@vex-chat/spire 2.3.4 → 2.5.0

package/src/ClientManager.ts

@@ -4,6 +4,7 @@
  * Commercial licenses available at vex.wtf
  */
 
+import type { CallManager } from "./CallManager.ts";
 import type { Database } from "./Database.ts";
 import type {
     BaseMsg,
@@ -27,6 +28,7 @@ import { MailWSSchema, SocketAuthErrors } from "@vex-chat/types";
 
 import { parse as uuidParse, validate as uuidValidate } from "uuid";
 
+import { callWakeDispatchData } from "./server/callWake.ts";
 import { validateMailIngress } from "./server/mailIngress.ts";
 import { TOKEN_EXPIRY } from "./Spire.ts";
 import { createUint8UUID } from "./utils/createUint8UUID.ts";
@@ -44,7 +46,9 @@ function emptyHeader() {
     return new Uint8Array(32);
 }
 
-const MAX_MSG_SIZE = 2048;
+// WebRTC SDP offers/answers are commonly several KB before encryption/packing.
+// Keep this well below HTTP body limits while allowing first-party call signals.
+const MAX_MSG_SIZE = 64 * 1024;
 
 // How many ping cycles in a row are allowed to go without a pong
 // before we declare the connection dead. With a 5s ping interval
@@ -68,6 +72,7 @@ const PING_INTERVAL_MS = 5000;
 export class ClientManager extends EventEmitter {
     private alive: boolean = true;
     private authed: boolean = false;
+    private callManager: CallManager;
     private challengeID: Uint8Array = createUint8UUID();
     private conn: WebSocket;
     private db: Database;
@@ -89,6 +94,7 @@ export class ClientManager extends EventEmitter {
     constructor(
         ws: WebSocket,
         db: Database,
+        callManager: CallManager,
         notify: (
             userID: string,
             event: string,
@@ -103,6 +109,7 @@ export class ClientManager extends EventEmitter {
         super();
         this.conn = ws;
         this.db = db;
+        this.callManager = callManager;
         this.user = null;
         this.userDetails = userDetails;
         this.device = null;
@@ -280,6 +287,25 @@ export class ClientManager extends EventEmitter {
 
     private async parseResourceMsg(msg: ResourceMsg, header: Uint8Array) {
         switch (msg.resourceType) {
+            case "call":
+                try {
+                    const event = await this.callManager.handleResource({
+                        action: msg.action,
+                        actor: {
+                            device: this.getDevice(),
+                            user: this.getUser(),
+                        },
+                        data: msg.data,
+                        transmissionID: msg.transmissionID,
+                    });
+                    this.sendSuccess(msg.transmissionID, event);
+                } catch (err: unknown) {
+                    this.sendErr(
+                        msg.transmissionID,
+                        err instanceof Error ? err.message : String(err),
+                    );
+                }
+                break;
             case "mail":
                 if (msg.action === "CREATE") {
                     const mailResult = MailWSSchema.safeParse(msg.data);
@@ -308,15 +334,28 @@ export class ClientManager extends EventEmitter {
                         );
 
                         this.sendSuccess(msg.transmissionID, null);
-                        this.notify(
-                            recipientDevice.owner,
-                            "mail",
-                            msg.transmissionID,
-                            null,
-                            mail.recipient,
-                            mail.authorID,
-                            mail.nonce,
-                        );
+                        const callWake = callWakeDispatchData(mail);
+                        if (callWake) {
+                            this.notify(
+                                recipientDevice.owner,
+                                "callWake",
+                                msg.transmissionID,
+                                callWake,
+                                mail.recipient,
+                                undefined,
+                                mail.nonce,
+                            );
+                        } else {
+                            this.notify(
+                                recipientDevice.owner,
+                                "mail",
+                                msg.transmissionID,
+                                null,
+                                mail.recipient,
+                                mail.authorID,
+                                mail.nonce,
+                            );
+                        }
                     } catch (err: unknown) {
                         this.sendErr(msg.transmissionID, String(err));
                     }

package/src/Database.ts

@@ -130,8 +130,10 @@ export interface InternalUserRecord extends UserRecord {
     hashAlgo: string;
 }
 
