@vex-chat/libvex 1.1.0 → 4.0.0

package/dist/storage/sqlite.js

@@ -8,28 +8,192 @@
  * This replaces three separate storage classes (Storage.ts, TauriStorage,
  * ExpoStorage) with a single implementation.
  */
-import { XKeyConvert, XUtils } from "@vex-chat/crypto";
+import { xBoxKeyPairFromSecret, XKeyConvert, xMakeNonce, xSecretbox, xSecretboxOpen, xSignKeyPairFromSecret, XUtils, } from "@vex-chat/crypto";
 import { EventEmitter } from "eventemitter3";
-import nacl from "tweetnacl";
 export class SqliteStorage extends EventEmitter {
     ready = false;
     closing = false;
     db;
-    log;
     idKeys;
-    constructor(db, SK, logger) {
+    constructor(db, SK) {
         super();
         this.db = db;
-        this.log = logger;
-        const idKeys = XKeyConvert.convertKeyPair(nacl.sign.keyPair.fromSecretKey(XUtils.decodeHex(SK)));
+        const idKeys = XKeyConvert.convertKeyPair(xSignKeyPairFromSecret(XUtils.decodeHex(SK)));
         if (!idKeys) {
             throw new Error("Can't convert SK!");
         }
         this.idKeys = idKeys;
     }
     // ── Lifecycle ────────────────────────────────────────────────────────────
+    async close() {
+        this.closing = true;
+        await this.db.destroy();
+    }
+    async deleteHistory(channelOrUserID) {
+        await this.db
+            .deleteFrom("messages")
+            .where((eb) => eb.or([
+            eb("group", "=", channelOrUserID),
+            eb.and([
+                eb("group", "is", null),
+                eb("authorID", "=", channelOrUserID),
+            ]),
+            eb.and([
+                eb("group", "is", null),
+                eb("readerID", "=", channelOrUserID),
+            ]),
+        ]))
+            .execute();
+    }
+    // ── Messages ─────────────────────────────────────────────────────────────
+    async deleteMessage(mailID) {
+        if (this.closing) {
+            return;
+        }
+        await this.db
+            .deleteFrom("messages")
+            .where("mailID", "=", mailID)
+            .execute();
+    }
+    async deleteOneTimeKey(index) {
+        if (this.closing) {
+            return;
+        }
+        await this.db
+            .deleteFrom("oneTimeKeys")
+            .where("index", "=", index)
+            .execute();
+    }
+    async getAllSessions() {
+        if (this.closing) {
+            return [];
+        }
+        const rows = await this.db
+            .selectFrom("sessions")
+            .selectAll()
+            .orderBy("lastUsed", "desc")
+            .execute();
+        return rows.map((s) => this.sessionRowToSQL(s));
+    }
+    async getDevice(deviceID) {
+        const rows = await this.db
+            .selectFrom("devices")
+            .selectAll()
+            .where("deviceID", "=", deviceID)
+            .execute();
+        const row = rows[0];
+        if (!row) {
+            return null;
+        }
+        return this.deviceRowToDevice(row);
+    }
+    async getGroupHistory(channelID) {
+        if (this.closing) {
+            return [];
+        }
+        const messages = await this.db
+            .selectFrom("messages")
+            .selectAll()
+            .where("group", "=", channelID)
+            .orderBy("timestamp", "asc")
+            .execute();
+        return this.decryptMessages(messages);
+    }
+    async getMessageHistory(userID) {
+        if (this.closing) {
+            return [];
+        }
+        const messages = await this.db
+            .selectFrom("messages")
+            .selectAll()
+            .where((eb) => eb.or([
+            eb.and([
+                eb("direction", "=", "incoming"),
+                eb("authorID", "=", userID),
+                eb("group", "is", null),
+            ]),
+            eb.and([
+                eb("direction", "=", "outgoing"),
+                eb("readerID", "=", userID),
+                eb("group", "is", null),
+            ]),
+        ]))
+            .orderBy("timestamp", "asc")
+            .execute();
+        return this.decryptMessages(messages);
+    }
+    // ── Sessions ─────────────────────────────────────────────────────────────
+    async getOneTimeKey(index) {
+        await this.untilReady();
+        if (this.closing) {
+            return null;
+        }
+        const rows = await this.db
+            .selectFrom("oneTimeKeys")
+            .selectAll()
+            .where("index", "=", index)
+            .execute();
+        const otkInfo = rows[0];
+        if (!otkInfo) {
+            return null;
+        }
