@rei-standard/amsg-server 2.6.0-next.0 → 2.6.0-next.2

package/dist/{chunk-PJAW56VN.mjs → chunk-PVNLB6TF.mjs}

@@ -162,53 +162,127 @@ function validateScheduleMessagePayload(payload) {
   return { valid: true };
 }
 
+// src/server/lib/webcrypto-utils.js
+import { toUint8, concatBytes, base64UrlToBytes } from "@rei-standard/amsg-shared";
+var TEXT_ENCODER = new TextEncoder();
+var TEXT_DECODER = new TextDecoder("utf-8", { fatal: false });
+function utf8(str) {
+  return TEXT_ENCODER.encode(String(str));
+}
+function utf8Decode(buf) {
+  return TEXT_DECODER.decode(toUint8(buf));
+}
+function bytesToBase64(buf) {
+  const bytes = toUint8(buf);
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) {
+    bin += String.fromCharCode(bytes[i]);
+  }
+  return typeof btoa === "function" ? btoa(bin) : Buffer.from(bin, "binary").toString("base64");
+}
+function bytesToBase64Url(buf) {
+  return bytesToBase64(buf).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function bytesToHex(buf) {
+  const bytes = toUint8(buf);
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    out += bytes[i].toString(16).padStart(2, "0");
+  }
+  return out;
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+function jsonToBase64Url(value) {
+  return bytesToBase64Url(utf8(JSON.stringify(value)));
+}
+function randomUUID() {
+  return globalThis.crypto.randomUUID();
+}
+function randomBytes(n) {
+  const out = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(out);
+  return out;
+}
+
 // src/server/lib/encryption.js
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
-function deriveUserEncryptionKey(userId, masterKey) {
-  return createHash("sha256").update(masterKey + userId).digest("hex").slice(0, 64);
+var base64ToBytes = base64UrlToBytes;
+var TAG_LENGTH_BYTES = 16;
+function importAesKey(hexKey, usage) {
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    hexToBytes(hexKey),
+    { name: "AES-GCM" },
+    false,
+    [usage]
+  );
+}
+async function aesGcmSeal(hexKey, iv, plaintextBytes) {
+  const key = await importAesKey(hexKey, "encrypt");
+  const sealed = new Uint8Array(await globalThis.crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, tagLength: TAG_LENGTH_BYTES * 8 },
+    key,
+    plaintextBytes
+  ));
+  return {
+    ciphertext: sealed.slice(0, sealed.length - TAG_LENGTH_BYTES),
+    authTag: sealed.slice(sealed.length - TAG_LENGTH_BYTES)
+  };
+}
+async function aesGcmOpen(hexKey, iv, ciphertext, authTag) {
+  const key = await importAesKey(hexKey, "decrypt");
+  const tagBits = authTag.length * 8;
+  const tagLength = tagBits >= 96 && tagBits <= 128 ? tagBits : 128;
+  const plain = await globalThis.crypto.subtle.decrypt(
+    { name: "AES-GCM", iv, tagLength },
+    key,
+    concatBytes(ciphertext, authTag)
+  );
+  return new Uint8Array(plain);
 }
-function decryptPayload(encryptedPayload, encryptionKey) {
+async function deriveUserEncryptionKey(userId, masterKey) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", utf8(masterKey + userId));
+  return bytesToHex(new Uint8Array(digest)).slice(0, 64);
+}
+async function decryptPayload(encryptedPayload, encryptionKey) {
   const { iv, authTag, encryptedData } = encryptedPayload;
-  const decipher = createDecipheriv(
-    "aes-256-gcm",
-    Buffer.from(encryptionKey, "hex"),
-    Buffer.from(iv, "base64")
+  const plain = await aesGcmOpen(
+    encryptionKey,
+    base64ToBytes(iv),
+    base64ToBytes(encryptedData),
+    base64ToBytes(authTag)
   );
-  decipher.setAuthTag(Buffer.from(authTag, "base64"));
-  const decrypted = Buffer.concat([
-    decipher.update(Buffer.from(encryptedData, "base64")),
-    decipher.final()
-  ]);
-  return JSON.parse(decrypted.toString("utf8"));
+  return JSON.parse(utf8Decode(plain));
 }
-function encryptPayload(payload, encryptionKey) {
+async function encryptPayload(payload, encryptionKey) {
   const plaintext = typeof payload === "string" ? payload : JSON.stringify(payload);
   const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", Buffer.from(encryptionKey, "hex"), iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const authTag = cipher.getAuthTag();
+  const { ciphertext, authTag } = await aesGcmSeal(encryptionKey, iv, utf8(plaintext));
   return {
-    iv: iv.toString("base64"),
-    authTag: authTag.toString("base64"),
-    encryptedData: encrypted.toString("base64")
+    iv: bytesToBase64(iv),
+    authTag: bytesToBase64(authTag),
+    encryptedData: bytesToBase64(ciphertext)
   };
 }
-function encryptForStorage(text, encryptionKey) {
+async function encryptForStorage(text, encryptionKey) {
   const iv = randomBytes(16);
-  const cipher = createCipheriv("aes-256-gcm", Buffer.from(encryptionKey, "hex"), iv);
-  const encrypted = cipher.update(text, "utf8", "hex") + cipher.final("hex");
-  const authTag = cipher.getAuthTag();
-  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted}`;
+  const { ciphertext, authTag } = await aesGcmSeal(encryptionKey, iv, utf8(text));
+  return `${bytesToHex(iv)}:${bytesToHex(authTag)}:${bytesToHex(ciphertext)}`;
 }
-function decryptFromStorage(encryptedText, encryptionKey) {
+async function decryptFromStorage(encryptedText, encryptionKey) {
   const [ivHex, authTagHex, encryptedDataHex] = encryptedText.split(":");
-  const decipher = createDecipheriv(
-    "aes-256-gcm",
-    Buffer.from(encryptionKey, "hex"),
-    Buffer.from(ivHex, "hex")
+  const plain = await aesGcmOpen(
+    encryptionKey,
+    hexToBytes(ivHex),
+    hexToBytes(encryptedDataHex),
+    hexToBytes(authTagHex)
   );
-  decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
-  return decipher.update(encryptedDataHex, "hex", "utf8") + decipher.final("utf8");
+  return utf8Decode(plain);
 }
 
