@lifeready/core 1.0.1 → 1.0.3

package/src/lib/api/message.service.ts

@@ -1,210 +0,0 @@
-import { Injectable } from '@angular/core';
-import gql from 'graphql-tag';
-import { JWK } from 'node-jose';
-import { EncryptionService } from '../cryptography/encryption.service';
-import { KeyGraphService } from '../cryptography/key-graph.service';
-import { KeyGraphFragment } from '../_common/queries.gql';
-import { KeyExchangeService } from './key-exchange.service';
-import { LrApolloService } from './lr-apollo.service';
-import { KeyFactoryService as KFS } from '../cryptography/key-factory.service';
-
-export const SendMessageMutation = gql`
-  mutation SendMessage($input: SendMessageInput!) {
-    sendMessage(input: $input) {
-      message {
-        id
-      }
-    }
-  }
-`;
-
-export const MessageQuery = gql`
-  query Message($id: LrRelayIdInput!) {
-    message(id: $id) {
-      id
-      sender {
-        username
-      }
-      receiver {
-        username
-      }
-      plainMessage
-      signedCipherMessage
-      sharedKey {
-        id
-      }
-      senderSigPbk {
-        id
-      }
-    }
-    keyGraph {
-      ...KeyGraphFragment
-    }
-  }
-  ${KeyGraphFragment}
-`;
-
-export interface SendMessage {
-  message: {
-    id: string;
-  };
-}
-
-export interface SendMessageInput {
-  username?: string;
-  userId?: string;
-  plainMessageJson?: any;
-  plainCipherMessageJson?: any;
-}
-
-export interface Message {
-  id: string;
-  sender: {
-    id: string;
-    username: string;
-  };
-  receiver: {
-    id: string;
-    username: string;
-  };
-  plainMessage: string;
-  plainMessageJson?: any;
-  signedCipherMessage: string;
-  plainSignedCipherMessageJson?: any;
-  senderSigPbk: {
-    id: string;
-  };
-  sharedKey: {
-    id: string;
-  };
-}
-
-interface DecryptMessageOptions {
-  sharedKey: JWK.Key;
-  senderSigPbk: JWK.Key;
-}
-
-@Injectable({
-  providedIn: 'root',
-})
-export class MessageService {
-  private readonly encrypt = this.encryptionService.encrypt.bind(
-    this.encryptionService
-  );
-  private readonly decrypt = this.encryptionService.decrypt.bind(
-    this.encryptionService
-  );
-  private readonly sign = this.encryptionService.sign.bind(
-    this.encryptionService
-  );
-  private readonly verify = this.encryptionService.verify.bind(
-    this.encryptionService
-  );
-
-  constructor(
-    private lrApollo: LrApolloService,
-    private keyGraph: KeyGraphService,
-    private encryptionService: EncryptionService,
-    private keyExchangeService: KeyExchangeService
-  ) {}
-
-  async sendMessage({
-    username,
-    userId,
-    plainMessageJson,
-    plainCipherMessageJson,
-  }: SendMessageInput): Promise<SendMessage> {
-    const userSharedKey = await this.keyExchangeService.currentUserSharedKey({
-      username,
-      userId,
-    });
-
-    const input: any = {
-      receiverUsername: username,
-      receiverId: userId,
-      sharedKeyId: userSharedKey.sharedKey.id,
-      senderSigPbkId: userSharedKey.userSigPrk.id,
-    };
-
-    if (plainCipherMessageJson) {
-      const sharedKey = await this.keyGraph.getJwkKey(
-        userSharedKey.sharedKey.id
-      );
-      const cipherMessage = await this.encrypt(
-        sharedKey,
-        plainCipherMessageJson
-      );
-
-      const senderSigPrk = await this.keyGraph.getJwkKey(
-        userSharedKey.userSigPrk.id
-      );
-      const signedCipherMessage = await this.sign(senderSigPrk, cipherMessage);
-
-      input.signedCipherMessage = JSON.stringify(signedCipherMessage);
-    }
-
-    if (plainMessageJson) {
-      input.plainMessage = JSON.stringify(plainMessageJson);
-    }
-
-    const res = await this.lrApollo.query<any>({
-      query: SendMessageMutation,
-      variables: {
-        input,
-      },
-    });
-
-    return res.sendMessage;
-  }
-
-  async decryptMessage(
-    message: Message,
-    { sharedKey, senderSigPbk }: DecryptMessageOptions
-  ): Promise<void> {
-    const signedCipherMessage = await this.verify(
-      senderSigPbk,
-      JSON.parse(message.signedCipherMessage)
-    );
-
-    message.plainSignedCipherMessageJson = await this.decrypt(
-      sharedKey,
-      signedCipherMessage
-    );
-  }
-
-  async getMessage(id: string): Promise<Message> {
-    const res = await this.lrApollo.query<any>({
-      query: MessageQuery,
-      variables: {
-        id,
-      },
-    });
-
-    this.keyGraph.addKeys(res.keyGraph);
-
-    const message = res.message as Message;
-
-    const sharedKey = await this.keyGraph.getJwkKey(message.sharedKey.id);
-
-    // The sender would be getting the Prk back. The receiver gets the Pbk back.
