@vex-chat/libvex 8.0.0 → 9.1.0

package/src/__tests__/verifyKeyBundle.test.ts

@@ -10,9 +10,8 @@ import type { Device, KeyBundle, KeyBundleEntry } from "@vex-chat/types";
 import {
     setCryptoProfile,
     xBoxKeyPairAsync,
-    xConstants,
     xEcdhKeyPairFromEcdsaKeyPairAsync,
-    xEncode,
+    xPreKeySignaturePayload,
     xSignAsync,
     xSignKeyPairAsync,
     XUtils,
@@ -20,7 +19,6 @@ import {
 
 import { afterEach, describe, expect, it } from "vitest";
 
-import { fipsP256PreKeySignPayload } from "../utils/fipsMailExtra.js";
 import { verifyKeyBundleSignatures } from "../utils/verifyKeyBundle.js";
 
 describe.sequential("verifyKeyBundleSignatures", () => {
@@ -126,7 +124,13 @@ async function makeBundle(
     };
 
     const keyBundle: KeyBundle = {
-        preKey: await makeBundleEntry(signKeys, profile, device.deviceID, 1),
+        preKey: await makeBundleEntry(
+            signKeys,
+            profile,
+            device.deviceID,
+            1,
+            "signed",
+        ),
         signKey: identityPublic,
     };
     if (includeOtk) {
@@ -135,6 +139,7 @@ async function makeBundle(
             profile,
             device.deviceID,
             2,
+            "one-time",
         );
     }
 
@@ -146,12 +151,10 @@ async function makeBundleEntry(
     profile: CryptoProfile,
     deviceID: string,
     index: number,
+    kind: "one-time" | "signed",
 ): Promise<KeyBundleEntry> {
     const preKey = await xBoxKeyPairAsync();
-    const payload =
-        profile === "fips"
-            ? fipsP256PreKeySignPayload(preKey.publicKey)
-            : xEncode(xConstants.CURVE, preKey.publicKey);
+    const payload = xPreKeySignaturePayload(preKey.publicKey, kind, profile);
     return {
         deviceID,
         index,

package/src/codecs.ts

@@ -93,11 +93,7 @@ export const RegisterPendingApprovalCodec = createCodec(
         expiresAt: z.string(),
         requestID: z.string(),
         status: z.literal("pending_approval"),
-        // Optional for backward compat with older servers that don't
-        // surface the existing user's ID in this response. When present,
-        // clients can use it to fetch the unauthenticated avatar and
-        // show an "is this you?" confirmation before proceeding.
-        userID: z.string().optional(),
+        userID: z.string(),
     }),
 );
 
@@ -116,6 +112,7 @@ export const DeviceRegistrationResultCodec = createCodec(
             expiresAt: z.string(),
             requestID: z.string(),
             status: z.literal("pending_approval"),
+            userID: z.string(),
         }),
     ]),
 );

package/src/http.ts

@@ -148,7 +148,7 @@ export class FetchHttpClient {
         maybeReportUploadProgress(data, config.onUploadProgress);
 
         const requestRecord: HttpRequestRecord = {
-            headers: headersToRecord(headers),
+            headers: headersToSafeRecord(headers),
             method,
             url,
         };
@@ -393,6 +393,21 @@ function headersToRecord(headers: Headers): Record<string, string> {
     return out;
 }
 
+function headersToSafeRecord(headers: Headers): Record<string, string> {
+    const sensitive = new Set([
+        "authorization",
+        "cookie",
+        "proxy-authorization",
+        "x-api-key",
+        "x-device-token",
+    ]);
+    const out: Record<string, string> = {};
+    headers.forEach((value, key) => {
+        out[key] = sensitive.has(key.toLowerCase()) ? "[REDACTED]" : value;
+    });
+    return out;
+}
+
 function isFormDataValue(value: unknown): value is FormData {
     return typeof FormData !== "undefined" && value instanceof FormData;
 }