 // src/server/lib/request.js
@@ -300,7 +374,7 @@ function createGetUserKeyHandler(ctx) {
       body: {
         success: true,
         data: {
-          userKey: deriveUserEncryptionKey(userId, masterKey),
+          userKey: await deriveUserEncryptionKey(userId, masterKey),
           version: 1
         }
       }
@@ -309,9 +383,6 @@ function createGetUserKeyHandler(ctx) {
   return { GET };
 }
 
-// src/server/handlers/schedule-message.js
-import { randomUUID as randomUUID2 } from "crypto";
-
 // src/server/lib/db-errors.js
 function isUniqueViolation(error) {
   if (!error || typeof error !== "object") return false;
@@ -322,7 +393,6 @@ function isUniqueViolation(error) {
 }
 
 // src/server/lib/message-processor.js
-import { randomUUID } from "crypto";
 import {
   buildContentPush,
   buildReasoningPush,
@@ -356,8 +426,8 @@ async function processSingleMessage(task, ctx, providedMasterKey) {
     if (!masterKey) {
       return { success: false, messagesSent: 0, error: "TENANT_MASTER_KEY_MISSING" };
     }
-    const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
-    const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+    const userKey = await deriveUserEncryptionKey(task.user_id, masterKey);
+    const decryptedPayload = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
     let messageContent;
     let llmResponse = null;
     if (decryptedPayload.messageType === "fixed") {
@@ -606,10 +676,10 @@ function createScheduleMessageHandler(ctx) {
       return { status: 400, body: { success: false, error: parsedBody.error } };
     }
     const encryptedBody = parsedBody.data;
+    const userKey = await deriveUserEncryptionKey(userId, masterKey);
     let payload;
     try {
-      const userKey2 = deriveUserEncryptionKey(userId, masterKey);
-      payload = decryptPayload(encryptedBody, userKey2);
+      payload = await decryptPayload(encryptedBody, userKey);
     } catch (error) {
       if (error instanceof SyntaxError) {
         return { status: 400, body: { success: false, error: { code: "INVALID_PAYLOAD_FORMAT", message: "\u89E3\u5BC6\u540E\u7684\u6570\u636E\u4E0D\u662F\u6709\u6548 JSON" } } };
@@ -627,8 +697,7 @@ function createScheduleMessageHandler(ctx) {
     if (!validationResult.valid) {
       return { status: 400, body: { success: false, error: { code: validationResult.errorCode, message: validationResult.errorMessage, details: validationResult.details } } };
     }
-    const taskUuid = payload.uuid || randomUUID2();
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
+    const taskUuid = payload.uuid || randomUUID();
     const fullTaskData = {
       contactName: payload.contactName,
       avatarUrl: payload.avatarUrl || null,
@@ -654,7 +723,7 @@ function createScheduleMessageHandler(ctx) {
       pushSubscription: payload.pushSubscription,
       metadata: payload.metadata || {}
     };
-    const encryptedPayload = encryptForStorage(JSON.stringify(fullTaskData), userKey);
+    const encryptedPayload = await encryptForStorage(JSON.stringify(fullTaskData), userKey);
     if (payload.messageType === "instant") {
       if (!ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
         return {
@@ -808,8 +877,8 @@ async function runScheduledTick(ctx) {
       return;
     }
     try {
-      const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
-      const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+      const userKey = await deriveUserEncryptionKey(task.user_id, masterKey);