+        return {
+            index: otkInfo.index,
+            keyPair: xBoxKeyPairFromSecret(XUtils.decodeHex(this.unsealHex(otkInfo.privateKey))),
+            signature: XUtils.decodeHex(otkInfo.signature),
+        };
+    }
+    async getPreKeys() {
+        await this.untilReady();
+        if (this.closing) {
+            return null;
+        }
+        const rows = await this.db.selectFrom("preKeys").selectAll().execute();
+        const preKeyInfo = rows[0];
+        if (!preKeyInfo) {
+            return null;
+        }
+        return {
+            index: preKeyInfo.index,
+            keyPair: xBoxKeyPairFromSecret(XUtils.decodeHex(this.unsealHex(preKeyInfo.privateKey))),
+            signature: XUtils.decodeHex(preKeyInfo.signature),
+        };
+    }
+    async getSessionByDeviceID(deviceID) {
+        if (this.closing) {
+            return null;
+        }
+        const rows = await this.db
+            .selectFrom("sessions")
+            .selectAll()
+            .where("deviceID", "=", deviceID)
+            .orderBy("lastUsed", "desc")
+            .limit(1)
+            .execute();
+        const sessionRow = rows[0];
+        if (!sessionRow) {
+            return null;
+        }
+        return this.sqlToCrypto(this.sessionRowToSQL(sessionRow));
+    }
+    async getSessionByPublicKey(publicKey) {
+        if (this.closing) {
+            return null;
+        }
+        const hex = XUtils.encodeHex(publicKey);
+        const rows = await this.db
+            .selectFrom("sessions")
+            .selectAll()
+            .where("publicKey", "=", hex)
+            .limit(1)
+            .execute();
+        const sessionRow = rows[0];
+        if (!sessionRow) {
+            return null;
+        }
+        return this.sqlToCrypto(this.sessionRowToSQL(sessionRow));
+    }
     async init() {
-        this.log.info("Initializing database tables.");
         try {
             await this.db.schema
                 .createTable("messages")
@@ -96,124 +260,22 @@ export class SqliteStorage extends EventEmitter {
             this.emit("ready");
         }
         catch (err) {
-            this.emit("error", err);
+            this.emit("error", err instanceof Error ? err : new Error(String(err)));
         }
     }
-    async close() {
-        this.closing = true;
-        this.log.info("Closing database.");
-        await this.db.destroy();
-    }
-    // ── Messages ─────────────────────────────────────────────────────────────
-    async saveMessage(message) {
-        if (this.closing) {
-            this.log.warn("Database is closing, saveMessage() will not complete.");
-            return;
-        }
-        // Encrypt plaintext with our idkey before saving to disk
-        const encryptedMessage = XUtils.encodeHex(nacl.secretbox(XUtils.decodeUTF8(message.message), XUtils.decodeHex(message.nonce), this.idKeys.secretKey));
-        try {
-            await this.db
-                .insertInto("messages")
-                .values({
-                nonce: message.nonce,
-                sender: message.sender,
-                recipient: message.recipient,
-                group: message.group ?? null,
-                mailID: message.mailID,
-                message: encryptedMessage,
-                direction: message.direction,
-                timestamp: message.timestamp instanceof Date
-                    ? message.timestamp.toISOString()
-                    : String(message.timestamp),
-                decrypted: message.decrypted ? 1 : 0,
-                forward: message.forward ? 1 : 0,
-                authorID: message.authorID,
-                readerID: message.readerID,
-            })
-                .execute();
-        }
-        catch (err) {
-            if (this.closing)
-                return;
-            if (err?.errno === 19 || err?.message?.includes("UNIQUE")) {
-                this.log.warn("Duplicate nonce in message table.");
-            }
-            else {
-                throw err;
-            }
-        }
-    }
-    async deleteMessage(mailID) {
+    async markSessionUsed(sessionID) {
         if (this.closing) {
-            this.log.warn("Database is closing, deleteMessage() will not complete.");
             return;
         }
         await this.db
-            .deleteFrom("messages")
-            .where("mailID", "=", mailID)
-            .execute();
-    }
-    async getMessageHistory(userID) {
-        if (this.closing) {
-            this.log.warn("Database is closing, getMessageHistory() will not complete.");
