@vex-chat/spire 1.0.0 → 1.0.1

package/src/server/index.ts

@@ -1,6 +1,5 @@
 import type { Database } from "../Database.ts";
 import type { Emoji } from "@vex-chat/types";
-import type winston from "winston";
 
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
@@ -15,7 +14,6 @@ import cors from "cors";
 import { fileTypeFromBuffer, fileTypeFromFile } from "file-type";
 import helmet from "helmet";
 import jwt from "jsonwebtoken";
-import morgan from "morgan";
 import multer from "multer";
 import parseDuration from "parse-duration";
 import { stringify as uuidStringify } from "uuid";
@@ -156,8 +154,6 @@ export const msgpackParser: express.RequestHandler = (req, res, next) => {
     next();
 };
 
-const isProduction = process.env["NODE_ENV"] === "production";
-
 const directories = ["files", "avatars"];
 for (const dir of directories) {
     if (!fs.existsSync(dir)) {
@@ -168,7 +164,6 @@ for (const dir of directories) {
 export const initApp = (
     api: express.Application,
     db: Database,
-    log: winston.Logger,
     tokenValidator: (key: string, scope: TokenScopes) => boolean,
     signKeys: KeyPair,
     notify: (
@@ -180,10 +175,10 @@ export const initApp = (
     ) => void,
 ) => {
     // INIT ROUTERS
-    const userRouter = getUserRouter(db, log, tokenValidator);
-    const fileRouter = getFileRouter(db, log);
-    const avatarRouter = getAvatarRouter(db, log);
-    const inviteRouter = getInviteRouter(db, log, tokenValidator, notify);
+    const userRouter = getUserRouter(db, tokenValidator);
+    const fileRouter = getFileRouter(db);
+    const avatarRouter = getAvatarRouter();
+    const inviteRouter = getInviteRouter(db, tokenValidator, notify);
 
     // MIDDLEWARE
     // Global per-IP rate limit is the FIRST middleware so a flooded
@@ -197,18 +192,18 @@ export const initApp = (
             type: "application/msgpack",
         }),
     );
-    if (isProduction) {
-        api.use(helmet());
-    }
+    api.use(helmet());
     api.use(msgpackParser);
     api.use(checkAuth);
     api.use(checkDevice);
 
-    if (!jestRun()) {
-        api.use(morgan("dev", { stream: process.stdout }));
-    }
-
-    api.use(cors({ credentials: true }));
+    const allowedOrigins = process.env["CORS_ORIGINS"]?.split(",") ?? [];
+    api.use(
+        cors({
+            credentials: true,
+            origin: allowedOrigins.length > 0 ? allowedOrigins : false,
+        }),
+    );
 
     api.get("/server/:id", protect, async (req, res) => {
         const server = await db.retrieveServer(getParam(req, "id"));
@@ -259,7 +254,6 @@ export const initApp = (
                 POWER_LEVELS.INVITE,
             )
         ) {
-            log.warn("No permission!");
             res.sendStatus(401);
             return;
         }
@@ -649,8 +643,8 @@ export const initApp = (
         res.set("Cache-control", "public, max-age=31536000");
 
         const stream = fs.createReadStream(filePath);
-        stream.on("error", (err) => {
-            log.error(err.toString());
+        stream.on("error", (_err) => {
+            // debugger: emoji stream read error
             res.sendStatus(500);
         });
         stream.pipe(res);
@@ -703,10 +697,11 @@ export const initApp = (
         }
         if (!payload.name) {
             res.sendStatus(400);
+            return;
         }
         if (Buffer.byteLength(buf) > 256000) {
-            log.warn("File too big.");
             res.sendStatus(413);
+            return;
         }
 
         const mimeType = await fileTypeFromBuffer(buf);
@@ -730,10 +725,9 @@ export const initApp = (
         try {
             // write the file to disk
             await fsp.writeFile("emoji/" + emoji.emojiID, buf);
-            log.info("Wrote new emoji " + emoji.emojiID);
             res.send(msgpack.encode(emoji));
-        } catch (err: unknown) {
-            log.warn(String(err));
+        } catch (_err: unknown) {
+            // debugger: emoji write failed
             res.sendStatus(500);
         }
     });
@@ -786,17 +780,17 @@ export const initApp = (
 
             if (!payload.name) {
                 res.sendStatus(400);
+                return;
             }
 
             if (!req.file) {
-                log.warn("MISSING FILE");
                 res.sendStatus(400);
                 return;
             }
 
             if (Buffer.byteLength(req.file.buffer) > 256000) {
-                log.warn("File too big.");
                 res.sendStatus(413);
+                return;
             }
 
