@vex-chat/spire 1.0.0 → 1.0.1

package/src/Spire.ts

@@ -1,6 +1,5 @@
 import type { ActionToken, BaseMsg, NotifyMsg, User } from "@vex-chat/types";
 import type { Server } from "http";
-import type winston from "winston";
 
 import { EventEmitter } from "events";
 import { execSync } from "node:child_process";
@@ -30,11 +29,10 @@ import { WebSocketServer } from "ws";
 import { z } from "zod/v4";
 
 import { ClientManager } from "./ClientManager.ts";
-import { Database, hashPassword } from "./Database.ts";
+import { Database, hashPasswordArgon2, verifyPassword } from "./Database.ts";
 import { initApp, protect } from "./server/index.ts";
 import { authLimiter } from "./server/rateLimit.ts";
 import { censorUser, getParam, getUser } from "./server/utils.ts";
-import { createLogger } from "./utils/createLogger.ts";
 import { getJwtSecret } from "./utils/jwtSecret.ts";
 import { msgpack } from "./utils/msgpack.ts";
 
@@ -130,14 +128,6 @@ const getCommitSha = (): string => {
 export interface SpireOptions {
     apiPort?: number;
     dbType?: "mysql" | "sqlite3" | "sqlite3mem" | "sqlite";
-    logLevel?:
-        | "debug"
-        | "error"
-        | "http"
-        | "info"
-        | "silly"
-        | "verbose"
-        | "warn";
 }
 
 export class Spire extends EventEmitter {
@@ -151,9 +141,6 @@ export class Spire extends EventEmitter {
         string,
         { deviceID: string; nonce: string; time: number }
     >();
-    private log: winston.Logger;
-    private options: SpireOptions | undefined;
-
     private queuedRequestIncrements = 0;
     private requestsTotal = 0;
 
@@ -164,7 +151,10 @@ export class Spire extends EventEmitter {
 
     private readonly startedAt = new Date();
     private readonly version = getAppVersion();
-    private wss: WebSocketServer = new WebSocketServer({ noServer: true });
+    private wss: WebSocketServer = new WebSocketServer({
+        maxPayload: 4096,
+        noServer: true,
+    });
 
     constructor(SK: string, options?: SpireOptions) {
         super();
@@ -180,17 +170,12 @@ export class Spire extends EventEmitter {
         this.db = new Database(options);
         this.db.on("ready", () => {
             this.dbReady = true;
-            this.bootstrapRequestCounter().catch((err: unknown) => {
-                this.log.error(
-                    "Failed to load persisted request counter: " + String(err),
-                );
+            this.bootstrapRequestCounter().catch((_err: unknown) => {
+                // debugger: bootstrap request counter failed
             });
         });
 
-        this.log = createLogger("spire", options?.logLevel || "error");
         this.init(options?.apiPort || 16777);
-
-        this.options = options;
     }
 
     public async close(): Promise<void> {
@@ -198,18 +183,9 @@ export class Spire extends EventEmitter {
             ws.terminate();
         });
 
-        this.wss.on("close", () => {
-            this.log.info("ws: closed.");
-        });
-
-        this.server?.on("close", () => {
-            this.log.info("http: closed.");
-        });
-
         this.server?.close();
         this.wss.close();
         await this.db.close();
-        return;
     }
 
     private async bootstrapRequestCounter(): Promise<void> {
@@ -246,11 +222,8 @@ export class Spire extends EventEmitter {
             if (!this.requestsTotalLoaded) {
                 this.queuedRequestIncrements += 1;
             } else {
-                this.db.incrementRequestsTotal(1).catch((err: unknown) => {
-                    this.log.warn(
-                        "Failed to persist request counter increment: " +
-                            String(err),
-                    );
+                this.db.incrementRequestsTotal(1).catch((_err: unknown) => {
+                    // debugger: failed to persist request counter
                 });
             }
 
@@ -261,7 +234,6 @@ export class Spire extends EventEmitter {
         initApp(
             this.api,
             this.db,
-            this.log,
             this.validateToken.bind(this),
             this.signKeys,
             this.notify.bind(this),
@@ -269,11 +241,9 @@ export class Spire extends EventEmitter {
 
