@vex-chat/spire 1.0.0 → 1.0.2

package/src/Database.ts

@@ -18,17 +18,19 @@ import type {
     UserRecord,
 } from "@vex-chat/types";
 import type { Migration, MigrationProvider } from "kysely";
-import type winston from "winston";
 
 import { EventEmitter } from "events";
 import { pbkdf2Sync } from "node:crypto";
+import { statSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-import { xMakeNonce, XUtils } from "@vex-chat/crypto";
+import { XUtils } from "@vex-chat/crypto";
 import { MailType } from "@vex-chat/types";
 
+import argon2 from "argon2";
+
 /**
  * Narrow a plain integer from the `mailType` SQL column to the
  * `MailType` union (0 = initial, 1 = subsequent). Throws if the
@@ -46,8 +48,6 @@ import BetterSqlite3 from "better-sqlite3";
 import { Kysely, Migrator, sql, SqliteDialect } from "kysely";
 import { stringify as uuidStringify, validate as uuidValidate } from "uuid";
 
-import { createLogger } from "./utils/createLogger.ts";
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const migrationFolder = path.join(__dirname, "migrations");
 
@@ -104,21 +104,53 @@ function isMigration(mod: unknown): mod is Migration {
 }
 
 const pubkeyRegex = /[0-9a-f]{64}/;
-export const ITERATIONS = 1000;
+
+/** Legacy iteration count kept only for verifying old PBKDF2 hashes. */
+const PBKDF2_ITERATIONS = 1000;
 
 // ── Row-to-interface converters ─────────────────────────────────────────
 // SQLite stores booleans as integers and dates as strings, but the
 // @vex-chat/types interfaces expect boolean / Date.
 
+/** Internal record that includes the hash algorithm discriminator. */
+export interface InternalUserRecord extends UserRecord {
+    hashAlgo: string;
+}
+
 export class Database extends EventEmitter {
     private db: Kysely<ServerDatabase>;
-    private log: winston.Logger;
+
+    /** Underlying better-sqlite3 handle (file or :memory:). */
+    private readonly rawSqlite: InstanceType<typeof BetterSqlite3>;
+
+    /**
+     * In-process cache for {@link retrieveUserDeviceList} when queried for a
+     * single owner. Libvex calls GET /user/:id/devices on every outgoing
+     * `forward()`; stress runs otherwise hammer SQLite with identical reads.
+     * Cleared on device create/delete and when the DB is closed.
+     */
+    private readonly userDeviceListCache = new Map<
+        string,
+        { devices: Device[]; until: number }
+    >();
+
+    /**
+     * Short TTL cache for {@link retrieveEmojiList} (key = server id, stored as
+     * `emojis.owner`). The noise harness fires `emoji.retrieveList` as a
+     * follow-up on ~1/25 successful ops, so this path can contend on SQLite
+     * before heavier surfaces. Invalidated on emoji create/delete.
+     */
+    private readonly emojiListByServerCache = new Map<
+        string,
+        { rows: Emoji[]; until: number }
+    >();
+
+    private static readonly USER_DEVICE_LIST_CACHE_TTL_MS = 10_000;
+    private static readonly EMOJI_LIST_CACHE_TTL_MS = 10_000;
 
     constructor(options?: SpireOptions) {
         super();
 
-        this.log = createLogger("spire-db", options?.logLevel || "error");
-
         const dbType = options?.dbType || "sqlite3";
 
         let filename: string;
@@ -135,23 +167,86 @@ export class Database extends EventEmitter {
                 break;
         }
 