package/src/keystore/node.ts

@@ -15,7 +15,7 @@ import * as path from "node:path";
  * Stores credentials as encrypted files on disk using XUtils.encryptKeyData.
  * Node-only — imports node:fs.
  */
-import { getCryptoProfile, XUtils } from "@vex-chat/crypto";
+import { XUtils } from "@vex-chat/crypto";
 
 export class NodeKeyStore implements KeyStore {
     private readonly dir: string;
@@ -65,16 +65,18 @@ export class NodeKeyStore implements KeyStore {
     }
 
     async save(creds: StoredCredentials): Promise<void> {
-        const data = JSON.stringify(creds);
-        const encrypted =
-            getCryptoProfile() === "fips"
-                ? await XUtils.encryptKeyDataAsync(this.passphrase, data)
-                : XUtils.encryptKeyData(this.passphrase, data);
-        fs.writeFileSync(this.filePath(creds.username), encrypted);
+        const data = XUtils.encodeHex(XUtils.decodeUTF8(JSON.stringify(creds)));
+        const encrypted = await XUtils.encryptKeyDataAsync(
+            this.passphrase,
+            data,
+        );
+        const filePath = this.filePath(creds.username);
+        fs.writeFileSync(filePath, encrypted, { mode: 0o600 });
+        fs.chmodSync(filePath, 0o600);
     }
 
     private filePath(username: string): string {
-        return path.join(this.dir, `${username}.vex`);
+        return path.join(this.dir, `${encodeURIComponent(username)}.vex`);
     }
 
     private async readFile(
@@ -82,17 +84,13 @@ export class NodeKeyStore implements KeyStore {
     ): Promise<null | StoredCredentials> {
         try {
             const data = fs.readFileSync(filePath);
-            const decrypted =
-                getCryptoProfile() === "fips"
-                    ? await XUtils.decryptKeyDataAsync(
-                          new Uint8Array(data),
-                          this.passphrase,
-                      )
-                    : XUtils.decryptKeyData(
-                          new Uint8Array(data),
-                          this.passphrase,
-                      );
-            const parsed: unknown = JSON.parse(decrypted);
+            const decrypted = await XUtils.decryptKeyDataAsync(
+                new Uint8Array(data),
+                this.passphrase,
+            );
+            const parsed: unknown = JSON.parse(
+                XUtils.encodeUTF8(XUtils.decodeHex(decrypted)),
+            );
             if (isStoredCredentials(parsed)) {
                 return parsed;
             }

package/src/storage/sqlite.ts

@@ -55,6 +55,10 @@ import { effectiveMessageRetentionHintDays } from "../retention.js";
 import { parseSkippedKeysStrict } from "../utils/ratchet.js";
 
 const STORAGE_MESSAGE_BLOB_PREFIX = "vex-storage-message:1\n";
+const STORAGE_CIPHERTEXT_PREFIX = "vex-storage-cipher:2:";
+const STORAGE_SECRET_TEXT_PREFIX = "vex-storage-secret:1:";
+const STORAGE_NONCE_BYTES = 24;
+const STORAGE_MAC_BYTES = 16;
 
 export class SqliteStorage extends EventEmitter implements Storage {
     public ready = false;
@@ -408,10 +412,10 @@ export class SqliteStorage extends EventEmitter implements Storage {
                 this.ready = true;
                 this.emit("ready");
             } catch (err: unknown) {
-                this.emit(
-                    "error",
-                    err instanceof Error ? err : new Error(String(err)),
-                );
+                const error =
+                    err instanceof Error ? err : new Error(String(err));
+                this.emit("error", error);
+                throw error;
             } finally {
                 this.initInFlight = null;
             }
@@ -526,14 +530,25 @@ export class SqliteStorage extends EventEmitter implements Storage {
             return;
         }
         await this.untilReady();
+        if (this.isClosingNow()) {
+            return;
+        }
 
