@vex-chat/spire 1.11.4 → 2.0.0

package/src/Spire.ts

@@ -4,7 +4,13 @@
  * Commercial licenses available at vex.wtf
  */
 
-import type { ActionToken, BaseMsg, User } from "@vex-chat/types";
+import type {
+    ActionToken,
+    BaseMsg,
+    Device,
+    MailWS,
+    User,
+} from "@vex-chat/types";
 import type { IncomingMessage, Server } from "http";
 
 import { EventEmitter } from "events";
@@ -100,6 +106,46 @@ const mailPostPayload = z.object({
     header: z.custom<Uint8Array>((val) => val instanceof Uint8Array),
     mail: MailWSSchema,
 });
+const MAIL_BATCH_MAX_ITEMS = 256;
+const mailBatchPostPayload = z.object({
+    mails: z.array(mailPostPayload).min(1).max(MAIL_BATCH_MAX_ITEMS),
+});
+
+interface MailBatchResult {
+    error?: string;
+    index: number;
+    mailID?: string;
+    ok: boolean;
+    recipient?: string;
+    status?: number;
+}
+
+interface ValidatedMailBatchEntry {
+    header: Uint8Array;
+    index: number;
+    mail: MailWS;
+    recipientDevice: Device;
+}
+
+export async function passkeySecondFactorError(
+    db: Database,
+    userID: string,
+    passkeyID: string | undefined,
+    mismatchError: string,
+): Promise<null | string> {
+    const passkeys = await db.retrievePasskeysByUser(userID);
+    if (passkeys.length === 0) {
+        return null;
+    }
+    if (!passkeyID) {
+        return "Passkey verification required.";
+    }
+    const passkey = await db.retrievePasskeyInternal(passkeyID);
+    if (!passkey || passkey.userID !== userID) {
+        return mismatchError;
+    }
+    return null;
+}
 
 const notificationSubscribePayload = z.object({
     channel: z.literal("expo"),
@@ -344,6 +390,19 @@ export class Spire extends EventEmitter {
         }
     }
 
+    private disconnectDevices(deviceIDs: string[]): void {
+        if (deviceIDs.length === 0) {
+            return;
+        }
+        const ids = new Set(deviceIDs);
+        for (const client of [...this.clients]) {
+            const deviceID = client.getDeviceID();
+            if (deviceID !== null && ids.has(deviceID)) {
+                client.disconnect();
+            }
+        }
+    }
+
     private init(apiPort: number): void {
         // Request traces (UUIDs and device public-key path segments redacted
         // in the `url` token). Enabled in all envs, including production.
@@ -381,6 +440,7 @@ export class Spire extends EventEmitter {
             this.validateToken.bind(this),
             this.signKeys,
             this.notify.bind(this),
+            this.disconnectDevices.bind(this),
         );
 
         // WS auth: client sends { type: "auth", token } as first message
@@ -748,6 +808,22 @@ export class Spire extends EventEmitter {
                         .send({ error: "Device owner not found." });
                 }
 
+                const passkeyError = await passkeySecondFactorError(
+                    this.db,
+                    user.userID,
+                    req.passkey?.passkeyID,
+                    "Passkey verification does not match this device.",
+                );
+                if (passkeyError) {
+                    const body: { error: string; username?: string } = {
+                        error: passkeyError,
+                    };
+                    if (passkeyError === "Passkey verification required.") {
+                        body.username = user.username;
+                    }
+                    return res.status(403).send(body);
+                }
+
                 // Issue short-lived JWT (1 hour, not 7 days)
                 const token = jwt.sign(
                     { user: censorUser(user) },
@@ -813,9 +889,129 @@ export class Spire extends EventEmitter {
                 null,
                 mail.recipient,
                 mail.authorID,
+                mail.nonce,
             );
         });
 
