@celestial-community/baileys 0.0.1-security → 1.0.0

package/lib/Utils/noise-handler.js

@@ -0,0 +1,175 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.makeNoiseHandler = void 0
+const boom_1 = require('@hapi/boom')
+const WAProto_1 = require('../../WAProto')
+const Defaults_1 = require('../Defaults')
+const WABinary_1 = require('../WABinary')
+const crypto_1 = require('./crypto')
+const generateIV = (counter) => {
+    const iv = new ArrayBuffer(12)
+    new DataView(iv).setUint32(8, counter)
+    return new Uint8Array(iv)
+}
+const makeNoiseHandler = ({
+    keyPair: { private: privateKey, public: publicKey },
+    NOISE_HEADER,
+    mobile,
+    logger,
+    routingInfo
+}) => {
+    logger = logger.child({ class: 'ns' })
+    const authenticate = (data) => {
+        if (!isFinished) {
+            hash = (0, crypto_1.sha256)(Buffer.concat([hash, data]))
+        }
+    }
+    const encrypt = (plaintext) => {
+        const result = (0, crypto_1.aesEncryptGCM)(
+            plaintext,
+            encKey,
+            generateIV(writeCounter),
+            hash
+        )
+        writeCounter += 1
+        authenticate(result)
+        return result
+    }
+    const decrypt = (ciphertext) => {
+        // before the handshake is finished, we use the same counter
+        // after handshake, the counters are different
+        const iv = generateIV(isFinished ? readCounter : writeCounter)
+        const result = (0, crypto_1.aesDecryptGCM)(ciphertext, decKey, iv, hash)
+        if (isFinished) {
+            readCounter += 1
+        } else {
+            writeCounter += 1
+        }
+        authenticate(ciphertext)
+        return result
+    }
+    const localHKDF = (data) => {
+        const key = (0, crypto_1.hkdf)(Buffer.from(data), 64, { salt, info: '' })
+        return [key.slice(0, 32), key.slice(32)]
+    }
+    const mixIntoKey = (data) => {
+        const [write, read] = localHKDF(data)
+        salt = write
+        encKey = read
+        decKey = read
+        readCounter = 0
+        writeCounter = 0
+    }
+    const finishInit = () => {
+        const [write, read] = localHKDF(new Uint8Array(0))
+        encKey = write
+        decKey = read
+        hash = Buffer.from([])
+        readCounter = 0
+        writeCounter = 0
+        isFinished = true
+    }
+    const data = Buffer.from(Defaults_1.NOISE_MODE)
+    let hash = Buffer.from(data.byteLength === 32 ? data : (0, crypto_1.sha256)(data))
+    let salt = hash
+    let encKey = hash
+    let decKey = hash
+    let readCounter = 0
+    let writeCounter = 0
+    let isFinished = false
+    let sentIntro = false
+    let inBytes = Buffer.alloc(0)
+    authenticate(NOISE_HEADER)
+    authenticate(publicKey)
+    return {
+        encrypt,
+        decrypt,
+        authenticate,
+        mixIntoKey,
+        finishInit,
+        processHandshake: ({ serverHello }, noiseKey) => {
+            authenticate(serverHello.ephemeral)
+            mixIntoKey(crypto_1.Curve.sharedKey(privateKey, serverHello.ephemeral))
+            const decStaticContent = decrypt(serverHello.static)
+            mixIntoKey(crypto_1.Curve.sharedKey(privateKey, decStaticContent))
+            const certDecoded = decrypt(serverHello.payload)
+            if (mobile) {
+                WAProto_1.proto.CertChain.NoiseCertificate.decode(certDecoded)
+            } else {
+                const { intermediate: certIntermediate } =
+                    WAProto_1.proto.CertChain.decode(certDecoded)
+                const { issuerSerial } = WAProto_1.proto.CertChain.NoiseCertificate.Details.decode(
+                    certIntermediate.details
+                )
+                if (issuerSerial !== Defaults_1.WA_CERT_DETAILS.SERIAL) {
+                    throw new boom_1.Boom('certification match failed', { statusCode: 400 })
+                }
+            }
+            const keyEnc = encrypt(noiseKey.public)
+            mixIntoKey(crypto_1.Curve.sharedKey(noiseKey.private, serverHello.ephemeral))
+            return keyEnc
+        },
+        encodeFrame: (data) => {
+            if (isFinished) {
+                data = encrypt(data)
+            }
+            let header
+            if (routingInfo) {
+                header = Buffer.alloc(7)
+                header.write('ED', 0, 'utf8')
+                header.writeUint8(0, 2)
+                header.writeUint8(1, 3)
+                header.writeUint8(routingInfo.byteLength >> 16, 4)
+                header.writeUint16BE(routingInfo.byteLength & 65535, 5)
+                header = Buffer.concat([header, routingInfo, NOISE_HEADER])
+            } else {
+                header = Buffer.from(NOISE_HEADER)
+            }
+            const introSize = sentIntro ? 0 : header.length
+            const frame = Buffer.alloc(introSize + 3 + data.byteLength)
+            if (!sentIntro) {
+                frame.set(header)
+                sentIntro = true
+            }
+            frame.writeUInt8(data.byteLength >> 16, introSize)
+            frame.writeUInt16BE(65535 & data.byteLength, introSize + 1)
+            frame.set(data, introSize + 3)
+            return frame
+        },
+        decodeFrame: (newData, onFrame) => {
+            var _a
+            // the binary protocol uses its own framing mechanism
+            // on top of the WS frames
+            // so we get this data and separate out the frames
+            const getBytesSize = () => {
+                if (inBytes.length >= 3) {
+                    return (inBytes.readUInt8() << 16) | inBytes.readUInt16BE(1)
+                }
+            }
+            inBytes = Buffer.concat([inBytes, newData])
+            logger.trace(`recv ${newData.length} bytes, total recv ${inBytes.length} bytes`)
+            let size = getBytesSize()
+            while (size && inBytes.length >= size + 3) {
+                let frame = inBytes.slice(3, size + 3)
+                inBytes = inBytes.slice(size + 3)
+                if (isFinished) {
+                    const result = decrypt(frame)
+                    frame = (0, WABinary_1.decodeBinaryNode)(result)
+                }
+                logger.trace(
+                    {
+                        msg:
+                            (_a = frame === null || frame === void 0 ? void 0 : frame.attrs) ===
+                                null || _a === void 0
+                                ? void 0
+                                : _a.id
+                    },
+                    'recv frame'
+                )
+                onFrame(frame)
+                size = getBytesSize()
+            }
+        }
+    }
+}
+exports.makeNoiseHandler = makeNoiseHandler