         // Fan-out to multiple devices reuses one `mailID` but each encrypt path
         // uses a fresh nonce (table PK). Keep a single local row per logical mail.
-        const dupe = await this.db
-            .selectFrom("messages")
-            .select("nonce")
-            .where("mailID", "=", message.mailID)
-            .executeTakeFirst();
+        let dupe: undefined | { nonce: string };
+        try {
+            dupe = await this.db
+                .selectFrom("messages")
+                .select("nonce")
+                .where("mailID", "=", message.mailID)
+                .executeTakeFirst();
+        } catch (err: unknown) {
+            if (this.isClosingNow() || this.isTornDownError(err)) {
+                return;
+            }
+            throw err;
+        }
         if (dupe !== undefined) {
             return;
         }
@@ -543,22 +558,9 @@ export class SqliteStorage extends EventEmitter implements Storage {
             !message.decrypted &&
             message.message === "" &&
             message.extra === undefined;
-        const fips = getCryptoProfile() === "fips";
         const encryptedMessage = isPlaintextFailurePlaceholder
             ? storedPlaintext
-            : XUtils.encodeHex(
-                  fips
-                      ? await xSecretboxAsync(
-                            XUtils.decodeUTF8(storedPlaintext),
-                            XUtils.decodeHex(message.nonce),
-                            this.atRestAesKey,
-                        )
-                      : xSecretbox(
-                            XUtils.decodeUTF8(storedPlaintext),
-                            XUtils.decodeHex(message.nonce),
-                            this.atRestAesKey,
-                        ),
-              );
+            : await this.sealMessagePlaintext(storedPlaintext);
         if (this.isClosingNow()) {
             return;
         }
@@ -656,61 +658,56 @@ export class SqliteStorage extends EventEmitter implements Storage {
         const sealedDHsPrivate = await this.sealHex(session.DHsPrivate);
         const sealedRK = await this.sealHex(session.RK);
         const sealedSK = await this.sealHex(session.SK);
-        try {
-            await this.db
-                .insertInto("sessions")
-                .values({
-                    CKr: sealedCKr,
-                    CKs: sealedCKs,
-                    deviceID: session.deviceID,
-                    DHr: session.DHr,
-                    DHsPrivate: sealedDHsPrivate,
-                    DHsPublic: session.DHsPublic,
-                    fingerprint: session.fingerprint,
-                    lastUsed: session.lastUsed,
-                    mode: session.mode,
-                    Nr: session.Nr,
-                    Ns: session.Ns,
-                    PN: session.PN,
-                    publicKey: session.publicKey,
-                    RK: sealedRK,
-                    sessionID: session.sessionID,
-                    SK: sealedSK,
-                    skippedKeys: session.skippedKeys,
-                    userID: session.userID,
-                    verified: session.verified ? 1 : 0,
-                })
-                .execute();
-        } catch (err: unknown) {
-            if (this.isDuplicateError(err)) {
-                await this.db
-                    .updateTable("sessions")
-                    .set({
-                        CKr: sealedCKr,
-                        CKs: sealedCKs,
-                        deviceID: session.deviceID,
-                        DHr: session.DHr,
-                        DHsPrivate: sealedDHsPrivate,
-                        DHsPublic: session.DHsPublic,
-                        fingerprint: session.fingerprint,
-                        lastUsed: session.lastUsed,
-                        mode: session.mode,
-                        Nr: session.Nr,
-                        Ns: session.Ns,
-                        PN: session.PN,
-                        publicKey: session.publicKey,
-                        RK: sealedRK,
-                        SK: sealedSK,
-                        skippedKeys: session.skippedKeys,
-                        userID: session.userID,
-                        verified: session.verified ? 1 : 0,
-                    })
-                    .where("sessionID", "=", session.sessionID)
-                    .execute();
-            } else {
-                throw err;
-            }
-        }
+        const sealedSkippedKeys = await this.sealSecretText(
+            session.skippedKeys,
+        );
+        const values = {
+            CKr: sealedCKr,
+            CKs: sealedCKs,
+            deviceID: session.deviceID,
+            DHr: session.DHr,
+            DHsPrivate: sealedDHsPrivate,
+            DHsPublic: session.DHsPublic,
+            fingerprint: session.fingerprint,
+            lastUsed: session.lastUsed,
+            mode: session.mode,
+            Nr: session.Nr,
+            Ns: session.Ns,
+            PN: session.PN,
+            publicKey: session.publicKey,
+            RK: sealedRK,
+            sessionID: session.sessionID,
+            SK: sealedSK,
+            skippedKeys: sealedSkippedKeys,
+            userID: session.userID,
+            verified: session.verified ? 1 : 0,
+        };
+        await this.db
+            .insertInto("sessions")
+            .values(values)
+            .onConflict((conflict) =>
+                conflict.column("sessionID").doUpdateSet({
+                    CKr: values.CKr,
+                    CKs: values.CKs,
+                    deviceID: values.deviceID,
+                    DHr: values.DHr,
+                    DHsPrivate: values.DHsPrivate,
+                    DHsPublic: values.DHsPublic,
+                    fingerprint: values.fingerprint,
+                    lastUsed: values.lastUsed,
+                    mode: values.mode,
+                    Nr: values.Nr,
+                    Ns: values.Ns,
+                    PN: values.PN,
+                    publicKey: values.publicKey,
+                    RK: values.RK,
+                    SK: values.SK,
+                    skippedKeys: values.skippedKeys,
+                    userID: values.userID,
+                    verified: values.verified,
+                }),
+            )
+            .execute();
     }
 
