Add independent ID key configuration and recovery

2026-10-08 02:12:30 +00:00 · 2026-09-29 12:58:11 +00:00
parent 126d6eadb8
commit bf7822f20b
51 changed files with 2572 additions and 168 deletions
@@ -99,6 +99,17 @@ function resolutionSettingsSignature(settings: ObsidianLiveSyncSettings): string
 }

 export class ModuleResolvingMismatchedTweaks extends AbstractModule {
+    private requiresIdConfigurationReview(assessment: TweakAssessment): boolean {
+        if (!assessment.entries.some(({ key, relation }) => key === "idDerivationVersion" && relation === "different")) {
+            return false;
+        }
+        Logger(
+            "The document ID configurations differ. Import the correct Setup URI, or configure the matching ID key, before synchronising.",
+            LOG_LEVEL_NOTICE
+        );
+        return true;
+    }
+
    private _selectNewerTweakSide(current: TweakValues, preferred: Partial<TweakValues>): "REMOTE" | "CURRENT" {
        Logger(`Modified: ${current.tweakModified} (current) vs ${preferred.tweakModified} (preferred)`);
        const currentModified = current.tweakModified;
@@ -196,6 +207,7 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
        assessment = assessTweakCompatibility(this.settings, preferred)
    ): Promise<[TweakValues | boolean, boolean]> {
        if (assessment.alignment === "matched") return [false, false];
+        if (this.requiresIdConfigurationReview(assessment)) return [false, false];
        const acceptedSettings = settingsAfterAdoption(assessment, "adoptPreferred");
        const autoAcceptSide = await this._shouldAutoAcceptCompatibleLossy(assessment);
        if (autoAcceptSide === "REMOTE") return [acceptedSettings, false];
@@ -363,6 +375,7 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
        const trialSignature = JSON.stringify(trialSetting);
        const currentSignature = resolutionSettingsSignature(this.settings);
        const assessment = assessTweakCompatibility(trialSetting, preferred);
+        if (this.requiresIdConfigurationReview(assessment)) return { result: false, requireFetch: false };
        if (assessment.alignment === "matched") {
            this._log("The settings in the remote database are the same as the local database.", LOG_LEVEL_NOTICE);
            return { result: false, requireFetch: false };
@@ -7,7 +7,7 @@ import {
    type TweakValues,
 } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import { extractObject } from "octagonal-wheels/object";
-import { assessTweakCompatibility } from "@vrtmrz/livesync-commonlib/settings";
+import { assessTweakCompatibility, configuredIdKey } from "@vrtmrz/livesync-commonlib/settings";
 import { ModuleResolvingMismatchedTweaks } from "./ModuleResolveMismatchedTweaks";
 import { setLang } from "@/common/translation";
 import {
@@ -74,6 +74,68 @@ function createModule(settingsOverride: Partial<typeof DEFAULT_SETTINGS> = {}) {
 }

