@ethora/chat-component-rn 26.8.6 → 26.8.7

package/src/e2ee/protobuf.ts

@@ -0,0 +1,188 @@
+import { concatBytes } from './crypto';
+
+const VARINT = 0;
+const FIXED64 = 1;
+const BYTES = 2;
+const FIXED32 = 5;
+
+function varint(value: number): number[] {
+  if (!Number.isInteger(value) || value < 0 || value > 0xffffffff) {
+    throw new Error(`Invalid uint32: ${value}`);
+  }
+  const out: number[] = [];
+  while (value > 0x7f) {
+    out.push(value % 0x80 | 0x80);
+    value = Math.floor(value / 0x80);
+  }
+  out.push(value);
+  return out;
+}
+
+class Writer {
+  private parts: Uint8Array[] = [];
+
+  uint(field: number, value: number): this {
+    this.parts.push(
+      Uint8Array.from([...varint((field << 3) | VARINT), ...varint(value)])
+    );
+    return this;
+  }
+
+  bytes(field: number, value: Uint8Array | undefined): this {
+    if (value === undefined) {return this;}
+    this.parts.push(
+      Uint8Array.from([
+        ...varint((field << 3) | BYTES),
+        ...varint(value.length),
+      ]),
+      value
+    );
+    return this;
+  }
+
+  finish(): Uint8Array {
+    return concatBytes(...this.parts);
+  }
+}
+
+function read(buf: Uint8Array): Map<number, number | Uint8Array> {
+  const fields = new Map<number, number | Uint8Array>();
+  let pos = 0;
+
+  const readVarint = () => {
+    let result = 0;
+    let scale = 1;
+    for (let i = 0; i < 10; i++) {
+      if (pos >= buf.length) {throw new Error('Truncated varint');}
+      const b = buf[pos++]!;
+      result += (b & 0x7f) * scale;
+      if (!(b & 0x80)) {return result;}
+      scale *= 0x80;
+    }
+    throw new Error('Varint too long');
+  };
+
+  const skip = (length: number) => {
+    if (pos + length > buf.length) {throw new Error('Truncated field');}
+    pos += length;
+  };
+
+  while (pos < buf.length) {
+    const tag = readVarint();
+    const field = Math.floor(tag / 8);
+    switch (tag % 8) {
+      case VARINT:
+        fields.set(field, readVarint());
+        break;
+      case BYTES: {
+        const length = readVarint();
+        const start = pos;
+        skip(length);
+        fields.set(field, buf.subarray(start, pos));
+        break;
+      }
+      case FIXED64:
+        skip(8);
+        break;
+      case FIXED32:
+        skip(4);
+        break;
+      default:
+        throw new Error('Unsupported wire type');
+    }
+  }
+  return fields;
+}
+
+function requireUint(
+  fields: Map<number, number | Uint8Array>,
+  field: number
+): number {
+  const value = fields.get(field);
+  if (typeof value !== 'number' || value > 0xffffffff) {
+    throw new Error(`Missing field ${field}`);
+  }
+  return value;
+}
+
+function requireBytes(
+  fields: Map<number, number | Uint8Array>,
+  field: number
+): Uint8Array {
+  const value = fields.get(field);
+  if (!(value instanceof Uint8Array)) {throw new Error(`Missing field ${field}`);}
+  // Copy, so stored values don't keep the whole input buffer alive
+  return value.slice();
+}
+
+export interface OmemoMessage {
+  n: number;
+  pn: number;
+  dhPub: Uint8Array;
+  ciphertext?: Uint8Array;
+}
+
+export function encodeMessage(m: OmemoMessage): Uint8Array {
+  return new Writer()
+    .uint(1, m.n)
+    .uint(2, m.pn)
+    .bytes(3, m.dhPub)
+    .bytes(4, m.ciphertext)
+    .finish();
+}
+
+export function decodeMessage(buf: Uint8Array): OmemoMessage {
+  const f = read(buf);
+  const ciphertext = f.get(4);
+  return {
+    n: requireUint(f, 1),
+    pn: requireUint(f, 2),
+    dhPub: requireBytes(f, 3),
+    ciphertext:
+      ciphertext instanceof Uint8Array ? ciphertext.slice() : undefined,
+  };
+}
+
+export interface AuthenticatedMessage {
+  mac: Uint8Array;
