@antzsoft/chat-core 1.1.0 → 1.1.2

package/dist/index.js

@@ -38,7 +38,7 @@ function resolveConfig(config) {
     userId: config.userId,
     tenantId: config.tenantId,
     avatar: config.avatar,
-    encryptionMode: config.encryptionMode ?? "none",
+    transitEncryption: config.transitEncryption ?? true,
     upload: {
       maxFileSizeMB: limits,
       maxFilesPerMessage: config.upload?.maxFilesPerMessage ?? 10,
@@ -125,6 +125,100 @@ async function compressFile(file, platformCompressFn, config) {
 
 // src/api/client.ts
 import axios from "axios";
+
+// src/crypto/transit.ts
+async function encryptPayload(data, sessionKey) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(data));
+  const encrypted = await globalThis.crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    sessionKey,
+    plaintext
+  );
+  const ct = encrypted.slice(0, encrypted.byteLength - 16);
+  const tag = encrypted.slice(encrypted.byteLength - 16);
+  return {
+    v: 1,
+    iv: bufToB64(iv),
+    tag: bufToB64(tag),
+    ct: bufToB64(ct)
+  };
+}
+async function decryptPayload(envelope, sessionKey) {
+  const iv = b64ToBuf(envelope.iv);
+  const tag = b64ToBuf(envelope.tag);
+  const ct = b64ToBuf(envelope.ct);
+  const combined = new Uint8Array(ct.byteLength + tag.byteLength);
+  combined.set(new Uint8Array(ct), 0);
+  combined.set(new Uint8Array(tag), ct.byteLength);
+  const decrypted = await globalThis.crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: new Uint8Array(iv) },
+    sessionKey,
+    combined
+  );
+  return JSON.parse(new TextDecoder().decode(decrypted));
+}
+function isTransitEnvelope(v) {
+  return typeof v === "object" && v !== null && v.v === 1 && typeof v.iv === "string" && typeof v.tag === "string" && typeof v.ct === "string";
+}
+function bufToB64(buf) {
+  const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+  let str = "";
+  bytes.forEach((b) => {
+    str += String.fromCharCode(b);
+  });
+  return btoa(str);
+}
+function b64ToBuf(b64) {
+  const bin = atob(b64);
+  const buf = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);
+  return buf.buffer;
+}
+
+// src/crypto/session.ts
+var _session = null;
+var _readyResolve = null;
+var _readyPromise = null;
+var _transitConfigured = null;
+function configureTransit(enabled) {
+  _transitConfigured = enabled;
+  if (!enabled) {
+    _readyResolve?.();
+    _readyResolve = null;
+  }
+}
+function waitForTransitReady() {
+  if (!_transitConfigured) return Promise.resolve();
+  if (_session) return Promise.resolve();
+  if (!_readyPromise) {
+    _readyPromise = new Promise((resolve) => {
+      _readyResolve = resolve;
+    });
+  }
+  return _readyPromise;
+}
+function setTransitSession(session) {
+  _session = session;
+  _readyResolve?.();
+  _readyResolve = null;
+}
+function clearTransitSession() {
+  _session = null;
+  _readyPromise = null;
+  _readyResolve = null;
+}
+function isTransitEnabled() {
+  return _session?.enabled === true;
+}
+function getSessionKey() {
+  return _session?.sessionKey ?? null;
+}
+function getSessionId() {
+  return _session?.sessionId ?? null;
+}
+
+// src/api/client.ts
 var _tokenStore = null;
 var _config = null;
 var _avatarSent = false;
@@ -136,7 +230,8 @@ function initApiClient(config, tokenStore) {
     baseURL: config.apiUrl,
     headers: { "Content-Type": "application/json" }
   });
-  client.interceptors.request.use((req) => {
+  configureTransit(config.transitEncryption);
+  client.interceptors.request.use(async (req) => {
     const token = _tokenStore?.getAccessToken();
     if (token) req.headers["Authorization"] = `Bearer ${token}`;
     if (_config?.userId) req.headers["x-user-id"] = _config.userId;
@@ -146,18 +241,54 @@ function initApiClient(config, tokenStore) {
       else if (_config.avatar.url) req.headers["x-avatar-url"] = _config.avatar.url;
       _avatarSent = true;
     }
+    await waitForTransitReady();
+    if (isTransitEnabled()) {
+      const sessionId = getSessionId();
+      const key = getSessionKey();