         // WS auth: client sends { type: "auth", token } as first message
         this.wss.on("connection", (ws) => {
-            this.log.info("WS connection established, waiting for auth...");
             const AUTH_TIMEOUT = 10_000;
 
             const timer = setTimeout(() => {
-                this.log.warn("WS auth timeout — closing.");
                 ws.close();
             }, AUTH_TIMEOUT);
 
@@ -308,47 +278,27 @@ export class Spire extends EventEmitter {
                     }
                     const userDetails: User = jwtResult.data.user;
 
-                    this.log.info(
-                        "WS auth succeeded for " + userDetails.username,
-                    );
-
                     const client = new ClientManager(
                         ws,
                         this.db,
                         this.notify.bind(this),
                         userDetails,
-                        this.options,
                     );
 
                     client.on("fail", () => {
-                        this.log.info(
-                            "Client connection is down, removing: " +
-                                client.toString(),
-                        );
                         if (this.clients.includes(client)) {
                             this.clients.splice(
                                 this.clients.indexOf(client),
                                 1,
                             );
                         }
-                        this.log.info(
-                            "Current authorized clients: " +
-                                String(this.clients.length),
-                        );
                     });
 
                     client.on("authed", () => {
-                        this.log.info(
-                            "New client authorized: " + client.toString(),
-                        );
                         this.clients.push(client);
-                        this.log.info(
-                            "Current authorized clients: " +
-                                String(this.clients.length),
-                        );
                     });
-                } catch (err: unknown) {
-                    this.log.warn("WS auth failed: " + String(err));
+                } catch (_err: unknown) {
+                    // debugger: WS auth failed
                     const errMsg: BaseMsg = {
                         transmissionID: crypto.randomUUID(),
                         type: "unauthorized",
@@ -421,9 +371,7 @@ export class Spire extends EventEmitter {
                 }
 
                 try {
-                    this.log.info("New token requested of type " + tokenType);
                     const token = this.createActionToken(scope);
-                    this.log.info("New token created: " + token.key);
 
                     setTimeout(() => {
                         this.deleteActionToken(token);
@@ -441,8 +389,8 @@ export class Spire extends EventEmitter {
 
                     res.set("Content-Type", "application/msgpack");
                     return res.send(msgpack.encode(token));
-                } catch (err: unknown) {
-                    this.log.error(String(err));
+                } catch (_err: unknown) {
+                    // debugger: token creation failed
                     return res.sendStatus(500);
                 }
             },
@@ -457,7 +405,6 @@ export class Spire extends EventEmitter {
             res.send(
                 msgpack.encode({
                     exp: req.exp,
-                    token: req.bearerToken,
                     user: req.user,
                 }),
             );
@@ -477,7 +424,12 @@ export class Spire extends EventEmitter {
             const checkDurationMs = Date.now() - started;
 
             const ok = dbHealthy;
+            const canaryEnv = process.env["CANARY"]?.trim().toLowerCase();
             res.json({
+                canary:
+                    canaryEnv === "1" ||
+                    canaryEnv === "true" ||
+                    canaryEnv === "yes",
                 checkDurationMs,
                 commitSha: this.commitSha,
                 dbHealthy,
@@ -532,12 +484,11 @@ export class Spire extends EventEmitter {
                     this.deviceChallenges.delete(challengeID);
                 }, DEVICE_CHALLENGE_EXPIRY);
 
-                this.log.info("Device challenge issued for " + deviceID);
                 return res.send(
                     msgpack.encode({ challenge: nonce, challengeID }),
                 );
-            } catch (err: unknown) {
-                this.log.error("Device challenge error: " + String(err));
+            } catch (_err: unknown) {
+                // debugger: device challenge error
                 return res.sendStatus(500);
             }
         });
@@ -608,18 +559,11 @@ export class Spire extends EventEmitter {
                     getJwtSecret(),
                     { expiresIn: DEVICE_AUTH_JWT_EXPIRY },
                 );
-                this.log.info(
-                    "Device-key auth succeeded for " +
-                        user.username +
-                        " (device " +
-                        device.deviceID +
-                        ")",
-                );
                 return res.send(
                     msgpack.encode({ token, user: censorUser(user) }),
                 );
-            } catch (err: unknown) {
-                this.log.error("Device verify error: " + String(err));
+            } catch (_err: unknown) {
+                // debugger: device verify error
                 return res.sendStatus(500);
             }
         });
@@ -648,8 +592,6 @@ export class Spire extends EventEmitter {
                 senderDeviceDetails.deviceID,
                 authorUserDetails.userID,
             );
-            this.log.info("Received mail for " + mail.recipient);
-
             const recipientDeviceDetails = await this.db.retrieveDevice(
                 mail.recipient,
             );
@@ -681,21 +623,25 @@ export class Spire extends EventEmitter {
             try {
                 const userEntry = await this.db.retrieveUser(username);
                 if (!userEntry) {
-                    res.sendStatus(404);
-                    this.log.warn("User does not exist.");
+                    res.sendStatus(401);
                     return;
                 }
 