+  message: Uint8Array;
+}
+
+export function encodeAuthenticated(m: AuthenticatedMessage): Uint8Array {
+  return new Writer().bytes(1, m.mac).bytes(2, m.message).finish();
+}
+
+export function decodeAuthenticated(buf: Uint8Array): AuthenticatedMessage {
+  const f = read(buf);
+  return { mac: requireBytes(f, 1), message: requireBytes(f, 2) };
+}
+
+export interface KeyExchange {
+  pkId: number;
+  spkId: number;
+  ik: Uint8Array;
+  ek: Uint8Array;
+  /** Encoded OMEMOAuthenticatedMessage. */
+  message: Uint8Array;
+}
+
+export function encodeKeyExchange(m: KeyExchange): Uint8Array {
+  return new Writer()
+    .uint(1, m.pkId)
+    .uint(2, m.spkId)
+    .bytes(3, m.ik)
+    .bytes(4, m.ek)
+    .bytes(5, m.message)
+    .finish();
+}
+
+export function decodeKeyExchange(buf: Uint8Array): KeyExchange {
+  const f = read(buf);
+  return {
+    pkId: requireUint(f, 1),
+    spkId: requireUint(f, 2),
+    ik: requireBytes(f, 3),
+    ek: requireBytes(f, 4),
+    message: requireBytes(f, 5),
+  };
+}

package/src/e2ee/ratchet.ts

@@ -0,0 +1,271 @@
+import {
+  aesDecrypt,
+  aesEncrypt,
+  bytesEqual,
+  concatBytes,
+  dh,
+  generateKeyPair,
+  hkdfSha256,
+  hmacSha256,
+  identityDhPrivate,
+  identityDhPublic,
+  randomBytes,
+  toBase64,
+  verify,
+  type IdentityKey,
+  type KeyPair,
+} from './crypto';
+import {
+  decodeAuthenticated,
+  decodeMessage,
+  encodeAuthenticated,
+  encodeMessage,
+} from './protobuf';
+
+const MAX_SKIP = 1000;
+const X3DH_PREFIX = new Uint8Array(32).fill(0xff);
+
+export interface Bundle {
+  ik: Uint8Array;
+  spkId: number;
+  spk: Uint8Array;
+  spkSignature: Uint8Array;
+  pkId: number;
+  pk: Uint8Array;
+}
+
+export interface Session {
+  rk: Uint8Array;
+  dhs: KeyPair;
+  dhr?: Uint8Array;
+  cks?: Uint8Array;
+  ckr?: Uint8Array;
+  ns: number;
+  nr: number;
+  pn: number;
+  skipped: Record<string, Uint8Array>;
+  ad: Uint8Array;
+  peerIk: Uint8Array;
+  pendingKex?: { pkId: number; spkId: number; ek: Uint8Array };
+  kexEk?: Uint8Array;
+}
+
+export function cloneSession(session: Session): Session {
+  const skipped: Record<string, Uint8Array> = {};
+  for (const id of Object.keys(session.skipped)) {
+    skipped[id] = session.skipped[id]!.slice();
+  }
+  return {
+    rk: session.rk.slice(),
+    dhs: { priv: session.dhs.priv.slice(), pub: session.dhs.pub.slice() },
+    ...(session.dhr ? { dhr: session.dhr.slice() } : {}),
+    ...(session.cks ? { cks: session.cks.slice() } : {}),
+    ...(session.ckr ? { ckr: session.ckr.slice() } : {}),
+    ns: session.ns,
+    nr: session.nr,
+    pn: session.pn,
+    skipped,
+    ad: session.ad.slice(),
+    peerIk: session.peerIk.slice(),
+    ...(session.pendingKex
+      ? {
+          pendingKex: {
+            pkId: session.pendingKex.pkId,
+            spkId: session.pendingKex.spkId,
+            ek: session.pendingKex.ek.slice(),
+          },
+        }
+      : {}),
+    ...(session.kexEk ? { kexEk: session.kexEk.slice() } : {}),
+  };
+}
+
+function kdfRk(rk: Uint8Array, dhOut: Uint8Array): [Uint8Array, Uint8Array] {
+  const out = hkdfSha256(dhOut, rk, 'OMEMO Root Chain', 64);
+  return [out.slice(0, 32), out.slice(32)];
+}
+
+function kdfCk(ck: Uint8Array): [Uint8Array, Uint8Array] {
+  return [
+    hmacSha256(ck, Uint8Array.of(0x02)),
+    hmacSha256(ck, Uint8Array.of(0x01)),
+  ];
+}
+
+function messageKeys(mk: Uint8Array) {
+  const km = hkdfSha256(mk, undefined, 'OMEMO Message Key Material', 80);
+  return { enc: km.slice(0, 32), auth: km.slice(32, 64), iv: km.slice(64) };
+}
+
+function x3dhSecret(...dhs: Uint8Array[]): Uint8Array {
+  return hkdfSha256(
+    concatBytes(X3DH_PREFIX, ...dhs),
+    undefined,