+      if (sessionId && key) {
+        req.headers["x-transit-session"] = sessionId;
+        if (req.data !== void 0 && req.data !== null) {
+          const envelope = await encryptPayload(req.data, key);
+          req.data = envelope;
+          req.headers["x-transit-encrypted"] = "1";
+        }
+      }
+    }
     return req;
   });
   let isRefreshing = false;
   let refreshQueue = [];
   client.interceptors.response.use(
-    (response) => {
+    async (response) => {
+      if (isTransitEnabled()) {
+        const key = getSessionKey();
+        if (key) {
+          if (isTransitEnvelope(response.data)) {
+            response.data = await decryptPayload(response.data, key);
+          } else if (response.data?.data && isTransitEnvelope(response.data.data)) {
+            response.data.data = await decryptPayload(response.data.data, key);
+          }
+        }
+      }
       if (response.data && typeof response.data === "object" && "success" in response.data && "data" in response.data) {
         response.data = response.data.data;
       }
       return response;
     },
     async (error) => {
+      if (isTransitEnabled() && error.response?.data) {
+        const key = getSessionKey();
+        if (key) {
+          try {
+            if (isTransitEnvelope(error.response.data)) {
+              error.response.data = await decryptPayload(error.response.data, key);
+            } else if (error.response.data?.data && isTransitEnvelope(error.response.data.data)) {
+              error.response.data.data = await decryptPayload(error.response.data.data, key);
+            }
+          } catch {
+          }
+        }
+      }
       const original = error.config;
       if (error.response?.status === 401 && !original._retry) {
         const refreshToken = _tokenStore?.getRefreshToken();
@@ -412,10 +543,10 @@ var conversationsApi = {
   async delete(conversationId) {
     await getApiClient().delete(`/conversations/${conversationId}`);
   },
-  async addParticipants(conversationId, userIds) {
+  async addParticipants(conversationId, userIds, role) {
     const { data } = await getApiClient().post(
       `/conversations/${conversationId}/participants`,
-      { userIds }
+      { userIds, ...role && { role } }
     );
     return normalizeConversation(data);
   },
@@ -535,7 +666,14 @@ async function uploadBatch(files, platformUploadFn, conversationId, onProgress,
     filename: f.name,
     mimeType: f.type,
     size: f.size,
-    conversationId
+    conversationId,
+    ...f.compressed && {
+      metadata: {
+        compressed: f.compressed,
+        originalSize: f.originalSize,
+        compressionAlgorithm: f.compressionAlgorithm
+      }
+    }
   }));
   const { urls, errors: requestErrors } = await storageApi.requestPresignedUrlBatch(requests);
   const progressMap = {};
@@ -632,6 +770,95 @@ var usersApi = {
 
 // src/socket/socket.ts
 import { io } from "socket.io-client";
+
+// src/crypto/detect.ts
+var _cached = null;
+async function detectTransitAlgo() {
+  if (_cached) return _cached;
+  try {
+    await globalThis.crypto.subtle.generateKey(
+      { name: "X25519" },
+      false,
+      ["deriveKey"]
+    );
+    _cached = "x25519";
+  } catch {
+    _cached = "p256";
+  }
+  return _cached;
+}
+function resetAlgoCache() {
+  _cached = null;
+}
+
+// src/crypto/handshake.ts
+async function fetchServerKeys(apiUrl) {
+  const res = await fetch(`${apiUrl}/crypto/pubkey`);
+  if (!res.ok) throw new Error(`[AntzChat] Failed to fetch server public key: ${res.status}`);
+  const body = await res.json();
+  return body?.data ?? body;
+}
+async function performHandshake(algo, serverKeys, socketHandshakeAuth) {
+  const ephemeral = await globalThis.crypto.subtle.generateKey(
+    algo === "x25519" ? { name: "X25519" } : { name: "ECDH", namedCurve: "P-256" },
+    false,
+    ["deriveBits"]
+  );
+  const pubRaw = await globalThis.crypto.subtle.exportKey("raw", ephemeral.publicKey);
