@vex-chat/spire 1.0.0 → 1.0.2

package/src/Spire.ts

@@ -1,10 +1,10 @@
 import type { ActionToken, BaseMsg, NotifyMsg, User } from "@vex-chat/types";
 import type { Server } from "http";
-import type winston from "winston";
 
 import { EventEmitter } from "events";
 import { execSync } from "node:child_process";
 import * as fs from "node:fs";
+import { freemem, loadavg, totalmem } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -30,11 +30,10 @@ import { WebSocketServer } from "ws";
 import { z } from "zod/v4";
 
 import { ClientManager } from "./ClientManager.ts";
-import { Database, hashPassword } from "./Database.ts";
+import { Database, hashPasswordArgon2, verifyPassword } from "./Database.ts";
 import { initApp, protect } from "./server/index.ts";
-import { authLimiter } from "./server/rateLimit.ts";
+import { authLimiter, devApiKeySkipsRateLimits } from "./server/rateLimit.ts";
 import { censorUser, getParam, getUser } from "./server/utils.ts";
-import { createLogger } from "./utils/createLogger.ts";
 import { getJwtSecret } from "./utils/jwtSecret.ts";
 import { msgpack } from "./utils/msgpack.ts";
 
@@ -130,14 +129,6 @@ const getCommitSha = (): string => {
 export interface SpireOptions {
     apiPort?: number;
     dbType?: "mysql" | "sqlite3" | "sqlite3mem" | "sqlite";
-    logLevel?:
-        | "debug"
-        | "error"
-        | "http"
-        | "info"
-        | "silly"
-        | "verbose"
-        | "warn";
 }
 
 export class Spire extends EventEmitter {
@@ -151,9 +142,6 @@ export class Spire extends EventEmitter {
         string,
         { deviceID: string; nonce: string; time: number }
     >();
-    private log: winston.Logger;
-    private options: SpireOptions | undefined;
-
     private queuedRequestIncrements = 0;
     private requestsTotal = 0;
 
@@ -164,7 +152,10 @@ export class Spire extends EventEmitter {
 
     private readonly startedAt = new Date();
     private readonly version = getAppVersion();
-    private wss: WebSocketServer = new WebSocketServer({ noServer: true });
+    private wss: WebSocketServer = new WebSocketServer({
+        maxPayload: 4096,
+        noServer: true,
+    });
 
     constructor(SK: string, options?: SpireOptions) {
         super();
@@ -180,17 +171,12 @@ export class Spire extends EventEmitter {
         this.db = new Database(options);
         this.db.on("ready", () => {
             this.dbReady = true;
-            this.bootstrapRequestCounter().catch((err: unknown) => {
-                this.log.error(
-                    "Failed to load persisted request counter: " + String(err),
-                );
+            this.bootstrapRequestCounter().catch((_err: unknown) => {
+                // debugger: bootstrap request counter failed
             });
         });
 
-        this.log = createLogger("spire", options?.logLevel || "error");
         this.init(options?.apiPort || 16777);
-
-        this.options = options;
     }
 
     public async close(): Promise<void> {
@@ -198,29 +184,29 @@ export class Spire extends EventEmitter {
             ws.terminate();
         });
 
-        this.wss.on("close", () => {
-            this.log.info("ws: closed.");
-        });
-
-        this.server?.on("close", () => {
-            this.log.info("http: closed.");
-        });
-
         this.server?.close();
         this.wss.close();
         await this.db.close();
-        return;
     }
 
     private async bootstrapRequestCounter(): Promise<void> {
         const persistedTotal = await this.db.getRequestsTotal();
+
+        // Between the await above and this synchronous block, requests may
+        // have incremented both `requestsTotal` and `queuedRequestIncrements`.
+        // Capture the queue, mark loaded, then merge — never overwrite
+        // `requestsTotal` (which already includes in-flight increments).
         const startupIncrements = this.queuedRequestIncrements;
         this.queuedRequestIncrements = 0;
-        this.requestsTotal = persistedTotal + startupIncrements;
+        this.requestsTotalLoaded = true;
+
+        // Add the persisted baseline on top of whatever the middleware
+        // already counted in-memory, instead of overwriting it.
+        this.requestsTotal += persistedTotal;
+
         if (startupIncrements > 0) {
             await this.db.incrementRequestsTotal(startupIncrements);
         }
-        this.requestsTotalLoaded = true;
     }
 
     private createActionToken(scope: TokenScopes): ActionToken {
@@ -234,8 +220,9 @@ export class Spire extends EventEmitter {
     }
 
     private deleteActionToken(key: ActionToken) {
-        if (this.actionTokens.includes(key)) {
-            this.actionTokens.splice(this.actionTokens.indexOf(key), 1);
+        const idx = this.actionTokens.indexOf(key);
+        if (idx !== -1) {
+            this.actionTokens.splice(idx, 1);
         }
     }
 