     async updateMessage(
@@ -749,18 +746,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
                 : {}),
         };
         const storedPlaintext = encodeStoredMessagePlaintext(next);
-        const fips = getCryptoProfile() === "fips";
-        const ct = fips
-            ? await xSecretboxAsync(
-                  XUtils.decodeUTF8(storedPlaintext),
-                  XUtils.decodeHex(row.nonce),
-                  this.atRestAesKey,
-              )
-            : xSecretbox(
-                  XUtils.decodeUTF8(storedPlaintext),
-                  XUtils.decodeHex(row.nonce),
-                  this.atRestAesKey,
-              );
+        const sealedMessage = await this.sealMessagePlaintext(storedPlaintext);
         if (this.isClosingNow()) {
             return false;
         }
@@ -768,7 +754,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
             .updateTable("messages")
             .set({
                 extra: null,
-                message: XUtils.encodeHex(ct),
+                message: sealedMessage,
             })
             .where("mailID", "=", mailID)
             .executeTakeFirst();
@@ -780,7 +766,6 @@ export class SqliteStorage extends EventEmitter implements Storage {
     private async decryptMessagesAsync(
         messages: MessageRow[],
     ): Promise<Message[]> {
-        const fips = getCryptoProfile() === "fips";
         const out: Message[] = [];
         let processed = 0;
         /** Yield so RN / web UIs can paint between at-rest decrypt blocks. */
@@ -796,20 +781,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
             const isPlaintextFailurePlaceholder =
                 !decryptedFlag && msg.message === "" && msg.extra === null;
             if (!isPlaintextFailurePlaceholder) {
-                const cipher = XUtils.decodeHex(msg.message);
-                const nonce = XUtils.decodeHex(msg.nonce);
-                const decrypted = fips
-                    ? await xSecretboxOpenAsync(
-                          cipher,
-                          nonce,
-                          this.atRestAesKey,
-                      )
-                    : xSecretboxOpen(cipher, nonce, this.atRestAesKey);
-                if (decrypted) {
-                    plaintext = XUtils.encodeUTF8(decrypted);
-                } else {
-                    throw new Error("Couldn't decrypt messages on disk!");
-                }
+                plaintext = await this.openMessagePlaintext(msg.message);
             }
             const direction =
                 msg.direction === "incoming" ? "incoming" : "outgoing";
@@ -930,8 +902,14 @@ export class SqliteStorage extends EventEmitter implements Storage {
     }
 
     private isDuplicateError(err: unknown): boolean {
-        if (err instanceof Error) {
-            return err.message.includes("UNIQUE");
+        const message =
+            err instanceof Error
+                ? err.message
+                : typeof err === "string"
+                  ? err
+                  : "";
+        if (message.toUpperCase().includes("UNIQUE")) {
+            return true;
         }
         if (typeof err === "object" && err !== null && "errno" in err) {
             return err.errno === 19;
@@ -955,26 +933,52 @@ export class SqliteStorage extends EventEmitter implements Storage {
         return false;
     }
 
