Notifications: Encrypted payload now uses current passkey to decrypt

src/lib/components/layouts/sidebar-layout/components/notification-item.svelte

@@ -80,9 +80,13 @@
         }
 
         const staffKeyShares = await getStaffKeyShares(tenant!.id, item.metaData.tunnelId);
+        const currentPasskeyId = page.data.passkeyId;
+        const staffKeyShare = staffKeyShares.find((share) => share.passkeyId === currentPasskeyId);
 
-        // TODO: When multiple staffKeyShares are supported, select the one currently in use
-        const staffKeyShare = staffKeyShares[0];
+        if (!staffKeyShare) {
+          console.error("No matching staff key share found for current passkey ID");
+          return;
+        }
 
         decrypted = await $staffCrypto.crypto.decryptStaff({
           data,

src/lib/types/staff.ts

@@ -5,4 +5,5 @@ export type TStaff = Pick<SelectUser, "id" | "name" | "role" | "email">;
 export type TStaffKeyShare = {
   tunnelId: string;
   encryptedTunnelKey: string;
+  passkeyId: string;
 };

src/routes/+layout.server.ts

@@ -3,5 +3,6 @@ import type { LayoutServerLoad } from "./$types";
 export const load: LayoutServerLoad = async ({ locals }) => {
   return {
     locale: locals.locale,
+    passkeyId: locals.user?.passkeyId,
   };
 };

src/routes/api/tenants/[id]/appointments/tunnels/[tunnelId]/staff-key-shares/+server.ts

@@ -53,8 +53,9 @@ registerOpenAPIRoute("/tenants/{id}/appointments/tunnels/{tunnelId}/staff-key-sh
                   properties: {
                     encryptedTunnelKey: { type: "string", description: "Encrypted tunnel key" },
                     tunnelId: { type: "string", format: "uuid", description: "Tunnel ID" },
+                    passkeyId: { type: "string", format: "uuid", description: "Passkey ID" },
                   },
-                  required: ["encryptedTunnelKey", "tunnelId"],
+                  required: ["encryptedTunnelKey", "tunnelId", "passkeyId"],
                 },
                 description: "Retrieved key shares",
               },
@@ -167,6 +168,7 @@ export const GET: RequestHandler = async ({ params, locals }) => {
       .select({
         tunnelId: clientTunnelStaffKeyShare.tunnelId,
         encryptedTunnelKey: clientTunnelStaffKeyShare.encryptedTunnelKey,
+        passkeyId: clientTunnelStaffKeyShare.passkeyId,
       })
       .from(clientTunnelStaffKeyShare)
       .where(

src/routes/api/tenants/[id]/appointments/tunnels/[tunnelId]/staff-key-shares/__tests__/get-staff-key-shares.test.ts

@@ -47,6 +47,7 @@ vi.mock("$lib/server/db/tenant-schema", () => ({
     userId: "userId",
     tunnelId: "tunnelId",
     encryptedTunnelKey: "encryptedTunnelKey",
+    passkeyId: "passkeyId",
   },
 }));
 
@@ -106,6 +107,7 @@ describe("Get Staff Key Shares API", () => {
         {
           tunnelId: mockTunnelId,
           encryptedTunnelKey: "encrypted-key-share",
+          passkeyId: "passkey-id",
         },
       ]),
     );
@@ -123,7 +125,13 @@ describe("Get Staff Key Shares API", () => {
     expect(response.status).toBe(200);
     const body = await response.json();
     expect(body).toEqual({
-      keyShares: [{ tunnelId: mockTunnelId, encryptedTunnelKey: "encrypted-key-share" }],
+      keyShares: [
+        {
+          tunnelId: mockTunnelId,
+          encryptedTunnelKey: "encrypted-key-share",
+          passkeyId: "passkey-id",
+        },
+      ],
     });
     expect(mockCheckPermission).toHaveBeenCalledWith(
       { user: { id: mockStaffUserId, tenantId: mockTenantId, role: "STAFF" } },