@vex-chat/spire 2.5.0 → 3.0.0

package/src/Spire.ts

@@ -48,7 +48,6 @@ import { ClientManager } from "./ClientManager.ts";
 import { Database, hashPasswordArgon2, verifyPassword } from "./Database.ts";
 import { resolveIceServersFromEnv } from "./IceServers.ts";
 import { NotificationService } from "./NotificationService.ts";
-import { callWakeDispatchData } from "./server/callWake.ts";
 import { initApp, protect } from "./server/index.ts";
 import {
     MailIngressValidationError,
@@ -134,8 +133,8 @@ interface ValidatedMailBatchEntry {
 }
 
 const notificationSubscribePayload = z.object({
-    channel: z.enum(["apnsVoip", "expo", "fcmCall"]),
-    events: z.array(z.string().min(1)).optional(),
+    channel: z.literal("expo"),
+    events: z.array(z.string().min(1)).default(["mail"]),
     platform: z.enum(["android", "ios", "web"]).optional(),
     token: z.string().min(1),
 });
@@ -872,28 +871,15 @@ export class Spire extends EventEmitter {
             );
 
             res.sendStatus(200);
-            const callWake = callWakeDispatchData(mail);
-            if (callWake) {
-                this.notify(
-                    recipientDeviceDetails.owner,
-                    "callWake",
-                    crypto.randomUUID(),
-                    callWake,
-                    mail.recipient,
-                    undefined,
-                    mail.nonce,
-                );
-            } else {
-                this.notify(
-                    recipientDeviceDetails.owner,
-                    "mail",
-                    crypto.randomUUID(),
-                    null,
-                    mail.recipient,
-                    mail.authorID,
-                    mail.nonce,
-                );
-            }
+            this.notify(
+                recipientDeviceDetails.owner,
+                "mail",
+                crypto.randomUUID(),
+                null,
+                mail.recipient,
+                mail.authorID,
+                mail.nonce,
+            );
         });
 
         this.api.post("/mail/batch", protect, async (req, res) => {
@@ -1003,28 +989,15 @@ export class Spire extends EventEmitter {
 
             res.send(msgpack.encode({ results }));
             for (const entry of deliveredEntries) {
-                const callWake = callWakeDispatchData(entry.mail);
-                if (callWake) {
-                    this.notify(
-                        entry.recipientDevice.owner,
-                        "callWake",
-                        crypto.randomUUID(),
-                        callWake,
-                        entry.mail.recipient,
-                        undefined,
-                        entry.mail.nonce,
-                    );
-                } else {
-                    this.notify(
-                        entry.recipientDevice.owner,
-                        "mail",
-                        crypto.randomUUID(),
-                        null,
-                        entry.mail.recipient,
-                        entry.mail.authorID,
-                        entry.mail.nonce,
-                    );
-                }
+                this.notify(
+                    entry.recipientDevice.owner,
+                    "mail",
+                    crypto.randomUUID(),
+                    null,
+                    entry.mail.recipient,
+                    entry.mail.authorID,
+                    entry.mail.nonce,
+                );
             }
         });
 
