRotated.js.map