@vex-chat/spire 1.0.0 → 1.0.1

package/dist/server/rateLimit.js

@@ -11,14 +11,14 @@ const keyByIp = (req) => ipKeyGenerator(req.ip ?? "");
 /**
  * Global per-IP limiter. Applied app-wide via `api.use(globalLimiter)`.
  *
- * 300 requests per 15 minutes per client IP. A human chatting via a
+ * 3000 requests per 15 minutes per client IP. A human chatting via a
  * browser or the libvex client won't come close; a single-host DoS
  * gets throttled quickly.
  */
 export const globalLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 300,
+    limit: 3000,
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
 });
@@ -26,7 +26,7 @@ export const globalLimiter = rateLimit({
  * Strict auth endpoint limiter. Applied per-route to /auth, /register,
  * and /auth/device.
  *
- * 5 failed attempts per 15 minutes per IP. Successful logins don't
+ * 50 failed attempts per 15 minutes per IP. Successful logins don't
  * count (`skipSuccessfulRequests`), so a normal user doesn't lock
  * themselves out by fat-fingering a password once. Blocks brute force
  * (CWE-307) without harming UX.
@@ -34,7 +34,7 @@ export const globalLimiter = rateLimit({
 export const authLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 5,
+    limit: 50,
     skipSuccessfulRequests: true,
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
@@ -45,13 +45,13 @@ export const authLimiter = rateLimit({
  * upload attempts per minute so an attacker can't force spire to
  * spend CPU/IO on repeated large-body parses.
  *
- * 20 uploads per minute per IP — generous for a chat client (rapid-
+ * 200 uploads per minute per IP — generous for a chat client (rapid-
  * fire image attachments) but tight enough to shield the disk.
  */
 export const uploadLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 20,
+    limit: 200,
     standardHeaders: "draft-7",
     windowMs: 60 * 1000,
 });

package/dist/server/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAyBA,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,CAAC;IACR,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAyBA,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,IAAI;IACX,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC"}

package/dist/server/user.d.ts

@@ -1,4 +1,3 @@
 import type { Database } from "../Database.ts";
-import type winston from "winston";
 import { TokenScopes } from "@vex-chat/types";
-export declare const getUserRouter: (db: Database, log: winston.Logger, tokenValidator: (key: string, scope: TokenScopes) => boolean) => import("express-serve-static-core").Router;
+export declare const getUserRouter: (db: Database, tokenValidator: (key: string, scope: TokenScopes) => boolean) => import("express-serve-static-core").Router;

package/dist/server/user.js

@@ -6,7 +6,7 @@ import { stringify } from "uuid";
 import { msgpack } from "../utils/msgpack.js";
 import { censorUser, getParam, getUser } from "./utils.js";
 import { protect } from "./index.js";
-export const getUserRouter = (db, log, tokenValidator) => {
+export const getUserRouter = (db, tokenValidator) => {
     const router = express.Router();
     router.get("/:id", protect, async (req, res) => {
         const user = await db.retrieveUser(getParam(req, "id"));
@@ -69,7 +69,6 @@ export const getUserRouter = (db, log, tokenValidator) => {
         const deviceData = parsed.data;
         const token = xSignOpen(XUtils.decodeHex(deviceData.signed), XUtils.decodeHex(deviceData.signKey));
         if (!token) {
-            log.warn("Invalid signature on token.");
             res.sendStatus(400);
             return;
         }
@@ -78,9 +77,8 @@ export const getUserRouter = (db, log, tokenValidator) => {
                 const device = await db.createDevice(userDetails.userID, deviceData);
                 res.send(msgpack.encode(device));
             }
-            catch (err) {
-                log.warn(String(err));
-                // failed registration due to signkey being taken
+            catch (_err) {
+                // signkey already taken
                 res.sendStatus(470);
                 return;
             }

package/dist/server/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/server/user.ts"],"names":[],"mappings":"AAGA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,EAAY,EACZ,GAAmB,EACnB,cAA4D,EAC9D,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAExD,IAAI,IAAI,EAAE,CAAC;YACP,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC;YAC/C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAC5C,WAAW,CAAC,MAAM,EAClB,KAAK,CACR,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC;YAC/C,WAAW,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oCAAoC;aAC9C,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAE/B,MAAM,KAAK,GAAG,SAAS,CACnB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EACnC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CACvC,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACxC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAChC,WAAW,CAAC,MAAM,EAClB,UAAU,CACb,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACpB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,iDAAiD;gBACjD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/server/user.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,EAAY,EACZ,cAA4D,EAC9D,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAExD,IAAI,IAAI,EAAE,CAAC;YACP,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC;YAC/C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAC5C,WAAW,CAAC,MAAM,EAClB,KAAK,CACR,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC;YAC/C,WAAW,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oCAAoC;aAC9C,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAE/B,MAAM,KAAK,GAAG,SAAS,CACnB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EACnC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CACvC,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAChC,WAAW,CAAC,MAAM,EAClB,UAAU,CACb,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,IAAa,EAAE,CAAC;gBACrB,wBAAwB;gBACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/utils/jwtSecret.d.ts