+  socketHandshakeAuth["transitEphemeralPub"] = bufToB642(pubRaw);
+  socketHandshakeAuth["transitAlgo"] = algo;
+  const ephemeralPriv = ephemeral.privateKey;
+  return (sessionId) => deriveSessionKey(ephemeralPriv, algo, serverKeys, sessionId);
+}
+async function deriveSessionKey(ephemeralPriv, algo, serverKeys, sessionId) {
+  const serverPubB64 = algo === "x25519" ? serverKeys.x25519 : serverKeys.p256;
+  const serverPubRaw = b64ToBuf2(serverPubB64);
+  const keyAlgoParams = algo === "x25519" ? { name: "X25519" } : { name: "ECDH", namedCurve: "P-256" };
+  const serverPubKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    serverPubRaw,
+    keyAlgoParams,
+    false,
+    []
+  );
+  const sharedBits = await globalThis.crypto.subtle.deriveBits(
+    { name: algo === "x25519" ? "X25519" : "ECDH", public: serverPubKey },
+    ephemeralPriv,
+    256
+  );
+  const hkdfKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    sharedBits,
+    "HKDF",
+    false,
+    ["deriveKey"]
+  );
+  const salt = new TextEncoder().encode(sessionId);
+  const info = new TextEncoder().encode("antz-transit-v1");
+  return globalThis.crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+function bufToB642(buf) {
+  const bytes = new Uint8Array(buf);
+  let str = "";
+  bytes.forEach((b) => {
+    str += String.fromCharCode(b);
+  });
+  return btoa(str);
+}
+function b64ToBuf2(b64) {
+  const bin = atob(b64);
+  const buf = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);
+  return buf.buffer;
+}
+
+// src/socket/socket.ts
 var _socket = null;
 var _status = "disconnected";
 var _statusListeners = /* @__PURE__ */ new Set();
@@ -656,23 +883,96 @@ function onSocketStatus(listener) {
   _statusListeners.add(listener);
   return () => _statusListeners.delete(listener);
 }
+async function secureEmit(socket, event, payload, ack) {
+  if (isTransitEnabled()) {
+    const key = getSessionKey();
+    if (key) {
+      const envelope = await encryptPayload(payload, key);
+      if (ack) {
+        socket.emit(event, envelope, async (encryptedResponse) => {
+          if (isTransitEnvelope(encryptedResponse)) {
+            try {
+              const decrypted = await decryptPayload(encryptedResponse, key);
+              ack(decrypted);
+            } catch {
+              ack(encryptedResponse);
+            }
+          } else {
+            ack(encryptedResponse);
+          }
+        });
+      } else {
+        socket.emit(event, envelope);
+      }
+      return;
+    }
+  }
+  if (ack) {
+    socket.emit(event, payload, ack);
+  } else {
+    socket.emit(event, payload);
+  }
+}
+function secureOn(socket, event, handler) {
+  socket.on(event, async (raw) => {
+    if (isTransitEnabled() && isTransitEnvelope(raw)) {
+      const key = getSessionKey();
+      if (key) {
+        try {
+          const data = await decryptPayload(raw, key);
+          handler(data);
+          return;
+        } catch {
+          console.error(`[AntzChat] Transit decryption failed for event: ${event}`);
+          return;
+        }
+      }
+    }
+    handler(raw);
+  });
+}
 async function connectSocket(config, getToken) {
   if (_socket && !_socket.disconnected) return _socket;
   _getToken = getToken;
   _userId = config.userId;
   _tenantId = config.tenantId;
   const token = getToken();
+  const socketHandshakeAuth = {
+    token: token ? `Bearer ${token}` : "",
+    ...config.userId && { userId: config.userId },
+    ...config.tenantId && { tenantId: config.tenantId },
+    ...config.avatar?.url && { avatarUrl: config.avatar.url },
+    ...config.avatar?.base64 && { avatarBase64: config.avatar.base64 }
+  };
+  let boundDeriveSessionKey = null;
+  if (config.transitEncryption) {
+    try {
+      const serverKeys = await fetchServerKeys(config.apiUrl);
+      if (!serverKeys.enabled) {
+        throw new Error(
+          "[AntzChat] Transit encryption mismatch: SDK has transitEncryption=true but server has TRANSIT_ENCRYPTION_ENABLED=false. Align the config on both sides."