-    // But only the Pbk is needed here to verify signature.
-    // So both sender and receiver can access this message.
-    const senderSigPbk = await this.keyGraph.getJwkKey(message.senderSigPbk.id);
-
-    // Test bad signature
-    // senderSigPbk = senderSigPbk.toJSON();
-    // senderSigPbk.n = "x" + senderSigPbk.n.substring(1);
-    // senderSigPbk = await KFS.asKey(senderSigPbk);
-
-    await this.decryptMessage(message, {
-      sharedKey,
-      senderSigPbk,
-    });
-
-    if (message.plainMessage) {
-      message.plainMessageJson = JSON.parse(message.plainMessage);
-    }
-
-    return res.message;
-  }
-}

package/src/lib/api/persist.service.spec.ts

@@ -1,209 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import {
-  delaySec,
-  lrConfigureTestingModule,
-  lrExpectAsyncThrow,
-  lrit,
-} from '../_common/tests';
-import { PersistService } from 'projects/core/src/lib/api/persist.service';
-import {
-  loginTestUser,
-  logoutUser,
-} from '../auth/life-ready-auth.service.spec';
-import { EncryptionService } from '../cryptography/encryption.service';
-import { JWK } from 'node-jose';
-import { CookieService } from 'ngx-cookie-service';
-import { LifeReadyConfig, LR_CONFIG } from '../life-ready.config';
-
-const TIMEOUT = 1000 * 60 * 10;
-
-describe('PersistService', () => {
-  let persistService: PersistService;
-  let encryptionService: EncryptionService;
-  let cookieService: CookieService;
-  let config: LifeReadyConfig;
-
-  beforeEach(async () => {
-    lrConfigureTestingModule();
-    persistService = TestBed.inject(PersistService);
-    encryptionService = TestBed.inject(EncryptionService);
-    cookieService = TestBed.inject(CookieService);
-    config = TestBed.inject(LR_CONFIG);
-  }, TIMEOUT);
-
-  function expiresAfter(seconds: number) {
-    return new Date(Date.now() + 1000 * seconds);
-  }
-
-  lrit(
-    'should persist',
-    async () => {
-      let res: any;
-      const name1 = 'name1';
-      const value1 = 'value1';
-      const name2 = 'name2';
-      const value2 = {
-        test: 2,
-      };
-      const name3 = 'name3';
-      const value3 = {
-        test: 3,
-      };
-
-      await persistService.set({
-        name: name1,
-        value: value1,
-        serverSession: false,
-      });
-      res = await persistService.get(name1);
-      console.log('res:', res);
-      expect(res).toEqual(value1);
-
-      await persistService.set({
-        name: name2,
-        value: value2,
-        serverSession: false,
-      });
-      res = await persistService.get(name2);
-      console.log('res:', res);
-      expect(res).toEqual(value2);
-
-      await persistService.set({
-        name: name3,
-        value: value3,
-        serverSession: false,
-        expiry: expiresAfter(3),
-      });
-      res = await persistService.get(name3);
-      console.log('res:', res);
-      expect(res).toEqual(value3);
-
-      await delaySec(1);
-      res = await persistService.get(name3);
-      console.log('res:', res);
-      expect(res).toEqual(value3);
-
-      await delaySec(2);
-      await delaySec(1); // give it some buffer to make sure it's expired.
-      res = await persistService.get(name3);
-      console.log('res:', res);
-      expect(res).toBeNull();
-    },
-    TIMEOUT
-  );
-
-  lrit(
-    'should persist with serverSession',
-    async () => {
-      expect(config.disableSessionEncryptionKey).toBeFalsy(
-        'Current tests can not run because disableSessionEncryptionKey=True. You can ignore this if this is deliberate decision.'