@@ -1,7 +1,7 @@
 /**
- * Returns the JWT signing secret.
+ * Returns the dedicated JWT HMAC signing secret.
  *
- * Prefers JWT_SECRET (dedicated HMAC key) over SPK (NaCl server signing key).
- * Falls back to SPK for backward compat with existing deployments.
+ * This MUST be a separate key from SPK (the Ed25519 server signing key)
+ * so that compromise of one does not affect the other.
  */
 export declare function getJwtSecret(): string;

package/dist/utils/jwtSecret.js

@@ -1,14 +1,13 @@
 /**
- * Returns the JWT signing secret.
+ * Returns the dedicated JWT HMAC signing secret.
  *
- * Prefers JWT_SECRET (dedicated HMAC key) over SPK (NaCl server signing key).
- * Falls back to SPK for backward compat with existing deployments.
+ * This MUST be a separate key from SPK (the Ed25519 server signing key)
+ * so that compromise of one does not affect the other.
  */
 export function getJwtSecret() {
-    const secret = process.env["JWT_SECRET"] ?? process.env["SPK"];
+    const secret = process.env["JWT_SECRET"];
     if (!secret) {
-        throw new Error("Neither JWT_SECRET nor SPK is set. " +
-            "Set JWT_SECRET (preferred) or SPK in your environment.");
+        throw new Error("JWT_SECRET is not set. Generate one with: node scripts/gen-spk.js");
     }
     return secret;
 }

package/dist/utils/jwtSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,qCAAqC;YACjC,wDAAwD,CAC/D,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"jwtSecret.js","sourceRoot":"","sources":["../../src/utils/jwtSecret.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,mEAAmE,CACtE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/utils/loadEnv.js

@@ -2,7 +2,7 @@ import { config } from "dotenv";
 /* Populate process.env with vars from .env and verify required vars are present. */
 export function loadEnv() {
     config();
-    const requiredEnvVars = ["CANARY", "DB_TYPE", "SPK"];
+    const requiredEnvVars = ["DB_TYPE", "JWT_SECRET", "SPK"];
     for (const required of requiredEnvVars) {
         if (process.env[required] === undefined) {
             process.stderr.write(`Required environment variable '${required}' is not set. Please consult the README.\n`);

package/dist/utils/loadEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}
+{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,MAAM,eAAe,GAAa,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vex-chat/spire",
-    "version": "1.0.0",
+    "version": "1.0.1",
     "description": "Vex server implementation in NodeJS.",
     "type": "module",
     "files": [
@@ -28,7 +28,7 @@
         "format:check": "prettier --check .",
         "lint": "eslint src/",
         "lint:fix": "eslint src/ --fix",
-        "prepare": "husky",
+        "prepare": "husky || true",
         "test": "vitest run",
         "gen-spk": "node scripts/gen-spk.js",
         "docs": "node ./scripts/generate-docs.js",
@@ -72,6 +72,9 @@
         "*.ts": [
             "eslint --fix",
             "prettier --write"
+        ],
+        "*.{yml,yaml}": [
+            "prettier --write"
         ]
     },
     "overrides": {
@@ -85,6 +88,7 @@
         "@scalar/express-api-reference": "0.9.7",
         "@vex-chat/crypto": "2.0.0",
         "@vex-chat/types": "2.0.0",
+        "argon2": "0.44.0",
         "better-sqlite3": "11.10.0",
         "cors": "2.8.6",
         "dotenv": "17.4.1",
@@ -98,10 +102,8 @@
         "msgpackr": "1.11.8",
         "multer": "2.1.1",
         "parse-duration": "2.1.6",
-        "picocolors": "1.1.1",
         "tweetnacl": "1.0.3",
         "uuid": "8.3.2",
-        "winston": "3.19.0",
         "ws": "8.20.0",
         "zod": "4.3.6"
     }

package/src/ClientManager.ts

@@ -11,7 +11,6 @@ import type {
     User,
     UserRecord,
 } from "@vex-chat/types";
-import type winston from "winston";
 import type WebSocket from "ws";
 
 import { EventEmitter } from "events";
@@ -21,11 +20,9 @@ import { xConcat, XUtils } from "@vex-chat/crypto";
 import { xSignOpen } from "@vex-chat/crypto";
 import { MailWSSchema, SocketAuthErrors } from "@vex-chat/types";
 