-        const sqliteDb = new BetterSqlite3(filename);
-        sqliteDb.pragma("journal_mode = WAL");
-        sqliteDb.pragma("synchronous = NORMAL");
-        sqliteDb.pragma("busy_timeout = 5000");
-        sqliteDb.pragma("cache_size = -64000");
-        sqliteDb.pragma("temp_store = memory");
-        sqliteDb.pragma("foreign_keys = ON");
+        this.rawSqlite = new BetterSqlite3(filename);
+        this.rawSqlite.pragma("journal_mode = WAL");
+        this.rawSqlite.pragma("synchronous = NORMAL");
+        this.rawSqlite.pragma("busy_timeout = 5000");
+        this.rawSqlite.pragma("cache_size = -64000");
+        this.rawSqlite.pragma("temp_store = memory");
+        this.rawSqlite.pragma("foreign_keys = ON");
 
         this.db = new Kysely<ServerDatabase>({
-            dialect: new SqliteDialect({ database: sqliteDb }),
+            dialect: new SqliteDialect({ database: this.rawSqlite }),
         });
 
         void this.init();
     }
 
+    /**
+     * Dev-only snapshot of SQLite files + pragmas (same process as Spire).
+     * Not for production callers.
+     */
+    public getDevSqliteMonitor(): Record<string, unknown> {
+        const openedAs = this.rawSqlite.name;
+        const absPath =
+            openedAs === ":memory:"
+                ? ":memory:"
+                : path.isAbsolute(openedAs)
+                  ? openedAs
+                  : path.resolve(process.cwd(), openedAs);
+
+        const journalMode = this.rawSqlite.pragma("journal_mode", {
+            simple: true,
+        });
+        const synchronous = this.rawSqlite.pragma("synchronous", {
+            simple: true,
+        });
+        const busyTimeout = this.rawSqlite.pragma("busy_timeout", {
+            simple: true,
+        });
+        const cacheSize = this.rawSqlite.pragma("cache_size", { simple: true });
+        const pageCount = this.rawSqlite.pragma("page_count", { simple: true });
+        const pageSize = this.rawSqlite.pragma("page_size", { simple: true });
+        const freelistCount = this.rawSqlite.pragma("freelist_count", {
+            simple: true,
+        });
+
+        const out: Record<string, unknown> = {
+            absPath,
+            busyTimeout,
+            cacheSize,
+            freelistCount,
+            journalMode,
+            openedAs,
+            pageCount,
+            pageSize,
+            synchronous,
+        };
+
+        if (openedAs !== ":memory:") {
+            const filePaths = {
+                main: absPath,
+                shm: `${absPath}-shm`,
+                wal: `${absPath}-wal`,
+            };
+            out["filePaths"] = filePaths;
+            const sizes: Record<string, number> = {};
+            for (const [label, fp] of Object.entries(filePaths)) {
+                try {
+                    sizes[label] = statSync(fp).size;
+                } catch {
+                    sizes[label] = 0;
+                }
+            }
+            out["fileBytes"] = sizes;
+        }
+
+        return out;
+    }
+
     public async close(): Promise<void> {
-        this.log.info("Closing database.");
+        this.userDeviceListCache.clear();
+        this.emojiListByServerCache.clear();
         await this.db.destroy();
     }
 
@@ -182,6 +277,7 @@ export class Database extends EventEmitter {
         };
 
         await this.db.insertInto("devices").values(device).execute();
+        this.userDeviceListCache.delete(owner);
 
         const medPreKeys = {
             deviceID: device.deviceID,
@@ -199,6 +295,7 @@ export class Database extends EventEmitter {
 
     public async createEmoji(emoji: Emoji): Promise<void> {
         await this.db.insertInto("emojis").values(emoji).execute();
+        this.emojiListByServerCache.delete(emoji.owner);
     }
 
     public async createFile(file: FileSQL): Promise<void> {
@@ -228,30 +325,31 @@ export class Database extends EventEmitter {
         resourceID: string,
         powerLevel: number,
     ): Promise<Permission> {
-        const permissionID = crypto.randomUUID();
-
-        // check if it already exists
-        const checkPermission = await this.db
-            .selectFrom("permissions")
-            .selectAll()
-            .where("userID", "=", userID)
-            .where("resourceID", "=", resourceID)
-            .execute();
-        const existing = checkPermission[0];
-        if (existing) {
-            return existing;
-        }
+        // Atomic check-then-insert inside a transaction so two concurrent
+        // callers cannot both find "no existing" and insert duplicates.
+        return this.db.transaction().execute(async (trx) => {
+            const checkPermission = await trx
+                .selectFrom("permissions")
+                .selectAll()
+                .where("userID", "=", userID)
+                .where("resourceID", "=", resourceID)
+                .execute();
+            const existing = checkPermission[0];
+            if (existing) {
+                return existing;
+            }
 