@@ -1070,11 +1043,7 @@ export class Spire extends EventEmitter {
                     {
                         channel: parsed.data.channel,
                         deviceID: device.deviceID,
-                        events:
-                            parsed.data.events ??
-                            (parsed.data.channel === "expo"
-                                ? ["mail"]
-                                : ["callWake"]),
+                        events: parsed.data.events,
                         platform: parsed.data.platform ?? null,
                         token: parsed.data.token,
                         userID: getUser(req).userID,
@@ -1212,6 +1181,59 @@ export class Spire extends EventEmitter {
                         TokenScopes.Register,
                     )
                 ) {
+                    const existingUser = await this.db.retrieveUser(
+                        normalizedPayload.username,
+                    );
+                    if (existingUser) {
+                        const existingBySignKey = await this.db.retrieveDevice(
+                            normalizedPayload.signKey,
+                        );
+                        if (existingBySignKey) {
+                            res.status(400).send({
+                                error: "Public key is already registered.",
+                            });
+                            return;
+                        }
+                        let requesterPasskeyID: string | undefined;
+                        if (req.passkey?.passkeyID) {
+                            const passkeyError = await passkeySecondFactorError(
+                                this.db,
+                                existingUser.userID,
+                                req.passkey.passkeyID,
+                                "Passkey verification does not match this account.",
+                            );
+                            if (passkeyError) {
+                                res.status(403).send({
+                                    error: passkeyError,
+                                });
+                                return;
+                            }
+                            requesterPasskeyID = req.passkey.passkeyID;
+                        }
+                        const pendingResponse =
+                            createPendingDeviceEnrollmentRequest(
+                                existingUser.userID,
+                                normalizedPayload,
+                                this.notify.bind(this),
+                                {
+                                    deferOwnerNotification: true,
+                                    ...(requesterPasskeyID
+                                        ? { requesterPasskeyID }
+                                        : {}),
+                                },
+                            );
+                        res.status(202).send(msgpack.encode(pendingResponse));
+                        return;
+                    }
+                    if (
+                        typeof normalizedPayload.password !== "string" ||
+                        normalizedPayload.password.trim().length === 0
+                    ) {
+                        res.status(400).send({
+                            error: "Password is required to register a new account.",
+                        });
+                        return;
+                    }
                     const [user, err] = await this.db.createUser(
                         regKey,
                         normalizedPayload,
@@ -1233,57 +1255,9 @@ export class Spire extends EventEmitter {
                             errCode === "SQLITE_CONSTRAINT_UNIQUE" ||
                             errText.includes("UNIQUE constraint failed");
                         if (isUniqueConstraint && usernameConflict) {
-                            const existingUser = await this.db.retrieveUser(
-                                normalizedPayload.username,
-                            );
-                            if (!existingUser) {
-                                res.status(400).send({
-                                    error: "Username is already registered.",
-                                });
-                                return;
-                            }
-                            const existingBySignKey =
-                                await this.db.retrieveDevice(
-                                    normalizedPayload.signKey,
-                                );
-                            if (existingBySignKey) {
-                                res.status(400).send({
-                                    error: "Public key is already registered.",
-                                });
-                                return;
-                            }
-                            let requesterPasskeyID: string | undefined;
-                            if (req.passkey?.passkeyID) {
-                                const passkeyError =
-                                    await passkeySecondFactorError(
-                                        this.db,
-                                        existingUser.userID,
-                                        req.passkey.passkeyID,
-                                        "Passkey verification does not match this account.",
-                                    );
-                                if (passkeyError) {
-                                    res.status(403).send({
-                                        error: passkeyError,
-                                    });
-                                    return;
-                                }
-                                requesterPasskeyID = req.passkey.passkeyID;
-                            }
-                            const pendingResponse =
-                                createPendingDeviceEnrollmentRequest(
-                                    existingUser.userID,
-                                    normalizedPayload,
-                                    this.notify.bind(this),
-                                    {
-                                        deferOwnerNotification: true,
-                                        ...(requesterPasskeyID
-                                            ? { requesterPasskeyID }
-                                            : {}),
-                                    },
-                                );
-                            res.status(202).send(
-                                msgpack.encode(pendingResponse),
-                            );
+                            res.status(400).send({
+                                error: "Username is already registered.",
+                            });
                             return;
                         }
                         if (isUniqueConstraint && signKeyConflict) {

package/src/__tests__/Database.spec.ts

@@ -81,6 +81,36 @@ describe("Database", () => {
         dbType: "sqlite3mem",
     };
 
+    describe("createUser", () => {
+        it("requires a password for new accounts", async () => {
+            expect.assertions(3);
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            const [user, err] = await provider.createUser(
+                                new Uint8Array(16),
+                                devicePayload("desktop", "b".repeat(64)),
+                            );
+                            expect(user).toBeNull();
+                            expect(err).toBeInstanceOf(Error);
+                            expect(err?.message).toBe(
+                                "Password is required to register a new account.",
+                            );
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
+    });
+
     describe("saveOTK", () => {
         it("takes a userId and one time key, adds a keyId and saves it to oneTimeKey table", async () => {
             expect.assertions(1);
@@ -298,23 +328,26 @@ describe("Database", () => {
                                 sender: "sender-a",
                                 time,
                             });
+                            const baseTimeMs = Date.now() - 60_000;
+                            const isoTime = (offsetMs: number) =>
+                                new Date(baseTimeMs + offsetMs).toISOString();
 
