Added recovery keys

convex/auth.ts

@@ -1,4 +1,4 @@
-import { query, mutation } from "./_generated/server";
+import { query, mutation, internalQuery, internalMutation } from "./_generated/server";
 import { v } from "convex/values";
 import { getPublicStorageUrl } from "./storageUrl";
 
@@ -284,3 +284,74 @@ export const updateStatus = mutation({
     return null;
   },
 });
+
+// Get encrypted private keys + public signing key for recovery
+export const getRecoveryData = query({
+  args: { username: v.string() },
+  returns: v.union(
+    v.object({
+      encryptedPrivateKeys: v.string(),
+      publicSigningKey: v.string(),
+    }),
+    v.object({ error: v.string() })
+  ),
+  handler: async (ctx, args) => {
+    const user = await ctx.db
+      .query("userProfiles")
+      .withIndex("by_username", (q) => q.eq("username", args.username))
+      .unique();
+
+    if (!user) {
+      return { error: "User not found" };
+    }
+
+    return {
+      encryptedPrivateKeys: user.encryptedPrivateKeys,
+      publicSigningKey: user.publicSigningKey,
+    };
+  },
+});
+
+// Internal: get userId + publicSigningKey for recovery action verification
+export const getUserForRecovery = internalQuery({
+  args: { username: v.string() },
+  returns: v.union(
+    v.object({
+      userId: v.id("userProfiles"),
+      publicSigningKey: v.string(),
+    }),
+    v.null()
+  ),
+  handler: async (ctx, args) => {
+    const user = await ctx.db
+      .query("userProfiles")
+      .withIndex("by_username", (q) => q.eq("username", args.username))
+      .unique();
+
+    if (!user) return null;
+
+    return {
+      userId: user._id,
+      publicSigningKey: user.publicSigningKey,
+    };
+  },
+});
+
+// Internal: update credentials after password reset
+export const updateCredentials = internalMutation({
+  args: {
+    userId: v.id("userProfiles"),
+    clientSalt: v.string(),
+    encryptedMasterKey: v.string(),
+    hashedAuthKey: v.string(),
+  },
+  returns: v.null(),
+  handler: async (ctx, args) => {
+    await ctx.db.patch(args.userId, {
+      clientSalt: args.clientSalt,
+      encryptedMasterKey: args.encryptedMasterKey,
+      hashedAuthKey: args.hashedAuthKey,
+    });
+    return null;
+  },
+});