-        const permission: Permission = {
-            permissionID,
-            powerLevel,
-            resourceID,
-            resourceType,
-            userID,
-        };
+            const permission: Permission = {
+                permissionID: crypto.randomUUID(),
+                powerLevel,
+                resourceID,
+                resourceType,
+                userID,
+            };
 
-        await this.db.insertInto("permissions").values(permission).execute();
-        return permission;
+            await trx.insertInto("permissions").values(permission).execute();
+            return permission;
+        });
     }
 
     public async createServer(name: string, ownerID: string): Promise<Server> {
@@ -280,13 +378,12 @@ export class Database extends EventEmitter {
         regPayload: RegistrationPayload,
     ): Promise<[null | UserRecord, Error | null]> {
         try {
-            const salt = xMakeNonce();
-            const passwordHash = hashPassword(regPayload.password, salt);
+            const passwordHash = await hashPasswordArgon2(regPayload.password);
 
             const user: UserRecord = {
                 lastSeen: new Date().toISOString(),
-                passwordHash: passwordHash.toString("hex"),
-                passwordSalt: XUtils.encodeHex(salt),
+                passwordHash,
+                passwordSalt: "",
                 userID: uuidStringify(regKey),
                 username: regPayload.username,
             };
@@ -295,6 +392,7 @@ export class Database extends EventEmitter {
                 .insertInto("users")
                 .values({
                     ...user,
+                    hashAlgo: "argon2id",
                     lastSeen: user.lastSeen,
                 })
                 .execute();
@@ -319,6 +417,12 @@ export class Database extends EventEmitter {
     }
 
     public async deleteDevice(deviceID: string): Promise<void> {
+        const ownerRow = await this.db
+            .selectFrom("devices")
+            .select("owner")
+            .where("deviceID", "=", deviceID)
+            .executeTakeFirst();
+
         await this.db
             .deleteFrom("preKeys")
             .where("deviceID", "=", deviceID)
@@ -334,13 +438,21 @@ export class Database extends EventEmitter {
             .set({ deleted: 1 })
             .where("deviceID", "=", deviceID)
             .execute();
+
+        if (ownerRow?.owner) {
+            this.userDeviceListCache.delete(ownerRow.owner);
+        }
     }
 
     public async deleteEmoji(emojiID: string): Promise<void> {
+        const existing = await this.retrieveEmoji(emojiID);
         await this.db
             .deleteFrom("emojis")
             .where("emojiID", "=", emojiID)
             .execute();
+        if (existing) {
+            this.emojiListByServerCache.delete(existing.owner);
+        }
     }
 
     public async deleteInvite(inviteID: string): Promise<void> {
@@ -403,31 +515,34 @@ export class Database extends EventEmitter {
     }
 
     public async getOTK(deviceID: string): Promise<null | PreKeysWS> {
-        const rows: PreKeysSQL[] = await this.db
-            .selectFrom("oneTimeKeys")
-            .selectAll()
-            .where("deviceID", "=", deviceID)
-            .orderBy("index")
-            .limit(1)
-            .execute();
-        const otkInfo = rows[0];
-        if (!otkInfo) {
-            return null;
-        }
-        const otk: PreKeysWS = {
-            deviceID: otkInfo.deviceID,
-            index: otkInfo.index,
-            publicKey: XUtils.decodeHex(otkInfo.publicKey),
-            signature: XUtils.decodeHex(otkInfo.signature),
-        };
+        // Atomic select-then-delete inside a transaction so two concurrent
+        // callers cannot dispense the same one-time key.
+        return this.db.transaction().execute(async (trx) => {
+            const rows: PreKeysSQL[] = await trx
+                .selectFrom("oneTimeKeys")
+                .selectAll()
+                .where("deviceID", "=", deviceID)
+                .orderBy("index")
+                .limit(1)
+                .execute();
+            const otkInfo = rows[0];
+            if (!otkInfo) {
+                return null;
+            }
 