                             await provider["db"]
                                 .insertInto("mail")
                                 .values([
                                     mail(
                                         "00000000-0000-0000-0000-000000000003",
-                                        "2026-05-07T12:00:02.000Z",
+                                        isoTime(2_000),
                                         "06",
                                     ),
                                     mail(
                                         "00000000-0000-0000-0000-000000000001",
-                                        "2026-05-07T12:00:00.000Z",
+                                        isoTime(0),
                                         "04",
                                     ),
                                     mail(
                                         "00000000-0000-0000-0000-000000000002",
-                                        "2026-05-07T12:00:01.000Z",
+                                        isoTime(1_000),
                                         "05",
                                     ),
                                 ])

package/src/__tests__/billing.spec.ts

@@ -0,0 +1,282 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { SpireOptions } from "../Spire.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import {
+    devBillingGrantRoutesEnabled,
+    getBillingRouter,
+} from "../server/billing.ts";
+
+const options: SpireOptions = {
+    dbType: "sqlite3mem",
+};
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const servers: Array<{ close: () => void }> = [];
+const originalEnv = { ...process.env };
+
+afterEach(() => {
+    for (const server of servers.splice(0)) {
+        server.close();
+    }
+    process.env = { ...originalEnv };
+});
+
+describe("Database store subscriptions", () => {
+    it("derives store entitlements from active subscriptions", async () => {
+        expect.assertions(4);
+        await withDb(async (db) => {
+            await db.upsertStoreSubscription({
+                environment: "sandbox",
+                expiresAt: new Date(Date.now() + 86_400_000).toISOString(),
+                externalOriginalID: "orig-1",
+                externalTransactionID: "tx-1",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                rawPayload: { transactionId: "tx-1" },
+                status: "active",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+                userID,
+            });
+
+            const entitlements = await db.recalculateStoreEntitlements(userID);
+            const state = await db.retrieveBillingAccountState(userID);
+
+            expect(entitlements.tier).toBe("plus");
+            expect(entitlements.source).toBe("store");
+            expect(state.subscriptions).toHaveLength(1);
+            expect(state.subscriptions[0]).toMatchObject({
+                platform: "apple_app_store",
+                status: "active",
+                tier: "plus",
+            });
+        });
+    });
+
+    it("downgrades expired store entitlements to free", async () => {
+        expect.assertions(2);
+        await withDb(async (db) => {
+            await db.setAccountEntitlementTier(userID, "pro", {
+                expiresAt: new Date(Date.now() - 1_000).toISOString(),
+                source: "store",
+            });
+            await db.upsertStoreSubscription({
+                environment: "sandbox",
+                expiresAt: new Date(Date.now() - 1_000).toISOString(),
+                externalOriginalID: "orig-2",
+                externalTransactionID: "tx-2",
+                platform: "apple_app_store",
+                productID: "apple_pro_monthly",
+                rawPayload: { transactionId: "tx-2" },
+                status: "expired",
+                storeProductID: "chat.vex.pro.monthly",
+                tier: "pro",
+                userID,
+            });
+
+            const entitlements = await db.recalculateStoreEntitlements(userID);
+
+            expect(entitlements.tier).toBe("free");
+            expect(entitlements.source).toBe("store");
+        });
+    });
+});
+
+describe("billing route guard", () => {
+    it("requires explicit non-production grant opt-in", () => {
+        expect(devBillingGrantRoutesEnabled({})).toBe(false);
+        expect(
+            devBillingGrantRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "production",
+                VEX_ENABLE_DEV_BILLING_GRANTS: "1",
+            }),
+        ).toBe(false);
+        expect(
+            devBillingGrantRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_BILLING_GRANTS: "1",
+            }),
+        ).toBe(true);
+    });
+});
+
+describe("billing routes", () => {
+    it("returns configured billing products", async () => {
