Researcher encrypted results

.npmrc

@@ -1 +1,2 @@
 package-lock=false
+confirm-modules-purge=false

Dockerfile.dev

@@ -14,6 +14,10 @@ RUN pnpm install --frozen-lockfile
 # Uncomment the following line to disable telemetry at run time
 ENV NEXT_TELEMETRY_DISABLED=1
 
+# Pre-create .next so the anonymous volume masking it (see docker-compose.yml)
+# initializes owned by node, not root — otherwise next dev hits EACCES on mkdir.
+RUN mkdir -p /app/.next
+
 # do not run as root user
 RUN chown -R node:node /app
 USER node

bin/inject-encrypted-results.ts

@@ -0,0 +1,139 @@
+/* eslint-disable no-console */
+/**
+ * DEV-ONLY: inject encrypted results into a job, mimicking what the Trusted Output App
+ * POSTs to /api/job/[jobId]/results — without the org-API auth dance. Lets you exercise
+ * the reviewer-decrypt → approve(re-wrap) → researcher-decrypt flow locally.
+ *
+ * Prereq: the job's reviewer(s) (enclave org users) must already have a key — generate it
+ * in the UI at /account/keys first, so getOrgPublicKeys returns a recipient to encrypt for.
+ *
+ * Run inside the container:
+ *   docker exec mgmnt-app pnpm exec tsx bin/inject-encrypted-results.ts <jobId>
+ */
+import { db } from '@/database'
+import { storeStudyEncryptedLogFile, storeStudyEncryptedResultsFile } from '@/server/storage'
+import { ResultsWriter } from 'si-encryption/job-results/writer'
+
+// Inline (not @/server/db/queries) — that module pulls in the Action framework → Clerk,
+// which tsx can't import standalone. Mirrors getOrgPublicKeys.
+async function orgPublicKeys(orgId: string): Promise<{ publicKey: ArrayBuffer; fingerprint: string }[]> {
+    const rows = await db
+        .selectFrom('orgUser')
+        .innerJoin('userPublicKey', 'userPublicKey.userId', 'orgUser.userId')
+        .select(['userPublicKey.publicKey', 'userPublicKey.fingerprint'])
+        .where('orgUser.orgId', '=', orgId)
+        .execute()
+    const keys = rows.map(({ publicKey, fingerprint }) => {
+        const ab = new ArrayBuffer(publicKey.byteLength)
+        new Uint8Array(ab).set(publicKey)
+        return { publicKey: ab, fingerprint }
+    })
+    // Seed data has placeholder keys (literal text bytes, not SPKI DER) that throw when wrapped.
+    // Pre-validate with si-encryption's import params and skip the duds.
+    const valid: typeof keys = []
+    for (const k of keys) {
+        try {
+            await crypto.subtle.importKey('spki', k.publicKey, { name: 'RSA-OAEP', hash: 'SHA-256' }, false, [
+                'encrypt',
+            ])
+            valid.push(k)
+        } catch {
+            console.warn(
+                `  skipping invalid public key (fingerprint ${k.fingerprint}) — not SPKI DER, likely seed placeholder`,
+            )
+        }
+    }
+    return valid
+}
+
+const toArrayBuffer = (s: string): ArrayBuffer => {
+    const buf = Buffer.from(s, 'utf-8')
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength)
+}
+
+async function buildZip(
+    files: Array<{ name: string; content: string }>,
+    keys: { publicKey: ArrayBuffer; fingerprint: string }[],
+): Promise<File> {
+    const writer = new ResultsWriter(keys)
+    for (const f of files) await writer.addFile(f.name, toArrayBuffer(f.content))
+    const zip = await writer.generate()
+    return new File([zip], 'encrypted.zip', { type: 'application/zip' })
+}
+
+async function main() {
+    const jobId = process.argv[2]
+    if (!jobId) throw new Error('usage: tsx bin/inject-encrypted-results.ts <jobId>')
+
+    const info = await db
+        .selectFrom('studyJob')
+        .innerJoin('study', 'study.id', 'studyJob.studyId')
+        .innerJoin('org', 'org.id', 'study.orgId')
+        .select(['studyJob.id as studyJobId', 'study.id as studyId', 'study.orgId as orgId', 'org.slug as orgSlug'])
+        .where('studyJob.id', '=', jobId)
+        .executeTakeFirstOrThrow(() => new Error(`job ${jobId} not found`))
+
+    // Encrypt for the enclave org's reviewer keys — exactly what TOA does. The reviewer
+    // decrypts with their private key, then re-wraps for researchers at approve.
+    const reviewerKeys = await orgPublicKeys(info.orgId)
+    if (!reviewerKeys.length) {
+        throw new Error(
+            `org ${info.orgSlug} has no public keys — log in as the reviewer and generate one at /account/keys first`,
+        )
+    }
+    console.info(`Encrypting for ${reviewerKeys.length} reviewer key(s) in org ${info.orgSlug}`)
+
+    // Idempotent: don't stack duplicate result rows if re-run against the same job.
+    const alreadyHasResults = await db
+        .selectFrom('studyJobFile')
+        .select('id')
+        .where('studyJobId', '=', jobId)
+        .where('fileType', '=', 'ENCRYPTED-RESULT')
+        .executeTakeFirst()
+
+    if (alreadyHasResults) {
+        console.info(`Job already has encrypted results — skipping store (delete study_job_file rows to re-inject).`)
+    } else {
+        // One results file + one logs file, matching the real enclave helper (one file per upload).
+        const resultsZip = await buildZip([{ name: 'results.csv', content: 'group,count\nA,42\nB,17\n' }], reviewerKeys)
+        const logZip = await buildZip([{ name: 'run.log', content: 'job started\njob finished ok\n' }], reviewerKeys)
+        await storeStudyEncryptedResultsFile(info, resultsZip)
+        await storeStudyEncryptedLogFile(info, logZip, 'ENCRYPTED-CODE-RUN-LOG')
+    }
+
+    // A results-stage job needs code approved first, else the proposal review buttons stay visible.
+    // Inject CODE-APPROVED before RUN-COMPLETE so the latest status stays RUN-COMPLETE.
+    const statuses = await db
+        .selectFrom('jobStatusChange')
+        .select(['status', 'createdAt'])
+        .where('studyJobId', '=', jobId)
+        .execute()
+    const has = (s: string) => statuses.some((r) => r.status === s)
+    const runComplete = statuses.find((r) => r.status === 'RUN-COMPLETE')
+
+    if (!has('CODE-APPROVED')) {
+        // 1s before an existing RUN-COMPLETE, or 2s in the past on a fresh job so it
+        // reliably precedes the RUN-COMPLETE inserted just below.
+        const ts = runComplete
+            ? new Date(new Date(runComplete.createdAt).getTime() - 1000)
+            : new Date(Date.now() - 2000)
+        await db
+            .insertInto('jobStatusChange')
+            .values({ status: 'CODE-APPROVED', studyJobId: jobId, createdAt: ts })
+            .execute()
+    }
+    if (!runComplete) {
+        await db.insertInto('jobStatusChange').values({ status: 'RUN-COMPLETE', studyJobId: jobId }).execute()
+    }
+    // Code approved ⇒ proposal-level review is done; study is back to APPROVED.
+    await db.updateTable('study').set({ status: 'APPROVED' }).where('id', '=', info.studyId).execute()
+
+    console.info(`✓ injected encrypted results + logs for job ${jobId} (CODE-APPROVED → RUN-COMPLETE, study APPROVED)`)
+    console.info(`  Now: review as the reviewer, decrypt with the reviewer PEM, Approve in the Study Status card.`)
+    await db.destroy()
+}
+
+main().catch((err) => {
+    console.error(err)
+    process.exit(1)
+})