 describe("ModuleResolvingMismatchedTweaks", () => {
+    it.each([0, 1] as const)(
+        "keeps ID configuration %s when automatically aligning Chunk settings",
+        async (idDerivationVersion) => {
+            const idDerivationKey = idDerivationVersion === 1 ? "ab".repeat(32) : "";
+            const { module, core, askSelectStringDialogue } = createModule({
+                encrypt: true,
+                usePathObfuscation: false,
+                idDerivationVersion,
+                idDerivationKey,
+                autoAcceptCompatibleTweak: true,
+                hashAlg: "xxhash64",
+                tweakModified: 1,
+            });
+            const preferred: TweakValues = {
+                ...extractObject(TweakValuesTemplate, core.settings),
+                idDerivationVersion: idDerivationVersion === 1 ? 0 : 1,
+                hashAlg: "xxhash32",
+                tweakModified: 2,
+            };
+            core._services.tweakValue = {
+                checkAndAskResolvingMismatched: module._checkAndAskResolvingMismatchedTweaks.bind(module),
+            };
+            core._services.setting.saveSettingData.mockImplementation(async () => {
+                configuredIdKey(core.settings);
+            });
+
+            await expect(module._askResolvingMismatchedTweaks(preferred, async () => true)).resolves.toBe("CHECKAGAIN");
+
+            expect(core.settings).toMatchObject({ idDerivationVersion, idDerivationKey, hashAlg: "xxhash32" });
+            expect(askSelectStringDialogue).not.toHaveBeenCalled();
+        }
+    );
+
+    it.each(["active", "trial"] as const)(
+        "withholds ordinary tweak adoption for different document ID modes (%s)",
+        async (route) => {
+            const { module, core, askSelectStringDialogue } = createModule({
+                encrypt: true,
+                usePathObfuscation: true,
+                idDerivationVersion: 0,
+                idDerivationKey: "",
+            });
+            const preferred: TweakValues = {
+                ...extractObject(TweakValuesTemplate, core.settings),
+                idDerivationVersion: 1,
+            };
+
+            if (route === "active") {
+                await expect(module._checkAndAskResolvingMismatchedTweaks(preferred)).resolves.toEqual([false, false]);
+            } else {
+                await expect(module._askUseRemoteConfiguration(core.settings, preferred)).resolves.toEqual({
+                    result: false,
+                    requireFetch: false,
+                });
+            }
+
+            expect(askSelectStringDialogue).not.toHaveBeenCalled();
+            expect(core._services.setting.saveSettingData).not.toHaveBeenCalled();
+            expect(core.settings).toMatchObject({ idDerivationVersion: 0, idDerivationKey: "" });
+        }
+    );
+
    it("compatibility: offers ordinary application for a missing legacy filename-case setting", async () => {
        const { module, askSelectStringDialogue } = createModule({
            autoAcceptCompatibleTweak: false,
@@ -140,6 +140,8 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
            settingToApply.couchDB_USER = this.settings.couchDB_USER;
            settingToApply.couchDB_PASSWORD = this.settings.couchDB_PASSWORD;
            settingToApply.passphrase = this.settings.passphrase;
+            settingToApply.idDerivationVersion = this.settings.idDerivationVersion;
+            settingToApply.idDerivationKey = this.settings.idDerivationKey;
        }
        const oldSetting = this.generateSettingForMarkdown(
            this.settings,
@@ -203,11 +205,13 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
        const saveData = { ...(settings ? settings : this.settings) } as Partial<ObsidianLiveSyncSettings>;
        delete saveData.encryptedCouchDBConnection;
        delete saveData.encryptedPassphrase;
+        delete saveData.encryptedIdDerivationKey;
        delete saveData.additionalSuffixOfDatabaseName;
        if (!saveData.writeCredentialsForSettingSync && !keepCredential) {
            delete saveData.couchDB_USER;
            delete saveData.couchDB_PASSWORD;
            delete saveData.passphrase;
+            delete saveData.idDerivationKey;
            delete saveData.jwtKey;
            delete saveData.jwtKid;
            delete saveData.jwtSub;
@@ -47,6 +47,12 @@ function getSettingsFromEditingSettings(editingSettings: AllSettings): ObsidianL
    }
    return workObj;
 }
+
+function syncIdDerivationSettings(target: Partial<ObsidianLiveSyncSettings>, source: ObsidianLiveSyncSettings): void {
+    target.idDerivationVersion = source.idDerivationVersion;
+    target.idDerivationKey = source.idDerivationKey;
+}
+
 function createRemoteConfigurationId(): string {
    return `remote-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
@@ -116,6 +122,8 @@ export function paneRemoteConfig(
                        .onClick(async () => {
                            const setupManager = this.core.getModule(SetupManager);
                            const originalSettings = getSettingsFromEditingSettings(this.editingSettings);
+                            const originalIdDerivationVersion = this.core.settings.idDerivationVersion;
+                            const originalIdDerivationKey = this.core.settings.idDerivationKey;
                            const applied = await setupManager.onlyE2EEConfiguration(UserMode.Update, originalSettings);
                            if (applied) {
                                this.editingSettings.encryptInternalMetadata =
@@ -126,6 +134,16 @@ export function paneRemoteConfig(