-    /**
-     * Encrypt a hex-encoded secret for at-rest storage.
-     * Returns hex(nonce || ciphertext) where nonce is 24 random bytes.
-     */
-    private async sealHex(plainHex: string): Promise<string> {
+    private async openMessagePlaintext(stored: string): Promise<string> {
+        if (!stored.startsWith(STORAGE_CIPHERTEXT_PREFIX)) {
+            throw new Error(
+                "Stored message is missing its encryption envelope.",
+            );
+        }
+        const plain = await this.unsealBytes(
+            stored.slice(STORAGE_CIPHERTEXT_PREFIX.length),
+        );
+        return XUtils.encodeUTF8(plain);
+    }
+
+    private async sealBytes(plaintext: Uint8Array): Promise<string> {
         const nonce = xMakeNonce();
         const fips = getCryptoProfile() === "fips";
         const ct = fips
-            ? await xSecretboxAsync(
-                  XUtils.decodeHex(plainHex),
-                  nonce,
-                  this.atRestAesKey,
-              )
-            : xSecretbox(XUtils.decodeHex(plainHex), nonce, this.atRestAesKey);
+            ? await xSecretboxAsync(plaintext, nonce, this.atRestAesKey)
+            : xSecretbox(plaintext, nonce, this.atRestAesKey);
         const sealed = new Uint8Array(nonce.length + ct.length);
         sealed.set(nonce);
         sealed.set(ct, nonce.length);
         return XUtils.encodeHex(sealed);
     }
 
+    /**
+     * Encrypt a hex-encoded secret for at-rest storage.
+     * Returns hex(nonce || ciphertext) where nonce is 24 random bytes.
+     */
+    private async sealHex(plainHex: string): Promise<string> {
+        return this.sealBytes(XUtils.decodeHex(plainHex));
+    }
+
+    private async sealMessagePlaintext(plaintext: string): Promise<string> {
+        return (
+            STORAGE_CIPHERTEXT_PREFIX +
+            (await this.sealBytes(XUtils.decodeUTF8(plaintext)))
+        );
+    }
+
+    private async sealSecretText(plaintext: string): Promise<string> {
+        return (
+            STORAGE_SECRET_TEXT_PREFIX +
+            (await this.sealBytes(XUtils.decodeUTF8(plaintext)))
+        );
+    }
+
     private async sessionRowToSQLAsync(row: SessionRow): Promise<SessionSQL> {
         const rawSK = await this.unsealHex(row.SK);
         const rawRK = row.RK ? await this.unsealHex(row.RK) : rawSK;
@@ -997,7 +1001,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
             RK: rawRK,
             sessionID: row.sessionID,
             SK: rawSK,
-            skippedKeys: row.skippedKeys,
+            skippedKeys: await this.unsealSecretText(row.skippedKeys),
             userID: row.userID,
             verified: row.verified !== 0,
         };
@@ -1027,14 +1031,13 @@ export class SqliteStorage extends EventEmitter implements Storage {
         };
     }
 