+    'OMEMO X3DH',
+    32
+  );
+}
+
+export function initiateSession(own: IdentityKey, bundle: Bundle): Session {
+  if (!verify(bundle.spkSignature, bundle.spk, bundle.ik)) {
+    throw new Error('Invalid signed prekey signature');
+  }
+  const ek = generateKeyPair();
+  const sk = x3dhSecret(
+    dh(identityDhPrivate(own), bundle.spk),
+    dh(ek.priv, identityDhPublic(bundle.ik)),
+    dh(ek.priv, bundle.spk),
+    dh(ek.priv, bundle.pk)
+  );
+
+  const dhs = generateKeyPair();
+  const [rk, cks] = kdfRk(sk, dh(dhs.priv, bundle.spk));
+  return {
+    rk,
+    dhs,
+    dhr: bundle.spk,
+    cks,
+    ns: 0,
+    nr: 0,
+    pn: 0,
+    skipped: {},
+    ad: concatBytes(own.pub, bundle.ik),
+    peerIk: bundle.ik,
+    pendingKex: { pkId: bundle.pkId, spkId: bundle.spkId, ek: ek.pub },
+  };
+}
+
+export function acceptSession(
+  own: IdentityKey,
+  spk: KeyPair,
+  pk: KeyPair,
+  peerIk: Uint8Array,
+  ek: Uint8Array
+): Session {
+  const sk = x3dhSecret(
+    dh(spk.priv, identityDhPublic(peerIk)),
+    dh(identityDhPrivate(own), ek),
+    dh(spk.priv, ek),
+    dh(pk.priv, ek)
+  );
+  return {
+    rk: sk,
+    dhs: spk,
+    ns: 0,
+    nr: 0,
+    pn: 0,
+    skipped: {},
+    ad: concatBytes(peerIk, own.pub),
+    peerIk,
+    kexEk: ek,
+  };
+}
+
+export function ratchetEncrypt(
+  session: Session,
+  plaintext: Uint8Array
+): [Session, Uint8Array] {
+  if (!session.cks) {throw new Error('Session cannot send yet');}
+  const s = cloneSession(session);
+  const [cks, mk] = kdfCk(s.cks!);
+  s.cks = cks;
+
+  const { enc, auth, iv } = messageKeys(mk);
+  const message = encodeMessage({
+    n: s.ns,
+    pn: s.pn,
+    dhPub: s.dhs.pub,
+    ciphertext: aesEncrypt(enc, iv, plaintext),
+  });
+  s.ns++;
+  const mac = hmacSha256(auth, concatBytes(s.ad, message)).slice(0, 16);
+  return [s, encodeAuthenticated({ mac, message })];
+}
+
+export function ratchetDecrypt(
+  session: Session,
+  data: Uint8Array
+): [Session, Uint8Array] {
+  const { mac, message } = decodeAuthenticated(data);
+  const header = decodeMessage(message);
+  if (!header.ciphertext) {throw new Error('Message without ciphertext');}
+  const s = cloneSession(session);
+
+  const decrypt = (mk: Uint8Array) => {
+    const { enc, auth, iv } = messageKeys(mk);
+    const expected = hmacSha256(auth, concatBytes(s.ad, message)).slice(0, 16);
+    if (!bytesEqual(expected, mac)) {
+      throw new Error('Message authentication failed');
+    }
+    return aesDecrypt(enc, iv, header.ciphertext!);
+  };
+
+  const skippedId = `${toBase64(header.dhPub)}:${header.n}`;
+  const skippedKey = s.skipped[skippedId];
+  if (skippedKey) {
+    delete s.skipped[skippedId];
+    return [s, decrypt(skippedKey)];
+  }
+
+  if (!s.dhr || !bytesEqual(header.dhPub, s.dhr)) {
+    skipMessageKeys(s, header.pn);
+    s.pn = s.ns;
+    s.ns = 0;
+    s.nr = 0;
+    s.dhr = header.dhPub;
+    [s.rk, s.ckr] = kdfRk(s.rk, dh(s.dhs.priv, s.dhr));
+    s.dhs = generateKeyPair();
+    [s.rk, s.cks] = kdfRk(s.rk, dh(s.dhs.priv, s.dhr));
+  }
+
+  skipMessageKeys(s, header.n);
+  const [ckr, mk] = kdfCk(s.ckr!);
+  s.ckr = ckr;
+  s.nr++;
+  return [s, decrypt(mk)];
+}
+
+function skipMessageKeys(s: Session, until: number) {
+  if (!s.ckr || !s.dhr) {return;}
+  if (until - s.nr > MAX_SKIP) {throw new Error('Too many skipped messages');}
+  const dhr = toBase64(s.dhr);
+  while (s.nr < until) {
+    const [ckr, mk] = kdfCk(s.ckr);
+    s.ckr = ckr;
+    s.skipped[`${dhr}:${s.nr}`] = mk;
+    s.nr++;
+  }
+  const ids = Object.keys(s.skipped);
+  for (const id of ids.slice(0, Math.max(0, ids.length - MAX_SKIP))) {
+    delete s.skipped[id];
+  }
+}
+
+function payloadKeys(key: Uint8Array) {