-                const salt = XUtils.decodeHex(userEntry.passwordSalt);
-                const payloadHash = XUtils.encodeHex(
-                    hashPassword(password, salt),
+                const { needsRehash, valid } = await verifyPassword(
+                    password,
+                    userEntry,
                 );
 
-                if (payloadHash !== userEntry.passwordHash) {
+                if (!valid) {
                     res.sendStatus(401);
                     return;
                 }
 
+                if (needsRehash) {
+                    const newHash = await hashPasswordArgon2(password);
+                    await this.db.rehashPassword(userEntry.userID, newHash);
+                }
+
                 const token = jwt.sign(
                     { user: censorUser(userEntry) },
                     getJwtSecret(),
@@ -708,8 +654,8 @@ export class Spire extends EventEmitter {
                 res.send(
                     msgpack.encode({ token, user: censorUser(userEntry) }),
                 );
-            } catch (err: unknown) {
-                this.log.error(String(err));
+            } catch (_err: unknown) {
+                // debugger: auth error
                 res.sendStatus(500);
             }
         });
@@ -762,9 +708,6 @@ export class Spire extends EventEmitter {
                                     "users_signkey_unique",
                                 );
 
-                                this.log.warn(
-                                    "User attempted to register duplicate account.",
-                                );
                                 if (usernameConflict) {
                                     res.status(400).send({
                                         error: "Username is already registered.",
@@ -782,16 +725,10 @@ export class Spire extends EventEmitter {
                                 });
                                 break;
                             default:
-                                this.log.info(
-                                    "Unsupported sql error type: " +
-                                        String(errCode),
-                                );
-                                this.log.error(String(err));
                                 res.sendStatus(500);
                                 break;
                         }
                     } else {
-                        this.log.info("Registration success.");
                         if (!user) {
                             res.sendStatus(500);
                             return;
@@ -803,15 +740,13 @@ export class Spire extends EventEmitter {
                         error: "Invalid or no token supplied.",
                     });
                 }
-            } catch (err: unknown) {
-                this.log.error("error registering user: " + String(err));
+            } catch (_err: unknown) {
+                // debugger: registration error
                 res.sendStatus(500);
             }
         });
 
-        this.server = this.api.listen(apiPort, () => {
-            this.log.info("API started on port " + String(apiPort));
-        });
+        this.server = this.api.listen(apiPort);
 
         // Accept all WS upgrades — auth happens post-connection.
         this.server.on("upgrade", (req, socket, head) => {
@@ -854,7 +789,6 @@ export class Spire extends EventEmitter {
     }
 
     private validateToken(key: string, scope: TokenScopes): boolean {
-        this.log.info("Validating token: " + key);
         for (const rKey of this.actionTokens) {
             if (rKey.key === key) {
                 if (rKey.scope !== scope) {
@@ -862,17 +796,12 @@ export class Spire extends EventEmitter {
                 }
 
                 const age = Date.now() - new Date(rKey.time).getTime();
-                this.log.info("Token found, " + String(age) + " ms old.");
                 if (age < TOKEN_EXPIRY) {
-                    this.log.info("Token is valid.");
                     this.deleteActionToken(rKey);
                     return true;
-                } else {
-                    this.log.info("Token is expired.");
                 }
             }
         }
-        this.log.info("Token not found.");
         return false;
     }
 }

package/src/__tests__/Database.spec.ts

@@ -5,7 +5,6 @@ import { XUtils } from "@vex-chat/crypto";
 
 import * as uuid from "uuid";
 import { describe, expect, it, vi } from "vitest";
-import winston from "winston";
 
 import { Database } from "../Database.ts";
 
@@ -27,19 +26,6 @@ vi.mock("uuid", () => ({
     validate: () => true,
 }));
 
