@vex-chat/spire 0.8.0 → 1.0.1

package/dist/Database.js

@@ -1,394 +1,430 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.hashPassword = exports.Database = exports.ITERATIONS = void 0;
-const crypto_1 = require("@vex-chat/crypto");
-const events_1 = require("events");
-const knex_1 = __importDefault(require("knex"));
-const pbkdf2_1 = __importDefault(require("pbkdf2"));
-const uuid = __importStar(require("uuid"));
-const createLogger_1 = require("./utils/createLogger");
+import { EventEmitter } from "events";
+import { pbkdf2Sync } from "node:crypto";
+import * as fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { XUtils } from "@vex-chat/crypto";
+import { MailType } from "@vex-chat/types";
+import argon2 from "argon2";
+/**
+ * Narrow a plain integer from the `mailType` SQL column to the
+ * `MailType` union (0 = initial, 1 = subsequent). Throws if the
+ * database contains an unexpected value, catching row corruption
+ * at read time instead of propagating an invalid literal into
+ * application code.
+ */
+function parseMailType(n) {
+    if (n === MailType.initial)
+        return MailType.initial;
+    if (n === MailType.subsequent)
+        return MailType.subsequent;
+    throw new Error(`Invalid mailType in database row: ${String(n)}`);
+}
+import BetterSqlite3 from "better-sqlite3";
+import { Kysely, Migrator, sql, SqliteDialect } from "kysely";
+import { stringify as uuidStringify, validate as uuidValidate } from "uuid";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const migrationFolder = path.join(__dirname, "migrations");
+/**
+ * Cross-platform Kysely migration provider.
+ *
+ * Replaces Kysely's built-in `FileMigrationProvider`, which on Windows
+ * fails with `ERR_UNSUPPORTED_ESM_URL_SCHEME` because it does
+ * `await import(joinedPath)` where `joinedPath` is a Windows absolute
+ * path like `D:\\spire\\src\\migrations\\schema.ts`. Node's ESM loader
+ * requires `file://` URLs for absolute paths on Windows.
+ *
+ * This implementation uses `pathToFileURL` to convert each migration
+ * file's absolute path to a `file://` URL before passing it to
+ * `import()`. Works on Linux, macOS, and Windows. Filters out `.d.ts`
+ * declaration files and accepts both `.ts` and `.js` source files for
+ * spire's `--experimental-strip-types` runtime.
+ */
+class CrossPlatformMigrationProvider {
+    folder;
+    constructor(folder) {
+        this.folder = folder;
+    }
+    async getMigrations() {
+        const files = await fs.readdir(this.folder);
+        const migrations = {};
+        for (const file of files.sort()) {
+            if (file.endsWith(".d.ts"))
+                continue;
+            if (!file.endsWith(".ts") && !file.endsWith(".js"))
+                continue;
+            const fullPath = path.join(this.folder, file);
+            const fileUrl = pathToFileURL(fullPath).href;
+            const mod = await import(__rewriteRelativeImportExtension(fileUrl));
+            if (!isMigration(mod)) {
+                throw new Error(`Invalid migration ${file}: expected an exported \`up\` function`);
+            }
+            const name = file.replace(/\.(ts|js)$/, "");
+            migrations[name] = mod;
+        }
+        return migrations;
+    }
+}
+function isMigration(mod) {
+    return (typeof mod === "object" &&
+        mod !== null &&
+        "up" in mod &&
+        typeof mod.up === "function");
+}
 const pubkeyRegex = /[0-9a-f]{64}/;
-exports.ITERATIONS = 1000;
-class Database extends events_1.EventEmitter {
+/** Legacy iteration count kept only for verifying old PBKDF2 hashes. */
+const PBKDF2_ITERATIONS = 1000;
+export class Database extends EventEmitter {
+    db;
     constructor(options) {
         super();
-        this.log = createLogger_1.createLogger("spire-db", (options === null || options === void 0 ? void 0 : options.logLevel) || "error");
-        switch ((options === null || options === void 0 ? void 0 : options.dbType) || "mysql") {
+        const dbType = options?.dbType || "sqlite3";
+        let filename;
+        switch (dbType) {
+            case "sqlite":
             case "sqlite3":
-                this.db = knex_1.default({
-                    client: "sqlite3",
-                    connection: {
-                        filename: "spire.sqlite",
-                    },
-                    useNullAsDefault: true,
-                });
+                filename = "spire.sqlite";
                 break;
             case "sqlite3mem":
-                this.db = knex_1.default({
-                    client: "sqlite3",
-                    connection: {
-                        filename: ":memory:",
-                    },
-                    useNullAsDefault: true,
-                });
+                filename = ":memory:";
                 break;
-            case "mysql":
             default:
-                this.db = knex_1.default({
-                    client: "mysql",
-                    connection: {
-                        host: process.env.SQL_HOST,
-                        user: process.env.SQL_USER,
-                        password: process.env.SQL_PASSWORD,
-                        database: process.env.SQL_DB_NAME,
-                    },
-                });
+                filename = "spire.sqlite";
                 break;
         }
-        this.init();
-    }
-    saveOTK(userID, deviceID, otks) {
-        return __awaiter(this, void 0, void 0, function* () {
-            for (const otk of otks) {
-                const newOTK = {
-                    keyID: uuid.v4(),
-                    userID,
-                    deviceID: otk.deviceID,
-                    publicKey: crypto_1.XUtils.encodeHex(otk.publicKey),
-                    signature: crypto_1.XUtils.encodeHex(otk.signature),
-                    index: otk.index,
-                };
-                yield this.db("oneTimeKeys").insert(newOTK);
-            }
-        });
-    }
-    getPreKeys(deviceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db
-                .from("preKeys")
-                .select()
-                .where({
-                deviceID,
-            });
-            if (rows.length === 0) {
-                return null;
-            }
-            const [preKeyInfo] = rows;
-            const preKey = {
-                index: preKeyInfo.index,
-                publicKey: crypto_1.XUtils.decodeHex(preKeyInfo.publicKey),
-                signature: crypto_1.XUtils.decodeHex(preKeyInfo.signature),