+        );
+      }
+      const algo = await detectTransitAlgo();
+      boundDeriveSessionKey = await performHandshake(algo, serverKeys, socketHandshakeAuth);
+    } catch (err) {
+      if (err.message?.startsWith("[AntzChat] Transit encryption mismatch")) throw err;
+      console.warn("[AntzChat] Transit handshake setup failed, connecting without transit encryption:", err.message);
+    }
+  } else {
+    try {
+      const serverKeys = await fetchServerKeys(config.apiUrl);
+      if (serverKeys.enabled) {
+        throw new Error(
+          "[AntzChat] Transit encryption mismatch: SDK has transitEncryption=false but server has TRANSIT_ENCRYPTION_ENABLED=true. Align the config on both sides."
+        );
+      }
+    } catch (err) {
+      if (err.message?.startsWith("[AntzChat] Transit encryption mismatch")) throw err;
+    }
+  }
   _socket = io(`${config.socketOrigin}/chat`, {
-    auth: {
-      token: token ? `Bearer ${token}` : "",
-      ...config.userId && { userId: config.userId },
-      ...config.tenantId && { tenantId: config.tenantId },
-      ...config.avatar?.url && { avatarUrl: config.avatar.url },
-      ...config.avatar?.base64 && { avatarBase64: config.avatar.base64 }
-    },
-    // path must match SOCKET_IO_PATH on the server (default '/socket.io').
-    // Set socketPath in SDK config when the server is behind a reverse proxy
-    // that adds a path prefix (e.g. '/chat-api/socket.io' for UAT).
+    auth: socketHandshakeAuth,
     path: config.socketPath,
     transports: ["websocket", "polling"],
     reconnection: true,
@@ -683,32 +983,80 @@ async function connectSocket(config, getToken) {
   });
   setStatus("connecting");
   _socket.on("connect", () => setStatus("connected"));
-  _socket.on("disconnect", () => setStatus("disconnected"));
+  _socket.on("disconnect", () => {
+    setStatus("disconnected");
+    clearTransitSession();
+  });
   _socket.on("connect_error", (err) => {
     console.error("[AntzChat] Socket connect_error:", err?.message, err?.data);
     setStatus("error");
   });
   _socket.on("reconnecting", () => setStatus("reconnecting"));
   _socket.on("reconnect", () => setStatus("connected"));
-  _socket.on("read_receipt", (event) => {
+  if (config.transitEncryption && boundDeriveSessionKey) {
+    await new Promise((resolve) => {
+      const done = () => {
+        clearTimeout(timeout);
+        resolve();
+      };
+      const timeout = setTimeout(() => {
+        console.warn("[AntzChat] transit_session timeout \u2014 unblocking HTTP without transit encryption");
+        configureTransit(false);
+        done();
+      }, 5e3);
+      _socket.on("transit_session", async ({ sessionId }) => {
+        try {
+          if (boundDeriveSessionKey) {
+            const sessionKey = await boundDeriveSessionKey(sessionId);
+            const algo = socketHandshakeAuth["transitAlgo"] ?? "p256";
+            setTransitSession({ sessionKey, algo, sessionId, enabled: true });
+          }
+        } catch (err) {
+          console.error("[AntzChat] Failed to derive transit session key:", err.message);
+        }
+        done();
+      });
+      _socket.on("connect_error", () => done());
+    });
+  }
+  secureOn(_socket, "read_receipt", (event) => {
     import("./chat.store-PY3YVYGN.js").then(({ useChatStore: useChatStore2 }) => {