docker-compose.yml

@@ -127,7 +127,10 @@ services:
         volumes:
             - ./:/app/
             - node_modules:/app/node_modules
-        restart: unless-stopped
+            # Mask the host's .next so the container owns its own Turbopack cache.
+            # Sharing it over the ./ bind mount poisons the cache across host/container.
+            - /app/.next
+        restart: 'no'
         networks:
             - mgmnt-app
         ports:

package.json

@@ -7,7 +7,7 @@
     "author": "Nathan Stitt",
     "main": "index.js",
     "type": "module",
-    "packageManager": "pnpm@11.3.0",
+    "packageManager": "pnpm@11.7.0+sha512.19cc852c120c7125760f2443ee6be0ca5b40f9f50598de1a09a1f177503e010e57c23c77646e01e761de59bf874fb22a3398c33ab9691fc13eb946b6f0f4d620",
     "engines": {
         "node": ">=22",
         "pnpm": ">=11"
@@ -113,7 +113,7 @@
         "react-phone-number-input": "^3.4.16",
         "remeda": "^2.33.6",
         "server-only": "^0.0.1",
-        "si-encryption": "github:safeinsights/encryption#2e35d3bb56f02bfc0e6d5cd9d83c54637ed0ac20",
+        "si-encryption": "github:safeinsights/encryption#4f31a899ba1e0ade8ebbbbb59609a7529343c2d4",
         "uuid": "^14.0.0",
         "validator": "^13.15.26",
         "yjs": "^13.6.30",

pnpm-workspace.yaml

@@ -14,6 +14,10 @@ overrides:
     '@types/react': 19.2.14
     esbuild: ^0.28.1
     form-data: ^4.0.6
+    # hono <4.12.25: GHSA-88fw-hqm2-52qc (CVE-2026-54290, HIGH) — CORS middleware reflects any
+    # Origin with credentials when origin defaults to wildcard. Dev-only transitive (@pandacss/dev
+    # → @pandacss/mcp → @modelcontextprotocol/sdk → @hono/node-server), but Trivy scans dev deps.
+    hono: ^4.12.25
     minimatch: ^10.2.1
     picomatch: ^4.0.4
     postcss: ^8.5.10