-                deviceID: preKeyInfo.deviceID,
-            };
-            return preKey;
-        });
-    }
-    retrieveUsers() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.db.from("users").select();
-        });
-    }
-    getKeyBundle(deviceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const device = yield this.retrieveDevice(deviceID);
-            if (!device) {
-                throw new Error("DeviceID not found.");
-            }
-            const otk = (yield this.getOTK(deviceID)) || undefined;
-            const preKey = yield this.getPreKeys(deviceID);
-            if (!preKey) {
-                throw new Error("Failed to get prekey.");
-            }
-            const keyBundle = {
-                signKey: crypto_1.XUtils.decodeHex(device.signKey),
-                preKey,
-                otk,
-            };
-            return keyBundle;
-        });
-    }
-    createDevice(owner, payload) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const device = {
-                owner,
-                signKey: payload.signKey,
-                deviceID: uuid.v4(),
-                name: payload.deviceName,
-                lastLogin: new Date(Date.now()).toString(),
-                deleted: false,
-            };
-            yield this.db("devices").insert(device);
-            const medPreKeys = {
-                keyID: uuid.v4(),
-                userID: owner,
-                deviceID: device.deviceID,
-                publicKey: payload.preKey,
-                signature: payload.preKeySignature,
-                index: payload.preKeyIndex,
+        const sqliteDb = new BetterSqlite3(filename);
+        sqliteDb.pragma("journal_mode = WAL");
+        sqliteDb.pragma("synchronous = NORMAL");
+        sqliteDb.pragma("busy_timeout = 5000");
+        sqliteDb.pragma("cache_size = -64000");
+        sqliteDb.pragma("temp_store = memory");
+        sqliteDb.pragma("foreign_keys = ON");
+        this.db = new Kysely({
+            dialect: new SqliteDialect({ database: sqliteDb }),
+        });
+        void this.init();
+    }
+    async close() {
+        await this.db.destroy();
+    }
+    async createChannel(name, serverID) {
+        const channel = {
+            channelID: crypto.randomUUID(),
+            name,
+            serverID,
+        };
+        await this.db.insertInto("channels").values(channel).execute();
+        return channel;
+    }
+    async createDevice(owner, payload) {
+        const device = {
+            deleted: 0,
+            deviceID: crypto.randomUUID(),
+            lastLogin: new Date().toISOString(),
+            name: payload.deviceName,
+            owner,
+            signKey: payload.signKey,
+        };
+        await this.db.insertInto("devices").values(device).execute();
+        const medPreKeys = {
+            deviceID: device.deviceID,
+            index: payload.preKeyIndex,
+            keyID: crypto.randomUUID(),
+            publicKey: payload.preKey,
+            signature: payload.preKeySignature,
+            userID: owner,
+        };
+        await this.db.insertInto("preKeys").values(medPreKeys).execute();
+        return toDevice(device);
+    }
+    async createEmoji(emoji) {
+        await this.db.insertInto("emojis").values(emoji).execute();
+    }
+    async createFile(file) {
+        await this.db.insertInto("files").values(file).execute();
+    }
+    async createInvite(inviteID, serverID, ownerID, expiration) {
+        const invite = {
+            expiration,
+            inviteID,
+            owner: ownerID,
+            serverID,
+        };
+        await this.db.insertInto("invites").values(invite).execute();
+        return invite;
+    }
+    async createPermission(userID, resourceType, resourceID, powerLevel) {
+        const permissionID = crypto.randomUUID();
+        // check if it already exists
+        const checkPermission = await this.db
+            .selectFrom("permissions")
+            .selectAll()
+            .where("userID", "=", userID)
+            .where("resourceID", "=", resourceID)
+            .execute();
+        const existing = checkPermission[0];
+        if (existing) {
+            return existing;
+        }
+        const permission = {
+            permissionID,
+            powerLevel,
+            resourceID,
+            resourceType,
+            userID,
+        };
+        await this.db.insertInto("permissions").values(permission).execute();
+        return permission;
+    }
+    async createServer(name, ownerID) {
+        // create the server
+        const server = {
+            name,
+            serverID: crypto.randomUUID(),
+        };
+        await this.db
+            .insertInto("servers")
+            .values({
+            icon: server.icon ?? null,
+            name: server.name,
+            serverID: server.serverID,
+        })
+            .execute();
+        // create the admin permission
+        await this.createPermission(ownerID, "server", server.serverID, 100);
+        // create the general channel
+        await this.createChannel("general", server.serverID);
+        return server;
+    }
+    async createUser(regKey, regPayload) {
+        try {
+            const passwordHash = await hashPasswordArgon2(regPayload.password);
+            const user = {
+                lastSeen: new Date().toISOString(),
+                passwordHash,
+                passwordSalt: "",
+                userID: uuidStringify(regKey),
+                username: regPayload.username,
             };
-            yield this.db("preKeys").insert(medPreKeys);
-            return device;
-        });
-    }
-    deleteDevice(deviceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db
-                .from("preKeys")
-                .where({ deviceID })
-                .del();
-            yield this.db
-                .from("oneTimeKeys")
-                .where({ deviceID })
-                .del();
-            return this.db
-                .from("devices")
-                .where({ deviceID })
-                .update({ deleted: true });
-        });
+            await this.db
+                .insertInto("users")
+                .values({
+                ...user,
+                hashAlgo: "argon2id",
+                lastSeen: user.lastSeen,
+            })
+                .execute();
+            await this.createDevice(user.userID, regPayload);
+            return [user, null];
+        }
+        catch (err) {