-      );
-
-      let res: any;
-      const name1 = 'name1';
-      const value1 = 'value1';
-      const name2 = 'name2';
-      const value2 = {
-        test: 2,
-      };
-      const name3 = 'name3';
-      const value3 = {
-        test: 3,
-      };
-
-      await logoutUser();
-
-      (
-        await lrExpectAsyncThrow(
-          persistService.set({
-            name: name1,
-            value: value1,
-            serverSession: true,
-          })
-        )
-      ).toBeTruthy('Pre-auth will should not have session key.');
-
-      const user = await loginTestUser();
-
-      // --------------------------------------------------------
-      // Test with server session
-      // --------------------------------------------------------
-      await persistService.set({
-        name: name1,
-        value: value1,
-        serverSession: true,
-      });
-
-      res = await persistService.get(name1);
-      expect(res).toEqual(value1);
-
-      // Independently make sure the encryption is done properly in localstorage and cookies.
-      res = await encryptionService.decrypt(
-        await JWK.asKey(JSON.parse(user.sessionEncryptionKey)),
-        JSON.parse(localStorage.getItem(`lrSession-${name1}`)).data
-      );
-      expect(res).toEqual(value1);
-      expect(cookieService.get(`lrSession-${name1}`)).toBe('');
-
-      // --------------------------------------------------------
-      // Test with cookie expiry
-      // --------------------------------------------------------
-      await persistService.set({
-        name: name1,
-        value: value1,
-        serverSession: false,
-        expiry: new Date(Date.now() + 1000 * 2),
-      });
-      res = await persistService.get(name1);
-      expect(res).toEqual(value1);
-
-      // Manual verification
-      res = await encryptionService.decrypt(
-        // Cookie key
-        await JWK.asKey(
-          JSON.parse(cookieService.get(`lrSession-${name1}`)).key
-        ),
-        JSON.parse(localStorage.getItem(`lrSession-${name1}`)).data
-      );
-      expect(res).toEqual(value1);
-
-      await delaySec(2);
-
-      res = await persistService.get(name1);
-      expect(res).toBeNull('Should have expired');
-
-      // --------------------------------------------------------
-      // Test with both server session and cookie expiry
-      // --------------------------------------------------------
-      await persistService.set({
-        name: name1,
-        value: value1,
-        serverSession: true,
-        expiry: new Date(Date.now() + 1000 * 2),
-      });
-
-      res = await persistService.get(name1);
-      expect(res).toEqual(value1);
-
-      // Manual verification
-      res = await encryptionService.decrypt(
-        // Cookie key
-        await JWK.asKey(
-          JSON.parse(cookieService.get(`lrSession-${name1}`)).key
-        ),
-        JSON.parse(localStorage.getItem(`lrSession-${name1}`)).data
-      );
-      res = await encryptionService.decrypt(
-        // session key
-        await JWK.asKey(JSON.parse(user.sessionEncryptionKey)),
-        res
-      );
-      expect(res).toEqual(value1);
-
-      await delaySec(2);
-      res = await persistService.get(name1);
-      expect(res).toBeNull('Should have expired');
-    },
-    TIMEOUT
-  );
-});

package/src/lib/api/persist.service.ts

@@ -1,220 +0,0 @@
-import { JWK } from 'node-jose';
-import { Injectable, Injector } from '@angular/core';
-import { CookieService } from 'ngx-cookie-service';
-import { EncryptionService } from '../cryptography/encryption.service';
-import { isDevMode } from '@angular/core';
-import { LrBadArgumentException } from '../_common/exceptions';
-import { KeyFactoryService as KFS } from '../cryptography/key-factory.service';
-
-interface Item {
-  data: string;
-  expiry?: string; // iso format
-  serverSession?: boolean;
-}
-
-interface CookieItem {
-  key: any;
-}
-
-@Injectable({
-  providedIn: 'root',
-})
-export class PersistService {
-  private readonly KEY_PREFIX = 'lrSession-';
-
-  private cookieSecure = true;
-  private serverSessionEncryptionKey: JWK.Key = null;
-
-  constructor(
-    private keyFactory: KFS,
-    private cookieService: CookieService,
-    private encryptionService: EncryptionService,
-    private injector: Injector
-  ) {
-    if (isDevMode()) {
-      this.setCookieSecure(false);
-    }
-  }
-
-  setServerSessionEncryptionKey(key: JWK.Key) {
-    this.serverSessionEncryptionKey = key;
-  }
-
-  clearServerSessionEncryptionKey() {
-    this.serverSessionEncryptionKey = null;
-  }
-
-  // It's important that set and delete cookie use exactly the same set of parameters.
-  private getCookieParams() {
-    return {
-      path: '/',
-      domain: null, // which means the current domain of the frontend app.