-            return [];
-        }
-        const messages = await this.db
-            .selectFrom("messages")
-            .selectAll()
-            .where((eb) => eb.or([
-            eb.and([
-                eb("direction", "=", "incoming"),
-                eb("authorID", "=", userID),
-                eb("group", "is", null),
-            ]),
-            eb.and([
-                eb("direction", "=", "outgoing"),
-                eb("readerID", "=", userID),
-                eb("group", "is", null),
-            ]),
-        ]))
-            .orderBy("timestamp", "asc")
-            .execute();
-        return this.decryptMessages(messages);
-    }
-    async getGroupHistory(channelID) {
-        if (this.closing) {
-            this.log.warn("Database is closing, getGroupHistory() will not complete.");
-            return [];
-        }
-        const messages = await this.db
-            .selectFrom("messages")
-            .selectAll()
-            .where("group", "=", channelID)
-            .orderBy("timestamp", "asc")
-            .execute();
-        return this.decryptMessages(messages);
-    }
-    async deleteHistory(channelOrUserID, _olderThan) {
-        await this.db
-            .deleteFrom("messages")
-            .where((eb) => eb.or([
-            eb("group", "=", channelOrUserID),
-            eb.and([
-                eb("group", "is", null),
-                eb("authorID", "=", channelOrUserID),
-            ]),
-            eb.and([
-                eb("group", "is", null),
-                eb("readerID", "=", channelOrUserID),
-            ]),
-        ]))
+            .updateTable("sessions")
+            .set({ lastUsed: new Date(Date.now()).toISOString() })
+            .where("sessionID", "=", sessionID)
             .execute();
     }
-    async purgeHistory() {
-        await this.db.deleteFrom("messages").execute();
-    }
-    // ── Sessions ─────────────────────────────────────────────────────────────
+    // ── PreKeys / OneTimeKeys ────────────────────────────────────────────────
     async markSessionVerified(sessionID) {
         if (this.closing) {
-            this.log.warn("Database is closing, markSessionVerified() will not complete.");
             return;
         }
         await this.db
@@ -222,263 +284,243 @@ export class SqliteStorage extends EventEmitter {
             .where("sessionID", "=", sessionID)
             .execute();
     }
-    async markSessionUsed(sessionID) {
-        if (this.closing) {
-            this.log.warn("Database is closing, markSessionUsed() will not complete.");
-            return;
-        }
-        await this.db
-            .updateTable("sessions")
-            .set({ lastUsed: new Date(Date.now()).toISOString() })
-            .where("sessionID", "=", sessionID)
-            .execute();
+    async purgeHistory() {
+        await this.db.deleteFrom("messages").execute();
     }
-    async getSessionByPublicKey(publicKey) {
-        if (this.closing) {
-            this.log.warn("Database is closing, getSessionByPublicKey() will not complete.");
-            return null;
-        }
-        const hex = XUtils.encodeHex(publicKey);
-        const rows = await this.db
-            .selectFrom("sessions")
-            .selectAll()
-            .where("publicKey", "=", hex)
-            .limit(1)
-            .execute();
-        if (rows.length === 0) {
-            this.log.warn(`getSessionByPublicKey(${hex}) => ${JSON.stringify(null)}`);
-            return null;
-        }
-        return this.sqlToCrypto(rows[0]);
+    async purgeKeyData() {
+        await this.db.deleteFrom("sessions").execute();
+        await this.db.deleteFrom("oneTimeKeys").execute();
+        await this.db.deleteFrom("preKeys").execute();
+        await this.db.deleteFrom("messages").execute();
     }
-    async getAllSessions() {
+    async saveDevice(device) {
         if (this.closing) {
-            this.log.warn("Database is closing, getAllSessions() will not complete.");
-            return [];
+            return;
         }
-        const rows = await this.db
-            .selectFrom("sessions")
-            .selectAll()
-            .orderBy("lastUsed", "desc")
-            .execute();
-        return rows.map((s) => ({
-            ...s,
-            verified: Boolean(s.verified),
-        }));
-    }
-    async getSessionByDeviceID(deviceID) {
-        if (this.closing) {
-            this.log.warn("Database is closing, getSessionByDeviceID() will not complete.");
-            return null;
