@vex-chat/libvex 8.0.0 → 9.1.0

package/src/__tests__/harness/shared-suite.ts

@@ -79,11 +79,46 @@ export function platformSuite(
             expect(true).toBe(true);
         });
 
-        test("send and receive DM (self)", async () => {
+        test("existing-account device request requires password", async () => {
+            const SK2 = await e2eGenerateSecretKey();
+            const opts2: ClientOptions = e2eClientOptionsBase();
+            const storage2 = await makeStorage(SK2, opts2);
+            const client2 = await Client.create(SK2, opts2, storage2);
+
+            try {
+                const [duplicateUser, duplicateErr] = await client2.register(
+                    username,
+                    password,
+                );
+                expect(duplicateUser).toBeNull();
+                expect(duplicateErr?.message).toContain(
+                    "Username is already registered. Sign in instead.",
+                );
+
+                const [missingPasswordUser, missingPasswordErr] =
+                    await client2.requestDeviceEnrollmentWithPasskey(username);
+                expect(missingPasswordUser).toBeNull();
+                expect(missingPasswordErr?.message).toContain(
+                    "Password is required to add this device.",
+                );
+
+                const [pendingUser, pendingErr] =
+                    await client2.requestDeviceEnrollment(username, password);
+                expect(pendingUser).toBeNull();
+                expect(pendingErr?.name).toBe("DeviceApprovalRequiredError");
+                expect(
+                    (pendingErr as null | { requestID?: unknown })?.requestID,
+                ).toEqual(expect.any(String));
+            } finally {
+                await client2.close().catch(() => {});
+            }
+        });
+
+        test("send self-DM without duplicating it as incoming", async () => {
             const me = client.me.user();
             const msgPromise = waitForMessage(
                 client,
-                (m) => m.direction === "incoming" && m.decrypted,
+                (m) => m.direction === "outgoing" && m.decrypted,
                 `[${platformName}] self-DM`,
             );
             await client.messages.send(me.userID, "platform-test");
@@ -91,7 +126,7 @@ export function platformSuite(
             expect(msg.message).toBe("platform-test");
         });
 
-        test("send and receive DM with encrypted extra", async () => {
+        test("send self-DM with encrypted extra", async () => {
             const me = client.me.user();
             const extra = JSON.stringify({
                 reactionEvent: {
@@ -104,7 +139,7 @@ export function platformSuite(
             const msgPromise = waitForMessage(
                 client,
                 (m) =>
-                    m.direction === "incoming" &&
+                    m.direction === "outgoing" &&
                     m.decrypted &&
                     m.extra === extra,
                 `[${platformName}] self-DM extra`,
@@ -127,7 +162,7 @@ export function platformSuite(
             const msgPromise = waitForMessage(
                 client,
                 (m) =>
-                    m.direction === "incoming" &&
+                    m.direction === "outgoing" &&
                     m.decrypted &&
                     m.message === body,
                 "history DM",
@@ -156,11 +191,14 @@ export function platformSuite(
             try {
                 const [user2, regErr] = await client2.register(
                     username2,
-                    "test-pw-2",
+                    "test password two",
                 );
                 expect(regErr).toBeNull();
 
-                const loginErr = await client2.login(username2, "test-pw-2");
+                const loginErr = await client2.login(
+                    username2,
+                    "test password two",
+                );
                 expect(loginErr.ok).toBe(true);
 
                 await connectAndWait(client2, "client2");
@@ -186,14 +224,14 @@ export function platformSuite(
             const storage1 = await makeStorage(SK1, opts1);
             const client1 = await Client.create(SK1, opts1, storage1);
             const username1 = Client.randomUsername();
-            const password1 = "test-pw-1";
+            const password1 = "test password one";
 
             const SK2 = await e2eGenerateSecretKey();
             const opts2: ClientOptions = e2eClientOptionsBase();
             const storage2 = await makeStorage(SK2, opts2);
             const client2 = await Client.create(SK2, opts2, storage2);
             const username2 = Client.randomUsername();
-            const password2 = "test-pw-2";
+            const password2 = "test password two";
 