package/lib/Utils/offline-node-processor.js

@@ -0,0 +1,45 @@
+/**
+ * Creates a processor for offline stanza nodes that:
+ * - Queues nodes for sequential processing
+ * - Yields to the event loop periodically to avoid blocking
+ * - Catches handler errors to prevent the processing loop from crashing
+ */
+export function makeOfflineNodeProcessor(nodeProcessorMap, deps, batchSize = 10) {
+    const nodes = []
+    let isProcessing = false
+    const enqueue = (type, node) => {
+        nodes.push({ type, node })
+        if (isProcessing) {
+            return
+        }
+        isProcessing = true
+        const promise = async () => {
+            let processedInBatch = 0
+            while (nodes.length && deps.isWsOpen()) {
+                const { type, node } = nodes.shift()
+                const nodeProcessor = nodeProcessorMap.get(type)
+                if (!nodeProcessor) {
+                    deps.onUnexpectedError(
+                        new Error(`unknown offline node type: ${type}`),
+                        'processing offline node'
+                    )
+                    continue
+                }
+                await nodeProcessor(node).catch((err) =>
+                    deps.onUnexpectedError(err, `processing offline ${type}`)
+                )
+                processedInBatch++
+                // Yield to event loop after processing a batch
+                // This prevents blocking the event loop for too long when there are many offline nodes
+                if (processedInBatch >= batchSize) {
+                    processedInBatch = 0
+                    await deps.yieldToEventLoop()
+                }
+            }
+            isProcessing = false
+        }
+        promise().catch((error) => deps.onUnexpectedError(error, 'processing offline nodes'))
+    }
+    return { enqueue }
+}
+//# sourceMappingURL=offline-node-processor.js.map