-/** Winston logger stub — Database.close() calls `.info`, and `{}` breaks that. */
-function silentLogger(): winston.Logger {
-    const noop = vi.fn();
-    return {
-        debug: noop,
-        error: noop,
-        info: noop,
-        log: noop,
-        verbose: noop,
-        warn: noop,
-    } as unknown as winston.Logger;
-}
-
 describe("Database", () => {
     // Reusable test data
     const keyID = "de459e05-aa63-4dfa-97b4-ed43d5c7a5f7";
@@ -80,9 +66,6 @@ describe("Database", () => {
             expect.assertions(1);
 
             vi.mocked(uuid.v4).mockReturnValueOnce(keyID);
-            vi.spyOn(winston, "createLogger").mockReturnValueOnce(
-                silentLogger(),
-            );
 
             const provider = new Database(options);
             await new Promise<void>((resolve, reject) => {

package/src/db/schema.ts

@@ -156,6 +156,7 @@ export type ServiceMetricUpdate = Updateable<ServiceMetricsTable>;
 
 export type UserRow = Selectable<UsersTable>;
 export interface UsersTable {
+    hashAlgo: string;
     lastSeen: string;
     passwordHash: string;
     passwordSalt: string;

package/src/migrations/2026-04-14_argon2id-password-hashing.ts

@@ -0,0 +1,18 @@
+import { type Kysely, sql } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.alterTable("users").dropColumn("hashAlgo").execute();
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .alterTable("users")
+        .addColumn("hashAlgo", "varchar(16)", (cb) =>
+            cb.defaultTo("pbkdf2").notNull(),
+        )
+        .execute();
+
+    await sql`UPDATE users SET hashAlgo = 'pbkdf2' WHERE hashAlgo = 'pbkdf2'`.execute(
+        db,
+    );
+}

package/src/run.ts

@@ -18,7 +18,6 @@ function main() {
     new Spire(spk, {
         ...(apiPort !== undefined ? { apiPort: Number(apiPort) } : {}),
         ...(dbType !== undefined ? { dbType } : {}),
-        logLevel: "info",
     });
 }
 

package/src/server/avatar.ts

@@ -1,6 +1,3 @@
-import type { Database } from "../Database.ts";
-import type winston from "winston";
-
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
 
@@ -20,7 +17,7 @@ import { ALLOWED_IMAGE_TYPES, protect } from "./index.ts";
 
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
 
-export const getAvatarRouter = (db: Database, log: winston.Logger) => {
+export const getAvatarRouter = () => {
     const router = express.Router();
 
     router.get("/:userID", async (req, res) => {
@@ -39,8 +36,8 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
         res.set("Cache-control", "public, max-age=31536000");
 
         const stream = fs.createReadStream(filePath);
-        stream.on("error", (err) => {
-            log.error(err.toString());
+        stream.on("error", (_err) => {
+            // debugger: avatar stream read error
             res.sendStatus(500);
         });
         stream.pipe(res);
@@ -65,7 +62,6 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
         }
 
         if (!payload.file) {
-            log.warn("MISSING FILE");
             res.sendStatus(400);
             return;
         }
@@ -84,10 +80,9 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
         try {
             // write the file to disk
             await fsp.writeFile("avatars/" + userDetails.userID, buf);
-            log.info("Wrote new avatar " + userDetails.userID);
             res.sendStatus(200);
-        } catch (err: unknown) {
-            log.warn(String(err));
+        } catch (_err: unknown) {
+            // debugger: avatar write failed
             res.sendStatus(500);
         }
     });
@@ -107,7 +102,6 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
             }
 
             if (!req.file) {
-                log.warn("MISSING FILE");
                 res.sendStatus(400);
                 return;
             }
@@ -128,10 +122,9 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
                     "avatars/" + userDetails.userID,
                     req.file.buffer,
                 );
-                log.info("Wrote new avatar " + userDetails.userID);
                 res.sendStatus(200);
-            } catch (err: unknown) {
-                log.warn(String(err));
+            } catch (_err: unknown) {
+                // debugger: avatar write failed
                 res.sendStatus(500);
             }
         },

package/src/server/errors.ts

@@ -9,8 +9,7 @@
  *   (which include database internals, file paths, and stack traces)
  *   back to the client. The new pattern: throw `AppError(status, msg)`
  *   or let an unknown error propagate, and the single 4-arg middleware
- *   below converts it into a JSON response with a generic message
- *   while logging the full internals server-side via winston.
+ *   below converts it into a JSON response with a generic message.
  *
  * - **CWE-79 / CWE-116 — Exception text reinterpreted as HTML.** Express's
  *   default finalhandler sends thrown `Error` objects as
@@ -27,7 +26,6 @@
  * `express-async-errors` shim needed.
  */
 import type { ErrorRequestHandler } from "express";
-import type winston from "winston";
 
 import { randomUUID } from "node:crypto";
 