+        try {
+            await this.db
+                .insertInto("devices")
+                .values({
+                deleted: device.deleted ? 1 : 0,
+                deviceID: device.deviceID,
+                lastLogin: device.lastLogin,
+                name: device.name,
+                owner: device.owner,
+                signKey: device.signKey,
+            })
+                .execute();
         }
-        const rows = await this.db
-            .selectFrom("sessions")
-            .selectAll()
-            .where("deviceID", "=", deviceID)
-            .orderBy("lastUsed", "desc")
-            .limit(1)
-            .execute();
-        if (rows.length === 0) {
-            this.log.debug("getSession() => " + JSON.stringify(null));
-            return null;
+        catch (err) {
+            if (this.isDuplicateError(err)) {
+                // duplicate deviceID — ignore
+            }
+            else {
+                throw err;
+            }
         }
-        return this.sqlToCrypto(rows[0]);
     }
-    async saveSession(session) {
+    // ── Devices ──────────────────────────────────────────────────────────────
+    async saveMessage(message) {
         if (this.closing) {
-            this.log.warn("Database is closing, saveSession() will not complete.");
             return;
         }
+        // Encrypt plaintext with our idkey before saving to disk
+        const encryptedMessage = XUtils.encodeHex(xSecretbox(XUtils.decodeUTF8(message.message), XUtils.decodeHex(message.nonce), this.idKeys.secretKey));
         try {
             await this.db
-                .insertInto("sessions")
+                .insertInto("messages")
                 .values({
-                sessionID: session.sessionID,
-                userID: session.userID,
-                deviceID: session.deviceID,
-                SK: session.SK,
-                publicKey: session.publicKey,
-                fingerprint: session.fingerprint,
-                mode: session.mode,
-                lastUsed: session.lastUsed instanceof Date
-                    ? session.lastUsed.toISOString()
-                    : String(session.lastUsed),
-                verified: session.verified ? 1 : 0,
+                authorID: message.authorID,
+                decrypted: message.decrypted ? 1 : 0,
+                direction: message.direction,
+                forward: message.forward ? 1 : 0,
+                group: message.group ?? null,
+                mailID: message.mailID,
+                message: encryptedMessage,
+                nonce: message.nonce,
+                readerID: message.readerID,
+                recipient: message.recipient,
+                sender: message.sender,
+                timestamp: message.timestamp,
             })
                 .execute();
         }
         catch (err) {
-            if (err?.errno === 19 || err?.message?.includes("UNIQUE")) {
-                this.log.warn("Attempted to insert duplicate SK");
+            if (this.isDuplicateError(err)) {
+                // duplicate nonce — ignore
             }
             else {
                 throw err;
             }
         }
     }
-    // ── PreKeys / OneTimeKeys ────────────────────────────────────────────────
     async savePreKeys(preKeys, oneTime) {
         await this.untilReady();
         if (this.closing) {
-            this.log.warn("Database is closing, savePreKeys() will not complete.");
             return [];
         }
         const table = oneTime ? "oneTimeKeys" : "preKeys";
-        const addedIndexes = [];
+        const saved = [];
         for (const preKey of preKeys) {
-            const result = await this.db
+            const row = await this.db
                 .insertInto(table)
                 .values({
-                privateKey: XUtils.encodeHex(preKey.keyPair.secretKey),
+                privateKey: this.sealHex(XUtils.encodeHex(preKey.keyPair.secretKey)),
                 publicKey: XUtils.encodeHex(preKey.keyPair.publicKey),
                 signature: XUtils.encodeHex(preKey.signature),
             })
-                .executeTakeFirst();
-            if (result.insertId !== undefined) {
-                addedIndexes.push(Number(result.insertId));
-            }
-        }
-        const rows = await this.db
-            .selectFrom(table)
-            .selectAll()
-            .where("index", "in", addedIndexes)
-            .execute();
-        return rows.map((key) => {
-            delete key.privateKey;
-            return key;
-        });