+        process.env["VEX_BILLING_PRODUCTS_JSON"] = JSON.stringify([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+        const { baseUrl } = mountBillingRouter({} as Database);
+
+        const res = await fetch(`${baseUrl}/billing/products?format=json`);
+        const body = (await res.json()) as unknown[];
+
+        expect(res.status).toBe(200);
+        expect(body).toEqual([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+    });
+
+    it("verifies a local Apple transaction payload and refreshes entitlements", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["VEX_BILLING_ALLOW_LOCAL_STORE_PAYLOADS"] = "1";
+        process.env["VEX_BILLING_PRODUCTS_JSON"] = JSON.stringify([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+
+        await withDb(async (db) => {
+            const notify = vi.fn();
+            const { baseUrl } = mountBillingRouter(db, notify);
+            const res = await fetch(
+                `${baseUrl}/billing/apple/transactions?format=json`,
+                {
+                    body: JSON.stringify({
+                        environment: "sandbox",
+                        signedTransactionInfo: encodedPayload({
+                            environment: "Sandbox",
+                            expiresDate: Date.now() + 86_400_000,
+                            originalTransactionId: "orig-apple-1",
+                            productId: "chat.vex.plus.monthly",
+                            transactionId: "tx-apple-1",
+                        }),
+                    }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            const body = (await res.json()) as {
+                entitlements?: { tier?: unknown };
+                subscriptions?: unknown[];
+            };
+
+            expect(res.status).toBe(200);
+            expect(body.entitlements?.tier).toBe("plus");
+            expect(body.subscriptions).toHaveLength(1);
+            expect(notify).toHaveBeenCalledWith(
+                userID,
+                "accountEntitlementsChanged",
+                expect.any(String),
+                { tier: "plus" },
+            );
+        });
+    });
+
+    it("allows explicit dev billing grants with the dev key", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["DEV_API_KEY"] = "local-secret";
+        process.env["VEX_ENABLE_DEV_BILLING_GRANTS"] = "1";
+        await withDb(async (db) => {
+            const notify = vi.fn();
+            const { baseUrl } = mountBillingRouter(db, notify);
+
+            const res = await fetch(
+                `${baseUrl}/__dev/billing/grants?format=json`,
+                {
+                    body: JSON.stringify({ tier: "pro", userID }),
+                    headers: {
+                        "Content-Type": "application/json",
+                        "x-dev-api-key": "local-secret",
+                    },
+                    method: "POST",
+                },
+            );
+            const body = (await res.json()) as {
+                source?: unknown;
+                tier?: unknown;
+            };
+
+            expect(res.status).toBe(200);
+            expect(body).toMatchObject({ source: "store", tier: "pro" });
+            expect(notify).toHaveBeenCalledWith(
+                userID,
+                "accountEntitlementsChanged",
+                expect.any(String),
+                { tier: "pro" },
+            );
+        });
+    });
+});
+
+function encodedPayload(payload: unknown): string {
+    return Buffer.from(JSON.stringify(payload))
+        .toString("base64")
+        .replace(/=/g, "")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_");
+}
+
+function mountBillingRouter(
+    db: Database,
+    notify = vi.fn(),
+): { baseUrl: string } {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        (
+            req as express.Request & {
+                user?: { lastSeen: string; userID: string; username: string };
+            }
+        ).user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        next();
+    });
+    app.use(getBillingRouter(db, notify));
+
+    const server = app.listen(0);
+    servers.push(server);
+    const { port } = server.address() as AddressInfo;
+    return { baseUrl: `http://127.0.0.1:${String(port)}` };
+}
+
+async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
+    const provider = new Database(options);
+    return new Promise<T>((resolve, reject) => {
+        provider.once("ready", () => {
+            void (async () => {
+                try {
+                    const result = await fn(provider);
+                    await provider.close();
+                    resolve(result);
+                } catch (e: unknown) {
+                    await provider.close().catch(() => {
+                        // best-effort cleanup; ignore close failures here
+                    });
+                    reject(e instanceof Error ? e : new Error(String(e)));
+                }
+            })();
+        });
+    });
+}