-        // delete the otk
-        await this.db
-            .deleteFrom("oneTimeKeys")
-            .where("deviceID", "=", deviceID)
-            .where("index", "=", otk.index)
-            .execute();
-        return otk;
+            await trx
+                .deleteFrom("oneTimeKeys")
+                .where("deviceID", "=", deviceID)
+                .where("index", "=", otkInfo.index)
+                .execute();
+
+            return {
+                deviceID: otkInfo.deviceID,
+                index: otkInfo.index,
+                publicKey: XUtils.decodeHex(otkInfo.publicKey),
+                signature: XUtils.decodeHex(otkInfo.signature),
+            };
+        });
     }
 
     public async getOTKCount(deviceID: string): Promise<number> {
@@ -489,8 +604,8 @@ export class Database extends EventEmitter {
         try {
             await sql`select 1 as ok`.execute(this.db);
             return true;
-        } catch (err: unknown) {
-            this.log.warn("Database health check failed: " + String(err));
+        } catch (_err: unknown) {
+            // debugger: health check failed
             return false;
         }
     }
@@ -511,6 +626,21 @@ export class Database extends EventEmitter {
             .execute();
     }
 
+    public async rehashPassword(
+        userID: string,
+        newHash: string,
+    ): Promise<void> {
+        await this.db
+            .updateTable("users")
+            .set({
+                hashAlgo: "argon2id",
+                passwordHash: newHash,
+                passwordSalt: "",
+            })
+            .where("userID", "=", userID)
+            .execute();
+    }
+
     /**
      * Retrives a list of users that should be notified when a specific resourceID
      * experiences changes.
@@ -588,12 +718,25 @@ export class Database extends EventEmitter {
         return rows[0] ?? null;
     }
 
-    public async retrieveEmojiList(userID: string): Promise<Emoji[]> {
-        return this.db
+    public async retrieveEmojiList(serverID: string): Promise<Emoji[]> {
+        const now = Date.now();
+        const hit = this.emojiListByServerCache.get(serverID);
+        if (hit && hit.until > now) {
+            return hit.rows.map((r) => ({ ...r }));
+        }
+
+        const rows: Emoji[] = await this.db
             .selectFrom("emojis")
             .selectAll()
-            .where("owner", "=", userID)
+            .where("owner", "=", serverID)
             .execute();
+
+        this.emojiListByServerCache.set(serverID, {
+            rows: rows.map((r) => ({ ...r })),
+            until: now + Database.EMOJI_LIST_CACHE_TTL_MS,
+        });
+
+        return rows.map((r) => ({ ...r }));
     }
 
     public async retrieveFile(fileID: string): Promise<FileSQL | null> {
@@ -735,17 +878,25 @@ export class Database extends EventEmitter {
             .where("serverID", "=", serverID)
             .execute();
 
-        return rows.filter((invite: Invite) => {
-            const valid =
-                new Date(Date.now()).getTime() <
-                new Date(invite.expiration).getTime();
-
-            if (!valid) {
-                void this.deleteInvite(invite.inviteID);
+        const nowMs = Date.now();
+        const expiredIds: string[] = [];
+        const valid: Invite[] = [];
+        for (const row of rows) {
+            const expMs = new Date(row.expiration).getTime();
+            if (!Number.isFinite(expMs) || expMs <= nowMs) {
+                expiredIds.push(row.inviteID);
+                continue;
             }
-
-            return valid;
-        });
+            valid.push(row);
+        }
+        if (expiredIds.length > 0) {
+            await this.db
+                .deleteFrom("invites")
+                .where("serverID", "=", serverID)
+                .where("inviteID", "in", expiredIds)
+                .execute();
+        }
+        return valid;
     }
 