@@ -246,11 +233,8 @@ export class Spire extends EventEmitter {
             if (!this.requestsTotalLoaded) {
                 this.queuedRequestIncrements += 1;
             } else {
-                this.db.incrementRequestsTotal(1).catch((err: unknown) => {
-                    this.log.warn(
-                        "Failed to persist request counter increment: " +
-                            String(err),
-                    );
+                this.db.incrementRequestsTotal(1).catch((_err: unknown) => {
+                    // debugger: failed to persist request counter
                 });
             }
 
@@ -261,7 +245,6 @@ export class Spire extends EventEmitter {
         initApp(
             this.api,
             this.db,
-            this.log,
             this.validateToken.bind(this),
             this.signKeys,
             this.notify.bind(this),
@@ -269,11 +252,9 @@ export class Spire extends EventEmitter {
 
         // WS auth: client sends { type: "auth", token } as first message
         this.wss.on("connection", (ws) => {
-            this.log.info("WS connection established, waiting for auth...");
             const AUTH_TIMEOUT = 10_000;
 
             const timer = setTimeout(() => {
-                this.log.warn("WS auth timeout — closing.");
                 ws.close();
             }, AUTH_TIMEOUT);
 
@@ -308,47 +289,25 @@ export class Spire extends EventEmitter {
                     }
                     const userDetails: User = jwtResult.data.user;
 
-                    this.log.info(
-                        "WS auth succeeded for " + userDetails.username,
-                    );
-
                     const client = new ClientManager(
                         ws,
                         this.db,
                         this.notify.bind(this),
                         userDetails,
-                        this.options,
                     );
 
                     client.on("fail", () => {
-                        this.log.info(
-                            "Client connection is down, removing: " +
-                                client.toString(),
-                        );
-                        if (this.clients.includes(client)) {
-                            this.clients.splice(
-                                this.clients.indexOf(client),
-                                1,
-                            );
+                        const idx = this.clients.indexOf(client);
+                        if (idx !== -1) {
+                            this.clients.splice(idx, 1);
                         }
-                        this.log.info(
-                            "Current authorized clients: " +
-                                String(this.clients.length),
-                        );
                     });
 
                     client.on("authed", () => {
-                        this.log.info(
-                            "New client authorized: " + client.toString(),
-                        );
                         this.clients.push(client);
-                        this.log.info(
-                            "Current authorized clients: " +
-                                String(this.clients.length),
-                        );
                     });
-                } catch (err: unknown) {
-                    this.log.warn("WS auth failed: " + String(err));
+                } catch (_err: unknown) {
+                    // debugger: WS auth failed
                     const errMsg: BaseMsg = {
                         transmissionID: crypto.randomUUID(),
                         type: "unauthorized",
@@ -421,9 +380,7 @@ export class Spire extends EventEmitter {
                 }
 
                 try {
-                    this.log.info("New token requested of type " + tokenType);
                     const token = this.createActionToken(scope);
-                    this.log.info("New token created: " + token.key);
 
                     setTimeout(() => {
                         this.deleteActionToken(token);
@@ -441,8 +398,8 @@ export class Spire extends EventEmitter {
 
                     res.set("Content-Type", "application/msgpack");
                     return res.send(msgpack.encode(token));
-                } catch (err: unknown) {
-                    this.log.error(String(err));
+                } catch (_err: unknown) {
+                    // debugger: token creation failed
                     return res.sendStatus(500);
                 }
             },
@@ -457,7 +414,6 @@ export class Spire extends EventEmitter {
             res.send(
                 msgpack.encode({
                     exp: req.exp,
-                    token: req.bearerToken,
                     user: req.user,
                 }),
             );
@@ -477,7 +433,12 @@ export class Spire extends EventEmitter {
             const checkDurationMs = Date.now() - started;
 
             const ok = dbHealthy;
+            const canaryEnv = process.env["CANARY"]?.trim().toLowerCase();
             res.json({
+                canary:
+                    canaryEnv === "1" ||
+                    canaryEnv === "true" ||
+                    canaryEnv === "yes",
                 checkDurationMs,
                 commitSha: this.commitSha,
                 dbHealthy,
@@ -496,6 +457,68 @@ export class Spire extends EventEmitter {
             });
         });
 
