@vex-chat/spire 1.11.5 → 2.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vex-chat/spire",
-  "version": "1.11.5",
+  "version": "2.0.0",
   "description": "Vex server implementation in NodeJS.",
   "type": "module",
   "files": [
@@ -55,7 +55,7 @@
     "typescript-eslint": "8.58.1",
     "vitest": "4.1.4",
     "@vex-chat/eslint-config": "0.0.1",
-    "@vex-chat/libvex": "^6.7.0"
+    "@vex-chat/libvex": "^7.0.0"
   },
   "typeCoverage": {
     "atLeast": 95,
@@ -74,7 +74,7 @@
     "file-type": "22.0.1",
     "helmet": "8.1.0",
     "jsonwebtoken": "9.0.3",
-    "kysely": "^0.28.17",
+    "kysely": "^0.29.2",
     "morgan": "1.10.1",
     "msgpackr": "^1.11.9",
     "multer": "2.1.1",
@@ -83,8 +83,8 @@
     "uuid": "^14.0.0",
     "ws": "8.20.1",
     "zod": "^4.3.6",
-    "@vex-chat/types": "^3.3.1",
-    "@vex-chat/crypto": "^6.0.0"
+    "@vex-chat/crypto": "^7.0.0",
+    "@vex-chat/types": "^4.0.0"
   },
   "scripts": {
     "rebuild:sqlite": "pnpm rebuild better-sqlite3",

package/src/ClientManager.ts

@@ -112,6 +112,10 @@ export class ClientManager extends EventEmitter {
         this.challenge();
     }
 
+    public disconnect(): void {
+        this.fail();
+    }
+
     public getDevice(): Device {
         if (!this.device) {
             throw new Error("No device set on this client.");

package/src/Database.ts

@@ -441,6 +441,11 @@ export class Database extends EventEmitter {
             .where("deviceID", "=", deviceID)
             .execute();
 
+        await this.db
+            .deleteFrom("notification_subscriptions")
+            .where("deviceID", "=", deviceID)
+            .execute();
+
         await this.db
             .updateTable("devices")
             .set({ deleted: 1 })
@@ -747,6 +752,66 @@ export class Database extends EventEmitter {
             .executeTakeFirst();
     }
 
+    public async recoverDevice(
+        owner: string,
+        payload: DevicePayload,
+    ): Promise<{ device: Device; revokedDeviceIDs: string[] }> {
+        const device = {
+            deleted: 0,
+            deviceID: crypto.randomUUID(),
+            lastLogin: new Date().toISOString(),
+            name: payload.deviceName,
+            owner,
+            signKey: payload.signKey,
+        };
+        const medPreKeys = {
+            deviceID: device.deviceID,
+            index: payload.preKeyIndex,
+            keyID: crypto.randomUUID(),
+            publicKey: payload.preKey,
+            signature: payload.preKeySignature,
+            userID: owner,
+        };
+
+        return this.db.transaction().execute(async (trx) => {
+            const activeRows = await trx
+                .selectFrom("devices")
+                .select("deviceID")
+                .where("owner", "=", owner)
+                .where("deleted", "=", 0)
+                .execute();
+            const revokedDeviceIDs = activeRows.map((row) => row.deviceID);
+
+            await trx.insertInto("devices").values(device).execute();
+            await trx.insertInto("preKeys").values(medPreKeys).execute();
+
+            if (revokedDeviceIDs.length > 0) {
+                await trx
+                    .deleteFrom("preKeys")
+                    .where("deviceID", "in", revokedDeviceIDs)
+                    .execute();
+                await trx
+                    .deleteFrom("oneTimeKeys")
+                    .where("deviceID", "in", revokedDeviceIDs)
+                    .execute();
+                await trx
+                    .deleteFrom("notification_subscriptions")
+                    .where("deviceID", "in", revokedDeviceIDs)
+                    .execute();
+                await trx
+                    .updateTable("devices")
+                    .set({ deleted: 1 })
+                    .where("deviceID", "in", revokedDeviceIDs)
+                    .execute();
+            }
+
+            return {
+                device: toDevice(device),
+                revokedDeviceIDs,
+            };
+        });
+    }
+
     public async rehashPassword(
         userID: string,
         newHash: string,
@@ -1228,22 +1293,7 @@ export class Database extends EventEmitter {
         deviceID: string,
         userID: string,
     ): Promise<void> {
-        const entry: MailSQL = {
-            authorID: userID,
-            cipher: XUtils.encodeHex(mail.cipher),
-            // Opaque transport metadata (X3DH initial payload or ratchet header).
-            extra: XUtils.encodeHex(mail.extra),
-            forward: mail.forward,
-            group: mail.group ? XUtils.encodeHex(mail.group) : null,
-            header: XUtils.encodeHex(header),
-            mailID: mail.mailID,
-            mailType: mail.mailType,
-            nonce: XUtils.encodeHex(mail.nonce),
-            readerID: mail.readerID,
-            recipient: mail.recipient,
-            sender: deviceID,
-            time: new Date().toISOString(),
-        };
+        const entry = this.mailSqlEntry(mail, header, deviceID, userID);
 