             try {
                 const [_user1, regErr1] = await client1.register(
@@ -264,8 +302,16 @@ export function platformSuite(
 
             try {
                 // Register + login + connect user2
-                await client2.register(username2, "test-pw-2");
-                await client2.login(username2, "test-pw-2");
+                const [_user2, registrationError] = await client2.register(
+                    username2,
+                    "test password two",
+                );
+                expect(registrationError).toBeNull();
+                const loginResult = await client2.login(
+                    username2,
+                    "test password two",
+                );
+                expect(loginResult.ok).toBe(true);
                 await connectAndWait(client2, "client2");
 
                 // user1 creates server + channel
@@ -366,6 +412,25 @@ export function platformSuite(
             const byID = await client.servers.retrieveByID(server.serverID);
             expect(byID?.serverID).toBe(server.serverID);
 
+            const renamed = await client.servers.update(
+                server.serverID,
+                "Renamed Server",
+            );
+            expect(renamed.name).toBe("Renamed Server");
+
+            const withIcon = await client.servers.setIcon(
+                server.serverID,
+                testImage,
+            );
+            expect(withIcon.icon).toEqual(expect.any(String));
+            expect(client.servers.iconURL(withIcon.icon!)).toContain(
+                `/server-icon/${withIcon.icon!}`,
+            );
+            const withoutIcon = await client.servers.removeIcon(
+                server.serverID,
+            );
+            expect(withoutIcon.icon).toBeUndefined();
+
             await client.servers.delete(server.serverID);
             const afterDelete = await client.servers.retrieve();
             expect(
@@ -383,6 +448,12 @@ export function platformSuite(
             const byID = await client.channels.retrieveByID(channel.channelID);
             expect(byID?.channelID).toBe(channel.channelID);
 
+            const renamed = await client.channels.update(
+                channel.channelID,
+                "Renamed Channel",
+            );
+            expect(renamed.name).toBe("Renamed Channel");
+
             await client.channels.delete(channel.channelID);
             const channels = await client.channels.retrieve(server.serverID);
             expect(
@@ -390,6 +461,9 @@ export function platformSuite(
             ).toBe(false);
             // Default channel still exists
             expect(channels.length).toBe(1);
+            await expect(
+                client.channels.delete(channels[0]!.channelID),
+            ).rejects.toThrow();
 
             await client.servers.delete(server.serverID);
         });
@@ -504,6 +578,31 @@ export function platformSuite(
                 });
             }
         });
+
+        test("changes the account password with current-password proof", async () => {
+            const replacementPassword = "updated platform test password";
+
+            await expect(
+                client.me.changePassword(
+                    "incorrect platform test password",
+                    replacementPassword,
+                ),
+            ).rejects.toThrow();
+            await client.me.changePassword(password, replacementPassword);
+            await client.logout();
+
+            const oldLogin = await client.login(username, password);
+            expect(oldLogin.ok).toBe(false);
+            const newLogin = await client.login(username, replacementPassword);
+            expect(newLogin.ok).toBe(true);
+        });
+
+        test("logout clears local authentication", async () => {
+            await client.logout();
+            await expect(client.connect()).rejects.toThrow(
+                "No token — call login() or loginWithDeviceKey() first.",
+            );
+        });
     });
 }
 

package/src/__tests__/http.test.ts

@@ -68,6 +68,28 @@ describe("FetchHttpClient", () => {
         expect(err.response?.data).toBe("plain failure");
     });
 