             const mimeType = await fileTypeFromBuffer(req.file.buffer);
@@ -820,10 +814,9 @@ export const initApp = (
             try {
                 // write the file to disk
                 await fsp.writeFile("emoji/" + emoji.emojiID, req.file.buffer);
-                log.info("Wrote new emoji " + emoji.emojiID);
                 res.send(msgpack.encode(emoji));
-            } catch (err: unknown) {
-                log.warn(String(err));
+            } catch (_err: unknown) {
+                // debugger: emoji write failed
                 res.sendStatus(500);
             }
         },
@@ -844,12 +837,5 @@ export const initApp = (
     // (client-safe status + message) and programmer errors (generic 500
     // with full details logged server-side). See src/server/errors.ts
     // for the CWE mapping.
-    api.use(errorHandler(log));
-};
-
-/**
- * @ignore
- */
-const jestRun = () => {
-    return process.env["JEST_WORKER_ID"] !== undefined;
+    api.use(errorHandler());
 };

package/src/server/invite.ts

@@ -1,6 +1,5 @@
 import type { Database } from "../Database.ts";
 import type { TokenScopes } from "@vex-chat/types";
-import type winston from "winston";
 
 import express from "express";
 
@@ -12,7 +11,6 @@ import { protect } from "./index.ts";
 
 export const getInviteRouter = (
     db: Database,
-    log: winston.Logger,
     tokenValidator: (key: string, scope: TokenScopes) => boolean,
     notify: (
         userID: string,

package/src/server/rateLimit.ts

@@ -38,14 +38,14 @@ const keyByIp = (req: Request): string => ipKeyGenerator(req.ip ?? "");
 /**
  * Global per-IP limiter. Applied app-wide via `api.use(globalLimiter)`.
  *
- * 300 requests per 15 minutes per client IP. A human chatting via a
+ * 3000 requests per 15 minutes per client IP. A human chatting via a
  * browser or the libvex client won't come close; a single-host DoS
  * gets throttled quickly.
  */
 export const globalLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 300,
+    limit: 3000,
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
 });
@@ -54,7 +54,7 @@ export const globalLimiter = rateLimit({
  * Strict auth endpoint limiter. Applied per-route to /auth, /register,
  * and /auth/device.
  *
- * 5 failed attempts per 15 minutes per IP. Successful logins don't
+ * 50 failed attempts per 15 minutes per IP. Successful logins don't
  * count (`skipSuccessfulRequests`), so a normal user doesn't lock
  * themselves out by fat-fingering a password once. Blocks brute force
  * (CWE-307) without harming UX.
@@ -62,7 +62,7 @@ export const globalLimiter = rateLimit({
 export const authLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 5,
+    limit: 50,
     skipSuccessfulRequests: true,
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
@@ -74,13 +74,13 @@ export const authLimiter = rateLimit({
  * upload attempts per minute so an attacker can't force spire to
  * spend CPU/IO on repeated large-body parses.
  *
- * 20 uploads per minute per IP — generous for a chat client (rapid-
+ * 200 uploads per minute per IP — generous for a chat client (rapid-
  * fire image attachments) but tight enough to shield the disk.
  */
 export const uploadLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 20,
+    limit: 200,
     standardHeaders: "draft-7",
     windowMs: 60 * 1000,
 });

package/src/server/user.ts

@@ -1,5 +1,4 @@
 import type { Database } from "../Database.ts";
-import type winston from "winston";
 
 import express from "express";
 
@@ -17,7 +16,6 @@ import { protect } from "./index.ts";
 
 export const getUserRouter = (
     db: Database,
-    log: winston.Logger,
     tokenValidator: (key: string, scope: TokenScopes) => boolean,
 ) => {
     const router = express.Router();
@@ -98,7 +96,6 @@ export const getUserRouter = (
         );
 
         if (!token) {
-            log.warn("Invalid signature on token.");
             res.sendStatus(400);
             return;
         }
@@ -110,9 +107,8 @@ export const getUserRouter = (
                     deviceData,
                 );
                 res.send(msgpack.encode(device));
-            } catch (err: unknown) {
-                log.warn(String(err));
-                // failed registration due to signkey being taken
+            } catch (_err: unknown) {
+                // signkey already taken
                 res.sendStatus(470);
                 return;
             }

package/src/utils/jwtSecret.ts

@@ -1,15 +1,14 @@
 /**
- * Returns the JWT signing secret.
+ * Returns the dedicated JWT HMAC signing secret.
  *
- * Prefers JWT_SECRET (dedicated HMAC key) over SPK (NaCl server signing key).
- * Falls back to SPK for backward compat with existing deployments.
+ * This MUST be a separate key from SPK (the Ed25519 server signing key)
+ * so that compromise of one does not affect the other.
  */
 export function getJwtSecret(): string {
-    const secret = process.env["JWT_SECRET"] ?? process.env["SPK"];
+    const secret = process.env["JWT_SECRET"];
     if (!secret) {
         throw new Error(
-            "Neither JWT_SECRET nor SPK is set. " +
-                "Set JWT_SECRET (preferred) or SPK in your environment.",
+            "JWT_SECRET is not set. Generate one with: node scripts/gen-spk.js",
         );
     }
     return secret;