package/lib/Utils/pre-key-manager.js

@@ -0,0 +1,131 @@
+"use strict"
+Object.defineProperty(exports, "__esModule", { value: true })
+exports.pre_key_manager = void 0
+
+/**
+ * @file pre-key-manager.js
+ * @description Serializes prekey/session-key mutations per key type so
+ *   concurrent transactions don't race on the same keyType bucket.
+ *   Batches updates vs deletions, and validates deletions against what
+ *   actually exists in the store before applying them.
+ *   Uses a small built-in FIFO queue (concurrency 1 per keyType) instead
+ *   of an external package, to keep bilis dependency-free/CJS-clean.
+ * @author Denzy ZeroDay
+ */
+
+/** Minimal FIFO async queue running one task at a time. */
+class _simple_queue {
+    constructor() {
+        this._tail = Promise.resolve()
+    }
+    add(task) {
+        const run = this._tail.then(() => task())
+        // swallow errors for chaining purposes, real error still propagates to caller via `run`
+        this._tail = run.catch(() => {})
+        return run
+    }
+}
+
+class pre_key_manager {
+    /**
+     * @param {object} store - key store with async get(keyType, ids) => { [id]: value }
+     * @param {object} logger - logger with .warn(msg)
+     */
+    constructor(store, logger) {
+        this.store = store
+        this.logger = logger
+        this.queues = new Map()
+    }
+
+    /** Get (or create) the serial queue for a given key type */
+    get_queue(key_type) {
+        if (!this.queues.has(key_type)) {
+            this.queues.set(key_type, new _simple_queue())
+        }
+        return this.queues.get(key_type)
+    }
+
+    /**
+     * Process pending mutations (updates + deletions) for a key type,
+     * serialized against any other in-flight operation on the same key type.
+     */
+    async process_operations(data, key_type, transaction_cache, mutations, is_in_transaction) {
+        const key_data = data[key_type]
+        if (!key_data) return
+
+        return this.get_queue(key_type).add(async () => {
+            transaction_cache[key_type] = transaction_cache[key_type] || {}
+            mutations[key_type] = mutations[key_type] || {}
+
+            const deletions = []
+            const updates = {}
+            for (const key_id in key_data) {
+                if (key_data[key_id] === null) {
+                    deletions.push(key_id)
+                } else {
+                    updates[key_id] = key_data[key_id]
+                }
+            }
+
+            if (Object.keys(updates).length > 0) {
+                Object.assign(transaction_cache[key_type], updates)
+                Object.assign(mutations[key_type], updates)
+            }
+            if (deletions.length > 0) {
+                await this.process_deletions(key_type, deletions, transaction_cache, mutations, is_in_transaction)
+            }
+        })
+    }
+
+    /**
+     * Apply deletions, skipping any id that doesn't actually exist
+     * (in the transaction cache if in-transaction, else in the real store).
+     */
+    async process_deletions(key_type, ids, transaction_cache, mutations, is_in_transaction) {
+        if (is_in_transaction) {
+            for (const key_id of ids) {
+                if (transaction_cache[key_type]?.[key_id]) {
+                    transaction_cache[key_type][key_id] = null
+                    mutations[key_type][key_id] = null
+                } else {
+                    this.logger.warn(`Skipping deletion of non-existent ${key_type} in transaction: ${key_id}`)
+                }
+            }
+        } else {
+            const existing_keys = await this.store.get(key_type, ids)
+            for (const key_id of ids) {
+                if (existing_keys[key_id]) {
+                    transaction_cache[key_type][key_id] = null
+                    mutations[key_type][key_id] = null
+                } else {
+                    this.logger.warn(`Skipping deletion of non-existent ${key_type}: ${key_id}`)
+                }
+            }
+        }
+    }
+
+    /**
+     * Pre-validate a batch of pending deletions against the store,
+     * dropping any that reference a non-existent key (mutates `data` in place).
+     */
+    async validate_deletions(data, key_type) {
+        const key_data = data[key_type]
+        if (!key_data) return
+
+        return this.get_queue(key_type).add(async () => {
+            const deletion_ids = Object.keys(key_data).filter(id => key_data[id] === null)
+            if (deletion_ids.length === 0) return
+
+            const existing_keys = await this.store.get(key_type, deletion_ids)
+            for (const key_id of deletion_ids) {
+                if (!existing_keys[key_id]) {
+                    this.logger.warn(`Skipping deletion of non-existent ${key_type}: ${key_id}`)
+                    delete data[key_type][key_id]
+                }
+            }
+        })
+    }
+}
+
+exports.pre_key_manager = pre_key_manager
+module.exports = { pre_key_manager }