+            return [null, err instanceof Error ? err : new Error(String(err))];
+        }
     }
-    retrieveDevice(deviceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (uuid.validate(deviceID)) {
-                const rows = yield this.db
-                    .from("devices")
-                    .select()
-                    .where({ deviceID, deleted: false });
-                if (rows.length === 0) {
-                    return null;
-                }
-                const [device] = rows;
-                return device;
-            }
-            if (pubkeyRegex.test(deviceID)) {
-                const rows = yield this.db
-                    .from("devices")
-                    .select()
-                    .where({ signKey: deviceID, deleted: false });
-                if (rows.length === 0) {
-                    return null;
-                }
-                const [device] = rows;
-                return device;
-            }
+    async deleteChannel(channelID) {
+        await this.deletePermissions(channelID);
+        await this.db
+            .deleteFrom("mail")
+            .where("group", "=", channelID)
+            .execute();
+        await this.db
+            .deleteFrom("channels")
+            .where("channelID", "=", channelID)
+            .execute();
+    }
+    async deleteDevice(deviceID) {
+        await this.db
+            .deleteFrom("preKeys")
+            .where("deviceID", "=", deviceID)
+            .execute();
+        await this.db
+            .deleteFrom("oneTimeKeys")
+            .where("deviceID", "=", deviceID)
+            .execute();
+        await this.db
+            .updateTable("devices")
+            .set({ deleted: 1 })
+            .where("deviceID", "=", deviceID)
+            .execute();
+    }
+    async deleteEmoji(emojiID) {
+        await this.db
+            .deleteFrom("emojis")
+            .where("emojiID", "=", emojiID)
+            .execute();
+    }
+    async deleteInvite(inviteID) {
+        await this.db
+            .deleteFrom("invites")
+            .where("inviteID", "=", inviteID)
+            .execute();
+    }
+    async deleteMail(nonce, userID) {
+        await this.db
+            .deleteFrom("mail")
+            .where("nonce", "=", XUtils.encodeHex(nonce))
+            .where("recipient", "=", userID)
+            .execute();
+    }
+    async deletePermission(permissionID) {
+        await this.db
+            .deleteFrom("permissions")
+            .where("permissionID", "=", permissionID)
+            .execute();
+    }
+    async deletePermissions(resourceID) {
+        await this.db
+            .deleteFrom("permissions")
+            .where("resourceID", "=", resourceID)
+            .execute();
+    }
+    async deleteServer(serverID) {
+        await this.deletePermissions(serverID);
+        const channels = await this.retrieveChannels(serverID);
+        for (const channel of channels) {
+            await this.deleteChannel(channel.channelID);
+        }
+        await this.db
+            .deleteFrom("servers")
+            .where("serverID", "=", serverID)
+            .execute();
+    }
+    async getKeyBundle(deviceID) {
+        const device = await this.retrieveDevice(deviceID);
+        if (!device) {
+            throw new Error("DeviceID not found.");
+        }
+        const otk = (await this.getOTK(deviceID)) || undefined;
+        const preKey = await this.getPreKeys(deviceID);
+        if (!preKey) {
+            throw new Error("Failed to get prekey.");
+        }
+        const keyBundle = {
+            otk,
+            preKey,
+            signKey: XUtils.decodeHex(device.signKey),
+        };
+        return keyBundle;
+    }
+    async getOTK(deviceID) {
+        const rows = await this.db
+            .selectFrom("oneTimeKeys")
+            .selectAll()
+            .where("deviceID", "=", deviceID)
+            .orderBy("index")
+            .limit(1)
+            .execute();
+        const otkInfo = rows[0];
+        if (!otkInfo) {
             return null;
-        });
-    }
-    retrieveUserDeviceList(userIDs) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.db
-                .from("devices")
-                .select()
-                .whereIn("owner", userIDs)
-                .andWhere({ deleted: false });
-        });
-    }
-    getOTK(deviceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db("oneTimeKeys")
-                .select()
-                .where({ deviceID })
-                .limit(1)
-                .orderBy("index");
-            if (rows.length === 0) {
-                return null;
-            }
-            const [otkInfo] = rows;
-            const otk = {
-                publicKey: crypto_1.XUtils.decodeHex(otkInfo.publicKey),
-                signature: crypto_1.XUtils.decodeHex(otkInfo.signature),
-                index: otkInfo.index,
-                deviceID: otkInfo.deviceID,
-            };
-            try {
-                // delete the otk
-                yield this.db
-                    .from("oneTimeKeys")
-                    .delete()
-                    .where({ deviceID, index: otk.index });
-                return otk;
-            }
-            catch (err) {
-                throw err;
-            }
-        });
-    }
-    getOTKCount(deviceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const keys = yield this.db
-                .from("oneTimeKeys")
-                .select()
-                .where({ deviceID });
-            return keys.length;
-        });
-    }
-    createPermission(userID, resourceType, resourceID, powerLevel) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const permissionID = uuid.v4();
-            // check if it already exists
-            const checkPermission = yield this.db
-                .from("permissions")
-                .select()
-                .where({ userID, resourceID });
-            if (checkPermission.length > 0) {
-                return checkPermission[0];
-            }
-            const permission = {
-                permissionID,
-                userID,
-                resourceType,
-                resourceID,
-                powerLevel,
-            };
-            yield this.db("permissions").insert(permission);
-            return permission;
-        });
-    }
-    retrieveInvite(inviteID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db
-                .from("invites")
-                .select()
-                .where({ inviteID });