         await this.db
             .insertInto("mail")
@@ -1255,6 +1305,37 @@ export class Database extends EventEmitter {
             .execute();
     }
 
+    public async saveMailBatch(
+        entries: {
+            header: Uint8Array;
+            mail: MailWS;
+            senderDeviceID: string;
+            userID: string;
+        }[],
+    ): Promise<void> {
+        if (entries.length === 0) {
+            return;
+        }
+
+        const now = new Date().toISOString();
+        const values = entries.map((entry) => {
+            const mail = this.mailSqlEntry(
+                entry.mail,
+                entry.header,
+                entry.senderDeviceID,
+                entry.userID,
+                now,
+            );
+            return {
+                ...mail,
+                forward: mail.forward ? 1 : 0,
+                time: mail.time,
+            };
+        });
+
+        await this.db.insertInto("mail").values(values).execute();
+    }
+
     public async saveNotificationSubscription(
         input: SaveNotificationSubscriptionInput,
     ): Promise<NotificationSubscription> {
@@ -1327,6 +1408,31 @@ export class Database extends EventEmitter {
         }
         this.emit("ready");
     }
+
+    private mailSqlEntry(
+        mail: MailWS,
+        header: Uint8Array,
+        deviceID: string,
+        userID: string,
+        time = new Date().toISOString(),
+    ): MailSQL {
+        return {
+            authorID: userID,
+            cipher: XUtils.encodeHex(mail.cipher),
+            // Opaque transport metadata (X3DH initial payload or ratchet header).
+            extra: XUtils.encodeHex(mail.extra),
+            forward: mail.forward,
+            group: mail.group ? XUtils.encodeHex(mail.group) : null,
+            header: XUtils.encodeHex(header),
+            mailID: mail.mailID,
+            mailType: mail.mailType,
+            nonce: XUtils.encodeHex(mail.nonce),
+            readerID: mail.readerID,
+            recipient: mail.recipient,
+            sender: deviceID,
+            time,
+        };
+    }
 }
 
 /**

package/src/Spire.ts

@@ -4,7 +4,13 @@
  * Commercial licenses available at vex.wtf
  */
 
-import type { ActionToken, BaseMsg, User } from "@vex-chat/types";
+import type {
+    ActionToken,
+    BaseMsg,
+    Device,
+    MailWS,
+    User,
+} from "@vex-chat/types";
 import type { IncomingMessage, Server } from "http";
 