+        /**
+         * Dev-only process snapshot (same gate as rate-limit bypass: `DEV_API_KEY`
+         * env + `x-dev-api-key` header). Returns 404 when not enabled or key wrong
+         * so the route is not advertised to anonymous callers.
+         * Lets local stress / `sample <pid>` workflows see RSS, WS count, etc.
+         */
+        this.api.get("/status/process", (req, res) => {
+            if (!devApiKeySkipsRateLimits(req)) {
+                res.sendStatus(404);
+                return;
+            }
+            const mu = process.memoryUsage();
+            const ru = process.resourceUsage();
+            res.json({
+                activeRequestsApprox: this.requestsTotal,
+                dbReady: this.dbReady,
+                hostOs: {
+                    freemem: freemem(),
+                    loadavg: loadavg(),
+                    totalmem: totalmem(),
+                },
+                memory: {
+                    arrayBuffers: mu.arrayBuffers,
+                    external: mu.external,
+                    heapTotal: mu.heapTotal,
+                    heapUsed: mu.heapUsed,
+                    rss: mu.rss,
+                },
+                pid: process.pid,
+                resourceUsage: {
+                    fsRead: ru.fsRead,
+                    fsWrite: ru.fsWrite,
+                    maxRSS: ru.maxRSS,
+                    systemMicros: ru.systemCPUTime,
+                    userMicros: ru.userCPUTime,
+                },
+                uptimeSeconds: Math.floor(process.uptime()),
+                websocketClients: this.wss.clients.size,
+            });
+        });
+
+        /**
+         * Dev-only SQLite file + pragma snapshot (same gate as `/status/process`).
+         */
+        this.api.get("/status/sqlite", (req, res) => {
+            if (!devApiKeySkipsRateLimits(req)) {
+                res.sendStatus(404);
+                return;
+            }
+            if (!this.dbReady) {
+                res.status(503).json({ dbReady: false, ok: false });
+                return;
+            }
+            try {
+                const sqlite = this.db.getDevSqliteMonitor();
+                res.json({ ok: true, sqlite });
+            } catch (err: unknown) {
+                const msg = err instanceof Error ? err.message : String(err);
+                res.status(500).json({ error: msg, ok: false });
+            }
+        });
+
         this.api.post("/goodbye", protect, (req, res) => {
             jwt.sign({ user: req.user }, getJwtSecret(), { expiresIn: -1 });
             res.sendStatus(200);
@@ -532,12 +555,11 @@ export class Spire extends EventEmitter {
                     this.deviceChallenges.delete(challengeID);
                 }, DEVICE_CHALLENGE_EXPIRY);
 
-                this.log.info("Device challenge issued for " + deviceID);
                 return res.send(
                     msgpack.encode({ challenge: nonce, challengeID }),
                 );
-            } catch (err: unknown) {
-                this.log.error("Device challenge error: " + String(err));
+            } catch (_err: unknown) {
+                // debugger: device challenge error
                 return res.sendStatus(500);
             }
         });
@@ -608,18 +630,11 @@ export class Spire extends EventEmitter {
                     getJwtSecret(),
                     { expiresIn: DEVICE_AUTH_JWT_EXPIRY },
                 );
-                this.log.info(
-                    "Device-key auth succeeded for " +
-                        user.username +
-                        " (device " +
-                        device.deviceID +
-                        ")",
-                );
                 return res.send(
                     msgpack.encode({ token, user: censorUser(user) }),
                 );
-            } catch (err: unknown) {
-                this.log.error("Device verify error: " + String(err));
+            } catch (_err: unknown) {
+                // debugger: device verify error
                 return res.sendStatus(500);
             }
         });
@@ -648,8 +663,6 @@ export class Spire extends EventEmitter {
                 senderDeviceDetails.deviceID,
                 authorUserDetails.userID,
             );
-            this.log.info("Received mail for " + mail.recipient);
-
             const recipientDeviceDetails = await this.db.retrieveDevice(
                 mail.recipient,
             );
@@ -681,21 +694,25 @@ export class Spire extends EventEmitter {
             try {
                 const userEntry = await this.db.retrieveUser(username);
                 if (!userEntry) {
-                    res.sendStatus(404);
-                    this.log.warn("User does not exist.");
+                    res.sendStatus(401);
                     return;
                 }
 