+      const decryptedPayload = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
       if (decryptedPayload.recurrenceType === "none") {
         await db.deleteTaskById(task.id);
         results.deletedOnceOffTasks++;
@@ -896,10 +965,10 @@ function createUpdateMessageHandler(ctx) {
       return { status: 400, body: { success: false, error: parsedBody.error } };
     }
     const encryptedBody = parsedBody.data;
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
+    const userKey = await deriveUserEncryptionKey(userId, masterKey);
     let updates;
     try {
-      updates = decryptPayload(encryptedBody, userKey);
+      updates = await decryptPayload(encryptedBody, userKey);
     } catch (_error) {
       return { status: 400, body: { success: false, error: { code: "DECRYPTION_FAILED", message: "\u8BF7\u6C42\u4F53\u89E3\u5BC6\u5931\u8D25" } } };
     }
@@ -948,7 +1017,7 @@ function createUpdateMessageHandler(ctx) {
       }
       return { status: 409, body: { success: false, error: { code: "TASK_ALREADY_COMPLETED", message: "\u4EFB\u52A1\u5DF2\u5B8C\u6210\u6216\u5DF2\u5931\u8D25\uFF0C\u65E0\u6CD5\u66F4\u65B0" } } };
     }
-    const existingData = JSON.parse(decryptFromStorage(existingTask.encrypted_payload, userKey));
+    const existingData = JSON.parse(await decryptFromStorage(existingTask.encrypted_payload, userKey));
     const promptUpdates = {};
     if (updates.completePrompt) {
       promptUpdates.completePrompt = updates.completePrompt;
@@ -971,7 +1040,7 @@ function createUpdateMessageHandler(ctx) {
       // string fields above are.
       ...Object.prototype.hasOwnProperty.call(updates, "splitPattern") && { splitPattern: updates.splitPattern ?? null }
     };
-    const encryptedPayload = encryptForStorage(JSON.stringify(updatedData), userKey);
+    const encryptedPayload = await encryptForStorage(JSON.stringify(updatedData), userKey);
     const extraFields = updates.nextSendAt ? { next_send_at: updates.nextSendAt } : void 0;
     const result = await db.updateTaskByUuid(taskUuid, userId, encryptedPayload, extraFields);
     if (!result) {
@@ -1064,9 +1133,9 @@ function createMessagesHandler(ctx) {
       return { status: 400, body: { success: false, error: { code: "INVALID_PARAMETERS", message: "offset \u53C2\u6570\u65E0\u6548\uFF0C\u5FC5\u987B\u4E3A\u975E\u8D1F\u6574\u6570" } } };
     }
     const { tasks, total } = await db.listTasks(userId, { status, limit, offset });
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
-    const decryptedTasks = tasks.map((task) => {
-      const decrypted = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+    const userKey = await deriveUserEncryptionKey(userId, masterKey);
+    const decryptedTasks = await Promise.all(tasks.map(async (task) => {
+      const decrypted = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
       return {
         id: task.id,
         uuid: task.uuid,
@@ -1080,12 +1149,12 @@ function createMessagesHandler(ctx) {
         createdAt: task.created_at,
         updatedAt: task.updated_at
       };
-    });
+    }));
     const responsePayload = {
       tasks: decryptedTasks,
       pagination: { total, limit, offset, hasMore: offset + limit < total }
     };
-    const encryptedResponse = encryptPayload(responsePayload, userKey);
+    const encryptedResponse = await encryptPayload(responsePayload, userKey);
     return {
       status: 200,
       body: {
@@ -1425,6 +1494,35 @@ function createSingleUserInitHandler(ctx) {
   return { POST };
 }
 