-    }
-    async getPreKeys() {
-        await this.untilReady();
-        if (this.closing) {
-            this.log.warn("Database is closing, getPreKeys() will not complete.");
-            return null;
-        }
-        const rows = await this.db.selectFrom("preKeys").selectAll().execute();
-        if (rows.length === 0) {
-            this.log.debug("getPreKeys() => " + JSON.stringify(null));
-            return null;
-        }
-        const preKeyInfo = rows[0];
-        return {
-            keyPair: nacl.box.keyPair.fromSecretKey(XUtils.decodeHex(preKeyInfo.privateKey)),
-            signature: XUtils.decodeHex(preKeyInfo.signature),
-        };
-    }
-    async getOneTimeKey(index) {
-        await this.untilReady();
-        if (this.closing) {
-            this.log.warn("Database is closing, getOneTimeKey() will not complete.");
-            return null;
-        }
-        const rows = await this.db
-            .selectFrom("oneTimeKeys")
-            .selectAll()
-            .where("index", "=", index)
-            .execute();
-        if (rows.length === 0) {
-            this.log.debug("getOneTimeKey() => " + JSON.stringify(null));
-            return null;
-        }
-        const otkInfo = rows[0];
-        return {
-            keyPair: nacl.box.keyPair.fromSecretKey(XUtils.decodeHex(otkInfo.privateKey)),
-            signature: XUtils.decodeHex(otkInfo.signature),
-            index: otkInfo.index,
-        };
-    }
-    async deleteOneTimeKey(index) {
-        if (this.closing) {
-            this.log.warn("Database is closing, deleteOneTimeKey() will not complete.");
-            return;
+                .returning([
+                "deviceID",
+                "index",
+                "keyID",
+                "publicKey",
+                "signature",
+                "userID",
+            ])
+                .executeTakeFirstOrThrow();
+            saved.push(row);
         }
-        await this.db
-            .deleteFrom("oneTimeKeys")
-            .where("index", "=", index)
-            .execute();
+        return saved;
     }
-    // ── Devices ──────────────────────────────────────────────────────────────
-    async getDevice(deviceID) {
-        const rows = await this.db
-            .selectFrom("devices")
-            .selectAll()
-            .where("deviceID", "=", deviceID)
-            .execute();
-        if (rows.length === 0) {
-            return null;
-        }
-        return rows[0];
-    }
-    async saveDevice(device) {
+    // ── Purge ────────────────────────────────────────────────────────────────
+    async saveSession(session) {
         if (this.closing) {
-            this.log.warn("Database is closing, saveDevice() will not complete.");
             return;
         }
         try {
             await this.db
-                .insertInto("devices")
+                .insertInto("sessions")
                 .values({
-                deviceID: device.deviceID,
-                owner: device.owner,
-                signKey: device.signKey,
-                name: device.name,
-                lastLogin: device.lastLogin,
-                deleted: device.deleted ? 1 : 0,
+                deviceID: session.deviceID,
+                fingerprint: session.fingerprint,
+                lastUsed: session.lastUsed,
+                mode: session.mode,
+                publicKey: session.publicKey,
+                sessionID: session.sessionID,
+                SK: this.sealHex(session.SK),
+                userID: session.userID,
+                verified: session.verified ? 1 : 0,
             })
                 .execute();
         }
         catch (err) {
-            if (err?.errno === 19 || err?.message?.includes("UNIQUE")) {
-                this.log.warn("Attempted to insert duplicate deviceID");
+            if (this.isDuplicateError(err)) {
+                // duplicate SK — ignore
             }
             else {
                 throw err;
             }
         }
     }
-    // ── Purge ────────────────────────────────────────────────────────────────
-    async purgeKeyData() {
-        await this.db.deleteFrom("sessions").execute();
-        await this.db.deleteFrom("oneTimeKeys").execute();
-        await this.db.deleteFrom("preKeys").execute();
-        await this.db.deleteFrom("messages").execute();
-    }
     // ── Private helpers ──────────────────────────────────────────────────────
     decryptMessages(messages) {
         return messages.map((msg) => {
-            msg.timestamp = new Date(msg.timestamp);