-                const salt = XUtils.decodeHex(userEntry.passwordSalt);
-                const payloadHash = XUtils.encodeHex(
-                    hashPassword(password, salt),
+                const { needsRehash, valid } = await verifyPassword(
+                    password,
+                    userEntry,
                 );
 
-                if (payloadHash !== userEntry.passwordHash) {
+                if (!valid) {
                     res.sendStatus(401);
                     return;
                 }
 
+                if (needsRehash) {
+                    const newHash = await hashPasswordArgon2(password);
+                    await this.db.rehashPassword(userEntry.userID, newHash);
+                }
+
                 const token = jwt.sign(
                     { user: censorUser(userEntry) },
                     getJwtSecret(),
@@ -708,8 +725,8 @@ export class Spire extends EventEmitter {
                 res.send(
                     msgpack.encode({ token, user: censorUser(userEntry) }),
                 );
-            } catch (err: unknown) {
-                this.log.error(String(err));
+            } catch (_err: unknown) {
+                // debugger: auth error
                 res.sendStatus(500);
             }
         });
@@ -762,9 +779,6 @@ export class Spire extends EventEmitter {
                                     "users_signkey_unique",
                                 );
 
-                                this.log.warn(
-                                    "User attempted to register duplicate account.",
-                                );
                                 if (usernameConflict) {
                                     res.status(400).send({
                                         error: "Username is already registered.",
@@ -782,16 +796,10 @@ export class Spire extends EventEmitter {
                                 });
                                 break;
                             default:
-                                this.log.info(
-                                    "Unsupported sql error type: " +
-                                        String(errCode),
-                                );
-                                this.log.error(String(err));
                                 res.sendStatus(500);
                                 break;
                         }
                     } else {
-                        this.log.info("Registration success.");
                         if (!user) {
                             res.sendStatus(500);
                             return;
@@ -803,15 +811,13 @@ export class Spire extends EventEmitter {
                         error: "Invalid or no token supplied.",
                     });
                 }
-            } catch (err: unknown) {
-                this.log.error("error registering user: " + String(err));
+            } catch (_err: unknown) {
+                // debugger: registration error
                 res.sendStatus(500);
             }
         });
 
-        this.server = this.api.listen(apiPort, () => {
-            this.log.info("API started on port " + String(apiPort));
-        });
+        this.server = this.api.listen(apiPort);
 
         // Accept all WS upgrades — auth happens post-connection.
         this.server.on("upgrade", (req, socket, head) => {
@@ -828,7 +834,10 @@ export class Spire extends EventEmitter {
         data?: unknown,
         deviceID?: string,
     ): void {
-        for (const client of this.clients) {
+        // Snapshot the array so that a synchronous `fail` → splice inside
+        // client.send() doesn't corrupt the iteration.
+        const snapshot = this.clients.slice();
+        for (const client of snapshot) {
             if (deviceID) {
                 if (client.getDevice().deviceID === deviceID) {
                     const msg: NotifyMsg = {
@@ -854,7 +863,6 @@ export class Spire extends EventEmitter {
     }
 
     private validateToken(key: string, scope: TokenScopes): boolean {
-        this.log.info("Validating token: " + key);
         for (const rKey of this.actionTokens) {
             if (rKey.key === key) {
                 if (rKey.scope !== scope) {
@@ -862,17 +870,12 @@ export class Spire extends EventEmitter {
                 }
 
                 const age = Date.now() - new Date(rKey.time).getTime();
-                this.log.info("Token found, " + String(age) + " ms old.");
                 if (age < TOKEN_EXPIRY) {
-                    this.log.info("Token is valid.");
                     this.deleteActionToken(rKey);
                     return true;
-                } else {
-                    this.log.info("Token is expired.");
                 }
             }
         }
-        this.log.info("Token not found.");
         return false;
     }
 }

package/src/__tests__/Database.spec.ts

@@ -5,7 +5,6 @@ import { XUtils } from "@vex-chat/crypto";
 
 import * as uuid from "uuid";
 import { describe, expect, it, vi } from "vitest";
-import winston from "winston";
 
 import { Database } from "../Database.ts";
 