-import pc from "picocolors";
 import { parse as uuidParse, validate as uuidValidate } from "uuid";
 
-import { type SpireOptions, TOKEN_EXPIRY } from "./Spire.ts";
-import { createLogger } from "./utils/createLogger.ts";
+import { TOKEN_EXPIRY } from "./Spire.ts";
 import { createUint8UUID } from "./utils/createUint8UUID.ts";
 import { msgpack } from "./utils/msgpack.ts";
 
@@ -50,7 +47,6 @@ export class ClientManager extends EventEmitter {
     private db: Database;
     private device: Device | null;
     private failed: boolean = false;
-    private log: winston.Logger;
     private notify: (
         userID: string,
         event: string,
@@ -66,7 +62,6 @@ export class ClientManager extends EventEmitter {
         db: Database,
         notify: (userID: string, event: string, transmissionID: string) => void,
         userDetails: User,
-        options?: SpireOptions,
     ) {
         super();
         this.conn = ws;
@@ -75,7 +70,6 @@ export class ClientManager extends EventEmitter {
         this.userDetails = userDetails;
         this.device = null;
         this.notify = notify;
-        this.log = createLogger("client-manager", options?.logLevel || "error");
 
         this.initListeners();
         this.challenge();
@@ -96,28 +90,11 @@ export class ClientManager extends EventEmitter {
     }
 
     public send(msg: BaseMsg, header?: Uint8Array) {
-        if (header) {
-            this.log.debug(pc.bold(pc.red("OUTH")), header.toString());
-        } else {
-            this.log.debug(pc.bold(pc.red("OUTH")), emptyHeader.toString());
-        }
-
         const packedMessage = packMessage(msg, header);
-
-        this.log.info(
-            pc.bold("⟶   ") +
-                responseColor(msg.type.toUpperCase()) +
-                " " +
-                this.toString() +
-                " " +
-                pc.yellow(Buffer.byteLength(packedMessage)),
-        );
-
-        this.log.debug(pc.bold(pc.red("OUT")), msg);
         try {
             this.conn.send(packedMessage);
-        } catch (err: unknown) {
-            this.log.warn(String(err));
+        } catch (_err: unknown) {
+            // debugger: WS send failed
             this.fail();
         }
     }
@@ -150,7 +127,6 @@ export class ClientManager extends EventEmitter {
         if (this.failed) {
             return;
         }
-        this.log.warn("Connection closed.");
         this.conn.close();
         this.failed = true;
         this.emit("fail");
@@ -173,12 +149,11 @@ export class ClientManager extends EventEmitter {
             this.fail();
         });
         this.conn.on("message", (message: Buffer) => {
-            const [header, msg] = unpackMessage(message);
             const size = Buffer.byteLength(message);
 
             if (size > MAX_MSG_SIZE) {
                 this.sendErr(
-                    msg.transmissionID,
+                    "00000000-0000-0000-0000-000000000000",
                     "Message is too big. Received size " +
                         String(size) +
                         " while max size is " +
@@ -187,16 +162,7 @@ export class ClientManager extends EventEmitter {
                 return;
             }
 
-            this.log.info(
-                pc.bold("⟵   ") +
-                    pc.bold(msg.type.toUpperCase()) +
-                    " " +
-                    this.toString() +
-                    " " +
-                    pc.yellow(String(size)),
-            );
-            this.log.debug(pc.bold(pc.red("INH")), header.toString());
-            this.log.debug(pc.bold(pc.red("IN")), msg);
+            const [header, msg] = unpackMessage(message);
 
             if (!msg.type) {
                 this.sendErr(msg.transmissionID, "Message type is required.");
@@ -238,7 +204,6 @@ export class ClientManager extends EventEmitter {
                     void this.verifyResponse(msg as RespMsg);
                     break;
                 default:
-                    this.log.info("unsupported message %s", msg.type);
                     break;
             }
         });
@@ -266,8 +231,6 @@ export class ClientManager extends EventEmitter {
                             this.getDevice().deviceID,
                             this.getUser().userID,
                         );
-                        this.log.info("Received mail for " + mail.recipient);
-
                         const deviceDetails = await this.db.retrieveDevice(
                             mail.recipient,
                         );
@@ -288,13 +251,12 @@ export class ClientManager extends EventEmitter {
                             mail.recipient,
                         );
                     } catch (err: unknown) {
-                        this.log.error(String(err));
                         this.sendErr(msg.transmissionID, String(err));
                     }
                 }
                 break;
             default:
-                this.log.info("Unsupported resource type " + msg.resourceType);
+                break;
         }
     }
 