-            if (rows.length === 0) {
-                return null;
-            }
-            return rows[0];
-        });
-    }
-    retrieveServerInvites(serverID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db
-                .from("invites")
-                .select()
-                .where({ serverID });
-            return rows.filter((invite) => {
-                const valid = new Date(Date.now()).getTime() <
-                    new Date(invite.expiration).getTime();
-                if (!valid) {
-                    this.deleteInvite(invite.inviteID);
-                }
-                return valid;
-            });
-        });
-    }
-    deleteInvite(inviteID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db
-                .from("invites")
-                .where({ inviteID })
-                .delete();
-        });
-    }
-    createInvite(inviteID, serverID, ownerID, expiration) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const invite = {
-                inviteID,
-                serverID,
-                owner: ownerID,
-                expiration,
-            };
-            yield this.db("invites").insert(invite);
-            return invite;
-        });
-    }
-    retrieveGroupMembers(channelID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const channel = yield this.retrieveChannel(channelID);
-            if (!channel) {
-                return [];
-            }
-            const permissions = yield this.db
-                .from("permissions")
-                .select()
-                .where({ resourceID: channel.serverID });
-            const groupMembers = [];
-            for (const permission of permissions) {
-                const user = yield this.retrieveUser(permission.userID);
-                if (user) {
-                    groupMembers.push(user);
-                }
-            }
-            return groupMembers;
-        });
-    }
-    retrieveChannel(channelID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const channels = yield this.db
-                .from("channels")
-                .select()
-                .where({ channelID })
-                .limit(1);
-            if (channels.length === 0) {
-                return null;
-            }
-            return channels[0];
-        });
-    }
-    retrieveChannels(serverID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const channels = yield this.db
-                .from("channels")
-                .select()
-                .where({ serverID });
-            return channels;
-        });
+        }
+        const otk = {
+            deviceID: otkInfo.deviceID,
+            index: otkInfo.index,
+            publicKey: XUtils.decodeHex(otkInfo.publicKey),
+            signature: XUtils.decodeHex(otkInfo.signature),
+        };
+        // delete the otk
+        await this.db
+            .deleteFrom("oneTimeKeys")
+            .where("deviceID", "=", deviceID)
+            .where("index", "=", otk.index)
+            .execute();
+        return otk;
+    }
+    async getOTKCount(deviceID) {
+        const result = await this.db
+            .selectFrom("oneTimeKeys")
+            .select((eb) => eb.fn.countAll().as("count"))
+            .where("deviceID", "=", deviceID)
+            .executeTakeFirst();
+        return Number(result?.count ?? 0);
+    }
+    async getPreKeys(deviceID) {
+        const rows = await this.db
+            .selectFrom("preKeys")
+            .selectAll()
+            .where("deviceID", "=", deviceID)
+            .execute();
+        const preKeyInfo = rows[0];
+        if (!preKeyInfo) {
+            return null;
+        }
+        const preKey = {
+            deviceID: preKeyInfo.deviceID,
+            index: preKeyInfo.index,
+            publicKey: XUtils.decodeHex(preKeyInfo.publicKey),
+            signature: XUtils.decodeHex(preKeyInfo.signature),
+        };
+        return preKey;
+    }
+    async getRequestsTotal() {
+        const row = await this.db
+            .selectFrom("service_metrics")
+            .select("metric_value")
+            .where("metric_key", "=", "requests_total")
+            .executeTakeFirst();
+        const raw = row?.metric_value;
+        const count = Number(raw);
+        if (!Number.isFinite(count) || count < 0) {
+            return 0;
+        }
+        return count;
     }
-    createChannel(name, serverID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const channel = {
-                channelID: uuid.v4(),
-                serverID,
-                name,
-            };
-            yield this.db("channels").insert(channel);
-            return channel;
-        });
+    async incrementRequestsTotal(by = 1) {
+        if (!Number.isFinite(by) || by <= 0) {
+            return;
+        }
+        await this.db
+            .updateTable("service_metrics")
+            .set({
+            metric_value: sql `metric_value + ${Math.floor(by)}`,
+        })
+            .where("metric_key", "=", "requests_total")
+            .execute();
+    }
+    async isHealthy() {
+        try {
+            await sql `select 1 as ok`.execute(this.db);
+            return true;
+        }
+        catch (_err) {
+            // debugger: health check failed
+            return false;
+        }
     }
-    createServer(name, ownerID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // create the server
-            const server = {
-                name,
-                serverID: uuid.v4(),
-            };
-            yield this.db("servers").insert(server);
-            // create the admin permission
-            yield this.createPermission(ownerID, "server", server.serverID, 100);
-            // create the general channel
-            yield this.createChannel("general", server.serverID);
-            return server;
-        });
+    async markDeviceLogin(device) {
+        await this.db
+            .updateTable("devices")
+            .set({ lastLogin: new Date().toISOString() })
+            .where("deviceID", "=", device.deviceID)
+            .execute();
+    }
+    async markUserSeen(user) {
+        await this.db
+            .updateTable("users")
+            .set({ lastSeen: new Date().toISOString() })
+            .where("userID", "=", user.userID)
+            .execute();
+    }
+    async rehashPassword(userID, newHash) {
+        await this.db
+            .updateTable("users")
+            .set({
+            hashAlgo: "argon2id",
+            passwordHash: newHash,