-    /**
-     * Decrypt a value produced by sealHex().
-     * Expects hex(nonce || ciphertext), returns the original hex string.
-     */
-    private async unsealHex(sealed: string): Promise<string> {
+    private async unsealBytes(sealed: string): Promise<Uint8Array> {
         const bytes = XUtils.decodeHex(sealed);
-        const nonce = bytes.slice(0, 24);
-        const ct = bytes.slice(24);
+        if (bytes.length < STORAGE_NONCE_BYTES + STORAGE_MAC_BYTES) {
+            throw new Error("Sealed column value is truncated.");
+        }
+        const nonce = bytes.slice(0, STORAGE_NONCE_BYTES);
+        const ct = bytes.slice(STORAGE_NONCE_BYTES);
         const fips = getCryptoProfile() === "fips";
         const plain = fips
             ? await xSecretboxOpenAsync(ct, nonce, this.atRestAesKey)
@@ -1042,21 +1045,41 @@ export class SqliteStorage extends EventEmitter implements Storage {
         if (!plain) {
             throw new Error("Failed to decrypt sealed column value.");
         }
-        return XUtils.encodeHex(plain);
+        return plain;
+    }
+
+    /**
+     * Decrypt a value produced by sealHex().
+     * Expects hex(nonce || ciphertext), returns the original hex string.
+     */
+    private async unsealHex(sealed: string): Promise<string> {
+        return XUtils.encodeHex(await this.unsealBytes(sealed));
+    }
+
+    private async unsealSecretText(stored: string): Promise<string> {
+        if (!stored.startsWith(STORAGE_SECRET_TEXT_PREFIX)) {
+            throw new Error(
+                "Stored secret is missing its encryption envelope.",
+            );
+        }
+        const plain = await this.unsealBytes(
+            stored.slice(STORAGE_SECRET_TEXT_PREFIX.length),
+        );
+        return XUtils.encodeUTF8(plain);
     }
 
     private async untilReady(): Promise<void> {
-        if (this.ready) return;
-        return new Promise((resolve) => {
-            const check = () => {
-                if (this.ready) {
-                    resolve();
-                    return;
-                }
-                setTimeout(check, 10);
-            };
-            check();
-        });
+        if (this.closing) {
+            throw new Error("SqliteStorage is closed.");
+        }
+        if (this.ready) {
+            return;
+        }
+        if (this.initInFlight) {
+            await this.initInFlight;
+        } else {
+            await this.init();
+        }
     }
 }
 

package/src/utils/verifyKeyBundle.ts

@@ -9,14 +9,11 @@ import type { Device, KeyBundle, KeyBundleEntry } from "@vex-chat/types";
 
 import {
     fipsEcdhRawPublicKeyFromEcdsaSpkiAsync,
-    xConstants,
-    xEncode,
+    xPreKeySignaturePayload,
     xSignOpenAsync,
     XUtils,
 } from "@vex-chat/crypto";
 
-import { fipsP256PreKeySignPayload } from "./fipsMailExtra.js";
-
 export async function verifyKeyBundleSignatures(
     keyBundle: KeyBundle,
     device: Device,
@@ -37,7 +34,7 @@ export async function verifyKeyBundleSignatures(
         device,
         deviceSignKey,
         cryptoProfile,
-        "signed prekey",
+        "signed",
     );
 
     if (keyBundle.otk) {
@@ -46,7 +43,7 @@ export async function verifyKeyBundleSignatures(
             device,
             deviceSignKey,
             cryptoProfile,
-            "one-time prekey",
+            "one-time",
         );
     }
 }
@@ -56,19 +53,22 @@ async function verifyKeyBundleEntrySignature(
     device: Device,
     deviceSignKey: Uint8Array,
     cryptoProfile: CryptoProfile,
-    label: string,
+    kind: "one-time" | "signed",
 ): Promise<void> {
     if (entry.deviceID !== device.deviceID) {
-        throw new Error(`Key bundle ${label} belongs to a different device.`);
+        throw new Error(
+            `Key bundle ${kind} prekey belongs to a different device.`,
+        );
     }
 
-    const payload =
-        cryptoProfile === "fips"
-            ? fipsP256PreKeySignPayload(entry.publicKey)
-            : xEncode(xConstants.CURVE, entry.publicKey);
+    const payload = xPreKeySignaturePayload(
+        entry.publicKey,
+        kind,
+        cryptoProfile,
+    );
     const opened = await xSignOpenAsync(entry.signature, deviceSignKey);
 
     if (!opened || !XUtils.bytesEqual(opened, payload)) {
-        throw new Error(`Key bundle ${label} signature is invalid.`);
+        throw new Error(`Key bundle ${kind} prekey signature is invalid.`);
     }
 }