@@ -384,7 +346,6 @@ export class ClientManager extends EventEmitter {
                 }
             }
             if (!message) {
-                this.log.warn("Signature verification failed!");
                 this.sendAuthError(SocketAuthErrors.BadSignature);
                 this.fail();
                 return;
@@ -394,11 +355,9 @@ export class ClientManager extends EventEmitter {
                 this.user = user;
                 this.authorize(msg.transmissionID);
             } else {
-                this.log.warn("Token is bad!");
                 this.sendAuthError(SocketAuthErrors.InvalidToken);
             }
         } else {
-            this.log.info("User is not registered.");
             this.sendAuthError(SocketAuthErrors.UserNotRegistered);
 
             this.fail();
@@ -421,14 +380,3 @@ function unpackMessage(msg: Buffer): [Uint8Array, BaseMsg] {
 
     return [msgh, msgb];
 }
-
-const responseColor = (status: string): string => {
-    switch (status) {
-        case "ERROR":
-            return pc.bold(pc.red(status));
-        case "SUCCESS":
-            return pc.bold(pc.green(status));
-        default:
-            return status;
-    }
-};

package/src/Database.ts

@@ -18,7 +18,6 @@ import type {
     UserRecord,
 } from "@vex-chat/types";
 import type { Migration, MigrationProvider } from "kysely";
-import type winston from "winston";
 
 import { EventEmitter } from "events";
 import { pbkdf2Sync } from "node:crypto";
@@ -26,9 +25,11 @@ import * as fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-import { xMakeNonce, XUtils } from "@vex-chat/crypto";
+import { XUtils } from "@vex-chat/crypto";
 import { MailType } from "@vex-chat/types";
 
+import argon2 from "argon2";
+
 /**
  * Narrow a plain integer from the `mailType` SQL column to the
  * `MailType` union (0 = initial, 1 = subsequent). Throws if the
@@ -46,8 +47,6 @@ import BetterSqlite3 from "better-sqlite3";
 import { Kysely, Migrator, sql, SqliteDialect } from "kysely";
 import { stringify as uuidStringify, validate as uuidValidate } from "uuid";
 
-import { createLogger } from "./utils/createLogger.ts";
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const migrationFolder = path.join(__dirname, "migrations");
 
@@ -104,21 +103,25 @@ function isMigration(mod: unknown): mod is Migration {
 }
 
 const pubkeyRegex = /[0-9a-f]{64}/;
-export const ITERATIONS = 1000;
+
+/** Legacy iteration count kept only for verifying old PBKDF2 hashes. */
+const PBKDF2_ITERATIONS = 1000;
 
 // ── Row-to-interface converters ─────────────────────────────────────────
 // SQLite stores booleans as integers and dates as strings, but the
 // @vex-chat/types interfaces expect boolean / Date.
 
+/** Internal record that includes the hash algorithm discriminator. */
+export interface InternalUserRecord extends UserRecord {
+    hashAlgo: string;
+}
+
 export class Database extends EventEmitter {
     private db: Kysely<ServerDatabase>;
-    private log: winston.Logger;
 
     constructor(options?: SpireOptions) {
         super();
 
-        this.log = createLogger("spire-db", options?.logLevel || "error");
-
         const dbType = options?.dbType || "sqlite3";
 
         let filename: string;
@@ -151,7 +154,6 @@ export class Database extends EventEmitter {
     }
 
     public async close(): Promise<void> {
-        this.log.info("Closing database.");
         await this.db.destroy();
     }
 