+        this.api.post("/mail/batch", protect, async (req, res) => {
+            const senderDeviceDetails = req.device;
+            if (!senderDeviceDetails) {
+                res.sendStatus(401);
+                return;
+            }
+            const authorUserDetails = getUser(req);
+
+            const parsed = mailBatchPostPayload.safeParse(req.body);
+            if (!parsed.success) {
+                res.status(400).json({
+                    error: "Invalid mail batch payload",
+                    issues: parsed.error.issues,
+                });
+                return;
+            }
+
+            const results: MailBatchResult[] = [];
+            const validEntries: ValidatedMailBatchEntry[] = [];
+            for (const [index, item] of parsed.data.mails.entries()) {
+                const { header, mail } = item;
+                try {
+                    const { recipientDevice } = await validateMailIngress(
+                        this.db,
+                        mail,
+                        senderDeviceDetails.deviceID,
+                        authorUserDetails.userID,
+                    );
+                    validEntries.push({
+                        header,
+                        index,
+                        mail,
+                        recipientDevice,
+                    });
+                } catch (err: unknown) {
+                    const status =
+                        err instanceof MailIngressValidationError
+                            ? err.status
+                            : 500;
+                    const message =
+                        err instanceof Error ? err.message : String(err);
+                    results[index] = {
+                        error: message,
+                        index,
+                        mailID: mail.mailID,
+                        ok: false,
+                        recipient: mail.recipient,
+                        status,
+                    };
+                }
+            }
+
+            const deliveredEntries: ValidatedMailBatchEntry[] = [];
+            if (validEntries.length > 0) {
+                try {
+                    await this.db.saveMailBatch(
+                        validEntries.map((entry) => ({
+                            header: entry.header,
+                            mail: entry.mail,
+                            senderDeviceID: senderDeviceDetails.deviceID,
+                            userID: authorUserDetails.userID,
+                        })),
+                    );
+                    for (const entry of validEntries) {
+                        deliveredEntries.push(entry);
+                        results[entry.index] = {
+                            index: entry.index,
+                            mailID: entry.mail.mailID,
+                            ok: true,
+                            recipient: entry.mail.recipient,
+                        };
+                    }
+                } catch {
+                    for (const entry of validEntries) {
+                        try {
+                            await this.db.saveMail(
+                                entry.mail,
+                                entry.header,
+                                senderDeviceDetails.deviceID,
+                                authorUserDetails.userID,
+                            );
+                            deliveredEntries.push(entry);
+                            results[entry.index] = {
+                                index: entry.index,
+                                mailID: entry.mail.mailID,
+                                ok: true,
+                                recipient: entry.mail.recipient,
+                            };
+                        } catch (err: unknown) {
+                            results[entry.index] = {
+                                error:
+                                    err instanceof Error
+                                        ? err.message
+                                        : String(err),
+                                index: entry.index,
+                                mailID: entry.mail.mailID,
+                                ok: false,
+                                recipient: entry.mail.recipient,
+                                status: 500,
+                            };
+                        }
+                    }
+                }
+            }
+
+            res.send(msgpack.encode({ results }));
+            for (const entry of deliveredEntries) {
+                this.notify(
+                    entry.recipientDevice.owner,
+                    "mail",
+                    crypto.randomUUID(),
+                    null,
+                    entry.mail.recipient,
+                    entry.mail.authorID,
+                    entry.mail.nonce,
+                );
+            }
+        });
+
         this.api.post(
             "/device/:id/notifications/subscriptions",
             protect,
@@ -909,6 +1105,19 @@ export class Spire extends EventEmitter {
                     await this.db.rehashPassword(userEntry.userID, newHash);
                 }
 
+                const passkeyError = await passkeySecondFactorError(
+                    this.db,
+                    userEntry.userID,
+                    req.passkey?.passkeyID,
+                    "Passkey verification does not match this account.",
+                );
+                if (passkeyError) {
+                    res.status(403).send({
+                        error: passkeyError,
+                    });
+                    return;
+                }
+
                 const token = jwt.sign(
                     { user: censorUser(userEntry) },
                     getJwtSecret(),
@@ -1032,7 +1241,27 @@ export class Spire extends EventEmitter {
                             res.sendStatus(500);
                             return;
                         }
-                        res.send(msgpack.encode(censorUser(user)));
+                        const device = await this.db.retrieveDevice(
+                            normalizedPayload.signKey,
+                        );
+                        if (!device) {
+                            res.sendStatus(500);
+                            return;
+                        }
+                        const censored = censorUser(user);
+                        const token = jwt.sign(
+                            { user: censored },
+                            getJwtSecret(),
+                            { expiresIn: JWT_EXPIRY },
+                        );
+                        jwt.verify(token, getJwtSecret());
+                        res.send(
+                            msgpack.encode({
+                                device,
+                                token,
+                                user: censored,
+                            }),
+                        );
                     }
                 } else if (regKey && regKey.length !== 16) {
                     res.status(400).send({
@@ -1076,11 +1305,13 @@ export class Spire extends EventEmitter {
         data?: unknown,
         deviceID?: string,
         headlessPushUserID?: string,
+        mailNonce?: Uint8Array,
     ): void {
         this.notifications.notify({
             data,
             event,
             ...(headlessPushUserID ? { headlessPushUserID } : {}),
+            ...(mailNonce ? { mailNonce } : {}),
             transmissionID,
             userID,
             ...(deviceID ? { deviceID } : {}),

package/src/__tests__/Database.spec.ts

@@ -5,7 +5,7 @@
  */
 
 import type { SpireOptions } from "../Spire.ts";
-import type { MailWS, PreKeysWS } from "@vex-chat/types";
+import type { DevicePayload, MailWS, PreKeysWS } from "@vex-chat/types";
 
 import { XUtils } from "@vex-chat/crypto";
 import { MailType } from "@vex-chat/types";
@@ -64,6 +64,19 @@ describe("Database", () => {
         signature,
     };
 