                                }
                                this.requestUpdate();
                            }
+                            if (
+                                this.core.settings.idDerivationVersion !== originalIdDerivationVersion ||
+                                this.core.settings.idDerivationKey !== originalIdDerivationKey
+                            ) {
+                                syncIdDerivationSettings(this.editingSettings, this.core.settings);
+                                if (this.initialSettings) {
+                                    syncIdDerivationSettings(this.initialSettings, this.core.settings);
+                                }
+                                this.requestUpdate();
+                            }
                            updateE2EESummary();
                        })
                        .setButtonText("Configure")
@@ -164,9 +182,11 @@ export function paneRemoteConfig(
                const currentConfigs = cloneRemoteConfigurations(this.core.settings.remoteConfigurations);
                this.editingSettings.remoteConfigurations = currentConfigs;
                this.editingSettings.activeConfigurationId = this.core.settings.activeConfigurationId;
+                syncIdDerivationSettings(this.editingSettings, this.core.settings);
                if (this.initialSettings) {
                    this.initialSettings.remoteConfigurations = cloneRemoteConfigurations(currentConfigs);
                    this.initialSettings.activeConfigurationId = this.core.settings.activeConfigurationId;
+                    syncIdDerivationSettings(this.initialSettings, this.core.settings);
                }
            };
            const persistRemoteConfigurations = async (synchroniseActiveRemote: boolean = false) => {
@@ -254,6 +274,8 @@ export function paneRemoteConfig(
                usePathObfuscation: this.editingSettings.usePathObfuscation,
                encryptInternalMetadata: this.editingSettings.encryptInternalMetadata,
                passphrase: this.editingSettings.passphrase,
+                idDerivationVersion: this.editingSettings.idDerivationVersion,
+                idDerivationKey: this.editingSettings.idDerivationKey,
                configPassphraseStore: this.editingSettings.configPassphraseStore,
            });
            const addRemoteConfiguration = async () => {
@@ -194,4 +194,51 @@ describe("paneRemoteConfig", () => {
        expect(host.initialSettings.encryptInternalMetadata).toBe(true);
        expect(host.requestUpdate).toHaveBeenCalledOnce();
    });
+
+    it("copies applied ID derivation settings into both dialogue buffers", async () => {
+        const nextIdKey = "ab".repeat(32);
+        const originalSettings = {
+            encrypt: true,
+            passphrase: "passphrase",
+            E2EEAlgorithm: "v2",
+            usePathObfuscation: true,
+            encryptInternalMetadata: false,
+            idDerivationVersion: 0,
+            idDerivationKey: "",
+            remoteConfigurations: {},
+        };
+        const setupManager = {
+            onlyE2EEConfiguration: vi.fn(() => {
+                host.core.settings.idDerivationVersion = 1;
+                host.core.settings.idDerivationKey = nextIdKey;
+                return Promise.resolve(false);
+            }),
+        };
+        const host = {
+            editingSettings: { ...originalSettings },
+            initialSettings: { ...originalSettings },
+            core: {
+                settings: { ...originalSettings },
+                getModule: vi.fn(() => setupManager),
+            },
+            lifetimeComponent: { register: vi.fn() },
+            requestUpdate: vi.fn(),
+        };
+        const addPanel = vi.fn((_parent: HTMLElement, heading: string) => ({
+            then(callback: (paneEl: HTMLElement) => void) {
+                if (heading === "E2EE Configuration") {
+                    callback(createPanelElement());
+                }
+            },
+        }));
+
+        paneRemoteConfig.call(host as never, {} as HTMLElement, { addPanel } as never);
+        await runtime.clickHandlers[0]();
+
+        expect(host.editingSettings.idDerivationVersion).toBe(1);
+        expect(host.editingSettings.idDerivationKey).toBe(nextIdKey);
+        expect(host.initialSettings.idDerivationVersion).toBe(1);
+        expect(host.initialSettings.idDerivationKey).toBe(nextIdKey);
+        expect(host.requestUpdate).toHaveBeenCalledOnce();
+    });
 });
@@ -68,6 +68,7 @@ export function getE2EEConfigSummary(setting: ObsidianLiveSyncSettings, showAdva
 export function getSummaryFromPartialSettings(setting: Partial<ObsidianLiveSyncSettings>, showAdvanced = false) {
    const outputSummary: Record<string, string> = {};
    for (const key of Object.keys(setting) as (keyof ObsidianLiveSyncSettings)[]) {
+        if (key === "idDerivationKey" || key === "encryptedIdDerivationKey") continue;
        const config = getConfig(key as AllSettingItemKey);
        if (!config) continue;
        if (config.isAdvanced && !showAdvanced) continue;
@@ -1,6 +1,5 @@
 import {
    type BucketSyncSetting,
-    type EncryptionSettings,
    type ObsidianLiveSyncSettings,
    type P2PSyncSetting,
    LOG_LEVEL_NOTICE,
@@ -36,6 +35,7 @@ import type {
    SetupRemoteCouchDBResultType,
    SetupRemoteCouchDBInitialData,
    SetupRemoteE2EEResultType,
+    SetupRemoteE2EEInitialData,
    SetupRemoteP2PInitialData,
    SetupRemoteP2PResultType,
    SetupRemoteResultType,
@@ -58,6 +58,20 @@ function copySettingsForRemoteProfileUpdate(settings: ObsidianLiveSyncSettings):
    };
 }

