@sandprivacy/sandgate 0.3.0 → 0.3.2

package/README.md

@@ -74,6 +74,11 @@ the challenge and the user-verification flag. Anything off — a replayed
 assertion, another device, a missing biometric — is a denial, never an
 approval. Off by default; `sandgate status` tells you where you stand.
 
+Turning it back off (`sandgate biometric off`) asks for the vault
+passphrase: the switch lives inside the encrypted vault, so editing a
+config file — or running the command without the passphrase — cannot
+weaken your setup.
+
 ## Policies
 
 ```bash

package/dist/config.js

@@ -26,3 +26,10 @@ export function saveConfig(config) {
 export function totpPolicy(config, domain) {
     return config.policies.totp[domain] ?? config.policies.totpDefault;
 }
+/**
+ * Is a verified biometric required? The vault wins; the plaintext config
+ * flag is only a fallback for vaults written before 0.3.2.
+ */
+export function biometricRequired(vault, config) {
+    return vault.requireBiometric ?? config.requireBiometric ?? false;
+}

package/dist/index.js

@@ -8,7 +8,7 @@ import { testImapConnection } from "./inbox.js";
 import { resolvePassphrase, protectPassphraseDpapi, dpapiDecryptCommand } from "./passphrase.js";
 import { auditPath } from "./paths.js";
 import { vaultExists, loadVault, saveVault, rekeyVault, } from "./vault.js";
-import { loadConfig, saveConfig } from "./config.js";
+import { loadConfig, saveConfig, biometricRequired } from "./config.js";
 import { normalizeSecret, generateCode } from "./totp.js";
 import { TelegramApprover, discoverChatId } from "./telegram.js";
 import { serve } from "./server.js";
@@ -284,9 +284,24 @@ async function cmdBiometric(mode) {
         console.error("Usage: sandgate biometric <on|off>");
         process.exit(1);
     }
+    // Turning a protection off must cost the passphrase, so the flag lives
+    // in the vault — not in a plaintext file anyone could edit.
+    const prompter = new Prompter();
+    const pass = await getPassphrase(prompter);
+    prompter.close();
+    const data = loadVault(pass);
+    if (mode === "on" && !data.biometric) {
+        console.error("Nothing enrolled yet. Run `sandgate enroll-biometric` first.");
+        process.exit(1);
+    }
+    data.requireBiometric = mode === "on";
+    saveVault(pass, data);
+    // Retire the legacy plaintext flag so the two can never disagree.
     const config = loadConfig();
-    config.requireBiometric = mode === "on";
-    saveConfig(config);
+    if (config.requireBiometric) {
+        config.requireBiometric = false;
+        saveConfig(config);
+    }
     console.log(mode === "on"
         ? "Biometric approvals required. Every approval must now be signed by the enrolled device."
         : "Biometric requirement off. A tap is enough again.");
@@ -305,6 +320,7 @@ async function cmdStatus() {
     const auditCount = existsSync(auditPath())
         ? readFileSync(auditPath(), "utf8").trim().split("\n").filter(Boolean).length
         : 0;
+    const requiresBio = biometricRequired(data, config);
     const approval = data.pwa
         ? `PWA via ${data.pwa.relayUrl} (Telegram ${data.telegram ? "fallback" : "not set"})`
         : data.telegram
@@ -326,7 +342,7 @@ async function cmdStatus() {
                     .map(([d, p]) => `${d}=${p}`)
                     .join(", ")
             : ""));
-    console.log(`  biometric          ${config.requireBiometric
+    console.log(`  biometric          ${requiresBio
         ? data.biometric
             ? "required (enrolled)"
             : "REQUIRED BUT NOT ENROLLED — run `sandgate enroll-biometric`"
@@ -423,9 +439,12 @@ async function cmdTestApproval() {
     const data = loadVault(pass);
     let approver;
     if (data.pwa) {
-        const { PwaApprover } = await import("./pwa-approver.js");
-        approver = new PwaApprover(data.pwa);
-        console.log("Sending test approval to the paired PWA (60s timeout)…");
+        const { pwaApproverFrom } = await import("./pwa-approver.js");
+        const config = loadConfig();
+        approver = pwaApproverFrom(data, config);
+        console.log(biometricRequired(data, config)
+            ? "Sending test approval to the paired PWA — Face ID required (60s timeout)…"
+            : "Sending test approval to the paired PWA (60s timeout)…");
     }
     else if (data.telegram) {
         approver = new TelegramApprover(data.telegram.botToken, data.telegram.chatId);

package/dist/pwa-approver.js

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { biometricRequired } from "./config.js";
 import { deriveKey, seal, open, aadForRequest, aadForDecision } from "./pwacrypto.js";
 import { verifyAssertion, verifyEnrollment, } from "./webauthn.js";
 export class PwaApprover {
@@ -101,3 +102,17 @@ export class PwaApprover {
         });
     }
 }
+/**
+ * Build the PWA approver from vault + config. Everything that talks to the
+ * phone goes through here: when `serve` and the CLI each assembled their
+ * own config, the CLI silently lost biometric enforcement.
