One album or file quak cannot decrypt no longer stops a refresh or a backup (closes #181)

collectionsSince and filesSince put a row that does not decrypt or parse in
an undecryptable list with the reason instead of throwing. The refresh
leaves it out, an album with its files, and the store keeps the list in
metadata.json until the server sends a copy that decrypts or deletes it,
since the next refresh asks only for changes. lib.backup() records each
such file in failures.json as "could not be decrypted: <reason>", unless a
copy in another album decrypted, logs one line per such album and lists
their IDs in undecryptableAlbums; quak backup exits 1 while any remain.
Tests use a stand-in Ente server with real encryption.

Model: opus-5-5

test/client/enumeration.test.ts

@@ -10,7 +10,9 @@
  * The return shape keeps live records and tombstones apart — `collections` /
  * `files` are decrypted live records, `deleted` is a plain list of the ids the
  * server tombstoned. A tombstone carries no decryptable key or metadata, so it
- * is a bare id rather than a hollowed-out `Collection` / `EnteFile`.
+ * is a bare id rather than a hollowed-out `Collection` / `EnteFile`. A live row
+ * that does not decrypt, or whose metadata is not JSON, is listed under
+ * `undecryptable` with the reason, so one bad row does not fail the call.
  *
  * All tests inject a fake `fetch` and drive a real `Client` (built with
  * `Client.fromJSON`) so the decryption path runs for real. Live rows are built
@@ -91,27 +93,38 @@ const ownedCollectionRow = (
     };
 };
 
-/** A live file row inside a collection, keyed under that collection's key. */
+/**
+ * A live file row inside a collection, keyed under that collection's key. Its
+ * metadata decrypts to `metadata` when given, otherwise to the JSON a client
+ * uploads for `title`.
+ */
 const fileRow = (
     collectionKey: Uint8Array,
-    opts: { id: number; title: string; updationTime: number },
+    opts: {
+        id: number;
+        title: string;
+        updationTime: number;
+        metadata?: string;
+    },
 ): Record<string, unknown> => {
     const fileKey = sodium.crypto_secretbox_keygen();
     const { ciphertext: encFileKey, nonce: fileKeyNonce } = secretboxEncrypt(
         fileKey,
         collectionKey,
     );
-    const metadata = {
-        title: opts.title,
-        fileType: 0,
-        creationTime: opts.updationTime,
-        modificationTime: opts.updationTime,
-    };
+    const metadata =
+        opts.metadata ??
+        JSON.stringify({
+            title: opts.title,
+            fileType: 0,
+            creationTime: opts.updationTime,
+            modificationTime: opts.updationTime,
+        });
     const push =
         sodium.crypto_secretstream_xchacha20poly1305_init_push(fileKey);
     const encMeta = sodium.crypto_secretstream_xchacha20poly1305_push(
         push.state,
-        new TextEncoder().encode(JSON.stringify(metadata)),
+        new TextEncoder().encode(metadata),
         null,
         sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL,
     );
@@ -131,6 +144,21 @@ const fileRow = (
     };
 };
 
+/**
+ * `row` with its sealed key replaced by random bytes of the same length, as a
+ * corrupt row arrives: no key opens it, so the row cannot be decrypted.
+ */
+const withCorruptKey = (
+    row: Record<string, unknown>,
+): Record<string, unknown> => ({
+    ...row,
+    encryptedKey: toBase64(
+        sodium.randombytes_buf(
+            sodium.crypto_secretbox_KEYBYTES + sodium.crypto_secretbox_MACBYTES,
+        ),
+    ),
+});
+
 /** A tombstone row. Never decrypted, so only these fields are ever read. */
 const tombstoneRow = (
     id: number,
@@ -278,6 +306,58 @@ describe("Client.filesSince", () => {
         // It gave up after the first page rather than looping.
         expect(sinceTimes).toEqual(["50"]);
     });
+
+    it("leaves out each file it cannot decrypt or parse, with the reason, and decrypts the rest", async () => {
+        const keys = buildKeys();
+        const collectionKey = sodium.crypto_secretbox_keygen();
+
+        // File 1002's key is sealed under no key quak holds, and file 1003's
+        // metadata decrypts to text that is not JSON. Neither may cost the
+        // caller file 1001: each is left out of `files` and reported under
+        // `undecryptable` with the reason instead of failing the call.
+        const { fetch } = recordingFetch(
+            jsonResponse({
+                diff: [
+                    fileRow(collectionKey, {
+                        id: 1001,
+                        title: "fine.jpg",
+                        updationTime: 100,
+                    }),
+                    withCorruptKey(
+                        fileRow(collectionKey, {
+                            id: 1002,
+                            title: "bad-key.jpg",
+                            updationTime: 200,
+                        }),
+                    ),
+                    fileRow(collectionKey, {
+                        id: 1003,
+                        title: "bad-metadata.jpg",
+                        updationTime: 300,
+                        metadata: "not json",
+                    }),
+                ],
+                hasMore: false,
+            }),
+        );
+        const client = Client.fromJSON(snapshotFor(keys), { fetch });
+
+        const { files, undecryptable, cursor } = await client.filesSince({
+            collectionID: 1,
+            collectionKey,
+            sinceTime: 0,
+        });
+
+        expect(files.map((f) => f.id)).toEqual([1001]);
+        expect(undecryptable).toEqual([
+            { id: 1002, error: expect.stringContaining("wrong secret key") },
+            { id: 1003, error: expect.stringContaining("JSON") },
+        ]);
+        // The cursor moves past the two left out, as past any other row, so
+        // the server does not send them again until its copy changes. The
+        // caller has to keep what it was told here.
+        expect(cursor).toBe(300);
+    });
 });
 
 describe("Client.collectionsSince", () => {
@@ -331,6 +411,42 @@ describe("Client.collectionsSince", () => {
         expect(result.cursor).toBe(150);
         expect(sinceTimes).toEqual(["150"]);
     });
+
+    it("leaves out an album it cannot decrypt, with the reason, and decrypts the rest", async () => {
+        const keys = buildKeys();
+
+        // Album 2's key is sealed under no key quak holds. Without its key
+        // neither its name nor its files can be read, so it is left out and
+        // reported under `undecryptable`; album 1 is unaffected.
+        const { fetch } = recordingFetch(
+            jsonResponse({
+                collections: [
+                    ownedCollectionRow(keys.masterKey, {
+                        id: 1,
+                        name: "Vacation",
+                        updationTime: 100,
+                    }),
+                    withCorruptKey(
+                        ownedCollectionRow(keys.masterKey, {
+                            id: 2,
+                            name: "Broken",
+                            updationTime: 200,
+                        }),
+                    ),
+                ],
+            }),
+        );
+        const client = Client.fromJSON(snapshotFor(keys), { fetch });
+
+        const { collections, undecryptable, cursor } =
+            await client.collectionsSince({ sinceTime: 0 });
+
+        expect(collections.map((c) => c.name)).toEqual(["Vacation"]);
+        expect(undecryptable).toEqual([
+            { id: 2, error: expect.stringContaining("wrong secret key") },
+        ]);
+        expect(cursor).toBe(200);
+    });
 });
 
 describe("Client list wrappers still hide deletions", () => {