+    it("redacts credentials from request metadata on errors", async () => {
+        globalThis.fetch = () =>
+            Promise.resolve(new Response(null, { status: 401 }));
+        const client = createFetchHttpClient();
+        client.defaults.headers.common.Authorization =
+            "Bearer secret-user-token";
+        client.defaults.headers.common["X-Device-Token"] =
+            "secret-device-token";
+
+        const err = await captureError(() =>
+            client.get("https://example.test/private"),
+        );
+        if (!isHttpError(err)) {
+            throw err;
+        }
+
+        expect(err.config.headers["authorization"]).toBe("[REDACTED]");
+        expect(err.config.headers["x-device-token"]).toBe("[REDACTED]");
+        expect(JSON.stringify(err)).not.toContain("secret-user-token");
+        expect(JSON.stringify(err)).not.toContain("secret-device-token");
+    });
+
     it("emits a final upload progress event for FormData payloads", async () => {
         globalThis.fetch = () =>
             Promise.resolve(new Response(new ArrayBuffer(0), { status: 200 }));

package/src/__tests__/multi-device-delivery.test.ts

@@ -0,0 +1,147 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Device, User } from "@vex-chat/types";
+
+import { describe, expect, it, vi } from "vitest";
+
+import { Client } from "../Client.js";
+
+type SendGroupMessage = (
+    this: unknown,
+    channelID: string,
+    message: string,
+) => Promise<void>;
+
+type SendMessage = (
+    this: unknown,
+    userID: string,
+    message: string,
+) => Promise<void>;
+
+const now = "2026-07-14T00:00:00.000Z";
+
+function device(deviceID: string, owner: string): Device {
+    return {
+        deleted: false,
+        deviceID,
+        lastLogin: now,
+        name: deviceID,
+        owner,
+        signKey: `${deviceID}-sign-key`,
+    };
+}
+
+function user(userID: string, username: string): User {
+    return { lastSeen: now, userID, username };
+}
+
+describe("multi-device delivery", () => {
+    it("succeeds when one direct-message recipient device is unavailable", async () => {
+        const sender = user("user-a", "alice");
+        const recipient = user("user-b", "bob");
+        const unavailable = device("device-b-1", recipient.userID);
+        const available = device("device-b-2", recipient.userID);
+        const sendMailWithRecovery = vi.fn((target: Device) =>
+            target === unavailable
+                ? Promise.reject(new Error("Device is unavailable."))
+                : Promise.resolve(null),
+        );
+        const fakeClient = {
+            fetchUser: vi.fn(() => Promise.resolve([recipient, null])),
+            fetchUserDeviceListOnce: vi.fn(() =>
+                Promise.resolve([unavailable, available]),
+            ),
+            fetchUserDeviceListWithBackoff: vi.fn(() =>
+                Promise.resolve([unavailable, available]),
+            ),
+            getUser: () => sender,
+            sendMailWithRecovery,
+        };
+        const sendMessage = Reflect.get(
+            Client.prototype,
+            "sendMessage",
+        ) as SendMessage;
+
+        await expect(
+            sendMessage.call(fakeClient, recipient.userID, "hello"),
+        ).resolves.toBeUndefined();
+        expect(sendMailWithRecovery).toHaveBeenCalledTimes(2);
+    });
+
+    it("succeeds when another device for each group recipient receives the message", async () => {
+        const sender = user("user-a", "alice");
+        const recipient = user("user-b", "bob");
+        const ownDevice = device("device-a-1", sender.userID);
+        const unavailable = device("device-b-1", recipient.userID);
+        const available = device("device-b-2", recipient.userID);
+        const sendMailWithRecovery = vi.fn((target: Device) =>
+            target === unavailable
+                ? Promise.reject(new Error("Device is unavailable."))
+                : Promise.resolve(null),
+        );
+        const fakeClient = {
+            fetchUserDeviceListWithBackoff: vi.fn(() =>
+                Promise.resolve([ownDevice]),
+            ),
+            getMultiUserDeviceList: vi.fn(() =>
+                Promise.resolve([unavailable, available]),
+            ),
+            getUser: () => sender,
+            getUserList: vi.fn(() => Promise.resolve([sender, recipient])),
+            sendMailWithRecovery,
+            userRecords: {} as Record<string, User>,
+        };
+        const sendGroupMessage = Reflect.get(
+            Client.prototype,
+            "sendGroupMessage",
+        ) as SendGroupMessage;
+
+        await expect(
+            sendGroupMessage.call(
+                fakeClient,
+                "1b0a66e2-8275-4f8b-84d5-cb7309d41410",
+                "hello channel",
+            ),
+        ).resolves.toBeUndefined();
+        expect(sendMailWithRecovery).toHaveBeenCalledTimes(3);
+    });
+
+    it("still fails a group send when a recipient has no successful device delivery", async () => {
+        const sender = user("user-a", "alice");
+        const recipient = user("user-b", "bob");
+        const ownDevice = device("device-a-1", sender.userID);
+        const recipientDevice = device("device-b-1", recipient.userID);
+        const fakeClient = {
+            fetchUserDeviceListWithBackoff: vi.fn(() =>
+                Promise.resolve([ownDevice]),
+            ),
+            getMultiUserDeviceList: vi.fn(() =>
+                Promise.resolve([recipientDevice]),
+            ),
+            getUser: () => sender,
+            getUserList: vi.fn(() => Promise.resolve([sender, recipient])),
+            sendMailWithRecovery: vi.fn((target: Device) =>
+                target === recipientDevice
+                    ? Promise.reject(new Error("Recipient is unavailable."))
+                    : Promise.resolve(null),
+            ),
+            userRecords: {} as Record<string, User>,
+        };
+        const sendGroupMessage = Reflect.get(
+            Client.prototype,
+            "sendGroupMessage",
+        ) as SendGroupMessage;
+
+        await expect(
+            sendGroupMessage.call(
+                fakeClient,
+                "1b0a66e2-8275-4f8b-84d5-cb7309d41410",
+                "hello channel",
+            ),
+        ).rejects.toThrow("Recipient is unavailable.");
+    });
+});