+            passwordSalt: "",
+        })
+            .where("userID", "=", userID)
+            .execute();
     }
     /**
      * Retrives a list of users that should be notified when a specific resourceID
@@ -396,414 +432,341 @@ class Database extends events_1.EventEmitter {
      *
      * @param resourceID
      */
-    retrieveAffectedUsers(resourceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const permissionList = yield this.retrievePermissionsByResourceID(resourceID);
-            const users = [];
-            for (const permission of permissionList) {
-                const user = yield this.retrieveUser(permission.userID);
-                if (user) {
-                    users.push(user);
-                }
-            }
-            return users;
-        });
-    }
-    retrievePermissionsByResourceID(resourceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.db
-                .from("permissions")
-                .select()
-                .where({ resourceID });
-        });
-    }
-    retrievePermissions(userID, resourceType) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (resourceType === "all") {
-                const sList = yield this.db
-                    .from("permissions")
-                    .select()
-                    .where({ userID });
-                return sList;
-            }
-            const serverList = yield this.db
-                .from("permissions")
-                .select()
-                .where({ userID, resourceType });
-            return serverList;
-        });
-    }
-    retrieveServer(serverID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db
-                .from("servers")
-                .select()
-                .where({ serverID })
-                .limit(1);
-            if (rows.length === 0) {
-                return null;
-            }
-            const server = rows[0];
-            return server;
-        });
-    }
-    deletePermissions(resourceID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db
-                .from("permissions")
-                .where({ resourceID })
-                .delete();
-        });
-    }
-    deletePermission(permissionID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db
-                .from("permissions")
-                .where({ permissionID })
-                .delete();
-        });
-    }
-    retrievePermission(permissionID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db
-                .from("permissions")
-                .where({ permissionID })
-                .select();
-            if (rows.length === 0) {
-                return null;
+    async retrieveAffectedUsers(resourceID) {
+        const permissionList = await this.retrievePermissionsByResourceID(resourceID);
+        const users = [];
+        for (const permission of permissionList) {
+            const user = await this.retrieveUser(permission.userID);
+            if (user) {
+                users.push(user);
             }
-            return rows[0];
-        });
-    }
-    deleteChannel(channelID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.deletePermissions(channelID);
-            yield this.db
-                .from("mail")
-                .where({ group: channelID })
-                .delete();
-            yield this.db
-                .from("channels")
-                .where({ channelID })
-                .delete();
-        });
-    }
-    createEmoji(emoji) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db("emojis").insert(emoji);
-        });
-    }
-    deleteEmoji(emojiID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db
-                .from("emojis")
-                .where({ emojiID })
-                .del();
-        });
-    }
-    retrieveEmojiList(userID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.db
-                .from("emojis")
-                .select()
-                .where({ owner: userID });
-        });
-    }
-    retrieveEmoji(emojiID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db
-                .from("emojis")
-                .select()
-                .where({ emojiID });
-            if (rows.length === 0) {
-                return null;
-            }
-            return rows[0];
-        });
-    }
-    deleteServer(serverID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.deletePermissions(serverID);
-            const channels = yield this.retrieveChannels(serverID);
-            for (const channel of channels) {
-                yield this.deleteChannel(channel.channelID);
-            }
-            yield this.db
-                .from("servers")
-                .where({ serverID })
-                .delete();
-        });
-    }
-    retrieveServers(userID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const serverPerms = yield this.retrievePermissions(userID, "server");
-            if (!serverPerms) {
-                return [];
-            }
-            const serverList = [];
-            for (const perm of serverPerms) {
-                const server = yield this.retrieveServer(perm.resourceID);
-                if (server) {
-                    serverList.push(server);
-                }
-            }
-            return serverList;
-        });
-    }
-    createUser(regKey, regPayload) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const salt = crypto_1.xMakeNonce();
-                const passwordHash = exports.hashPassword(regPayload.password, salt);
-                const user = {
-                    userID: uuid.stringify(regKey),
-                    username: regPayload.username,
-                    lastSeen: new Date(Date.now()),
-                    passwordHash: passwordHash.toString("hex"),
-                    passwordSalt: crypto_1.XUtils.encodeHex(salt),
-                };
-                yield this.db("users").insert(user);
-                yield this.createDevice(user.userID, regPayload);
-                return [user, null];
-            }
-            catch (err) {
-                return [null, err];
-            }
-        });
-    }
-    createFile(file) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.db("files").insert(file);
-        });
-    }
-    retrieveFile(fileID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const file = yield this.db
-                .from("files")
-                .select()
-                .where({ fileID });
-            if (file.length === 0) {
-                return null;