@@ -280,13 +282,12 @@ export class Database extends EventEmitter {
         regPayload: RegistrationPayload,
     ): Promise<[null | UserRecord, Error | null]> {
         try {
-            const salt = xMakeNonce();
-            const passwordHash = hashPassword(regPayload.password, salt);
+            const passwordHash = await hashPasswordArgon2(regPayload.password);
 
             const user: UserRecord = {
                 lastSeen: new Date().toISOString(),
-                passwordHash: passwordHash.toString("hex"),
-                passwordSalt: XUtils.encodeHex(salt),
+                passwordHash,
+                passwordSalt: "",
                 userID: uuidStringify(regKey),
                 username: regPayload.username,
             };
@@ -295,6 +296,7 @@ export class Database extends EventEmitter {
                 .insertInto("users")
                 .values({
                     ...user,
+                    hashAlgo: "argon2id",
                     lastSeen: user.lastSeen,
                 })
                 .execute();
@@ -489,8 +491,8 @@ export class Database extends EventEmitter {
         try {
             await sql`select 1 as ok`.execute(this.db);
             return true;
-        } catch (err: unknown) {
-            this.log.warn("Database health check failed: " + String(err));
+        } catch (_err: unknown) {
+            // debugger: health check failed
             return false;
         }
     }
@@ -511,6 +513,21 @@ export class Database extends EventEmitter {
             .execute();
     }
 
+    public async rehashPassword(
+        userID: string,
+        newHash: string,
+    ): Promise<void> {
+        await this.db
+            .updateTable("users")
+            .set({
+                hashAlgo: "argon2id",
+                passwordHash: newHash,
+                passwordSalt: "",
+            })
+            .where("userID", "=", userID)
+            .execute();
+    }
+
     /**
      * Retrives a list of users that should be notified when a specific resourceID
      * experiences changes.
@@ -763,7 +780,7 @@ export class Database extends EventEmitter {
     // the identifier can be username, public key, or userID
     public async retrieveUser(
         userIdentifier: string,
-    ): Promise<null | UserRecord> {
+    ): Promise<InternalUserRecord | null> {
         let rows;
         if (uuidValidate(userIdentifier)) {
             rows = await this.db
@@ -795,7 +812,7 @@ export class Database extends EventEmitter {
         return rows.map(toDevice);
     }
 
-    public async retrieveUsers(): Promise<UserRecord[]> {
+    public async retrieveUsers(): Promise<InternalUserRecord[]> {
         const rows = await this.db.selectFrom("users").selectAll().execute();
         return rows.map(toUserRecord);
     }
@@ -864,6 +881,53 @@ export class Database extends EventEmitter {
     }
 }
 
+/**
+ * Hash a password with Argon2id (new default).
+ * Returns the encoded hash string which embeds salt, params, and digest.
+ */
+export async function hashPasswordArgon2(password: string): Promise<string> {
+    return argon2.hash(password, {
+        memoryCost: 65536,
+        parallelism: 4,
+        timeCost: 3,
+        type: argon2.argon2id,
+    });
+}
+
+/**
+ * Verify a password against either Argon2id or legacy PBKDF2 storage.
+ * Returns `{ valid, needsRehash }` — callers should rehash on success
+ * when `needsRehash` is true.
+ */
+export async function verifyPassword(
+    password: string,
+    stored: { hashAlgo: string; passwordHash: string; passwordSalt: string },
+): Promise<{ needsRehash: boolean; valid: boolean }> {
+    if (stored.hashAlgo === "argon2id") {
+        const valid = await argon2.verify(stored.passwordHash, password);
+        return { needsRehash: false, valid };
+    }
+
+    // Legacy PBKDF2 path
+    const salt = XUtils.decodeHex(stored.passwordSalt);
+    const computed = pbkdf2Sync(
+        password,
+        salt,
+        PBKDF2_ITERATIONS,
+        32,
+        "sha512",
+    );
+    const storedBuf = XUtils.decodeHex(stored.passwordHash);
+
+    if (computed.length !== storedBuf.length) {
+        return { needsRehash: false, valid: false };
+    }
+
+    const { timingSafeEqual } = await import("node:crypto");
+    const valid = timingSafeEqual(computed, storedBuf);
+    return { needsRehash: valid, valid };
+}
+
 function toDevice(row: {
     deleted: number;
     deviceID: string;
@@ -912,14 +976,12 @@ function toServer(row: {
 }
 
 function toUserRecord(row: {
+    hashAlgo: string;
     lastSeen: string;
     passwordHash: string;
     passwordSalt: string;
     userID: string;
     username: string;
-}): UserRecord {
+}): InternalUserRecord {
     return { ...row };
 }
-
-export const hashPassword = (password: string, salt: Uint8Array) =>
-    pbkdf2Sync(password, salt, ITERATIONS, 32, "sha512");