-      useChatStore2.getState().setLastRead(event.conversationId, event.messageId, event.readAt);
+      const e = event;
+      useChatStore2.getState().setLastRead(e.conversationId, e.messageId, e.readAt);
     });
   });
-  _socket.on("user_online", (event) => {
+  secureOn(_socket, "user_online", (event) => {
     import("./chat.store-PY3YVYGN.js").then(({ useChatStore: useChatStore2 }) => {
-      const store = useChatStore2.getState();
-      store.setUserOnline(event.userId);
+      useChatStore2.getState().setUserOnline(event.userId);
     });
   });
-  _socket.on("user_offline", (event) => {
+  secureOn(_socket, "user_offline", (event) => {
     import("./chat.store-PY3YVYGN.js").then(({ useChatStore: useChatStore2 }) => {
+      const e = event;
       const store = useChatStore2.getState();
-      store.setUserOffline(event.userId);
-      if (event.lastSeenAt) store.setLastSeen(event.userId, event.lastSeenAt);
+      store.setUserOffline(e.userId);
+      if (e.lastSeenAt) store.setLastSeen(e.userId, e.lastSeenAt);
     });
   });
-  return _socket;
+  return createSecureSocketProxy(_socket);
+}
+function createSecureSocketProxy(socket) {
+  return new Proxy(socket, {
+    get(target, prop) {
+      if (prop === "on") {
+        return (event, handler) => {
+          const internal = ["connect", "disconnect", "connect_error", "reconnect", "reconnecting", "error"];
+          if (internal.includes(event)) {
+            return target.on(event, handler);
+          }
+          secureOn(target, event, handler);
+          return socket;
+        };
+      }
+      const val = target[prop];
+      return typeof val === "function" ? val.bind(target) : val;
+    }
+  });
 }
 function disconnectSocket() {
   if (_socket) {
@@ -716,6 +1064,8 @@ function disconnectSocket() {
     _socket = null;
     setStatus("disconnected");
   }
+  clearTransitSession();
+  resetAlgoCache();
   _getToken = null;
   _userId = void 0;
   _tenantId = void 0;
@@ -773,7 +1123,7 @@ async function withAck(event, payload) {
   if (!socket) return Promise.reject(new Error(`[AntzChat] Socket not connected (event: ${event})`));
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error(`Socket ack timeout: ${event}`)), ACK_TIMEOUT);
-    socket.emit(event, payload, (response) => {
+    secureEmit(socket, event, payload, (response) => {
       clearTimeout(timer);
       resolve(response);
     });
@@ -782,7 +1132,7 @@ async function withAck(event, payload) {
 function fireAndForget(event, payload) {
   const socket = tryGetSocket();
   if (!socket) return;
-  socket.emit(event, payload);
+  secureEmit(socket, event, payload);
 }
 var socketEmit = {
   joinRoom(conversationId) {
@@ -827,7 +1177,7 @@ var socketEmit = {
     if (!socket) return Promise.resolve([]);
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error("get_online_users timeout")), ACK_TIMEOUT);
-      socket.emit("get_online_users", { userIds }, (response) => {
+      secureEmit(socket, "get_online_users", { userIds }, (response) => {
         clearTimeout(timer);
         if (response && typeof response === "object" && "onlineStatus" in response) {
           const status = response.onlineStatus;
@@ -1005,6 +1355,7 @@ export {
   resetAuthStore,
   resolveConfig,
   setApiClientInstance,
+  setTransitSession,
   socketEmit,
   storageApi,
   tryGetSocket,