+  const km = hkdfSha256(key, undefined, 'OMEMO Payload', 80);
+  return { enc: km.slice(0, 32), auth: km.slice(32, 64), iv: km.slice(64) };
+}
+
+export function encryptPayload(plaintext: Uint8Array): {
+  keyMaterial: Uint8Array;
+  payload: Uint8Array;
+} {
+  const key = randomBytes(32);
+  const { enc, auth, iv } = payloadKeys(key);
+  const payload = aesEncrypt(enc, iv, plaintext);
+  const mac = hmacSha256(auth, payload).slice(0, 16);
+  return { keyMaterial: concatBytes(key, mac), payload };
+}
+
+export function decryptPayload(
+  keyMaterial: Uint8Array,
+  payload: Uint8Array
+): Uint8Array {
+  if (keyMaterial.length !== 48) {throw new Error('Invalid key material');}
+  const { enc, auth, iv } = payloadKeys(keyMaterial.slice(0, 32));
+  const expected = hmacSha256(auth, payload).slice(0, 16);
+  if (!bytesEqual(expected, keyMaterial.slice(32))) {
+    throw new Error('Payload authentication failed');
+  }
+  return aesDecrypt(enc, iv, payload);
+}

package/src/e2ee/sealedBody.ts

@@ -0,0 +1,17 @@
+export function parseSealedMediaBody(body?: string): string[] | undefined {
+  const text = String(body || '').trim();
+  if (!text.startsWith('{')) {return undefined;}
+
+  try {
+    const parsed = JSON.parse(text) as { v?: unknown; keys?: unknown };
+    if (parsed?.v !== 1 || !Array.isArray(parsed.keys)) {return undefined;}
+    const keys = parsed.keys.filter(
+      (k): k is string => typeof k === 'string' && k.length > 0
+    );
+    return keys.length === parsed.keys.length && keys.length > 0
+      ? keys
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}

package/src/e2ee/sealedFiles.ts

@@ -0,0 +1,181 @@
+import { Directory, File as FsFile, Paths } from 'expo-file-system';
+import * as LegacyFileSystem from 'expo-file-system/legacy';
+import { ensureFilenameHasExtension } from '../helpers/mimeToExtension';
+import { sanitizeFileNameForPath } from '../helpers/getDisplayFileName';
+import { openSealedFile, sealFileForUpload } from './fileEnvelope';
+import type { Progress } from './fileCipher';
+import { MAX_OPEN_BYTES, MAX_SEAL_BYTES } from './limits';
+
+export { MAX_OPEN_BYTES, MAX_SEAL_BYTES };
+
+const OPENED_DIR = 'ethora-sealed';
+
+export interface SealedUpload {
+  uri: string;
+  name: string;
+  keyMaterial: string;
+  dispose(): void;
+}
+
+export interface OpenedFile {
+  uri: string;
+  name: string;
+  mimetype: string;
+  size: number;
+}
+
+const hashString = (value: string) => {
+  let hash = 5381;
+  for (let i = 0; i < value.length; i++) {
+    hash = (hash * 33) ^ value.charCodeAt(i);
+  }
+  return (hash >>> 0).toString(36);
+};
+
+export async function sealPickedFile(
+  picked: { uri: string; name?: string; type?: string; size?: number },
+  onProgress?: Progress
+): Promise<SealedUpload> {
+  if (typeof picked.size === 'number' && picked.size > MAX_SEAL_BYTES) {
+    throw new Error('sealed_attachment_too_large');
+  }
+  const bytes = await new FsFile(picked.uri).bytes();
+  if (bytes.length > MAX_SEAL_BYTES) {
+    throw new Error('sealed_attachment_too_large');
+  }
+  const sealed = await sealFileForUpload(
+    { bytes, name: picked.name, type: picked.type },
+    onProgress
+  );
+  const parked = new FsFile(Paths.cache, `ethora-seal-${sealed.filename}`);
+  parked.write(sealed.ciphertext);
+  return {
+    uri: parked.uri,
+    name: sealed.filename,
+    keyMaterial: sealed.keyMaterial,
+    dispose: () => {
+      try {
+        if (parked.exists) {parked.delete();}
+      } catch {
+      }
+    },
+  };
+}
+
+const folderFor = (location: string): Directory =>
+  new Directory(
+    Paths.cache,
+    OPENED_DIR,
+    hashString(location.split('#')[0]!.split('?')[0]!)