     public async retrieveServers(userID: string): Promise<Server[]> {
@@ -763,7 +914,7 @@ export class Database extends EventEmitter {
     // the identifier can be username, public key, or userID
     public async retrieveUser(
         userIdentifier: string,
-    ): Promise<null | UserRecord> {
+    ): Promise<InternalUserRecord | null> {
         let rows;
         if (uuidValidate(userIdentifier)) {
             rows = await this.db
@@ -786,16 +937,39 @@ export class Database extends EventEmitter {
     }
 
     public async retrieveUserDeviceList(userIDs: string[]): Promise<Device[]> {
+        const now = Date.now();
+        if (userIDs.length === 1) {
+            const owner = userIDs[0];
+            if (typeof owner === "string") {
+                const hit = this.userDeviceListCache.get(owner);
+                if (hit && hit.until > now) {
+                    return hit.devices.map((d) => ({ ...d }));
+                }
+            }
+        }
+
         const rows = await this.db
             .selectFrom("devices")
             .selectAll()
             .where("owner", "in", userIDs)
             .where("deleted", "=", 0)
             .execute();
-        return rows.map(toDevice);
+        const devices = rows.map(toDevice);
+
+        if (userIDs.length === 1) {
+            const owner = userIDs[0];
+            if (typeof owner === "string") {
+                this.userDeviceListCache.set(owner, {
+                    devices: devices.map((d) => ({ ...d })),
+                    until: now + Database.USER_DEVICE_LIST_CACHE_TTL_MS,
+                });
+            }
+        }
+
+        return devices;
     }
 
-    public async retrieveUsers(): Promise<UserRecord[]> {
+    public async retrieveUsers(): Promise<InternalUserRecord[]> {
         const rows = await this.db.selectFrom("users").selectAll().execute();
         return rows.map(toUserRecord);
     }
@@ -864,6 +1038,53 @@ export class Database extends EventEmitter {
     }
 }
 
+/**
+ * Hash a password with Argon2id (new default).
+ * Returns the encoded hash string which embeds salt, params, and digest.
+ */
+export async function hashPasswordArgon2(password: string): Promise<string> {
+    return argon2.hash(password, {
+        memoryCost: 65536,
+        parallelism: 4,
+        timeCost: 3,
+        type: argon2.argon2id,
+    });
+}
+
+/**
+ * Verify a password against either Argon2id or legacy PBKDF2 storage.
+ * Returns `{ valid, needsRehash }` — callers should rehash on success
+ * when `needsRehash` is true.
+ */
+export async function verifyPassword(
+    password: string,
+    stored: { hashAlgo: string; passwordHash: string; passwordSalt: string },
+): Promise<{ needsRehash: boolean; valid: boolean }> {
+    if (stored.hashAlgo === "argon2id") {
+        const valid = await argon2.verify(stored.passwordHash, password);
+        return { needsRehash: false, valid };
+    }
+
+    // Legacy PBKDF2 path
+    const salt = XUtils.decodeHex(stored.passwordSalt);
+    const computed = pbkdf2Sync(
+        password,
+        salt,
+        PBKDF2_ITERATIONS,
+        32,
+        "sha512",
+    );
+    const storedBuf = XUtils.decodeHex(stored.passwordHash);
+
+    if (computed.length !== storedBuf.length) {
+        return { needsRehash: false, valid: false };
+    }
+
+    const { timingSafeEqual } = await import("node:crypto");
+    const valid = timingSafeEqual(computed, storedBuf);
+    return { needsRehash: valid, valid };
+}
+
 function toDevice(row: {
     deleted: number;
     deviceID: string;
@@ -912,14 +1133,12 @@ function toServer(row: {
 }
 
 function toUserRecord(row: {
+    hashAlgo: string;
     lastSeen: string;
     passwordHash: string;
     passwordSalt: string;
     userID: string;
     username: string;
-}): UserRecord {
+}): InternalUserRecord {
     return { ...row };
 }
-
-export const hashPassword = (password: string, salt: Uint8Array) =>
-    pbkdf2Sync(password, salt, ITERATIONS, 32, "sha512");