-            }
-            return file[0];
-        });
-    }
-    // the identifier can be username, public key, or userID
-    retrieveUser(userIdentifier) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let rows = [];
-            if (uuid.validate(userIdentifier)) {
-                rows = yield this.db
-                    .from("users")
-                    .select()
-                    .where({ userID: userIdentifier })
-                    .limit(1);
-            }
-            else {
-                rows = yield this.db
-                    .from("users")
-                    .select()
-                    .where({ username: userIdentifier })
-                    .limit(1);
-            }
-            if (rows.length === 0) {
-                return null;
+        }
+        return users;
+    }
+    async retrieveChannel(channelID) {
+        const channels = await this.db
+            .selectFrom("channels")
+            .selectAll()
+            .where("channelID", "=", channelID)
+            .limit(1)
+            .execute();
+        return channels[0] ?? null;
+    }
+    async retrieveChannels(serverID) {
+        const channels = await this.db
+            .selectFrom("channels")
+            .selectAll()
+            .where("serverID", "=", serverID)
+            .execute();
+        return channels;
+    }
+    async retrieveDevice(deviceID) {
+        if (uuidValidate(deviceID)) {
+            const rows = await this.db
+                .selectFrom("devices")
+                .selectAll()
+                .where("deviceID", "=", deviceID)
+                .where("deleted", "=", 0)
+                .execute();
+            const device = rows[0];
+            return device ? toDevice(device) : null;
+        }
+        if (pubkeyRegex.test(deviceID)) {
+            const rows = await this.db
+                .selectFrom("devices")
+                .selectAll()
+                .where("signKey", "=", deviceID)
+                .where("deleted", "=", 0)
+                .execute();
+            const device = rows[0];
+            return device ? toDevice(device) : null;
+        }
+        return null;
+    }
+    async retrieveEmoji(emojiID) {
+        const rows = await this.db
+            .selectFrom("emojis")
+            .selectAll()
+            .where("emojiID", "=", emojiID)
+            .execute();
+        return rows[0] ?? null;
+    }
+    async retrieveEmojiList(userID) {
+        return this.db
+            .selectFrom("emojis")
+            .selectAll()
+            .where("owner", "=", userID)
+            .execute();
+    }
+    async retrieveFile(fileID) {
+        const file = await this.db
+            .selectFrom("files")
+            .selectAll()
+            .where("fileID", "=", fileID)
+            .execute();
+        return file[0] ?? null;
+    }
+    async retrieveGroupMembers(channelID) {
+        const channel = await this.retrieveChannel(channelID);
+        if (!channel) {
+            return [];
+        }
+        const permissions = await this.db
+            .selectFrom("permissions")
+            .selectAll()
+            .where("resourceID", "=", channel.serverID)
+            .execute();
+        const groupMembers = [];
+        for (const permission of permissions) {
+            const user = await this.retrieveUser(permission.userID);
+            if (user) {
+                groupMembers.push(user);
             }
-            const [user] = rows;
-            return user;
-        });
-    }
-    saveMail(mail, header, deviceID, userID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const entry = {
+        }
+        return groupMembers;
+    }
+    async retrieveInvite(inviteID) {
+        const rows = await this.db
+            .selectFrom("invites")
+            .selectAll()
+            .where("inviteID", "=", inviteID)
+            .execute();
+        return rows[0] ?? null;
+    }
+    async retrieveMail(deviceID) {
+        const rawRows = await this.db
+            .selectFrom("mail")
+            .selectAll()
+            .where("recipient", "=", deviceID)
+            .execute();
+        const rows = rawRows.map(toMailSQL);
+        const fixMail = (mail) => {
+            const msgb = {
+                authorID: mail.authorID,
+                cipher: XUtils.decodeHex(mail.cipher),
+                extra: XUtils.decodeHex(mail.extra),
+                forward: mail.forward,
+                group: mail.group ? XUtils.decodeHex(mail.group) : null,
                 mailID: mail.mailID,
                 mailType: mail.mailType,
-                recipient: mail.recipient,
-                sender: deviceID,
-                cipher: crypto_1.XUtils.encodeHex(mail.cipher),
-                nonce: crypto_1.XUtils.encodeHex(mail.nonce),
-                extra: crypto_1.XUtils.encodeHex(mail.extra),
-                header: crypto_1.XUtils.encodeHex(header),
-                time: new Date(Date.now()),
-                group: mail.group ? crypto_1.XUtils.encodeHex(mail.group) : null,
-                forward: mail.forward,
-                authorID: userID,
+                nonce: XUtils.decodeHex(mail.nonce),
                 readerID: mail.readerID,
+                recipient: mail.recipient,
+                sender: mail.sender,
             };
-            yield this.db("mail").insert(entry);
-        });
+            const msgh = XUtils.decodeHex(mail.header);
+            return [msgh, msgb, mail.time];
+        };
+        const allMail = rows.map(fixMail);
+        return allMail;
+    }
+    async retrievePermission(permissionID) {
+        const rows = await this.db
+            .selectFrom("permissions")
+            .selectAll()
+            .where("permissionID", "=", permissionID)
+            .execute();
+        return rows[0] ?? null;
+    }
+    async retrievePermissions(userID, resourceType) {
+        if (resourceType === "all") {
+            const sList = await this.db
+                .selectFrom("permissions")
+                .selectAll()
+                .where("userID", "=", userID)
+                .execute();
+            return sList;
+        }
+        const serverList = await this.db
+            .selectFrom("permissions")
+            .selectAll()
+            .where("userID", "=", userID)
+            .where("resourceType", "=", resourceType)
+            .execute();
+        return serverList;
+    }
+    async retrievePermissionsByResourceID(resourceID) {
+        return this.db