+function normaliseImportedIdDerivationSettings(settings: ObsidianLiveSyncSettings): ObsidianLiveSyncSettings {
+    // Setup URIs are complete imports even when their encoder omitted default-valued fields.
+    // Fill each missing half so a receiving device cannot supply the unrelated saved key.
+    return {
+        ...settings,
+        idDerivationVersion: Object.prototype.hasOwnProperty.call(settings, "idDerivationVersion")
+            ? settings.idDerivationVersion
+            : 0,
+        idDerivationKey: Object.prototype.hasOwnProperty.call(settings, "idDerivationKey")
+            ? settings.idDerivationKey
+            : "",
+    };
+}
+
 /**
 * User modes for onboarding and setup
 */
@@ -219,7 +233,7 @@ export class SetupManager extends AbstractModule {
            return false;
        }
        this._log("Setup URI dialog closed.", LOG_LEVEL_VERBOSE);
-        return await this.onConfirmApplySettingsFromWizard(newSetting, userMode);
+        return await this.onConfirmApplySettingsFromWizard(normaliseImportedIdDerivationSettings(newSetting), userMode);
    }

    /**
@@ -328,9 +342,12 @@ export class SetupManager extends AbstractModule {
     * @returns
     */
    async onlyE2EEConfiguration(userMode: UserMode, currentSetting: ObsidianLiveSyncSettings): Promise<boolean> {
-        const e2eeConf = await this.dialogManager.openWithExplicitCancel<SetupRemoteE2EEResultType, EncryptionSettings>(
+        const e2eeConf = await this.dialogManager.openWithExplicitCancel<
+            SetupRemoteE2EEResultType,
+            SetupRemoteE2EEInitialData
+        >(
            SetupRemoteE2EE,
-            currentSetting
+            { settings: currentSetting, newVault: userMode === UserMode.NewUser }
        );
        if (e2eeConf === "cancelled") {
            this._log("E2EE configuration cancelled.", LOG_LEVEL_NOTICE);
@@ -341,7 +358,9 @@ export class SetupManager extends AbstractModule {
            currentSetting.encrypt === e2eeConf.encrypt &&
            currentSetting.passphrase === e2eeConf.passphrase &&
            currentSetting.E2EEAlgorithm === e2eeConf.E2EEAlgorithm &&
-            currentSetting.usePathObfuscation === e2eeConf.usePathObfuscation;
+            currentSetting.usePathObfuscation === e2eeConf.usePathObfuscation &&
+            currentSetting.idDerivationVersion === e2eeConf.idDerivationVersion &&
+            currentSetting.idDerivationKey === e2eeConf.idDerivationKey;
        if (userMode === UserMode.Update && onlyInternalMetadataPreferenceChanged) {
            if (e2eeConf.encryptInternalMetadata && currentSetting.remoteType === REMOTE_COUCHDB) {
                const proceed = "Enable without rebuilding — update every other device first";
@@ -375,9 +394,12 @@ export class SetupManager extends AbstractModule {
     * @returns
     */
    async onConfigureManually(originalSetting: ObsidianLiveSyncSettings, userMode: UserMode): Promise<boolean> {
-        const e2eeConf = await this.dialogManager.openWithExplicitCancel<SetupRemoteE2EEResultType, EncryptionSettings>(
+        const e2eeConf = await this.dialogManager.openWithExplicitCancel<
+            SetupRemoteE2EEResultType,
+            SetupRemoteE2EEInitialData
+        >(
            SetupRemoteE2EE,
-            originalSetting
+            { settings: originalSetting, newVault: userMode === UserMode.NewUser }
        );
        if (e2eeConf === "cancelled") {
            this._log("Manual configuration cancelled.", LOG_LEVEL_NOTICE);
@@ -521,7 +543,13 @@ export class SetupManager extends AbstractModule {
     * @returns Promise that resolves to true if settings applied successfully, false otherwise
     */
    async decodeQR(qr: string) {
-        const newSettings = decodeSettingsFromQRCodeData(qr);
+        let newSettings: ObsidianLiveSyncSettings;
+        try {
+            newSettings = normaliseImportedIdDerivationSettings(decodeSettingsFromQRCodeData(qr));
+        } catch {
+            this._log("The QR configuration could not be decoded or contains unsupported settings.", LOG_LEVEL_NOTICE);
+            return false;
+        }
        return await this.onConfirmApplySettingsFromWizard(newSettings, UserMode.Unknown);
    }

@@ -193,6 +193,58 @@ describe("SetupManager", () => {
        expect(setting.currentSettings().activeConfigurationId).toBe("legacy-couchdb");
    });

+    it("compatibility: treats omitted ID derivation fields in a Setup URI as legacy defaults", async () => {
+        const { manager, setting, dialogManager } = createSetupManager();
+        const savedKey = "12".repeat(32);
+        setting.settings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+            idDerivationKey: savedKey,
+        };
+        const imported = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+        } as Partial<ObsidianLiveSyncSettings>;
+        delete imported.idDerivationVersion;
+        delete imported.idDerivationKey;
+        vi.spyOn(setting, "adjustSettings").mockImplementation((settings) => Promise.resolve(settings));
+        dialogManager.openWithExplicitCancel.mockResolvedValueOnce(imported).mockResolvedValueOnce("cancelled");
+
+        await manager.onUseSetupURI(UserMode.Unknown, "mock-config://legacy-settings");
+
+        const mergedSettings = vi.mocked(setting.adjustSettings).mock.calls[0][0];
+        expect(mergedSettings.idDerivationVersion).toBe(0);
+        expect(mergedSettings.idDerivationKey).toBe("");
+        expect(setting.currentSettings().idDerivationKey).toBe(savedKey);
+    });
+
+    it("does not inherit the missing half of a partially present Setup URI ID configuration", async () => {
+        const { manager, setting, dialogManager } = createSetupManager();
+        const savedKey = "34".repeat(32);
+        setting.settings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+            idDerivationKey: savedKey,
+        };
+        const imported = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+        } as Partial<ObsidianLiveSyncSettings>;
+        delete imported.idDerivationKey;
+        vi.spyOn(setting, "adjustSettings").mockImplementation((settings) => Promise.resolve(settings));
+        dialogManager.openWithExplicitCancel.mockResolvedValueOnce(imported).mockResolvedValueOnce("cancelled");
+
+        await manager.onUseSetupURI(UserMode.Unknown, "mock-config://partial-settings");
+
+        const mergedSettings = vi.mocked(setting.adjustSettings).mock.calls[0][0];
+        expect(mergedSettings.idDerivationVersion).toBe(1);
+        expect(mergedSettings.idDerivationKey).toBe("");
+        expect(setting.currentSettings().idDerivationKey).toBe(savedKey);
+    });
+
    it("compatibility: normalises imported flat remote settings from QR data before applying", async () => {
        const { manager, setting, dialogManager } = createSetupManager();
        vi.mocked(decodeSettingsFromQRCodeData).mockReturnValue(createLegacyRemoteSetting());
@@ -208,6 +260,79 @@ describe("SetupManager", () => {
        expect(setting.currentSettings().activeConfigurationId).toBe("legacy-couchdb");
    });