@@ -39,8 +37,7 @@ import { ZodError } from "zod/v4";
  * - `status` — HTTP status code (400, 401, 403, 404, 409, etc.)
  * - `message` — client-safe message, MUST NOT contain request data
  *   (route params, body fields, query strings). Anything operator-
- *   only (database errors, file paths) belongs in winston logs, not
- *   in this string.
+ *   only (database errors, file paths) should not appear in this string.
  *
  * Anything that isn't an `AppError` (raw `Error`, `TypeError`, a
  * rejected promise from a DB query, etc.) is treated by the central
@@ -68,8 +65,7 @@ export class AppError extends Error {
  *     api.use(errorHandler(log));
  */
 export const errorHandler =
-    (log: winston.Logger): ErrorRequestHandler =>
-    (err, req, res, _next) => {
+    (): ErrorRequestHandler => (err, _req, res, _next) => {
         // If headers already went out there's nothing safe to do except
         // let Express's default handler close the socket.
         if (res.headersSent) {
@@ -95,31 +91,6 @@ export const errorHandler =
             clientMessage = err.message;
         }
 
-        // Log the full internals server-side. `err instanceof Error` also
-        // catches AppError (extends Error), so we get stacks and messages
-        // for every branch in the logs.
-        if (err instanceof Error) {
-            log.error("request failed", {
-                error: {
-                    message: err.message,
-                    name: err.name,
-                    stack: err.stack,
-                },
-                method: req.method,
-                path: req.path,
-                requestId,
-                status,
-            });
-        } else {
-            log.error("request failed", {
-                error: String(err),
-                method: req.method,
-                path: req.path,
-                requestId,
-                status,
-            });
-        }
-
         // ALWAYS JSON — prevents the exception-text-as-HTML XSS vector.
         res.status(status)
             .type("application/json")

package/src/server/file.ts

@@ -1,6 +1,5 @@
 import type { Database } from "../Database.ts";
 import type { FileSQL } from "@vex-chat/types";
-import type winston from "winston";
 
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
@@ -23,7 +22,7 @@ import { protect } from "./index.ts";
 
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
 
-export const getFileRouter = (db: Database, log: winston.Logger) => {
+export const getFileRouter = (db: Database) => {
     const router = express.Router();
 
     router.get("/:id", protect, async (req, res) => {
@@ -37,8 +36,8 @@ export const getFileRouter = (db: Database, log: winston.Logger) => {
             res.sendStatus(404);
         } else {
             const stream = fs.createReadStream("./files/" + entry.fileID);
-            stream.on("error", (err) => {
-                log.error(err.toString());
+            stream.on("error", (_err) => {
+                // debugger: file stream read error
                 res.sendStatus(500);
             });
             stream.pipe(res);
@@ -105,12 +104,10 @@ export const getFileRouter = (db: Database, log: winston.Logger) => {
         const newFile: FileSQL = {
             fileID: crypto.randomUUID(),
             nonce: payload.nonce,
-            owner: payload.owner,
+            owner: deviceDetails.deviceID,
         };
 
         await fsp.writeFile("files/" + newFile.fileID, buf);
-        log.info("Wrote new file " + newFile.fileID);
-
         await db.createFile(newFile);
         res.send(msgpack.encode(newFile));
     });
@@ -157,12 +154,10 @@ export const getFileRouter = (db: Database, log: winston.Logger) => {
             const newFile: FileSQL = {
                 fileID: crypto.randomUUID(),
                 nonce: payload.nonce,
-                owner: payload.owner,
+                owner: deviceDetails.deviceID,
             };
 
             await fsp.writeFile("files/" + newFile.fileID, req.file.buffer);
-            log.info("Wrote new file " + newFile.fileID);
-
             await db.createFile(newFile);
             res.send(msgpack.encode(newFile));
         },