+  );
+
+const noteIn = (folder: Directory) => new FsFile(folder, 'meta.json');
+
+export async function findOpened(location: string): Promise<OpenedFile | null> {
+  if (!location) {return null;}
+  try {
+    const folder = folderFor(location);
+    const note = noteIn(folder);
+    if (!note.exists) {return null;}
+    const opened = JSON.parse(await note.text()) as OpenedFile;
+    return new FsFile(opened.uri).exists ? opened : null;
+  } catch {
+    return null;
+  }
+}
+
+function keep(
+  location: string,
+  meta: { name: string; mimetype: string; size: number },
+  write: (target: FsFile) => void | Promise<void>
+): Promise<OpenedFile> {
+  return (async () => {
+    const folder = folderFor(location);
+    folder.create({ intermediates: true, idempotent: true });
+    const name =
+      sanitizeFileNameForPath(
+        ensureFilenameHasExtension(meta.name, meta.mimetype)
+      ).replace(/^\.+/, '') || 'file';
+    const target = new FsFile(folder, name);
+    if (target.exists) {target.delete();}
+    await write(target);
+    const opened: OpenedFile = {
+      uri: target.uri,
+      name: meta.name,
+      mimetype: meta.mimetype,
+      size: meta.size,
+    };
+    const note = noteIn(folder);
+    if (note.exists) {note.delete();}
+    note.write(JSON.stringify(opened));
+    return opened;
+  })();
+}
+
+const opening = new Map<string, Promise<OpenedFile>>();
+
+export function openSealedAttachment(
+  location: string,
+  url: string,
+  keyMaterial: string,
+  onProgress?: Progress
+): Promise<OpenedFile> {
+  const running = opening.get(location);
+  if (running) {return running;}
+
+  const task = (async () => {
+    const kept = await findOpened(location);
+    if (kept) {return kept;}
+
+    const parked = new FsFile(Paths.cache, `ethora-open-${hashString(location)}`);
+    try {
+      if (parked.exists) {parked.delete();}
+      const download = await LegacyFileSystem.downloadAsync(url, parked.uri);
+      if (download.status < 200 || download.status >= 300) {
+        throw new Error(`sealed_attachment_http_${download.status}`);
+      }
+      if ((parked.size ?? 0) > MAX_OPEN_BYTES) {
+        throw new Error('sealed_attachment_too_large');
+      }
+      const ciphertext = await parked.bytes();
+      const { meta, bytes } = await openSealedFile(ciphertext, keyMaterial, onProgress);
+      return await keep(
+        location,
+        { name: meta.originalname, mimetype: meta.mimetype, size: bytes.length },
+        (target) => target.write(bytes)
+      );
+    } finally {
+      try {
+        if (parked.exists) {parked.delete();}
+      } catch {
+      }
+    }
+  })().finally(() => opening.delete(location));
+  opening.set(location, task);
+  return task;
+}
+
+export async function rememberOpened(
+  location: string,
+  source: { uri: string; name?: string; type?: string; size?: number }
+): Promise<void> {
+  if (!location || !source?.uri) {return;}
+  const original = new FsFile(source.uri);
+  await keep(
+    location,
+    {
+      name: source.name || 'blob',
+      mimetype: source.type || 'application/octet-stream',
+      size: source.size ?? original.size ?? 0,
+    },
+    (target) => original.copy(target)
+  );
+}
+
+export function clearOpenedFiles(): void {
+  try {
+    const root = new Directory(Paths.cache, OPENED_DIR);
+    if (root.exists) {root.delete();}
+  } catch {
+  }
+}