+    it("compatibility: applies legacy defaults when QR data omits ID derivation fields", async () => {
+        const { manager, setting, dialogManager } = createSetupManager();
+        const savedKey = "56".repeat(32);
+        setting.settings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+            idDerivationKey: savedKey,
+        };
+        const imported = { ...createLegacyRemoteSetting(), isConfigured: true } as Partial<ObsidianLiveSyncSettings>;
+        delete imported.idDerivationVersion;
+        delete imported.idDerivationKey;
+        vi.mocked(decodeSettingsFromQRCodeData).mockReturnValue(imported as ObsidianLiveSyncSettings);
+        vi.spyOn(setting, "adjustSettings").mockImplementation((settings) => Promise.resolve(settings));
+        dialogManager.openWithExplicitCancel.mockResolvedValueOnce("cancelled");
+
+        await manager.decodeQR("qr-data");
+
+        const mergedSettings = vi.mocked(setting.adjustSettings).mock.calls[0][0];
+        expect(mergedSettings.idDerivationVersion).toBe(0);
+        expect(mergedSettings.idDerivationKey).toBe("");
+        expect(setting.currentSettings().idDerivationKey).toBe(savedKey);
+    });
+
+    it("rejects invalid QR settings before applying them", async () => {
+        const { manager, setting } = createSetupManager();
+        vi.mocked(decodeSettingsFromQRCodeData).mockImplementationOnce(() => {
+            throw new Error("Invalid ID derivation key");
+        });
+        const applyExternalSettings = vi.spyOn(setting, "applyExternalSettings");
+
+        await expect(manager.decodeQR("invalid-qr")).resolves.toBe(false);
+        expect(applyExternalSettings).not.toHaveBeenCalled();
+    });
+
+    it("requires the normal Fetch choice when ID derivation changes with the Metadata preference", async () => {
+        const { manager, setting, dialogManager, core } = createSetupManager();
+        const currentSettings: ObsidianLiveSyncSettings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            encrypt: true,
+            passphrase: "e2ee-passphrase",
+            usePathObfuscation: true,
+            encryptInternalMetadata: false,
+            idDerivationVersion: 0,
+            idDerivationKey: "",
+        };
+        const nextIdKey = "78".repeat(32);
+        setting.settings = currentSettings;
+        const applyPartial = vi.spyOn(setting, "applyPartial");
+        core.confirm = {
+            askSelectStringDialogue: vi.fn(() =>
+                Promise.resolve("Enable without rebuilding — update every other device first")
+            ),
+        };
+        dialogManager.openWithExplicitCancel
+            .mockResolvedValueOnce({
+                ...currentSettings,
+                encryptInternalMetadata: true,
+                idDerivationVersion: 1,
+                idDerivationKey: nextIdKey,
+            })
+            .mockResolvedValueOnce("existing-user")
+            .mockResolvedValueOnce("apply");
+
+        await manager.onlyE2EEConfiguration(UserMode.Update, currentSettings);
+
+        expect(applyPartial).not.toHaveBeenCalled();
+        expect(core.rebuilder.scheduleFetch).toHaveBeenCalledWith(expect.any(Function));
+        expect(setting.currentSettings().idDerivationVersion).toBe(1);
+        expect(setting.currentSettings().idDerivationKey).toBe(nextIdKey);
+    });
+
    it("reserves Rebuild before saving a new-user configuration", async () => {
        const { manager, setting, dialogManager, core } = createSetupManager();
        setting.settings = { ...setting.currentSettings(), isConfigured: false };
@@ -13,13 +13,26 @@
        E2EEAlgorithms,
        type EncryptionSettings,
    } from "@vrtmrz/livesync-commonlib/compat/common/types";
+    import {
+        deriveIdKey,
+        deriveOrImportIdKey,
+        formatIdRecoveryCode,
+        ID_DERIVATION_VERSION,
+        ID_RECOVERY_CODE_PREFIX,
+    } from "@vrtmrz/livesync-commonlib/settings";
    import { onMount } from "svelte";
    import type { GuestDialogProps } from "@/modules/services/LiveSyncUI/svelteDialog";
    import { copyTo, pickEncryptionSettings } from "@vrtmrz/livesync-commonlib/compat/common/utils";
-    import { TYPE_CANCELLED, type SetupRemoteE2EEResultType } from "./setupDialogTypes";
+    import {
+        TYPE_CANCELLED,
+        type SetupRemoteE2EEInitialData,
+        type SetupRemoteE2EEResultType,
+    } from "./setupDialogTypes";
    import { $msg as translateMessage } from "@/common/translation";

