@vex-chat/spire 2.0.1 → 2.1.0

package/src/db/schema.ts

@@ -18,6 +18,16 @@ export interface ChannelsTable {
 
 export type ChannelUpdate = Updateable<ChannelsTable>;
 
+export type DevicePasskeyApprovalRow = Selectable<DevicePasskeyApprovalsTable>;
+
+export interface DevicePasskeyApprovalsTable {
+    approvedAt: string;
+    approvedByDeviceID: null | string;
+    approvedByPasskeyID: string;
+    deviceID: string;
+    userID: string;
+}
+
 export type DeviceRow = Selectable<DevicesTable>;
 
 export interface DevicesTable {
@@ -85,6 +95,7 @@ export type MailUpdate = Updateable<MailTable>;
 export type NewChannel = Insertable<ChannelsTable>;
 
 export type NewDevice = Insertable<DevicesTable>;
+export type NewDevicePasskeyApproval = Insertable<DevicePasskeyApprovalsTable>;
 export type NewEmoji = Insertable<EmojisTable>;
 export type NewFile = Insertable<FilesTable>;
 
@@ -167,6 +178,7 @@ export interface PreKeysTable {
 export type PreKeyUpdate = Updateable<PreKeysTable>;
 export interface ServerDatabase {
     channels: ChannelsTable;
+    device_passkey_approvals: DevicePasskeyApprovalsTable;
     devices: DevicesTable;
     emojis: EmojisTable;
     files: FilesTable;

package/src/migrations/2026-05-25_device-passkey-approvals.ts

@@ -0,0 +1,30 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Kysely } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropTable("device_passkey_approvals").ifExists().execute();
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .createTable("device_passkey_approvals")
+        .ifNotExists()
+        .addColumn("deviceID", "varchar(255)", (cb) => cb.primaryKey())
+        .addColumn("userID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("approvedByPasskeyID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("approvedByDeviceID", "varchar(255)")
+        .addColumn("approvedAt", "text", (cb) => cb.notNull())
+        .execute();
+
+    await db.schema
+        .createIndex("device_passkey_approvals_user_idx")
+        .ifNotExists()
+        .on("device_passkey_approvals")
+        .columns(["userID", "deviceID"])
+        .execute();
+}

package/src/server/passkeyDevices.ts

@@ -106,12 +106,18 @@ export const getPasskeyDeviceRouter = (
                 res.sendStatus(401);
                 return;
             }
+            const passkeyID = req.passkey?.passkeyID;
+            if (!passkeyID) {
+                res.sendStatus(401);
+                return;
+            }
             // Recovery is intentionally the only passkey-backed
             // provisioning path: it provisions the pending device and
             // revokes every previously-active device for the account in
             // one server-side operation. Clients cannot accidentally
             // restore an account while leaving lost devices trusted.
             const result = await recoverDeviceEnrollmentRequest({
+                approvedByPasskeyID: passkeyID,
                 db,
                 notify,
                 requestID,

package/src/server/passkeySecondFactor.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+
+export async function passkeySecondFactorError(
+    db: Database,
+    userID: string,
+    passkeyID: string | undefined,
+    mismatchError: string,
+    options?: { trustedDeviceID?: string },
+): Promise<null | string> {
+    if (
+        options?.trustedDeviceID &&
+        (await db.isDevicePasskeyApproved(userID, options.trustedDeviceID))
+    ) {
+        return null;
+    }
+
+    const passkeys = await db.retrievePasskeysByUser(userID);
+    if (passkeys.length === 0) {
+        return null;
+    }
+    if (!passkeyID) {
+        return "Passkey verification required.";
+    }
+    const passkey = await db.retrievePasskeyInternal(passkeyID);
+    if (!passkey || passkey.userID !== userID) {
+        return mismatchError;
+    }
+    return null;
+}

package/src/server/user.ts

@@ -19,6 +19,7 @@ import { z } from "zod/v4";
 import { msgpack } from "../utils/msgpack.ts";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.ts";
 
+import { passkeySecondFactorError } from "./passkeySecondFactor.ts";
 import { censorUser, getParam, getUser } from "./utils.ts";
 
 import { protect } from "./index.ts";
@@ -127,6 +128,7 @@ export function createPendingDeviceEnrollmentRequest(
  * approving device's signature before invoking this helper.
  */
 export async function recoverDeviceEnrollmentRequest(args: {
+    approvedByPasskeyID?: string;
     db: Database;
     notify: (
         userID: string,
@@ -165,6 +167,9 @@ export async function recoverDeviceEnrollmentRequest(args: {
         const { device, revokedDeviceIDs } = await args.db.recoverDevice(
             args.userID,
             pending.devicePayload,
+            args.approvedByPasskeyID
+                ? { approvedByPasskeyID: args.approvedByPasskeyID }
+                : undefined,
         );
         pending.status = "approved";
         pending.approvedDeviceID = device.deviceID;
@@ -710,6 +715,17 @@ export const getUserRouter = (
                 return;
             }
 
+            const passkeyError = await passkeySecondFactorError(
+                db,
+                userID,
+                req.passkey?.passkeyID,
+                "Passkey verification does not match this account.",
+            );
+            if (passkeyError) {
+                res.status(403).send({ error: passkeyError });
+                return;
+            }
+
             const opened = await spireXSignOpenAsync(
                 XUtils.decodeHex(parsedApprove.data.signed),
                 XUtils.decodeHex(approverDevice.signKey),
@@ -732,6 +748,12 @@ export const getUserRouter = (
                 const device = await db.createDevice(
                     userID,
                     pending.devicePayload,
+                    req.passkey
+                        ? {
+                              approvedByDeviceID: approverDevice.deviceID,
+                              approvedByPasskeyID: req.passkey.passkeyID,
+                          }
+                        : undefined,
                 );
                 pending.status = "approved";
                 pending.approvedDeviceID = device.deviceID;

package/src/types/express.ts

@@ -25,7 +25,7 @@ declare global {
              * Set by `checkPasskey` middleware when the bearer token is
              * a passkey-scoped JWT. The presence of `req.passkey`
              * (without `req.device`) marks an admin-only request that
-             * may list/delete devices and approve enrollments, but
+             * may list/delete devices and recover/reject enrollments, but
              * cannot send mail or do anything device-specific.
              */
             passkey?: { passkeyID: string };