+ */
+export function pwaApproverFrom(vault, config) {
+    if (!vault.pwa)
+        return null;
+    return new PwaApprover({
+        ...vault.pwa,
+        biometric: vault.biometric,
+        requireBiometric: biometricRequired(vault, config),
+    });
+}

package/dist/relay/pwa-page.js

@@ -631,7 +631,26 @@ export const PWA_HTML = `<!doctype html>
     }
   }
 
+  // Push, SSE and the safety poll all trigger refreshes, and they arrive
+  // together. Two of them used to race in the gap between "do I have this
+  // card?" and adding it — decrypting is async — so one request could
+  // render several times, and only the last copy stayed wired. One refresh
+  // runs at a time now; overlapping triggers coalesce into one re-run.
+  var refreshing = false;
+  var refreshQueued = false;
+
   async function fetchPending() {
+    if (refreshing) { refreshQueued = true; return; }
+    refreshing = true;
+    try {
+      await refreshOnce();
+    } finally {
+      refreshing = false;
+      if (refreshQueued) { refreshQueued = false; fetchPending(); }
+    }
+  }
+
+  async function refreshOnce() {
     var seen = {};
     await Promise.all(pairs.map(async function (p) {
       var raw;
@@ -642,16 +661,27 @@ export const PWA_HTML = `<!doctype html>
         var key = p.pairId + ":" + raw[i].requestId;
         seen[key] = true;
         if (cards[key]) continue;
+        // Claim the key before awaiting: two vaults resolving at once must
+        // not both decide the card is missing.
+        cards[key] = null;
         try {
           var req = await openSealed(p, raw[i].payload, "req:" + raw[i].requestId);
           addCard(key, p, raw[i].requestId, req);
-        } catch (e) { /* not ours / tampered */ }
+        } catch (e) {
+          delete cards[key]; // not ours / tampered — release the claim
+        }
       }
     }));
     for (var cid in cards) {
-      if (!seen[cid]) { cards[cid].el.remove(); delete cards[cid]; }
+      if (!seen[cid] && cards[cid]) { cards[cid].el.remove(); delete cards[cid]; }
     }
-    ensureEmpty(Object.keys(cards).length === 0);
+    ensureEmpty(activeCount() === 0);
+  }
+
+  function activeCount() {
+    var n = 0;
+    for (var k in cards) if (cards[k]) n++;
+    return n;
   }
 
   function addCard(id, p, requestId, req) {
@@ -765,7 +795,7 @@ export const PWA_HTML = `<!doctype html>
     c.barEl.className = "bar" + (remaining < total * 0.25 ? " low" : "");
   }
   setInterval(function () {
-    for (var id in cards) tickOne(cards[id]);
+    for (var id in cards) if (cards[id]) tickOne(cards[id]);
   }, 1000);
 
   function makeActionBtn(label, cls, icon, onTap) {
@@ -794,7 +824,7 @@ export const PWA_HTML = `<!doctype html>
         cards[id].el.remove();
         delete cards[id];
       }
-      ensureEmpty(Object.keys(cards).length === 0);
+      ensureEmpty(activeCount() === 0);
     } catch (err) {
       btn.disabled = false;
       alert("Could not send your decision: " + (err && err.message ? err.message : err));

package/dist/server.js

@@ -2,10 +2,10 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { loadVault } from "./vault.js";
-import { loadConfig, totpPolicy } from "./config.js";
+import { loadConfig, totpPolicy, biometricRequired } from "./config.js";
 import { generateCode } from "./totp.js";
 import { TelegramApprover } from "./telegram.js";
-import { PwaApprover } from "./pwa-approver.js";
+import { pwaApproverFrom } from "./pwa-approver.js";
 import { backendFromVault } from "./inbox.js";
 import { audit } from "./audit.js";
 /**
@@ -23,17 +23,13 @@ function refusal(message) {
 export async function serve(passphrase) {
     const vault = loadVault(passphrase);
     const config = loadConfig();
-    if (config.requireBiometric && !vault.biometric) {
+    if (biometricRequired(vault, config) && !vault.biometric) {
         // Fail closed rather than silently downgrade to a plain tap.