-    type Props = GuestDialogProps<SetupRemoteE2EEResultType, EncryptionSettings>;
+    type Props = GuestDialogProps<SetupRemoteE2EEResultType, SetupRemoteE2EEInitialData>;
+    type IdConfigurationChoice = "keep" | "random" | "custom";
+    type IdCustomChoice = "passphrase" | "source" | "recovery";
    const { setResult, getInitialData }: Props = $props();
    let default_encryption: EncryptionSettings = {
        encrypt: true,
@@ -27,17 +40,37 @@
        E2EEAlgorithm: DEFAULT_SETTINGS.E2EEAlgorithm,
        usePathObfuscation: true,
        encryptInternalMetadata: true,
+        idDerivationVersion: 0,
+        idDerivationKey: "",
    };

    let encryptionSettings = $state<EncryptionSettings>({ ...default_encryption });
+    let newVault = $state(false);
+    let idConfigurationChoice = $state<IdConfigurationChoice>("keep");
+    let idCustomChoice = $state<IdCustomChoice>("source");
+    let idDerivationSource = $state("");
+    let idDerivationError = $state("");
+    let recoveryCodeVisible = $state(false);
+    let recoveryCodeCopied = $state(false);
+
+    const idDerivationConfigured = $derived(
+        encryptionSettings.idDerivationVersion === ID_DERIVATION_VERSION &&
+            typeof encryptionSettings.idDerivationKey === "string" &&
+            encryptionSettings.idDerivationKey.length > 0
+    );
+    const recoveryCode = $derived.by(() =>
+        idDerivationConfigured ? formatIdRecoveryCode(encryptionSettings.idDerivationKey) : ""
+    );

    onMount(() => {
        if (getInitialData) {
            const initialData = getInitialData();
            if (initialData) {
-                copyTo(initialData, encryptionSettings);
+                copyTo(initialData.settings, encryptionSettings);
+                newVault = initialData.newVault;
            }
        }
+        idConfigurationChoice = !idDerivationConfigured && newVault ? "random" : "keep";
    });
    let e2eeValid = $derived.by(() => {
        if (!encryptionSettings.encrypt) return true;
@@ -49,8 +82,75 @@
            encryptionSettings.usePathObfuscation
    );

-    function commit() {
-        setResult(pickEncryptionSettings(encryptionSettings));
+    function resetIdDerivationSource() {
+        idDerivationSource = "";
+        idDerivationError = "";
+    }
+
+    function toggleEncryption(enabled: boolean) {
+        encryptionSettings.encrypt = enabled;
+        if (!enabled) resetIdDerivationSource();
+    }
+
+    function selectIdConfiguration() {
+        recoveryCodeVisible = false;
+        recoveryCodeCopied = false;
+        resetIdDerivationSource();
+    }
+
+    function selectIdCustomSource() {
+        resetIdDerivationSource();
+    }
+
+    async function copyRecoveryCode() {
+        try {
+            await navigator.clipboard.writeText(recoveryCode);
+            recoveryCodeCopied = true;
+        } catch {
+            idDerivationError = translateMessage("The recovery code could not be copied. Select and copy the visible code instead.");
+        }
+    }
+
+    async function commit() {
+        idDerivationError = "";
+        const result = pickEncryptionSettings(encryptionSettings);
+
+        if (encryptionSettings.encrypt && idConfigurationChoice !== "keep") {
+            let source = idDerivationSource;
+            if (idConfigurationChoice === "random") {
+                const bytes = crypto.getRandomValues(new Uint8Array(32));
+                source = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+            } else if (idCustomChoice === "passphrase") {
+                source = encryptionSettings.passphrase;
+            }
+            if (source.length === 0) {
+                if (!idDerivationConfigured) {
+                    idDerivationError = translateMessage("An ID source is required to enable this option.");
+                    return;
+                }
+            } else {
+                try {
+                    result.idDerivationKey =
+                        idConfigurationChoice === "custom" && idCustomChoice !== "passphrase"
+                            ? await importOrDeriveEnteredIdKey(source, idCustomChoice)
+                            : await deriveIdKey(source);
+                    result.idDerivationVersion = ID_DERIVATION_VERSION;
+                } catch {
+                    idDerivationError = translateMessage("The ID source or recovery code is invalid. Check it and try again.");
+                    return;
+                }
+            }
+        }
+
+        idDerivationSource = "";
+        setResult(result);
+    }
+
+    async function importOrDeriveEnteredIdKey(source: string, choice: IdCustomChoice): Promise<string> {
+        if (choice === "recovery" && !source.trim().startsWith(ID_RECOVERY_CODE_PREFIX)) {
+            throw new Error("An ID recovery code is required.");
+        }
+        return await deriveOrImportIdKey(source);
    }
 </script>