+            .selectFrom("permissions")
+            .selectAll()
+            .where("resourceID", "=", resourceID)
+            .execute();
+    }
+    async retrieveServer(serverID) {
+        const rows = await this.db
+            .selectFrom("servers")
+            .selectAll()
+            .where("serverID", "=", serverID)
+            .limit(1)
+            .execute();
+        const row = rows[0];
+        return row ? toServer(row) : null;
+    }
+    async retrieveServerInvites(serverID) {
+        const rows = await this.db
+            .selectFrom("invites")
+            .selectAll()
+            .where("serverID", "=", serverID)
+            .execute();
+        return rows.filter((invite) => {
+            const valid = new Date(Date.now()).getTime() <
+                new Date(invite.expiration).getTime();
+            if (!valid) {
+                void this.deleteInvite(invite.inviteID);
+            }
+            return valid;
+        });
+    }
+    async retrieveServers(userID) {
+        const serverPerms = await this.retrievePermissions(userID, "server");
+        const serverList = [];
+        for (const perm of serverPerms) {
+            const server = await this.retrieveServer(perm.resourceID);
+            if (server) {
+                serverList.push(server);
+            }
+        }
+        return serverList;
     }
-    retrieveMail(deviceID
-    // tslint:disable-next-line: array-type
-    ) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const rows = yield this.db
-                .from("mail")
-                .select()
-                .where({ recipient: deviceID });
-            const fixMail = (mail) => {
-                const msgb = {
-                    mailType: mail.mailType,
-                    mailID: mail.mailID,
-                    recipient: mail.recipient,
-                    cipher: crypto_1.XUtils.decodeHex(mail.cipher),
-                    nonce: crypto_1.XUtils.decodeHex(mail.nonce),
-                    extra: crypto_1.XUtils.decodeHex(mail.extra),
-                    sender: mail.sender,
-                    group: mail.group ? crypto_1.XUtils.decodeHex(mail.group) : null,
-                    forward: Boolean(mail.forward),
-                    authorID: mail.authorID,
-                    readerID: mail.readerID,
-                };
-                const msgh = crypto_1.XUtils.decodeHex(mail.header);
-                return [msgh, msgb, new Date(mail.time)];
+    // the identifier can be username, public key, or userID
+    async retrieveUser(userIdentifier) {
+        let rows;
+        if (uuidValidate(userIdentifier)) {
+            rows = await this.db
+                .selectFrom("users")
+                .selectAll()
+                .where("userID", "=", userIdentifier)
+                .limit(1)
+                .execute();
+        }
+        else {
+            rows = await this.db
+                .selectFrom("users")
+                .selectAll()
+                .where("username", "=", userIdentifier)
+                .limit(1)
+                .execute();
+        }
+        const row = rows[0];
+        return row ? toUserRecord(row) : null;
+    }
+    async retrieveUserDeviceList(userIDs) {
+        const rows = await this.db
+            .selectFrom("devices")
+            .selectAll()
+            .where("owner", "in", userIDs)
+            .where("deleted", "=", 0)
+            .execute();
+        return rows.map(toDevice);
+    }
+    async retrieveUsers() {
+        const rows = await this.db.selectFrom("users").selectAll().execute();
+        return rows.map(toUserRecord);
+    }
+    async saveMail(mail, header, deviceID, userID) {
+        const entry = {
+            authorID: userID,
+            cipher: XUtils.encodeHex(mail.cipher),
+            extra: XUtils.encodeHex(mail.extra),
+            forward: mail.forward,
+            group: mail.group ? XUtils.encodeHex(mail.group) : null,
+            header: XUtils.encodeHex(header),
+            mailID: mail.mailID,
+            mailType: mail.mailType,
+            nonce: XUtils.encodeHex(mail.nonce),
+            readerID: mail.readerID,
+            recipient: mail.recipient,
+            sender: deviceID,
+            time: new Date().toISOString(),
+        };
+        await this.db
+            .insertInto("mail")
+            .values({
+            ...entry,
+            forward: entry.forward ? 1 : 0,
+            time: entry.time,
+        })
+            .execute();
+    }
+    async saveOTK(userID, deviceID, otks) {
+        for (const otk of otks) {
+            const newOTK = {
+                deviceID: otk.deviceID,
+                index: otk.index ?? 0,
+                keyID: crypto.randomUUID(),
+                publicKey: XUtils.encodeHex(otk.publicKey),
+                signature: XUtils.encodeHex(otk.signature),
+                userID,
             };
-            const allMail = rows.map(fixMail);
-            return allMail;
-        });
-    }
-    deleteMail(nonce, userID) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db
-                .from("mail")
-                .delete()
-                .where({ nonce: crypto_1.XUtils.encodeHex(nonce), recipient: userID });
-        });
-    }
-    markUserSeen(user) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db("users")
-                .where({ userID: user.userID })
-                .update({
-                lastSeen: new Date(Date.now()),
-            });
-        });
-    }
-    markDeviceLogin(device) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.db("devices")
-                .where({ deviceID: device.deviceID })
-                .update({
-                lastLogin: new Date(Date.now()),
-            });
-        });
-    }
-    close() {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.log.info("Closing database.");
-            yield this.db.destroy();
-        });
+            await this.db.insertInto("oneTimeKeys").values(newOTK).execute();
+        }
     }
-    init() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!(yield this.db.schema.hasTable("invites"))) {
-                yield this.db.schema.createTable("invites", (table) => {
-                    table.string("inviteID").primary();
-                    table.string("serverID").index();
-                    table.string("owner");
-                    table.string("expiration");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("users"))) {
-                yield this.db.schema.createTable("users", (table) => {