         throw new Error("requireBiometric is on but no credential is enrolled. Run `sandgate enroll-biometric`, or turn it off with `sandgate biometric off`.");
     }
     // PWA (E2EE push) wins over Telegram when both are configured.
     const approver = vault.pwa
-        ? new PwaApprover({
-            ...vault.pwa,
-            biometric: vault.biometric,
-            requireBiometric: config.requireBiometric,
-        })
+        ? pwaApproverFrom(vault, config)
         : vault.telegram
             ? new TelegramApprover(vault.telegram.botToken, vault.telegram.chatId)
             : null;

package/dist/test/approver-wiring.test.js

@@ -0,0 +1,122 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { newPairing, deriveKey, seal, open, aadForRequest, aadForDecision } from "../pwacrypto.js";
+import { startRelay } from "../relay/server.js";
+import { pwaApproverFrom } from "../pwa-approver.js";
+import { DEFAULT_CONFIG } from "../config.js";
+/**
+ * Guards the wiring, not the crypto: enforcement must reach the phone
+ * from every entry point. `sandgate test-approval` once built its own
+ * approver config and quietly dropped requireBiometric, so an enforced
+ * vault still accepted a bare tap. One builder now serves serve() and the
+ * CLI, and this test fails if it ever stops enforcing.
+ */
+const CREDENTIAL = {
+    credentialId: "unused-for-this-test",
+    publicKeySpki: "unused-for-this-test",
+    rpId: "localhost",
+    origin: "http://localhost",
+    enrolledAt: new Date().toISOString(),
+};
+/** A phone that taps Approve without producing any assertion. */
+async function tapWithoutAssertion(relayUrl, pairId, secret) {
+    const key = deriveKey(secret);
+    for (let i = 0; i < 100; i++) {
+        const res = await fetch(`${relayUrl}/api/pending?pairId=${pairId}`);
+        const items = (await res.json());
+        if (items.length) {
+            const { requestId, payload } = items[0];
+            const request = open(key, payload, aadForRequest(requestId));
+            await fetch(`${relayUrl}/api/decision`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    pairId,
+                    requestId,
+                    payload: seal(key, { requestId, approved: true, ts: Date.now() }, aadForDecision(requestId)),
+                }),
+            });
+            return request;
+        }
+        await new Promise((r) => setTimeout(r, 50));
+    }
+    throw new Error("phone never saw a request");
+}
+/** Settle a promise without ever leaving a rejection unhandled. */
+function settled(p) {
+    return p.then((value) => ({ value }), (error) => ({ error }));
+}
+async function withRelay(fn) {
+    const relay = await startRelay({
+        port: 0,
+        stateDir: mkdtempSync(join(tmpdir(), "sandgate-relay-")),
+    });
+    try {
+        return await fn(`http://localhost:${relay.port}`);
+    }
+    finally {
+        relay.close();
+    }
+}
+test("an enforced vault rejects an approval that carries no assertion", async () => {
+    await withRelay(async (relayUrl) => {
+        const pairing = newPairing();
+        const vault = {
+            totp: {},
+            pwa: { relayUrl, pairId: pairing.pairId, secret: pairing.secret },
+            biometric: CREDENTIAL,
+        };
+        const approver = pwaApproverFrom(vault, { ...DEFAULT_CONFIG, requireBiometric: true });
+        const deciding = settled(approver.request({ title: "Pay 300 EUR", timeoutSec: 15 }));
+        const request = await tapWithoutAssertion(relayUrl, pairing.pairId, pairing.secret);
+        // The phone must be TOLD to ask for biometrics...
+        assert.equal(request.requireBiometric, true, "the request did not demand a biometric");
+        // ...and a bare tap must not pass for an approval.