+export type NotificationChannel = "apnsVoip" | "expo" | "fcmCall";
+
 export interface NotificationSubscription {
-    channel: "expo";
+    channel: NotificationChannel;
     createdAt: string;
     deviceID: string;
     enabled: boolean;
@@ -144,7 +146,7 @@ export interface NotificationSubscription {
 }
 
 export interface SaveNotificationSubscriptionInput {
-    channel: "expo";
+    channel: NotificationChannel;
     deviceID: string;
     events: string[];
     platform?: null | string;
@@ -1627,6 +1629,13 @@ function normalizeRegistrationUsername(
     return `key_${seed}`;
 }
 
+function parseNotificationChannel(channel: string): NotificationChannel {
+    if (channel === "apnsVoip" || channel === "expo" || channel === "fcmCall") {
+        return channel;
+    }
+    return "expo";
+}
+
 function toDevice(row: {
     deleted: number;
     deviceID: string;
@@ -1676,7 +1685,7 @@ function toNotificationSubscription(row: {
 }): NotificationSubscription {
     return {
         ...row,
-        channel: "expo",
+        channel: parseNotificationChannel(row.channel),
         enabled: Boolean(row.enabled),
         events: decodeNotificationEvents(row.events),
     };

package/src/IceServers.ts

@@ -0,0 +1,185 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { IceServerConfig } from "@vex-chat/types";
+
+import { IceServerConfigSchema } from "@vex-chat/types";
+
+import { z } from "zod/v4";
+
+const CLOUDFLARE_TURN_ENDPOINT = "https://rtc.live.cloudflare.com/v1/turn/keys";
+const DEFAULT_CLOUDFLARE_TURN_TIMEOUT_MS = 5_000;
+const DEFAULT_CLOUDFLARE_TURN_TTL_SECONDS = 86_400;
+
+const cloudflareIceServersResponseSchema = z.object({
+    iceServers: z.array(IceServerConfigSchema),
+});
+
+export async function resolveIceServersFromEnv(): Promise<IceServerConfig[]> {
+    const jsonOverride = readJsonIceServersFromEnv();
+    if (jsonOverride) {
+        return jsonOverride;
+    }
+
+    const staticServers = readStaticIceServersFromEnv();
+    const cloudflareServers = await readCloudflareIceServersFromEnv();
+    return [...staticServers, ...cloudflareServers];
+}
+
+async function readCloudflareIceServersFromEnv(): Promise<IceServerConfig[]> {
+    const keyID = readEnv([
+        "SPIRE_CLOUDFLARE_TURN_KEY_ID",
+        "CLOUDFLARE_TURN_KEY_ID",
+        "TURN_KEY_ID",
+    ]);
+    const apiToken = readEnv([
+        "SPIRE_CLOUDFLARE_TURN_API_TOKEN",
+        "CLOUDFLARE_TURN_API_TOKEN",
+        "TURN_KEY_API_TOKEN",
+    ]);
+    const endpointOverride = readEnv(["SPIRE_CLOUDFLARE_TURN_ENDPOINT"]);
+    if (!keyID && !apiToken && !endpointOverride) {
+        return [];
+    }
+
+    if (!apiToken || (!keyID && !endpointOverride)) {
+        console.warn(
+            "[spire-calls] Cloudflare TURN is partially configured; set SPIRE_CLOUDFLARE_TURN_KEY_ID and SPIRE_CLOUDFLARE_TURN_API_TOKEN",
+        );
+        return [];
+    }
+
+    let endpoint = endpointOverride;
+    if (!endpoint) {
+        if (!keyID) {
+            console.warn(
+                "[spire-calls] Cloudflare TURN is partially configured; set SPIRE_CLOUDFLARE_TURN_KEY_ID and SPIRE_CLOUDFLARE_TURN_API_TOKEN",
+            );
+            return [];
+        }
+        endpoint = `${CLOUDFLARE_TURN_ENDPOINT}/${encodeURIComponent(keyID)}/credentials/generate-ice-servers`;
+    }
+    const ttl = readPositiveIntegerEnv(
+        "SPIRE_CLOUDFLARE_TURN_TTL_SECONDS",