package/src/__tests__/node-keystore.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { StoredCredentials } from "../types/index.js";
+
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { NodeKeyStore } from "../keystore/node.js";
+
+const dirs: string[] = [];
+
+afterEach(() => {
+    for (const dir of dirs.splice(0)) {
+        fs.rmSync(dir, { force: true, recursive: true });
+    }
+});
+
+describe("NodeKeyStore", () => {
+    it("round-trips credentials through the encrypted file", async () => {
+        const dir = makeTempDir();
+        const store = new NodeKeyStore("correct horse battery staple", dir);
+        const credentials: StoredCredentials = {
+            deviceID: "device-id",
+            deviceKey: "ab".repeat(64),
+            preKey: "cd".repeat(32),
+            token: "saved-token",
+            username: "alice",
+        };
+
+        await store.save(credentials);
+
+        await expect(store.load("alice")).resolves.toEqual(credentials);
+        await expect(store.load()).resolves.toEqual(credentials);
+        const raw = fs.readFileSync(path.join(dir, "alice.vex"));
+        expect(raw.toString("utf8")).not.toContain("saved-token");
+        expect(fs.statSync(path.join(dir, "alice.vex")).mode & 0o777).toBe(
+            0o600,
+        );
+    });
+
+    it("keeps usernames inside the configured directory", async () => {
+        const dir = makeTempDir();
+        const store = new NodeKeyStore("password", dir);
+
+        await store.save({
+            deviceID: "device-id",
+            deviceKey: "ab".repeat(64),
+            username: "../outside",
+        });
+
+        expect(fs.readdirSync(dir)).toEqual(["..%2Foutside.vex"]);
+        await expect(store.load("../outside")).resolves.toMatchObject({
+            username: "../outside",
+        });
+    });
+});
+
+function makeTempDir(): string {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "vex-keystore-"));
+    dirs.push(dir);
+    return dir;
+}