src/app/[orgSlug]/dashboard/page.test.tsx

@@ -12,7 +12,6 @@ import OrgDashboardPage from './page'
 vi.mock('@/server/actions/org.actions', async () => {
     return {
         getOrgFromSlugAction: vi.fn(),
-        getReviewerPublicKeyAction: vi.fn(),
     }
 })
 

src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx

@@ -1,5 +1,5 @@
 import { describe, expect, it, Mock, vi } from 'vitest'
-import { insertTestStudyJobData, mockSessionWithTestData, renderWithProviders } from '@/tests/unit.helpers'
+import { db, insertTestStudyJobData, mockSessionWithTestData, renderWithProviders } from '@/tests/unit.helpers'
 import { JobReviewButtons } from './job-review-buttons'
 import { act, fireEvent, screen, waitFor } from '@testing-library/react'
 import { latestJobForStudy } from '@/server/db/queries'
@@ -10,7 +10,7 @@ vi.spyOn(actions, 'approveStudyJobFilesAction')
 vi.spyOn(actions, 'rejectStudyJobFilesAction')
 
 vi.mock('@/server/storage', () => ({
-    storeApprovedJobFile: vi.fn(),
+    fetchFileContents: vi.fn(),
 }))
 
 describe('Study Results Approve/Reject buttons', async () => {
@@ -73,7 +73,58 @@ describe('Study Results Approve/Reject buttons', async () => {
     })
 
     it('can approve results', async () => {
-        await clickNTest('Approve', actions.approveStudyJobFilesAction as Mock, 'FILES-APPROVED')
+        // Approve re-wraps each file's AES key for the lab researchers. Use real keys (so
+        // wrapAesKey accepts the SPKI) and reuse the keyed session user as researcher so no
+        // fake-key user pollutes the recipient set. The selected file must be a real row.
+        const { org, user } = await mockSessionWithTestData({ orgType: 'enclave', useRealKeys: true })
+        const { latestJobWithStatus: job } = await insertTestStudyJobData({
+            org,
+            studyStatus: 'PENDING-REVIEW',
+            researcherId: user.id,
+        })
+
+        const row = await db
+            .insertInto('studyJobFile')
+            .values({
+                studyJobId: job.id,
+                name: 'test.csv',
+                path: `results/encrypted/test.csv`,
+                fileType: 'ENCRYPTED-RESULT',
+            })
+            .returning('id')
+            .executeTakeFirstOrThrow()
+
+        const decryptedResults = [
+            {
+                path: 'test.csv',
+                contents: new TextEncoder().encode('test123').buffer,
+                sourceId: row.id,
+                fileType: 'APPROVED-RESULT' as FileType,
+                rawAesKey: new ArrayBuffer(32),
+            },
+        ]
+
+        await act(async () => {
+            renderWithProviders(<JobReviewButtons job={job} decryptedResults={decryptedResults} />)
+        })
+
+        await act(async () => {
+            fireEvent.click(screen.getByRole('button', { name: 'Approve' }))
+        })
+
+        await waitFor(async () => {
+            expect(actions.approveStudyJobFilesAction).toHaveBeenCalled()
+            const latestJob = await latestJobForStudy(job.studyId)
+            expect(latestJob.statusChanges.find((sc) => sc.status === 'FILES-APPROVED')).not.toBeUndefined()
+        })
+
+        // The re-wrapped researcher key was persisted against the real file row.
+        const wrappedKeys = await db
+            .selectFrom('studyJobFileRecipientKey')
+            .select('fingerprint')
+            .where('studyJobFileId', '=', row.id)
+            .execute()
+        expect(wrappedKeys.length).toBeGreaterThan(0)
     })
 
     it('can reject results', async () => {

src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx

@@ -8,6 +8,7 @@ import { Routes } from '@/lib/routes'
 import { JobFileInfo, MinimalJobInfo } from '@/lib/types'
 import { approveStudyJobFilesAction, rejectStudyJobFilesAction } from '@/server/actions/study-job.actions'
 import type { LatestJobForStudy } from '@/server/db/queries'
+import { buildSharedFiles } from '@/lib/re-wrap-results'
 import { Button, Group, Text, useMantineTheme } from '@mantine/core'
 import { CheckCircleIcon, XCircleIcon } from '@phosphor-icons/react/dist/ssr'
 import dayjs from 'dayjs'
@@ -42,7 +43,10 @@ export const JobReviewButtons = ({
             }
 
             if (status === 'FILES-APPROVED') {
-                await approveStudyJobFilesAction({ orgSlug, jobInfo, jobFiles: decryptedResults })
+                // Re-wrap each approved file's AES key for the lab researchers, client-side.
+                // Only the wrapped keys are sent — never the raw key or plaintext.
+                const sharedFiles = await buildSharedFiles(job.studyId, decryptedResults)
+                await approveStudyJobFilesAction({ orgSlug, jobInfo, sharedFiles })
             }
 
             if (status === 'FILES-REJECTED') {