Add independent ID key configuration and recovery

utils/setup/generate_setup_uri.test.ts

@@ -26,6 +26,20 @@ Deno.test("generates an Object Storage Setup URI with a selected S3 profile", as
   );
   assert(decoded, "Commonlib could not decode the Object Storage Setup URI");
   const effective = { ...DEFAULT_SETTINGS, ...decoded };
+  const recoveryCode = generated.idRecoveryCode;
+  assert(
+    typeof recoveryCode === "string" && recoveryCode.startsWith("sls-id-v1:"),
+    "the generator did not return an ID recovery code",
+  );
+  assert(
+    (effective as typeof effective & { idDerivationVersion?: number }).idDerivationVersion === 1,
+    "the Setup URI did not enable independent IDs",
+  );
+  assert(
+    (effective as typeof effective & { idDerivationKey?: string }).idDerivationKey ===
+      recoveryCode.slice("sls-id-v1:".length),
+    "the Setup URI did not contain the generated ID key",
+  );
   assert(
     effective.isConfigured,
     "the Setup URI left the imported device unconfigured",
@@ -74,6 +88,11 @@ Deno.test("generates a random-room P2P Setup URI without copying a device identi
   );
   assert(decoded, "Commonlib could not decode the P2P Setup URI");
   const effective = { ...DEFAULT_SETTINGS, ...decoded };
+  assert(
+    (effective as typeof effective & { idDerivationKey?: string }).idDerivationKey ===
+      generated.idRecoveryCode?.slice("sls-id-v1:".length),
+    "the P2P Setup URI did not contain the generated ID key",
+  );
   assert(
     /^\d{3}-\d{3}-\d{3}-[a-z0-9]{3}$/.test(effective.P2P_roomID),
     "Commonlib did not generate the expected random room ID",
@@ -121,3 +140,46 @@ Deno.test("generates a random-room P2P Setup URI without copying a device identi
     "the selected profile was not a P2P connection URI",
   );
 });
+
+Deno.test("reuses the ID key from a recovery code and permits explicit legacy IDs", async () => {
+  const environment = {
+    remote_type: "p2p",
+    passphrase: "vault-secret",
+    uri_passphrase: "setup-secret",
+  };
+  const first = await generateSetupURI(environment);
+  const second = await generateSetupURI({ ...environment, id_recovery_code: first.idRecoveryCode });
+  const independentlyGenerated = await generateSetupURI(environment);
+  assert(second.idRecoveryCode === first.idRecoveryCode, "the recovery code changed on repeat generation");
+  assert(independentlyGenerated.idRecoveryCode !== first.idRecoveryCode, "the default ID key was reused");
+  const repeatedSettings = await decodeSettingsFromSetupURI(second.setupURI, second.setupPassphrase);
+  assert(repeatedSettings, "the repeated Setup URI could not be decoded");
+  assert(
+    (repeatedSettings as typeof repeatedSettings & { idDerivationKey?: string }).idDerivationKey ===
+      first.idRecoveryCode?.slice("sls-id-v1:".length),
+    "the recovery code did not restore the original ID key",
+  );
+
+  const legacy = await generateSetupURI({ ...environment, id_mode: "legacy" });
+  const decoded = await decodeSettingsFromSetupURI(legacy.setupURI, legacy.setupPassphrase);
+  assert(decoded, "the legacy Setup URI could not be decoded");
+  assert(legacy.idRecoveryCode === undefined, "legacy mode returned an ID recovery code");
+  assert(
+    (decoded as typeof decoded & { idDerivationVersion?: number }).idDerivationVersion !== 1,
+    "legacy mode enabled independent IDs",
+  );
+  let rejected = false;
+  try {
+    await generateSetupURI({ ...environment, id_recovery_code: "sls-id-v1:wrong" });
+  } catch {
+    rejected = true;
+  }
+  assert(rejected, "an invalid recovery code was accepted");
+  rejected = false;
+  try {
+    await generateSetupURI({ ...environment, id_mode: "legacy", id_recovery_code: first.idRecoveryCode });
+  } catch {
+    rejected = true;
+  }
+  assert(rejected, "legacy mode silently ignored a recovery code");
+});