package/src/__tests__/prekey-reuse.test.ts

@@ -10,10 +10,9 @@ import type { CryptoProfile, KeyPair } from "@vex-chat/crypto";
 import {
     setCryptoProfile,
     xBoxKeyPairAsync,
-    xConstants,
     xEcdhKeyPairFromEcdsaKeyPairAsync,
-    xEncode,
     XKeyConvert,
+    xPreKeySignaturePayload,
     xSignAsync,
     xSignKeyPair,
     xSignKeyPairAsync,
@@ -24,12 +23,11 @@ import {
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { Client } from "../Client.js";
-import { fipsP256PreKeySignPayload } from "../utils/fipsMailExtra.js";
 
 import { MemoryStorage } from "./harness/memory-storage.js";
 
 interface KeyRingHarness {
-    createPreKey: () => Promise<UnsavedPreKey>;
+    createPreKey: (kind: "one-time" | "signed") => Promise<UnsavedPreKey>;
     cryptoProfile: CryptoProfile;
     database: MemoryStorage;
     idKeys: KeyPair;
@@ -41,7 +39,7 @@ interface KeyRingHarness {
 }
 
 const clientMethods = Client.prototype as unknown as {
-    createPreKey: () => Promise<UnsavedPreKey>;
+    createPreKey: (kind: "one-time" | "signed") => Promise<UnsavedPreKey>;
     isPreKeySignedByCurrentDevice: (preKey: PreKeysCrypto) => Promise<boolean>;
     populateKeyRing: () => Promise<void>;
     runWithThisCryptoProfile: <T>(fn: () => Promise<T>) => Promise<T>;
@@ -54,10 +52,11 @@ async function isValidFor(
 ): Promise<boolean> {
     setCryptoProfile(profile);
     const opened = await xSignOpenAsync(preKey.signature, signKeys.publicKey);
-    const payload =
-        profile === "fips"
-            ? fipsP256PreKeySignPayload(preKey.keyPair.publicKey)
-            : xEncode(xConstants.CURVE, preKey.keyPair.publicKey);
+    const payload = xPreKeySignaturePayload(
+        preKey.keyPair.publicKey,
+        "signed",
+        profile,
+    );
     return Boolean(opened && XUtils.bytesEqual(opened, payload));
 }
 
@@ -67,10 +66,11 @@ async function makeSignedPreKey(
 ): Promise<UnsavedPreKey> {
     setCryptoProfile(profile);
     const keyPair = await xBoxKeyPairAsync();
-    const payload =
-        profile === "fips"
-            ? fipsP256PreKeySignPayload(keyPair.publicKey)
-            : xEncode(xConstants.CURVE, keyPair.publicKey);
+    const payload = xPreKeySignaturePayload(
+        keyPair.publicKey,
+        "signed",
+        profile,
+    );
     return {
         keyPair,
         signature: await xSignAsync(payload, signKeys.secretKey),

package/src/__tests__/storage-sqlite.test.ts

@@ -1,5 +1,6 @@
 import type { Message } from "../index.js";
 import type { ClientDatabase } from "../storage/schema.js";
+import type { SessionSQL } from "@vex-chat/types";
 