+        DEFAULT_CLOUDFLARE_TURN_TTL_SECONDS,
+    );
+    const timeoutMs = readPositiveIntegerEnv(
+        "SPIRE_CLOUDFLARE_TURN_TIMEOUT_MS",
+        DEFAULT_CLOUDFLARE_TURN_TIMEOUT_MS,
+    );
+
+    const controller = new AbortController();
+    const timeout = setTimeout(() => {
+        controller.abort();
+    }, timeoutMs);
+
+    try {
+        const response = await fetch(endpoint, {
+            body: JSON.stringify({ ttl }),
+            headers: {
+                Authorization: `Bearer ${apiToken}`,
+                "Content-Type": "application/json",
+            },
+            method: "POST",
+            signal: controller.signal,
+        });
+
+        if (!response.ok) {
+            throw new Error(
+                `Cloudflare TURN credential request failed with ${response.status}`,
+            );
+        }
+
+        const payload = await response.json();
+        return cloudflareIceServersResponseSchema.parse(payload).iceServers;
+    } catch (err: unknown) {
+        console.warn(
+            "[spire-calls] failed to fetch Cloudflare TURN credentials",
+            err instanceof Error ? err.message : String(err),
+        );
+        return [];
+    } finally {
+        clearTimeout(timeout);
+    }
+}
+
+function readEnv(names: string[]): string | undefined {
+    for (const name of names) {
+        const value = process.env[name]?.trim();
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+
+function readJsonIceServersFromEnv(): IceServerConfig[] | null {
+    const json = process.env["SPIRE_ICE_SERVERS"]?.trim();
+    if (!json) {
+        return null;
+    }
+
+    try {
+        const parsed = JSON.parse(json) as unknown;
+        return z.array(IceServerConfigSchema).parse(parsed);
+    } catch (err: unknown) {
+        console.warn(
+            "[spire-calls] ignoring invalid SPIRE_ICE_SERVERS",
+            err instanceof Error ? err.message : String(err),
+        );
+        return null;
+    }
+}
+
+function readPositiveIntegerEnv(name: string, fallback: number): number {
+    const raw = process.env[name]?.trim();
+    if (!raw) {
+        return fallback;
+    }
+
+    const parsed = Number.parseInt(raw, 10);
+    if (Number.isInteger(parsed) && parsed > 0) {
+        return parsed;
+    }
+
+    console.warn(
+        `[spire-calls] ignoring invalid ${name}; expected a positive integer`,
+    );
+    return fallback;
+}
+
+function readStaticIceServersFromEnv(): IceServerConfig[] {
+    const servers: IceServerConfig[] = [];
+    for (const url of splitCsvEnv("SPIRE_STUN_URLS")) {
+        servers.push({ urls: url });
+    }
+
+    const turnUrls = splitCsvEnv("SPIRE_TURN_URLS");
+    if (turnUrls.length > 0) {
+        const username = process.env["SPIRE_TURN_USERNAME"]?.trim();
+        const credential = process.env["SPIRE_TURN_CREDENTIAL"]?.trim();
+        const [firstTurnUrl] = turnUrls;
+        if (!firstTurnUrl) {
+            return servers;
+        }
+        const urls: string | string[] =
+            turnUrls.length === 1 ? firstTurnUrl : turnUrls;
+        servers.push({
+            ...(credential ? { credential } : {}),
+            urls,
+            ...(username ? { username } : {}),
+        });
+    }
+
+    return servers;
+}
+
+function splitCsvEnv(name: string): string[] {
+    return (process.env[name] ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+}