+// src/server/handlers/vapid-public-key.js
+function createVapidPublicKeyHandler(ctx) {
+  async function GET(url, headers) {
+    const effectiveHeaders = headers || url || {};
+    const tenantResult = await ctx.tenantManager.resolveTenant(effectiveHeaders);
+    if (!tenantResult.ok) {
+      return tenantResult.error;
+    }
+    const publicKey = ctx.vapid && ctx.vapid.publicKey;
+    if (!publicKey) {
+      return {
+        status: 503,
+        body: {
+          success: false,
+          error: {
+            code: "VAPID_NOT_CONFIGURED",
+            message: "VAPID \u516C\u94A5\u672A\u914D\u7F6E\uFF1A\u8BF7\u4E3A\u672C Worker \u8BBE\u7F6E VAPID_PUBLIC_KEY"
+          }
+        }
+      };
+    }
+    return {
+      status: 200,
+      body: { success: true, publicKey }
+    };
+  }
+  return { GET };
+}
+
 // src/server/single-user.js
 function createSingleUserServer(config) {
   if (!config || !config.db) throw new Error("[amsg-server single-user] config.db is required");
@@ -1452,36 +1550,12 @@ function createSingleUserServer(config) {
       scheduleMessage: createScheduleMessageHandler(ctx),
       updateMessage: createUpdateMessageHandler(ctx),
       cancelMessage: createCancelMessageHandler(ctx),
-      messages: createMessagesHandler(ctx)
+      messages: createMessagesHandler(ctx),
+      vapidPublicKey: createVapidPublicKeyHandler(ctx)
     }
   };
 }
 
-// src/server/lib/webcrypto-utils.js
-import { toUint8, concatBytes, base64UrlToBytes } from "@rei-standard/amsg-shared";
-var TEXT_ENCODER = new TextEncoder();
-var TEXT_DECODER = new TextDecoder("utf-8", { fatal: false });
-function utf8(str) {
-  return TEXT_ENCODER.encode(String(str));
-}
-function bytesToBase64Url(buf) {
-  const bytes = toUint8(buf);
-  let bin = "";
-  for (let i = 0; i < bytes.length; i++) {
-    bin += String.fromCharCode(bytes[i]);
-  }
-  const b64 = typeof btoa === "function" ? btoa(bin) : Buffer.from(bin, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function jsonToBase64Url(value) {
-  return bytesToBase64Url(utf8(JSON.stringify(value)));
-}
-function randomBytes2(n) {
-  const out = new Uint8Array(n);
-  globalThis.crypto.getRandomValues(out);
-  return out;
-}
-
 // src/server/lib/webpush-webcrypto.js
 import { normalizeVapidSubject } from "@rei-standard/amsg-shared";
 var KEY_INFO_PREFIX = utf8("WebPush: info\0");
@@ -1569,7 +1643,7 @@ async function encryptPushPayload({ plaintext, uaPublicKey, authSecret }) {
   );
   const keyInfo = concatBytes(KEY_INFO_PREFIX, uaPublicKey, asPublicRaw);
   const ikm = await hkdfSha256(authSecret, ecdhSecret, keyInfo, 32);
-  const salt = randomBytes2(16);
+  const salt = randomBytes(16);
   const cekBytes = await hkdfSha256(salt, ikm, CEK_INFO, 16);
   const cek = await globalThis.crypto.subtle.importKey(
     "raw",
@@ -1741,6 +1815,8 @@ function createSingleUserCloudflareWorker(buildConfig) {
         result = await server.handlers.updateMessage.PUT(url, headers, await request.text());
       } else if (method === "DELETE" && pathname.endsWith("/cancel-message")) {
         result = await server.handlers.cancelMessage.DELETE(url, headers);
+      } else if (method === "GET" && pathname.endsWith("/vapid-public-key")) {
+        result = await server.handlers.vapidPublicKey.GET(url, headers);
       } else {
         result = { status: 404, body: { success: false, error: { code: "NOT_FOUND", message: "Unknown route" } } };
       }