@@ -58,7 +158,11 @@
    <DialogHeader title={translateMessage("End-to-End Encryption")} />
    <Guidance>{translateMessage("Please configure your end-to-end encryption settings.")}</Guidance>
    <InputRow label={translateMessage("End-to-End Encryption")}>
-        <input type="checkbox" bind:checked={encryptionSettings.encrypt} />
+        <input
+            type="checkbox"
+            checked={encryptionSettings.encrypt}
+            onchange={(event) => toggleEncryption(event.currentTarget.checked)}
+        />
    </InputRow>
    <InfoNote title={translateMessage("Strongly Recommended")}>
        {translateMessage(
@@ -93,6 +197,164 @@
        </InfoNote>
    {/if}

+    <fieldset class="sls-id-choices" disabled={!encryptionSettings.encrypt}>
+        <legend>{translateMessage("ID generation")}</legend>
+        <label class="sls-id-choice">
+            <input
+                type="radio"
+                name="id-derivation-choice"
+                value="keep"
+                bind:group={idConfigurationChoice}
+                onchange={selectIdConfiguration}
+            />
+            <div class="sls-id-choice-text">
+                <span>{translateMessage("Keep current configuration")}</span>
+                <small class="sls-current-id-configuration">
+                    {#if idDerivationConfigured}
+                        {translateMessage(
+                            encryptionSettings.encrypt
+                                ? "Current configuration: a saved ID key is used."
+                                : "Current configuration: the saved ID key is retained while E2EE is off."
+                        )}
+                    {:else}
+                        {translateMessage(
+                            "Current configuration: no ID key is saved. With E2EE enabled, keeping it uses legacy IDs tied to the E2EE passphrase."
+                        )}
+                    {/if}
+                </small>
+            </div>
+        </label>
+        <label class="sls-id-choice">
+            <input
+                type="radio"
+                name="id-derivation-choice"
+                value="random"
+                bind:group={idConfigurationChoice}
+                onchange={selectIdConfiguration}
+            />
+            <span>{translateMessage("Generate a random ID key")}</span>
+        </label>
+        <label class="sls-id-choice">
+            <input
+                type="radio"
+                name="id-derivation-choice"
+                value="custom"
+                bind:group={idConfigurationChoice}
+                onchange={selectIdConfiguration}
+            />
+            <span>{translateMessage("Set an ID key")}</span>
+        </label>
+    </fieldset>
+    {#if encryptionSettings.encrypt && idConfigurationChoice === "keep" && !idDerivationConfigured}
+        <InfoNote warning>
+            {translateMessage("Changing the E2EE passphrase changes IDs generated by the legacy configuration.")}
+        </InfoNote>
+    {/if}
+    {#if (encryptionSettings.encrypt && idConfigurationChoice !== "keep") || idDerivationConfigured}
+        {#if encryptionSettings.encrypt}
+            <InfoNote>
+                {translateMessage(
+                    "This uses a saved key for new Chunk IDs and obfuscated Metadata document IDs, so changing the E2EE passphrase does not derive a new key automatically."
+                )}
+            </InfoNote>
+        {/if}
+        {#if idDerivationConfigured}
+            <InfoNote title={translateMessage("Configured")}>
+                {translateMessage("The saved ID key is configured. Its source cannot be shown again.")}
+            </InfoNote>
+            <button type="button" onclick={() => (recoveryCodeVisible = !recoveryCodeVisible)}>
+                {translateMessage(recoveryCodeVisible ? "Hide current recovery code" : "Show current recovery code")}
+            </button>
+            {#if recoveryCodeVisible}
+                <InputRow label={translateMessage("Current ID recovery code")}>
+                    <input type="text" readonly value={recoveryCode} aria-label={translateMessage("Current ID recovery code")} />
+                    <button type="button" onclick={copyRecoveryCode}>{translateMessage("Copy recovery code")}</button>
+                </InputRow>
+                {#if recoveryCodeCopied}
+                    <InfoNote>{translateMessage("Recovery code copied.")}</InfoNote>
+                {/if}
+            {/if}
+        {/if}
+        {#if encryptionSettings.encrypt}
+            {#if idConfigurationChoice === "custom"}
+                <fieldset class="sls-id-choices sls-id-custom-choices">
+                    <legend>{translateMessage("How to set the ID key")}</legend>
+                    <label class="sls-id-choice">
+                        <input
+                            type="radio"
+                            name="id-custom-choice"
+                            value="passphrase"
+                            bind:group={idCustomChoice}
+                            onchange={selectIdCustomSource}
+                        />
+                        <span>{translateMessage("Derive from current E2EE passphrase")}</span>
+                    </label>
+                    <label class="sls-id-choice">