-      secure: this.cookieSecure,
-      sameSite: 'Lax' as 'Lax' | 'None' | 'Strict',
-    };
-  }
-
-  public clear() {
-    // Remove all cookies
-    Object.keys(this.cookieService.getAll()).forEach((key) => {
-      if (key.startsWith(this.KEY_PREFIX)) {
-        this.deletePrefixedName(key);
-      }
-    });
-
-    // Remove all persisted session variables
-    Object.keys(localStorage).forEach((key) => {
-      if (key.startsWith(this.KEY_PREFIX)) {
-        this.deletePrefixedName(key);
-      }
-    });
-  }
-
-  public setCookieSecure(value: boolean) {
-    this.cookieSecure = value;
-    if (!value) {
-      if (isDevMode()) {
-        console.warn(
-          'The cookie secure flag in persistService has been set to false, set it to true in production mode'
-        );
-      } else {
-        throw new LrBadArgumentException(
-          'Can not set PersistService cookie secure flag to false in production mode.'
-        );
-      }
-    }
-  }
-
-  private prefixName(name: string): string {
-    return this.KEY_PREFIX + name;
-  }
-
-  public delete(name: string): void {
-    this.deletePrefixedName(this.prefixName(name));
-  }
-
-  private deletePrefixedName(prefixedName: string): void {
-    const params = this.getCookieParams();
-    this.cookieService.delete(
-      prefixedName, // name: string,
-      params.path, // path?: string,
-      params.domain, // domain ?: string,
-      params.secure, // secure ?: boolean,
-      params.sameSite // sameSite ?: 'Lax' | 'None' | 'Strict'): void;
-    );
-    localStorage.removeItem(prefixedName);
-  }
-
-  public async set({
-    name,
-    value,
-    serverSession,
-    expiry,
-  }: {
-    name: string;
-    value: any;
-    serverSession: boolean;
-    expiry?: Date;
-  }): Promise<void> {
-    const prefixedName = this.prefixName(name);
-
-    let item: Item;
-
-    if (serverSession) {
-      item = {
-        serverSession: true,
-        data: await this.encryptionService.encryptToString(
-          this.serverSessionEncryptionKey,
-          value
-        ),
-      };
-    } else {
-      item = {
-        data: value,
-      };
-    }
-
-    if (expiry) {
-      const key = await this.keyFactory.createKey();
-      item.expiry = expiry.toISOString();
-      item.data = await this.encryptionService.encryptToString(key, item.data);
-
-      const cookieItem: CookieItem = {
-        key: key.toJSON(true),
-      };
-
-      // If path is set to anything other than "/" then the cookie is only
-      // accessible by JS if the current URL has the same prefix as the path.
-      // Ideally we don't want the encryption key cookie to be sent at all, but
-      // since the encrypted content is held in localstorage, it is not a security
-      // risk, i.e. it is at least as secure as storing only in localstorage.
-      const params = this.getCookieParams();
-      this.cookieService.set(
-        prefixedName, // name: string,
-        JSON.stringify(cookieItem), // value: string,
-        expiry, // expires?: number | Date,
-        params.path, // path?: string,
-        params.domain, // domain?: string,
-        params.secure, // secure?: boolean,
-        params.sameSite // sameSite?: 'Lax' | 'None' | 'Strict'
-      );
-    }
-
-    localStorage.setItem(prefixedName, JSON.stringify(item));
-  }
-
-  public async get(name: string): Promise<any> {
-    const prefixedName = this.prefixName(name);
-
-    try {
-      const ret = await this.getImpl(prefixedName);
-      if (ret == null) {
-        // Clear any cookies to keep things in sync.
-        this.deletePrefixedName(prefixedName);
-      }
-      return ret;
-    } catch (error) {
-      this.deletePrefixedName(prefixedName);
-      throw error;
-    }
-  }
-
-  private async getImpl(name: string): Promise<any> {
-    const itemString = localStorage.getItem(name);
-    if (!itemString) {
-      return null;
-    }
-
-    const item: Item = JSON.parse(itemString);
-
-    let data: any;
-
-    if (item.expiry) {
-      const cookieItemString = this.cookieService.get(name);
-      if (!cookieItemString) {
-        // Probably expired, but we won't make any interpretations since if we only used
-        // cookies we can't tell if it's expired or explicitly removed. So we just make
-        // the behaviour here consistent with that.
-        console.log('No cookie.');
-        return null;
-      }
-
-      const cookieItem = JSON.parse(cookieItemString);
-
-      const key = await KFS.asKey(cookieItem.key);
-
-      data = await this.encryptionService.decrypt(key, item.data);
-    } else {
-      data = item.data;
-    }
-
-    if (item.serverSession) {
-      data = await this.encryptionService.decrypt(
-        this.serverSessionEncryptionKey,
-        data
-      );
-    }
-
-    return data;
-  }
-}