@@ -27,19 +26,6 @@ vi.mock("uuid", () => ({
     validate: () => true,
 }));
 
-/** Winston logger stub — Database.close() calls `.info`, and `{}` breaks that. */
-function silentLogger(): winston.Logger {
-    const noop = vi.fn();
-    return {
-        debug: noop,
-        error: noop,
-        info: noop,
-        log: noop,
-        verbose: noop,
-        warn: noop,
-    } as unknown as winston.Logger;
-}
-
 describe("Database", () => {
     // Reusable test data
     const keyID = "de459e05-aa63-4dfa-97b4-ed43d5c7a5f7";
@@ -80,9 +66,6 @@ describe("Database", () => {
             expect.assertions(1);
 
             vi.mocked(uuid.v4).mockReturnValueOnce(keyID);
-            vi.spyOn(winston, "createLogger").mockReturnValueOnce(
-                silentLogger(),
-            );
 
             const provider = new Database(options);
             await new Promise<void>((resolve, reject) => {

package/src/db/schema.ts

@@ -156,6 +156,7 @@ export type ServiceMetricUpdate = Updateable<ServiceMetricsTable>;
 
 export type UserRow = Selectable<UsersTable>;
 export interface UsersTable {
+    hashAlgo: string;
     lastSeen: string;
     passwordHash: string;
     passwordSalt: string;

package/src/migrations/2026-04-14_argon2id-password-hashing.ts

@@ -0,0 +1,18 @@
+import { type Kysely, sql } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.alterTable("users").dropColumn("hashAlgo").execute();
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .alterTable("users")
+        .addColumn("hashAlgo", "varchar(16)", (cb) =>
+            cb.defaultTo("pbkdf2").notNull(),
+        )
+        .execute();
+
+    await sql`UPDATE users SET hashAlgo = 'pbkdf2' WHERE hashAlgo = 'pbkdf2'`.execute(
+        db,
+    );
+}

package/src/run.ts

@@ -18,7 +18,6 @@ function main() {
     new Spire(spk, {
         ...(apiPort !== undefined ? { apiPort: Number(apiPort) } : {}),
         ...(dbType !== undefined ? { dbType } : {}),
-        logLevel: "info",
     });
 }
 

package/src/server/avatar.ts

@@ -1,6 +1,3 @@
-import type { Database } from "../Database.ts";
-import type winston from "winston";
-
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
 
@@ -20,7 +17,7 @@ import { ALLOWED_IMAGE_TYPES, protect } from "./index.ts";
 
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
 
-export const getAvatarRouter = (db: Database, log: winston.Logger) => {
+export const getAvatarRouter = () => {
     const router = express.Router();
 
     router.get("/:userID", async (req, res) => {
@@ -39,8 +36,8 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
         res.set("Cache-control", "public, max-age=31536000");
 
         const stream = fs.createReadStream(filePath);
-        stream.on("error", (err) => {
-            log.error(err.toString());
+        stream.on("error", (_err) => {
+            // debugger: avatar stream read error
             res.sendStatus(500);
         });
         stream.pipe(res);
@@ -65,7 +62,6 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
         }
 
         if (!payload.file) {
-            log.warn("MISSING FILE");
             res.sendStatus(400);
             return;
         }
@@ -84,10 +80,9 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
         try {
             // write the file to disk
             await fsp.writeFile("avatars/" + userDetails.userID, buf);
-            log.info("Wrote new avatar " + userDetails.userID);
             res.sendStatus(200);
-        } catch (err: unknown) {
-            log.warn(String(err));
+        } catch (_err: unknown) {
+            // debugger: avatar write failed
             res.sendStatus(500);
         }
     });
@@ -107,7 +102,6 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
             }
 
             if (!req.file) {
-                log.warn("MISSING FILE");
                 res.sendStatus(400);
                 return;
             }
@@ -128,10 +122,9 @@ export const getAvatarRouter = (db: Database, log: winston.Logger) => {
                     "avatars/" + userDetails.userID,
                     req.file.buffer,
                 );
-                log.info("Wrote new avatar " + userDetails.userID);
                 res.sendStatus(200);
-            } catch (err: unknown) {
-                log.warn(String(err));
+            } catch (_err: unknown) {
+                // debugger: avatar write failed
                 res.sendStatus(500);
             }
         },