+        const outcome = await deciding;
+        assert.equal(outcome.value, undefined, "a bare tap was accepted as an approval");
+        assert.match(String(outcome.error), /without the required biometric assertion/);
+    });
+});
+test("without enforcement, the same tap is a normal approval", async () => {
+    await withRelay(async (relayUrl) => {
+        const pairing = newPairing();
+        const vault = {
+            totp: {},
+            pwa: { relayUrl, pairId: pairing.pairId, secret: pairing.secret },
+        };
+        const approver = pwaApproverFrom(vault, { ...DEFAULT_CONFIG, requireBiometric: false });
+        const deciding = settled(approver.request({ title: "Harmless", timeoutSec: 15 }));
+        const request = await tapWithoutAssertion(relayUrl, pairing.pairId, pairing.secret);
+        assert.equal(request.requireBiometric, false);
+        assert.deepEqual((await deciding).value, { approved: true, decision: "approved" });
+    });
+});
+test("enforcement without an enrolled credential refuses instead of downgrading", async () => {
+    await withRelay(async (relayUrl) => {
+        const pairing = newPairing();
+        const vault = {
+            totp: {},
+            pwa: { relayUrl, pairId: pairing.pairId, secret: pairing.secret },
+        };
+        const approver = pwaApproverFrom(vault, { ...DEFAULT_CONFIG, requireBiometric: true });
+        const deciding = settled(approver.request({ title: "Pay 300 EUR", timeoutSec: 15 }));
+        await tapWithoutAssertion(relayUrl, pairing.pairId, pairing.secret);
+        const outcome = await deciding;
+        assert.equal(outcome.value, undefined, "an unenrolled vault approved anyway");
+        assert.match(String(outcome.error), /no credential is enrolled/);
+    });
+});
+test("the vault flag wins over the legacy plaintext config flag", async () => {
+    const { biometricRequired } = await import("../config.js");
+    const base = { totp: {} };
+    // Vaults written before 0.3.2 kept the switch in config.json.
+    assert.equal(biometricRequired(base, { ...DEFAULT_CONFIG, requireBiometric: true }), true);
+    // Once the vault carries it, the plaintext file cannot re-enable...
+    assert.equal(biometricRequired({ ...base, requireBiometric: false }, { ...DEFAULT_CONFIG, requireBiometric: true }), false);
+    // ...nor disable it: only the passphrase-protected vault decides.
+    assert.equal(biometricRequired({ ...base, requireBiometric: true }, { ...DEFAULT_CONFIG, requireBiometric: false }), true);
+    assert.equal(biometricRequired(base, DEFAULT_CONFIG), false);
+});

package/dist/test/pwa-dedup.test.js

@@ -0,0 +1,64 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { newPairing } from "../pwacrypto.js";
+import { startRelay } from "../relay/server.js";
+import { PwaApprover } from "../pwa-approver.js";
+import { loadPage, waitFor } from "./helpers/page.js";
+/**
+ * One request must never render twice. Concurrent refreshes (an SSE event,
+ * the safety poll and a visibility change can all land together) used to
+ * race in the async gap between "do I already have this card?" and adding
+ * it, leaving a duplicate whose buttons pointed at nothing.
+ */
+test("concurrent refreshes render a single card per request", async () => {
+    const relay = await startRelay({
+        port: 0,
+        stateDir: mkdtempSync(join(tmpdir(), "sandgate-relay-")),
+    });
+    const relayUrl = `http://localhost:${relay.port}`;
+    try {
+        const pairing = newPairing();
+        const { window, close } = await loadPage(relayUrl, {
+            hash: `#p=${pairing.pairId}&s=${pairing.secret}`,
+        });
+        try {
+            const approver = new PwaApprover({
+                relayUrl,
+                pairId: pairing.pairId,
+                secret: pairing.secret,
+            });
+            const deciding = approver.request({ title: "Only once", timeoutSec: 25 }).catch(() => { });
+            // Wait until the relay actually holds the request, otherwise the
+            // burst below races an empty queue and proves nothing.
+            for (let i = 0; i < 60; i++) {
+                const items = (await (await fetch(`${relayUrl}/api/pending?pairId=${pairing.pairId}`)).json());
+                if (items.length)
+                    break;
+                await new Promise((r) => setTimeout(r, 50));
+            }
+            // Every visibilitychange kicks a refresh; firing a burst reproduces
+            // the overlap that a real phone hits when push, SSE and poll agree.
+            for (let i = 0; i < 8; i++) {
+                window.document.dispatchEvent(new window.Event("visibilitychange"));
+            }
+            await waitFor(() => window.document.querySelector(".card"));
+            await new Promise((r) => setTimeout(r, 1500)); // let every racer land
+            const cards = window.document.querySelectorAll(".card");
+            assert.equal(cards.length, 1, `rendered ${cards.length} cards for one request`);
+            assert.equal(window.document.querySelectorAll(".card button.ok").length, 1, "a duplicate card left dead buttons behind");
+            // And the surviving card must still work.
+            window.document.querySelector(".card button.ok").click();
+            await waitFor(() => (window.document.querySelectorAll(".card").length === 0 ? true : null));
+            await deciding;
+        }
+        finally {
+            close();
+        }
+    }
+    finally {
+        relay.close();
+    }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandprivacy/sandgate",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "The human gateway for AI agents — approvals, 2FA codes and email verification, self-hosted. Your agent asks; you decide; secrets never touch the LLM.",
   "license": "AGPL-3.0-only",
   "type": "module",