+    const devicePayload = (
+        deviceName: string,
+        signKey: string,
+    ): DevicePayload => ({
+        deviceName,
+        preKey: testSQLPreKey.publicKey,
+        preKeyIndex: 1,
+        preKeySignature: testSQLPreKey.signature,
+        signed: "00",
+        signKey,
+        username: "alice",
+    });
+
     const options: SpireOptions = {
         dbType: "sqlite3mem",
     };
@@ -156,6 +169,100 @@ describe("Database", () => {
         });
     });
 
+    describe("recoverDevice", () => {
+        it("creates a new device and revokes all previous devices for the user", async () => {
+            expect.assertions(8);
+
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            const oldA = await provider.createDevice(
+                                userID,
+                                devicePayload("old-a", "a".repeat(64)),
+                            );
+                            const oldB = await provider.createDevice(
+                                userID,
+                                devicePayload("old-b", "b".repeat(64)),
+                            );
+                            await provider.saveOTK(userID, oldA.deviceID, [
+                                {
+                                    deviceID: oldA.deviceID,
+                                    index: 1,
+                                    publicKey,
+                                    signature,
+                                },
+                            ]);
+                            await provider.saveNotificationSubscription({
+                                channel: "expo",
+                                deviceID: oldA.deviceID,
+                                events: ["deviceRequest"],
+                                platform: "ios",
+                                token: "ExponentPushToken[old-a]",
+                                userID,
+                            });
+                            await provider.saveNotificationSubscription({
+                                channel: "expo",
+                                deviceID: oldB.deviceID,
+                                events: ["*"],
+                                platform: "android",
+                                token: "ExponentPushToken[old-b]",
+                                userID,
+                            });
+
+                            const recovered = await provider.recoverDevice(
+                                userID,
+                                devicePayload("recovered", "c".repeat(64)),
+                            );
+
+                            expect(recovered.revokedDeviceIDs.sort()).toEqual(
+                                [oldA.deviceID, oldB.deviceID].sort(),
+                            );
+                            expect(
+                                await provider.retrieveDevice(oldA.deviceID),
+                            ).toBeNull();
+                            expect(
+                                await provider.retrieveDevice(oldB.deviceID),
+                            ).toBeNull();
+                            expect(
+                                await provider.retrieveDevice(
+                                    recovered.device.deviceID,
+                                ),
+                            ).toEqual(recovered.device);
+                            expect(
+                                await provider.retrieveUserDeviceList([userID]),
+                            ).toEqual([recovered.device]);
+                            expect(
+                                await provider.getPreKeys(oldA.deviceID),
+                            ).toBeNull();
+                            expect(
+                                await provider.getOTK(oldA.deviceID),
+                            ).toBeNull();
+                            expect(
+                                await provider.retrieveNotificationSubscriptions(
+                                    {
+                                        event: "deviceRequest",
+                                        userID,
+                                    },
+                                ),
+                            ).toEqual([]);
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            await provider.close().catch(() => {
+                                /* ignore cleanup failure */
+                            });
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
+    });
+
     describe("retrieveMail", () => {
         it("returns queued mail in send order for logged-out batch drains", async () => {
             expect.assertions(1);
@@ -231,9 +338,80 @@ describe("Database", () => {
         });
     });
 
+    describe("saveMailBatch", () => {
+        it("stores multiple queued mail rows in one insert", async () => {
+            expect.assertions(1);
+
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            const mail = (
+                                mailID: string,
+                                nonce: number,
+                            ): MailWS => ({
+                                authorID: userID,
+                                cipher: new Uint8Array([1, nonce]),
+                                extra: new Uint8Array([2, nonce]),
+                                forward: false,
+                                group: null,
+                                mailID,
+                                mailType: MailType.initial,
+                                nonce: new Uint8Array([3, nonce]),
+                                readerID: userID,
+                                recipient: deviceID,
+                                sender: "sender-a",
+                            });
+
+                            await provider.saveMailBatch([
+                                {
+                                    header: new Uint8Array([4, 1]),
+                                    mail: mail(
+                                        "00000000-0000-0000-0000-000000000011",
+                                        1,
+                                    ),
+                                    senderDeviceID: "sender-a",
+                                    userID,
+                                },
+                                {
+                                    header: new Uint8Array([4, 2]),
+                                    mail: mail(
+                                        "00000000-0000-0000-0000-000000000012",
+                                        2,
+                                    ),
+                                    senderDeviceID: "sender-a",
+                                    userID,
+                                },
+                            ]);
+
+                            const result =
+                                await provider.retrieveMail(deviceID);
+                            expect(
+                                result.map(
+                                    ([, body]: [Uint8Array, MailWS, string]) =>
+                                        body.mailID,
+                                ),
+                            ).toEqual([
+                                "00000000-0000-0000-0000-000000000011",
+                                "00000000-0000-0000-0000-000000000012",
+                            ]);
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
+    });
+
     describe("notification subscriptions", () => {
         it("upserts and filters Expo push subscriptions by event", async () => {
-            expect.assertions(7);
+            expect.assertions(8);
 