-            msg.decrypted = Boolean(msg.decrypted);
-            msg.forward = Boolean(msg.forward);
-            if (msg.decrypted) {
-                const decrypted = nacl.secretbox.open(XUtils.decodeHex(msg.message), XUtils.decodeHex(msg.nonce), this.idKeys.secretKey);
+            const decryptedFlag = msg.decrypted !== 0;
+            let plaintext = msg.message;
+            if (decryptedFlag) {
+                const decrypted = xSecretboxOpen(XUtils.decodeHex(msg.message), XUtils.decodeHex(msg.nonce), this.idKeys.secretKey);
                 if (decrypted) {
-                    msg.message = XUtils.encodeUTF8(decrypted);
+                    plaintext = XUtils.encodeUTF8(decrypted);
                 }
                 else {
                     throw new Error("Couldn't decrypt messages on disk!");
                 }
             }
-            return msg;
+            const direction = msg.direction === "incoming" ? "incoming" : "outgoing";
+            return {
+                authorID: msg.authorID,
+                decrypted: decryptedFlag,
+                direction,
+                forward: msg.forward !== 0,
+                group: msg.group,
+                mailID: msg.mailID,
+                message: plaintext,
+                nonce: msg.nonce,
+                readerID: msg.readerID,
+                recipient: msg.recipient,
+                sender: msg.sender,
+                timestamp: msg.timestamp,
+            };
         });
     }
+    deviceRowToDevice(row) {
+        return {
+            deleted: row.deleted !== 0,
+            deviceID: row.deviceID,
+            lastLogin: row.lastLogin,
+            name: row.name,
+            owner: row.owner,
+            signKey: row.signKey,
+        };
+    }
+    isDuplicateError(err) {
+        if (err instanceof Error) {
+            return err.message.includes("UNIQUE");
+        }
+        if (typeof err === "object" && err !== null && "errno" in err) {
+            return err.errno === 19;
+        }
+        return false;
+    }
+    /**
+     * Encrypt a hex-encoded secret for at-rest storage.
+     * Returns hex(nonce || ciphertext) where nonce is 24 random bytes.
+     */
+    sealHex(plainHex) {
+        const nonce = xMakeNonce();
+        const ct = xSecretbox(XUtils.decodeHex(plainHex), nonce, this.idKeys.secretKey);
+        const sealed = new Uint8Array(nonce.length + ct.length);
+        sealed.set(nonce);
+        sealed.set(ct, nonce.length);
+        return XUtils.encodeHex(sealed);
+    }
+    sessionRowToSQL(row) {
+        return {
+            deviceID: row.deviceID,
+            fingerprint: row.fingerprint,
+            lastUsed: row.lastUsed,
+            mode: row.mode === "initiator" ? "initiator" : "receiver",
+            publicKey: row.publicKey,
+            sessionID: row.sessionID,
+            SK: this.unsealHex(row.SK),
+            userID: row.userID,
+            verified: row.verified !== 0,
+        };
+    }
     sqlToCrypto(session) {
         return {
-            sessionID: session.sessionID,
-            userID: session.userID,
+            fingerprint: XUtils.decodeHex(session.fingerprint),
+            lastUsed: session.lastUsed,
             mode: session.mode,
-            SK: XUtils.decodeHex(session.SK),
             publicKey: XUtils.decodeHex(session.publicKey),
-            lastUsed: session.lastUsed,
-            fingerprint: XUtils.decodeHex(session.fingerprint),
+            sessionID: session.sessionID,
+            SK: XUtils.decodeHex(session.SK),
+            userID: session.userID,
         };
     }
+    /**
+     * Decrypt a value produced by sealHex().
+     * Expects hex(nonce || ciphertext), returns the original hex string.
+     */
+    unsealHex(sealed) {
+        const bytes = XUtils.decodeHex(sealed);
+        const nonce = bytes.slice(0, 24);
+        const ct = bytes.slice(24);
+        const plain = xSecretboxOpen(ct, nonce, this.idKeys.secretKey);
+        if (!plain) {
+            throw new Error("Failed to decrypt sealed column value.");
+        }
+        return XUtils.encodeHex(plain);
+    }
     async untilReady() {
         if (this.ready)
             return;
         return new Promise((resolve) => {
             const check = () => {
-                if (this.ready)
-                    return resolve();
+                if (this.ready) {
+                    resolve();
+                    return;
+                }
                 setTimeout(check, 10);
             };
             check();