package/src/utils/loadEnv.ts

@@ -3,7 +3,7 @@ import { config } from "dotenv";
 /* Populate process.env with vars from .env and verify required vars are present. */
 export function loadEnv(): void {
     config();
-    const requiredEnvVars: string[] = ["CANARY", "DB_TYPE", "SPK"];
+    const requiredEnvVars: string[] = ["DB_TYPE", "JWT_SECRET", "SPK"];
     for (const required of requiredEnvVars) {
         if (process.env[required] === undefined) {
             process.stderr.write(

package/dist/utils/createLogger.d.ts

@@ -1,5 +0,0 @@
-import winston from "winston";
-/**
- * @ignore
- */
-export declare function createLogger(logName: string, logLevel?: string): winston.Logger;

package/dist/utils/createLogger.js

@@ -1,35 +0,0 @@
-import winston from "winston";
-/**
- * @ignore
- */
-export function createLogger(logName, logLevel) {
-    const logger = winston.createLogger({
-        defaultMeta: { service: "vex-" + logName },
-        format: winston.format.combine(winston.format.timestamp({
-            format: "YYYY-MM-DD HH:mm:ss",
-        }), winston.format.errors({ stack: true }), winston.format.splat(), winston.format.json()),
-        level: logLevel || "error",
-        transports: [
-            //
-            // - Write all logs with level `error` and below to `error.log`
-            // - Write all logs with level `info` and below to `combined.log`
-            //
-            new winston.transports.File({
-                filename: "vex:" + logName + ".log",
-                level: "error",
-            }),
-        ],
-    });
-    //
-    // If we're not in production then log to the `console` with the format:
-    // `${info.level}: ${info.message} JSON.stringify({ ...rest }) `
-    //
-    if (process.env["NODE_ENV"] !== "production" &&
-        process.env["NODE_ENV"] !== "test") {
-        logger.add(new winston.transports.Console({
-            format: winston.format.combine(winston.format.colorize(), winston.format.simple()),
-        }));
-    }
-    return logger;
-}
-//# sourceMappingURL=createLogger.js.map

package/dist/utils/createLogger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createLogger.js","sourceRoot":"","sources":["../../src/utils/createLogger.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAiB;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;QAChC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAC1B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YACrB,MAAM,EAAE,qBAAqB;SAChC,CAAC,EACF,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EACtC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EACtB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CACxB;QACD,KAAK,EAAE,QAAQ,IAAI,OAAO;QAC1B,UAAU,EAAE;YACR,EAAE;YACF,+DAA+D;YAC/D,iEAAiE;YACjE,EAAE;YACF,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBACxB,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM;gBACnC,KAAK,EAAE,OAAO;aACjB,CAAC;SACL;KACJ,CAAC,CAAC;IACH,EAAE;IACF,wEAAwE;IACxE,gEAAgE;IAChE,EAAE;IACF,IACI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QACxC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,EACpC,CAAC;QACC,MAAM,CAAC,GAAG,CACN,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,EACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAC1B;SACJ,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/src/utils/createLogger.ts

@@ -1,47 +0,0 @@
-import winston from "winston";
-
-/**
- * @ignore
- */
-export function createLogger(logName: string, logLevel?: string) {
-    const logger = winston.createLogger({
-        defaultMeta: { service: "vex-" + logName },
-        format: winston.format.combine(
-            winston.format.timestamp({
-                format: "YYYY-MM-DD HH:mm:ss",
-            }),
-            winston.format.errors({ stack: true }),
-            winston.format.splat(),
-            winston.format.json(),
-        ),
-        level: logLevel || "error",
-        transports: [
-            //
-            // - Write all logs with level `error` and below to `error.log`
-            // - Write all logs with level `info` and below to `combined.log`
-            //
-            new winston.transports.File({
-                filename: "vex:" + logName + ".log",
-                level: "error",
-            }),
-        ],
-    });
-    //
-    // If we're not in production then log to the `console` with the format:
-    // `${info.level}: ${info.message} JSON.stringify({ ...rest }) `
-    //
-    if (
-        process.env["NODE_ENV"] !== "production" &&
-        process.env["NODE_ENV"] !== "test"
-    ) {
-        logger.add(
-            new winston.transports.Console({
-                format: winston.format.combine(
-                    winston.format.colorize(),
-                    winston.format.simple(),
-                ),
-            }),
-        );
-    }
-    return logger;
-}