             const provider = new Database(options);
             await new Promise<void>((resolve, reject) => {
@@ -297,6 +475,17 @@ describe("Database", () => {
                                 );
                             expect(deviceSubsAfterUpdate).toHaveLength(1);
 
+                            await provider.deleteDevice(deviceID);
+                            expect(
+                                await provider.retrieveNotificationSubscriptions(
+                                    {
+                                        deviceID,
+                                        event: "deviceRequest",
+                                        userID,
+                                    },
+                                ),
+                            ).toEqual([]);
+
                             await provider.close();
                             resolve();
                         } catch (e: unknown) {

package/src/__tests__/loadEnv.spec.ts

@@ -0,0 +1,91 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import { describe, expect, it } from "vitest";
+
+import {
+    isSpireFipsEnabled,
+    normalizeEnvValue,
+    validateSpireRuntimeEnv,
+} from "../utils/loadEnv.ts";
+
+const TWEETNACL_SPK = "ab".repeat(64);
+const FIPS_SPK = "cd".repeat(90);
+const JWT_SECRET = "ef".repeat(32);
+
+describe("normalizeEnvValue", () => {
+    it("strips matching quotes from compose/dotenv values", () => {
+        expect(normalizeEnvValue(`"${TWEETNACL_SPK}"`)).toBe(TWEETNACL_SPK);
+        expect(normalizeEnvValue(`'${JWT_SECRET}'`)).toBe(JWT_SECRET);
+    });
+
+    it("trims whitespace without stripping unmatched quotes", () => {
+        expect(normalizeEnvValue(`  ${TWEETNACL_SPK}  `)).toBe(TWEETNACL_SPK);
+        expect(normalizeEnvValue(`"${TWEETNACL_SPK}`)).toBe(
+            `"${TWEETNACL_SPK}`,
+        );
+    });
+});
+
+describe("isSpireFipsEnabled", () => {
+    it("accepts true and 1 only", () => {
+        expect(isSpireFipsEnabled("true")).toBe(true);
+        expect(isSpireFipsEnabled('"true"')).toBe(true);
+        expect(isSpireFipsEnabled("1")).toBe(true);
+        expect(isSpireFipsEnabled("false")).toBe(false);
+        expect(isSpireFipsEnabled(undefined)).toBe(false);
+    });
+});
+
+describe("validateSpireRuntimeEnv", () => {
+    it("accepts quoted compose-safe tweetnacl keys", () => {
+        expect(() => {
+            validateSpireRuntimeEnv({
+                JWT_SECRET: `"${JWT_SECRET}"`,
+                SPIRE_FIPS: "false",
+                SPK: `"${TWEETNACL_SPK}"`,
+            });
+        }).not.toThrow();
+    });
+
+    it("rejects non-hex SPK values before crypto init", () => {
+        expect(() => {
+            validateSpireRuntimeEnv({
+                JWT_SECRET,
+                SPK: `"${TWEETNACL_SPK}`,
+            });
+        }).toThrow(/SPK must be an even-length hex string/);
+    });
+
+    it("rejects a FIPS flag with a tweetnacl-sized SPK", () => {
+        expect(() => {
+            validateSpireRuntimeEnv({
+                JWT_SECRET,
+                SPIRE_FIPS: "true",
+                SPK: TWEETNACL_SPK,
+            });
+        }).toThrow(/requires an SPK from .*gen-spk-fips/);
+    });
+
+    it("rejects a FIPS-sized SPK without the FIPS flag", () => {
+        expect(() => {
+            validateSpireRuntimeEnv({
+                JWT_SECRET,
+                SPIRE_FIPS: "false",
+                SPK: FIPS_SPK,
+            });
+        }).toThrow(/SPK must be 128 hex characters/);
+    });
+
+    it("rejects reusing SPK as JWT_SECRET", () => {
+        expect(() => {
+            validateSpireRuntimeEnv({
+                JWT_SECRET: TWEETNACL_SPK,
+                SPK: TWEETNACL_SPK,
+            });
+        }).toThrow(/JWT_SECRET must be separate from SPK/);
+    });
+});