+                        <input
+                            type="radio"
+                            name="id-custom-choice"
+                            value="source"
+                            bind:group={idCustomChoice}
+                            onchange={selectIdCustomSource}
+                        />
+                        <span>{translateMessage("Enter an ID source")}</span>
+                    </label>
+                    <label class="sls-id-choice">
+                        <input
+                            type="radio"
+                            name="id-custom-choice"
+                            value="recovery"
+                            bind:group={idCustomChoice}
+                            onchange={selectIdCustomSource}
+                        />
+                        <span>{translateMessage("Import an ID recovery code")}</span>
+                    </label>
+                </fieldset>
+                {#if idCustomChoice === "source" || idCustomChoice === "recovery"}
+                    <InputRow
+                        label={translateMessage(idCustomChoice === "source" ? "ID source" : "ID recovery code")}
+                    >
+                        <Password
+                            name="id-derivation-source"
+                            placeholder={translateMessage(
+                                idCustomChoice === "source" ? "Enter an ID source" : "Enter an ID recovery code"
+                            )}
+                            bind:value={idDerivationSource}
+                        />
+                    </InputRow>
+                {/if}
+            {/if}
+            {#if idDerivationConfigured && idConfigurationChoice !== "keep"}
+                <InfoNote>
+                    {translateMessage("The displayed recovery code belongs to the current key. Reopen this dialogue after saving to copy the replacement key.")}
+                </InfoNote>
+            {/if}
+            {#if idConfigurationChoice === "custom" && idCustomChoice === "source"}
+                <InfoNote>
+                    {translateMessage("Choose a long, unpredictable source. It is used once and cannot be shown again after saving. A recovery code can be displayed on this device later. This input also accepts a tagged recovery code.")}
+                </InfoNote>
+            {:else if idConfigurationChoice === "custom" && idCustomChoice === "recovery"}
+                <InfoNote>
+                    {translateMessage("Paste a tagged recovery code from an existing device to restore the same ID key.")}
+                </InfoNote>
+            {:else if idConfigurationChoice === "random"}
+                <InfoNote warning>
+                    {translateMessage("For recovery after losing every device, save the recovery code after setup or choose an ID source you can reproduce.")}
+                </InfoNote>
+            {:else if idConfigurationChoice === "custom" && idCustomChoice === "passphrase"}
+                <InfoNote warning>
+                    {translateMessage(
+                        "The ID key is derived from the current E2EE passphrase and saved separately. Changing that passphrase later does not change the saved ID key. To reduce the risk of guessing that passphrase from known IDs, use a separate, unpredictable ID source instead."
+                    )}
+                </InfoNote>
+            {/if}
+            {#if idDerivationConfigured && idConfigurationChoice === "custom" && idCustomChoice !== "passphrase"}
+                <InfoNote>{translateMessage("Leave this input empty to keep the saved ID key.")}</InfoNote>
+            {/if}
+        {/if}
+        <InfoNote error visible={idDerivationError !== ""}>{idDerivationError}</InfoNote>
+    {/if}
+
    <InputRow label="Encrypt internal file Properties">
        <input
            type="checkbox"
@@ -162,4 +424,41 @@
        width: auto;
        min-width: 8em;
    }
+    .sls-id-choices {
+        border: 0;
+        display: flex;
+        flex-direction: column;
+        gap: 0.35em;
+        margin: 0;
+        min-width: 0;
+        padding: 0;
+    }
+    .sls-id-choices legend {
+        margin-bottom: 0.35em;
+    }
+    .sls-id-choices:disabled {
+        opacity: 0.6;
+    }
+    .sls-id-custom-choices {
+        margin-left: 1.5em;
+    }
+    .sls-id-choice {
+        align-items: flex-start;
+        display: flex;
+        gap: 0.5em;
+    }
+    .sls-id-choice input[type="radio"] {
+        flex: none;
+        margin-top: 0.25em;
+    }
+    .sls-id-choice-text {
+        display: flex;
+        flex-direction: column;
+    }
+    .sls-current-id-configuration {
+        color: var(--text-muted);
+        display: block;
+        font-size: var(--font-ui-smaller);
+        margin-top: 0.15em;
+    }
 </style>
@@ -110,6 +110,10 @@ export type SetupRemoteResultType = typeof TYPE_COUCHDB | typeof TYPE_BUCKET | t
 export type UseSetupURIResultType = typeof TYPE_CANCELLED | ObsidianLiveSyncSettings;

 export type SetupRemoteE2EEResultType = typeof TYPE_CANCELLED | EncryptionSettings;
+export type SetupRemoteE2EEInitialData = {
+    settings: EncryptionSettings;
+    newVault: boolean;
+};

 export type SetupRemoteBucketResultType = typeof TYPE_CANCELLED | BucketSyncSetting;