 import { EventEmitter } from "events";
@@ -100,6 +106,46 @@ const mailPostPayload = z.object({
     header: z.custom<Uint8Array>((val) => val instanceof Uint8Array),
     mail: MailWSSchema,
 });
+const MAIL_BATCH_MAX_ITEMS = 256;
+const mailBatchPostPayload = z.object({
+    mails: z.array(mailPostPayload).min(1).max(MAIL_BATCH_MAX_ITEMS),
+});
+
+interface MailBatchResult {
+    error?: string;
+    index: number;
+    mailID?: string;
+    ok: boolean;
+    recipient?: string;
+    status?: number;
+}
+
+interface ValidatedMailBatchEntry {
+    header: Uint8Array;
+    index: number;
+    mail: MailWS;
+    recipientDevice: Device;
+}
+
+export async function passkeySecondFactorError(
+    db: Database,
+    userID: string,
+    passkeyID: string | undefined,
+    mismatchError: string,
+): Promise<null | string> {
+    const passkeys = await db.retrievePasskeysByUser(userID);
+    if (passkeys.length === 0) {
+        return null;
+    }
+    if (!passkeyID) {
+        return "Passkey verification required.";
+    }
+    const passkey = await db.retrievePasskeyInternal(passkeyID);
+    if (!passkey || passkey.userID !== userID) {
+        return mismatchError;
+    }
+    return null;
+}
 
 const notificationSubscribePayload = z.object({
     channel: z.literal("expo"),
@@ -344,6 +390,19 @@ export class Spire extends EventEmitter {
         }
     }
 
+    private disconnectDevices(deviceIDs: string[]): void {
+        if (deviceIDs.length === 0) {
+            return;
+        }
+        const ids = new Set(deviceIDs);
+        for (const client of [...this.clients]) {
+            const deviceID = client.getDeviceID();
+            if (deviceID !== null && ids.has(deviceID)) {
+                client.disconnect();
+            }
+        }
+    }
+
     private init(apiPort: number): void {
         // Request traces (UUIDs and device public-key path segments redacted
         // in the `url` token). Enabled in all envs, including production.
@@ -381,6 +440,7 @@ export class Spire extends EventEmitter {
             this.validateToken.bind(this),
             this.signKeys,
             this.notify.bind(this),
+            this.disconnectDevices.bind(this),
         );
 
         // WS auth: client sends { type: "auth", token } as first message
@@ -748,6 +808,22 @@ export class Spire extends EventEmitter {
                         .send({ error: "Device owner not found." });
                 }
 
+                const passkeyError = await passkeySecondFactorError(
+                    this.db,
+                    user.userID,
+                    req.passkey?.passkeyID,
+                    "Passkey verification does not match this device.",
+                );
+                if (passkeyError) {
+                    const body: { error: string; username?: string } = {
+                        error: passkeyError,
+                    };
+                    if (passkeyError === "Passkey verification required.") {
+                        body.username = user.username;
+                    }
+                    return res.status(403).send(body);
+                }
+
                 // Issue short-lived JWT (1 hour, not 7 days)
                 const token = jwt.sign(
                     { user: censorUser(user) },
@@ -817,6 +893,125 @@ export class Spire extends EventEmitter {
             );
         });
 