 import BetterSqlite3 from "better-sqlite3";
 import { Kysely, SqliteDialect } from "kysely";
@@ -74,6 +75,96 @@ describe("SqliteStorage message at-rest encryption", () => {
             await storage.close();
         }
     });
+
+    it("uses a fresh local nonce when a stored message is edited", async () => {
+        const { db, storage } = makeStorage();
+        try {
+            await storage.init();
+            const message = makeMessage({
+                mailID: "editable-mail",
+                message: "before",
+                nonce: nonceHex(3),
+            });
+            await storage.saveMessage(message);
+
+            const before = await messageRow(db, message.mailID);
+            expect(before?.message).toMatch(/^vex-storage-cipher:2:/);
+            const localNonce = before?.message
+                .slice("vex-storage-cipher:2:".length)
+                .slice(0, 48);
+            expect(localNonce).not.toBe(message.nonce);
+
+            await expect(
+                storage.updateMessage(message.mailID, { message: "after" }),
+            ).resolves.toBe(true);
+            const after = await messageRow(db, message.mailID);
+            expect(after?.message).toMatch(/^vex-storage-cipher:2:/);
+            expect(after?.message).not.toBe(before?.message);
+            expect(after?.nonce).toBe(message.nonce);
+
+            const history = await storage.getMessageHistory(message.authorID);
+            expect(history).toMatchObject([
+                { mailID: message.mailID, message: "after" },
+            ]);
+        } finally {
+            await storage.close();
+        }
+    });
+
+    it("encrypts skipped Double Ratchet keys at rest", async () => {
+        const { db, storage } = makeStorage();
+        try {
+            await storage.init();
+            const skippedKeys = JSON.stringify({
+                "ratchet-key:7": "ab".repeat(32),
+            });
+            const session = makeSession({ skippedKeys });
+            await storage.saveSession(session);
+
+            const row = await db
+                .selectFrom("sessions")
+                .select("skippedKeys")
+                .where("sessionID", "=", session.sessionID)
+                .executeTakeFirstOrThrow();
+            expect(row.skippedKeys).toMatch(/^vex-storage-secret:1:/);
+            expect(row.skippedKeys).not.toContain("ratchet-key");
+            expect(row.skippedKeys).not.toContain("ab".repeat(32));
+
+            const roundTripped = await storage.getAllSessions();
+            expect(roundTripped).toMatchObject([
+                { sessionID: session.sessionID, skippedKeys },
+            ]);
+        } finally {
+            await storage.close();
+        }
+    });
+
+    it("atomically updates an existing Double Ratchet session", async () => {
+        const { storage } = makeStorage();
+        try {
+            await storage.init();
+            const session = makeSession({ Ns: 1 });
+            await storage.saveSession(session);
+
+            await storage.saveSession({
+                ...session,
+                CKs: "77".repeat(32),
+                lastUsed: "2026-06-02T00:00:00.000Z",
+                Ns: 2,
+            });
+
+            const rows = await storage.getAllSessions();
+            expect(rows).toHaveLength(1);
+            expect(rows[0]).toMatchObject({
+                CKs: "77".repeat(32),
+                lastUsed: "2026-06-02T00:00:00.000Z",
+                Ns: 2,
+                sessionID: session.sessionID,
+            });
+        } finally {
+            await storage.close();
+        }
+    });
 });
 
 function makeMessage(overrides: Partial<Message>): Message {
@@ -94,6 +185,31 @@ function makeMessage(overrides: Partial<Message>): Message {
     };
 }
 
+function makeSession(overrides: Partial<SessionSQL>): SessionSQL {
+    return {
+        CKr: null,
+        CKs: null,
+        deviceID: "peer-device",
+        DHr: null,
+        DHsPrivate: "11".repeat(32),
+        DHsPublic: "22".repeat(32),
+        fingerprint: "33".repeat(32),
+        lastUsed: "2026-06-01T00:00:00.000Z",
+        mode: "initiator",
+        Nr: 0,
+        Ns: 0,
+        PN: 0,
+        publicKey: "44".repeat(32),
+        RK: "55".repeat(32),
+        sessionID: "session-id",
+        SK: "66".repeat(32),
+        skippedKeys: "{}",
+        userID: "peer-user",
+        verified: false,
+        ...overrides,
+    };
+}
+
 function makeStorage(): {
     db: Kysely<ClientDatabase>;
     storage: SqliteStorage;
@@ -112,7 +228,7 @@ function makeStorage(): {
 async function messageRow(db: Kysely<ClientDatabase>, mailID: string) {
     return await db
         .selectFrom("messages")
-        .select(["decrypted", "extra", "message"])
+        .select(["decrypted", "extra", "message", "nonce"])
         .where("mailID", "=", mailID)
         .executeTakeFirst();
 }