-                    table.string("userID").primary();
-                    table.string("username").unique();
-                    table.string("passwordHash");
-                    table.string("passwordSalt");
-                    table.dateTime("lastSeen");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("devices"))) {
-                yield this.db.schema.createTable("devices", (table) => {
-                    table.string("deviceID").primary();
-                    table.string("signKey").unique();
-                    table.string("owner");
-                    table.string("name");
-                    table.string("lastLogin");
-                    table.boolean("deleted");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("mail"))) {
-                yield this.db.schema.createTable("mail", (table) => {
-                    table.string("nonce").primary();
-                    table.string("recipient").index();
-                    table.string("mailID");
-                    table.string("sender");
-                    table.string("header");
-                    table.text("cipher", "mediumtext");
-                    table.string("group");
-                    table.text("extra");
-                    table.integer("mailType");
-                    table.dateTime("time");
-                    table.boolean("forward");
-                    table.string("authorID");
-                    table.string("readerID");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("preKeys"))) {
-                yield this.db.schema.createTable("preKeys", (table) => {
-                    table.string("keyID").primary();
-                    table.string("userID").index();
-                    table
-                        .string("deviceID")
-                        .index()
-                        .unique();
-                    table.string("publicKey");
-                    table.string("signature");
-                    table.integer("index");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("oneTimeKeys"))) {
-                yield this.db.schema.createTable("oneTimeKeys", (table) => {
-                    table.string("keyID").primary();
-                    table.string("userID").index();
-                    table.string("deviceID").index();
-                    table.string("publicKey");
-                    table.string("signature");
-                    table.integer("index");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("servers"))) {
-                yield this.db.schema.createTable("servers", (table) => {
-                    table.string("serverID").primary();
-                    table.string("name");
-                    table.string("icon");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("channels"))) {
-                yield this.db.schema.createTable("channels", (table) => {
-                    table.string("channelID").primary();
-                    table.string("serverID");
-                    table.string("name");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("permissions"))) {
-                yield this.db.schema.createTable("permissions", (table) => {
-                    table.string("permissionID").primary();
-                    table.string("userID").index();
-                    table.string("resourceType");
-                    table.string("resourceID").index();
-                    table.integer("powerLevel");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("files"))) {
-                yield this.db.schema.createTable("files", (table) => {
-                    table.string("fileID").primary();
-                    table.string("owner").index();
-                    table.string("nonce");
-                });
-            }
-            if (!(yield this.db.schema.hasTable("emojis"))) {
-                yield this.db.schema.createTable("emojis", (table) => {
-                    table.string("emojiID").primary();
-                    table.string("owner").index();
-                    table.string("name");
-                });
-            }
-            this.emit("ready");
+    async init() {
+        const migrator = new Migrator({
+            db: this.db,
+            provider: new CrossPlatformMigrationProvider(migrationFolder),
         });
+        const { error } = await migrator.migrateToLatest();
+        if (error) {
+            this.emit("error", error);
+            return;
+        }
+        this.emit("ready");
     }
 }
-exports.Database = Database;
-const hashPassword = (password, salt) => pbkdf2_1.default.pbkdf2Sync(password, salt, exports.ITERATIONS, 32, "sha512");
-exports.hashPassword = hashPassword;
+/**
+ * Hash a password with Argon2id (new default).
+ * Returns the encoded hash string which embeds salt, params, and digest.
+ */
+export async function hashPasswordArgon2(password) {
+    return argon2.hash(password, {
+        memoryCost: 65536,
+        parallelism: 4,
+        timeCost: 3,
+        type: argon2.argon2id,
+    });
+}
+/**
+ * Verify a password against either Argon2id or legacy PBKDF2 storage.
+ * Returns `{ valid, needsRehash }` — callers should rehash on success
+ * when `needsRehash` is true.
+ */
+export async function verifyPassword(password, stored) {
+    if (stored.hashAlgo === "argon2id") {
+        const valid = await argon2.verify(stored.passwordHash, password);
+        return { needsRehash: false, valid };
+    }
+    // Legacy PBKDF2 path
+    const salt = XUtils.decodeHex(stored.passwordSalt);
+    const computed = pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, 32, "sha512");
+    const storedBuf = XUtils.decodeHex(stored.passwordHash);
+    if (computed.length !== storedBuf.length) {
+        return { needsRehash: false, valid: false };
+    }
+    const { timingSafeEqual } = await import("node:crypto");
+    const valid = timingSafeEqual(computed, storedBuf);
+    return { needsRehash: valid, valid };
+}
+function toDevice(row) {
+    return { ...row, deleted: Boolean(row.deleted) };
+}
+function toMailSQL(row) {
+    return {
+        ...row,
+        extra: row.extra ?? "",
+        forward: Boolean(row.forward),
+        mailType: parseMailType(row.mailType),
+        time: row.time,
+    };
+}
+function toServer(row) {
+    return {
+        icon: row.icon ?? undefined,
+        name: row.name,
+        serverID: row.serverID,
+    };
+}
+function toUserRecord(row) {
+    return { ...row };
+}
+//# sourceMappingURL=Database.js.map