+        this.api.post("/mail/batch", protect, async (req, res) => {
+            const senderDeviceDetails = req.device;
+            if (!senderDeviceDetails) {
+                res.sendStatus(401);
+                return;
+            }
+            const authorUserDetails = getUser(req);
+
+            const parsed = mailBatchPostPayload.safeParse(req.body);
+            if (!parsed.success) {
+                res.status(400).json({
+                    error: "Invalid mail batch payload",
+                    issues: parsed.error.issues,
+                });
+                return;
+            }
+
+            const results: MailBatchResult[] = [];
+            const validEntries: ValidatedMailBatchEntry[] = [];
+            for (const [index, item] of parsed.data.mails.entries()) {
+                const { header, mail } = item;
+                try {
+                    const { recipientDevice } = await validateMailIngress(
+                        this.db,
+                        mail,
+                        senderDeviceDetails.deviceID,
+                        authorUserDetails.userID,
+                    );
+                    validEntries.push({
+                        header,
+                        index,
+                        mail,
+                        recipientDevice,
+                    });
+                } catch (err: unknown) {
+                    const status =
+                        err instanceof MailIngressValidationError
+                            ? err.status
+                            : 500;
+                    const message =
+                        err instanceof Error ? err.message : String(err);
+                    results[index] = {
+                        error: message,
+                        index,
+                        mailID: mail.mailID,
+                        ok: false,
+                        recipient: mail.recipient,
+                        status,
+                    };
+                }
+            }
+
+            const deliveredEntries: ValidatedMailBatchEntry[] = [];
+            if (validEntries.length > 0) {
+                try {
+                    await this.db.saveMailBatch(
+                        validEntries.map((entry) => ({
+                            header: entry.header,
+                            mail: entry.mail,
+                            senderDeviceID: senderDeviceDetails.deviceID,
+                            userID: authorUserDetails.userID,
+                        })),
+                    );
+                    for (const entry of validEntries) {
+                        deliveredEntries.push(entry);
+                        results[entry.index] = {
+                            index: entry.index,
+                            mailID: entry.mail.mailID,
+                            ok: true,
+                            recipient: entry.mail.recipient,
+                        };
+                    }
+                } catch {
+                    for (const entry of validEntries) {
+                        try {
+                            await this.db.saveMail(
+                                entry.mail,
+                                entry.header,
+                                senderDeviceDetails.deviceID,
+                                authorUserDetails.userID,
+                            );
+                            deliveredEntries.push(entry);
+                            results[entry.index] = {
+                                index: entry.index,
+                                mailID: entry.mail.mailID,
+                                ok: true,
+                                recipient: entry.mail.recipient,
+                            };
+                        } catch (err: unknown) {
+                            results[entry.index] = {
+                                error:
+                                    err instanceof Error
+                                        ? err.message
+                                        : String(err),
+                                index: entry.index,
+                                mailID: entry.mail.mailID,
+                                ok: false,
+                                recipient: entry.mail.recipient,
+                                status: 500,
+                            };
+                        }
+                    }
+                }
+            }
+
+            res.send(msgpack.encode({ results }));
+            for (const entry of deliveredEntries) {
+                this.notify(
+                    entry.recipientDevice.owner,
+                    "mail",
+                    crypto.randomUUID(),
+                    null,
+                    entry.mail.recipient,
+                    entry.mail.authorID,
+                    entry.mail.nonce,
+                );
+            }
+        });
+
         this.api.post(
             "/device/:id/notifications/subscriptions",
             protect,
@@ -910,6 +1105,19 @@ export class Spire extends EventEmitter {
                     await this.db.rehashPassword(userEntry.userID, newHash);
                 }
 
+                const passkeyError = await passkeySecondFactorError(
+                    this.db,
+                    userEntry.userID,
+                    req.passkey?.passkeyID,
+                    "Passkey verification does not match this account.",
+                );
+                if (passkeyError) {
+                    res.status(403).send({
+                        error: passkeyError,
+                    });
+                    return;
+                }
+
                 const token = jwt.sign(
                     { user: censorUser(userEntry) },
                     getJwtSecret(),
@@ -1033,7 +1241,27 @@ export class Spire extends EventEmitter {
                             res.sendStatus(500);
                             return;
                         }
-                        res.send(msgpack.encode(censorUser(user)));
+                        const device = await this.db.retrieveDevice(
+                            normalizedPayload.signKey,
+                        );
+                        if (!device) {
+                            res.sendStatus(500);
+                            return;
+                        }
+                        const censored = censorUser(user);
+                        const token = jwt.sign(
+                            { user: censored },
+                            getJwtSecret(),
+                            { expiresIn: JWT_EXPIRY },
+                        );
+                        jwt.verify(token, getJwtSecret());
+                        res.send(
+                            msgpack.encode({
+                                device,
+                                token,
+                                user: censored,
+                            }),
+                        );
                     }
                 } else if (regKey && regKey.length !== 16) {
                     res.status(400).send({